xmrig | 12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab

Analysis

max time kernel
120s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
Size

1.3MB
MD5

bb894cba3ebc6f31ca9e22ae1857e625
SHA1

bf2919ec8982149f2815b8b0adfe10f47b72bda4
SHA256

12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab
SHA512

95f47feb3ee5f0221e9b2ee65d022632379d1b946e60e6e6ce38eea4473c88b9b163c6ae8303a1ece4f2d2c779cc9423bc35256cad2fdfd3e8a6f38255598d7a
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPqZSso:GezaTF8FcNkNdfE0pZ9ozttwIRROso

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b1a-4.dat	xmrig
behavioral2/files/0x000a000000023b7b-7.dat	xmrig
behavioral2/files/0x000b000000023b77-9.dat	xmrig
behavioral2/files/0x000a000000023b7c-19.dat	xmrig
behavioral2/files/0x000a000000023b7e-27.dat	xmrig
behavioral2/files/0x0031000000023b80-30.dat	xmrig
behavioral2/files/0x0031000000023b7f-31.dat	xmrig
behavioral2/files/0x0031000000023b81-36.dat	xmrig
behavioral2/files/0x000a000000023b83-47.dat	xmrig
behavioral2/files/0x000a000000023b82-48.dat	xmrig
behavioral2/files/0x000a000000023b84-54.dat	xmrig
behavioral2/files/0x000b000000023b78-57.dat	xmrig
behavioral2/files/0x000a000000023b85-64.dat	xmrig
behavioral2/files/0x000a000000023b88-76.dat	xmrig
behavioral2/files/0x000a000000023b87-75.dat	xmrig
behavioral2/files/0x000a000000023b89-85.dat	xmrig
behavioral2/files/0x000a000000023b86-72.dat	xmrig
behavioral2/files/0x000a000000023b8a-88.dat	xmrig
behavioral2/files/0x000a000000023b8c-98.dat	xmrig
behavioral2/files/0x000a000000023b8d-101.dat	xmrig
behavioral2/files/0x000a000000023b8e-104.dat	xmrig
behavioral2/files/0x000a000000023b8f-107.dat	xmrig
behavioral2/files/0x000a000000023b90-115.dat	xmrig
behavioral2/files/0x000a000000023b91-119.dat	xmrig
behavioral2/files/0x000a000000023b92-122.dat	xmrig
behavioral2/files/0x000a000000023b93-129.dat	xmrig
behavioral2/files/0x000e000000023a44-134.dat	xmrig
behavioral2/files/0x000a000000023b94-139.dat	xmrig
behavioral2/files/0x000a000000023b95-144.dat	xmrig
behavioral2/files/0x000a000000023b96-149.dat	xmrig
behavioral2/files/0x000b000000023a40-158.dat	xmrig
behavioral2/files/0x000a000000023b97-160.dat	xmrig
behavioral2/files/0x000f000000023a42-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
852	vwWFzdv.exe
2236	kbJvVMC.exe
1488	ZflrbYn.exe
4904	CvtJbOa.exe
2820	kphhwfr.exe
1904	LBYcfXp.exe
3360	hBbbhVU.exe
4092	sLmCSqg.exe
3052	lOxnwVz.exe
4220	WnCatbh.exe
4296	JwSEykP.exe
2456	EuWwSqt.exe
1480	DWUfroM.exe
432	xCeavaq.exe
3868	MsWeveN.exe
4764	ZkQqQMQ.exe
2312	GbLpjva.exe
2080	rZHrnes.exe
2932	gNVLQGC.exe
3244	tbRZdzM.exe
2816	ammukyB.exe
636	iXtxFWQ.exe
1840	IgkUwNv.exe
1608	sDSxBso.exe
2324	bxPGQvp.exe
4416	YVTolcF.exe
2004	nxdVvxl.exe
912	zKpoqSH.exe
1448	XuSWZmF.exe
424	RgFVaCp.exe
2800	RAaZWrm.exe
2984	pPYWNsx.exe
2124	kpRDLbk.exe
764	FMQJHgN.exe
880	RTeAezF.exe
5052	KkSIVlt.exe
3592	bkjMaZc.exe
4848	DBPTNda.exe
4964	YZcBlnn.exe
3380	EPansSH.exe
3932	sNJQkad.exe
2752	XkiBTTG.exe
3816	BRZRBcV.exe
3008	luKoHeb.exe
3680	fwqYiYu.exe
4148	QDUHtkp.exe
3648	TEmdNiX.exe
1828	maMzCkM.exe
2592	oZgnAdk.exe
2224	CSrSvtO.exe
4192	mygCeak.exe
4144	qWSwJDa.exe
3348	kAnBGSc.exe
4756	uPHXUUC.exe
1216	PZWfwvO.exe
2132	KjQKEaP.exe
980	sXjxVTd.exe
5028	IcdnCVy.exe
4056	EXmSYuD.exe
3908	eNJaBMe.exe
5084	YERIitr.exe
3004	PSNyNwA.exe
3140	lgKLNvE.exe
4140	IcGYvTt.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IqmQqdV.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\srhunzZ.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\FeRtfVl.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\CYLpqUV.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\OrRmxTe.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\dEXJzkT.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\vofwsGH.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\ZvJHjAm.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\xTtRMAd.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\maMzCkM.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\FeyNiqu.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\YzxBkbf.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\bBZPYUT.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\oevGSRU.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\GZzeseT.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\UYtIjEf.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\lTlfiIm.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\CRYOcEg.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\oZgnAdk.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\UhvbhID.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\BLERdYr.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\nxdVvxl.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\XRBwhip.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\ArcHXYS.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\vQEhBwD.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\YVTolcF.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\iijHkLe.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\CShzAsF.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\yOgfNQk.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\OIpricn.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\lgUXweR.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\onMLwCB.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\GWvmEUl.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\TcLRSAd.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\gOSWnWn.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\RJslxKc.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\dZfgHKj.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\IzZlQPa.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\ruzEhXh.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\cwuUHSv.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\mudjmPc.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\miyTbYr.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\nvuyaFj.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\eXzlwYY.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\VGectlq.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\EMjACAm.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\LVALarE.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\IGsEcqB.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\pkSBtff.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\aVXmSch.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\GbWTFcW.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\bUuJWwb.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\JDgcAEB.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\XtJOBdy.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\mBRmxwY.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\kgZpfGN.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\mmzjAEZ.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\jSbSqSl.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\hloCRSO.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\TctMrEQ.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\PdLDQBP.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\zhXLAtX.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\wtvAjwA.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
File created	C:\Windows\System\CdYPXOb.exe	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16844	dwm.exe
Token: SeChangeNotifyPrivilege	16844	dwm.exe
Token: 33	16844	dwm.exe
Token: SeIncBasePriorityPrivilege	16844	dwm.exe
Token: SeShutdownPrivilege	16844	dwm.exe
Token: SeCreatePagefilePrivilege	16844	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 852	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	84
PID 728 wrote to memory of 852	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	84
PID 728 wrote to memory of 2236	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	85
PID 728 wrote to memory of 2236	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	85
PID 728 wrote to memory of 1488	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	86
PID 728 wrote to memory of 1488	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	86
PID 728 wrote to memory of 4904	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	87
PID 728 wrote to memory of 4904	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	87
PID 728 wrote to memory of 2820	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	88
PID 728 wrote to memory of 2820	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	88
PID 728 wrote to memory of 1904	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	89
PID 728 wrote to memory of 1904	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	89
PID 728 wrote to memory of 3360	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	90
PID 728 wrote to memory of 3360	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	90
PID 728 wrote to memory of 4092	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	91
PID 728 wrote to memory of 4092	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	91
PID 728 wrote to memory of 3052	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	92
PID 728 wrote to memory of 3052	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	92
PID 728 wrote to memory of 4220	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	93
PID 728 wrote to memory of 4220	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	93
PID 728 wrote to memory of 4296	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	96
PID 728 wrote to memory of 4296	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	96
PID 728 wrote to memory of 2456	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	97
PID 728 wrote to memory of 2456	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	97
PID 728 wrote to memory of 1480	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	98
PID 728 wrote to memory of 1480	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	98
PID 728 wrote to memory of 432	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	100
PID 728 wrote to memory of 432	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	100
PID 728 wrote to memory of 3868	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	101
PID 728 wrote to memory of 3868	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	101
PID 728 wrote to memory of 4764	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	102
PID 728 wrote to memory of 4764	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	102
PID 728 wrote to memory of 2312	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	103
PID 728 wrote to memory of 2312	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	103
PID 728 wrote to memory of 2080	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	104
PID 728 wrote to memory of 2080	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	104
PID 728 wrote to memory of 2932	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	105
PID 728 wrote to memory of 2932	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	105
PID 728 wrote to memory of 3244	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	106
PID 728 wrote to memory of 3244	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	106
PID 728 wrote to memory of 2816	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	107
PID 728 wrote to memory of 2816	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	107
PID 728 wrote to memory of 636	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	108
PID 728 wrote to memory of 636	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	108
PID 728 wrote to memory of 1840	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	109
PID 728 wrote to memory of 1840	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	109
PID 728 wrote to memory of 1608	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	110
PID 728 wrote to memory of 1608	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	110
PID 728 wrote to memory of 2324	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	111
PID 728 wrote to memory of 2324	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	111
PID 728 wrote to memory of 4416	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	112
PID 728 wrote to memory of 4416	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	112
PID 728 wrote to memory of 2004	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	113
PID 728 wrote to memory of 2004	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	113
PID 728 wrote to memory of 912	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	114
PID 728 wrote to memory of 912	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	114
PID 728 wrote to memory of 1448	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	115
PID 728 wrote to memory of 1448	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	115
PID 728 wrote to memory of 424	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	116
PID 728 wrote to memory of 424	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	116
PID 728 wrote to memory of 2800	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	117
PID 728 wrote to memory of 2800	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	117
PID 728 wrote to memory of 2984	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	118
PID 728 wrote to memory of 2984	728	12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe	118

C:\Users\Admin\AppData\Local\Temp\12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe
"C:\Users\Admin\AppData\Local\Temp\12befe6eb84aa565fdfc35f88b9c8d4c3e30d28cf6af7b97af51ac1e24b8e1ab.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\System\vwWFzdv.exe
  C:\Windows\System\vwWFzdv.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\kbJvVMC.exe
  C:\Windows\System\kbJvVMC.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ZflrbYn.exe
  C:\Windows\System\ZflrbYn.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\CvtJbOa.exe
  C:\Windows\System\CvtJbOa.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\kphhwfr.exe
  C:\Windows\System\kphhwfr.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\LBYcfXp.exe
  C:\Windows\System\LBYcfXp.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\hBbbhVU.exe
  C:\Windows\System\hBbbhVU.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\sLmCSqg.exe
  C:\Windows\System\sLmCSqg.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\lOxnwVz.exe
  C:\Windows\System\lOxnwVz.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\WnCatbh.exe
  C:\Windows\System\WnCatbh.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\JwSEykP.exe
  C:\Windows\System\JwSEykP.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\EuWwSqt.exe
  C:\Windows\System\EuWwSqt.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\DWUfroM.exe
  C:\Windows\System\DWUfroM.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\xCeavaq.exe
  C:\Windows\System\xCeavaq.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\MsWeveN.exe
  C:\Windows\System\MsWeveN.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\ZkQqQMQ.exe
  C:\Windows\System\ZkQqQMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\GbLpjva.exe
  C:\Windows\System\GbLpjva.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\rZHrnes.exe
  C:\Windows\System\rZHrnes.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\gNVLQGC.exe
  C:\Windows\System\gNVLQGC.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\tbRZdzM.exe
  C:\Windows\System\tbRZdzM.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\ammukyB.exe
  C:\Windows\System\ammukyB.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\iXtxFWQ.exe
  C:\Windows\System\iXtxFWQ.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\IgkUwNv.exe
  C:\Windows\System\IgkUwNv.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\sDSxBso.exe
  C:\Windows\System\sDSxBso.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\bxPGQvp.exe
  C:\Windows\System\bxPGQvp.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\YVTolcF.exe
  C:\Windows\System\YVTolcF.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\nxdVvxl.exe
  C:\Windows\System\nxdVvxl.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\zKpoqSH.exe
  C:\Windows\System\zKpoqSH.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\XuSWZmF.exe
  C:\Windows\System\XuSWZmF.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\RgFVaCp.exe
  C:\Windows\System\RgFVaCp.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\RAaZWrm.exe
  C:\Windows\System\RAaZWrm.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\pPYWNsx.exe
  C:\Windows\System\pPYWNsx.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\kpRDLbk.exe
  C:\Windows\System\kpRDLbk.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\FMQJHgN.exe
  C:\Windows\System\FMQJHgN.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\RTeAezF.exe
  C:\Windows\System\RTeAezF.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\KkSIVlt.exe
  C:\Windows\System\KkSIVlt.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\bkjMaZc.exe
  C:\Windows\System\bkjMaZc.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\DBPTNda.exe
  C:\Windows\System\DBPTNda.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\YZcBlnn.exe
  C:\Windows\System\YZcBlnn.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\EPansSH.exe
  C:\Windows\System\EPansSH.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\sNJQkad.exe
  C:\Windows\System\sNJQkad.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\XkiBTTG.exe
  C:\Windows\System\XkiBTTG.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\BRZRBcV.exe
  C:\Windows\System\BRZRBcV.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\luKoHeb.exe
  C:\Windows\System\luKoHeb.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\fwqYiYu.exe
  C:\Windows\System\fwqYiYu.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\QDUHtkp.exe
  C:\Windows\System\QDUHtkp.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\TEmdNiX.exe
  C:\Windows\System\TEmdNiX.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\maMzCkM.exe
  C:\Windows\System\maMzCkM.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\oZgnAdk.exe
  C:\Windows\System\oZgnAdk.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\CSrSvtO.exe
  C:\Windows\System\CSrSvtO.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\mygCeak.exe
  C:\Windows\System\mygCeak.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\qWSwJDa.exe
  C:\Windows\System\qWSwJDa.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\kAnBGSc.exe
  C:\Windows\System\kAnBGSc.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\uPHXUUC.exe
  C:\Windows\System\uPHXUUC.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\PZWfwvO.exe
  C:\Windows\System\PZWfwvO.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\KjQKEaP.exe
  C:\Windows\System\KjQKEaP.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\sXjxVTd.exe
  C:\Windows\System\sXjxVTd.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\IcdnCVy.exe
  C:\Windows\System\IcdnCVy.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\EXmSYuD.exe
  C:\Windows\System\EXmSYuD.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\eNJaBMe.exe
  C:\Windows\System\eNJaBMe.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\YERIitr.exe
  C:\Windows\System\YERIitr.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\PSNyNwA.exe
  C:\Windows\System\PSNyNwA.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\lgKLNvE.exe
  C:\Windows\System\lgKLNvE.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\IcGYvTt.exe
  C:\Windows\System\IcGYvTt.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\csDRiaM.exe
  C:\Windows\System\csDRiaM.exe
  2⤵
  PID:2112
- C:\Windows\System\vinSdXb.exe
  C:\Windows\System\vinSdXb.exe
  2⤵
  PID:3048
- C:\Windows\System\AcrsKiD.exe
  C:\Windows\System\AcrsKiD.exe
  2⤵
  PID:1388
- C:\Windows\System\YHVPyUA.exe
  C:\Windows\System\YHVPyUA.exe
  2⤵
  PID:3920
- C:\Windows\System\JDgcAEB.exe
  C:\Windows\System\JDgcAEB.exe
  2⤵
  PID:1380
- C:\Windows\System\Zfthqkl.exe
  C:\Windows\System\Zfthqkl.exe
  2⤵
  PID:5008
- C:\Windows\System\CievgUA.exe
  C:\Windows\System\CievgUA.exe
  2⤵
  PID:2660
- C:\Windows\System\RJkogSr.exe
  C:\Windows\System\RJkogSr.exe
  2⤵
  PID:1796
- C:\Windows\System\UoOaghz.exe
  C:\Windows\System\UoOaghz.exe
  2⤵
  PID:3152
- C:\Windows\System\KWqFLCT.exe
  C:\Windows\System\KWqFLCT.exe
  2⤵
  PID:1392
- C:\Windows\System\HEXgIhR.exe
  C:\Windows\System\HEXgIhR.exe
  2⤵
  PID:1780
- C:\Windows\System\FrUMftz.exe
  C:\Windows\System\FrUMftz.exe
  2⤵
  PID:4492
- C:\Windows\System\qWCTRzc.exe
  C:\Windows\System\qWCTRzc.exe
  2⤵
  PID:4024
- C:\Windows\System\nAKdduJ.exe
  C:\Windows\System\nAKdduJ.exe
  2⤵
  PID:4948
- C:\Windows\System\wZHaFYS.exe
  C:\Windows\System\wZHaFYS.exe
  2⤵
  PID:3996
- C:\Windows\System\kEwIaIc.exe
  C:\Windows\System\kEwIaIc.exe
  2⤵
  PID:4724
- C:\Windows\System\XbmmjpH.exe
  C:\Windows\System\XbmmjpH.exe
  2⤵
  PID:1080
- C:\Windows\System\XtJOBdy.exe
  C:\Windows\System\XtJOBdy.exe
  2⤵
  PID:1424
- C:\Windows\System\BxohfKQ.exe
  C:\Windows\System\BxohfKQ.exe
  2⤵
  PID:3068
- C:\Windows\System\pAnGyRk.exe
  C:\Windows\System\pAnGyRk.exe
  2⤵
  PID:3316
- C:\Windows\System\HvkrUyv.exe
  C:\Windows\System\HvkrUyv.exe
  2⤵
  PID:116
- C:\Windows\System\wTtvUsl.exe
  C:\Windows\System\wTtvUsl.exe
  2⤵
  PID:1960
- C:\Windows\System\axsqRnU.exe
  C:\Windows\System\axsqRnU.exe
  2⤵
  PID:1136
- C:\Windows\System\XnBizHp.exe
  C:\Windows\System\XnBizHp.exe
  2⤵
  PID:1836
- C:\Windows\System\XzkneeW.exe
  C:\Windows\System\XzkneeW.exe
  2⤵
  PID:1156
- C:\Windows\System\TKAXpzV.exe
  C:\Windows\System\TKAXpzV.exe
  2⤵
  PID:1312
- C:\Windows\System\yjjCTXJ.exe
  C:\Windows\System\yjjCTXJ.exe
  2⤵
  PID:4188
- C:\Windows\System\FzwyKPu.exe
  C:\Windows\System\FzwyKPu.exe
  2⤵
  PID:2980
- C:\Windows\System\uvBmkFO.exe
  C:\Windows\System\uvBmkFO.exe
  2⤵
  PID:4488
- C:\Windows\System\IheSPtk.exe
  C:\Windows\System\IheSPtk.exe
  2⤵
  PID:5132
- C:\Windows\System\VHfGdTa.exe
  C:\Windows\System\VHfGdTa.exe
  2⤵
  PID:5156
- C:\Windows\System\nEfXcfl.exe
  C:\Windows\System\nEfXcfl.exe
  2⤵
  PID:5188
- C:\Windows\System\UlTThoo.exe
  C:\Windows\System\UlTThoo.exe
  2⤵
  PID:5216
- C:\Windows\System\QkAmMkF.exe
  C:\Windows\System\QkAmMkF.exe
  2⤵
  PID:5240
- C:\Windows\System\fsGeKnE.exe
  C:\Windows\System\fsGeKnE.exe
  2⤵
  PID:5264
- C:\Windows\System\rMwDvQV.exe
  C:\Windows\System\rMwDvQV.exe
  2⤵
  PID:5300
- C:\Windows\System\aontpGg.exe
  C:\Windows\System\aontpGg.exe
  2⤵
  PID:5324
- C:\Windows\System\siRUjeU.exe
  C:\Windows\System\siRUjeU.exe
  2⤵
  PID:5352
- C:\Windows\System\SEGvqRP.exe
  C:\Windows\System\SEGvqRP.exe
  2⤵
  PID:5376
- C:\Windows\System\FeyNiqu.exe
  C:\Windows\System\FeyNiqu.exe
  2⤵
  PID:5396
- C:\Windows\System\XRBwhip.exe
  C:\Windows\System\XRBwhip.exe
  2⤵
  PID:5436
- C:\Windows\System\FdKnYtt.exe
  C:\Windows\System\FdKnYtt.exe
  2⤵
  PID:5460
- C:\Windows\System\QsLofpA.exe
  C:\Windows\System\QsLofpA.exe
  2⤵
  PID:5480
- C:\Windows\System\PQkGivZ.exe
  C:\Windows\System\PQkGivZ.exe
  2⤵
  PID:5520
- C:\Windows\System\RpbFYNZ.exe
  C:\Windows\System\RpbFYNZ.exe
  2⤵
  PID:5540
- C:\Windows\System\bfUraSc.exe
  C:\Windows\System\bfUraSc.exe
  2⤵
  PID:5576
- C:\Windows\System\WAdlTQW.exe
  C:\Windows\System\WAdlTQW.exe
  2⤵
  PID:5604
- C:\Windows\System\utIljcJ.exe
  C:\Windows\System\utIljcJ.exe
  2⤵
  PID:5624
- C:\Windows\System\EMtUTwU.exe
  C:\Windows\System\EMtUTwU.exe
  2⤵
  PID:5660
- C:\Windows\System\mabypiv.exe
  C:\Windows\System\mabypiv.exe
  2⤵
  PID:5688
- C:\Windows\System\reJNSMG.exe
  C:\Windows\System\reJNSMG.exe
  2⤵
  PID:5704
- C:\Windows\System\SihNOtU.exe
  C:\Windows\System\SihNOtU.exe
  2⤵
  PID:5740
- C:\Windows\System\vAStVib.exe
  C:\Windows\System\vAStVib.exe
  2⤵
  PID:5776
- C:\Windows\System\UjImvid.exe
  C:\Windows\System\UjImvid.exe
  2⤵
  PID:5800
- C:\Windows\System\OIpricn.exe
  C:\Windows\System\OIpricn.exe
  2⤵
  PID:5820
- C:\Windows\System\MbMQHem.exe
  C:\Windows\System\MbMQHem.exe
  2⤵
  PID:5840
- C:\Windows\System\wfDLdNG.exe
  C:\Windows\System\wfDLdNG.exe
  2⤵
  PID:5888
- C:\Windows\System\ocupEkD.exe
  C:\Windows\System\ocupEkD.exe
  2⤵
  PID:5916
- C:\Windows\System\hlNlQUM.exe
  C:\Windows\System\hlNlQUM.exe
  2⤵
  PID:5944
- C:\Windows\System\hPoGTre.exe
  C:\Windows\System\hPoGTre.exe
  2⤵
  PID:5972
- C:\Windows\System\zJLISWG.exe
  C:\Windows\System\zJLISWG.exe
  2⤵
  PID:6004
- C:\Windows\System\zpVMPMf.exe
  C:\Windows\System\zpVMPMf.exe
  2⤵
  PID:6028
- C:\Windows\System\tPkFkXb.exe
  C:\Windows\System\tPkFkXb.exe
  2⤵
  PID:6060
- C:\Windows\System\xjmMcpK.exe
  C:\Windows\System\xjmMcpK.exe
  2⤵
  PID:6084
- C:\Windows\System\rwdxEHe.exe
  C:\Windows\System\rwdxEHe.exe
  2⤵
  PID:6112
- C:\Windows\System\lGJMfdP.exe
  C:\Windows\System\lGJMfdP.exe
  2⤵
  PID:6140
- C:\Windows\System\OBMXjLp.exe
  C:\Windows\System\OBMXjLp.exe
  2⤵
  PID:5152
- C:\Windows\System\sXMeRom.exe
  C:\Windows\System\sXMeRom.exe
  2⤵
  PID:5224
- C:\Windows\System\qpgMNJW.exe
  C:\Windows\System\qpgMNJW.exe
  2⤵
  PID:5284
- C:\Windows\System\ZsAjcNC.exe
  C:\Windows\System\ZsAjcNC.exe
  2⤵
  PID:5344
- C:\Windows\System\NfsfiBg.exe
  C:\Windows\System\NfsfiBg.exe
  2⤵
  PID:5428
- C:\Windows\System\HFirbQN.exe
  C:\Windows\System\HFirbQN.exe
  2⤵
  PID:5472
- C:\Windows\System\XBZIvsz.exe
  C:\Windows\System\XBZIvsz.exe
  2⤵
  PID:5548
- C:\Windows\System\ZWnNiwc.exe
  C:\Windows\System\ZWnNiwc.exe
  2⤵
  PID:5612
- C:\Windows\System\kyteUmG.exe
  C:\Windows\System\kyteUmG.exe
  2⤵
  PID:5680
- C:\Windows\System\jXhMJEV.exe
  C:\Windows\System\jXhMJEV.exe
  2⤵
  PID:5716
- C:\Windows\System\BXWOcae.exe
  C:\Windows\System\BXWOcae.exe
  2⤵
  PID:5812
- C:\Windows\System\zoBffvH.exe
  C:\Windows\System\zoBffvH.exe
  2⤵
  PID:5868
- C:\Windows\System\RMQurPr.exe
  C:\Windows\System\RMQurPr.exe
  2⤵
  PID:5940
- C:\Windows\System\uaFVKEL.exe
  C:\Windows\System\uaFVKEL.exe
  2⤵
  PID:6016
- C:\Windows\System\zONkGQt.exe
  C:\Windows\System\zONkGQt.exe
  2⤵
  PID:6068
- C:\Windows\System\iijHkLe.exe
  C:\Windows\System\iijHkLe.exe
  2⤵
  PID:6124
- C:\Windows\System\uBcuLix.exe
  C:\Windows\System\uBcuLix.exe
  2⤵
  PID:5180
- C:\Windows\System\AwgDQoR.exe
  C:\Windows\System\AwgDQoR.exe
  2⤵
  PID:5392
- C:\Windows\System\oevGSRU.exe
  C:\Windows\System\oevGSRU.exe
  2⤵
  PID:5560
- C:\Windows\System\YLEeXmO.exe
  C:\Windows\System\YLEeXmO.exe
  2⤵
  PID:5696
- C:\Windows\System\WhyUFGJ.exe
  C:\Windows\System\WhyUFGJ.exe
  2⤵
  PID:5792
- C:\Windows\System\pkvZIhz.exe
  C:\Windows\System\pkvZIhz.exe
  2⤵
  PID:6024
- C:\Windows\System\oTsPrnk.exe
  C:\Windows\System\oTsPrnk.exe
  2⤵
  PID:436
- C:\Windows\System\cwuUHSv.exe
  C:\Windows\System\cwuUHSv.exe
  2⤵
  PID:5468
- C:\Windows\System\VfnkydA.exe
  C:\Windows\System\VfnkydA.exe
  2⤵
  PID:5908
- C:\Windows\System\VGectlq.exe
  C:\Windows\System\VGectlq.exe
  2⤵
  PID:5288
- C:\Windows\System\qepohnt.exe
  C:\Windows\System\qepohnt.exe
  2⤵
  PID:5984
- C:\Windows\System\VqCSrUI.exe
  C:\Windows\System\VqCSrUI.exe
  2⤵
  PID:6172
- C:\Windows\System\XVPTnjv.exe
  C:\Windows\System\XVPTnjv.exe
  2⤵
  PID:6188
- C:\Windows\System\BGDqghP.exe
  C:\Windows\System\BGDqghP.exe
  2⤵
  PID:6220
- C:\Windows\System\CJLDLDD.exe
  C:\Windows\System\CJLDLDD.exe
  2⤵
  PID:6252
- C:\Windows\System\TctMrEQ.exe
  C:\Windows\System\TctMrEQ.exe
  2⤵
  PID:6272
- C:\Windows\System\ReKqgyq.exe
  C:\Windows\System\ReKqgyq.exe
  2⤵
  PID:6312
- C:\Windows\System\KvYZmce.exe
  C:\Windows\System\KvYZmce.exe
  2⤵
  PID:6340
- C:\Windows\System\RhbJpaa.exe
  C:\Windows\System\RhbJpaa.exe
  2⤵
  PID:6384
- C:\Windows\System\Knutdkk.exe
  C:\Windows\System\Knutdkk.exe
  2⤵
  PID:6408
- C:\Windows\System\iirpSUz.exe
  C:\Windows\System\iirpSUz.exe
  2⤵
  PID:6436
- C:\Windows\System\GCjiyKT.exe
  C:\Windows\System\GCjiyKT.exe
  2⤵
  PID:6464
- C:\Windows\System\ILYZzay.exe
  C:\Windows\System\ILYZzay.exe
  2⤵
  PID:6492
- C:\Windows\System\HcwzOGj.exe
  C:\Windows\System\HcwzOGj.exe
  2⤵
  PID:6520
- C:\Windows\System\rIOxRBC.exe
  C:\Windows\System\rIOxRBC.exe
  2⤵
  PID:6536
- C:\Windows\System\SaIxmFE.exe
  C:\Windows\System\SaIxmFE.exe
  2⤵
  PID:6560
- C:\Windows\System\kiAFVFH.exe
  C:\Windows\System\kiAFVFH.exe
  2⤵
  PID:6588
- C:\Windows\System\zpycydb.exe
  C:\Windows\System\zpycydb.exe
  2⤵
  PID:6612
- C:\Windows\System\OzLxpUF.exe
  C:\Windows\System\OzLxpUF.exe
  2⤵
  PID:6640
- C:\Windows\System\OlCceHx.exe
  C:\Windows\System\OlCceHx.exe
  2⤵
  PID:6676
- C:\Windows\System\jHJBuzU.exe
  C:\Windows\System\jHJBuzU.exe
  2⤵
  PID:6696
- C:\Windows\System\lwUspFH.exe
  C:\Windows\System\lwUspFH.exe
  2⤵
  PID:6720
- C:\Windows\System\ArcHXYS.exe
  C:\Windows\System\ArcHXYS.exe
  2⤵
  PID:6740
- C:\Windows\System\nyfTkZn.exe
  C:\Windows\System\nyfTkZn.exe
  2⤵
  PID:6776
- C:\Windows\System\SZlDBhV.exe
  C:\Windows\System\SZlDBhV.exe
  2⤵
  PID:6828
- C:\Windows\System\OSJIBhQ.exe
  C:\Windows\System\OSJIBhQ.exe
  2⤵
  PID:6856
- C:\Windows\System\nCiLddE.exe
  C:\Windows\System\nCiLddE.exe
  2⤵
  PID:6884
- C:\Windows\System\WtSQpOI.exe
  C:\Windows\System\WtSQpOI.exe
  2⤵
  PID:6900
- C:\Windows\System\CxXCYwo.exe
  C:\Windows\System\CxXCYwo.exe
  2⤵
  PID:6928
- C:\Windows\System\XdtVVVm.exe
  C:\Windows\System\XdtVVVm.exe
  2⤵
  PID:6956
- C:\Windows\System\iTUjFZo.exe
  C:\Windows\System\iTUjFZo.exe
  2⤵
  PID:6984
- C:\Windows\System\pdtCUIO.exe
  C:\Windows\System\pdtCUIO.exe
  2⤵
  PID:7000
- C:\Windows\System\qwMLvyV.exe
  C:\Windows\System\qwMLvyV.exe
  2⤵
  PID:7040
- C:\Windows\System\NEcDVWg.exe
  C:\Windows\System\NEcDVWg.exe
  2⤵
  PID:7068
- C:\Windows\System\ypZWKMz.exe
  C:\Windows\System\ypZWKMz.exe
  2⤵
  PID:7084
- C:\Windows\System\EwvOrfe.exe
  C:\Windows\System\EwvOrfe.exe
  2⤵
  PID:7100
- C:\Windows\System\gHzJaag.exe
  C:\Windows\System\gHzJaag.exe
  2⤵
  PID:7140
- C:\Windows\System\ADPjTuF.exe
  C:\Windows\System\ADPjTuF.exe
  2⤵
  PID:7164
- C:\Windows\System\EMjACAm.exe
  C:\Windows\System\EMjACAm.exe
  2⤵
  PID:6052
- C:\Windows\System\SJWsTpN.exe
  C:\Windows\System\SJWsTpN.exe
  2⤵
  PID:6212
- C:\Windows\System\PwFHUtJ.exe
  C:\Windows\System\PwFHUtJ.exe
  2⤵
  PID:6260
- C:\Windows\System\eHSsFwc.exe
  C:\Windows\System\eHSsFwc.exe
  2⤵
  PID:6292
- C:\Windows\System\FWErRvJ.exe
  C:\Windows\System\FWErRvJ.exe
  2⤵
  PID:6356
- C:\Windows\System\ABqFrqS.exe
  C:\Windows\System\ABqFrqS.exe
  2⤵
  PID:6420
- C:\Windows\System\pFvaLrQ.exe
  C:\Windows\System\pFvaLrQ.exe
  2⤵
  PID:6508
- C:\Windows\System\tbEMrUf.exe
  C:\Windows\System\tbEMrUf.exe
  2⤵
  PID:6572
- C:\Windows\System\sEUKWlu.exe
  C:\Windows\System\sEUKWlu.exe
  2⤵
  PID:6628
- C:\Windows\System\fuBAFVJ.exe
  C:\Windows\System\fuBAFVJ.exe
  2⤵
  PID:6716
- C:\Windows\System\PKmOpcP.exe
  C:\Windows\System\PKmOpcP.exe
  2⤵
  PID:6772
- C:\Windows\System\QMrWxxv.exe
  C:\Windows\System\QMrWxxv.exe
  2⤵
  PID:6804
- C:\Windows\System\dvOaors.exe
  C:\Windows\System\dvOaors.exe
  2⤵
  PID:6896
- C:\Windows\System\TVuYHXM.exe
  C:\Windows\System\TVuYHXM.exe
  2⤵
  PID:6944
- C:\Windows\System\sziZxor.exe
  C:\Windows\System\sziZxor.exe
  2⤵
  PID:7012
- C:\Windows\System\RouytQN.exe
  C:\Windows\System\RouytQN.exe
  2⤵
  PID:7092
- C:\Windows\System\fLJZVcl.exe
  C:\Windows\System\fLJZVcl.exe
  2⤵
  PID:5648
- C:\Windows\System\ssHldMC.exe
  C:\Windows\System\ssHldMC.exe
  2⤵
  PID:6288
- C:\Windows\System\UhvbhID.exe
  C:\Windows\System\UhvbhID.exe
  2⤵
  PID:6364
- C:\Windows\System\aJSEqmA.exe
  C:\Windows\System\aJSEqmA.exe
  2⤵
  PID:6672
- C:\Windows\System\oNHupOv.exe
  C:\Windows\System\oNHupOv.exe
  2⤵
  PID:7080
- C:\Windows\System\jSbSqSl.exe
  C:\Windows\System\jSbSqSl.exe
  2⤵
  PID:7120
- C:\Windows\System\zjjrkUm.exe
  C:\Windows\System\zjjrkUm.exe
  2⤵
  PID:7076
- C:\Windows\System\KwdImfw.exe
  C:\Windows\System\KwdImfw.exe
  2⤵
  PID:6332
- C:\Windows\System\MwiRWNF.exe
  C:\Windows\System\MwiRWNF.exe
  2⤵
  PID:6712
- C:\Windows\System\CFHWYUC.exe
  C:\Windows\System\CFHWYUC.exe
  2⤵
  PID:7172
- C:\Windows\System\pphYTlS.exe
  C:\Windows\System\pphYTlS.exe
  2⤵
  PID:7196
- C:\Windows\System\gWUDKkB.exe
  C:\Windows\System\gWUDKkB.exe
  2⤵
  PID:7236
- C:\Windows\System\juaxOxZ.exe
  C:\Windows\System\juaxOxZ.exe
  2⤵
  PID:7264
- C:\Windows\System\LVALarE.exe
  C:\Windows\System\LVALarE.exe
  2⤵
  PID:7280
- C:\Windows\System\ZvFUxqY.exe
  C:\Windows\System\ZvFUxqY.exe
  2⤵
  PID:7300
- C:\Windows\System\tNCAHnd.exe
  C:\Windows\System\tNCAHnd.exe
  2⤵
  PID:7328
- C:\Windows\System\nijNYsy.exe
  C:\Windows\System\nijNYsy.exe
  2⤵
  PID:7352
- C:\Windows\System\qtnPEif.exe
  C:\Windows\System\qtnPEif.exe
  2⤵
  PID:7376
- C:\Windows\System\vzMSaBT.exe
  C:\Windows\System\vzMSaBT.exe
  2⤵
  PID:7408
- C:\Windows\System\mudjmPc.exe
  C:\Windows\System\mudjmPc.exe
  2⤵
  PID:7436
- C:\Windows\System\nfOvGVc.exe
  C:\Windows\System\nfOvGVc.exe
  2⤵
  PID:7460
- C:\Windows\System\bPRlLKj.exe
  C:\Windows\System\bPRlLKj.exe
  2⤵
  PID:7480
- C:\Windows\System\CBpNnsX.exe
  C:\Windows\System\CBpNnsX.exe
  2⤵
  PID:7508
- C:\Windows\System\wUNtdyg.exe
  C:\Windows\System\wUNtdyg.exe
  2⤵
  PID:7528
- C:\Windows\System\FJpAqwf.exe
  C:\Windows\System\FJpAqwf.exe
  2⤵
  PID:7560
- C:\Windows\System\zPbbEsM.exe
  C:\Windows\System\zPbbEsM.exe
  2⤵
  PID:7628
- C:\Windows\System\mhbSqBv.exe
  C:\Windows\System\mhbSqBv.exe
  2⤵
  PID:7644
- C:\Windows\System\FinBViD.exe
  C:\Windows\System\FinBViD.exe
  2⤵
  PID:7684
- C:\Windows\System\MabiaZB.exe
  C:\Windows\System\MabiaZB.exe
  2⤵
  PID:7700
- C:\Windows\System\BykaaGg.exe
  C:\Windows\System\BykaaGg.exe
  2⤵
  PID:7728
- C:\Windows\System\aIcSVUA.exe
  C:\Windows\System\aIcSVUA.exe
  2⤵
  PID:7760
- C:\Windows\System\YHhkTbV.exe
  C:\Windows\System\YHhkTbV.exe
  2⤵
  PID:7780
- C:\Windows\System\xSjLusl.exe
  C:\Windows\System\xSjLusl.exe
  2⤵
  PID:7824
- C:\Windows\System\WhAMlZq.exe
  C:\Windows\System\WhAMlZq.exe
  2⤵
  PID:7852
- C:\Windows\System\oTJTvfi.exe
  C:\Windows\System\oTJTvfi.exe
  2⤵
  PID:7880
- C:\Windows\System\bogSYOs.exe
  C:\Windows\System\bogSYOs.exe
  2⤵
  PID:7908
- C:\Windows\System\miyTbYr.exe
  C:\Windows\System\miyTbYr.exe
  2⤵
  PID:7932
- C:\Windows\System\UzfuLBh.exe
  C:\Windows\System\UzfuLBh.exe
  2⤵
  PID:7952
- C:\Windows\System\quJAXQm.exe
  C:\Windows\System\quJAXQm.exe
  2⤵
  PID:7976
- C:\Windows\System\XXMcHnI.exe
  C:\Windows\System\XXMcHnI.exe
  2⤵
  PID:8008
- C:\Windows\System\qKBjwZO.exe
  C:\Windows\System\qKBjwZO.exe
  2⤵
  PID:8032
- C:\Windows\System\QBkLNdL.exe
  C:\Windows\System\QBkLNdL.exe
  2⤵
  PID:8064
- C:\Windows\System\VojByxu.exe
  C:\Windows\System\VojByxu.exe
  2⤵
  PID:8100
- C:\Windows\System\FZeOfNZ.exe
  C:\Windows\System\FZeOfNZ.exe
  2⤵
  PID:8124
- C:\Windows\System\sWFTRuL.exe
  C:\Windows\System\sWFTRuL.exe
  2⤵
  PID:8164
- C:\Windows\System\YlcWwQM.exe
  C:\Windows\System\YlcWwQM.exe
  2⤵
  PID:8184
- C:\Windows\System\GZzeseT.exe
  C:\Windows\System\GZzeseT.exe
  2⤵
  PID:6848
- C:\Windows\System\ptHAYWV.exe
  C:\Windows\System\ptHAYWV.exe
  2⤵
  PID:7248
- C:\Windows\System\qcqwiDy.exe
  C:\Windows\System\qcqwiDy.exe
  2⤵
  PID:7296
- C:\Windows\System\RvGXVHF.exe
  C:\Windows\System\RvGXVHF.exe
  2⤵
  PID:7320
- C:\Windows\System\noanovH.exe
  C:\Windows\System\noanovH.exe
  2⤵
  PID:7368
- C:\Windows\System\RCzhrbm.exe
  C:\Windows\System\RCzhrbm.exe
  2⤵
  PID:7536
- C:\Windows\System\HBHbGmi.exe
  C:\Windows\System\HBHbGmi.exe
  2⤵
  PID:7548
- C:\Windows\System\QPZxqGi.exe
  C:\Windows\System\QPZxqGi.exe
  2⤵
  PID:7640
- C:\Windows\System\UMQNNPe.exe
  C:\Windows\System\UMQNNPe.exe
  2⤵
  PID:7696
- C:\Windows\System\Mmjdhgp.exe
  C:\Windows\System\Mmjdhgp.exe
  2⤵
  PID:7768
- C:\Windows\System\lkDkFMk.exe
  C:\Windows\System\lkDkFMk.exe
  2⤵
  PID:7800
- C:\Windows\System\BkfVCHd.exe
  C:\Windows\System\BkfVCHd.exe
  2⤵
  PID:7868
- C:\Windows\System\kFeFcEL.exe
  C:\Windows\System\kFeFcEL.exe
  2⤵
  PID:7940
- C:\Windows\System\jLnoLkb.exe
  C:\Windows\System\jLnoLkb.exe
  2⤵
  PID:8052
- C:\Windows\System\SAgbhBb.exe
  C:\Windows\System\SAgbhBb.exe
  2⤵
  PID:8108
- C:\Windows\System\VkxQzdM.exe
  C:\Windows\System\VkxQzdM.exe
  2⤵
  PID:8180
- C:\Windows\System\mgmenpO.exe
  C:\Windows\System\mgmenpO.exe
  2⤵
  PID:7272
- C:\Windows\System\EURDbAS.exe
  C:\Windows\System\EURDbAS.exe
  2⤵
  PID:7496
- C:\Windows\System\ILSetJj.exe
  C:\Windows\System\ILSetJj.exe
  2⤵
  PID:7604
- C:\Windows\System\NGRKixE.exe
  C:\Windows\System\NGRKixE.exe
  2⤵
  PID:7744
- C:\Windows\System\sigOSVx.exe
  C:\Windows\System\sigOSVx.exe
  2⤵
  PID:7848
- C:\Windows\System\dHWqQDa.exe
  C:\Windows\System\dHWqQDa.exe
  2⤵
  PID:7960
- C:\Windows\System\cnSpxvW.exe
  C:\Windows\System\cnSpxvW.exe
  2⤵
  PID:8080
- C:\Windows\System\kNbdGDZ.exe
  C:\Windows\System\kNbdGDZ.exe
  2⤵
  PID:7312
- C:\Windows\System\HeUURTQ.exe
  C:\Windows\System\HeUURTQ.exe
  2⤵
  PID:7452
- C:\Windows\System\CdUVTAw.exe
  C:\Windows\System\CdUVTAw.exe
  2⤵
  PID:8048
- C:\Windows\System\iqTYXpp.exe
  C:\Windows\System\iqTYXpp.exe
  2⤵
  PID:8040
- C:\Windows\System\JEaoion.exe
  C:\Windows\System\JEaoion.exe
  2⤵
  PID:8212
- C:\Windows\System\gOSWnWn.exe
  C:\Windows\System\gOSWnWn.exe
  2⤵
  PID:8244
- C:\Windows\System\oFFHKpS.exe
  C:\Windows\System\oFFHKpS.exe
  2⤵
  PID:8272
- C:\Windows\System\AHnuPvE.exe
  C:\Windows\System\AHnuPvE.exe
  2⤵
  PID:8296
- C:\Windows\System\cBaySUH.exe
  C:\Windows\System\cBaySUH.exe
  2⤵
  PID:8316
- C:\Windows\System\iBPgaed.exe
  C:\Windows\System\iBPgaed.exe
  2⤵
  PID:8352
- C:\Windows\System\CATbJMF.exe
  C:\Windows\System\CATbJMF.exe
  2⤵
  PID:8380
- C:\Windows\System\kKoNZRl.exe
  C:\Windows\System\kKoNZRl.exe
  2⤵
  PID:8436
- C:\Windows\System\EulutQZ.exe
  C:\Windows\System\EulutQZ.exe
  2⤵
  PID:8464
- C:\Windows\System\JFyyarX.exe
  C:\Windows\System\JFyyarX.exe
  2⤵
  PID:8488
- C:\Windows\System\wtvAjwA.exe
  C:\Windows\System\wtvAjwA.exe
  2⤵
  PID:8520
- C:\Windows\System\KPUeeae.exe
  C:\Windows\System\KPUeeae.exe
  2⤵
  PID:8560
- C:\Windows\System\bCHteMO.exe
  C:\Windows\System\bCHteMO.exe
  2⤵
  PID:8580
- C:\Windows\System\OyNaQPF.exe
  C:\Windows\System\OyNaQPF.exe
  2⤵
  PID:8600
- C:\Windows\System\RpkZLaX.exe
  C:\Windows\System\RpkZLaX.exe
  2⤵
  PID:8628
- C:\Windows\System\fHgeQOf.exe
  C:\Windows\System\fHgeQOf.exe
  2⤵
  PID:8656
- C:\Windows\System\WLVFndo.exe
  C:\Windows\System\WLVFndo.exe
  2⤵
  PID:8680
- C:\Windows\System\rdJaWHm.exe
  C:\Windows\System\rdJaWHm.exe
  2⤵
  PID:8708
- C:\Windows\System\xLHNdkz.exe
  C:\Windows\System\xLHNdkz.exe
  2⤵
  PID:8744
- C:\Windows\System\srhunzZ.exe
  C:\Windows\System\srhunzZ.exe
  2⤵
  PID:8772
- C:\Windows\System\tISSMjJ.exe
  C:\Windows\System\tISSMjJ.exe
  2⤵
  PID:8800
- C:\Windows\System\AQNgPNZ.exe
  C:\Windows\System\AQNgPNZ.exe
  2⤵
  PID:8840
- C:\Windows\System\mnjquFt.exe
  C:\Windows\System\mnjquFt.exe
  2⤵
  PID:8868
- C:\Windows\System\NGOFSTm.exe
  C:\Windows\System\NGOFSTm.exe
  2⤵
  PID:8884
- C:\Windows\System\yzviJHy.exe
  C:\Windows\System\yzviJHy.exe
  2⤵
  PID:8912
- C:\Windows\System\dqelfMp.exe
  C:\Windows\System\dqelfMp.exe
  2⤵
  PID:8940
- C:\Windows\System\FumZmnJ.exe
  C:\Windows\System\FumZmnJ.exe
  2⤵
  PID:8956
- C:\Windows\System\CShzAsF.exe
  C:\Windows\System\CShzAsF.exe
  2⤵
  PID:8984
- C:\Windows\System\JbWPIvY.exe
  C:\Windows\System\JbWPIvY.exe
  2⤵
  PID:9020
- C:\Windows\System\THhbZBB.exe
  C:\Windows\System\THhbZBB.exe
  2⤵
  PID:9048
- C:\Windows\System\JmPgzzh.exe
  C:\Windows\System\JmPgzzh.exe
  2⤵
  PID:9076
- C:\Windows\System\uDFJwMD.exe
  C:\Windows\System\uDFJwMD.exe
  2⤵
  PID:9100
- C:\Windows\System\nJjrRoo.exe
  C:\Windows\System\nJjrRoo.exe
  2⤵
  PID:9120
- C:\Windows\System\sheEXfC.exe
  C:\Windows\System\sheEXfC.exe
  2⤵
  PID:9164
- C:\Windows\System\SpmkMRO.exe
  C:\Windows\System\SpmkMRO.exe
  2⤵
  PID:9204
- C:\Windows\System\UyTZqBw.exe
  C:\Windows\System\UyTZqBw.exe
  2⤵
  PID:7492
- C:\Windows\System\LgSkeVx.exe
  C:\Windows\System\LgSkeVx.exe
  2⤵
  PID:8268
- C:\Windows\System\OrRmxTe.exe
  C:\Windows\System\OrRmxTe.exe
  2⤵
  PID:8264
- C:\Windows\System\jIbIeVV.exe
  C:\Windows\System\jIbIeVV.exe
  2⤵
  PID:8364
- C:\Windows\System\ntllQmM.exe
  C:\Windows\System\ntllQmM.exe
  2⤵
  PID:8412
- C:\Windows\System\msRByCV.exe
  C:\Windows\System\msRByCV.exe
  2⤵
  PID:8456
- C:\Windows\System\aiUSnBM.exe
  C:\Windows\System\aiUSnBM.exe
  2⤵
  PID:8536
- C:\Windows\System\OcuTkoF.exe
  C:\Windows\System\OcuTkoF.exe
  2⤵
  PID:8572
- C:\Windows\System\fmYrYuI.exe
  C:\Windows\System\fmYrYuI.exe
  2⤵
  PID:8676
- C:\Windows\System\oyivGuj.exe
  C:\Windows\System\oyivGuj.exe
  2⤵
  PID:8728
- C:\Windows\System\JLnIEMs.exe
  C:\Windows\System\JLnIEMs.exe
  2⤵
  PID:8764
- C:\Windows\System\rtlUOfl.exe
  C:\Windows\System\rtlUOfl.exe
  2⤵
  PID:8784
- C:\Windows\System\xFjpaqY.exe
  C:\Windows\System\xFjpaqY.exe
  2⤵
  PID:8968
- C:\Windows\System\YeQBiuR.exe
  C:\Windows\System\YeQBiuR.exe
  2⤵
  PID:9036
- C:\Windows\System\GVQeAFB.exe
  C:\Windows\System\GVQeAFB.exe
  2⤵
  PID:9112
- C:\Windows\System\fSWDQAA.exe
  C:\Windows\System\fSWDQAA.exe
  2⤵
  PID:9160
- C:\Windows\System\QNcIGTZ.exe
  C:\Windows\System\QNcIGTZ.exe
  2⤵
  PID:8200
- C:\Windows\System\JdMnnuL.exe
  C:\Windows\System\JdMnnuL.exe
  2⤵
  PID:8236
- C:\Windows\System\mwYMdcy.exe
  C:\Windows\System\mwYMdcy.exe
  2⤵
  PID:8432
- C:\Windows\System\GAyeQzO.exe
  C:\Windows\System\GAyeQzO.exe
  2⤵
  PID:8664
- C:\Windows\System\oXEZaOg.exe
  C:\Windows\System\oXEZaOg.exe
  2⤵
  PID:8696
- C:\Windows\System\dsiEuUG.exe
  C:\Windows\System\dsiEuUG.exe
  2⤵
  PID:8760
- C:\Windows\System\gMpjRCV.exe
  C:\Windows\System\gMpjRCV.exe
  2⤵
  PID:9032
- C:\Windows\System\CwRdaxp.exe
  C:\Windows\System\CwRdaxp.exe
  2⤵
  PID:9136
- C:\Windows\System\lgUXweR.exe
  C:\Windows\System\lgUXweR.exe
  2⤵
  PID:8500
- C:\Windows\System\NdQnHWD.exe
  C:\Windows\System\NdQnHWD.exe
  2⤵
  PID:8896
- C:\Windows\System\RJslxKc.exe
  C:\Windows\System\RJslxKc.exe
  2⤵
  PID:8820
- C:\Windows\System\jnwJCAC.exe
  C:\Windows\System\jnwJCAC.exe
  2⤵
  PID:9212
- C:\Windows\System\ANYFTPb.exe
  C:\Windows\System\ANYFTPb.exe
  2⤵
  PID:9220
- C:\Windows\System\KBbjsJB.exe
  C:\Windows\System\KBbjsJB.exe
  2⤵
  PID:9252
- C:\Windows\System\KPjWxey.exe
  C:\Windows\System\KPjWxey.exe
  2⤵
  PID:9272
- C:\Windows\System\enpcNcc.exe
  C:\Windows\System\enpcNcc.exe
  2⤵
  PID:9300
- C:\Windows\System\vqaUpTL.exe
  C:\Windows\System\vqaUpTL.exe
  2⤵
  PID:9332
- C:\Windows\System\MaYYDHi.exe
  C:\Windows\System\MaYYDHi.exe
  2⤵
  PID:9372
- C:\Windows\System\tOPsLMz.exe
  C:\Windows\System\tOPsLMz.exe
  2⤵
  PID:9400
- C:\Windows\System\DIOkIZY.exe
  C:\Windows\System\DIOkIZY.exe
  2⤵
  PID:9428
- C:\Windows\System\pgKsjWX.exe
  C:\Windows\System\pgKsjWX.exe
  2⤵
  PID:9452
- C:\Windows\System\grdpfYc.exe
  C:\Windows\System\grdpfYc.exe
  2⤵
  PID:9480
- C:\Windows\System\qOsETBZ.exe
  C:\Windows\System\qOsETBZ.exe
  2⤵
  PID:9508
- C:\Windows\System\vmUiEty.exe
  C:\Windows\System\vmUiEty.exe
  2⤵
  PID:9524
- C:\Windows\System\KuJoBxI.exe
  C:\Windows\System\KuJoBxI.exe
  2⤵
  PID:9552
- C:\Windows\System\ztWgPdz.exe
  C:\Windows\System\ztWgPdz.exe
  2⤵
  PID:9576
- C:\Windows\System\siwLYnn.exe
  C:\Windows\System\siwLYnn.exe
  2⤵
  PID:9604
- C:\Windows\System\VzTnSAp.exe
  C:\Windows\System\VzTnSAp.exe
  2⤵
  PID:9624
- C:\Windows\System\dmReEcx.exe
  C:\Windows\System\dmReEcx.exe
  2⤵
  PID:9652
- C:\Windows\System\SGBsVed.exe
  C:\Windows\System\SGBsVed.exe
  2⤵
  PID:9672
- C:\Windows\System\kCBQrBQ.exe
  C:\Windows\System\kCBQrBQ.exe
  2⤵
  PID:9708
- C:\Windows\System\uTFqwmg.exe
  C:\Windows\System\uTFqwmg.exe
  2⤵
  PID:9740
- C:\Windows\System\pDrbTOv.exe
  C:\Windows\System\pDrbTOv.exe
  2⤵
  PID:9788
- C:\Windows\System\johwIsh.exe
  C:\Windows\System\johwIsh.exe
  2⤵
  PID:9816
- C:\Windows\System\vQEhBwD.exe
  C:\Windows\System\vQEhBwD.exe
  2⤵
  PID:9844
- C:\Windows\System\cUdibuB.exe
  C:\Windows\System\cUdibuB.exe
  2⤵
  PID:9868
- C:\Windows\System\ZiKFtdX.exe
  C:\Windows\System\ZiKFtdX.exe
  2⤵
  PID:9912
- C:\Windows\System\NItIBuL.exe
  C:\Windows\System\NItIBuL.exe
  2⤵
  PID:9932
- C:\Windows\System\XuzlEkD.exe
  C:\Windows\System\XuzlEkD.exe
  2⤵
  PID:9988
- C:\Windows\System\ZuqLTqj.exe
  C:\Windows\System\ZuqLTqj.exe
  2⤵
  PID:10004
- C:\Windows\System\ktPYJhl.exe
  C:\Windows\System\ktPYJhl.exe
  2⤵
  PID:10044
- C:\Windows\System\KItBOES.exe
  C:\Windows\System\KItBOES.exe
  2⤵
  PID:10064
- C:\Windows\System\Wvlukjp.exe
  C:\Windows\System\Wvlukjp.exe
  2⤵
  PID:10092
- C:\Windows\System\onMLwCB.exe
  C:\Windows\System\onMLwCB.exe
  2⤵
  PID:10116
- C:\Windows\System\WZLVuqX.exe
  C:\Windows\System\WZLVuqX.exe
  2⤵
  PID:10132
- C:\Windows\System\JswbtsO.exe
  C:\Windows\System\JswbtsO.exe
  2⤵
  PID:10160
- C:\Windows\System\ScyNlpk.exe
  C:\Windows\System\ScyNlpk.exe
  2⤵
  PID:10180
- C:\Windows\System\UdhjJKQ.exe
  C:\Windows\System\UdhjJKQ.exe
  2⤵
  PID:10208
- C:\Windows\System\GJUzgud.exe
  C:\Windows\System\GJUzgud.exe
  2⤵
  PID:9240
- C:\Windows\System\FfIhXMV.exe
  C:\Windows\System\FfIhXMV.exe
  2⤵
  PID:9324
- C:\Windows\System\DrjLKNK.exe
  C:\Windows\System\DrjLKNK.exe
  2⤵
  PID:9420
- C:\Windows\System\UEjKLQT.exe
  C:\Windows\System\UEjKLQT.exe
  2⤵
  PID:9468
- C:\Windows\System\QbyBLsJ.exe
  C:\Windows\System\QbyBLsJ.exe
  2⤵
  PID:9464
- C:\Windows\System\tEjwzei.exe
  C:\Windows\System\tEjwzei.exe
  2⤵
  PID:9544
- C:\Windows\System\Rlbzuaw.exe
  C:\Windows\System\Rlbzuaw.exe
  2⤵
  PID:9668
- C:\Windows\System\IGsEcqB.exe
  C:\Windows\System\IGsEcqB.exe
  2⤵
  PID:9704
- C:\Windows\System\sDoYljT.exe
  C:\Windows\System\sDoYljT.exe
  2⤵
  PID:9776
- C:\Windows\System\MuXLDNg.exe
  C:\Windows\System\MuXLDNg.exe
  2⤵
  PID:9836
- C:\Windows\System\XEpeKDL.exe
  C:\Windows\System\XEpeKDL.exe
  2⤵
  PID:9888
- C:\Windows\System\FeRtfVl.exe
  C:\Windows\System\FeRtfVl.exe
  2⤵
  PID:9972
- C:\Windows\System\Qzkotbs.exe
  C:\Windows\System\Qzkotbs.exe
  2⤵
  PID:10088
- C:\Windows\System\dCkeSqm.exe
  C:\Windows\System\dCkeSqm.exe
  2⤵
  PID:10168
- C:\Windows\System\TPWxeEK.exe
  C:\Windows\System\TPWxeEK.exe
  2⤵
  PID:4304
- C:\Windows\System\BLMqcSN.exe
  C:\Windows\System\BLMqcSN.exe
  2⤵
  PID:9396
- C:\Windows\System\UZeYWXd.exe
  C:\Windows\System\UZeYWXd.exe
  2⤵
  PID:9516
- C:\Windows\System\ODrYCyU.exe
  C:\Windows\System\ODrYCyU.exe
  2⤵
  PID:9728
- C:\Windows\System\YkdtfzW.exe
  C:\Windows\System\YkdtfzW.exe
  2⤵
  PID:9812
- C:\Windows\System\EmyXtBF.exe
  C:\Windows\System\EmyXtBF.exe
  2⤵
  PID:10072
- C:\Windows\System\YECGBBz.exe
  C:\Windows\System\YECGBBz.exe
  2⤵
  PID:10220
- C:\Windows\System\WNVKGPR.exe
  C:\Windows\System\WNVKGPR.exe
  2⤵
  PID:10052
- C:\Windows\System\nfqrduE.exe
  C:\Windows\System\nfqrduE.exe
  2⤵
  PID:9692
- C:\Windows\System\BQbgnNJ.exe
  C:\Windows\System\BQbgnNJ.exe
  2⤵
  PID:10280
- C:\Windows\System\rhFiHdB.exe
  C:\Windows\System\rhFiHdB.exe
  2⤵
  PID:10320
- C:\Windows\System\CbJCyxM.exe
  C:\Windows\System\CbJCyxM.exe
  2⤵
  PID:10344
- C:\Windows\System\lGviZXo.exe
  C:\Windows\System\lGviZXo.exe
  2⤵
  PID:10368
- C:\Windows\System\rqFnaeO.exe
  C:\Windows\System\rqFnaeO.exe
  2⤵
  PID:10396
- C:\Windows\System\BJeFcFY.exe
  C:\Windows\System\BJeFcFY.exe
  2⤵
  PID:10456
- C:\Windows\System\cFMhSED.exe
  C:\Windows\System\cFMhSED.exe
  2⤵
  PID:10488
- C:\Windows\System\UWJxUof.exe
  C:\Windows\System\UWJxUof.exe
  2⤵
  PID:10524
- C:\Windows\System\dEXJzkT.exe
  C:\Windows\System\dEXJzkT.exe
  2⤵
  PID:10544
- C:\Windows\System\INYOikW.exe
  C:\Windows\System\INYOikW.exe
  2⤵
  PID:10564
- C:\Windows\System\JYubmuG.exe
  C:\Windows\System\JYubmuG.exe
  2⤵
  PID:10608
- C:\Windows\System\NOFFcXp.exe
  C:\Windows\System\NOFFcXp.exe
  2⤵
  PID:10636
- C:\Windows\System\AZcKypV.exe
  C:\Windows\System\AZcKypV.exe
  2⤵
  PID:10664
- C:\Windows\System\CGlYAZz.exe
  C:\Windows\System\CGlYAZz.exe
  2⤵
  PID:10692
- C:\Windows\System\FqIMgRT.exe
  C:\Windows\System\FqIMgRT.exe
  2⤵
  PID:10716
- C:\Windows\System\rXXwddZ.exe
  C:\Windows\System\rXXwddZ.exe
  2⤵
  PID:10748
- C:\Windows\System\sTLXEYz.exe
  C:\Windows\System\sTLXEYz.exe
  2⤵
  PID:10764
- C:\Windows\System\Itknoxn.exe
  C:\Windows\System\Itknoxn.exe
  2⤵
  PID:10780
- C:\Windows\System\LuRNNqv.exe
  C:\Windows\System\LuRNNqv.exe
  2⤵
  PID:10812
- C:\Windows\System\bBZPYUT.exe
  C:\Windows\System\bBZPYUT.exe
  2⤵
  PID:10840
- C:\Windows\System\BeXTiax.exe
  C:\Windows\System\BeXTiax.exe
  2⤵
  PID:10872
- C:\Windows\System\GbWTFcW.exe
  C:\Windows\System\GbWTFcW.exe
  2⤵
  PID:10896
- C:\Windows\System\YUMyyJm.exe
  C:\Windows\System\YUMyyJm.exe
  2⤵
  PID:10916
- C:\Windows\System\hoNEJpQ.exe
  C:\Windows\System\hoNEJpQ.exe
  2⤵
  PID:10936
- C:\Windows\System\tmuXCSC.exe
  C:\Windows\System\tmuXCSC.exe
  2⤵
  PID:10952
- C:\Windows\System\oPaUXSU.exe
  C:\Windows\System\oPaUXSU.exe
  2⤵
  PID:10968
- C:\Windows\System\yAdkxjf.exe
  C:\Windows\System\yAdkxjf.exe
  2⤵
  PID:11036
- C:\Windows\System\TjHvncO.exe
  C:\Windows\System\TjHvncO.exe
  2⤵
  PID:11076
- C:\Windows\System\iWMYihz.exe
  C:\Windows\System\iWMYihz.exe
  2⤵
  PID:11108
- C:\Windows\System\EgPPgKB.exe
  C:\Windows\System\EgPPgKB.exe
  2⤵
  PID:11140
- C:\Windows\System\gRdKlSk.exe
  C:\Windows\System\gRdKlSk.exe
  2⤵
  PID:11180
- C:\Windows\System\UYtIjEf.exe
  C:\Windows\System\UYtIjEf.exe
  2⤵
  PID:11200
- C:\Windows\System\iZhShOJ.exe
  C:\Windows\System\iZhShOJ.exe
  2⤵
  PID:11228
- C:\Windows\System\DArMSLx.exe
  C:\Windows\System\DArMSLx.exe
  2⤵
  PID:9448
- C:\Windows\System\OiEKKZT.exe
  C:\Windows\System\OiEKKZT.exe
  2⤵
  PID:10304
- C:\Windows\System\uejJZeh.exe
  C:\Windows\System\uejJZeh.exe
  2⤵
  PID:4980
- C:\Windows\System\KYIsLtf.exe
  C:\Windows\System\KYIsLtf.exe
  2⤵
  PID:10464
- C:\Windows\System\lTlfiIm.exe
  C:\Windows\System\lTlfiIm.exe
  2⤵
  PID:10540
- C:\Windows\System\oCXMsJB.exe
  C:\Windows\System\oCXMsJB.exe
  2⤵
  PID:10632
- C:\Windows\System\nTSxZdF.exe
  C:\Windows\System\nTSxZdF.exe
  2⤵
  PID:10684
- C:\Windows\System\oHaqhUb.exe
  C:\Windows\System\oHaqhUb.exe
  2⤵
  PID:10728
- C:\Windows\System\lfIIpzb.exe
  C:\Windows\System\lfIIpzb.exe
  2⤵
  PID:10832
- C:\Windows\System\vofwsGH.exe
  C:\Windows\System\vofwsGH.exe
  2⤵
  PID:10792
- C:\Windows\System\uLTfiwX.exe
  C:\Windows\System\uLTfiwX.exe
  2⤵
  PID:10888
- C:\Windows\System\RKZidGQ.exe
  C:\Windows\System\RKZidGQ.exe
  2⤵
  PID:10944
- C:\Windows\System\guXHlRU.exe
  C:\Windows\System\guXHlRU.exe
  2⤵
  PID:11072
- C:\Windows\System\drvTgrf.exe
  C:\Windows\System\drvTgrf.exe
  2⤵
  PID:4048
- C:\Windows\System\YMSCkCC.exe
  C:\Windows\System\YMSCkCC.exe
  2⤵
  PID:11216
- C:\Windows\System\bStmMNh.exe
  C:\Windows\System\bStmMNh.exe
  2⤵
  PID:10340
- C:\Windows\System\zfLQGWm.exe
  C:\Windows\System\zfLQGWm.exe
  2⤵
  PID:10536
- C:\Windows\System\AsdFqjX.exe
  C:\Windows\System\AsdFqjX.exe
  2⤵
  PID:10556
- C:\Windows\System\DRNBTzS.exe
  C:\Windows\System\DRNBTzS.exe
  2⤵
  PID:10712
- C:\Windows\System\PQlpjbS.exe
  C:\Windows\System\PQlpjbS.exe
  2⤵
  PID:10820
- C:\Windows\System\jmdwxre.exe
  C:\Windows\System\jmdwxre.exe
  2⤵
  PID:11084
- C:\Windows\System\oaeSdLQ.exe
  C:\Windows\System\oaeSdLQ.exe
  2⤵
  PID:11212
- C:\Windows\System\fhcuxyu.exe
  C:\Windows\System\fhcuxyu.exe
  2⤵
  PID:10588
- C:\Windows\System\BLERdYr.exe
  C:\Windows\System\BLERdYr.exe
  2⤵
  PID:10740
- C:\Windows\System\CYLpqUV.exe
  C:\Windows\System\CYLpqUV.exe
  2⤵
  PID:10892
- C:\Windows\System\yeTvaNc.exe
  C:\Windows\System\yeTvaNc.exe
  2⤵
  PID:10560
- C:\Windows\System\YaRXYYj.exe
  C:\Windows\System\YaRXYYj.exe
  2⤵
  PID:10364
- C:\Windows\System\KkYmBem.exe
  C:\Windows\System\KkYmBem.exe
  2⤵
  PID:11284
- C:\Windows\System\zjxVewd.exe
  C:\Windows\System\zjxVewd.exe
  2⤵
  PID:11308
- C:\Windows\System\gUrYeIB.exe
  C:\Windows\System\gUrYeIB.exe
  2⤵
  PID:11340
- C:\Windows\System\aLFsjVW.exe
  C:\Windows\System\aLFsjVW.exe
  2⤵
  PID:11376
- C:\Windows\System\lvTaIFJ.exe
  C:\Windows\System\lvTaIFJ.exe
  2⤵
  PID:11392
- C:\Windows\System\nBwsaSF.exe
  C:\Windows\System\nBwsaSF.exe
  2⤵
  PID:11432
- C:\Windows\System\uFXgyzU.exe
  C:\Windows\System\uFXgyzU.exe
  2⤵
  PID:11452
- C:\Windows\System\yaQjMZt.exe
  C:\Windows\System\yaQjMZt.exe
  2⤵
  PID:11488
- C:\Windows\System\vOGLARS.exe
  C:\Windows\System\vOGLARS.exe
  2⤵
  PID:11516
- C:\Windows\System\eTQKWOo.exe
  C:\Windows\System\eTQKWOo.exe
  2⤵
  PID:11532
- C:\Windows\System\UJDYXPW.exe
  C:\Windows\System\UJDYXPW.exe
  2⤵
  PID:11560
- C:\Windows\System\tyUNBXk.exe
  C:\Windows\System\tyUNBXk.exe
  2⤵
  PID:11600
- C:\Windows\System\ygkWusK.exe
  C:\Windows\System\ygkWusK.exe
  2⤵
  PID:11628
- C:\Windows\System\KvpXbmr.exe
  C:\Windows\System\KvpXbmr.exe
  2⤵
  PID:11644
- C:\Windows\System\ZgadeQy.exe
  C:\Windows\System\ZgadeQy.exe
  2⤵
  PID:11664
- C:\Windows\System\eZLGsnc.exe
  C:\Windows\System\eZLGsnc.exe
  2⤵
  PID:11700
- C:\Windows\System\lPYXQlB.exe
  C:\Windows\System\lPYXQlB.exe
  2⤵
  PID:11728
- C:\Windows\System\uekDOYu.exe
  C:\Windows\System\uekDOYu.exe
  2⤵
  PID:11756
- C:\Windows\System\MBpXIzv.exe
  C:\Windows\System\MBpXIzv.exe
  2⤵
  PID:11776
- C:\Windows\System\ktHOKNJ.exe
  C:\Windows\System\ktHOKNJ.exe
  2⤵
  PID:11804
- C:\Windows\System\CPdxMPG.exe
  C:\Windows\System\CPdxMPG.exe
  2⤵
  PID:11824
- C:\Windows\System\IqiFquH.exe
  C:\Windows\System\IqiFquH.exe
  2⤵
  PID:11852
- C:\Windows\System\icGhJmp.exe
  C:\Windows\System\icGhJmp.exe
  2⤵
  PID:11884
- C:\Windows\System\vjFgvqi.exe
  C:\Windows\System\vjFgvqi.exe
  2⤵
  PID:11920
- C:\Windows\System\hnDKRvc.exe
  C:\Windows\System\hnDKRvc.exe
  2⤵
  PID:11960
- C:\Windows\System\bdfTQUZ.exe
  C:\Windows\System\bdfTQUZ.exe
  2⤵
  PID:11984
- C:\Windows\System\jFCBndM.exe
  C:\Windows\System\jFCBndM.exe
  2⤵
  PID:12024
- C:\Windows\System\qLSGtVT.exe
  C:\Windows\System\qLSGtVT.exe
  2⤵
  PID:12052
- C:\Windows\System\hsSYIbk.exe
  C:\Windows\System\hsSYIbk.exe
  2⤵
  PID:12068
- C:\Windows\System\RZZNTcD.exe
  C:\Windows\System\RZZNTcD.exe
  2⤵
  PID:12084
- C:\Windows\System\TSKaYCl.exe
  C:\Windows\System\TSKaYCl.exe
  2⤵
  PID:12112
- C:\Windows\System\xFDxcFV.exe
  C:\Windows\System\xFDxcFV.exe
  2⤵
  PID:12152
- C:\Windows\System\wFoRyMg.exe
  C:\Windows\System\wFoRyMg.exe
  2⤵
  PID:12176
- C:\Windows\System\PHEESXT.exe
  C:\Windows\System\PHEESXT.exe
  2⤵
  PID:12204
- C:\Windows\System\eYJYNzC.exe
  C:\Windows\System\eYJYNzC.exe
  2⤵
  PID:12240
- C:\Windows\System\sHEQsqe.exe
  C:\Windows\System\sHEQsqe.exe
  2⤵
  PID:12264
- C:\Windows\System\pkSBtff.exe
  C:\Windows\System\pkSBtff.exe
  2⤵
  PID:10648
- C:\Windows\System\AFVZbOO.exe
  C:\Windows\System\AFVZbOO.exe
  2⤵
  PID:11320
- C:\Windows\System\mNpAbEq.exe
  C:\Windows\System\mNpAbEq.exe
  2⤵
  PID:11360
- C:\Windows\System\xEPcnLi.exe
  C:\Windows\System\xEPcnLi.exe
  2⤵
  PID:11476
- C:\Windows\System\LPOjsWE.exe
  C:\Windows\System\LPOjsWE.exe
  2⤵
  PID:11524
- C:\Windows\System\AnQozEn.exe
  C:\Windows\System\AnQozEn.exe
  2⤵
  PID:11592
- C:\Windows\System\ZfCVzjo.exe
  C:\Windows\System\ZfCVzjo.exe
  2⤵
  PID:11660
- C:\Windows\System\NbjKfps.exe
  C:\Windows\System\NbjKfps.exe
  2⤵
  PID:11744
- C:\Windows\System\uVaZBEn.exe
  C:\Windows\System\uVaZBEn.exe
  2⤵
  PID:11784
- C:\Windows\System\eFGuxKx.exe
  C:\Windows\System\eFGuxKx.exe
  2⤵
  PID:11848
- C:\Windows\System\BOiwcAn.exe
  C:\Windows\System\BOiwcAn.exe
  2⤵
  PID:11904
- C:\Windows\System\iJpsKps.exe
  C:\Windows\System\iJpsKps.exe
  2⤵
  PID:11948
- C:\Windows\System\pUGbwKL.exe
  C:\Windows\System\pUGbwKL.exe
  2⤵
  PID:12020
- C:\Windows\System\gSUyzFS.exe
  C:\Windows\System\gSUyzFS.exe
  2⤵
  PID:12124
- C:\Windows\System\fleSsuZ.exe
  C:\Windows\System\fleSsuZ.exe
  2⤵
  PID:12196
- C:\Windows\System\PpWzrii.exe
  C:\Windows\System\PpWzrii.exe
  2⤵
  PID:12188
- C:\Windows\System\BZMIgCK.exe
  C:\Windows\System\BZMIgCK.exe
  2⤵
  PID:11124
- C:\Windows\System\LyIdeBy.exe
  C:\Windows\System\LyIdeBy.exe
  2⤵
  PID:11428
- C:\Windows\System\HivpPtd.exe
  C:\Windows\System\HivpPtd.exe
  2⤵
  PID:11552
- C:\Windows\System\wkQlEjm.exe
  C:\Windows\System\wkQlEjm.exe
  2⤵
  PID:11832
- C:\Windows\System\cvxKwvH.exe
  C:\Windows\System\cvxKwvH.exe
  2⤵
  PID:11840
- C:\Windows\System\KqvLGfP.exe
  C:\Windows\System\KqvLGfP.exe
  2⤵
  PID:11872
- C:\Windows\System\YJHnYxn.exe
  C:\Windows\System\YJHnYxn.exe
  2⤵
  PID:12008
- C:\Windows\System\opPZOHg.exe
  C:\Windows\System\opPZOHg.exe
  2⤵
  PID:11348
- C:\Windows\System\CnDYRga.exe
  C:\Windows\System\CnDYRga.exe
  2⤵
  PID:11512
- C:\Windows\System\VyHaiqa.exe
  C:\Windows\System\VyHaiqa.exe
  2⤵
  PID:1600
- C:\Windows\System\eDIpgHq.exe
  C:\Windows\System\eDIpgHq.exe
  2⤵
  PID:12192
- C:\Windows\System\xjTxJpA.exe
  C:\Windows\System\xjTxJpA.exe
  2⤵
  PID:12260
- C:\Windows\System\PwCsGTW.exe
  C:\Windows\System\PwCsGTW.exe
  2⤵
  PID:12132
- C:\Windows\System\KyJLAii.exe
  C:\Windows\System\KyJLAii.exe
  2⤵
  PID:12076
- C:\Windows\System\oLHmldx.exe
  C:\Windows\System\oLHmldx.exe
  2⤵
  PID:12312
- C:\Windows\System\MIMUXHi.exe
  C:\Windows\System\MIMUXHi.exe
  2⤵
  PID:12352
- C:\Windows\System\vFKRFPG.exe
  C:\Windows\System\vFKRFPG.exe
  2⤵
  PID:12380
- C:\Windows\System\tAOXMAa.exe
  C:\Windows\System\tAOXMAa.exe
  2⤵
  PID:12424
- C:\Windows\System\OFBgAAn.exe
  C:\Windows\System\OFBgAAn.exe
  2⤵
  PID:12452
- C:\Windows\System\BOkQgcy.exe
  C:\Windows\System\BOkQgcy.exe
  2⤵
  PID:12488
- C:\Windows\System\STwZHyU.exe
  C:\Windows\System\STwZHyU.exe
  2⤵
  PID:12504
- C:\Windows\System\XRrZqWW.exe
  C:\Windows\System\XRrZqWW.exe
  2⤵
  PID:12524
- C:\Windows\System\OnorEIy.exe
  C:\Windows\System\OnorEIy.exe
  2⤵
  PID:12556
- C:\Windows\System\GzfcLcX.exe
  C:\Windows\System\GzfcLcX.exe
  2⤵
  PID:12596
- C:\Windows\System\JbLswOK.exe
  C:\Windows\System\JbLswOK.exe
  2⤵
  PID:12616
- C:\Windows\System\SsldPZD.exe
  C:\Windows\System\SsldPZD.exe
  2⤵
  PID:12644
- C:\Windows\System\hMCFgBI.exe
  C:\Windows\System\hMCFgBI.exe
  2⤵
  PID:12684
- C:\Windows\System\ibTfwbE.exe
  C:\Windows\System\ibTfwbE.exe
  2⤵
  PID:12712
- C:\Windows\System\NOMmpXc.exe
  C:\Windows\System\NOMmpXc.exe
  2⤵
  PID:12728
- C:\Windows\System\mHEUxZL.exe
  C:\Windows\System\mHEUxZL.exe
  2⤵
  PID:12752
- C:\Windows\System\hHhKUSj.exe
  C:\Windows\System\hHhKUSj.exe
  2⤵
  PID:12772
- C:\Windows\System\tNvSowH.exe
  C:\Windows\System\tNvSowH.exe
  2⤵
  PID:12800
- C:\Windows\System\DOpDMgp.exe
  C:\Windows\System\DOpDMgp.exe
  2⤵
  PID:12852
- C:\Windows\System\xjrAIEX.exe
  C:\Windows\System\xjrAIEX.exe
  2⤵
  PID:12876
- C:\Windows\System\dnSCLgS.exe
  C:\Windows\System\dnSCLgS.exe
  2⤵
  PID:12896
- C:\Windows\System\uFLyaKn.exe
  C:\Windows\System\uFLyaKn.exe
  2⤵
  PID:12936
- C:\Windows\System\wcMSVHe.exe
  C:\Windows\System\wcMSVHe.exe
  2⤵
  PID:12952
- C:\Windows\System\YzxBkbf.exe
  C:\Windows\System\YzxBkbf.exe
  2⤵
  PID:12992
- C:\Windows\System\QiuEQiz.exe
  C:\Windows\System\QiuEQiz.exe
  2⤵
  PID:13012
- C:\Windows\System\WoHmzsh.exe
  C:\Windows\System\WoHmzsh.exe
  2⤵
  PID:13052
- C:\Windows\System\zdEVaeT.exe
  C:\Windows\System\zdEVaeT.exe
  2⤵
  PID:13068
- C:\Windows\System\bTeOKem.exe
  C:\Windows\System\bTeOKem.exe
  2⤵
  PID:13096
- C:\Windows\System\JlXDRkg.exe
  C:\Windows\System\JlXDRkg.exe
  2⤵
  PID:13124
- C:\Windows\System\VyXTRYp.exe
  C:\Windows\System\VyXTRYp.exe
  2⤵
  PID:13156
- C:\Windows\System\ZuoDcCn.exe
  C:\Windows\System\ZuoDcCn.exe
  2⤵
  PID:13180
- C:\Windows\System\GvqyxyT.exe
  C:\Windows\System\GvqyxyT.exe
  2⤵
  PID:13208
- C:\Windows\System\dHWqkOJ.exe
  C:\Windows\System\dHWqkOJ.exe
  2⤵
  PID:13232
- C:\Windows\System\hejbiUD.exe
  C:\Windows\System\hejbiUD.exe
  2⤵
  PID:13256
- C:\Windows\System\eyeECdi.exe
  C:\Windows\System\eyeECdi.exe
  2⤵
  PID:13292
- C:\Windows\System\vlqOrzb.exe
  C:\Windows\System\vlqOrzb.exe
  2⤵
  PID:12108
- C:\Windows\System\CVBVSbT.exe
  C:\Windows\System\CVBVSbT.exe
  2⤵
  PID:12364
- C:\Windows\System\MZivstM.exe
  C:\Windows\System\MZivstM.exe
  2⤵
  PID:12376
- C:\Windows\System\sqMkePH.exe
  C:\Windows\System\sqMkePH.exe
  2⤵
  PID:12500
- C:\Windows\System\WYLmWAq.exe
  C:\Windows\System\WYLmWAq.exe
  2⤵
  PID:12548
- C:\Windows\System\PDeqKWg.exe
  C:\Windows\System\PDeqKWg.exe
  2⤵
  PID:12636
- C:\Windows\System\GxFWqwy.exe
  C:\Windows\System\GxFWqwy.exe
  2⤵
  PID:12680
- C:\Windows\System\qqdhdcf.exe
  C:\Windows\System\qqdhdcf.exe
  2⤵
  PID:12748
- C:\Windows\System\xZHEexV.exe
  C:\Windows\System\xZHEexV.exe
  2⤵
  PID:12832
- C:\Windows\System\PdLDQBP.exe
  C:\Windows\System\PdLDQBP.exe
  2⤵
  PID:12908
- C:\Windows\System\lXGViSm.exe
  C:\Windows\System\lXGViSm.exe
  2⤵
  PID:12984
- C:\Windows\System\RAlIVaF.exe
  C:\Windows\System\RAlIVaF.exe
  2⤵
  PID:13084
- C:\Windows\System\IwewEkL.exe
  C:\Windows\System\IwewEkL.exe
  2⤵
  PID:13136
- C:\Windows\System\WiLFYZs.exe
  C:\Windows\System\WiLFYZs.exe
  2⤵
  PID:13172
- C:\Windows\System\pbyukkO.exe
  C:\Windows\System\pbyukkO.exe
  2⤵
  PID:13216
- C:\Windows\System\kEqCvbb.exe
  C:\Windows\System\kEqCvbb.exe
  2⤵
  PID:12464
- C:\Windows\System\KcgCKeS.exe
  C:\Windows\System\KcgCKeS.exe
  2⤵
  PID:12572
- C:\Windows\System\lhqDdVN.exe
  C:\Windows\System\lhqDdVN.exe
  2⤵
  PID:12584
- C:\Windows\System\AjuolxT.exe
  C:\Windows\System\AjuolxT.exe
  2⤵
  PID:12740
- C:\Windows\System\pzbqDqu.exe
  C:\Windows\System\pzbqDqu.exe
  2⤵
  PID:12916
- C:\Windows\System\cEusmtO.exe
  C:\Windows\System\cEusmtO.exe
  2⤵
  PID:13116
- C:\Windows\System\eHzEPJS.exe
  C:\Windows\System\eHzEPJS.exe
  2⤵
  PID:13176
- C:\Windows\System\nCvyRwJ.exe
  C:\Windows\System\nCvyRwJ.exe
  2⤵
  PID:11580
- C:\Windows\System\JqYgQJZ.exe
  C:\Windows\System\JqYgQJZ.exe
  2⤵
  PID:3620
- C:\Windows\System\zEajBZL.exe
  C:\Windows\System\zEajBZL.exe
  2⤵
  PID:13248
- C:\Windows\System\BANwjhX.exe
  C:\Windows\System\BANwjhX.exe
  2⤵
  PID:13332
- C:\Windows\System\jcwPGkC.exe
  C:\Windows\System\jcwPGkC.exe
  2⤵
  PID:13356
- C:\Windows\System\YRYvQPp.exe
  C:\Windows\System\YRYvQPp.exe
  2⤵
  PID:13384
- C:\Windows\System\UPFSInN.exe
  C:\Windows\System\UPFSInN.exe
  2⤵
  PID:13404
- C:\Windows\System\WKSwcca.exe
  C:\Windows\System\WKSwcca.exe
  2⤵
  PID:13440
- C:\Windows\System\GWvmEUl.exe
  C:\Windows\System\GWvmEUl.exe
  2⤵
  PID:13480
- C:\Windows\System\SObFZdM.exe
  C:\Windows\System\SObFZdM.exe
  2⤵
  PID:13496
- C:\Windows\System\dmWyOnU.exe
  C:\Windows\System\dmWyOnU.exe
  2⤵
  PID:13516
- C:\Windows\System\qSBukEo.exe
  C:\Windows\System\qSBukEo.exe
  2⤵
  PID:13548
- C:\Windows\System\KRWBqAk.exe
  C:\Windows\System\KRWBqAk.exe
  2⤵
  PID:13568
- C:\Windows\System\FNGVISp.exe
  C:\Windows\System\FNGVISp.exe
  2⤵
  PID:13592
- C:\Windows\System\zhXLAtX.exe
  C:\Windows\System\zhXLAtX.exe
  2⤵
  PID:13648
- C:\Windows\System\hloCRSO.exe
  C:\Windows\System\hloCRSO.exe
  2⤵
  PID:13676
- C:\Windows\System\fRzNTQY.exe
  C:\Windows\System\fRzNTQY.exe
  2⤵
  PID:13692
- C:\Windows\System\dOZBdhm.exe
  C:\Windows\System\dOZBdhm.exe
  2⤵
  PID:13708
- C:\Windows\System\vILQIWp.exe
  C:\Windows\System\vILQIWp.exe
  2⤵
  PID:13740
- C:\Windows\System\sWaTAOk.exe
  C:\Windows\System\sWaTAOk.exe
  2⤵
  PID:13768
- C:\Windows\System\PVhALuc.exe
  C:\Windows\System\PVhALuc.exe
  2⤵
  PID:13792
- C:\Windows\System\BCNbzQN.exe
  C:\Windows\System\BCNbzQN.exe
  2⤵
  PID:13824
- C:\Windows\System\CdYPXOb.exe
  C:\Windows\System\CdYPXOb.exe
  2⤵
  PID:13856
- C:\Windows\System\PsgBQCc.exe
  C:\Windows\System\PsgBQCc.exe
  2⤵
  PID:13876
- C:\Windows\System\dZfgHKj.exe
  C:\Windows\System\dZfgHKj.exe
  2⤵
  PID:13916
- C:\Windows\System\kgZpfGN.exe
  C:\Windows\System\kgZpfGN.exe
  2⤵
  PID:13936
- C:\Windows\System\gPebqjY.exe
  C:\Windows\System\gPebqjY.exe
  2⤵
  PID:13984
- C:\Windows\System\sjMBiGG.exe
  C:\Windows\System\sjMBiGG.exe
  2⤵
  PID:14000
- C:\Windows\System\atZjhig.exe
  C:\Windows\System\atZjhig.exe
  2⤵
  PID:14016
- C:\Windows\System\TDSxCCS.exe
  C:\Windows\System\TDSxCCS.exe
  2⤵
  PID:14040
- C:\Windows\System\sLkZvxL.exe
  C:\Windows\System\sLkZvxL.exe
  2⤵
  PID:14060
- C:\Windows\System\vNVrtEa.exe
  C:\Windows\System\vNVrtEa.exe
  2⤵
  PID:14092
- C:\Windows\System\VlBFLKp.exe
  C:\Windows\System\VlBFLKp.exe
  2⤵
  PID:14120
- C:\Windows\System\jlELPND.exe
  C:\Windows\System\jlELPND.exe
  2⤵
  PID:14144
- C:\Windows\System\nUuXtWS.exe
  C:\Windows\System\nUuXtWS.exe
  2⤵
  PID:14208
- C:\Windows\System\iFYRPRX.exe
  C:\Windows\System\iFYRPRX.exe
  2⤵
  PID:14236
- C:\Windows\System\DSddFHR.exe
  C:\Windows\System\DSddFHR.exe
  2⤵
  PID:14264
- C:\Windows\System\BPBkvAF.exe
  C:\Windows\System\BPBkvAF.exe
  2⤵
  PID:14292
- C:\Windows\System\xtBXNVd.exe
  C:\Windows\System\xtBXNVd.exe
  2⤵
  PID:14320
- C:\Windows\System\hQPoqRg.exe
  C:\Windows\System\hQPoqRg.exe
  2⤵
  PID:12396
- C:\Windows\System\FPfEiwc.exe
  C:\Windows\System\FPfEiwc.exe
  2⤵
  PID:13316
- C:\Windows\System\kDBXCMG.exe
  C:\Windows\System\kDBXCMG.exe
  2⤵
  PID:13348
- C:\Windows\System\zRubywJ.exe
  C:\Windows\System\zRubywJ.exe
  2⤵
  PID:13428
- C:\Windows\System\yKzIDYY.exe
  C:\Windows\System\yKzIDYY.exe
  2⤵
  PID:13512
- C:\Windows\System\ClsyUbC.exe
  C:\Windows\System\ClsyUbC.exe
  2⤵
  PID:13544
- C:\Windows\System\dTvHODZ.exe
  C:\Windows\System\dTvHODZ.exe
  2⤵
  PID:13660
- C:\Windows\System\FPTPPbY.exe
  C:\Windows\System\FPTPPbY.exe
  2⤵
  PID:13752
- C:\Windows\System\oyiXEKM.exe
  C:\Windows\System\oyiXEKM.exe
  2⤵
  PID:13800
- C:\Windows\System\OAXknhr.exe
  C:\Windows\System\OAXknhr.exe
  2⤵
  PID:13812
- C:\Windows\System\vybcQew.exe
  C:\Windows\System\vybcQew.exe
  2⤵
  PID:13888
- C:\Windows\System\tVibNeV.exe
  C:\Windows\System\tVibNeV.exe
  2⤵
  PID:13900
- C:\Windows\System\siIcjxV.exe
  C:\Windows\System\siIcjxV.exe
  2⤵
  PID:13932
- C:\Windows\System\VwaCpdN.exe
  C:\Windows\System\VwaCpdN.exe
  2⤵
  PID:14028
- C:\Windows\System\oVgGAlR.exe
  C:\Windows\System\oVgGAlR.exe
  2⤵
  PID:14136
- C:\Windows\System\HeptubW.exe
  C:\Windows\System\HeptubW.exe
  2⤵
  PID:14204
- C:\Windows\System\DXsJwGj.exe
  C:\Windows\System\DXsJwGj.exe
  2⤵
  PID:14312
- C:\Windows\System\PqXUGKz.exe
  C:\Windows\System\PqXUGKz.exe
  2⤵
  PID:13320
- C:\Windows\System\IqmQqdV.exe
  C:\Windows\System\IqmQqdV.exe
  2⤵
  PID:13436
- C:\Windows\System\pKajdoI.exe
  C:\Windows\System\pKajdoI.exe
  2⤵
  PID:13624
- C:\Windows\System\IaGkZMB.exe
  C:\Windows\System\IaGkZMB.exe
  2⤵
  PID:13724
- C:\Windows\System\oVfHSIZ.exe
  C:\Windows\System\oVfHSIZ.exe
  2⤵
  PID:13840
- C:\Windows\System\uYZIblv.exe
  C:\Windows\System\uYZIblv.exe
  2⤵
  PID:13836
- C:\Windows\System\muZcjXs.exe
  C:\Windows\System\muZcjXs.exe
  2⤵
  PID:14116
- C:\Windows\System\egJVxWt.exe
  C:\Windows\System\egJVxWt.exe
  2⤵
  PID:14256
- C:\Windows\System\HUXWlsk.exe
  C:\Windows\System\HUXWlsk.exe
  2⤵
  PID:13424
- C:\Windows\System\mbUbUyN.exe
  C:\Windows\System\mbUbUyN.exe
  2⤵
  PID:13536
- C:\Windows\System\tYjpcht.exe
  C:\Windows\System\tYjpcht.exe
  2⤵
  PID:1356
- C:\Windows\System\MmfCwFL.exe
  C:\Windows\System\MmfCwFL.exe
  2⤵
  PID:13612
- C:\Windows\System\TcLRSAd.exe
  C:\Windows\System\TcLRSAd.exe
  2⤵
  PID:14388
- C:\Windows\System\kbMxBxW.exe
  C:\Windows\System\kbMxBxW.exe
  2⤵
  PID:14404
- C:\Windows\System\XBysNbz.exe
  C:\Windows\System\XBysNbz.exe
  2⤵
  PID:14432
- C:\Windows\System\yDYOGUv.exe
  C:\Windows\System\yDYOGUv.exe
  2⤵
  PID:14460
- C:\Windows\System\gFbuGcv.exe
  C:\Windows\System\gFbuGcv.exe
  2⤵
  PID:14476
- C:\Windows\System\rnEoFRi.exe
  C:\Windows\System\rnEoFRi.exe
  2⤵
  PID:14496
- C:\Windows\System\CTqNLHz.exe
  C:\Windows\System\CTqNLHz.exe
  2⤵
  PID:14520
- C:\Windows\System\tfMOSTQ.exe
  C:\Windows\System\tfMOSTQ.exe
  2⤵
  PID:14572
- C:\Windows\System\Qmvutay.exe
  C:\Windows\System\Qmvutay.exe
  2⤵
  PID:14588
- C:\Windows\System\QxqjLJE.exe
  C:\Windows\System\QxqjLJE.exe
  2⤵
  PID:14620
- C:\Windows\System\zmPDfsT.exe
  C:\Windows\System\zmPDfsT.exe
  2⤵
  PID:14656
- C:\Windows\System\yWXZBdz.exe
  C:\Windows\System\yWXZBdz.exe
  2⤵
  PID:14684
- C:\Windows\System\cNgEhoE.exe
  C:\Windows\System\cNgEhoE.exe
  2⤵
  PID:14712
- C:\Windows\System\nvuyaFj.exe
  C:\Windows\System\nvuyaFj.exe
  2⤵
  PID:14728
- C:\Windows\System\vjMCrXL.exe
  C:\Windows\System\vjMCrXL.exe
  2⤵
  PID:14772
- C:\Windows\System\DhvXRZs.exe
  C:\Windows\System\DhvXRZs.exe
  2⤵
  PID:14796
- C:\Windows\System\mdeJGBl.exe
  C:\Windows\System\mdeJGBl.exe
  2⤵
  PID:14824
- C:\Windows\System\gDWnWJN.exe
  C:\Windows\System\gDWnWJN.exe
  2⤵
  PID:14852
- C:\Windows\System\lYpRJmm.exe
  C:\Windows\System\lYpRJmm.exe
  2⤵
  PID:14880
- C:\Windows\System\nsGwkjS.exe
  C:\Windows\System\nsGwkjS.exe
  2⤵
  PID:14908
- C:\Windows\System\IzZlQPa.exe
  C:\Windows\System\IzZlQPa.exe
  2⤵
  PID:14924
- C:\Windows\System\kdiseZx.exe
  C:\Windows\System\kdiseZx.exe
  2⤵
  PID:14952
- C:\Windows\System\hKcmYoB.exe
  C:\Windows\System\hKcmYoB.exe
  2⤵
  PID:14980
- C:\Windows\System\iMynHLl.exe
  C:\Windows\System\iMynHLl.exe
  2⤵
  PID:14996
- C:\Windows\System\bBMcDEF.exe
  C:\Windows\System\bBMcDEF.exe
  2⤵
  PID:15048
- C:\Windows\System\CyUeBAt.exe
  C:\Windows\System\CyUeBAt.exe
  2⤵
  PID:15064
- C:\Windows\System\UYwbWmj.exe
  C:\Windows\System\UYwbWmj.exe
  2⤵
  PID:15080
- C:\Windows\System\bcqelva.exe
  C:\Windows\System\bcqelva.exe
  2⤵
  PID:15108
- C:\Windows\System\psoJssY.exe
  C:\Windows\System\psoJssY.exe
  2⤵
  PID:15144
- C:\Windows\System\IFkQYhj.exe
  C:\Windows\System\IFkQYhj.exe
  2⤵
  PID:15180
- C:\Windows\System\xYocImW.exe
  C:\Windows\System\xYocImW.exe
  2⤵
  PID:15220
- C:\Windows\System\zWbuXNg.exe
  C:\Windows\System\zWbuXNg.exe
  2⤵
  PID:15248
- C:\Windows\System\eZSTNAG.exe
  C:\Windows\System\eZSTNAG.exe
  2⤵
  PID:15276
- C:\Windows\System\mmzjAEZ.exe
  C:\Windows\System\mmzjAEZ.exe
  2⤵
  PID:15300
- C:\Windows\System\XzgigTv.exe
  C:\Windows\System\XzgigTv.exe
  2⤵
  PID:15320
- C:\Windows\System\nVGCRSw.exe
  C:\Windows\System\nVGCRSw.exe
  2⤵
  PID:15352
- C:\Windows\System\YZczUEH.exe
  C:\Windows\System\YZczUEH.exe
  2⤵
  PID:14340
- C:\Windows\System\sDPWqAT.exe
  C:\Windows\System\sDPWqAT.exe
  2⤵
  PID:14368
- C:\Windows\System\ZDNMqno.exe
  C:\Windows\System\ZDNMqno.exe
  2⤵
  PID:14468
- C:\Windows\System\BxZJhVb.exe
  C:\Windows\System\BxZJhVb.exe
  2⤵
  PID:14532
- C:\Windows\System\ZdASMDN.exe
  C:\Windows\System\ZdASMDN.exe
  2⤵
  PID:14608
- C:\Windows\System\uJipTua.exe
  C:\Windows\System\uJipTua.exe
  2⤵
  PID:14640
- C:\Windows\System\yaAKxpV.exe
  C:\Windows\System\yaAKxpV.exe
  2⤵
  PID:14720
- C:\Windows\System\htgwSoR.exe
  C:\Windows\System\htgwSoR.exe
  2⤵
  PID:14820
- C:\Windows\System\HsaoiOL.exe
  C:\Windows\System\HsaoiOL.exe
  2⤵
  PID:14840
- C:\Windows\System\yxPwTcB.exe
  C:\Windows\System\yxPwTcB.exe
  2⤵
  PID:14892
- C:\Windows\System\fwwtJYJ.exe
  C:\Windows\System\fwwtJYJ.exe
  2⤵
  PID:14940
- C:\Windows\System\BrZPTYl.exe
  C:\Windows\System\BrZPTYl.exe
  2⤵
  PID:15024
- C:\Windows\System\yAtvEhY.exe
  C:\Windows\System\yAtvEhY.exe
  2⤵
  PID:15060
- C:\Windows\System\MrgaZjh.exe
  C:\Windows\System\MrgaZjh.exe
  2⤵
  PID:15136
- C:\Windows\System\yOgfNQk.exe
  C:\Windows\System\yOgfNQk.exe
  2⤵
  PID:15268
- C:\Windows\System\WSuYTcX.exe
  C:\Windows\System\WSuYTcX.exe
  2⤵
  PID:15316
- C:\Windows\System\MbdDuuw.exe
  C:\Windows\System\MbdDuuw.exe
  2⤵
  PID:13788
- C:\Windows\System\vGVzdJs.exe
  C:\Windows\System\vGVzdJs.exe
  2⤵
  PID:14452
- C:\Windows\System\ruzEhXh.exe
  C:\Windows\System\ruzEhXh.exe
  2⤵
  PID:14604
- C:\Windows\System\WMuWfzm.exe
  C:\Windows\System\WMuWfzm.exe
  2⤵
  PID:14724
- C:\Windows\System\bLGrOFH.exe
  C:\Windows\System\bLGrOFH.exe
  2⤵
  PID:14844
- C:\Windows\System\fmPklvM.exe
  C:\Windows\System\fmPklvM.exe
  2⤵
  PID:14976
- C:\Windows\System\AutNFHI.exe
  C:\Windows\System\AutNFHI.exe
  2⤵
  PID:15096
- C:\Windows\System\HMymPjO.exe
  C:\Windows\System\HMymPjO.exe
  2⤵
  PID:15244
- C:\Windows\System\ePUnrmu.exe
  C:\Windows\System\ePUnrmu.exe
  2⤵
  PID:15332
- C:\Windows\System\YsrDiZJ.exe
  C:\Windows\System\YsrDiZJ.exe
  2⤵
  PID:14600
- C:\Windows\System\yQiSGGc.exe
  C:\Windows\System\yQiSGGc.exe
  2⤵
  PID:14764
- C:\Windows\System\LiahnNV.exe
  C:\Windows\System\LiahnNV.exe
  2⤵
  PID:15368
- C:\Windows\System\dSNbeFU.exe
  C:\Windows\System\dSNbeFU.exe
  2⤵
  PID:15412
- C:\Windows\System\ZCDtCDy.exe
  C:\Windows\System\ZCDtCDy.exe
  2⤵
  PID:15460
- C:\Windows\System\RMAoYPc.exe
  C:\Windows\System\RMAoYPc.exe
  2⤵
  PID:15480
- C:\Windows\System\jPwdNFR.exe
  C:\Windows\System\jPwdNFR.exe
  2⤵
  PID:15504
- C:\Windows\System\JmssXon.exe
  C:\Windows\System\JmssXon.exe
  2⤵
  PID:15532
- C:\Windows\System\yaKXsGJ.exe
  C:\Windows\System\yaKXsGJ.exe
  2⤵
  PID:15560
- C:\Windows\System\VjLYBQp.exe
  C:\Windows\System\VjLYBQp.exe
  2⤵
  PID:15588
- C:\Windows\System\kONIBae.exe
  C:\Windows\System\kONIBae.exe
  2⤵
  PID:15612
- C:\Windows\System\YrPwnMB.exe
  C:\Windows\System\YrPwnMB.exe
  2⤵
  PID:15640
- C:\Windows\System\CRFvbUq.exe
  C:\Windows\System\CRFvbUq.exe
  2⤵
  PID:15660
- C:\Windows\System\bnMAgFB.exe
  C:\Windows\System\bnMAgFB.exe
  2⤵
  PID:15700
- C:\Windows\System\pGhItpA.exe
  C:\Windows\System\pGhItpA.exe
  2⤵
  PID:15744
- C:\Windows\System\QFdtQib.exe
  C:\Windows\System\QFdtQib.exe
  2⤵
  PID:15768
- C:\Windows\System\zcNwnjF.exe
  C:\Windows\System\zcNwnjF.exe
  2⤵
  PID:15796
- C:\Windows\System\PenMTqy.exe
  C:\Windows\System\PenMTqy.exe
  2⤵
  PID:15828
- C:\Windows\System\FYJVUgu.exe
  C:\Windows\System\FYJVUgu.exe
  2⤵
  PID:15876
- C:\Windows\System\etKGtBS.exe
  C:\Windows\System\etKGtBS.exe
  2⤵
  PID:15900
- C:\Windows\System\fKsYIMk.exe
  C:\Windows\System\fKsYIMk.exe
  2⤵
  PID:15940
- C:\Windows\System\DUjEWBv.exe
  C:\Windows\System\DUjEWBv.exe
  2⤵
  PID:15956
- C:\Windows\System\wjqQXls.exe
  C:\Windows\System\wjqQXls.exe
  2⤵
  PID:15972
- C:\Windows\System\bazLvrU.exe
  C:\Windows\System\bazLvrU.exe
  2⤵
  PID:16024
- C:\Windows\System\laDqcBy.exe
  C:\Windows\System\laDqcBy.exe
  2⤵
  PID:16052
- C:\Windows\System\vsoZpFQ.exe
  C:\Windows\System\vsoZpFQ.exe
  2⤵
  PID:16088
- C:\Windows\System\rygXtbO.exe
  C:\Windows\System\rygXtbO.exe
  2⤵
  PID:16112
- C:\Windows\System\jjDapXc.exe
  C:\Windows\System\jjDapXc.exe
  2⤵
  PID:16140
- C:\Windows\System\UPnpCZz.exe
  C:\Windows\System\UPnpCZz.exe
  2⤵
  PID:16188
- C:\Windows\System\bukcwqg.exe
  C:\Windows\System\bukcwqg.exe
  2⤵
  PID:16212
- C:\Windows\System\ZWillXH.exe
  C:\Windows\System\ZWillXH.exe
  2⤵
  PID:16256
- C:\Windows\System\LfLcScF.exe
  C:\Windows\System\LfLcScF.exe
  2⤵
  PID:16300
- C:\Windows\System\nPeWpHY.exe
  C:\Windows\System\nPeWpHY.exe
  2⤵
  PID:16316
- C:\Windows\System\IjtKGEn.exe
  C:\Windows\System\IjtKGEn.exe
  2⤵
  PID:16336
- C:\Windows\System\DMiMYBz.exe
  C:\Windows\System\DMiMYBz.exe
  2⤵
  PID:16368
- C:\Windows\System\mPVBtVA.exe
  C:\Windows\System\mPVBtVA.exe
  2⤵
  PID:15288
- C:\Windows\System\phxwLrI.exe
  C:\Windows\System\phxwLrI.exe
  2⤵
  PID:15424
- C:\Windows\System\UHAjjcX.exe
  C:\Windows\System\UHAjjcX.exe
  2⤵
  PID:15476
- C:\Windows\System\LpPlvzM.exe
  C:\Windows\System\LpPlvzM.exe
  2⤵
  PID:15568
- C:\Windows\System\nYtMPLw.exe
  C:\Windows\System\nYtMPLw.exe
  2⤵
  PID:15628
- C:\Windows\System\lavCFCs.exe
  C:\Windows\System\lavCFCs.exe
  2⤵
  PID:15696
- C:\Windows\System\RlWxkjX.exe
  C:\Windows\System\RlWxkjX.exe
  2⤵
  PID:15812
- C:\Windows\System\nUwpNld.exe
  C:\Windows\System\nUwpNld.exe
  2⤵
  PID:15892
- C:\Windows\System\eXzlwYY.exe
  C:\Windows\System\eXzlwYY.exe
  2⤵
  PID:15936
- C:\Windows\System\OJSQXYV.exe
  C:\Windows\System\OJSQXYV.exe
  2⤵
  PID:15968
- C:\Windows\System\cqBrdSR.exe
  C:\Windows\System\cqBrdSR.exe
  2⤵
  PID:16048
- C:\Windows\System\MyxxEWT.exe
  C:\Windows\System\MyxxEWT.exe
  2⤵
  PID:16128
- C:\Windows\System\ultmCLF.exe
  C:\Windows\System\ultmCLF.exe
  2⤵
  PID:16172
- C:\Windows\System\mQdrKsX.exe
  C:\Windows\System\mQdrKsX.exe
  2⤵
  PID:16332
- C:\Windows\System\DyVkgrW.exe
  C:\Windows\System\DyVkgrW.exe
  2⤵
  PID:16364
- C:\Windows\System\lhLUZKl.exe
  C:\Windows\System\lhLUZKl.exe
  2⤵
  PID:15396
- C:\Windows\System\VPyZCaQ.exe
  C:\Windows\System\VPyZCaQ.exe
  2⤵
  PID:15500
- C:\Windows\System\ieotjAi.exe
  C:\Windows\System\ieotjAi.exe
  2⤵
  PID:15740
- C:\Windows\System\NflnjxJ.exe
  C:\Windows\System\NflnjxJ.exe
  2⤵
  PID:16004
- C:\Windows\System\ytIkeDg.exe
  C:\Windows\System\ytIkeDg.exe
  2⤵
  PID:15124
- C:\Windows\System\tsjFPqj.exe
  C:\Windows\System\tsjFPqj.exe
  2⤵
  PID:16288
- C:\Windows\System\iartLiP.exe
  C:\Windows\System\iartLiP.exe
  2⤵
  PID:15520
- C:\Windows\System\eyTpsLg.exe
  C:\Windows\System\eyTpsLg.exe
  2⤵
  PID:15652
- C:\Windows\System\rTXvadb.exe
  C:\Windows\System\rTXvadb.exe
  2⤵
  PID:16272
- C:\Windows\System\HLzeSit.exe
  C:\Windows\System\HLzeSit.exe
  2⤵
  PID:16408
- C:\Windows\System\XKOuogS.exe
  C:\Windows\System\XKOuogS.exe
  2⤵
  PID:16436
- C:\Windows\System\JCtQyLT.exe
  C:\Windows\System\JCtQyLT.exe
  2⤵
  PID:16456
- C:\Windows\System\RwJktCm.exe
  C:\Windows\System\RwJktCm.exe
  2⤵
  PID:16512
- C:\Windows\System\VQeXakj.exe
  C:\Windows\System\VQeXakj.exe
  2⤵
  PID:16536
- C:\Windows\System\MdkedKy.exe
  C:\Windows\System\MdkedKy.exe
  2⤵
  PID:16552
- C:\Windows\System\TfdfcpD.exe
  C:\Windows\System\TfdfcpD.exe
  2⤵
  PID:16572
- C:\Windows\System\ZvJHjAm.exe
  C:\Windows\System\ZvJHjAm.exe
  2⤵
  PID:16600
- C:\Windows\System\lICVhTw.exe
  C:\Windows\System\lICVhTw.exe
  2⤵
  PID:16632
- C:\Windows\System\YfAXiAs.exe
  C:\Windows\System\YfAXiAs.exe
  2⤵
  PID:16652
- C:\Windows\System\eMyudNn.exe
  C:\Windows\System\eMyudNn.exe
  2⤵
  PID:16700
- C:\Windows\System\VTrjCcE.exe
  C:\Windows\System\VTrjCcE.exe
  2⤵
  PID:16736
- C:\Windows\System\KEmYhqa.exe
  C:\Windows\System\KEmYhqa.exe
  2⤵
  PID:16756
- C:\Windows\System\CRYOcEg.exe
  C:\Windows\System\CRYOcEg.exe
  2⤵
  PID:16776
- C:\Windows\System\lWwjpup.exe
  C:\Windows\System\lWwjpup.exe
  2⤵
  PID:16796
- C:\Windows\System\GjqUNfL.exe
  C:\Windows\System\GjqUNfL.exe
  2⤵
  PID:16820
- C:\Windows\System\xTtRMAd.exe
  C:\Windows\System\xTtRMAd.exe
  2⤵
  PID:16872
- C:\Windows\System\ILiWpyC.exe
  C:\Windows\System\ILiWpyC.exe
  2⤵
  PID:16900
- C:\Windows\System\CyGsTqq.exe
  C:\Windows\System\CyGsTqq.exe
  2⤵
  PID:16924
- C:\Windows\System\tJxQQGC.exe
  C:\Windows\System\tJxQQGC.exe
  2⤵
  PID:16944
- C:\Windows\System\fragJsc.exe
  C:\Windows\System\fragJsc.exe
  2⤵
  PID:16968
- C:\Windows\System\AsHiHNj.exe
  C:\Windows\System\AsHiHNj.exe
  2⤵
  PID:17004
- C:\Windows\System\GHFvttN.exe
  C:\Windows\System\GHFvttN.exe
  2⤵
  PID:17028
- C:\Windows\System\zOXJlxi.exe
  C:\Windows\System\zOXJlxi.exe
  2⤵
  PID:17048
- C:\Windows\System\APYEfjA.exe
  C:\Windows\System\APYEfjA.exe
  2⤵
  PID:17072
- C:\Windows\System\OSzUbrB.exe
  C:\Windows\System\OSzUbrB.exe
  2⤵
  PID:17116
- C:\Windows\System\CuVBQHr.exe
  C:\Windows\System\CuVBQHr.exe
  2⤵
  PID:17140
- C:\Windows\System\rVUzFhr.exe
  C:\Windows\System\rVUzFhr.exe
  2⤵
  PID:17180
- C:\Windows\System\yOxQrvx.exe
  C:\Windows\System\yOxQrvx.exe
  2⤵
  PID:17208
- C:\Windows\System\sNGYWbQ.exe
  C:\Windows\System\sNGYWbQ.exe
  2⤵
  PID:17236
- C:\Windows\System\ftfYJUO.exe
  C:\Windows\System\ftfYJUO.exe
  2⤵
  PID:17252
- C:\Windows\System\taDwOXB.exe
  C:\Windows\System\taDwOXB.exe
  2⤵
  PID:17288
- C:\Windows\System\YJvzDWr.exe
  C:\Windows\System\YJvzDWr.exe
  2⤵
  PID:17320
- C:\Windows\System\KZyWAqT.exe
  C:\Windows\System\KZyWAqT.exe
  2⤵
  PID:17336
- C:\Windows\System\qagCXCd.exe
  C:\Windows\System\qagCXCd.exe
  2⤵
  PID:17360
- C:\Windows\System\grplwZI.exe
  C:\Windows\System\grplwZI.exe
  2⤵
  PID:17376
- C:\Windows\System\KYvITcN.exe
  C:\Windows\System\KYvITcN.exe
  2⤵
  PID:16040
- C:\Windows\System\olmYJeR.exe
  C:\Windows\System\olmYJeR.exe
  2⤵
  PID:16432
- C:\Windows\System\JedDwnk.exe
  C:\Windows\System\JedDwnk.exe
  2⤵
  PID:16528
- C:\Windows\System\APBZDvx.exe
  C:\Windows\System\APBZDvx.exe
  2⤵
  PID:16580
- C:\Windows\System\JtHUwga.exe
  C:\Windows\System\JtHUwga.exe
  2⤵
  PID:16592
- C:\Windows\System\NCMbjKa.exe
  C:\Windows\System\NCMbjKa.exe
  2⤵
  PID:16676
- C:\Windows\System\iLhWZkp.exe
  C:\Windows\System\iLhWZkp.exe
  2⤵
  PID:16728
- C:\Windows\System\dsQQAWJ.exe
  C:\Windows\System\dsQQAWJ.exe
  2⤵
  PID:16832
- C:\Windows\System\WRTjcxs.exe
  C:\Windows\System\WRTjcxs.exe
  2⤵
  PID:16864
- C:\Windows\System\UUtBUYi.exe
  C:\Windows\System\UUtBUYi.exe
  2⤵
  PID:16916
- C:\Windows\System\eqmeLcP.exe
  C:\Windows\System\eqmeLcP.exe
  2⤵
  PID:16960
- C:\Windows\System\aVXmSch.exe
  C:\Windows\System\aVXmSch.exe
  2⤵
  PID:17060
- C:\Windows\System\UBdVMOQ.exe
  C:\Windows\System\UBdVMOQ.exe
  2⤵
  PID:17136
- C:\Windows\System\yZLWvlf.exe
  C:\Windows\System\yZLWvlf.exe
  2⤵
  PID:17188
- C:\Windows\System\pYDmKyf.exe
  C:\Windows\System\pYDmKyf.exe
  2⤵
  PID:17296
- C:\Windows\System\NbEzlyG.exe
  C:\Windows\System\NbEzlyG.exe
  2⤵
  PID:17372
- C:\Windows\System\uvFuveJ.exe
  C:\Windows\System\uvFuveJ.exe
  2⤵
  PID:16492

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CvtJbOa.exe

Filesize
1.3MB

MD5
a8ae8bd45385f062d9d479e152989a9d

SHA1
3e949ccb0fad66f92b24e870c34992c923f37c8c

SHA256
764323cd7fe888823bc8b5258a6757dfc5bf6c9c3eeee7119c720c16163de61f

SHA512
0e714d022ec54040f33d99a78c59baf33256385b18da4e4426197276487bc7632293c9be53565252e9c35688287508859ea8f8bf52c90e242e11da856e3db511

Download Submit
C:\Windows\System\DWUfroM.exe

Filesize
1.3MB

MD5
c2631daf0c8fee5d584675f5d8595001

SHA1
7584e28947da435b546136900637ba36752c6ee6

SHA256
12f8ce180b0bc200b056ff38e486804a616a75c0a6a1b5f5a9c75f5125ea1a59

SHA512
a5bb3852fffc997ae19b6714c7e58d61ec5edc4d2478edeacf9ee44197bd7e65e53bce5d7393fde846aef3e7faf5b35db16ee200e542d15e0e31c3c04c5f9ccb

Download Submit
C:\Windows\System\EuWwSqt.exe

Filesize
1.3MB

MD5
689eb2f14b3c51cf1d638d529dc0b6bc

SHA1
40b19eb8cb00ac1cee2aab52be94c74806d75e7e

SHA256
45ea3dddd92204a0bd638df2e00704adf86bea1b1553f9ad3a77bf950f5aa903

SHA512
a6fdac4a168ba01c588c137b055980f7a88aa680d4519dee2a325f8ec6ffa0a1cf142142ec9828cefecfc9b962132681378ac14caad4d53528668454a13fc0e5

Download Submit
C:\Windows\System\GbLpjva.exe

Filesize
1.3MB

MD5
b579a6f68ae3f3cb5987ec8b017ac501

SHA1
a006084e4d2c1028d43b1728b48b21cde84d431b

SHA256
9e7e2932f358e04e7853310ffc2f10f01deaa8169adf1729f9d7b85b6ad25b96

SHA512
fbcbfc6dc4079e7ee15de1cf57b145e900f4a4343689f361b409af88c0f12ec6e4b80e401c39ede5cf364da160692486320d12c1407f2bafe864ce2595d3eb77

Download Submit
C:\Windows\System\IgkUwNv.exe

Filesize
1.3MB

MD5
99303d9c7afcdb8ab5cafebe4d22ac0f

SHA1
a34000e386d72a94023a5e1af6d6d1f4318b2bd8

SHA256
2ace66155b61d7633a5dad69296621bffb84aaed7092814d5ef5feaa1af62486

SHA512
52de831c393f91cb80371f2c0f65af42163317a14aee2919e7b73fe207fae8403c9ba5d237e53d78df4a56901b080c349daa05a85434130fdba5579f14fac9dd

Download Submit
C:\Windows\System\JwSEykP.exe

Filesize
1.3MB

MD5
ac04dc20b42751cb3c89ed9bdc0a93eb

SHA1
e329d8801398a16379a00a9599ec56a4a83f39e0

SHA256
b5204064c6d621e328bffad270d7898822a56a384d68a13f1c580cbe7966fe59

SHA512
46cc6b3f8b4f713f71a798502f8448c667b0ac2d739b0f0e4a4a31b31c1b5fe92e72a8f355931e003ea374318194767c6a05afe439474d34173b71ef4fb8d9a9

Download Submit
C:\Windows\System\LBYcfXp.exe

Filesize
1.3MB

MD5
d8daf68e6dd207012fa92a4e68f9dede

SHA1
61875ec94624628035e5a94cf492cd27f9e12282

SHA256
a93799f71b3d18630c955b4a68764fea27a0704743b569d3f38508b779327f70

SHA512
23f549154829a5ad065097845d4f63768a051ac2eeb1d815dc32cc73dd5bbab727dfdd3c391942e139b4843cf4f1bceeedcd727d2273c2e101c94be0d57b20f3

Download Submit
C:\Windows\System\MsWeveN.exe

Filesize
1.3MB

MD5
e97a436cd66a9a1ada090f6e6b450d68

SHA1
2476942b367837960c7d65554a8f9c2a72a6079d

SHA256
cfdbc7ba826361db378e31b4fc7a2a654b8eb83e8136fb47fbb660f5aa3019c5

SHA512
2dc0d79afe67fb9506aa04413a9ae84d488a5dca5ba0d688d9c7fa0cbc3edaab7cd20103d50718f88f9daba9b58b6a2a8d42b12f407e08790aacb64cac40b96e

Download Submit
C:\Windows\System\RAaZWrm.exe

Filesize
1.3MB

MD5
12a465082e766445fbcadb3e12c86380

SHA1
ae2127ada969453760091963abbbba338b17b584

SHA256
dbe48772ad4f6b7a3c61e8856dc28e8b66e7c5904a7127d3c6e207926395c1dd

SHA512
67b02a22062bc3550b0dc3f81323fb33376038bc9ed36114b6833c9bcf46c6a93586e6ef94cd89d40f16a71a1fd89a6153b2f8375b9b41c6fb975e6f2acf2cc2

Download Submit
C:\Windows\System\RgFVaCp.exe

Filesize
1.3MB

MD5
d96318e9916718b428a623c7dee93942

SHA1
7e2b24fd32cde9c50409ddd4091a80ec03f7873c

SHA256
4283e8e4d5798cced642faa87d176c6ac88557d4f22e41f4b414798c524d250f

SHA512
3cbaa770545ce86502668643435e72de8fce652d8699535577231976268ba779a2d7745f64a9445ccfba5908206b6384ff7019d9ead0b5c503277111c8f1a5a1

Download Submit
C:\Windows\System\WnCatbh.exe

Filesize
1.3MB

MD5
4ea6fa4b07e1d33d0c3cf4fcd1ed50ba

SHA1
57211c356d55be83d29157822ce0e92f7d29ea88

SHA256
76c57f231d08d0c6da23796e6d1552cfc4384f5c7507cb8ffafb0848944666a8

SHA512
e1a1ed0a0bf5ea802319eb65ef1fdc1a811d481a313cfe93704b2c1676a0e03a89786a0b40ed496e9715d2aac9688f843cb2da4a25bda6f753ce7cff3a8bd62e

Download Submit
C:\Windows\System\XuSWZmF.exe

Filesize
1.3MB

MD5
55aa4b7fc7f3300245d3b7db0f01574f

SHA1
3a5c53180b6168de297d3fd2d3c37b453d6a1c95

SHA256
fd597686cb1d6e02677e092195d6ed65ff6219cd273cf950cc502c6b95edc419

SHA512
b426f02372bd6deb306e0057d0c9611c02e975c95ecbbba35f9ddd5485d5a6dcd2dababaa6ac2ef6e00408ea8a755a29b4c89afb4cfd39c7974a6ec8ba9a8cd1

Download Submit
C:\Windows\System\YVTolcF.exe

Filesize
1.3MB

MD5
5bd905e6b64d4eb9565b3443a5157260

SHA1
e1457675b0a1452842d759f742efc46d6dacc97d

SHA256
d780272dc8f70dffb7ffbe5fd781d88e775712f74f6c5df81752150f0d95d71d

SHA512
a0ad236ce79d6966c058c8d577c0476b3a81357839dfefc2c8036cffcd8c03d589f7ee124637e17607d50d6fdaa211650bb5beb9b998f049e61ea7900571ebc9

Download Submit
C:\Windows\System\ZflrbYn.exe

Filesize
1.3MB

MD5
cdc162668cb09024dca2b1083267e31a

SHA1
f11135c56480f722a020533b164751dc0f609872

SHA256
5ae7c48cf1ae38bfeb092e6aba9c0400ea118a25197b5d80e8117a6b221946a3

SHA512
685c0c4a1bdd7cf96ac6a8c189564fa43cd54dc4333bcaeea71f89afa8c3ebe52b498fdd1913ab723e2427f15d60b8bbe2affbc8f8df1b21d722e217df81b55c

Download Submit
C:\Windows\System\ZkQqQMQ.exe

Filesize
1.3MB

MD5
b10a3c7d7d8467fdf9873b6ac415b393

SHA1
df06ed47a098a14e9aed79f4b9b15281264b3e69

SHA256
9fab3ea7ad0e44d57ee46850bcf23a1c73b23110411572547963b4857e8a6423

SHA512
699573a322570dcb0f2ed17c7ae1a11418abf1d2f5eefb2b25b863f23d12e727d8077f9714b0048c318005650592deb714f2c8084095dbb21717425adaac24b7

Download Submit
C:\Windows\System\ammukyB.exe

Filesize
1.3MB

MD5
bcc94a1f54099eaf1a9eda2ffcd946a4

SHA1
fa71f5241a9cb037b228efac454c462f8f897687

SHA256
c5cb9030c4cc45533d6fb263c5c2b44977206d99410ffb9b49a961de7e0c4549

SHA512
8c3696227fd7ecd7ffc293e57de15270ad4b46d45b9bcfb0be56336a8d8442ad859ffc5a06ae757ba44531ac91b7b4a60b65cb88e4e1f4ce22b41cbfc5b83692

Download Submit
C:\Windows\System\bxPGQvp.exe

Filesize
1.3MB

MD5
b2e9788db2d19be4408b7336443f1a33

SHA1
41ad16ade9a92fa9e85d8a0f24c2f8017858d49e

SHA256
00f9cbad7c5cbe516bf139cfe55e6cac1b4cdc3b7ab6cae71035b6354a4fc44c

SHA512
63d16639e74df81cb1555d36679cb867acc4b9354a3adf0e99f3cb75b7f3cb664de98a7bce54b4d7a9ac2adc5c9059632bd5992002687dab48784f8859f26ca5

Download Submit
C:\Windows\System\gNVLQGC.exe

Filesize
1.3MB

MD5
4dd7ab0d5b231f9a0133c2c79faff691

SHA1
364d30bf8d3c0361995e6a86a736cbb870d91691

SHA256
98e2f255b6d57767d5bf756a32379b137d88c9ecead40a6dae13de71f4c900a7

SHA512
b32aa1f00166bbc7666f85925be8195106b99ebb6ef9b4d2119bd3893397a9481b4dc7f0c64f336db25ac56aff4dc7f3931696abb6b628ab8fe4e21244c11979

Download Submit
C:\Windows\System\hBbbhVU.exe

Filesize
1.3MB

MD5
d9327debb09555ba5e2c82a1438e0f6c

SHA1
5349aff703104a9c571d66a4f935a5c119b71d99

SHA256
3417b7fe1e2ea83d868fe6142c6c122e57cf0051d0312578f614cbc2b311675f

SHA512
783f261ce0f1befe91c31d200203b6e382ddb27d118047ea3e345be7ea0d53474711a5ecfdfe4fa17cb93be03360dc8390ee252b7d3dd299df13e564dc19c95f

Download Submit
C:\Windows\System\iXtxFWQ.exe

Filesize
1.3MB

MD5
993eb775b84008e018236d0f6859bd16

SHA1
1df96beb44b7d3d9c6894535a94246321c9b0f71

SHA256
4833b34917016883871eb8db27e2042f7b70ec86cacc0ed1292a10ac0b214091

SHA512
6ac1fc2a2ccf1ec03485e7cba5c52b55f8b5718cbce39943a28ada005d586df682f3a9999de025034ffab2e2af387dfed60f3ec84b55c2a1bd8be6c0725536a9

Download Submit
C:\Windows\System\kbJvVMC.exe

Filesize
1.3MB

MD5
dc8553511a192c5a10bfa6b0d4daa5f2

SHA1
fdf7d0b605e645d9f638041aa0b60e3ca21f3534

SHA256
ec71ab6ffd50bab94fefdef63867a5893a78f116dae5e3f406d92d91b6fd033d

SHA512
3c19f43346a261d35f45bd40f66c3c224171404cd4bcbf73b8963e05a3639f716ec8713c75fd4ffe86813521f71077823d59cbfa7d60c1c275a658ccd3b4fffe

Download Submit
C:\Windows\System\kpRDLbk.exe

Filesize
1.3MB

MD5
33d4ee37661e46ea001e09b984088cb9

SHA1
41be241f6b60459de7fbf9f4ded2e2b2076a03ad

SHA256
dafb0bd70b0432239c039628848d95d1207b03f1042137d50f460ac7e54328b6

SHA512
1237d243096e42083c0a15c3376a4734e56deca51ae16b614c7f49b4d6882b2a33d32af5206bf90cc47ca4482374a95c29b1e5fee889b93b3486ae0c76bf3d95

Download Submit
C:\Windows\System\kphhwfr.exe

Filesize
1.3MB

MD5
e21d7c5a7c617223b1c61168dd6818b2

SHA1
a142ad98339f7b7bd8c02ddb97d5463be6621c37

SHA256
751ac00df745061fd039c54435e89fa34b31b27177971dc4c019f7797a854530

SHA512
938c4f2f3a34cea7afad6717590f27406eae3af06b98800279a3e8080cd1d4dec46567d97cccdd3b15a8ab49604a6a424c2570e42f531f3e9f770e36368152d1

Download Submit
C:\Windows\System\lOxnwVz.exe

Filesize
1.3MB

MD5
f46c9c83ef8a5b03fb4304e6ed3265fe

SHA1
cb2d3929f58b714b0abce65994af1079335953ce

SHA256
da1a282bc3fd72e8623502251699938e95db8fdcd9702c3f35c78795e90743ab

SHA512
c9d67d4f5c7523eb783cad602c82c9d567711c3b5a68aa30f127da9314370fd230fdd917b709d656f85b4fd5b74e38b751457430f1ac47de0151a9acea9df74a

Download Submit
C:\Windows\System\nxdVvxl.exe

Filesize
1.3MB

MD5
47dd61a2d806958ea331e169f23f106f

SHA1
b7f8dc471c01c53f67c1c2586eec4d4f8742bbde

SHA256
658b9f0ac4a4f409991d6f3537decdba4ea6e8a8fd34a71978e9954de04f2423

SHA512
e009b321e16312dd0df7c077c55ea11aea14f4adba6e63486d24fd12b9eced58bf7f5a7b7a749337f90299b0db6d73d595587a87ce48d3c56b756f6444cad5fd

Download Submit
C:\Windows\System\pPYWNsx.exe

Filesize
1.3MB

MD5
08bbed7619435f494b3e8a9ce2be0d71

SHA1
3dc573674251ab79c782d67642b39e5c8b40d2b6

SHA256
756ec406f7e04efbbbd6ee1386435f5b3b071322cecdc3b1473434582158cef2

SHA512
342edb2d3cfc2f22d0d16e1f73a334aa1588adf80520cb7e7d64bcb234be7ddd4ab939443f2132292fcbe911e905cbe0d5978ac656d1c551bbdd7a919703624c

Download Submit
C:\Windows\System\rZHrnes.exe

Filesize
1.3MB

MD5
878dadcb2e3b93cfc85b442edc89b7d0

SHA1
a27b5e7ac15a4d600d649dc973948429169f65bf

SHA256
9cd58ecdd771a83c4077e77177fb3e42c3771fcd3ae999cac89f65820b86d23a

SHA512
d0a02de41876886d0c588a8cfa5007d21bbd86f73bf1f7d8461c321d1d977ddfb4ca2adfef75a65ade7326ab60760dd5d038360a782900680e62c5c0a4c02e58

Download Submit
C:\Windows\System\sDSxBso.exe

Filesize
1.3MB

MD5
3fa900cb8b660d5aed0b18e70ab46dcf

SHA1
cebec81aad89f24df6711feb92c6001e50c9fc58

SHA256
238633b14ed3a9bb10a080246c131d30c6f4afb642a55d0186acbc2d66215d7f

SHA512
42cad29f833d0c67643b71b0cb6ff4767d550d102389fbcf686013fd3ee28ceae4d04ef00c553cb7d183e7c82526cb8fbc5a9634a2875f1444a6baccaba8eb7b

Download Submit
C:\Windows\System\sLmCSqg.exe

Filesize
1.3MB

MD5
e4bf7a510b521ab44a7991e8b4ff7a0f

SHA1
a1466ef43ea904d3fb768fa9d86365f9724abf78

SHA256
f476ed83b442859f11882fb56ad4be2c6ae5f94d99646a9c1733d598cd6b96f1

SHA512
e74420d3cb0026c2a2aeee555075c73756efe51f8f2de082649777ae9b5670a8c3481917fe19ddbcbb95f5e920d0244b81e83d196c603d5998d8946df1ae612f

Download Submit
C:\Windows\System\tbRZdzM.exe

Filesize
1.3MB

MD5
cdc08b2483e4d4eb27b58ec91e3d215b

SHA1
25ded5cfcf3bb6193b104510cbfc5e88890c204d

SHA256
1863437bb788e16065c35b177c2b166accac0d1c65bb81328cdbf79092d87fa6

SHA512
9e2dd51866aadf3fdb27ee6453a0ce337b03245c308bef987e9d780c98a99b7d75c4472364da95a62fa81cebd41554e8c2ec4e850af4d1824e39ffd08ae5a3d5

Download Submit
C:\Windows\System\vwWFzdv.exe

Filesize
1.3MB

MD5
db642c3c536c6453c4622a6d21d7431e

SHA1
259ffa2c621d77865aab2d92ea11d038b8794bc6

SHA256
81e63152925a756c0e814f4e9871a9db2fc37f0c22925799ec06b3a87b093b51

SHA512
a7af0198ff0691ce619ff627503dd3009b68faf3b5679ff3ceaecc311dfc618b99d914e15995cfe5c3937b1dced690685f980f002e6eacb5e3ffdcf7b4c81981

Download Submit
C:\Windows\System\xCeavaq.exe

Filesize
1.3MB

MD5
b635434756251c9f46d02d1660f37fbb

SHA1
1085c07e610380f03abcc5ba6be79451f92eefbe

SHA256
df9d9d699edcb24d26ac22d5ac036ce99110710dae56a168944caaa755d83e2b

SHA512
4bce335c05adc8f768dc5417ac30ca5ccce2744b157c15fc90476fa6c6eb75199644bb249330706dbe6f19130aca7f7bac96460f4dc65037614484bdbe3fd8dc

Download Submit
C:\Windows\System\zKpoqSH.exe

Filesize
1.3MB

MD5
d52da1657519eec0f93e83de713e69e4

SHA1
1c15f35f8b0a502decde32df4149ca151877a793

SHA256
0ad5f26fdb252119edc24f0e7c6d3ff05f0b75dc9cad48740243bb2d16285331

SHA512
eb79219a49607894fdf0d5e56fa254e8b54f6a4d2c34b5101fa7af3928fb3d068c4e84df775eeaf90045d369124cbc618aaf7345ba7cce9e6febdc9f2cae4a19

Download Submit
memory/728-0-0x000001AC261E0000-0x000001AC261F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads