xmrig | 0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
Size

1.7MB
MD5

0d30998c11e675e5daa3c29743a46149
SHA1

6a8f253e0dc3113045f15fb8cb8a98962e1da9a6
SHA256

0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239
SHA512

66e849892487c17cc73fb344d0f56b5d7126dede6f8f160f554ea202621c4f094c9898cd9110e9c9df6a890e4498f4eb24564c5bbfa61a1ff725467be3ce7e63
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxeqwMal9:GemTLkNdfE0pZyG

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b17-3.dat	xmrig
behavioral2/files/0x000a000000023b7b-8.dat	xmrig
behavioral2/files/0x000a000000023b7a-9.dat	xmrig
behavioral2/files/0x000a000000023b7c-19.dat	xmrig
behavioral2/files/0x000a000000023b7e-37.dat	xmrig
behavioral2/files/0x000a000000023b81-47.dat	xmrig
behavioral2/files/0x000a000000023b84-58.dat	xmrig
behavioral2/files/0x000a000000023b8d-103.dat	xmrig
behavioral2/files/0x000a000000023b8e-114.dat	xmrig
behavioral2/files/0x000e000000023ba3-146.dat	xmrig
behavioral2/files/0x0009000000023bb2-161.dat	xmrig
behavioral2/files/0x0008000000023bac-159.dat	xmrig
behavioral2/files/0x0009000000023bb1-156.dat	xmrig
behavioral2/files/0x000a000000023b9c-149.dat	xmrig
behavioral2/files/0x000b000000023b94-144.dat	xmrig
behavioral2/files/0x000b000000023b93-139.dat	xmrig
behavioral2/files/0x000b000000023b92-134.dat	xmrig
behavioral2/files/0x000a000000023b91-129.dat	xmrig
behavioral2/files/0x000a000000023b90-124.dat	xmrig
behavioral2/files/0x000a000000023b8f-119.dat	xmrig
behavioral2/files/0x000a000000023b8c-101.dat	xmrig
behavioral2/files/0x000a000000023b8b-97.dat	xmrig
behavioral2/files/0x000a000000023b8a-91.dat	xmrig
behavioral2/files/0x000a000000023b89-87.dat	xmrig
behavioral2/files/0x000a000000023b88-82.dat	xmrig
behavioral2/files/0x000a000000023b87-77.dat	xmrig
behavioral2/files/0x000a000000023b86-72.dat	xmrig
behavioral2/files/0x000a000000023b85-67.dat	xmrig
behavioral2/files/0x000a000000023b83-56.dat	xmrig
behavioral2/files/0x000a000000023b82-52.dat	xmrig
behavioral2/files/0x000a000000023b80-42.dat	xmrig
behavioral2/files/0x000a000000023b7f-32.dat	xmrig
behavioral2/files/0x000a000000023b7d-27.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2388	yhbOajm.exe
2784	muMfCcI.exe
5080	eJmgniw.exe
1488	jRurgqe.exe
3400	vldPELO.exe
3108	AfwEiFr.exe
5044	byIPWhQ.exe
4356	kUJnNBm.exe
1768	dRWJatB.exe
4276	MLhjbpS.exe
4516	YqRVyhG.exe
900	NkVRuDT.exe
4180	olmoiEy.exe
1376	TeeAsfp.exe
536	HhodqZD.exe
2872	UoaBRTu.exe
4156	ylgsHYV.exe
4064	JrhDfFp.exe
4236	wtKVBeL.exe
5076	UYsyhZj.exe
2036	eBiYvHw.exe
4648	luTiOgH.exe
3620	YOMjshD.exe
4996	GzfnAxi.exe
4492	iycORAl.exe
2512	dibClQl.exe
2592	wjHbCvl.exe
1368	YOefdcS.exe
1256	xVWWgPy.exe
1912	UsUSdCv.exe
4632	sqneZJw.exe
3352	oZBnCIT.exe
1552	dXdmeuu.exe
5004	zcvkKxY.exe
372	APaGYmS.exe
1756	JjUmnXJ.exe
2104	KoZFimN.exe
4440	XYSCsdH.exe
3428	lyEnLbf.exe
4388	cqkpdNS.exe
1360	HhPdACf.exe
1604	HPiCqKZ.exe
4188	aZETYus.exe
4184	pPSziSF.exe
1396	aiEeITI.exe
2528	MrJUPPD.exe
4308	zJdvWTz.exe
2480	vcEALIP.exe
2248	mkEFMsK.exe
1984	UnwbDzx.exe
428	ltHTXdh.exe
1896	TMMTnhf.exe
844	eyeesJq.exe
856	IgaNKGH.exe
2180	AGyaffz.exe
4604	cHVUnrC.exe
4840	gARQTaa.exe
1344	ZXTJqKT.exe
3320	nZAFfZR.exe
3584	UjbCtNH.exe
3300	ZTUGVcU.exe
2516	DUhNvNO.exe
2840	xjpFfVQ.exe
4500	kELGzsj.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\enLGQvx.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\VqRaklr.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\UPruHWU.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\JrhDfFp.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\ETtzVop.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\VVkdemf.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\PdcVQQr.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\jUnDyCY.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\BPMJRoW.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\WTJrStc.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\uhpdDdv.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\fmIZptk.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\ZAfwABE.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\mEkdTFs.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\dayjVEY.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\iJUYsdK.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\MxDMjUj.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\oVdIboT.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\GIJmgUv.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\gARQTaa.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\fRAngpm.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\olmoiEy.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\nzGVKvU.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\MnTdbcb.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\LvlAVln.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\XttQpLi.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\jnwTBhT.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\VLWTlbO.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\uBuCuzn.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\hHEphLx.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\XBVXDLt.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\FbENpfc.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\Hqihipt.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\ezaqVBn.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\DrClYAc.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\oqGZwuF.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\zwgYSZz.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\vyMoNhq.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\vjiuuvz.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\fQvLBXO.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\CDzQWjM.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\wLayaEv.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\AuoJRea.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\OBLNIll.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\dgkxZQZ.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\HUnpGuP.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\cMcEhDD.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\SlglrUn.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\iBbOPfy.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\KEJZbhE.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\AiDrhXK.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\nQpdhuG.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\rhAgZQK.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\TqkDaqt.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\DjRBmah.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\IOpCinF.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\PDPKRcQ.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\vcEALIP.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\xJDoaHB.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\NRZWdgm.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\GCTzWjO.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\sWzFVQN.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\RVUKsFn.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
File created	C:\Windows\System\qBuKLMC.exe	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16532	dwm.exe
Token: SeChangeNotifyPrivilege	16532	dwm.exe
Token: 33	16532	dwm.exe
Token: SeIncBasePriorityPrivilege	16532	dwm.exe
Token: SeShutdownPrivilege	16532	dwm.exe
Token: SeCreatePagefilePrivilege	16532	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2388	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	84
PID 2112 wrote to memory of 2388	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	84
PID 2112 wrote to memory of 2784	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	85
PID 2112 wrote to memory of 2784	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	85
PID 2112 wrote to memory of 5080	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	86
PID 2112 wrote to memory of 5080	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	86
PID 2112 wrote to memory of 1488	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	87
PID 2112 wrote to memory of 1488	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	87
PID 2112 wrote to memory of 3400	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	88
PID 2112 wrote to memory of 3400	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	88
PID 2112 wrote to memory of 3108	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	89
PID 2112 wrote to memory of 3108	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	89
PID 2112 wrote to memory of 5044	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	90
PID 2112 wrote to memory of 5044	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	90
PID 2112 wrote to memory of 4356	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	91
PID 2112 wrote to memory of 4356	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	91
PID 2112 wrote to memory of 1768	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	92
PID 2112 wrote to memory of 1768	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	92
PID 2112 wrote to memory of 4276	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	93
PID 2112 wrote to memory of 4276	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	93
PID 2112 wrote to memory of 4516	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	94
PID 2112 wrote to memory of 4516	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	94
PID 2112 wrote to memory of 900	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	95
PID 2112 wrote to memory of 900	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	95
PID 2112 wrote to memory of 4180	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	96
PID 2112 wrote to memory of 4180	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	96
PID 2112 wrote to memory of 1376	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	97
PID 2112 wrote to memory of 1376	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	97
PID 2112 wrote to memory of 536	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	98
PID 2112 wrote to memory of 536	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	98
PID 2112 wrote to memory of 2872	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	99
PID 2112 wrote to memory of 2872	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	99
PID 2112 wrote to memory of 4156	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	100
PID 2112 wrote to memory of 4156	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	100
PID 2112 wrote to memory of 4064	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	101
PID 2112 wrote to memory of 4064	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	101
PID 2112 wrote to memory of 4236	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	102
PID 2112 wrote to memory of 4236	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	102
PID 2112 wrote to memory of 5076	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	103
PID 2112 wrote to memory of 5076	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	103
PID 2112 wrote to memory of 2036	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	104
PID 2112 wrote to memory of 2036	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	104
PID 2112 wrote to memory of 4648	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	105
PID 2112 wrote to memory of 4648	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	105
PID 2112 wrote to memory of 3620	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	106
PID 2112 wrote to memory of 3620	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	106
PID 2112 wrote to memory of 4996	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	107
PID 2112 wrote to memory of 4996	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	107
PID 2112 wrote to memory of 4492	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	108
PID 2112 wrote to memory of 4492	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	108
PID 2112 wrote to memory of 2512	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	109
PID 2112 wrote to memory of 2512	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	109
PID 2112 wrote to memory of 2592	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	110
PID 2112 wrote to memory of 2592	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	110
PID 2112 wrote to memory of 1368	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	111
PID 2112 wrote to memory of 1368	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	111
PID 2112 wrote to memory of 1256	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	112
PID 2112 wrote to memory of 1256	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	112
PID 2112 wrote to memory of 1912	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	113
PID 2112 wrote to memory of 1912	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	113
PID 2112 wrote to memory of 4632	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	114
PID 2112 wrote to memory of 4632	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	114
PID 2112 wrote to memory of 3352	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	115
PID 2112 wrote to memory of 3352	2112	0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe	115

C:\Users\Admin\AppData\Local\Temp\0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe
"C:\Users\Admin\AppData\Local\Temp\0cd3348498d6d098d770aa3e637a49b32b8fcbaf3f5d49229852592492d9f239.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System\yhbOajm.exe
  C:\Windows\System\yhbOajm.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\muMfCcI.exe
  C:\Windows\System\muMfCcI.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\eJmgniw.exe
  C:\Windows\System\eJmgniw.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\jRurgqe.exe
  C:\Windows\System\jRurgqe.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\vldPELO.exe
  C:\Windows\System\vldPELO.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\AfwEiFr.exe
  C:\Windows\System\AfwEiFr.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\byIPWhQ.exe
  C:\Windows\System\byIPWhQ.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\kUJnNBm.exe
  C:\Windows\System\kUJnNBm.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\dRWJatB.exe
  C:\Windows\System\dRWJatB.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\MLhjbpS.exe
  C:\Windows\System\MLhjbpS.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\YqRVyhG.exe
  C:\Windows\System\YqRVyhG.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\NkVRuDT.exe
  C:\Windows\System\NkVRuDT.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\olmoiEy.exe
  C:\Windows\System\olmoiEy.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\TeeAsfp.exe
  C:\Windows\System\TeeAsfp.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\HhodqZD.exe
  C:\Windows\System\HhodqZD.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\UoaBRTu.exe
  C:\Windows\System\UoaBRTu.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ylgsHYV.exe
  C:\Windows\System\ylgsHYV.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\JrhDfFp.exe
  C:\Windows\System\JrhDfFp.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\wtKVBeL.exe
  C:\Windows\System\wtKVBeL.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\UYsyhZj.exe
  C:\Windows\System\UYsyhZj.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\eBiYvHw.exe
  C:\Windows\System\eBiYvHw.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\luTiOgH.exe
  C:\Windows\System\luTiOgH.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\YOMjshD.exe
  C:\Windows\System\YOMjshD.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\GzfnAxi.exe
  C:\Windows\System\GzfnAxi.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\iycORAl.exe
  C:\Windows\System\iycORAl.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\dibClQl.exe
  C:\Windows\System\dibClQl.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\wjHbCvl.exe
  C:\Windows\System\wjHbCvl.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\YOefdcS.exe
  C:\Windows\System\YOefdcS.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\xVWWgPy.exe
  C:\Windows\System\xVWWgPy.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\UsUSdCv.exe
  C:\Windows\System\UsUSdCv.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\sqneZJw.exe
  C:\Windows\System\sqneZJw.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\oZBnCIT.exe
  C:\Windows\System\oZBnCIT.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\dXdmeuu.exe
  C:\Windows\System\dXdmeuu.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\zcvkKxY.exe
  C:\Windows\System\zcvkKxY.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\APaGYmS.exe
  C:\Windows\System\APaGYmS.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\JjUmnXJ.exe
  C:\Windows\System\JjUmnXJ.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\KoZFimN.exe
  C:\Windows\System\KoZFimN.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\XYSCsdH.exe
  C:\Windows\System\XYSCsdH.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\lyEnLbf.exe
  C:\Windows\System\lyEnLbf.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\cqkpdNS.exe
  C:\Windows\System\cqkpdNS.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\HhPdACf.exe
  C:\Windows\System\HhPdACf.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\HPiCqKZ.exe
  C:\Windows\System\HPiCqKZ.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\aZETYus.exe
  C:\Windows\System\aZETYus.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\pPSziSF.exe
  C:\Windows\System\pPSziSF.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\aiEeITI.exe
  C:\Windows\System\aiEeITI.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\MrJUPPD.exe
  C:\Windows\System\MrJUPPD.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\zJdvWTz.exe
  C:\Windows\System\zJdvWTz.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\vcEALIP.exe
  C:\Windows\System\vcEALIP.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\mkEFMsK.exe
  C:\Windows\System\mkEFMsK.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\UnwbDzx.exe
  C:\Windows\System\UnwbDzx.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ltHTXdh.exe
  C:\Windows\System\ltHTXdh.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\TMMTnhf.exe
  C:\Windows\System\TMMTnhf.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\eyeesJq.exe
  C:\Windows\System\eyeesJq.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\IgaNKGH.exe
  C:\Windows\System\IgaNKGH.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\AGyaffz.exe
  C:\Windows\System\AGyaffz.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\cHVUnrC.exe
  C:\Windows\System\cHVUnrC.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\gARQTaa.exe
  C:\Windows\System\gARQTaa.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\ZXTJqKT.exe
  C:\Windows\System\ZXTJqKT.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\nZAFfZR.exe
  C:\Windows\System\nZAFfZR.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\UjbCtNH.exe
  C:\Windows\System\UjbCtNH.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\ZTUGVcU.exe
  C:\Windows\System\ZTUGVcU.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\DUhNvNO.exe
  C:\Windows\System\DUhNvNO.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\xjpFfVQ.exe
  C:\Windows\System\xjpFfVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\kELGzsj.exe
  C:\Windows\System\kELGzsj.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\CETjvMg.exe
  C:\Windows\System\CETjvMg.exe
  2⤵
  PID:3028
- C:\Windows\System\xyMUWNc.exe
  C:\Windows\System\xyMUWNc.exe
  2⤵
  PID:3724
- C:\Windows\System\vtPkheQ.exe
  C:\Windows\System\vtPkheQ.exe
  2⤵
  PID:3668
- C:\Windows\System\WwdsoAl.exe
  C:\Windows\System\WwdsoAl.exe
  2⤵
  PID:3032
- C:\Windows\System\MxDMjUj.exe
  C:\Windows\System\MxDMjUj.exe
  2⤵
  PID:4728
- C:\Windows\System\cZfuXpK.exe
  C:\Windows\System\cZfuXpK.exe
  2⤵
  PID:836
- C:\Windows\System\hlHMowI.exe
  C:\Windows\System\hlHMowI.exe
  2⤵
  PID:5048
- C:\Windows\System\YlSsDXg.exe
  C:\Windows\System\YlSsDXg.exe
  2⤵
  PID:1148
- C:\Windows\System\BVkJEvj.exe
  C:\Windows\System\BVkJEvj.exe
  2⤵
  PID:860
- C:\Windows\System\cUyZOXG.exe
  C:\Windows\System\cUyZOXG.exe
  2⤵
  PID:4712
- C:\Windows\System\hsXWKVB.exe
  C:\Windows\System\hsXWKVB.exe
  2⤵
  PID:4636
- C:\Windows\System\DtpOOgo.exe
  C:\Windows\System\DtpOOgo.exe
  2⤵
  PID:3080
- C:\Windows\System\lmIuqTT.exe
  C:\Windows\System\lmIuqTT.exe
  2⤵
  PID:4860
- C:\Windows\System\qjRAgAE.exe
  C:\Windows\System\qjRAgAE.exe
  2⤵
  PID:4888
- C:\Windows\System\wDPCuqa.exe
  C:\Windows\System\wDPCuqa.exe
  2⤵
  PID:4716
- C:\Windows\System\vlVeaxq.exe
  C:\Windows\System\vlVeaxq.exe
  2⤵
  PID:4068
- C:\Windows\System\mMgJCmi.exe
  C:\Windows\System\mMgJCmi.exe
  2⤵
  PID:956
- C:\Windows\System\bbXXonP.exe
  C:\Windows\System\bbXXonP.exe
  2⤵
  PID:4320
- C:\Windows\System\mTnCayF.exe
  C:\Windows\System\mTnCayF.exe
  2⤵
  PID:1632
- C:\Windows\System\kdVEpyT.exe
  C:\Windows\System\kdVEpyT.exe
  2⤵
  PID:2292
- C:\Windows\System\kUSXCwq.exe
  C:\Windows\System\kUSXCwq.exe
  2⤵
  PID:936
- C:\Windows\System\hPSPJdY.exe
  C:\Windows\System\hPSPJdY.exe
  2⤵
  PID:2880
- C:\Windows\System\vyMoNhq.exe
  C:\Windows\System\vyMoNhq.exe
  2⤵
  PID:1540
- C:\Windows\System\UxaTiUp.exe
  C:\Windows\System\UxaTiUp.exe
  2⤵
  PID:424
- C:\Windows\System\HnsmSfI.exe
  C:\Windows\System\HnsmSfI.exe
  2⤵
  PID:5132
- C:\Windows\System\dIwNSII.exe
  C:\Windows\System\dIwNSII.exe
  2⤵
  PID:5160
- C:\Windows\System\ALoOQkr.exe
  C:\Windows\System\ALoOQkr.exe
  2⤵
  PID:5188
- C:\Windows\System\LUwZgjm.exe
  C:\Windows\System\LUwZgjm.exe
  2⤵
  PID:5212
- C:\Windows\System\ofWPxLU.exe
  C:\Windows\System\ofWPxLU.exe
  2⤵
  PID:5240
- C:\Windows\System\YaoZJvy.exe
  C:\Windows\System\YaoZJvy.exe
  2⤵
  PID:5272
- C:\Windows\System\FXueQLG.exe
  C:\Windows\System\FXueQLG.exe
  2⤵
  PID:5296
- C:\Windows\System\JySXDLr.exe
  C:\Windows\System\JySXDLr.exe
  2⤵
  PID:5324
- C:\Windows\System\jnwTBhT.exe
  C:\Windows\System\jnwTBhT.exe
  2⤵
  PID:5352
- C:\Windows\System\dTjDCGR.exe
  C:\Windows\System\dTjDCGR.exe
  2⤵
  PID:5384
- C:\Windows\System\UuOfaOm.exe
  C:\Windows\System\UuOfaOm.exe
  2⤵
  PID:5412
- C:\Windows\System\FEtQedc.exe
  C:\Windows\System\FEtQedc.exe
  2⤵
  PID:5440
- C:\Windows\System\IcRMzhh.exe
  C:\Windows\System\IcRMzhh.exe
  2⤵
  PID:5468
- C:\Windows\System\hArJnku.exe
  C:\Windows\System\hArJnku.exe
  2⤵
  PID:5492
- C:\Windows\System\QRouNrF.exe
  C:\Windows\System\QRouNrF.exe
  2⤵
  PID:5520
- C:\Windows\System\fevPWaI.exe
  C:\Windows\System\fevPWaI.exe
  2⤵
  PID:5548
- C:\Windows\System\jMCPudf.exe
  C:\Windows\System\jMCPudf.exe
  2⤵
  PID:5612
- C:\Windows\System\YdhzHeg.exe
  C:\Windows\System\YdhzHeg.exe
  2⤵
  PID:5628
- C:\Windows\System\xJvwmuK.exe
  C:\Windows\System\xJvwmuK.exe
  2⤵
  PID:5644
- C:\Windows\System\TsjLHcL.exe
  C:\Windows\System\TsjLHcL.exe
  2⤵
  PID:5668
- C:\Windows\System\BGFRMWy.exe
  C:\Windows\System\BGFRMWy.exe
  2⤵
  PID:5688
- C:\Windows\System\TMNeQor.exe
  C:\Windows\System\TMNeQor.exe
  2⤵
  PID:5716
- C:\Windows\System\hFjdRnK.exe
  C:\Windows\System\hFjdRnK.exe
  2⤵
  PID:5744
- C:\Windows\System\yqYACcZ.exe
  C:\Windows\System\yqYACcZ.exe
  2⤵
  PID:5768
- C:\Windows\System\IhjVeZO.exe
  C:\Windows\System\IhjVeZO.exe
  2⤵
  PID:5796
- C:\Windows\System\VuzxsVz.exe
  C:\Windows\System\VuzxsVz.exe
  2⤵
  PID:5828
- C:\Windows\System\GWwhcMQ.exe
  C:\Windows\System\GWwhcMQ.exe
  2⤵
  PID:5856
- C:\Windows\System\VnnyOJb.exe
  C:\Windows\System\VnnyOJb.exe
  2⤵
  PID:5884
- C:\Windows\System\VSskBgv.exe
  C:\Windows\System\VSskBgv.exe
  2⤵
  PID:5912
- C:\Windows\System\ybTGUBh.exe
  C:\Windows\System\ybTGUBh.exe
  2⤵
  PID:5940
- C:\Windows\System\rebdhsg.exe
  C:\Windows\System\rebdhsg.exe
  2⤵
  PID:5968
- C:\Windows\System\ibcyFdp.exe
  C:\Windows\System\ibcyFdp.exe
  2⤵
  PID:5996
- C:\Windows\System\cUBaVOS.exe
  C:\Windows\System\cUBaVOS.exe
  2⤵
  PID:6020
- C:\Windows\System\CKyOlEk.exe
  C:\Windows\System\CKyOlEk.exe
  2⤵
  PID:6052
- C:\Windows\System\NyvmncR.exe
  C:\Windows\System\NyvmncR.exe
  2⤵
  PID:6080
- C:\Windows\System\mJhuyxh.exe
  C:\Windows\System\mJhuyxh.exe
  2⤵
  PID:6104
- C:\Windows\System\vLUgGEW.exe
  C:\Windows\System\vLUgGEW.exe
  2⤵
  PID:6132
- C:\Windows\System\yOSzgQj.exe
  C:\Windows\System\yOSzgQj.exe
  2⤵
  PID:1068
- C:\Windows\System\PHqKNqW.exe
  C:\Windows\System\PHqKNqW.exe
  2⤵
  PID:4232
- C:\Windows\System\uqFhuAe.exe
  C:\Windows\System\uqFhuAe.exe
  2⤵
  PID:1876
- C:\Windows\System\eiZxNSF.exe
  C:\Windows\System\eiZxNSF.exe
  2⤵
  PID:2760
- C:\Windows\System\jzXQOqF.exe
  C:\Windows\System\jzXQOqF.exe
  2⤵
  PID:4844
- C:\Windows\System\yqTCDiE.exe
  C:\Windows\System\yqTCDiE.exe
  2⤵
  PID:5072
- C:\Windows\System\IvtOZNU.exe
  C:\Windows\System\IvtOZNU.exe
  2⤵
  PID:5224
- C:\Windows\System\cmAfmVK.exe
  C:\Windows\System\cmAfmVK.exe
  2⤵
  PID:5288
- C:\Windows\System\QGmxpfP.exe
  C:\Windows\System\QGmxpfP.exe
  2⤵
  PID:1336
- C:\Windows\System\MnTdbcb.exe
  C:\Windows\System\MnTdbcb.exe
  2⤵
  PID:5400
- C:\Windows\System\ysVnokT.exe
  C:\Windows\System\ysVnokT.exe
  2⤵
  PID:5460
- C:\Windows\System\Rsjlznl.exe
  C:\Windows\System\Rsjlznl.exe
  2⤵
  PID:5512
- C:\Windows\System\KyvBYqw.exe
  C:\Windows\System\KyvBYqw.exe
  2⤵
  PID:5580
- C:\Windows\System\VcoHafF.exe
  C:\Windows\System\VcoHafF.exe
  2⤵
  PID:5636
- C:\Windows\System\cZGkVPL.exe
  C:\Windows\System\cZGkVPL.exe
  2⤵
  PID:5684
- C:\Windows\System\TFFCCtB.exe
  C:\Windows\System\TFFCCtB.exe
  2⤵
  PID:5756
- C:\Windows\System\MQBQDdK.exe
  C:\Windows\System\MQBQDdK.exe
  2⤵
  PID:5816
- C:\Windows\System\wkvksKt.exe
  C:\Windows\System\wkvksKt.exe
  2⤵
  PID:5876
- C:\Windows\System\EQbFbIK.exe
  C:\Windows\System\EQbFbIK.exe
  2⤵
  PID:5956
- C:\Windows\System\aOSCfdZ.exe
  C:\Windows\System\aOSCfdZ.exe
  2⤵
  PID:6012
- C:\Windows\System\PFFvmtx.exe
  C:\Windows\System\PFFvmtx.exe
  2⤵
  PID:6072
- C:\Windows\System\djAOTBl.exe
  C:\Windows\System\djAOTBl.exe
  2⤵
  PID:6124
- C:\Windows\System\oZzLvhu.exe
  C:\Windows\System\oZzLvhu.exe
  2⤵
  PID:3492
- C:\Windows\System\lUBpVpN.exe
  C:\Windows\System\lUBpVpN.exe
  2⤵
  PID:1844
- C:\Windows\System\toieCbx.exe
  C:\Windows\System\toieCbx.exe
  2⤵
  PID:5148
- C:\Windows\System\LuiucTB.exe
  C:\Windows\System\LuiucTB.exe
  2⤵
  PID:5256
- C:\Windows\System\xkUTQKq.exe
  C:\Windows\System\xkUTQKq.exe
  2⤵
  PID:5364
- C:\Windows\System\ETtzVop.exe
  C:\Windows\System\ETtzVop.exe
  2⤵
  PID:5504
- C:\Windows\System\brkuSwY.exe
  C:\Windows\System\brkuSwY.exe
  2⤵
  PID:5624
- C:\Windows\System\UIpOONZ.exe
  C:\Windows\System\UIpOONZ.exe
  2⤵
  PID:5680
- C:\Windows\System\ZSqLeDy.exe
  C:\Windows\System\ZSqLeDy.exe
  2⤵
  PID:5792
- C:\Windows\System\hWmLqmz.exe
  C:\Windows\System\hWmLqmz.exe
  2⤵
  PID:3052
- C:\Windows\System\zUuunCI.exe
  C:\Windows\System\zUuunCI.exe
  2⤵
  PID:4428
- C:\Windows\System\BxWswfL.exe
  C:\Windows\System\BxWswfL.exe
  2⤵
  PID:2700
- C:\Windows\System\vNulIpk.exe
  C:\Windows\System\vNulIpk.exe
  2⤵
  PID:1920
- C:\Windows\System\lEoqPLQ.exe
  C:\Windows\System\lEoqPLQ.exe
  2⤵
  PID:2332
- C:\Windows\System\CPKcqOm.exe
  C:\Windows\System\CPKcqOm.exe
  2⤵
  PID:3972
- C:\Windows\System\SGGbsKm.exe
  C:\Windows\System\SGGbsKm.exe
  2⤵
  PID:952
- C:\Windows\System\ukUmasC.exe
  C:\Windows\System\ukUmasC.exe
  2⤵
  PID:388
- C:\Windows\System\giczksD.exe
  C:\Windows\System\giczksD.exe
  2⤵
  PID:4764
- C:\Windows\System\LvlAVln.exe
  C:\Windows\System\LvlAVln.exe
  2⤵
  PID:1572
- C:\Windows\System\yINmWYh.exe
  C:\Windows\System\yINmWYh.exe
  2⤵
  PID:712
- C:\Windows\System\lfuIsAY.exe
  C:\Windows\System\lfuIsAY.exe
  2⤵
  PID:1784
- C:\Windows\System\vnWKDRa.exe
  C:\Windows\System\vnWKDRa.exe
  2⤵
  PID:4872
- C:\Windows\System\ToDTryQ.exe
  C:\Windows\System\ToDTryQ.exe
  2⤵
  PID:1788
- C:\Windows\System\JNtfIjI.exe
  C:\Windows\System\JNtfIjI.exe
  2⤵
  PID:940
- C:\Windows\System\wtsfKII.exe
  C:\Windows\System\wtsfKII.exe
  2⤵
  PID:1348
- C:\Windows\System\PbCiUgY.exe
  C:\Windows\System\PbCiUgY.exe
  2⤵
  PID:5560
- C:\Windows\System\GJahEnf.exe
  C:\Windows\System\GJahEnf.exe
  2⤵
  PID:4536
- C:\Windows\System\EcdYvyD.exe
  C:\Windows\System\EcdYvyD.exe
  2⤵
  PID:3112
- C:\Windows\System\YywHFYB.exe
  C:\Windows\System\YywHFYB.exe
  2⤵
  PID:1076
- C:\Windows\System\CtnbzbF.exe
  C:\Windows\System\CtnbzbF.exe
  2⤵
  PID:2876
- C:\Windows\System\AuoJRea.exe
  C:\Windows\System\AuoJRea.exe
  2⤵
  PID:6068
- C:\Windows\System\wBgetnY.exe
  C:\Windows\System\wBgetnY.exe
  2⤵
  PID:6148
- C:\Windows\System\wdYdvKG.exe
  C:\Windows\System\wdYdvKG.exe
  2⤵
  PID:6168
- C:\Windows\System\PHYJCil.exe
  C:\Windows\System\PHYJCil.exe
  2⤵
  PID:6204
- C:\Windows\System\oqGZwuF.exe
  C:\Windows\System\oqGZwuF.exe
  2⤵
  PID:6232
- C:\Windows\System\fxtqlXN.exe
  C:\Windows\System\fxtqlXN.exe
  2⤵
  PID:6272
- C:\Windows\System\uVuOEXS.exe
  C:\Windows\System\uVuOEXS.exe
  2⤵
  PID:6300
- C:\Windows\System\lgSFGUl.exe
  C:\Windows\System\lgSFGUl.exe
  2⤵
  PID:6328
- C:\Windows\System\pjwHfie.exe
  C:\Windows\System\pjwHfie.exe
  2⤵
  PID:6344
- C:\Windows\System\dYFCTHa.exe
  C:\Windows\System\dYFCTHa.exe
  2⤵
  PID:6372
- C:\Windows\System\tPMeRiB.exe
  C:\Windows\System\tPMeRiB.exe
  2⤵
  PID:6412
- C:\Windows\System\DtHlrTG.exe
  C:\Windows\System\DtHlrTG.exe
  2⤵
  PID:6436
- C:\Windows\System\CUAqTcS.exe
  C:\Windows\System\CUAqTcS.exe
  2⤵
  PID:6468
- C:\Windows\System\eetgdwi.exe
  C:\Windows\System\eetgdwi.exe
  2⤵
  PID:6492
- C:\Windows\System\pNbupIN.exe
  C:\Windows\System\pNbupIN.exe
  2⤵
  PID:6516
- C:\Windows\System\iQXwOHU.exe
  C:\Windows\System\iQXwOHU.exe
  2⤵
  PID:6536
- C:\Windows\System\GWmCvXg.exe
  C:\Windows\System\GWmCvXg.exe
  2⤵
  PID:6564
- C:\Windows\System\oJPSFmB.exe
  C:\Windows\System\oJPSFmB.exe
  2⤵
  PID:6604
- C:\Windows\System\eZeRdeS.exe
  C:\Windows\System\eZeRdeS.exe
  2⤵
  PID:6636
- C:\Windows\System\pVsFuRq.exe
  C:\Windows\System\pVsFuRq.exe
  2⤵
  PID:6664
- C:\Windows\System\AnvdaPZ.exe
  C:\Windows\System\AnvdaPZ.exe
  2⤵
  PID:6688
- C:\Windows\System\rSoIdWd.exe
  C:\Windows\System\rSoIdWd.exe
  2⤵
  PID:6716
- C:\Windows\System\DwYldhz.exe
  C:\Windows\System\DwYldhz.exe
  2⤵
  PID:6748
- C:\Windows\System\BSgmRwW.exe
  C:\Windows\System\BSgmRwW.exe
  2⤵
  PID:6772
- C:\Windows\System\zKaczPe.exe
  C:\Windows\System\zKaczPe.exe
  2⤵
  PID:6808
- C:\Windows\System\uZIpyKH.exe
  C:\Windows\System\uZIpyKH.exe
  2⤵
  PID:6828
- C:\Windows\System\OWBnpDx.exe
  C:\Windows\System\OWBnpDx.exe
  2⤵
  PID:6848
- C:\Windows\System\cZYdSXj.exe
  C:\Windows\System\cZYdSXj.exe
  2⤵
  PID:6876
- C:\Windows\System\LNXpTpf.exe
  C:\Windows\System\LNXpTpf.exe
  2⤵
  PID:6916
- C:\Windows\System\dNEfFfG.exe
  C:\Windows\System\dNEfFfG.exe
  2⤵
  PID:6944
- C:\Windows\System\XtEccJI.exe
  C:\Windows\System\XtEccJI.exe
  2⤵
  PID:6960
- C:\Windows\System\eIpQuKE.exe
  C:\Windows\System\eIpQuKE.exe
  2⤵
  PID:6980
- C:\Windows\System\JRzVvCo.exe
  C:\Windows\System\JRzVvCo.exe
  2⤵
  PID:7008
- C:\Windows\System\zBUcZny.exe
  C:\Windows\System\zBUcZny.exe
  2⤵
  PID:7036
- C:\Windows\System\xJynDpt.exe
  C:\Windows\System\xJynDpt.exe
  2⤵
  PID:7056
- C:\Windows\System\oWXdhhi.exe
  C:\Windows\System\oWXdhhi.exe
  2⤵
  PID:7084
- C:\Windows\System\xJDoaHB.exe
  C:\Windows\System\xJDoaHB.exe
  2⤵
  PID:7144
- C:\Windows\System\DJAwNnP.exe
  C:\Windows\System\DJAwNnP.exe
  2⤵
  PID:2508
- C:\Windows\System\oVdIboT.exe
  C:\Windows\System\oVdIboT.exe
  2⤵
  PID:6220
- C:\Windows\System\xyuICfW.exe
  C:\Windows\System\xyuICfW.exe
  2⤵
  PID:6268
- C:\Windows\System\nBgRvLA.exe
  C:\Windows\System\nBgRvLA.exe
  2⤵
  PID:3684
- C:\Windows\System\dnkKgpl.exe
  C:\Windows\System\dnkKgpl.exe
  2⤵
  PID:6316
- C:\Windows\System\wPaJuNE.exe
  C:\Windows\System\wPaJuNE.exe
  2⤵
  PID:6392
- C:\Windows\System\JuQtvdX.exe
  C:\Windows\System\JuQtvdX.exe
  2⤵
  PID:6460
- C:\Windows\System\XBVXDLt.exe
  C:\Windows\System\XBVXDLt.exe
  2⤵
  PID:6504
- C:\Windows\System\SegCsRD.exe
  C:\Windows\System\SegCsRD.exe
  2⤵
  PID:6548
- C:\Windows\System\jVJWJfu.exe
  C:\Windows\System\jVJWJfu.exe
  2⤵
  PID:6676
- C:\Windows\System\DDlRnCr.exe
  C:\Windows\System\DDlRnCr.exe
  2⤵
  PID:6756
- C:\Windows\System\wpsLvbN.exe
  C:\Windows\System\wpsLvbN.exe
  2⤵
  PID:6792
- C:\Windows\System\KEJZbhE.exe
  C:\Windows\System\KEJZbhE.exe
  2⤵
  PID:6836
- C:\Windows\System\ScrdBFD.exe
  C:\Windows\System\ScrdBFD.exe
  2⤵
  PID:6936
- C:\Windows\System\OWOcaux.exe
  C:\Windows\System\OWOcaux.exe
  2⤵
  PID:6992
- C:\Windows\System\ZOsENzQ.exe
  C:\Windows\System\ZOsENzQ.exe
  2⤵
  PID:7080
- C:\Windows\System\pybnIvd.exe
  C:\Windows\System\pybnIvd.exe
  2⤵
  PID:7024
- C:\Windows\System\gOIDptE.exe
  C:\Windows\System\gOIDptE.exe
  2⤵
  PID:7156
- C:\Windows\System\DWPdmjp.exe
  C:\Windows\System\DWPdmjp.exe
  2⤵
  PID:3124
- C:\Windows\System\dFwhwpx.exe
  C:\Windows\System\dFwhwpx.exe
  2⤵
  PID:6528
- C:\Windows\System\wkXBiTE.exe
  C:\Windows\System\wkXBiTE.exe
  2⤵
  PID:6616
- C:\Windows\System\elnrUZk.exe
  C:\Windows\System\elnrUZk.exe
  2⤵
  PID:6584
- C:\Windows\System\Hqpigxj.exe
  C:\Windows\System\Hqpigxj.exe
  2⤵
  PID:6804
- C:\Windows\System\ZJQoWjG.exe
  C:\Windows\System\ZJQoWjG.exe
  2⤵
  PID:6976
- C:\Windows\System\WTJrStc.exe
  C:\Windows\System\WTJrStc.exe
  2⤵
  PID:7004
- C:\Windows\System\gYucYcl.exe
  C:\Windows\System\gYucYcl.exe
  2⤵
  PID:6356
- C:\Windows\System\YQBddeX.exe
  C:\Windows\System\YQBddeX.exe
  2⤵
  PID:6816
- C:\Windows\System\RxFBLXG.exe
  C:\Windows\System\RxFBLXG.exe
  2⤵
  PID:4804
- C:\Windows\System\tNUuKdp.exe
  C:\Windows\System\tNUuKdp.exe
  2⤵
  PID:6908
- C:\Windows\System\SDuRXmE.exe
  C:\Windows\System\SDuRXmE.exe
  2⤵
  PID:6484
- C:\Windows\System\TWwFIQM.exe
  C:\Windows\System\TWwFIQM.exe
  2⤵
  PID:7204
- C:\Windows\System\XhpQyVM.exe
  C:\Windows\System\XhpQyVM.exe
  2⤵
  PID:7236
- C:\Windows\System\jQEeHHY.exe
  C:\Windows\System\jQEeHHY.exe
  2⤵
  PID:7276
- C:\Windows\System\kQTdSBo.exe
  C:\Windows\System\kQTdSBo.exe
  2⤵
  PID:7292
- C:\Windows\System\ObNgorT.exe
  C:\Windows\System\ObNgorT.exe
  2⤵
  PID:7320
- C:\Windows\System\GpFhqUG.exe
  C:\Windows\System\GpFhqUG.exe
  2⤵
  PID:7352
- C:\Windows\System\PjKhHBV.exe
  C:\Windows\System\PjKhHBV.exe
  2⤵
  PID:7388
- C:\Windows\System\EsgfuMV.exe
  C:\Windows\System\EsgfuMV.exe
  2⤵
  PID:7416
- C:\Windows\System\idFlFVr.exe
  C:\Windows\System\idFlFVr.exe
  2⤵
  PID:7444
- C:\Windows\System\OBLNIll.exe
  C:\Windows\System\OBLNIll.exe
  2⤵
  PID:7476
- C:\Windows\System\gIiWzNG.exe
  C:\Windows\System\gIiWzNG.exe
  2⤵
  PID:7504
- C:\Windows\System\yaTWYUG.exe
  C:\Windows\System\yaTWYUG.exe
  2⤵
  PID:7520
- C:\Windows\System\HinTNsP.exe
  C:\Windows\System\HinTNsP.exe
  2⤵
  PID:7560
- C:\Windows\System\crffDrb.exe
  C:\Windows\System\crffDrb.exe
  2⤵
  PID:7588
- C:\Windows\System\fmVSkFw.exe
  C:\Windows\System\fmVSkFw.exe
  2⤵
  PID:7612
- C:\Windows\System\JzoUrin.exe
  C:\Windows\System\JzoUrin.exe
  2⤵
  PID:7628
- C:\Windows\System\ktYNNxX.exe
  C:\Windows\System\ktYNNxX.exe
  2⤵
  PID:7648
- C:\Windows\System\dgkxZQZ.exe
  C:\Windows\System\dgkxZQZ.exe
  2⤵
  PID:7672
- C:\Windows\System\hUPLoue.exe
  C:\Windows\System\hUPLoue.exe
  2⤵
  PID:7712
- C:\Windows\System\dmBSPuA.exe
  C:\Windows\System\dmBSPuA.exe
  2⤵
  PID:7744
- C:\Windows\System\dBGnpvq.exe
  C:\Windows\System\dBGnpvq.exe
  2⤵
  PID:7764
- C:\Windows\System\yAVJqgS.exe
  C:\Windows\System\yAVJqgS.exe
  2⤵
  PID:7800
- C:\Windows\System\CMHfiQF.exe
  C:\Windows\System\CMHfiQF.exe
  2⤵
  PID:7840
- C:\Windows\System\cuEKvlf.exe
  C:\Windows\System\cuEKvlf.exe
  2⤵
  PID:7856
- C:\Windows\System\jTLenEg.exe
  C:\Windows\System\jTLenEg.exe
  2⤵
  PID:7880
- C:\Windows\System\OZJzCGL.exe
  C:\Windows\System\OZJzCGL.exe
  2⤵
  PID:7900
- C:\Windows\System\lWTaUCm.exe
  C:\Windows\System\lWTaUCm.exe
  2⤵
  PID:7920
- C:\Windows\System\wzwkmLz.exe
  C:\Windows\System\wzwkmLz.exe
  2⤵
  PID:7948
- C:\Windows\System\ryFqnMd.exe
  C:\Windows\System\ryFqnMd.exe
  2⤵
  PID:7980
- C:\Windows\System\JurZNzB.exe
  C:\Windows\System\JurZNzB.exe
  2⤵
  PID:8032
- C:\Windows\System\HUnpGuP.exe
  C:\Windows\System\HUnpGuP.exe
  2⤵
  PID:8048
- C:\Windows\System\dxmrWXP.exe
  C:\Windows\System\dxmrWXP.exe
  2⤵
  PID:8072
- C:\Windows\System\JmYcscv.exe
  C:\Windows\System\JmYcscv.exe
  2⤵
  PID:8108
- C:\Windows\System\ZSBYLcY.exe
  C:\Windows\System\ZSBYLcY.exe
  2⤵
  PID:8140
- C:\Windows\System\zkgXYss.exe
  C:\Windows\System\zkgXYss.exe
  2⤵
  PID:8156
- C:\Windows\System\NruBZyp.exe
  C:\Windows\System\NruBZyp.exe
  2⤵
  PID:8172
- C:\Windows\System\OphlCja.exe
  C:\Windows\System\OphlCja.exe
  2⤵
  PID:8188
- C:\Windows\System\FEGbwDO.exe
  C:\Windows\System\FEGbwDO.exe
  2⤵
  PID:7016
- C:\Windows\System\UgfwShu.exe
  C:\Windows\System\UgfwShu.exe
  2⤵
  PID:7284
- C:\Windows\System\vobEIAR.exe
  C:\Windows\System\vobEIAR.exe
  2⤵
  PID:7308
- C:\Windows\System\OROuoTc.exe
  C:\Windows\System\OROuoTc.exe
  2⤵
  PID:7440
- C:\Windows\System\DjRBmah.exe
  C:\Windows\System\DjRBmah.exe
  2⤵
  PID:7512
- C:\Windows\System\KafoRwP.exe
  C:\Windows\System\KafoRwP.exe
  2⤵
  PID:7536
- C:\Windows\System\uTLNWoN.exe
  C:\Windows\System\uTLNWoN.exe
  2⤵
  PID:7596
- C:\Windows\System\tzEcFPp.exe
  C:\Windows\System\tzEcFPp.exe
  2⤵
  PID:7660
- C:\Windows\System\pgBmHXx.exe
  C:\Windows\System\pgBmHXx.exe
  2⤵
  PID:7724
- C:\Windows\System\VMLFpdI.exe
  C:\Windows\System\VMLFpdI.exe
  2⤵
  PID:7872
- C:\Windows\System\ncIBKfI.exe
  C:\Windows\System\ncIBKfI.exe
  2⤵
  PID:8020
- C:\Windows\System\zDfHQDd.exe
  C:\Windows\System\zDfHQDd.exe
  2⤵
  PID:8040
- C:\Windows\System\zgkAnvM.exe
  C:\Windows\System\zgkAnvM.exe
  2⤵
  PID:8088
- C:\Windows\System\UEmYRgI.exe
  C:\Windows\System\UEmYRgI.exe
  2⤵
  PID:8168
- C:\Windows\System\yXedzli.exe
  C:\Windows\System\yXedzli.exe
  2⤵
  PID:8164
- C:\Windows\System\bsZtLjG.exe
  C:\Windows\System\bsZtLjG.exe
  2⤵
  PID:7456
- C:\Windows\System\hPIedkg.exe
  C:\Windows\System\hPIedkg.exe
  2⤵
  PID:7492
- C:\Windows\System\BYXuojh.exe
  C:\Windows\System\BYXuojh.exe
  2⤵
  PID:7584
- C:\Windows\System\AZnZoTP.exe
  C:\Windows\System\AZnZoTP.exe
  2⤵
  PID:7888
- C:\Windows\System\FbENpfc.exe
  C:\Windows\System\FbENpfc.exe
  2⤵
  PID:8068
- C:\Windows\System\EhHENdg.exe
  C:\Windows\System\EhHENdg.exe
  2⤵
  PID:8152
- C:\Windows\System\FFKSkXY.exe
  C:\Windows\System\FFKSkXY.exe
  2⤵
  PID:7404
- C:\Windows\System\SvgwEzL.exe
  C:\Windows\System\SvgwEzL.exe
  2⤵
  PID:7916
- C:\Windows\System\mAfkdPM.exe
  C:\Windows\System\mAfkdPM.exe
  2⤵
  PID:7180
- C:\Windows\System\UUlDYIr.exe
  C:\Windows\System\UUlDYIr.exe
  2⤵
  PID:7796
- C:\Windows\System\EjvxMbU.exe
  C:\Windows\System\EjvxMbU.exe
  2⤵
  PID:8208
- C:\Windows\System\lIFGMeh.exe
  C:\Windows\System\lIFGMeh.exe
  2⤵
  PID:8236
- C:\Windows\System\xvXnmus.exe
  C:\Windows\System\xvXnmus.exe
  2⤵
  PID:8264
- C:\Windows\System\ZLSMvhv.exe
  C:\Windows\System\ZLSMvhv.exe
  2⤵
  PID:8292
- C:\Windows\System\PfdEfBT.exe
  C:\Windows\System\PfdEfBT.exe
  2⤵
  PID:8308
- C:\Windows\System\IejjJXn.exe
  C:\Windows\System\IejjJXn.exe
  2⤵
  PID:8336
- C:\Windows\System\PKQoAdp.exe
  C:\Windows\System\PKQoAdp.exe
  2⤵
  PID:8364
- C:\Windows\System\FFdDdpW.exe
  C:\Windows\System\FFdDdpW.exe
  2⤵
  PID:8400
- C:\Windows\System\jdvGTvU.exe
  C:\Windows\System\jdvGTvU.exe
  2⤵
  PID:8432
- C:\Windows\System\OxWltkI.exe
  C:\Windows\System\OxWltkI.exe
  2⤵
  PID:8460
- C:\Windows\System\uarHynd.exe
  C:\Windows\System\uarHynd.exe
  2⤵
  PID:8488
- C:\Windows\System\vaUZwpW.exe
  C:\Windows\System\vaUZwpW.exe
  2⤵
  PID:8504
- C:\Windows\System\jDzoEyZ.exe
  C:\Windows\System\jDzoEyZ.exe
  2⤵
  PID:8520
- C:\Windows\System\yFLJsvg.exe
  C:\Windows\System\yFLJsvg.exe
  2⤵
  PID:8564
- C:\Windows\System\XbkvCMt.exe
  C:\Windows\System\XbkvCMt.exe
  2⤵
  PID:8592
- C:\Windows\System\EpcTsmj.exe
  C:\Windows\System\EpcTsmj.exe
  2⤵
  PID:8628
- C:\Windows\System\MBScaQY.exe
  C:\Windows\System\MBScaQY.exe
  2⤵
  PID:8660
- C:\Windows\System\YMLILPD.exe
  C:\Windows\System\YMLILPD.exe
  2⤵
  PID:8696
- C:\Windows\System\qLGcJgy.exe
  C:\Windows\System\qLGcJgy.exe
  2⤵
  PID:8724
- C:\Windows\System\FonyOqM.exe
  C:\Windows\System\FonyOqM.exe
  2⤵
  PID:8752
- C:\Windows\System\AhHWyLb.exe
  C:\Windows\System\AhHWyLb.exe
  2⤵
  PID:8780
- C:\Windows\System\KiChpmO.exe
  C:\Windows\System\KiChpmO.exe
  2⤵
  PID:8808
- C:\Windows\System\BHEazrB.exe
  C:\Windows\System\BHEazrB.exe
  2⤵
  PID:8832
- C:\Windows\System\qXPedVj.exe
  C:\Windows\System\qXPedVj.exe
  2⤵
  PID:8852
- C:\Windows\System\wNBbedd.exe
  C:\Windows\System\wNBbedd.exe
  2⤵
  PID:8884
- C:\Windows\System\ORZpcso.exe
  C:\Windows\System\ORZpcso.exe
  2⤵
  PID:8908
- C:\Windows\System\UCqavlx.exe
  C:\Windows\System\UCqavlx.exe
  2⤵
  PID:8952
- C:\Windows\System\uhpdDdv.exe
  C:\Windows\System\uhpdDdv.exe
  2⤵
  PID:8972
- C:\Windows\System\emGakKC.exe
  C:\Windows\System\emGakKC.exe
  2⤵
  PID:9008
- C:\Windows\System\fvHsncf.exe
  C:\Windows\System\fvHsncf.exe
  2⤵
  PID:9040
- C:\Windows\System\TXGRrki.exe
  C:\Windows\System\TXGRrki.exe
  2⤵
  PID:9060
- C:\Windows\System\vdqBizP.exe
  C:\Windows\System\vdqBizP.exe
  2⤵
  PID:9088
- C:\Windows\System\JkKREDW.exe
  C:\Windows\System\JkKREDW.exe
  2⤵
  PID:9124
- C:\Windows\System\iIcovro.exe
  C:\Windows\System\iIcovro.exe
  2⤵
  PID:9144
- C:\Windows\System\EAsWMoW.exe
  C:\Windows\System\EAsWMoW.exe
  2⤵
  PID:9180
- C:\Windows\System\aiEwWLK.exe
  C:\Windows\System\aiEwWLK.exe
  2⤵
  PID:9212
- C:\Windows\System\fWxvhWF.exe
  C:\Windows\System\fWxvhWF.exe
  2⤵
  PID:8228
- C:\Windows\System\MbZHgMR.exe
  C:\Windows\System\MbZHgMR.exe
  2⤵
  PID:8284
- C:\Windows\System\bghYXdZ.exe
  C:\Windows\System\bghYXdZ.exe
  2⤵
  PID:8376
- C:\Windows\System\ZBwcRJG.exe
  C:\Windows\System\ZBwcRJG.exe
  2⤵
  PID:8428
- C:\Windows\System\RiFpZto.exe
  C:\Windows\System\RiFpZto.exe
  2⤵
  PID:8496
- C:\Windows\System\utNwkxG.exe
  C:\Windows\System\utNwkxG.exe
  2⤵
  PID:8536
- C:\Windows\System\yQXmSRr.exe
  C:\Windows\System\yQXmSRr.exe
  2⤵
  PID:8620
- C:\Windows\System\oTOTWKY.exe
  C:\Windows\System\oTOTWKY.exe
  2⤵
  PID:8692
- C:\Windows\System\DeKfgdh.exe
  C:\Windows\System\DeKfgdh.exe
  2⤵
  PID:8764
- C:\Windows\System\LGMbYpm.exe
  C:\Windows\System\LGMbYpm.exe
  2⤵
  PID:8824
- C:\Windows\System\cWPcVRv.exe
  C:\Windows\System\cWPcVRv.exe
  2⤵
  PID:8924
- C:\Windows\System\opJbAOO.exe
  C:\Windows\System\opJbAOO.exe
  2⤵
  PID:8968
- C:\Windows\System\JhAtQnU.exe
  C:\Windows\System\JhAtQnU.exe
  2⤵
  PID:9024
- C:\Windows\System\nzGVKvU.exe
  C:\Windows\System\nzGVKvU.exe
  2⤵
  PID:9132
- C:\Windows\System\NqLqZAS.exe
  C:\Windows\System\NqLqZAS.exe
  2⤵
  PID:9196
- C:\Windows\System\imSKXBq.exe
  C:\Windows\System\imSKXBq.exe
  2⤵
  PID:8260
- C:\Windows\System\DJaKPCq.exe
  C:\Windows\System\DJaKPCq.exe
  2⤵
  PID:8424
- C:\Windows\System\ReaWNKd.exe
  C:\Windows\System\ReaWNKd.exe
  2⤵
  PID:8580
- C:\Windows\System\DRcJmEj.exe
  C:\Windows\System\DRcJmEj.exe
  2⤵
  PID:8748
- C:\Windows\System\DTMZRzP.exe
  C:\Windows\System\DTMZRzP.exe
  2⤵
  PID:8864
- C:\Windows\System\wpXhbnM.exe
  C:\Windows\System\wpXhbnM.exe
  2⤵
  PID:9016
- C:\Windows\System\aQFjlwt.exe
  C:\Windows\System\aQFjlwt.exe
  2⤵
  PID:9104
- C:\Windows\System\NRZWdgm.exe
  C:\Windows\System\NRZWdgm.exe
  2⤵
  PID:8644
- C:\Windows\System\ThQZbtx.exe
  C:\Windows\System\ThQZbtx.exe
  2⤵
  PID:9004
- C:\Windows\System\IAAqEOb.exe
  C:\Windows\System\IAAqEOb.exe
  2⤵
  PID:8548
- C:\Windows\System\ustTjKt.exe
  C:\Windows\System\ustTjKt.exe
  2⤵
  PID:8576
- C:\Windows\System\RHLTIKM.exe
  C:\Windows\System\RHLTIKM.exe
  2⤵
  PID:9236
- C:\Windows\System\GOQvOht.exe
  C:\Windows\System\GOQvOht.exe
  2⤵
  PID:9264
- C:\Windows\System\BnpNZFb.exe
  C:\Windows\System\BnpNZFb.exe
  2⤵
  PID:9292
- C:\Windows\System\gJRbYVu.exe
  C:\Windows\System\gJRbYVu.exe
  2⤵
  PID:9312
- C:\Windows\System\lNIkjHN.exe
  C:\Windows\System\lNIkjHN.exe
  2⤵
  PID:9340
- C:\Windows\System\sVzEpHM.exe
  C:\Windows\System\sVzEpHM.exe
  2⤵
  PID:9376
- C:\Windows\System\nliKKAx.exe
  C:\Windows\System\nliKKAx.exe
  2⤵
  PID:9404
- C:\Windows\System\WQCXgAD.exe
  C:\Windows\System\WQCXgAD.exe
  2⤵
  PID:9420
- C:\Windows\System\ZxZVzPN.exe
  C:\Windows\System\ZxZVzPN.exe
  2⤵
  PID:9460
- C:\Windows\System\mCgHolE.exe
  C:\Windows\System\mCgHolE.exe
  2⤵
  PID:9488
- C:\Windows\System\ygWHbEg.exe
  C:\Windows\System\ygWHbEg.exe
  2⤵
  PID:9516
- C:\Windows\System\KBoHeiS.exe
  C:\Windows\System\KBoHeiS.exe
  2⤵
  PID:9544
- C:\Windows\System\ZAfwABE.exe
  C:\Windows\System\ZAfwABE.exe
  2⤵
  PID:9576
- C:\Windows\System\THCexJH.exe
  C:\Windows\System\THCexJH.exe
  2⤵
  PID:9612
- C:\Windows\System\iFJYCen.exe
  C:\Windows\System\iFJYCen.exe
  2⤵
  PID:9640
- C:\Windows\System\AlZurOj.exe
  C:\Windows\System\AlZurOj.exe
  2⤵
  PID:9656
- C:\Windows\System\YIevhRn.exe
  C:\Windows\System\YIevhRn.exe
  2⤵
  PID:9696
- C:\Windows\System\uVABgCR.exe
  C:\Windows\System\uVABgCR.exe
  2⤵
  PID:9724
- C:\Windows\System\wonIVaA.exe
  C:\Windows\System\wonIVaA.exe
  2⤵
  PID:9752
- C:\Windows\System\mRUoymO.exe
  C:\Windows\System\mRUoymO.exe
  2⤵
  PID:9772
- C:\Windows\System\hHEphLx.exe
  C:\Windows\System\hHEphLx.exe
  2⤵
  PID:9808
- C:\Windows\System\SQzrNPy.exe
  C:\Windows\System\SQzrNPy.exe
  2⤵
  PID:9836
- C:\Windows\System\YLPfyCO.exe
  C:\Windows\System\YLPfyCO.exe
  2⤵
  PID:9868
- C:\Windows\System\IvmPfPl.exe
  C:\Windows\System\IvmPfPl.exe
  2⤵
  PID:9896
- C:\Windows\System\VcIEXxg.exe
  C:\Windows\System\VcIEXxg.exe
  2⤵
  PID:9916
- C:\Windows\System\VAcQHCV.exe
  C:\Windows\System\VAcQHCV.exe
  2⤵
  PID:9944
- C:\Windows\System\Moymezy.exe
  C:\Windows\System\Moymezy.exe
  2⤵
  PID:9972
- C:\Windows\System\ohbxHKE.exe
  C:\Windows\System\ohbxHKE.exe
  2⤵
  PID:10000
- C:\Windows\System\rnPFcGL.exe
  C:\Windows\System\rnPFcGL.exe
  2⤵
  PID:10024
- C:\Windows\System\tdygqNB.exe
  C:\Windows\System\tdygqNB.exe
  2⤵
  PID:10060
- C:\Windows\System\jWTDfod.exe
  C:\Windows\System\jWTDfod.exe
  2⤵
  PID:10084
- C:\Windows\System\MBOCZxB.exe
  C:\Windows\System\MBOCZxB.exe
  2⤵
  PID:10112
- C:\Windows\System\ondZZFu.exe
  C:\Windows\System\ondZZFu.exe
  2⤵
  PID:10140
- C:\Windows\System\AdZDAgW.exe
  C:\Windows\System\AdZDAgW.exe
  2⤵
  PID:10180
- C:\Windows\System\BzXXNdW.exe
  C:\Windows\System\BzXXNdW.exe
  2⤵
  PID:10196
- C:\Windows\System\PDPKRcQ.exe
  C:\Windows\System\PDPKRcQ.exe
  2⤵
  PID:10224
- C:\Windows\System\JTAmoXh.exe
  C:\Windows\System\JTAmoXh.exe
  2⤵
  PID:9248
- C:\Windows\System\iqoEwQn.exe
  C:\Windows\System\iqoEwQn.exe
  2⤵
  PID:9320
- C:\Windows\System\DonsRfc.exe
  C:\Windows\System\DonsRfc.exe
  2⤵
  PID:9364
- C:\Windows\System\OtglzIF.exe
  C:\Windows\System\OtglzIF.exe
  2⤵
  PID:9472
- C:\Windows\System\Efnvnoj.exe
  C:\Windows\System\Efnvnoj.exe
  2⤵
  PID:9536
- C:\Windows\System\snoIiAC.exe
  C:\Windows\System\snoIiAC.exe
  2⤵
  PID:9628
- C:\Windows\System\lCCMDQi.exe
  C:\Windows\System\lCCMDQi.exe
  2⤵
  PID:9684
- C:\Windows\System\FVwIzYB.exe
  C:\Windows\System\FVwIzYB.exe
  2⤵
  PID:9716
- C:\Windows\System\ryvoHvf.exe
  C:\Windows\System\ryvoHvf.exe
  2⤵
  PID:9792
- C:\Windows\System\IUACNMj.exe
  C:\Windows\System\IUACNMj.exe
  2⤵
  PID:9832
- C:\Windows\System\AiDrhXK.exe
  C:\Windows\System\AiDrhXK.exe
  2⤵
  PID:9888
- C:\Windows\System\lbEkNOj.exe
  C:\Windows\System\lbEkNOj.exe
  2⤵
  PID:9960
- C:\Windows\System\mEkdTFs.exe
  C:\Windows\System\mEkdTFs.exe
  2⤵
  PID:10020
- C:\Windows\System\RoICxtw.exe
  C:\Windows\System\RoICxtw.exe
  2⤵
  PID:10136
- C:\Windows\System\YYUvWCh.exe
  C:\Windows\System\YYUvWCh.exe
  2⤵
  PID:10172
- C:\Windows\System\IuBlLEq.exe
  C:\Windows\System\IuBlLEq.exe
  2⤵
  PID:10232
- C:\Windows\System\SaCTzhM.exe
  C:\Windows\System\SaCTzhM.exe
  2⤵
  PID:9232
- C:\Windows\System\wkkDNEc.exe
  C:\Windows\System\wkkDNEc.exe
  2⤵
  PID:9436
- C:\Windows\System\CynscRf.exe
  C:\Windows\System\CynscRf.exe
  2⤵
  PID:8684
- C:\Windows\System\DOxpGZN.exe
  C:\Windows\System\DOxpGZN.exe
  2⤵
  PID:9796
- C:\Windows\System\TPRCHDz.exe
  C:\Windows\System\TPRCHDz.exe
  2⤵
  PID:9952
- C:\Windows\System\CxOjjFk.exe
  C:\Windows\System\CxOjjFk.exe
  2⤵
  PID:10212
- C:\Windows\System\VECzJqz.exe
  C:\Windows\System\VECzJqz.exe
  2⤵
  PID:9356
- C:\Windows\System\ovrtten.exe
  C:\Windows\System\ovrtten.exe
  2⤵
  PID:9596
- C:\Windows\System\Pdemqwl.exe
  C:\Windows\System\Pdemqwl.exe
  2⤵
  PID:10104
- C:\Windows\System\vMluEOp.exe
  C:\Windows\System\vMluEOp.exe
  2⤵
  PID:9564
- C:\Windows\System\ndvnWHC.exe
  C:\Windows\System\ndvnWHC.exe
  2⤵
  PID:10244
- C:\Windows\System\lrVYLJB.exe
  C:\Windows\System\lrVYLJB.exe
  2⤵
  PID:10280
- C:\Windows\System\MhUzNiw.exe
  C:\Windows\System\MhUzNiw.exe
  2⤵
  PID:10308
- C:\Windows\System\VRyDkds.exe
  C:\Windows\System\VRyDkds.exe
  2⤵
  PID:10336
- C:\Windows\System\gcSxfiE.exe
  C:\Windows\System\gcSxfiE.exe
  2⤵
  PID:10364
- C:\Windows\System\Hqihipt.exe
  C:\Windows\System\Hqihipt.exe
  2⤵
  PID:10384
- C:\Windows\System\zFJsFzT.exe
  C:\Windows\System\zFJsFzT.exe
  2⤵
  PID:10412
- C:\Windows\System\aXuZGjJ.exe
  C:\Windows\System\aXuZGjJ.exe
  2⤵
  PID:10448
- C:\Windows\System\vPlpKem.exe
  C:\Windows\System\vPlpKem.exe
  2⤵
  PID:10468
- C:\Windows\System\HZsyuhM.exe
  C:\Windows\System\HZsyuhM.exe
  2⤵
  PID:10492
- C:\Windows\System\enLGQvx.exe
  C:\Windows\System\enLGQvx.exe
  2⤵
  PID:10520
- C:\Windows\System\SSqqXNz.exe
  C:\Windows\System\SSqqXNz.exe
  2⤵
  PID:10548
- C:\Windows\System\HRVFUNG.exe
  C:\Windows\System\HRVFUNG.exe
  2⤵
  PID:10588
- C:\Windows\System\VVkdemf.exe
  C:\Windows\System\VVkdemf.exe
  2⤵
  PID:10616
- C:\Windows\System\ZxrUxrc.exe
  C:\Windows\System\ZxrUxrc.exe
  2⤵
  PID:10632
- C:\Windows\System\jfIrVcz.exe
  C:\Windows\System\jfIrVcz.exe
  2⤵
  PID:10660
- C:\Windows\System\drJYSbU.exe
  C:\Windows\System\drJYSbU.exe
  2⤵
  PID:10688
- C:\Windows\System\ojvyDYf.exe
  C:\Windows\System\ojvyDYf.exe
  2⤵
  PID:10704
- C:\Windows\System\gIdxOob.exe
  C:\Windows\System\gIdxOob.exe
  2⤵
  PID:10740
- C:\Windows\System\ezaqVBn.exe
  C:\Windows\System\ezaqVBn.exe
  2⤵
  PID:10772
- C:\Windows\System\JerYkpC.exe
  C:\Windows\System\JerYkpC.exe
  2⤵
  PID:10800
- C:\Windows\System\FmttquU.exe
  C:\Windows\System\FmttquU.exe
  2⤵
  PID:10828
- C:\Windows\System\nQpdhuG.exe
  C:\Windows\System\nQpdhuG.exe
  2⤵
  PID:10864
- C:\Windows\System\SHoyClk.exe
  C:\Windows\System\SHoyClk.exe
  2⤵
  PID:10884
- C:\Windows\System\bUpLILl.exe
  C:\Windows\System\bUpLILl.exe
  2⤵
  PID:10908
- C:\Windows\System\BadvMKC.exe
  C:\Windows\System\BadvMKC.exe
  2⤵
  PID:10952
- C:\Windows\System\qZpIiJV.exe
  C:\Windows\System\qZpIiJV.exe
  2⤵
  PID:10980
- C:\Windows\System\CnYOjaE.exe
  C:\Windows\System\CnYOjaE.exe
  2⤵
  PID:11008
- C:\Windows\System\yMbvPAn.exe
  C:\Windows\System\yMbvPAn.exe
  2⤵
  PID:11036
- C:\Windows\System\qQaSgwr.exe
  C:\Windows\System\qQaSgwr.exe
  2⤵
  PID:11064
- C:\Windows\System\ZmTaYaO.exe
  C:\Windows\System\ZmTaYaO.exe
  2⤵
  PID:11092
- C:\Windows\System\oMkrnLv.exe
  C:\Windows\System\oMkrnLv.exe
  2⤵
  PID:11108
- C:\Windows\System\wmVwsHb.exe
  C:\Windows\System\wmVwsHb.exe
  2⤵
  PID:11148
- C:\Windows\System\oAEGeRz.exe
  C:\Windows\System\oAEGeRz.exe
  2⤵
  PID:11168
- C:\Windows\System\JQoZIUF.exe
  C:\Windows\System\JQoZIUF.exe
  2⤵
  PID:11200
- C:\Windows\System\qbeXysy.exe
  C:\Windows\System\qbeXysy.exe
  2⤵
  PID:11232
- C:\Windows\System\fjMQvCo.exe
  C:\Windows\System\fjMQvCo.exe
  2⤵
  PID:11252
- C:\Windows\System\IyCYCfv.exe
  C:\Windows\System\IyCYCfv.exe
  2⤵
  PID:10276
- C:\Windows\System\YfaFgdy.exe
  C:\Windows\System\YfaFgdy.exe
  2⤵
  PID:10352
- C:\Windows\System\vtGOczz.exe
  C:\Windows\System\vtGOczz.exe
  2⤵
  PID:10396
- C:\Windows\System\vmWVuZa.exe
  C:\Windows\System\vmWVuZa.exe
  2⤵
  PID:10444
- C:\Windows\System\VsWNidD.exe
  C:\Windows\System\VsWNidD.exe
  2⤵
  PID:10504
- C:\Windows\System\yNRWJpM.exe
  C:\Windows\System\yNRWJpM.exe
  2⤵
  PID:10604
- C:\Windows\System\UPYGvGT.exe
  C:\Windows\System\UPYGvGT.exe
  2⤵
  PID:10676
- C:\Windows\System\vjiuuvz.exe
  C:\Windows\System\vjiuuvz.exe
  2⤵
  PID:10720
- C:\Windows\System\cdYdjoI.exe
  C:\Windows\System\cdYdjoI.exe
  2⤵
  PID:10748
- C:\Windows\System\DpCNxAD.exe
  C:\Windows\System\DpCNxAD.exe
  2⤵
  PID:10872
- C:\Windows\System\pgXqqfI.exe
  C:\Windows\System\pgXqqfI.exe
  2⤵
  PID:9968
- C:\Windows\System\xWFzdXj.exe
  C:\Windows\System\xWFzdXj.exe
  2⤵
  PID:10996
- C:\Windows\System\yujrTWu.exe
  C:\Windows\System\yujrTWu.exe
  2⤵
  PID:11032
- C:\Windows\System\ljymfWQ.exe
  C:\Windows\System\ljymfWQ.exe
  2⤵
  PID:11124
- C:\Windows\System\EUDoKIP.exe
  C:\Windows\System\EUDoKIP.exe
  2⤵
  PID:11132
- C:\Windows\System\MYnbVoI.exe
  C:\Windows\System\MYnbVoI.exe
  2⤵
  PID:11248
- C:\Windows\System\hYRvyQc.exe
  C:\Windows\System\hYRvyQc.exe
  2⤵
  PID:10268
- C:\Windows\System\pIgmdST.exe
  C:\Windows\System\pIgmdST.exe
  2⤵
  PID:10432
- C:\Windows\System\jFgCZZa.exe
  C:\Windows\System\jFgCZZa.exe
  2⤵
  PID:10560
- C:\Windows\System\NzugvjU.exe
  C:\Windows\System\NzugvjU.exe
  2⤵
  PID:10684
- C:\Windows\System\ffcDIZq.exe
  C:\Windows\System\ffcDIZq.exe
  2⤵
  PID:10816
- C:\Windows\System\ggCkKrC.exe
  C:\Windows\System\ggCkKrC.exe
  2⤵
  PID:11100
- C:\Windows\System\JcUQoDt.exe
  C:\Windows\System\JcUQoDt.exe
  2⤵
  PID:11244
- C:\Windows\System\cFUwUsv.exe
  C:\Windows\System\cFUwUsv.exe
  2⤵
  PID:10436
- C:\Windows\System\GCCIfaL.exe
  C:\Windows\System\GCCIfaL.exe
  2⤵
  PID:10700
- C:\Windows\System\PaqxvEJ.exe
  C:\Windows\System\PaqxvEJ.exe
  2⤵
  PID:10976
- C:\Windows\System\eLgoOog.exe
  C:\Windows\System\eLgoOog.exe
  2⤵
  PID:10320
- C:\Windows\System\WncpSJf.exe
  C:\Windows\System\WncpSJf.exe
  2⤵
  PID:11156
- C:\Windows\System\ljdozLu.exe
  C:\Windows\System\ljdozLu.exe
  2⤵
  PID:11292
- C:\Windows\System\CjyXkAK.exe
  C:\Windows\System\CjyXkAK.exe
  2⤵
  PID:11328
- C:\Windows\System\bmPgikx.exe
  C:\Windows\System\bmPgikx.exe
  2⤵
  PID:11344
- C:\Windows\System\VLWTlbO.exe
  C:\Windows\System\VLWTlbO.exe
  2⤵
  PID:11392
- C:\Windows\System\uzsjqOk.exe
  C:\Windows\System\uzsjqOk.exe
  2⤵
  PID:11420
- C:\Windows\System\ICKivsu.exe
  C:\Windows\System\ICKivsu.exe
  2⤵
  PID:11448
- C:\Windows\System\BkCrNgh.exe
  C:\Windows\System\BkCrNgh.exe
  2⤵
  PID:11472
- C:\Windows\System\rhAgZQK.exe
  C:\Windows\System\rhAgZQK.exe
  2⤵
  PID:11504
- C:\Windows\System\VHlLyVu.exe
  C:\Windows\System\VHlLyVu.exe
  2⤵
  PID:11544
- C:\Windows\System\QlqkThI.exe
  C:\Windows\System\QlqkThI.exe
  2⤵
  PID:11568
- C:\Windows\System\LGbbWVX.exe
  C:\Windows\System\LGbbWVX.exe
  2⤵
  PID:11588
- C:\Windows\System\RDbCRWF.exe
  C:\Windows\System\RDbCRWF.exe
  2⤵
  PID:11620
- C:\Windows\System\gIYBbfA.exe
  C:\Windows\System\gIYBbfA.exe
  2⤵
  PID:11656
- C:\Windows\System\ALSKDUV.exe
  C:\Windows\System\ALSKDUV.exe
  2⤵
  PID:11676
- C:\Windows\System\UDMBTAK.exe
  C:\Windows\System\UDMBTAK.exe
  2⤵
  PID:11696
- C:\Windows\System\wMtUtWA.exe
  C:\Windows\System\wMtUtWA.exe
  2⤵
  PID:11720
- C:\Windows\System\CXYpHrI.exe
  C:\Windows\System\CXYpHrI.exe
  2⤵
  PID:11756
- C:\Windows\System\BcZyGMi.exe
  C:\Windows\System\BcZyGMi.exe
  2⤵
  PID:11788
- C:\Windows\System\EWsGCvr.exe
  C:\Windows\System\EWsGCvr.exe
  2⤵
  PID:11812
- C:\Windows\System\ldihHOl.exe
  C:\Windows\System\ldihHOl.exe
  2⤵
  PID:11840
- C:\Windows\System\UOALsYe.exe
  C:\Windows\System\UOALsYe.exe
  2⤵
  PID:11856
- C:\Windows\System\DTRYtMn.exe
  C:\Windows\System\DTRYtMn.exe
  2⤵
  PID:11888
- C:\Windows\System\nmzMpwV.exe
  C:\Windows\System\nmzMpwV.exe
  2⤵
  PID:11936
- C:\Windows\System\KoEhAtj.exe
  C:\Windows\System\KoEhAtj.exe
  2⤵
  PID:11952
- C:\Windows\System\ImDrHtP.exe
  C:\Windows\System\ImDrHtP.exe
  2⤵
  PID:11972
- C:\Windows\System\CWHYqiG.exe
  C:\Windows\System\CWHYqiG.exe
  2⤵
  PID:12020
- C:\Windows\System\JjLuyKI.exe
  C:\Windows\System\JjLuyKI.exe
  2⤵
  PID:12044
- C:\Windows\System\GdGDYAa.exe
  C:\Windows\System\GdGDYAa.exe
  2⤵
  PID:12064
- C:\Windows\System\FqGATtR.exe
  C:\Windows\System\FqGATtR.exe
  2⤵
  PID:12088
- C:\Windows\System\IqHOpev.exe
  C:\Windows\System\IqHOpev.exe
  2⤵
  PID:12108
- C:\Windows\System\UbXrLGA.exe
  C:\Windows\System\UbXrLGA.exe
  2⤵
  PID:12124
- C:\Windows\System\ZtsGfkw.exe
  C:\Windows\System\ZtsGfkw.exe
  2⤵
  PID:12176
- C:\Windows\System\hBEhYNK.exe
  C:\Windows\System\hBEhYNK.exe
  2⤵
  PID:12208
- C:\Windows\System\ZAZuOdb.exe
  C:\Windows\System\ZAZuOdb.exe
  2⤵
  PID:12248
- C:\Windows\System\DaXyAvb.exe
  C:\Windows\System\DaXyAvb.exe
  2⤵
  PID:12276
- C:\Windows\System\fQvLBXO.exe
  C:\Windows\System\fQvLBXO.exe
  2⤵
  PID:10844
- C:\Windows\System\RMnzBbV.exe
  C:\Windows\System\RMnzBbV.exe
  2⤵
  PID:11360
- C:\Windows\System\iSYaQDM.exe
  C:\Windows\System\iSYaQDM.exe
  2⤵
  PID:11404
- C:\Windows\System\cMcEhDD.exe
  C:\Windows\System\cMcEhDD.exe
  2⤵
  PID:11460
- C:\Windows\System\ncTyiAg.exe
  C:\Windows\System\ncTyiAg.exe
  2⤵
  PID:11536
- C:\Windows\System\LxyAVxS.exe
  C:\Windows\System\LxyAVxS.exe
  2⤵
  PID:11580
- C:\Windows\System\MagCVgI.exe
  C:\Windows\System\MagCVgI.exe
  2⤵
  PID:11652
- C:\Windows\System\HMbDwgO.exe
  C:\Windows\System\HMbDwgO.exe
  2⤵
  PID:11708
- C:\Windows\System\zPWfQRY.exe
  C:\Windows\System\zPWfQRY.exe
  2⤵
  PID:11832
- C:\Windows\System\YwFTWKG.exe
  C:\Windows\System\YwFTWKG.exe
  2⤵
  PID:11824
- C:\Windows\System\ZaZYrBV.exe
  C:\Windows\System\ZaZYrBV.exe
  2⤵
  PID:11880
- C:\Windows\System\dsQmEwJ.exe
  C:\Windows\System\dsQmEwJ.exe
  2⤵
  PID:11968
- C:\Windows\System\uVdwmgD.exe
  C:\Windows\System\uVdwmgD.exe
  2⤵
  PID:12016
- C:\Windows\System\tGmBRqe.exe
  C:\Windows\System\tGmBRqe.exe
  2⤵
  PID:12084
- C:\Windows\System\AZUEaBb.exe
  C:\Windows\System\AZUEaBb.exe
  2⤵
  PID:12144
- C:\Windows\System\VyglrGs.exe
  C:\Windows\System\VyglrGs.exe
  2⤵
  PID:12240
- C:\Windows\System\baWmMVz.exe
  C:\Windows\System\baWmMVz.exe
  2⤵
  PID:11280
- C:\Windows\System\aCaBMUJ.exe
  C:\Windows\System\aCaBMUJ.exe
  2⤵
  PID:11376
- C:\Windows\System\iMmUHij.exe
  C:\Windows\System\iMmUHij.exe
  2⤵
  PID:11552
- C:\Windows\System\quxprrm.exe
  C:\Windows\System\quxprrm.exe
  2⤵
  PID:11736
- C:\Windows\System\tfVTxuH.exe
  C:\Windows\System\tfVTxuH.exe
  2⤵
  PID:11780
- C:\Windows\System\NzyPnsk.exe
  C:\Windows\System\NzyPnsk.exe
  2⤵
  PID:11960
- C:\Windows\System\IYFnoZw.exe
  C:\Windows\System\IYFnoZw.exe
  2⤵
  PID:12116
- C:\Windows\System\FpRkZJI.exe
  C:\Windows\System\FpRkZJI.exe
  2⤵
  PID:12192
- C:\Windows\System\tUlrDzN.exe
  C:\Windows\System\tUlrDzN.exe
  2⤵
  PID:10944
- C:\Windows\System\pIjgDfX.exe
  C:\Windows\System\pIjgDfX.exe
  2⤵
  PID:11500
- C:\Windows\System\CNNSEwW.exe
  C:\Windows\System\CNNSEwW.exe
  2⤵
  PID:11768
- C:\Windows\System\CarKCND.exe
  C:\Windows\System\CarKCND.exe
  2⤵
  PID:11336
- C:\Windows\System\NoZPktY.exe
  C:\Windows\System\NoZPktY.exe
  2⤵
  PID:12304
- C:\Windows\System\MkLbfpo.exe
  C:\Windows\System\MkLbfpo.exe
  2⤵
  PID:12332
- C:\Windows\System\JpBwNEw.exe
  C:\Windows\System\JpBwNEw.exe
  2⤵
  PID:12360
- C:\Windows\System\WoXpcgT.exe
  C:\Windows\System\WoXpcgT.exe
  2⤵
  PID:12392
- C:\Windows\System\prhQvwd.exe
  C:\Windows\System\prhQvwd.exe
  2⤵
  PID:12420
- C:\Windows\System\FHsKspG.exe
  C:\Windows\System\FHsKspG.exe
  2⤵
  PID:12452
- C:\Windows\System\uJFrtsf.exe
  C:\Windows\System\uJFrtsf.exe
  2⤵
  PID:12468
- C:\Windows\System\gFDNOXs.exe
  C:\Windows\System\gFDNOXs.exe
  2⤵
  PID:12488
- C:\Windows\System\ISREVlN.exe
  C:\Windows\System\ISREVlN.exe
  2⤵
  PID:12508
- C:\Windows\System\eqCTVtO.exe
  C:\Windows\System\eqCTVtO.exe
  2⤵
  PID:12524
- C:\Windows\System\FeWSoFl.exe
  C:\Windows\System\FeWSoFl.exe
  2⤵
  PID:12564
- C:\Windows\System\fZMvJpQ.exe
  C:\Windows\System\fZMvJpQ.exe
  2⤵
  PID:12600
- C:\Windows\System\KHQOlyA.exe
  C:\Windows\System\KHQOlyA.exe
  2⤵
  PID:12624
- C:\Windows\System\PEihjRz.exe
  C:\Windows\System\PEihjRz.exe
  2⤵
  PID:12664
- C:\Windows\System\NmTXxEL.exe
  C:\Windows\System\NmTXxEL.exe
  2⤵
  PID:12700
- C:\Windows\System\MClIXuA.exe
  C:\Windows\System\MClIXuA.exe
  2⤵
  PID:12724
- C:\Windows\System\Tdryqer.exe
  C:\Windows\System\Tdryqer.exe
  2⤵
  PID:12756
- C:\Windows\System\uEUqbEL.exe
  C:\Windows\System\uEUqbEL.exe
  2⤵
  PID:12784
- C:\Windows\System\GkbRvGh.exe
  C:\Windows\System\GkbRvGh.exe
  2⤵
  PID:12804
- C:\Windows\System\omSIXRw.exe
  C:\Windows\System\omSIXRw.exe
  2⤵
  PID:12832
- C:\Windows\System\zGkiioO.exe
  C:\Windows\System\zGkiioO.exe
  2⤵
  PID:12852
- C:\Windows\System\AKEJdIT.exe
  C:\Windows\System\AKEJdIT.exe
  2⤵
  PID:12880
- C:\Windows\System\pfciJuG.exe
  C:\Windows\System\pfciJuG.exe
  2⤵
  PID:12920
- C:\Windows\System\wBmMnqd.exe
  C:\Windows\System\wBmMnqd.exe
  2⤵
  PID:12960
- C:\Windows\System\qkMLitQ.exe
  C:\Windows\System\qkMLitQ.exe
  2⤵
  PID:12976
- C:\Windows\System\aEEkpoe.exe
  C:\Windows\System\aEEkpoe.exe
  2⤵
  PID:12992
- C:\Windows\System\fTrUMpx.exe
  C:\Windows\System\fTrUMpx.exe
  2⤵
  PID:13016
- C:\Windows\System\LcBJtpp.exe
  C:\Windows\System\LcBJtpp.exe
  2⤵
  PID:13044
- C:\Windows\System\hhFVQgy.exe
  C:\Windows\System\hhFVQgy.exe
  2⤵
  PID:13072
- C:\Windows\System\LQLagre.exe
  C:\Windows\System\LQLagre.exe
  2⤵
  PID:13108
- C:\Windows\System\BsORuiN.exe
  C:\Windows\System\BsORuiN.exe
  2⤵
  PID:13144
- C:\Windows\System\UNIQUkc.exe
  C:\Windows\System\UNIQUkc.exe
  2⤵
  PID:13184
- C:\Windows\System\Sgwccro.exe
  C:\Windows\System\Sgwccro.exe
  2⤵
  PID:13212
- C:\Windows\System\RkYjidH.exe
  C:\Windows\System\RkYjidH.exe
  2⤵
  PID:13240
- C:\Windows\System\mzCjqIl.exe
  C:\Windows\System\mzCjqIl.exe
  2⤵
  PID:13260
- C:\Windows\System\WsnIeqN.exe
  C:\Windows\System\WsnIeqN.exe
  2⤵
  PID:13284
- C:\Windows\System\ecGufzC.exe
  C:\Windows\System\ecGufzC.exe
  2⤵
  PID:12200
- C:\Windows\System\KWBWWpb.exe
  C:\Windows\System\KWBWWpb.exe
  2⤵
  PID:12352
- C:\Windows\System\VqRaklr.exe
  C:\Windows\System\VqRaklr.exe
  2⤵
  PID:12428
- C:\Windows\System\xrcSBMl.exe
  C:\Windows\System\xrcSBMl.exe
  2⤵
  PID:12480
- C:\Windows\System\EVkUgKZ.exe
  C:\Windows\System\EVkUgKZ.exe
  2⤵
  PID:12500
- C:\Windows\System\WfzVAte.exe
  C:\Windows\System\WfzVAte.exe
  2⤵
  PID:12552
- C:\Windows\System\BcBTbgg.exe
  C:\Windows\System\BcBTbgg.exe
  2⤵
  PID:12616
- C:\Windows\System\EPRWpFF.exe
  C:\Windows\System\EPRWpFF.exe
  2⤵
  PID:12656
- C:\Windows\System\EnYabDW.exe
  C:\Windows\System\EnYabDW.exe
  2⤵
  PID:12736
- C:\Windows\System\bzQpmlj.exe
  C:\Windows\System\bzQpmlj.exe
  2⤵
  PID:12828
- C:\Windows\System\NMmzVak.exe
  C:\Windows\System\NMmzVak.exe
  2⤵
  PID:12956
- C:\Windows\System\GrdPJKw.exe
  C:\Windows\System\GrdPJKw.exe
  2⤵
  PID:13008
- C:\Windows\System\jIFCOMS.exe
  C:\Windows\System\jIFCOMS.exe
  2⤵
  PID:13028
- C:\Windows\System\LQsdTWD.exe
  C:\Windows\System\LQsdTWD.exe
  2⤵
  PID:13128
- C:\Windows\System\TqkDaqt.exe
  C:\Windows\System\TqkDaqt.exe
  2⤵
  PID:13200
- C:\Windows\System\kulJAUV.exe
  C:\Windows\System\kulJAUV.exe
  2⤵
  PID:11440
- C:\Windows\System\oSrcDSs.exe
  C:\Windows\System\oSrcDSs.exe
  2⤵
  PID:13300
- C:\Windows\System\QokXkfi.exe
  C:\Windows\System\QokXkfi.exe
  2⤵
  PID:12444
- C:\Windows\System\tpWJStk.exe
  C:\Windows\System\tpWJStk.exe
  2⤵
  PID:12680
- C:\Windows\System\pjzlUDN.exe
  C:\Windows\System\pjzlUDN.exe
  2⤵
  PID:12612
- C:\Windows\System\ULikUrZ.exe
  C:\Windows\System\ULikUrZ.exe
  2⤵
  PID:12936
- C:\Windows\System\lLyapvb.exe
  C:\Windows\System\lLyapvb.exe
  2⤵
  PID:12972
- C:\Windows\System\BVlJXBR.exe
  C:\Windows\System\BVlJXBR.exe
  2⤵
  PID:13208
- C:\Windows\System\HoESyqM.exe
  C:\Windows\System\HoESyqM.exe
  2⤵
  PID:13304
- C:\Windows\System\FMxNllf.exe
  C:\Windows\System\FMxNllf.exe
  2⤵
  PID:12404
- C:\Windows\System\nGhxZqe.exe
  C:\Windows\System\nGhxZqe.exe
  2⤵
  PID:13132
- C:\Windows\System\eCUSlwc.exe
  C:\Windows\System\eCUSlwc.exe
  2⤵
  PID:12864
- C:\Windows\System\ykEBNLY.exe
  C:\Windows\System\ykEBNLY.exe
  2⤵
  PID:12484
- C:\Windows\System\cUIOsbr.exe
  C:\Windows\System\cUIOsbr.exe
  2⤵
  PID:13328
- C:\Windows\System\AsEYbyP.exe
  C:\Windows\System\AsEYbyP.exe
  2⤵
  PID:13356
- C:\Windows\System\EmFeQNt.exe
  C:\Windows\System\EmFeQNt.exe
  2⤵
  PID:13372
- C:\Windows\System\IQTkaXB.exe
  C:\Windows\System\IQTkaXB.exe
  2⤵
  PID:13412
- C:\Windows\System\uNfAlsp.exe
  C:\Windows\System\uNfAlsp.exe
  2⤵
  PID:13440
- C:\Windows\System\gGMaoGf.exe
  C:\Windows\System\gGMaoGf.exe
  2⤵
  PID:13468
- C:\Windows\System\DuPeQjl.exe
  C:\Windows\System\DuPeQjl.exe
  2⤵
  PID:13492
- C:\Windows\System\XttQpLi.exe
  C:\Windows\System\XttQpLi.exe
  2⤵
  PID:13512
- C:\Windows\System\cfDwQDj.exe
  C:\Windows\System\cfDwQDj.exe
  2⤵
  PID:13528
- C:\Windows\System\YcNKIJb.exe
  C:\Windows\System\YcNKIJb.exe
  2⤵
  PID:13580
- C:\Windows\System\DDThnWa.exe
  C:\Windows\System\DDThnWa.exe
  2⤵
  PID:13596
- C:\Windows\System\ddfWZMi.exe
  C:\Windows\System\ddfWZMi.exe
  2⤵
  PID:13636
- C:\Windows\System\hYMpmel.exe
  C:\Windows\System\hYMpmel.exe
  2⤵
  PID:13652
- C:\Windows\System\jGNRkWS.exe
  C:\Windows\System\jGNRkWS.exe
  2⤵
  PID:13680
- C:\Windows\System\sngXjpf.exe
  C:\Windows\System\sngXjpf.exe
  2⤵
  PID:13708
- C:\Windows\System\NVzbhRx.exe
  C:\Windows\System\NVzbhRx.exe
  2⤵
  PID:13736
- C:\Windows\System\KJmgosO.exe
  C:\Windows\System\KJmgosO.exe
  2⤵
  PID:13768
- C:\Windows\System\MrsuTSa.exe
  C:\Windows\System\MrsuTSa.exe
  2⤵
  PID:13800
- C:\Windows\System\zTRwjmW.exe
  C:\Windows\System\zTRwjmW.exe
  2⤵
  PID:13832
- C:\Windows\System\adikdDi.exe
  C:\Windows\System\adikdDi.exe
  2⤵
  PID:13848
- C:\Windows\System\fNZNhFX.exe
  C:\Windows\System\fNZNhFX.exe
  2⤵
  PID:13880
- C:\Windows\System\PNMQkdW.exe
  C:\Windows\System\PNMQkdW.exe
  2⤵
  PID:13900
- C:\Windows\System\BVKaFUi.exe
  C:\Windows\System\BVKaFUi.exe
  2⤵
  PID:13932
- C:\Windows\System\VXbMqID.exe
  C:\Windows\System\VXbMqID.exe
  2⤵
  PID:13956
- C:\Windows\System\VYSWauU.exe
  C:\Windows\System\VYSWauU.exe
  2⤵
  PID:13984
- C:\Windows\System\FYkJzLi.exe
  C:\Windows\System\FYkJzLi.exe
  2⤵
  PID:14012
- C:\Windows\System\QbjataY.exe
  C:\Windows\System\QbjataY.exe
  2⤵
  PID:14040
- C:\Windows\System\ScqitUU.exe
  C:\Windows\System\ScqitUU.exe
  2⤵
  PID:14084
- C:\Windows\System\dayjVEY.exe
  C:\Windows\System\dayjVEY.exe
  2⤵
  PID:14112
- C:\Windows\System\CKpZXDm.exe
  C:\Windows\System\CKpZXDm.exe
  2⤵
  PID:14140
- C:\Windows\System\pYLqHtf.exe
  C:\Windows\System\pYLqHtf.exe
  2⤵
  PID:14168
- C:\Windows\System\nrBdUmX.exe
  C:\Windows\System\nrBdUmX.exe
  2⤵
  PID:14196
- C:\Windows\System\PCtvggr.exe
  C:\Windows\System\PCtvggr.exe
  2⤵
  PID:14212
- C:\Windows\System\PwnMUUJ.exe
  C:\Windows\System\PwnMUUJ.exe
  2⤵
  PID:14252
- C:\Windows\System\jrlRBUd.exe
  C:\Windows\System\jrlRBUd.exe
  2⤵
  PID:14268
- C:\Windows\System\TOWhERk.exe
  C:\Windows\System\TOWhERk.exe
  2⤵
  PID:14296
- C:\Windows\System\GlAOFfq.exe
  C:\Windows\System\GlAOFfq.exe
  2⤵
  PID:14324
- C:\Windows\System\TrQOilD.exe
  C:\Windows\System\TrQOilD.exe
  2⤵
  PID:13352
- C:\Windows\System\zzAtQvX.exe
  C:\Windows\System\zzAtQvX.exe
  2⤵
  PID:13396
- C:\Windows\System\SlglrUn.exe
  C:\Windows\System\SlglrUn.exe
  2⤵
  PID:13484
- C:\Windows\System\VtnnrZh.exe
  C:\Windows\System\VtnnrZh.exe
  2⤵
  PID:13572
- C:\Windows\System\QESBMpP.exe
  C:\Windows\System\QESBMpP.exe
  2⤵
  PID:13648
- C:\Windows\System\jBXtLWG.exe
  C:\Windows\System\jBXtLWG.exe
  2⤵
  PID:13700
- C:\Windows\System\roSUHSi.exe
  C:\Windows\System\roSUHSi.exe
  2⤵
  PID:13728
- C:\Windows\System\FSCoSpe.exe
  C:\Windows\System\FSCoSpe.exe
  2⤵
  PID:13816
- C:\Windows\System\TmzIhOH.exe
  C:\Windows\System\TmzIhOH.exe
  2⤵
  PID:13896
- C:\Windows\System\LozHPmo.exe
  C:\Windows\System\LozHPmo.exe
  2⤵
  PID:13944
- C:\Windows\System\HKcMsfX.exe
  C:\Windows\System\HKcMsfX.exe
  2⤵
  PID:13976
- C:\Windows\System\puusYgg.exe
  C:\Windows\System\puusYgg.exe
  2⤵
  PID:14072
- C:\Windows\System\CscsldN.exe
  C:\Windows\System\CscsldN.exe
  2⤵
  PID:14124
- C:\Windows\System\SDdelFe.exe
  C:\Windows\System\SDdelFe.exe
  2⤵
  PID:14188
- C:\Windows\System\yPtzdac.exe
  C:\Windows\System\yPtzdac.exe
  2⤵
  PID:14248
- C:\Windows\System\fLEZavG.exe
  C:\Windows\System\fLEZavG.exe
  2⤵
  PID:12648
- C:\Windows\System\BCwDpDd.exe
  C:\Windows\System\BCwDpDd.exe
  2⤵
  PID:13480
- C:\Windows\System\awSIoRD.exe
  C:\Windows\System\awSIoRD.exe
  2⤵
  PID:13644
- C:\Windows\System\gXaRehw.exe
  C:\Windows\System\gXaRehw.exe
  2⤵
  PID:13824
- C:\Windows\System\wvwZFRT.exe
  C:\Windows\System\wvwZFRT.exe
  2⤵
  PID:13928
- C:\Windows\System\QaykrlP.exe
  C:\Windows\System\QaykrlP.exe
  2⤵
  PID:14008
- C:\Windows\System\OgiNpPa.exe
  C:\Windows\System\OgiNpPa.exe
  2⤵
  PID:14180
- C:\Windows\System\vwDWsXR.exe
  C:\Windows\System\vwDWsXR.exe
  2⤵
  PID:13460
- C:\Windows\System\iKVuMyz.exe
  C:\Windows\System\iKVuMyz.exe
  2⤵
  PID:13920
- C:\Windows\System\ysTGmyY.exe
  C:\Windows\System\ysTGmyY.exe
  2⤵
  PID:14208
- C:\Windows\System\tdpACTr.exe
  C:\Windows\System\tdpACTr.exe
  2⤵
  PID:13820
- C:\Windows\System\dWyJdKN.exe
  C:\Windows\System\dWyJdKN.exe
  2⤵
  PID:14332
- C:\Windows\System\AdDNPGe.exe
  C:\Windows\System\AdDNPGe.exe
  2⤵
  PID:14352
- C:\Windows\System\vJxPfPg.exe
  C:\Windows\System\vJxPfPg.exe
  2⤵
  PID:14372
- C:\Windows\System\sAGdhIl.exe
  C:\Windows\System\sAGdhIl.exe
  2⤵
  PID:14396
- C:\Windows\System\QaFSclx.exe
  C:\Windows\System\QaFSclx.exe
  2⤵
  PID:14420
- C:\Windows\System\CNJubES.exe
  C:\Windows\System\CNJubES.exe
  2⤵
  PID:14436
- C:\Windows\System\cBanDpD.exe
  C:\Windows\System\cBanDpD.exe
  2⤵
  PID:14504
- C:\Windows\System\dIdUGPr.exe
  C:\Windows\System\dIdUGPr.exe
  2⤵
  PID:14532
- C:\Windows\System\KxljSVc.exe
  C:\Windows\System\KxljSVc.exe
  2⤵
  PID:14560
- C:\Windows\System\lkWWRjB.exe
  C:\Windows\System\lkWWRjB.exe
  2⤵
  PID:14580
- C:\Windows\System\NXQHjYk.exe
  C:\Windows\System\NXQHjYk.exe
  2⤵
  PID:14604
- C:\Windows\System\pcpVYJT.exe
  C:\Windows\System\pcpVYJT.exe
  2⤵
  PID:14644
- C:\Windows\System\xGuTUDp.exe
  C:\Windows\System\xGuTUDp.exe
  2⤵
  PID:14672
- C:\Windows\System\CLXOrZv.exe
  C:\Windows\System\CLXOrZv.exe
  2⤵
  PID:14692
- C:\Windows\System\vtxCcsU.exe
  C:\Windows\System\vtxCcsU.exe
  2⤵
  PID:14716
- C:\Windows\System\mOtBVho.exe
  C:\Windows\System\mOtBVho.exe
  2⤵
  PID:14744
- C:\Windows\System\yUWzBKS.exe
  C:\Windows\System\yUWzBKS.exe
  2⤵
  PID:14764
- C:\Windows\System\yiCepcP.exe
  C:\Windows\System\yiCepcP.exe
  2⤵
  PID:14780
- C:\Windows\System\AbeMrHf.exe
  C:\Windows\System\AbeMrHf.exe
  2⤵
  PID:14816
- C:\Windows\System\QeRbtLT.exe
  C:\Windows\System\QeRbtLT.exe
  2⤵
  PID:14856
- C:\Windows\System\HltseVB.exe
  C:\Windows\System\HltseVB.exe
  2⤵
  PID:14888
- C:\Windows\System\ZBFTwmV.exe
  C:\Windows\System\ZBFTwmV.exe
  2⤵
  PID:14920
- C:\Windows\System\CZKfVsR.exe
  C:\Windows\System\CZKfVsR.exe
  2⤵
  PID:14940
- C:\Windows\System\bBPwKNP.exe
  C:\Windows\System\bBPwKNP.exe
  2⤵
  PID:14980
- C:\Windows\System\iJUYsdK.exe
  C:\Windows\System\iJUYsdK.exe
  2⤵
  PID:15000
- C:\Windows\System\hLMtRyz.exe
  C:\Windows\System\hLMtRyz.exe
  2⤵
  PID:15024
- C:\Windows\System\mdosFFf.exe
  C:\Windows\System\mdosFFf.exe
  2⤵
  PID:15044
- C:\Windows\System\ZatwcEu.exe
  C:\Windows\System\ZatwcEu.exe
  2⤵
  PID:15080
- C:\Windows\System\PpXSkjj.exe
  C:\Windows\System\PpXSkjj.exe
  2⤵
  PID:15108
- C:\Windows\System\IkbCuLi.exe
  C:\Windows\System\IkbCuLi.exe
  2⤵
  PID:15148
- C:\Windows\System\cLMIhQi.exe
  C:\Windows\System\cLMIhQi.exe
  2⤵
  PID:15176
- C:\Windows\System\PdcVQQr.exe
  C:\Windows\System\PdcVQQr.exe
  2⤵
  PID:15192
- C:\Windows\System\rxXrBTd.exe
  C:\Windows\System\rxXrBTd.exe
  2⤵
  PID:15228
- C:\Windows\System\pojbFGB.exe
  C:\Windows\System\pojbFGB.exe
  2⤵
  PID:15248
- C:\Windows\System\jypzmTg.exe
  C:\Windows\System\jypzmTg.exe
  2⤵
  PID:15276
- C:\Windows\System\JdNQVFR.exe
  C:\Windows\System\JdNQVFR.exe
  2⤵
  PID:15304
- C:\Windows\System\izwYfHZ.exe
  C:\Windows\System\izwYfHZ.exe
  2⤵
  PID:15328
- C:\Windows\System\drFGgTY.exe
  C:\Windows\System\drFGgTY.exe
  2⤵
  PID:13632
- C:\Windows\System\VIVzrqH.exe
  C:\Windows\System\VIVzrqH.exe
  2⤵
  PID:14368
- C:\Windows\System\neUuVQt.exe
  C:\Windows\System\neUuVQt.exe
  2⤵
  PID:14416
- C:\Windows\System\DrClYAc.exe
  C:\Windows\System\DrClYAc.exe
  2⤵
  PID:14520
- C:\Windows\System\hmOnFBY.exe
  C:\Windows\System\hmOnFBY.exe
  2⤵
  PID:14600
- C:\Windows\System\glYMTsO.exe
  C:\Windows\System\glYMTsO.exe
  2⤵
  PID:14656
- C:\Windows\System\RBpnFSU.exe
  C:\Windows\System\RBpnFSU.exe
  2⤵
  PID:14728
- C:\Windows\System\ITfVRSE.exe
  C:\Windows\System\ITfVRSE.exe
  2⤵
  PID:14792
- C:\Windows\System\fpCwdiy.exe
  C:\Windows\System\fpCwdiy.exe
  2⤵
  PID:14848
- C:\Windows\System\zwgYSZz.exe
  C:\Windows\System\zwgYSZz.exe
  2⤵
  PID:14964
- C:\Windows\System\vuWPNlV.exe
  C:\Windows\System\vuWPNlV.exe
  2⤵
  PID:15012
- C:\Windows\System\AMkCGoB.exe
  C:\Windows\System\AMkCGoB.exe
  2⤵
  PID:15060
- C:\Windows\System\qsFPsXp.exe
  C:\Windows\System\qsFPsXp.exe
  2⤵
  PID:15100
- C:\Windows\System\ztIqfjY.exe
  C:\Windows\System\ztIqfjY.exe
  2⤵
  PID:15132
- C:\Windows\System\NAcCedW.exe
  C:\Windows\System\NAcCedW.exe
  2⤵
  PID:15184
- C:\Windows\System\hWbAHvr.exe
  C:\Windows\System\hWbAHvr.exe
  2⤵
  PID:15260
- C:\Windows\System\duEcasB.exe
  C:\Windows\System\duEcasB.exe
  2⤵
  PID:15348
- C:\Windows\System\DPIyxpL.exe
  C:\Windows\System\DPIyxpL.exe
  2⤵
  PID:14620
- C:\Windows\System\JQVyWoW.exe
  C:\Windows\System\JQVyWoW.exe
  2⤵
  PID:14736
- C:\Windows\System\TyeePQB.exe
  C:\Windows\System\TyeePQB.exe
  2⤵
  PID:14772
- C:\Windows\System\guzGpxs.exe
  C:\Windows\System\guzGpxs.exe
  2⤵
  PID:14928
- C:\Windows\System\kWNYavh.exe
  C:\Windows\System\kWNYavh.exe
  2⤵
  PID:15092
- C:\Windows\System\vQItxuZ.exe
  C:\Windows\System\vQItxuZ.exe
  2⤵
  PID:15168
- C:\Windows\System\SCBaCPn.exe
  C:\Windows\System\SCBaCPn.exe
  2⤵
  PID:15204
- C:\Windows\System\CFXhXHg.exe
  C:\Windows\System\CFXhXHg.exe
  2⤵
  PID:14812
- C:\Windows\System\dFjfsgF.exe
  C:\Windows\System\dFjfsgF.exe
  2⤵
  PID:15336
- C:\Windows\System\KpphrhM.exe
  C:\Windows\System\KpphrhM.exe
  2⤵
  PID:14808
- C:\Windows\System\JANRogE.exe
  C:\Windows\System\JANRogE.exe
  2⤵
  PID:14868
- C:\Windows\System\jtUpzTk.exe
  C:\Windows\System\jtUpzTk.exe
  2⤵
  PID:15384
- C:\Windows\System\cDRWHQR.exe
  C:\Windows\System\cDRWHQR.exe
  2⤵
  PID:15416
- C:\Windows\System\nEZEQgo.exe
  C:\Windows\System\nEZEQgo.exe
  2⤵
  PID:15432
- C:\Windows\System\iBbOPfy.exe
  C:\Windows\System\iBbOPfy.exe
  2⤵
  PID:15448
- C:\Windows\System\IaFeifk.exe
  C:\Windows\System\IaFeifk.exe
  2⤵
  PID:15476
- C:\Windows\System\jQFAbJi.exe
  C:\Windows\System\jQFAbJi.exe
  2⤵
  PID:15524
- C:\Windows\System\GANFRWv.exe
  C:\Windows\System\GANFRWv.exe
  2⤵
  PID:15568
- C:\Windows\System\FxVfRZg.exe
  C:\Windows\System\FxVfRZg.exe
  2⤵
  PID:15584
- C:\Windows\System\yYfrkUN.exe
  C:\Windows\System\yYfrkUN.exe
  2⤵
  PID:15600
- C:\Windows\System\YHaTPTr.exe
  C:\Windows\System\YHaTPTr.exe
  2⤵
  PID:15632
- C:\Windows\System\LwMyPxq.exe
  C:\Windows\System\LwMyPxq.exe
  2⤵
  PID:15648
- C:\Windows\System\fRAngpm.exe
  C:\Windows\System\fRAngpm.exe
  2⤵
  PID:15672
- C:\Windows\System\GIJmgUv.exe
  C:\Windows\System\GIJmgUv.exe
  2⤵
  PID:15704
- C:\Windows\System\CDzQWjM.exe
  C:\Windows\System\CDzQWjM.exe
  2⤵
  PID:15760
- C:\Windows\System\RHoVwUB.exe
  C:\Windows\System\RHoVwUB.exe
  2⤵
  PID:15784
- C:\Windows\System\HjvzjZh.exe
  C:\Windows\System\HjvzjZh.exe
  2⤵
  PID:15812
- C:\Windows\System\llLJMZE.exe
  C:\Windows\System\llLJMZE.exe
  2⤵
  PID:15840
- C:\Windows\System\bBXqDHw.exe
  C:\Windows\System\bBXqDHw.exe
  2⤵
  PID:15868
- C:\Windows\System\SBSzJyP.exe
  C:\Windows\System\SBSzJyP.exe
  2⤵
  PID:15900
- C:\Windows\System\VjQSLyW.exe
  C:\Windows\System\VjQSLyW.exe
  2⤵
  PID:15936
- C:\Windows\System\tGRXjSt.exe
  C:\Windows\System\tGRXjSt.exe
  2⤵
  PID:15952
- C:\Windows\System\yDOcQdX.exe
  C:\Windows\System\yDOcQdX.exe
  2⤵
  PID:15980
- C:\Windows\System\EWHOaat.exe
  C:\Windows\System\EWHOaat.exe
  2⤵
  PID:16020
- C:\Windows\System\cbXNkTX.exe
  C:\Windows\System\cbXNkTX.exe
  2⤵
  PID:16040
- C:\Windows\System\ZyotNGZ.exe
  C:\Windows\System\ZyotNGZ.exe
  2⤵
  PID:16064
- C:\Windows\System\SoLNorl.exe
  C:\Windows\System\SoLNorl.exe
  2⤵
  PID:16092
- C:\Windows\System\ShDyJEz.exe
  C:\Windows\System\ShDyJEz.exe
  2⤵
  PID:16128
- C:\Windows\System\THXxYNA.exe
  C:\Windows\System\THXxYNA.exe
  2⤵
  PID:16148
- C:\Windows\System\VsLpoOh.exe
  C:\Windows\System\VsLpoOh.exe
  2⤵
  PID:16172
- C:\Windows\System\PkFEMfB.exe
  C:\Windows\System\PkFEMfB.exe
  2⤵
  PID:16200
- C:\Windows\System\DUcUivE.exe
  C:\Windows\System\DUcUivE.exe
  2⤵
  PID:16232
- C:\Windows\System\UqfOJxv.exe
  C:\Windows\System\UqfOJxv.exe
  2⤵
  PID:16260
- C:\Windows\System\iebDtFf.exe
  C:\Windows\System\iebDtFf.exe
  2⤵
  PID:16288
- C:\Windows\System\hZrtpNk.exe
  C:\Windows\System\hZrtpNk.exe
  2⤵
  PID:16304
- C:\Windows\System\acCkDZv.exe
  C:\Windows\System\acCkDZv.exe
  2⤵
  PID:16340
- C:\Windows\System\LVyNFBC.exe
  C:\Windows\System\LVyNFBC.exe
  2⤵
  PID:14700
- C:\Windows\System\yzBoKWT.exe
  C:\Windows\System\yzBoKWT.exe
  2⤵
  PID:15400
- C:\Windows\System\GpOgvtd.exe
  C:\Windows\System\GpOgvtd.exe
  2⤵
  PID:15512
- C:\Windows\System\wLayaEv.exe
  C:\Windows\System\wLayaEv.exe
  2⤵
  PID:15464
- C:\Windows\System\pghpiTw.exe
  C:\Windows\System\pghpiTw.exe
  2⤵
  PID:15612
- C:\Windows\System\GCTzWjO.exe
  C:\Windows\System\GCTzWjO.exe
  2⤵
  PID:15644
- C:\Windows\System\ydFZvGd.exe
  C:\Windows\System\ydFZvGd.exe
  2⤵
  PID:15716
- C:\Windows\System\HBJdmnN.exe
  C:\Windows\System\HBJdmnN.exe
  2⤵
  PID:15772
- C:\Windows\System\PvOYKCv.exe
  C:\Windows\System\PvOYKCv.exe
  2⤵
  PID:15856
- C:\Windows\System\bDSjwvw.exe
  C:\Windows\System\bDSjwvw.exe
  2⤵
  PID:15972
- C:\Windows\System\aaiYtSR.exe
  C:\Windows\System\aaiYtSR.exe
  2⤵
  PID:16016
- C:\Windows\System\uFNNgdI.exe
  C:\Windows\System\uFNNgdI.exe
  2⤵
  PID:16088
- C:\Windows\System\BPMJRoW.exe
  C:\Windows\System\BPMJRoW.exe
  2⤵
  PID:16184
- C:\Windows\System\IOpCinF.exe
  C:\Windows\System\IOpCinF.exe
  2⤵
  PID:16244
- C:\Windows\System\jUnDyCY.exe
  C:\Windows\System\jUnDyCY.exe
  2⤵
  PID:16316
- C:\Windows\System\RwHHtyi.exe
  C:\Windows\System\RwHHtyi.exe
  2⤵
  PID:15376
- C:\Windows\System\DHCngsQ.exe
  C:\Windows\System\DHCngsQ.exe
  2⤵
  PID:15460
- C:\Windows\System\sWzFVQN.exe
  C:\Windows\System\sWzFVQN.exe
  2⤵
  PID:15696
- C:\Windows\System\EjGrXAx.exe
  C:\Windows\System\EjGrXAx.exe
  2⤵
  PID:15888
- C:\Windows\System\rrnPFeH.exe
  C:\Windows\System\rrnPFeH.exe
  2⤵
  PID:15948
- C:\Windows\System\rGnzeVq.exe
  C:\Windows\System\rGnzeVq.exe
  2⤵
  PID:16216
- C:\Windows\System\IxTxCug.exe
  C:\Windows\System\IxTxCug.exe
  2⤵
  PID:15424
- C:\Windows\System\XwwXkRc.exe
  C:\Windows\System\XwwXkRc.exe
  2⤵
  PID:15664
- C:\Windows\System\UPruHWU.exe
  C:\Windows\System\UPruHWU.exe
  2⤵
  PID:16228
- C:\Windows\System\zVzLwMi.exe
  C:\Windows\System\zVzLwMi.exe
  2⤵
  PID:16360
- C:\Windows\System\YCJDHkO.exe
  C:\Windows\System\YCJDHkO.exe
  2⤵
  PID:15072
- C:\Windows\System\sWkuVUB.exe
  C:\Windows\System\sWkuVUB.exe
  2⤵
  PID:16412
- C:\Windows\System\ZKtFAsd.exe
  C:\Windows\System\ZKtFAsd.exe
  2⤵
  PID:16440
- C:\Windows\System\ytByRjP.exe
  C:\Windows\System\ytByRjP.exe
  2⤵
  PID:16460
- C:\Windows\System\ToWGadF.exe
  C:\Windows\System\ToWGadF.exe
  2⤵
  PID:16484
- C:\Windows\System\fcjfIQI.exe
  C:\Windows\System\fcjfIQI.exe
  2⤵
  PID:16512
- C:\Windows\System\eEhDiKu.exe
  C:\Windows\System\eEhDiKu.exe
  2⤵
  PID:16540
- C:\Windows\System\fmIZptk.exe
  C:\Windows\System\fmIZptk.exe
  2⤵
  PID:16568
- C:\Windows\System\XRJuUuA.exe
  C:\Windows\System\XRJuUuA.exe
  2⤵
  PID:16596
- C:\Windows\System\rHJJinl.exe
  C:\Windows\System\rHJJinl.exe
  2⤵
  PID:16636
- C:\Windows\System\ZKVELYE.exe
  C:\Windows\System\ZKVELYE.exe
  2⤵
  PID:16656
- C:\Windows\System\RgzoKus.exe
  C:\Windows\System\RgzoKus.exe
  2⤵
  PID:16692
- C:\Windows\System\XnkGBLV.exe
  C:\Windows\System\XnkGBLV.exe
  2⤵
  PID:16716
- C:\Windows\System\xlfyfGj.exe
  C:\Windows\System\xlfyfGj.exe
  2⤵
  PID:16736
- C:\Windows\System\JEtLpvc.exe
  C:\Windows\System\JEtLpvc.exe
  2⤵
  PID:16792
- C:\Windows\System\PahmAXb.exe
  C:\Windows\System\PahmAXb.exe
  2⤵
  PID:16812
- C:\Windows\System\rGakKnz.exe
  C:\Windows\System\rGakKnz.exe
  2⤵
  PID:16836
- C:\Windows\System\GBBzGcU.exe
  C:\Windows\System\GBBzGcU.exe
  2⤵
  PID:16856
- C:\Windows\System\OFqFSrQ.exe
  C:\Windows\System\OFqFSrQ.exe
  2⤵
  PID:16896
- C:\Windows\System\MRkggtY.exe
  C:\Windows\System\MRkggtY.exe
  2⤵
  PID:16936
- C:\Windows\System\ppRZucM.exe
  C:\Windows\System\ppRZucM.exe
  2⤵
  PID:16980
- C:\Windows\System\jxENErn.exe
  C:\Windows\System\jxENErn.exe
  2⤵
  PID:17012
- C:\Windows\System\XXgADeC.exe
  C:\Windows\System\XXgADeC.exe
  2⤵
  PID:17032

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AfwEiFr.exe

Filesize
1.7MB

MD5
5100b3918a0ea2af7393fbf65d418c22

SHA1
7da4995159c8db5d4567275272c54864960b60d9

SHA256
3c45d16f507b7413b933a7402cc704c99157ab82d4cc7db1db57dce9c1597a2a

SHA512
8452c94f7e689907ef5b6da1038ee82eefcdbaca229601a236ddd9018e59fb766b7e8bdc0dd839cc99864068f3bc0f9321d20d74af60601e5e0816f001007717

Download Submit
C:\Windows\System\GzfnAxi.exe

Filesize
1.7MB

MD5
97e6758a291d53f7ad3d4f364cbcc3e1

SHA1
4bc4bcc2fc200415d7673f3edbc0b17dabd55f23

SHA256
670d38eab355e9982c5058549ae2902d7be9e87f8c2b26231f7a9e01a108b078

SHA512
1d2a9660f225e2bbd9911ef6d199c0056292ad408c443add198335f5745b312494e31eba208d16ddb646c2c4937c4a270bf1c9c7940835506a5ded9c6b336f9b

Download Submit
C:\Windows\System\HhodqZD.exe

Filesize
1.7MB

MD5
c563aec299d3f9bbbe46d3d88e500502

SHA1
2a10c28a94b2147c08d2cdd8a2c3eedba10ed399

SHA256
e1ee761b83c00a20043193b6480d8bbadb7a105aedac0a9574f17f4ff6dd72b7

SHA512
93284cf50881df1b3bd707f56b8645426dd3de90bacfe1e86cab351fafb9e435b1081860e4f52c802057c75763ebeecea21b3c141bcd246d325af244c506fde7

Download Submit
C:\Windows\System\JrhDfFp.exe

Filesize
1.7MB

MD5
6dd46d09b38dc7eb114e7a79ee6e28c4

SHA1
d655a42a659f49032da2292546e11d1f211e93bc

SHA256
c89562a5e8f72fae9743719cf96768e2481c7b7f1573abf601c7e1dea2922f9d

SHA512
0497833ef2853b7b7bc5dd9ba8542c38ef05014be9cfad8b60af0c763d60f63248886a4c51aa18234c07bb5bae920c5aa9ed47ab20fdd685a8dff3ae47eff65e

Download Submit
C:\Windows\System\MLhjbpS.exe

Filesize
1.7MB

MD5
06f2ff8e6580460e0b5d1b575d37e489

SHA1
d47eda617b1774a7b0087093ea664f5adcbd48e9

SHA256
bf26499754eeb8f11492cd4b3b04cef4361b59cb5c1fe87c2457d83d1b1be3bf

SHA512
30fdf0a8bb4049ab4225e16af70b260eb9daf14ce64afa32ad26958db33ceada1985d9f734810afb0e48a2fed68636f1b2f556f408643f01aad67ba8f9161739

Download Submit
C:\Windows\System\NkVRuDT.exe

Filesize
1.7MB

MD5
c4aafd113b84334eaac1487fa504ccb6

SHA1
c570d76b238eee2b3d67de9e0d25232c08b1944b

SHA256
355f698fb0b1a94cfe278599f63be3eafcc5508d1088014d94995c107079704f

SHA512
01bb33873d5b8d643f1ef229875d086321b0d25430bbedb5f49e048d9654890dcbf90d4c4aa9eb096b7b49ef50707eb4e21425e7c3d84f5405d8c0c31b202fcd

Download Submit
C:\Windows\System\TeeAsfp.exe

Filesize
1.7MB

MD5
a4a5adbc0917a7b8ba59ab0f83a0b49a

SHA1
2a6656038d4504eaa1e5d881950002e1f60092d7

SHA256
a7f83fa92d05ed0f26b13828ea6e2e2ca1bc8503604eebb44658ac575358c97e

SHA512
363f6b5a20aea301c54e812d1877f9f8a7f530bfed4f5507195348cb17502c02d0ec63af923dd0b5b01933ff09057290fec2223b43330c0615d614b9268d8405

Download Submit
C:\Windows\System\UYsyhZj.exe

Filesize
1.7MB

MD5
2ad5b937eba2b1eaeb6750c9299003cc

SHA1
f8b7c80ca41c40cbca2f61672b4d2c31908e0926

SHA256
e0a0743e58d01f0f54bfc44df2e2f8110748fcbf798bcb7601107c0a288b5ec6

SHA512
1d14f4bb033aafcdeb759d9b5c881f798a321d4034e85bffc4a11e2e053f9a786da7c4b992226f927789516cec5ea6e9287c5aae328e29783a9cb358257b8bef

Download Submit
C:\Windows\System\UoaBRTu.exe

Filesize
1.7MB

MD5
db7ba053bb0b740b7a5c219a72dbad39

SHA1
a963832e2aab1cbbc4ca110c78420d895039d3cd

SHA256
4a8b42af57c5c0ddb6dee7c3892b5aeb358789935592d7c626a0f4bb9384eb6f

SHA512
ee2d2ac46f8e5cef6da66330b5071d0379f77dfa8cf7dbba0dc829f85b4dc90a9bfc106c3768ad8f9f66d25a5a3730a8556a680f09bc63c815fc3ab31f703597

Download Submit
C:\Windows\System\UsUSdCv.exe

Filesize
1.7MB

MD5
4ca1083318367365c0c299f25858b53a

SHA1
89caa4e6adf0d499b85e1edcca2e1c0e5273fd0d

SHA256
a37fd69ca6b65b525c95b7c8c05cc597c4cd542b9bb292b6d305cc2fb1528f6e

SHA512
9529f8755417a282b444cb7cd6ebfa4d2ea93bc2527bcabfce3d363c51277a4d7f6e5877bda4d05c84afde0466ef95f179f13406a04e16c7a7770c83a5f78e71

Download Submit
C:\Windows\System\YOMjshD.exe

Filesize
1.7MB

MD5
4831f2e0da37818ba465f87836baa12f

SHA1
fa5bfd6c8fa3d1f7eb1e0999ed9e0c7f044a68d3

SHA256
2d615ec39b09422374cd89c659dce8e8c90740484374037d7ab5fbe5fba57b11

SHA512
d764a8d1adc72e583521972947be8fc8e4da494dd9e447420b8e2c115cd6e7d7a3d909d4aad1ea6737a3af1e1e3c9a3a121ecf8bb9d3513bfead2d63bd14a7ed

Download Submit
C:\Windows\System\YOefdcS.exe

Filesize
1.7MB

MD5
7a3d0ac09a3f28fe55b4c3d861467c74

SHA1
7ece86d03fdb52ed5c7ddcd9b6741d9163fa57ca

SHA256
c24297ea9351480b9ea40e5a3cfbd51944d71f3d9ef0c3dceb3f4ce3e7ce6bce

SHA512
0e3166909e55ea0e889138eaddaf5ed14b6c2c928108dcd8f22d500d6d167b513cb41ca98c5f875446eddff4dbbcae238206850af6ae6d3952f847237affadfd

Download Submit
C:\Windows\System\YqRVyhG.exe

Filesize
1.7MB

MD5
5dd3fb6c849fab5807c81405a0931b84

SHA1
38a0e9f5be34d61d4b3092047827d19617db227a

SHA256
ffc91eee9d43e4380802c571e3c7e972a8e3a3c66a1573e4b6935de585277cf3

SHA512
40135c6b97e252aa1c8dfbc399d0fbc9f4f211e75968c49039976f8c425b2e45a66ac2ee57fc57b16a389d093de380fadca4bb2eab78387322984a47c6ebec83

Download Submit
C:\Windows\System\byIPWhQ.exe

Filesize
1.7MB

MD5
2a58b3b61040396564cb95d2c62dfacb

SHA1
7c9b01a27be07b6343e6e790032aa8c21e35ffb9

SHA256
e6ddd041af79d640e735ec74f0c9ecdf8bb68a1d5c9df42b5aedc8a425ddb92e

SHA512
50029967089702b70c59e7ef05ea194c4a5bc7a9952cdf79f993e38597f5025fc6875efff671c2323d090a1f0ad59d82ad131c4d3b8e39c20f5ae686eaa4708b

Download Submit
C:\Windows\System\dRWJatB.exe

Filesize
1.7MB

MD5
c848162c5e6f8198dcf4033359c654ba

SHA1
c2d603a80c2a4c744445e11b7a314ecd09e66841

SHA256
9a717be01718648ffb261e8fc81b0a74fc2a0909e84d18fe9a2e57626cac58ee

SHA512
06d4a482627391662c71f4adbf1435f10aff0d4004db3e273135d2f7a1f04dc1933ca3797bb349f6a400bf3c700be2dc09e5b8872a9b39337ea7b24ae788e40a

Download Submit
C:\Windows\System\dXdmeuu.exe

Filesize
1.7MB

MD5
7695edb6f85567abf79b2224f5167552

SHA1
2660ebc183f79ecb955aa70410948b11623506ac

SHA256
41f302aa7e9c7311584bbcb1467e98971f50b0334ccc94ed1ff882a4d29c87f5

SHA512
e443250019d1d8589f1d77325ebc98bb5644510bca9a2aeac5fc9dd0df9a0fb56d7c6b1db50d9547e2d1274b6281d6a6b43a4b58186a35df9f5d5e7423ad6c62

Download Submit
C:\Windows\System\dibClQl.exe

Filesize
1.7MB

MD5
e83f55ae665e428ebcf9895d97cf4928

SHA1
cefba763069ec39124cc8bff114144064c836edd

SHA256
408aba8c07a441105516d9e7775a2b72914b01b6daa9dd108340730a030d6f82

SHA512
352083b334702a8354b5fb9bdfaac72eb96d9aa6c3f0c94720177cd5347a0f3b669fc5e545ce489e6ef7fc8b89a744fe34939c3b07027c15644bdd67291481ce

Download Submit
C:\Windows\System\eBiYvHw.exe

Filesize
1.7MB

MD5
aa93e04af6dbfcb5b0c813904b39e57d

SHA1
a6a6ef5f360115a2c28e13ae5a35e9a63a02646b

SHA256
5274886c70ff061e5ee13a04b586549fc16a364f4d5998614480b5c7521f2d5a

SHA512
a9c4dfa1f9ab0664511f3705f5538687537f0d598e84dd3c3b40c86e64990e7fca0b1d66251be1cfe1c92e83b88a405d7d1219f9cfe34e7920a7c8a6840fdfa1

Download Submit
C:\Windows\System\eJmgniw.exe

Filesize
1.7MB

MD5
ad9c0f607d16eca3053af3b1e5ee2120

SHA1
658358d003ad2537faec4d2e7d409aad392d3f94

SHA256
ee54ac85f39375bc91bc6fc4807ff9520f72c5020c8bc584ba2743fc36d1d8a4

SHA512
e89ac962b21c318d42832fce9ada01e3139f62f908c38618dccb0b7ec53dca2ddde7af093cc12939e893b5467ba0e29deb4fe70906353e0d0a4cd1033220db8f

Download Submit
C:\Windows\System\iycORAl.exe

Filesize
1.7MB

MD5
ddd5372b8b111dfffb19d485e8a89500

SHA1
463499bf1d12fe32e3c4ec58080a7da5458aecf8

SHA256
2ac2ac20c286b9a25d16425caf1b0559c89752c7a8e042b50ec6c8656f0f5ed3

SHA512
46663bc5917711c1c3b0f2a9e0111ebe47cbcfaf3da4b2e4ac2c24155fae9687a81322b4e9e77b36ce0be9b3d9d5e7b965f9c1157e1bb53bd9943040207cad58

Download Submit
C:\Windows\System\jRurgqe.exe

Filesize
1.7MB

MD5
f8b4d03c69e2e770e3e9123ee0acf7d4

SHA1
97810ef6828b064c571c904cb6e0521c615479af

SHA256
2e34278e2882507d1cb2a5d674c7488d5259695280ed377120675979a249d338

SHA512
3076be2a021b764cfde4d5abaa99e188a1fc295b7218b5dfd13e891b46302e550eedd5eb28285f259bab3efa2d2a0f8738d7068e67b3e83c05a49e9d85f57d9c

Download Submit
C:\Windows\System\kUJnNBm.exe

Filesize
1.7MB

MD5
9826ec87eb201b7236c16fa34447a1dc

SHA1
7c29d2516389e7855f2c0bd4d9616ccea89fb802

SHA256
42e203e58a420397223a29516a2dfab71e185c51bb8e6b6c664e9ac1c5804b8e

SHA512
b2a3a08fb9e6a3b05b9739538395848800dbcd6102f7128a27a3b80b359db3c3ed80b149f790d43a953ce3bc1e6e4d61db8094c6aeb40edae2326d97941e35ef

Download Submit
C:\Windows\System\luTiOgH.exe

Filesize
1.7MB

MD5
394ab0249be2b212b402c0bd90e7e835

SHA1
e3033b8db0a6441ffe948176f3930c3edefb572d

SHA256
96c62ca278616ec7e7ec38e96535552fe7950f3fe150e766b8d998f40ea93d5e

SHA512
abaa6e5b867eba076afe756e8470e128656c24a5af8556337e90463d168b01415943977eed69429aec3dd5a46020d2a7f404d346609e1d498bbcf94ffc68a8e3

Download Submit
C:\Windows\System\muMfCcI.exe

Filesize
1.7MB

MD5
09f02f8cbcb8bd6b6cff84ec85ee7d0c

SHA1
8bacb5f98b77ed57bdedb1a820ac9f65ee090893

SHA256
9cac1cdb9d3c3afc06f9ef97380af887f77e209032c69c1e8f543fde11991bf6

SHA512
f7e8f59b84f3db9c59a38ada96abe8015602dda07f8948a0056ac4ddfcebaab522f2854c31e99c17f4bf90e47f6335acd84aaf06c48b48bf36b0712f42e1e43a

Download Submit
C:\Windows\System\oZBnCIT.exe

Filesize
1.7MB

MD5
66701720a250512176fd58626339dd11

SHA1
646c199861223e352eaae0e1f4df07f32204b781

SHA256
36e5c15fa36e74b108dddda22162b572344bd3f70bad682fca30df1fa18c0951

SHA512
e1f880828f05eed7899766984bc0e8c33719b2973310c3ad39915158bd8abfc15cdf9056164daa537362a639e310945f161aaff26866407c38dbdcc4532b96d9

Download Submit
C:\Windows\System\olmoiEy.exe

Filesize
1.7MB

MD5
184c82095e786ec4b06cf56987238d01

SHA1
dd951eabbeeb16b7867e7cf9a142d43788a92199

SHA256
c653ee0d35be73c633836610fb1aabd5c93cf381604291b73bb1d253938fd5b5

SHA512
bfdc729ce26cfb735544f06d793c8fd63c005a1fb7af58add43f59b6119995f1196892cecb32741886606089663b676b428d10948b71d11b6c9c012a895b5cf1

Download Submit
C:\Windows\System\sqneZJw.exe

Filesize
1.7MB

MD5
43ed4366dd9af669406b19ca9e127edb

SHA1
c8b9b722aff8824c676b83ff1fe713208f1359a1

SHA256
4c0fdd5b0c16914753dbfa2acd3498323fb5f13b0bd3170ae8b630a5608aad4b

SHA512
91fbedf8589a77e379cdb7a562a5cb6e92bfba09ab5b80b5bf545ebe21322d11cca5260628f0344264182e15640e37b50985e24d68beda0da466a434091fe4d4

Download Submit
C:\Windows\System\vldPELO.exe

Filesize
1.7MB

MD5
2088a25517d38c00972665f6c2ac2816

SHA1
68ee7dfcdbd1522d142809894a095beb70b73a7c

SHA256
c098bd992b63635e05268399378768ed32cffbd493c187e0507942129e4eadfd

SHA512
0c4a29d7ce27a41389fa83cae569dbec8d0f851bba3bc042c4d0cab1e859b1c3cfec76ea8c053ee247f0ba9e91b1b07015a253d00e8a8f6232d233ede9ee49ec

Download Submit
C:\Windows\System\wjHbCvl.exe

Filesize
1.7MB

MD5
9d4b30e3ff03762bc4f872af7a3643ae

SHA1
b6cdab3c49dd8eaa02aa6be6d5ceba2e45b1f04f

SHA256
56d06f6927ae31859bbcf5a47210cf819fd848e7bff79394b76d93b920e1a940

SHA512
3765c08f72a4fadc66589884fa8ddefde484fb977d22ede4973fc56c1657d5486b043d798960eea8a0e345652c105825ad3af1745379492761a4593a41ee8b28

Download Submit
C:\Windows\System\wtKVBeL.exe

Filesize
1.7MB

MD5
56fac5b743ebcb9b8bf0390992b747f2

SHA1
d7ad0c3330321acc83291dba47b4482485a4bb98

SHA256
fad00cadd4277820c0864db6c1d966a322cc1ce37f33cf87a1971b0b8b9ca1b6

SHA512
e1914c0b324b88632480d83e6053265183187cf663f3abdca947c1d0a1ffac6924906660eb8e0ae093fa88aafc680d254c12ed059335bb222066756e9b1dd247

Download Submit
C:\Windows\System\xVWWgPy.exe

Filesize
1.7MB

MD5
229442ae26f9de6edaa1aad632fe6bf4

SHA1
6c581ad59f99c4d8ad37d9f86ef4ca63c63434f5

SHA256
eef5e2385f517a9f198214c9d5e771201e54afa9c57f1afa6bd72b792df4c417

SHA512
d9958205587d2b8e4221139b5287210c62b1e1ebc62301f41f7a8b52ae6cb6532e3a2be307cd2e1f851bd99dea6e9937784914fba139eac078ba5598a5bf0f7a

Download Submit
C:\Windows\System\yhbOajm.exe

Filesize
1.7MB

MD5
0aca4806e02c61947ea810e43cbf6399

SHA1
821ee79f894d352f4f37c056916cde57e3887f79

SHA256
9f1a8d28378c40857edd2626310bfb42f91e03ae7b81efde1104d53182c2898a

SHA512
94191c1742f29ec1cd9daf32781a3390b1cb3e6105046fe35c35a14b665173c8102c6a7d2f62f4703d5a69ff3a06baf3934d08c2064dd91e148facf665e58035

Download Submit
C:\Windows\System\ylgsHYV.exe

Filesize
1.7MB

MD5
f1701f53792298c1ced5f0ccb984b5ec

SHA1
a6ada5e5a966faee1edca5a8e378e0d65b429664

SHA256
cfd3bc4e721eda35b25abaf31e8bc797fca50c2ecb8c5a4c3d962aa71b1bb3de

SHA512
bf18e2df75dd7a55c6d39dfb110a18e79c73bca0be1aab7dae854dbf715a2a2c318ee9ac99ff50430ae53d04d5b03208bca7dd88ffe60aad120c55e78f97ca59

Download Submit
memory/2112-0-0x000001B2CB130000-0x000001B2CB140000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads