xmrig | 48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
Size

1.1MB
MD5

c88cae603cd588cf4f7d504a33228f7b
SHA1

fa61eeb04b1992cca7a7b245920ca52c9359fca0
SHA256

48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd
SHA512

91e13043adbf56673efed0c44509c6675ae2535816b60c46084ec65745999c4fba0a4fd3f8bebe6b2d66a9f8ec3c48d41fdc6aac0cce4e2342eddafe6ea96e9c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMru475N28CR:GezaTF8FcNkNdfE0pZ9ozttwIRQNdX4

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b88-4.dat	xmrig
behavioral2/files/0x0007000000023c72-7.dat	xmrig
behavioral2/files/0x0008000000023c71-8.dat	xmrig
behavioral2/files/0x0007000000023c76-28.dat	xmrig
behavioral2/files/0x0007000000023c75-33.dat	xmrig
behavioral2/files/0x0007000000023c74-31.dat	xmrig
behavioral2/files/0x0007000000023c73-29.dat	xmrig
behavioral2/files/0x0007000000023c77-39.dat	xmrig
behavioral2/files/0x0007000000023c7a-49.dat	xmrig
behavioral2/files/0x0007000000023c7c-62.dat	xmrig
behavioral2/files/0x0007000000023c7f-73.dat	xmrig
behavioral2/files/0x0007000000023c81-84.dat	xmrig
behavioral2/files/0x0007000000023c80-79.dat	xmrig
behavioral2/files/0x0007000000023c7b-74.dat	xmrig
behavioral2/files/0x0007000000023c7d-75.dat	xmrig
behavioral2/files/0x0007000000023c7e-66.dat	xmrig
behavioral2/files/0x0008000000023c6f-59.dat	xmrig
behavioral2/files/0x0007000000023c79-50.dat	xmrig
behavioral2/files/0x0007000000023c86-107.dat	xmrig
behavioral2/files/0x0007000000023c87-137.dat	xmrig
behavioral2/files/0x0007000000023c8d-149.dat	xmrig
behavioral2/files/0x0007000000023c8c-147.dat	xmrig
behavioral2/files/0x0007000000023c8b-145.dat	xmrig
behavioral2/files/0x0007000000023c8a-143.dat	xmrig
behavioral2/files/0x0007000000023c89-141.dat	xmrig
behavioral2/files/0x0007000000023c88-139.dat	xmrig
behavioral2/files/0x0007000000023c85-135.dat	xmrig
behavioral2/files/0x0007000000023c84-133.dat	xmrig
behavioral2/files/0x0007000000023c83-123.dat	xmrig
behavioral2/files/0x0007000000023c82-121.dat	xmrig
behavioral2/files/0x0007000000023c8e-154.dat	xmrig
behavioral2/files/0x0007000000023c90-160.dat	xmrig
behavioral2/files/0x0007000000023c8f-158.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
736	FAlGFRG.exe
4768	ZBYUHjO.exe
4444	NOkzVhN.exe
2944	lcgpEuU.exe
3364	nwjDZQq.exe
1080	koWhdLN.exe
3160	mrUNFwE.exe
2028	IhphLXs.exe
1560	TdrSMwX.exe
700	gmxOhlI.exe
1420	rcncwRt.exe
1980	DpfHYlg.exe
4420	oAtcoJU.exe
5016	eYFACOE.exe
4084	tvdQFeh.exe
4956	qnwfadn.exe
2388	ccdchYd.exe
3060	MUAnKpr.exe
2948	kVeMaUr.exe
1680	TZYmCRb.exe
1332	RFfNTYs.exe
4824	ALtrCtd.exe
624	kDXAhRr.exe
2376	zWjjmWe.exe
1484	AuDuuSB.exe
760	ojbsGTZ.exe
756	hjMCTXh.exe
1856	NdGbnbV.exe
468	jUNpJII.exe
3120	VcyqOim.exe
2072	jbQhBtr.exe
4352	PvOvBrE.exe
2036	uvPHBLk.exe
3200	BDTAWJA.exe
3636	TExcfTa.exe
720	QcNBNhM.exe
4668	RgUzGNj.exe
4528	PRNdLCV.exe
380	nQggPLc.exe
4556	ZpFKTmz.exe
2644	XJFLutU.exe
2904	LSrkFxa.exe
4384	ZIncqFv.exe
3548	uEilmKe.exe
3488	NUNkffZ.exe
2880	kcbvPXQ.exe
3640	ZyqgARy.exe
4628	WLhzZrE.exe
3680	YiJJWHf.exe
1580	yFdKpUa.exe
316	KaSAyXC.exe
3236	fOYsvDg.exe
4024	zdKOuZG.exe
868	gIVisNQ.exe
4776	KeGKaOV.exe
3076	NkXsrhq.exe
2716	LbnevpM.exe
4652	QXrKEor.exe
3248	XklMrFC.exe
4832	YCNQRxW.exe
4640	sQBBkeW.exe
2896	SMvRTEM.exe
4684	FCbwgGP.exe
2688	YqMPTlZ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cWRRVra.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\FalAfBw.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\RfAPbGe.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\cbYpULc.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\yQhcfRm.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\siawjDM.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\fOuLSNc.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\Eedxbuc.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\uNDDQXr.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\PjcDEgV.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\zJlMFDX.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\XciDdsX.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\ogVmGzd.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\ihhvqvu.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\ICnAgIo.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\SaMtruX.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\ALtrCtd.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\qtXeucm.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\IqVicpf.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\ecMXLuY.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\TmCVTeK.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\BEjjPgX.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\ihQkBTH.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\UMKMKig.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\LzZaGzx.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\mzfPAFb.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\XeweBoT.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\rhkwnRO.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\dvVaefd.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\yPrkQib.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\AuDuuSB.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\HYYimKC.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\squGDLT.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\MZJYtav.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\lJpNzyx.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\NUdpmYS.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\RKfBpzC.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\cxjydir.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\VqJBOnk.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\whChRRM.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\HzxVQbL.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\ojbsGTZ.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\eBTiAam.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\kAtIphS.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\ydbzqnJ.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\midbkMP.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\mUQhjhy.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\PipcGVO.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\tGJTaal.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\LEjvZMB.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\EKyBXTd.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\MhdmaWl.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\mQCKStd.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\CXUbcsZ.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\rhLKpeG.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\jpEkyzu.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\gjOVPgz.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\jLjDoHJ.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\ROqCngQ.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\DkWUUTp.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\tjiBous.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\AdYrzfe.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\CcgHRlK.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
File created	C:\Windows\System\MHImMsJ.exe	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15604	dwm.exe
Token: SeChangeNotifyPrivilege	15604	dwm.exe
Token: 33	15604	dwm.exe
Token: SeIncBasePriorityPrivilege	15604	dwm.exe
Token: SeShutdownPrivilege	15604	dwm.exe
Token: SeCreatePagefilePrivilege	15604	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 736	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	84
PID 2556 wrote to memory of 736	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	84
PID 2556 wrote to memory of 4768	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	85
PID 2556 wrote to memory of 4768	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	85
PID 2556 wrote to memory of 4444	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	86
PID 2556 wrote to memory of 4444	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	86
PID 2556 wrote to memory of 2944	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	87
PID 2556 wrote to memory of 2944	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	87
PID 2556 wrote to memory of 3364	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	88
PID 2556 wrote to memory of 3364	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	88
PID 2556 wrote to memory of 1080	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	89
PID 2556 wrote to memory of 1080	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	89
PID 2556 wrote to memory of 3160	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	90
PID 2556 wrote to memory of 3160	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	90
PID 2556 wrote to memory of 2028	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	91
PID 2556 wrote to memory of 2028	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	91
PID 2556 wrote to memory of 1560	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	92
PID 2556 wrote to memory of 1560	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	92
PID 2556 wrote to memory of 1980	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	93
PID 2556 wrote to memory of 1980	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	93
PID 2556 wrote to memory of 700	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	94
PID 2556 wrote to memory of 700	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	94
PID 2556 wrote to memory of 1420	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	95
PID 2556 wrote to memory of 1420	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	95
PID 2556 wrote to memory of 4420	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	96
PID 2556 wrote to memory of 4420	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	96
PID 2556 wrote to memory of 5016	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	97
PID 2556 wrote to memory of 5016	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	97
PID 2556 wrote to memory of 4084	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	98
PID 2556 wrote to memory of 4084	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	98
PID 2556 wrote to memory of 4956	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	99
PID 2556 wrote to memory of 4956	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	99
PID 2556 wrote to memory of 2388	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	100
PID 2556 wrote to memory of 2388	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	100
PID 2556 wrote to memory of 3060	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	101
PID 2556 wrote to memory of 3060	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	101
PID 2556 wrote to memory of 2948	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	102
PID 2556 wrote to memory of 2948	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	102
PID 2556 wrote to memory of 1680	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	103
PID 2556 wrote to memory of 1680	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	103
PID 2556 wrote to memory of 1332	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	104
PID 2556 wrote to memory of 1332	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	104
PID 2556 wrote to memory of 4824	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	105
PID 2556 wrote to memory of 4824	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	105
PID 2556 wrote to memory of 624	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	106
PID 2556 wrote to memory of 624	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	106
PID 2556 wrote to memory of 2376	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	107
PID 2556 wrote to memory of 2376	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	107
PID 2556 wrote to memory of 1484	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	108
PID 2556 wrote to memory of 1484	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	108
PID 2556 wrote to memory of 760	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	109
PID 2556 wrote to memory of 760	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	109
PID 2556 wrote to memory of 756	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	110
PID 2556 wrote to memory of 756	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	110
PID 2556 wrote to memory of 1856	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	111
PID 2556 wrote to memory of 1856	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	111
PID 2556 wrote to memory of 468	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	112
PID 2556 wrote to memory of 468	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	112
PID 2556 wrote to memory of 3120	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	113
PID 2556 wrote to memory of 3120	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	113
PID 2556 wrote to memory of 2072	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	114
PID 2556 wrote to memory of 2072	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	114
PID 2556 wrote to memory of 4352	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	115
PID 2556 wrote to memory of 4352	2556	48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe	115

C:\Users\Admin\AppData\Local\Temp\48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe
"C:\Users\Admin\AppData\Local\Temp\48f97250bf8d0c2c652315a89829c472889fee3d0b135ca8abe46ca77aa9c7cd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\System\FAlGFRG.exe
  C:\Windows\System\FAlGFRG.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\ZBYUHjO.exe
  C:\Windows\System\ZBYUHjO.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\NOkzVhN.exe
  C:\Windows\System\NOkzVhN.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\lcgpEuU.exe
  C:\Windows\System\lcgpEuU.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\nwjDZQq.exe
  C:\Windows\System\nwjDZQq.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\koWhdLN.exe
  C:\Windows\System\koWhdLN.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\mrUNFwE.exe
  C:\Windows\System\mrUNFwE.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\IhphLXs.exe
  C:\Windows\System\IhphLXs.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\TdrSMwX.exe
  C:\Windows\System\TdrSMwX.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\DpfHYlg.exe
  C:\Windows\System\DpfHYlg.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\gmxOhlI.exe
  C:\Windows\System\gmxOhlI.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\rcncwRt.exe
  C:\Windows\System\rcncwRt.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\oAtcoJU.exe
  C:\Windows\System\oAtcoJU.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\eYFACOE.exe
  C:\Windows\System\eYFACOE.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\tvdQFeh.exe
  C:\Windows\System\tvdQFeh.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\qnwfadn.exe
  C:\Windows\System\qnwfadn.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\ccdchYd.exe
  C:\Windows\System\ccdchYd.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\MUAnKpr.exe
  C:\Windows\System\MUAnKpr.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\kVeMaUr.exe
  C:\Windows\System\kVeMaUr.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\TZYmCRb.exe
  C:\Windows\System\TZYmCRb.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\RFfNTYs.exe
  C:\Windows\System\RFfNTYs.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\ALtrCtd.exe
  C:\Windows\System\ALtrCtd.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\kDXAhRr.exe
  C:\Windows\System\kDXAhRr.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\zWjjmWe.exe
  C:\Windows\System\zWjjmWe.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\AuDuuSB.exe
  C:\Windows\System\AuDuuSB.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\ojbsGTZ.exe
  C:\Windows\System\ojbsGTZ.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\hjMCTXh.exe
  C:\Windows\System\hjMCTXh.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\NdGbnbV.exe
  C:\Windows\System\NdGbnbV.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\jUNpJII.exe
  C:\Windows\System\jUNpJII.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\VcyqOim.exe
  C:\Windows\System\VcyqOim.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\jbQhBtr.exe
  C:\Windows\System\jbQhBtr.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\PvOvBrE.exe
  C:\Windows\System\PvOvBrE.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\uvPHBLk.exe
  C:\Windows\System\uvPHBLk.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\QcNBNhM.exe
  C:\Windows\System\QcNBNhM.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\BDTAWJA.exe
  C:\Windows\System\BDTAWJA.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\TExcfTa.exe
  C:\Windows\System\TExcfTa.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\RgUzGNj.exe
  C:\Windows\System\RgUzGNj.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\PRNdLCV.exe
  C:\Windows\System\PRNdLCV.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\nQggPLc.exe
  C:\Windows\System\nQggPLc.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\ZpFKTmz.exe
  C:\Windows\System\ZpFKTmz.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\XJFLutU.exe
  C:\Windows\System\XJFLutU.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\LSrkFxa.exe
  C:\Windows\System\LSrkFxa.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\kcbvPXQ.exe
  C:\Windows\System\kcbvPXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ZIncqFv.exe
  C:\Windows\System\ZIncqFv.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\uEilmKe.exe
  C:\Windows\System\uEilmKe.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\NUNkffZ.exe
  C:\Windows\System\NUNkffZ.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\KaSAyXC.exe
  C:\Windows\System\KaSAyXC.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\fOYsvDg.exe
  C:\Windows\System\fOYsvDg.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\ZyqgARy.exe
  C:\Windows\System\ZyqgARy.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\WLhzZrE.exe
  C:\Windows\System\WLhzZrE.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\YiJJWHf.exe
  C:\Windows\System\YiJJWHf.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\yFdKpUa.exe
  C:\Windows\System\yFdKpUa.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\zdKOuZG.exe
  C:\Windows\System\zdKOuZG.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\LbnevpM.exe
  C:\Windows\System\LbnevpM.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gIVisNQ.exe
  C:\Windows\System\gIVisNQ.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\KeGKaOV.exe
  C:\Windows\System\KeGKaOV.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\NkXsrhq.exe
  C:\Windows\System\NkXsrhq.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\QXrKEor.exe
  C:\Windows\System\QXrKEor.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\XklMrFC.exe
  C:\Windows\System\XklMrFC.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\YCNQRxW.exe
  C:\Windows\System\YCNQRxW.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\sQBBkeW.exe
  C:\Windows\System\sQBBkeW.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\SMvRTEM.exe
  C:\Windows\System\SMvRTEM.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\FCbwgGP.exe
  C:\Windows\System\FCbwgGP.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\cxjydir.exe
  C:\Windows\System\cxjydir.exe
  2⤵
  PID:2336
- C:\Windows\System\YqMPTlZ.exe
  C:\Windows\System\YqMPTlZ.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\poiQOSp.exe
  C:\Windows\System\poiQOSp.exe
  2⤵
  PID:1512
- C:\Windows\System\EoNzKpc.exe
  C:\Windows\System\EoNzKpc.exe
  2⤵
  PID:1344
- C:\Windows\System\SsuDkOA.exe
  C:\Windows\System\SsuDkOA.exe
  2⤵
  PID:2200
- C:\Windows\System\kBsXMUO.exe
  C:\Windows\System\kBsXMUO.exe
  2⤵
  PID:4536
- C:\Windows\System\fQjBmfI.exe
  C:\Windows\System\fQjBmfI.exe
  2⤵
  PID:1256
- C:\Windows\System\oLyYRsb.exe
  C:\Windows\System\oLyYRsb.exe
  2⤵
  PID:3320
- C:\Windows\System\acGqLmt.exe
  C:\Windows\System\acGqLmt.exe
  2⤵
  PID:1096
- C:\Windows\System\dtOLHXF.exe
  C:\Windows\System\dtOLHXF.exe
  2⤵
  PID:1464
- C:\Windows\System\jqcPyfy.exe
  C:\Windows\System\jqcPyfy.exe
  2⤵
  PID:324
- C:\Windows\System\AeLprQn.exe
  C:\Windows\System\AeLprQn.exe
  2⤵
  PID:4928
- C:\Windows\System\cKdadoK.exe
  C:\Windows\System\cKdadoK.exe
  2⤵
  PID:3260
- C:\Windows\System\bCSJaPc.exe
  C:\Windows\System\bCSJaPc.exe
  2⤵
  PID:1176
- C:\Windows\System\iVgfbDZ.exe
  C:\Windows\System\iVgfbDZ.exe
  2⤵
  PID:2484
- C:\Windows\System\bPHdbDB.exe
  C:\Windows\System\bPHdbDB.exe
  2⤵
  PID:3136
- C:\Windows\System\kTvcYKX.exe
  C:\Windows\System\kTvcYKX.exe
  2⤵
  PID:1468
- C:\Windows\System\aeYJjiY.exe
  C:\Windows\System\aeYJjiY.exe
  2⤵
  PID:232
- C:\Windows\System\wtPqhIO.exe
  C:\Windows\System\wtPqhIO.exe
  2⤵
  PID:2984
- C:\Windows\System\LzZaGzx.exe
  C:\Windows\System\LzZaGzx.exe
  2⤵
  PID:2008
- C:\Windows\System\RfAPbGe.exe
  C:\Windows\System\RfAPbGe.exe
  2⤵
  PID:4140
- C:\Windows\System\tPojtTQ.exe
  C:\Windows\System\tPojtTQ.exe
  2⤵
  PID:4308
- C:\Windows\System\NfKPbkk.exe
  C:\Windows\System\NfKPbkk.exe
  2⤵
  PID:3440
- C:\Windows\System\rYGhiID.exe
  C:\Windows\System\rYGhiID.exe
  2⤵
  PID:5040
- C:\Windows\System\YPADiis.exe
  C:\Windows\System\YPADiis.exe
  2⤵
  PID:5116
- C:\Windows\System\VTypZgF.exe
  C:\Windows\System\VTypZgF.exe
  2⤵
  PID:1808
- C:\Windows\System\doZMQUU.exe
  C:\Windows\System\doZMQUU.exe
  2⤵
  PID:4500
- C:\Windows\System\RDnJGgH.exe
  C:\Windows\System\RDnJGgH.exe
  2⤵
  PID:3300
- C:\Windows\System\anFdxGs.exe
  C:\Windows\System\anFdxGs.exe
  2⤵
  PID:1240
- C:\Windows\System\oUzZTfZ.exe
  C:\Windows\System\oUzZTfZ.exe
  2⤵
  PID:1968
- C:\Windows\System\YKNSmXU.exe
  C:\Windows\System\YKNSmXU.exe
  2⤵
  PID:1788
- C:\Windows\System\FPqjWlX.exe
  C:\Windows\System\FPqjWlX.exe
  2⤵
  PID:5060
- C:\Windows\System\qYxKqws.exe
  C:\Windows\System\qYxKqws.exe
  2⤵
  PID:1860
- C:\Windows\System\dIhXEBO.exe
  C:\Windows\System\dIhXEBO.exe
  2⤵
  PID:3632
- C:\Windows\System\IpKhVTK.exe
  C:\Windows\System\IpKhVTK.exe
  2⤵
  PID:3952
- C:\Windows\System\gvHcptz.exe
  C:\Windows\System\gvHcptz.exe
  2⤵
  PID:4944
- C:\Windows\System\vCRdvbK.exe
  C:\Windows\System\vCRdvbK.exe
  2⤵
  PID:1292
- C:\Windows\System\dmjoUac.exe
  C:\Windows\System\dmjoUac.exe
  2⤵
  PID:3616
- C:\Windows\System\ojMgARy.exe
  C:\Windows\System\ojMgARy.exe
  2⤵
  PID:2308
- C:\Windows\System\HwZktQj.exe
  C:\Windows\System\HwZktQj.exe
  2⤵
  PID:4412
- C:\Windows\System\HjoqANw.exe
  C:\Windows\System\HjoqANw.exe
  2⤵
  PID:4916
- C:\Windows\System\NJnQDgz.exe
  C:\Windows\System\NJnQDgz.exe
  2⤵
  PID:1984
- C:\Windows\System\yxpdKuC.exe
  C:\Windows\System\yxpdKuC.exe
  2⤵
  PID:452
- C:\Windows\System\WpagIdS.exe
  C:\Windows\System\WpagIdS.exe
  2⤵
  PID:1628
- C:\Windows\System\PRRyqVU.exe
  C:\Windows\System\PRRyqVU.exe
  2⤵
  PID:4344
- C:\Windows\System\JliXtQa.exe
  C:\Windows\System\JliXtQa.exe
  2⤵
  PID:4820
- C:\Windows\System\SBHnCWy.exe
  C:\Windows\System\SBHnCWy.exe
  2⤵
  PID:4872
- C:\Windows\System\kgWDVDB.exe
  C:\Windows\System\kgWDVDB.exe
  2⤵
  PID:768
- C:\Windows\System\zaMnJKy.exe
  C:\Windows\System\zaMnJKy.exe
  2⤵
  PID:4468
- C:\Windows\System\HzkQuzM.exe
  C:\Windows\System\HzkQuzM.exe
  2⤵
  PID:1368
- C:\Windows\System\yXimNXH.exe
  C:\Windows\System\yXimNXH.exe
  2⤵
  PID:960
- C:\Windows\System\DIfKOSJ.exe
  C:\Windows\System\DIfKOSJ.exe
  2⤵
  PID:5136
- C:\Windows\System\LpjVugE.exe
  C:\Windows\System\LpjVugE.exe
  2⤵
  PID:5168
- C:\Windows\System\JUnOHPj.exe
  C:\Windows\System\JUnOHPj.exe
  2⤵
  PID:5200
- C:\Windows\System\MRSlLWa.exe
  C:\Windows\System\MRSlLWa.exe
  2⤵
  PID:5236
- C:\Windows\System\MNzHzit.exe
  C:\Windows\System\MNzHzit.exe
  2⤵
  PID:5256
- C:\Windows\System\TmCVTeK.exe
  C:\Windows\System\TmCVTeK.exe
  2⤵
  PID:5288
- C:\Windows\System\TBvPoQO.exe
  C:\Windows\System\TBvPoQO.exe
  2⤵
  PID:5312
- C:\Windows\System\nJyrSHR.exe
  C:\Windows\System\nJyrSHR.exe
  2⤵
  PID:5340
- C:\Windows\System\mUVpEtN.exe
  C:\Windows\System\mUVpEtN.exe
  2⤵
  PID:5364
- C:\Windows\System\CcgHRlK.exe
  C:\Windows\System\CcgHRlK.exe
  2⤵
  PID:5392
- C:\Windows\System\FYpxTeK.exe
  C:\Windows\System\FYpxTeK.exe
  2⤵
  PID:5424
- C:\Windows\System\DCuSiGj.exe
  C:\Windows\System\DCuSiGj.exe
  2⤵
  PID:5456
- C:\Windows\System\qUXsitu.exe
  C:\Windows\System\qUXsitu.exe
  2⤵
  PID:5488
- C:\Windows\System\GrSDtlg.exe
  C:\Windows\System\GrSDtlg.exe
  2⤵
  PID:5520
- C:\Windows\System\ekcKvPO.exe
  C:\Windows\System\ekcKvPO.exe
  2⤵
  PID:5540
- C:\Windows\System\eUygjEL.exe
  C:\Windows\System\eUygjEL.exe
  2⤵
  PID:5572
- C:\Windows\System\fIsXuta.exe
  C:\Windows\System\fIsXuta.exe
  2⤵
  PID:5604
- C:\Windows\System\eMDuchz.exe
  C:\Windows\System\eMDuchz.exe
  2⤵
  PID:5624
- C:\Windows\System\WHHOKba.exe
  C:\Windows\System\WHHOKba.exe
  2⤵
  PID:5660
- C:\Windows\System\ssgOoRQ.exe
  C:\Windows\System\ssgOoRQ.exe
  2⤵
  PID:5688
- C:\Windows\System\uczNyGr.exe
  C:\Windows\System\uczNyGr.exe
  2⤵
  PID:5712
- C:\Windows\System\cRUZeNl.exe
  C:\Windows\System\cRUZeNl.exe
  2⤵
  PID:5740
- C:\Windows\System\RhoyjgB.exe
  C:\Windows\System\RhoyjgB.exe
  2⤵
  PID:5760
- C:\Windows\System\ZWrmCqD.exe
  C:\Windows\System\ZWrmCqD.exe
  2⤵
  PID:5796
- C:\Windows\System\BEjjPgX.exe
  C:\Windows\System\BEjjPgX.exe
  2⤵
  PID:5816
- C:\Windows\System\vvLovNV.exe
  C:\Windows\System\vvLovNV.exe
  2⤵
  PID:5844
- C:\Windows\System\OyRaTlz.exe
  C:\Windows\System\OyRaTlz.exe
  2⤵
  PID:5868
- C:\Windows\System\IaOrsbz.exe
  C:\Windows\System\IaOrsbz.exe
  2⤵
  PID:5896
- C:\Windows\System\lLVPePC.exe
  C:\Windows\System\lLVPePC.exe
  2⤵
  PID:5936
- C:\Windows\System\aUZkBDa.exe
  C:\Windows\System\aUZkBDa.exe
  2⤵
  PID:5968
- C:\Windows\System\TJQgZDt.exe
  C:\Windows\System\TJQgZDt.exe
  2⤵
  PID:5992
- C:\Windows\System\wZHdKHe.exe
  C:\Windows\System\wZHdKHe.exe
  2⤵
  PID:6028
- C:\Windows\System\XUbeDCe.exe
  C:\Windows\System\XUbeDCe.exe
  2⤵
  PID:6068
- C:\Windows\System\BVTEpJj.exe
  C:\Windows\System\BVTEpJj.exe
  2⤵
  PID:6100
- C:\Windows\System\RPnPRTs.exe
  C:\Windows\System\RPnPRTs.exe
  2⤵
  PID:6132
- C:\Windows\System\BwyAoQx.exe
  C:\Windows\System\BwyAoQx.exe
  2⤵
  PID:1416
- C:\Windows\System\QaYufao.exe
  C:\Windows\System\QaYufao.exe
  2⤵
  PID:4996
- C:\Windows\System\RLPpUul.exe
  C:\Windows\System\RLPpUul.exe
  2⤵
  PID:5248
- C:\Windows\System\tVNkJxi.exe
  C:\Windows\System\tVNkJxi.exe
  2⤵
  PID:5324
- C:\Windows\System\WLqDFNI.exe
  C:\Windows\System\WLqDFNI.exe
  2⤵
  PID:5224
- C:\Windows\System\KFYPfiA.exe
  C:\Windows\System\KFYPfiA.exe
  2⤵
  PID:5376
- C:\Windows\System\ZFPNbCU.exe
  C:\Windows\System\ZFPNbCU.exe
  2⤵
  PID:5508
- C:\Windows\System\GHaULeV.exe
  C:\Windows\System\GHaULeV.exe
  2⤵
  PID:5552
- C:\Windows\System\iIxLMak.exe
  C:\Windows\System\iIxLMak.exe
  2⤵
  PID:5616
- C:\Windows\System\pLoGlyo.exe
  C:\Windows\System\pLoGlyo.exe
  2⤵
  PID:5648
- C:\Windows\System\CrSYFNP.exe
  C:\Windows\System\CrSYFNP.exe
  2⤵
  PID:5632
- C:\Windows\System\uYWIEGJ.exe
  C:\Windows\System\uYWIEGJ.exe
  2⤵
  PID:5748
- C:\Windows\System\aJdhgtw.exe
  C:\Windows\System\aJdhgtw.exe
  2⤵
  PID:5856
- C:\Windows\System\rORvHtK.exe
  C:\Windows\System\rORvHtK.exe
  2⤵
  PID:5920
- C:\Windows\System\yUQaAwb.exe
  C:\Windows\System\yUQaAwb.exe
  2⤵
  PID:6000
- C:\Windows\System\ZJDwRAu.exe
  C:\Windows\System\ZJDwRAu.exe
  2⤵
  PID:6092
- C:\Windows\System\NxCPXCx.exe
  C:\Windows\System\NxCPXCx.exe
  2⤵
  PID:5264
- C:\Windows\System\txbNwoc.exe
  C:\Windows\System\txbNwoc.exe
  2⤵
  PID:5276
- C:\Windows\System\SnWBtog.exe
  C:\Windows\System\SnWBtog.exe
  2⤵
  PID:5436
- C:\Windows\System\XxpXJWD.exe
  C:\Windows\System\XxpXJWD.exe
  2⤵
  PID:5536
- C:\Windows\System\ehVyFTl.exe
  C:\Windows\System\ehVyFTl.exe
  2⤵
  PID:5676
- C:\Windows\System\xgSDMyr.exe
  C:\Windows\System\xgSDMyr.exe
  2⤵
  PID:5696
- C:\Windows\System\MWjNKrs.exe
  C:\Windows\System\MWjNKrs.exe
  2⤵
  PID:6036
- C:\Windows\System\YUErDnp.exe
  C:\Windows\System\YUErDnp.exe
  2⤵
  PID:6052
- C:\Windows\System\teagejJ.exe
  C:\Windows\System\teagejJ.exe
  2⤵
  PID:3880
- C:\Windows\System\hvWgMpA.exe
  C:\Windows\System\hvWgMpA.exe
  2⤵
  PID:5404
- C:\Windows\System\PBOAtAT.exe
  C:\Windows\System\PBOAtAT.exe
  2⤵
  PID:5732
- C:\Windows\System\DzNBtOs.exe
  C:\Windows\System\DzNBtOs.exe
  2⤵
  PID:5864
- C:\Windows\System\iZFUkyC.exe
  C:\Windows\System\iZFUkyC.exe
  2⤵
  PID:1536
- C:\Windows\System\QXkqhJW.exe
  C:\Windows\System\QXkqhJW.exe
  2⤵
  PID:6180
- C:\Windows\System\rawsIuH.exe
  C:\Windows\System\rawsIuH.exe
  2⤵
  PID:6204
- C:\Windows\System\kxjArMN.exe
  C:\Windows\System\kxjArMN.exe
  2⤵
  PID:6228
- C:\Windows\System\HbMphRZ.exe
  C:\Windows\System\HbMphRZ.exe
  2⤵
  PID:6244
- C:\Windows\System\eKhCqkD.exe
  C:\Windows\System\eKhCqkD.exe
  2⤵
  PID:6268
- C:\Windows\System\lpYPDqv.exe
  C:\Windows\System\lpYPDqv.exe
  2⤵
  PID:6296
- C:\Windows\System\wOpDXGE.exe
  C:\Windows\System\wOpDXGE.exe
  2⤵
  PID:6316
- C:\Windows\System\HZnPKVq.exe
  C:\Windows\System\HZnPKVq.exe
  2⤵
  PID:6352
- C:\Windows\System\trjQZgI.exe
  C:\Windows\System\trjQZgI.exe
  2⤵
  PID:6372
- C:\Windows\System\yODzlCe.exe
  C:\Windows\System\yODzlCe.exe
  2⤵
  PID:6396
- C:\Windows\System\gljQYFC.exe
  C:\Windows\System\gljQYFC.exe
  2⤵
  PID:6424
- C:\Windows\System\OkdjCjP.exe
  C:\Windows\System\OkdjCjP.exe
  2⤵
  PID:6452
- C:\Windows\System\ZCXGRxu.exe
  C:\Windows\System\ZCXGRxu.exe
  2⤵
  PID:6472
- C:\Windows\System\MHImMsJ.exe
  C:\Windows\System\MHImMsJ.exe
  2⤵
  PID:6504
- C:\Windows\System\njbRLLE.exe
  C:\Windows\System\njbRLLE.exe
  2⤵
  PID:6532
- C:\Windows\System\jLjDoHJ.exe
  C:\Windows\System\jLjDoHJ.exe
  2⤵
  PID:6552
- C:\Windows\System\aipdZlB.exe
  C:\Windows\System\aipdZlB.exe
  2⤵
  PID:6588
- C:\Windows\System\coMeJNa.exe
  C:\Windows\System\coMeJNa.exe
  2⤵
  PID:6604
- C:\Windows\System\xIosyLJ.exe
  C:\Windows\System\xIosyLJ.exe
  2⤵
  PID:6636
- C:\Windows\System\rhkwnRO.exe
  C:\Windows\System\rhkwnRO.exe
  2⤵
  PID:6668
- C:\Windows\System\CQwrDCI.exe
  C:\Windows\System\CQwrDCI.exe
  2⤵
  PID:6700
- C:\Windows\System\LQJggYZ.exe
  C:\Windows\System\LQJggYZ.exe
  2⤵
  PID:6724
- C:\Windows\System\MtuNHHq.exe
  C:\Windows\System\MtuNHHq.exe
  2⤵
  PID:6756
- C:\Windows\System\fQjgRxc.exe
  C:\Windows\System\fQjgRxc.exe
  2⤵
  PID:6792
- C:\Windows\System\KhMAiEe.exe
  C:\Windows\System\KhMAiEe.exe
  2⤵
  PID:6820
- C:\Windows\System\hQcMGUR.exe
  C:\Windows\System\hQcMGUR.exe
  2⤵
  PID:6844
- C:\Windows\System\NUdpmYS.exe
  C:\Windows\System\NUdpmYS.exe
  2⤵
  PID:6868
- C:\Windows\System\BHJRqlr.exe
  C:\Windows\System\BHJRqlr.exe
  2⤵
  PID:6892
- C:\Windows\System\RDXneQo.exe
  C:\Windows\System\RDXneQo.exe
  2⤵
  PID:6916
- C:\Windows\System\YcPoRXJ.exe
  C:\Windows\System\YcPoRXJ.exe
  2⤵
  PID:6952
- C:\Windows\System\mzvEpJA.exe
  C:\Windows\System\mzvEpJA.exe
  2⤵
  PID:6980
- C:\Windows\System\IqtPWHI.exe
  C:\Windows\System\IqtPWHI.exe
  2⤵
  PID:7000
- C:\Windows\System\IaCBAZT.exe
  C:\Windows\System\IaCBAZT.exe
  2⤵
  PID:7020
- C:\Windows\System\cnqCrGN.exe
  C:\Windows\System\cnqCrGN.exe
  2⤵
  PID:7044
- C:\Windows\System\uNDDQXr.exe
  C:\Windows\System\uNDDQXr.exe
  2⤵
  PID:7072
- C:\Windows\System\gErPSCr.exe
  C:\Windows\System\gErPSCr.exe
  2⤵
  PID:7092
- C:\Windows\System\THuxQKX.exe
  C:\Windows\System\THuxQKX.exe
  2⤵
  PID:7116
- C:\Windows\System\jZcyZrq.exe
  C:\Windows\System\jZcyZrq.exe
  2⤵
  PID:7136
- C:\Windows\System\MSoVqfo.exe
  C:\Windows\System\MSoVqfo.exe
  2⤵
  PID:5216
- C:\Windows\System\YQPlVBj.exe
  C:\Windows\System\YQPlVBj.exe
  2⤵
  PID:6164
- C:\Windows\System\TduoWYN.exe
  C:\Windows\System\TduoWYN.exe
  2⤵
  PID:6200
- C:\Windows\System\mQCKStd.exe
  C:\Windows\System\mQCKStd.exe
  2⤵
  PID:6240
- C:\Windows\System\RDODmSF.exe
  C:\Windows\System\RDODmSF.exe
  2⤵
  PID:6280
- C:\Windows\System\PGIGWgZ.exe
  C:\Windows\System\PGIGWgZ.exe
  2⤵
  PID:6312
- C:\Windows\System\HkNhDOn.exe
  C:\Windows\System\HkNhDOn.exe
  2⤵
  PID:6416
- C:\Windows\System\PQgVIWK.exe
  C:\Windows\System\PQgVIWK.exe
  2⤵
  PID:6368
- C:\Windows\System\eBTiAam.exe
  C:\Windows\System\eBTiAam.exe
  2⤵
  PID:6524
- C:\Windows\System\IiRQqgS.exe
  C:\Windows\System\IiRQqgS.exe
  2⤵
  PID:6544
- C:\Windows\System\DbYtjFg.exe
  C:\Windows\System\DbYtjFg.exe
  2⤵
  PID:6648
- C:\Windows\System\wrLVlQN.exe
  C:\Windows\System\wrLVlQN.exe
  2⤵
  PID:6692
- C:\Windows\System\mrEIFir.exe
  C:\Windows\System\mrEIFir.exe
  2⤵
  PID:6740
- C:\Windows\System\kAtIphS.exe
  C:\Windows\System\kAtIphS.exe
  2⤵
  PID:6808
- C:\Windows\System\LlnPIJj.exe
  C:\Windows\System\LlnPIJj.exe
  2⤵
  PID:6908
- C:\Windows\System\ZVhDPfg.exe
  C:\Windows\System\ZVhDPfg.exe
  2⤵
  PID:6860
- C:\Windows\System\HBOLMHJ.exe
  C:\Windows\System\HBOLMHJ.exe
  2⤵
  PID:7064
- C:\Windows\System\OMyiYIc.exe
  C:\Windows\System\OMyiYIc.exe
  2⤵
  PID:7060
- C:\Windows\System\VqoOqIb.exe
  C:\Windows\System\VqoOqIb.exe
  2⤵
  PID:7108
- C:\Windows\System\HogZjnR.exe
  C:\Windows\System\HogZjnR.exe
  2⤵
  PID:7160
- C:\Windows\System\MSDaYRb.exe
  C:\Windows\System\MSDaYRb.exe
  2⤵
  PID:6500
- C:\Windows\System\HYYimKC.exe
  C:\Windows\System\HYYimKC.exe
  2⤵
  PID:6468
- C:\Windows\System\EZxvoSC.exe
  C:\Windows\System\EZxvoSC.exe
  2⤵
  PID:7188
- C:\Windows\System\ERdNMvH.exe
  C:\Windows\System\ERdNMvH.exe
  2⤵
  PID:7216
- C:\Windows\System\lcqbZIV.exe
  C:\Windows\System\lcqbZIV.exe
  2⤵
  PID:7236
- C:\Windows\System\HyyyVul.exe
  C:\Windows\System\HyyyVul.exe
  2⤵
  PID:7252
- C:\Windows\System\FhBlTEX.exe
  C:\Windows\System\FhBlTEX.exe
  2⤵
  PID:7280
- C:\Windows\System\VSJJeas.exe
  C:\Windows\System\VSJJeas.exe
  2⤵
  PID:7300
- C:\Windows\System\PcMpRee.exe
  C:\Windows\System\PcMpRee.exe
  2⤵
  PID:7324
- C:\Windows\System\squGDLT.exe
  C:\Windows\System\squGDLT.exe
  2⤵
  PID:7344
- C:\Windows\System\PsrdyJb.exe
  C:\Windows\System\PsrdyJb.exe
  2⤵
  PID:7368
- C:\Windows\System\TyXMujQ.exe
  C:\Windows\System\TyXMujQ.exe
  2⤵
  PID:7388
- C:\Windows\System\gDckuyn.exe
  C:\Windows\System\gDckuyn.exe
  2⤵
  PID:7408
- C:\Windows\System\XciDdsX.exe
  C:\Windows\System\XciDdsX.exe
  2⤵
  PID:7424
- C:\Windows\System\dAGTvgb.exe
  C:\Windows\System\dAGTvgb.exe
  2⤵
  PID:7444
- C:\Windows\System\FZVtXiN.exe
  C:\Windows\System\FZVtXiN.exe
  2⤵
  PID:7464
- C:\Windows\System\ShrWFdO.exe
  C:\Windows\System\ShrWFdO.exe
  2⤵
  PID:7488
- C:\Windows\System\MmAPzNZ.exe
  C:\Windows\System\MmAPzNZ.exe
  2⤵
  PID:7516
- C:\Windows\System\zBmMEAY.exe
  C:\Windows\System\zBmMEAY.exe
  2⤵
  PID:7544
- C:\Windows\System\XtbhlnZ.exe
  C:\Windows\System\XtbhlnZ.exe
  2⤵
  PID:7564
- C:\Windows\System\aJaigtM.exe
  C:\Windows\System\aJaigtM.exe
  2⤵
  PID:7588
- C:\Windows\System\GMKqLBb.exe
  C:\Windows\System\GMKqLBb.exe
  2⤵
  PID:7616
- C:\Windows\System\KqzPrFr.exe
  C:\Windows\System\KqzPrFr.exe
  2⤵
  PID:7632
- C:\Windows\System\JQJPzMc.exe
  C:\Windows\System\JQJPzMc.exe
  2⤵
  PID:7664
- C:\Windows\System\wWPldPk.exe
  C:\Windows\System\wWPldPk.exe
  2⤵
  PID:7688
- C:\Windows\System\KNgIivF.exe
  C:\Windows\System\KNgIivF.exe
  2⤵
  PID:7712
- C:\Windows\System\YFEOFAU.exe
  C:\Windows\System\YFEOFAU.exe
  2⤵
  PID:7732
- C:\Windows\System\WZXiYbl.exe
  C:\Windows\System\WZXiYbl.exe
  2⤵
  PID:7756
- C:\Windows\System\txDxEhF.exe
  C:\Windows\System\txDxEhF.exe
  2⤵
  PID:7780
- C:\Windows\System\tHluywh.exe
  C:\Windows\System\tHluywh.exe
  2⤵
  PID:7804
- C:\Windows\System\obnVcIY.exe
  C:\Windows\System\obnVcIY.exe
  2⤵
  PID:7832
- C:\Windows\System\CyFcGmT.exe
  C:\Windows\System\CyFcGmT.exe
  2⤵
  PID:7852
- C:\Windows\System\FYHAMvV.exe
  C:\Windows\System\FYHAMvV.exe
  2⤵
  PID:7876
- C:\Windows\System\wUabdpx.exe
  C:\Windows\System\wUabdpx.exe
  2⤵
  PID:7892
- C:\Windows\System\EMAAjbR.exe
  C:\Windows\System\EMAAjbR.exe
  2⤵
  PID:7920
- C:\Windows\System\YBMuPkT.exe
  C:\Windows\System\YBMuPkT.exe
  2⤵
  PID:7948
- C:\Windows\System\QSBtFaQ.exe
  C:\Windows\System\QSBtFaQ.exe
  2⤵
  PID:7976
- C:\Windows\System\ihQkBTH.exe
  C:\Windows\System\ihQkBTH.exe
  2⤵
  PID:8004
- C:\Windows\System\dnTEzJs.exe
  C:\Windows\System\dnTEzJs.exe
  2⤵
  PID:8028
- C:\Windows\System\uxZaiJp.exe
  C:\Windows\System\uxZaiJp.exe
  2⤵
  PID:8056
- C:\Windows\System\nBtSanW.exe
  C:\Windows\System\nBtSanW.exe
  2⤵
  PID:8080
- C:\Windows\System\FBLnMfX.exe
  C:\Windows\System\FBLnMfX.exe
  2⤵
  PID:8100
- C:\Windows\System\KNgFmgM.exe
  C:\Windows\System\KNgFmgM.exe
  2⤵
  PID:8124
- C:\Windows\System\SwWHdzL.exe
  C:\Windows\System\SwWHdzL.exe
  2⤵
  PID:8152
- C:\Windows\System\BTeajAZ.exe
  C:\Windows\System\BTeajAZ.exe
  2⤵
  PID:8180
- C:\Windows\System\nQLOPOJ.exe
  C:\Windows\System\nQLOPOJ.exe
  2⤵
  PID:6968
- C:\Windows\System\RrbYsqB.exe
  C:\Windows\System\RrbYsqB.exe
  2⤵
  PID:7156
- C:\Windows\System\rGHIyth.exe
  C:\Windows\System\rGHIyth.exe
  2⤵
  PID:6172
- C:\Windows\System\Uadcoxs.exe
  C:\Windows\System\Uadcoxs.exe
  2⤵
  PID:6464
- C:\Windows\System\GgudEDQ.exe
  C:\Windows\System\GgudEDQ.exe
  2⤵
  PID:7184
- C:\Windows\System\hoyWTMg.exe
  C:\Windows\System\hoyWTMg.exe
  2⤵
  PID:7100
- C:\Windows\System\tfwSUfo.exe
  C:\Windows\System\tfwSUfo.exe
  2⤵
  PID:7268
- C:\Windows\System\VdbBSnx.exe
  C:\Windows\System\VdbBSnx.exe
  2⤵
  PID:7152
- C:\Windows\System\yezhGDn.exe
  C:\Windows\System\yezhGDn.exe
  2⤵
  PID:7016
- C:\Windows\System\sSBCBWZ.exe
  C:\Windows\System\sSBCBWZ.exe
  2⤵
  PID:7232
- C:\Windows\System\oRGNXGK.exe
  C:\Windows\System\oRGNXGK.exe
  2⤵
  PID:7556
- C:\Windows\System\onPTbco.exe
  C:\Windows\System\onPTbco.exe
  2⤵
  PID:7436
- C:\Windows\System\BSaqhGg.exe
  C:\Windows\System\BSaqhGg.exe
  2⤵
  PID:7476
- C:\Windows\System\fKgOAAv.exe
  C:\Windows\System\fKgOAAv.exe
  2⤵
  PID:7508
- C:\Windows\System\kNqlFmQ.exe
  C:\Windows\System\kNqlFmQ.exe
  2⤵
  PID:7576
- C:\Windows\System\iubMkxV.exe
  C:\Windows\System\iubMkxV.exe
  2⤵
  PID:7752
- C:\Windows\System\zppYVRG.exe
  C:\Windows\System\zppYVRG.exe
  2⤵
  PID:7820
- C:\Windows\System\FmoIjCQ.exe
  C:\Windows\System\FmoIjCQ.exe
  2⤵
  PID:7672
- C:\Windows\System\ZGNOFtU.exe
  C:\Windows\System\ZGNOFtU.exe
  2⤵
  PID:8040
- C:\Windows\System\oxnAfYa.exe
  C:\Windows\System\oxnAfYa.exe
  2⤵
  PID:8148
- C:\Windows\System\UFJdzfw.exe
  C:\Windows\System\UFJdzfw.exe
  2⤵
  PID:8172
- C:\Windows\System\STEWFAN.exe
  C:\Windows\System\STEWFAN.exe
  2⤵
  PID:7916
- C:\Windows\System\GcyJRqY.exe
  C:\Windows\System\GcyJRqY.exe
  2⤵
  PID:8000
- C:\Windows\System\GdCPtgE.exe
  C:\Windows\System\GdCPtgE.exe
  2⤵
  PID:7248
- C:\Windows\System\dEIStyr.exe
  C:\Windows\System\dEIStyr.exe
  2⤵
  PID:7848
- C:\Windows\System\SEZTIjD.exe
  C:\Windows\System\SEZTIjD.exe
  2⤵
  PID:8216
- C:\Windows\System\KyZshgD.exe
  C:\Windows\System\KyZshgD.exe
  2⤵
  PID:8244
- C:\Windows\System\qtXeucm.exe
  C:\Windows\System\qtXeucm.exe
  2⤵
  PID:8264
- C:\Windows\System\xUohlON.exe
  C:\Windows\System\xUohlON.exe
  2⤵
  PID:8284
- C:\Windows\System\nOkOawF.exe
  C:\Windows\System\nOkOawF.exe
  2⤵
  PID:8312
- C:\Windows\System\CsNcLTx.exe
  C:\Windows\System\CsNcLTx.exe
  2⤵
  PID:8336
- C:\Windows\System\WVunhLM.exe
  C:\Windows\System\WVunhLM.exe
  2⤵
  PID:8364
- C:\Windows\System\kAKyKHz.exe
  C:\Windows\System\kAKyKHz.exe
  2⤵
  PID:8384
- C:\Windows\System\lMLAJMJ.exe
  C:\Windows\System\lMLAJMJ.exe
  2⤵
  PID:8408
- C:\Windows\System\HHKXNYl.exe
  C:\Windows\System\HHKXNYl.exe
  2⤵
  PID:8424
- C:\Windows\System\CXUbcsZ.exe
  C:\Windows\System\CXUbcsZ.exe
  2⤵
  PID:8444
- C:\Windows\System\cFPfcip.exe
  C:\Windows\System\cFPfcip.exe
  2⤵
  PID:8472
- C:\Windows\System\EzlsQBf.exe
  C:\Windows\System\EzlsQBf.exe
  2⤵
  PID:8500
- C:\Windows\System\TtDDhSJ.exe
  C:\Windows\System\TtDDhSJ.exe
  2⤵
  PID:8520
- C:\Windows\System\EgAjtex.exe
  C:\Windows\System\EgAjtex.exe
  2⤵
  PID:8548
- C:\Windows\System\dvjTUQc.exe
  C:\Windows\System\dvjTUQc.exe
  2⤵
  PID:8568
- C:\Windows\System\LgfYfag.exe
  C:\Windows\System\LgfYfag.exe
  2⤵
  PID:8596
- C:\Windows\System\dRBCFVD.exe
  C:\Windows\System\dRBCFVD.exe
  2⤵
  PID:8620
- C:\Windows\System\ILbBDDa.exe
  C:\Windows\System\ILbBDDa.exe
  2⤵
  PID:8644
- C:\Windows\System\HmMEOXv.exe
  C:\Windows\System\HmMEOXv.exe
  2⤵
  PID:8668
- C:\Windows\System\dShGApt.exe
  C:\Windows\System\dShGApt.exe
  2⤵
  PID:8692
- C:\Windows\System\TciDSXN.exe
  C:\Windows\System\TciDSXN.exe
  2⤵
  PID:8712
- C:\Windows\System\tmoPuYl.exe
  C:\Windows\System\tmoPuYl.exe
  2⤵
  PID:8736
- C:\Windows\System\QVlGWzh.exe
  C:\Windows\System\QVlGWzh.exe
  2⤵
  PID:8760
- C:\Windows\System\zMzkEoS.exe
  C:\Windows\System\zMzkEoS.exe
  2⤵
  PID:8784
- C:\Windows\System\dHiWydP.exe
  C:\Windows\System\dHiWydP.exe
  2⤵
  PID:8808
- C:\Windows\System\ibHOJtb.exe
  C:\Windows\System\ibHOJtb.exe
  2⤵
  PID:8824
- C:\Windows\System\KmMikfU.exe
  C:\Windows\System\KmMikfU.exe
  2⤵
  PID:8856
- C:\Windows\System\NAtBIFv.exe
  C:\Windows\System\NAtBIFv.exe
  2⤵
  PID:8884
- C:\Windows\System\PFWAsqh.exe
  C:\Windows\System\PFWAsqh.exe
  2⤵
  PID:8904
- C:\Windows\System\RIXvlla.exe
  C:\Windows\System\RIXvlla.exe
  2⤵
  PID:8928
- C:\Windows\System\ADZMCHx.exe
  C:\Windows\System\ADZMCHx.exe
  2⤵
  PID:8956
- C:\Windows\System\HhlJpoJ.exe
  C:\Windows\System\HhlJpoJ.exe
  2⤵
  PID:8976
- C:\Windows\System\KUTLtTb.exe
  C:\Windows\System\KUTLtTb.exe
  2⤵
  PID:9000
- C:\Windows\System\dgwoKHo.exe
  C:\Windows\System\dgwoKHo.exe
  2⤵
  PID:9020
- C:\Windows\System\gFWQTlt.exe
  C:\Windows\System\gFWQTlt.exe
  2⤵
  PID:9044
- C:\Windows\System\qflHtUW.exe
  C:\Windows\System\qflHtUW.exe
  2⤵
  PID:9076
- C:\Windows\System\lWmnDDX.exe
  C:\Windows\System\lWmnDDX.exe
  2⤵
  PID:9104
- C:\Windows\System\slYhdPW.exe
  C:\Windows\System\slYhdPW.exe
  2⤵
  PID:9132
- C:\Windows\System\CVMSLrY.exe
  C:\Windows\System\CVMSLrY.exe
  2⤵
  PID:9160
- C:\Windows\System\UHAbhkm.exe
  C:\Windows\System\UHAbhkm.exe
  2⤵
  PID:9192
- C:\Windows\System\KVlnqAS.exe
  C:\Windows\System\KVlnqAS.exe
  2⤵
  PID:9212
- C:\Windows\System\MfldEZf.exe
  C:\Windows\System\MfldEZf.exe
  2⤵
  PID:7888
- C:\Windows\System\rHJCgNV.exe
  C:\Windows\System\rHJCgNV.exe
  2⤵
  PID:6888
- C:\Windows\System\ZhrgLcO.exe
  C:\Windows\System\ZhrgLcO.exe
  2⤵
  PID:7884
- C:\Windows\System\zMhhAgu.exe
  C:\Windows\System\zMhhAgu.exe
  2⤵
  PID:7208
- C:\Windows\System\iODZzml.exe
  C:\Windows\System\iODZzml.exe
  2⤵
  PID:7864
- C:\Windows\System\pkKuBWE.exe
  C:\Windows\System\pkKuBWE.exe
  2⤵
  PID:7312
- C:\Windows\System\VEczrar.exe
  C:\Windows\System\VEczrar.exe
  2⤵
  PID:8016
- C:\Windows\System\rHoCqmI.exe
  C:\Windows\System\rHoCqmI.exe
  2⤵
  PID:7584
- C:\Windows\System\yhANUew.exe
  C:\Windows\System\yhANUew.exe
  2⤵
  PID:6660
- C:\Windows\System\ypAlNBY.exe
  C:\Windows\System\ypAlNBY.exe
  2⤵
  PID:7704
- C:\Windows\System\VrAzJax.exe
  C:\Windows\System\VrAzJax.exe
  2⤵
  PID:7800
- C:\Windows\System\lTQJFCr.exe
  C:\Windows\System\lTQJFCr.exe
  2⤵
  PID:8440
- C:\Windows\System\vukyAdK.exe
  C:\Windows\System\vukyAdK.exe
  2⤵
  PID:8540
- C:\Windows\System\hklaMWZ.exe
  C:\Windows\System\hklaMWZ.exe
  2⤵
  PID:8096
- C:\Windows\System\KvlRicY.exe
  C:\Windows\System\KvlRicY.exe
  2⤵
  PID:8636
- C:\Windows\System\mPBxDFs.exe
  C:\Windows\System\mPBxDFs.exe
  2⤵
  PID:7352
- C:\Windows\System\pOSiFjU.exe
  C:\Windows\System\pOSiFjU.exe
  2⤵
  PID:8332
- C:\Windows\System\XiSxMiQ.exe
  C:\Windows\System\XiSxMiQ.exe
  2⤵
  PID:8792
- C:\Windows\System\LiPKKFa.exe
  C:\Windows\System\LiPKKFa.exe
  2⤵
  PID:8460
- C:\Windows\System\sBFUayD.exe
  C:\Windows\System\sBFUayD.exe
  2⤵
  PID:8912
- C:\Windows\System\adSvKeV.exe
  C:\Windows\System\adSvKeV.exe
  2⤵
  PID:8208
- C:\Windows\System\TFcaMGR.exe
  C:\Windows\System\TFcaMGR.exe
  2⤵
  PID:9036
- C:\Windows\System\siawjDM.exe
  C:\Windows\System\siawjDM.exe
  2⤵
  PID:8280
- C:\Windows\System\ebZPFVH.exe
  C:\Windows\System\ebZPFVH.exe
  2⤵
  PID:9128
- C:\Windows\System\rhLKpeG.exe
  C:\Windows\System\rhLKpeG.exe
  2⤵
  PID:8420
- C:\Windows\System\jnJUdYK.exe
  C:\Windows\System\jnJUdYK.exe
  2⤵
  PID:8876
- C:\Windows\System\dUFAvZw.exe
  C:\Windows\System\dUFAvZw.exe
  2⤵
  PID:9228
- C:\Windows\System\ydbzqnJ.exe
  C:\Windows\System\ydbzqnJ.exe
  2⤵
  PID:9252
- C:\Windows\System\HfIeVrj.exe
  C:\Windows\System\HfIeVrj.exe
  2⤵
  PID:9276
- C:\Windows\System\ezcvuWX.exe
  C:\Windows\System\ezcvuWX.exe
  2⤵
  PID:9300
- C:\Windows\System\mNOtRJL.exe
  C:\Windows\System\mNOtRJL.exe
  2⤵
  PID:9332
- C:\Windows\System\biTzzsj.exe
  C:\Windows\System\biTzzsj.exe
  2⤵
  PID:9348
- C:\Windows\System\eLrnJEE.exe
  C:\Windows\System\eLrnJEE.exe
  2⤵
  PID:9380
- C:\Windows\System\PDRYVIm.exe
  C:\Windows\System\PDRYVIm.exe
  2⤵
  PID:9408
- C:\Windows\System\XuYMIVI.exe
  C:\Windows\System\XuYMIVI.exe
  2⤵
  PID:9432
- C:\Windows\System\Hctgclt.exe
  C:\Windows\System\Hctgclt.exe
  2⤵
  PID:9456
- C:\Windows\System\ZXGCvEJ.exe
  C:\Windows\System\ZXGCvEJ.exe
  2⤵
  PID:9484
- C:\Windows\System\AgBjVPh.exe
  C:\Windows\System\AgBjVPh.exe
  2⤵
  PID:9500
- C:\Windows\System\YdUoZGl.exe
  C:\Windows\System\YdUoZGl.exe
  2⤵
  PID:9520
- C:\Windows\System\LhthAso.exe
  C:\Windows\System\LhthAso.exe
  2⤵
  PID:9544
- C:\Windows\System\xCwtbvE.exe
  C:\Windows\System\xCwtbvE.exe
  2⤵
  PID:9572
- C:\Windows\System\yfbqORd.exe
  C:\Windows\System\yfbqORd.exe
  2⤵
  PID:9596
- C:\Windows\System\NCUjnUP.exe
  C:\Windows\System\NCUjnUP.exe
  2⤵
  PID:9616
- C:\Windows\System\DaXjwCM.exe
  C:\Windows\System\DaXjwCM.exe
  2⤵
  PID:9632
- C:\Windows\System\IqVicpf.exe
  C:\Windows\System\IqVicpf.exe
  2⤵
  PID:9652
- C:\Windows\System\wdqatqh.exe
  C:\Windows\System\wdqatqh.exe
  2⤵
  PID:9680
- C:\Windows\System\mLRHfQw.exe
  C:\Windows\System\mLRHfQw.exe
  2⤵
  PID:9704
- C:\Windows\System\HNSVSWE.exe
  C:\Windows\System\HNSVSWE.exe
  2⤵
  PID:9732
- C:\Windows\System\PjcDEgV.exe
  C:\Windows\System\PjcDEgV.exe
  2⤵
  PID:9752
- C:\Windows\System\bjFznDp.exe
  C:\Windows\System\bjFznDp.exe
  2⤵
  PID:9780
- C:\Windows\System\VFqAVlG.exe
  C:\Windows\System\VFqAVlG.exe
  2⤵
  PID:9808
- C:\Windows\System\wrxUjDH.exe
  C:\Windows\System\wrxUjDH.exe
  2⤵
  PID:9832
- C:\Windows\System\wnBiOiq.exe
  C:\Windows\System\wnBiOiq.exe
  2⤵
  PID:9856
- C:\Windows\System\DuwbuXi.exe
  C:\Windows\System\DuwbuXi.exe
  2⤵
  PID:9884
- C:\Windows\System\yKNulgt.exe
  C:\Windows\System\yKNulgt.exe
  2⤵
  PID:9916
- C:\Windows\System\FSlQdmS.exe
  C:\Windows\System\FSlQdmS.exe
  2⤵
  PID:9940
- C:\Windows\System\ocuesXa.exe
  C:\Windows\System\ocuesXa.exe
  2⤵
  PID:9968
- C:\Windows\System\yCpanCI.exe
  C:\Windows\System\yCpanCI.exe
  2⤵
  PID:9984
- C:\Windows\System\yZNFBau.exe
  C:\Windows\System\yZNFBau.exe
  2⤵
  PID:10016
- C:\Windows\System\diMiEQb.exe
  C:\Windows\System\diMiEQb.exe
  2⤵
  PID:10048
- C:\Windows\System\LSxpLUm.exe
  C:\Windows\System\LSxpLUm.exe
  2⤵
  PID:9156
- C:\Windows\System\OZHZzBl.exe
  C:\Windows\System\OZHZzBl.exe
  2⤵
  PID:8816
- C:\Windows\System\MZUuMyh.exe
  C:\Windows\System\MZUuMyh.exe
  2⤵
  PID:7560
- C:\Windows\System\zQKPbVM.exe
  C:\Windows\System\zQKPbVM.exe
  2⤵
  PID:6332
- C:\Windows\System\paeVPlu.exe
  C:\Windows\System\paeVPlu.exe
  2⤵
  PID:9324
- C:\Windows\System\UprsYNH.exe
  C:\Windows\System\UprsYNH.exe
  2⤵
  PID:9084
- C:\Windows\System\rywIYya.exe
  C:\Windows\System\rywIYya.exe
  2⤵
  PID:9568
- C:\Windows\System\dMcXKpc.exe
  C:\Windows\System\dMcXKpc.exe
  2⤵
  PID:9648
- C:\Windows\System\evjyuoj.exe
  C:\Windows\System\evjyuoj.exe
  2⤵
  PID:7628
- C:\Windows\System\JUYarFt.exe
  C:\Windows\System\JUYarFt.exe
  2⤵
  PID:7124
- C:\Windows\System\yHQCrys.exe
  C:\Windows\System\yHQCrys.exe
  2⤵
  PID:8252
- C:\Windows\System\lOKgFgD.exe
  C:\Windows\System\lOKgFgD.exe
  2⤵
  PID:9060
- C:\Windows\System\VVjOHcs.exe
  C:\Windows\System\VVjOHcs.exe
  2⤵
  PID:9220
- C:\Windows\System\FIliWiC.exe
  C:\Windows\System\FIliWiC.exe
  2⤵
  PID:9292
- C:\Windows\System\iQzhzWA.exe
  C:\Windows\System\iQzhzWA.exe
  2⤵
  PID:9440
- C:\Windows\System\mUQhjhy.exe
  C:\Windows\System\mUQhjhy.exe
  2⤵
  PID:9444
- C:\Windows\System\PTtlcwd.exe
  C:\Windows\System\PTtlcwd.exe
  2⤵
  PID:9644
- C:\Windows\System\jpEkyzu.exe
  C:\Windows\System\jpEkyzu.exe
  2⤵
  PID:9820
- C:\Windows\System\cbYpULc.exe
  C:\Windows\System\cbYpULc.exe
  2⤵
  PID:9976
- C:\Windows\System\NFpMCQK.exe
  C:\Windows\System\NFpMCQK.exe
  2⤵
  PID:9604
- C:\Windows\System\TWKzOaB.exe
  C:\Windows\System\TWKzOaB.exe
  2⤵
  PID:9800
- C:\Windows\System\NkzGiDO.exe
  C:\Windows\System\NkzGiDO.exe
  2⤵
  PID:9900
- C:\Windows\System\ahBsIso.exe
  C:\Windows\System\ahBsIso.exe
  2⤵
  PID:10036
- C:\Windows\System\jcmPMVL.exe
  C:\Windows\System\jcmPMVL.exe
  2⤵
  PID:8864
- C:\Windows\System\hKBBbmI.exe
  C:\Windows\System\hKBBbmI.exe
  2⤵
  PID:7944
- C:\Windows\System\WjuEhCW.exe
  C:\Windows\System\WjuEhCW.exe
  2⤵
  PID:9392
- C:\Windows\System\LaxEYmY.exe
  C:\Windows\System\LaxEYmY.exe
  2⤵
  PID:9612
- C:\Windows\System\EfBjJrl.exe
  C:\Windows\System\EfBjJrl.exe
  2⤵
  PID:10248
- C:\Windows\System\MqZUnpe.exe
  C:\Windows\System\MqZUnpe.exe
  2⤵
  PID:10276
- C:\Windows\System\pCOEZgA.exe
  C:\Windows\System\pCOEZgA.exe
  2⤵
  PID:10292
- C:\Windows\System\GCCLFJJ.exe
  C:\Windows\System\GCCLFJJ.exe
  2⤵
  PID:10316
- C:\Windows\System\ecQeBwR.exe
  C:\Windows\System\ecQeBwR.exe
  2⤵
  PID:10332
- C:\Windows\System\LQBfaJv.exe
  C:\Windows\System\LQBfaJv.exe
  2⤵
  PID:10368
- C:\Windows\System\wDEUFun.exe
  C:\Windows\System\wDEUFun.exe
  2⤵
  PID:10396
- C:\Windows\System\MQmZcVA.exe
  C:\Windows\System\MQmZcVA.exe
  2⤵
  PID:10416
- C:\Windows\System\ulwASOO.exe
  C:\Windows\System\ulwASOO.exe
  2⤵
  PID:10452
- C:\Windows\System\XBTvVAG.exe
  C:\Windows\System\XBTvVAG.exe
  2⤵
  PID:10484
- C:\Windows\System\ZauOjRV.exe
  C:\Windows\System\ZauOjRV.exe
  2⤵
  PID:10508
- C:\Windows\System\lACadmH.exe
  C:\Windows\System\lACadmH.exe
  2⤵
  PID:10528
- C:\Windows\System\QkJsRwF.exe
  C:\Windows\System\QkJsRwF.exe
  2⤵
  PID:10548
- C:\Windows\System\AuPyylJ.exe
  C:\Windows\System\AuPyylJ.exe
  2⤵
  PID:10580
- C:\Windows\System\cXNvXeF.exe
  C:\Windows\System\cXNvXeF.exe
  2⤵
  PID:10612
- C:\Windows\System\KTErvri.exe
  C:\Windows\System\KTErvri.exe
  2⤵
  PID:10628
- C:\Windows\System\sWhqIFe.exe
  C:\Windows\System\sWhqIFe.exe
  2⤵
  PID:10652
- C:\Windows\System\qjQMxrK.exe
  C:\Windows\System\qjQMxrK.exe
  2⤵
  PID:10668
- C:\Windows\System\gguNzlK.exe
  C:\Windows\System\gguNzlK.exe
  2⤵
  PID:10688
- C:\Windows\System\wfUFHYL.exe
  C:\Windows\System\wfUFHYL.exe
  2⤵
  PID:10724
- C:\Windows\System\htuWYKe.exe
  C:\Windows\System\htuWYKe.exe
  2⤵
  PID:10756
- C:\Windows\System\FLBWDBT.exe
  C:\Windows\System\FLBWDBT.exe
  2⤵
  PID:10776
- C:\Windows\System\xAxEHNZ.exe
  C:\Windows\System\xAxEHNZ.exe
  2⤵
  PID:10800
- C:\Windows\System\GAVQEYO.exe
  C:\Windows\System\GAVQEYO.exe
  2⤵
  PID:10824
- C:\Windows\System\HXmlIaH.exe
  C:\Windows\System\HXmlIaH.exe
  2⤵
  PID:10848
- C:\Windows\System\ZqLcmbC.exe
  C:\Windows\System\ZqLcmbC.exe
  2⤵
  PID:10872
- C:\Windows\System\CZBhcqD.exe
  C:\Windows\System\CZBhcqD.exe
  2⤵
  PID:10892
- C:\Windows\System\zmydvWv.exe
  C:\Windows\System\zmydvWv.exe
  2⤵
  PID:10924
- C:\Windows\System\hPWsZIA.exe
  C:\Windows\System\hPWsZIA.exe
  2⤵
  PID:10948
- C:\Windows\System\WujOktr.exe
  C:\Windows\System\WujOktr.exe
  2⤵
  PID:10972
- C:\Windows\System\qspygLI.exe
  C:\Windows\System\qspygLI.exe
  2⤵
  PID:10996
- C:\Windows\System\JlumcHg.exe
  C:\Windows\System\JlumcHg.exe
  2⤵
  PID:11020
- C:\Windows\System\jFyzGYm.exe
  C:\Windows\System\jFyzGYm.exe
  2⤵
  PID:11044
- C:\Windows\System\XTMumTc.exe
  C:\Windows\System\XTMumTc.exe
  2⤵
  PID:11060
- C:\Windows\System\zPQtzNp.exe
  C:\Windows\System\zPQtzNp.exe
  2⤵
  PID:11088
- C:\Windows\System\cvuVBKY.exe
  C:\Windows\System\cvuVBKY.exe
  2⤵
  PID:11112
- C:\Windows\System\BIHAAwe.exe
  C:\Windows\System\BIHAAwe.exe
  2⤵
  PID:11132
- C:\Windows\System\HUWeCHb.exe
  C:\Windows\System\HUWeCHb.exe
  2⤵
  PID:11160
- C:\Windows\System\vifMtOH.exe
  C:\Windows\System\vifMtOH.exe
  2⤵
  PID:11180
- C:\Windows\System\AKBzfht.exe
  C:\Windows\System\AKBzfht.exe
  2⤵
  PID:11204
- C:\Windows\System\PTfUJIA.exe
  C:\Windows\System\PTfUJIA.exe
  2⤵
  PID:11236
- C:\Windows\System\KLRoolN.exe
  C:\Windows\System\KLRoolN.exe
  2⤵
  PID:11256
- C:\Windows\System\zAcDkDe.exe
  C:\Windows\System\zAcDkDe.exe
  2⤵
  PID:7968
- C:\Windows\System\ZiYMdzM.exe
  C:\Windows\System\ZiYMdzM.exe
  2⤵
  PID:9360
- C:\Windows\System\pihBfyt.exe
  C:\Windows\System\pihBfyt.exe
  2⤵
  PID:9764
- C:\Windows\System\csWFlLr.exe
  C:\Windows\System\csWFlLr.exe
  2⤵
  PID:10032
- C:\Windows\System\pDGhTgB.exe
  C:\Windows\System\pDGhTgB.exe
  2⤵
  PID:7380
- C:\Windows\System\RhWdRXE.exe
  C:\Windows\System\RhWdRXE.exe
  2⤵
  PID:7788
- C:\Windows\System\ZZDbVcs.exe
  C:\Windows\System\ZZDbVcs.exe
  2⤵
  PID:9008
- C:\Windows\System\UzDqpCj.exe
  C:\Windows\System\UzDqpCj.exe
  2⤵
  PID:7608
- C:\Windows\System\yHSPXaB.exe
  C:\Windows\System\yHSPXaB.exe
  2⤵
  PID:10244
- C:\Windows\System\OdKvhEZ.exe
  C:\Windows\System\OdKvhEZ.exe
  2⤵
  PID:10308
- C:\Windows\System\DmyHhFI.exe
  C:\Windows\System\DmyHhFI.exe
  2⤵
  PID:10444
- C:\Windows\System\RUhamMe.exe
  C:\Windows\System\RUhamMe.exe
  2⤵
  PID:10468
- C:\Windows\System\uUDsXgw.exe
  C:\Windows\System\uUDsXgw.exe
  2⤵
  PID:8800
- C:\Windows\System\OdEwdBr.exe
  C:\Windows\System\OdEwdBr.exe
  2⤵
  PID:10564
- C:\Windows\System\PLpJeEe.exe
  C:\Windows\System\PLpJeEe.exe
  2⤵
  PID:9396
- C:\Windows\System\pPLqhJn.exe
  C:\Windows\System\pPLqhJn.exe
  2⤵
  PID:8556
- C:\Windows\System\iiXQRnN.exe
  C:\Windows\System\iiXQRnN.exe
  2⤵
  PID:10700
- C:\Windows\System\IQDrTtg.exe
  C:\Windows\System\IQDrTtg.exe
  2⤵
  PID:10792
- C:\Windows\System\qRMQqoO.exe
  C:\Windows\System\qRMQqoO.exe
  2⤵
  PID:10340
- C:\Windows\System\SjFghcg.exe
  C:\Windows\System\SjFghcg.exe
  2⤵
  PID:9244
- C:\Windows\System\mQdaNen.exe
  C:\Windows\System\mQdaNen.exe
  2⤵
  PID:10392
- C:\Windows\System\nExXwWb.exe
  C:\Windows\System\nExXwWb.exe
  2⤵
  PID:10496
- C:\Windows\System\JoZZWgZ.exe
  C:\Windows\System\JoZZWgZ.exe
  2⤵
  PID:11036
- C:\Windows\System\tiwusfO.exe
  C:\Windows\System\tiwusfO.exe
  2⤵
  PID:11148
- C:\Windows\System\FZvWpOb.exe
  C:\Windows\System\FZvWpOb.exe
  2⤵
  PID:3156
- C:\Windows\System\VoSbMOT.exe
  C:\Windows\System\VoSbMOT.exe
  2⤵
  PID:11252
- C:\Windows\System\fOuLSNc.exe
  C:\Windows\System\fOuLSNc.exe
  2⤵
  PID:11280
- C:\Windows\System\JmGscVB.exe
  C:\Windows\System\JmGscVB.exe
  2⤵
  PID:11296
- C:\Windows\System\PipcGVO.exe
  C:\Windows\System\PipcGVO.exe
  2⤵
  PID:11328
- C:\Windows\System\WiQMldS.exe
  C:\Windows\System\WiQMldS.exe
  2⤵
  PID:11352
- C:\Windows\System\HMlmaOr.exe
  C:\Windows\System\HMlmaOr.exe
  2⤵
  PID:11368
- C:\Windows\System\JhVFUUp.exe
  C:\Windows\System\JhVFUUp.exe
  2⤵
  PID:11388
- C:\Windows\System\RgYamEu.exe
  C:\Windows\System\RgYamEu.exe
  2⤵
  PID:11416
- C:\Windows\System\GDMtrRD.exe
  C:\Windows\System\GDMtrRD.exe
  2⤵
  PID:11432
- C:\Windows\System\iXPbhgM.exe
  C:\Windows\System\iXPbhgM.exe
  2⤵
  PID:11460
- C:\Windows\System\OxEvlvU.exe
  C:\Windows\System\OxEvlvU.exe
  2⤵
  PID:11476
- C:\Windows\System\BMPBhNJ.exe
  C:\Windows\System\BMPBhNJ.exe
  2⤵
  PID:11496
- C:\Windows\System\JIUFTHm.exe
  C:\Windows\System\JIUFTHm.exe
  2⤵
  PID:11524
- C:\Windows\System\oLQMEga.exe
  C:\Windows\System\oLQMEga.exe
  2⤵
  PID:11540
- C:\Windows\System\sTVtnML.exe
  C:\Windows\System\sTVtnML.exe
  2⤵
  PID:11568
- C:\Windows\System\FFsFFYM.exe
  C:\Windows\System\FFsFFYM.exe
  2⤵
  PID:11592
- C:\Windows\System\JxPQszd.exe
  C:\Windows\System\JxPQszd.exe
  2⤵
  PID:11608
- C:\Windows\System\CLaUKeM.exe
  C:\Windows\System\CLaUKeM.exe
  2⤵
  PID:11632
- C:\Windows\System\tMhbTHB.exe
  C:\Windows\System\tMhbTHB.exe
  2⤵
  PID:11648
- C:\Windows\System\KoqqDpU.exe
  C:\Windows\System\KoqqDpU.exe
  2⤵
  PID:11672
- C:\Windows\System\vzeNkND.exe
  C:\Windows\System\vzeNkND.exe
  2⤵
  PID:11692
- C:\Windows\System\Hpleqcb.exe
  C:\Windows\System\Hpleqcb.exe
  2⤵
  PID:11712
- C:\Windows\System\kunrWqD.exe
  C:\Windows\System\kunrWqD.exe
  2⤵
  PID:11748
- C:\Windows\System\AfRYVSj.exe
  C:\Windows\System\AfRYVSj.exe
  2⤵
  PID:11764
- C:\Windows\System\pbyemmu.exe
  C:\Windows\System\pbyemmu.exe
  2⤵
  PID:11784
- C:\Windows\System\HVVvmqB.exe
  C:\Windows\System\HVVvmqB.exe
  2⤵
  PID:11804
- C:\Windows\System\WeQDTCW.exe
  C:\Windows\System\WeQDTCW.exe
  2⤵
  PID:11824
- C:\Windows\System\WMrnSTR.exe
  C:\Windows\System\WMrnSTR.exe
  2⤵
  PID:11852
- C:\Windows\System\VqJBOnk.exe
  C:\Windows\System\VqJBOnk.exe
  2⤵
  PID:11876
- C:\Windows\System\zYYTTAx.exe
  C:\Windows\System\zYYTTAx.exe
  2⤵
  PID:11904
- C:\Windows\System\rnVpeQF.exe
  C:\Windows\System\rnVpeQF.exe
  2⤵
  PID:11924
- C:\Windows\System\PkqdwOj.exe
  C:\Windows\System\PkqdwOj.exe
  2⤵
  PID:11944
- C:\Windows\System\NpaBJVz.exe
  C:\Windows\System\NpaBJVz.exe
  2⤵
  PID:11972
- C:\Windows\System\igsJqRF.exe
  C:\Windows\System\igsJqRF.exe
  2⤵
  PID:11988
- C:\Windows\System\LajluYa.exe
  C:\Windows\System\LajluYa.exe
  2⤵
  PID:12020
- C:\Windows\System\cWxmSjo.exe
  C:\Windows\System\cWxmSjo.exe
  2⤵
  PID:12044
- C:\Windows\System\UsvkrnM.exe
  C:\Windows\System\UsvkrnM.exe
  2⤵
  PID:12064
- C:\Windows\System\SuHvHiy.exe
  C:\Windows\System\SuHvHiy.exe
  2⤵
  PID:12088
- C:\Windows\System\TOeiwxa.exe
  C:\Windows\System\TOeiwxa.exe
  2⤵
  PID:12108
- C:\Windows\System\ErtvhbA.exe
  C:\Windows\System\ErtvhbA.exe
  2⤵
  PID:12132
- C:\Windows\System\cDvOnlv.exe
  C:\Windows\System\cDvOnlv.exe
  2⤵
  PID:12152
- C:\Windows\System\JtvSSkG.exe
  C:\Windows\System\JtvSSkG.exe
  2⤵
  PID:12176
- C:\Windows\System\dthpYVM.exe
  C:\Windows\System\dthpYVM.exe
  2⤵
  PID:12200
- C:\Windows\System\ejbchXF.exe
  C:\Windows\System\ejbchXF.exe
  2⤵
  PID:12228
- C:\Windows\System\cwubjAY.exe
  C:\Windows\System\cwubjAY.exe
  2⤵
  PID:12256
- C:\Windows\System\cXsYxqT.exe
  C:\Windows\System\cXsYxqT.exe
  2⤵
  PID:12276
- C:\Windows\System\QfVJOdC.exe
  C:\Windows\System\QfVJOdC.exe
  2⤵
  PID:9872
- C:\Windows\System\CaOBxny.exe
  C:\Windows\System\CaOBxny.exe
  2⤵
  PID:10904
- C:\Windows\System\FCVbQIo.exe
  C:\Windows\System\FCVbQIo.exe
  2⤵
  PID:10412
- C:\Windows\System\mDtdNxq.exe
  C:\Windows\System\mDtdNxq.exe
  2⤵
  PID:10288
- C:\Windows\System\vxAXMXk.exe
  C:\Windows\System\vxAXMXk.exe
  2⤵
  PID:11104
- C:\Windows\System\tGJTaal.exe
  C:\Windows\System\tGJTaal.exe
  2⤵
  PID:11200
- C:\Windows\System\FFGTQQW.exe
  C:\Windows\System\FFGTQQW.exe
  2⤵
  PID:8720
- C:\Windows\System\rpgumrb.exe
  C:\Windows\System\rpgumrb.exe
  2⤵
  PID:11268
- C:\Windows\System\gjOVPgz.exe
  C:\Windows\System\gjOVPgz.exe
  2⤵
  PID:10708
- C:\Windows\System\FzfnEIl.exe
  C:\Windows\System\FzfnEIl.exe
  2⤵
  PID:10740
- C:\Windows\System\dvVaefd.exe
  C:\Windows\System\dvVaefd.exe
  2⤵
  PID:8024
- C:\Windows\System\eIzdiAN.exe
  C:\Windows\System\eIzdiAN.exe
  2⤵
  PID:8296
- C:\Windows\System\SRwAUkR.exe
  C:\Windows\System\SRwAUkR.exe
  2⤵
  PID:9676
- C:\Windows\System\OHCTvuU.exe
  C:\Windows\System\OHCTvuU.exe
  2⤵
  PID:11520
- C:\Windows\System\DQnSPOa.exe
  C:\Windows\System\DQnSPOa.exe
  2⤵
  PID:11576
- C:\Windows\System\BRXTknq.exe
  C:\Windows\System\BRXTknq.exe
  2⤵
  PID:10964
- C:\Windows\System\YcFHrZh.exe
  C:\Windows\System\YcFHrZh.exe
  2⤵
  PID:9892
- C:\Windows\System\AkDBeCJ.exe
  C:\Windows\System\AkDBeCJ.exe
  2⤵
  PID:11052
- C:\Windows\System\jKmsDSL.exe
  C:\Windows\System\jKmsDSL.exe
  2⤵
  PID:11756
- C:\Windows\System\MZJYtav.exe
  C:\Windows\System\MZJYtav.exe
  2⤵
  PID:10916
- C:\Windows\System\OMCPGoJ.exe
  C:\Windows\System\OMCPGoJ.exe
  2⤵
  PID:12316
- C:\Windows\System\uXYQWNp.exe
  C:\Windows\System\uXYQWNp.exe
  2⤵
  PID:12340
- C:\Windows\System\pOXeBeO.exe
  C:\Windows\System\pOXeBeO.exe
  2⤵
  PID:12360
- C:\Windows\System\znZVCsm.exe
  C:\Windows\System\znZVCsm.exe
  2⤵
  PID:12384
- C:\Windows\System\zrZrFlK.exe
  C:\Windows\System\zrZrFlK.exe
  2⤵
  PID:12400
- C:\Windows\System\UfhHStE.exe
  C:\Windows\System\UfhHStE.exe
  2⤵
  PID:12424
- C:\Windows\System\NOyRWfZ.exe
  C:\Windows\System\NOyRWfZ.exe
  2⤵
  PID:12452
- C:\Windows\System\gQutIbW.exe
  C:\Windows\System\gQutIbW.exe
  2⤵
  PID:12488
- C:\Windows\System\ScdphcA.exe
  C:\Windows\System\ScdphcA.exe
  2⤵
  PID:12524
- C:\Windows\System\SAajtdd.exe
  C:\Windows\System\SAajtdd.exe
  2⤵
  PID:12544
- C:\Windows\System\gWfqpcu.exe
  C:\Windows\System\gWfqpcu.exe
  2⤵
  PID:12564
- C:\Windows\System\mzfPAFb.exe
  C:\Windows\System\mzfPAFb.exe
  2⤵
  PID:12580
- C:\Windows\System\asnaros.exe
  C:\Windows\System\asnaros.exe
  2⤵
  PID:13020
- C:\Windows\System\ROqCngQ.exe
  C:\Windows\System\ROqCngQ.exe
  2⤵
  PID:13036
- C:\Windows\System\NuiVZEk.exe
  C:\Windows\System\NuiVZEk.exe
  2⤵
  PID:13052
- C:\Windows\System\BnRSLme.exe
  C:\Windows\System\BnRSLme.exe
  2⤵
  PID:13072
- C:\Windows\System\PVMJbug.exe
  C:\Windows\System\PVMJbug.exe
  2⤵
  PID:13168
- C:\Windows\System\DuIjZAf.exe
  C:\Windows\System\DuIjZAf.exe
  2⤵
  PID:13188
- C:\Windows\System\kAtZHNv.exe
  C:\Windows\System\kAtZHNv.exe
  2⤵
  PID:13204
- C:\Windows\System\EzgForN.exe
  C:\Windows\System\EzgForN.exe
  2⤵
  PID:13224
- C:\Windows\System\zZFhueM.exe
  C:\Windows\System\zZFhueM.exe
  2⤵
  PID:13256
- C:\Windows\System\dspMSFx.exe
  C:\Windows\System\dspMSFx.exe
  2⤵
  PID:11172
- C:\Windows\System\EQFQCgi.exe
  C:\Windows\System\EQFQCgi.exe
  2⤵
  PID:9724
- C:\Windows\System\ZqmhlrO.exe
  C:\Windows\System\ZqmhlrO.exe
  2⤵
  PID:10504
- C:\Windows\System\RNgKqOy.exe
  C:\Windows\System\RNgKqOy.exe
  2⤵
  PID:11556
- C:\Windows\System\WGuEpHl.exe
  C:\Windows\System\WGuEpHl.exe
  2⤵
  PID:11584
- C:\Windows\System\xuKvSbu.exe
  C:\Windows\System\xuKvSbu.exe
  2⤵
  PID:10596
- C:\Windows\System\ubEhJRR.exe
  C:\Windows\System\ubEhJRR.exe
  2⤵
  PID:11604
- C:\Windows\System\nqbQtwS.exe
  C:\Windows\System\nqbQtwS.exe
  2⤵
  PID:10736
- C:\Windows\System\VxZKtlP.exe
  C:\Windows\System\VxZKtlP.exe
  2⤵
  PID:11380
- C:\Windows\System\UfdHnFA.exe
  C:\Windows\System\UfdHnFA.exe
  2⤵
  PID:11744
- C:\Windows\System\MHiBTGQ.exe
  C:\Windows\System\MHiBTGQ.exe
  2⤵
  PID:10620
- C:\Windows\System\xIcYvoC.exe
  C:\Windows\System\xIcYvoC.exe
  2⤵
  PID:12000
- C:\Windows\System\aklOlhh.exe
  C:\Windows\System\aklOlhh.exe
  2⤵
  PID:12060
- C:\Windows\System\FlALWOa.exe
  C:\Windows\System\FlALWOa.exe
  2⤵
  PID:12160
- C:\Windows\System\kxXGNpW.exe
  C:\Windows\System\kxXGNpW.exe
  2⤵
  PID:11408
- C:\Windows\System\ecMXLuY.exe
  C:\Windows\System\ecMXLuY.exe
  2⤵
  PID:12272
- C:\Windows\System\wySEDlH.exe
  C:\Windows\System\wySEDlH.exe
  2⤵
  PID:11492
- C:\Windows\System\jQLMayH.exe
  C:\Windows\System\jQLMayH.exe
  2⤵
  PID:10720
- C:\Windows\System\hPTCIiC.exe
  C:\Windows\System\hPTCIiC.exe
  2⤵
  PID:11720
- C:\Windows\System\hLYhIVj.exe
  C:\Windows\System\hLYhIVj.exe
  2⤵
  PID:11816
- C:\Windows\System\Eedxbuc.exe
  C:\Windows\System\Eedxbuc.exe
  2⤵
  PID:11864
- C:\Windows\System\TWnHzBM.exe
  C:\Windows\System\TWnHzBM.exe
  2⤵
  PID:11920
- C:\Windows\System\myBxeKr.exe
  C:\Windows\System\myBxeKr.exe
  2⤵
  PID:11984
- C:\Windows\System\ltUgJjd.exe
  C:\Windows\System\ltUgJjd.exe
  2⤵
  PID:10832
- C:\Windows\System\dduBoLd.exe
  C:\Windows\System\dduBoLd.exe
  2⤵
  PID:10264
- C:\Windows\System\CoMEDeo.exe
  C:\Windows\System\CoMEDeo.exe
  2⤵
  PID:11664
- C:\Windows\System\paOyntY.exe
  C:\Windows\System\paOyntY.exe
  2⤵
  PID:12348
- C:\Windows\System\mGUeSYE.exe
  C:\Windows\System\mGUeSYE.exe
  2⤵
  PID:13060
- C:\Windows\System\htYKAsZ.exe
  C:\Windows\System\htYKAsZ.exe
  2⤵
  PID:12640
- C:\Windows\System\UMKMKig.exe
  C:\Windows\System\UMKMKig.exe
  2⤵
  PID:12712
- C:\Windows\System\CbXlbAG.exe
  C:\Windows\System\CbXlbAG.exe
  2⤵
  PID:13244
- C:\Windows\System\MJTXbDA.exe
  C:\Windows\System\MJTXbDA.exe
  2⤵
  PID:12840
- C:\Windows\System\zFjYcYQ.exe
  C:\Windows\System\zFjYcYQ.exe
  2⤵
  PID:12484
- C:\Windows\System\ICSHSZR.exe
  C:\Windows\System\ICSHSZR.exe
  2⤵
  PID:12560
- C:\Windows\System\raJIYUP.exe
  C:\Windows\System\raJIYUP.exe
  2⤵
  PID:12952
- C:\Windows\System\EKyBXTd.exe
  C:\Windows\System\EKyBXTd.exe
  2⤵
  PID:13012
- C:\Windows\System\XUsAYeg.exe
  C:\Windows\System\XUsAYeg.exe
  2⤵
  PID:5092
- C:\Windows\System\IfbgpCt.exe
  C:\Windows\System\IfbgpCt.exe
  2⤵
  PID:9368
- C:\Windows\System\jqqbWYZ.exe
  C:\Windows\System\jqqbWYZ.exe
  2⤵
  PID:13320
- C:\Windows\System\CrYTVon.exe
  C:\Windows\System\CrYTVon.exe
  2⤵
  PID:13356
- C:\Windows\System\RrnJsUo.exe
  C:\Windows\System\RrnJsUo.exe
  2⤵
  PID:13388
- C:\Windows\System\ogVmGzd.exe
  C:\Windows\System\ogVmGzd.exe
  2⤵
  PID:13408
- C:\Windows\System\yCOEnvZ.exe
  C:\Windows\System\yCOEnvZ.exe
  2⤵
  PID:13432
- C:\Windows\System\xybroca.exe
  C:\Windows\System\xybroca.exe
  2⤵
  PID:13456
- C:\Windows\System\XeweBoT.exe
  C:\Windows\System\XeweBoT.exe
  2⤵
  PID:13480
- C:\Windows\System\xPcLgjP.exe
  C:\Windows\System\xPcLgjP.exe
  2⤵
  PID:13500
- C:\Windows\System\OudpvMW.exe
  C:\Windows\System\OudpvMW.exe
  2⤵
  PID:13536
- C:\Windows\System\RMmwidA.exe
  C:\Windows\System\RMmwidA.exe
  2⤵
  PID:13564
- C:\Windows\System\dmtcuNE.exe
  C:\Windows\System\dmtcuNE.exe
  2⤵
  PID:13600
- C:\Windows\System\DxjmQOp.exe
  C:\Windows\System\DxjmQOp.exe
  2⤵
  PID:13620
- C:\Windows\System\XTuLxHt.exe
  C:\Windows\System\XTuLxHt.exe
  2⤵
  PID:13644
- C:\Windows\System\RcZpmLK.exe
  C:\Windows\System\RcZpmLK.exe
  2⤵
  PID:13668
- C:\Windows\System\EZbYoIY.exe
  C:\Windows\System\EZbYoIY.exe
  2⤵
  PID:13692
- C:\Windows\System\sDHTmhO.exe
  C:\Windows\System\sDHTmhO.exe
  2⤵
  PID:13708
- C:\Windows\System\bkObGdX.exe
  C:\Windows\System\bkObGdX.exe
  2⤵
  PID:13732
- C:\Windows\System\RvDmRdx.exe
  C:\Windows\System\RvDmRdx.exe
  2⤵
  PID:13752
- C:\Windows\System\rLIcKrt.exe
  C:\Windows\System\rLIcKrt.exe
  2⤵
  PID:13776
- C:\Windows\System\HPIufXd.exe
  C:\Windows\System\HPIufXd.exe
  2⤵
  PID:13792
- C:\Windows\System\QtYaTuY.exe
  C:\Windows\System\QtYaTuY.exe
  2⤵
  PID:13824
- C:\Windows\System\ICnAgIo.exe
  C:\Windows\System\ICnAgIo.exe
  2⤵
  PID:13848
- C:\Windows\System\iTULHYJ.exe
  C:\Windows\System\iTULHYJ.exe
  2⤵
  PID:13868
- C:\Windows\System\NkhYMWM.exe
  C:\Windows\System\NkhYMWM.exe
  2⤵
  PID:13888
- C:\Windows\System\ZxPYPBt.exe
  C:\Windows\System\ZxPYPBt.exe
  2⤵
  PID:13920
- C:\Windows\System\PORXzdg.exe
  C:\Windows\System\PORXzdg.exe
  2⤵
  PID:13944
- C:\Windows\System\QSlBxZY.exe
  C:\Windows\System\QSlBxZY.exe
  2⤵
  PID:14276
- C:\Windows\System\jREgmAU.exe
  C:\Windows\System\jREgmAU.exe
  2⤵
  PID:14292
- C:\Windows\System\IwkGrhG.exe
  C:\Windows\System\IwkGrhG.exe
  2⤵
  PID:14320
- C:\Windows\System\TgJhRTE.exe
  C:\Windows\System\TgJhRTE.exe
  2⤵
  PID:12440
- C:\Windows\System\bOEvgkN.exe
  C:\Windows\System\bOEvgkN.exe
  2⤵
  PID:12196
- C:\Windows\System\yHRYpPB.exe
  C:\Windows\System\yHRYpPB.exe
  2⤵
  PID:12532
- C:\Windows\System\cqxPHpC.exe
  C:\Windows\System\cqxPHpC.exe
  2⤵
  PID:11708
- C:\Windows\System\FvCKqRy.exe
  C:\Windows\System\FvCKqRy.exe
  2⤵
  PID:11936
- C:\Windows\System\yiilTWF.exe
  C:\Windows\System\yiilTWF.exe
  2⤵
  PID:11956
- C:\Windows\System\SScaBAC.exe
  C:\Windows\System\SScaBAC.exe
  2⤵
  PID:12124
- C:\Windows\System\CLmoebX.exe
  C:\Windows\System\CLmoebX.exe
  2⤵
  PID:12396
- C:\Windows\System\aKUVchg.exe
  C:\Windows\System\aKUVchg.exe
  2⤵
  PID:12680
- C:\Windows\System\wcuqrjZ.exe
  C:\Windows\System\wcuqrjZ.exe
  2⤵
  PID:12912
- C:\Windows\System\jsFKcVk.exe
  C:\Windows\System\jsFKcVk.exe
  2⤵
  PID:12928
- C:\Windows\System\YUbvlGn.exe
  C:\Windows\System\YUbvlGn.exe
  2⤵
  PID:13368
- C:\Windows\System\pbkIZyd.exe
  C:\Windows\System\pbkIZyd.exe
  2⤵
  PID:13400
- C:\Windows\System\zVCfyxw.exe
  C:\Windows\System\zVCfyxw.exe
  2⤵
  PID:13448
- C:\Windows\System\cKqYBYG.exe
  C:\Windows\System\cKqYBYG.exe
  2⤵
  PID:13496
- C:\Windows\System\arMFYMa.exe
  C:\Windows\System\arMFYMa.exe
  2⤵
  PID:10360
- C:\Windows\System\bQqrtLP.exe
  C:\Windows\System\bQqrtLP.exe
  2⤵
  PID:10664
- C:\Windows\System\SaMtruX.exe
  C:\Windows\System\SaMtruX.exe
  2⤵
  PID:10816
- C:\Windows\System\fWeLNiI.exe
  C:\Windows\System\fWeLNiI.exe
  2⤵
  PID:13008
- C:\Windows\System\SNxwQdJ.exe
  C:\Windows\System\SNxwQdJ.exe
  2⤵
  PID:12728
- C:\Windows\System\meBxbOg.exe
  C:\Windows\System\meBxbOg.exe
  2⤵
  PID:12832
- C:\Windows\System\asVCbRB.exe
  C:\Windows\System\asVCbRB.exe
  2⤵
  PID:13932
- C:\Windows\System\ZhyKnae.exe
  C:\Windows\System\ZhyKnae.exe
  2⤵
  PID:10408
- C:\Windows\System\ILcCUxF.exe
  C:\Windows\System\ILcCUxF.exe
  2⤵
  PID:13176
- C:\Windows\System\JPTmtnx.exe
  C:\Windows\System\JPTmtnx.exe
  2⤵
  PID:14008
- C:\Windows\System\iDgPRtO.exe
  C:\Windows\System\iDgPRtO.exe
  2⤵
  PID:14072
- C:\Windows\System\AQHpDBC.exe
  C:\Windows\System\AQHpDBC.exe
  2⤵
  PID:14288
- C:\Windows\System\cWRRVra.exe
  C:\Windows\System\cWRRVra.exe
  2⤵
  PID:14328
- C:\Windows\System\EVykuHA.exe
  C:\Windows\System\EVykuHA.exe
  2⤵
  PID:12140
- C:\Windows\System\wwCONuA.exe
  C:\Windows\System\wwCONuA.exe
  2⤵
  PID:14248
- C:\Windows\System\advlGUx.exe
  C:\Windows\System\advlGUx.exe
  2⤵
  PID:1252
- C:\Windows\System\gxEvRkJ.exe
  C:\Windows\System\gxEvRkJ.exe
  2⤵
  PID:12236
- C:\Windows\System\JPczHfV.exe
  C:\Windows\System\JPczHfV.exe
  2⤵
  PID:12252
- C:\Windows\System\EHAXgnU.exe
  C:\Windows\System\EHAXgnU.exe
  2⤵
  PID:14360
- C:\Windows\System\RfQARij.exe
  C:\Windows\System\RfQARij.exe
  2⤵
  PID:14384
- C:\Windows\System\cTMYNnZ.exe
  C:\Windows\System\cTMYNnZ.exe
  2⤵
  PID:14400
- C:\Windows\System\ihhvqvu.exe
  C:\Windows\System\ihhvqvu.exe
  2⤵
  PID:14424
- C:\Windows\System\CXKWScM.exe
  C:\Windows\System\CXKWScM.exe
  2⤵
  PID:14448
- C:\Windows\System\fXEuSTY.exe
  C:\Windows\System\fXEuSTY.exe
  2⤵
  PID:14472
- C:\Windows\System\xWlHAMA.exe
  C:\Windows\System\xWlHAMA.exe
  2⤵
  PID:14488
- C:\Windows\System\DkWUUTp.exe
  C:\Windows\System\DkWUUTp.exe
  2⤵
  PID:14512
- C:\Windows\System\jbyDuIi.exe
  C:\Windows\System\jbyDuIi.exe
  2⤵
  PID:14528
- C:\Windows\System\ZLvsxLP.exe
  C:\Windows\System\ZLvsxLP.exe
  2⤵
  PID:14552
- C:\Windows\System\sSoGhPM.exe
  C:\Windows\System\sSoGhPM.exe
  2⤵
  PID:14576
- C:\Windows\System\xWxsgNF.exe
  C:\Windows\System\xWxsgNF.exe
  2⤵
  PID:14604
- C:\Windows\System\OxJbiWa.exe
  C:\Windows\System\OxJbiWa.exe
  2⤵
  PID:14624
- C:\Windows\System\jxHdIsS.exe
  C:\Windows\System\jxHdIsS.exe
  2⤵
  PID:14652
- C:\Windows\System\bUFnhvX.exe
  C:\Windows\System\bUFnhvX.exe
  2⤵
  PID:14672
- C:\Windows\System\TjmZLIh.exe
  C:\Windows\System\TjmZLIh.exe
  2⤵
  PID:14704
- C:\Windows\System\zJlMFDX.exe
  C:\Windows\System\zJlMFDX.exe
  2⤵
  PID:14720
- C:\Windows\System\hSMmqah.exe
  C:\Windows\System\hSMmqah.exe
  2⤵
  PID:14736
- C:\Windows\System\iagIUar.exe
  C:\Windows\System\iagIUar.exe
  2⤵
  PID:14752
- C:\Windows\System\lJpNzyx.exe
  C:\Windows\System\lJpNzyx.exe
  2⤵
  PID:14768
- C:\Windows\System\MMqLOwU.exe
  C:\Windows\System\MMqLOwU.exe
  2⤵
  PID:14788
- C:\Windows\System\whChRRM.exe
  C:\Windows\System\whChRRM.exe
  2⤵
  PID:14808
- C:\Windows\System\MhdmaWl.exe
  C:\Windows\System\MhdmaWl.exe
  2⤵
  PID:14828
- C:\Windows\System\UUawqcq.exe
  C:\Windows\System\UUawqcq.exe
  2⤵
  PID:14848
- C:\Windows\System\RyxCKMT.exe
  C:\Windows\System\RyxCKMT.exe
  2⤵
  PID:14884
- C:\Windows\System\oZXicjg.exe
  C:\Windows\System\oZXicjg.exe
  2⤵
  PID:14908
- C:\Windows\System\EMZJnpe.exe
  C:\Windows\System\EMZJnpe.exe
  2⤵
  PID:14924
- C:\Windows\System\nhGAMlw.exe
  C:\Windows\System\nhGAMlw.exe
  2⤵
  PID:14948
- C:\Windows\System\WlEvkcN.exe
  C:\Windows\System\WlEvkcN.exe
  2⤵
  PID:15300
- C:\Windows\System\UaLYbbc.exe
  C:\Windows\System\UaLYbbc.exe
  2⤵
  PID:15332
- C:\Windows\System\AdYrzfe.exe
  C:\Windows\System\AdYrzfe.exe
  2⤵
  PID:15348
- C:\Windows\System\bAlGGrw.exe
  C:\Windows\System\bAlGGrw.exe
  2⤵
  PID:14332
- C:\Windows\System\VEmKdIJ.exe
  C:\Windows\System\VEmKdIJ.exe
  2⤵
  PID:12120
- C:\Windows\System\YWBYWLX.exe
  C:\Windows\System\YWBYWLX.exe
  2⤵
  PID:13912
- C:\Windows\System\MFtKKvy.exe
  C:\Windows\System\MFtKKvy.exe
  2⤵
  PID:14092
- C:\Windows\System\eyfzamm.exe
  C:\Windows\System\eyfzamm.exe
  2⤵
  PID:12324
- C:\Windows\System\BAEAeac.exe
  C:\Windows\System\BAEAeac.exe
  2⤵
  PID:12336
- C:\Windows\System\fwvuvlS.exe
  C:\Windows\System\fwvuvlS.exe
  2⤵
  PID:13960
- C:\Windows\System\hikHpAR.exe
  C:\Windows\System\hikHpAR.exe
  2⤵
  PID:13352
- C:\Windows\System\hxHadho.exe
  C:\Windows\System\hxHadho.exe
  2⤵
  PID:14500
- C:\Windows\System\IrtVrxB.exe
  C:\Windows\System\IrtVrxB.exe
  2⤵
  PID:14548
- C:\Windows\System\aFloJHG.exe
  C:\Windows\System\aFloJHG.exe
  2⤵
  PID:13704
- C:\Windows\System\yPuFpyd.exe
  C:\Windows\System\yPuFpyd.exe
  2⤵
  PID:14616
- C:\Windows\System\UhajxbK.exe
  C:\Windows\System\UhajxbK.exe
  2⤵
  PID:11360
- C:\Windows\System\twSuFvq.exe
  C:\Windows\System\twSuFvq.exe
  2⤵
  PID:13936
- C:\Windows\System\gPIVJFO.exe
  C:\Windows\System\gPIVJFO.exe
  2⤵
  PID:14480
- C:\Windows\System\gVYzoFC.exe
  C:\Windows\System\gVYzoFC.exe
  2⤵
  PID:14308
- C:\Windows\System\AGIqLfK.exe
  C:\Windows\System\AGIqLfK.exe
  2⤵
  PID:14160
- C:\Windows\System\ZNSBGhO.exe
  C:\Windows\System\ZNSBGhO.exe
  2⤵
  PID:14876
- C:\Windows\System\UUGnavP.exe
  C:\Windows\System\UUGnavP.exe
  2⤵
  PID:14904
- C:\Windows\System\lxlDeRN.exe
  C:\Windows\System\lxlDeRN.exe
  2⤵
  PID:14412
- C:\Windows\System\MIoOUxm.exe
  C:\Windows\System\MIoOUxm.exe
  2⤵
  PID:15060
- C:\Windows\System\yQhcfRm.exe
  C:\Windows\System\yQhcfRm.exe
  2⤵
  PID:14692
- C:\Windows\System\wXEyAwx.exe
  C:\Windows\System\wXEyAwx.exe
  2⤵
  PID:15100
- C:\Windows\System\UaUGAdK.exe
  C:\Windows\System\UaUGAdK.exe
  2⤵
  PID:14784
- C:\Windows\System\ecFXVcE.exe
  C:\Windows\System\ecFXVcE.exe
  2⤵
  PID:14844
- C:\Windows\System\vTfMAHG.exe
  C:\Windows\System\vTfMAHG.exe
  2⤵
  PID:15248
- C:\Windows\System\BLGFWwk.exe
  C:\Windows\System\BLGFWwk.exe
  2⤵
  PID:15312
- C:\Windows\System\UkLmjYM.exe
  C:\Windows\System\UkLmjYM.exe
  2⤵
  PID:12808
- C:\Windows\System\tjiBous.exe
  C:\Windows\System\tjiBous.exe
  2⤵
  PID:14356
- C:\Windows\System\HepoqmG.exe
  C:\Windows\System\HepoqmG.exe
  2⤵
  PID:15176
- C:\Windows\System\eAvcrZk.exe
  C:\Windows\System\eAvcrZk.exe
  2⤵
  PID:15224
- C:\Windows\System\eHYpBEz.exe
  C:\Windows\System\eHYpBEz.exe
  2⤵
  PID:15264
- C:\Windows\System\ldmOMuo.exe
  C:\Windows\System\ldmOMuo.exe
  2⤵
  PID:14196
- C:\Windows\System\ewWxmfs.exe
  C:\Windows\System\ewWxmfs.exe
  2⤵
  PID:14208
- C:\Windows\System\XKrsASx.exe
  C:\Windows\System\XKrsASx.exe
  2⤵
  PID:15392
- C:\Windows\System\zESuEUT.exe
  C:\Windows\System\zESuEUT.exe
  2⤵
  PID:15412
- C:\Windows\System\yCLxhmk.exe
  C:\Windows\System\yCLxhmk.exe
  2⤵
  PID:15444
- C:\Windows\System\oGOkpfG.exe
  C:\Windows\System\oGOkpfG.exe
  2⤵
  PID:15460
- C:\Windows\System\tmreHRR.exe
  C:\Windows\System\tmreHRR.exe
  2⤵
  PID:15480
- C:\Windows\System\UgKNkxx.exe
  C:\Windows\System\UgKNkxx.exe
  2⤵
  PID:15500
- C:\Windows\System\kPOWgDx.exe
  C:\Windows\System\kPOWgDx.exe
  2⤵
  PID:15516
- C:\Windows\System\BuGQKUb.exe
  C:\Windows\System\BuGQKUb.exe
  2⤵
  PID:15540
- C:\Windows\System\eFfvlcn.exe
  C:\Windows\System\eFfvlcn.exe
  2⤵
  PID:15560
- C:\Windows\System\gxDsnwb.exe
  C:\Windows\System\gxDsnwb.exe
  2⤵
  PID:15588
- C:\Windows\System\BfljtGt.exe
  C:\Windows\System\BfljtGt.exe
  2⤵
  PID:15612
- C:\Windows\System\EJBDotp.exe
  C:\Windows\System\EJBDotp.exe
  2⤵
  PID:15640
- C:\Windows\System\KYUsAcN.exe
  C:\Windows\System\KYUsAcN.exe
  2⤵
  PID:15656
- C:\Windows\System\HflbMPE.exe
  C:\Windows\System\HflbMPE.exe
  2⤵
  PID:15672
- C:\Windows\System\XbJLRre.exe
  C:\Windows\System\XbJLRre.exe
  2⤵
  PID:15688
- C:\Windows\System\GneLRvF.exe
  C:\Windows\System\GneLRvF.exe
  2⤵
  PID:15704
- C:\Windows\System\Wvwxxcs.exe
  C:\Windows\System\Wvwxxcs.exe
  2⤵
  PID:15720
- C:\Windows\System\tzJGeqW.exe
  C:\Windows\System\tzJGeqW.exe
  2⤵
  PID:15744
- C:\Windows\System\xxNDiDp.exe
  C:\Windows\System\xxNDiDp.exe
  2⤵
  PID:15764
- C:\Windows\System\vKjIKzs.exe
  C:\Windows\System\vKjIKzs.exe
  2⤵
  PID:15784
- C:\Windows\System\oajxwkQ.exe
  C:\Windows\System\oajxwkQ.exe
  2⤵
  PID:15800
- C:\Windows\System\YHcVTeO.exe
  C:\Windows\System\YHcVTeO.exe
  2⤵
  PID:15832
- C:\Windows\System\CVYewnq.exe
  C:\Windows\System\CVYewnq.exe
  2⤵
  PID:15860
- C:\Windows\System\AOEhVYh.exe
  C:\Windows\System\AOEhVYh.exe
  2⤵
  PID:15876
- C:\Windows\System\rRbYWsz.exe
  C:\Windows\System\rRbYWsz.exe
  2⤵
  PID:15900
- C:\Windows\System\GerGAgV.exe
  C:\Windows\System\GerGAgV.exe
  2⤵
  PID:15916
- C:\Windows\System\wHZoWoz.exe
  C:\Windows\System\wHZoWoz.exe
  2⤵
  PID:15940
- C:\Windows\System\avLezhX.exe
  C:\Windows\System\avLezhX.exe
  2⤵
  PID:15960
- C:\Windows\System\skRSIPF.exe
  C:\Windows\System\skRSIPF.exe
  2⤵
  PID:15980
- C:\Windows\System\MANGbFh.exe
  C:\Windows\System\MANGbFh.exe
  2⤵
  PID:16004
- C:\Windows\System\ynEYTIl.exe
  C:\Windows\System\ynEYTIl.exe
  2⤵
  PID:16020
- C:\Windows\System\HkTcEtp.exe
  C:\Windows\System\HkTcEtp.exe
  2⤵
  PID:16036
- C:\Windows\System\WMawOnp.exe
  C:\Windows\System\WMawOnp.exe
  2⤵
  PID:16052
- C:\Windows\System\mwUvWsG.exe
  C:\Windows\System\mwUvWsG.exe
  2⤵
  PID:16080
- C:\Windows\System\tEWfUTW.exe
  C:\Windows\System\tEWfUTW.exe
  2⤵
  PID:16096
- C:\Windows\System\nZMFdrZ.exe
  C:\Windows\System\nZMFdrZ.exe
  2⤵
  PID:16112
- C:\Windows\System\KHirOkY.exe
  C:\Windows\System\KHirOkY.exe
  2⤵
  PID:16132
- C:\Windows\System\NjnAFSy.exe
  C:\Windows\System\NjnAFSy.exe
  2⤵
  PID:16152
- C:\Windows\System\HfqBbnB.exe
  C:\Windows\System\HfqBbnB.exe
  2⤵
  PID:16172
- C:\Windows\System\zbZnfDB.exe
  C:\Windows\System\zbZnfDB.exe
  2⤵
  PID:16188
- C:\Windows\System\poiBYqQ.exe
  C:\Windows\System\poiBYqQ.exe
  2⤵
  PID:16216
- C:\Windows\System\sTJUlcS.exe
  C:\Windows\System\sTJUlcS.exe
  2⤵
  PID:16240
- C:\Windows\System\RNxuLrn.exe
  C:\Windows\System\RNxuLrn.exe
  2⤵
  PID:16256
- C:\Windows\System\drSnAAW.exe
  C:\Windows\System\drSnAAW.exe
  2⤵
  PID:16288
- C:\Windows\System\GgmXuEg.exe
  C:\Windows\System\GgmXuEg.exe
  2⤵
  PID:16304
- C:\Windows\System\mGUEdLV.exe
  C:\Windows\System\mGUEdLV.exe
  2⤵
  PID:16320
- C:\Windows\System\Yvputdd.exe
  C:\Windows\System\Yvputdd.exe
  2⤵
  PID:16336
- C:\Windows\System\FalAfBw.exe
  C:\Windows\System\FalAfBw.exe
  2⤵
  PID:16356
- C:\Windows\System\SEExeUx.exe
  C:\Windows\System\SEExeUx.exe
  2⤵
  PID:16380
- C:\Windows\System\uEhAJMu.exe
  C:\Windows\System\uEhAJMu.exe
  2⤵
  PID:13044
- C:\Windows\System\XFEOjUn.exe
  C:\Windows\System\XFEOjUn.exe
  2⤵
  PID:13424
- C:\Windows\System\pTnvPXq.exe
  C:\Windows\System\pTnvPXq.exe
  2⤵
  PID:14596
- C:\Windows\System\sAdmppi.exe
  C:\Windows\System\sAdmppi.exe
  2⤵
  PID:10820
- C:\Windows\System\JEGsepL.exe
  C:\Windows\System\JEGsepL.exe
  2⤵
  PID:13876
- C:\Windows\System\SyHNhcZ.exe
  C:\Windows\System\SyHNhcZ.exe
  2⤵
  PID:14520
- C:\Windows\System\VxCwOxl.exe
  C:\Windows\System\VxCwOxl.exe
  2⤵
  PID:14956
- C:\Windows\System\qLSQcvJ.exe
  C:\Windows\System\qLSQcvJ.exe
  2⤵
  PID:14260
- C:\Windows\System\jDFResU.exe
  C:\Windows\System\jDFResU.exe
  2⤵
  PID:15452
- C:\Windows\System\yPrkQib.exe
  C:\Windows\System\yPrkQib.exe
  2⤵
  PID:15532
- C:\Windows\System\gEAEQQh.exe
  C:\Windows\System\gEAEQQh.exe
  2⤵
  PID:14544
- C:\Windows\System\ZILNxZo.exe
  C:\Windows\System\ZILNxZo.exe
  2⤵
  PID:13728
- C:\Windows\System\dDOWUko.exe
  C:\Windows\System\dDOWUko.exe
  2⤵
  PID:15636
- C:\Windows\System\DjXnZrk.exe
  C:\Windows\System\DjXnZrk.exe
  2⤵
  PID:15668
- C:\Windows\System\REVTTIX.exe
  C:\Windows\System\REVTTIX.exe
  2⤵
  PID:11484
- C:\Windows\System\ayHHNqv.exe
  C:\Windows\System\ayHHNqv.exe
  2⤵
  PID:15868
- C:\Windows\System\RpYhQLn.exe
  C:\Windows\System\RpYhQLn.exe
  2⤵
  PID:14392
- C:\Windows\System\ToubDNR.exe
  C:\Windows\System\ToubDNR.exe
  2⤵
  PID:15424
- C:\Windows\System\BKIPhra.exe
  C:\Windows\System\BKIPhra.exe
  2⤵
  PID:15956
- C:\Windows\System\CotQpZb.exe
  C:\Windows\System\CotQpZb.exe
  2⤵
  PID:16388
- C:\Windows\System\EPYaGqH.exe
  C:\Windows\System\EPYaGqH.exe
  2⤵
  PID:16412
- C:\Windows\System\fpBmEek.exe
  C:\Windows\System\fpBmEek.exe
  2⤵
  PID:16436
- C:\Windows\System\LEjvZMB.exe
  C:\Windows\System\LEjvZMB.exe
  2⤵
  PID:16452
- C:\Windows\System\jZZODpG.exe
  C:\Windows\System\jZZODpG.exe
  2⤵
  PID:16468
- C:\Windows\System\KNCwWqM.exe
  C:\Windows\System\KNCwWqM.exe
  2⤵
  PID:16488
- C:\Windows\System\RKfBpzC.exe
  C:\Windows\System\RKfBpzC.exe
  2⤵
  PID:16508
- C:\Windows\System\OENtSPd.exe
  C:\Windows\System\OENtSPd.exe
  2⤵
  PID:16532
- C:\Windows\System\IIAdhmd.exe
  C:\Windows\System\IIAdhmd.exe
  2⤵
  PID:16556
- C:\Windows\System\rgmWpHR.exe
  C:\Windows\System\rgmWpHR.exe
  2⤵
  PID:16584
- C:\Windows\System\CboxPRY.exe
  C:\Windows\System\CboxPRY.exe
  2⤵
  PID:16600
- C:\Windows\System\GWzenfz.exe
  C:\Windows\System\GWzenfz.exe
  2⤵
  PID:16624
- C:\Windows\System\ciVnCdb.exe
  C:\Windows\System\ciVnCdb.exe
  2⤵
  PID:16644
- C:\Windows\System\FAvaicW.exe
  C:\Windows\System\FAvaicW.exe
  2⤵
  PID:16660
- C:\Windows\System\uiadtgU.exe
  C:\Windows\System\uiadtgU.exe
  2⤵
  PID:16676
- C:\Windows\System\Rjrlbwe.exe
  C:\Windows\System\Rjrlbwe.exe
  2⤵
  PID:16692
- C:\Windows\System\GQtOcuW.exe
  C:\Windows\System\GQtOcuW.exe
  2⤵
  PID:16720
- C:\Windows\System\GHxDfWu.exe
  C:\Windows\System\GHxDfWu.exe
  2⤵
  PID:16736
- C:\Windows\System\HKeMmDc.exe
  C:\Windows\System\HKeMmDc.exe
  2⤵
  PID:16752
- C:\Windows\System\glxSqIC.exe
  C:\Windows\System\glxSqIC.exe
  2⤵
  PID:16776
- C:\Windows\System\WuUgPhj.exe
  C:\Windows\System\WuUgPhj.exe
  2⤵
  PID:16800
- C:\Windows\System\yFBFJIR.exe
  C:\Windows\System\yFBFJIR.exe
  2⤵
  PID:16824
- C:\Windows\System\midbkMP.exe
  C:\Windows\System\midbkMP.exe
  2⤵
  PID:16840
- C:\Windows\System\pZxTLMv.exe
  C:\Windows\System\pZxTLMv.exe
  2⤵
  PID:16860
- C:\Windows\System\eVHtKeE.exe
  C:\Windows\System\eVHtKeE.exe
  2⤵
  PID:16880

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ALtrCtd.exe

Filesize
1.1MB

MD5
39b491c4aaeb8ddde976bf60c2df4c1c

SHA1
f65747869bd6899dda2d424eb5ac5fc0db307e43

SHA256
533e7a949db50230de3fc9e7f107369abb4274c87273969c3a54fd360c8bd765

SHA512
e8476c77aff1e618d896359df36da601adcae3b638116be3a31edf884519e7c745ded14429901b4d127e6e4380c32776b382011a779e2aba7b4bc3f1c1774fde

Download Submit
C:\Windows\System\AuDuuSB.exe

Filesize
1.1MB

MD5
8d45e0a029ccf7994fcf5857dfadefa7

SHA1
fff76cbae1f47e40bf3d68474115ccd4e94256fe

SHA256
e9ba16f2357e8b4828c6b57069d238d6fb943089c7d7b03d9912cc196bf23f47

SHA512
4e03e745a1ec6497792aa1595845fea27dde816f491cd26aa6f3c4f4ac598b8f18f8b819f7797e86f3b5a1063a61b153d2794264801de2af2be76dae9e07f2e6

Download Submit
C:\Windows\System\DpfHYlg.exe

Filesize
1.1MB

MD5
420bb9a9831716b8652a8d590d1d021b

SHA1
1ed42acbe6489ebdebee373a0acdfcdd0dbc1a44

SHA256
2ff2c37113becfec950abcb4b205a04d6a4a51a8859d62ea5a4c03ac2f4b1d65

SHA512
292af862f3a71e6d08613fdc004e5a1545e3e7b4ba6b69d468aae1e7826c319ff6abb5b65522a1e740b74713b51b20063b29b5f16fa3d11964e564c0748f8fd5

Download Submit
C:\Windows\System\FAlGFRG.exe

Filesize
1.1MB

MD5
76bea84a00de994157bd71c6332dabf1

SHA1
1b8f60854d36ee9afbe27d3b301da68a52180489

SHA256
acdd4a187472a45eba8d1dca6b30872a412e4d2a0eabd588eead4104eaa08e70

SHA512
f2988370934fb651f60b28330ccd91cf99167d2deaeec59f258bba85b1ab18562b99c9b582df7929bf31252a53d01aa54d20ed171568dcb5f5f9b7ddfffc3673

Download Submit
C:\Windows\System\IhphLXs.exe

Filesize
1.1MB

MD5
6a81cc828307e8b7e0bd3b7955ea74a1

SHA1
c7ccf815742f24ade48c52b86f10ceaf4dc5b5a6

SHA256
1b304a4eea3026e48999f751b51138d69b6cd2378afe45ba995fe16f82d42cf7

SHA512
39166c0ad564d058e1b085b33ad010a035932ca5305b07437ee3eebc4e9c819afe22c500b39e31fe5e3608b40aab1049499e8620c38171dcc5b2c15321b65567

Download Submit
C:\Windows\System\MUAnKpr.exe

Filesize
1.1MB

MD5
9bd0d699f80171a5f9d7eb23bc45e5f1

SHA1
68888d7b9a5d14f4a9db7e492d1dd5368cb1519e

SHA256
352f31913d024a86e93c3834b7e64e5b7581aeca18ff0902c4618a9cb83bbdfd

SHA512
dc2e125d1866360a327b809b8e2b76a1f8fb6eaa3fc6f75fafb075a2f890640eaf11e1abf278d96048796d95105b9f2aaab72c49cb9a010f5affd5aca70b8c47

Download Submit
C:\Windows\System\NOkzVhN.exe

Filesize
1.1MB

MD5
36c5c5becad4af3e6bcfb686cf8003bb

SHA1
e00452ac01538222c2446d3884fdd4e7ce82bc86

SHA256
b11b1656551105c72e90d25d880afcbaf3de92737a0aade610e88bd53aa22ade

SHA512
9ad8fc748c3cb6033f7e63c8a6ea27f9d0de091ae99f560f75cfd85964b94f729906917ef6aff040fe79e74087b4348f6ee3210d1487963141743b34618f2777

Download Submit
C:\Windows\System\NdGbnbV.exe

Filesize
1.1MB

MD5
a086de24e6aaff5a9fd93e088edcf099

SHA1
2f41df59e12891658f6899ec666b5cbad095e4de

SHA256
e04ce815f50ab125223d6c71707d019ac4e66104c245a6aa5f84559ab6f77246

SHA512
f2d83b0fa722097f3e538dae9e6b853af333ad8e8f72fc817adf815824108c572a16729c4505ea994d52c3aca5323dedd74af54c525c5e6f3440e8f7d5763448

Download Submit
C:\Windows\System\PvOvBrE.exe

Filesize
1.1MB

MD5
4e72003d14164a95ec5f71e5250af3bd

SHA1
a5cb7c8c30decb10b8f63dd87d09aee79ef967f3

SHA256
6b833ec7998a156d5c740fe16b8192a54cbe5ec4d9091af86937c894a5e7c982

SHA512
0107caa4781998f1a58ea41b16fe7e2aee6c8cc5518c2db096532d9f660bb107f84bee7390732a15fd778f921644a82147b35ca8c145360b084e6e4c1c9f733b

Download Submit
C:\Windows\System\RFfNTYs.exe

Filesize
1.1MB

MD5
bde77198cbb39c566dd8775e01806491

SHA1
38881cea965b7885faac7ac18ee5bfdde57b7cdf

SHA256
0571d43ee36b8f8de7c0a4fc01ed371d253c9af862b89e3040ec79c888322d58

SHA512
3fe8133358eae11dce0eef20337fbbf6bc2e3b0890e7774cd9ecd3dee8f034d0ea8e6905313dbeed54c78610e51789be69f0ece4f9c1713e46e6aba9ec86cca5

Download Submit
C:\Windows\System\TZYmCRb.exe

Filesize
1.1MB

MD5
b9482b264902797a00dc8b5defd16fde

SHA1
a4e6bd57f66d110a5280d24ea5e46bbd771b968d

SHA256
14a574c400ee70334fdcd84200e2b3ccf735bb6adf3ad1f6609dc51f4ea627d7

SHA512
a3d51120c7101c28807677b1e088820de84e06fd4b5c4f41500acc3c15c1ba480df023fd68e283a1e26cc7e80815163ce79b2712e44988e037d29743c5c74e91

Download Submit
C:\Windows\System\TdrSMwX.exe

Filesize
1.1MB

MD5
edf8314e29416a863b73a61b617b9112

SHA1
e8cea41afe33283e2c944b17998141856b6aea70

SHA256
c17662cbd0a26fcc5867cb9148c3043e97c0810f4bc591d5cef7900804ddd9df

SHA512
49458dda36430dc71f3943446eb9f6100d2fc357a360976eaf92ac54156a94a1a61f42381306438fd9548c2a31224bdd659a68b3622b736406ee56113017a74f

Download Submit
C:\Windows\System\VcyqOim.exe

Filesize
1.1MB

MD5
3e6478cf9350eb978594e3a81c2ff527

SHA1
8f8b5a4061cce86a01b7d8ce6dfc8195523164f8

SHA256
9eb31dcfd4f3489fa0fb7d8c51d2c6e45ce6ee22b1ef726b1f7daaee919fbc02

SHA512
256d044639fb50e73ddcf094f3c79f1a1e94842b5f9222a034cdaa55feba4d0bb21c4f2dcf465983c4a380c48d0e6efd77a545c5d2c8c8c76dcc713980db1d10

Download Submit
C:\Windows\System\ZBYUHjO.exe

Filesize
1.1MB

MD5
ddc573b6824c79cffb9dda8622aa8720

SHA1
cbc902cee5f1777e787e9177b60acb2a93e48b80

SHA256
5bbde3c9672b8daa57c1ae5976a087558cd3040902870992b6e42224bd039f63

SHA512
84f7d0adf2eee1d0bdd7df306ff55e1f26a72fed841c041f12f8c0771ae76e14693d8bcd726d71df00953fb12c8a618c5928028b44cea9f0248203bdc5260a03

Download Submit
C:\Windows\System\ccdchYd.exe

Filesize
1.1MB

MD5
4f7151c044bdad608ddeca703d7098a4

SHA1
8b4792f5ce3d64fca0f98d71cadfdccde94a78f5

SHA256
739aaca37e9ba616594555d3f77fc13f5ffc0e7a34cf5e2d8048b51550bff294

SHA512
b636a4b3a52c772853f3cbedc13b29bf9982e6a1e048f5a4d5ce7c52218fffff07c9b321dca6d0810ccbb6b74ff0d1fdfc5eed42b0c98bf16add5f51e742da54

Download Submit
C:\Windows\System\eYFACOE.exe

Filesize
1.1MB

MD5
4a8391ff8bc0cfa05483c64aff19ca62

SHA1
96e4b53b89854bd7e2f4bd24fe11c6ce971e7b27

SHA256
131607d15bde46d67dcc12acfd0c494da4932b165b061b58b5ca91a1cbaa12f1

SHA512
ba8cb84ae6c412f89a557b740265130306ecb05e0a7c44ca1f39ff0dd5c63c49a51a4298c0b28fef6758123152fd44fc9d1cc0ebd277d2b190a6e73ac27eb04d

Download Submit
C:\Windows\System\gmxOhlI.exe

Filesize
1.1MB

MD5
dee357c52a562bfeb560248c22b8d902

SHA1
ca7795d817bc326fdee763ee0f111988027dab88

SHA256
c21038289fa70f8c4e90034709afcea1bf934d0607075b628ef9776f8fb8566e

SHA512
80f86ab3c08ef6fb5313c0f2ac76c288d6a7837b2f0743adc6646a36d130a3bab3df4b51b446d27838b53d4ce2ab9ddae008a5b1bf6fb727d214ff9f5378fcd3

Download Submit
C:\Windows\System\hjMCTXh.exe

Filesize
1.1MB

MD5
dcfef9cf64f74dd2bf9dced2d3931891

SHA1
277a1eea7223b124da9a974fdfbd3691202b9830

SHA256
71b654dfa5a2f459e2ba93a1d85938851ca5a8167c410ea535db946f6f26c949

SHA512
f428e51630b8545e2ce1892a7e4844784a484b047b27e6733b4c2c4756b9e80921ce962d174662f76089cb0c4afd308494f914114979fe88f021869be674f117

Download Submit
C:\Windows\System\jUNpJII.exe

Filesize
1.1MB

MD5
67a0b9ef91f4f85a5cd0041028b5031f

SHA1
348e5fb121c1e2101ef5c18c58f80a2e05c8bdd7

SHA256
847ea3e32b9ae1deec6d8f2c9b6cdf69d53c1fff02e0389b07f31b7102389b42

SHA512
ef426adcc3343fa90bf772e726657d443adfbfa0eb283e76c9e546f254b1ee5721cdb79224d637d7112524c9f5b0342a2d0c66be2a484b73bc3149987da8852e

Download Submit
C:\Windows\System\jbQhBtr.exe

Filesize
1.1MB

MD5
8aa743e27c8ea5c4bb0a5b89003e1d87

SHA1
8eb8ee83787a3a1a4885f3bc99cb49e4a4b5d194

SHA256
c527ca1820f58a7edff8a558f653ec53aa9ab872e62d4e62d0a7937b1a3a622c

SHA512
4373921b84894104ac2141bd98f0f52712a46fb8e648bd1fbf2523deb6dcc77a5cb63d83d55781730e0cabef18ac452a7427b260fa43469ef9029860f1d4d787

Download Submit
C:\Windows\System\kDXAhRr.exe

Filesize
1.1MB

MD5
516464582e69480dcfb312cfa0f8cf73

SHA1
2808945f207bba14047e47955e517dd41bdfbae8

SHA256
db4af30a3ad3f1b8d9564724377fbd95affd9f2ed7cc541b8d51145762a7f478

SHA512
93aee583d2b95c1aac6df041c44e3f2367f2485728f0b8dff7457d012f716ae410e586e1cb83079987627fc7eb9ef0ccd917b9e585bba51dc28c73d893283eaf

Download Submit
C:\Windows\System\kVeMaUr.exe

Filesize
1.1MB

MD5
0cdc9426e86c0a57badb028c3b5b7eaa

SHA1
cea73a8d7f07685b51253c4b24070b2481b09810

SHA256
7feb45afd9673c3eb4692b0f8d793c72097200f92024611e4ffa53a9d758d0d3

SHA512
b8396fdaae352837233ddf8e73a719a567f0afdf8699391447ec1de38c07b42b9914ea17fa2ffac175b08bbc1073d7f3531dbbf15fa71517262274b23dd26a51

Download Submit
C:\Windows\System\koWhdLN.exe

Filesize
1.1MB

MD5
50b5e53a655458a6e41f7f695ed72ad1

SHA1
d52dbc77970db2edfb7ae24f3043af2def3cddef

SHA256
3d65ec2e96b84a4ded623747c635e276305548c463ce02293e4248cbc131b369

SHA512
9a253f4d64b313160bdf8a7f0ae9ca2c8d39d9b97dfd53b2ba2bb705e798e6989680b78f57e8e205b7cb2e530811768b7f72eaede30f4990afe0b9eae2f8c7dc

Download Submit
C:\Windows\System\lcgpEuU.exe

Filesize
1.1MB

MD5
1de2efcd827875cf72b4411e9e435c7c

SHA1
529576022017e750e6278f33f2ad15da486c6405

SHA256
e59907cee973e3ec25362905eef36f24efbffeabfd1b612ac7c7a9a2770b19e1

SHA512
9f4684b294d28d1f301404e9f930c56ef7c71236f432f703e4decce06b8fd6ce941e800c470e9b88b3226ad6be1283a2d7d7c0c4062db9b4ab56bcca3766ec95

Download Submit
C:\Windows\System\mrUNFwE.exe

Filesize
1.1MB

MD5
c97c62b920aa8a0713adf353fbbba487

SHA1
9cce38c4226a338b0a498b7810e01e16f05dba79

SHA256
e979b32355e03cdc175bf9c0c44d6d9c8e83627f47007bdee6948afa6c62022f

SHA512
80761dd4262047c75ab581a3e721952daf97a5b270a22c2d55371ea82bce2f302ac1e035858c54d3059991952b97ecce5c28ee6678e3baedd5917be12f626100

Download Submit
C:\Windows\System\nwjDZQq.exe

Filesize
1.1MB

MD5
cc33e097eb61bec39c8da4ba1b678e2f

SHA1
3b450b88b535cd1087c5e2d6fa86034cf9083b76

SHA256
8d72d48cd3ac81ddb9630a7ef20bbc5bb57cb18612d4341b3829d2810c78b2e9

SHA512
9f6b3780a6db6c6f86857841d7297821c2fb2dc02a12737c79747278e9837f37ecec9c8d362e567e3ce1cc503eaedaffebde511107c2851fd8cf1443acded244

Download Submit
C:\Windows\System\oAtcoJU.exe

Filesize
1.1MB

MD5
7ee96a0873aea3afc3d804f1f621ed12

SHA1
85d4b7864c9015b68e4203304b19d9c32d415037

SHA256
100ef22b5837e540960f97ed7767a1156f56a478fafed739c536085ca34cec6a

SHA512
9c6ae457ca5ef59471d46c091ae27f461e2d2863e3bd3841491bdf22cba86bb710b628009cc3416a1edf340b29963fe1e3a823bbffd187953f1aa1cef26b9fcf

Download Submit
C:\Windows\System\ojbsGTZ.exe

Filesize
1.1MB

MD5
fb8c4f935a386b3e09e7c56ba3c5265a

SHA1
fb4eea13b31d51fe8d0973e0e0e47654d0a30282

SHA256
161b86534ed182e1e25034912bb8bc5f8eb422f3fb4596356f4613031d330d38

SHA512
d9d8f0babbe164577df90858a47200748325b42a70ad2d89bebaacc5ae7463d20cb6134cded3977510ab2f4fe97c275b1185dac04634a78a9905628e39debaa7

Download Submit
C:\Windows\System\qnwfadn.exe

Filesize
1.1MB

MD5
d3ef8b1e2ae484c250d9a0059419d507

SHA1
0f0b8442108c22386d1db8ad3d12ffad130bdeb9

SHA256
08c8185ee9a15998ea572d91501c3027d8f46c1eef27c9c7d79689ee15c3cc95

SHA512
792693937854054e8e46ae3b378f6460b35b9525d2b6640cbdebadae0529f85f5a18fbbacb16da2e3eb019366aeef7c0a17027e081bcf416f00f795ae44d133c

Download Submit
C:\Windows\System\rcncwRt.exe

Filesize
1.1MB

MD5
9b4b5b5382f14c7cb061721dd8ed7c6f

SHA1
c2d804d786f0cbd605d9dd0e7b10ee4d958483a7

SHA256
5cf70b403bfc50a27fdf03bd45c231684afabdfbc588d3c20ea066e7f0ad9c07

SHA512
0b72f47602979fc30a61a6b6b566b5ff5f9e82cb6877d3c05e651b77b16b98b35ac666e9a4b04d7da7071e1938b8bb7ce97a59266d7e652c87323fd01902c00c

Download Submit
C:\Windows\System\tvdQFeh.exe

Filesize
1.1MB

MD5
574c4fc6b9f44710103f1d1079f6787e

SHA1
cbb2ca2947b78625954a16ebe8e834171a196412

SHA256
da42cc903b494976a323803fad2e9dbe7ae9cf2ea1120db9f944e5799d60a6fd

SHA512
0f72ffd300c0104fc98b677498cd53359ddc784ced8ff7b7f65a283f3b10543bfedfe581f4f60a4e9656d8e5f1e62c510b4e39b025e003718894f6013283d032

Download Submit
C:\Windows\System\uvPHBLk.exe

Filesize
1.1MB

MD5
9d8da8ec75bf855328ce37098e223f00

SHA1
d0530be920cb0a9c8f2c2718eeaa8eb031b655d1

SHA256
af45fc747192a8c1e5fcf8f45eb8d7e91029501dbda4da7036d091af28aaead1

SHA512
dad5905930daab8c5bf1744a26aa9ecf885ef01e54d4fc7ea3b039cbaf0fb39a213b381da10a39739e16e11253d83e4cc5d84a32ed84af2f6e1ece6de9173314

Download Submit
C:\Windows\System\zWjjmWe.exe

Filesize
1.1MB

MD5
2471e8c5c0413b9508ce6484cd15a44a

SHA1
78c7887b1eb27ab701baebb1f1f4153b9d6fc6ff

SHA256
f7a27dfa51f259e0cd50c700e5c096837cc7c70f0eaba70f13e7bb62591dd9eb

SHA512
5b797c0247cba12927d4b73070834f6e8655c9d83907ac49e4c1f684c7886b29e2b8ce415ab6d8a68b5387f3b3c8ecc2da1d0cabff2e1ae68556a7156ce1ac47

Download Submit
memory/2556-0-0x00000110F34D0000-0x00000110F34E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads