xmrig | adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd

Analysis

max time kernel
126s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
Size

1.3MB
MD5

a68a46ff69b0d6a7be9fa616940eee8b
SHA1

534d08c1593726c9d89c9f73d043c18ce346a8c6
SHA256

adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd
SHA512

e01fc4ba42a1bdac48bc9945d2f2be508dad508596f72cbfb61adf711588c68a3c81733b26321211af958914e3c2c919f978a1467b806ebae9037f8139b30e05
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p904aohckF:GezaTF8FcNkNdfE0pZ9ozttwIRxGDKZR

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c9f-4.dat	xmrig
behavioral2/files/0x000a000000023ca9-10.dat	xmrig
behavioral2/files/0x0007000000023cad-14.dat	xmrig
behavioral2/files/0x0007000000023cae-22.dat	xmrig
behavioral2/files/0x0007000000023cb2-39.dat	xmrig
behavioral2/files/0x0007000000023cb6-65.dat	xmrig
behavioral2/files/0x0007000000023cb9-80.dat	xmrig
behavioral2/files/0x0007000000023cc1-112.dat	xmrig
behavioral2/files/0x0007000000023cc4-135.dat	xmrig
behavioral2/files/0x0007000000023cc9-160.dat	xmrig
behavioral2/files/0x0007000000023ccb-162.dat	xmrig
behavioral2/files/0x0007000000023cca-157.dat	xmrig
behavioral2/files/0x0007000000023cc8-155.dat	xmrig
behavioral2/files/0x0007000000023cc7-150.dat	xmrig
behavioral2/files/0x0007000000023cc6-145.dat	xmrig
behavioral2/files/0x0007000000023cc5-140.dat	xmrig
behavioral2/files/0x0007000000023cc3-130.dat	xmrig
behavioral2/files/0x0007000000023cc2-125.dat	xmrig
behavioral2/files/0x0007000000023cc0-115.dat	xmrig
behavioral2/files/0x0007000000023cbf-110.dat	xmrig
behavioral2/files/0x0007000000023cbe-105.dat	xmrig
behavioral2/files/0x0007000000023cbd-100.dat	xmrig
behavioral2/files/0x0007000000023cbc-95.dat	xmrig
behavioral2/files/0x0007000000023cbb-90.dat	xmrig
behavioral2/files/0x0007000000023cba-85.dat	xmrig
behavioral2/files/0x0007000000023cb8-75.dat	xmrig
behavioral2/files/0x0007000000023cb7-70.dat	xmrig
behavioral2/files/0x0007000000023cb5-60.dat	xmrig
behavioral2/files/0x0007000000023cb4-55.dat	xmrig
behavioral2/files/0x0007000000023cb3-50.dat	xmrig
behavioral2/files/0x0007000000023cb1-37.dat	xmrig
behavioral2/files/0x0007000000023cb0-33.dat	xmrig
behavioral2/files/0x0007000000023caf-25.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
844	mgvNWjw.exe
808	VYgQprq.exe
2112	PNiitAU.exe
1944	eOSwktc.exe
3332	BIMsaJz.exe
4560	IptDOFF.exe
3636	KFkCQkj.exe
3404	thDdQfC.exe
1648	XzmkQDs.exe
2248	QrHMJVO.exe
4924	SVBPOLi.exe
3680	hzhqECi.exe
3516	zraEJsj.exe
1712	RUslZPm.exe
5104	GIvrCTD.exe
2704	aqYmFaH.exe
4972	TamDpcm.exe
4604	CsJxcty.exe
2324	SGXLyNw.exe
3904	jxVIVRz.exe
5056	BbJzniM.exe
512	KMntcPk.exe
2868	XRzhJyX.exe
4288	UDadFpH.exe
3908	SNjDxAk.exe
3652	YOFNweb.exe
4756	mNqEvJw.exe
3532	kEfoSkF.exe
3316	AvrqVIv.exe
4984	wlbcRyI.exe
3860	sIKhMpZ.exe
1696	eqLeyht.exe
1352	CCeFZIx.exe
680	cWtbVbr.exe
736	CZrQBCw.exe
4848	eqvxzOF.exe
4304	uguVwXI.exe
1588	hHRFLaK.exe
5020	kuHJlaG.exe
1576	mzDdqoe.exe
5112	pSAvRDD.exe
4204	SUrcnhZ.exe
640	fxxJHtI.exe
1016	FQncpah.exe
624	sXxiCWJ.exe
5016	HtUMRUl.exe
1924	hBUPwmW.exe
2584	PQgXwMC.exe
3376	FgaYXNs.exe
1704	YpuLlVz.exe
4152	LktLJsg.exe
2596	SlAHZLp.exe
2880	uhKuWGw.exe
2968	lxwMerd.exe
644	kEYxGKu.exe
4508	JVTMobB.exe
4276	xBBDFUJ.exe
920	njnJRfI.exe
4344	mZgnkLE.exe
2464	mltANkj.exe
4568	anbgsak.exe
3952	mcUqqZv.exe
1624	lIADeTn.exe
4500	ymbYtpb.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\krXGJle.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\jWDgqob.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\QhRLpNo.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\dVULAaX.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\YgdVHZU.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\oiradEZ.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\FsAItsG.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\EPAAnQS.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\NrsHdMB.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\Folivws.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\GQiXlhm.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\WqBLGCv.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\WDQmsKl.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\ThGzryg.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\PlxMfuq.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\nVgfRDk.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\rMsyaRt.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\gzJhHJF.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\mSTpzEa.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\tKrRGws.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\WhjKyqk.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\KMntcPk.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\JVTMobB.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\VMGXTJT.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\njNBxKQ.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\EzQviCo.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\UIcgmJo.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\dXMoYRl.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\lxwMerd.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\xvncllV.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\FcELXLW.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\sIKhMpZ.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\sbsGWRc.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\xwspKkv.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\WFELGiN.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\dgvzLWe.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\BcJxQVH.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\vuUItjz.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\kuHJlaG.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\sJiKLXF.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\fsUOHsu.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\pHMYrEt.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\ugzUApr.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\jXUohkY.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\FHUnwjc.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\SVBPOLi.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\uhKuWGw.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\JKVlEli.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\clfUMOf.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\tATCVSM.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\RUslZPm.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\FdmZZEh.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\jtirrwz.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\kEfoSkF.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\HpTIdSC.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\iHbvzzj.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\lCJZVmD.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\WnXjlSk.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\KnBQyQW.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\AHfDzBo.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\vchrNWv.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\cLuGvqn.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\ePOhnKv.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
File created	C:\Windows\System\UtDZSId.exe	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17028	dwm.exe
Token: SeChangeNotifyPrivilege	17028	dwm.exe
Token: 33	17028	dwm.exe
Token: SeIncBasePriorityPrivilege	17028	dwm.exe
Token: SeShutdownPrivilege	17028	dwm.exe
Token: SeCreatePagefilePrivilege	17028	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 844	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	84
PID 3200 wrote to memory of 844	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	84
PID 3200 wrote to memory of 808	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	85
PID 3200 wrote to memory of 808	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	85
PID 3200 wrote to memory of 2112	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	86
PID 3200 wrote to memory of 2112	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	86
PID 3200 wrote to memory of 1944	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	87
PID 3200 wrote to memory of 1944	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	87
PID 3200 wrote to memory of 3332	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	88
PID 3200 wrote to memory of 3332	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	88
PID 3200 wrote to memory of 4560	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	89
PID 3200 wrote to memory of 4560	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	89
PID 3200 wrote to memory of 3636	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	90
PID 3200 wrote to memory of 3636	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	90
PID 3200 wrote to memory of 3404	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	91
PID 3200 wrote to memory of 3404	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	91
PID 3200 wrote to memory of 1648	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	92
PID 3200 wrote to memory of 1648	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	92
PID 3200 wrote to memory of 2248	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	93
PID 3200 wrote to memory of 2248	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	93
PID 3200 wrote to memory of 4924	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	94
PID 3200 wrote to memory of 4924	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	94
PID 3200 wrote to memory of 3680	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	95
PID 3200 wrote to memory of 3680	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	95
PID 3200 wrote to memory of 3516	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	96
PID 3200 wrote to memory of 3516	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	96
PID 3200 wrote to memory of 1712	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	97
PID 3200 wrote to memory of 1712	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	97
PID 3200 wrote to memory of 5104	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	98
PID 3200 wrote to memory of 5104	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	98
PID 3200 wrote to memory of 2704	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	99
PID 3200 wrote to memory of 2704	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	99
PID 3200 wrote to memory of 4972	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	100
PID 3200 wrote to memory of 4972	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	100
PID 3200 wrote to memory of 4604	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	101
PID 3200 wrote to memory of 4604	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	101
PID 3200 wrote to memory of 2324	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	102
PID 3200 wrote to memory of 2324	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	102
PID 3200 wrote to memory of 3904	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	103
PID 3200 wrote to memory of 3904	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	103
PID 3200 wrote to memory of 5056	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	104
PID 3200 wrote to memory of 5056	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	104
PID 3200 wrote to memory of 512	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	105
PID 3200 wrote to memory of 512	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	105
PID 3200 wrote to memory of 2868	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	106
PID 3200 wrote to memory of 2868	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	106
PID 3200 wrote to memory of 4288	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	107
PID 3200 wrote to memory of 4288	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	107
PID 3200 wrote to memory of 3908	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	108
PID 3200 wrote to memory of 3908	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	108
PID 3200 wrote to memory of 3652	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	109
PID 3200 wrote to memory of 3652	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	109
PID 3200 wrote to memory of 4756	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	110
PID 3200 wrote to memory of 4756	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	110
PID 3200 wrote to memory of 3532	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	111
PID 3200 wrote to memory of 3532	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	111
PID 3200 wrote to memory of 3316	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	112
PID 3200 wrote to memory of 3316	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	112
PID 3200 wrote to memory of 4984	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	113
PID 3200 wrote to memory of 4984	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	113
PID 3200 wrote to memory of 3860	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	114
PID 3200 wrote to memory of 3860	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	114
PID 3200 wrote to memory of 1696	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	115
PID 3200 wrote to memory of 1696	3200	adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe	115

C:\Users\Admin\AppData\Local\Temp\adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe
"C:\Users\Admin\AppData\Local\Temp\adbff36a199bfbfb6bced0049d55f3a24234dd4898df614b015397183096dacd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\System\mgvNWjw.exe
  C:\Windows\System\mgvNWjw.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\VYgQprq.exe
  C:\Windows\System\VYgQprq.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\PNiitAU.exe
  C:\Windows\System\PNiitAU.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\eOSwktc.exe
  C:\Windows\System\eOSwktc.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\BIMsaJz.exe
  C:\Windows\System\BIMsaJz.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\IptDOFF.exe
  C:\Windows\System\IptDOFF.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\KFkCQkj.exe
  C:\Windows\System\KFkCQkj.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\thDdQfC.exe
  C:\Windows\System\thDdQfC.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\XzmkQDs.exe
  C:\Windows\System\XzmkQDs.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\QrHMJVO.exe
  C:\Windows\System\QrHMJVO.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\SVBPOLi.exe
  C:\Windows\System\SVBPOLi.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\hzhqECi.exe
  C:\Windows\System\hzhqECi.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\zraEJsj.exe
  C:\Windows\System\zraEJsj.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\RUslZPm.exe
  C:\Windows\System\RUslZPm.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\GIvrCTD.exe
  C:\Windows\System\GIvrCTD.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\aqYmFaH.exe
  C:\Windows\System\aqYmFaH.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\TamDpcm.exe
  C:\Windows\System\TamDpcm.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\CsJxcty.exe
  C:\Windows\System\CsJxcty.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\SGXLyNw.exe
  C:\Windows\System\SGXLyNw.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\jxVIVRz.exe
  C:\Windows\System\jxVIVRz.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\BbJzniM.exe
  C:\Windows\System\BbJzniM.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\KMntcPk.exe
  C:\Windows\System\KMntcPk.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\XRzhJyX.exe
  C:\Windows\System\XRzhJyX.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\UDadFpH.exe
  C:\Windows\System\UDadFpH.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\SNjDxAk.exe
  C:\Windows\System\SNjDxAk.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\YOFNweb.exe
  C:\Windows\System\YOFNweb.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\mNqEvJw.exe
  C:\Windows\System\mNqEvJw.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\kEfoSkF.exe
  C:\Windows\System\kEfoSkF.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\AvrqVIv.exe
  C:\Windows\System\AvrqVIv.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\wlbcRyI.exe
  C:\Windows\System\wlbcRyI.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\sIKhMpZ.exe
  C:\Windows\System\sIKhMpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\eqLeyht.exe
  C:\Windows\System\eqLeyht.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\CCeFZIx.exe
  C:\Windows\System\CCeFZIx.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\cWtbVbr.exe
  C:\Windows\System\cWtbVbr.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\CZrQBCw.exe
  C:\Windows\System\CZrQBCw.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\eqvxzOF.exe
  C:\Windows\System\eqvxzOF.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\uguVwXI.exe
  C:\Windows\System\uguVwXI.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\hHRFLaK.exe
  C:\Windows\System\hHRFLaK.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\kuHJlaG.exe
  C:\Windows\System\kuHJlaG.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\mzDdqoe.exe
  C:\Windows\System\mzDdqoe.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\pSAvRDD.exe
  C:\Windows\System\pSAvRDD.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\SUrcnhZ.exe
  C:\Windows\System\SUrcnhZ.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\fxxJHtI.exe
  C:\Windows\System\fxxJHtI.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\FQncpah.exe
  C:\Windows\System\FQncpah.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\sXxiCWJ.exe
  C:\Windows\System\sXxiCWJ.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\HtUMRUl.exe
  C:\Windows\System\HtUMRUl.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\hBUPwmW.exe
  C:\Windows\System\hBUPwmW.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\PQgXwMC.exe
  C:\Windows\System\PQgXwMC.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\FgaYXNs.exe
  C:\Windows\System\FgaYXNs.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\YpuLlVz.exe
  C:\Windows\System\YpuLlVz.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\LktLJsg.exe
  C:\Windows\System\LktLJsg.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\SlAHZLp.exe
  C:\Windows\System\SlAHZLp.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\uhKuWGw.exe
  C:\Windows\System\uhKuWGw.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\lxwMerd.exe
  C:\Windows\System\lxwMerd.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\kEYxGKu.exe
  C:\Windows\System\kEYxGKu.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\JVTMobB.exe
  C:\Windows\System\JVTMobB.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\xBBDFUJ.exe
  C:\Windows\System\xBBDFUJ.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\njnJRfI.exe
  C:\Windows\System\njnJRfI.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\mZgnkLE.exe
  C:\Windows\System\mZgnkLE.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\mltANkj.exe
  C:\Windows\System\mltANkj.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\anbgsak.exe
  C:\Windows\System\anbgsak.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\mcUqqZv.exe
  C:\Windows\System\mcUqqZv.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\lIADeTn.exe
  C:\Windows\System\lIADeTn.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\ymbYtpb.exe
  C:\Windows\System\ymbYtpb.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\slHgJOb.exe
  C:\Windows\System\slHgJOb.exe
  2⤵
  PID:1116
- C:\Windows\System\jEUqNNA.exe
  C:\Windows\System\jEUqNNA.exe
  2⤵
  PID:4404
- C:\Windows\System\fjJTpGT.exe
  C:\Windows\System\fjJTpGT.exe
  2⤵
  PID:5024
- C:\Windows\System\YKHqnEv.exe
  C:\Windows\System\YKHqnEv.exe
  2⤵
  PID:4556
- C:\Windows\System\ItcWRqE.exe
  C:\Windows\System\ItcWRqE.exe
  2⤵
  PID:2900
- C:\Windows\System\NWEXqbE.exe
  C:\Windows\System\NWEXqbE.exe
  2⤵
  PID:3960
- C:\Windows\System\wLwQSbM.exe
  C:\Windows\System\wLwQSbM.exe
  2⤵
  PID:4820
- C:\Windows\System\CYTfBhL.exe
  C:\Windows\System\CYTfBhL.exe
  2⤵
  PID:4800
- C:\Windows\System\WnXjlSk.exe
  C:\Windows\System\WnXjlSk.exe
  2⤵
  PID:1236
- C:\Windows\System\VOkWVzs.exe
  C:\Windows\System\VOkWVzs.exe
  2⤵
  PID:4488
- C:\Windows\System\ZQYvamV.exe
  C:\Windows\System\ZQYvamV.exe
  2⤵
  PID:3128
- C:\Windows\System\sEMgOqd.exe
  C:\Windows\System\sEMgOqd.exe
  2⤵
  PID:3148
- C:\Windows\System\DkGUGFn.exe
  C:\Windows\System\DkGUGFn.exe
  2⤵
  PID:5028
- C:\Windows\System\mvwnXfa.exe
  C:\Windows\System\mvwnXfa.exe
  2⤵
  PID:4728
- C:\Windows\System\UHrSUUD.exe
  C:\Windows\System\UHrSUUD.exe
  2⤵
  PID:2484
- C:\Windows\System\JZqBDMF.exe
  C:\Windows\System\JZqBDMF.exe
  2⤵
  PID:3468
- C:\Windows\System\ksuDxdM.exe
  C:\Windows\System\ksuDxdM.exe
  2⤵
  PID:752
- C:\Windows\System\KBXcUpV.exe
  C:\Windows\System\KBXcUpV.exe
  2⤵
  PID:4408
- C:\Windows\System\OcvgJvy.exe
  C:\Windows\System\OcvgJvy.exe
  2⤵
  PID:1552
- C:\Windows\System\GkATFoX.exe
  C:\Windows\System\GkATFoX.exe
  2⤵
  PID:3068
- C:\Windows\System\FdmZZEh.exe
  C:\Windows\System\FdmZZEh.exe
  2⤵
  PID:3664
- C:\Windows\System\SNmNyGq.exe
  C:\Windows\System\SNmNyGq.exe
  2⤵
  PID:760
- C:\Windows\System\hNUtBMX.exe
  C:\Windows\System\hNUtBMX.exe
  2⤵
  PID:5128
- C:\Windows\System\kJYUPCI.exe
  C:\Windows\System\kJYUPCI.exe
  2⤵
  PID:5156
- C:\Windows\System\isFLpRn.exe
  C:\Windows\System\isFLpRn.exe
  2⤵
  PID:5184
- C:\Windows\System\nsapFfv.exe
  C:\Windows\System\nsapFfv.exe
  2⤵
  PID:5212
- C:\Windows\System\srVjdwM.exe
  C:\Windows\System\srVjdwM.exe
  2⤵
  PID:5240
- C:\Windows\System\DrrczfY.exe
  C:\Windows\System\DrrczfY.exe
  2⤵
  PID:5268
- C:\Windows\System\OTBrYMr.exe
  C:\Windows\System\OTBrYMr.exe
  2⤵
  PID:5300
- C:\Windows\System\RuffSdL.exe
  C:\Windows\System\RuffSdL.exe
  2⤵
  PID:5324
- C:\Windows\System\llRlgXX.exe
  C:\Windows\System\llRlgXX.exe
  2⤵
  PID:5352
- C:\Windows\System\BWbRsFD.exe
  C:\Windows\System\BWbRsFD.exe
  2⤵
  PID:5380
- C:\Windows\System\xrvrttj.exe
  C:\Windows\System\xrvrttj.exe
  2⤵
  PID:5444
- C:\Windows\System\kvIckop.exe
  C:\Windows\System\kvIckop.exe
  2⤵
  PID:5460
- C:\Windows\System\VNdSwbm.exe
  C:\Windows\System\VNdSwbm.exe
  2⤵
  PID:5476
- C:\Windows\System\BSWmpDz.exe
  C:\Windows\System\BSWmpDz.exe
  2⤵
  PID:5500
- C:\Windows\System\NGHttxW.exe
  C:\Windows\System\NGHttxW.exe
  2⤵
  PID:5528
- C:\Windows\System\fciQZFw.exe
  C:\Windows\System\fciQZFw.exe
  2⤵
  PID:5556
- C:\Windows\System\ZTWhCUH.exe
  C:\Windows\System\ZTWhCUH.exe
  2⤵
  PID:5584
- C:\Windows\System\iFtrulm.exe
  C:\Windows\System\iFtrulm.exe
  2⤵
  PID:5604
- C:\Windows\System\YphPvKg.exe
  C:\Windows\System\YphPvKg.exe
  2⤵
  PID:5632
- C:\Windows\System\izIhsrN.exe
  C:\Windows\System\izIhsrN.exe
  2⤵
  PID:5660
- C:\Windows\System\GoBwLFl.exe
  C:\Windows\System\GoBwLFl.exe
  2⤵
  PID:5688
- C:\Windows\System\wDpHjhK.exe
  C:\Windows\System\wDpHjhK.exe
  2⤵
  PID:5716
- C:\Windows\System\zbMuiOs.exe
  C:\Windows\System\zbMuiOs.exe
  2⤵
  PID:5744
- C:\Windows\System\QGIvDkR.exe
  C:\Windows\System\QGIvDkR.exe
  2⤵
  PID:5772
- C:\Windows\System\DkiqQgk.exe
  C:\Windows\System\DkiqQgk.exe
  2⤵
  PID:5800
- C:\Windows\System\ZDzwsOV.exe
  C:\Windows\System\ZDzwsOV.exe
  2⤵
  PID:5824
- C:\Windows\System\ciDUSww.exe
  C:\Windows\System\ciDUSww.exe
  2⤵
  PID:5852
- C:\Windows\System\OJfihcZ.exe
  C:\Windows\System\OJfihcZ.exe
  2⤵
  PID:5880
- C:\Windows\System\pfHXmRl.exe
  C:\Windows\System\pfHXmRl.exe
  2⤵
  PID:5920
- C:\Windows\System\XNZabXb.exe
  C:\Windows\System\XNZabXb.exe
  2⤵
  PID:5944
- C:\Windows\System\CnMiJBi.exe
  C:\Windows\System\CnMiJBi.exe
  2⤵
  PID:5972
- C:\Windows\System\KnBQyQW.exe
  C:\Windows\System\KnBQyQW.exe
  2⤵
  PID:6004
- C:\Windows\System\NHMWWDW.exe
  C:\Windows\System\NHMWWDW.exe
  2⤵
  PID:6028
- C:\Windows\System\HpTIdSC.exe
  C:\Windows\System\HpTIdSC.exe
  2⤵
  PID:6060
- C:\Windows\System\Uinpuey.exe
  C:\Windows\System\Uinpuey.exe
  2⤵
  PID:6088
- C:\Windows\System\LVoYcJF.exe
  C:\Windows\System\LVoYcJF.exe
  2⤵
  PID:6116
- C:\Windows\System\nnTUCLe.exe
  C:\Windows\System\nnTUCLe.exe
  2⤵
  PID:6140
- C:\Windows\System\oOMkmLP.exe
  C:\Windows\System\oOMkmLP.exe
  2⤵
  PID:4280
- C:\Windows\System\SxrBdNY.exe
  C:\Windows\System\SxrBdNY.exe
  2⤵
  PID:1360
- C:\Windows\System\HnATTQP.exe
  C:\Windows\System\HnATTQP.exe
  2⤵
  PID:536
- C:\Windows\System\LCJmEDc.exe
  C:\Windows\System\LCJmEDc.exe
  2⤵
  PID:60
- C:\Windows\System\BqDppBy.exe
  C:\Windows\System\BqDppBy.exe
  2⤵
  PID:4600
- C:\Windows\System\lzqCzAU.exe
  C:\Windows\System\lzqCzAU.exe
  2⤵
  PID:2848
- C:\Windows\System\xQRTTYt.exe
  C:\Windows\System\xQRTTYt.exe
  2⤵
  PID:1200
- C:\Windows\System\jwVNbRN.exe
  C:\Windows\System\jwVNbRN.exe
  2⤵
  PID:5168
- C:\Windows\System\Eqwybbs.exe
  C:\Windows\System\Eqwybbs.exe
  2⤵
  PID:5228
- C:\Windows\System\jKVMCJY.exe
  C:\Windows\System\jKVMCJY.exe
  2⤵
  PID:5308
- C:\Windows\System\TLexqzh.exe
  C:\Windows\System\TLexqzh.exe
  2⤵
  PID:5364
- C:\Windows\System\EezpTpu.exe
  C:\Windows\System\EezpTpu.exe
  2⤵
  PID:5424
- C:\Windows\System\gMIqohG.exe
  C:\Windows\System\gMIqohG.exe
  2⤵
  PID:5472
- C:\Windows\System\EEHQqsi.exe
  C:\Windows\System\EEHQqsi.exe
  2⤵
  PID:5548
- C:\Windows\System\KBitrea.exe
  C:\Windows\System\KBitrea.exe
  2⤵
  PID:5616
- C:\Windows\System\DXJsszX.exe
  C:\Windows\System\DXJsszX.exe
  2⤵
  PID:5676
- C:\Windows\System\JKVlEli.exe
  C:\Windows\System\JKVlEli.exe
  2⤵
  PID:5736
- C:\Windows\System\HKDcGxx.exe
  C:\Windows\System\HKDcGxx.exe
  2⤵
  PID:5812
- C:\Windows\System\xTbsBDX.exe
  C:\Windows\System\xTbsBDX.exe
  2⤵
  PID:5872
- C:\Windows\System\rohwaEw.exe
  C:\Windows\System\rohwaEw.exe
  2⤵
  PID:5940
- C:\Windows\System\jvVogDG.exe
  C:\Windows\System\jvVogDG.exe
  2⤵
  PID:5996
- C:\Windows\System\sbsGWRc.exe
  C:\Windows\System\sbsGWRc.exe
  2⤵
  PID:6072
- C:\Windows\System\iHbvzzj.exe
  C:\Windows\System\iHbvzzj.exe
  2⤵
  PID:6128
- C:\Windows\System\PRHBazz.exe
  C:\Windows\System\PRHBazz.exe
  2⤵
  PID:1740
- C:\Windows\System\YwueAOM.exe
  C:\Windows\System\YwueAOM.exe
  2⤵
  PID:1380
- C:\Windows\System\hfZwKlh.exe
  C:\Windows\System\hfZwKlh.exe
  2⤵
  PID:5000
- C:\Windows\System\YYYQUlF.exe
  C:\Windows\System\YYYQUlF.exe
  2⤵
  PID:5144
- C:\Windows\System\NWIkalY.exe
  C:\Windows\System\NWIkalY.exe
  2⤵
  PID:5280
- C:\Windows\System\wOYUKcA.exe
  C:\Windows\System\wOYUKcA.exe
  2⤵
  PID:224
- C:\Windows\System\MvraKit.exe
  C:\Windows\System\MvraKit.exe
  2⤵
  PID:5596
- C:\Windows\System\DiLbpOe.exe
  C:\Windows\System\DiLbpOe.exe
  2⤵
  PID:2092
- C:\Windows\System\JhVCsUQ.exe
  C:\Windows\System\JhVCsUQ.exe
  2⤵
  PID:5932
- C:\Windows\System\JjtKIpQ.exe
  C:\Windows\System\JjtKIpQ.exe
  2⤵
  PID:5988
- C:\Windows\System\lGYBYyr.exe
  C:\Windows\System\lGYBYyr.exe
  2⤵
  PID:6164
- C:\Windows\System\lcfNHDv.exe
  C:\Windows\System\lcfNHDv.exe
  2⤵
  PID:6184
- C:\Windows\System\MLMHtdC.exe
  C:\Windows\System\MLMHtdC.exe
  2⤵
  PID:6212
- C:\Windows\System\gibVYhg.exe
  C:\Windows\System\gibVYhg.exe
  2⤵
  PID:6240
- C:\Windows\System\nyfxqBL.exe
  C:\Windows\System\nyfxqBL.exe
  2⤵
  PID:6268
- C:\Windows\System\EVkHFGS.exe
  C:\Windows\System\EVkHFGS.exe
  2⤵
  PID:6292
- C:\Windows\System\PovBehw.exe
  C:\Windows\System\PovBehw.exe
  2⤵
  PID:6320
- C:\Windows\System\awUZHfi.exe
  C:\Windows\System\awUZHfi.exe
  2⤵
  PID:6348
- C:\Windows\System\kuRaHdg.exe
  C:\Windows\System\kuRaHdg.exe
  2⤵
  PID:6380
- C:\Windows\System\eTCOYPs.exe
  C:\Windows\System\eTCOYPs.exe
  2⤵
  PID:6408
- C:\Windows\System\cZNPMel.exe
  C:\Windows\System\cZNPMel.exe
  2⤵
  PID:6436
- C:\Windows\System\eaNGcwN.exe
  C:\Windows\System\eaNGcwN.exe
  2⤵
  PID:6460
- C:\Windows\System\kxdBIIi.exe
  C:\Windows\System\kxdBIIi.exe
  2⤵
  PID:6488
- C:\Windows\System\PevTnvn.exe
  C:\Windows\System\PevTnvn.exe
  2⤵
  PID:6520
- C:\Windows\System\pKyLimk.exe
  C:\Windows\System\pKyLimk.exe
  2⤵
  PID:6548
- C:\Windows\System\AofhVFH.exe
  C:\Windows\System\AofhVFH.exe
  2⤵
  PID:6576
- C:\Windows\System\tufLtku.exe
  C:\Windows\System\tufLtku.exe
  2⤵
  PID:6600
- C:\Windows\System\aFutBTC.exe
  C:\Windows\System\aFutBTC.exe
  2⤵
  PID:6628
- C:\Windows\System\viSUkyT.exe
  C:\Windows\System\viSUkyT.exe
  2⤵
  PID:6656
- C:\Windows\System\vOvipbw.exe
  C:\Windows\System\vOvipbw.exe
  2⤵
  PID:6688
- C:\Windows\System\dCDKxyi.exe
  C:\Windows\System\dCDKxyi.exe
  2⤵
  PID:6716
- C:\Windows\System\gcZxWdu.exe
  C:\Windows\System\gcZxWdu.exe
  2⤵
  PID:6744
- C:\Windows\System\jiCVOsC.exe
  C:\Windows\System\jiCVOsC.exe
  2⤵
  PID:6788
- C:\Windows\System\eGZYdbb.exe
  C:\Windows\System\eGZYdbb.exe
  2⤵
  PID:6852
- C:\Windows\System\XhnbLeA.exe
  C:\Windows\System\XhnbLeA.exe
  2⤵
  PID:6888
- C:\Windows\System\WPpiuco.exe
  C:\Windows\System\WPpiuco.exe
  2⤵
  PID:6912
- C:\Windows\System\FPYSvgk.exe
  C:\Windows\System\FPYSvgk.exe
  2⤵
  PID:6932
- C:\Windows\System\BIBYcUy.exe
  C:\Windows\System\BIBYcUy.exe
  2⤵
  PID:6964
- C:\Windows\System\ewUlivb.exe
  C:\Windows\System\ewUlivb.exe
  2⤵
  PID:7000
- C:\Windows\System\bLaUhAe.exe
  C:\Windows\System\bLaUhAe.exe
  2⤵
  PID:7016
- C:\Windows\System\xwspKkv.exe
  C:\Windows\System\xwspKkv.exe
  2⤵
  PID:7040
- C:\Windows\System\xtCIrtb.exe
  C:\Windows\System\xtCIrtb.exe
  2⤵
  PID:7064
- C:\Windows\System\jetfcGH.exe
  C:\Windows\System\jetfcGH.exe
  2⤵
  PID:7100
- C:\Windows\System\dVULAaX.exe
  C:\Windows\System\dVULAaX.exe
  2⤵
  PID:7128
- C:\Windows\System\jAFgeXB.exe
  C:\Windows\System\jAFgeXB.exe
  2⤵
  PID:7152
- C:\Windows\System\UWwnmKl.exe
  C:\Windows\System\UWwnmKl.exe
  2⤵
  PID:880
- C:\Windows\System\bewfqLu.exe
  C:\Windows\System\bewfqLu.exe
  2⤵
  PID:3480
- C:\Windows\System\AvcqvRC.exe
  C:\Windows\System\AvcqvRC.exe
  2⤵
  PID:2056
- C:\Windows\System\clfUMOf.exe
  C:\Windows\System\clfUMOf.exe
  2⤵
  PID:5204
- C:\Windows\System\qhoMrQh.exe
  C:\Windows\System\qhoMrQh.exe
  2⤵
  PID:5516
- C:\Windows\System\KTkXiNH.exe
  C:\Windows\System\KTkXiNH.exe
  2⤵
  PID:3720
- C:\Windows\System\EPcGOYj.exe
  C:\Windows\System\EPcGOYj.exe
  2⤵
  PID:6176
- C:\Windows\System\mHNltPx.exe
  C:\Windows\System\mHNltPx.exe
  2⤵
  PID:6228
- C:\Windows\System\rjOZCPV.exe
  C:\Windows\System\rjOZCPV.exe
  2⤵
  PID:2080
- C:\Windows\System\MTnPQOB.exe
  C:\Windows\System\MTnPQOB.exe
  2⤵
  PID:6308
- C:\Windows\System\rMdprny.exe
  C:\Windows\System\rMdprny.exe
  2⤵
  PID:2604
- C:\Windows\System\idzFQeM.exe
  C:\Windows\System\idzFQeM.exe
  2⤵
  PID:6392
- C:\Windows\System\sZWcOgk.exe
  C:\Windows\System\sZWcOgk.exe
  2⤵
  PID:6428
- C:\Windows\System\UfQdIGn.exe
  C:\Windows\System\UfQdIGn.exe
  2⤵
  PID:6476
- C:\Windows\System\uNpLHuJ.exe
  C:\Windows\System\uNpLHuJ.exe
  2⤵
  PID:6540
- C:\Windows\System\ASHRhfa.exe
  C:\Windows\System\ASHRhfa.exe
  2⤵
  PID:6588
- C:\Windows\System\FquhzQL.exe
  C:\Windows\System\FquhzQL.exe
  2⤵
  PID:3544
- C:\Windows\System\agOfTFM.exe
  C:\Windows\System\agOfTFM.exe
  2⤵
  PID:4160
- C:\Windows\System\WcPybWw.exe
  C:\Windows\System\WcPybWw.exe
  2⤵
  PID:2304
- C:\Windows\System\jeBDNgH.exe
  C:\Windows\System\jeBDNgH.exe
  2⤵
  PID:3972
- C:\Windows\System\sWMjgAV.exe
  C:\Windows\System\sWMjgAV.exe
  2⤵
  PID:2380
- C:\Windows\System\iNIHJyE.exe
  C:\Windows\System\iNIHJyE.exe
  2⤵
  PID:6800
- C:\Windows\System\sJiKLXF.exe
  C:\Windows\System\sJiKLXF.exe
  2⤵
  PID:6804
- C:\Windows\System\IibVSqS.exe
  C:\Windows\System\IibVSqS.exe
  2⤵
  PID:4364
- C:\Windows\System\QfQVoYI.exe
  C:\Windows\System\QfQVoYI.exe
  2⤵
  PID:6948
- C:\Windows\System\EFHzqHb.exe
  C:\Windows\System\EFHzqHb.exe
  2⤵
  PID:7032
- C:\Windows\System\vwFtfLY.exe
  C:\Windows\System\vwFtfLY.exe
  2⤵
  PID:7084
- C:\Windows\System\zqxxlqH.exe
  C:\Windows\System\zqxxlqH.exe
  2⤵
  PID:7148
- C:\Windows\System\plbnlXZ.exe
  C:\Windows\System\plbnlXZ.exe
  2⤵
  PID:1356
- C:\Windows\System\npZnOZZ.exe
  C:\Windows\System\npZnOZZ.exe
  2⤵
  PID:5396
- C:\Windows\System\fVCewpE.exe
  C:\Windows\System\fVCewpE.exe
  2⤵
  PID:5908
- C:\Windows\System\tmJhBWu.exe
  C:\Windows\System\tmJhBWu.exe
  2⤵
  PID:1052
- C:\Windows\System\ElBlaMA.exe
  C:\Windows\System\ElBlaMA.exe
  2⤵
  PID:6260
- C:\Windows\System\SGfdLlD.exe
  C:\Windows\System\SGfdLlD.exe
  2⤵
  PID:6536
- C:\Windows\System\cxJlcSq.exe
  C:\Windows\System\cxJlcSq.exe
  2⤵
  PID:6592
- C:\Windows\System\xvncllV.exe
  C:\Windows\System\xvncllV.exe
  2⤵
  PID:6648
- C:\Windows\System\hbyPQLO.exe
  C:\Windows\System\hbyPQLO.exe
  2⤵
  PID:5092
- C:\Windows\System\wfwvfWE.exe
  C:\Windows\System\wfwvfWE.exe
  2⤵
  PID:6812
- C:\Windows\System\kntymCs.exe
  C:\Windows\System\kntymCs.exe
  2⤵
  PID:6924
- C:\Windows\System\VoHQFQd.exe
  C:\Windows\System\VoHQFQd.exe
  2⤵
  PID:7092
- C:\Windows\System\eHWWRsj.exe
  C:\Windows\System\eHWWRsj.exe
  2⤵
  PID:5072
- C:\Windows\System\rzliaKm.exe
  C:\Windows\System\rzliaKm.exe
  2⤵
  PID:6152
- C:\Windows\System\MAHJold.exe
  C:\Windows\System\MAHJold.exe
  2⤵
  PID:6568
- C:\Windows\System\ncQHTuv.exe
  C:\Windows\System\ncQHTuv.exe
  2⤵
  PID:6704
- C:\Windows\System\mSTpzEa.exe
  C:\Windows\System\mSTpzEa.exe
  2⤵
  PID:6944
- C:\Windows\System\MkHImUM.exe
  C:\Windows\System\MkHImUM.exe
  2⤵
  PID:5848
- C:\Windows\System\eOEJjet.exe
  C:\Windows\System\eOEJjet.exe
  2⤵
  PID:3176
- C:\Windows\System\CppEMfz.exe
  C:\Windows\System\CppEMfz.exe
  2⤵
  PID:6824
- C:\Windows\System\FsAItsG.exe
  C:\Windows\System\FsAItsG.exe
  2⤵
  PID:7176
- C:\Windows\System\ckmaQop.exe
  C:\Windows\System\ckmaQop.exe
  2⤵
  PID:7204
- C:\Windows\System\nvNtirD.exe
  C:\Windows\System\nvNtirD.exe
  2⤵
  PID:7232
- C:\Windows\System\WtmjgEx.exe
  C:\Windows\System\WtmjgEx.exe
  2⤵
  PID:7272
- C:\Windows\System\upUQjDr.exe
  C:\Windows\System\upUQjDr.exe
  2⤵
  PID:7288
- C:\Windows\System\rOswbNg.exe
  C:\Windows\System\rOswbNg.exe
  2⤵
  PID:7316
- C:\Windows\System\vhrfiMO.exe
  C:\Windows\System\vhrfiMO.exe
  2⤵
  PID:7356
- C:\Windows\System\ihiVAJX.exe
  C:\Windows\System\ihiVAJX.exe
  2⤵
  PID:7372
- C:\Windows\System\bDcVESB.exe
  C:\Windows\System\bDcVESB.exe
  2⤵
  PID:7388
- C:\Windows\System\ZEUnTDK.exe
  C:\Windows\System\ZEUnTDK.exe
  2⤵
  PID:7440
- C:\Windows\System\LAZYXty.exe
  C:\Windows\System\LAZYXty.exe
  2⤵
  PID:7456
- C:\Windows\System\zVtHRCH.exe
  C:\Windows\System\zVtHRCH.exe
  2⤵
  PID:7484
- C:\Windows\System\YKfiwLJ.exe
  C:\Windows\System\YKfiwLJ.exe
  2⤵
  PID:7512
- C:\Windows\System\feAlWgR.exe
  C:\Windows\System\feAlWgR.exe
  2⤵
  PID:7536
- C:\Windows\System\iQSZZAZ.exe
  C:\Windows\System\iQSZZAZ.exe
  2⤵
  PID:7560
- C:\Windows\System\FdtlhqA.exe
  C:\Windows\System\FdtlhqA.exe
  2⤵
  PID:7592
- C:\Windows\System\cdqmNuW.exe
  C:\Windows\System\cdqmNuW.exe
  2⤵
  PID:7620
- C:\Windows\System\fnxqBMx.exe
  C:\Windows\System\fnxqBMx.exe
  2⤵
  PID:7652
- C:\Windows\System\StnNFQZ.exe
  C:\Windows\System\StnNFQZ.exe
  2⤵
  PID:7692
- C:\Windows\System\gqtrixP.exe
  C:\Windows\System\gqtrixP.exe
  2⤵
  PID:7716
- C:\Windows\System\jBKNfmY.exe
  C:\Windows\System\jBKNfmY.exe
  2⤵
  PID:7736
- C:\Windows\System\qDgXrbl.exe
  C:\Windows\System\qDgXrbl.exe
  2⤵
  PID:7768
- C:\Windows\System\fsUOHsu.exe
  C:\Windows\System\fsUOHsu.exe
  2⤵
  PID:7792
- C:\Windows\System\ulnDaQh.exe
  C:\Windows\System\ulnDaQh.exe
  2⤵
  PID:7808
- C:\Windows\System\lCJZVmD.exe
  C:\Windows\System\lCJZVmD.exe
  2⤵
  PID:7840
- C:\Windows\System\ysuCezV.exe
  C:\Windows\System\ysuCezV.exe
  2⤵
  PID:7864
- C:\Windows\System\gHSmVOe.exe
  C:\Windows\System\gHSmVOe.exe
  2⤵
  PID:7900
- C:\Windows\System\dDdbuuI.exe
  C:\Windows\System\dDdbuuI.exe
  2⤵
  PID:7920
- C:\Windows\System\KiKukfv.exe
  C:\Windows\System\KiKukfv.exe
  2⤵
  PID:7956
- C:\Windows\System\hDjzoMk.exe
  C:\Windows\System\hDjzoMk.exe
  2⤵
  PID:8000
- C:\Windows\System\JITpNlw.exe
  C:\Windows\System\JITpNlw.exe
  2⤵
  PID:8016
- C:\Windows\System\YKAkLyZ.exe
  C:\Windows\System\YKAkLyZ.exe
  2⤵
  PID:8044
- C:\Windows\System\ogPJELO.exe
  C:\Windows\System\ogPJELO.exe
  2⤵
  PID:8060
- C:\Windows\System\quPLzJF.exe
  C:\Windows\System\quPLzJF.exe
  2⤵
  PID:8084
- C:\Windows\System\GAdbCDU.exe
  C:\Windows\System\GAdbCDU.exe
  2⤵
  PID:8132
- C:\Windows\System\wnXJmnK.exe
  C:\Windows\System\wnXJmnK.exe
  2⤵
  PID:8160
- C:\Windows\System\quILwdg.exe
  C:\Windows\System\quILwdg.exe
  2⤵
  PID:6420
- C:\Windows\System\yGZLuGC.exe
  C:\Windows\System\yGZLuGC.exe
  2⤵
  PID:6996
- C:\Windows\System\WjayRlz.exe
  C:\Windows\System\WjayRlz.exe
  2⤵
  PID:7264
- C:\Windows\System\UyJNvmx.exe
  C:\Windows\System\UyJNvmx.exe
  2⤵
  PID:7344
- C:\Windows\System\UsFiQqy.exe
  C:\Windows\System\UsFiQqy.exe
  2⤵
  PID:7416
- C:\Windows\System\rwbvjIe.exe
  C:\Windows\System\rwbvjIe.exe
  2⤵
  PID:7452
- C:\Windows\System\PNNHGZG.exe
  C:\Windows\System\PNNHGZG.exe
  2⤵
  PID:7552
- C:\Windows\System\FHwSVZF.exe
  C:\Windows\System\FHwSVZF.exe
  2⤵
  PID:7572
- C:\Windows\System\vNTaexk.exe
  C:\Windows\System\vNTaexk.exe
  2⤵
  PID:7616
- C:\Windows\System\ePOhnKv.exe
  C:\Windows\System\ePOhnKv.exe
  2⤵
  PID:7708
- C:\Windows\System\jeMGafD.exe
  C:\Windows\System\jeMGafD.exe
  2⤵
  PID:7784
- C:\Windows\System\AcShtrX.exe
  C:\Windows\System\AcShtrX.exe
  2⤵
  PID:7860
- C:\Windows\System\vAAWLkP.exe
  C:\Windows\System\vAAWLkP.exe
  2⤵
  PID:7856
- C:\Windows\System\PMNfwNJ.exe
  C:\Windows\System\PMNfwNJ.exe
  2⤵
  PID:7976
- C:\Windows\System\tKrRGws.exe
  C:\Windows\System\tKrRGws.exe
  2⤵
  PID:8028
- C:\Windows\System\ECkrzqx.exe
  C:\Windows\System\ECkrzqx.exe
  2⤵
  PID:8096
- C:\Windows\System\PMOruKI.exe
  C:\Windows\System\PMOruKI.exe
  2⤵
  PID:8140
- C:\Windows\System\nzIVORA.exe
  C:\Windows\System\nzIVORA.exe
  2⤵
  PID:7252
- C:\Windows\System\ktrBAEq.exe
  C:\Windows\System\ktrBAEq.exe
  2⤵
  PID:7500
- C:\Windows\System\AZcUjpa.exe
  C:\Windows\System\AZcUjpa.exe
  2⤵
  PID:7640
- C:\Windows\System\mETOvLs.exe
  C:\Windows\System\mETOvLs.exe
  2⤵
  PID:7680
- C:\Windows\System\UurKkTK.exe
  C:\Windows\System\UurKkTK.exe
  2⤵
  PID:7884
- C:\Windows\System\FXPTzhP.exe
  C:\Windows\System\FXPTzhP.exe
  2⤵
  PID:8072
- C:\Windows\System\CePPnDg.exe
  C:\Windows\System\CePPnDg.exe
  2⤵
  PID:7268
- C:\Windows\System\DGvNZSp.exe
  C:\Windows\System\DGvNZSp.exe
  2⤵
  PID:7332
- C:\Windows\System\CXZytRk.exe
  C:\Windows\System\CXZytRk.exe
  2⤵
  PID:7780
- C:\Windows\System\oERAJJx.exe
  C:\Windows\System\oERAJJx.exe
  2⤵
  PID:7612
- C:\Windows\System\LhgKJct.exe
  C:\Windows\System\LhgKJct.exe
  2⤵
  PID:7932
- C:\Windows\System\gSyUPcH.exe
  C:\Windows\System\gSyUPcH.exe
  2⤵
  PID:8216
- C:\Windows\System\BLBFitp.exe
  C:\Windows\System\BLBFitp.exe
  2⤵
  PID:8244
- C:\Windows\System\RZxCArn.exe
  C:\Windows\System\RZxCArn.exe
  2⤵
  PID:8260
- C:\Windows\System\tATCVSM.exe
  C:\Windows\System\tATCVSM.exe
  2⤵
  PID:8300
- C:\Windows\System\thGstup.exe
  C:\Windows\System\thGstup.exe
  2⤵
  PID:8316
- C:\Windows\System\zbhClNk.exe
  C:\Windows\System\zbhClNk.exe
  2⤵
  PID:8344
- C:\Windows\System\eAxjjgO.exe
  C:\Windows\System\eAxjjgO.exe
  2⤵
  PID:8384
- C:\Windows\System\apUSkBv.exe
  C:\Windows\System\apUSkBv.exe
  2⤵
  PID:8400
- C:\Windows\System\uZknnrf.exe
  C:\Windows\System\uZknnrf.exe
  2⤵
  PID:8420
- C:\Windows\System\bWnhUYW.exe
  C:\Windows\System\bWnhUYW.exe
  2⤵
  PID:8444
- C:\Windows\System\XSpxAwl.exe
  C:\Windows\System\XSpxAwl.exe
  2⤵
  PID:8484
- C:\Windows\System\takGmDX.exe
  C:\Windows\System\takGmDX.exe
  2⤵
  PID:8508
- C:\Windows\System\ZRbjSJA.exe
  C:\Windows\System\ZRbjSJA.exe
  2⤵
  PID:8528
- C:\Windows\System\oLHkxve.exe
  C:\Windows\System\oLHkxve.exe
  2⤵
  PID:8572
- C:\Windows\System\VYEdWuo.exe
  C:\Windows\System\VYEdWuo.exe
  2⤵
  PID:8608
- C:\Windows\System\lrHwXpE.exe
  C:\Windows\System\lrHwXpE.exe
  2⤵
  PID:8624
- C:\Windows\System\LzupvvX.exe
  C:\Windows\System\LzupvvX.exe
  2⤵
  PID:8652
- C:\Windows\System\uGlcwSy.exe
  C:\Windows\System\uGlcwSy.exe
  2⤵
  PID:8692
- C:\Windows\System\ksktRMg.exe
  C:\Windows\System\ksktRMg.exe
  2⤵
  PID:8720
- C:\Windows\System\teFTDpT.exe
  C:\Windows\System\teFTDpT.exe
  2⤵
  PID:8736
- C:\Windows\System\tvIhjTY.exe
  C:\Windows\System\tvIhjTY.exe
  2⤵
  PID:8752
- C:\Windows\System\xPczffu.exe
  C:\Windows\System\xPczffu.exe
  2⤵
  PID:8776
- C:\Windows\System\oqMYjwj.exe
  C:\Windows\System\oqMYjwj.exe
  2⤵
  PID:8804
- C:\Windows\System\EFnosCu.exe
  C:\Windows\System\EFnosCu.exe
  2⤵
  PID:8836
- C:\Windows\System\DUtujfM.exe
  C:\Windows\System\DUtujfM.exe
  2⤵
  PID:8860
- C:\Windows\System\OGQaHQG.exe
  C:\Windows\System\OGQaHQG.exe
  2⤵
  PID:8884
- C:\Windows\System\BVPveiU.exe
  C:\Windows\System\BVPveiU.exe
  2⤵
  PID:8944
- C:\Windows\System\UdNGKEX.exe
  C:\Windows\System\UdNGKEX.exe
  2⤵
  PID:8972
- C:\Windows\System\xxxqjxg.exe
  C:\Windows\System\xxxqjxg.exe
  2⤵
  PID:8988
- C:\Windows\System\djsdicE.exe
  C:\Windows\System\djsdicE.exe
  2⤵
  PID:9028
- C:\Windows\System\jVrpnfE.exe
  C:\Windows\System\jVrpnfE.exe
  2⤵
  PID:9056
- C:\Windows\System\iPoSOJp.exe
  C:\Windows\System\iPoSOJp.exe
  2⤵
  PID:9084
- C:\Windows\System\GxirbPB.exe
  C:\Windows\System\GxirbPB.exe
  2⤵
  PID:9112
- C:\Windows\System\YTfpZcY.exe
  C:\Windows\System\YTfpZcY.exe
  2⤵
  PID:9140
- C:\Windows\System\bwkHLWr.exe
  C:\Windows\System\bwkHLWr.exe
  2⤵
  PID:9168
- C:\Windows\System\FnLtVME.exe
  C:\Windows\System\FnLtVME.exe
  2⤵
  PID:9184
- C:\Windows\System\irsCEuZ.exe
  C:\Windows\System\irsCEuZ.exe
  2⤵
  PID:9204
- C:\Windows\System\zXnnRTL.exe
  C:\Windows\System\zXnnRTL.exe
  2⤵
  PID:8228
- C:\Windows\System\HrRRMft.exe
  C:\Windows\System\HrRRMft.exe
  2⤵
  PID:8288
- C:\Windows\System\XtrMkmu.exe
  C:\Windows\System\XtrMkmu.exe
  2⤵
  PID:8396
- C:\Windows\System\UIcgmJo.exe
  C:\Windows\System\UIcgmJo.exe
  2⤵
  PID:8440
- C:\Windows\System\sEppkoy.exe
  C:\Windows\System\sEppkoy.exe
  2⤵
  PID:8476
- C:\Windows\System\TeWqwcK.exe
  C:\Windows\System\TeWqwcK.exe
  2⤵
  PID:8580
- C:\Windows\System\bzLHfbO.exe
  C:\Windows\System\bzLHfbO.exe
  2⤵
  PID:8616
- C:\Windows\System\PWnMfuf.exe
  C:\Windows\System\PWnMfuf.exe
  2⤵
  PID:8668
- C:\Windows\System\hBktFAw.exe
  C:\Windows\System\hBktFAw.exe
  2⤵
  PID:8708
- C:\Windows\System\VGZYrRO.exe
  C:\Windows\System\VGZYrRO.exe
  2⤵
  PID:8788
- C:\Windows\System\tqGjOoi.exe
  C:\Windows\System\tqGjOoi.exe
  2⤵
  PID:8828
- C:\Windows\System\jDUEFua.exe
  C:\Windows\System\jDUEFua.exe
  2⤵
  PID:8964
- C:\Windows\System\TYTsBQQ.exe
  C:\Windows\System\TYTsBQQ.exe
  2⤵
  PID:9040
- C:\Windows\System\FuONhXn.exe
  C:\Windows\System\FuONhXn.exe
  2⤵
  PID:9104
- C:\Windows\System\bkarDFU.exe
  C:\Windows\System\bkarDFU.exe
  2⤵
  PID:9152
- C:\Windows\System\erJyBhG.exe
  C:\Windows\System\erJyBhG.exe
  2⤵
  PID:7364
- C:\Windows\System\fXRMjSP.exe
  C:\Windows\System\fXRMjSP.exe
  2⤵
  PID:8372
- C:\Windows\System\WkEPLBV.exe
  C:\Windows\System\WkEPLBV.exe
  2⤵
  PID:8520
- C:\Windows\System\ZkoydeP.exe
  C:\Windows\System\ZkoydeP.exe
  2⤵
  PID:8672
- C:\Windows\System\jQaPcal.exe
  C:\Windows\System\jQaPcal.exe
  2⤵
  PID:8772
- C:\Windows\System\jXUohkY.exe
  C:\Windows\System\jXUohkY.exe
  2⤵
  PID:8904
- C:\Windows\System\rUWHxST.exe
  C:\Windows\System\rUWHxST.exe
  2⤵
  PID:9072
- C:\Windows\System\dXMoYRl.exe
  C:\Windows\System\dXMoYRl.exe
  2⤵
  PID:9192
- C:\Windows\System\BENqEEu.exe
  C:\Windows\System\BENqEEu.exe
  2⤵
  PID:8644
- C:\Windows\System\lJcEeIw.exe
  C:\Windows\System\lJcEeIw.exe
  2⤵
  PID:9136
- C:\Windows\System\lAtGwrJ.exe
  C:\Windows\System\lAtGwrJ.exe
  2⤵
  PID:8852
- C:\Windows\System\lsmAOhw.exe
  C:\Windows\System\lsmAOhw.exe
  2⤵
  PID:9224
- C:\Windows\System\rXVnbFT.exe
  C:\Windows\System\rXVnbFT.exe
  2⤵
  PID:9244
- C:\Windows\System\wIGDiey.exe
  C:\Windows\System\wIGDiey.exe
  2⤵
  PID:9272
- C:\Windows\System\bzKDEhm.exe
  C:\Windows\System\bzKDEhm.exe
  2⤵
  PID:9304
- C:\Windows\System\rWuhjuS.exe
  C:\Windows\System\rWuhjuS.exe
  2⤵
  PID:9324
- C:\Windows\System\TvvpLpQ.exe
  C:\Windows\System\TvvpLpQ.exe
  2⤵
  PID:9360
- C:\Windows\System\UswxqXW.exe
  C:\Windows\System\UswxqXW.exe
  2⤵
  PID:9412
- C:\Windows\System\wBSRAgM.exe
  C:\Windows\System\wBSRAgM.exe
  2⤵
  PID:9428
- C:\Windows\System\sapeFRY.exe
  C:\Windows\System\sapeFRY.exe
  2⤵
  PID:9452
- C:\Windows\System\QgVxxhg.exe
  C:\Windows\System\QgVxxhg.exe
  2⤵
  PID:9472
- C:\Windows\System\iOpBQbj.exe
  C:\Windows\System\iOpBQbj.exe
  2⤵
  PID:9488
- C:\Windows\System\rqXvnhr.exe
  C:\Windows\System\rqXvnhr.exe
  2⤵
  PID:9504
- C:\Windows\System\vGUdZFR.exe
  C:\Windows\System\vGUdZFR.exe
  2⤵
  PID:9520
- C:\Windows\System\cBHGPao.exe
  C:\Windows\System\cBHGPao.exe
  2⤵
  PID:9536
- C:\Windows\System\BiMUXZb.exe
  C:\Windows\System\BiMUXZb.exe
  2⤵
  PID:9628
- C:\Windows\System\SnQZUns.exe
  C:\Windows\System\SnQZUns.exe
  2⤵
  PID:9652
- C:\Windows\System\IbEGqch.exe
  C:\Windows\System\IbEGqch.exe
  2⤵
  PID:9672
- C:\Windows\System\XaqFeNf.exe
  C:\Windows\System\XaqFeNf.exe
  2⤵
  PID:9704
- C:\Windows\System\jiEEnzT.exe
  C:\Windows\System\jiEEnzT.exe
  2⤵
  PID:9748
- C:\Windows\System\TJtpgOZ.exe
  C:\Windows\System\TJtpgOZ.exe
  2⤵
  PID:9776
- C:\Windows\System\aKJMqLi.exe
  C:\Windows\System\aKJMqLi.exe
  2⤵
  PID:9796
- C:\Windows\System\yvVPjEp.exe
  C:\Windows\System\yvVPjEp.exe
  2⤵
  PID:9820
- C:\Windows\System\FjWERsH.exe
  C:\Windows\System\FjWERsH.exe
  2⤵
  PID:9848
- C:\Windows\System\nOPBwPg.exe
  C:\Windows\System\nOPBwPg.exe
  2⤵
  PID:9888
- C:\Windows\System\cjLjKmd.exe
  C:\Windows\System\cjLjKmd.exe
  2⤵
  PID:9904
- C:\Windows\System\auaXyhg.exe
  C:\Windows\System\auaXyhg.exe
  2⤵
  PID:9932
- C:\Windows\System\geZahNY.exe
  C:\Windows\System\geZahNY.exe
  2⤵
  PID:9960
- C:\Windows\System\WyqcwMa.exe
  C:\Windows\System\WyqcwMa.exe
  2⤵
  PID:10000
- C:\Windows\System\nGaWIbW.exe
  C:\Windows\System\nGaWIbW.exe
  2⤵
  PID:10016
- C:\Windows\System\HSPtlbt.exe
  C:\Windows\System\HSPtlbt.exe
  2⤵
  PID:10036
- C:\Windows\System\mLlYKeH.exe
  C:\Windows\System\mLlYKeH.exe
  2⤵
  PID:10060
- C:\Windows\System\nImcCRR.exe
  C:\Windows\System\nImcCRR.exe
  2⤵
  PID:10080
- C:\Windows\System\liozgou.exe
  C:\Windows\System\liozgou.exe
  2⤵
  PID:10112
- C:\Windows\System\pnKFUFC.exe
  C:\Windows\System\pnKFUFC.exe
  2⤵
  PID:10144
- C:\Windows\System\YMSimPn.exe
  C:\Windows\System\YMSimPn.exe
  2⤵
  PID:10172
- C:\Windows\System\rYMZqWW.exe
  C:\Windows\System\rYMZqWW.exe
  2⤵
  PID:10212
- C:\Windows\System\dvAciji.exe
  C:\Windows\System\dvAciji.exe
  2⤵
  PID:10228
- C:\Windows\System\QmHPpbO.exe
  C:\Windows\System\QmHPpbO.exe
  2⤵
  PID:8468
- C:\Windows\System\LvTwieb.exe
  C:\Windows\System\LvTwieb.exe
  2⤵
  PID:9260
- C:\Windows\System\yZYLPQt.exe
  C:\Windows\System\yZYLPQt.exe
  2⤵
  PID:9352
- C:\Windows\System\AFvlhCg.exe
  C:\Windows\System\AFvlhCg.exe
  2⤵
  PID:9464
- C:\Windows\System\lsMGuah.exe
  C:\Windows\System\lsMGuah.exe
  2⤵
  PID:9496
- C:\Windows\System\uLHzBHE.exe
  C:\Windows\System\uLHzBHE.exe
  2⤵
  PID:9568
- C:\Windows\System\wuQmcSC.exe
  C:\Windows\System\wuQmcSC.exe
  2⤵
  PID:9688
- C:\Windows\System\tHXoPdq.exe
  C:\Windows\System\tHXoPdq.exe
  2⤵
  PID:9720
- C:\Windows\System\JZyJVfE.exe
  C:\Windows\System\JZyJVfE.exe
  2⤵
  PID:9816
- C:\Windows\System\wjcxCxo.exe
  C:\Windows\System\wjcxCxo.exe
  2⤵
  PID:9884
- C:\Windows\System\xTdQYpb.exe
  C:\Windows\System\xTdQYpb.exe
  2⤵
  PID:9944
- C:\Windows\System\oLNxXcB.exe
  C:\Windows\System\oLNxXcB.exe
  2⤵
  PID:10008
- C:\Windows\System\XJteOVL.exe
  C:\Windows\System\XJteOVL.exe
  2⤵
  PID:10076
- C:\Windows\System\pxsAuzc.exe
  C:\Windows\System\pxsAuzc.exe
  2⤵
  PID:10180
- C:\Windows\System\aSaRPDo.exe
  C:\Windows\System\aSaRPDo.exe
  2⤵
  PID:10220
- C:\Windows\System\CylIRKr.exe
  C:\Windows\System\CylIRKr.exe
  2⤵
  PID:8172
- C:\Windows\System\EPAAnQS.exe
  C:\Windows\System\EPAAnQS.exe
  2⤵
  PID:9312
- C:\Windows\System\ziTHRcF.exe
  C:\Windows\System\ziTHRcF.exe
  2⤵
  PID:9728
- C:\Windows\System\WFELGiN.exe
  C:\Windows\System\WFELGiN.exe
  2⤵
  PID:9868
- C:\Windows\System\dgvzLWe.exe
  C:\Windows\System\dgvzLWe.exe
  2⤵
  PID:10088
- C:\Windows\System\HUSFmoM.exe
  C:\Windows\System\HUSFmoM.exe
  2⤵
  PID:10124
- C:\Windows\System\peBBbsn.exe
  C:\Windows\System\peBBbsn.exe
  2⤵
  PID:10236
- C:\Windows\System\YKBfIou.exe
  C:\Windows\System\YKBfIou.exe
  2⤵
  PID:9588
- C:\Windows\System\dgxCjVN.exe
  C:\Windows\System\dgxCjVN.exe
  2⤵
  PID:10132
- C:\Windows\System\OrDnaiY.exe
  C:\Windows\System\OrDnaiY.exe
  2⤵
  PID:9512
- C:\Windows\System\EOfTiZu.exe
  C:\Windows\System\EOfTiZu.exe
  2⤵
  PID:10252
- C:\Windows\System\MBoKiVT.exe
  C:\Windows\System\MBoKiVT.exe
  2⤵
  PID:10284
- C:\Windows\System\OgTQiVo.exe
  C:\Windows\System\OgTQiVo.exe
  2⤵
  PID:10304
- C:\Windows\System\GYlAScq.exe
  C:\Windows\System\GYlAScq.exe
  2⤵
  PID:10340
- C:\Windows\System\Ffjnhno.exe
  C:\Windows\System\Ffjnhno.exe
  2⤵
  PID:10364
- C:\Windows\System\iJlVKMc.exe
  C:\Windows\System\iJlVKMc.exe
  2⤵
  PID:10392
- C:\Windows\System\GnJhbrr.exe
  C:\Windows\System\GnJhbrr.exe
  2⤵
  PID:10424
- C:\Windows\System\yvcmdkU.exe
  C:\Windows\System\yvcmdkU.exe
  2⤵
  PID:10452
- C:\Windows\System\hkcVojI.exe
  C:\Windows\System\hkcVojI.exe
  2⤵
  PID:10480
- C:\Windows\System\ovfqwXC.exe
  C:\Windows\System\ovfqwXC.exe
  2⤵
  PID:10508
- C:\Windows\System\IxZlyEO.exe
  C:\Windows\System\IxZlyEO.exe
  2⤵
  PID:10532
- C:\Windows\System\DBzMIpZ.exe
  C:\Windows\System\DBzMIpZ.exe
  2⤵
  PID:10564
- C:\Windows\System\crLLVPp.exe
  C:\Windows\System\crLLVPp.exe
  2⤵
  PID:10584
- C:\Windows\System\IzNdYTk.exe
  C:\Windows\System\IzNdYTk.exe
  2⤵
  PID:10612
- C:\Windows\System\dWpBagf.exe
  C:\Windows\System\dWpBagf.exe
  2⤵
  PID:10660
- C:\Windows\System\RGlUxmy.exe
  C:\Windows\System\RGlUxmy.exe
  2⤵
  PID:10680
- C:\Windows\System\aGCsTUS.exe
  C:\Windows\System\aGCsTUS.exe
  2⤵
  PID:10724
- C:\Windows\System\NrsHdMB.exe
  C:\Windows\System\NrsHdMB.exe
  2⤵
  PID:10744
- C:\Windows\System\cgJvdKL.exe
  C:\Windows\System\cgJvdKL.exe
  2⤵
  PID:10768
- C:\Windows\System\rgQKstm.exe
  C:\Windows\System\rgQKstm.exe
  2⤵
  PID:10808
- C:\Windows\System\ewDDabN.exe
  C:\Windows\System\ewDDabN.exe
  2⤵
  PID:10836
- C:\Windows\System\hjwuxqy.exe
  C:\Windows\System\hjwuxqy.exe
  2⤵
  PID:10860
- C:\Windows\System\LCflvqv.exe
  C:\Windows\System\LCflvqv.exe
  2⤵
  PID:10880
- C:\Windows\System\BcJxQVH.exe
  C:\Windows\System\BcJxQVH.exe
  2⤵
  PID:10908
- C:\Windows\System\syZNcri.exe
  C:\Windows\System\syZNcri.exe
  2⤵
  PID:10932
- C:\Windows\System\QsNkxOv.exe
  C:\Windows\System\QsNkxOv.exe
  2⤵
  PID:10960
- C:\Windows\System\PSKNkPg.exe
  C:\Windows\System\PSKNkPg.exe
  2⤵
  PID:10980
- C:\Windows\System\okhBYFL.exe
  C:\Windows\System\okhBYFL.exe
  2⤵
  PID:11004
- C:\Windows\System\lvtgvJY.exe
  C:\Windows\System\lvtgvJY.exe
  2⤵
  PID:11028
- C:\Windows\System\ETGfVLD.exe
  C:\Windows\System\ETGfVLD.exe
  2⤵
  PID:11084
- C:\Windows\System\KClyBUn.exe
  C:\Windows\System\KClyBUn.exe
  2⤵
  PID:11108
- C:\Windows\System\bAADIdk.exe
  C:\Windows\System\bAADIdk.exe
  2⤵
  PID:11152
- C:\Windows\System\raTLxhl.exe
  C:\Windows\System\raTLxhl.exe
  2⤵
  PID:11180
- C:\Windows\System\kkZWcTA.exe
  C:\Windows\System\kkZWcTA.exe
  2⤵
  PID:11196
- C:\Windows\System\vHOufWI.exe
  C:\Windows\System\vHOufWI.exe
  2⤵
  PID:11220
- C:\Windows\System\gTfAHxv.exe
  C:\Windows\System\gTfAHxv.exe
  2⤵
  PID:11240
- C:\Windows\System\vYEePKQ.exe
  C:\Windows\System\vYEePKQ.exe
  2⤵
  PID:9448
- C:\Windows\System\osRrfQj.exe
  C:\Windows\System\osRrfQj.exe
  2⤵
  PID:10296
- C:\Windows\System\mHKNueG.exe
  C:\Windows\System\mHKNueG.exe
  2⤵
  PID:10324
- C:\Windows\System\ovteBjY.exe
  C:\Windows\System\ovteBjY.exe
  2⤵
  PID:10360
- C:\Windows\System\ETXyuCK.exe
  C:\Windows\System\ETXyuCK.exe
  2⤵
  PID:10436
- C:\Windows\System\GQiXlhm.exe
  C:\Windows\System\GQiXlhm.exe
  2⤵
  PID:10524
- C:\Windows\System\XqLFKVS.exe
  C:\Windows\System\XqLFKVS.exe
  2⤵
  PID:10628
- C:\Windows\System\WsIVVRc.exe
  C:\Windows\System\WsIVVRc.exe
  2⤵
  PID:10708
- C:\Windows\System\DGUeOrH.exe
  C:\Windows\System\DGUeOrH.exe
  2⤵
  PID:10784
- C:\Windows\System\AHfDzBo.exe
  C:\Windows\System\AHfDzBo.exe
  2⤵
  PID:10828
- C:\Windows\System\vrRCxeN.exe
  C:\Windows\System\vrRCxeN.exe
  2⤵
  PID:10900
- C:\Windows\System\RlQkTgK.exe
  C:\Windows\System\RlQkTgK.exe
  2⤵
  PID:10988
- C:\Windows\System\PMgxpqz.exe
  C:\Windows\System\PMgxpqz.exe
  2⤵
  PID:11068
- C:\Windows\System\zKlAKOQ.exe
  C:\Windows\System\zKlAKOQ.exe
  2⤵
  PID:11100
- C:\Windows\System\OpgZsIW.exe
  C:\Windows\System\OpgZsIW.exe
  2⤵
  PID:11148
- C:\Windows\System\fjDVxCY.exe
  C:\Windows\System\fjDVxCY.exe
  2⤵
  PID:11236
- C:\Windows\System\tQQuAlZ.exe
  C:\Windows\System\tQQuAlZ.exe
  2⤵
  PID:10268
- C:\Windows\System\mREfKOo.exe
  C:\Windows\System\mREfKOo.exe
  2⤵
  PID:10444
- C:\Windows\System\FDemFMI.exe
  C:\Windows\System\FDemFMI.exe
  2⤵
  PID:10596
- C:\Windows\System\oJGdxKa.exe
  C:\Windows\System\oJGdxKa.exe
  2⤵
  PID:10756
- C:\Windows\System\OZPfiwm.exe
  C:\Windows\System\OZPfiwm.exe
  2⤵
  PID:10800
- C:\Windows\System\ZooCNHy.exe
  C:\Windows\System\ZooCNHy.exe
  2⤵
  PID:10896
- C:\Windows\System\WvKmJPm.exe
  C:\Windows\System\WvKmJPm.exe
  2⤵
  PID:11188
- C:\Windows\System\gLzvfeD.exe
  C:\Windows\System\gLzvfeD.exe
  2⤵
  PID:10336
- C:\Windows\System\sqtAVxr.exe
  C:\Windows\System\sqtAVxr.exe
  2⤵
  PID:10636
- C:\Windows\System\lnVnqhF.exe
  C:\Windows\System\lnVnqhF.exe
  2⤵
  PID:11024
- C:\Windows\System\MpUktXU.exe
  C:\Windows\System\MpUktXU.exe
  2⤵
  PID:11260
- C:\Windows\System\tIEZRAf.exe
  C:\Windows\System\tIEZRAf.exe
  2⤵
  PID:11284
- C:\Windows\System\bPQDvTo.exe
  C:\Windows\System\bPQDvTo.exe
  2⤵
  PID:11316
- C:\Windows\System\cYCtVOu.exe
  C:\Windows\System\cYCtVOu.exe
  2⤵
  PID:11336
- C:\Windows\System\FVbundw.exe
  C:\Windows\System\FVbundw.exe
  2⤵
  PID:11360
- C:\Windows\System\UtDZSId.exe
  C:\Windows\System\UtDZSId.exe
  2⤵
  PID:11404
- C:\Windows\System\lrXawwL.exe
  C:\Windows\System\lrXawwL.exe
  2⤵
  PID:11432
- C:\Windows\System\hetbetl.exe
  C:\Windows\System\hetbetl.exe
  2⤵
  PID:11448
- C:\Windows\System\iNqSqOf.exe
  C:\Windows\System\iNqSqOf.exe
  2⤵
  PID:11476
- C:\Windows\System\vQfZUGZ.exe
  C:\Windows\System\vQfZUGZ.exe
  2⤵
  PID:11532
- C:\Windows\System\mYMVYEp.exe
  C:\Windows\System\mYMVYEp.exe
  2⤵
  PID:11560
- C:\Windows\System\tzqxBCF.exe
  C:\Windows\System\tzqxBCF.exe
  2⤵
  PID:11576
- C:\Windows\System\WtUGPHh.exe
  C:\Windows\System\WtUGPHh.exe
  2⤵
  PID:11616
- C:\Windows\System\BjTzJmo.exe
  C:\Windows\System\BjTzJmo.exe
  2⤵
  PID:11632
- C:\Windows\System\QlrkzyE.exe
  C:\Windows\System\QlrkzyE.exe
  2⤵
  PID:11684
- C:\Windows\System\YzRsUvE.exe
  C:\Windows\System\YzRsUvE.exe
  2⤵
  PID:11712
- C:\Windows\System\DCfthuk.exe
  C:\Windows\System\DCfthuk.exe
  2⤵
  PID:11728
- C:\Windows\System\FuXRCPs.exe
  C:\Windows\System\FuXRCPs.exe
  2⤵
  PID:11752
- C:\Windows\System\DtKBtkd.exe
  C:\Windows\System\DtKBtkd.exe
  2⤵
  PID:11776
- C:\Windows\System\PETTXwg.exe
  C:\Windows\System\PETTXwg.exe
  2⤵
  PID:11812
- C:\Windows\System\OzJyEgi.exe
  C:\Windows\System\OzJyEgi.exe
  2⤵
  PID:11832
- C:\Windows\System\LdfHQTM.exe
  C:\Windows\System\LdfHQTM.exe
  2⤵
  PID:11868
- C:\Windows\System\XcIVOcF.exe
  C:\Windows\System\XcIVOcF.exe
  2⤵
  PID:11896
- C:\Windows\System\YMAAvze.exe
  C:\Windows\System\YMAAvze.exe
  2⤵
  PID:11972
- C:\Windows\System\sFCficY.exe
  C:\Windows\System\sFCficY.exe
  2⤵
  PID:11988
- C:\Windows\System\evxcsxL.exe
  C:\Windows\System\evxcsxL.exe
  2⤵
  PID:12016
- C:\Windows\System\MMJgiUp.exe
  C:\Windows\System\MMJgiUp.exe
  2⤵
  PID:12052
- C:\Windows\System\DIGbShe.exe
  C:\Windows\System\DIGbShe.exe
  2⤵
  PID:12072
- C:\Windows\System\XvwKmbd.exe
  C:\Windows\System\XvwKmbd.exe
  2⤵
  PID:12108
- C:\Windows\System\TVVkgbN.exe
  C:\Windows\System\TVVkgbN.exe
  2⤵
  PID:12128
- C:\Windows\System\HOgxOlM.exe
  C:\Windows\System\HOgxOlM.exe
  2⤵
  PID:12152
- C:\Windows\System\pMbxExf.exe
  C:\Windows\System\pMbxExf.exe
  2⤵
  PID:12176
- C:\Windows\System\OXgWfXc.exe
  C:\Windows\System\OXgWfXc.exe
  2⤵
  PID:12204
- C:\Windows\System\Zjljuaj.exe
  C:\Windows\System\Zjljuaj.exe
  2⤵
  PID:12232
- C:\Windows\System\NFXnpmD.exe
  C:\Windows\System\NFXnpmD.exe
  2⤵
  PID:12268
- C:\Windows\System\sCDGzQj.exe
  C:\Windows\System\sCDGzQj.exe
  2⤵
  PID:10244
- C:\Windows\System\HVcQqjA.exe
  C:\Windows\System\HVcQqjA.exe
  2⤵
  PID:10672
- C:\Windows\System\vchrNWv.exe
  C:\Windows\System\vchrNWv.exe
  2⤵
  PID:11348
- C:\Windows\System\vtioMwG.exe
  C:\Windows\System\vtioMwG.exe
  2⤵
  PID:11424
- C:\Windows\System\RDPSjcU.exe
  C:\Windows\System\RDPSjcU.exe
  2⤵
  PID:11508
- C:\Windows\System\wydFwgG.exe
  C:\Windows\System\wydFwgG.exe
  2⤵
  PID:11568
- C:\Windows\System\zdmBKHU.exe
  C:\Windows\System\zdmBKHU.exe
  2⤵
  PID:11672
- C:\Windows\System\pHMYrEt.exe
  C:\Windows\System\pHMYrEt.exe
  2⤵
  PID:11720
- C:\Windows\System\dJHKshI.exe
  C:\Windows\System\dJHKshI.exe
  2⤵
  PID:11768
- C:\Windows\System\Eihfvoa.exe
  C:\Windows\System\Eihfvoa.exe
  2⤵
  PID:11824
- C:\Windows\System\GTSFNBQ.exe
  C:\Windows\System\GTSFNBQ.exe
  2⤵
  PID:11880
- C:\Windows\System\aUMdPtm.exe
  C:\Windows\System\aUMdPtm.exe
  2⤵
  PID:11968
- C:\Windows\System\tGngjRy.exe
  C:\Windows\System\tGngjRy.exe
  2⤵
  PID:12124
- C:\Windows\System\CaDFJUb.exe
  C:\Windows\System\CaDFJUb.exe
  2⤵
  PID:12148
- C:\Windows\System\IXZiokh.exe
  C:\Windows\System\IXZiokh.exe
  2⤵
  PID:12196
- C:\Windows\System\mZOuWOZ.exe
  C:\Windows\System\mZOuWOZ.exe
  2⤵
  PID:12240
- C:\Windows\System\AynmAWL.exe
  C:\Windows\System\AynmAWL.exe
  2⤵
  PID:11280
- C:\Windows\System\mBJPpoz.exe
  C:\Windows\System\mBJPpoz.exe
  2⤵
  PID:11552
- C:\Windows\System\DgLwulb.exe
  C:\Windows\System\DgLwulb.exe
  2⤵
  PID:11696
- C:\Windows\System\rYjbBLn.exe
  C:\Windows\System\rYjbBLn.exe
  2⤵
  PID:11844
- C:\Windows\System\rcelYuI.exe
  C:\Windows\System\rcelYuI.exe
  2⤵
  PID:11964
- C:\Windows\System\EwTsjcM.exe
  C:\Windows\System\EwTsjcM.exe
  2⤵
  PID:12100
- C:\Windows\System\uFSkskQ.exe
  C:\Windows\System\uFSkskQ.exe
  2⤵
  PID:11208
- C:\Windows\System\ecAzJRT.exe
  C:\Windows\System\ecAzJRT.exe
  2⤵
  PID:11600
- C:\Windows\System\lMTDAvg.exe
  C:\Windows\System\lMTDAvg.exe
  2⤵
  PID:11888
- C:\Windows\System\OePRjCP.exe
  C:\Windows\System\OePRjCP.exe
  2⤵
  PID:11308
- C:\Windows\System\dOxqKfl.exe
  C:\Windows\System\dOxqKfl.exe
  2⤵
  PID:10892
- C:\Windows\System\qkTyQEw.exe
  C:\Windows\System\qkTyQEw.exe
  2⤵
  PID:12312
- C:\Windows\System\nMmRabG.exe
  C:\Windows\System\nMmRabG.exe
  2⤵
  PID:12336
- C:\Windows\System\XdYvFPO.exe
  C:\Windows\System\XdYvFPO.exe
  2⤵
  PID:12356
- C:\Windows\System\qmoLQNs.exe
  C:\Windows\System\qmoLQNs.exe
  2⤵
  PID:12380
- C:\Windows\System\PcinzjF.exe
  C:\Windows\System\PcinzjF.exe
  2⤵
  PID:12404
- C:\Windows\System\XBrjAAm.exe
  C:\Windows\System\XBrjAAm.exe
  2⤵
  PID:12436
- C:\Windows\System\iAufYRG.exe
  C:\Windows\System\iAufYRG.exe
  2⤵
  PID:12464
- C:\Windows\System\wlxbAuG.exe
  C:\Windows\System\wlxbAuG.exe
  2⤵
  PID:12516
- C:\Windows\System\WluQgcg.exe
  C:\Windows\System\WluQgcg.exe
  2⤵
  PID:12536
- C:\Windows\System\cjxWhvV.exe
  C:\Windows\System\cjxWhvV.exe
  2⤵
  PID:12560
- C:\Windows\System\ZSYfTCH.exe
  C:\Windows\System\ZSYfTCH.exe
  2⤵
  PID:12592
- C:\Windows\System\bLuuaov.exe
  C:\Windows\System\bLuuaov.exe
  2⤵
  PID:12616
- C:\Windows\System\HcWJnfJ.exe
  C:\Windows\System\HcWJnfJ.exe
  2⤵
  PID:12636
- C:\Windows\System\BBIAiAG.exe
  C:\Windows\System\BBIAiAG.exe
  2⤵
  PID:12660
- C:\Windows\System\uPmqhKC.exe
  C:\Windows\System\uPmqhKC.exe
  2⤵
  PID:12684
- C:\Windows\System\IwbDVln.exe
  C:\Windows\System\IwbDVln.exe
  2⤵
  PID:12728
- C:\Windows\System\GObkERF.exe
  C:\Windows\System\GObkERF.exe
  2⤵
  PID:12744
- C:\Windows\System\hKpTBIz.exe
  C:\Windows\System\hKpTBIz.exe
  2⤵
  PID:12788
- C:\Windows\System\qhmimAI.exe
  C:\Windows\System\qhmimAI.exe
  2⤵
  PID:12808
- C:\Windows\System\KCIoYfg.exe
  C:\Windows\System\KCIoYfg.exe
  2⤵
  PID:12840
- C:\Windows\System\cUGeNHv.exe
  C:\Windows\System\cUGeNHv.exe
  2⤵
  PID:12860
- C:\Windows\System\qvVzBIb.exe
  C:\Windows\System\qvVzBIb.exe
  2⤵
  PID:12908
- C:\Windows\System\HzQYzFW.exe
  C:\Windows\System\HzQYzFW.exe
  2⤵
  PID:12936
- C:\Windows\System\nrTNKOF.exe
  C:\Windows\System\nrTNKOF.exe
  2⤵
  PID:12964
- C:\Windows\System\mhxplIa.exe
  C:\Windows\System\mhxplIa.exe
  2⤵
  PID:12980
- C:\Windows\System\TRRiomV.exe
  C:\Windows\System\TRRiomV.exe
  2⤵
  PID:13000
- C:\Windows\System\lIuRbiI.exe
  C:\Windows\System\lIuRbiI.exe
  2⤵
  PID:13036
- C:\Windows\System\FfPzdAr.exe
  C:\Windows\System\FfPzdAr.exe
  2⤵
  PID:13076
- C:\Windows\System\cLuGvqn.exe
  C:\Windows\System\cLuGvqn.exe
  2⤵
  PID:13096
- C:\Windows\System\lpSvzLn.exe
  C:\Windows\System\lpSvzLn.exe
  2⤵
  PID:13124
- C:\Windows\System\qxdyEOq.exe
  C:\Windows\System\qxdyEOq.exe
  2⤵
  PID:13156
- C:\Windows\System\WqBLGCv.exe
  C:\Windows\System\WqBLGCv.exe
  2⤵
  PID:13176
- C:\Windows\System\IzCQEta.exe
  C:\Windows\System\IzCQEta.exe
  2⤵
  PID:13192
- C:\Windows\System\vFddxHK.exe
  C:\Windows\System\vFddxHK.exe
  2⤵
  PID:13208
- C:\Windows\System\FHUnwjc.exe
  C:\Windows\System\FHUnwjc.exe
  2⤵
  PID:13244
- C:\Windows\System\pRkKNTI.exe
  C:\Windows\System\pRkKNTI.exe
  2⤵
  PID:13284
- C:\Windows\System\ugzUApr.exe
  C:\Windows\System\ugzUApr.exe
  2⤵
  PID:11744
- C:\Windows\System\WBwteRQ.exe
  C:\Windows\System\WBwteRQ.exe
  2⤵
  PID:12372
- C:\Windows\System\WtgcZpU.exe
  C:\Windows\System\WtgcZpU.exe
  2⤵
  PID:12416
- C:\Windows\System\iksTIRW.exe
  C:\Windows\System\iksTIRW.exe
  2⤵
  PID:12496
- C:\Windows\System\GQWpyCJ.exe
  C:\Windows\System\GQWpyCJ.exe
  2⤵
  PID:12544
- C:\Windows\System\qKDRsZA.exe
  C:\Windows\System\qKDRsZA.exe
  2⤵
  PID:12652
- C:\Windows\System\dIxzDzp.exe
  C:\Windows\System\dIxzDzp.exe
  2⤵
  PID:12680
- C:\Windows\System\fhOiynB.exe
  C:\Windows\System\fhOiynB.exe
  2⤵
  PID:12740
- C:\Windows\System\WqnfLgv.exe
  C:\Windows\System\WqnfLgv.exe
  2⤵
  PID:12800
- C:\Windows\System\eQPHMxz.exe
  C:\Windows\System\eQPHMxz.exe
  2⤵
  PID:12832
- C:\Windows\System\DfvgIuD.exe
  C:\Windows\System\DfvgIuD.exe
  2⤵
  PID:12952
- C:\Windows\System\DqRRQDm.exe
  C:\Windows\System\DqRRQDm.exe
  2⤵
  PID:13016
- C:\Windows\System\fnLyUoz.exe
  C:\Windows\System\fnLyUoz.exe
  2⤵
  PID:13068
- C:\Windows\System\ZSwNFHb.exe
  C:\Windows\System\ZSwNFHb.exe
  2⤵
  PID:13092
- C:\Windows\System\gFHcTPF.exe
  C:\Windows\System\gFHcTPF.exe
  2⤵
  PID:13168
- C:\Windows\System\gnqSKAR.exe
  C:\Windows\System\gnqSKAR.exe
  2⤵
  PID:13232
- C:\Windows\System\ytRgJva.exe
  C:\Windows\System\ytRgJva.exe
  2⤵
  PID:13280
- C:\Windows\System\WENqmaT.exe
  C:\Windows\System\WENqmaT.exe
  2⤵
  PID:12524
- C:\Windows\System\PaVQSLC.exe
  C:\Windows\System\PaVQSLC.exe
  2⤵
  PID:12608
- C:\Windows\System\nxfVBxG.exe
  C:\Windows\System\nxfVBxG.exe
  2⤵
  PID:376
- C:\Windows\System\jqybzli.exe
  C:\Windows\System\jqybzli.exe
  2⤵
  PID:12676
- C:\Windows\System\UfSDADS.exe
  C:\Windows\System\UfSDADS.exe
  2⤵
  PID:12776
- C:\Windows\System\ThGzryg.exe
  C:\Windows\System\ThGzryg.exe
  2⤵
  PID:13052
- C:\Windows\System\WKGxjuP.exe
  C:\Windows\System\WKGxjuP.exe
  2⤵
  PID:13204
- C:\Windows\System\GOuVicO.exe
  C:\Windows\System\GOuVicO.exe
  2⤵
  PID:12320
- C:\Windows\System\TCUTzIn.exe
  C:\Windows\System\TCUTzIn.exe
  2⤵
  PID:12488
- C:\Windows\System\vHMNKaG.exe
  C:\Windows\System\vHMNKaG.exe
  2⤵
  PID:11440
- C:\Windows\System\GhtWXti.exe
  C:\Windows\System\GhtWXti.exe
  2⤵
  PID:13132
- C:\Windows\System\JkVniQi.exe
  C:\Windows\System\JkVniQi.exe
  2⤵
  PID:12764
- C:\Windows\System\tMlOkyb.exe
  C:\Windows\System\tMlOkyb.exe
  2⤵
  PID:13084
- C:\Windows\System\bJtHOoA.exe
  C:\Windows\System\bJtHOoA.exe
  2⤵
  PID:13332
- C:\Windows\System\BzXHzON.exe
  C:\Windows\System\BzXHzON.exe
  2⤵
  PID:13360
- C:\Windows\System\eJOYcxJ.exe
  C:\Windows\System\eJOYcxJ.exe
  2⤵
  PID:13376
- C:\Windows\System\EbgDKoo.exe
  C:\Windows\System\EbgDKoo.exe
  2⤵
  PID:13404
- C:\Windows\System\aBUvFMi.exe
  C:\Windows\System\aBUvFMi.exe
  2⤵
  PID:13432
- C:\Windows\System\XNxxRiP.exe
  C:\Windows\System\XNxxRiP.exe
  2⤵
  PID:13456
- C:\Windows\System\OhYEjfZ.exe
  C:\Windows\System\OhYEjfZ.exe
  2⤵
  PID:13492
- C:\Windows\System\DrPGtXw.exe
  C:\Windows\System\DrPGtXw.exe
  2⤵
  PID:13524
- C:\Windows\System\IqnNqoN.exe
  C:\Windows\System\IqnNqoN.exe
  2⤵
  PID:13544
- C:\Windows\System\IMrvFxS.exe
  C:\Windows\System\IMrvFxS.exe
  2⤵
  PID:13596
- C:\Windows\System\kvdzQPF.exe
  C:\Windows\System\kvdzQPF.exe
  2⤵
  PID:13616
- C:\Windows\System\vYWgIyD.exe
  C:\Windows\System\vYWgIyD.exe
  2⤵
  PID:13652
- C:\Windows\System\AbEAeMb.exe
  C:\Windows\System\AbEAeMb.exe
  2⤵
  PID:13680
- C:\Windows\System\DoFYeic.exe
  C:\Windows\System\DoFYeic.exe
  2⤵
  PID:13704
- C:\Windows\System\yshOtby.exe
  C:\Windows\System\yshOtby.exe
  2⤵
  PID:13724
- C:\Windows\System\apjDcfG.exe
  C:\Windows\System\apjDcfG.exe
  2⤵
  PID:13752
- C:\Windows\System\hzKQFxD.exe
  C:\Windows\System\hzKQFxD.exe
  2⤵
  PID:13772
- C:\Windows\System\WhjKyqk.exe
  C:\Windows\System\WhjKyqk.exe
  2⤵
  PID:13812
- C:\Windows\System\iuXwTjb.exe
  C:\Windows\System\iuXwTjb.exe
  2⤵
  PID:13832
- C:\Windows\System\osOYTMI.exe
  C:\Windows\System\osOYTMI.exe
  2⤵
  PID:13864
- C:\Windows\System\WRyEOCY.exe
  C:\Windows\System\WRyEOCY.exe
  2⤵
  PID:13880
- C:\Windows\System\HbcTGIO.exe
  C:\Windows\System\HbcTGIO.exe
  2⤵
  PID:13924
- C:\Windows\System\HwpgpTo.exe
  C:\Windows\System\HwpgpTo.exe
  2⤵
  PID:13948
- C:\Windows\System\eBAVvCn.exe
  C:\Windows\System\eBAVvCn.exe
  2⤵
  PID:13976
- C:\Windows\System\eSfEeHE.exe
  C:\Windows\System\eSfEeHE.exe
  2⤵
  PID:13996
- C:\Windows\System\yRlHdAU.exe
  C:\Windows\System\yRlHdAU.exe
  2⤵
  PID:14024
- C:\Windows\System\pBZaRmM.exe
  C:\Windows\System\pBZaRmM.exe
  2⤵
  PID:14060
- C:\Windows\System\ZLufEJV.exe
  C:\Windows\System\ZLufEJV.exe
  2⤵
  PID:14080
- C:\Windows\System\rVNovFx.exe
  C:\Windows\System\rVNovFx.exe
  2⤵
  PID:14108
- C:\Windows\System\VXTvGzv.exe
  C:\Windows\System\VXTvGzv.exe
  2⤵
  PID:14132
- C:\Windows\System\CGIWSAM.exe
  C:\Windows\System\CGIWSAM.exe
  2⤵
  PID:14152
- C:\Windows\System\tNgtsAJ.exe
  C:\Windows\System\tNgtsAJ.exe
  2⤵
  PID:14176
- C:\Windows\System\tDuZPlO.exe
  C:\Windows\System\tDuZPlO.exe
  2⤵
  PID:14228
- C:\Windows\System\jYXrAUy.exe
  C:\Windows\System\jYXrAUy.exe
  2⤵
  PID:14256
- C:\Windows\System\PSJxglj.exe
  C:\Windows\System\PSJxglj.exe
  2⤵
  PID:14276
- C:\Windows\System\KTsSFuG.exe
  C:\Windows\System\KTsSFuG.exe
  2⤵
  PID:14300
- C:\Windows\System\WLUbkyq.exe
  C:\Windows\System\WLUbkyq.exe
  2⤵
  PID:14328
- C:\Windows\System\VssUCtg.exe
  C:\Windows\System\VssUCtg.exe
  2⤵
  PID:13392
- C:\Windows\System\ScqJoPJ.exe
  C:\Windows\System\ScqJoPJ.exe
  2⤵
  PID:13500
- C:\Windows\System\zgbpsIv.exe
  C:\Windows\System\zgbpsIv.exe
  2⤵
  PID:13484
- C:\Windows\System\OPnlpsj.exe
  C:\Windows\System\OPnlpsj.exe
  2⤵
  PID:13568
- C:\Windows\System\OOBRfuK.exe
  C:\Windows\System\OOBRfuK.exe
  2⤵
  PID:13608
- C:\Windows\System\DZeDdtP.exe
  C:\Windows\System\DZeDdtP.exe
  2⤵
  PID:13700
- C:\Windows\System\VMGXTJT.exe
  C:\Windows\System\VMGXTJT.exe
  2⤵
  PID:13720
- C:\Windows\System\ghkoOMJ.exe
  C:\Windows\System\ghkoOMJ.exe
  2⤵
  PID:13796
- C:\Windows\System\kIOaUmP.exe
  C:\Windows\System\kIOaUmP.exe
  2⤵
  PID:13844
- C:\Windows\System\vcBSGSh.exe
  C:\Windows\System\vcBSGSh.exe
  2⤵
  PID:13940
- C:\Windows\System\uZbUqnP.exe
  C:\Windows\System\uZbUqnP.exe
  2⤵
  PID:14032
- C:\Windows\System\zokMwtq.exe
  C:\Windows\System\zokMwtq.exe
  2⤵
  PID:14092
- C:\Windows\System\zcpWYbS.exe
  C:\Windows\System\zcpWYbS.exe
  2⤵
  PID:14128
- C:\Windows\System\ZypCzGr.exe
  C:\Windows\System\ZypCzGr.exe
  2⤵
  PID:14252
- C:\Windows\System\zniJImw.exe
  C:\Windows\System\zniJImw.exe
  2⤵
  PID:14284
- C:\Windows\System\PlxMfuq.exe
  C:\Windows\System\PlxMfuq.exe
  2⤵
  PID:13344
- C:\Windows\System\XapFGnc.exe
  C:\Windows\System\XapFGnc.exe
  2⤵
  PID:13420
- C:\Windows\System\ZuvFEqa.exe
  C:\Windows\System\ZuvFEqa.exe
  2⤵
  PID:13660
- C:\Windows\System\JBfaibU.exe
  C:\Windows\System\JBfaibU.exe
  2⤵
  PID:13828
- C:\Windows\System\zZCWxhv.exe
  C:\Windows\System\zZCWxhv.exe
  2⤵
  PID:13760
- C:\Windows\System\ABGBZfz.exe
  C:\Windows\System\ABGBZfz.exe
  2⤵
  PID:14008
- C:\Windows\System\rMsyaRt.exe
  C:\Windows\System\rMsyaRt.exe
  2⤵
  PID:14116
- C:\Windows\System\kVtGCrE.exe
  C:\Windows\System\kVtGCrE.exe
  2⤵
  PID:14212
- C:\Windows\System\fCXhUxZ.exe
  C:\Windows\System\fCXhUxZ.exe
  2⤵
  PID:13672
- C:\Windows\System\fHNGHNW.exe
  C:\Windows\System\fHNGHNW.exe
  2⤵
  PID:13820
- C:\Windows\System\vxGaRbp.exe
  C:\Windows\System\vxGaRbp.exe
  2⤵
  PID:14324
- C:\Windows\System\joptEAb.exe
  C:\Windows\System\joptEAb.exe
  2⤵
  PID:14364
- C:\Windows\System\DwrTOWI.exe
  C:\Windows\System\DwrTOWI.exe
  2⤵
  PID:14380
- C:\Windows\System\SQVKaqn.exe
  C:\Windows\System\SQVKaqn.exe
  2⤵
  PID:14416
- C:\Windows\System\RFimgoM.exe
  C:\Windows\System\RFimgoM.exe
  2⤵
  PID:14436
- C:\Windows\System\krXGJle.exe
  C:\Windows\System\krXGJle.exe
  2⤵
  PID:14460
- C:\Windows\System\HnZSDKq.exe
  C:\Windows\System\HnZSDKq.exe
  2⤵
  PID:14480
- C:\Windows\System\mQOQwrm.exe
  C:\Windows\System\mQOQwrm.exe
  2⤵
  PID:14516
- C:\Windows\System\guhfvjs.exe
  C:\Windows\System\guhfvjs.exe
  2⤵
  PID:14548
- C:\Windows\System\uLGuwlT.exe
  C:\Windows\System\uLGuwlT.exe
  2⤵
  PID:14580
- C:\Windows\System\HyjIvIn.exe
  C:\Windows\System\HyjIvIn.exe
  2⤵
  PID:14608
- C:\Windows\System\cCoFkyy.exe
  C:\Windows\System\cCoFkyy.exe
  2⤵
  PID:14624
- C:\Windows\System\NduYadD.exe
  C:\Windows\System\NduYadD.exe
  2⤵
  PID:14640
- C:\Windows\System\oRjoJjW.exe
  C:\Windows\System\oRjoJjW.exe
  2⤵
  PID:14668
- C:\Windows\System\wVUdYai.exe
  C:\Windows\System\wVUdYai.exe
  2⤵
  PID:14704
- C:\Windows\System\ixwNSUN.exe
  C:\Windows\System\ixwNSUN.exe
  2⤵
  PID:14732
- C:\Windows\System\tTfHrxF.exe
  C:\Windows\System\tTfHrxF.exe
  2⤵
  PID:14760
- C:\Windows\System\TUCUyQM.exe
  C:\Windows\System\TUCUyQM.exe
  2⤵
  PID:14788
- C:\Windows\System\jarKbTt.exe
  C:\Windows\System\jarKbTt.exe
  2⤵
  PID:14824
- C:\Windows\System\YBmSECq.exe
  C:\Windows\System\YBmSECq.exe
  2⤵
  PID:14848
- C:\Windows\System\noCrLoT.exe
  C:\Windows\System\noCrLoT.exe
  2⤵
  PID:14872
- C:\Windows\System\fqPRNHt.exe
  C:\Windows\System\fqPRNHt.exe
  2⤵
  PID:14904
- C:\Windows\System\bNPrhHS.exe
  C:\Windows\System\bNPrhHS.exe
  2⤵
  PID:14936
- C:\Windows\System\DgqelGd.exe
  C:\Windows\System\DgqelGd.exe
  2⤵
  PID:14960
- C:\Windows\System\yJwKleL.exe
  C:\Windows\System\yJwKleL.exe
  2⤵
  PID:14980
- C:\Windows\System\VBrwksI.exe
  C:\Windows\System\VBrwksI.exe
  2⤵
  PID:15004
- C:\Windows\System\kAJQMpi.exe
  C:\Windows\System\kAJQMpi.exe
  2⤵
  PID:15044
- C:\Windows\System\RZhzGjH.exe
  C:\Windows\System\RZhzGjH.exe
  2⤵
  PID:15080
- C:\Windows\System\pjQytUI.exe
  C:\Windows\System\pjQytUI.exe
  2⤵
  PID:15100
- C:\Windows\System\GgwtVqM.exe
  C:\Windows\System\GgwtVqM.exe
  2⤵
  PID:15140
- C:\Windows\System\ZPYodcJ.exe
  C:\Windows\System\ZPYodcJ.exe
  2⤵
  PID:15164
- C:\Windows\System\QrSjJGH.exe
  C:\Windows\System\QrSjJGH.exe
  2⤵
  PID:15208
- C:\Windows\System\nVgfRDk.exe
  C:\Windows\System\nVgfRDk.exe
  2⤵
  PID:15224
- C:\Windows\System\nhIiFyC.exe
  C:\Windows\System\nhIiFyC.exe
  2⤵
  PID:15244
- C:\Windows\System\gmscgEY.exe
  C:\Windows\System\gmscgEY.exe
  2⤵
  PID:15280
- C:\Windows\System\XYFzrQV.exe
  C:\Windows\System\XYFzrQV.exe
  2⤵
  PID:15308
- C:\Windows\System\FcELXLW.exe
  C:\Windows\System\FcELXLW.exe
  2⤵
  PID:15336
- C:\Windows\System\IlnSUqw.exe
  C:\Windows\System\IlnSUqw.exe
  2⤵
  PID:15356
- C:\Windows\System\EabNgOl.exe
  C:\Windows\System\EabNgOl.exe
  2⤵
  PID:14348
- C:\Windows\System\JTmtCDN.exe
  C:\Windows\System\JTmtCDN.exe
  2⤵
  PID:14424
- C:\Windows\System\FmBTCdG.exe
  C:\Windows\System\FmBTCdG.exe
  2⤵
  PID:14456
- C:\Windows\System\wWdexZR.exe
  C:\Windows\System\wWdexZR.exe
  2⤵
  PID:14508
- C:\Windows\System\gptAJPU.exe
  C:\Windows\System\gptAJPU.exe
  2⤵
  PID:14596
- C:\Windows\System\bBEDgRx.exe
  C:\Windows\System\bBEDgRx.exe
  2⤵
  PID:14696
- C:\Windows\System\hcfXNkH.exe
  C:\Windows\System\hcfXNkH.exe
  2⤵
  PID:14688
- C:\Windows\System\PBwSehE.exe
  C:\Windows\System\PBwSehE.exe
  2⤵
  PID:14780
- C:\Windows\System\UxIOvWh.exe
  C:\Windows\System\UxIOvWh.exe
  2⤵
  PID:14888
- C:\Windows\System\ZmTMTrj.exe
  C:\Windows\System\ZmTMTrj.exe
  2⤵
  PID:14948
- C:\Windows\System\YyvcfcA.exe
  C:\Windows\System\YyvcfcA.exe
  2⤵
  PID:15000
- C:\Windows\System\jsWjBBz.exe
  C:\Windows\System\jsWjBBz.exe
  2⤵
  PID:15068
- C:\Windows\System\GWyRiUd.exe
  C:\Windows\System\GWyRiUd.exe
  2⤵
  PID:15116
- C:\Windows\System\EzQviCo.exe
  C:\Windows\System\EzQviCo.exe
  2⤵
  PID:15232
- C:\Windows\System\tNuiWWS.exe
  C:\Windows\System\tNuiWWS.exe
  2⤵
  PID:15272
- C:\Windows\System\NFubeJG.exe
  C:\Windows\System\NFubeJG.exe
  2⤵
  PID:15328
- C:\Windows\System\ZqsicYM.exe
  C:\Windows\System\ZqsicYM.exe
  2⤵
  PID:13992
- C:\Windows\System\EOXDhOB.exe
  C:\Windows\System\EOXDhOB.exe
  2⤵
  PID:14568
- C:\Windows\System\yIcKaTg.exe
  C:\Windows\System\yIcKaTg.exe
  2⤵
  PID:14716
- C:\Windows\System\WHVGGMh.exe
  C:\Windows\System\WHVGGMh.exe
  2⤵
  PID:14968
- C:\Windows\System\KlmKWGV.exe
  C:\Windows\System\KlmKWGV.exe
  2⤵
  PID:15028
- C:\Windows\System\ZhMEcjY.exe
  C:\Windows\System\ZhMEcjY.exe
  2⤵
  PID:15160
- C:\Windows\System\PhIVXvW.exe
  C:\Windows\System\PhIVXvW.exe
  2⤵
  PID:15332
- C:\Windows\System\rfNLuqu.exe
  C:\Windows\System\rfNLuqu.exe
  2⤵
  PID:14616
- C:\Windows\System\xvurbzK.exe
  C:\Windows\System\xvurbzK.exe
  2⤵
  PID:14808
- C:\Windows\System\ARHGIet.exe
  C:\Windows\System\ARHGIet.exe
  2⤵
  PID:15240
- C:\Windows\System\TkKkvKy.exe
  C:\Windows\System\TkKkvKy.exe
  2⤵
  PID:14772
- C:\Windows\System\dPNwuGW.exe
  C:\Windows\System\dPNwuGW.exe
  2⤵
  PID:15364
- C:\Windows\System\yvGgEzg.exe
  C:\Windows\System\yvGgEzg.exe
  2⤵
  PID:15404
- C:\Windows\System\WgyvFKf.exe
  C:\Windows\System\WgyvFKf.exe
  2⤵
  PID:15420
- C:\Windows\System\pUPAugz.exe
  C:\Windows\System\pUPAugz.exe
  2⤵
  PID:15448
- C:\Windows\System\RRezpBN.exe
  C:\Windows\System\RRezpBN.exe
  2⤵
  PID:15472
- C:\Windows\System\uTmLkZj.exe
  C:\Windows\System\uTmLkZj.exe
  2⤵
  PID:15516
- C:\Windows\System\eogDhep.exe
  C:\Windows\System\eogDhep.exe
  2⤵
  PID:15540
- C:\Windows\System\YgdVHZU.exe
  C:\Windows\System\YgdVHZU.exe
  2⤵
  PID:15564
- C:\Windows\System\ZvDPoQZ.exe
  C:\Windows\System\ZvDPoQZ.exe
  2⤵
  PID:15596
- C:\Windows\System\PWgrmpT.exe
  C:\Windows\System\PWgrmpT.exe
  2⤵
  PID:15624
- C:\Windows\System\uKIvfDY.exe
  C:\Windows\System\uKIvfDY.exe
  2⤵
  PID:15656
- C:\Windows\System\yQbbnFk.exe
  C:\Windows\System\yQbbnFk.exe
  2⤵
  PID:15676
- C:\Windows\System\SMWqGRy.exe
  C:\Windows\System\SMWqGRy.exe
  2⤵
  PID:15724
- C:\Windows\System\vnQUhUO.exe
  C:\Windows\System\vnQUhUO.exe
  2⤵
  PID:15752
- C:\Windows\System\NQYngol.exe
  C:\Windows\System\NQYngol.exe
  2⤵
  PID:15780
- C:\Windows\System\JsofwTI.exe
  C:\Windows\System\JsofwTI.exe
  2⤵
  PID:15808
- C:\Windows\System\AzSpCyg.exe
  C:\Windows\System\AzSpCyg.exe
  2⤵
  PID:15836
- C:\Windows\System\eYmNuTW.exe
  C:\Windows\System\eYmNuTW.exe
  2⤵
  PID:15864
- C:\Windows\System\gzJhHJF.exe
  C:\Windows\System\gzJhHJF.exe
  2⤵
  PID:15880
- C:\Windows\System\VmaOSDH.exe
  C:\Windows\System\VmaOSDH.exe
  2⤵
  PID:15896
- C:\Windows\System\tCiwbCk.exe
  C:\Windows\System\tCiwbCk.exe
  2⤵
  PID:15940
- C:\Windows\System\SzXhsvG.exe
  C:\Windows\System\SzXhsvG.exe
  2⤵
  PID:15956
- C:\Windows\System\cQZSdqY.exe
  C:\Windows\System\cQZSdqY.exe
  2⤵
  PID:15984
- C:\Windows\System\YjmGVFr.exe
  C:\Windows\System\YjmGVFr.exe
  2⤵
  PID:16008
- C:\Windows\System\JVrQgcl.exe
  C:\Windows\System\JVrQgcl.exe
  2⤵
  PID:16032
- C:\Windows\System\WylAQNf.exe
  C:\Windows\System\WylAQNf.exe
  2⤵
  PID:16080
- C:\Windows\System\faFlDhf.exe
  C:\Windows\System\faFlDhf.exe
  2⤵
  PID:16108
- C:\Windows\System\VExjgzT.exe
  C:\Windows\System\VExjgzT.exe
  2⤵
  PID:16140
- C:\Windows\System\SGmOrjs.exe
  C:\Windows\System\SGmOrjs.exe
  2⤵
  PID:16184
- C:\Windows\System\DSWwAza.exe
  C:\Windows\System\DSWwAza.exe
  2⤵
  PID:16208
- C:\Windows\System\zPjopSB.exe
  C:\Windows\System\zPjopSB.exe
  2⤵
  PID:16236
- C:\Windows\System\WDQmsKl.exe
  C:\Windows\System\WDQmsKl.exe
  2⤵
  PID:16252
- C:\Windows\System\hUlvoBK.exe
  C:\Windows\System\hUlvoBK.exe
  2⤵
  PID:16268
- C:\Windows\System\IporzNO.exe
  C:\Windows\System\IporzNO.exe
  2⤵
  PID:16320
- C:\Windows\System\CHiSbAB.exe
  C:\Windows\System\CHiSbAB.exe
  2⤵
  PID:16336
- C:\Windows\System\aWcpEzU.exe
  C:\Windows\System\aWcpEzU.exe
  2⤵
  PID:16352
- C:\Windows\System\BaJFjOx.exe
  C:\Windows\System\BaJFjOx.exe
  2⤵
  PID:15388
- C:\Windows\System\VPpSDqZ.exe
  C:\Windows\System\VPpSDqZ.exe
  2⤵
  PID:15432
- C:\Windows\System\YKwLAfS.exe
  C:\Windows\System\YKwLAfS.exe
  2⤵
  PID:15460
- C:\Windows\System\udPADZV.exe
  C:\Windows\System\udPADZV.exe
  2⤵
  PID:15508
- C:\Windows\System\JrkTFXW.exe
  C:\Windows\System\JrkTFXW.exe
  2⤵
  PID:15588
- C:\Windows\System\puRMXHM.exe
  C:\Windows\System\puRMXHM.exe
  2⤵
  PID:15696
- C:\Windows\System\iqpYpEp.exe
  C:\Windows\System\iqpYpEp.exe
  2⤵
  PID:15736
- C:\Windows\System\eyVEjwe.exe
  C:\Windows\System\eyVEjwe.exe
  2⤵
  PID:15820
- C:\Windows\System\SxSreoD.exe
  C:\Windows\System\SxSreoD.exe
  2⤵
  PID:15856
- C:\Windows\System\hDvXhnJ.exe
  C:\Windows\System\hDvXhnJ.exe
  2⤵
  PID:15932
- C:\Windows\System\DIRiweL.exe
  C:\Windows\System\DIRiweL.exe
  2⤵
  PID:16052
- C:\Windows\System\zODBNxl.exe
  C:\Windows\System\zODBNxl.exe
  2⤵
  PID:16024
- C:\Windows\System\oiradEZ.exe
  C:\Windows\System\oiradEZ.exe
  2⤵
  PID:16136
- C:\Windows\System\Folivws.exe
  C:\Windows\System\Folivws.exe
  2⤵
  PID:16180
- C:\Windows\System\rYlEhBU.exe
  C:\Windows\System\rYlEhBU.exe
  2⤵
  PID:16228
- C:\Windows\System\QhxFXkd.exe
  C:\Windows\System\QhxFXkd.exe
  2⤵
  PID:16264
- C:\Windows\System\uAlDsnm.exe
  C:\Windows\System\uAlDsnm.exe
  2⤵
  PID:14724
- C:\Windows\System\pEpHmiO.exe
  C:\Windows\System\pEpHmiO.exe
  2⤵
  PID:15552
- C:\Windows\System\oWjZDPd.exe
  C:\Windows\System\oWjZDPd.exe
  2⤵
  PID:14496
- C:\Windows\System\kezqsoH.exe
  C:\Windows\System\kezqsoH.exe
  2⤵
  PID:15796
- C:\Windows\System\kQwOlOt.exe
  C:\Windows\System\kQwOlOt.exe
  2⤵
  PID:15916
- C:\Windows\System\iQMXVNa.exe
  C:\Windows\System\iQMXVNa.exe
  2⤵
  PID:16016
- C:\Windows\System\PLtmHEP.exe
  C:\Windows\System\PLtmHEP.exe
  2⤵
  PID:16120
- C:\Windows\System\fSGwPrD.exe
  C:\Windows\System\fSGwPrD.exe
  2⤵
  PID:16220
- C:\Windows\System\QhRLpNo.exe
  C:\Windows\System\QhRLpNo.exe
  2⤵
  PID:15572
- C:\Windows\System\htYPCqX.exe
  C:\Windows\System\htYPCqX.exe
  2⤵
  PID:15852
- C:\Windows\System\RruErJU.exe
  C:\Windows\System\RruErJU.exe
  2⤵
  PID:16160
- C:\Windows\System\JsSFaQX.exe
  C:\Windows\System\JsSFaQX.exe
  2⤵
  PID:16100
- C:\Windows\System\nTjcOTE.exe
  C:\Windows\System\nTjcOTE.exe
  2⤵
  PID:16404
- C:\Windows\System\aGvttZm.exe
  C:\Windows\System\aGvttZm.exe
  2⤵
  PID:16428
- C:\Windows\System\vNrgwVM.exe
  C:\Windows\System\vNrgwVM.exe
  2⤵
  PID:16444
- C:\Windows\System\dwWXKfY.exe
  C:\Windows\System\dwWXKfY.exe
  2⤵
  PID:16480
- C:\Windows\System\AcknwYm.exe
  C:\Windows\System\AcknwYm.exe
  2⤵
  PID:16508
- C:\Windows\System\wJRmBrS.exe
  C:\Windows\System\wJRmBrS.exe
  2⤵
  PID:16540
- C:\Windows\System\VKnTIvz.exe
  C:\Windows\System\VKnTIvz.exe
  2⤵
  PID:16580
- C:\Windows\System\exNJrEh.exe
  C:\Windows\System\exNJrEh.exe
  2⤵
  PID:16608
- C:\Windows\System\gvUJjhV.exe
  C:\Windows\System\gvUJjhV.exe
  2⤵
  PID:16628
- C:\Windows\System\jtirrwz.exe
  C:\Windows\System\jtirrwz.exe
  2⤵
  PID:16676
- C:\Windows\System\mIrreHa.exe
  C:\Windows\System\mIrreHa.exe
  2⤵
  PID:16692
- C:\Windows\System\ECduWSN.exe
  C:\Windows\System\ECduWSN.exe
  2⤵
  PID:16716
- C:\Windows\System\isVKYJv.exe
  C:\Windows\System\isVKYJv.exe
  2⤵
  PID:16740

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AvrqVIv.exe

Filesize
1.4MB

MD5
78d4c4d5c938534a2ff04d114e509949

SHA1
13f66db0d5a905419a6c26be4fe1dd5d1d7d66a8

SHA256
f0559dd0eb8fb19035fd0376f6b025e70b3610bbb8c1bb935ffac0cc198c219b

SHA512
005d644cac653cf184523c9982747b72124916676414cf4d1d199c242e149c2b01d5430952da0242c8763c7aa955083d5caaeb7aef895287064af5012d0b2c9e

Download Submit
C:\Windows\System\BIMsaJz.exe

Filesize
1.3MB

MD5
59257e794dcf3c94b9836bbd52964aba

SHA1
dc6796ae7aca336b2c502ec340557c8ce098b128

SHA256
449d774b4a5de1852f09375b785662800bfddae01ca4fa2f59551001661fb25a

SHA512
20cc52d5c15cc7968cf120e5ae9d3a635d3f6bbb0dc0d720a4171a709366af34be5a1970827e35df5fad0961455fd1f28c26120bfd8c6b4fb61fa218ce1b2295

Download Submit
C:\Windows\System\BbJzniM.exe

Filesize
1.4MB

MD5
18d715bfde98c16614f0823c639c0884

SHA1
f58904ce96e307a1a54eed468bfc8341dd051529

SHA256
fa8e374c2d67f52c27505cda5da9c79f345947c8b25c6eea21ce0b25ba7553cf

SHA512
9c2b8b0090292b25fe296bb1bee75abbebd04fdf52a256f7e61ceca5bd80fc0d44492552b22b00514e445af05a7b428188027ca383a5b7722c218f226b9df764

Download Submit
C:\Windows\System\CCeFZIx.exe

Filesize
1.4MB

MD5
83d78ed49851ed42f35aac44e477e921

SHA1
5074b2e155a59322dd3887ad4f7fc40002d959d8

SHA256
3aaa1ae5bb604acac79199922d111b4be8e6229d6771d0672a5165b1ca616606

SHA512
be8800f59a9445bdd6ce2124272ead6329f2f896b16b74b60d83ca846cbf93830c21f9ef11ccbef375d271e383df0bfab68c679a16d0bf625fbf465b143cf7cb

Download Submit
C:\Windows\System\CsJxcty.exe

Filesize
1.3MB

MD5
d3e8b6f819799d578f475aef41b951b1

SHA1
27b778b1471f4e52ec4e6dccb9e479069dddb6c0

SHA256
d1add7a7de2ca95cfffc5a38cd38b2fdebcd72388a6111c1b8655056ddb5ceaa

SHA512
971fbe1e171486b5f6077d2f25ebe4de59bcb92ea584f345792e0ac0961b79b73c2a8607991cd2d7665f2156618229e4f6e8cdec854c5dd98dd2e1212897eb27

Download Submit
C:\Windows\System\GIvrCTD.exe

Filesize
1.3MB

MD5
d94cb49edbffe75f042b008622764782

SHA1
5501148c8f51132f1d1bb85ae08b71d3d38685d9

SHA256
68a389d58527659ca84bfaa8bed140ffda87a5d96045534e797a353b1f54a716

SHA512
b9d4fe29553a53f71cd77dc1f0046c7186cf19bfb3a2dd6419fcb3adf0bade70149b02d33e06b5d872dd7dcf3f4ba0701ba6f3c1c695a7081c99d46d7d8d3d22

Download Submit
C:\Windows\System\IptDOFF.exe

Filesize
1.3MB

MD5
49bcc0070c1564bf8ec6ec5dd11478f0

SHA1
58dc785832f3b14cae8d6d733d3fac67508bdcb1

SHA256
3d001c0c5caccba964804a5aad99bb5ad99c3104a294ad70673930033068b131

SHA512
377709def2b39bc2a54fd487af2052e58f621dae205f22be1c956a53cab52593d1458e641b804b75c69fb7258309aafcaa51e61b39307abf0a442dad63a6c317

Download Submit
C:\Windows\System\KFkCQkj.exe

Filesize
1.3MB

MD5
3a74631e964cec801c91f59030fa9324

SHA1
4b86dfe3face8cc9c6f9bc66bb86eef06b312a7d

SHA256
17cc3f688bac38f23c7ed28466b23e88997e154b313d27ace9b7ad98995a7b93

SHA512
9f29759113a10bd3a3abf3707a5026530d614aa34973995e31e1da16a7d39bf4682558036fd0faacc7ccb5cc67f778a9e7654b4c8c083ebc363e06f0a562b6ec

Download Submit
C:\Windows\System\KMntcPk.exe

Filesize
1.4MB

MD5
3f4b3cba59f1450125adf6f244323963

SHA1
712b5624fab8d5659d01fcc2fcd2670297a4deba

SHA256
840a511b432e9a54e7fc13d57a93d88dcc2b13847b394bc6bb8ea6bcd7f94151

SHA512
b5362e611f6cdfb14f1432d7ef544838b516921abf67972cf96d5e99fd7b01cdea9e9377ea6c4ef40e4ab7b9b4ae26ab4551e86de5a79fe7d0f1e8263d6efcb6

Download Submit
C:\Windows\System\PNiitAU.exe

Filesize
1.3MB

MD5
3ac60cc4f6c9f95592af8c5f1b834d53

SHA1
9664ff8880cfec4e26f35749cc83278a92f34770

SHA256
788a8eb40772f76dd3f657df9120fd0882fae9c1052658ef8fb0f7b6dcc23d02

SHA512
95b8b8d6bbe54ba5ed59af65780f5ba144149e8eb271c3915f49dc880b4c024b1077607adad385d4b2772f12902f8ed02c0304c983efe8b5faf5309b46077ffb

Download Submit
C:\Windows\System\QrHMJVO.exe

Filesize
1.3MB

MD5
79297f3b0dfaa9a2618ab05abc734003

SHA1
12d9df825911763df302bc02e101485111a8a276

SHA256
6a245fc336153238a517396e3ee2602b811b3d478e1daac688485344f49f309d

SHA512
3b5c8eac15996c4acbe8988155c42b3c37e38738bbde4599ba6e532328edd7a43e8b9467865ca0e388628a7f33f6ecabaaaba28a8882695784dcc1ceafec36b5

Download Submit
C:\Windows\System\RUslZPm.exe

Filesize
1.3MB

MD5
38da5154b092eab060d7b5f1a46f41e3

SHA1
debafa78b03957ac2c729194a2c2b4837b64068c

SHA256
d10fbde73035b1e46383ceddb74ceda428ace97b54496469e0c9ddc74cf2e494

SHA512
15bf1cea3518af5c7a6a210326fcc0b037be7da6677f61dedb7f8090c3111dcc6ede7731e71db2396f32d4620ed5e45a09fdb1a916490438331300b6b69da4f7

Download Submit
C:\Windows\System\SGXLyNw.exe

Filesize
1.3MB

MD5
f11eb7729b588540ed5ad4502f14f5b0

SHA1
76a2b1fe69e3b053ab8274b57368371c01430fa4

SHA256
b3f5e51c40df2733fa4d6d8a96c85075ffd9adbc01883779a0f5d6e66241abb7

SHA512
203470fe50abd8379be1a5bbf5c6e686d70fcc00d2225d91d589289a20939d82846b749ac42543ef0ade63ea7d7df33d544e07ad7b6f2f35761be0493d6f93b4

Download Submit
C:\Windows\System\SNjDxAk.exe

Filesize
1.4MB

MD5
d2494b625b841b5125b5b626e59d4f2b

SHA1
17301c90c9f4a0fd45e2f3f11532d950ac06e719

SHA256
8307fe8f35da42cb5d5d87e9135626a7f73b6162f32138151ea3b4e0aa684b51

SHA512
07962603470f67cbb5d97a9287f51d0e0e679e5e7abc7ba8c91e4bb75f99827a0dc01ea371daf9928c96dce5ac114f76fb6bf03fbb50f4da585866b1c5eaee61

Download Submit
C:\Windows\System\SVBPOLi.exe

Filesize
1.3MB

MD5
ebe84d7ca7485868141aca55c341365f

SHA1
fca1426facc1634c2d1fc7c528085ca5d1030650

SHA256
fa5a7e730c9a4c76d09f63232dd458eccd5c8673c38ece39725f1334e001dee4

SHA512
cf76cddd0d82770edaa6bfda3c13c11d1ad96483a5102fe7b61b752d555f47b2ab07a1d6bbcd875b43433b29bcda7483df91592a3e18e28008899457326eb059

Download Submit
C:\Windows\System\TamDpcm.exe

Filesize
1.3MB

MD5
2d3a35196a7e2d80d2ebcfb8d7d86995

SHA1
bf4930e336114bd60abdf655967756d3e8f52b44

SHA256
a57498e8d58029f75697b8d1045a5643f1170386706028f7bc8487feadde2c46

SHA512
ff6629bc33a1119d68a6f6d9d98390188b7ac98455bdba93cd3fc849cbc39c3f12b3efa20a988263d2ec5b9c7ab02203118a3345e7d22483ec281e178b3dd066

Download Submit
C:\Windows\System\UDadFpH.exe

Filesize
1.4MB

MD5
8e424281afa4109beb30c39389abd61f

SHA1
30f33b843b5ecd3eba005d1239002986ce131175

SHA256
2aa7ac19b53370184d756808c0cbe0e6235b315284fbc12bd30f28fcc8d6ea04

SHA512
1cb0e2b5c123134386d15ae61f8e5836b7d9a08b7e8b177f7cfe954995f4291d5f98c6a0de5a9b7757e02423f48a3d2e7a7c79853614f3b996308878900fad05

Download Submit
C:\Windows\System\VYgQprq.exe

Filesize
1.3MB

MD5
b30dcd2c698ebea217a21a50f94f4e76

SHA1
0f736a91cb397b0529e164c24ef925b13cdfc4d8

SHA256
28ae3144cafbcebf420db8c1f6d472876e32d0971adbdac17958143774a94215

SHA512
f1afda19c86eb9e2476964a968faefd9978fb62e3e9ab17895992648d02b5b99056533404813a68558d627bd1bd243cdfa730ceb7380d0650163e6a257809818

Download Submit
C:\Windows\System\XRzhJyX.exe

Filesize
1.4MB

MD5
a496aece2c48b07c8382e10aae205d5d

SHA1
98512354796b80eaa044d6e34cd80ba452a8df68

SHA256
f276ac9484a11ff8b432c52d88cb65284428f5ab091672bcbc9ebcecdeef4b2a

SHA512
2d60bc4f0d0712ac43d30b37eb7505f7098ef4fc22a1c6489995f6f87b6fae8a62b10172fa1cfaa109e81699499ecfe985b50bd1efd643411db7b3562bdda8f9

Download Submit
C:\Windows\System\XzmkQDs.exe

Filesize
1.3MB

MD5
9d442e61d75818db488ac366e44536ec

SHA1
ce4134cfe1c0be6d73810a0d01d6eaab0b0b42e1

SHA256
34b35263b4b8234dee9cb92dd8730893d9b2b2a0863bbd2e8f34a303d1b014d2

SHA512
d423e4ae712a0738dfa10858ae42124a0d5c7c8feed2fbac86ec064cd4fb4982b6df79947c22616f47c703206a76ee0a2d5879a4a18e674782ae474f4c784e49

Download Submit
C:\Windows\System\YOFNweb.exe

Filesize
1.4MB

MD5
ac19fe5946d07fddb55015447f77bbcb

SHA1
4bee15a5e24cefc661c06577f6e6d128650aaa77

SHA256
6b0fd03bd8f1e65f1aa5ca4bdd8cba1d38e6fac4760ce6190e515487bc04ed7f

SHA512
4ff9907bc723183af240a86ac68ff24023881c09af62c506c907d7b09aa0f871376c81560cec524806db96f53b2e65cd79e72443fab3717daee0ef720071666e

Download Submit
C:\Windows\System\aqYmFaH.exe

Filesize
1.3MB

MD5
1f3502a64101ee1f9a6fa81fbc7a8bb5

SHA1
219a18e753aa117b0eb91ac589fabd5a368676a4

SHA256
8c91dd544a5d990603c4b96f1c7a8db66215d9c2b57c974ff96b7c9ad1690d67

SHA512
a7d0dc0f242f8de2869d46f040a85f9569dffe343bb19b3509ccdfcd1611a13400619eb663eb736aa2716bd443194ae6a411d3886a27ac9d8b90a63b433016f0

Download Submit
C:\Windows\System\eOSwktc.exe

Filesize
1.3MB

MD5
2d98c26047b05135848a053d43531011

SHA1
33d85d97224df06f71a4deb9deb8534990fc2490

SHA256
2b220c9ad71f5cc73dbdb991df52aaa7725451c02db90fdd171d95f36aba045d

SHA512
5b20aa55fc71c7bb2ad5dc58dbaba58a9ac11ab76384a9e0ea178deb58acd7b77c889397126f440310e9ed177bcc713273dda1ca13a85d676b423290fbe09dca

Download Submit
C:\Windows\System\eqLeyht.exe

Filesize
1.4MB

MD5
d5305117112d5686dcf4f67712178254

SHA1
639c2dd1906b1f1067ba479c55bf8f824c50bc5d

SHA256
55553dc848a73433bb4a937b5456fa24a1af70691df1e33f10736304c83e8d08

SHA512
5c75ed22cd6b0272c896004a53482ec2a2bd5aea188293416ed05611348870df85496e8b7728f3ebcaa9c14b050eace1f2a8b09cf2ac0c1798b6ce279dd6127a

Download Submit
C:\Windows\System\hzhqECi.exe

Filesize
1.3MB

MD5
c01d98b089653d81e47639f97f22bc47

SHA1
b7701c433da7e2486ed44e1f1a86536f36d6bacc

SHA256
64bd03c88e9d89cc58d9be5f528321e860b4024a75639d2194d3290aa33f6e11

SHA512
a7560ad5cf50dbb9ee58724cef67c5cd88c66b7cb895dd002a89f307c5c6c537a433c534b91f948c0eb9297d6c8c846daa3f65fb53aa7cf83a834a607328f45b

Download Submit
C:\Windows\System\jxVIVRz.exe

Filesize
1.3MB

MD5
50231875ab3d4fd75ed5d6889882f17a

SHA1
85e5772bbd75af6af30acc97a0991a1c736de818

SHA256
ace386fbbfb7509fec11f926b0014faac41e034a1ff65f72ab12f252cf99476e

SHA512
54f5140ac2e078fa909a2d2a8e050e8fb9a3234685c6854d09b86a04de9edbd0a761541968bfeef08ef35e2cfb099bddc85c5b7931cd00c56978ae5e8cab54fd

Download Submit
C:\Windows\System\kEfoSkF.exe

Filesize
1.4MB

MD5
46798e7ddb6fc9845476343b27879fcf

SHA1
801be0c03a6fa9b30c4f4c96dbc0841a41da5fff

SHA256
b36b4c99a31780ad40ae1856477c8bee2aae4b4332b2f2b750ea99d976ed46be

SHA512
dcb83e197a204e46994960d49627f22261551572735a7de44cf294bcbaecc26ed572368f188da7118eaeef367082af8e1c0e7fb2ef0d4a1e560cfa314ea1a508

Download Submit
C:\Windows\System\kUdTNBA.exe

Filesize
18B

MD5
839f17714c3b04fb55ce346847304ede

SHA1
160d2161bdcae005510311e49b0391507fbfe987

SHA256
de5ad7bcb3eba56dff1165796a896f3a0f536a169ae8de4b35148408aadbbc2c

SHA512
f98f6b00d0dee741b76b925fb419c585916192e8d523ff1e412ca602adb602ae2496b813b2f638727cc8130fcd3cd793388d48c0d11bd07ec82670c3e68bdc9e

Download Submit
C:\Windows\System\mNqEvJw.exe

Filesize
1.4MB

MD5
d48b67924a4b8975aa94333b55bd65bf

SHA1
2bed1357deb6df7722e8893e95660647690cadc2

SHA256
2db9a8ebf6d6b16084ba8536e61f65b44c00098518ec0ee36efd1444d37a3952

SHA512
d63c332e015c78ba60078e2bd4030af188a56720695c9189aa22241a08bbb44710dd1443ac0b86ef511874e8fc1653f2302f78989f5aef30dc0cca6a58e43dfa

Download Submit
C:\Windows\System\mgvNWjw.exe

Filesize
1.3MB

MD5
40de15f9745fc8c7a1af1412987b7afa

SHA1
b753b5c01157467297ecdcbd7e290dc7582b9175

SHA256
07172319449d11e6705f841facc769667cd5e64a16976a7134c5a4259eca2f29

SHA512
24c839400db96fc39f91d30716285939fa4c720c7dce271e890a38caf711d2e696debe6ce561c5cf8226e3df0043f9c06347d7bc49d939740bcdb2281a2469fe

Download Submit
C:\Windows\System\sIKhMpZ.exe

Filesize
1.4MB

MD5
64c175d19e07268fa77d0baf2528c4be

SHA1
7159da025d84e2cb158ef6760e373b11aca177ec

SHA256
5d3565de83fcb5f5887ef26b33b58a9ee04ff208f051a4a64b16ec1802750b89

SHA512
2b284305ebe710c03ac340187f8a5a5ce37add9efcfcb56a8e3ee464512b0fe029e0239963c5a3b273349548caac4611f25fa5c668f7fc8216832b9081a695ed

Download Submit
C:\Windows\System\thDdQfC.exe

Filesize
1.3MB

MD5
ec843134fd38999a2451f6dc3ea9915c

SHA1
102806548a68f83230ed67ea46320cc99333086c

SHA256
7219aaa8e0782a16371c8eb2c2e3f31b71f8636fd6475fdfe88e24df8b2e1cef

SHA512
16b759a93dcbcc4eb256801296902a56441a864f37a88e6fe70c2b2d2dafeab690ccfb0bbc7feb0b3ffe9df0ecef130332b05f15aa395a7d81e71516d3348446

Download Submit
C:\Windows\System\wlbcRyI.exe

Filesize
1.4MB

MD5
6e6f7353d30dd7fc60e8c06653cbc2b5

SHA1
fa8b2431e7da3e125852e9af3002aae30e9621c7

SHA256
971a5dde72a8966607d557d6570bde4f57f3808e2a377aa95b59c16c2f79d5d5

SHA512
c30e43bb938758ea4b3b219a80fdfa8d4d0c4aa80489f2f24771349fdcb17bd6bc34b71786ed85aca182a2a92c808bfbad40cbc08e6cee387303deafa88a6d86

Download Submit
C:\Windows\System\zraEJsj.exe

Filesize
1.3MB

MD5
1c26664f7ccab8cabf7f9a1bb45ff6bc

SHA1
dbbf524f4f95abbb9f9c9b4ccf4686025a679f7f

SHA256
ac50a001d18b6a037c6fbb34981d7148d00963de909155c50360237b8642bac7

SHA512
0dac9b6bb231703f05c5416aa5aa28b6039eab1b04c965bb9a02917bd19465d7deb617c23b15c6923d7a88503b723d4e17cf917bcf1856fbf32f63025e0b37b0

Download Submit
memory/3200-0-0x00000194446F0000-0x0000019444700000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads