xmrig | fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f

Analysis

max time kernel
112s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
Size

1.8MB
MD5

c91aafda449715070751b00ee1e0ac03
SHA1

7e51523a32ba41f00652d44cb442e8e5ee5500df
SHA256

fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f
SHA512

c516f56881302589fe731608ab3f4d407639690b032283b23b8787d9f377bf1e5ae1aa475ed6dbce4169f2ed45057b20e1c48b01080533c88f846e31b42092b3
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZbStB:GemTLkNdfE0pZyQ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023bbe-6.dat	xmrig
behavioral2/files/0x000c000000023b46-4.dat	xmrig
behavioral2/files/0x000c000000023ba1-15.dat	xmrig
behavioral2/files/0x000e000000023bc4-29.dat	xmrig
behavioral2/files/0x0008000000023bcb-53.dat	xmrig
behavioral2/files/0x0008000000023bcc-55.dat	xmrig
behavioral2/files/0x0008000000023bca-51.dat	xmrig
behavioral2/files/0x0008000000023bc9-49.dat	xmrig
behavioral2/files/0x0008000000023bc6-47.dat	xmrig
behavioral2/files/0x0009000000023bc0-37.dat	xmrig
behavioral2/files/0x0009000000023bbf-36.dat	xmrig
behavioral2/files/0x0008000000023bfb-61.dat	xmrig
behavioral2/files/0x0008000000023bfd-67.dat	xmrig
behavioral2/files/0x0008000000023bfc-62.dat	xmrig
behavioral2/files/0x0008000000023bff-82.dat	xmrig
behavioral2/files/0x0008000000023bfe-88.dat	xmrig
behavioral2/files/0x0008000000023c06-98.dat	xmrig
behavioral2/files/0x0008000000023c1f-107.dat	xmrig
behavioral2/files/0x0008000000023c20-117.dat	xmrig
behavioral2/files/0x0008000000023c22-129.dat	xmrig
behavioral2/files/0x0008000000023c21-127.dat	xmrig
behavioral2/files/0x0008000000023c19-119.dat	xmrig
behavioral2/files/0x0008000000023c07-115.dat	xmrig
behavioral2/files/0x0008000000023c05-102.dat	xmrig
behavioral2/files/0x0008000000023c00-96.dat	xmrig
behavioral2/files/0x000b000000023ba9-85.dat	xmrig
behavioral2/files/0x0008000000023c23-134.dat	xmrig
behavioral2/files/0x0008000000023c24-137.dat	xmrig
behavioral2/files/0x000b000000023c39-142.dat	xmrig
behavioral2/files/0x0016000000023c3a-147.dat	xmrig
behavioral2/files/0x0008000000023c50-156.dat	xmrig
behavioral2/files/0x0008000000023c51-162.dat	xmrig
behavioral2/files/0x0008000000023c44-157.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
840	aycwDtK.exe
3036	rdmXRMl.exe
3560	aawlzuM.exe
2020	DcqvNzL.exe
4524	URsOGQu.exe
3516	XpihYPL.exe
2040	ghKPyLv.exe
3576	iyVZhix.exe
1548	IFJKghI.exe
548	nPQSXmS.exe
4376	gwNFoDD.exe
3616	dtrHOUv.exe
2660	EzGdQxT.exe
1736	xEenoUC.exe
1580	pFVbivK.exe
4140	fcqjcVJ.exe
1624	xNmAxkz.exe
3272	oKPHRNx.exe
4316	TPCgLpO.exe
2572	KeadhGA.exe
208	dKsynnZ.exe
2460	WAgaBoP.exe
5036	PqfHyrD.exe
1652	UFFxFdU.exe
1704	OQKKxKk.exe
776	UBMElId.exe
2580	rvpQZxV.exe
3040	EKxIIBL.exe
1928	PgRLMFs.exe
2584	kcjKWeg.exe
4364	IIUzKDQ.exe
4860	EtkWamJ.exe
1636	NyTEzvi.exe
1648	ZiMtaWw.exe
1340	zQQlzGC.exe
1628	FmWOoHR.exe
4880	yxfDTbK.exe
2060	RKEqJPz.exe
2976	uPOmWwW.exe
2468	sMSqRir.exe
3408	rTtOqBf.exe
4760	sJexDeI.exe
4112	QxDSOAX.exe
4768	Fbemokz.exe
836	viKXOhR.exe
2548	qHUlqIb.exe
3972	bcMSCvh.exe
952	JySeAej.exe
1148	VAROuUN.exe
3068	vELMGLu.exe
2752	WoAREXg.exe
4264	SdCRjGd.exe
1676	npXQplJ.exe
2364	KWQbAYE.exe
4328	DCMAbqF.exe
4772	LtbZhBh.exe
3928	duFuHgh.exe
3016	Piibept.exe
4240	KCElanw.exe
4700	AoDftnn.exe
652	CmnfCZV.exe
4072	oHSylOW.exe
4872	GeEDrij.exe
5068	CGJlKtZ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WmQbQyT.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\CCwLAiJ.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\QGzKNpr.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\yygozrW.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\hGhUKHP.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\FnRRyjP.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\WztYSGB.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\pkjfyBS.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\YroBiXm.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\WAPqlNt.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\udncVKp.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\QrqYpSa.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\zWrjtdb.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\sHOnjGk.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\ymeuYet.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\rjXTjau.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\qPKHENA.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\PzZnQWa.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\lCQTlqC.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\zSHvLSJ.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\HiBwQNX.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\csDPmGi.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\PNhjKEh.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\ixabdgG.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\pawATVJ.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\bNdSTNw.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\dFPLBxP.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\vVAhlCm.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\KDTHaAV.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\QbpBrpa.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\vGujzSP.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\MwenapO.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\ZYAAuny.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\odXogwg.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\qwlojGn.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\nLifGyM.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\VXJrAUl.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\pJQgkhR.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\hFwfkNJ.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\aEKqKvX.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\gMTaVvI.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\UBhVSUX.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\iyVZhix.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\WMKtRVY.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\rZxEuRi.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\oxOAASO.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\UspYtjN.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\ZWeoomB.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\CBKMkCg.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\dzYHLAS.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\GJaTDev.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\mWTFXkN.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\PDZnTyE.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\LfgcIuB.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\KQdvHLS.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\yxEfylW.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\tEKexEL.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\EKxIIBL.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\FeWpbXC.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\UqXopll.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\gjleTRZ.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\wcvBkYU.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\hKtlGrs.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
File created	C:\Windows\System\DWueuGI.exe	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16828	dwm.exe
Token: SeChangeNotifyPrivilege	16828	dwm.exe
Token: 33	16828	dwm.exe
Token: SeIncBasePriorityPrivilege	16828	dwm.exe
Token: SeShutdownPrivilege	16828	dwm.exe
Token: SeCreatePagefilePrivilege	16828	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 840	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	84
PID 2016 wrote to memory of 840	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	84
PID 2016 wrote to memory of 3036	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	85
PID 2016 wrote to memory of 3036	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	85
PID 2016 wrote to memory of 3560	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	86
PID 2016 wrote to memory of 3560	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	86
PID 2016 wrote to memory of 2020	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	87
PID 2016 wrote to memory of 2020	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	87
PID 2016 wrote to memory of 4524	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	88
PID 2016 wrote to memory of 4524	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	88
PID 2016 wrote to memory of 3516	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	89
PID 2016 wrote to memory of 3516	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	89
PID 2016 wrote to memory of 2040	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	90
PID 2016 wrote to memory of 2040	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	90
PID 2016 wrote to memory of 3576	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	91
PID 2016 wrote to memory of 3576	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	91
PID 2016 wrote to memory of 1548	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	92
PID 2016 wrote to memory of 1548	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	92
PID 2016 wrote to memory of 548	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	93
PID 2016 wrote to memory of 548	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	93
PID 2016 wrote to memory of 4376	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	94
PID 2016 wrote to memory of 4376	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	94
PID 2016 wrote to memory of 3616	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	95
PID 2016 wrote to memory of 3616	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	95
PID 2016 wrote to memory of 2660	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	96
PID 2016 wrote to memory of 2660	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	96
PID 2016 wrote to memory of 1736	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	97
PID 2016 wrote to memory of 1736	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	97
PID 2016 wrote to memory of 1580	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	98
PID 2016 wrote to memory of 1580	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	98
PID 2016 wrote to memory of 4140	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	99
PID 2016 wrote to memory of 4140	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	99
PID 2016 wrote to memory of 1624	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	100
PID 2016 wrote to memory of 1624	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	100
PID 2016 wrote to memory of 3272	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	101
PID 2016 wrote to memory of 3272	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	101
PID 2016 wrote to memory of 4316	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	102
PID 2016 wrote to memory of 4316	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	102
PID 2016 wrote to memory of 2572	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	103
PID 2016 wrote to memory of 2572	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	103
PID 2016 wrote to memory of 208	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	104
PID 2016 wrote to memory of 208	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	104
PID 2016 wrote to memory of 2460	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	105
PID 2016 wrote to memory of 2460	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	105
PID 2016 wrote to memory of 5036	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	106
PID 2016 wrote to memory of 5036	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	106
PID 2016 wrote to memory of 1652	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	107
PID 2016 wrote to memory of 1652	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	107
PID 2016 wrote to memory of 1704	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	108
PID 2016 wrote to memory of 1704	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	108
PID 2016 wrote to memory of 776	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	109
PID 2016 wrote to memory of 776	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	109
PID 2016 wrote to memory of 2580	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	110
PID 2016 wrote to memory of 2580	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	110
PID 2016 wrote to memory of 3040	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	111
PID 2016 wrote to memory of 3040	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	111
PID 2016 wrote to memory of 1928	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	112
PID 2016 wrote to memory of 1928	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	112
PID 2016 wrote to memory of 2584	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	113
PID 2016 wrote to memory of 2584	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	113
PID 2016 wrote to memory of 4364	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	114
PID 2016 wrote to memory of 4364	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	114
PID 2016 wrote to memory of 4860	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	115
PID 2016 wrote to memory of 4860	2016	fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe	115

C:\Users\Admin\AppData\Local\Temp\fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe
"C:\Users\Admin\AppData\Local\Temp\fe87bd31286feb03da7dfbd4d9476bd887fcef59ccb2bf92653e7e0c4045891f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\System\aycwDtK.exe
  C:\Windows\System\aycwDtK.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\rdmXRMl.exe
  C:\Windows\System\rdmXRMl.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\aawlzuM.exe
  C:\Windows\System\aawlzuM.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\DcqvNzL.exe
  C:\Windows\System\DcqvNzL.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\URsOGQu.exe
  C:\Windows\System\URsOGQu.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\XpihYPL.exe
  C:\Windows\System\XpihYPL.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\ghKPyLv.exe
  C:\Windows\System\ghKPyLv.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\iyVZhix.exe
  C:\Windows\System\iyVZhix.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\IFJKghI.exe
  C:\Windows\System\IFJKghI.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\nPQSXmS.exe
  C:\Windows\System\nPQSXmS.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\gwNFoDD.exe
  C:\Windows\System\gwNFoDD.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\dtrHOUv.exe
  C:\Windows\System\dtrHOUv.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\EzGdQxT.exe
  C:\Windows\System\EzGdQxT.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\xEenoUC.exe
  C:\Windows\System\xEenoUC.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\pFVbivK.exe
  C:\Windows\System\pFVbivK.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\fcqjcVJ.exe
  C:\Windows\System\fcqjcVJ.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\xNmAxkz.exe
  C:\Windows\System\xNmAxkz.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\oKPHRNx.exe
  C:\Windows\System\oKPHRNx.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\TPCgLpO.exe
  C:\Windows\System\TPCgLpO.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\KeadhGA.exe
  C:\Windows\System\KeadhGA.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\dKsynnZ.exe
  C:\Windows\System\dKsynnZ.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\WAgaBoP.exe
  C:\Windows\System\WAgaBoP.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\PqfHyrD.exe
  C:\Windows\System\PqfHyrD.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\UFFxFdU.exe
  C:\Windows\System\UFFxFdU.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\OQKKxKk.exe
  C:\Windows\System\OQKKxKk.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\UBMElId.exe
  C:\Windows\System\UBMElId.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\rvpQZxV.exe
  C:\Windows\System\rvpQZxV.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\EKxIIBL.exe
  C:\Windows\System\EKxIIBL.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\PgRLMFs.exe
  C:\Windows\System\PgRLMFs.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\kcjKWeg.exe
  C:\Windows\System\kcjKWeg.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\IIUzKDQ.exe
  C:\Windows\System\IIUzKDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\EtkWamJ.exe
  C:\Windows\System\EtkWamJ.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\NyTEzvi.exe
  C:\Windows\System\NyTEzvi.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\ZiMtaWw.exe
  C:\Windows\System\ZiMtaWw.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\zQQlzGC.exe
  C:\Windows\System\zQQlzGC.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\FmWOoHR.exe
  C:\Windows\System\FmWOoHR.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\yxfDTbK.exe
  C:\Windows\System\yxfDTbK.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\RKEqJPz.exe
  C:\Windows\System\RKEqJPz.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\uPOmWwW.exe
  C:\Windows\System\uPOmWwW.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\sMSqRir.exe
  C:\Windows\System\sMSqRir.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\rTtOqBf.exe
  C:\Windows\System\rTtOqBf.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\sJexDeI.exe
  C:\Windows\System\sJexDeI.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\QxDSOAX.exe
  C:\Windows\System\QxDSOAX.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\Fbemokz.exe
  C:\Windows\System\Fbemokz.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\viKXOhR.exe
  C:\Windows\System\viKXOhR.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\bcMSCvh.exe
  C:\Windows\System\bcMSCvh.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\qHUlqIb.exe
  C:\Windows\System\qHUlqIb.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\JySeAej.exe
  C:\Windows\System\JySeAej.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\VAROuUN.exe
  C:\Windows\System\VAROuUN.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\vELMGLu.exe
  C:\Windows\System\vELMGLu.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\WoAREXg.exe
  C:\Windows\System\WoAREXg.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\npXQplJ.exe
  C:\Windows\System\npXQplJ.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\KWQbAYE.exe
  C:\Windows\System\KWQbAYE.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\SdCRjGd.exe
  C:\Windows\System\SdCRjGd.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\DCMAbqF.exe
  C:\Windows\System\DCMAbqF.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\LtbZhBh.exe
  C:\Windows\System\LtbZhBh.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\duFuHgh.exe
  C:\Windows\System\duFuHgh.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\Piibept.exe
  C:\Windows\System\Piibept.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\KCElanw.exe
  C:\Windows\System\KCElanw.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\AoDftnn.exe
  C:\Windows\System\AoDftnn.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\CmnfCZV.exe
  C:\Windows\System\CmnfCZV.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\oHSylOW.exe
  C:\Windows\System\oHSylOW.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\GeEDrij.exe
  C:\Windows\System\GeEDrij.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\CGJlKtZ.exe
  C:\Windows\System\CGJlKtZ.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\XGIOGqC.exe
  C:\Windows\System\XGIOGqC.exe
  2⤵
  PID:1924
- C:\Windows\System\WAPqlNt.exe
  C:\Windows\System\WAPqlNt.exe
  2⤵
  PID:2748
- C:\Windows\System\eWYAARz.exe
  C:\Windows\System\eWYAARz.exe
  2⤵
  PID:3116
- C:\Windows\System\TRfrhMf.exe
  C:\Windows\System\TRfrhMf.exe
  2⤵
  PID:1936
- C:\Windows\System\YJhWkbl.exe
  C:\Windows\System\YJhWkbl.exe
  2⤵
  PID:4460
- C:\Windows\System\bLHwZBz.exe
  C:\Windows\System\bLHwZBz.exe
  2⤵
  PID:1436
- C:\Windows\System\gUvLLiB.exe
  C:\Windows\System\gUvLLiB.exe
  2⤵
  PID:4308
- C:\Windows\System\DJNccmG.exe
  C:\Windows\System\DJNccmG.exe
  2⤵
  PID:3404
- C:\Windows\System\LDUKsyV.exe
  C:\Windows\System\LDUKsyV.exe
  2⤵
  PID:1560
- C:\Windows\System\HiBwQNX.exe
  C:\Windows\System\HiBwQNX.exe
  2⤵
  PID:4572
- C:\Windows\System\tmkNliu.exe
  C:\Windows\System\tmkNliu.exe
  2⤵
  PID:4060
- C:\Windows\System\PVjXvjX.exe
  C:\Windows\System\PVjXvjX.exe
  2⤵
  PID:1404
- C:\Windows\System\QrqYpSa.exe
  C:\Windows\System\QrqYpSa.exe
  2⤵
  PID:4356
- C:\Windows\System\uTijAwh.exe
  C:\Windows\System\uTijAwh.exe
  2⤵
  PID:1792
- C:\Windows\System\pkjfyBS.exe
  C:\Windows\System\pkjfyBS.exe
  2⤵
  PID:5060
- C:\Windows\System\LKMEuid.exe
  C:\Windows\System\LKMEuid.exe
  2⤵
  PID:4548
- C:\Windows\System\nWBtvkF.exe
  C:\Windows\System\nWBtvkF.exe
  2⤵
  PID:3948
- C:\Windows\System\uWNWHpd.exe
  C:\Windows\System\uWNWHpd.exe
  2⤵
  PID:3236
- C:\Windows\System\lcBKTNC.exe
  C:\Windows\System\lcBKTNC.exe
  2⤵
  PID:2076
- C:\Windows\System\hXJaCfY.exe
  C:\Windows\System\hXJaCfY.exe
  2⤵
  PID:2536
- C:\Windows\System\iTiYSAr.exe
  C:\Windows\System\iTiYSAr.exe
  2⤵
  PID:4776
- C:\Windows\System\vEobZbp.exe
  C:\Windows\System\vEobZbp.exe
  2⤵
  PID:4612
- C:\Windows\System\pLEfPWv.exe
  C:\Windows\System\pLEfPWv.exe
  2⤵
  PID:1664
- C:\Windows\System\kGCPyPp.exe
  C:\Windows\System\kGCPyPp.exe
  2⤵
  PID:3868
- C:\Windows\System\yISOSiU.exe
  C:\Windows\System\yISOSiU.exe
  2⤵
  PID:464
- C:\Windows\System\kLPrEjr.exe
  C:\Windows\System\kLPrEjr.exe
  2⤵
  PID:4220
- C:\Windows\System\RYnUxnK.exe
  C:\Windows\System\RYnUxnK.exe
  2⤵
  PID:1844
- C:\Windows\System\UspYtjN.exe
  C:\Windows\System\UspYtjN.exe
  2⤵
  PID:3544
- C:\Windows\System\iGXxvFf.exe
  C:\Windows\System\iGXxvFf.exe
  2⤵
  PID:3460
- C:\Windows\System\ndmKONi.exe
  C:\Windows\System\ndmKONi.exe
  2⤵
  PID:2188
- C:\Windows\System\pASuefG.exe
  C:\Windows\System\pASuefG.exe
  2⤵
  PID:4840
- C:\Windows\System\WMKtRVY.exe
  C:\Windows\System\WMKtRVY.exe
  2⤵
  PID:1700
- C:\Windows\System\hrXmnrb.exe
  C:\Windows\System\hrXmnrb.exe
  2⤵
  PID:3356
- C:\Windows\System\IDqWsWe.exe
  C:\Windows\System\IDqWsWe.exe
  2⤵
  PID:4404
- C:\Windows\System\gmgGmZe.exe
  C:\Windows\System\gmgGmZe.exe
  2⤵
  PID:3052
- C:\Windows\System\FoLWgHy.exe
  C:\Windows\System\FoLWgHy.exe
  2⤵
  PID:3048
- C:\Windows\System\sFvyxDd.exe
  C:\Windows\System\sFvyxDd.exe
  2⤵
  PID:816
- C:\Windows\System\UttYWjs.exe
  C:\Windows\System\UttYWjs.exe
  2⤵
  PID:4324
- C:\Windows\System\wtZsBUr.exe
  C:\Windows\System\wtZsBUr.exe
  2⤵
  PID:3860
- C:\Windows\System\FtzGeFi.exe
  C:\Windows\System\FtzGeFi.exe
  2⤵
  PID:2172
- C:\Windows\System\UwaolGT.exe
  C:\Windows\System\UwaolGT.exe
  2⤵
  PID:2276
- C:\Windows\System\WAWGXbi.exe
  C:\Windows\System\WAWGXbi.exe
  2⤵
  PID:1020
- C:\Windows\System\QvdxDVL.exe
  C:\Windows\System\QvdxDVL.exe
  2⤵
  PID:4024
- C:\Windows\System\YGBsPra.exe
  C:\Windows\System\YGBsPra.exe
  2⤵
  PID:3744
- C:\Windows\System\jZPmlem.exe
  C:\Windows\System\jZPmlem.exe
  2⤵
  PID:4284
- C:\Windows\System\lyyHGvv.exe
  C:\Windows\System\lyyHGvv.exe
  2⤵
  PID:2980
- C:\Windows\System\eTKhDAE.exe
  C:\Windows\System\eTKhDAE.exe
  2⤵
  PID:5140
- C:\Windows\System\YEHtZlD.exe
  C:\Windows\System\YEHtZlD.exe
  2⤵
  PID:5180
- C:\Windows\System\ubMnxis.exe
  C:\Windows\System\ubMnxis.exe
  2⤵
  PID:5200
- C:\Windows\System\prOgyXI.exe
  C:\Windows\System\prOgyXI.exe
  2⤵
  PID:5216
- C:\Windows\System\grBjKjy.exe
  C:\Windows\System\grBjKjy.exe
  2⤵
  PID:5252
- C:\Windows\System\FfesrRd.exe
  C:\Windows\System\FfesrRd.exe
  2⤵
  PID:5276
- C:\Windows\System\OPFEXmS.exe
  C:\Windows\System\OPFEXmS.exe
  2⤵
  PID:5304
- C:\Windows\System\ayCSXgX.exe
  C:\Windows\System\ayCSXgX.exe
  2⤵
  PID:5352
- C:\Windows\System\DfbpHZo.exe
  C:\Windows\System\DfbpHZo.exe
  2⤵
  PID:5372
- C:\Windows\System\sUNMQPI.exe
  C:\Windows\System\sUNMQPI.exe
  2⤵
  PID:5404
- C:\Windows\System\DmLXSRz.exe
  C:\Windows\System\DmLXSRz.exe
  2⤵
  PID:5428
- C:\Windows\System\CUJkRps.exe
  C:\Windows\System\CUJkRps.exe
  2⤵
  PID:5456
- C:\Windows\System\aLlgajZ.exe
  C:\Windows\System\aLlgajZ.exe
  2⤵
  PID:5476
- C:\Windows\System\hSqkRdA.exe
  C:\Windows\System\hSqkRdA.exe
  2⤵
  PID:5496
- C:\Windows\System\WKtOjJO.exe
  C:\Windows\System\WKtOjJO.exe
  2⤵
  PID:5524
- C:\Windows\System\sjLTFly.exe
  C:\Windows\System\sjLTFly.exe
  2⤵
  PID:5564
- C:\Windows\System\DbNWbwh.exe
  C:\Windows\System\DbNWbwh.exe
  2⤵
  PID:5584
- C:\Windows\System\XVjLwpA.exe
  C:\Windows\System\XVjLwpA.exe
  2⤵
  PID:5620
- C:\Windows\System\PNhjKEh.exe
  C:\Windows\System\PNhjKEh.exe
  2⤵
  PID:5648
- C:\Windows\System\JnNoAxB.exe
  C:\Windows\System\JnNoAxB.exe
  2⤵
  PID:5676
- C:\Windows\System\wblKkTh.exe
  C:\Windows\System\wblKkTh.exe
  2⤵
  PID:5704
- C:\Windows\System\ikJLuOl.exe
  C:\Windows\System\ikJLuOl.exe
  2⤵
  PID:5744
- C:\Windows\System\FtBbups.exe
  C:\Windows\System\FtBbups.exe
  2⤵
  PID:5760
- C:\Windows\System\OEpuOix.exe
  C:\Windows\System\OEpuOix.exe
  2⤵
  PID:5788
- C:\Windows\System\vNIyNTg.exe
  C:\Windows\System\vNIyNTg.exe
  2⤵
  PID:5816
- C:\Windows\System\ZUjUyYH.exe
  C:\Windows\System\ZUjUyYH.exe
  2⤵
  PID:5848
- C:\Windows\System\ZvoCeYg.exe
  C:\Windows\System\ZvoCeYg.exe
  2⤵
  PID:5872
- C:\Windows\System\IYQYInp.exe
  C:\Windows\System\IYQYInp.exe
  2⤵
  PID:5900
- C:\Windows\System\sEeqdwS.exe
  C:\Windows\System\sEeqdwS.exe
  2⤵
  PID:5920
- C:\Windows\System\ozUuZGk.exe
  C:\Windows\System\ozUuZGk.exe
  2⤵
  PID:5960
- C:\Windows\System\ZYAAuny.exe
  C:\Windows\System\ZYAAuny.exe
  2⤵
  PID:5988
- C:\Windows\System\WoJCKsv.exe
  C:\Windows\System\WoJCKsv.exe
  2⤵
  PID:6028
- C:\Windows\System\ssxOkXo.exe
  C:\Windows\System\ssxOkXo.exe
  2⤵
  PID:6048
- C:\Windows\System\AALaeOd.exe
  C:\Windows\System\AALaeOd.exe
  2⤵
  PID:6072
- C:\Windows\System\rbExrQO.exe
  C:\Windows\System\rbExrQO.exe
  2⤵
  PID:6100
- C:\Windows\System\VzRzYkB.exe
  C:\Windows\System\VzRzYkB.exe
  2⤵
  PID:6128
- C:\Windows\System\cRakLsX.exe
  C:\Windows\System\cRakLsX.exe
  2⤵
  PID:5164
- C:\Windows\System\LVcydpR.exe
  C:\Windows\System\LVcydpR.exe
  2⤵
  PID:5244
- C:\Windows\System\BBBnNfl.exe
  C:\Windows\System\BBBnNfl.exe
  2⤵
  PID:5292
- C:\Windows\System\rzIcFDc.exe
  C:\Windows\System\rzIcFDc.exe
  2⤵
  PID:5368
- C:\Windows\System\SXJmhyJ.exe
  C:\Windows\System\SXJmhyJ.exe
  2⤵
  PID:5440
- C:\Windows\System\GTJXLAG.exe
  C:\Windows\System\GTJXLAG.exe
  2⤵
  PID:5512
- C:\Windows\System\uPBtArq.exe
  C:\Windows\System\uPBtArq.exe
  2⤵
  PID:5484
- C:\Windows\System\VFRHTwC.exe
  C:\Windows\System\VFRHTwC.exe
  2⤵
  PID:5572
- C:\Windows\System\MFsWYlv.exe
  C:\Windows\System\MFsWYlv.exe
  2⤵
  PID:5612
- C:\Windows\System\ThmTsBV.exe
  C:\Windows\System\ThmTsBV.exe
  2⤵
  PID:5724
- C:\Windows\System\mBvEBEv.exe
  C:\Windows\System\mBvEBEv.exe
  2⤵
  PID:5776
- C:\Windows\System\EJpBgpa.exe
  C:\Windows\System\EJpBgpa.exe
  2⤵
  PID:5868
- C:\Windows\System\RGDEDrB.exe
  C:\Windows\System\RGDEDrB.exe
  2⤵
  PID:5948
- C:\Windows\System\lbCaiOX.exe
  C:\Windows\System\lbCaiOX.exe
  2⤵
  PID:6000
- C:\Windows\System\MzknAff.exe
  C:\Windows\System\MzknAff.exe
  2⤵
  PID:6060
- C:\Windows\System\oUeAVFb.exe
  C:\Windows\System\oUeAVFb.exe
  2⤵
  PID:6084
- C:\Windows\System\jVLsPiX.exe
  C:\Windows\System\jVLsPiX.exe
  2⤵
  PID:5212
- C:\Windows\System\Mtehmrg.exe
  C:\Windows\System\Mtehmrg.exe
  2⤵
  PID:5344
- C:\Windows\System\bypBibM.exe
  C:\Windows\System\bypBibM.exe
  2⤵
  PID:5492
- C:\Windows\System\rfKyEDD.exe
  C:\Windows\System\rfKyEDD.exe
  2⤵
  PID:5640
- C:\Windows\System\JtghOtl.exe
  C:\Windows\System\JtghOtl.exe
  2⤵
  PID:5856
- C:\Windows\System\cWFLiCF.exe
  C:\Windows\System\cWFLiCF.exe
  2⤵
  PID:5976
- C:\Windows\System\jsQKVka.exe
  C:\Windows\System\jsQKVka.exe
  2⤵
  PID:6140
- C:\Windows\System\yzkpaGM.exe
  C:\Windows\System\yzkpaGM.exe
  2⤵
  PID:5332
- C:\Windows\System\ppqxLXj.exe
  C:\Windows\System\ppqxLXj.exe
  2⤵
  PID:5884
- C:\Windows\System\rMsxISL.exe
  C:\Windows\System\rMsxISL.exe
  2⤵
  PID:5268
- C:\Windows\System\Usqzwps.exe
  C:\Windows\System\Usqzwps.exe
  2⤵
  PID:5600
- C:\Windows\System\bXPEyMI.exe
  C:\Windows\System\bXPEyMI.exe
  2⤵
  PID:6148
- C:\Windows\System\NZUgNRL.exe
  C:\Windows\System\NZUgNRL.exe
  2⤵
  PID:6172
- C:\Windows\System\rHBiZun.exe
  C:\Windows\System\rHBiZun.exe
  2⤵
  PID:6204
- C:\Windows\System\KRIzNBZ.exe
  C:\Windows\System\KRIzNBZ.exe
  2⤵
  PID:6228
- C:\Windows\System\lrvuIVi.exe
  C:\Windows\System\lrvuIVi.exe
  2⤵
  PID:6256
- C:\Windows\System\oWnuHpt.exe
  C:\Windows\System\oWnuHpt.exe
  2⤵
  PID:6280
- C:\Windows\System\LvqgOBn.exe
  C:\Windows\System\LvqgOBn.exe
  2⤵
  PID:6300
- C:\Windows\System\INjqFrQ.exe
  C:\Windows\System\INjqFrQ.exe
  2⤵
  PID:6336
- C:\Windows\System\JCybMiQ.exe
  C:\Windows\System\JCybMiQ.exe
  2⤵
  PID:6368
- C:\Windows\System\xOeWTZp.exe
  C:\Windows\System\xOeWTZp.exe
  2⤵
  PID:6396
- C:\Windows\System\qkxEqHH.exe
  C:\Windows\System\qkxEqHH.exe
  2⤵
  PID:6428
- C:\Windows\System\QwddXiw.exe
  C:\Windows\System\QwddXiw.exe
  2⤵
  PID:6460
- C:\Windows\System\eGxngYK.exe
  C:\Windows\System\eGxngYK.exe
  2⤵
  PID:6488
- C:\Windows\System\wRUExha.exe
  C:\Windows\System\wRUExha.exe
  2⤵
  PID:6508
- C:\Windows\System\JethWvQ.exe
  C:\Windows\System\JethWvQ.exe
  2⤵
  PID:6536
- C:\Windows\System\ugOqfvk.exe
  C:\Windows\System\ugOqfvk.exe
  2⤵
  PID:6568
- C:\Windows\System\znJolVl.exe
  C:\Windows\System\znJolVl.exe
  2⤵
  PID:6608
- C:\Windows\System\qXftELu.exe
  C:\Windows\System\qXftELu.exe
  2⤵
  PID:6636
- C:\Windows\System\IuWakME.exe
  C:\Windows\System\IuWakME.exe
  2⤵
  PID:6660
- C:\Windows\System\uaxwYbi.exe
  C:\Windows\System\uaxwYbi.exe
  2⤵
  PID:6688
- C:\Windows\System\yGWjiEd.exe
  C:\Windows\System\yGWjiEd.exe
  2⤵
  PID:6712
- C:\Windows\System\HBJxLow.exe
  C:\Windows\System\HBJxLow.exe
  2⤵
  PID:6744
- C:\Windows\System\hWYelJx.exe
  C:\Windows\System\hWYelJx.exe
  2⤵
  PID:6772
- C:\Windows\System\eTGledz.exe
  C:\Windows\System\eTGledz.exe
  2⤵
  PID:6792
- C:\Windows\System\YTqEQBN.exe
  C:\Windows\System\YTqEQBN.exe
  2⤵
  PID:6816
- C:\Windows\System\VpNlUIG.exe
  C:\Windows\System\VpNlUIG.exe
  2⤵
  PID:6844
- C:\Windows\System\kIzikFk.exe
  C:\Windows\System\kIzikFk.exe
  2⤵
  PID:6880
- C:\Windows\System\ySLVAjl.exe
  C:\Windows\System\ySLVAjl.exe
  2⤵
  PID:6912
- C:\Windows\System\SsNdzkP.exe
  C:\Windows\System\SsNdzkP.exe
  2⤵
  PID:6932
- C:\Windows\System\QTGdRAu.exe
  C:\Windows\System\QTGdRAu.exe
  2⤵
  PID:6964
- C:\Windows\System\hslwsCk.exe
  C:\Windows\System\hslwsCk.exe
  2⤵
  PID:7000
- C:\Windows\System\ORNhySN.exe
  C:\Windows\System\ORNhySN.exe
  2⤵
  PID:7036
- C:\Windows\System\BAwhtWe.exe
  C:\Windows\System\BAwhtWe.exe
  2⤵
  PID:7056
- C:\Windows\System\rkbSmSI.exe
  C:\Windows\System\rkbSmSI.exe
  2⤵
  PID:7088
- C:\Windows\System\CLpiCYC.exe
  C:\Windows\System\CLpiCYC.exe
  2⤵
  PID:7116
- C:\Windows\System\XesBQRs.exe
  C:\Windows\System\XesBQRs.exe
  2⤵
  PID:7152
- C:\Windows\System\pVPVwxh.exe
  C:\Windows\System\pVPVwxh.exe
  2⤵
  PID:6156
- C:\Windows\System\ATGlahI.exe
  C:\Windows\System\ATGlahI.exe
  2⤵
  PID:6244
- C:\Windows\System\xvbWMYE.exe
  C:\Windows\System\xvbWMYE.exe
  2⤵
  PID:6292
- C:\Windows\System\pjTkutf.exe
  C:\Windows\System\pjTkutf.exe
  2⤵
  PID:6324
- C:\Windows\System\xcwBDwu.exe
  C:\Windows\System\xcwBDwu.exe
  2⤵
  PID:6424
- C:\Windows\System\aaONxOu.exe
  C:\Windows\System\aaONxOu.exe
  2⤵
  PID:6480
- C:\Windows\System\glucaDT.exe
  C:\Windows\System\glucaDT.exe
  2⤵
  PID:6504
- C:\Windows\System\hBJFrNu.exe
  C:\Windows\System\hBJFrNu.exe
  2⤵
  PID:6576
- C:\Windows\System\PvlpQZp.exe
  C:\Windows\System\PvlpQZp.exe
  2⤵
  PID:6596
- C:\Windows\System\kLWerlU.exe
  C:\Windows\System\kLWerlU.exe
  2⤵
  PID:6628
- C:\Windows\System\dUrBnkk.exe
  C:\Windows\System\dUrBnkk.exe
  2⤵
  PID:6752
- C:\Windows\System\nNslnOm.exe
  C:\Windows\System\nNslnOm.exe
  2⤵
  PID:6836
- C:\Windows\System\ZktIXGs.exe
  C:\Windows\System\ZktIXGs.exe
  2⤵
  PID:6832
- C:\Windows\System\InovEIv.exe
  C:\Windows\System\InovEIv.exe
  2⤵
  PID:6944
- C:\Windows\System\lopUPuL.exe
  C:\Windows\System\lopUPuL.exe
  2⤵
  PID:7024
- C:\Windows\System\riUUuUp.exe
  C:\Windows\System\riUUuUp.exe
  2⤵
  PID:7080
- C:\Windows\System\iOnwRfN.exe
  C:\Windows\System\iOnwRfN.exe
  2⤵
  PID:7124
- C:\Windows\System\ClskMKA.exe
  C:\Windows\System\ClskMKA.exe
  2⤵
  PID:6196
- C:\Windows\System\OYsMpYx.exe
  C:\Windows\System\OYsMpYx.exe
  2⤵
  PID:6384
- C:\Windows\System\fnGPOks.exe
  C:\Windows\System\fnGPOks.exe
  2⤵
  PID:6616
- C:\Windows\System\RccjDgg.exe
  C:\Windows\System\RccjDgg.exe
  2⤵
  PID:6788
- C:\Windows\System\MALujGy.exe
  C:\Windows\System\MALujGy.exe
  2⤵
  PID:6760
- C:\Windows\System\Qkyepql.exe
  C:\Windows\System\Qkyepql.exe
  2⤵
  PID:6900
- C:\Windows\System\miefnji.exe
  C:\Windows\System\miefnji.exe
  2⤵
  PID:7132
- C:\Windows\System\yHURJkV.exe
  C:\Windows\System\yHURJkV.exe
  2⤵
  PID:6548
- C:\Windows\System\oENnSBn.exe
  C:\Windows\System\oENnSBn.exe
  2⤵
  PID:6556
- C:\Windows\System\VMjRiGe.exe
  C:\Windows\System\VMjRiGe.exe
  2⤵
  PID:6416
- C:\Windows\System\OwMmtoJ.exe
  C:\Windows\System\OwMmtoJ.exe
  2⤵
  PID:7192
- C:\Windows\System\cSNljme.exe
  C:\Windows\System\cSNljme.exe
  2⤵
  PID:7228
- C:\Windows\System\PRvPgis.exe
  C:\Windows\System\PRvPgis.exe
  2⤵
  PID:7252
- C:\Windows\System\siCRMBk.exe
  C:\Windows\System\siCRMBk.exe
  2⤵
  PID:7288
- C:\Windows\System\uVQTOUF.exe
  C:\Windows\System\uVQTOUF.exe
  2⤵
  PID:7312
- C:\Windows\System\BfmdKtg.exe
  C:\Windows\System\BfmdKtg.exe
  2⤵
  PID:7332
- C:\Windows\System\hyPEURs.exe
  C:\Windows\System\hyPEURs.exe
  2⤵
  PID:7360
- C:\Windows\System\ACJcjeY.exe
  C:\Windows\System\ACJcjeY.exe
  2⤵
  PID:7388
- C:\Windows\System\OnQmqmL.exe
  C:\Windows\System\OnQmqmL.exe
  2⤵
  PID:7416
- C:\Windows\System\MwenapO.exe
  C:\Windows\System\MwenapO.exe
  2⤵
  PID:7444
- C:\Windows\System\HPijFFw.exe
  C:\Windows\System\HPijFFw.exe
  2⤵
  PID:7472
- C:\Windows\System\ZAMWrNO.exe
  C:\Windows\System\ZAMWrNO.exe
  2⤵
  PID:7488
- C:\Windows\System\RFWGUcr.exe
  C:\Windows\System\RFWGUcr.exe
  2⤵
  PID:7520
- C:\Windows\System\rtYQFSd.exe
  C:\Windows\System\rtYQFSd.exe
  2⤵
  PID:7548
- C:\Windows\System\HHWeSmz.exe
  C:\Windows\System\HHWeSmz.exe
  2⤵
  PID:7580
- C:\Windows\System\JBsFMzp.exe
  C:\Windows\System\JBsFMzp.exe
  2⤵
  PID:7612
- C:\Windows\System\wNBUWUh.exe
  C:\Windows\System\wNBUWUh.exe
  2⤵
  PID:7628
- C:\Windows\System\GlmlTej.exe
  C:\Windows\System\GlmlTej.exe
  2⤵
  PID:7652
- C:\Windows\System\JJMTXWZ.exe
  C:\Windows\System\JJMTXWZ.exe
  2⤵
  PID:7680
- C:\Windows\System\zWrjtdb.exe
  C:\Windows\System\zWrjtdb.exe
  2⤵
  PID:7724
- C:\Windows\System\USeteCU.exe
  C:\Windows\System\USeteCU.exe
  2⤵
  PID:7752
- C:\Windows\System\seRcMVt.exe
  C:\Windows\System\seRcMVt.exe
  2⤵
  PID:7780
- C:\Windows\System\fHPOizP.exe
  C:\Windows\System\fHPOizP.exe
  2⤵
  PID:7800
- C:\Windows\System\rKGsgQz.exe
  C:\Windows\System\rKGsgQz.exe
  2⤵
  PID:7824
- C:\Windows\System\hgZiWMS.exe
  C:\Windows\System\hgZiWMS.exe
  2⤵
  PID:7856
- C:\Windows\System\JJfNcgX.exe
  C:\Windows\System\JJfNcgX.exe
  2⤵
  PID:7888
- C:\Windows\System\uDXAcdp.exe
  C:\Windows\System\uDXAcdp.exe
  2⤵
  PID:7920
- C:\Windows\System\coQKVkm.exe
  C:\Windows\System\coQKVkm.exe
  2⤵
  PID:7940
- C:\Windows\System\rcPcYWJ.exe
  C:\Windows\System\rcPcYWJ.exe
  2⤵
  PID:7960
- C:\Windows\System\xkVoBTg.exe
  C:\Windows\System\xkVoBTg.exe
  2⤵
  PID:7980
- C:\Windows\System\lOsmjPe.exe
  C:\Windows\System\lOsmjPe.exe
  2⤵
  PID:8008
- C:\Windows\System\EMyndba.exe
  C:\Windows\System\EMyndba.exe
  2⤵
  PID:8056
- C:\Windows\System\pzXkZDF.exe
  C:\Windows\System\pzXkZDF.exe
  2⤵
  PID:8084
- C:\Windows\System\jzgEJYs.exe
  C:\Windows\System\jzgEJYs.exe
  2⤵
  PID:8100
- C:\Windows\System\cSGlGhi.exe
  C:\Windows\System\cSGlGhi.exe
  2⤵
  PID:8124
- C:\Windows\System\JnxDlBy.exe
  C:\Windows\System\JnxDlBy.exe
  2⤵
  PID:8152
- C:\Windows\System\CPThhyg.exe
  C:\Windows\System\CPThhyg.exe
  2⤵
  PID:6756
- C:\Windows\System\SjEpjdt.exe
  C:\Windows\System\SjEpjdt.exe
  2⤵
  PID:7240
- C:\Windows\System\aJDrJhw.exe
  C:\Windows\System\aJDrJhw.exe
  2⤵
  PID:7308
- C:\Windows\System\tHaeJLq.exe
  C:\Windows\System\tHaeJLq.exe
  2⤵
  PID:7408
- C:\Windows\System\vWvXryy.exe
  C:\Windows\System\vWvXryy.exe
  2⤵
  PID:7432
- C:\Windows\System\LTNlaBp.exe
  C:\Windows\System\LTNlaBp.exe
  2⤵
  PID:7572
- C:\Windows\System\pfIAxOk.exe
  C:\Windows\System\pfIAxOk.exe
  2⤵
  PID:7556
- C:\Windows\System\QwWDQFE.exe
  C:\Windows\System\QwWDQFE.exe
  2⤵
  PID:7688
- C:\Windows\System\bFpLXLY.exe
  C:\Windows\System\bFpLXLY.exe
  2⤵
  PID:7704
- C:\Windows\System\HWzkFPQ.exe
  C:\Windows\System\HWzkFPQ.exe
  2⤵
  PID:7740
- C:\Windows\System\FavLgHV.exe
  C:\Windows\System\FavLgHV.exe
  2⤵
  PID:7776
- C:\Windows\System\SrUAIwc.exe
  C:\Windows\System\SrUAIwc.exe
  2⤵
  PID:7864
- C:\Windows\System\tZYbIOG.exe
  C:\Windows\System\tZYbIOG.exe
  2⤵
  PID:7952
- C:\Windows\System\Bttanvg.exe
  C:\Windows\System\Bttanvg.exe
  2⤵
  PID:8040
- C:\Windows\System\ePOZTCr.exe
  C:\Windows\System\ePOZTCr.exe
  2⤵
  PID:8064
- C:\Windows\System\rZxEuRi.exe
  C:\Windows\System\rZxEuRi.exe
  2⤵
  PID:8044
- C:\Windows\System\JbZcxxF.exe
  C:\Windows\System\JbZcxxF.exe
  2⤵
  PID:8140
- C:\Windows\System\wcvBkYU.exe
  C:\Windows\System\wcvBkYU.exe
  2⤵
  PID:7272
- C:\Windows\System\DezhQhp.exe
  C:\Windows\System\DezhQhp.exe
  2⤵
  PID:7400
- C:\Windows\System\TtKXJdQ.exe
  C:\Windows\System\TtKXJdQ.exe
  2⤵
  PID:7700
- C:\Windows\System\Ndsqilj.exe
  C:\Windows\System\Ndsqilj.exe
  2⤵
  PID:7668
- C:\Windows\System\JTdVzFX.exe
  C:\Windows\System\JTdVzFX.exe
  2⤵
  PID:7844
- C:\Windows\System\jObTmsx.exe
  C:\Windows\System\jObTmsx.exe
  2⤵
  PID:7816
- C:\Windows\System\pzZazxc.exe
  C:\Windows\System\pzZazxc.exe
  2⤵
  PID:8004
- C:\Windows\System\UzMDVGR.exe
  C:\Windows\System\UzMDVGR.exe
  2⤵
  PID:7204
- C:\Windows\System\wXXfzdf.exe
  C:\Windows\System\wXXfzdf.exe
  2⤵
  PID:7512
- C:\Windows\System\bcSKgpj.exe
  C:\Windows\System\bcSKgpj.exe
  2⤵
  PID:8196
- C:\Windows\System\ijmldfH.exe
  C:\Windows\System\ijmldfH.exe
  2⤵
  PID:8216
- C:\Windows\System\yoTiBdH.exe
  C:\Windows\System\yoTiBdH.exe
  2⤵
  PID:8244
- C:\Windows\System\DALtZUH.exe
  C:\Windows\System\DALtZUH.exe
  2⤵
  PID:8272
- C:\Windows\System\wVZmInf.exe
  C:\Windows\System\wVZmInf.exe
  2⤵
  PID:8308
- C:\Windows\System\aSJBfox.exe
  C:\Windows\System\aSJBfox.exe
  2⤵
  PID:8336
- C:\Windows\System\wsLaJri.exe
  C:\Windows\System\wsLaJri.exe
  2⤵
  PID:8360
- C:\Windows\System\TzsWngK.exe
  C:\Windows\System\TzsWngK.exe
  2⤵
  PID:8392
- C:\Windows\System\TPuTUsO.exe
  C:\Windows\System\TPuTUsO.exe
  2⤵
  PID:8428
- C:\Windows\System\YfUwowW.exe
  C:\Windows\System\YfUwowW.exe
  2⤵
  PID:8456
- C:\Windows\System\KDTHaAV.exe
  C:\Windows\System\KDTHaAV.exe
  2⤵
  PID:8484
- C:\Windows\System\xBbLltD.exe
  C:\Windows\System\xBbLltD.exe
  2⤵
  PID:8512
- C:\Windows\System\QgJAZmR.exe
  C:\Windows\System\QgJAZmR.exe
  2⤵
  PID:8540
- C:\Windows\System\ZpEqPbW.exe
  C:\Windows\System\ZpEqPbW.exe
  2⤵
  PID:8572
- C:\Windows\System\tAEGfKs.exe
  C:\Windows\System\tAEGfKs.exe
  2⤵
  PID:8604
- C:\Windows\System\pYhSVGI.exe
  C:\Windows\System\pYhSVGI.exe
  2⤵
  PID:8632
- C:\Windows\System\TqlGjSI.exe
  C:\Windows\System\TqlGjSI.exe
  2⤵
  PID:8664
- C:\Windows\System\kyfRDvl.exe
  C:\Windows\System\kyfRDvl.exe
  2⤵
  PID:8700
- C:\Windows\System\ukKvAQP.exe
  C:\Windows\System\ukKvAQP.exe
  2⤵
  PID:8716
- C:\Windows\System\YtctdMa.exe
  C:\Windows\System\YtctdMa.exe
  2⤵
  PID:8744
- C:\Windows\System\bmWMGeR.exe
  C:\Windows\System\bmWMGeR.exe
  2⤵
  PID:8772
- C:\Windows\System\DMPWQVT.exe
  C:\Windows\System\DMPWQVT.exe
  2⤵
  PID:8800
- C:\Windows\System\BduROOO.exe
  C:\Windows\System\BduROOO.exe
  2⤵
  PID:8836
- C:\Windows\System\ezSGwsx.exe
  C:\Windows\System\ezSGwsx.exe
  2⤵
  PID:8856
- C:\Windows\System\NqzcPhi.exe
  C:\Windows\System\NqzcPhi.exe
  2⤵
  PID:8884
- C:\Windows\System\odgvBMv.exe
  C:\Windows\System\odgvBMv.exe
  2⤵
  PID:8912
- C:\Windows\System\FDzLBmS.exe
  C:\Windows\System\FDzLBmS.exe
  2⤵
  PID:8940
- C:\Windows\System\ZSJaIgX.exe
  C:\Windows\System\ZSJaIgX.exe
  2⤵
  PID:8968
- C:\Windows\System\nogSOPz.exe
  C:\Windows\System\nogSOPz.exe
  2⤵
  PID:8996
- C:\Windows\System\qVtjkOv.exe
  C:\Windows\System\qVtjkOv.exe
  2⤵
  PID:9024
- C:\Windows\System\ewfmtRu.exe
  C:\Windows\System\ewfmtRu.exe
  2⤵
  PID:9052
- C:\Windows\System\OYPduhS.exe
  C:\Windows\System\OYPduhS.exe
  2⤵
  PID:9080
- C:\Windows\System\PCYoNYq.exe
  C:\Windows\System\PCYoNYq.exe
  2⤵
  PID:9108
- C:\Windows\System\mqntGEG.exe
  C:\Windows\System\mqntGEG.exe
  2⤵
  PID:9144
- C:\Windows\System\dasFjEt.exe
  C:\Windows\System\dasFjEt.exe
  2⤵
  PID:9168
- C:\Windows\System\ZEYyWuE.exe
  C:\Windows\System\ZEYyWuE.exe
  2⤵
  PID:9188
- C:\Windows\System\RupHjhf.exe
  C:\Windows\System\RupHjhf.exe
  2⤵
  PID:9212
- C:\Windows\System\CYjTHxT.exe
  C:\Windows\System\CYjTHxT.exe
  2⤵
  PID:7968
- C:\Windows\System\kUHQAgz.exe
  C:\Windows\System\kUHQAgz.exe
  2⤵
  PID:7676
- C:\Windows\System\YSnXFvp.exe
  C:\Windows\System\YSnXFvp.exe
  2⤵
  PID:8232
- C:\Windows\System\wQDXefV.exe
  C:\Windows\System\wQDXefV.exe
  2⤵
  PID:8280
- C:\Windows\System\tGaJPnh.exe
  C:\Windows\System\tGaJPnh.exe
  2⤵
  PID:8328
- C:\Windows\System\ZVtfuxE.exe
  C:\Windows\System\ZVtfuxE.exe
  2⤵
  PID:8464
- C:\Windows\System\QSJxZfb.exe
  C:\Windows\System\QSJxZfb.exe
  2⤵
  PID:8508
- C:\Windows\System\LmFaTsM.exe
  C:\Windows\System\LmFaTsM.exe
  2⤵
  PID:8588
- C:\Windows\System\IPrEmWO.exe
  C:\Windows\System\IPrEmWO.exe
  2⤵
  PID:8616
- C:\Windows\System\tgZGYuI.exe
  C:\Windows\System\tgZGYuI.exe
  2⤵
  PID:8688
- C:\Windows\System\QGzKNpr.exe
  C:\Windows\System\QGzKNpr.exe
  2⤵
  PID:8756
- C:\Windows\System\jBVRVoK.exe
  C:\Windows\System\jBVRVoK.exe
  2⤵
  PID:8816
- C:\Windows\System\qbZulEr.exe
  C:\Windows\System\qbZulEr.exe
  2⤵
  PID:8876
- C:\Windows\System\kGmkEVC.exe
  C:\Windows\System\kGmkEVC.exe
  2⤵
  PID:8992
- C:\Windows\System\xtVUthz.exe
  C:\Windows\System\xtVUthz.exe
  2⤵
  PID:9040
- C:\Windows\System\EpUyIkp.exe
  C:\Windows\System\EpUyIkp.exe
  2⤵
  PID:9124
- C:\Windows\System\RWwOxum.exe
  C:\Windows\System\RWwOxum.exe
  2⤵
  PID:9156
- C:\Windows\System\CnGEtcH.exe
  C:\Windows\System\CnGEtcH.exe
  2⤵
  PID:7996
- C:\Windows\System\rTmhebO.exe
  C:\Windows\System\rTmhebO.exe
  2⤵
  PID:8120
- C:\Windows\System\VDstrSa.exe
  C:\Windows\System\VDstrSa.exe
  2⤵
  PID:8292
- C:\Windows\System\IadJOIt.exe
  C:\Windows\System\IadJOIt.exe
  2⤵
  PID:8496
- C:\Windows\System\fENiwYv.exe
  C:\Windows\System\fENiwYv.exe
  2⤵
  PID:8556
- C:\Windows\System\lNDJkTY.exe
  C:\Windows\System\lNDJkTY.exe
  2⤵
  PID:8848
- C:\Windows\System\tuyLmLO.exe
  C:\Windows\System\tuyLmLO.exe
  2⤵
  PID:9100
- C:\Windows\System\zzCMZSr.exe
  C:\Windows\System\zzCMZSr.exe
  2⤵
  PID:7956
- C:\Windows\System\ZWeoomB.exe
  C:\Windows\System\ZWeoomB.exe
  2⤵
  PID:8288
- C:\Windows\System\HQobXcp.exe
  C:\Windows\System\HQobXcp.exe
  2⤵
  PID:8648
- C:\Windows\System\AJZDlAs.exe
  C:\Windows\System\AJZDlAs.exe
  2⤵
  PID:8824
- C:\Windows\System\aMRZZxC.exe
  C:\Windows\System\aMRZZxC.exe
  2⤵
  PID:8452
- C:\Windows\System\KBVndUF.exe
  C:\Windows\System\KBVndUF.exe
  2⤵
  PID:9220
- C:\Windows\System\CJEphnG.exe
  C:\Windows\System\CJEphnG.exe
  2⤵
  PID:9240
- C:\Windows\System\sDkUuut.exe
  C:\Windows\System\sDkUuut.exe
  2⤵
  PID:9264
- C:\Windows\System\JjPDIhF.exe
  C:\Windows\System\JjPDIhF.exe
  2⤵
  PID:9296
- C:\Windows\System\CejNEcO.exe
  C:\Windows\System\CejNEcO.exe
  2⤵
  PID:9324
- C:\Windows\System\JVoRvOM.exe
  C:\Windows\System\JVoRvOM.exe
  2⤵
  PID:9356
- C:\Windows\System\SYSLbeR.exe
  C:\Windows\System\SYSLbeR.exe
  2⤵
  PID:9380
- C:\Windows\System\LzUPKmD.exe
  C:\Windows\System\LzUPKmD.exe
  2⤵
  PID:9408
- C:\Windows\System\LSpyllI.exe
  C:\Windows\System\LSpyllI.exe
  2⤵
  PID:9432
- C:\Windows\System\yJnbqxm.exe
  C:\Windows\System\yJnbqxm.exe
  2⤵
  PID:9464
- C:\Windows\System\vXIAVcV.exe
  C:\Windows\System\vXIAVcV.exe
  2⤵
  PID:9504
- C:\Windows\System\KTTUCbN.exe
  C:\Windows\System\KTTUCbN.exe
  2⤵
  PID:9536
- C:\Windows\System\vCyyfRT.exe
  C:\Windows\System\vCyyfRT.exe
  2⤵
  PID:9560
- C:\Windows\System\sQUatRr.exe
  C:\Windows\System\sQUatRr.exe
  2⤵
  PID:9580
- C:\Windows\System\UqTALNx.exe
  C:\Windows\System\UqTALNx.exe
  2⤵
  PID:9608
- C:\Windows\System\FeWpbXC.exe
  C:\Windows\System\FeWpbXC.exe
  2⤵
  PID:9640
- C:\Windows\System\WztYSGB.exe
  C:\Windows\System\WztYSGB.exe
  2⤵
  PID:9668
- C:\Windows\System\kouZleP.exe
  C:\Windows\System\kouZleP.exe
  2⤵
  PID:9688
- C:\Windows\System\UJfijzQ.exe
  C:\Windows\System\UJfijzQ.exe
  2⤵
  PID:9716
- C:\Windows\System\JhRvCwP.exe
  C:\Windows\System\JhRvCwP.exe
  2⤵
  PID:9748
- C:\Windows\System\ySbpCmF.exe
  C:\Windows\System\ySbpCmF.exe
  2⤵
  PID:9780
- C:\Windows\System\CZheUDF.exe
  C:\Windows\System\CZheUDF.exe
  2⤵
  PID:9808
- C:\Windows\System\jxhgQtp.exe
  C:\Windows\System\jxhgQtp.exe
  2⤵
  PID:9836
- C:\Windows\System\jrblOEV.exe
  C:\Windows\System\jrblOEV.exe
  2⤵
  PID:9868
- C:\Windows\System\LVHzbSC.exe
  C:\Windows\System\LVHzbSC.exe
  2⤵
  PID:9896
- C:\Windows\System\Nhanecm.exe
  C:\Windows\System\Nhanecm.exe
  2⤵
  PID:9924
- C:\Windows\System\zcFQEWn.exe
  C:\Windows\System\zcFQEWn.exe
  2⤵
  PID:9952
- C:\Windows\System\APPOHjt.exe
  C:\Windows\System\APPOHjt.exe
  2⤵
  PID:9988
- C:\Windows\System\NXTATuW.exe
  C:\Windows\System\NXTATuW.exe
  2⤵
  PID:10008
- C:\Windows\System\zyaPeaw.exe
  C:\Windows\System\zyaPeaw.exe
  2⤵
  PID:10036
- C:\Windows\System\GvWEKwX.exe
  C:\Windows\System\GvWEKwX.exe
  2⤵
  PID:10064
- C:\Windows\System\MeoCFWB.exe
  C:\Windows\System\MeoCFWB.exe
  2⤵
  PID:10096
- C:\Windows\System\CBKMkCg.exe
  C:\Windows\System\CBKMkCg.exe
  2⤵
  PID:10132
- C:\Windows\System\ZEggUWR.exe
  C:\Windows\System\ZEggUWR.exe
  2⤵
  PID:10160
- C:\Windows\System\xCHxlqR.exe
  C:\Windows\System\xCHxlqR.exe
  2⤵
  PID:10196
- C:\Windows\System\HtArIno.exe
  C:\Windows\System\HtArIno.exe
  2⤵
  PID:10220
- C:\Windows\System\lPDjMWU.exe
  C:\Windows\System\lPDjMWU.exe
  2⤵
  PID:9232
- C:\Windows\System\DiHXzkp.exe
  C:\Windows\System\DiHXzkp.exe
  2⤵
  PID:9276
- C:\Windows\System\YIpkWkr.exe
  C:\Windows\System\YIpkWkr.exe
  2⤵
  PID:9308
- C:\Windows\System\kPJAKgb.exe
  C:\Windows\System\kPJAKgb.exe
  2⤵
  PID:9428
- C:\Windows\System\BSJxhfz.exe
  C:\Windows\System\BSJxhfz.exe
  2⤵
  PID:9492
- C:\Windows\System\xfKtyWr.exe
  C:\Windows\System\xfKtyWr.exe
  2⤵
  PID:9476
- C:\Windows\System\MdbsmWr.exe
  C:\Windows\System\MdbsmWr.exe
  2⤵
  PID:9532
- C:\Windows\System\yjniDNP.exe
  C:\Windows\System\yjniDNP.exe
  2⤵
  PID:9596
- C:\Windows\System\xpxICJi.exe
  C:\Windows\System\xpxICJi.exe
  2⤵
  PID:9676
- C:\Windows\System\JnBYkRK.exe
  C:\Windows\System\JnBYkRK.exe
  2⤵
  PID:9760
- C:\Windows\System\XROCEks.exe
  C:\Windows\System\XROCEks.exe
  2⤵
  PID:9800
- C:\Windows\System\JrHHsJk.exe
  C:\Windows\System\JrHHsJk.exe
  2⤵
  PID:9932
- C:\Windows\System\NvbZfuu.exe
  C:\Windows\System\NvbZfuu.exe
  2⤵
  PID:9976
- C:\Windows\System\DzIOrrD.exe
  C:\Windows\System\DzIOrrD.exe
  2⤵
  PID:10084
- C:\Windows\System\EiZbVHx.exe
  C:\Windows\System\EiZbVHx.exe
  2⤵
  PID:10052
- C:\Windows\System\hxxFrWm.exe
  C:\Windows\System\hxxFrWm.exe
  2⤵
  PID:10144
- C:\Windows\System\uavsKSP.exe
  C:\Windows\System\uavsKSP.exe
  2⤵
  PID:8240
- C:\Windows\System\InaxHBA.exe
  C:\Windows\System\InaxHBA.exe
  2⤵
  PID:9252
- C:\Windows\System\IxzJSWn.exe
  C:\Windows\System\IxzJSWn.exe
  2⤵
  PID:9460
- C:\Windows\System\fVvmZKJ.exe
  C:\Windows\System\fVvmZKJ.exe
  2⤵
  PID:9736
- C:\Windows\System\bHIVaha.exe
  C:\Windows\System\bHIVaha.exe
  2⤵
  PID:9792
- C:\Windows\System\IegimCk.exe
  C:\Windows\System\IegimCk.exe
  2⤵
  PID:10004
- C:\Windows\System\zteLfmx.exe
  C:\Windows\System\zteLfmx.exe
  2⤵
  PID:10112
- C:\Windows\System\ynGAFSj.exe
  C:\Windows\System\ynGAFSj.exe
  2⤵
  PID:9228
- C:\Windows\System\lEEMNTE.exe
  C:\Windows\System\lEEMNTE.exe
  2⤵
  PID:9604
- C:\Windows\System\HNeoTaf.exe
  C:\Windows\System\HNeoTaf.exe
  2⤵
  PID:9128
- C:\Windows\System\yOmKWJc.exe
  C:\Windows\System\yOmKWJc.exe
  2⤵
  PID:9396
- C:\Windows\System\dMtxeTj.exe
  C:\Windows\System\dMtxeTj.exe
  2⤵
  PID:10244
- C:\Windows\System\AyBageP.exe
  C:\Windows\System\AyBageP.exe
  2⤵
  PID:10264
- C:\Windows\System\JsCBWyv.exe
  C:\Windows\System\JsCBWyv.exe
  2⤵
  PID:10304
- C:\Windows\System\nnvucZs.exe
  C:\Windows\System\nnvucZs.exe
  2⤵
  PID:10332
- C:\Windows\System\dxKThsy.exe
  C:\Windows\System\dxKThsy.exe
  2⤵
  PID:10372
- C:\Windows\System\XGLAAJY.exe
  C:\Windows\System\XGLAAJY.exe
  2⤵
  PID:10388
- C:\Windows\System\lKRdOOT.exe
  C:\Windows\System\lKRdOOT.exe
  2⤵
  PID:10416
- C:\Windows\System\aCtRtnR.exe
  C:\Windows\System\aCtRtnR.exe
  2⤵
  PID:10444
- C:\Windows\System\OOrBCly.exe
  C:\Windows\System\OOrBCly.exe
  2⤵
  PID:10460
- C:\Windows\System\dzYHLAS.exe
  C:\Windows\System\dzYHLAS.exe
  2⤵
  PID:10480
- C:\Windows\System\ZPUaXCf.exe
  C:\Windows\System\ZPUaXCf.exe
  2⤵
  PID:10504
- C:\Windows\System\OwcAieK.exe
  C:\Windows\System\OwcAieK.exe
  2⤵
  PID:10528
- C:\Windows\System\hFwfkNJ.exe
  C:\Windows\System\hFwfkNJ.exe
  2⤵
  PID:10548
- C:\Windows\System\pvluoxM.exe
  C:\Windows\System\pvluoxM.exe
  2⤵
  PID:10572
- C:\Windows\System\oxOAASO.exe
  C:\Windows\System\oxOAASO.exe
  2⤵
  PID:10600
- C:\Windows\System\COnnrCD.exe
  C:\Windows\System\COnnrCD.exe
  2⤵
  PID:10644
- C:\Windows\System\SFeYplm.exe
  C:\Windows\System\SFeYplm.exe
  2⤵
  PID:10664
- C:\Windows\System\XXbvGHr.exe
  C:\Windows\System\XXbvGHr.exe
  2⤵
  PID:10688
- C:\Windows\System\cWQwyQT.exe
  C:\Windows\System\cWQwyQT.exe
  2⤵
  PID:10724
- C:\Windows\System\okxXdQy.exe
  C:\Windows\System\okxXdQy.exe
  2⤵
  PID:10748
- C:\Windows\System\zoANzhz.exe
  C:\Windows\System\zoANzhz.exe
  2⤵
  PID:10772
- C:\Windows\System\NWklYry.exe
  C:\Windows\System\NWklYry.exe
  2⤵
  PID:10804
- C:\Windows\System\wvrbHIq.exe
  C:\Windows\System\wvrbHIq.exe
  2⤵
  PID:10844
- C:\Windows\System\eZyVosU.exe
  C:\Windows\System\eZyVosU.exe
  2⤵
  PID:10880
- C:\Windows\System\bfNuhRF.exe
  C:\Windows\System\bfNuhRF.exe
  2⤵
  PID:10904
- C:\Windows\System\pJQgkhR.exe
  C:\Windows\System\pJQgkhR.exe
  2⤵
  PID:10936
- C:\Windows\System\nncXxNq.exe
  C:\Windows\System\nncXxNq.exe
  2⤵
  PID:10972
- C:\Windows\System\luPGAiB.exe
  C:\Windows\System\luPGAiB.exe
  2⤵
  PID:11004
- C:\Windows\System\YKfWuyy.exe
  C:\Windows\System\YKfWuyy.exe
  2⤵
  PID:11020
- C:\Windows\System\CQoWOOs.exe
  C:\Windows\System\CQoWOOs.exe
  2⤵
  PID:11036
- C:\Windows\System\afUHahr.exe
  C:\Windows\System\afUHahr.exe
  2⤵
  PID:11064
- C:\Windows\System\aEKqKvX.exe
  C:\Windows\System\aEKqKvX.exe
  2⤵
  PID:11100
- C:\Windows\System\JSqgkkJ.exe
  C:\Windows\System\JSqgkkJ.exe
  2⤵
  PID:11132
- C:\Windows\System\odXogwg.exe
  C:\Windows\System\odXogwg.exe
  2⤵
  PID:11148
- C:\Windows\System\NCcZHhh.exe
  C:\Windows\System\NCcZHhh.exe
  2⤵
  PID:11192
- C:\Windows\System\gjunAPa.exe
  C:\Windows\System\gjunAPa.exe
  2⤵
  PID:11212
- C:\Windows\System\qWOeIMl.exe
  C:\Windows\System\qWOeIMl.exe
  2⤵
  PID:11232
- C:\Windows\System\mgHtZWu.exe
  C:\Windows\System\mgHtZWu.exe
  2⤵
  PID:10000
- C:\Windows\System\QGGXXQe.exe
  C:\Windows\System\QGGXXQe.exe
  2⤵
  PID:10284
- C:\Windows\System\gEkrKEs.exe
  C:\Windows\System\gEkrKEs.exe
  2⤵
  PID:10584
- C:\Windows\System\lzNWqhX.exe
  C:\Windows\System\lzNWqhX.exe
  2⤵
  PID:10792
- C:\Windows\System\ZOoIvoa.exe
  C:\Windows\System\ZOoIvoa.exe
  2⤵
  PID:10872
- C:\Windows\System\UqXopll.exe
  C:\Windows\System\UqXopll.exe
  2⤵
  PID:10960
- C:\Windows\System\hmYmScz.exe
  C:\Windows\System\hmYmScz.exe
  2⤵
  PID:11012
- C:\Windows\System\NANabjl.exe
  C:\Windows\System\NANabjl.exe
  2⤵
  PID:11060
- C:\Windows\System\oxRiiZO.exe
  C:\Windows\System\oxRiiZO.exe
  2⤵
  PID:11092
- C:\Windows\System\MgCNXQd.exe
  C:\Windows\System\MgCNXQd.exe
  2⤵
  PID:11168
- C:\Windows\System\wSFQHiJ.exe
  C:\Windows\System\wSFQHiJ.exe
  2⤵
  PID:11180
- C:\Windows\System\UFwIgCq.exe
  C:\Windows\System\UFwIgCq.exe
  2⤵
  PID:10256
- C:\Windows\System\GtZlNbi.exe
  C:\Windows\System\GtZlNbi.exe
  2⤵
  PID:10380
- C:\Windows\System\UFkXmia.exe
  C:\Windows\System\UFkXmia.exe
  2⤵
  PID:10496
- C:\Windows\System\IKLsnOD.exe
  C:\Windows\System\IKLsnOD.exe
  2⤵
  PID:10536
- C:\Windows\System\mcMSAJe.exe
  C:\Windows\System\mcMSAJe.exe
  2⤵
  PID:10592
- C:\Windows\System\JbkXIeJ.exe
  C:\Windows\System\JbkXIeJ.exe
  2⤵
  PID:10652
- C:\Windows\System\uTsIohf.exe
  C:\Windows\System\uTsIohf.exe
  2⤵
  PID:10796
- C:\Windows\System\gzNonEA.exe
  C:\Windows\System\gzNonEA.exe
  2⤵
  PID:10840
- C:\Windows\System\uOCscaC.exe
  C:\Windows\System\uOCscaC.exe
  2⤵
  PID:10320
- C:\Windows\System\QbpBrpa.exe
  C:\Windows\System\QbpBrpa.exe
  2⤵
  PID:11032
- C:\Windows\System\eRGWOhR.exe
  C:\Windows\System\eRGWOhR.exe
  2⤵
  PID:11140
- C:\Windows\System\HPNSmea.exe
  C:\Windows\System\HPNSmea.exe
  2⤵
  PID:10456
- C:\Windows\System\egnhhhr.exe
  C:\Windows\System\egnhhhr.exe
  2⤵
  PID:10596
- C:\Windows\System\YJeLDIV.exe
  C:\Windows\System\YJeLDIV.exe
  2⤵
  PID:10828
- C:\Windows\System\csDPmGi.exe
  C:\Windows\System\csDPmGi.exe
  2⤵
  PID:9416
- C:\Windows\System\VzyutVo.exe
  C:\Windows\System\VzyutVo.exe
  2⤵
  PID:10996
- C:\Windows\System\HfAMQNC.exe
  C:\Windows\System\HfAMQNC.exe
  2⤵
  PID:11276
- C:\Windows\System\XBKrCbh.exe
  C:\Windows\System\XBKrCbh.exe
  2⤵
  PID:11304
- C:\Windows\System\yygozrW.exe
  C:\Windows\System\yygozrW.exe
  2⤵
  PID:11324
- C:\Windows\System\GOWMEgC.exe
  C:\Windows\System\GOWMEgC.exe
  2⤵
  PID:11352
- C:\Windows\System\eTXIpur.exe
  C:\Windows\System\eTXIpur.exe
  2⤵
  PID:11384
- C:\Windows\System\rRPaqSA.exe
  C:\Windows\System\rRPaqSA.exe
  2⤵
  PID:11400
- C:\Windows\System\KplbkFh.exe
  C:\Windows\System\KplbkFh.exe
  2⤵
  PID:11428
- C:\Windows\System\HFehmWA.exe
  C:\Windows\System\HFehmWA.exe
  2⤵
  PID:11476
- C:\Windows\System\nXDQmRT.exe
  C:\Windows\System\nXDQmRT.exe
  2⤵
  PID:11524
- C:\Windows\System\UYJZNmx.exe
  C:\Windows\System\UYJZNmx.exe
  2⤵
  PID:11540
- C:\Windows\System\oMJZCvK.exe
  C:\Windows\System\oMJZCvK.exe
  2⤵
  PID:11556
- C:\Windows\System\YREHhlm.exe
  C:\Windows\System\YREHhlm.exe
  2⤵
  PID:11584
- C:\Windows\System\AYfTafc.exe
  C:\Windows\System\AYfTafc.exe
  2⤵
  PID:11608
- C:\Windows\System\SXfuKSM.exe
  C:\Windows\System\SXfuKSM.exe
  2⤵
  PID:11644
- C:\Windows\System\BuNXdGy.exe
  C:\Windows\System\BuNXdGy.exe
  2⤵
  PID:11684
- C:\Windows\System\dLAkdpY.exe
  C:\Windows\System\dLAkdpY.exe
  2⤵
  PID:11712
- C:\Windows\System\amhXHuY.exe
  C:\Windows\System\amhXHuY.exe
  2⤵
  PID:11732
- C:\Windows\System\FDCvKmx.exe
  C:\Windows\System\FDCvKmx.exe
  2⤵
  PID:11764
- C:\Windows\System\XvmXoUk.exe
  C:\Windows\System\XvmXoUk.exe
  2⤵
  PID:11784
- C:\Windows\System\HBrfMBB.exe
  C:\Windows\System\HBrfMBB.exe
  2⤵
  PID:11816
- C:\Windows\System\yvOUsJr.exe
  C:\Windows\System\yvOUsJr.exe
  2⤵
  PID:11852
- C:\Windows\System\QgdQntt.exe
  C:\Windows\System\QgdQntt.exe
  2⤵
  PID:11880
- C:\Windows\System\ixabdgG.exe
  C:\Windows\System\ixabdgG.exe
  2⤵
  PID:11908
- C:\Windows\System\DmEpXmP.exe
  C:\Windows\System\DmEpXmP.exe
  2⤵
  PID:11940
- C:\Windows\System\ZaEvJnc.exe
  C:\Windows\System\ZaEvJnc.exe
  2⤵
  PID:11964
- C:\Windows\System\gdwHFrR.exe
  C:\Windows\System\gdwHFrR.exe
  2⤵
  PID:11992
- C:\Windows\System\RAuLVjx.exe
  C:\Windows\System\RAuLVjx.exe
  2⤵
  PID:12020
- C:\Windows\System\XzFrpei.exe
  C:\Windows\System\XzFrpei.exe
  2⤵
  PID:12048
- C:\Windows\System\lNSMPQs.exe
  C:\Windows\System\lNSMPQs.exe
  2⤵
  PID:12080
- C:\Windows\System\rEQvvwc.exe
  C:\Windows\System\rEQvvwc.exe
  2⤵
  PID:12112
- C:\Windows\System\NmIJUCF.exe
  C:\Windows\System\NmIJUCF.exe
  2⤵
  PID:12136
- C:\Windows\System\AattRYQ.exe
  C:\Windows\System\AattRYQ.exe
  2⤵
  PID:12164
- C:\Windows\System\lkLNJLn.exe
  C:\Windows\System\lkLNJLn.exe
  2⤵
  PID:12192
- C:\Windows\System\wtCdIAp.exe
  C:\Windows\System\wtCdIAp.exe
  2⤵
  PID:12224
- C:\Windows\System\oXAmTGs.exe
  C:\Windows\System\oXAmTGs.exe
  2⤵
  PID:12260
- C:\Windows\System\eEVloVV.exe
  C:\Windows\System\eEVloVV.exe
  2⤵
  PID:12280
- C:\Windows\System\VhCyrbu.exe
  C:\Windows\System\VhCyrbu.exe
  2⤵
  PID:10628
- C:\Windows\System\tYXzXKj.exe
  C:\Windows\System\tYXzXKj.exe
  2⤵
  PID:11220
- C:\Windows\System\lrHmTGO.exe
  C:\Windows\System\lrHmTGO.exe
  2⤵
  PID:11372
- C:\Windows\System\atWslnJ.exe
  C:\Windows\System\atWslnJ.exe
  2⤵
  PID:11424
- C:\Windows\System\udhBXXB.exe
  C:\Windows\System\udhBXXB.exe
  2⤵
  PID:11532
- C:\Windows\System\LcMqYzh.exe
  C:\Windows\System\LcMqYzh.exe
  2⤵
  PID:11508
- C:\Windows\System\GAIjghl.exe
  C:\Windows\System\GAIjghl.exe
  2⤵
  PID:11636
- C:\Windows\System\RByvrci.exe
  C:\Windows\System\RByvrci.exe
  2⤵
  PID:11628
- C:\Windows\System\Zlpnqsn.exe
  C:\Windows\System\Zlpnqsn.exe
  2⤵
  PID:11752
- C:\Windows\System\LwanXCV.exe
  C:\Windows\System\LwanXCV.exe
  2⤵
  PID:11836
- C:\Windows\System\IBoPQhU.exe
  C:\Windows\System\IBoPQhU.exe
  2⤵
  PID:11800
- C:\Windows\System\RzGXVzL.exe
  C:\Windows\System\RzGXVzL.exe
  2⤵
  PID:11900
- C:\Windows\System\SdmtVpL.exe
  C:\Windows\System\SdmtVpL.exe
  2⤵
  PID:12028
- C:\Windows\System\lcZWqdW.exe
  C:\Windows\System\lcZWqdW.exe
  2⤵
  PID:12008
- C:\Windows\System\lYRwXSC.exe
  C:\Windows\System\lYRwXSC.exe
  2⤵
  PID:12128
- C:\Windows\System\qwlojGn.exe
  C:\Windows\System\qwlojGn.exe
  2⤵
  PID:12212
- C:\Windows\System\sPlwcWW.exe
  C:\Windows\System\sPlwcWW.exe
  2⤵
  PID:11300
- C:\Windows\System\LDFKQSC.exe
  C:\Windows\System\LDFKQSC.exe
  2⤵
  PID:11292
- C:\Windows\System\UwtQbQR.exe
  C:\Windows\System\UwtQbQR.exe
  2⤵
  PID:11348
- C:\Windows\System\pawATVJ.exe
  C:\Windows\System\pawATVJ.exe
  2⤵
  PID:11620
- C:\Windows\System\AWpVsOe.exe
  C:\Windows\System\AWpVsOe.exe
  2⤵
  PID:11744
- C:\Windows\System\CcMqrUu.exe
  C:\Windows\System\CcMqrUu.exe
  2⤵
  PID:11876
- C:\Windows\System\rXYGmhR.exe
  C:\Windows\System\rXYGmhR.exe
  2⤵
  PID:11984
- C:\Windows\System\WrFhZid.exe
  C:\Windows\System\WrFhZid.exe
  2⤵
  PID:12232
- C:\Windows\System\gVXIfOS.exe
  C:\Windows\System\gVXIfOS.exe
  2⤵
  PID:12268
- C:\Windows\System\PtlLOuQ.exe
  C:\Windows\System\PtlLOuQ.exe
  2⤵
  PID:11396
- C:\Windows\System\qPKHENA.exe
  C:\Windows\System\qPKHENA.exe
  2⤵
  PID:11804
- C:\Windows\System\dCfAowZ.exe
  C:\Windows\System\dCfAowZ.exe
  2⤵
  PID:12096
- C:\Windows\System\lEseTBE.exe
  C:\Windows\System\lEseTBE.exe
  2⤵
  PID:12188
- C:\Windows\System\DnKyrPD.exe
  C:\Windows\System\DnKyrPD.exe
  2⤵
  PID:12300
- C:\Windows\System\WCDHGXH.exe
  C:\Windows\System\WCDHGXH.exe
  2⤵
  PID:12344
- C:\Windows\System\TENBlZO.exe
  C:\Windows\System\TENBlZO.exe
  2⤵
  PID:12364
- C:\Windows\System\EtfrcXQ.exe
  C:\Windows\System\EtfrcXQ.exe
  2⤵
  PID:12380
- C:\Windows\System\GSPoBAW.exe
  C:\Windows\System\GSPoBAW.exe
  2⤵
  PID:12412
- C:\Windows\System\gMTaVvI.exe
  C:\Windows\System\gMTaVvI.exe
  2⤵
  PID:12428
- C:\Windows\System\GslTijf.exe
  C:\Windows\System\GslTijf.exe
  2⤵
  PID:12444
- C:\Windows\System\crfNotW.exe
  C:\Windows\System\crfNotW.exe
  2⤵
  PID:12480
- C:\Windows\System\hKtlGrs.exe
  C:\Windows\System\hKtlGrs.exe
  2⤵
  PID:12508
- C:\Windows\System\anGYCxv.exe
  C:\Windows\System\anGYCxv.exe
  2⤵
  PID:12536
- C:\Windows\System\uooeAlk.exe
  C:\Windows\System\uooeAlk.exe
  2⤵
  PID:12556
- C:\Windows\System\RnwqCHg.exe
  C:\Windows\System\RnwqCHg.exe
  2⤵
  PID:12584
- C:\Windows\System\WNFhFXR.exe
  C:\Windows\System\WNFhFXR.exe
  2⤵
  PID:12628
- C:\Windows\System\AMbwCBZ.exe
  C:\Windows\System\AMbwCBZ.exe
  2⤵
  PID:12660
- C:\Windows\System\lhRuusK.exe
  C:\Windows\System\lhRuusK.exe
  2⤵
  PID:12688
- C:\Windows\System\JudSntA.exe
  C:\Windows\System\JudSntA.exe
  2⤵
  PID:12716
- C:\Windows\System\YoDppsD.exe
  C:\Windows\System\YoDppsD.exe
  2⤵
  PID:12744
- C:\Windows\System\BuYGvAM.exe
  C:\Windows\System\BuYGvAM.exe
  2⤵
  PID:12764
- C:\Windows\System\OAtbYUi.exe
  C:\Windows\System\OAtbYUi.exe
  2⤵
  PID:12788
- C:\Windows\System\jnSOMzL.exe
  C:\Windows\System\jnSOMzL.exe
  2⤵
  PID:12812
- C:\Windows\System\aNDrHHX.exe
  C:\Windows\System\aNDrHHX.exe
  2⤵
  PID:12844
- C:\Windows\System\VJwHWmf.exe
  C:\Windows\System\VJwHWmf.exe
  2⤵
  PID:12872
- C:\Windows\System\VfJZRaj.exe
  C:\Windows\System\VfJZRaj.exe
  2⤵
  PID:12900
- C:\Windows\System\aMzQilI.exe
  C:\Windows\System\aMzQilI.exe
  2⤵
  PID:12932
- C:\Windows\System\lquzQTh.exe
  C:\Windows\System\lquzQTh.exe
  2⤵
  PID:12968
- C:\Windows\System\CDMaCpe.exe
  C:\Windows\System\CDMaCpe.exe
  2⤵
  PID:12996
- C:\Windows\System\ELzkDnQ.exe
  C:\Windows\System\ELzkDnQ.exe
  2⤵
  PID:13020
- C:\Windows\System\fASwLcO.exe
  C:\Windows\System\fASwLcO.exe
  2⤵
  PID:13056
- C:\Windows\System\rncBUiy.exe
  C:\Windows\System\rncBUiy.exe
  2⤵
  PID:13072
- C:\Windows\System\OZuUWHj.exe
  C:\Windows\System\OZuUWHj.exe
  2⤵
  PID:13096
- C:\Windows\System\jxpNfsM.exe
  C:\Windows\System\jxpNfsM.exe
  2⤵
  PID:13220
- C:\Windows\System\YsRlXDQ.exe
  C:\Windows\System\YsRlXDQ.exe
  2⤵
  PID:13244
- C:\Windows\System\svfFSzB.exe
  C:\Windows\System\svfFSzB.exe
  2⤵
  PID:13264
- C:\Windows\System\JLEDxrk.exe
  C:\Windows\System\JLEDxrk.exe
  2⤵
  PID:13280
- C:\Windows\System\rzIyVrW.exe
  C:\Windows\System\rzIyVrW.exe
  2⤵
  PID:13304
- C:\Windows\System\GsBcGKb.exe
  C:\Windows\System\GsBcGKb.exe
  2⤵
  PID:11332
- C:\Windows\System\YTTxjGi.exe
  C:\Windows\System\YTTxjGi.exe
  2⤵
  PID:11796
- C:\Windows\System\UAGiSLb.exe
  C:\Windows\System\UAGiSLb.exe
  2⤵
  PID:12404
- C:\Windows\System\VmuabcX.exe
  C:\Windows\System\VmuabcX.exe
  2⤵
  PID:12440
- C:\Windows\System\HHZudpx.exe
  C:\Windows\System\HHZudpx.exe
  2⤵
  PID:12424
- C:\Windows\System\eybsRtM.exe
  C:\Windows\System\eybsRtM.exe
  2⤵
  PID:12616
- C:\Windows\System\MVxNwNX.exe
  C:\Windows\System\MVxNwNX.exe
  2⤵
  PID:12656
- C:\Windows\System\zrsoxoz.exe
  C:\Windows\System\zrsoxoz.exe
  2⤵
  PID:12712
- C:\Windows\System\LjznkPh.exe
  C:\Windows\System\LjznkPh.exe
  2⤵
  PID:12756
- C:\Windows\System\FROkUzJ.exe
  C:\Windows\System\FROkUzJ.exe
  2⤵
  PID:12732
- C:\Windows\System\hQpXNdo.exe
  C:\Windows\System\hQpXNdo.exe
  2⤵
  PID:12944
- C:\Windows\System\AJdYyfl.exe
  C:\Windows\System\AJdYyfl.exe
  2⤵
  PID:12980
- C:\Windows\System\iNzuAzz.exe
  C:\Windows\System\iNzuAzz.exe
  2⤵
  PID:13004
- C:\Windows\System\YroBiXm.exe
  C:\Windows\System\YroBiXm.exe
  2⤵
  PID:13112
- C:\Windows\System\pjRthud.exe
  C:\Windows\System\pjRthud.exe
  2⤵
  PID:1724
- C:\Windows\System\wBTALPC.exe
  C:\Windows\System\wBTALPC.exe
  2⤵
  PID:13188
- C:\Windows\System\jjQwPRu.exe
  C:\Windows\System\jjQwPRu.exe
  2⤵
  PID:13236
- C:\Windows\System\AhShcyB.exe
  C:\Windows\System\AhShcyB.exe
  2⤵
  PID:12316
- C:\Windows\System\gynNedk.exe
  C:\Windows\System\gynNedk.exe
  2⤵
  PID:12376
- C:\Windows\System\nOilDJz.exe
  C:\Windows\System\nOilDJz.exe
  2⤵
  PID:12516
- C:\Windows\System\oRQtCeP.exe
  C:\Windows\System\oRQtCeP.exe
  2⤵
  PID:12608
- C:\Windows\System\BltVSuC.exe
  C:\Windows\System\BltVSuC.exe
  2⤵
  PID:12908
- C:\Windows\System\ofWtMWb.exe
  C:\Windows\System\ofWtMWb.exe
  2⤵
  PID:12864
- C:\Windows\System\hGhUKHP.exe
  C:\Windows\System\hGhUKHP.exe
  2⤵
  PID:13092
- C:\Windows\System\WToJhem.exe
  C:\Windows\System\WToJhem.exe
  2⤵
  PID:11952
- C:\Windows\System\UGrlyYd.exe
  C:\Windows\System\UGrlyYd.exe
  2⤵
  PID:12580
- C:\Windows\System\hiXFKPL.exe
  C:\Windows\System\hiXFKPL.exe
  2⤵
  PID:12772
- C:\Windows\System\KdzcKhe.exe
  C:\Windows\System\KdzcKhe.exe
  2⤵
  PID:13032
- C:\Windows\System\NELhMxY.exe
  C:\Windows\System\NELhMxY.exe
  2⤵
  PID:13068
- C:\Windows\System\gjleTRZ.exe
  C:\Windows\System\gjleTRZ.exe
  2⤵
  PID:13348
- C:\Windows\System\KtZBmZm.exe
  C:\Windows\System\KtZBmZm.exe
  2⤵
  PID:13372
- C:\Windows\System\ohoGPpg.exe
  C:\Windows\System\ohoGPpg.exe
  2⤵
  PID:13400
- C:\Windows\System\UptTaDd.exe
  C:\Windows\System\UptTaDd.exe
  2⤵
  PID:13428
- C:\Windows\System\kyUSZDK.exe
  C:\Windows\System\kyUSZDK.exe
  2⤵
  PID:13448
- C:\Windows\System\sYcnCrn.exe
  C:\Windows\System\sYcnCrn.exe
  2⤵
  PID:13472
- C:\Windows\System\JwKimQb.exe
  C:\Windows\System\JwKimQb.exe
  2⤵
  PID:13496
- C:\Windows\System\ftfHXdD.exe
  C:\Windows\System\ftfHXdD.exe
  2⤵
  PID:13516
- C:\Windows\System\yYyzBuj.exe
  C:\Windows\System\yYyzBuj.exe
  2⤵
  PID:13552
- C:\Windows\System\zGfGfoC.exe
  C:\Windows\System\zGfGfoC.exe
  2⤵
  PID:13580
- C:\Windows\System\KlAIxNI.exe
  C:\Windows\System\KlAIxNI.exe
  2⤵
  PID:13608
- C:\Windows\System\LbXmeRo.exe
  C:\Windows\System\LbXmeRo.exe
  2⤵
  PID:13636
- C:\Windows\System\uxMMNAt.exe
  C:\Windows\System\uxMMNAt.exe
  2⤵
  PID:13660
- C:\Windows\System\nLifGyM.exe
  C:\Windows\System\nLifGyM.exe
  2⤵
  PID:13684
- C:\Windows\System\bDPiroQ.exe
  C:\Windows\System\bDPiroQ.exe
  2⤵
  PID:13708
- C:\Windows\System\AlRYQwu.exe
  C:\Windows\System\AlRYQwu.exe
  2⤵
  PID:13732
- C:\Windows\System\NSvZnhO.exe
  C:\Windows\System\NSvZnhO.exe
  2⤵
  PID:13764
- C:\Windows\System\bXLBgEm.exe
  C:\Windows\System\bXLBgEm.exe
  2⤵
  PID:13792
- C:\Windows\System\DGcLhbW.exe
  C:\Windows\System\DGcLhbW.exe
  2⤵
  PID:13812
- C:\Windows\System\dLBkaYT.exe
  C:\Windows\System\dLBkaYT.exe
  2⤵
  PID:13840
- C:\Windows\System\vFIVkWT.exe
  C:\Windows\System\vFIVkWT.exe
  2⤵
  PID:13876
- C:\Windows\System\uFfaWbw.exe
  C:\Windows\System\uFfaWbw.exe
  2⤵
  PID:13904
- C:\Windows\System\oFXoqlG.exe
  C:\Windows\System\oFXoqlG.exe
  2⤵
  PID:13932
- C:\Windows\System\TQuRAgL.exe
  C:\Windows\System\TQuRAgL.exe
  2⤵
  PID:13960
- C:\Windows\System\LvWNnqB.exe
  C:\Windows\System\LvWNnqB.exe
  2⤵
  PID:13984
- C:\Windows\System\qxGhgUM.exe
  C:\Windows\System\qxGhgUM.exe
  2⤵
  PID:14012
- C:\Windows\System\AlZZCYp.exe
  C:\Windows\System\AlZZCYp.exe
  2⤵
  PID:14040
- C:\Windows\System\aEtJuws.exe
  C:\Windows\System\aEtJuws.exe
  2⤵
  PID:14064
- C:\Windows\System\ywlVPpi.exe
  C:\Windows\System\ywlVPpi.exe
  2⤵
  PID:14100
- C:\Windows\System\oBedPOm.exe
  C:\Windows\System\oBedPOm.exe
  2⤵
  PID:14124
- C:\Windows\System\GYkgArR.exe
  C:\Windows\System\GYkgArR.exe
  2⤵
  PID:14148
- C:\Windows\System\OcThWPz.exe
  C:\Windows\System\OcThWPz.exe
  2⤵
  PID:14164
- C:\Windows\System\eIeWgox.exe
  C:\Windows\System\eIeWgox.exe
  2⤵
  PID:14192
- C:\Windows\System\OZZnzRq.exe
  C:\Windows\System\OZZnzRq.exe
  2⤵
  PID:14216
- C:\Windows\System\bhYiwvZ.exe
  C:\Windows\System\bhYiwvZ.exe
  2⤵
  PID:14244
- C:\Windows\System\sHOnjGk.exe
  C:\Windows\System\sHOnjGk.exe
  2⤵
  PID:14268
- C:\Windows\System\issCzHk.exe
  C:\Windows\System\issCzHk.exe
  2⤵
  PID:14288
- C:\Windows\System\YXzssjo.exe
  C:\Windows\System\YXzssjo.exe
  2⤵
  PID:14316
- C:\Windows\System\tghiTHM.exe
  C:\Windows\System\tghiTHM.exe
  2⤵
  PID:12728
- C:\Windows\System\CaNUZxj.exe
  C:\Windows\System\CaNUZxj.exe
  2⤵
  PID:13168
- C:\Windows\System\uovxolj.exe
  C:\Windows\System\uovxolj.exe
  2⤵
  PID:13332
- C:\Windows\System\xtyjSeM.exe
  C:\Windows\System\xtyjSeM.exe
  2⤵
  PID:13456
- C:\Windows\System\hYKwFEy.exe
  C:\Windows\System\hYKwFEy.exe
  2⤵
  PID:13528
- C:\Windows\System\dFPLBxP.exe
  C:\Windows\System\dFPLBxP.exe
  2⤵
  PID:13488
- C:\Windows\System\ONvETZs.exe
  C:\Windows\System\ONvETZs.exe
  2⤵
  PID:13624
- C:\Windows\System\zWEIUsv.exe
  C:\Windows\System\zWEIUsv.exe
  2⤵
  PID:13504
- C:\Windows\System\obWrehP.exe
  C:\Windows\System\obWrehP.exe
  2⤵
  PID:13756
- C:\Windows\System\yHFeXDM.exe
  C:\Windows\System\yHFeXDM.exe
  2⤵
  PID:13700
- C:\Windows\System\hnBhOLq.exe
  C:\Windows\System\hnBhOLq.exe
  2⤵
  PID:13808
- C:\Windows\System\jkpxobG.exe
  C:\Windows\System\jkpxobG.exe
  2⤵
  PID:13828
- C:\Windows\System\hUyEFQy.exe
  C:\Windows\System\hUyEFQy.exe
  2⤵
  PID:13832
- C:\Windows\System\rMpSaAq.exe
  C:\Windows\System\rMpSaAq.exe
  2⤵
  PID:13892
- C:\Windows\System\tOEzqsJ.exe
  C:\Windows\System\tOEzqsJ.exe
  2⤵
  PID:14052
- C:\Windows\System\msUxfCf.exe
  C:\Windows\System\msUxfCf.exe
  2⤵
  PID:14208
- C:\Windows\System\yeSBuzE.exe
  C:\Windows\System\yeSBuzE.exe
  2⤵
  PID:14180
- C:\Windows\System\EnXqtQP.exe
  C:\Windows\System\EnXqtQP.exe
  2⤵
  PID:12372
- C:\Windows\System\JGYuYSq.exe
  C:\Windows\System\JGYuYSq.exe
  2⤵
  PID:14308
- C:\Windows\System\HmsIyzv.exe
  C:\Windows\System\HmsIyzv.exe
  2⤵
  PID:12652
- C:\Windows\System\OjlOzpS.exe
  C:\Windows\System\OjlOzpS.exe
  2⤵
  PID:13416
- C:\Windows\System\yxEfylW.exe
  C:\Windows\System\yxEfylW.exe
  2⤵
  PID:13728
- C:\Windows\System\tXGADYs.exe
  C:\Windows\System\tXGADYs.exe
  2⤵
  PID:13860
- C:\Windows\System\iKnNKfN.exe
  C:\Windows\System\iKnNKfN.exe
  2⤵
  PID:13744
- C:\Windows\System\YwJtfRn.exe
  C:\Windows\System\YwJtfRn.exe
  2⤵
  PID:13440
- C:\Windows\System\xffbWRx.exe
  C:\Windows\System\xffbWRx.exe
  2⤵
  PID:14356
- C:\Windows\System\SzxciZc.exe
  C:\Windows\System\SzxciZc.exe
  2⤵
  PID:14372
- C:\Windows\System\AbXMbnA.exe
  C:\Windows\System\AbXMbnA.exe
  2⤵
  PID:14404
- C:\Windows\System\kEfjafs.exe
  C:\Windows\System\kEfjafs.exe
  2⤵
  PID:14424
- C:\Windows\System\QggyfJn.exe
  C:\Windows\System\QggyfJn.exe
  2⤵
  PID:14456
- C:\Windows\System\ZFQzeSU.exe
  C:\Windows\System\ZFQzeSU.exe
  2⤵
  PID:14488
- C:\Windows\System\ocOGlme.exe
  C:\Windows\System\ocOGlme.exe
  2⤵
  PID:14512
- C:\Windows\System\qMuucnf.exe
  C:\Windows\System\qMuucnf.exe
  2⤵
  PID:14544
- C:\Windows\System\aaPMvjO.exe
  C:\Windows\System\aaPMvjO.exe
  2⤵
  PID:14576
- C:\Windows\System\RPyKQgu.exe
  C:\Windows\System\RPyKQgu.exe
  2⤵
  PID:14608
- C:\Windows\System\sCUQxvY.exe
  C:\Windows\System\sCUQxvY.exe
  2⤵
  PID:14624
- C:\Windows\System\VZMvvye.exe
  C:\Windows\System\VZMvvye.exe
  2⤵
  PID:14660
- C:\Windows\System\icUrFug.exe
  C:\Windows\System\icUrFug.exe
  2⤵
  PID:14692
- C:\Windows\System\EpHyeuj.exe
  C:\Windows\System\EpHyeuj.exe
  2⤵
  PID:14720
- C:\Windows\System\YmgTumY.exe
  C:\Windows\System\YmgTumY.exe
  2⤵
  PID:14744
- C:\Windows\System\hSzgOge.exe
  C:\Windows\System\hSzgOge.exe
  2⤵
  PID:14776
- C:\Windows\System\liluyUP.exe
  C:\Windows\System\liluyUP.exe
  2⤵
  PID:14796
- C:\Windows\System\KQtmAog.exe
  C:\Windows\System\KQtmAog.exe
  2⤵
  PID:14816
- C:\Windows\System\HABfNlm.exe
  C:\Windows\System\HABfNlm.exe
  2⤵
  PID:14840
- C:\Windows\System\MvCmPST.exe
  C:\Windows\System\MvCmPST.exe
  2⤵
  PID:14884
- C:\Windows\System\bwlVIkT.exe
  C:\Windows\System\bwlVIkT.exe
  2⤵
  PID:14908
- C:\Windows\System\PDZnTyE.exe
  C:\Windows\System\PDZnTyE.exe
  2⤵
  PID:14928
- C:\Windows\System\jNVCxqF.exe
  C:\Windows\System\jNVCxqF.exe
  2⤵
  PID:14964
- C:\Windows\System\MssUiLe.exe
  C:\Windows\System\MssUiLe.exe
  2⤵
  PID:14988
- C:\Windows\System\afpVsgk.exe
  C:\Windows\System\afpVsgk.exe
  2⤵
  PID:15024
- C:\Windows\System\huZJkTq.exe
  C:\Windows\System\huZJkTq.exe
  2⤵
  PID:15048
- C:\Windows\System\htkgjzZ.exe
  C:\Windows\System\htkgjzZ.exe
  2⤵
  PID:15064
- C:\Windows\System\nWrFOGT.exe
  C:\Windows\System\nWrFOGT.exe
  2⤵
  PID:15092
- C:\Windows\System\yxGItlC.exe
  C:\Windows\System\yxGItlC.exe
  2⤵
  PID:15128
- C:\Windows\System\oEalmoo.exe
  C:\Windows\System\oEalmoo.exe
  2⤵
  PID:15148
- C:\Windows\System\TRFUfrx.exe
  C:\Windows\System\TRFUfrx.exe
  2⤵
  PID:15168
- C:\Windows\System\nclgZIO.exe
  C:\Windows\System\nclgZIO.exe
  2⤵
  PID:15192
- C:\Windows\System\HmRduoA.exe
  C:\Windows\System\HmRduoA.exe
  2⤵
  PID:15212
- C:\Windows\System\sDIQdQa.exe
  C:\Windows\System\sDIQdQa.exe
  2⤵
  PID:15244
- C:\Windows\System\zClbHfv.exe
  C:\Windows\System\zClbHfv.exe
  2⤵
  PID:15260
- C:\Windows\System\OJLjYqC.exe
  C:\Windows\System\OJLjYqC.exe
  2⤵
  PID:15288
- C:\Windows\System\ncBoAih.exe
  C:\Windows\System\ncBoAih.exe
  2⤵
  PID:15304
- C:\Windows\System\GEMjZNT.exe
  C:\Windows\System\GEMjZNT.exe
  2⤵
  PID:15328
- C:\Windows\System\FtPkdVl.exe
  C:\Windows\System\FtPkdVl.exe
  2⤵
  PID:15356
- C:\Windows\System\PzZnQWa.exe
  C:\Windows\System\PzZnQWa.exe
  2⤵
  PID:13436
- C:\Windows\System\UBhVSUX.exe
  C:\Windows\System\UBhVSUX.exe
  2⤵
  PID:14140
- C:\Windows\System\TXmrawi.exe
  C:\Windows\System\TXmrawi.exe
  2⤵
  PID:13776
- C:\Windows\System\MHnRwMW.exe
  C:\Windows\System\MHnRwMW.exe
  2⤵
  PID:14240
- C:\Windows\System\WIQQxlT.exe
  C:\Windows\System\WIQQxlT.exe
  2⤵
  PID:13980
- C:\Windows\System\ogCONNx.exe
  C:\Windows\System\ogCONNx.exe
  2⤵
  PID:14364
- C:\Windows\System\yEUNDQF.exe
  C:\Windows\System\yEUNDQF.exe
  2⤵
  PID:14468
- C:\Windows\System\TWgrvVb.exe
  C:\Windows\System\TWgrvVb.exe
  2⤵
  PID:14688
- C:\Windows\System\dqBopOR.exe
  C:\Windows\System\dqBopOR.exe
  2⤵
  PID:14600
- C:\Windows\System\trbJTzf.exe
  C:\Windows\System\trbJTzf.exe
  2⤵
  PID:14704
- C:\Windows\System\bsIPkJn.exe
  C:\Windows\System\bsIPkJn.exe
  2⤵
  PID:14792
- C:\Windows\System\VfqJogR.exe
  C:\Windows\System\VfqJogR.exe
  2⤵
  PID:14940
- C:\Windows\System\CCwLAiJ.exe
  C:\Windows\System\CCwLAiJ.exe
  2⤵
  PID:14976
- C:\Windows\System\RJoBjJT.exe
  C:\Windows\System\RJoBjJT.exe
  2⤵
  PID:15016
- C:\Windows\System\YqRdRKU.exe
  C:\Windows\System\YqRdRKU.exe
  2⤵
  PID:15124
- C:\Windows\System\MHvlkwe.exe
  C:\Windows\System\MHvlkwe.exe
  2⤵
  PID:15056
- C:\Windows\System\fXbuIoi.exe
  C:\Windows\System\fXbuIoi.exe
  2⤵
  PID:15208
- C:\Windows\System\IvKeFlx.exe
  C:\Windows\System\IvKeFlx.exe
  2⤵
  PID:15236
- C:\Windows\System\bFxhlBf.exe
  C:\Windows\System\bFxhlBf.exe
  2⤵
  PID:15300
- C:\Windows\System\eMHqiVx.exe
  C:\Windows\System\eMHqiVx.exe
  2⤵
  PID:13772
- C:\Windows\System\THhIyPc.exe
  C:\Windows\System\THhIyPc.exe
  2⤵
  PID:15296
- C:\Windows\System\GJaTDev.exe
  C:\Windows\System\GJaTDev.exe
  2⤵
  PID:15344
- C:\Windows\System\pCFKBbG.exe
  C:\Windows\System\pCFKBbG.exe
  2⤵
  PID:13648
- C:\Windows\System\fbQmiWI.exe
  C:\Windows\System\fbQmiWI.exe
  2⤵
  PID:4344
- C:\Windows\System\osNIbnk.exe
  C:\Windows\System\osNIbnk.exe
  2⤵
  PID:14880
- C:\Windows\System\ogjgoyN.exe
  C:\Windows\System\ogjgoyN.exe
  2⤵
  PID:14872
- C:\Windows\System\toHHptr.exe
  C:\Windows\System\toHHptr.exe
  2⤵
  PID:15372
- C:\Windows\System\OfSZKdj.exe
  C:\Windows\System\OfSZKdj.exe
  2⤵
  PID:15400
- C:\Windows\System\rtvTGZi.exe
  C:\Windows\System\rtvTGZi.exe
  2⤵
  PID:15416
- C:\Windows\System\CRyRzps.exe
  C:\Windows\System\CRyRzps.exe
  2⤵
  PID:15440
- C:\Windows\System\VGVAkmQ.exe
  C:\Windows\System\VGVAkmQ.exe
  2⤵
  PID:15468
- C:\Windows\System\tFWScfp.exe
  C:\Windows\System\tFWScfp.exe
  2⤵
  PID:15492
- C:\Windows\System\kdfMiwG.exe
  C:\Windows\System\kdfMiwG.exe
  2⤵
  PID:15520
- C:\Windows\System\gGblQBz.exe
  C:\Windows\System\gGblQBz.exe
  2⤵
  PID:15556
- C:\Windows\System\MeIPWMG.exe
  C:\Windows\System\MeIPWMG.exe
  2⤵
  PID:15584
- C:\Windows\System\jiiVATT.exe
  C:\Windows\System\jiiVATT.exe
  2⤵
  PID:15600
- C:\Windows\System\AMoQyLa.exe
  C:\Windows\System\AMoQyLa.exe
  2⤵
  PID:15616
- C:\Windows\System\yGIejuV.exe
  C:\Windows\System\yGIejuV.exe
  2⤵
  PID:15632
- C:\Windows\System\uOactpv.exe
  C:\Windows\System\uOactpv.exe
  2⤵
  PID:15660
- C:\Windows\System\GmEMgFA.exe
  C:\Windows\System\GmEMgFA.exe
  2⤵
  PID:15692
- C:\Windows\System\dBhnByU.exe
  C:\Windows\System\dBhnByU.exe
  2⤵
  PID:15716
- C:\Windows\System\iKdcFQl.exe
  C:\Windows\System\iKdcFQl.exe
  2⤵
  PID:15744
- C:\Windows\System\tLNNESb.exe
  C:\Windows\System\tLNNESb.exe
  2⤵
  PID:15764
- C:\Windows\System\DHUwsTw.exe
  C:\Windows\System\DHUwsTw.exe
  2⤵
  PID:15800
- C:\Windows\System\fqYZnvj.exe
  C:\Windows\System\fqYZnvj.exe
  2⤵
  PID:15832
- C:\Windows\System\nWTbNyQ.exe
  C:\Windows\System\nWTbNyQ.exe
  2⤵
  PID:15852
- C:\Windows\System\ukvFuGs.exe
  C:\Windows\System\ukvFuGs.exe
  2⤵
  PID:15888
- C:\Windows\System\Wepjwgu.exe
  C:\Windows\System\Wepjwgu.exe
  2⤵
  PID:15904
- C:\Windows\System\VjvWCTe.exe
  C:\Windows\System\VjvWCTe.exe
  2⤵
  PID:15920
- C:\Windows\System\lsZMosr.exe
  C:\Windows\System\lsZMosr.exe
  2⤵
  PID:15952
- C:\Windows\System\ZgxGNre.exe
  C:\Windows\System\ZgxGNre.exe
  2⤵
  PID:15984
- C:\Windows\System\LsXuEEp.exe
  C:\Windows\System\LsXuEEp.exe
  2⤵
  PID:16016
- C:\Windows\System\aBRQnkg.exe
  C:\Windows\System\aBRQnkg.exe
  2⤵
  PID:16040
- C:\Windows\System\LzhJLGQ.exe
  C:\Windows\System\LzhJLGQ.exe
  2⤵
  PID:16064
- C:\Windows\System\mWTFXkN.exe
  C:\Windows\System\mWTFXkN.exe
  2⤵
  PID:16088
- C:\Windows\System\LOJYqvD.exe
  C:\Windows\System\LOJYqvD.exe
  2⤵
  PID:16108
- C:\Windows\System\FZIuYgv.exe
  C:\Windows\System\FZIuYgv.exe
  2⤵
  PID:16132
- C:\Windows\System\DePkoRL.exe
  C:\Windows\System\DePkoRL.exe
  2⤵
  PID:16168
- C:\Windows\System\cKfgVzy.exe
  C:\Windows\System\cKfgVzy.exe
  2⤵
  PID:16196
- C:\Windows\System\ymeuYet.exe
  C:\Windows\System\ymeuYet.exe
  2⤵
  PID:16228
- C:\Windows\System\BsbjgnR.exe
  C:\Windows\System\BsbjgnR.exe
  2⤵
  PID:16248
- C:\Windows\System\PsSioYP.exe
  C:\Windows\System\PsSioYP.exe
  2⤵
  PID:16276
- C:\Windows\System\urtocfU.exe
  C:\Windows\System\urtocfU.exe
  2⤵
  PID:16292
- C:\Windows\System\vVAhlCm.exe
  C:\Windows\System\vVAhlCm.exe
  2⤵
  PID:16324
- C:\Windows\System\xeXijuw.exe
  C:\Windows\System\xeXijuw.exe
  2⤵
  PID:16348
- C:\Windows\System\iyxtHte.exe
  C:\Windows\System\iyxtHte.exe
  2⤵
  PID:16376
- C:\Windows\System\BzfeAWW.exe
  C:\Windows\System\BzfeAWW.exe
  2⤵
  PID:14432
- C:\Windows\System\rLEeMKH.exe
  C:\Windows\System\rLEeMKH.exe
  2⤵
  PID:14060
- C:\Windows\System\qmvcbTr.exe
  C:\Windows\System\qmvcbTr.exe
  2⤵
  PID:14344
- C:\Windows\System\tEKexEL.exe
  C:\Windows\System\tEKexEL.exe
  2⤵
  PID:15340
- C:\Windows\System\tZZcQjA.exe
  C:\Windows\System\tZZcQjA.exe
  2⤵
  PID:14772
- C:\Windows\System\HyDndtX.exe
  C:\Windows\System\HyDndtX.exe
  2⤵
  PID:15512
- C:\Windows\System\AarWPpT.exe
  C:\Windows\System\AarWPpT.exe
  2⤵
  PID:15532
- C:\Windows\System\jWRJVYp.exe
  C:\Windows\System\jWRJVYp.exe
  2⤵
  PID:15476
- C:\Windows\System\uRVvODY.exe
  C:\Windows\System\uRVvODY.exe
  2⤵
  PID:15540
- C:\Windows\System\jeLwVGK.exe
  C:\Windows\System\jeLwVGK.exe
  2⤵
  PID:15760
- C:\Windows\System\lnjqMti.exe
  C:\Windows\System\lnjqMti.exe
  2⤵
  PID:15504
- C:\Windows\System\XzueYlb.exe
  C:\Windows\System\XzueYlb.exe
  2⤵
  PID:16000
- C:\Windows\System\jQPvVcl.exe
  C:\Windows\System\jQPvVcl.exe
  2⤵
  PID:15816
- C:\Windows\System\LfgcIuB.exe
  C:\Windows\System\LfgcIuB.exe
  2⤵
  PID:15872
- C:\Windows\System\lIvotkQ.exe
  C:\Windows\System\lIvotkQ.exe
  2⤵
  PID:16192
- C:\Windows\System\iapZCIl.exe
  C:\Windows\System\iapZCIl.exe
  2⤵
  PID:16012
- C:\Windows\System\ZYxhtuf.exe
  C:\Windows\System\ZYxhtuf.exe
  2⤵
  PID:16332
- C:\Windows\System\HdlIHjF.exe
  C:\Windows\System\HdlIHjF.exe
  2⤵
  PID:16148
- C:\Windows\System\DWueuGI.exe
  C:\Windows\System\DWueuGI.exe
  2⤵
  PID:14172
- C:\Windows\System\UMSYGxf.exe
  C:\Windows\System\UMSYGxf.exe
  2⤵
  PID:15156
- C:\Windows\System\vsgQpsl.exe
  C:\Windows\System\vsgQpsl.exe
  2⤵
  PID:12780
- C:\Windows\System\CkIZoAr.exe
  C:\Windows\System\CkIZoAr.exe
  2⤵
  PID:16344
- C:\Windows\System\AtLAKkd.exe
  C:\Windows\System\AtLAKkd.exe
  2⤵
  PID:16404
- C:\Windows\System\dovlsMb.exe
  C:\Windows\System\dovlsMb.exe
  2⤵
  PID:16436
- C:\Windows\System\NRcIWvp.exe
  C:\Windows\System\NRcIWvp.exe
  2⤵
  PID:16460
- C:\Windows\System\bKhftRZ.exe
  C:\Windows\System\bKhftRZ.exe
  2⤵
  PID:16476
- C:\Windows\System\Reuuvsf.exe
  C:\Windows\System\Reuuvsf.exe
  2⤵
  PID:16496
- C:\Windows\System\oKqnOZu.exe
  C:\Windows\System\oKqnOZu.exe
  2⤵
  PID:16536
- C:\Windows\System\NeNwvTv.exe
  C:\Windows\System\NeNwvTv.exe
  2⤵
  PID:16556
- C:\Windows\System\snBYeIQ.exe
  C:\Windows\System\snBYeIQ.exe
  2⤵
  PID:16588
- C:\Windows\System\LbqQXIu.exe
  C:\Windows\System\LbqQXIu.exe
  2⤵
  PID:16604
- C:\Windows\System\pUcpjgn.exe
  C:\Windows\System\pUcpjgn.exe
  2⤵
  PID:16640
- C:\Windows\System\JOsZkLZ.exe
  C:\Windows\System\JOsZkLZ.exe
  2⤵
  PID:16664
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16664 -s 248
    3⤵
    PID:16732
- C:\Windows\System\CEnGgcd.exe
  C:\Windows\System\CEnGgcd.exe
  2⤵
  PID:16696
- C:\Windows\System\upIGCJJ.exe
  C:\Windows\System\upIGCJJ.exe
  2⤵
  PID:16724
- C:\Windows\System\jEZfIYd.exe
  C:\Windows\System\jEZfIYd.exe
  2⤵
  PID:16748
- C:\Windows\System\aPhSlBF.exe
  C:\Windows\System\aPhSlBF.exe
  2⤵
  PID:16780
- C:\Windows\System\ZyeABaQ.exe
  C:\Windows\System\ZyeABaQ.exe
  2⤵
  PID:16800
- C:\Windows\System\mZWcDbu.exe
  C:\Windows\System\mZWcDbu.exe
  2⤵
  PID:16832
- C:\Windows\System\FsZddxS.exe
  C:\Windows\System\FsZddxS.exe
  2⤵
  PID:16856
- C:\Windows\System\kiDtXbe.exe
  C:\Windows\System\kiDtXbe.exe
  2⤵
  PID:16888
- C:\Windows\System\FMzSrxg.exe
  C:\Windows\System\FMzSrxg.exe
  2⤵
  PID:16908
- C:\Windows\System\aEzszwB.exe
  C:\Windows\System\aEzszwB.exe
  2⤵
  PID:16924
- C:\Windows\System\IMQrGHw.exe
  C:\Windows\System\IMQrGHw.exe
  2⤵
  PID:16944
- C:\Windows\System\AAteDDG.exe
  C:\Windows\System\AAteDDG.exe
  2⤵
  PID:16968
- C:\Windows\System\SQTfKhv.exe
  C:\Windows\System\SQTfKhv.exe
  2⤵
  PID:16992
- C:\Windows\System\XvotYui.exe
  C:\Windows\System\XvotYui.exe
  2⤵
  PID:17008
- C:\Windows\System\HcQEGxQ.exe
  C:\Windows\System\HcQEGxQ.exe
  2⤵
  PID:17044
- C:\Windows\System\ygIFdma.exe
  C:\Windows\System\ygIFdma.exe
  2⤵
  PID:17076
- C:\Windows\System\AiNAFsy.exe
  C:\Windows\System\AiNAFsy.exe
  2⤵
  PID:17096
- C:\Windows\System\bfrYqYP.exe
  C:\Windows\System\bfrYqYP.exe
  2⤵
  PID:17120
- C:\Windows\System\iVCHIBj.exe
  C:\Windows\System\iVCHIBj.exe
  2⤵
  PID:17152
- C:\Windows\System\CcsFhxL.exe
  C:\Windows\System\CcsFhxL.exe
  2⤵
  PID:17172
- C:\Windows\System\kcQSYmm.exe
  C:\Windows\System\kcQSYmm.exe
  2⤵
  PID:17200
- C:\Windows\System\gCNprit.exe
  C:\Windows\System\gCNprit.exe
  2⤵
  PID:17220
- C:\Windows\System\vtFbKXk.exe
  C:\Windows\System\vtFbKXk.exe
  2⤵
  PID:17244
- C:\Windows\System\VVxCgIj.exe
  C:\Windows\System\VVxCgIj.exe
  2⤵
  PID:17268
- C:\Windows\System\gATeaFa.exe
  C:\Windows\System\gATeaFa.exe
  2⤵
  PID:17288
- C:\Windows\System\KQdvHLS.exe
  C:\Windows\System\KQdvHLS.exe
  2⤵
  PID:16456
- C:\Windows\System\wFKPAVT.exe
  C:\Windows\System\wFKPAVT.exe
  2⤵
  PID:16636
- C:\Windows\System\OlFMqlT.exe
  C:\Windows\System\OlFMqlT.exe
  2⤵
  PID:16600
- C:\Windows\System\pjRuFkG.exe
  C:\Windows\System\pjRuFkG.exe
  2⤵
  PID:16772
- C:\Windows\System\VUdCrez.exe
  C:\Windows\System\VUdCrez.exe
  2⤵
  PID:16544
- C:\Windows\System\HYNnoDt.exe
  C:\Windows\System\HYNnoDt.exe
  2⤵
  PID:17368
- C:\Windows\System\cfwMcmB.exe
  C:\Windows\System\cfwMcmB.exe
  2⤵
  PID:17276
- C:\Windows\System\YQgdMdS.exe
  C:\Windows\System\YQgdMdS.exe
  2⤵
  PID:17320

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16828

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:16600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DcqvNzL.exe

Filesize
1.8MB

MD5
e559d42ca18aee560efb97b1efc184f3

SHA1
88f5308c55c5fbd7797f4abf2367e4f435740d32

SHA256
99d076c55b34565963b50776353784a1c4ee7ef61dd76d03a3df49aef8995a19

SHA512
d9b61a67911d4a19f121ee1e6c64cef3816c108200d507376df7da4288076f2c8457c7ff3b6f23bc7509da19c12ac343b8cb36f4ebdf507a5129c8e68c1e8974

Download Submit
C:\Windows\System\EKxIIBL.exe

Filesize
1.8MB

MD5
f444ad5b0a94e24074225c9ea04ae8fa

SHA1
b4704101fd4d95dafc044d6210a5581d85475550

SHA256
a803791f5b8b86cca206b78bb243441a52aac7d80f41fa0d6cdad7c555bf3c9a

SHA512
428c08d086d736cc55bf607dd7c8dc9e53419d2cb0106560f6ab4b9bbd618f51d34a36d592c7f84720bcd8bb1cb146b4f903ad60570f2b15178375b0ab8167b9

Download Submit
C:\Windows\System\EtkWamJ.exe

Filesize
1.8MB

MD5
0fce04756c13bc206e85effca38f6f56

SHA1
4a56bf537fc24e7f1ade9b382b78ad6c27360aec

SHA256
8fd44327bae3ba20cc3359a95b5b2df23c3caac44a84541a3f757369583fa14a

SHA512
d53fdd989abb4719e91c8688b7861db0ecf1406bdb2914cca93c90c10a05c12003667fd79e26f50e6138ed836834b84336cfd9245831be71d763433080133785

Download Submit
C:\Windows\System\EzGdQxT.exe

Filesize
1.8MB

MD5
91f71e81e37318e1f1f7dc694d5cd136

SHA1
38db7dff6303bc08ab720ae1b103747e07c22aa4

SHA256
aeb9c64d225b771a46a3eee8ec7bdee6364202e779066742648b58979d086f85

SHA512
4ee4046d83122d13c95547d5f8ffb6e745bbffcbe9317fb419e6566d678e4aa2697defe564159fc8d2c1f7346ad7596c246214fab069931551f3a62bf8fa4de7

Download Submit
C:\Windows\System\IFJKghI.exe

Filesize
1.8MB

MD5
3f7bbdf26552913b2986299416449e5e

SHA1
ad173618fe419551cd00d1c8f2ad134e3a1c93ed

SHA256
85a453afb4245ac9bdbd04800c170bc441022285928979ba855b576f9e87fefa

SHA512
ae8c79b8e260cc71dfa8aed83a089652f76e132220e00c1d901e335b2da6f626668260c0d2ed435c4914f2c2c3aa6842d1e6e94e8ad2b38e167089b1fdce2d68

Download Submit
C:\Windows\System\IIUzKDQ.exe

Filesize
1.8MB

MD5
a56893862f67a5a2a51481df2ef4995a

SHA1
54016ce345b7cdc6c7a4c212ce516f49d54bb605

SHA256
94ac3f100a5a2c8b85c4842768f4f6dcb649187bf238b71de25a2815283ea7f2

SHA512
c7328837a6f54ede79d45ddc09ba597b5990a976f74eed94afc126c0c386b8625231b49602488caaa57ed6b783f7de838dc20552405ea3e42dabf0da05dd2537

Download Submit
C:\Windows\System\KeadhGA.exe

Filesize
1.8MB

MD5
d32363c10b000b88f295ad77316fea71

SHA1
9aa0fdccf657cd46cc9a390167525f8a2c2e2414

SHA256
86eb78b59c37ad5ad23c00f595a1fbba998330030e85f35204320a743ecbea08

SHA512
3cc771ad0f07da02c932674c9f01a220d169030f59162914ff5df6ea144df41e155a3fce633d3a3a680d7b15048a4d19c9491facf6254319333ce141e707de4a

Download Submit
C:\Windows\System\NyTEzvi.exe

Filesize
1.8MB

MD5
ccdf9627e8a54f4638b5ab8a959bec2f

SHA1
a61bc51a25b225f1ad355fb78dce2610698a89d2

SHA256
789851b111ab946fde666b43cf02080088e40de125cf964015ac22a1196c4557

SHA512
366214ce206db3ac74472982a127b72a2b6a0e6fcfd1ec4a91684459e13e5938137c9c677661c8e6d422ad3d08b1200fd83311bf72b5eef700f89805f226bcc6

Download Submit
C:\Windows\System\OQKKxKk.exe

Filesize
1.8MB

MD5
cb3d1f5f1ac62ff29029333954e5aaab

SHA1
a4b9b9aeffb605110547926d47aead35b988922e

SHA256
68a33345f944e32876afbeb12c01fc1b250da4413f6086d5dd16ea5cb888a5c5

SHA512
13d21c22ce297bf02c119712b1df0ef0185d8805dbe1dd55921599b32cd9d23a19e3d8c38c48a8ff1cc0426befaaa4e1c03864894ee8cecd8c0c7d695c9c4dca

Download Submit
C:\Windows\System\PgRLMFs.exe

Filesize
1.8MB

MD5
757d43fcbfa759b624135cf16954d5fd

SHA1
74c4203e2935240bbfe9967493a2b145aa4bed23

SHA256
7847d293573ab398d3c74769c82e9f1d46f34794db6cf37001f624bb9096c3d7

SHA512
b8c95b43978c1c6d0fde560f4e509445088ded7fcbdf17f62e61dc5c97d96473899e52c7482a406ba730a1756d120e3df80dde41d3419db143a07b8714f214ca

Download Submit
C:\Windows\System\PqfHyrD.exe

Filesize
1.8MB

MD5
50df3d5ef5988d4ec2ee984b37287fe8

SHA1
d4b3d5c0eb45f80f4e1da4fc7c3f7950ec597a08

SHA256
70ba614f3a14cbf5ae73b35338cf4005dd7116c86fe841d57f003d32e5efc092

SHA512
df0e5b8daa6fb5e595aa9d3ec56a070f51a07633e4e5dbe954684d1438823b0854d05277a73633095745254fc3dccaa305c84d7b1cf01c04388052962cfe8197

Download Submit
C:\Windows\System\TPCgLpO.exe

Filesize
1.8MB

MD5
9789db82a3a616f6206357dc1c269472

SHA1
9331a30e327d25d24ec2cd61ae1ba8ce12ed4457

SHA256
0911f9a8717d8891c6ab336a20fb92e77ee4227a5854c7c95617418e5893ba1b

SHA512
ba455d2f882819ca65a736cb6d584ccd94bb883f9abca18a0658724e11bb36d0235aa68682860cb4008aa27c14834ad51b40b4f54db78bedf18d204333a43658

Download Submit
C:\Windows\System\UBMElId.exe

Filesize
1.8MB

MD5
64b5959f0deefc82123afaaec8f4e20e

SHA1
50077fa517dcec41878435222f2c21cb41970e65

SHA256
db2393cdac0ce182f5d32826d62823ba7a78208d6b981268adf3b63c750f5792

SHA512
6c06a677e94357c324145d0935a8b44ae5933aeabd89833470eebc7b0b082e8f552df1d609241c15c622dbbc3f28e339879e0265c3a8ce0c4633603df2e0e098

Download Submit
C:\Windows\System\UFFxFdU.exe

Filesize
1.8MB

MD5
839ae5c9ea30fd01f919578bb66ed219

SHA1
20fa44b4cf3089aec208da8c6813f2a1bd19abf2

SHA256
80b5da261e4564cecf64d82d49fd6934f0e35a8995e25c5f68f4bb91813373c7

SHA512
40f8cf98267f811cbdcd556e296cc44c0a0cc74ecc9f4595f515a09da94481069f09b5f5e929eeec73b682c41fdf9a5521d777336945d98364e61ccf74375f85

Download Submit
C:\Windows\System\URsOGQu.exe

Filesize
1.8MB

MD5
28bce8a502b971cb463a94b774c21bb4

SHA1
095b73f047620e33dacd90daf9e33a28c4fb0f95

SHA256
45680fec1780c5138dce6f8328b82ceaf17e1274f0bf58f9df1a85520546447a

SHA512
fc2b2259f8bf16ac5f0b237c3e7a88e7750eee2ad0f8452c688a48ac5a5b91226907a5289a6e381a45385f3305cc0f27bc3bfed34c03d3c07d0e8260ad0a39fa

Download Submit
C:\Windows\System\WAgaBoP.exe

Filesize
1.8MB

MD5
d66e5f7728792bf4b4df877b8879ee84

SHA1
4497453d3c9d703128ff2d4caf0e6a018cf710cb

SHA256
af9e56b333588151d73a14e76fa64705274f25bb5ce58ee12740e7e70e1af99c

SHA512
133b8152962815059b428ec99bdcb1e945a20279d45553933d9892927d33172a582e98735b5a21ea4da5176e636a0c2dc5cc54ede06b2de56483aaf11b84da76

Download Submit
C:\Windows\System\XpihYPL.exe

Filesize
1.8MB

MD5
d45fc111ff2aca0e0efd1b9967f1f6ed

SHA1
70ce8ad42a88364a30ee8ee129c2b296fe02f8ed

SHA256
0fd6edd517396b4b6fc8cb1a389ae30afc1b8568aaef6b4885909656e877ba4d

SHA512
fdb75a2e8028a08bb667de694e833460b68c03b646434d1372dae17f59b9495befd263874c10064d3be011818d96c178e3273a261449bb5139d8f308e1c1e836

Download Submit
C:\Windows\System\aawlzuM.exe

Filesize
1.8MB

MD5
53c5261a70168c92c558bd5f2df6dd44

SHA1
9f0891470551ab9771d70d20400a6a493d6097fa

SHA256
6dd32713a686b3cd6a5147e35722391d38b455e819f9a35d07d9c167666abb39

SHA512
9ef7aad2c635a06daf7450a750bacd0cc54450a5d1f6444946a0a3ffaa47fd313dbde4262f7e0d1ff1875df96ecd226dac8491b5985adbc5765dbf8b7f0e7f86

Download Submit
C:\Windows\System\aycwDtK.exe

Filesize
1.8MB

MD5
60f7326a33bb005c790d407c46a745b2

SHA1
c0957d054a626f6db5c92fe6ebff87aa4c3e2ad8

SHA256
4c8a316fd9bdc70b7d032066ad3dba3aa78006628c93221d1069a29ee723479e

SHA512
4204b5a20a196c22e9dcf3b9a123d605aad9f7d0913846e004ca715b955d02b64ba192426cf0a013fa6966e8f49b78a0f557d952870eaa079c22a21f6114278e

Download Submit
C:\Windows\System\dKsynnZ.exe

Filesize
1.8MB

MD5
174db522495c74574e8f803120e96376

SHA1
afbd9c4a9cf0b8ea4f5d42658e5a2bb83c04a010

SHA256
16150cfa09b07b923e4a07cba0be49a424f5e35c00ba143c02bdc38d5f4f409c

SHA512
b3a80eda31ab579c4af98e29bd20897d2cf48b4a9d276b58a2d19ba74648275e08cb3261d7a8b554ea1866561a08c05f7ffa4f60e860e2210081d83a268f90b7

Download Submit
C:\Windows\System\dtrHOUv.exe

Filesize
1.8MB

MD5
396e1385c7f5e72d8de9d0a5de7b0f83

SHA1
353de5c817b95c28eee30ea9daeae1608ada85ac

SHA256
7848015b32a7cc5fe7619af63bddfe5a477915a3b98db40e7e7ffa870ca0f011

SHA512
d22ab855f4c4af1ab7c00d463b7be5f271b348f0f31ab43a6e7f41b3a8db2e5b90c99180109f234ba45d62bbc388d1fc25d3a794184a9d41992a5a7f7e997e74

Download Submit
C:\Windows\System\fcqjcVJ.exe

Filesize
1.8MB

MD5
bee10bf549929c0c70f0c32c72d04940

SHA1
66eb208b6109f7c73cac43c3166841b118486f05

SHA256
336c559273107f56418e8c0f2c7357ba961629b9dd9dda55e8e180628cf657a6

SHA512
bddf72df9103b56a9e5dd7a71f3708e496f0b3000fda212a4cc34e1708c11f619ce1a4f96f6107985b9a4067dd4ec9acd5ce6cebb4cc24ff9f120e23d0b135d0

Download Submit
C:\Windows\System\ghKPyLv.exe

Filesize
1.8MB

MD5
92dbc5a26a5500217b5af18d08052a42

SHA1
30d83b7f37139d2df418b07701af2c9dea3f33b7

SHA256
9e733293c4d71a883cfe91beb411eba79efa53aefc21954f88452a217ca75b9e

SHA512
eb4d337092e35d8d02fc5fffdd8d37accd11ef69a2f00953e334e84a0fee0ba3920eb6e733097cd297477a54be6297d7d2dd53ec862ad722d2cd3a4d0e7a4cd3

Download Submit
C:\Windows\System\gwNFoDD.exe

Filesize
1.8MB

MD5
fa5ffc61cc32cb871c3a09f282f111e2

SHA1
1a2aa5727166e8a8f28ba3eaede0c0d6fbb791c9

SHA256
d9f721d38b0c83413e96621f3a49d5bfdddcd9ce10da7ec6e774de5dfa3e8477

SHA512
cf91b819a4d0b34a1b58138e36fb08d041a1a96715a678e5163c624befe616812ca963c51c285d51d46ee0950520f5fcbb2dc5dc6ddc3f4221f5ea298c3b630d

Download Submit
C:\Windows\System\iyVZhix.exe

Filesize
1.8MB

MD5
7684a54d87015aa4f706d3b46c1c3800

SHA1
76c545fb860ea552d20d8d8d584444d7fe731a20

SHA256
d08ccce7991a3d21800d56edc1e07588f9b4f0fbcd3c6a718e409406b7fef8c1

SHA512
e2589683c998d2f900871935f7a6a88573a8fcbb54b2973e307f5a39f4ca6190770987fd7fdd5d47cb3db29fc6a694a5e1648fbe9f3f8dff508c8381a50cb92f

Download Submit
C:\Windows\System\kcjKWeg.exe

Filesize
1.8MB

MD5
2699bf72c9a2d7c3d455dba5ee938cfe

SHA1
edf98d00f38020b6d5e710059f6fc797e1f4b655

SHA256
44bcc344f2783386461d817813f28c5b3d87cf0a59030799ada679dedd3de0ef

SHA512
db2c51a46ea9c99dd99e6ee3c78e5015f519cead3f0af05b82651c3fc21f43730f703c9b58195160b9cd8952ba6932da1254c99f7306c1f0da508cdf13ddd0ce

Download Submit
C:\Windows\System\nPQSXmS.exe

Filesize
1.8MB

MD5
00d2fafadeb5ea29b0f6a350b8ab02ab

SHA1
50cb17fa23443a9bea4bbd3c35bdbba3b255c5d7

SHA256
bc3ba2dd4e94aecfe627e393885544ee73e4c44871681c6b4032b04a0423cd95

SHA512
dad66cf9bb4c2c647a0f07cd1d3349649f65e1a1edc4cfeae4cb827dac9218512e7be594c7d2cd98b732012e760d21496475bde528cc39dac84de6c9901388e9

Download Submit
C:\Windows\System\oKPHRNx.exe

Filesize
1.8MB

MD5
8041e95518952fbccbde0c445ab9d046

SHA1
cba41e4337cd1ee51fd5f1c43b8d4edf816b3d44

SHA256
fd9fd8de1969736319b23a40f24247931a61ab75f989b71f0f99b34795ffa9ce

SHA512
ae58e9a18b844aec45411951263d8e8e73faaf9d53b559f61cbd35e5abcc76bc749f2d40f2f3372f53be64e3b0e60110b6b468af1b6c4303ff25d2a915c3b1ba

Download Submit
C:\Windows\System\pFVbivK.exe

Filesize
1.8MB

MD5
5a0a3dffb66e87068d26ef543389ce44

SHA1
4bc5ae6d53dc1c7c0fdc778127d6e02675c7bdb9

SHA256
b5fb38321d9ababad37e6731d4694bec2891622fcf33b407f4df2703fe8472ec

SHA512
08d8b9093a123a2424b843aa0d8f3ff025a64e10df9d8b4c7ee5eb9f349af5079e012222c2510ebd2d30939436d25f50d179263d381e4cf2b3433373c6b70724

Download Submit
C:\Windows\System\rdmXRMl.exe

Filesize
1.8MB

MD5
27ce5165556b3d22b630c7b7d979d486

SHA1
2d67f2f763a9630f90524af9522d3946cca10548

SHA256
eef4e138c85a1ca9faba9acc8d2a013adf7ed0a2537b7522877ba29a7dbab6a5

SHA512
1adf7c98dae96394a9eaf8e9e36cb08fc39eabd3b6c4e9c60f39d3227be79a8fe0c828c9a387792cc74d610bb81d54cfa07c40c349105478a9f1f8fa65082135

Download Submit
C:\Windows\System\rvpQZxV.exe

Filesize
1.8MB

MD5
37ae1f063ce3b63b40d0d17a7231a5d9

SHA1
9f5b553ece646a1dc5078320d82d0710ae6c9afc

SHA256
c9babd9b82110b0951fe97ad5d816b315bdd6a42f9e2953e0ac2761afdbcf6e5

SHA512
848baf5e85b1e269870418b976ff13915ab51598cd3c25613e2662e710e1d9deaaee8a71db15961c638d87f35bd7f16e5a0ac70d282b59b3ab71d37db28c9020

Download Submit
C:\Windows\System\xEenoUC.exe

Filesize
1.8MB

MD5
22477b0f0f9c0ae7459face4b583be22

SHA1
87b5f569f33ffc2d417e5a1f3ac106f8e3d894e1

SHA256
5f5a7874c0d61006387519870c24626cb4bb2067a0bed3168808fc7d0d4e072c

SHA512
22e7eae735d03b2e0ad03f580276c627b4c50a85439395cc62f941a9f8147df6bbf69b590d1ae0467a261de783af8300219d31a94d5793ee54020dc3eb28b351

Download Submit
C:\Windows\System\xNmAxkz.exe

Filesize
1.8MB

MD5
60f862acb628b8a500b2406b8a47c950

SHA1
1fedeb6c626a2723ec08d9713e9fbdbb23076f4d

SHA256
0d00373ff9d97fef4333e0445de703c72ce5afad57deda48425bcb369f4c1bb8

SHA512
16646cf6d397f8334f4786a59d32b90c46999dec4bba9af0e7118c860b864416699d8565b7028131c7512791b06bbaf25167f21d6ca16d58ba159edb165c6d20

Download Submit
memory/2016-0-0x00000242BA510000-0x00000242BA520000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads