xmrig | f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c

Analysis

max time kernel
133s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
Size

1.8MB
MD5

6047e9b3aa7a87ea33040f310eef802e
SHA1

aab21b6da61c011ff3f0da5f5dfcb829516775d4
SHA256

f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c
SHA512

46b13012ffffb774d8fbaaa8b9fd7debdf01007c9110d5ec826553794842b12d6140543ce62b22e18b002290ca91017c5445ede3831cd3bd128bbc0509112804
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQmnVwYDLyHZ:GemTLkNdfE0pZyI

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023b0d-4.dat	xmrig
behavioral2/files/0x000a000000023b73-8.dat	xmrig
behavioral2/files/0x000a000000023b74-20.dat	xmrig
behavioral2/files/0x000a000000023b75-23.dat	xmrig
behavioral2/files/0x000a000000023b76-29.dat	xmrig
behavioral2/files/0x000a000000023b77-35.dat	xmrig
behavioral2/files/0x000a000000023b7a-49.dat	xmrig
behavioral2/files/0x000a000000023b7d-65.dat	xmrig
behavioral2/files/0x000a000000023b86-113.dat	xmrig
behavioral2/files/0x000a000000023b8a-133.dat	xmrig
behavioral2/files/0x000a000000023b91-162.dat	xmrig
behavioral2/files/0x000a000000023b8f-158.dat	xmrig
behavioral2/files/0x000a000000023b90-157.dat	xmrig
behavioral2/files/0x000a000000023b8e-153.dat	xmrig
behavioral2/files/0x000a000000023b8d-148.dat	xmrig
behavioral2/files/0x000a000000023b8c-143.dat	xmrig
behavioral2/files/0x000a000000023b8b-137.dat	xmrig
behavioral2/files/0x000a000000023b89-127.dat	xmrig
behavioral2/files/0x000a000000023b88-123.dat	xmrig
behavioral2/files/0x000a000000023b87-117.dat	xmrig
behavioral2/files/0x000a000000023b85-107.dat	xmrig
behavioral2/files/0x000a000000023b84-103.dat	xmrig
behavioral2/files/0x000a000000023b83-98.dat	xmrig
behavioral2/files/0x000a000000023b82-93.dat	xmrig
behavioral2/files/0x000a000000023b81-88.dat	xmrig
behavioral2/files/0x000a000000023b80-83.dat	xmrig
behavioral2/files/0x000a000000023b7f-77.dat	xmrig
behavioral2/files/0x000a000000023b7e-73.dat	xmrig
behavioral2/files/0x000a000000023b7c-62.dat	xmrig
behavioral2/files/0x000a000000023b7b-58.dat	xmrig
behavioral2/files/0x000a000000023b79-47.dat	xmrig
behavioral2/files/0x000a000000023b78-40.dat	xmrig
behavioral2/files/0x000b000000023b6f-10.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3968	IwnSVXU.exe
4016	ZbsNGMS.exe
4808	YgKzsmU.exe
556	xKttfFS.exe
2128	YmZqIco.exe
3628	LZzoFOH.exe
3516	zYRMPPv.exe
3992	BzbtdkX.exe
2140	klZVlwV.exe
2204	VwyDijg.exe
3028	mLCMYGR.exe
2020	SlpMYeK.exe
2264	cIxEowi.exe
4032	KkVbfNa.exe
1480	PYpqgly.exe
4012	PsxHrVx.exe
3624	ffzBDjL.exe
1140	MVdAwKm.exe
4828	DQAfugy.exe
3712	czsdXrh.exe
1696	UEqAJUZ.exe
4652	BxgsEcv.exe
4752	MglhhSL.exe
2352	odYiiSH.exe
1364	xscsnpT.exe
2104	vHWZxVg.exe
3228	Dlbwbzz.exe
4588	NoRqimd.exe
5000	GbOcoIZ.exe
2260	DNWaTNl.exe
2076	TSkzqTo.exe
1868	IEBIpRz.exe
2580	CVybxDv.exe
2192	YqHykoB.exe
432	MLRpMsS.exe
4932	MmFbGsw.exe
3580	loXMpJw.exe
3632	CUlnudn.exe
4004	lbEJmyZ.exe
4316	cjQVqXN.exe
5044	TBQHUxY.exe
4080	RpEpadv.exe
4692	aikiyBV.exe
3576	uZhhOgb.exe
2640	SBRnKBw.exe
2900	EvMYfmZ.exe
720	sfnVAXO.exe
4344	GBZMfFI.exe
380	SYmJjNQ.exe
4532	kCxQabH.exe
4572	NKKBKLL.exe
3004	aEqNcda.exe
448	BNeryfb.exe
832	ZZHJKgp.exe
4504	gxqbtuI.exe
3636	jovoXBx.exe
1464	YQnlYpz.exe
3980	XixyIdk.exe
4956	OmNxQuJ.exe
2448	xBNHQqp.exe
1892	FGfeJCV.exe
4736	EfhfUPC.exe
4668	BlTVWQW.exe
1756	DIPpZnA.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ahrpVal.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\BGrfNAD.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\blroPXM.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\gaGsPdj.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\EvMYfmZ.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\xoAyFpi.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\zTrYlzi.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\IJUXzkT.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\xMVWGjl.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\SVfYqgR.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\dwHtlgs.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\fkWaHlm.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\MtCBUoq.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\MglhhSL.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\MAHerPG.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\RVpPipq.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\hxcMKUy.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\ryXqaDW.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\smGrwwX.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\EJWsbIj.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\tiKXdCa.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\hawDfGn.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\HJvYlCi.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\BlGLNHy.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\somDljo.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\FxPxdMY.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\aEqNcda.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\qXrfvJX.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\dTwGnOn.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\IeFKnYI.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\MDZdthF.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\GQwzNpw.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\CjpNnek.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\VzyqDfP.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\lBKoaIj.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\WKHYxIJ.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\Zlyjtyo.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\sCScOLe.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\tXeGdvj.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\cRPLINM.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\mdpEJAp.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\xKttfFS.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\TWccfEd.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\AQftacP.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\haGnKIe.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\kDXrLKA.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\TFovKwZ.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\IHsJuBF.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\mZWwkkk.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\YHSCPoi.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\HqZeEHL.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\oHmfKkh.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\NLHUdAM.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\HQVqsIT.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\pgNSMCy.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\wbPTNcq.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\CYRvUeL.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\cjQVqXN.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\kmTBjMR.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\kjDiJsm.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\vbfTVKR.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\maGaMzL.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\dOasqDm.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
File created	C:\Windows\System\qVafQyO.exe	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17272	dwm.exe
Token: SeChangeNotifyPrivilege	17272	dwm.exe
Token: 33	17272	dwm.exe
Token: SeIncBasePriorityPrivilege	17272	dwm.exe
Token: SeShutdownPrivilege	17272	dwm.exe
Token: SeCreatePagefilePrivilege	17272	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3968	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	84
PID 4820 wrote to memory of 3968	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	84
PID 4820 wrote to memory of 4016	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	85
PID 4820 wrote to memory of 4016	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	85
PID 4820 wrote to memory of 4808	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	86
PID 4820 wrote to memory of 4808	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	86
PID 4820 wrote to memory of 556	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	87
PID 4820 wrote to memory of 556	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	87
PID 4820 wrote to memory of 2128	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	88
PID 4820 wrote to memory of 2128	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	88
PID 4820 wrote to memory of 3628	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	89
PID 4820 wrote to memory of 3628	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	89
PID 4820 wrote to memory of 3516	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	90
PID 4820 wrote to memory of 3516	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	90
PID 4820 wrote to memory of 3992	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	91
PID 4820 wrote to memory of 3992	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	91
PID 4820 wrote to memory of 2140	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	92
PID 4820 wrote to memory of 2140	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	92
PID 4820 wrote to memory of 2204	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	93
PID 4820 wrote to memory of 2204	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	93
PID 4820 wrote to memory of 3028	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	94
PID 4820 wrote to memory of 3028	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	94
PID 4820 wrote to memory of 2020	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	95
PID 4820 wrote to memory of 2020	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	95
PID 4820 wrote to memory of 2264	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	96
PID 4820 wrote to memory of 2264	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	96
PID 4820 wrote to memory of 4032	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	97
PID 4820 wrote to memory of 4032	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	97
PID 4820 wrote to memory of 1480	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	98
PID 4820 wrote to memory of 1480	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	98
PID 4820 wrote to memory of 4012	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	99
PID 4820 wrote to memory of 4012	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	99
PID 4820 wrote to memory of 3624	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	100
PID 4820 wrote to memory of 3624	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	100
PID 4820 wrote to memory of 1140	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	101
PID 4820 wrote to memory of 1140	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	101
PID 4820 wrote to memory of 4828	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	102
PID 4820 wrote to memory of 4828	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	102
PID 4820 wrote to memory of 3712	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	103
PID 4820 wrote to memory of 3712	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	103
PID 4820 wrote to memory of 1696	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	104
PID 4820 wrote to memory of 1696	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	104
PID 4820 wrote to memory of 4652	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	105
PID 4820 wrote to memory of 4652	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	105
PID 4820 wrote to memory of 4752	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	106
PID 4820 wrote to memory of 4752	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	106
PID 4820 wrote to memory of 2352	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	107
PID 4820 wrote to memory of 2352	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	107
PID 4820 wrote to memory of 1364	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	108
PID 4820 wrote to memory of 1364	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	108
PID 4820 wrote to memory of 2104	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	109
PID 4820 wrote to memory of 2104	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	109
PID 4820 wrote to memory of 3228	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	110
PID 4820 wrote to memory of 3228	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	110
PID 4820 wrote to memory of 4588	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	111
PID 4820 wrote to memory of 4588	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	111
PID 4820 wrote to memory of 5000	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	112
PID 4820 wrote to memory of 5000	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	112
PID 4820 wrote to memory of 2260	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	113
PID 4820 wrote to memory of 2260	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	113
PID 4820 wrote to memory of 2076	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	114
PID 4820 wrote to memory of 2076	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	114
PID 4820 wrote to memory of 1868	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	115
PID 4820 wrote to memory of 1868	4820	f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe	115

C:\Users\Admin\AppData\Local\Temp\f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe
"C:\Users\Admin\AppData\Local\Temp\f55621c6ce361529a8dc1782a23b8e7011e90a490694e32a542ef817efb58c3c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\System\IwnSVXU.exe
  C:\Windows\System\IwnSVXU.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\ZbsNGMS.exe
  C:\Windows\System\ZbsNGMS.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\YgKzsmU.exe
  C:\Windows\System\YgKzsmU.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\xKttfFS.exe
  C:\Windows\System\xKttfFS.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\YmZqIco.exe
  C:\Windows\System\YmZqIco.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\LZzoFOH.exe
  C:\Windows\System\LZzoFOH.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\zYRMPPv.exe
  C:\Windows\System\zYRMPPv.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\BzbtdkX.exe
  C:\Windows\System\BzbtdkX.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\klZVlwV.exe
  C:\Windows\System\klZVlwV.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\VwyDijg.exe
  C:\Windows\System\VwyDijg.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\mLCMYGR.exe
  C:\Windows\System\mLCMYGR.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\SlpMYeK.exe
  C:\Windows\System\SlpMYeK.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\cIxEowi.exe
  C:\Windows\System\cIxEowi.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\KkVbfNa.exe
  C:\Windows\System\KkVbfNa.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\PYpqgly.exe
  C:\Windows\System\PYpqgly.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\PsxHrVx.exe
  C:\Windows\System\PsxHrVx.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\ffzBDjL.exe
  C:\Windows\System\ffzBDjL.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\MVdAwKm.exe
  C:\Windows\System\MVdAwKm.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\DQAfugy.exe
  C:\Windows\System\DQAfugy.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\czsdXrh.exe
  C:\Windows\System\czsdXrh.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\UEqAJUZ.exe
  C:\Windows\System\UEqAJUZ.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\BxgsEcv.exe
  C:\Windows\System\BxgsEcv.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\MglhhSL.exe
  C:\Windows\System\MglhhSL.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\odYiiSH.exe
  C:\Windows\System\odYiiSH.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\xscsnpT.exe
  C:\Windows\System\xscsnpT.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\vHWZxVg.exe
  C:\Windows\System\vHWZxVg.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\Dlbwbzz.exe
  C:\Windows\System\Dlbwbzz.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\NoRqimd.exe
  C:\Windows\System\NoRqimd.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\GbOcoIZ.exe
  C:\Windows\System\GbOcoIZ.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\DNWaTNl.exe
  C:\Windows\System\DNWaTNl.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\TSkzqTo.exe
  C:\Windows\System\TSkzqTo.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\IEBIpRz.exe
  C:\Windows\System\IEBIpRz.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\CVybxDv.exe
  C:\Windows\System\CVybxDv.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\YqHykoB.exe
  C:\Windows\System\YqHykoB.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\MLRpMsS.exe
  C:\Windows\System\MLRpMsS.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\MmFbGsw.exe
  C:\Windows\System\MmFbGsw.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\loXMpJw.exe
  C:\Windows\System\loXMpJw.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\CUlnudn.exe
  C:\Windows\System\CUlnudn.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\lbEJmyZ.exe
  C:\Windows\System\lbEJmyZ.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\cjQVqXN.exe
  C:\Windows\System\cjQVqXN.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\TBQHUxY.exe
  C:\Windows\System\TBQHUxY.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\RpEpadv.exe
  C:\Windows\System\RpEpadv.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\aikiyBV.exe
  C:\Windows\System\aikiyBV.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\uZhhOgb.exe
  C:\Windows\System\uZhhOgb.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\SBRnKBw.exe
  C:\Windows\System\SBRnKBw.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\EvMYfmZ.exe
  C:\Windows\System\EvMYfmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\sfnVAXO.exe
  C:\Windows\System\sfnVAXO.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\GBZMfFI.exe
  C:\Windows\System\GBZMfFI.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\SYmJjNQ.exe
  C:\Windows\System\SYmJjNQ.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\kCxQabH.exe
  C:\Windows\System\kCxQabH.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\NKKBKLL.exe
  C:\Windows\System\NKKBKLL.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\aEqNcda.exe
  C:\Windows\System\aEqNcda.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\BNeryfb.exe
  C:\Windows\System\BNeryfb.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\ZZHJKgp.exe
  C:\Windows\System\ZZHJKgp.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\gxqbtuI.exe
  C:\Windows\System\gxqbtuI.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\jovoXBx.exe
  C:\Windows\System\jovoXBx.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\YQnlYpz.exe
  C:\Windows\System\YQnlYpz.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\XixyIdk.exe
  C:\Windows\System\XixyIdk.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\OmNxQuJ.exe
  C:\Windows\System\OmNxQuJ.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\xBNHQqp.exe
  C:\Windows\System\xBNHQqp.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\FGfeJCV.exe
  C:\Windows\System\FGfeJCV.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\EfhfUPC.exe
  C:\Windows\System\EfhfUPC.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\BlTVWQW.exe
  C:\Windows\System\BlTVWQW.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\DIPpZnA.exe
  C:\Windows\System\DIPpZnA.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\YjfvHzz.exe
  C:\Windows\System\YjfvHzz.exe
  2⤵
  PID:2616
- C:\Windows\System\JzeiDSa.exe
  C:\Windows\System\JzeiDSa.exe
  2⤵
  PID:3724
- C:\Windows\System\jjpGgUm.exe
  C:\Windows\System\jjpGgUm.exe
  2⤵
  PID:1044
- C:\Windows\System\uTgGkDS.exe
  C:\Windows\System\uTgGkDS.exe
  2⤵
  PID:5028
- C:\Windows\System\HpdsmvC.exe
  C:\Windows\System\HpdsmvC.exe
  2⤵
  PID:4520
- C:\Windows\System\sAhziYs.exe
  C:\Windows\System\sAhziYs.exe
  2⤵
  PID:4852
- C:\Windows\System\SSQDTNL.exe
  C:\Windows\System\SSQDTNL.exe
  2⤵
  PID:4136
- C:\Windows\System\DzvxmFx.exe
  C:\Windows\System\DzvxmFx.exe
  2⤵
  PID:4732
- C:\Windows\System\WKHYxIJ.exe
  C:\Windows\System\WKHYxIJ.exe
  2⤵
  PID:868
- C:\Windows\System\VrkXbjX.exe
  C:\Windows\System\VrkXbjX.exe
  2⤵
  PID:4924
- C:\Windows\System\HQVqsIT.exe
  C:\Windows\System\HQVqsIT.exe
  2⤵
  PID:5128
- C:\Windows\System\lxDwmqz.exe
  C:\Windows\System\lxDwmqz.exe
  2⤵
  PID:5156
- C:\Windows\System\uMEVZcI.exe
  C:\Windows\System\uMEVZcI.exe
  2⤵
  PID:5184
- C:\Windows\System\csRINeG.exe
  C:\Windows\System\csRINeG.exe
  2⤵
  PID:5200
- C:\Windows\System\mpihIhB.exe
  C:\Windows\System\mpihIhB.exe
  2⤵
  PID:5228
- C:\Windows\System\IHLBlnC.exe
  C:\Windows\System\IHLBlnC.exe
  2⤵
  PID:5256
- C:\Windows\System\scJkIFw.exe
  C:\Windows\System\scJkIFw.exe
  2⤵
  PID:5288
- C:\Windows\System\DqUVTDy.exe
  C:\Windows\System\DqUVTDy.exe
  2⤵
  PID:5312
- C:\Windows\System\EcaoiTl.exe
  C:\Windows\System\EcaoiTl.exe
  2⤵
  PID:5340
- C:\Windows\System\pwwyqtB.exe
  C:\Windows\System\pwwyqtB.exe
  2⤵
  PID:5368
- C:\Windows\System\hsfpgUe.exe
  C:\Windows\System\hsfpgUe.exe
  2⤵
  PID:5396
- C:\Windows\System\aKlaoIy.exe
  C:\Windows\System\aKlaoIy.exe
  2⤵
  PID:5424
- C:\Windows\System\AUxgxce.exe
  C:\Windows\System\AUxgxce.exe
  2⤵
  PID:5452
- C:\Windows\System\lDuhEtB.exe
  C:\Windows\System\lDuhEtB.exe
  2⤵
  PID:5480
- C:\Windows\System\NYmffMu.exe
  C:\Windows\System\NYmffMu.exe
  2⤵
  PID:5508
- C:\Windows\System\AyrFilj.exe
  C:\Windows\System\AyrFilj.exe
  2⤵
  PID:5532
- C:\Windows\System\YNIPaIb.exe
  C:\Windows\System\YNIPaIb.exe
  2⤵
  PID:5564
- C:\Windows\System\dzbXpAo.exe
  C:\Windows\System\dzbXpAo.exe
  2⤵
  PID:5596
- C:\Windows\System\AQftacP.exe
  C:\Windows\System\AQftacP.exe
  2⤵
  PID:5620
- C:\Windows\System\zoSSRRg.exe
  C:\Windows\System\zoSSRRg.exe
  2⤵
  PID:5644
- C:\Windows\System\TYRZdyc.exe
  C:\Windows\System\TYRZdyc.exe
  2⤵
  PID:5676
- C:\Windows\System\nMcEZJn.exe
  C:\Windows\System\nMcEZJn.exe
  2⤵
  PID:5704
- C:\Windows\System\eNFswxE.exe
  C:\Windows\System\eNFswxE.exe
  2⤵
  PID:5728
- C:\Windows\System\ooVwvWn.exe
  C:\Windows\System\ooVwvWn.exe
  2⤵
  PID:5760
- C:\Windows\System\hNRJxKh.exe
  C:\Windows\System\hNRJxKh.exe
  2⤵
  PID:5788
- C:\Windows\System\sZoDIAp.exe
  C:\Windows\System\sZoDIAp.exe
  2⤵
  PID:5816
- C:\Windows\System\iTSFONm.exe
  C:\Windows\System\iTSFONm.exe
  2⤵
  PID:5840
- C:\Windows\System\igneQtJ.exe
  C:\Windows\System\igneQtJ.exe
  2⤵
  PID:5872
- C:\Windows\System\lMWNVFZ.exe
  C:\Windows\System\lMWNVFZ.exe
  2⤵
  PID:5900
- C:\Windows\System\bJVZsHJ.exe
  C:\Windows\System\bJVZsHJ.exe
  2⤵
  PID:5924
- C:\Windows\System\ephIKZj.exe
  C:\Windows\System\ephIKZj.exe
  2⤵
  PID:5956
- C:\Windows\System\JktHHre.exe
  C:\Windows\System\JktHHre.exe
  2⤵
  PID:5984
- C:\Windows\System\BCakKQQ.exe
  C:\Windows\System\BCakKQQ.exe
  2⤵
  PID:6012
- C:\Windows\System\aFJwrsj.exe
  C:\Windows\System\aFJwrsj.exe
  2⤵
  PID:6040
- C:\Windows\System\lbRqwpI.exe
  C:\Windows\System\lbRqwpI.exe
  2⤵
  PID:6056
- C:\Windows\System\smKXrMl.exe
  C:\Windows\System\smKXrMl.exe
  2⤵
  PID:6084
- C:\Windows\System\SKVgUuq.exe
  C:\Windows\System\SKVgUuq.exe
  2⤵
  PID:6120
- C:\Windows\System\VgvttIl.exe
  C:\Windows\System\VgvttIl.exe
  2⤵
  PID:4556
- C:\Windows\System\zeAEBxb.exe
  C:\Windows\System\zeAEBxb.exe
  2⤵
  PID:2868
- C:\Windows\System\PyBpfDm.exe
  C:\Windows\System\PyBpfDm.exe
  2⤵
  PID:4776
- C:\Windows\System\OMticux.exe
  C:\Windows\System\OMticux.exe
  2⤵
  PID:2560
- C:\Windows\System\BzyDbtz.exe
  C:\Windows\System\BzyDbtz.exe
  2⤵
  PID:2200
- C:\Windows\System\IeFKnYI.exe
  C:\Windows\System\IeFKnYI.exe
  2⤵
  PID:2028
- C:\Windows\System\yroTHnR.exe
  C:\Windows\System\yroTHnR.exe
  2⤵
  PID:5124
- C:\Windows\System\uVEPMAO.exe
  C:\Windows\System\uVEPMAO.exe
  2⤵
  PID:5192
- C:\Windows\System\dUeYukF.exe
  C:\Windows\System\dUeYukF.exe
  2⤵
  PID:5248
- C:\Windows\System\RDfCSod.exe
  C:\Windows\System\RDfCSod.exe
  2⤵
  PID:5324
- C:\Windows\System\TRsBEic.exe
  C:\Windows\System\TRsBEic.exe
  2⤵
  PID:5384
- C:\Windows\System\GWZjTtx.exe
  C:\Windows\System\GWZjTtx.exe
  2⤵
  PID:5440
- C:\Windows\System\nsUBppA.exe
  C:\Windows\System\nsUBppA.exe
  2⤵
  PID:5520
- C:\Windows\System\DxBoVJy.exe
  C:\Windows\System\DxBoVJy.exe
  2⤵
  PID:5576
- C:\Windows\System\hwMyUXA.exe
  C:\Windows\System\hwMyUXA.exe
  2⤵
  PID:5640
- C:\Windows\System\BNQfqFz.exe
  C:\Windows\System\BNQfqFz.exe
  2⤵
  PID:5716
- C:\Windows\System\AZFAAEB.exe
  C:\Windows\System\AZFAAEB.exe
  2⤵
  PID:5776
- C:\Windows\System\PEKvucZ.exe
  C:\Windows\System\PEKvucZ.exe
  2⤵
  PID:5836
- C:\Windows\System\BntQXPL.exe
  C:\Windows\System\BntQXPL.exe
  2⤵
  PID:5892
- C:\Windows\System\QnViXxL.exe
  C:\Windows\System\QnViXxL.exe
  2⤵
  PID:5948
- C:\Windows\System\nkLDaqN.exe
  C:\Windows\System\nkLDaqN.exe
  2⤵
  PID:6004
- C:\Windows\System\uNvoiHk.exe
  C:\Windows\System\uNvoiHk.exe
  2⤵
  PID:6080
- C:\Windows\System\MiTfAfv.exe
  C:\Windows\System\MiTfAfv.exe
  2⤵
  PID:3216
- C:\Windows\System\IWZpolu.exe
  C:\Windows\System\IWZpolu.exe
  2⤵
  PID:4880
- C:\Windows\System\CDqWdEn.exe
  C:\Windows\System\CDqWdEn.exe
  2⤵
  PID:3728
- C:\Windows\System\flaTdtb.exe
  C:\Windows\System\flaTdtb.exe
  2⤵
  PID:5172
- C:\Windows\System\bbggEWZ.exe
  C:\Windows\System\bbggEWZ.exe
  2⤵
  PID:5352
- C:\Windows\System\pRuDody.exe
  C:\Windows\System\pRuDody.exe
  2⤵
  PID:5492
- C:\Windows\System\zoQUZWK.exe
  C:\Windows\System\zoQUZWK.exe
  2⤵
  PID:5632
- C:\Windows\System\CDuMsQb.exe
  C:\Windows\System\CDuMsQb.exe
  2⤵
  PID:5804
- C:\Windows\System\tOOMYoJ.exe
  C:\Windows\System\tOOMYoJ.exe
  2⤵
  PID:6148
- C:\Windows\System\wJTMsae.exe
  C:\Windows\System\wJTMsae.exe
  2⤵
  PID:6176
- C:\Windows\System\qDcMjEg.exe
  C:\Windows\System\qDcMjEg.exe
  2⤵
  PID:6208
- C:\Windows\System\LzPwXNX.exe
  C:\Windows\System\LzPwXNX.exe
  2⤵
  PID:6240
- C:\Windows\System\LZVihTT.exe
  C:\Windows\System\LZVihTT.exe
  2⤵
  PID:6268
- C:\Windows\System\aMmRMYF.exe
  C:\Windows\System\aMmRMYF.exe
  2⤵
  PID:6288
- C:\Windows\System\AoAMRlD.exe
  C:\Windows\System\AoAMRlD.exe
  2⤵
  PID:6316
- C:\Windows\System\nlVTJTL.exe
  C:\Windows\System\nlVTJTL.exe
  2⤵
  PID:6344
- C:\Windows\System\HuDQeJS.exe
  C:\Windows\System\HuDQeJS.exe
  2⤵
  PID:6372
- C:\Windows\System\EzROuyH.exe
  C:\Windows\System\EzROuyH.exe
  2⤵
  PID:6400
- C:\Windows\System\vqjyFjD.exe
  C:\Windows\System\vqjyFjD.exe
  2⤵
  PID:6428
- C:\Windows\System\wWxqLwr.exe
  C:\Windows\System\wWxqLwr.exe
  2⤵
  PID:6456
- C:\Windows\System\DIlSJYn.exe
  C:\Windows\System\DIlSJYn.exe
  2⤵
  PID:6484
- C:\Windows\System\uJjYMxr.exe
  C:\Windows\System\uJjYMxr.exe
  2⤵
  PID:6508
- C:\Windows\System\pZJbgYl.exe
  C:\Windows\System\pZJbgYl.exe
  2⤵
  PID:6540
- C:\Windows\System\reJDryp.exe
  C:\Windows\System\reJDryp.exe
  2⤵
  PID:6564
- C:\Windows\System\aFuqYyA.exe
  C:\Windows\System\aFuqYyA.exe
  2⤵
  PID:6592
- C:\Windows\System\mexjFVn.exe
  C:\Windows\System\mexjFVn.exe
  2⤵
  PID:6628
- C:\Windows\System\zlxWXvQ.exe
  C:\Windows\System\zlxWXvQ.exe
  2⤵
  PID:6652
- C:\Windows\System\wEZgTdf.exe
  C:\Windows\System\wEZgTdf.exe
  2⤵
  PID:6676
- C:\Windows\System\tiKXdCa.exe
  C:\Windows\System\tiKXdCa.exe
  2⤵
  PID:6704
- C:\Windows\System\Wbuemah.exe
  C:\Windows\System\Wbuemah.exe
  2⤵
  PID:6736
- C:\Windows\System\czDMfCt.exe
  C:\Windows\System\czDMfCt.exe
  2⤵
  PID:6764
- C:\Windows\System\oLbEivo.exe
  C:\Windows\System\oLbEivo.exe
  2⤵
  PID:6792
- C:\Windows\System\VPNpHKF.exe
  C:\Windows\System\VPNpHKF.exe
  2⤵
  PID:6816
- C:\Windows\System\xoAyFpi.exe
  C:\Windows\System\xoAyFpi.exe
  2⤵
  PID:6848
- C:\Windows\System\ecFHBlB.exe
  C:\Windows\System\ecFHBlB.exe
  2⤵
  PID:6876
- C:\Windows\System\xnapVGs.exe
  C:\Windows\System\xnapVGs.exe
  2⤵
  PID:6904
- C:\Windows\System\dUdHXbR.exe
  C:\Windows\System\dUdHXbR.exe
  2⤵
  PID:6932
- C:\Windows\System\WolTVqr.exe
  C:\Windows\System\WolTVqr.exe
  2⤵
  PID:6956
- C:\Windows\System\WYNyxsk.exe
  C:\Windows\System\WYNyxsk.exe
  2⤵
  PID:6988
- C:\Windows\System\tdDZZIQ.exe
  C:\Windows\System\tdDZZIQ.exe
  2⤵
  PID:7016
- C:\Windows\System\fwAVYiS.exe
  C:\Windows\System\fwAVYiS.exe
  2⤵
  PID:7044
- C:\Windows\System\YfWLheA.exe
  C:\Windows\System\YfWLheA.exe
  2⤵
  PID:7072
- C:\Windows\System\eYLjiuW.exe
  C:\Windows\System\eYLjiuW.exe
  2⤵
  PID:7096
- C:\Windows\System\qXPDcrr.exe
  C:\Windows\System\qXPDcrr.exe
  2⤵
  PID:7124
- C:\Windows\System\zCoQSet.exe
  C:\Windows\System\zCoQSet.exe
  2⤵
  PID:7160
- C:\Windows\System\BmSpsbq.exe
  C:\Windows\System\BmSpsbq.exe
  2⤵
  PID:6000
- C:\Windows\System\QsCMHDa.exe
  C:\Windows\System\QsCMHDa.exe
  2⤵
  PID:6136
- C:\Windows\System\VeDnQwK.exe
  C:\Windows\System\VeDnQwK.exe
  2⤵
  PID:2212
- C:\Windows\System\qfBRJTu.exe
  C:\Windows\System\qfBRJTu.exe
  2⤵
  PID:5412
- C:\Windows\System\Xziwkna.exe
  C:\Windows\System\Xziwkna.exe
  2⤵
  PID:5692
- C:\Windows\System\oYkqVFx.exe
  C:\Windows\System\oYkqVFx.exe
  2⤵
  PID:6164
- C:\Windows\System\qMAiipM.exe
  C:\Windows\System\qMAiipM.exe
  2⤵
  PID:6232
- C:\Windows\System\gcuBfOb.exe
  C:\Windows\System\gcuBfOb.exe
  2⤵
  PID:6284
- C:\Windows\System\qrLrUjB.exe
  C:\Windows\System\qrLrUjB.exe
  2⤵
  PID:6360
- C:\Windows\System\kZUfjxA.exe
  C:\Windows\System\kZUfjxA.exe
  2⤵
  PID:6416
- C:\Windows\System\LhhzMea.exe
  C:\Windows\System\LhhzMea.exe
  2⤵
  PID:6476
- C:\Windows\System\dlKwBMc.exe
  C:\Windows\System\dlKwBMc.exe
  2⤵
  PID:6532
- C:\Windows\System\XXYECDr.exe
  C:\Windows\System\XXYECDr.exe
  2⤵
  PID:6588
- C:\Windows\System\jSdwSoZ.exe
  C:\Windows\System\jSdwSoZ.exe
  2⤵
  PID:6648
- C:\Windows\System\hRVHrWd.exe
  C:\Windows\System\hRVHrWd.exe
  2⤵
  PID:6696
- C:\Windows\System\nHbYPyk.exe
  C:\Windows\System\nHbYPyk.exe
  2⤵
  PID:6756
- C:\Windows\System\qUMQSIt.exe
  C:\Windows\System\qUMQSIt.exe
  2⤵
  PID:6832
- C:\Windows\System\CKGTuWO.exe
  C:\Windows\System\CKGTuWO.exe
  2⤵
  PID:6892
- C:\Windows\System\LtbuCXG.exe
  C:\Windows\System\LtbuCXG.exe
  2⤵
  PID:6952
- C:\Windows\System\jWVZgXQ.exe
  C:\Windows\System\jWVZgXQ.exe
  2⤵
  PID:2612
- C:\Windows\System\RVpPipq.exe
  C:\Windows\System\RVpPipq.exe
  2⤵
  PID:7056
- C:\Windows\System\ugjxASV.exe
  C:\Windows\System\ugjxASV.exe
  2⤵
  PID:7116
- C:\Windows\System\LHRZDmj.exe
  C:\Windows\System\LHRZDmj.exe
  2⤵
  PID:5976
- C:\Windows\System\OTraQTc.exe
  C:\Windows\System\OTraQTc.exe
  2⤵
  PID:516
- C:\Windows\System\grcViYV.exe
  C:\Windows\System\grcViYV.exe
  2⤵
  PID:5556
- C:\Windows\System\EqqUVLz.exe
  C:\Windows\System\EqqUVLz.exe
  2⤵
  PID:6944
- C:\Windows\System\zAlVXWN.exe
  C:\Windows\System\zAlVXWN.exe
  2⤵
  PID:4876
- C:\Windows\System\RrqMfuF.exe
  C:\Windows\System\RrqMfuF.exe
  2⤵
  PID:6980
- C:\Windows\System\uHNiGoB.exe
  C:\Windows\System\uHNiGoB.exe
  2⤵
  PID:1164
- C:\Windows\System\RzTJMnh.exe
  C:\Windows\System\RzTJMnh.exe
  2⤵
  PID:7088
- C:\Windows\System\qJqPKkp.exe
  C:\Windows\System\qJqPKkp.exe
  2⤵
  PID:4172
- C:\Windows\System\QDdWKVM.exe
  C:\Windows\System\QDdWKVM.exe
  2⤵
  PID:2932
- C:\Windows\System\hMQBftV.exe
  C:\Windows\System\hMQBftV.exe
  2⤵
  PID:3244
- C:\Windows\System\CnMxGoE.exe
  C:\Windows\System\CnMxGoE.exe
  2⤵
  PID:2984
- C:\Windows\System\mCyfJos.exe
  C:\Windows\System\mCyfJos.exe
  2⤵
  PID:1476
- C:\Windows\System\rAgKhfd.exe
  C:\Windows\System\rAgKhfd.exe
  2⤵
  PID:3132
- C:\Windows\System\zlGINym.exe
  C:\Windows\System\zlGINym.exe
  2⤵
  PID:4276
- C:\Windows\System\LZRoeAO.exe
  C:\Windows\System\LZRoeAO.exe
  2⤵
  PID:3448
- C:\Windows\System\mKwUVVF.exe
  C:\Windows\System\mKwUVVF.exe
  2⤵
  PID:6228
- C:\Windows\System\ycitIZG.exe
  C:\Windows\System\ycitIZG.exe
  2⤵
  PID:3964
- C:\Windows\System\RKJCqkv.exe
  C:\Windows\System\RKJCqkv.exe
  2⤵
  PID:6392
- C:\Windows\System\gOTKskU.exe
  C:\Windows\System\gOTKskU.exe
  2⤵
  PID:6448
- C:\Windows\System\bwaTEyY.exe
  C:\Windows\System\bwaTEyY.exe
  2⤵
  PID:3080
- C:\Windows\System\UcfignX.exe
  C:\Windows\System\UcfignX.exe
  2⤵
  PID:4116
- C:\Windows\System\YmRkhpv.exe
  C:\Windows\System\YmRkhpv.exe
  2⤵
  PID:7032
- C:\Windows\System\IbpxZEU.exe
  C:\Windows\System\IbpxZEU.exe
  2⤵
  PID:2668
- C:\Windows\System\KOwUQIb.exe
  C:\Windows\System\KOwUQIb.exe
  2⤵
  PID:6612
- C:\Windows\System\TxVsqhN.exe
  C:\Windows\System\TxVsqhN.exe
  2⤵
  PID:5100
- C:\Windows\System\lWahORk.exe
  C:\Windows\System\lWahORk.exe
  2⤵
  PID:3536
- C:\Windows\System\gjDkjrf.exe
  C:\Windows\System\gjDkjrf.exe
  2⤵
  PID:4440
- C:\Windows\System\zTrYlzi.exe
  C:\Windows\System\zTrYlzi.exe
  2⤵
  PID:4484
- C:\Windows\System\IJUXzkT.exe
  C:\Windows\System\IJUXzkT.exe
  2⤵
  PID:2680
- C:\Windows\System\gSauphC.exe
  C:\Windows\System\gSauphC.exe
  2⤵
  PID:6388
- C:\Windows\System\vbfTVKR.exe
  C:\Windows\System\vbfTVKR.exe
  2⤵
  PID:6504
- C:\Windows\System\GMSdlgc.exe
  C:\Windows\System\GMSdlgc.exe
  2⤵
  PID:1984
- C:\Windows\System\vlWAnyT.exe
  C:\Windows\System\vlWAnyT.exe
  2⤵
  PID:7092
- C:\Windows\System\zejwTju.exe
  C:\Windows\System\zejwTju.exe
  2⤵
  PID:3672
- C:\Windows\System\lxpLThw.exe
  C:\Windows\System\lxpLThw.exe
  2⤵
  PID:6672
- C:\Windows\System\aIjLCNF.exe
  C:\Windows\System\aIjLCNF.exe
  2⤵
  PID:6808
- C:\Windows\System\gkrDWdG.exe
  C:\Windows\System\gkrDWdG.exe
  2⤵
  PID:6784
- C:\Windows\System\pSvxHaE.exe
  C:\Windows\System\pSvxHaE.exe
  2⤵
  PID:1172
- C:\Windows\System\jUEjvTU.exe
  C:\Windows\System\jUEjvTU.exe
  2⤵
  PID:6636
- C:\Windows\System\AiZatZJ.exe
  C:\Windows\System\AiZatZJ.exe
  2⤵
  PID:7180
- C:\Windows\System\tzoAFsw.exe
  C:\Windows\System\tzoAFsw.exe
  2⤵
  PID:7200
- C:\Windows\System\dOtZoyE.exe
  C:\Windows\System\dOtZoyE.exe
  2⤵
  PID:7252
- C:\Windows\System\iYOtYJg.exe
  C:\Windows\System\iYOtYJg.exe
  2⤵
  PID:7284
- C:\Windows\System\aQjiwiH.exe
  C:\Windows\System\aQjiwiH.exe
  2⤵
  PID:7312
- C:\Windows\System\lzrTgzq.exe
  C:\Windows\System\lzrTgzq.exe
  2⤵
  PID:7340
- C:\Windows\System\UUgrNmQ.exe
  C:\Windows\System\UUgrNmQ.exe
  2⤵
  PID:7368
- C:\Windows\System\kmTBjMR.exe
  C:\Windows\System\kmTBjMR.exe
  2⤵
  PID:7396
- C:\Windows\System\hgVSSte.exe
  C:\Windows\System\hgVSSte.exe
  2⤵
  PID:7424
- C:\Windows\System\pIafppf.exe
  C:\Windows\System\pIafppf.exe
  2⤵
  PID:7456
- C:\Windows\System\oEMQNTd.exe
  C:\Windows\System\oEMQNTd.exe
  2⤵
  PID:7492
- C:\Windows\System\RZkdeNi.exe
  C:\Windows\System\RZkdeNi.exe
  2⤵
  PID:7508
- C:\Windows\System\zaqIXyD.exe
  C:\Windows\System\zaqIXyD.exe
  2⤵
  PID:7540
- C:\Windows\System\pgNSMCy.exe
  C:\Windows\System\pgNSMCy.exe
  2⤵
  PID:7576
- C:\Windows\System\dJlBLxY.exe
  C:\Windows\System\dJlBLxY.exe
  2⤵
  PID:7592
- C:\Windows\System\PjcrjuN.exe
  C:\Windows\System\PjcrjuN.exe
  2⤵
  PID:7620
- C:\Windows\System\aAtXgMb.exe
  C:\Windows\System\aAtXgMb.exe
  2⤵
  PID:7648
- C:\Windows\System\mYvyVJR.exe
  C:\Windows\System\mYvyVJR.exe
  2⤵
  PID:7676
- C:\Windows\System\dZBETTH.exe
  C:\Windows\System\dZBETTH.exe
  2⤵
  PID:7708
- C:\Windows\System\ZQRqaGV.exe
  C:\Windows\System\ZQRqaGV.exe
  2⤵
  PID:7744
- C:\Windows\System\ZhOxJZl.exe
  C:\Windows\System\ZhOxJZl.exe
  2⤵
  PID:7760
- C:\Windows\System\NVAoUTv.exe
  C:\Windows\System\NVAoUTv.exe
  2⤵
  PID:7788
- C:\Windows\System\xShFOtx.exe
  C:\Windows\System\xShFOtx.exe
  2⤵
  PID:7816
- C:\Windows\System\YxqSliz.exe
  C:\Windows\System\YxqSliz.exe
  2⤵
  PID:7872
- C:\Windows\System\XYHLSoa.exe
  C:\Windows\System\XYHLSoa.exe
  2⤵
  PID:7888
- C:\Windows\System\uAriXkP.exe
  C:\Windows\System\uAriXkP.exe
  2⤵
  PID:7920
- C:\Windows\System\gKFUoWw.exe
  C:\Windows\System\gKFUoWw.exe
  2⤵
  PID:7936
- C:\Windows\System\wfUvTwG.exe
  C:\Windows\System\wfUvTwG.exe
  2⤵
  PID:7956
- C:\Windows\System\Zlyjtyo.exe
  C:\Windows\System\Zlyjtyo.exe
  2⤵
  PID:8004
- C:\Windows\System\UHbEsFU.exe
  C:\Windows\System\UHbEsFU.exe
  2⤵
  PID:8020
- C:\Windows\System\GkGkgaq.exe
  C:\Windows\System\GkGkgaq.exe
  2⤵
  PID:8056
- C:\Windows\System\NcMcrdz.exe
  C:\Windows\System\NcMcrdz.exe
  2⤵
  PID:8088
- C:\Windows\System\UiEpvlc.exe
  C:\Windows\System\UiEpvlc.exe
  2⤵
  PID:8104
- C:\Windows\System\iXefTuR.exe
  C:\Windows\System\iXefTuR.exe
  2⤵
  PID:8132
- C:\Windows\System\tyRWYsF.exe
  C:\Windows\System\tyRWYsF.exe
  2⤵
  PID:8160
- C:\Windows\System\QMQZDJO.exe
  C:\Windows\System\QMQZDJO.exe
  2⤵
  PID:8188
- C:\Windows\System\iwRpJnq.exe
  C:\Windows\System\iwRpJnq.exe
  2⤵
  PID:7224
- C:\Windows\System\aIlPUBV.exe
  C:\Windows\System\aIlPUBV.exe
  2⤵
  PID:7296
- C:\Windows\System\NhKGwxD.exe
  C:\Windows\System\NhKGwxD.exe
  2⤵
  PID:7364
- C:\Windows\System\kApkhfg.exe
  C:\Windows\System\kApkhfg.exe
  2⤵
  PID:7384
- C:\Windows\System\zdjiEiW.exe
  C:\Windows\System\zdjiEiW.exe
  2⤵
  PID:7500
- C:\Windows\System\CIJumJK.exe
  C:\Windows\System\CIJumJK.exe
  2⤵
  PID:7536
- C:\Windows\System\SkQGSZb.exe
  C:\Windows\System\SkQGSZb.exe
  2⤵
  PID:7636
- C:\Windows\System\GtVCSoO.exe
  C:\Windows\System\GtVCSoO.exe
  2⤵
  PID:7688
- C:\Windows\System\UTdZICH.exe
  C:\Windows\System\UTdZICH.exe
  2⤵
  PID:7756
- C:\Windows\System\dvkSZVt.exe
  C:\Windows\System\dvkSZVt.exe
  2⤵
  PID:7772
- C:\Windows\System\OgWtzmO.exe
  C:\Windows\System\OgWtzmO.exe
  2⤵
  PID:7832
- C:\Windows\System\HJmSNgF.exe
  C:\Windows\System\HJmSNgF.exe
  2⤵
  PID:7884
- C:\Windows\System\yKswede.exe
  C:\Windows\System\yKswede.exe
  2⤵
  PID:7964
- C:\Windows\System\GhmGuuw.exe
  C:\Windows\System\GhmGuuw.exe
  2⤵
  PID:8000
- C:\Windows\System\YloRJSU.exe
  C:\Windows\System\YloRJSU.exe
  2⤵
  PID:8048
- C:\Windows\System\qtuPUyb.exe
  C:\Windows\System\qtuPUyb.exe
  2⤵
  PID:8124
- C:\Windows\System\AwECQnd.exe
  C:\Windows\System\AwECQnd.exe
  2⤵
  PID:8148
- C:\Windows\System\maGaMzL.exe
  C:\Windows\System\maGaMzL.exe
  2⤵
  PID:7196
- C:\Windows\System\iPJpTKc.exe
  C:\Windows\System\iPJpTKc.exe
  2⤵
  PID:7268
- C:\Windows\System\BfHEQGa.exe
  C:\Windows\System\BfHEQGa.exe
  2⤵
  PID:7612
- C:\Windows\System\XMzEqCh.exe
  C:\Windows\System\XMzEqCh.exe
  2⤵
  PID:7736
- C:\Windows\System\haGnKIe.exe
  C:\Windows\System\haGnKIe.exe
  2⤵
  PID:7944
- C:\Windows\System\mpzKUOd.exe
  C:\Windows\System\mpzKUOd.exe
  2⤵
  PID:8120
- C:\Windows\System\zpBMnbC.exe
  C:\Windows\System\zpBMnbC.exe
  2⤵
  PID:7272
- C:\Windows\System\hbKiRZC.exe
  C:\Windows\System\hbKiRZC.exe
  2⤵
  PID:7980
- C:\Windows\System\dLKopEX.exe
  C:\Windows\System\dLKopEX.exe
  2⤵
  PID:7996
- C:\Windows\System\dFBnmyC.exe
  C:\Windows\System\dFBnmyC.exe
  2⤵
  PID:7436
- C:\Windows\System\CpssWKR.exe
  C:\Windows\System\CpssWKR.exe
  2⤵
  PID:8208
- C:\Windows\System\WcgBGgm.exe
  C:\Windows\System\WcgBGgm.exe
  2⤵
  PID:8256
- C:\Windows\System\HRPijgv.exe
  C:\Windows\System\HRPijgv.exe
  2⤵
  PID:8272
- C:\Windows\System\uRbnnQG.exe
  C:\Windows\System\uRbnnQG.exe
  2⤵
  PID:8288
- C:\Windows\System\rGKVfzD.exe
  C:\Windows\System\rGKVfzD.exe
  2⤵
  PID:8312
- C:\Windows\System\BWRDDjU.exe
  C:\Windows\System\BWRDDjU.exe
  2⤵
  PID:8348
- C:\Windows\System\IBEEFfn.exe
  C:\Windows\System\IBEEFfn.exe
  2⤵
  PID:8376
- C:\Windows\System\kDXrLKA.exe
  C:\Windows\System\kDXrLKA.exe
  2⤵
  PID:8396
- C:\Windows\System\FYhGobG.exe
  C:\Windows\System\FYhGobG.exe
  2⤵
  PID:8436
- C:\Windows\System\IzCWkPu.exe
  C:\Windows\System\IzCWkPu.exe
  2⤵
  PID:8468
- C:\Windows\System\UBAmvuj.exe
  C:\Windows\System\UBAmvuj.exe
  2⤵
  PID:8500
- C:\Windows\System\TyyjlKh.exe
  C:\Windows\System\TyyjlKh.exe
  2⤵
  PID:8524
- C:\Windows\System\tzAyGub.exe
  C:\Windows\System\tzAyGub.exe
  2⤵
  PID:8540
- C:\Windows\System\hEjmMtP.exe
  C:\Windows\System\hEjmMtP.exe
  2⤵
  PID:8596
- C:\Windows\System\cFrnUtr.exe
  C:\Windows\System\cFrnUtr.exe
  2⤵
  PID:8612
- C:\Windows\System\OVVmeYM.exe
  C:\Windows\System\OVVmeYM.exe
  2⤵
  PID:8652
- C:\Windows\System\UqESLTS.exe
  C:\Windows\System\UqESLTS.exe
  2⤵
  PID:8672
- C:\Windows\System\elxaznf.exe
  C:\Windows\System\elxaznf.exe
  2⤵
  PID:8700
- C:\Windows\System\dmlJvZG.exe
  C:\Windows\System\dmlJvZG.exe
  2⤵
  PID:8740
- C:\Windows\System\aHcZsIZ.exe
  C:\Windows\System\aHcZsIZ.exe
  2⤵
  PID:8764
- C:\Windows\System\PsZeofe.exe
  C:\Windows\System\PsZeofe.exe
  2⤵
  PID:8780
- C:\Windows\System\kHimztj.exe
  C:\Windows\System\kHimztj.exe
  2⤵
  PID:8812
- C:\Windows\System\SXOaejY.exe
  C:\Windows\System\SXOaejY.exe
  2⤵
  PID:8840
- C:\Windows\System\Nypuqzy.exe
  C:\Windows\System\Nypuqzy.exe
  2⤵
  PID:8856
- C:\Windows\System\SLLIKRB.exe
  C:\Windows\System\SLLIKRB.exe
  2⤵
  PID:8884
- C:\Windows\System\pHetuPK.exe
  C:\Windows\System\pHetuPK.exe
  2⤵
  PID:8916
- C:\Windows\System\sCScOLe.exe
  C:\Windows\System\sCScOLe.exe
  2⤵
  PID:8948
- C:\Windows\System\hxNSkqw.exe
  C:\Windows\System\hxNSkqw.exe
  2⤵
  PID:8992
- C:\Windows\System\QyHadGf.exe
  C:\Windows\System\QyHadGf.exe
  2⤵
  PID:9020
- C:\Windows\System\TOOzKyf.exe
  C:\Windows\System\TOOzKyf.exe
  2⤵
  PID:9040
- C:\Windows\System\jBoDiJV.exe
  C:\Windows\System\jBoDiJV.exe
  2⤵
  PID:9064
- C:\Windows\System\WgwFMtN.exe
  C:\Windows\System\WgwFMtN.exe
  2⤵
  PID:9088
- C:\Windows\System\alXgmSg.exe
  C:\Windows\System\alXgmSg.exe
  2⤵
  PID:9116
- C:\Windows\System\dNPcVqy.exe
  C:\Windows\System\dNPcVqy.exe
  2⤵
  PID:9152
- C:\Windows\System\ZzmiaRW.exe
  C:\Windows\System\ZzmiaRW.exe
  2⤵
  PID:9176
- C:\Windows\System\rwPpctw.exe
  C:\Windows\System\rwPpctw.exe
  2⤵
  PID:9212
- C:\Windows\System\ALdxOGj.exe
  C:\Windows\System\ALdxOGj.exe
  2⤵
  PID:8300
- C:\Windows\System\TSecIOL.exe
  C:\Windows\System\TSecIOL.exe
  2⤵
  PID:8372
- C:\Windows\System\cwHUhIQ.exe
  C:\Windows\System\cwHUhIQ.exe
  2⤵
  PID:8388
- C:\Windows\System\vnWbRyv.exe
  C:\Windows\System\vnWbRyv.exe
  2⤵
  PID:8484
- C:\Windows\System\RlIasgi.exe
  C:\Windows\System\RlIasgi.exe
  2⤵
  PID:8564
- C:\Windows\System\zfyfVQW.exe
  C:\Windows\System\zfyfVQW.exe
  2⤵
  PID:8632
- C:\Windows\System\IRycPUK.exe
  C:\Windows\System\IRycPUK.exe
  2⤵
  PID:8736
- C:\Windows\System\rCGkdNf.exe
  C:\Windows\System\rCGkdNf.exe
  2⤵
  PID:8772
- C:\Windows\System\svThRWJ.exe
  C:\Windows\System\svThRWJ.exe
  2⤵
  PID:8848
- C:\Windows\System\CHacLIZ.exe
  C:\Windows\System\CHacLIZ.exe
  2⤵
  PID:8936
- C:\Windows\System\VIgZzUs.exe
  C:\Windows\System\VIgZzUs.exe
  2⤵
  PID:8980
- C:\Windows\System\uKDRHPr.exe
  C:\Windows\System\uKDRHPr.exe
  2⤵
  PID:9108
- C:\Windows\System\DfKYNGJ.exe
  C:\Windows\System\DfKYNGJ.exe
  2⤵
  PID:9128
- C:\Windows\System\uJETlqc.exe
  C:\Windows\System\uJETlqc.exe
  2⤵
  PID:8248
- C:\Windows\System\jttOlSg.exe
  C:\Windows\System\jttOlSg.exe
  2⤵
  PID:8404
- C:\Windows\System\dhwzfiU.exe
  C:\Windows\System\dhwzfiU.exe
  2⤵
  PID:8392
- C:\Windows\System\PzpqidF.exe
  C:\Windows\System\PzpqidF.exe
  2⤵
  PID:8592
- C:\Windows\System\WusCdpn.exe
  C:\Windows\System\WusCdpn.exe
  2⤵
  PID:8800
- C:\Windows\System\DlVryCO.exe
  C:\Windows\System\DlVryCO.exe
  2⤵
  PID:8896
- C:\Windows\System\nqPAWDE.exe
  C:\Windows\System\nqPAWDE.exe
  2⤵
  PID:9080
- C:\Windows\System\EHhvjcO.exe
  C:\Windows\System\EHhvjcO.exe
  2⤵
  PID:9208
- C:\Windows\System\PjckFxN.exe
  C:\Windows\System\PjckFxN.exe
  2⤵
  PID:8280
- C:\Windows\System\NYrQzUh.exe
  C:\Windows\System\NYrQzUh.exe
  2⤵
  PID:8804
- C:\Windows\System\lllysIU.exe
  C:\Windows\System\lllysIU.exe
  2⤵
  PID:8964
- C:\Windows\System\IHNdcqT.exe
  C:\Windows\System\IHNdcqT.exe
  2⤵
  PID:9220
- C:\Windows\System\YPuqEwK.exe
  C:\Windows\System\YPuqEwK.exe
  2⤵
  PID:9248
- C:\Windows\System\RlkVWor.exe
  C:\Windows\System\RlkVWor.exe
  2⤵
  PID:9276
- C:\Windows\System\QCvEmUv.exe
  C:\Windows\System\QCvEmUv.exe
  2⤵
  PID:9320
- C:\Windows\System\mXLTAoT.exe
  C:\Windows\System\mXLTAoT.exe
  2⤵
  PID:9340
- C:\Windows\System\WhHfYXM.exe
  C:\Windows\System\WhHfYXM.exe
  2⤵
  PID:9364
- C:\Windows\System\bnjiQbr.exe
  C:\Windows\System\bnjiQbr.exe
  2⤵
  PID:9380
- C:\Windows\System\cRPLINM.exe
  C:\Windows\System\cRPLINM.exe
  2⤵
  PID:9408
- C:\Windows\System\rLnNOLV.exe
  C:\Windows\System\rLnNOLV.exe
  2⤵
  PID:9464
- C:\Windows\System\FBxtenu.exe
  C:\Windows\System\FBxtenu.exe
  2⤵
  PID:9480
- C:\Windows\System\lBKoaIj.exe
  C:\Windows\System\lBKoaIj.exe
  2⤵
  PID:9508
- C:\Windows\System\jdxKuHH.exe
  C:\Windows\System\jdxKuHH.exe
  2⤵
  PID:9536
- C:\Windows\System\EiYwMsy.exe
  C:\Windows\System\EiYwMsy.exe
  2⤵
  PID:9552
- C:\Windows\System\acDVbdE.exe
  C:\Windows\System\acDVbdE.exe
  2⤵
  PID:9576
- C:\Windows\System\hawDfGn.exe
  C:\Windows\System\hawDfGn.exe
  2⤵
  PID:9628
- C:\Windows\System\DZbkMvK.exe
  C:\Windows\System\DZbkMvK.exe
  2⤵
  PID:9648
- C:\Windows\System\bopefgW.exe
  C:\Windows\System\bopefgW.exe
  2⤵
  PID:9676
- C:\Windows\System\wWxyUCU.exe
  C:\Windows\System\wWxyUCU.exe
  2⤵
  PID:9704
- C:\Windows\System\JWWUAoZ.exe
  C:\Windows\System\JWWUAoZ.exe
  2⤵
  PID:9732
- C:\Windows\System\OTCKFTW.exe
  C:\Windows\System\OTCKFTW.exe
  2⤵
  PID:9756
- C:\Windows\System\KxvkqCP.exe
  C:\Windows\System\KxvkqCP.exe
  2⤵
  PID:9776
- C:\Windows\System\WmNxWSx.exe
  C:\Windows\System\WmNxWSx.exe
  2⤵
  PID:9800
- C:\Windows\System\OFFaLlM.exe
  C:\Windows\System\OFFaLlM.exe
  2⤵
  PID:9824
- C:\Windows\System\TFBEDrH.exe
  C:\Windows\System\TFBEDrH.exe
  2⤵
  PID:9856
- C:\Windows\System\kyoJmAR.exe
  C:\Windows\System\kyoJmAR.exe
  2⤵
  PID:9884
- C:\Windows\System\EFVoQNO.exe
  C:\Windows\System\EFVoQNO.exe
  2⤵
  PID:9908
- C:\Windows\System\jPNXkpQ.exe
  C:\Windows\System\jPNXkpQ.exe
  2⤵
  PID:9944
- C:\Windows\System\DleDAkN.exe
  C:\Windows\System\DleDAkN.exe
  2⤵
  PID:9976
- C:\Windows\System\OqmkGvY.exe
  C:\Windows\System\OqmkGvY.exe
  2⤵
  PID:10012
- C:\Windows\System\XEmWHuh.exe
  C:\Windows\System\XEmWHuh.exe
  2⤵
  PID:10036
- C:\Windows\System\qMqLfMV.exe
  C:\Windows\System\qMqLfMV.exe
  2⤵
  PID:10060
- C:\Windows\System\HQOhEJD.exe
  C:\Windows\System\HQOhEJD.exe
  2⤵
  PID:10084
- C:\Windows\System\ioVNthC.exe
  C:\Windows\System\ioVNthC.exe
  2⤵
  PID:10136
- C:\Windows\System\AtsceLp.exe
  C:\Windows\System\AtsceLp.exe
  2⤵
  PID:10156
- C:\Windows\System\cqAihpn.exe
  C:\Windows\System\cqAihpn.exe
  2⤵
  PID:10184
- C:\Windows\System\NCOLVZf.exe
  C:\Windows\System\NCOLVZf.exe
  2⤵
  PID:10200
- C:\Windows\System\ZDkKMpO.exe
  C:\Windows\System\ZDkKMpO.exe
  2⤵
  PID:9236
- C:\Windows\System\xXqNIrS.exe
  C:\Windows\System\xXqNIrS.exe
  2⤵
  PID:9272
- C:\Windows\System\lTjaMXw.exe
  C:\Windows\System\lTjaMXw.exe
  2⤵
  PID:9312
- C:\Windows\System\FaUdMNJ.exe
  C:\Windows\System\FaUdMNJ.exe
  2⤵
  PID:9376
- C:\Windows\System\cCJpSPZ.exe
  C:\Windows\System\cCJpSPZ.exe
  2⤵
  PID:9448
- C:\Windows\System\qSxhiLV.exe
  C:\Windows\System\qSxhiLV.exe
  2⤵
  PID:9492
- C:\Windows\System\FCphXYB.exe
  C:\Windows\System\FCphXYB.exe
  2⤵
  PID:9620
- C:\Windows\System\blroPXM.exe
  C:\Windows\System\blroPXM.exe
  2⤵
  PID:9660
- C:\Windows\System\wNRlKRx.exe
  C:\Windows\System\wNRlKRx.exe
  2⤵
  PID:9744
- C:\Windows\System\vcRYGyD.exe
  C:\Windows\System\vcRYGyD.exe
  2⤵
  PID:9772
- C:\Windows\System\TyiwvJq.exe
  C:\Windows\System\TyiwvJq.exe
  2⤵
  PID:9904
- C:\Windows\System\GZtzkwU.exe
  C:\Windows\System\GZtzkwU.exe
  2⤵
  PID:9896
- C:\Windows\System\crFPRQf.exe
  C:\Windows\System\crFPRQf.exe
  2⤵
  PID:9960
- C:\Windows\System\SAKlBAU.exe
  C:\Windows\System\SAKlBAU.exe
  2⤵
  PID:10076
- C:\Windows\System\onVTnUx.exe
  C:\Windows\System\onVTnUx.exe
  2⤵
  PID:10056
- C:\Windows\System\GqXFnhm.exe
  C:\Windows\System\GqXFnhm.exe
  2⤵
  PID:10168
- C:\Windows\System\PGMRsPO.exe
  C:\Windows\System\PGMRsPO.exe
  2⤵
  PID:10220
- C:\Windows\System\lTcOOQn.exe
  C:\Windows\System\lTcOOQn.exe
  2⤵
  PID:8536
- C:\Windows\System\gaGsPdj.exe
  C:\Windows\System\gaGsPdj.exe
  2⤵
  PID:9432
- C:\Windows\System\DqjHUpR.exe
  C:\Windows\System\DqjHUpR.exe
  2⤵
  PID:9548
- C:\Windows\System\MDZdthF.exe
  C:\Windows\System\MDZdthF.exe
  2⤵
  PID:9728
- C:\Windows\System\ogZHCFO.exe
  C:\Windows\System\ogZHCFO.exe
  2⤵
  PID:9876
- C:\Windows\System\nCbNJZi.exe
  C:\Windows\System\nCbNJZi.exe
  2⤵
  PID:10072
- C:\Windows\System\DEmHCai.exe
  C:\Windows\System\DEmHCai.exe
  2⤵
  PID:8720
- C:\Windows\System\kcuUYxL.exe
  C:\Windows\System\kcuUYxL.exe
  2⤵
  PID:9560
- C:\Windows\System\jQqnERr.exe
  C:\Windows\System\jQqnERr.exe
  2⤵
  PID:9768
- C:\Windows\System\GrjKELI.exe
  C:\Windows\System\GrjKELI.exe
  2⤵
  PID:10152
- C:\Windows\System\mZWwkkk.exe
  C:\Windows\System\mZWwkkk.exe
  2⤵
  PID:10000
- C:\Windows\System\sQmSKlx.exe
  C:\Windows\System\sQmSKlx.exe
  2⤵
  PID:9296
- C:\Windows\System\BoJQmtz.exe
  C:\Windows\System\BoJQmtz.exe
  2⤵
  PID:10264
- C:\Windows\System\QtrBAop.exe
  C:\Windows\System\QtrBAop.exe
  2⤵
  PID:10300
- C:\Windows\System\vpZVgSd.exe
  C:\Windows\System\vpZVgSd.exe
  2⤵
  PID:10324
- C:\Windows\System\nSzQSRp.exe
  C:\Windows\System\nSzQSRp.exe
  2⤵
  PID:10356
- C:\Windows\System\eQeQgXl.exe
  C:\Windows\System\eQeQgXl.exe
  2⤵
  PID:10372
- C:\Windows\System\AaqnIsG.exe
  C:\Windows\System\AaqnIsG.exe
  2⤵
  PID:10388
- C:\Windows\System\XiAkxte.exe
  C:\Windows\System\XiAkxte.exe
  2⤵
  PID:10416
- C:\Windows\System\zzfhHbN.exe
  C:\Windows\System\zzfhHbN.exe
  2⤵
  PID:10468
- C:\Windows\System\yUXQDJs.exe
  C:\Windows\System\yUXQDJs.exe
  2⤵
  PID:10488
- C:\Windows\System\ahrpVal.exe
  C:\Windows\System\ahrpVal.exe
  2⤵
  PID:10524
- C:\Windows\System\guUVboX.exe
  C:\Windows\System\guUVboX.exe
  2⤵
  PID:10552
- C:\Windows\System\nCCwsDX.exe
  C:\Windows\System\nCCwsDX.exe
  2⤵
  PID:10580
- C:\Windows\System\rHcwvkJ.exe
  C:\Windows\System\rHcwvkJ.exe
  2⤵
  PID:10608
- C:\Windows\System\OXjqvkT.exe
  C:\Windows\System\OXjqvkT.exe
  2⤵
  PID:10624
- C:\Windows\System\AwmWiXC.exe
  C:\Windows\System\AwmWiXC.exe
  2⤵
  PID:10656
- C:\Windows\System\VYdziSO.exe
  C:\Windows\System\VYdziSO.exe
  2⤵
  PID:10676
- C:\Windows\System\oBdcAal.exe
  C:\Windows\System\oBdcAal.exe
  2⤵
  PID:10692
- C:\Windows\System\ukVwWfx.exe
  C:\Windows\System\ukVwWfx.exe
  2⤵
  PID:10712
- C:\Windows\System\dxfWqLW.exe
  C:\Windows\System\dxfWqLW.exe
  2⤵
  PID:10764
- C:\Windows\System\GQwzNpw.exe
  C:\Windows\System\GQwzNpw.exe
  2⤵
  PID:10796
- C:\Windows\System\ccBEjeZ.exe
  C:\Windows\System\ccBEjeZ.exe
  2⤵
  PID:10832
- C:\Windows\System\NUMBTHV.exe
  C:\Windows\System\NUMBTHV.exe
  2⤵
  PID:10860
- C:\Windows\System\VYZNyVh.exe
  C:\Windows\System\VYZNyVh.exe
  2⤵
  PID:10876
- C:\Windows\System\wIsjqqe.exe
  C:\Windows\System\wIsjqqe.exe
  2⤵
  PID:10892
- C:\Windows\System\SjmgEzc.exe
  C:\Windows\System\SjmgEzc.exe
  2⤵
  PID:10916
- C:\Windows\System\aisMgjN.exe
  C:\Windows\System\aisMgjN.exe
  2⤵
  PID:10964
- C:\Windows\System\dOasqDm.exe
  C:\Windows\System\dOasqDm.exe
  2⤵
  PID:10996
- C:\Windows\System\bJMdhfL.exe
  C:\Windows\System\bJMdhfL.exe
  2⤵
  PID:11016
- C:\Windows\System\XlJyNyW.exe
  C:\Windows\System\XlJyNyW.exe
  2⤵
  PID:11044
- C:\Windows\System\CDdQzIU.exe
  C:\Windows\System\CDdQzIU.exe
  2⤵
  PID:11068
- C:\Windows\System\mVxNHvi.exe
  C:\Windows\System\mVxNHvi.exe
  2⤵
  PID:11104
- C:\Windows\System\oYHzBRP.exe
  C:\Windows\System\oYHzBRP.exe
  2⤵
  PID:11128
- C:\Windows\System\tIPvGUg.exe
  C:\Windows\System\tIPvGUg.exe
  2⤵
  PID:11168
- C:\Windows\System\NmFQBeE.exe
  C:\Windows\System\NmFQBeE.exe
  2⤵
  PID:11196
- C:\Windows\System\qXrfvJX.exe
  C:\Windows\System\qXrfvJX.exe
  2⤵
  PID:11212
- C:\Windows\System\gKjBObQ.exe
  C:\Windows\System\gKjBObQ.exe
  2⤵
  PID:11244
- C:\Windows\System\JjJHkFL.exe
  C:\Windows\System\JjJHkFL.exe
  2⤵
  PID:10248
- C:\Windows\System\jkPQCgh.exe
  C:\Windows\System\jkPQCgh.exe
  2⤵
  PID:10340
- C:\Windows\System\xGnjGIJ.exe
  C:\Windows\System\xGnjGIJ.exe
  2⤵
  PID:10368
- C:\Windows\System\HHKlDlO.exe
  C:\Windows\System\HHKlDlO.exe
  2⤵
  PID:10432
- C:\Windows\System\ZpLXTOL.exe
  C:\Windows\System\ZpLXTOL.exe
  2⤵
  PID:10596
- C:\Windows\System\BWSBaAU.exe
  C:\Windows\System\BWSBaAU.exe
  2⤵
  PID:10688
- C:\Windows\System\fZrMGww.exe
  C:\Windows\System\fZrMGww.exe
  2⤵
  PID:10744
- C:\Windows\System\AnMemoA.exe
  C:\Windows\System\AnMemoA.exe
  2⤵
  PID:10780
- C:\Windows\System\tbMlNBS.exe
  C:\Windows\System\tbMlNBS.exe
  2⤵
  PID:10868
- C:\Windows\System\OMjBmFb.exe
  C:\Windows\System\OMjBmFb.exe
  2⤵
  PID:10972
- C:\Windows\System\lNLsuNs.exe
  C:\Windows\System\lNLsuNs.exe
  2⤵
  PID:11012
- C:\Windows\System\Pmcdeef.exe
  C:\Windows\System\Pmcdeef.exe
  2⤵
  PID:11060
- C:\Windows\System\uFHvOLT.exe
  C:\Windows\System\uFHvOLT.exe
  2⤵
  PID:11100
- C:\Windows\System\jdGazUF.exe
  C:\Windows\System\jdGazUF.exe
  2⤵
  PID:11160
- C:\Windows\System\AoUBQrn.exe
  C:\Windows\System\AoUBQrn.exe
  2⤵
  PID:11240
- C:\Windows\System\tGLaSTH.exe
  C:\Windows\System\tGLaSTH.exe
  2⤵
  PID:10316
- C:\Windows\System\njoMXKs.exe
  C:\Windows\System\njoMXKs.exe
  2⤵
  PID:10512
- C:\Windows\System\zTGzQCy.exe
  C:\Windows\System\zTGzQCy.exe
  2⤵
  PID:10672
- C:\Windows\System\WIbMRjh.exe
  C:\Windows\System\WIbMRjh.exe
  2⤵
  PID:10740
- C:\Windows\System\nxBDNxI.exe
  C:\Windows\System\nxBDNxI.exe
  2⤵
  PID:10980
- C:\Windows\System\kLdKmxF.exe
  C:\Windows\System\kLdKmxF.exe
  2⤵
  PID:11144
- C:\Windows\System\aSaSluh.exe
  C:\Windows\System\aSaSluh.exe
  2⤵
  PID:11228
- C:\Windows\System\msAKHgi.exe
  C:\Windows\System\msAKHgi.exe
  2⤵
  PID:10520
- C:\Windows\System\ByoSRln.exe
  C:\Windows\System\ByoSRln.exe
  2⤵
  PID:10664
- C:\Windows\System\psXJtZW.exe
  C:\Windows\System\psXJtZW.exe
  2⤵
  PID:11092
- C:\Windows\System\AWpKQgo.exe
  C:\Windows\System\AWpKQgo.exe
  2⤵
  PID:10620
- C:\Windows\System\gNwsCzX.exe
  C:\Windows\System\gNwsCzX.exe
  2⤵
  PID:11276
- C:\Windows\System\LoOumQp.exe
  C:\Windows\System\LoOumQp.exe
  2⤵
  PID:11292
- C:\Windows\System\DJKwrlQ.exe
  C:\Windows\System\DJKwrlQ.exe
  2⤵
  PID:11320
- C:\Windows\System\KgzCqtF.exe
  C:\Windows\System\KgzCqtF.exe
  2⤵
  PID:11368
- C:\Windows\System\YHSCPoi.exe
  C:\Windows\System\YHSCPoi.exe
  2⤵
  PID:11388
- C:\Windows\System\BttmvYL.exe
  C:\Windows\System\BttmvYL.exe
  2⤵
  PID:11412
- C:\Windows\System\VOdOkvg.exe
  C:\Windows\System\VOdOkvg.exe
  2⤵
  PID:11444
- C:\Windows\System\CyzCbUB.exe
  C:\Windows\System\CyzCbUB.exe
  2⤵
  PID:11460
- C:\Windows\System\oUQjWLE.exe
  C:\Windows\System\oUQjWLE.exe
  2⤵
  PID:11500
- C:\Windows\System\NVMIwTa.exe
  C:\Windows\System\NVMIwTa.exe
  2⤵
  PID:11516
- C:\Windows\System\oEoywqK.exe
  C:\Windows\System\oEoywqK.exe
  2⤵
  PID:11544
- C:\Windows\System\mrZxQdt.exe
  C:\Windows\System\mrZxQdt.exe
  2⤵
  PID:11584
- C:\Windows\System\qVafQyO.exe
  C:\Windows\System\qVafQyO.exe
  2⤵
  PID:11624
- C:\Windows\System\cCeCGCf.exe
  C:\Windows\System\cCeCGCf.exe
  2⤵
  PID:11640
- C:\Windows\System\HqZeEHL.exe
  C:\Windows\System\HqZeEHL.exe
  2⤵
  PID:11660
- C:\Windows\System\gyDeWBQ.exe
  C:\Windows\System\gyDeWBQ.exe
  2⤵
  PID:11696
- C:\Windows\System\OIXhnWv.exe
  C:\Windows\System\OIXhnWv.exe
  2⤵
  PID:11720
- C:\Windows\System\OWSjNhp.exe
  C:\Windows\System\OWSjNhp.exe
  2⤵
  PID:11760
- C:\Windows\System\JkHPToy.exe
  C:\Windows\System\JkHPToy.exe
  2⤵
  PID:11776
- C:\Windows\System\yukQpAM.exe
  C:\Windows\System\yukQpAM.exe
  2⤵
  PID:11796
- C:\Windows\System\fAgOIIB.exe
  C:\Windows\System\fAgOIIB.exe
  2⤵
  PID:11840
- C:\Windows\System\uwTHaBh.exe
  C:\Windows\System\uwTHaBh.exe
  2⤵
  PID:11872
- C:\Windows\System\SSFWhnE.exe
  C:\Windows\System\SSFWhnE.exe
  2⤵
  PID:11896
- C:\Windows\System\EHANWLf.exe
  C:\Windows\System\EHANWLf.exe
  2⤵
  PID:11928
- C:\Windows\System\JceTQCj.exe
  C:\Windows\System\JceTQCj.exe
  2⤵
  PID:11956
- C:\Windows\System\DYwNDhm.exe
  C:\Windows\System\DYwNDhm.exe
  2⤵
  PID:11980
- C:\Windows\System\ceBWrXH.exe
  C:\Windows\System\ceBWrXH.exe
  2⤵
  PID:12008
- C:\Windows\System\JzjZxVN.exe
  C:\Windows\System\JzjZxVN.exe
  2⤵
  PID:12032
- C:\Windows\System\SybYCaN.exe
  C:\Windows\System\SybYCaN.exe
  2⤵
  PID:12068
- C:\Windows\System\QpbUzeJ.exe
  C:\Windows\System\QpbUzeJ.exe
  2⤵
  PID:12088
- C:\Windows\System\jUsPleF.exe
  C:\Windows\System\jUsPleF.exe
  2⤵
  PID:12108
- C:\Windows\System\yrifLzf.exe
  C:\Windows\System\yrifLzf.exe
  2⤵
  PID:12152
- C:\Windows\System\HGCXxvC.exe
  C:\Windows\System\HGCXxvC.exe
  2⤵
  PID:12184
- C:\Windows\System\pHelnxr.exe
  C:\Windows\System\pHelnxr.exe
  2⤵
  PID:12224
- C:\Windows\System\HbNUgDA.exe
  C:\Windows\System\HbNUgDA.exe
  2⤵
  PID:12252
- C:\Windows\System\FUPCTvo.exe
  C:\Windows\System\FUPCTvo.exe
  2⤵
  PID:12280
- C:\Windows\System\baKYyeM.exe
  C:\Windows\System\baKYyeM.exe
  2⤵
  PID:10828
- C:\Windows\System\JNxaqjW.exe
  C:\Windows\System\JNxaqjW.exe
  2⤵
  PID:11308
- C:\Windows\System\LKgMBMP.exe
  C:\Windows\System\LKgMBMP.exe
  2⤵
  PID:11380
- C:\Windows\System\tSRkXDf.exe
  C:\Windows\System\tSRkXDf.exe
  2⤵
  PID:11436
- C:\Windows\System\eZAHwVF.exe
  C:\Windows\System\eZAHwVF.exe
  2⤵
  PID:11512
- C:\Windows\System\Vebwtsp.exe
  C:\Windows\System\Vebwtsp.exe
  2⤵
  PID:11612
- C:\Windows\System\uuGrLJZ.exe
  C:\Windows\System\uuGrLJZ.exe
  2⤵
  PID:11668
- C:\Windows\System\NlMsiNp.exe
  C:\Windows\System\NlMsiNp.exe
  2⤵
  PID:11708
- C:\Windows\System\RbwsOve.exe
  C:\Windows\System\RbwsOve.exe
  2⤵
  PID:11792
- C:\Windows\System\JhRcaNC.exe
  C:\Windows\System\JhRcaNC.exe
  2⤵
  PID:11816
- C:\Windows\System\ncEREts.exe
  C:\Windows\System\ncEREts.exe
  2⤵
  PID:11948
- C:\Windows\System\nfHYZTf.exe
  C:\Windows\System\nfHYZTf.exe
  2⤵
  PID:11996
- C:\Windows\System\mxTuztB.exe
  C:\Windows\System\mxTuztB.exe
  2⤵
  PID:12000
- C:\Windows\System\KQSbQth.exe
  C:\Windows\System\KQSbQth.exe
  2⤵
  PID:12136
- C:\Windows\System\MqKDeFq.exe
  C:\Windows\System\MqKDeFq.exe
  2⤵
  PID:12168
- C:\Windows\System\kuckVoD.exe
  C:\Windows\System\kuckVoD.exe
  2⤵
  PID:12236
- C:\Windows\System\GhBwXWb.exe
  C:\Windows\System\GhBwXWb.exe
  2⤵
  PID:11304
- C:\Windows\System\sjFGHpo.exe
  C:\Windows\System\sjFGHpo.exe
  2⤵
  PID:11400
- C:\Windows\System\JKUmpZw.exe
  C:\Windows\System\JKUmpZw.exe
  2⤵
  PID:11620
- C:\Windows\System\HJvYlCi.exe
  C:\Windows\System\HJvYlCi.exe
  2⤵
  PID:11684
- C:\Windows\System\ayybsTV.exe
  C:\Windows\System\ayybsTV.exe
  2⤵
  PID:11892
- C:\Windows\System\CjpNnek.exe
  C:\Windows\System\CjpNnek.exe
  2⤵
  PID:12076
- C:\Windows\System\xqHTBCE.exe
  C:\Windows\System\xqHTBCE.exe
  2⤵
  PID:12164
- C:\Windows\System\clNfbbx.exe
  C:\Windows\System\clNfbbx.exe
  2⤵
  PID:11384
- C:\Windows\System\lsfYmcs.exe
  C:\Windows\System\lsfYmcs.exe
  2⤵
  PID:11716
- C:\Windows\System\kUxyxDA.exe
  C:\Windows\System\kUxyxDA.exe
  2⤵
  PID:8716
- C:\Windows\System\KyEfjuM.exe
  C:\Windows\System\KyEfjuM.exe
  2⤵
  PID:11556
- C:\Windows\System\MKJzLAb.exe
  C:\Windows\System\MKJzLAb.exe
  2⤵
  PID:12300
- C:\Windows\System\vDNwgMX.exe
  C:\Windows\System\vDNwgMX.exe
  2⤵
  PID:12316
- C:\Windows\System\lerOWRA.exe
  C:\Windows\System\lerOWRA.exe
  2⤵
  PID:12332
- C:\Windows\System\WPJujrO.exe
  C:\Windows\System\WPJujrO.exe
  2⤵
  PID:12384
- C:\Windows\System\IZKSqLL.exe
  C:\Windows\System\IZKSqLL.exe
  2⤵
  PID:12412
- C:\Windows\System\xMVWGjl.exe
  C:\Windows\System\xMVWGjl.exe
  2⤵
  PID:12440
- C:\Windows\System\EEGCDCF.exe
  C:\Windows\System\EEGCDCF.exe
  2⤵
  PID:12468
- C:\Windows\System\zqIOWgZ.exe
  C:\Windows\System\zqIOWgZ.exe
  2⤵
  PID:12496
- C:\Windows\System\VKiyRyh.exe
  C:\Windows\System\VKiyRyh.exe
  2⤵
  PID:12512
- C:\Windows\System\ZeGjVLr.exe
  C:\Windows\System\ZeGjVLr.exe
  2⤵
  PID:12540
- C:\Windows\System\iiBbHMj.exe
  C:\Windows\System\iiBbHMj.exe
  2⤵
  PID:12580
- C:\Windows\System\XZiZXWc.exe
  C:\Windows\System\XZiZXWc.exe
  2⤵
  PID:12608
- C:\Windows\System\NLHUdAM.exe
  C:\Windows\System\NLHUdAM.exe
  2⤵
  PID:12636
- C:\Windows\System\WztxHZP.exe
  C:\Windows\System\WztxHZP.exe
  2⤵
  PID:12664
- C:\Windows\System\FyEZLbI.exe
  C:\Windows\System\FyEZLbI.exe
  2⤵
  PID:12692
- C:\Windows\System\OjbpGbw.exe
  C:\Windows\System\OjbpGbw.exe
  2⤵
  PID:12720
- C:\Windows\System\UdWYgBA.exe
  C:\Windows\System\UdWYgBA.exe
  2⤵
  PID:12748
- C:\Windows\System\pQiHYfL.exe
  C:\Windows\System\pQiHYfL.exe
  2⤵
  PID:12768
- C:\Windows\System\vDaOeIu.exe
  C:\Windows\System\vDaOeIu.exe
  2⤵
  PID:12792
- C:\Windows\System\TUIcUpc.exe
  C:\Windows\System\TUIcUpc.exe
  2⤵
  PID:12816
- C:\Windows\System\BywgChd.exe
  C:\Windows\System\BywgChd.exe
  2⤵
  PID:12840
- C:\Windows\System\JXtVLuJ.exe
  C:\Windows\System\JXtVLuJ.exe
  2⤵
  PID:12872
- C:\Windows\System\opIOvNq.exe
  C:\Windows\System\opIOvNq.exe
  2⤵
  PID:12892
- C:\Windows\System\vGBokAg.exe
  C:\Windows\System\vGBokAg.exe
  2⤵
  PID:12928
- C:\Windows\System\EErTAHI.exe
  C:\Windows\System\EErTAHI.exe
  2⤵
  PID:12972
- C:\Windows\System\yEGTFdm.exe
  C:\Windows\System\yEGTFdm.exe
  2⤵
  PID:12988
- C:\Windows\System\BGrfNAD.exe
  C:\Windows\System\BGrfNAD.exe
  2⤵
  PID:13008
- C:\Windows\System\UeaxSiG.exe
  C:\Windows\System\UeaxSiG.exe
  2⤵
  PID:13036
- C:\Windows\System\fkWaHlm.exe
  C:\Windows\System\fkWaHlm.exe
  2⤵
  PID:13072
- C:\Windows\System\StwAHmT.exe
  C:\Windows\System\StwAHmT.exe
  2⤵
  PID:13104
- C:\Windows\System\zCttRkA.exe
  C:\Windows\System\zCttRkA.exe
  2⤵
  PID:13132
- C:\Windows\System\SOwLRnO.exe
  C:\Windows\System\SOwLRnO.exe
  2⤵
  PID:13156
- C:\Windows\System\grhDOMP.exe
  C:\Windows\System\grhDOMP.exe
  2⤵
  PID:13196
- C:\Windows\System\EcyvyOO.exe
  C:\Windows\System\EcyvyOO.exe
  2⤵
  PID:13220
- C:\Windows\System\JtALiNs.exe
  C:\Windows\System\JtALiNs.exe
  2⤵
  PID:13240
- C:\Windows\System\LPZGupz.exe
  C:\Windows\System\LPZGupz.exe
  2⤵
  PID:13276
- C:\Windows\System\EkYAZFB.exe
  C:\Windows\System\EkYAZFB.exe
  2⤵
  PID:13296
- C:\Windows\System\UloErEM.exe
  C:\Windows\System\UloErEM.exe
  2⤵
  PID:12096
- C:\Windows\System\PpsZpyA.exe
  C:\Windows\System\PpsZpyA.exe
  2⤵
  PID:12364
- C:\Windows\System\VMrpkIp.exe
  C:\Windows\System\VMrpkIp.exe
  2⤵
  PID:12452
- C:\Windows\System\NNFRLJc.exe
  C:\Windows\System\NNFRLJc.exe
  2⤵
  PID:12504
- C:\Windows\System\ICLAZBO.exe
  C:\Windows\System\ICLAZBO.exe
  2⤵
  PID:12572
- C:\Windows\System\ewzDFgu.exe
  C:\Windows\System\ewzDFgu.exe
  2⤵
  PID:12628
- C:\Windows\System\knQpuZv.exe
  C:\Windows\System\knQpuZv.exe
  2⤵
  PID:12684
- C:\Windows\System\brKkMGR.exe
  C:\Windows\System\brKkMGR.exe
  2⤵
  PID:8244
- C:\Windows\System\XExAbNq.exe
  C:\Windows\System\XExAbNq.exe
  2⤵
  PID:12780
- C:\Windows\System\koEhNKR.exe
  C:\Windows\System\koEhNKR.exe
  2⤵
  PID:12832
- C:\Windows\System\TVzdZZb.exe
  C:\Windows\System\TVzdZZb.exe
  2⤵
  PID:12980
- C:\Windows\System\JKkFuoz.exe
  C:\Windows\System\JKkFuoz.exe
  2⤵
  PID:13004
- C:\Windows\System\YiljLUS.exe
  C:\Windows\System\YiljLUS.exe
  2⤵
  PID:13088
- C:\Windows\System\kEBYXVp.exe
  C:\Windows\System\kEBYXVp.exe
  2⤵
  PID:13128
- C:\Windows\System\rxoBhBO.exe
  C:\Windows\System\rxoBhBO.exe
  2⤵
  PID:13188
- C:\Windows\System\hNZFAda.exe
  C:\Windows\System\hNZFAda.exe
  2⤵
  PID:13228
- C:\Windows\System\XdmTaSA.exe
  C:\Windows\System\XdmTaSA.exe
  2⤵
  PID:12328
- C:\Windows\System\EUqTvOx.exe
  C:\Windows\System\EUqTvOx.exe
  2⤵
  PID:12528
- C:\Windows\System\VXEYNpV.exe
  C:\Windows\System\VXEYNpV.exe
  2⤵
  PID:12680
- C:\Windows\System\AYnXpZa.exe
  C:\Windows\System\AYnXpZa.exe
  2⤵
  PID:12776
- C:\Windows\System\MAWsjhC.exe
  C:\Windows\System\MAWsjhC.exe
  2⤵
  PID:12948
- C:\Windows\System\gqUnOov.exe
  C:\Windows\System\gqUnOov.exe
  2⤵
  PID:13000
- C:\Windows\System\zGXVffv.exe
  C:\Windows\System\zGXVffv.exe
  2⤵
  PID:13152
- C:\Windows\System\RzcPKww.exe
  C:\Windows\System\RzcPKww.exe
  2⤵
  PID:11268
- C:\Windows\System\uyaphMV.exe
  C:\Windows\System\uyaphMV.exe
  2⤵
  PID:12648
- C:\Windows\System\TnrUnQd.exe
  C:\Windows\System\TnrUnQd.exe
  2⤵
  PID:13048
- C:\Windows\System\HzyNWnt.exe
  C:\Windows\System\HzyNWnt.exe
  2⤵
  PID:13260
- C:\Windows\System\YaXmeDH.exe
  C:\Windows\System\YaXmeDH.exe
  2⤵
  PID:13324
- C:\Windows\System\DdzrgNv.exe
  C:\Windows\System\DdzrgNv.exe
  2⤵
  PID:13348
- C:\Windows\System\jPTFIuE.exe
  C:\Windows\System\jPTFIuE.exe
  2⤵
  PID:13396
- C:\Windows\System\eVqtaMf.exe
  C:\Windows\System\eVqtaMf.exe
  2⤵
  PID:13424
- C:\Windows\System\gVxBnWs.exe
  C:\Windows\System\gVxBnWs.exe
  2⤵
  PID:13452
- C:\Windows\System\MAHerPG.exe
  C:\Windows\System\MAHerPG.exe
  2⤵
  PID:13480
- C:\Windows\System\lANTyGf.exe
  C:\Windows\System\lANTyGf.exe
  2⤵
  PID:13508
- C:\Windows\System\kdrvJyo.exe
  C:\Windows\System\kdrvJyo.exe
  2⤵
  PID:13528
- C:\Windows\System\RPnoToh.exe
  C:\Windows\System\RPnoToh.exe
  2⤵
  PID:13572
- C:\Windows\System\MRatrjR.exe
  C:\Windows\System\MRatrjR.exe
  2⤵
  PID:13600
- C:\Windows\System\DSGGvKZ.exe
  C:\Windows\System\DSGGvKZ.exe
  2⤵
  PID:13636
- C:\Windows\System\AufJugq.exe
  C:\Windows\System\AufJugq.exe
  2⤵
  PID:13664
- C:\Windows\System\LKJzXHE.exe
  C:\Windows\System\LKJzXHE.exe
  2⤵
  PID:13704
- C:\Windows\System\JcQPHIO.exe
  C:\Windows\System\JcQPHIO.exe
  2⤵
  PID:13732
- C:\Windows\System\cToqkql.exe
  C:\Windows\System\cToqkql.exe
  2⤵
  PID:13772
- C:\Windows\System\wqYeNMu.exe
  C:\Windows\System\wqYeNMu.exe
  2⤵
  PID:13800
- C:\Windows\System\QASfJnl.exe
  C:\Windows\System\QASfJnl.exe
  2⤵
  PID:13816
- C:\Windows\System\WFPKPHg.exe
  C:\Windows\System\WFPKPHg.exe
  2⤵
  PID:13832
- C:\Windows\System\KrnqYEq.exe
  C:\Windows\System\KrnqYEq.exe
  2⤵
  PID:13868
- C:\Windows\System\ulTLFlZ.exe
  C:\Windows\System\ulTLFlZ.exe
  2⤵
  PID:13900
- C:\Windows\System\IlPnLyM.exe
  C:\Windows\System\IlPnLyM.exe
  2⤵
  PID:13928
- C:\Windows\System\JkaTLMo.exe
  C:\Windows\System\JkaTLMo.exe
  2⤵
  PID:13956
- C:\Windows\System\SzDmHrb.exe
  C:\Windows\System\SzDmHrb.exe
  2⤵
  PID:13996
- C:\Windows\System\PxJdEOb.exe
  C:\Windows\System\PxJdEOb.exe
  2⤵
  PID:14024
- C:\Windows\System\ilvCylG.exe
  C:\Windows\System\ilvCylG.exe
  2⤵
  PID:14056
- C:\Windows\System\gVrotzM.exe
  C:\Windows\System\gVrotzM.exe
  2⤵
  PID:14072
- C:\Windows\System\XjrpQQz.exe
  C:\Windows\System\XjrpQQz.exe
  2⤵
  PID:14092
- C:\Windows\System\IHNijgx.exe
  C:\Windows\System\IHNijgx.exe
  2⤵
  PID:14140
- C:\Windows\System\ACReWRm.exe
  C:\Windows\System\ACReWRm.exe
  2⤵
  PID:14168
- C:\Windows\System\xONTZCy.exe
  C:\Windows\System\xONTZCy.exe
  2⤵
  PID:14192
- C:\Windows\System\fbwbVAX.exe
  C:\Windows\System\fbwbVAX.exe
  2⤵
  PID:14224
- C:\Windows\System\ciHPPpR.exe
  C:\Windows\System\ciHPPpR.exe
  2⤵
  PID:14252
- C:\Windows\System\LwChsQy.exe
  C:\Windows\System\LwChsQy.exe
  2⤵
  PID:14280
- C:\Windows\System\TWccfEd.exe
  C:\Windows\System\TWccfEd.exe
  2⤵
  PID:14308
- C:\Windows\System\wJroyak.exe
  C:\Windows\System\wJroyak.exe
  2⤵
  PID:14324
- C:\Windows\System\DQICepC.exe
  C:\Windows\System\DQICepC.exe
  2⤵
  PID:13168
- C:\Windows\System\ycRBdUA.exe
  C:\Windows\System\ycRBdUA.exe
  2⤵
  PID:13392
- C:\Windows\System\LVWQYOa.exe
  C:\Windows\System\LVWQYOa.exe
  2⤵
  PID:13464
- C:\Windows\System\CmixoQy.exe
  C:\Windows\System\CmixoQy.exe
  2⤵
  PID:2888
- C:\Windows\System\BhPZLUe.exe
  C:\Windows\System\BhPZLUe.exe
  2⤵
  PID:13540
- C:\Windows\System\OYIkiey.exe
  C:\Windows\System\OYIkiey.exe
  2⤵
  PID:13588
- C:\Windows\System\bTwrFsO.exe
  C:\Windows\System\bTwrFsO.exe
  2⤵
  PID:13716
- C:\Windows\System\WtVpJwu.exe
  C:\Windows\System\WtVpJwu.exe
  2⤵
  PID:13788
- C:\Windows\System\vQMpIVR.exe
  C:\Windows\System\vQMpIVR.exe
  2⤵
  PID:13884
- C:\Windows\System\FoUjyYq.exe
  C:\Windows\System\FoUjyYq.exe
  2⤵
  PID:13920
- C:\Windows\System\goiQWRA.exe
  C:\Windows\System\goiQWRA.exe
  2⤵
  PID:13976
- C:\Windows\System\zLNucgw.exe
  C:\Windows\System\zLNucgw.exe
  2⤵
  PID:14040
- C:\Windows\System\PsLQXCp.exe
  C:\Windows\System\PsLQXCp.exe
  2⤵
  PID:14112
- C:\Windows\System\BKwTfMw.exe
  C:\Windows\System\BKwTfMw.exe
  2⤵
  PID:14156
- C:\Windows\System\nHGoKxm.exe
  C:\Windows\System\nHGoKxm.exe
  2⤵
  PID:14208
- C:\Windows\System\dTwGnOn.exe
  C:\Windows\System\dTwGnOn.exe
  2⤵
  PID:14300
- C:\Windows\System\moMQgEx.exe
  C:\Windows\System\moMQgEx.exe
  2⤵
  PID:13388
- C:\Windows\System\BbafEjk.exe
  C:\Windows\System\BbafEjk.exe
  2⤵
  PID:13524
- C:\Windows\System\XXQCnGI.exe
  C:\Windows\System\XXQCnGI.exe
  2⤵
  PID:13740
- C:\Windows\System\SiwynZb.exe
  C:\Windows\System\SiwynZb.exe
  2⤵
  PID:13760
- C:\Windows\System\IHsJuBF.exe
  C:\Windows\System\IHsJuBF.exe
  2⤵
  PID:13944
- C:\Windows\System\uXQjDeO.exe
  C:\Windows\System\uXQjDeO.exe
  2⤵
  PID:14020
- C:\Windows\System\SXJelPS.exe
  C:\Windows\System\SXJelPS.exe
  2⤵
  PID:14236
- C:\Windows\System\RJVMVSM.exe
  C:\Windows\System\RJVMVSM.exe
  2⤵
  PID:13316
- C:\Windows\System\nDedcGG.exe
  C:\Windows\System\nDedcGG.exe
  2⤵
  PID:14080
- C:\Windows\System\KvDnNyx.exe
  C:\Windows\System\KvDnNyx.exe
  2⤵
  PID:13644
- C:\Windows\System\zeFDKgr.exe
  C:\Windows\System\zeFDKgr.exe
  2⤵
  PID:14212
- C:\Windows\System\crorZfm.exe
  C:\Windows\System\crorZfm.exe
  2⤵
  PID:14364
- C:\Windows\System\iTkbCRX.exe
  C:\Windows\System\iTkbCRX.exe
  2⤵
  PID:14392
- C:\Windows\System\ZHLrjIW.exe
  C:\Windows\System\ZHLrjIW.exe
  2⤵
  PID:14420
- C:\Windows\System\UXEXEMK.exe
  C:\Windows\System\UXEXEMK.exe
  2⤵
  PID:14436
- C:\Windows\System\EeMcuXH.exe
  C:\Windows\System\EeMcuXH.exe
  2⤵
  PID:14464
- C:\Windows\System\vERuYEo.exe
  C:\Windows\System\vERuYEo.exe
  2⤵
  PID:14480
- C:\Windows\System\cQhAaJu.exe
  C:\Windows\System\cQhAaJu.exe
  2⤵
  PID:14504
- C:\Windows\System\nOBRVIZ.exe
  C:\Windows\System\nOBRVIZ.exe
  2⤵
  PID:14544
- C:\Windows\System\WRRusZC.exe
  C:\Windows\System\WRRusZC.exe
  2⤵
  PID:14568
- C:\Windows\System\QfTvpRm.exe
  C:\Windows\System\QfTvpRm.exe
  2⤵
  PID:14588
- C:\Windows\System\DAiIfEB.exe
  C:\Windows\System\DAiIfEB.exe
  2⤵
  PID:14632
- C:\Windows\System\fMBpJZY.exe
  C:\Windows\System\fMBpJZY.exe
  2⤵
  PID:14652
- C:\Windows\System\zMvMcZF.exe
  C:\Windows\System\zMvMcZF.exe
  2⤵
  PID:14684
- C:\Windows\System\tICrEMY.exe
  C:\Windows\System\tICrEMY.exe
  2⤵
  PID:14716
- C:\Windows\System\MccWCUW.exe
  C:\Windows\System\MccWCUW.exe
  2⤵
  PID:14732
- C:\Windows\System\EnHYgQr.exe
  C:\Windows\System\EnHYgQr.exe
  2⤵
  PID:14764
- C:\Windows\System\MtCBUoq.exe
  C:\Windows\System\MtCBUoq.exe
  2⤵
  PID:14788
- C:\Windows\System\pJiQyZj.exe
  C:\Windows\System\pJiQyZj.exe
  2⤵
  PID:14840
- C:\Windows\System\mdpEJAp.exe
  C:\Windows\System\mdpEJAp.exe
  2⤵
  PID:14860
- C:\Windows\System\rLOeaZB.exe
  C:\Windows\System\rLOeaZB.exe
  2⤵
  PID:14892
- C:\Windows\System\YdIYmBz.exe
  C:\Windows\System\YdIYmBz.exe
  2⤵
  PID:14940
- C:\Windows\System\jinDVDK.exe
  C:\Windows\System\jinDVDK.exe
  2⤵
  PID:14956
- C:\Windows\System\liTrBcN.exe
  C:\Windows\System\liTrBcN.exe
  2⤵
  PID:14972
- C:\Windows\System\RYvetOc.exe
  C:\Windows\System\RYvetOc.exe
  2⤵
  PID:15012
- C:\Windows\System\eZsjSsJ.exe
  C:\Windows\System\eZsjSsJ.exe
  2⤵
  PID:15048
- C:\Windows\System\meiiepU.exe
  C:\Windows\System\meiiepU.exe
  2⤵
  PID:15100
- C:\Windows\System\kOWXyNQ.exe
  C:\Windows\System\kOWXyNQ.exe
  2⤵
  PID:15120
- C:\Windows\System\brjnNsP.exe
  C:\Windows\System\brjnNsP.exe
  2⤵
  PID:15156
- C:\Windows\System\DXgWBdZ.exe
  C:\Windows\System\DXgWBdZ.exe
  2⤵
  PID:15172
- C:\Windows\System\ewCFQVF.exe
  C:\Windows\System\ewCFQVF.exe
  2⤵
  PID:15188
- C:\Windows\System\EAIKLxI.exe
  C:\Windows\System\EAIKLxI.exe
  2⤵
  PID:15208
- C:\Windows\System\jyubobM.exe
  C:\Windows\System\jyubobM.exe
  2⤵
  PID:15264
- C:\Windows\System\BlGLNHy.exe
  C:\Windows\System\BlGLNHy.exe
  2⤵
  PID:15292
- C:\Windows\System\ZRTyxIO.exe
  C:\Windows\System\ZRTyxIO.exe
  2⤵
  PID:15356
- C:\Windows\System\jNCBlXG.exe
  C:\Windows\System\jNCBlXG.exe
  2⤵
  PID:14360
- C:\Windows\System\TFovKwZ.exe
  C:\Windows\System\TFovKwZ.exe
  2⤵
  PID:14472
- C:\Windows\System\KMCNPMW.exe
  C:\Windows\System\KMCNPMW.exe
  2⤵
  PID:14528
- C:\Windows\System\hxcMKUy.exe
  C:\Windows\System\hxcMKUy.exe
  2⤵
  PID:14604
- C:\Windows\System\ryXqaDW.exe
  C:\Windows\System\ryXqaDW.exe
  2⤵
  PID:14660
- C:\Windows\System\FhkPLNK.exe
  C:\Windows\System\FhkPLNK.exe
  2⤵
  PID:14832
- C:\Windows\System\WTmbaAd.exe
  C:\Windows\System\WTmbaAd.exe
  2⤵
  PID:14872
- C:\Windows\System\hkiJIhE.exe
  C:\Windows\System\hkiJIhE.exe
  2⤵
  PID:14992
- C:\Windows\System\gosgohU.exe
  C:\Windows\System\gosgohU.exe
  2⤵
  PID:15060
- C:\Windows\System\fVkTMVL.exe
  C:\Windows\System\fVkTMVL.exe
  2⤵
  PID:15180
- C:\Windows\System\NVGjHQH.exe
  C:\Windows\System\NVGjHQH.exe
  2⤵
  PID:15224
- C:\Windows\System\nSZmWPz.exe
  C:\Windows\System\nSZmWPz.exe
  2⤵
  PID:15316
- C:\Windows\System\yPDByTx.exe
  C:\Windows\System\yPDByTx.exe
  2⤵
  PID:14452
- C:\Windows\System\IjbjZJc.exe
  C:\Windows\System\IjbjZJc.exe
  2⤵
  PID:14556
- C:\Windows\System\HnsWxuo.exe
  C:\Windows\System\HnsWxuo.exe
  2⤵
  PID:14876
- C:\Windows\System\SVfYqgR.exe
  C:\Windows\System\SVfYqgR.exe
  2⤵
  PID:15132
- C:\Windows\System\NPOjziV.exe
  C:\Windows\System\NPOjziV.exe
  2⤵
  PID:15232
- C:\Windows\System\jBsgotX.exe
  C:\Windows\System\jBsgotX.exe
  2⤵
  PID:15288
- C:\Windows\System\FgbSJHo.exe
  C:\Windows\System\FgbSJHo.exe
  2⤵
  PID:14916
- C:\Windows\System\XryNmWh.exe
  C:\Windows\System\XryNmWh.exe
  2⤵
  PID:15144
- C:\Windows\System\MEMrVyM.exe
  C:\Windows\System\MEMrVyM.exe
  2⤵
  PID:15376
- C:\Windows\System\eQBAtLt.exe
  C:\Windows\System\eQBAtLt.exe
  2⤵
  PID:15408
- C:\Windows\System\QsMuZng.exe
  C:\Windows\System\QsMuZng.exe
  2⤵
  PID:15448
- C:\Windows\System\fuFSgmH.exe
  C:\Windows\System\fuFSgmH.exe
  2⤵
  PID:15480
- C:\Windows\System\BrwlhOS.exe
  C:\Windows\System\BrwlhOS.exe
  2⤵
  PID:15504
- C:\Windows\System\tXeGdvj.exe
  C:\Windows\System\tXeGdvj.exe
  2⤵
  PID:15528
- C:\Windows\System\lGxhyZb.exe
  C:\Windows\System\lGxhyZb.exe
  2⤵
  PID:15548
- C:\Windows\System\DFGuUMN.exe
  C:\Windows\System\DFGuUMN.exe
  2⤵
  PID:15580
- C:\Windows\System\ltTyyto.exe
  C:\Windows\System\ltTyyto.exe
  2⤵
  PID:15596
- C:\Windows\System\bJILQOE.exe
  C:\Windows\System\bJILQOE.exe
  2⤵
  PID:15612
- C:\Windows\System\ePDUztP.exe
  C:\Windows\System\ePDUztP.exe
  2⤵
  PID:15640
- C:\Windows\System\ttJcIYX.exe
  C:\Windows\System\ttJcIYX.exe
  2⤵
  PID:15668
- C:\Windows\System\wRKNMUe.exe
  C:\Windows\System\wRKNMUe.exe
  2⤵
  PID:15692
- C:\Windows\System\PWvxzZC.exe
  C:\Windows\System\PWvxzZC.exe
  2⤵
  PID:15728
- C:\Windows\System\nhNGKqU.exe
  C:\Windows\System\nhNGKqU.exe
  2⤵
  PID:15796
- C:\Windows\System\JEzEROm.exe
  C:\Windows\System\JEzEROm.exe
  2⤵
  PID:15820
- C:\Windows\System\zxgnVwr.exe
  C:\Windows\System\zxgnVwr.exe
  2⤵
  PID:15860
- C:\Windows\System\RiEcQBq.exe
  C:\Windows\System\RiEcQBq.exe
  2⤵
  PID:15888
- C:\Windows\System\NzoLtHM.exe
  C:\Windows\System\NzoLtHM.exe
  2⤵
  PID:15912
- C:\Windows\System\oHmfKkh.exe
  C:\Windows\System\oHmfKkh.exe
  2⤵
  PID:15936
- C:\Windows\System\BOMJXOd.exe
  C:\Windows\System\BOMJXOd.exe
  2⤵
  PID:16004
- C:\Windows\System\QExGFFT.exe
  C:\Windows\System\QExGFFT.exe
  2⤵
  PID:16020
- C:\Windows\System\GsEKKEP.exe
  C:\Windows\System\GsEKKEP.exe
  2⤵
  PID:16036
- C:\Windows\System\wbPTNcq.exe
  C:\Windows\System\wbPTNcq.exe
  2⤵
  PID:16072
- C:\Windows\System\NACFeBb.exe
  C:\Windows\System\NACFeBb.exe
  2⤵
  PID:16092
- C:\Windows\System\lciRaQi.exe
  C:\Windows\System\lciRaQi.exe
  2⤵
  PID:16116
- C:\Windows\System\xDHdLJw.exe
  C:\Windows\System\xDHdLJw.exe
  2⤵
  PID:16132
- C:\Windows\System\WegxzHW.exe
  C:\Windows\System\WegxzHW.exe
  2⤵
  PID:16172
- C:\Windows\System\hxGfocG.exe
  C:\Windows\System\hxGfocG.exe
  2⤵
  PID:16188
- C:\Windows\System\iCzJszG.exe
  C:\Windows\System\iCzJszG.exe
  2⤵
  PID:16216
- C:\Windows\System\KaVLOmq.exe
  C:\Windows\System\KaVLOmq.exe
  2⤵
  PID:16240
- C:\Windows\System\EQigkEg.exe
  C:\Windows\System\EQigkEg.exe
  2⤵
  PID:16264
- C:\Windows\System\meGFRTA.exe
  C:\Windows\System\meGFRTA.exe
  2⤵
  PID:16300
- C:\Windows\System\XCBczBr.exe
  C:\Windows\System\XCBczBr.exe
  2⤵
  PID:16352
- C:\Windows\System\XfAGwfa.exe
  C:\Windows\System\XfAGwfa.exe
  2⤵
  PID:16376
- C:\Windows\System\smGrwwX.exe
  C:\Windows\System\smGrwwX.exe
  2⤵
  PID:15308
- C:\Windows\System\cIbiZYa.exe
  C:\Windows\System\cIbiZYa.exe
  2⤵
  PID:15428
- C:\Windows\System\HRhsTjG.exe
  C:\Windows\System\HRhsTjG.exe
  2⤵
  PID:15472
- C:\Windows\System\blECqCp.exe
  C:\Windows\System\blECqCp.exe
  2⤵
  PID:15624
- C:\Windows\System\pthpQoI.exe
  C:\Windows\System\pthpQoI.exe
  2⤵
  PID:15592
- C:\Windows\System\rsnBQCw.exe
  C:\Windows\System\rsnBQCw.exe
  2⤵
  PID:15764
- C:\Windows\System\dwHtlgs.exe
  C:\Windows\System\dwHtlgs.exe
  2⤵
  PID:15816
- C:\Windows\System\rISlfwm.exe
  C:\Windows\System\rISlfwm.exe
  2⤵
  PID:15900
- C:\Windows\System\GaDlRva.exe
  C:\Windows\System\GaDlRva.exe
  2⤵
  PID:15960
- C:\Windows\System\kjDiJsm.exe
  C:\Windows\System\kjDiJsm.exe
  2⤵
  PID:16028
- C:\Windows\System\gQOgFfK.exe
  C:\Windows\System\gQOgFfK.exe
  2⤵
  PID:16088
- C:\Windows\System\jJllOnK.exe
  C:\Windows\System\jJllOnK.exe
  2⤵
  PID:16148
- C:\Windows\System\YjyTFeJ.exe
  C:\Windows\System\YjyTFeJ.exe
  2⤵
  PID:16224
- C:\Windows\System\LicLvnh.exe
  C:\Windows\System\LicLvnh.exe
  2⤵
  PID:16196
- C:\Windows\System\jnTmqQJ.exe
  C:\Windows\System\jnTmqQJ.exe
  2⤵
  PID:16372
- C:\Windows\System\vNArDfj.exe
  C:\Windows\System\vNArDfj.exe
  2⤵
  PID:15388
- C:\Windows\System\UtGhlCI.exe
  C:\Windows\System\UtGhlCI.exe
  2⤵
  PID:15576
- C:\Windows\System\TouyRzK.exe
  C:\Windows\System\TouyRzK.exe
  2⤵
  PID:15744
- C:\Windows\System\BXxBGVg.exe
  C:\Windows\System\BXxBGVg.exe
  2⤵
  PID:15944
- C:\Windows\System\kHvIGGy.exe
  C:\Windows\System\kHvIGGy.exe
  2⤵
  PID:16064
- C:\Windows\System\MdFcGMN.exe
  C:\Windows\System\MdFcGMN.exe
  2⤵
  PID:16128
- C:\Windows\System\GNFgfSr.exe
  C:\Windows\System\GNFgfSr.exe
  2⤵
  PID:16252
- C:\Windows\System\roVduam.exe
  C:\Windows\System\roVduam.exe
  2⤵
  PID:15524
- C:\Windows\System\BMCnJif.exe
  C:\Windows\System\BMCnJif.exe
  2⤵
  PID:15844
- C:\Windows\System\giDaGyD.exe
  C:\Windows\System\giDaGyD.exe
  2⤵
  PID:15368
- C:\Windows\System\eYCQdjy.exe
  C:\Windows\System\eYCQdjy.exe
  2⤵
  PID:16124
- C:\Windows\System\kgMZBXJ.exe
  C:\Windows\System\kgMZBXJ.exe
  2⤵
  PID:16408
- C:\Windows\System\oFuqPQK.exe
  C:\Windows\System\oFuqPQK.exe
  2⤵
  PID:16428
- C:\Windows\System\eDtoGmk.exe
  C:\Windows\System\eDtoGmk.exe
  2⤵
  PID:16452
- C:\Windows\System\Onqkvtz.exe
  C:\Windows\System\Onqkvtz.exe
  2⤵
  PID:16480
- C:\Windows\System\wEXqYBB.exe
  C:\Windows\System\wEXqYBB.exe
  2⤵
  PID:16504
- C:\Windows\System\XPLofMG.exe
  C:\Windows\System\XPLofMG.exe
  2⤵
  PID:16524
- C:\Windows\System\VzyqDfP.exe
  C:\Windows\System\VzyqDfP.exe
  2⤵
  PID:16552
- C:\Windows\System\iTCJqIW.exe
  C:\Windows\System\iTCJqIW.exe
  2⤵
  PID:16576
- C:\Windows\System\uIJcFFI.exe
  C:\Windows\System\uIJcFFI.exe
  2⤵
  PID:16608
- C:\Windows\System\YKNeMow.exe
  C:\Windows\System\YKNeMow.exe
  2⤵
  PID:16628
- C:\Windows\System\kvsdvUV.exe
  C:\Windows\System\kvsdvUV.exe
  2⤵
  PID:16664
- C:\Windows\System\YTuNohB.exe
  C:\Windows\System\YTuNohB.exe
  2⤵
  PID:16696
- C:\Windows\System\GzkkvnX.exe
  C:\Windows\System\GzkkvnX.exe
  2⤵
  PID:16720
- C:\Windows\System\hksmnmN.exe
  C:\Windows\System\hksmnmN.exe
  2⤵
  PID:16736
- C:\Windows\System\rKnQaXe.exe
  C:\Windows\System\rKnQaXe.exe
  2⤵
  PID:16800
- C:\Windows\System\YjmNzzK.exe
  C:\Windows\System\YjmNzzK.exe
  2⤵
  PID:16828
- C:\Windows\System\imINdpv.exe
  C:\Windows\System\imINdpv.exe
  2⤵
  PID:16852
- C:\Windows\System\mBmZvIX.exe
  C:\Windows\System\mBmZvIX.exe
  2⤵
  PID:16872
- C:\Windows\System\QsyMyPg.exe
  C:\Windows\System\QsyMyPg.exe
  2⤵
  PID:16888
- C:\Windows\System\oFMJFMa.exe
  C:\Windows\System\oFMJFMa.exe
  2⤵
  PID:16924
- C:\Windows\System\GmyLRfK.exe
  C:\Windows\System\GmyLRfK.exe
  2⤵
  PID:16948
- C:\Windows\System\lNReaPL.exe
  C:\Windows\System\lNReaPL.exe
  2⤵
  PID:16976
- C:\Windows\System\quuixTO.exe
  C:\Windows\System\quuixTO.exe
  2⤵
  PID:17024
- C:\Windows\System\xdPcibd.exe
  C:\Windows\System\xdPcibd.exe
  2⤵
  PID:17040
- C:\Windows\System\eZQxBsq.exe
  C:\Windows\System\eZQxBsq.exe
  2⤵
  PID:17080
- C:\Windows\System\somDljo.exe
  C:\Windows\System\somDljo.exe
  2⤵
  PID:17100
- C:\Windows\System\YeiRFyJ.exe
  C:\Windows\System\YeiRFyJ.exe
  2⤵
  PID:17124
- C:\Windows\System\YLcjXOq.exe
  C:\Windows\System\YLcjXOq.exe
  2⤵
  PID:17164
- C:\Windows\System\uBWVBps.exe
  C:\Windows\System\uBWVBps.exe
  2⤵
  PID:17192
- C:\Windows\System\LSNnRYx.exe
  C:\Windows\System\LSNnRYx.exe
  2⤵
  PID:17208
- C:\Windows\System\CdqVGhj.exe
  C:\Windows\System\CdqVGhj.exe
  2⤵
  PID:17236
- C:\Windows\System\pHRvHyz.exe
  C:\Windows\System\pHRvHyz.exe
  2⤵
  PID:17264
- C:\Windows\System\SNPdJWf.exe
  C:\Windows\System\SNPdJWf.exe
  2⤵
  PID:17284

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BxgsEcv.exe

Filesize
1.8MB

MD5
610198ba44b840c95ae6cd2af5029482

SHA1
f2eb9dc69d65800521e0b9fb7a903ace2eddc7b0

SHA256
257be0891384777da18e7db3d9874cf99b9827de3fd5cb49863858df19f775d3

SHA512
75d025f860646c391521c3998d17772a5bf94b8fc65c734fc45c352784d6aa21e76371c3537ce43ba6bc22001f96dad9e54e189480a4fe3d2498d3a993145337

Download Submit
C:\Windows\System\BzbtdkX.exe

Filesize
1.8MB

MD5
7583db143bb15a377bf70d52c67e1eb2

SHA1
e677d9259c8635a85a3c754313b54f1b7151d660

SHA256
056726ae632d89f5714952aba29c631779a537b26372aa37586681cc8fbce0b0

SHA512
74fcc2c97fe97bbb3ab657a43a68776668454079044eabb49fd9f9a41f3786afb07c8a82d4884c33846acf1849ec5c1054f42569c26676c01fa4e8e4bfc7024e

Download Submit
C:\Windows\System\CVybxDv.exe

Filesize
1.8MB

MD5
4456558c226368dc33b2924557d701f9

SHA1
10d5e7ea69991f666c2929add4670ea801c29033

SHA256
161577fc1685a9eadcfcf69a8826ec3c88de4761c6711fad0651c6f8a49b7a17

SHA512
cc4bb19d786bc9a6909d15d2bdfb1966d58db092debe6a700492d80aabebc83fc7d8985a459803e763666df37d23edd3bbc2cd60923087a0eb967496f8d4269b

Download Submit
C:\Windows\System\DNWaTNl.exe

Filesize
1.8MB

MD5
e69bb78dd7b68100c2cde373c42c4091

SHA1
513815ff9a7f12c86231d8b94676dc75ab544fae

SHA256
a9c92997dd9281222a5d5940c77aabf85b4fbf8c4145de5a2f371011ebdad40e

SHA512
a8598a1aacd5a2c8c9df81bc4783876b026b4ec578ffa707ac05bbbe35d76fd4b7a7d5a26d8e7980d56f33815b37909d46fc5998544518e6b0d0404a5ba0fc22

Download Submit
C:\Windows\System\DQAfugy.exe

Filesize
1.8MB

MD5
b6bfcff84535da295d02ea6053d4afe6

SHA1
4dce3a199a6d214e0175864d548986f83f95fc6b

SHA256
842aea79598abb28e6efa83056363d0e94aa8d41849ac1760a6c901a8fb06886

SHA512
a35c34e01ba6e5ce5e9900ab06680b105c2fea7ccca286b469a1af3fa824794df78bb337b181ef8aceefc411b8e86c05dfbf23df151a869ce11e8cb9bbbee10f

Download Submit
C:\Windows\System\Dlbwbzz.exe

Filesize
1.8MB

MD5
24bb92926899e3a1df975350909660b9

SHA1
4453fcc43dfe04c456c085da1165adfbe989f397

SHA256
8ef856c57e43faac516f7816e2cca176b5dfd877aea3dd444c86f400bd35577a

SHA512
e578b81b82b3887ed53bd79e58c6f79db85230af69d7a00d064172e156524cc78b9eccea904ba4eca65a5a80778641afe938624a23fc4f44239425bb71b4909e

Download Submit
C:\Windows\System\GbOcoIZ.exe

Filesize
1.8MB

MD5
f88f35221dbfc4a6fd8444011cdc75ac

SHA1
5b5a1053138dd5f1e32976611ad8a1ead20ade48

SHA256
ceecfeb80da1990d8aeac084df06845502ef4ffe780da5fb1ae8340fa285b2d2

SHA512
67048bf8a16c53ce7245e2d0d15353030ab362fe9939b9f1d67140f3a66df4aca4ec365833fe317d20d92975c6160133e803200899d4bf4e062c18f3e6d6ee72

Download Submit
C:\Windows\System\IEBIpRz.exe

Filesize
1.8MB

MD5
e45a83c118c93d42dc898d6f9af80205

SHA1
5ba1fb10e477f8f5f566301e11bd7ca9becceb1b

SHA256
dfc970cd8e690b7e1f53c5c5d836e33a45e71e9660a163a9aba6ec6a26fcc3a3

SHA512
7be97014490115d9ac4163e0822b029dedd8025be7b9f29724475525a83123678290cefc29e8b6d5c87868a380b97c1e21e56767156abcbeeae43dbae316d603

Download Submit
C:\Windows\System\IwnSVXU.exe

Filesize
1.8MB

MD5
200e3e42334b9df50eb8e6df77e623cb

SHA1
b7185dec47e7a5b440aafad7dd00769438bbf900

SHA256
df2d1f926b5f3192c887d809c212b92bcd717fd20badf30de9be6bc5ffd734d5

SHA512
713661497e1282bd91c5aa7fab32b16fcfafad768c139365041b1422efecb289e2514444923a6615fabf7ebd3cfc4769be425f742e4f09cc22f2e6ff899b0ca6

Download Submit
C:\Windows\System\KkVbfNa.exe

Filesize
1.8MB

MD5
5db2ba9f999ebad63b84cfa5844fe473

SHA1
85ec61a2cecdb17b3ec306f330cacade18f2a664

SHA256
5cf8598b51be215cb1ff4c4164839a54734e5f40723751e18932da1f6735ba46

SHA512
b7ab4d4768d0b938fccbe4885d31095dbb86efc3d04d0d940a32b50a409c699f6e570f00f981aa8caca6fa98699b5201b5ff72e1127b4ae5e1ce9ca3849a9085

Download Submit
C:\Windows\System\LZzoFOH.exe

Filesize
1.8MB

MD5
0e468289fa3cd38eafef037380d025b0

SHA1
9ba17810a8ada1b44ebcb6b7486ada7fc4a85b5f

SHA256
d2baa45f77250add981a5477c0ab296c0f8da62e3ad8c337069b0c3b3ce3ab84

SHA512
ef46efdc7d5dd05209ab134ae5e6d99a509653075d62362339f644e3fe02984fb191ee39a3a9b2f525cc96f65c91a781f89a140a2e7839c9a4045144804e828f

Download Submit
C:\Windows\System\MVdAwKm.exe

Filesize
1.8MB

MD5
79a07da9936b79d93e9bb99ca938cace

SHA1
0698487c8ccc936cd6b64865b3c0d437f4d41993

SHA256
760664dc938756cbaaa671475e5f0bbc71689975a3e7507684a328de767539a8

SHA512
360045043bc9a5473a8fe785748356a9cded5d201e9c5de138c4c0b1eb806622a6dc047d602961f272d386e15d6efc0a3e55d09fc62fe7b754b76fe78c3b4b38

Download Submit
C:\Windows\System\MglhhSL.exe

Filesize
1.8MB

MD5
3dee68f4b8d09a18efacef9ec9141605

SHA1
88aa3348244e4381f021a934de6f8fdff0714ba9

SHA256
55f2401e45283c5f414c64518c164b2b2a0861fcf7f64f723711977d74a2640b

SHA512
9c1225f397fdf2de4bb58113044a43061b6c29f87199c04568c089f488ee6b4a7564e90745fa5d4aee460ad1f2292d03eb13744710710a93a7571bb70440ebf6

Download Submit
C:\Windows\System\NoRqimd.exe

Filesize
1.8MB

MD5
3dab2ee24abf38d39f4783999d265154

SHA1
67c15149c6afa3f3642d33110d2e95c9481f79e4

SHA256
8fc1f603b6a1371d8ab29ea73b93c3dcde4057356ed99dee37d2ceac55a365a5

SHA512
513fa46c673d47886903155b64b70c8fc13a3d81397672dd8b7e79c0d084da25346cac6fe8a365f5ca28f0b4c48b96f71549c97a90a2d7bf8d2049a9403cb8fa

Download Submit
C:\Windows\System\PYpqgly.exe

Filesize
1.8MB

MD5
ecc03918bdf41bc963a8589731c4fb22

SHA1
edbdebb587a5808f83a5038fdb16489de4c4cfee

SHA256
d3ffc1827c924ccc811a4caf47e272a87d3910c896611aa6513dd54c9230a3f7

SHA512
2450c20132d7b9ae3bc445267853e4ccc4213892339e4a55b3fa70dac85e1a47b00fd55f37a11b6eb3fc56ede7d32ccc3841eb182ee984b2163452be87a0860b

Download Submit
C:\Windows\System\PsxHrVx.exe

Filesize
1.8MB

MD5
94df30f429c567570b694d3dd7f02b2a

SHA1
7168d9802b22ed33f6ccba4f40751374169d840b

SHA256
e0326a59ace791548ecf2e7f205ce1201e2a46ece5272fbccd4b139944d9b143

SHA512
ea630057aa119162ce97139e8ed8b834052ad41a59d0d6178d9f13477b57f57bf2aab2484fdae708644787153bc04f38d5d7cbbc48b87dec7697aef43469595f

Download Submit
C:\Windows\System\SlpMYeK.exe

Filesize
1.8MB

MD5
a5e85630b9990acbf1d6618fc16ac138

SHA1
6190c1f11f1a5033211f7a6fc34c1004bd468250

SHA256
e8ac20089be1747d8e048cf116d7adb66b0463bc5130b3a32a4a49fb73ac2d42

SHA512
6548d8eb1e1e0c39be658d63134f1fb802043a34984016edd693431866c1b798933d457224211a1a01c4332791408c4dfce434d4eec9c8d6c46c0062688b900b

Download Submit
C:\Windows\System\TSkzqTo.exe

Filesize
1.8MB

MD5
3e30e701ed7a659dacce59d64905ed08

SHA1
f46b5693aa6d88af101864e6b861c19f2e064c22

SHA256
91a722ebab8fa4299f36d128312109a23e7e68c2c0ee68f3055bcefecd9c6574

SHA512
a3c8e6617f2b5680de3720ea3107ef8962f95fa0140c15ceec6eafbd6d2ab7d0951fc81645ac003aaac208c333f4c8f45736246274999c4629f9ccb90c732125

Download Submit
C:\Windows\System\UEqAJUZ.exe

Filesize
1.8MB

MD5
809e112a10557ce702d259dd86e3ef6e

SHA1
d23f9c1a397003ff1338639a9dee5c4d6816854a

SHA256
8b27d74249847e912875c9c4695ee9a619dcd93cc6a66f68f9267b5785387801

SHA512
914f228031b94eaf52d7d1e1494ffc16ea40e488bd96f63b2b81aa8f2fd2799fb83796e94d23205c50dd3a9543166dcc79316b7f59762620e693d482ef17eb49

Download Submit
C:\Windows\System\VwyDijg.exe

Filesize
1.8MB

MD5
768acfa768bbec5c3ce3729f22901729

SHA1
5c80e6846690d95374b0a0d288a0ad78c3bd7fe4

SHA256
dbc4ceec590ff1cb68c05b02fa874b9b344b1f5a9dd89977bf48bf914206a339

SHA512
6aa8580c8010e79dd23fc856e8407fe00daa59917944e68f5252162183675d0dd1f14d4d091749708c696d655039c87f16006228218f0b3e5d01fb9a7ef2af8e

Download Submit
C:\Windows\System\YgKzsmU.exe

Filesize
1.8MB

MD5
8f6958c698ba451c315bbc567bb4c457

SHA1
3b194de40fe2477e0110670adfa8a8e0077933f9

SHA256
3272ab1f0876ba882fc3838347dc959515aaadd8b83c62ee2b23a49510e7ae13

SHA512
eece8128faa6328ff579a71d53a339b6868a9ed3c8ab4f1e7bcb3fad720ecdc7411fb31ea5c9190d47d875529d8f7e9b255dcbdd0943110690e4cb639d415b2d

Download Submit
C:\Windows\System\YmZqIco.exe

Filesize
1.8MB

MD5
54fb376ead384b5653cf8cda3961f5e4

SHA1
284f2d063ee67f893d74608cf7b83f305c121d92

SHA256
a0ab1f4b967ff82e6ffeac94b80be1d3a7c84762f14d0990a608278bde140dda

SHA512
81029c643cf55e9339f143d96748764c2a5d7f6b837de03807d84a2bfdacdb8796e82ea63427eba5543dcec10043b8308d9f8f79fb390812e391c534bb77d66e

Download Submit
C:\Windows\System\ZbsNGMS.exe

Filesize
1.8MB

MD5
dc63993b5e8abc0c2d09847223551be2

SHA1
ab5849584db3e10ec9c275fc73766b62127fb994

SHA256
bffce7048eee33a5eee16eab8b3fad8e44e5a96e81b07775ec95bd829005e713

SHA512
d716e65c0ad457bef00f936f329af21cf7b037cbdef5326efb5dc88a4057e46e90e41c81eac006f58502c9bf2d573616a0053aee5e7e5941466d461bad536c18

Download Submit
C:\Windows\System\cIxEowi.exe

Filesize
1.8MB

MD5
5579c21cf0e438c1630fc5fa0f0bcc47

SHA1
ec9902939a0987ff3ea799d7bbc76f85587a7fc5

SHA256
97574b0b09847eb81abbf3ff975d316df5d29e241978b1fecf541bab059b493a

SHA512
56f0dd2fa621c3851efc505c50b18744d28ab1484c373f75da23f2bbeb8fc68ee7f9bd14f5719fd9ad6a6ba1d2d51a02ae01a0e291797be03cfaaaf284fa10d1

Download Submit
C:\Windows\System\czsdXrh.exe

Filesize
1.8MB

MD5
54d989145d0cae45d92834a03d608c2f

SHA1
bb5b49fa9ed720ffe41ae50e1777f5855b8f2839

SHA256
c97752a78a11f0dedd31bcafedfb5311ba8d84d51b6fcf0117ee7534007f37c5

SHA512
5f15971d6c77770eda3036b597407c4cd57e00a663d26100975fadd10d5ae56b2e717a3ac833dc0f96089e7f0accfc3e3a95e4887abc3ac3b30ca77f17e5bdea

Download Submit
C:\Windows\System\ffzBDjL.exe

Filesize
1.8MB

MD5
95b31773596e002beb914f7546e70cbe

SHA1
b81132e7166ad044fe061dc88fe19dee98350f9c

SHA256
f726b14f5957295ca4b3465e067fa9f831f24b0e45a5fd8c59c9a9725c1ccc25

SHA512
63735f2be09587f36f8d7033e70792a6c22cf6f47881ce381d1b967d0d54a89e23475f5ee673150d7ee76abec7d5030aa7f1d504151d81c1e49c2f91bcc89313

Download Submit
C:\Windows\System\klZVlwV.exe

Filesize
1.8MB

MD5
7a58115ba97e2fdae226792098b5d63e

SHA1
25e756a858bdc407904a716bf85007bc220d4902

SHA256
dbd79087c35a4158d88c84dcaa5e3c29e7cc5d45997383de9d510047b7480e5e

SHA512
ec652cf85d1941915f4e41fe46813b657ccf3c73dcad0fe1fd877fba63d21b339bceedcad67aff36a8adddb928f145f917b65e602469e28b15cea48588a68069

Download Submit
C:\Windows\System\mLCMYGR.exe

Filesize
1.8MB

MD5
f425c9e3f4d8d7db3efad640aeeeba69

SHA1
ff7e81423a52256beaaf8028f7eb5b7316a6fce1

SHA256
fd4cfbc49976ed4150aafc17373a5cddd27b422bc4710f925a756aa8a89c4c3d

SHA512
404b7ea4ae0e2fe9d8ee057f7b532ea2a82c6dae4b1f72bd8f52491de7dc798275f3e93ce4deefa784d7dc8ac1d816493fcc76b2c0b7bbbd51f2908be8ac7a20

Download Submit
C:\Windows\System\odYiiSH.exe

Filesize
1.8MB

MD5
3640b07db69a966f7836a378816a0517

SHA1
f8ea689dcd1ec5e0cf715bdafdfb1523999e4413

SHA256
22e17aa5ea6fd5f256470edd75838699e09382ccffeb5a1681d516a2ef09d814

SHA512
5483d91108d4f09e8b75541904b93b27a7746ebea517607d54d3b843e46c4affbcba42889ca89f567cd75cf1382b1682bbe3d720b9e36bc074a94d674f81e4b3

Download Submit
C:\Windows\System\vHWZxVg.exe

Filesize
1.8MB

MD5
b17d471180d892012b46a2f27523bf93

SHA1
b5b9e59c03ccd29f64ba3b9b89e6f8571f841e5b

SHA256
a6f7d3d2682a4325f423e222eb9aadf8ecdd52e9eb2744df7f615fc5e82a3dca

SHA512
dc7b8d96e6b6e074515912a9bc6924c8dcb686070d05ff40ad4ea0981a0500d761c9afcaed8b395deb3b60078e7afc70fd479869714f84aa9356fc4cc2fe7517

Download Submit
C:\Windows\System\xKttfFS.exe

Filesize
1.8MB

MD5
464807b59d2ceef75d314906a145b69b

SHA1
946aa2530ed15eb36f9a6351f6a5ce32500f1181

SHA256
f002a4b3ddb40c89b72bb60f431aa96ac3a68cb840e47d391807334211ea1f33

SHA512
ee73bda3126dcd221a586efa0efa336e79f11452dd5cd57bd4b0b5535067a1fc630337da36119affc640bb729d6a0297c7ffc78e32010d064261c944b7199e17

Download Submit
C:\Windows\System\xscsnpT.exe

Filesize
1.8MB

MD5
aa27c7765b40070eae4ec101b2d2c686

SHA1
8c3d062e0d1670231eeb8a896ddc7fcee9913853

SHA256
34e4b59f326310823c1ef63db65512877d662329868ddd022e64179b409e5793

SHA512
ef6266a896e0af884ad452f35ebda57229eda69639fdde467ff897ab729f42fc61ad37f38152dc11df99b65c885bc151725db4e2df6fba7399f1189121d5940a

Download Submit
C:\Windows\System\zYRMPPv.exe

Filesize
1.8MB

MD5
fa6edd3e90c9adbd4b5f23c24898b378

SHA1
2e3da45a8394360b853ea59a6b086373aa1b1945

SHA256
2e878f00c035071541c15ebc527799e33df614a002efcd6ee5fe9ccbb17b3b07

SHA512
5c81228cbeb2bf7a66f965fa9a5257cc2f2f3b8b7e31946e5b0b474c5c7ff1cf7cdac6f18351fbda83ee24dbec0f861095442def817106215355a76ace8c251d

Download Submit
memory/4820-0-0x0000014CEFE50000-0x0000014CEFE60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads