xmrig | 26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
Size

1.4MB
MD5

5673037bf131970c49d28a02cc4a6589
SHA1

08f353d04a98f7e6b6be9d7509fe20a1ad1a78b8
SHA256

26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16
SHA512

69d06832c196f51a2f23028e371e1502f38742d828d742e303e577ea3f38c159b3c11b2cf923c2e6b0947014cbcde73f2f8f3aa576a057f51c3a2768131552ff
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcmC3f/DFNkTQbOF+sabJKMC+DAjD1Gvw:knw9oUUEEDl37jcmWH/xbnbJo+kjF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/520-45-0x00007FF67A790000-0x00007FF67AB81000-memory.dmp	xmrig
behavioral2/memory/3160-50-0x00007FF7C4F60000-0x00007FF7C5351000-memory.dmp	xmrig
behavioral2/memory/4816-1108-0x00007FF616330000-0x00007FF616721000-memory.dmp	xmrig
behavioral2/memory/520-1105-0x00007FF67A790000-0x00007FF67AB81000-memory.dmp	xmrig
behavioral2/memory/4548-1673-0x00007FF624BA0000-0x00007FF624F91000-memory.dmp	xmrig
behavioral2/memory/4360-1763-0x00007FF79F320000-0x00007FF79F711000-memory.dmp	xmrig
behavioral2/memory/5036-1878-0x00007FF60D6D0000-0x00007FF60DAC1000-memory.dmp	xmrig
behavioral2/memory/3456-2069-0x00007FF63CF10000-0x00007FF63D301000-memory.dmp	xmrig
behavioral2/memory/520-2071-0x00007FF67A790000-0x00007FF67AB81000-memory.dmp	xmrig
behavioral2/memory/4248-2073-0x00007FF7C2330000-0x00007FF7C2721000-memory.dmp	xmrig
behavioral2/memory/3160-2115-0x00007FF7C4F60000-0x00007FF7C5351000-memory.dmp	xmrig
behavioral2/memory/4816-2154-0x00007FF616330000-0x00007FF616721000-memory.dmp	xmrig
behavioral2/memory/2732-2452-0x00007FF7DFD10000-0x00007FF7E0101000-memory.dmp	xmrig
behavioral2/memory/708-2529-0x00007FF7567D0000-0x00007FF756BC1000-memory.dmp	xmrig
behavioral2/memory/5036-2676-0x00007FF60D6D0000-0x00007FF60DAC1000-memory.dmp	xmrig
behavioral2/memory/4360-2674-0x00007FF79F320000-0x00007FF79F711000-memory.dmp	xmrig
behavioral2/memory/3456-2589-0x00007FF63CF10000-0x00007FF63D301000-memory.dmp	xmrig
behavioral2/memory/1388-2586-0x00007FF634620000-0x00007FF634A11000-memory.dmp	xmrig
behavioral2/memory/3444-2582-0x00007FF76CE10000-0x00007FF76D201000-memory.dmp	xmrig
behavioral2/memory/4128-2576-0x00007FF7484E0000-0x00007FF7488D1000-memory.dmp	xmrig
behavioral2/memory/2036-2574-0x00007FF731440000-0x00007FF731831000-memory.dmp	xmrig
behavioral2/memory/2296-2747-0x00007FF6FE140000-0x00007FF6FE531000-memory.dmp	xmrig
behavioral2/memory/3536-2692-0x00007FF631320000-0x00007FF631711000-memory.dmp	xmrig
behavioral2/memory/4504-2584-0x00007FF656D60000-0x00007FF657151000-memory.dmp	xmrig
behavioral2/memory/4548-2580-0x00007FF624BA0000-0x00007FF624F91000-memory.dmp	xmrig
behavioral2/memory/2012-2578-0x00007FF6E2ED0000-0x00007FF6E32C1000-memory.dmp	xmrig
behavioral2/memory/5112-2572-0x00007FF6E9D10000-0x00007FF6EA101000-memory.dmp	xmrig
behavioral2/memory/1236-2565-0x00007FF6CC130000-0x00007FF6CC521000-memory.dmp	xmrig
behavioral2/memory/4904-2563-0x00007FF7B6330000-0x00007FF7B6721000-memory.dmp	xmrig
behavioral2/memory/116-2560-0x00007FF7B11C0000-0x00007FF7B15B1000-memory.dmp	xmrig
behavioral2/memory/1216-2519-0x00007FF73D150000-0x00007FF73D541000-memory.dmp	xmrig
behavioral2/memory/4700-2527-0x00007FF6B58D0000-0x00007FF6B5CC1000-memory.dmp	xmrig
behavioral2/memory/4248-2517-0x00007FF7C2330000-0x00007FF7C2721000-memory.dmp	xmrig
behavioral2/memory/2832-2485-0x00007FF6165A0000-0x00007FF616991000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3160	rMhCGcj.exe
4816	cKAjfDv.exe
2732	SGHEZrq.exe
116	dzaCSjl.exe
4904	qyWnCRp.exe
1236	BhpgOvO.exe
2296	UbplDWB.exe
1216	FKXZGok.exe
4700	tpwRaWo.exe
708	dszTfCK.exe
3536	LBmPJOH.exe
5112	MkCpxUR.exe
4128	gtXOTYl.exe
2036	RhTMwjY.exe
4504	JCdUOwg.exe
2012	UMcoxVA.exe
3444	SpiDZow.exe
1388	OckSQBj.exe
4548	BULTOsj.exe
4360	wWtmNTQ.exe
5036	DAZsWEH.exe
2832	oklVPse.exe
3456	NXzhjlR.exe
4248	aChfBrA.exe
1256	AkmWYAV.exe
1412	TELGkqO.exe
3420	EUEJvNA.exe
1328	CyXrxcG.exe
1692	HWqNsbI.exe
4852	mRSqEoB.exe
4320	pIhqJdo.exe
3340	CZQFZbN.exe
2340	ihEvrPe.exe
3652	rNFWQDx.exe
2764	PTWNnsX.exe
1260	LycgSMj.exe
5056	KoxnFSU.exe
4160	SoysiHR.exe
4140	pgHRsNZ.exe
3988	skVcGuB.exe
3232	QNlAnIa.exe
2084	dGMPaJz.exe
2624	jJtvxZT.exe
3188	VvnHXvu.exe
644	lLexWkL.exe
2984	RmFowra.exe
4704	hGfMmlh.exe
4164	niPPYqd.exe
1560	XwVUIiK.exe
3100	oeULIQP.exe
1536	GdiPyND.exe
2124	FpkekcN.exe
1068	ZnTAlkk.exe
5072	mtaFWzY.exe
4584	OyifoGE.exe
4804	ATiYiwP.exe
552	PgSCTdx.exe
3116	MVpBKcw.exe
1084	NfckScB.exe
444	zhqSBrx.exe
4628	HzfvjSw.exe
1240	ordEAZP.exe
2548	avLqHoM.exe
1484	EfidYUA.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\fzLHIyt.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\kAeoMzl.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\GBzhAJc.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\pvFqibA.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\grmZSMt.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\UDGnBwQ.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\knhUjFW.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\vuHKwqR.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\HkEgwaZ.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\uVXcsre.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\HvkcRAg.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\kbRopIH.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\yeonVAJ.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\mTOiagZ.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\QUjZRpA.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\yuidhMh.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\UMwrKnL.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\hgPmrCe.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\voJASgU.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\AfXrDgW.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\HYmRFPk.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\CtXOaxV.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\KbRoadw.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\QkaEAIb.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\YUqvdot.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\MpQTHuY.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\LukmYHt.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\ZXeoJCf.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\pOfOouc.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\ALdCAgp.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\qyWnCRp.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\UZbsblg.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\bMbsHEx.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\apOEaof.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\rBcqGlT.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\BsuNBuq.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\AmxTkJv.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\WzJhHAE.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\RyNkqSa.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\dEIFtWY.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\zwLPHwE.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\bOXJTNB.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\bXujBGt.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\VbNAKyv.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\pIhqJdo.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\ihEvrPe.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\BrgeOlx.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\ZDUbGlI.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\QnIrJTm.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\wDXUphJ.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\pPMqmcs.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\RLrqOhg.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\ncCPKoi.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\RhTMwjY.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\SoysiHR.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\UAxBkmq.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\gdmQkyX.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\LIdRgxl.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\faCkvgE.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\KBBuYZY.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\zbgPilq.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\hrzzrYI.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\DTQlTRG.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
File created	C:\Windows\System32\DuIWguG.exe	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/520-0-0x00007FF67A790000-0x00007FF67AB81000-memory.dmp	upx
behavioral2/files/0x0009000000023c35-4.dat	upx
behavioral2/memory/3160-6-0x00007FF7C4F60000-0x00007FF7C5351000-memory.dmp	upx
behavioral2/files/0x0008000000023c4f-11.dat	upx
behavioral2/files/0x0008000000023c50-14.dat	upx
behavioral2/memory/116-21-0x00007FF7B11C0000-0x00007FF7B15B1000-memory.dmp	upx
behavioral2/memory/4904-25-0x00007FF7B6330000-0x00007FF7B6721000-memory.dmp	upx
behavioral2/files/0x0008000000023c54-31.dat	upx
behavioral2/memory/2296-33-0x00007FF6FE140000-0x00007FF6FE531000-memory.dmp	upx
behavioral2/files/0x0016000000023c6a-39.dat	upx
behavioral2/memory/520-45-0x00007FF67A790000-0x00007FF67AB81000-memory.dmp	upx
behavioral2/files/0x0008000000023c80-54.dat	upx
behavioral2/files/0x0008000000023c81-58.dat	upx
behavioral2/files/0x0008000000023c82-62.dat	upx
behavioral2/memory/4504-68-0x00007FF656D60000-0x00007FF657151000-memory.dmp	upx
behavioral2/memory/1388-80-0x00007FF634620000-0x00007FF634A11000-memory.dmp	upx
behavioral2/files/0x0007000000023cb3-196.dat	upx
behavioral2/files/0x0007000000023cba-217.dat	upx
behavioral2/files/0x0007000000023cb9-214.dat	upx
behavioral2/files/0x0007000000023cb8-211.dat	upx
behavioral2/files/0x0007000000023cb7-208.dat	upx
behavioral2/files/0x0007000000023cb6-205.dat	upx
behavioral2/files/0x0007000000023cb5-202.dat	upx
behavioral2/files/0x0007000000023cb4-199.dat	upx
behavioral2/files/0x0007000000023cb2-193.dat	upx
behavioral2/files/0x0007000000023cb1-190.dat	upx
behavioral2/files/0x0007000000023cb0-187.dat	upx
behavioral2/files/0x0007000000023caf-184.dat	upx
behavioral2/files/0x0007000000023cae-181.dat	upx
behavioral2/files/0x0007000000023cad-178.dat	upx
behavioral2/files/0x0007000000023cac-175.dat	upx
behavioral2/files/0x0007000000023cab-172.dat	upx
behavioral2/files/0x0007000000023caa-169.dat	upx
behavioral2/files/0x0007000000023ca9-166.dat	upx
behavioral2/files/0x0007000000023ca8-163.dat	upx
behavioral2/files/0x0007000000023ca7-160.dat	upx
behavioral2/files/0x0007000000023ca6-157.dat	upx
behavioral2/files/0x0007000000023ca5-154.dat	upx
behavioral2/files/0x0007000000023ca4-151.dat	upx
behavioral2/files/0x0007000000023ca3-148.dat	upx
behavioral2/files/0x0007000000023ca2-145.dat	upx
behavioral2/files/0x0007000000023ca1-142.dat	upx
behavioral2/files/0x0007000000023ca0-139.dat	upx
behavioral2/files/0x0007000000023c9f-136.dat	upx
behavioral2/files/0x0007000000023c9e-133.dat	upx
behavioral2/files/0x0007000000023c9d-130.dat	upx
behavioral2/files/0x0007000000023c9c-127.dat	upx
behavioral2/files/0x0007000000023c9b-124.dat	upx
behavioral2/files/0x0007000000023c9a-121.dat	upx
behavioral2/files/0x0007000000023c99-118.dat	upx
behavioral2/files/0x0007000000023c98-115.dat	upx
behavioral2/files/0x0007000000023c97-112.dat	upx
behavioral2/files/0x0007000000023c96-109.dat	upx
behavioral2/files/0x0007000000023c95-106.dat	upx
behavioral2/memory/4248-104-0x00007FF7C2330000-0x00007FF7C2721000-memory.dmp	upx
behavioral2/files/0x0007000000023c94-102.dat	upx
behavioral2/memory/3456-100-0x00007FF63CF10000-0x00007FF63D301000-memory.dmp	upx
behavioral2/files/0x0007000000023c93-98.dat	upx
behavioral2/memory/2832-96-0x00007FF6165A0000-0x00007FF616991000-memory.dmp	upx
behavioral2/files/0x0008000000023c8a-94.dat	upx
behavioral2/memory/5036-92-0x00007FF60D6D0000-0x00007FF60DAC1000-memory.dmp	upx
behavioral2/files/0x0008000000023c89-90.dat	upx
behavioral2/memory/4360-88-0x00007FF79F320000-0x00007FF79F711000-memory.dmp	upx
behavioral2/files/0x0008000000023c88-86.dat	upx

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7316	dwm.exe
Token: SeChangeNotifyPrivilege	7316	dwm.exe
Token: 33	7316	dwm.exe
Token: SeIncBasePriorityPrivilege	7316	dwm.exe
Token: SeShutdownPrivilege	7316	dwm.exe
Token: SeCreatePagefilePrivilege	7316	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 3160	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	85
PID 520 wrote to memory of 3160	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	85
PID 520 wrote to memory of 4816	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	86
PID 520 wrote to memory of 4816	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	86
PID 520 wrote to memory of 2732	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	87
PID 520 wrote to memory of 2732	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	87
PID 520 wrote to memory of 116	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	88
PID 520 wrote to memory of 116	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	88
PID 520 wrote to memory of 4904	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	89
PID 520 wrote to memory of 4904	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	89
PID 520 wrote to memory of 1236	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	90
PID 520 wrote to memory of 1236	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	90
PID 520 wrote to memory of 2296	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	91
PID 520 wrote to memory of 2296	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	91
PID 520 wrote to memory of 1216	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	92
PID 520 wrote to memory of 1216	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	92
PID 520 wrote to memory of 4700	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	93
PID 520 wrote to memory of 4700	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	93
PID 520 wrote to memory of 708	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	94
PID 520 wrote to memory of 708	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	94
PID 520 wrote to memory of 3536	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	95
PID 520 wrote to memory of 3536	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	95
PID 520 wrote to memory of 5112	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	96
PID 520 wrote to memory of 5112	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	96
PID 520 wrote to memory of 4128	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	97
PID 520 wrote to memory of 4128	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	97
PID 520 wrote to memory of 2036	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	98
PID 520 wrote to memory of 2036	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	98
PID 520 wrote to memory of 4504	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	99
PID 520 wrote to memory of 4504	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	99
PID 520 wrote to memory of 2012	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	100
PID 520 wrote to memory of 2012	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	100
PID 520 wrote to memory of 3444	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	101
PID 520 wrote to memory of 3444	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	101
PID 520 wrote to memory of 1388	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	102
PID 520 wrote to memory of 1388	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	102
PID 520 wrote to memory of 4548	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	103
PID 520 wrote to memory of 4548	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	103
PID 520 wrote to memory of 4360	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	104
PID 520 wrote to memory of 4360	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	104
PID 520 wrote to memory of 5036	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	105
PID 520 wrote to memory of 5036	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	105
PID 520 wrote to memory of 2832	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	106
PID 520 wrote to memory of 2832	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	106
PID 520 wrote to memory of 3456	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	107
PID 520 wrote to memory of 3456	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	107
PID 520 wrote to memory of 4248	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	108
PID 520 wrote to memory of 4248	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	108
PID 520 wrote to memory of 1256	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	109
PID 520 wrote to memory of 1256	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	109
PID 520 wrote to memory of 1412	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	110
PID 520 wrote to memory of 1412	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	110
PID 520 wrote to memory of 3420	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	111
PID 520 wrote to memory of 3420	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	111
PID 520 wrote to memory of 1328	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	112
PID 520 wrote to memory of 1328	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	112
PID 520 wrote to memory of 1692	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	113
PID 520 wrote to memory of 1692	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	113
PID 520 wrote to memory of 4852	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	114
PID 520 wrote to memory of 4852	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	114
PID 520 wrote to memory of 4320	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	115
PID 520 wrote to memory of 4320	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	115
PID 520 wrote to memory of 3340	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	116
PID 520 wrote to memory of 3340	520	26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe	116

C:\Users\Admin\AppData\Local\Temp\26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe
"C:\Users\Admin\AppData\Local\Temp\26dc7259d8530d24b8fa55c8184029a1d26693a902fd72e66160128536be7b16.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\System32\rMhCGcj.exe
  C:\Windows\System32\rMhCGcj.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System32\cKAjfDv.exe
  C:\Windows\System32\cKAjfDv.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System32\SGHEZrq.exe
  C:\Windows\System32\SGHEZrq.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System32\dzaCSjl.exe
  C:\Windows\System32\dzaCSjl.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System32\qyWnCRp.exe
  C:\Windows\System32\qyWnCRp.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System32\BhpgOvO.exe
  C:\Windows\System32\BhpgOvO.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System32\UbplDWB.exe
  C:\Windows\System32\UbplDWB.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System32\FKXZGok.exe
  C:\Windows\System32\FKXZGok.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System32\tpwRaWo.exe
  C:\Windows\System32\tpwRaWo.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System32\dszTfCK.exe
  C:\Windows\System32\dszTfCK.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System32\LBmPJOH.exe
  C:\Windows\System32\LBmPJOH.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System32\MkCpxUR.exe
  C:\Windows\System32\MkCpxUR.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System32\gtXOTYl.exe
  C:\Windows\System32\gtXOTYl.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System32\RhTMwjY.exe
  C:\Windows\System32\RhTMwjY.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System32\JCdUOwg.exe
  C:\Windows\System32\JCdUOwg.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System32\UMcoxVA.exe
  C:\Windows\System32\UMcoxVA.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System32\SpiDZow.exe
  C:\Windows\System32\SpiDZow.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System32\OckSQBj.exe
  C:\Windows\System32\OckSQBj.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System32\BULTOsj.exe
  C:\Windows\System32\BULTOsj.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System32\wWtmNTQ.exe
  C:\Windows\System32\wWtmNTQ.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System32\DAZsWEH.exe
  C:\Windows\System32\DAZsWEH.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System32\oklVPse.exe
  C:\Windows\System32\oklVPse.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System32\NXzhjlR.exe
  C:\Windows\System32\NXzhjlR.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System32\aChfBrA.exe
  C:\Windows\System32\aChfBrA.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System32\AkmWYAV.exe
  C:\Windows\System32\AkmWYAV.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System32\TELGkqO.exe
  C:\Windows\System32\TELGkqO.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System32\EUEJvNA.exe
  C:\Windows\System32\EUEJvNA.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System32\CyXrxcG.exe
  C:\Windows\System32\CyXrxcG.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System32\HWqNsbI.exe
  C:\Windows\System32\HWqNsbI.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System32\mRSqEoB.exe
  C:\Windows\System32\mRSqEoB.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System32\pIhqJdo.exe
  C:\Windows\System32\pIhqJdo.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System32\CZQFZbN.exe
  C:\Windows\System32\CZQFZbN.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System32\ihEvrPe.exe
  C:\Windows\System32\ihEvrPe.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System32\rNFWQDx.exe
  C:\Windows\System32\rNFWQDx.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System32\PTWNnsX.exe
  C:\Windows\System32\PTWNnsX.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System32\LycgSMj.exe
  C:\Windows\System32\LycgSMj.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System32\KoxnFSU.exe
  C:\Windows\System32\KoxnFSU.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System32\SoysiHR.exe
  C:\Windows\System32\SoysiHR.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System32\pgHRsNZ.exe
  C:\Windows\System32\pgHRsNZ.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System32\skVcGuB.exe
  C:\Windows\System32\skVcGuB.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System32\QNlAnIa.exe
  C:\Windows\System32\QNlAnIa.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System32\dGMPaJz.exe
  C:\Windows\System32\dGMPaJz.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System32\jJtvxZT.exe
  C:\Windows\System32\jJtvxZT.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System32\VvnHXvu.exe
  C:\Windows\System32\VvnHXvu.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System32\lLexWkL.exe
  C:\Windows\System32\lLexWkL.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System32\RmFowra.exe
  C:\Windows\System32\RmFowra.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System32\hGfMmlh.exe
  C:\Windows\System32\hGfMmlh.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System32\niPPYqd.exe
  C:\Windows\System32\niPPYqd.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System32\XwVUIiK.exe
  C:\Windows\System32\XwVUIiK.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System32\oeULIQP.exe
  C:\Windows\System32\oeULIQP.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System32\GdiPyND.exe
  C:\Windows\System32\GdiPyND.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System32\FpkekcN.exe
  C:\Windows\System32\FpkekcN.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System32\ZnTAlkk.exe
  C:\Windows\System32\ZnTAlkk.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System32\mtaFWzY.exe
  C:\Windows\System32\mtaFWzY.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System32\OyifoGE.exe
  C:\Windows\System32\OyifoGE.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System32\ATiYiwP.exe
  C:\Windows\System32\ATiYiwP.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System32\PgSCTdx.exe
  C:\Windows\System32\PgSCTdx.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System32\MVpBKcw.exe
  C:\Windows\System32\MVpBKcw.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System32\NfckScB.exe
  C:\Windows\System32\NfckScB.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System32\zhqSBrx.exe
  C:\Windows\System32\zhqSBrx.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System32\HzfvjSw.exe
  C:\Windows\System32\HzfvjSw.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System32\ordEAZP.exe
  C:\Windows\System32\ordEAZP.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System32\avLqHoM.exe
  C:\Windows\System32\avLqHoM.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System32\EfidYUA.exe
  C:\Windows\System32\EfidYUA.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System32\VfNNutA.exe
  C:\Windows\System32\VfNNutA.exe
  2⤵
  PID:1644
- C:\Windows\System32\tyquaCl.exe
  C:\Windows\System32\tyquaCl.exe
  2⤵
  PID:2284
- C:\Windows\System32\TzEcnsF.exe
  C:\Windows\System32\TzEcnsF.exe
  2⤵
  PID:1820
- C:\Windows\System32\CHfoMwT.exe
  C:\Windows\System32\CHfoMwT.exe
  2⤵
  PID:228
- C:\Windows\System32\PhMQwYh.exe
  C:\Windows\System32\PhMQwYh.exe
  2⤵
  PID:1764
- C:\Windows\System32\rVMJBtU.exe
  C:\Windows\System32\rVMJBtU.exe
  2⤵
  PID:4444
- C:\Windows\System32\HrxFDfj.exe
  C:\Windows\System32\HrxFDfj.exe
  2⤵
  PID:2092
- C:\Windows\System32\QLkbqwh.exe
  C:\Windows\System32\QLkbqwh.exe
  2⤵
  PID:1940
- C:\Windows\System32\MOAacCZ.exe
  C:\Windows\System32\MOAacCZ.exe
  2⤵
  PID:1284
- C:\Windows\System32\JYxKAwY.exe
  C:\Windows\System32\JYxKAwY.exe
  2⤵
  PID:3668
- C:\Windows\System32\BbOYRfw.exe
  C:\Windows\System32\BbOYRfw.exe
  2⤵
  PID:1104
- C:\Windows\System32\ZsAuoBK.exe
  C:\Windows\System32\ZsAuoBK.exe
  2⤵
  PID:1796
- C:\Windows\System32\xMQzXLW.exe
  C:\Windows\System32\xMQzXLW.exe
  2⤵
  PID:1144
- C:\Windows\System32\uHuHlfd.exe
  C:\Windows\System32\uHuHlfd.exe
  2⤵
  PID:1172
- C:\Windows\System32\nbnEPaz.exe
  C:\Windows\System32\nbnEPaz.exe
  2⤵
  PID:3772
- C:\Windows\System32\mTOiagZ.exe
  C:\Windows\System32\mTOiagZ.exe
  2⤵
  PID:1516
- C:\Windows\System32\WYwIJZx.exe
  C:\Windows\System32\WYwIJZx.exe
  2⤵
  PID:1440
- C:\Windows\System32\XBCxQQs.exe
  C:\Windows\System32\XBCxQQs.exe
  2⤵
  PID:1992
- C:\Windows\System32\sHKkdvv.exe
  C:\Windows\System32\sHKkdvv.exe
  2⤵
  PID:4408
- C:\Windows\System32\FcyRcNI.exe
  C:\Windows\System32\FcyRcNI.exe
  2⤵
  PID:4424
- C:\Windows\System32\DOyXqWc.exe
  C:\Windows\System32\DOyXqWc.exe
  2⤵
  PID:4420
- C:\Windows\System32\TTaZTew.exe
  C:\Windows\System32\TTaZTew.exe
  2⤵
  PID:2248
- C:\Windows\System32\HYmRFPk.exe
  C:\Windows\System32\HYmRFPk.exe
  2⤵
  PID:3352
- C:\Windows\System32\NrGgoHP.exe
  C:\Windows\System32\NrGgoHP.exe
  2⤵
  PID:2444
- C:\Windows\System32\BqpuLMA.exe
  C:\Windows\System32\BqpuLMA.exe
  2⤵
  PID:2768
- C:\Windows\System32\boyZRRz.exe
  C:\Windows\System32\boyZRRz.exe
  2⤵
  PID:3648
- C:\Windows\System32\PeRzzQp.exe
  C:\Windows\System32\PeRzzQp.exe
  2⤵
  PID:2664
- C:\Windows\System32\GzHYNit.exe
  C:\Windows\System32\GzHYNit.exe
  2⤵
  PID:2908
- C:\Windows\System32\QlCCuWM.exe
  C:\Windows\System32\QlCCuWM.exe
  2⤵
  PID:3968
- C:\Windows\System32\CfTYSUL.exe
  C:\Windows\System32\CfTYSUL.exe
  2⤵
  PID:632
- C:\Windows\System32\IgBFtCI.exe
  C:\Windows\System32\IgBFtCI.exe
  2⤵
  PID:5024
- C:\Windows\System32\TnyqDwr.exe
  C:\Windows\System32\TnyqDwr.exe
  2⤵
  PID:380
- C:\Windows\System32\BsuNBuq.exe
  C:\Windows\System32\BsuNBuq.exe
  2⤵
  PID:2604
- C:\Windows\System32\fPSRtxP.exe
  C:\Windows\System32\fPSRtxP.exe
  2⤵
  PID:4784
- C:\Windows\System32\tWeJAvt.exe
  C:\Windows\System32\tWeJAvt.exe
  2⤵
  PID:2560
- C:\Windows\System32\mbPGhWv.exe
  C:\Windows\System32\mbPGhWv.exe
  2⤵
  PID:2676
- C:\Windows\System32\jUQioNu.exe
  C:\Windows\System32\jUQioNu.exe
  2⤵
  PID:2980
- C:\Windows\System32\AhLRQWO.exe
  C:\Windows\System32\AhLRQWO.exe
  2⤵
  PID:3140
- C:\Windows\System32\IAmudaP.exe
  C:\Windows\System32\IAmudaP.exe
  2⤵
  PID:4316
- C:\Windows\System32\diJPCsc.exe
  C:\Windows\System32\diJPCsc.exe
  2⤵
  PID:1444
- C:\Windows\System32\OqxmlwA.exe
  C:\Windows\System32\OqxmlwA.exe
  2⤵
  PID:4856
- C:\Windows\System32\wlyAlUX.exe
  C:\Windows\System32\wlyAlUX.exe
  2⤵
  PID:5060
- C:\Windows\System32\lKeeePm.exe
  C:\Windows\System32\lKeeePm.exe
  2⤵
  PID:988
- C:\Windows\System32\pPMqmcs.exe
  C:\Windows\System32\pPMqmcs.exe
  2⤵
  PID:1708
- C:\Windows\System32\NnpHplc.exe
  C:\Windows\System32\NnpHplc.exe
  2⤵
  PID:4256
- C:\Windows\System32\pTvgRvw.exe
  C:\Windows\System32\pTvgRvw.exe
  2⤵
  PID:3548
- C:\Windows\System32\QkaEAIb.exe
  C:\Windows\System32\QkaEAIb.exe
  2⤵
  PID:936
- C:\Windows\System32\hxaouVg.exe
  C:\Windows\System32\hxaouVg.exe
  2⤵
  PID:3764
- C:\Windows\System32\knhUjFW.exe
  C:\Windows\System32\knhUjFW.exe
  2⤵
  PID:3248
- C:\Windows\System32\YchCoqE.exe
  C:\Windows\System32\YchCoqE.exe
  2⤵
  PID:2476
- C:\Windows\System32\TKnADbu.exe
  C:\Windows\System32\TKnADbu.exe
  2⤵
  PID:5096
- C:\Windows\System32\vkvgScc.exe
  C:\Windows\System32\vkvgScc.exe
  2⤵
  PID:428
- C:\Windows\System32\xFFVmjT.exe
  C:\Windows\System32\xFFVmjT.exe
  2⤵
  PID:4528
- C:\Windows\System32\WqUAcWN.exe
  C:\Windows\System32\WqUAcWN.exe
  2⤵
  PID:712
- C:\Windows\System32\LSsoJYw.exe
  C:\Windows\System32\LSsoJYw.exe
  2⤵
  PID:1520
- C:\Windows\System32\hNKCYbt.exe
  C:\Windows\System32\hNKCYbt.exe
  2⤵
  PID:828
- C:\Windows\System32\Qktfyiw.exe
  C:\Windows\System32\Qktfyiw.exe
  2⤵
  PID:544
- C:\Windows\System32\kdpXYED.exe
  C:\Windows\System32\kdpXYED.exe
  2⤵
  PID:4484
- C:\Windows\System32\ghDEvHo.exe
  C:\Windows\System32\ghDEvHo.exe
  2⤵
  PID:3360
- C:\Windows\System32\aRGRpAw.exe
  C:\Windows\System32\aRGRpAw.exe
  2⤵
  PID:3148
- C:\Windows\System32\WAiYtAI.exe
  C:\Windows\System32\WAiYtAI.exe
  2⤵
  PID:4712
- C:\Windows\System32\vIRQxSB.exe
  C:\Windows\System32\vIRQxSB.exe
  2⤵
  PID:436
- C:\Windows\System32\rEsheDf.exe
  C:\Windows\System32\rEsheDf.exe
  2⤵
  PID:900
- C:\Windows\System32\FVUILXc.exe
  C:\Windows\System32\FVUILXc.exe
  2⤵
  PID:2308
- C:\Windows\System32\OsIiXhf.exe
  C:\Windows\System32\OsIiXhf.exe
  2⤵
  PID:4436
- C:\Windows\System32\LDlSGvP.exe
  C:\Windows\System32\LDlSGvP.exe
  2⤵
  PID:2240
- C:\Windows\System32\zYigXiS.exe
  C:\Windows\System32\zYigXiS.exe
  2⤵
  PID:1140
- C:\Windows\System32\iKctuQO.exe
  C:\Windows\System32\iKctuQO.exe
  2⤵
  PID:2064
- C:\Windows\System32\QUjZRpA.exe
  C:\Windows\System32\QUjZRpA.exe
  2⤵
  PID:4560
- C:\Windows\System32\LLONlfX.exe
  C:\Windows\System32\LLONlfX.exe
  2⤵
  PID:1556
- C:\Windows\System32\ANvbAne.exe
  C:\Windows\System32\ANvbAne.exe
  2⤵
  PID:4968
- C:\Windows\System32\LraaFWQ.exe
  C:\Windows\System32\LraaFWQ.exe
  2⤵
  PID:4612
- C:\Windows\System32\mZolCJA.exe
  C:\Windows\System32\mZolCJA.exe
  2⤵
  PID:2260
- C:\Windows\System32\oCsiHkx.exe
  C:\Windows\System32\oCsiHkx.exe
  2⤵
  PID:1784
- C:\Windows\System32\LoMGYuI.exe
  C:\Windows\System32\LoMGYuI.exe
  2⤵
  PID:2208
- C:\Windows\System32\pnUirBo.exe
  C:\Windows\System32\pnUirBo.exe
  2⤵
  PID:1480
- C:\Windows\System32\XSpFdzr.exe
  C:\Windows\System32\XSpFdzr.exe
  2⤵
  PID:3692
- C:\Windows\System32\eyTIVuf.exe
  C:\Windows\System32\eyTIVuf.exe
  2⤵
  PID:5048
- C:\Windows\System32\PhADzrY.exe
  C:\Windows\System32\PhADzrY.exe
  2⤵
  PID:3964
- C:\Windows\System32\gmapBoh.exe
  C:\Windows\System32\gmapBoh.exe
  2⤵
  PID:4736
- C:\Windows\System32\wcUcyOg.exe
  C:\Windows\System32\wcUcyOg.exe
  2⤵
  PID:5132
- C:\Windows\System32\JNiUzlM.exe
  C:\Windows\System32\JNiUzlM.exe
  2⤵
  PID:5148
- C:\Windows\System32\yuidhMh.exe
  C:\Windows\System32\yuidhMh.exe
  2⤵
  PID:5164
- C:\Windows\System32\EMeiUnN.exe
  C:\Windows\System32\EMeiUnN.exe
  2⤵
  PID:5180
- C:\Windows\System32\jQwqMKR.exe
  C:\Windows\System32\jQwqMKR.exe
  2⤵
  PID:5196
- C:\Windows\System32\YleEDTj.exe
  C:\Windows\System32\YleEDTj.exe
  2⤵
  PID:5212
- C:\Windows\System32\vGjbaMQ.exe
  C:\Windows\System32\vGjbaMQ.exe
  2⤵
  PID:5228
- C:\Windows\System32\gvQCSVV.exe
  C:\Windows\System32\gvQCSVV.exe
  2⤵
  PID:5244
- C:\Windows\System32\NVQpLFj.exe
  C:\Windows\System32\NVQpLFj.exe
  2⤵
  PID:5260
- C:\Windows\System32\kgXZAiQ.exe
  C:\Windows\System32\kgXZAiQ.exe
  2⤵
  PID:5276
- C:\Windows\System32\BMMJRsx.exe
  C:\Windows\System32\BMMJRsx.exe
  2⤵
  PID:5292
- C:\Windows\System32\ouOEJng.exe
  C:\Windows\System32\ouOEJng.exe
  2⤵
  PID:5308
- C:\Windows\System32\tnYPfKA.exe
  C:\Windows\System32\tnYPfKA.exe
  2⤵
  PID:5324
- C:\Windows\System32\gzHoXRq.exe
  C:\Windows\System32\gzHoXRq.exe
  2⤵
  PID:5340
- C:\Windows\System32\KqgOOLh.exe
  C:\Windows\System32\KqgOOLh.exe
  2⤵
  PID:5356
- C:\Windows\System32\RAUTUgp.exe
  C:\Windows\System32\RAUTUgp.exe
  2⤵
  PID:5372
- C:\Windows\System32\HqjdUsr.exe
  C:\Windows\System32\HqjdUsr.exe
  2⤵
  PID:5388
- C:\Windows\System32\ipItocp.exe
  C:\Windows\System32\ipItocp.exe
  2⤵
  PID:5404
- C:\Windows\System32\oxeFDgG.exe
  C:\Windows\System32\oxeFDgG.exe
  2⤵
  PID:5420
- C:\Windows\System32\jfdRRUM.exe
  C:\Windows\System32\jfdRRUM.exe
  2⤵
  PID:5436
- C:\Windows\System32\crYhqvL.exe
  C:\Windows\System32\crYhqvL.exe
  2⤵
  PID:5452
- C:\Windows\System32\VHmYaCX.exe
  C:\Windows\System32\VHmYaCX.exe
  2⤵
  PID:5468
- C:\Windows\System32\ZkcOFnX.exe
  C:\Windows\System32\ZkcOFnX.exe
  2⤵
  PID:5484
- C:\Windows\System32\mJFuQwD.exe
  C:\Windows\System32\mJFuQwD.exe
  2⤵
  PID:5500
- C:\Windows\System32\DbMzkfH.exe
  C:\Windows\System32\DbMzkfH.exe
  2⤵
  PID:5516
- C:\Windows\System32\YUqvdot.exe
  C:\Windows\System32\YUqvdot.exe
  2⤵
  PID:5532
- C:\Windows\System32\TvMbebU.exe
  C:\Windows\System32\TvMbebU.exe
  2⤵
  PID:5548
- C:\Windows\System32\koQDlwj.exe
  C:\Windows\System32\koQDlwj.exe
  2⤵
  PID:5564
- C:\Windows\System32\YIhquUw.exe
  C:\Windows\System32\YIhquUw.exe
  2⤵
  PID:5580
- C:\Windows\System32\cpdOOKi.exe
  C:\Windows\System32\cpdOOKi.exe
  2⤵
  PID:5596
- C:\Windows\System32\FLZWDLq.exe
  C:\Windows\System32\FLZWDLq.exe
  2⤵
  PID:5612
- C:\Windows\System32\nzapeyh.exe
  C:\Windows\System32\nzapeyh.exe
  2⤵
  PID:5628
- C:\Windows\System32\TwnEqnf.exe
  C:\Windows\System32\TwnEqnf.exe
  2⤵
  PID:5644
- C:\Windows\System32\MSzxGqU.exe
  C:\Windows\System32\MSzxGqU.exe
  2⤵
  PID:5660
- C:\Windows\System32\HTWyPmg.exe
  C:\Windows\System32\HTWyPmg.exe
  2⤵
  PID:5676
- C:\Windows\System32\wMYwQEj.exe
  C:\Windows\System32\wMYwQEj.exe
  2⤵
  PID:5692
- C:\Windows\System32\tPYLVgK.exe
  C:\Windows\System32\tPYLVgK.exe
  2⤵
  PID:5708
- C:\Windows\System32\ZoSaGSS.exe
  C:\Windows\System32\ZoSaGSS.exe
  2⤵
  PID:5724
- C:\Windows\System32\GHFQHJU.exe
  C:\Windows\System32\GHFQHJU.exe
  2⤵
  PID:5740
- C:\Windows\System32\enjxVLL.exe
  C:\Windows\System32\enjxVLL.exe
  2⤵
  PID:5756
- C:\Windows\System32\KzfclqV.exe
  C:\Windows\System32\KzfclqV.exe
  2⤵
  PID:5772
- C:\Windows\System32\RAylkGJ.exe
  C:\Windows\System32\RAylkGJ.exe
  2⤵
  PID:5788
- C:\Windows\System32\LXKBOUK.exe
  C:\Windows\System32\LXKBOUK.exe
  2⤵
  PID:5804
- C:\Windows\System32\cKxadaE.exe
  C:\Windows\System32\cKxadaE.exe
  2⤵
  PID:5820
- C:\Windows\System32\GcTupjz.exe
  C:\Windows\System32\GcTupjz.exe
  2⤵
  PID:5836
- C:\Windows\System32\cPtqjal.exe
  C:\Windows\System32\cPtqjal.exe
  2⤵
  PID:5852
- C:\Windows\System32\iLhhIWe.exe
  C:\Windows\System32\iLhhIWe.exe
  2⤵
  PID:5868
- C:\Windows\System32\euvTxfb.exe
  C:\Windows\System32\euvTxfb.exe
  2⤵
  PID:5884
- C:\Windows\System32\xauOcWK.exe
  C:\Windows\System32\xauOcWK.exe
  2⤵
  PID:5900
- C:\Windows\System32\pKBycJY.exe
  C:\Windows\System32\pKBycJY.exe
  2⤵
  PID:5916
- C:\Windows\System32\MceoBqf.exe
  C:\Windows\System32\MceoBqf.exe
  2⤵
  PID:5932
- C:\Windows\System32\oCPcIQy.exe
  C:\Windows\System32\oCPcIQy.exe
  2⤵
  PID:5948
- C:\Windows\System32\yXXTAXO.exe
  C:\Windows\System32\yXXTAXO.exe
  2⤵
  PID:5964
- C:\Windows\System32\RenYiIT.exe
  C:\Windows\System32\RenYiIT.exe
  2⤵
  PID:5980
- C:\Windows\System32\wxhFhYW.exe
  C:\Windows\System32\wxhFhYW.exe
  2⤵
  PID:5996
- C:\Windows\System32\SvGuCJm.exe
  C:\Windows\System32\SvGuCJm.exe
  2⤵
  PID:6012
- C:\Windows\System32\tdPDxsT.exe
  C:\Windows\System32\tdPDxsT.exe
  2⤵
  PID:6028
- C:\Windows\System32\oVkHZxU.exe
  C:\Windows\System32\oVkHZxU.exe
  2⤵
  PID:6044
- C:\Windows\System32\VwOlBWs.exe
  C:\Windows\System32\VwOlBWs.exe
  2⤵
  PID:6060
- C:\Windows\System32\PnAlqRA.exe
  C:\Windows\System32\PnAlqRA.exe
  2⤵
  PID:6076
- C:\Windows\System32\wgcoVQz.exe
  C:\Windows\System32\wgcoVQz.exe
  2⤵
  PID:6092
- C:\Windows\System32\zbgPilq.exe
  C:\Windows\System32\zbgPilq.exe
  2⤵
  PID:6108
- C:\Windows\System32\tdJAIEu.exe
  C:\Windows\System32\tdJAIEu.exe
  2⤵
  PID:6124
- C:\Windows\System32\DAGAWRo.exe
  C:\Windows\System32\DAGAWRo.exe
  2⤵
  PID:6140
- C:\Windows\System32\MpQTHuY.exe
  C:\Windows\System32\MpQTHuY.exe
  2⤵
  PID:3244
- C:\Windows\System32\Doibkog.exe
  C:\Windows\System32\Doibkog.exe
  2⤵
  PID:3868
- C:\Windows\System32\VgEHcOb.exe
  C:\Windows\System32\VgEHcOb.exe
  2⤵
  PID:2464
- C:\Windows\System32\KdxuclP.exe
  C:\Windows\System32\KdxuclP.exe
  2⤵
  PID:3860
- C:\Windows\System32\LukmYHt.exe
  C:\Windows\System32\LukmYHt.exe
  2⤵
  PID:780
- C:\Windows\System32\kAIdjxv.exe
  C:\Windows\System32\kAIdjxv.exe
  2⤵
  PID:392
- C:\Windows\System32\lWYcIKV.exe
  C:\Windows\System32\lWYcIKV.exe
  2⤵
  PID:2852
- C:\Windows\System32\nXgVxNL.exe
  C:\Windows\System32\nXgVxNL.exe
  2⤵
  PID:5032
- C:\Windows\System32\fudDmRA.exe
  C:\Windows\System32\fudDmRA.exe
  2⤵
  PID:212
- C:\Windows\System32\QvYyVkP.exe
  C:\Windows\System32\QvYyVkP.exe
  2⤵
  PID:4032
- C:\Windows\System32\odwsyJh.exe
  C:\Windows\System32\odwsyJh.exe
  2⤵
  PID:468
- C:\Windows\System32\tqRHJEN.exe
  C:\Windows\System32\tqRHJEN.exe
  2⤵
  PID:4092
- C:\Windows\System32\zVrNacT.exe
  C:\Windows\System32\zVrNacT.exe
  2⤵
  PID:4776
- C:\Windows\System32\AkrsJoO.exe
  C:\Windows\System32\AkrsJoO.exe
  2⤵
  PID:4168
- C:\Windows\System32\Wimyqcz.exe
  C:\Windows\System32\Wimyqcz.exe
  2⤵
  PID:4652
- C:\Windows\System32\yBcYjYC.exe
  C:\Windows\System32\yBcYjYC.exe
  2⤵
  PID:5124
- C:\Windows\System32\ncWhryp.exe
  C:\Windows\System32\ncWhryp.exe
  2⤵
  PID:5156
- C:\Windows\System32\SyfyqpF.exe
  C:\Windows\System32\SyfyqpF.exe
  2⤵
  PID:5188
- C:\Windows\System32\Lbwawnu.exe
  C:\Windows\System32\Lbwawnu.exe
  2⤵
  PID:5220
- C:\Windows\System32\ZXeoJCf.exe
  C:\Windows\System32\ZXeoJCf.exe
  2⤵
  PID:5252
- C:\Windows\System32\NlcWqVP.exe
  C:\Windows\System32\NlcWqVP.exe
  2⤵
  PID:5284
- C:\Windows\System32\UYZSAJy.exe
  C:\Windows\System32\UYZSAJy.exe
  2⤵
  PID:5316
- C:\Windows\System32\fvygGXr.exe
  C:\Windows\System32\fvygGXr.exe
  2⤵
  PID:4000
- C:\Windows\System32\vuHKwqR.exe
  C:\Windows\System32\vuHKwqR.exe
  2⤵
  PID:5368
- C:\Windows\System32\RLrqOhg.exe
  C:\Windows\System32\RLrqOhg.exe
  2⤵
  PID:5400
- C:\Windows\System32\UGzyvyr.exe
  C:\Windows\System32\UGzyvyr.exe
  2⤵
  PID:5432
- C:\Windows\System32\dHLoooN.exe
  C:\Windows\System32\dHLoooN.exe
  2⤵
  PID:5464
- C:\Windows\System32\trnkZAL.exe
  C:\Windows\System32\trnkZAL.exe
  2⤵
  PID:5496
- C:\Windows\System32\onyxCIM.exe
  C:\Windows\System32\onyxCIM.exe
  2⤵
  PID:5528
- C:\Windows\System32\EVprnoC.exe
  C:\Windows\System32\EVprnoC.exe
  2⤵
  PID:5560
- C:\Windows\System32\wEPWVej.exe
  C:\Windows\System32\wEPWVej.exe
  2⤵
  PID:5592
- C:\Windows\System32\KlTqJUi.exe
  C:\Windows\System32\KlTqJUi.exe
  2⤵
  PID:5624
- C:\Windows\System32\UKdKZBW.exe
  C:\Windows\System32\UKdKZBW.exe
  2⤵
  PID:5656
- C:\Windows\System32\gjThuLP.exe
  C:\Windows\System32\gjThuLP.exe
  2⤵
  PID:5688
- C:\Windows\System32\kDvsFvd.exe
  C:\Windows\System32\kDvsFvd.exe
  2⤵
  PID:5720
- C:\Windows\System32\qKVnafw.exe
  C:\Windows\System32\qKVnafw.exe
  2⤵
  PID:5752
- C:\Windows\System32\qJEFaGU.exe
  C:\Windows\System32\qJEFaGU.exe
  2⤵
  PID:5780
- C:\Windows\System32\JIaPEEJ.exe
  C:\Windows\System32\JIaPEEJ.exe
  2⤵
  PID:5812
- C:\Windows\System32\Pltmlii.exe
  C:\Windows\System32\Pltmlii.exe
  2⤵
  PID:5844
- C:\Windows\System32\bZBcXlg.exe
  C:\Windows\System32\bZBcXlg.exe
  2⤵
  PID:5876
- C:\Windows\System32\bykfJJO.exe
  C:\Windows\System32\bykfJJO.exe
  2⤵
  PID:5908
- C:\Windows\System32\CYAoyZi.exe
  C:\Windows\System32\CYAoyZi.exe
  2⤵
  PID:5940
- C:\Windows\System32\SoyGjDD.exe
  C:\Windows\System32\SoyGjDD.exe
  2⤵
  PID:5972
- C:\Windows\System32\DaDShKZ.exe
  C:\Windows\System32\DaDShKZ.exe
  2⤵
  PID:6004
- C:\Windows\System32\RfIwnzi.exe
  C:\Windows\System32\RfIwnzi.exe
  2⤵
  PID:6020
- C:\Windows\System32\rPgKxxm.exe
  C:\Windows\System32\rPgKxxm.exe
  2⤵
  PID:6056
- C:\Windows\System32\aXFoPJr.exe
  C:\Windows\System32\aXFoPJr.exe
  2⤵
  PID:6088
- C:\Windows\System32\UDwTNMy.exe
  C:\Windows\System32\UDwTNMy.exe
  2⤵
  PID:6120
- C:\Windows\System32\mSjFlez.exe
  C:\Windows\System32\mSjFlez.exe
  2⤵
  PID:4604
- C:\Windows\System32\HiPjBJQ.exe
  C:\Windows\System32\HiPjBJQ.exe
  2⤵
  PID:3256
- C:\Windows\System32\dJCaxAz.exe
  C:\Windows\System32\dJCaxAz.exe
  2⤵
  PID:1576
- C:\Windows\System32\EbCqyXL.exe
  C:\Windows\System32\EbCqyXL.exe
  2⤵
  PID:2280
- C:\Windows\System32\vpseFuo.exe
  C:\Windows\System32\vpseFuo.exe
  2⤵
  PID:824
- C:\Windows\System32\lorRago.exe
  C:\Windows\System32\lorRago.exe
  2⤵
  PID:2072
- C:\Windows\System32\qSqhOvb.exe
  C:\Windows\System32\qSqhOvb.exe
  2⤵
  PID:5040
- C:\Windows\System32\FHiKdxA.exe
  C:\Windows\System32\FHiKdxA.exe
  2⤵
  PID:2880
- C:\Windows\System32\iTRgbLE.exe
  C:\Windows\System32\iTRgbLE.exe
  2⤵
  PID:5140
- C:\Windows\System32\MLGUEwQ.exe
  C:\Windows\System32\MLGUEwQ.exe
  2⤵
  PID:5204
- C:\Windows\System32\jgikMsi.exe
  C:\Windows\System32\jgikMsi.exe
  2⤵
  PID:5268
- C:\Windows\System32\DEDXBVg.exe
  C:\Windows\System32\DEDXBVg.exe
  2⤵
  PID:5332
- C:\Windows\System32\iOETELK.exe
  C:\Windows\System32\iOETELK.exe
  2⤵
  PID:5384
- C:\Windows\System32\XqkBfLu.exe
  C:\Windows\System32\XqkBfLu.exe
  2⤵
  PID:5448
- C:\Windows\System32\OfgcgNl.exe
  C:\Windows\System32\OfgcgNl.exe
  2⤵
  PID:5492
- C:\Windows\System32\tKkkeMO.exe
  C:\Windows\System32\tKkkeMO.exe
  2⤵
  PID:5556
- C:\Windows\System32\HkEgwaZ.exe
  C:\Windows\System32\HkEgwaZ.exe
  2⤵
  PID:5620
- C:\Windows\System32\dXgXXwn.exe
  C:\Windows\System32\dXgXXwn.exe
  2⤵
  PID:5672
- C:\Windows\System32\oqfFVGj.exe
  C:\Windows\System32\oqfFVGj.exe
  2⤵
  PID:5736
- C:\Windows\System32\pksEMjG.exe
  C:\Windows\System32\pksEMjG.exe
  2⤵
  PID:5796
- C:\Windows\System32\AnQjvSp.exe
  C:\Windows\System32\AnQjvSp.exe
  2⤵
  PID:5860
- C:\Windows\System32\tcSwXhJ.exe
  C:\Windows\System32\tcSwXhJ.exe
  2⤵
  PID:5924
- C:\Windows\System32\qEzXaOD.exe
  C:\Windows\System32\qEzXaOD.exe
  2⤵
  PID:5988
- C:\Windows\System32\TmJETmf.exe
  C:\Windows\System32\TmJETmf.exe
  2⤵
  PID:6040
- C:\Windows\System32\ncCPKoi.exe
  C:\Windows\System32\ncCPKoi.exe
  2⤵
  PID:6104
- C:\Windows\System32\ZOXMUZq.exe
  C:\Windows\System32\ZOXMUZq.exe
  2⤵
  PID:1244
- C:\Windows\System32\AmxTkJv.exe
  C:\Windows\System32\AmxTkJv.exe
  2⤵
  PID:6156
- C:\Windows\System32\zwmUVde.exe
  C:\Windows\System32\zwmUVde.exe
  2⤵
  PID:6172
- C:\Windows\System32\hrzzrYI.exe
  C:\Windows\System32\hrzzrYI.exe
  2⤵
  PID:6188
- C:\Windows\System32\WzJhHAE.exe
  C:\Windows\System32\WzJhHAE.exe
  2⤵
  PID:6204
- C:\Windows\System32\DTQlTRG.exe
  C:\Windows\System32\DTQlTRG.exe
  2⤵
  PID:6220
- C:\Windows\System32\MCKKkDi.exe
  C:\Windows\System32\MCKKkDi.exe
  2⤵
  PID:6236
- C:\Windows\System32\lthyaEB.exe
  C:\Windows\System32\lthyaEB.exe
  2⤵
  PID:6252
- C:\Windows\System32\XkrjhUs.exe
  C:\Windows\System32\XkrjhUs.exe
  2⤵
  PID:6268
- C:\Windows\System32\uVXcsre.exe
  C:\Windows\System32\uVXcsre.exe
  2⤵
  PID:6284
- C:\Windows\System32\uaOhFrS.exe
  C:\Windows\System32\uaOhFrS.exe
  2⤵
  PID:6300
- C:\Windows\System32\zPaKEmq.exe
  C:\Windows\System32\zPaKEmq.exe
  2⤵
  PID:6316
- C:\Windows\System32\KuqGOXm.exe
  C:\Windows\System32\KuqGOXm.exe
  2⤵
  PID:6332
- C:\Windows\System32\onShfeB.exe
  C:\Windows\System32\onShfeB.exe
  2⤵
  PID:6348
- C:\Windows\System32\ZIiemim.exe
  C:\Windows\System32\ZIiemim.exe
  2⤵
  PID:6364
- C:\Windows\System32\dgQwJQx.exe
  C:\Windows\System32\dgQwJQx.exe
  2⤵
  PID:6380
- C:\Windows\System32\MQFBoyD.exe
  C:\Windows\System32\MQFBoyD.exe
  2⤵
  PID:6396
- C:\Windows\System32\bDfdgHZ.exe
  C:\Windows\System32\bDfdgHZ.exe
  2⤵
  PID:6412
- C:\Windows\System32\cHSCsnI.exe
  C:\Windows\System32\cHSCsnI.exe
  2⤵
  PID:6428
- C:\Windows\System32\jPAoTWn.exe
  C:\Windows\System32\jPAoTWn.exe
  2⤵
  PID:6444
- C:\Windows\System32\DuIWguG.exe
  C:\Windows\System32\DuIWguG.exe
  2⤵
  PID:6460
- C:\Windows\System32\xCkKkwA.exe
  C:\Windows\System32\xCkKkwA.exe
  2⤵
  PID:6476
- C:\Windows\System32\dTVtpoG.exe
  C:\Windows\System32\dTVtpoG.exe
  2⤵
  PID:6492
- C:\Windows\System32\oOlWUrm.exe
  C:\Windows\System32\oOlWUrm.exe
  2⤵
  PID:6508
- C:\Windows\System32\IIvZUKq.exe
  C:\Windows\System32\IIvZUKq.exe
  2⤵
  PID:6524
- C:\Windows\System32\lSwjZqW.exe
  C:\Windows\System32\lSwjZqW.exe
  2⤵
  PID:6540
- C:\Windows\System32\TWlNEXO.exe
  C:\Windows\System32\TWlNEXO.exe
  2⤵
  PID:6556
- C:\Windows\System32\yehIymp.exe
  C:\Windows\System32\yehIymp.exe
  2⤵
  PID:6572
- C:\Windows\System32\EJKynTl.exe
  C:\Windows\System32\EJKynTl.exe
  2⤵
  PID:6588
- C:\Windows\System32\KycrDzB.exe
  C:\Windows\System32\KycrDzB.exe
  2⤵
  PID:6604
- C:\Windows\System32\hDwXoRA.exe
  C:\Windows\System32\hDwXoRA.exe
  2⤵
  PID:6620
- C:\Windows\System32\WEokFxt.exe
  C:\Windows\System32\WEokFxt.exe
  2⤵
  PID:6636
- C:\Windows\System32\vCAkCSP.exe
  C:\Windows\System32\vCAkCSP.exe
  2⤵
  PID:6652
- C:\Windows\System32\xBgTLfS.exe
  C:\Windows\System32\xBgTLfS.exe
  2⤵
  PID:6668
- C:\Windows\System32\ZygwVnY.exe
  C:\Windows\System32\ZygwVnY.exe
  2⤵
  PID:6684
- C:\Windows\System32\xjzjDKX.exe
  C:\Windows\System32\xjzjDKX.exe
  2⤵
  PID:6700
- C:\Windows\System32\YMatfkE.exe
  C:\Windows\System32\YMatfkE.exe
  2⤵
  PID:6716
- C:\Windows\System32\thTmWPd.exe
  C:\Windows\System32\thTmWPd.exe
  2⤵
  PID:6732
- C:\Windows\System32\ZLJzLEn.exe
  C:\Windows\System32\ZLJzLEn.exe
  2⤵
  PID:6748
- C:\Windows\System32\BrgeOlx.exe
  C:\Windows\System32\BrgeOlx.exe
  2⤵
  PID:6764
- C:\Windows\System32\xtmNvqX.exe
  C:\Windows\System32\xtmNvqX.exe
  2⤵
  PID:6780
- C:\Windows\System32\eIcMQfG.exe
  C:\Windows\System32\eIcMQfG.exe
  2⤵
  PID:6796
- C:\Windows\System32\qvnisqV.exe
  C:\Windows\System32\qvnisqV.exe
  2⤵
  PID:6812
- C:\Windows\System32\MfXxMMs.exe
  C:\Windows\System32\MfXxMMs.exe
  2⤵
  PID:6828
- C:\Windows\System32\XqGJSpa.exe
  C:\Windows\System32\XqGJSpa.exe
  2⤵
  PID:6844
- C:\Windows\System32\KZqvfLh.exe
  C:\Windows\System32\KZqvfLh.exe
  2⤵
  PID:6860
- C:\Windows\System32\lGEjmIx.exe
  C:\Windows\System32\lGEjmIx.exe
  2⤵
  PID:6876
- C:\Windows\System32\uzqLeRm.exe
  C:\Windows\System32\uzqLeRm.exe
  2⤵
  PID:6892
- C:\Windows\System32\QxciCou.exe
  C:\Windows\System32\QxciCou.exe
  2⤵
  PID:6908
- C:\Windows\System32\VsHEZAU.exe
  C:\Windows\System32\VsHEZAU.exe
  2⤵
  PID:6924
- C:\Windows\System32\xvQLBEy.exe
  C:\Windows\System32\xvQLBEy.exe
  2⤵
  PID:6940
- C:\Windows\System32\IPkHEAF.exe
  C:\Windows\System32\IPkHEAF.exe
  2⤵
  PID:6956
- C:\Windows\System32\QKyCQWz.exe
  C:\Windows\System32\QKyCQWz.exe
  2⤵
  PID:6972
- C:\Windows\System32\QejTxlt.exe
  C:\Windows\System32\QejTxlt.exe
  2⤵
  PID:6988
- C:\Windows\System32\wEjJvlQ.exe
  C:\Windows\System32\wEjJvlQ.exe
  2⤵
  PID:7004
- C:\Windows\System32\IheEpRD.exe
  C:\Windows\System32\IheEpRD.exe
  2⤵
  PID:7020
- C:\Windows\System32\fSXcUeQ.exe
  C:\Windows\System32\fSXcUeQ.exe
  2⤵
  PID:7036
- C:\Windows\System32\rIWgsLb.exe
  C:\Windows\System32\rIWgsLb.exe
  2⤵
  PID:7052
- C:\Windows\System32\DZRSEcz.exe
  C:\Windows\System32\DZRSEcz.exe
  2⤵
  PID:7068
- C:\Windows\System32\YIGQzTf.exe
  C:\Windows\System32\YIGQzTf.exe
  2⤵
  PID:7084
- C:\Windows\System32\VajXXun.exe
  C:\Windows\System32\VajXXun.exe
  2⤵
  PID:7100
- C:\Windows\System32\EfaNcbP.exe
  C:\Windows\System32\EfaNcbP.exe
  2⤵
  PID:7116
- C:\Windows\System32\OKbEiUy.exe
  C:\Windows\System32\OKbEiUy.exe
  2⤵
  PID:7132
- C:\Windows\System32\ZduCWHB.exe
  C:\Windows\System32\ZduCWHB.exe
  2⤵
  PID:7148
- C:\Windows\System32\mdPqVDM.exe
  C:\Windows\System32\mdPqVDM.exe
  2⤵
  PID:7164
- C:\Windows\System32\fzLHIyt.exe
  C:\Windows\System32\fzLHIyt.exe
  2⤵
  PID:4112
- C:\Windows\System32\AYjvRRJ.exe
  C:\Windows\System32\AYjvRRJ.exe
  2⤵
  PID:3936
- C:\Windows\System32\aYUiqNJ.exe
  C:\Windows\System32\aYUiqNJ.exe
  2⤵
  PID:2860
- C:\Windows\System32\mnPytnu.exe
  C:\Windows\System32\mnPytnu.exe
  2⤵
  PID:5172
- C:\Windows\System32\XlkaItm.exe
  C:\Windows\System32\XlkaItm.exe
  2⤵
  PID:5304
- C:\Windows\System32\tvUtvTV.exe
  C:\Windows\System32\tvUtvTV.exe
  2⤵
  PID:5364
- C:\Windows\System32\pfXPJdZ.exe
  C:\Windows\System32\pfXPJdZ.exe
  2⤵
  PID:5480
- C:\Windows\System32\HUsZrwb.exe
  C:\Windows\System32\HUsZrwb.exe
  2⤵
  PID:5608
- C:\Windows\System32\ZuTitBM.exe
  C:\Windows\System32\ZuTitBM.exe
  2⤵
  PID:5716
- C:\Windows\System32\CGltNIP.exe
  C:\Windows\System32\CGltNIP.exe
  2⤵
  PID:5832
- C:\Windows\System32\ApBowEc.exe
  C:\Windows\System32\ApBowEc.exe
  2⤵
  PID:5960
- C:\Windows\System32\ddXFBpX.exe
  C:\Windows\System32\ddXFBpX.exe
  2⤵
  PID:6084
- C:\Windows\System32\nUmZoZs.exe
  C:\Windows\System32\nUmZoZs.exe
  2⤵
  PID:6148
- C:\Windows\System32\KNGruDn.exe
  C:\Windows\System32\KNGruDn.exe
  2⤵
  PID:1996
- C:\Windows\System32\IOhskib.exe
  C:\Windows\System32\IOhskib.exe
  2⤵
  PID:6200
- C:\Windows\System32\IpIGfDD.exe
  C:\Windows\System32\IpIGfDD.exe
  2⤵
  PID:6232
- C:\Windows\System32\hDVHWnY.exe
  C:\Windows\System32\hDVHWnY.exe
  2⤵
  PID:6264
- C:\Windows\System32\BpHAvnu.exe
  C:\Windows\System32\BpHAvnu.exe
  2⤵
  PID:6292
- C:\Windows\System32\XmQgTls.exe
  C:\Windows\System32\XmQgTls.exe
  2⤵
  PID:6324
- C:\Windows\System32\opLJhYI.exe
  C:\Windows\System32\opLJhYI.exe
  2⤵
  PID:6356
- C:\Windows\System32\JCMjDOf.exe
  C:\Windows\System32\JCMjDOf.exe
  2⤵
  PID:6388
- C:\Windows\System32\voNIoil.exe
  C:\Windows\System32\voNIoil.exe
  2⤵
  PID:6420
- C:\Windows\System32\eklZHIn.exe
  C:\Windows\System32\eklZHIn.exe
  2⤵
  PID:6440
- C:\Windows\System32\IRQfgbf.exe
  C:\Windows\System32\IRQfgbf.exe
  2⤵
  PID:6472
- C:\Windows\System32\KeiWbyd.exe
  C:\Windows\System32\KeiWbyd.exe
  2⤵
  PID:6504
- C:\Windows\System32\FQUuiFp.exe
  C:\Windows\System32\FQUuiFp.exe
  2⤵
  PID:6536
- C:\Windows\System32\fPnscAQ.exe
  C:\Windows\System32\fPnscAQ.exe
  2⤵
  PID:6564
- C:\Windows\System32\FoYvRNH.exe
  C:\Windows\System32\FoYvRNH.exe
  2⤵
  PID:6600
- C:\Windows\System32\UUiytTl.exe
  C:\Windows\System32\UUiytTl.exe
  2⤵
  PID:6628
- C:\Windows\System32\GkIrurj.exe
  C:\Windows\System32\GkIrurj.exe
  2⤵
  PID:6660
- C:\Windows\System32\HvkcRAg.exe
  C:\Windows\System32\HvkcRAg.exe
  2⤵
  PID:6692
- C:\Windows\System32\YBMNwFC.exe
  C:\Windows\System32\YBMNwFC.exe
  2⤵
  PID:6712
- C:\Windows\System32\MhDycZh.exe
  C:\Windows\System32\MhDycZh.exe
  2⤵
  PID:6740
- C:\Windows\System32\oRoherf.exe
  C:\Windows\System32\oRoherf.exe
  2⤵
  PID:6772
- C:\Windows\System32\pKqilGg.exe
  C:\Windows\System32\pKqilGg.exe
  2⤵
  PID:6804
- C:\Windows\System32\UMwrKnL.exe
  C:\Windows\System32\UMwrKnL.exe
  2⤵
  PID:6836
- C:\Windows\System32\mgxXVNX.exe
  C:\Windows\System32\mgxXVNX.exe
  2⤵
  PID:6868
- C:\Windows\System32\fQUYPFw.exe
  C:\Windows\System32\fQUYPFw.exe
  2⤵
  PID:6900
- C:\Windows\System32\iSvqnsE.exe
  C:\Windows\System32\iSvqnsE.exe
  2⤵
  PID:6932
- C:\Windows\System32\rvpPUNl.exe
  C:\Windows\System32\rvpPUNl.exe
  2⤵
  PID:4452
- C:\Windows\System32\bHKHYIw.exe
  C:\Windows\System32\bHKHYIw.exe
  2⤵
  PID:6980
- C:\Windows\System32\SwQVWlA.exe
  C:\Windows\System32\SwQVWlA.exe
  2⤵
  PID:4580
- C:\Windows\System32\SRSsljU.exe
  C:\Windows\System32\SRSsljU.exe
  2⤵
  PID:7028
- C:\Windows\System32\jjVLjVy.exe
  C:\Windows\System32\jjVLjVy.exe
  2⤵
  PID:7060
- C:\Windows\System32\wRpokOc.exe
  C:\Windows\System32\wRpokOc.exe
  2⤵
  PID:7080
- C:\Windows\System32\MRKgtfQ.exe
  C:\Windows\System32\MRKgtfQ.exe
  2⤵
  PID:1592
- C:\Windows\System32\clSBFjZ.exe
  C:\Windows\System32\clSBFjZ.exe
  2⤵
  PID:7124
- C:\Windows\System32\AGsVKWT.exe
  C:\Windows\System32\AGsVKWT.exe
  2⤵
  PID:7156
- C:\Windows\System32\QMdsgRR.exe
  C:\Windows\System32\QMdsgRR.exe
  2⤵
  PID:4984
- C:\Windows\System32\lMdBEPo.exe
  C:\Windows\System32\lMdBEPo.exe
  2⤵
  PID:4264
- C:\Windows\System32\iAiELeq.exe
  C:\Windows\System32\iAiELeq.exe
  2⤵
  PID:5236
- C:\Windows\System32\cEYqmHd.exe
  C:\Windows\System32\cEYqmHd.exe
  2⤵
  PID:5428
- C:\Windows\System32\cLpgCZW.exe
  C:\Windows\System32\cLpgCZW.exe
  2⤵
  PID:5652
- C:\Windows\System32\vNPWnfo.exe
  C:\Windows\System32\vNPWnfo.exe
  2⤵
  PID:5896
- C:\Windows\System32\WrLaaQn.exe
  C:\Windows\System32\WrLaaQn.exe
  2⤵
  PID:4908
- C:\Windows\System32\eZXBsBt.exe
  C:\Windows\System32\eZXBsBt.exe
  2⤵
  PID:6168
- C:\Windows\System32\ixjExbq.exe
  C:\Windows\System32\ixjExbq.exe
  2⤵
  PID:6212
- C:\Windows\System32\fzKJJYM.exe
  C:\Windows\System32\fzKJJYM.exe
  2⤵
  PID:6260
- C:\Windows\System32\hxBuaJh.exe
  C:\Windows\System32\hxBuaJh.exe
  2⤵
  PID:1836
- C:\Windows\System32\vmYwsBj.exe
  C:\Windows\System32\vmYwsBj.exe
  2⤵
  PID:6340
- C:\Windows\System32\tUsCivD.exe
  C:\Windows\System32\tUsCivD.exe
  2⤵
  PID:6372
- C:\Windows\System32\CdSVQNp.exe
  C:\Windows\System32\CdSVQNp.exe
  2⤵
  PID:1788
- C:\Windows\System32\RyNkqSa.exe
  C:\Windows\System32\RyNkqSa.exe
  2⤵
  PID:6468
- C:\Windows\System32\fbkcMqZ.exe
  C:\Windows\System32\fbkcMqZ.exe
  2⤵
  PID:6500
- C:\Windows\System32\GsKwPFR.exe
  C:\Windows\System32\GsKwPFR.exe
  2⤵
  PID:6520
- C:\Windows\System32\CtXOaxV.exe
  C:\Windows\System32\CtXOaxV.exe
  2⤵
  PID:6568
- C:\Windows\System32\YEWGbAq.exe
  C:\Windows\System32\YEWGbAq.exe
  2⤵
  PID:6584
- C:\Windows\System32\FqcJQpq.exe
  C:\Windows\System32\FqcJQpq.exe
  2⤵
  PID:4008
- C:\Windows\System32\FiYmFAM.exe
  C:\Windows\System32\FiYmFAM.exe
  2⤵
  PID:6644
- C:\Windows\System32\bPzYEdL.exe
  C:\Windows\System32\bPzYEdL.exe
  2⤵
  PID:2224
- C:\Windows\System32\jHkWkCL.exe
  C:\Windows\System32\jHkWkCL.exe
  2⤵
  PID:4072
- C:\Windows\System32\jFeIrqZ.exe
  C:\Windows\System32\jFeIrqZ.exe
  2⤵
  PID:2196
- C:\Windows\System32\QDQtVtm.exe
  C:\Windows\System32\QDQtVtm.exe
  2⤵
  PID:6788
- C:\Windows\System32\zgcHuNR.exe
  C:\Windows\System32\zgcHuNR.exe
  2⤵
  PID:4004
- C:\Windows\System32\avtiikB.exe
  C:\Windows\System32\avtiikB.exe
  2⤵
  PID:6884
- C:\Windows\System32\SSbPPHF.exe
  C:\Windows\System32\SSbPPHF.exe
  2⤵
  PID:6948
- C:\Windows\System32\UkMMWsf.exe
  C:\Windows\System32\UkMMWsf.exe
  2⤵
  PID:6996
- C:\Windows\System32\YGwFoqW.exe
  C:\Windows\System32\YGwFoqW.exe
  2⤵
  PID:7044
- C:\Windows\System32\VPNEDkn.exe
  C:\Windows\System32\VPNEDkn.exe
  2⤵
  PID:7092
- C:\Windows\System32\YSkvQyS.exe
  C:\Windows\System32\YSkvQyS.exe
  2⤵
  PID:7140
- C:\Windows\System32\EyfeetW.exe
  C:\Windows\System32\EyfeetW.exe
  2⤵
  PID:2492
- C:\Windows\System32\cVfUDlx.exe
  C:\Windows\System32\cVfUDlx.exe
  2⤵
  PID:2744
- C:\Windows\System32\Pcgxtvt.exe
  C:\Windows\System32\Pcgxtvt.exe
  2⤵
  PID:5828
- C:\Windows\System32\nKEleyj.exe
  C:\Windows\System32\nKEleyj.exe
  2⤵
  PID:3268
- C:\Windows\System32\TIgkCsr.exe
  C:\Windows\System32\TIgkCsr.exe
  2⤵
  PID:2028
- C:\Windows\System32\mxuHFln.exe
  C:\Windows\System32\mxuHFln.exe
  2⤵
  PID:6312
- C:\Windows\System32\ZDUbGlI.exe
  C:\Windows\System32\ZDUbGlI.exe
  2⤵
  PID:6404
- C:\Windows\System32\UZbsblg.exe
  C:\Windows\System32\UZbsblg.exe
  2⤵
  PID:5052
- C:\Windows\System32\fJiSPIX.exe
  C:\Windows\System32\fJiSPIX.exe
  2⤵
  PID:396
- C:\Windows\System32\afGNEct.exe
  C:\Windows\System32\afGNEct.exe
  2⤵
  PID:2040
- C:\Windows\System32\XvjAzDs.exe
  C:\Windows\System32\XvjAzDs.exe
  2⤵
  PID:6676
- C:\Windows\System32\kAeoMzl.exe
  C:\Windows\System32\kAeoMzl.exe
  2⤵
  PID:4040
- C:\Windows\System32\PEwYLWy.exe
  C:\Windows\System32\PEwYLWy.exe
  2⤵
  PID:2388
- C:\Windows\System32\coOEbOV.exe
  C:\Windows\System32\coOEbOV.exe
  2⤵
  PID:4860
- C:\Windows\System32\bXujBGt.exe
  C:\Windows\System32\bXujBGt.exe
  2⤵
  PID:6968
- C:\Windows\System32\BTdCJtZ.exe
  C:\Windows\System32\BTdCJtZ.exe
  2⤵
  PID:7076
- C:\Windows\System32\gSrtAcc.exe
  C:\Windows\System32\gSrtAcc.exe
  2⤵
  PID:904
- C:\Windows\System32\mxrtSqc.exe
  C:\Windows\System32\mxrtSqc.exe
  2⤵
  PID:5588
- C:\Windows\System32\VUvWtfz.exe
  C:\Windows\System32\VUvWtfz.exe
  2⤵
  PID:6184
- C:\Windows\System32\JtUPYyv.exe
  C:\Windows\System32\JtUPYyv.exe
  2⤵
  PID:6376
- C:\Windows\System32\pOfOouc.exe
  C:\Windows\System32\pOfOouc.exe
  2⤵
  PID:6532
- C:\Windows\System32\NUAGyno.exe
  C:\Windows\System32\NUAGyno.exe
  2⤵
  PID:2996
- C:\Windows\System32\tOSAYTc.exe
  C:\Windows\System32\tOSAYTc.exe
  2⤵
  PID:6756
- C:\Windows\System32\OxKWneS.exe
  C:\Windows\System32\OxKWneS.exe
  2⤵
  PID:6916
- C:\Windows\System32\oqOCHWy.exe
  C:\Windows\System32\oqOCHWy.exe
  2⤵
  PID:7128
- C:\Windows\System32\guMHErF.exe
  C:\Windows\System32\guMHErF.exe
  2⤵
  PID:4532
- C:\Windows\System32\sKrhUnX.exe
  C:\Windows\System32\sKrhUnX.exe
  2⤵
  PID:7176
- C:\Windows\System32\OdCQzFe.exe
  C:\Windows\System32\OdCQzFe.exe
  2⤵
  PID:7192
- C:\Windows\System32\QnTclJx.exe
  C:\Windows\System32\QnTclJx.exe
  2⤵
  PID:7208
- C:\Windows\System32\gAymCZz.exe
  C:\Windows\System32\gAymCZz.exe
  2⤵
  PID:7224
- C:\Windows\System32\TcVJcEh.exe
  C:\Windows\System32\TcVJcEh.exe
  2⤵
  PID:7240
- C:\Windows\System32\oDFUUuE.exe
  C:\Windows\System32\oDFUUuE.exe
  2⤵
  PID:7256
- C:\Windows\System32\aPYRhMB.exe
  C:\Windows\System32\aPYRhMB.exe
  2⤵
  PID:7272
- C:\Windows\System32\vHFDYqM.exe
  C:\Windows\System32\vHFDYqM.exe
  2⤵
  PID:7288
- C:\Windows\System32\UAxBkmq.exe
  C:\Windows\System32\UAxBkmq.exe
  2⤵
  PID:7304
- C:\Windows\System32\OjSUrFN.exe
  C:\Windows\System32\OjSUrFN.exe
  2⤵
  PID:7320
- C:\Windows\System32\faCkvgE.exe
  C:\Windows\System32\faCkvgE.exe
  2⤵
  PID:7336
- C:\Windows\System32\aFsAhnk.exe
  C:\Windows\System32\aFsAhnk.exe
  2⤵
  PID:7352
- C:\Windows\System32\LfgXDvD.exe
  C:\Windows\System32\LfgXDvD.exe
  2⤵
  PID:7368
- C:\Windows\System32\QnIrJTm.exe
  C:\Windows\System32\QnIrJTm.exe
  2⤵
  PID:7384
- C:\Windows\System32\xeRJwrs.exe
  C:\Windows\System32\xeRJwrs.exe
  2⤵
  PID:7400
- C:\Windows\System32\kbRopIH.exe
  C:\Windows\System32\kbRopIH.exe
  2⤵
  PID:7416
- C:\Windows\System32\aFtdLxF.exe
  C:\Windows\System32\aFtdLxF.exe
  2⤵
  PID:7432
- C:\Windows\System32\TLrHRtA.exe
  C:\Windows\System32\TLrHRtA.exe
  2⤵
  PID:7448
- C:\Windows\System32\bjBSZOt.exe
  C:\Windows\System32\bjBSZOt.exe
  2⤵
  PID:7464
- C:\Windows\System32\BzuyEHn.exe
  C:\Windows\System32\BzuyEHn.exe
  2⤵
  PID:7480
- C:\Windows\System32\weHUCkP.exe
  C:\Windows\System32\weHUCkP.exe
  2⤵
  PID:7496
- C:\Windows\System32\VVaQyje.exe
  C:\Windows\System32\VVaQyje.exe
  2⤵
  PID:7512
- C:\Windows\System32\GUfhQlB.exe
  C:\Windows\System32\GUfhQlB.exe
  2⤵
  PID:7528
- C:\Windows\System32\bIJPDAa.exe
  C:\Windows\System32\bIJPDAa.exe
  2⤵
  PID:7544
- C:\Windows\System32\upWGvgZ.exe
  C:\Windows\System32\upWGvgZ.exe
  2⤵
  PID:7560
- C:\Windows\System32\VuwDCEy.exe
  C:\Windows\System32\VuwDCEy.exe
  2⤵
  PID:7576
- C:\Windows\System32\WoWEuoD.exe
  C:\Windows\System32\WoWEuoD.exe
  2⤵
  PID:7592
- C:\Windows\System32\xiMFkMV.exe
  C:\Windows\System32\xiMFkMV.exe
  2⤵
  PID:7608
- C:\Windows\System32\UENIrbt.exe
  C:\Windows\System32\UENIrbt.exe
  2⤵
  PID:7624
- C:\Windows\System32\wxiPFay.exe
  C:\Windows\System32\wxiPFay.exe
  2⤵
  PID:7640
- C:\Windows\System32\zEPZfSn.exe
  C:\Windows\System32\zEPZfSn.exe
  2⤵
  PID:7656
- C:\Windows\System32\KbRoadw.exe
  C:\Windows\System32\KbRoadw.exe
  2⤵
  PID:7672
- C:\Windows\System32\IwfdHld.exe
  C:\Windows\System32\IwfdHld.exe
  2⤵
  PID:7688
- C:\Windows\System32\OFazmhA.exe
  C:\Windows\System32\OFazmhA.exe
  2⤵
  PID:7704
- C:\Windows\System32\TRqljjg.exe
  C:\Windows\System32\TRqljjg.exe
  2⤵
  PID:7720
- C:\Windows\System32\BGKnEWo.exe
  C:\Windows\System32\BGKnEWo.exe
  2⤵
  PID:7736
- C:\Windows\System32\UMgJWNj.exe
  C:\Windows\System32\UMgJWNj.exe
  2⤵
  PID:7752
- C:\Windows\System32\wzZEzrA.exe
  C:\Windows\System32\wzZEzrA.exe
  2⤵
  PID:7768
- C:\Windows\System32\GBzhAJc.exe
  C:\Windows\System32\GBzhAJc.exe
  2⤵
  PID:7784
- C:\Windows\System32\OaLyLAl.exe
  C:\Windows\System32\OaLyLAl.exe
  2⤵
  PID:7800
- C:\Windows\System32\HjajlOB.exe
  C:\Windows\System32\HjajlOB.exe
  2⤵
  PID:7816
- C:\Windows\System32\wYxJsXr.exe
  C:\Windows\System32\wYxJsXr.exe
  2⤵
  PID:7856
- C:\Windows\System32\ObqLdRb.exe
  C:\Windows\System32\ObqLdRb.exe
  2⤵
  PID:7908
- C:\Windows\System32\hSvIYOg.exe
  C:\Windows\System32\hSvIYOg.exe
  2⤵
  PID:7924
- C:\Windows\System32\HMWHpWL.exe
  C:\Windows\System32\HMWHpWL.exe
  2⤵
  PID:7948
- C:\Windows\System32\ZlrjHVH.exe
  C:\Windows\System32\ZlrjHVH.exe
  2⤵
  PID:7964
- C:\Windows\System32\czaHJQh.exe
  C:\Windows\System32\czaHJQh.exe
  2⤵
  PID:7980
- C:\Windows\System32\hgPmrCe.exe
  C:\Windows\System32\hgPmrCe.exe
  2⤵
  PID:7996
- C:\Windows\System32\orrdpcy.exe
  C:\Windows\System32\orrdpcy.exe
  2⤵
  PID:8012
- C:\Windows\System32\dbvfWYk.exe
  C:\Windows\System32\dbvfWYk.exe
  2⤵
  PID:8028
- C:\Windows\System32\ldwVWGQ.exe
  C:\Windows\System32\ldwVWGQ.exe
  2⤵
  PID:8048
- C:\Windows\System32\eJdySnK.exe
  C:\Windows\System32\eJdySnK.exe
  2⤵
  PID:8064
- C:\Windows\System32\gywllQn.exe
  C:\Windows\System32\gywllQn.exe
  2⤵
  PID:8080
- C:\Windows\System32\eQEjbnb.exe
  C:\Windows\System32\eQEjbnb.exe
  2⤵
  PID:8116
- C:\Windows\System32\LqgwudJ.exe
  C:\Windows\System32\LqgwudJ.exe
  2⤵
  PID:8136
- C:\Windows\System32\KfqvXCF.exe
  C:\Windows\System32\KfqvXCF.exe
  2⤵
  PID:8152
- C:\Windows\System32\ZahfUHa.exe
  C:\Windows\System32\ZahfUHa.exe
  2⤵
  PID:8172
- C:\Windows\System32\VonOWkw.exe
  C:\Windows\System32\VonOWkw.exe
  2⤵
  PID:8188
- C:\Windows\System32\bMbsHEx.exe
  C:\Windows\System32\bMbsHEx.exe
  2⤵
  PID:3500
- C:\Windows\System32\zzVEqzG.exe
  C:\Windows\System32\zzVEqzG.exe
  2⤵
  PID:3288
- C:\Windows\System32\TpkdJBm.exe
  C:\Windows\System32\TpkdJBm.exe
  2⤵
  PID:7016
- C:\Windows\System32\InIGoQP.exe
  C:\Windows\System32\InIGoQP.exe
  2⤵
  PID:6196
- C:\Windows\System32\BhLOgGW.exe
  C:\Windows\System32\BhLOgGW.exe
  2⤵
  PID:7204
- C:\Windows\System32\JCTDPdG.exe
  C:\Windows\System32\JCTDPdG.exe
  2⤵
  PID:7236
- C:\Windows\System32\yPlWOpB.exe
  C:\Windows\System32\yPlWOpB.exe
  2⤵
  PID:7264
- C:\Windows\System32\PwvjkQs.exe
  C:\Windows\System32\PwvjkQs.exe
  2⤵
  PID:7296
- C:\Windows\System32\iPRmbbK.exe
  C:\Windows\System32\iPRmbbK.exe
  2⤵
  PID:7328
- C:\Windows\System32\oanVeEF.exe
  C:\Windows\System32\oanVeEF.exe
  2⤵
  PID:7348
- C:\Windows\System32\xcQgnFS.exe
  C:\Windows\System32\xcQgnFS.exe
  2⤵
  PID:7376
- C:\Windows\System32\sjmMMnb.exe
  C:\Windows\System32\sjmMMnb.exe
  2⤵
  PID:7408
- C:\Windows\System32\paQvQQk.exe
  C:\Windows\System32\paQvQQk.exe
  2⤵
  PID:4540
- C:\Windows\System32\ALdCAgp.exe
  C:\Windows\System32\ALdCAgp.exe
  2⤵
  PID:7472
- C:\Windows\System32\GMqDHIq.exe
  C:\Windows\System32\GMqDHIq.exe
  2⤵
  PID:3588
- C:\Windows\System32\LESEByd.exe
  C:\Windows\System32\LESEByd.exe
  2⤵
  PID:9664
- C:\Windows\System32\wiamMrk.exe
  C:\Windows\System32\wiamMrk.exe
  2⤵
  PID:9680
- C:\Windows\System32\FSXatha.exe
  C:\Windows\System32\FSXatha.exe
  2⤵
  PID:12148
- C:\Windows\System32\qZbnURx.exe
  C:\Windows\System32\qZbnURx.exe
  2⤵
  PID:13200
- C:\Windows\System32\rVruZlB.exe
  C:\Windows\System32\rVruZlB.exe
  2⤵
  PID:13244
- C:\Windows\System32\lCoGaOC.exe
  C:\Windows\System32\lCoGaOC.exe
  2⤵
  PID:13288
- C:\Windows\System32\sxwNucn.exe
  C:\Windows\System32\sxwNucn.exe
  2⤵
  PID:8072
- C:\Windows\System32\nxOYWXt.exe
  C:\Windows\System32\nxOYWXt.exe
  2⤵
  PID:11860
- C:\Windows\System32\JitixYi.exe
  C:\Windows\System32\JitixYi.exe
  2⤵
  PID:13628
- C:\Windows\System32\IrZoPRY.exe
  C:\Windows\System32\IrZoPRY.exe
  2⤵
  PID:13660
- C:\Windows\System32\ZJzcWyk.exe
  C:\Windows\System32\ZJzcWyk.exe
  2⤵
  PID:13676
- C:\Windows\System32\QbcWCeZ.exe
  C:\Windows\System32\QbcWCeZ.exe
  2⤵
  PID:13720
- C:\Windows\System32\myJQFuR.exe
  C:\Windows\System32\myJQFuR.exe
  2⤵
  PID:13752
- C:\Windows\System32\tzQLvnc.exe
  C:\Windows\System32\tzQLvnc.exe
  2⤵
  PID:13768
- C:\Windows\System32\usXGcHA.exe
  C:\Windows\System32\usXGcHA.exe
  2⤵
  PID:13812
- C:\Windows\System32\gdmQkyX.exe
  C:\Windows\System32\gdmQkyX.exe
  2⤵
  PID:13852
- C:\Windows\System32\IfXzptk.exe
  C:\Windows\System32\IfXzptk.exe
  2⤵
  PID:13872
- C:\Windows\System32\cbUhDGa.exe
  C:\Windows\System32\cbUhDGa.exe
  2⤵
  PID:13896
- C:\Windows\System32\PqhJBZl.exe
  C:\Windows\System32\PqhJBZl.exe
  2⤵
  PID:13924
- C:\Windows\System32\enoEzjR.exe
  C:\Windows\System32\enoEzjR.exe
  2⤵
  PID:13948
- C:\Windows\System32\IYCudLy.exe
  C:\Windows\System32\IYCudLy.exe
  2⤵
  PID:13968
- C:\Windows\System32\mlaBedL.exe
  C:\Windows\System32\mlaBedL.exe
  2⤵
  PID:14000
- C:\Windows\System32\QMmEDpk.exe
  C:\Windows\System32\QMmEDpk.exe
  2⤵
  PID:14028
- C:\Windows\System32\GZhERIV.exe
  C:\Windows\System32\GZhERIV.exe
  2⤵
  PID:14052
- C:\Windows\System32\gaQmJuo.exe
  C:\Windows\System32\gaQmJuo.exe
  2⤵
  PID:14092
- C:\Windows\System32\JzTsgZH.exe
  C:\Windows\System32\JzTsgZH.exe
  2⤵
  PID:14112
- C:\Windows\System32\jqCmLgu.exe
  C:\Windows\System32\jqCmLgu.exe
  2⤵
  PID:14156
- C:\Windows\System32\VICGlGd.exe
  C:\Windows\System32\VICGlGd.exe
  2⤵
  PID:14180
- C:\Windows\System32\gHkuYBZ.exe
  C:\Windows\System32\gHkuYBZ.exe
  2⤵
  PID:14204
- C:\Windows\System32\dEIFtWY.exe
  C:\Windows\System32\dEIFtWY.exe
  2⤵
  PID:14232
- C:\Windows\System32\FZWbeOP.exe
  C:\Windows\System32\FZWbeOP.exe
  2⤵
  PID:14260
- C:\Windows\System32\DJVlnWQ.exe
  C:\Windows\System32\DJVlnWQ.exe
  2⤵
  PID:14304
- C:\Windows\System32\nktnxMo.exe
  C:\Windows\System32\nktnxMo.exe
  2⤵
  PID:14324
- C:\Windows\System32\YEQVgqt.exe
  C:\Windows\System32\YEQVgqt.exe
  2⤵
  PID:10380
- C:\Windows\System32\EmucBEg.exe
  C:\Windows\System32\EmucBEg.exe
  2⤵
  PID:10424
- C:\Windows\System32\DujOVOA.exe
  C:\Windows\System32\DujOVOA.exe
  2⤵
  PID:10516
- C:\Windows\System32\qRMSKHu.exe
  C:\Windows\System32\qRMSKHu.exe
  2⤵
  PID:10564
- C:\Windows\System32\OikBSBi.exe
  C:\Windows\System32\OikBSBi.exe
  2⤵
  PID:7616
- C:\Windows\System32\yeonVAJ.exe
  C:\Windows\System32\yeonVAJ.exe
  2⤵
  PID:7700
- C:\Windows\System32\RnJONCD.exe
  C:\Windows\System32\RnJONCD.exe
  2⤵
  PID:3084
- C:\Windows\System32\wDXUphJ.exe
  C:\Windows\System32\wDXUphJ.exe
  2⤵
  PID:2168
- C:\Windows\System32\twsFYJw.exe
  C:\Windows\System32\twsFYJw.exe
  2⤵
  PID:3068
- C:\Windows\System32\IJMofNb.exe
  C:\Windows\System32\IJMofNb.exe
  2⤵
  PID:7920
- C:\Windows\System32\IShxdiO.exe
  C:\Windows\System32\IShxdiO.exe
  2⤵
  PID:8128
- C:\Windows\System32\wWchQnQ.exe
  C:\Windows\System32\wWchQnQ.exe
  2⤵
  PID:7232
- C:\Windows\System32\DdKsywV.exe
  C:\Windows\System32\DdKsywV.exe
  2⤵
  PID:7428
- C:\Windows\System32\oOTEgho.exe
  C:\Windows\System32\oOTEgho.exe
  2⤵
  PID:8204
- C:\Windows\System32\NUoQEXs.exe
  C:\Windows\System32\NUoQEXs.exe
  2⤵
  PID:8276
- C:\Windows\System32\OcqUhZH.exe
  C:\Windows\System32\OcqUhZH.exe
  2⤵
  PID:8308
- C:\Windows\System32\apOEaof.exe
  C:\Windows\System32\apOEaof.exe
  2⤵
  PID:8348
- C:\Windows\System32\JGvHttJ.exe
  C:\Windows\System32\JGvHttJ.exe
  2⤵
  PID:8388
- C:\Windows\System32\Cllxvrg.exe
  C:\Windows\System32\Cllxvrg.exe
  2⤵
  PID:8424
- C:\Windows\System32\DRPibEK.exe
  C:\Windows\System32\DRPibEK.exe
  2⤵
  PID:8528
- C:\Windows\System32\vrRaLkG.exe
  C:\Windows\System32\vrRaLkG.exe
  2⤵
  PID:8608
- C:\Windows\System32\zQxmpDl.exe
  C:\Windows\System32\zQxmpDl.exe
  2⤵
  PID:8692
- C:\Windows\System32\QgwnZxe.exe
  C:\Windows\System32\QgwnZxe.exe
  2⤵
  PID:8760
- C:\Windows\System32\BdrCNbT.exe
  C:\Windows\System32\BdrCNbT.exe
  2⤵
  PID:8816
- C:\Windows\System32\ToBjQxx.exe
  C:\Windows\System32\ToBjQxx.exe
  2⤵
  PID:8872
- C:\Windows\System32\YkJwvZT.exe
  C:\Windows\System32\YkJwvZT.exe
  2⤵
  PID:8944
- C:\Windows\System32\tLZeuKo.exe
  C:\Windows\System32\tLZeuKo.exe
  2⤵
  PID:9016
- C:\Windows\System32\RPhEamy.exe
  C:\Windows\System32\RPhEamy.exe
  2⤵
  PID:9056
- C:\Windows\System32\nEWdeaa.exe
  C:\Windows\System32\nEWdeaa.exe
  2⤵
  PID:9232
- C:\Windows\System32\aBTFfqP.exe
  C:\Windows\System32\aBTFfqP.exe
  2⤵
  PID:9288
- C:\Windows\System32\oEnZYjN.exe
  C:\Windows\System32\oEnZYjN.exe
  2⤵
  PID:9336
- C:\Windows\System32\VbNAKyv.exe
  C:\Windows\System32\VbNAKyv.exe
  2⤵
  PID:9424
- C:\Windows\System32\nMBrpCk.exe
  C:\Windows\System32\nMBrpCk.exe
  2⤵
  PID:9480
- C:\Windows\System32\EyCFrIE.exe
  C:\Windows\System32\EyCFrIE.exe
  2⤵
  PID:9528
- C:\Windows\System32\rsmNCrg.exe
  C:\Windows\System32\rsmNCrg.exe
  2⤵
  PID:9596
- C:\Windows\System32\dSmpWmH.exe
  C:\Windows\System32\dSmpWmH.exe
  2⤵
  PID:11772
- C:\Windows\System32\EeNXxSO.exe
  C:\Windows\System32\EeNXxSO.exe
  2⤵
  PID:12016
- C:\Windows\System32\mgmUOwI.exe
  C:\Windows\System32\mgmUOwI.exe
  2⤵
  PID:9756
- C:\Windows\System32\McwkXeI.exe
  C:\Windows\System32\McwkXeI.exe
  2⤵
  PID:9672
- C:\Windows\System32\OnbLCnJ.exe
  C:\Windows\System32\OnbLCnJ.exe
  2⤵
  PID:13164
- C:\Windows\System32\voJASgU.exe
  C:\Windows\System32\voJASgU.exe
  2⤵
  PID:13232
- C:\Windows\System32\pvFqibA.exe
  C:\Windows\System32\pvFqibA.exe
  2⤵
  PID:9916
- C:\Windows\System32\jCBwSUB.exe
  C:\Windows\System32\jCBwSUB.exe
  2⤵
  PID:9400
- C:\Windows\System32\THREbCT.exe
  C:\Windows\System32\THREbCT.exe
  2⤵
  PID:9884
- C:\Windows\System32\BXzNMCK.exe
  C:\Windows\System32\BXzNMCK.exe
  2⤵
  PID:11756
- C:\Windows\System32\vXVcwuk.exe
  C:\Windows\System32\vXVcwuk.exe
  2⤵
  PID:10076
- C:\Windows\System32\fwURkmB.exe
  C:\Windows\System32\fwURkmB.exe
  2⤵
  PID:10124
- C:\Windows\System32\JWlGnzf.exe
  C:\Windows\System32\JWlGnzf.exe
  2⤵
  PID:10180
- C:\Windows\System32\gUhFMhr.exe
  C:\Windows\System32\gUhFMhr.exe
  2⤵
  PID:10264
- C:\Windows\System32\thImVkJ.exe
  C:\Windows\System32\thImVkJ.exe
  2⤵
  PID:10336
- C:\Windows\System32\PczXWzG.exe
  C:\Windows\System32\PczXWzG.exe
  2⤵
  PID:10652
- C:\Windows\System32\tAsXPxZ.exe
  C:\Windows\System32\tAsXPxZ.exe
  2⤵
  PID:10692
- C:\Windows\System32\yhDaIaO.exe
  C:\Windows\System32\yhDaIaO.exe
  2⤵
  PID:11796
- C:\Windows\System32\HTKqDQN.exe
  C:\Windows\System32\HTKqDQN.exe
  2⤵
  PID:11936
- C:\Windows\System32\oJVEyhA.exe
  C:\Windows\System32\oJVEyhA.exe
  2⤵
  PID:13156
- C:\Windows\System32\zMKbkKp.exe
  C:\Windows\System32\zMKbkKp.exe
  2⤵
  PID:12228
- C:\Windows\System32\MLPjazS.exe
  C:\Windows\System32\MLPjazS.exe
  2⤵
  PID:12384
- C:\Windows\System32\JSGKULX.exe
  C:\Windows\System32\JSGKULX.exe
  2⤵
  PID:12656
- C:\Windows\System32\EFrNomA.exe
  C:\Windows\System32\EFrNomA.exe
  2⤵
  PID:11764
- C:\Windows\System32\FLrtXUR.exe
  C:\Windows\System32\FLrtXUR.exe
  2⤵
  PID:11972
- C:\Windows\System32\ImqezRY.exe
  C:\Windows\System32\ImqezRY.exe
  2⤵
  PID:12212
- C:\Windows\System32\fyUHiPe.exe
  C:\Windows\System32\fyUHiPe.exe
  2⤵
  PID:13376

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\ATiYiwP.exe

Filesize
1.4MB

MD5
9b17bc53dfd4343d7170eb42e2de0968

SHA1
46b829964213fa666d261ad82e0e81f8e990ab04

SHA256
93e738ea411a3a45954e2bb1b501e3d34b2a1ad0a8501015a2df8f56cf6d6793

SHA512
f79a24841c115c344a06f7d12b73aaac626949ffab930a596ccd1a7a56cb807aaebb1024f5e00b142d9b8c95d2b0c156fb4231c0de62094ccfb13b6ebd22f22f

Download Submit
C:\Windows\System32\AkmWYAV.exe

Filesize
1.4MB

MD5
7fffc9f4ec27de85428be1ba89128658

SHA1
a9e870173f1afc89b1663957714a1a0bfe54db80

SHA256
ef6912d27ecdaaf9a78f6fb5df169a6dd53d5dc2ab2ae6b0409946b1b11ec93b

SHA512
61f91fa70ebbc21f49c69e8a2709d7c1bbbdd2d6fa6949ac6a1631ed39b04d5d8430b09ec3b8133de362319924dc3773ae71328f7466c67f23e1040611efe96d

Download Submit
C:\Windows\System32\BULTOsj.exe

Filesize
1.4MB

MD5
f363313b11a325209f61d0149d54759b

SHA1
663be043b4d1706e7e460b8d098b0f261efe041b

SHA256
c3dbdbc7e8373d6bb7988346e7a7a7df1e43772741fc862a6a5b57f1524edf9c

SHA512
8c78d6dacf32ce5aaac0394997b6b0379ef28e0799cfa432cb265d85fefc86c195f56742d4183d566758803eab912b02f7acd4355059eb3d283fdae3781f10e1

Download Submit
C:\Windows\System32\BhpgOvO.exe

Filesize
1.4MB

MD5
39372e73621973d01331f80b709fa322

SHA1
5365bb56d639e7e121d624b2cbd75515b48e7bb5

SHA256
01b64f357ca72e1d649853bc5c320e8d81d931cee48ecba55297cb8b15bdacfb

SHA512
9f59c9d583718761a47934e019d557df57f6f10a6397536e39a75f18d5d03ec076c9091c4bc3c642c38a1f62f001a9b9a8f6b189ccc097f75e46577b095d688a

Download Submit
C:\Windows\System32\CZQFZbN.exe

Filesize
1.4MB

MD5
697f6f96b831907ea0f51f0577a60ae5

SHA1
1710c9eb0ad311907d0dae99bf698fd0ddd02e44

SHA256
1a588893728a5e0b7a51bd378b18bda4b248ae254375ccd9a6b185d6704ea56a

SHA512
0fb2ec2e4be426263403ce181ab666af41a43f5d3b1cd4703ccd8c4fc2466a9bec4cd58dea88c5cac209b239ce76679f6bfd1207e4d4be8a83a34d825355eb7a

Download Submit
C:\Windows\System32\CyXrxcG.exe

Filesize
1.4MB

MD5
1b1deced0205ef4ef4388ba5369592eb

SHA1
c2b1c391ac9c8d0744d935ff0ff70259047b4627

SHA256
06864b0ed3800d162ac64538fc3ec9e3c9db318bb7f509eb2741750491288689

SHA512
3e612700d6c072e47f7b3012292c801cbb7382ca567bd95bd7c84543331d913d67241df3090d34fcc569c21a9ff54f484fc0dad9c5177272b836a9bc9875fc90

Download Submit
C:\Windows\System32\DAZsWEH.exe

Filesize
1.4MB

MD5
abf5b29c0720cf8ce2a56417152ec23b

SHA1
7490e85be6e3cc33e931ea40489cf4a88e8af9b0

SHA256
29a5b8b4f817212b93452a40f084093b6504acb07e49168155004ab525cec71e

SHA512
2c0a8078037569274b174faa846ff1b810185754379463c14c313ece932f74e185f1302d4d8050cafdfe52a82afd3fc94a3799344e87f113d597990650a12beb

Download Submit
C:\Windows\System32\EUEJvNA.exe

Filesize
1.4MB

MD5
07d4cc01424dfc63280a697308f769c3

SHA1
35e7b9678a076af76a69cdfccc160602ab79f6b2

SHA256
4ff304e475350762a6c5c1d73cb4bd5003f1e392a62b26d36c41e31c041a47d5

SHA512
0d815cae9f43a54b6d8148aa9d8e53d59ff18f16d7ddc39ce3e1cc34863412e5231b95986e55344084be3697a534b7cf82a30ccf1fa262432c8a8e67f5da9381

Download Submit
C:\Windows\System32\FKXZGok.exe

Filesize
1.4MB

MD5
077f1dee2dd9970e983cbfcb57ceffe9

SHA1
89637ef851ec48893066154a406d9444b676b1c8

SHA256
67d76e0e4483f379554bb616aade383c529987ba86e6bf3e7a109b5ce11300c4

SHA512
1aec81b82405eca30418b7510299c0575a390f6e6b96d3ea5e6e16a323ea1b66ae5b3bac77863d6510bec9d3364fc80581d5b916d15a2bc749600fcb79a8294a

Download Submit
C:\Windows\System32\FpkekcN.exe

Filesize
1.4MB

MD5
c7ee01039477d4da703d1e1508e093ee

SHA1
63ff57ebf2451ae9fe1b3198cdc938a89c6938ff

SHA256
c858726de262c2396e160e61b29dbf6e1de8c70fc3f1cc02ec55d4701e7a73bc

SHA512
af1c3a02aa96a5de9554ac2d973e9d0d7c38b93f0f4e61087ebdcd6603a3204d85d85b3f3508aec05d2b615763c20c112b36ac2a66f82acfa3be75a8aa638337

Download Submit
C:\Windows\System32\GdiPyND.exe

Filesize
1.4MB

MD5
c0fde959502246d2a757a5f2729ed097

SHA1
69acafc6adee667f3983529c166d6d2fd40a197f

SHA256
7d03c6dcfbd593e1c7af79135a39b19b8dabef82bfe01ac7222518556fc86130

SHA512
685ca5f5e0300b189d7e367499af34017ec21b0e0c28f2579d5b6c84b317dd32b13270be1d65764adf65f6556b83964ed729275ea3ae4ebc33f034f7590bd3ad

Download Submit
C:\Windows\System32\HWqNsbI.exe

Filesize
1.4MB

MD5
e338c907fce1ed362306c2a3c8a5dd5d

SHA1
fb73bed53ed537c2e8d9475cec33f112b4a5e90a

SHA256
e07ff0da14eff87a016f5f491472d0caaad506829b675334e5729ae8b728bef4

SHA512
6d20df9fa9326766861ac666bdaa8b942ce3acbbeced0de8fcc21b5b350fb49d500b34e258327ce0c05ff505a0f991ea98bea494a4223d40cac783ea58ee87ed

Download Submit
C:\Windows\System32\HzfvjSw.exe

Filesize
1.4MB

MD5
9ddd52986f70da7a1078676147d0ebf9

SHA1
9923c055ba924f36c9b684d208c44ba940f268ee

SHA256
eadb7a9531f9a96bf06353ff2c9a490f5f921241a67ad2266d8809bd792a08fb

SHA512
cf2f75dff061a45e03d09362e37c05155fc14374808284599b3c0948212979f007dd044689e97598b2350bff9aaa94b663a271ce806e115bf7b66d8195f5170c

Download Submit
C:\Windows\System32\JCdUOwg.exe

Filesize
1.4MB

MD5
0da9b6e7d553e21afdd2061457526b79

SHA1
ed6e589b986df33f0aad59245cbc7106292fd983

SHA256
0fe59e96f42077794655e0366545c2d125963900e2abb022608160870a09cc62

SHA512
10af7c4740dbef8975871581423a0b4055876629f93cebeb54796babbe252a9fd2bf674684da22e4b34c615dff583b883d54b970b1271afb5dc1682c8c99c1ca

Download Submit
C:\Windows\System32\KoxnFSU.exe

Filesize
1.4MB

MD5
3ca92993e5144dfdf3db1556f9e9f122

SHA1
e0930f69abb30e1c194e45ad1dd456e0ec22f879

SHA256
778f2fbf4dd6c4d8bab50f82baa82a289d5249f7f2c99d3f2e006bb1f89ccb43

SHA512
ebb093452e4bcdf2a08101b0e4f6f95a6f1a94889fdd114ae2bed7e5eb60802eb29e0d1068e094d2cefa5f57605154f1d50305e9a767d44df84c7943f08ae36b

Download Submit
C:\Windows\System32\LBmPJOH.exe

Filesize
1.4MB

MD5
9521e4c2b6621c2bb428d0773299cb42

SHA1
2cc08012c23cf2deb5bc10f3edb38b0c17235a29

SHA256
7fe7ac111c6c57ee079e8f190e10ba708880ce70e644e5b171b93d46b069cd67

SHA512
e974190438383f1821510f437530da5499051c5ff59b6b69a870a2a974eeb7393a639d3c1aa30299643070c348f46c3906383aa6b8411feae800b14902599f12

Download Submit
C:\Windows\System32\LycgSMj.exe

Filesize
1.4MB

MD5
58a2eb7f08c38d695685f154d86e4faa

SHA1
30b555b1fed9a1985b0aabae65e901193b0268f0

SHA256
184d8da7595df95a8332f8b43f06574c5a7e2ecb6f6662d10924d462687fc7e7

SHA512
a001772c287cc3b22798aa9864af429dc53f2c5e41e369cd1004c4d2a1894bb8e22401c255c39b5dc8fe1005f57799f1fd0018dedc4b2cddfd63348cd0df9c9c

Download Submit
C:\Windows\System32\MVpBKcw.exe

Filesize
1.4MB

MD5
abae7c1abf87c5af9473962e7bee87e9

SHA1
ef75e8e7c6b3ec21e7e82668dbc13ef1b35c692f

SHA256
ba54c2fbed22cd0945d6270f9ce7eccfad89ed6b7e669360c44caa79f6d4cfde

SHA512
0673b2695f0cc9df950063698570bc474dfea8ba4ff28e67ffca37d7c6aee89c7a880f2616febdcfa06bfb1d0973c01eea5cc906acec2de533918a1a0bea0bc6

Download Submit
C:\Windows\System32\MkCpxUR.exe

Filesize
1.4MB

MD5
24f2486c4bb5667a7b91feefebb3da47

SHA1
b60f84cde21dad16c3fcc2e57106c377044ac5ce

SHA256
ce882c589d1b131a20ed23498a66636777f48ce7b879d46bb5fa04867c5d0d45

SHA512
9d204a515d3c365d06b9ca559dd06992bac6bcad0566f50cb66b68379087cdc53fefe1c38d770edac4c786331cb1c98672d67aeb5d9e2f0589b8b5700c315ce4

Download Submit
C:\Windows\System32\NXzhjlR.exe

Filesize
1.4MB

MD5
991342bbe9718288265e5649c8a00b98

SHA1
d4cb15199e1b42a52542e88f5d7032ea12cd5bd3

SHA256
3dc303c13ca769182c8a967e1da5f477a4108d680c284ebc7bc632f5999097f1

SHA512
c75301df029561eb52fbb60c3bf217d21484165af8b1d97f6013cea8f420742a4f017a03a06d0f63b971c7331e2d2671c1c8b87e248e01b8b4d99eb4b6309e45

Download Submit
C:\Windows\System32\NfckScB.exe

Filesize
1.4MB

MD5
ab035855725dd4f498dccdb8c6323d21

SHA1
02ee27eee3d00dfe1478a6984783c38a2e5b6d9a

SHA256
83ddb3d02935fad2b52c46037b17420fe03f14d223196ddbc71eb9b9d39a5efa

SHA512
67f923eaf519e292767c9726d68b1d7de95961d7702cddb58e966f3ea0daf45c32634d839f4a3ad82a09bab7bb9b8e085967ce0688859c91ef66d90bbf28ef76

Download Submit
C:\Windows\System32\OckSQBj.exe

Filesize
1.4MB

MD5
5e06df6a7350fe31128ef26f7c500ded

SHA1
56680d294aae1faa08f6ec8613f2ea89987351e0

SHA256
ce99f4e77a93ea25dda55d10a01382ffe74bda48ecd9ea1e62921305b818dc43

SHA512
0fb393a583a13f8d1f79e8740089afb1a58625f545b5b4d0e7e072c8e59ee4416bf51fedfcdcc89a5853b5565f466d7d3015501212cb94659d315f4bc2dc3707

Download Submit
C:\Windows\System32\OyifoGE.exe

Filesize
1.4MB

MD5
2c2c96d9fc2b3ea92a50c3a728d80c98

SHA1
1c317ac0c67b256b86d4040785be0a320082a498

SHA256
3680a661732b438eea2ea88e2ce48d996712fd58d064de2f241de10ddb46bd09

SHA512
9222ca6eac8879b18926223272895971cce4d53323b1108a9a83d30afe47996d497ea0a2fe12280a4947d7d3a00e81c54337037970df88dbd1528bb1a1f5a465

Download Submit
C:\Windows\System32\PTWNnsX.exe

Filesize
1.4MB

MD5
8c53e0ef2d82ef73cb2c3cfc6268859a

SHA1
9ea4090be550ba26451cad3d9ad5b7767ecccbd6

SHA256
be96473b23fe4f80ff5cd52ff28e2bc70d52ba4a7dad739c85b933e7436f3250

SHA512
6fbd7da02288edfe8d253351e22b0a6a8fd453f8832dea06684c8ba7cff915759588e14364a1ccc3bb407920e6d2160e5aacf9e9bbf8307391523ef3d93ab7ca

Download Submit
C:\Windows\System32\PgSCTdx.exe

Filesize
1.4MB

MD5
7cd36de00d8af398a396da23001b849d

SHA1
b78cf58e74cc2d85cb81cb9f1487fbf28a993271

SHA256
a47c01b3fbb557a53b1af48e08a1e4b0c0d9b310084096f2db4149f50d2bbc60

SHA512
85a8f59c905f9fb7078d21844e57356a54b0f6ed90891459c8e7c7a6529ac6caecf7a755dd339ef15d6aba658359e4ac6794b64f20f56f3ee196cfe67ce9af23

Download Submit
C:\Windows\System32\QNlAnIa.exe

Filesize
1.4MB

MD5
2d864dfa6aca82ac7294cbc7ac0ce608

SHA1
0726a8c221c934df17bfeb5dab0ba7eaad15b47b

SHA256
9102adbb54c22a7c83926cec582eb9d42be7a366eb2939bc188f73b97410ba10

SHA512
38ae838901ac1923d6c2afa631c12c0a1a3d4e8b2b8b071d8d92e87de9169440234da4b2d0c574caa0928eddf16c9b3c46c81528d410ff28daeb843805ae46cf

Download Submit
C:\Windows\System32\RhTMwjY.exe

Filesize
1.4MB

MD5
707c16ee88ab19b86d64717735766573

SHA1
17120b936698e9aa8ac73c6b0752869108c0eb23

SHA256
10e840691dee4c31ab49c9d4588966496ff36fd3a1b90eb8f2a0aa31b3887c9f

SHA512
9aa02fab0aea3183489a8fe20cab60fe3fe1df80c4d777bd48cfe85ee64dd5c2a1caa45a7b12dd6b483ca90a45b10ca4fdab0b81702a7518c458c68a8e68661f

Download Submit
C:\Windows\System32\RmFowra.exe

Filesize
1.4MB

MD5
4ffe41233f4dfee821030dc5e3a0d7b4

SHA1
0fbaa1191c1dbcdbca1d2b3f40468a1bd45dbdcb

SHA256
5ee8dc52d7d3d2af963ec9a7b22b36a4b0b16bb6d926bff5ca69960fcd72ae0d

SHA512
9ea9a8206da0e986fe5384ccc739bae2e39027884a2d9901dfafce2f9209a1fe82bc02778c650885a61dc8c11e489372c792b4f37d29dc9cb994af709de3eed5

Download Submit
C:\Windows\System32\SGHEZrq.exe

Filesize
1.4MB

MD5
f723139e8ecdf9b05fbd54ace886708b

SHA1
2400b8606ea1fb251913e1e5bf209b5b19ce8f7f

SHA256
f275a38e604542fdcdfd251ea8999d7d0c75c174b017d75321382a3c203fcddb

SHA512
398cdf186f45357aeafc5ba01a2908a6f782f9605bd9f336f833924cbce8cc7550c8e343f791f42d93343fc1cb6b03e91b2edb61af06345be41c6d4f27361f11

Download Submit
C:\Windows\System32\SoysiHR.exe

Filesize
1.4MB

MD5
bb362c02a7211e1a02e7d9e571fa8429

SHA1
99c4e11b97f9c68905e0fb46c2fc3a7b1937dc61

SHA256
1b24277756f1dbba54e7f5fe0cc6bf3640f67e41671e6db4757573c6c31f0e56

SHA512
f3f5881681a0ed8eeed0c64c63dad102ba1c24e75aa8212f845e52db3d7cb256cf15eecad68f9f09ab3b4e772f16eb31e9901b953d73b2e0509b340c318b783e

Download Submit
C:\Windows\System32\SpiDZow.exe

Filesize
1.4MB

MD5
1c75f5d9e7cf369fa1d333c1283d9828

SHA1
a5297785643d73a90fb1047d859e048790bd942a

SHA256
4afce680ecd75b85dc6ad64e33c591cf51dd14ea0d2181fff5e698b5fc2c0aaa

SHA512
235c22b0df6afa30761a7326b0b8ef5dd9684cebc2ae48ef03e3e4c82622a1a03ff48b8b6df5467f4c54a0b37a2657fd78cd2021eab0a3f3200d2937dc0861b9

Download Submit
C:\Windows\System32\TELGkqO.exe

Filesize
1.4MB

MD5
b655f031851a250d4071d6585d1773c3

SHA1
12bed92a29d47f6c47ad59d394dbd069ff455f6c

SHA256
76fc6a3971ba88bc1ae924f8e5b2656ffed5e5c18814a3eb633633dc601d947c

SHA512
66d5affaec7a56c05aa4bbe482d07407ad7b8d2a38ad456693c5557851a79ee56aabd5d372cd28b786b63fe8fee8aa1e1afdfc309663ca7a443d5adfb4a20fc7

Download Submit
C:\Windows\System32\UMcoxVA.exe

Filesize
1.4MB

MD5
77476c70675e19b6690f5e2b8a2d4f3d

SHA1
d9da6eaab52be346ba94280c13f8b639b62fb52f

SHA256
b7ca1fe3bc45f405c48487911d4b63f26919b05acd9aaa4d6eaef4f27e4d977f

SHA512
947b0563f706c37d75c6754c660e1b054361f4508797efc813cfe5c1b16b773cad738765e6a7b65eb2496f112103da7ded474cd6f64bcd69ad293e73424bcb25

Download Submit
C:\Windows\System32\UbplDWB.exe

Filesize
1.4MB

MD5
e42271ed91b14266af2986824c563f7b

SHA1
75e1ef5f19ea327132ffb4b861454d7e5cd99241

SHA256
bcb78203bb7a6dd65e5aaf1b036d23a8b445a81c8aa4cbd03f51b06690ddc09d

SHA512
ce882d2d10fced629d97418114be926e14f770935a1cbff03f37c3e21dcf970e000d02460f59c9c669319e47b0a9d47e13bbd7ccf8a43f1ae472aa186124e92f

Download Submit
C:\Windows\System32\VvnHXvu.exe

Filesize
1.4MB

MD5
61e9724bda54b0de40ceaebef52d7d97

SHA1
84a204b43ac95220b2364cea835aaaeaf27b6a4d

SHA256
1ee722ef292f8f6b608b9745941845563a7bfcc0c71ec271987ef64435e7af1e

SHA512
38edaaaaba654398cd1b9174c54cb0ef0a38b3a4eb83ad773ab58d97a6e65c0669f35800d395eb9391c06a9a10b363b5630c13b768b4dba1d853a5894cb85852

Download Submit
C:\Windows\System32\XwVUIiK.exe

Filesize
1.4MB

MD5
4aca5845fffbdaa8f55eb8dac15e78a3

SHA1
8940872fb52790ac49294aac6cf565f3f78cb8cd

SHA256
9d739b1b7cbd66820bf3596b65b4f4f29783c8033d56aae1763a188a1937e0a5

SHA512
82cd98043a2410048a7b83dc466ab3961f08cb59f897200803a658f59e1b3ed5e8026362dd8dd175553f152b07f825b0cfa0b07023d2fa44bd379fb9ee219c7e

Download Submit
C:\Windows\System32\ZnTAlkk.exe

Filesize
1.4MB

MD5
ea37970b2af453fcc23bb12a5fa5e099

SHA1
6efddd66ddd54ae816ff1eccbbbc1ad2987015b6

SHA256
c8bbe47b0683759541221ef15eac3ac28bd09435d1a2a905fee62b6a939e6ac7

SHA512
5d76f65b90782e2978550810fe53a5c6c5841015dff9b944ec7d27e72124e4f3e942807bb656f7ee8d57108429441fbae6469799245e9ac4cee3872bff6ae3ed

Download Submit
C:\Windows\System32\aChfBrA.exe

Filesize
1.4MB

MD5
7c02364e259e234091a3626be7adf8d1

SHA1
8837e1cea9a105c42857e6a1358183e869ef941c

SHA256
4719ae48b9be31d13e30e29b0b1f31e511e5279ce5c4797e0201c358ad9208ad

SHA512
214ac26bc7c83d3641af321cc38d89947abc8ee04092129f6318dbb0dd9d25d53c5cc600fd2fb7aedb1ca78aba8322871f4cdf9056e9c906eb7dfc78522dd434

Download Submit
C:\Windows\System32\cKAjfDv.exe

Filesize
1.4MB

MD5
9ba31ff962a2ab52c7864cd9e0f02016

SHA1
8368977179c889c04b81c5e76be9594cc423ccc3

SHA256
8bf125bb470cb782a3eb44f29a1117951202ffe7012c06a79771ced8e69ea45f

SHA512
9b78679477f463037e6dda454d19cadb6d000212189e9353101c801f1abc68ae2462196db33f3dbacabfe70becbd2f815692657266e789d09fdc3fd45aeb43be

Download Submit
C:\Windows\System32\dGMPaJz.exe

Filesize
1.4MB

MD5
69a2f1bec91f3b93fd9a5a97c9228bdb

SHA1
ec1ba5ee7f75f29ca710fa62f1e83df07d3c9b7e

SHA256
a27a77a60c2342d6e102029b86f77f208e2bd694eb4069fa371a7a9c65e0809b

SHA512
b43769c9655e04396350fba30b1105b38615b77244b6227b2af8cb57da8c0891ce96368f0f4a3e8850fba151e28e1f6ae3eac4231375b71445bb03f054444da3

Download Submit
C:\Windows\System32\dszTfCK.exe

Filesize
1.4MB

MD5
3e5c3724cdab92a9b4668e154ba21500

SHA1
9ba152f7f3868c01427fc5332d0a690ab1f14dcc

SHA256
f338950678c933e10c74903f2effe320db3cece8d0724ad0d3bb9e7505175ce0

SHA512
eef2ca5e4c09730b6e0c95040217b8f79c52db538f36afc9eda4bd80f3ad997d30c5556f76de9d9bd241ccd791b2958e96e7935d4c14f59a33cd0a52657693dc

Download Submit
C:\Windows\System32\dzaCSjl.exe

Filesize
1.4MB

MD5
846b822acbd5ff8c6463195f8bd6e292

SHA1
79617a531644332ff234930c28b3b84b018820e5

SHA256
46e149de6867c45819514973a868f313463ceda21cb1f90041e3ab7eef6001e1

SHA512
bc8ccbb51b39fcaffe537a1e395b38d69dc3e8ba21fc10cc2d57e17a787e6325b1fc91e6ee12f72a577782d2ccda2421878148a94cd45b6ba807a895bac5962d

Download Submit
C:\Windows\System32\gtXOTYl.exe

Filesize
1.4MB

MD5
ac15ee2630426fd4533b0f24f8a7b9b4

SHA1
1185632c114d671db6fbf14dc3b0b35c9ff92b52

SHA256
47863651074843b661e292e4d79f705359f8bb1cfb22680310d2166c9de9db5f

SHA512
219c4616494e6e91872ddaf4277c346b49f4aeb7074d5cfd204bc38eaad362b012478bc8c3fc32bb0cf4e5197575e5e4c5427d283fc152627b7eb7d5203e4c73

Download Submit
C:\Windows\System32\hGfMmlh.exe

Filesize
1.4MB

MD5
019f69226b7c2901c674ae3336634dad

SHA1
9c65f5ede51ea62e0243e95fc7e89298d935a0c9

SHA256
c633d0e204e391bc3d182e27261203d91add31ff81dc752c56c9de1766686564

SHA512
036f6833a2669146c3495397a80466bbb39fb907f88886dfd36a6d2e71d8084d365ebcc9242295de143639e8f3754d1fa4ca221970bb445e2a5274be8688b855

Download Submit
C:\Windows\System32\ihEvrPe.exe

Filesize
1.4MB

MD5
6a0407119732e066c0732dfbbb5f9982

SHA1
4a90fddb878623fc945935a096b48b1afe6fba51

SHA256
3ebd3fbd0f476394d7be148e41b80cb330f09a61dbde99499393d095d132c043

SHA512
ace3ceb6bbec1eed336fbf610a443bc805b4ce1779db5e2602fd0eb8acf8007aa279fdc5c7721ade893d9722231413bae0a57fc3841d14b9db99328ddbb0faf2

Download Submit
C:\Windows\System32\jJtvxZT.exe

Filesize
1.4MB

MD5
d8828a015c60576c6f0ca3bbb83ca7df

SHA1
4c4548e93d2400ab1d1ae09d3154077e3489bbba

SHA256
36ca78a9286301625b1e62b4d5afe430cd9c0919c9d8367583833165d5ce4639

SHA512
c89812e7e0df4a01431d9672d7a61d0a406e4af99fa440a467d89d461ff07fcfcb6c5f900c3d210b156bd65f6ffc300db53709392cd191098f2bf99e463253f3

Download Submit
C:\Windows\System32\lLexWkL.exe

Filesize
1.4MB

MD5
3ad1ed2c6e5ea40be714e9bd27c340cd

SHA1
e12558f44af3dff090aabdaedc50b3c0b84fd036

SHA256
9385fbf90613234645ca4d649eeee59f01e3c2b2856cfdbe7cbcd668bb56faa9

SHA512
c7d261cae463a76fe5987046743deabfb10640e791d91405e6d2d9db5f7cf83627f916ecd5e72c28748551f337d7a630284ffaa169523adfc64eb3287cff06f3

Download Submit
C:\Windows\System32\mRSqEoB.exe

Filesize
1.4MB

MD5
30791c679e68bb037c4e48bb0389964b

SHA1
187ad088fb851ef93c7162e19d50c3681e3876ec

SHA256
5651a0cbc02ecef8ed311ef3047c898e135282950379e6320e17d58621083843

SHA512
5c91237253b267610d223fd48b9cb814bfbec3faea6c6afeea0c38cf769b146c963059baeb00cd8b9f5fea3ef33e133ac8b49385c87ef9d88e77d062a2709a53

Download Submit
C:\Windows\System32\mtaFWzY.exe

Filesize
1.4MB

MD5
1b3d2c96824f696f8b90db83201ad4a7

SHA1
00f135a46568b98b45d4a04950679e31f1231ab4

SHA256
6411f1f0defd59bbb39931f119d57d9994aa1ba06c0a552621e2e670e5f7a315

SHA512
a0769c914ed1b58aae7d664342d8b1125c3d2fe1e301f446c897e55a9affab862a88525844af5b1a13b4ed99d0cb1870e298849e8fa4bb886cda20d672263384

Download Submit
C:\Windows\System32\niPPYqd.exe

Filesize
1.4MB

MD5
0741c176152d5714ec9cf568d080fdae

SHA1
ae7b4b68011a34fc4d12014420dc6f018629e905

SHA256
8342dbf9fcbf4f7d6c5c3e0f6930511f51114b977cd24fd689555e3a9a8802cb

SHA512
b30339b70e3bb6ca90b213fdebfceabfb87f6be1c058fcfb641e12175105d2ae6ec2e3a5695f659206b9923753a5e912ebd04e0f7e2b939b8f9bbe9ff53d8039

Download Submit
C:\Windows\System32\oeULIQP.exe

Filesize
1.4MB

MD5
f07756ffb3434e2867cd43596c1890e9

SHA1
4e058a802ccee20720098a40c06bc4a916fb7bed

SHA256
0b8ed68774574842066192ef24798852cdf6d6d185068f080202909769cab6e8

SHA512
c8de1a1cd9e3ecc5e6382bce8e495db223639dfe7e9eec6a64c243912a2213c6069c135cbe07e9c9201adf08f327b716b14cad02efd00e03d5c56302617bfb32

Download Submit
C:\Windows\System32\oklVPse.exe

Filesize
1.4MB

MD5
38fe3d17053c08484cf572aab56e5771

SHA1
cbbf44c2da3f841f5b85d5a764033ad25e2db7ec

SHA256
f418ff35fe138fbafcc73d074c4b3d272fd6e1ed5e81536cbd56408a8fe2963f

SHA512
52eb003696c715a1f9f3b4864ee143b9f57affc72fa082306361ee9c9ec00f3b45bedfc5cda4acbf18defd55e8eba1414e35cdf79b6f87ba0f12f1db6ad96c2f

Download Submit
C:\Windows\System32\ordEAZP.exe

Filesize
1.4MB

MD5
e16223b31ef50e27009978323c7e925a

SHA1
658fdc2719cdf58d3f39f6c52e9d9085be62373b

SHA256
180df1810e0900b318da244e4156f7f6991ce258f156fb8d5a9e5155a165b7b2

SHA512
2baaaab7b14e1b87c66040c9865682489a57bf4bc53b3763407b227a13084533204d81c91bbe069d656bd033c19fe17b507807192b1b861369887079b159d3c2

Download Submit
C:\Windows\System32\pIhqJdo.exe

Filesize
1.4MB

MD5
b208dc98eb147b0c5495f22b63da99a3

SHA1
f14e110fb00add9d5708bc869831e6b2475ba127

SHA256
7377e7f7cb5ddd688f51fd4a36975ba972e30514f6d0129eda792e1ccf06e3ef

SHA512
1c8d78c81f24db82fe3f54075ae5c4a3c9dd043ac84625f7be506f9bc3d8817542f9e87fc6c5141ed5416546042bd3974a0edfa8d2f3a6f2bacfd190da1d7e0f

Download Submit
C:\Windows\System32\pgHRsNZ.exe

Filesize
1.4MB

MD5
867006ca8ec045f79e36fc2f7929595f

SHA1
b5fbe9475f0948ef38f45fd0ae1f55cc0827b38f

SHA256
339b35743b20cc44c0fda0291c7b65043546171559ea03b812423869492ccb85

SHA512
fe493f0a59bc07057401813c87060bd60a348b0837b11d211f82e0f84120d5cefaa166829e9d13ec46bee1ec345f32564a555839650dab121a2e803593553990

Download Submit
C:\Windows\System32\qyWnCRp.exe

Filesize
1.4MB

MD5
cdfd59e4fa46724802dbe3ba4d42e098

SHA1
5466ea94c0c7e55c831a220f4fd865d64263cab2

SHA256
681bf73554517c33fe24e9b25845aa5ce189744046249fccdc96a1193a6405c8

SHA512
c0029008a9abaf19765127b82ee15ed36fadcd1b5c7e1f9d8f3c25d8616d20cfcf603d83953bebcc92ab1232a69f20209b49436fae32c7a2e15ac596ae84e06e

Download Submit
C:\Windows\System32\rMhCGcj.exe

Filesize
1.4MB

MD5
ceab508b42cd37cfa948cd871ea223c4

SHA1
8858b5089ac9c38b1ef167b439550d9ec9a4215f

SHA256
a3b0651ce921cf53f0c8f6471b9a200b487f0b55298acbe07c2d6c274b79eb41

SHA512
7b603ea1e025eaa0a1fd02330ca4ebe3b351575967e536b63f84b09960764c4622a9ac7f44b6549b25320ab2a674b92ae14373b9ef27f2d2ed5c1322a09efc75

Download Submit
C:\Windows\System32\rNFWQDx.exe

Filesize
1.4MB

MD5
e322e8920a8b33b0014b8be0fccdde3e

SHA1
c399996d120cd1f492d9d91517bbdede86803f46

SHA256
ece33e0d4aa1e0e607cea36442f7b10f644d358de3276a636a990a6b33a0b7ec

SHA512
6cb2749297573c54c2bb5d683ef981f65e2181f72b8f3fe27d596fe5910815ac4896717d51c255514ec662820afec351235fdb308b1562ed1e58a78a797aed5c

Download Submit
C:\Windows\System32\skVcGuB.exe

Filesize
1.4MB

MD5
1444645902c927c54f7af4c6dab87478

SHA1
5cece60116b51222c817af6a66edd6d79b809652

SHA256
6a4d5070cb8170ef1fd51fae59431a805d1f61c4df2ef7b6a87ba2af59beb3f5

SHA512
d6c0643ab4d3b47b9c819d62a8e9903624158bc5b2f6c813afef8b44d7903b232be938d34c99770612b0a1da9d3f2c0b4c0826ee579013d5b3fa0c1319f5325a

Download Submit
C:\Windows\System32\tpwRaWo.exe

Filesize
1.4MB

MD5
968494841b1ab20953bc88ba9875c5f0

SHA1
bdc4f87992ea97128f38fa06ea7b4ad31c063164

SHA256
879a4088808661d2fe502362bf875e9310cc5d990f5cc38e40ef58f032d0345c

SHA512
40af1f9b039330a681f2a9780bf3ff194864ef59e8aa1d85954f76dd9c65c935f36c0cceae114aa1f04098e292ae6159ffeab1de21adee146ebf16a585c20d39

Download Submit
C:\Windows\System32\wWtmNTQ.exe

Filesize
1.4MB

MD5
78c9bc67b9caf47a7db8042108c10106

SHA1
dd9bd2fb04929ddaa3ff299a5c153246576aeb80

SHA256
3239c6aa673cf04b28464ad38398d23d7790c2a5a6d13496ebbde6b23e363a21

SHA512
c34cc43dcec5aa4f06816221a241b86e0c98292dd69909b5b208f5c95441b327c5db98b7ccc606bafbabf319dcbb57174173a63c17b53c0fa95a8183a3a3d397

Download Submit
C:\Windows\System32\zhqSBrx.exe

Filesize
1.4MB

MD5
f5032340d0b59ee0d16b763d4bfc7458

SHA1
62ad8f9def5d7b50582cc82d8d6eff8a7b143f6d

SHA256
daa64722193f6b38d618359ebd3e18aabe5ad6cf71f02b0f798824e92cdb78a4

SHA512
7b4c022b89280c04f60460becaab379289c2b3d8854da8176bb13cd433ce22d6ff9df2e23e0ca8b8b4b20942bd360684f4c5a19eafb11f8606deca4aab93d298

Download Submit
memory/116-21-0x00007FF7B11C0000-0x00007FF7B15B1000-memory.dmp

Filesize
3.9MB

Download
memory/116-2560-0x00007FF7B11C0000-0x00007FF7B15B1000-memory.dmp

Filesize
3.9MB

Download
memory/520-2071-0x00007FF67A790000-0x00007FF67AB81000-memory.dmp

Filesize
3.9MB

Download
memory/520-1-0x0000021943C40000-0x0000021943C50000-memory.dmp

Filesize
64KB

Download
memory/520-0-0x00007FF67A790000-0x00007FF67AB81000-memory.dmp

Filesize
3.9MB

Download
memory/520-45-0x00007FF67A790000-0x00007FF67AB81000-memory.dmp

Filesize
3.9MB

Download
memory/520-1105-0x00007FF67A790000-0x00007FF67AB81000-memory.dmp

Filesize
3.9MB

Download
memory/708-2529-0x00007FF7567D0000-0x00007FF756BC1000-memory.dmp

Filesize
3.9MB

Download
memory/708-46-0x00007FF7567D0000-0x00007FF756BC1000-memory.dmp

Filesize
3.9MB

Download
memory/1216-37-0x00007FF73D150000-0x00007FF73D541000-memory.dmp

Filesize
3.9MB

Download
memory/1216-2519-0x00007FF73D150000-0x00007FF73D541000-memory.dmp

Filesize
3.9MB

Download
memory/1236-2565-0x00007FF6CC130000-0x00007FF6CC521000-memory.dmp

Filesize
3.9MB

Download
memory/1236-29-0x00007FF6CC130000-0x00007FF6CC521000-memory.dmp

Filesize
3.9MB

Download
memory/1388-2586-0x00007FF634620000-0x00007FF634A11000-memory.dmp

Filesize
3.9MB

Download
memory/1388-80-0x00007FF634620000-0x00007FF634A11000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2578-0x00007FF6E2ED0000-0x00007FF6E32C1000-memory.dmp

Filesize
3.9MB

Download
memory/2012-72-0x00007FF6E2ED0000-0x00007FF6E32C1000-memory.dmp

Filesize
3.9MB

Download
memory/2036-64-0x00007FF731440000-0x00007FF731831000-memory.dmp

Filesize
3.9MB

Download
memory/2036-2574-0x00007FF731440000-0x00007FF731831000-memory.dmp

Filesize
3.9MB

Download
memory/2296-33-0x00007FF6FE140000-0x00007FF6FE531000-memory.dmp

Filesize
3.9MB

Download
memory/2296-2747-0x00007FF6FE140000-0x00007FF6FE531000-memory.dmp

Filesize
3.9MB

Download
memory/2732-17-0x00007FF7DFD10000-0x00007FF7E0101000-memory.dmp

Filesize
3.9MB

Download
memory/2732-2452-0x00007FF7DFD10000-0x00007FF7E0101000-memory.dmp

Filesize
3.9MB

Download
memory/2832-96-0x00007FF6165A0000-0x00007FF616991000-memory.dmp

Filesize
3.9MB

Download
memory/2832-2485-0x00007FF6165A0000-0x00007FF616991000-memory.dmp

Filesize
3.9MB

Download
memory/3160-6-0x00007FF7C4F60000-0x00007FF7C5351000-memory.dmp

Filesize
3.9MB

Download
memory/3160-50-0x00007FF7C4F60000-0x00007FF7C5351000-memory.dmp

Filesize
3.9MB

Download
memory/3160-2115-0x00007FF7C4F60000-0x00007FF7C5351000-memory.dmp

Filesize
3.9MB

Download
memory/3444-76-0x00007FF76CE10000-0x00007FF76D201000-memory.dmp

Filesize
3.9MB

Download
memory/3444-2582-0x00007FF76CE10000-0x00007FF76D201000-memory.dmp

Filesize
3.9MB

Download
memory/3456-2589-0x00007FF63CF10000-0x00007FF63D301000-memory.dmp

Filesize
3.9MB

Download
memory/3456-100-0x00007FF63CF10000-0x00007FF63D301000-memory.dmp

Filesize
3.9MB

Download
memory/3456-2069-0x00007FF63CF10000-0x00007FF63D301000-memory.dmp

Filesize
3.9MB

Download
memory/3536-51-0x00007FF631320000-0x00007FF631711000-memory.dmp

Filesize
3.9MB

Download
memory/3536-2692-0x00007FF631320000-0x00007FF631711000-memory.dmp

Filesize
3.9MB

Download
memory/4128-2576-0x00007FF7484E0000-0x00007FF7488D1000-memory.dmp

Filesize
3.9MB

Download
memory/4128-60-0x00007FF7484E0000-0x00007FF7488D1000-memory.dmp

Filesize
3.9MB

Download
memory/4248-2073-0x00007FF7C2330000-0x00007FF7C2721000-memory.dmp

Filesize
3.9MB

Download
memory/4248-104-0x00007FF7C2330000-0x00007FF7C2721000-memory.dmp

Filesize
3.9MB

Download
memory/4248-2517-0x00007FF7C2330000-0x00007FF7C2721000-memory.dmp

Filesize
3.9MB

Download
memory/4360-1763-0x00007FF79F320000-0x00007FF79F711000-memory.dmp

Filesize
3.9MB

Download
memory/4360-2674-0x00007FF79F320000-0x00007FF79F711000-memory.dmp

Filesize
3.9MB

Download
memory/4360-88-0x00007FF79F320000-0x00007FF79F711000-memory.dmp

Filesize
3.9MB

Download
memory/4504-2584-0x00007FF656D60000-0x00007FF657151000-memory.dmp

Filesize
3.9MB

Download
memory/4504-68-0x00007FF656D60000-0x00007FF657151000-memory.dmp

Filesize
3.9MB

Download
memory/4548-2580-0x00007FF624BA0000-0x00007FF624F91000-memory.dmp

Filesize
3.9MB

Download
memory/4548-84-0x00007FF624BA0000-0x00007FF624F91000-memory.dmp

Filesize
3.9MB

Download
memory/4548-1673-0x00007FF624BA0000-0x00007FF624F91000-memory.dmp

Filesize
3.9MB

Download
memory/4700-41-0x00007FF6B58D0000-0x00007FF6B5CC1000-memory.dmp

Filesize
3.9MB

Download
memory/4700-2527-0x00007FF6B58D0000-0x00007FF6B5CC1000-memory.dmp

Filesize
3.9MB

Download
memory/4816-2154-0x00007FF616330000-0x00007FF616721000-memory.dmp

Filesize
3.9MB

Download
memory/4816-1108-0x00007FF616330000-0x00007FF616721000-memory.dmp

Filesize
3.9MB

Download
memory/4816-12-0x00007FF616330000-0x00007FF616721000-memory.dmp

Filesize
3.9MB

Download
memory/4816-55-0x00007FF616330000-0x00007FF616721000-memory.dmp

Filesize
3.9MB

Download
memory/4904-2563-0x00007FF7B6330000-0x00007FF7B6721000-memory.dmp

Filesize
3.9MB

Download
memory/4904-25-0x00007FF7B6330000-0x00007FF7B6721000-memory.dmp

Filesize
3.9MB

Download
memory/5036-1878-0x00007FF60D6D0000-0x00007FF60DAC1000-memory.dmp

Filesize
3.9MB

Download
memory/5036-2676-0x00007FF60D6D0000-0x00007FF60DAC1000-memory.dmp

Filesize
3.9MB

Download
memory/5036-92-0x00007FF60D6D0000-0x00007FF60DAC1000-memory.dmp

Filesize
3.9MB

Download
memory/5112-2572-0x00007FF6E9D10000-0x00007FF6EA101000-memory.dmp

Filesize
3.9MB

Download
memory/5112-57-0x00007FF6E9D10000-0x00007FF6EA101000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads