xmrig | 6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f

Analysis

max time kernel
117s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
Size

1.5MB
MD5

126bf655e1b1ed455b38e330e815e809
SHA1

340ae23cbb08934939cb1e109e164ef191de2b47
SHA256

6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f
SHA512

a364a5b00b469af0a3cf73d3fa890d20f523473f70c45b14c78972e82dcf1caeb045e1fd61f01c9d2c92739ec8f49a0b3fcde893d2de5b5459736e1e571c0a06
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcr:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c59

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

Processes:

resource	yara_rule
behavioral2/files/0x000c000000023b8c-4.dat	xmrig
behavioral2/files/0x0007000000023c84-6.dat	xmrig
behavioral2/files/0x0008000000023c7f-14.dat	xmrig
behavioral2/files/0x0007000000023c87-30.dat	xmrig
behavioral2/files/0x0007000000023c89-40.dat	xmrig
behavioral2/files/0x0007000000023c88-38.dat	xmrig
behavioral2/files/0x0007000000023c86-27.dat	xmrig
behavioral2/files/0x0007000000023c85-20.dat	xmrig
behavioral2/files/0x0007000000023c8a-44.dat	xmrig
behavioral2/files/0x0008000000023c80-48.dat	xmrig
behavioral2/files/0x0007000000023c8c-56.dat	xmrig
behavioral2/files/0x0007000000023c8d-64.dat	xmrig
behavioral2/files/0x0007000000023c8b-58.dat	xmrig
behavioral2/files/0x0007000000023c8e-70.dat	xmrig
behavioral2/files/0x0007000000023c90-74.dat	xmrig
behavioral2/files/0x0007000000023c91-78.dat	xmrig
behavioral2/files/0x0007000000023c92-84.dat	xmrig
behavioral2/files/0x0007000000023c93-89.dat	xmrig
behavioral2/files/0x0007000000023c94-95.dat	xmrig
behavioral2/files/0x0007000000023c96-104.dat	xmrig
behavioral2/files/0x0007000000023c95-100.dat	xmrig
behavioral2/files/0x0007000000023c97-109.dat	xmrig
behavioral2/files/0x0007000000023c98-112.dat	xmrig
behavioral2/files/0x0007000000023c99-120.dat	xmrig
behavioral2/files/0x0007000000023c9a-124.dat	xmrig
behavioral2/files/0x0007000000023c9b-130.dat	xmrig
behavioral2/files/0x0007000000023c9c-134.dat	xmrig
behavioral2/files/0x0002000000022dc9-139.dat	xmrig
behavioral2/files/0x0010000000023b3f-147.dat	xmrig
behavioral2/files/0x0002000000022dcd-148.dat	xmrig
behavioral2/files/0x000d000000023b41-154.dat	xmrig
behavioral2/files/0x0007000000023c9d-160.dat	xmrig

Executes dropped EXE 64 IoCs

Processes:

VQNJjzy.exeBigtjMX.exeSPoBNmS.exelpYXvsw.exePtuezKb.exeANNpNqG.exeNPOmBle.exeoVKRqlo.exemhYLjWp.exequmcpyG.exeIoCrFzy.exeFFiPEDi.exeVATRThA.exeXxdcxhM.exeyZpDEWW.exeTWRjBea.exeljVPnYT.exetVJLsmZ.exeESlcGEy.exeDPwdZKI.exeZIKnren.exeQzPVmoT.exemaIxkku.exeFrDGkie.exeSkxJavw.exehGgmmPW.exekMaTbCk.exejgenHBJ.exepEgTdzM.exevCnZOTJ.exetXnXEwX.exeYgIwlYF.exeHZbyecJ.exewIiLEHQ.exeWsypBky.exeoZWcoMH.exeOwpuPuo.exeFjLMblT.exeMWfafZJ.exeqmffxiY.exeXOZgMlb.exeuTDOVET.exedfSQcQk.exehuiGsXu.exeiYWpKYy.exeHDfSJGC.exeZbmcVrC.exeldaJlrP.exeHDefVBC.exemXyrhiR.exekwDkbND.exexWBsVRt.exeafefbRI.exeRYIvqDT.exeslOFaJS.exelrcmokR.exenuyAqhK.exeJaRUjuE.exeulGkcLW.exeRUKoygo.exeYQKdgHd.exeqXPLsxc.exetjQkQui.exeXDTpEZP.exe

pid	Process
3980	VQNJjzy.exe
384	BigtjMX.exe
4824	SPoBNmS.exe
1096	lpYXvsw.exe
4088	PtuezKb.exe
2964	ANNpNqG.exe
1948	NPOmBle.exe
3764	oVKRqlo.exe
2480	mhYLjWp.exe
4176	qumcpyG.exe
3208	IoCrFzy.exe
4848	FFiPEDi.exe
2200	VATRThA.exe
2228	XxdcxhM.exe
216	yZpDEWW.exe
920	TWRjBea.exe
872	ljVPnYT.exe
3404	tVJLsmZ.exe
4012	ESlcGEy.exe
3760	DPwdZKI.exe
2924	ZIKnren.exe
1632	QzPVmoT.exe
4164	maIxkku.exe
4064	FrDGkie.exe
3360	SkxJavw.exe
4948	hGgmmPW.exe
676	kMaTbCk.exe
2720	jgenHBJ.exe
3536	pEgTdzM.exe
3092	vCnZOTJ.exe
4428	tXnXEwX.exe
4168	YgIwlYF.exe
3336	HZbyecJ.exe
4960	wIiLEHQ.exe
1044	WsypBky.exe
860	oZWcoMH.exe
3596	OwpuPuo.exe
4956	FjLMblT.exe
3924	MWfafZJ.exe
4560	qmffxiY.exe
456	XOZgMlb.exe
3292	uTDOVET.exe
2700	dfSQcQk.exe
3228	huiGsXu.exe
1224	iYWpKYy.exe
2832	HDfSJGC.exe
4732	ZbmcVrC.exe
4856	ldaJlrP.exe
5108	HDefVBC.exe
3900	mXyrhiR.exe
3560	kwDkbND.exe
2008	xWBsVRt.exe
2688	afefbRI.exe
2632	RYIvqDT.exe
3504	slOFaJS.exe
1880	lrcmokR.exe
1100	nuyAqhK.exe
832	JaRUjuE.exe
540	ulGkcLW.exe
3408	RUKoygo.exe
3028	YQKdgHd.exe
404	qXPLsxc.exe
4280	tjQkQui.exe
4572	XDTpEZP.exe

Drops file in Windows directory 64 IoCs

Processes:

6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe

description	ioc	Process
File created	C:\Windows\System\sjzanfY.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\yckrVUh.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\VPvMCaY.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\INYJSIT.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\ojhBOXz.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\yZbQOVx.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\gqDrBuM.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\GQvVfXb.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\RKOYNkb.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\IjPqAqr.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\OlOUcEg.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\GalycQK.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\aYmJoWp.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\qumcpyG.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\RUKoygo.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\ieslsqU.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\yFaXODI.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\iyVXBZI.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\IJWKOuR.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\hJjiCAF.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\aRMHXLM.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\kUJvfXN.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\KWDytXd.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\LJZdPhh.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\WZWnOnI.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\WccHETS.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\HUgLGxP.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\eaBVDMF.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\Aildacw.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\LICGqWE.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\LpInUFS.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\jSpBcDX.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\iaSPepK.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\oEdOWVx.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\hNFcADY.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\kyYsTgY.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\CddYwvk.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\WrtyQeM.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\jvlmcPI.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\khQmyUe.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\wpgyHNk.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\mXyrhiR.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\ZsgDGjI.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\GAlYHcG.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\oXaBeEM.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\Pihnlvh.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\UYaVjpy.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\ckrCKzE.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\WATmRGO.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\lkLrEMR.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\ByxhtPc.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\vnrTsxL.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\OQnfMyf.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\XOZgMlb.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\muMjYOb.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\ZhoxbPz.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\EjBkMFN.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\qdIyECE.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\vMMWmOb.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\foWUtDb.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\SgJxGLK.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\NdkYrAQ.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\UKFMfhb.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
File created	C:\Windows\System\DKvrHLa.exe	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dwm.exe

description	pid	Process
Token: SeCreateGlobalPrivilege	3636	dwm.exe
Token: SeChangeNotifyPrivilege	3636	dwm.exe
Token: 33	3636	dwm.exe
Token: SeIncBasePriorityPrivilege	3636	dwm.exe
Token: SeShutdownPrivilege	3636	dwm.exe
Token: SeCreatePagefilePrivilege	3636	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe

description	pid	Process	procid_target
PID 868 wrote to memory of 3980	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	84
PID 868 wrote to memory of 3980	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	84
PID 868 wrote to memory of 384	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	85
PID 868 wrote to memory of 384	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	85
PID 868 wrote to memory of 4824	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	86
PID 868 wrote to memory of 4824	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	86
PID 868 wrote to memory of 1096	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	87
PID 868 wrote to memory of 1096	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	87
PID 868 wrote to memory of 4088	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	88
PID 868 wrote to memory of 4088	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	88
PID 868 wrote to memory of 2964	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	89
PID 868 wrote to memory of 2964	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	89
PID 868 wrote to memory of 1948	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	90
PID 868 wrote to memory of 1948	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	90
PID 868 wrote to memory of 3764	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	91
PID 868 wrote to memory of 3764	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	91
PID 868 wrote to memory of 2480	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	92
PID 868 wrote to memory of 2480	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	92
PID 868 wrote to memory of 4176	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	93
PID 868 wrote to memory of 4176	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	93
PID 868 wrote to memory of 4848	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	94
PID 868 wrote to memory of 4848	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	94
PID 868 wrote to memory of 3208	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	95
PID 868 wrote to memory of 3208	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	95
PID 868 wrote to memory of 2200	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	96
PID 868 wrote to memory of 2200	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	96
PID 868 wrote to memory of 2228	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	97
PID 868 wrote to memory of 2228	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	97
PID 868 wrote to memory of 216	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	99
PID 868 wrote to memory of 216	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	99
PID 868 wrote to memory of 920	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	101
PID 868 wrote to memory of 920	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	101
PID 868 wrote to memory of 872	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	102
PID 868 wrote to memory of 872	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	102
PID 868 wrote to memory of 3404	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	103
PID 868 wrote to memory of 3404	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	103
PID 868 wrote to memory of 4012	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	104
PID 868 wrote to memory of 4012	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	104
PID 868 wrote to memory of 3760	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	106
PID 868 wrote to memory of 3760	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	106
PID 868 wrote to memory of 2924	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	107
PID 868 wrote to memory of 2924	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	107
PID 868 wrote to memory of 1632	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	108
PID 868 wrote to memory of 1632	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	108
PID 868 wrote to memory of 4164	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	109
PID 868 wrote to memory of 4164	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	109
PID 868 wrote to memory of 4064	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	110
PID 868 wrote to memory of 4064	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	110
PID 868 wrote to memory of 3360	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	111
PID 868 wrote to memory of 3360	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	111
PID 868 wrote to memory of 4948	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	112
PID 868 wrote to memory of 4948	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	112
PID 868 wrote to memory of 676	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	113
PID 868 wrote to memory of 676	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	113
PID 868 wrote to memory of 2720	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	114
PID 868 wrote to memory of 2720	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	114
PID 868 wrote to memory of 3536	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	115
PID 868 wrote to memory of 3536	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	115
PID 868 wrote to memory of 3092	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	116
PID 868 wrote to memory of 3092	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	116
PID 868 wrote to memory of 4428	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	117
PID 868 wrote to memory of 4428	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	117
PID 868 wrote to memory of 4168	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	118
PID 868 wrote to memory of 4168	868	6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe	118

C:\Users\Admin\AppData\Local\Temp\6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe
"C:\Users\Admin\AppData\Local\Temp\6db8d01bb8c3e9aa8402b23ec4bf787cf649b068c2d676deeeabdd1651ccf69f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\System\VQNJjzy.exe
  C:\Windows\System\VQNJjzy.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\BigtjMX.exe
  C:\Windows\System\BigtjMX.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\SPoBNmS.exe
  C:\Windows\System\SPoBNmS.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\lpYXvsw.exe
  C:\Windows\System\lpYXvsw.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\PtuezKb.exe
  C:\Windows\System\PtuezKb.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\ANNpNqG.exe
  C:\Windows\System\ANNpNqG.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\NPOmBle.exe
  C:\Windows\System\NPOmBle.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\oVKRqlo.exe
  C:\Windows\System\oVKRqlo.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\mhYLjWp.exe
  C:\Windows\System\mhYLjWp.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\qumcpyG.exe
  C:\Windows\System\qumcpyG.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\FFiPEDi.exe
  C:\Windows\System\FFiPEDi.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\IoCrFzy.exe
  C:\Windows\System\IoCrFzy.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\VATRThA.exe
  C:\Windows\System\VATRThA.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\XxdcxhM.exe
  C:\Windows\System\XxdcxhM.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\yZpDEWW.exe
  C:\Windows\System\yZpDEWW.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\TWRjBea.exe
  C:\Windows\System\TWRjBea.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\ljVPnYT.exe
  C:\Windows\System\ljVPnYT.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\tVJLsmZ.exe
  C:\Windows\System\tVJLsmZ.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\ESlcGEy.exe
  C:\Windows\System\ESlcGEy.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\DPwdZKI.exe
  C:\Windows\System\DPwdZKI.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\ZIKnren.exe
  C:\Windows\System\ZIKnren.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\QzPVmoT.exe
  C:\Windows\System\QzPVmoT.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\maIxkku.exe
  C:\Windows\System\maIxkku.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\FrDGkie.exe
  C:\Windows\System\FrDGkie.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\SkxJavw.exe
  C:\Windows\System\SkxJavw.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\hGgmmPW.exe
  C:\Windows\System\hGgmmPW.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\kMaTbCk.exe
  C:\Windows\System\kMaTbCk.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\jgenHBJ.exe
  C:\Windows\System\jgenHBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\pEgTdzM.exe
  C:\Windows\System\pEgTdzM.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\vCnZOTJ.exe
  C:\Windows\System\vCnZOTJ.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\tXnXEwX.exe
  C:\Windows\System\tXnXEwX.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\YgIwlYF.exe
  C:\Windows\System\YgIwlYF.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\HZbyecJ.exe
  C:\Windows\System\HZbyecJ.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\wIiLEHQ.exe
  C:\Windows\System\wIiLEHQ.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\WsypBky.exe
  C:\Windows\System\WsypBky.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\OwpuPuo.exe
  C:\Windows\System\OwpuPuo.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\oZWcoMH.exe
  C:\Windows\System\oZWcoMH.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\FjLMblT.exe
  C:\Windows\System\FjLMblT.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\MWfafZJ.exe
  C:\Windows\System\MWfafZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\qmffxiY.exe
  C:\Windows\System\qmffxiY.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\XOZgMlb.exe
  C:\Windows\System\XOZgMlb.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\uTDOVET.exe
  C:\Windows\System\uTDOVET.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\dfSQcQk.exe
  C:\Windows\System\dfSQcQk.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\huiGsXu.exe
  C:\Windows\System\huiGsXu.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\iYWpKYy.exe
  C:\Windows\System\iYWpKYy.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\HDfSJGC.exe
  C:\Windows\System\HDfSJGC.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ZbmcVrC.exe
  C:\Windows\System\ZbmcVrC.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\ldaJlrP.exe
  C:\Windows\System\ldaJlrP.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\HDefVBC.exe
  C:\Windows\System\HDefVBC.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\mXyrhiR.exe
  C:\Windows\System\mXyrhiR.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\kwDkbND.exe
  C:\Windows\System\kwDkbND.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\xWBsVRt.exe
  C:\Windows\System\xWBsVRt.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\afefbRI.exe
  C:\Windows\System\afefbRI.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\RYIvqDT.exe
  C:\Windows\System\RYIvqDT.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\slOFaJS.exe
  C:\Windows\System\slOFaJS.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\lrcmokR.exe
  C:\Windows\System\lrcmokR.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\nuyAqhK.exe
  C:\Windows\System\nuyAqhK.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\JaRUjuE.exe
  C:\Windows\System\JaRUjuE.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\ulGkcLW.exe
  C:\Windows\System\ulGkcLW.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\RUKoygo.exe
  C:\Windows\System\RUKoygo.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\YQKdgHd.exe
  C:\Windows\System\YQKdgHd.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\qXPLsxc.exe
  C:\Windows\System\qXPLsxc.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\tjQkQui.exe
  C:\Windows\System\tjQkQui.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\XDTpEZP.exe
  C:\Windows\System\XDTpEZP.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\XhYykqg.exe
  C:\Windows\System\XhYykqg.exe
  2⤵
  PID:4528
- C:\Windows\System\qAcHTVA.exe
  C:\Windows\System\qAcHTVA.exe
  2⤵
  PID:1228
- C:\Windows\System\YenMLOG.exe
  C:\Windows\System\YenMLOG.exe
  2⤵
  PID:1352
- C:\Windows\System\xCuUlCc.exe
  C:\Windows\System\xCuUlCc.exe
  2⤵
  PID:4448
- C:\Windows\System\GogSjIi.exe
  C:\Windows\System\GogSjIi.exe
  2⤵
  PID:3004
- C:\Windows\System\HUgLGxP.exe
  C:\Windows\System\HUgLGxP.exe
  2⤵
  PID:3716
- C:\Windows\System\DEZgNya.exe
  C:\Windows\System\DEZgNya.exe
  2⤵
  PID:4132
- C:\Windows\System\IJnVIhh.exe
  C:\Windows\System\IJnVIhh.exe
  2⤵
  PID:4680
- C:\Windows\System\ikiVsDH.exe
  C:\Windows\System\ikiVsDH.exe
  2⤵
  PID:5100
- C:\Windows\System\rTtyLUS.exe
  C:\Windows\System\rTtyLUS.exe
  2⤵
  PID:2420
- C:\Windows\System\ByxhtPc.exe
  C:\Windows\System\ByxhtPc.exe
  2⤵
  PID:3932
- C:\Windows\System\XrskZrv.exe
  C:\Windows\System\XrskZrv.exe
  2⤵
  PID:1080
- C:\Windows\System\xFwTDOD.exe
  C:\Windows\System\xFwTDOD.exe
  2⤵
  PID:2092
- C:\Windows\System\bpmhBiz.exe
  C:\Windows\System\bpmhBiz.exe
  2⤵
  PID:5052
- C:\Windows\System\QWJHrLz.exe
  C:\Windows\System\QWJHrLz.exe
  2⤵
  PID:5084
- C:\Windows\System\zHITZAt.exe
  C:\Windows\System\zHITZAt.exe
  2⤵
  PID:4116
- C:\Windows\System\VYENvtT.exe
  C:\Windows\System\VYENvtT.exe
  2⤵
  PID:2840
- C:\Windows\System\AdeMPQb.exe
  C:\Windows\System\AdeMPQb.exe
  2⤵
  PID:3100
- C:\Windows\System\HFDohQq.exe
  C:\Windows\System\HFDohQq.exe
  2⤵
  PID:3456
- C:\Windows\System\HWUcpAo.exe
  C:\Windows\System\HWUcpAo.exe
  2⤵
  PID:1456
- C:\Windows\System\OMjZiZC.exe
  C:\Windows\System\OMjZiZC.exe
  2⤵
  PID:2868
- C:\Windows\System\VaLujGo.exe
  C:\Windows\System\VaLujGo.exe
  2⤵
  PID:4864
- C:\Windows\System\hkUVYFz.exe
  C:\Windows\System\hkUVYFz.exe
  2⤵
  PID:1656
- C:\Windows\System\odMAmPY.exe
  C:\Windows\System\odMAmPY.exe
  2⤵
  PID:5064
- C:\Windows\System\JPUVrcv.exe
  C:\Windows\System\JPUVrcv.exe
  2⤵
  PID:2488
- C:\Windows\System\SGNbRLI.exe
  C:\Windows\System\SGNbRLI.exe
  2⤵
  PID:3464
- C:\Windows\System\ExDlFVw.exe
  C:\Windows\System\ExDlFVw.exe
  2⤵
  PID:1056
- C:\Windows\System\yfJxHNQ.exe
  C:\Windows\System\yfJxHNQ.exe
  2⤵
  PID:2256
- C:\Windows\System\EjBkMFN.exe
  C:\Windows\System\EjBkMFN.exe
  2⤵
  PID:4708
- C:\Windows\System\mTZynzN.exe
  C:\Windows\System\mTZynzN.exe
  2⤵
  PID:1920
- C:\Windows\System\fzgweVh.exe
  C:\Windows\System\fzgweVh.exe
  2⤵
  PID:1320
- C:\Windows\System\Webydyx.exe
  C:\Windows\System\Webydyx.exe
  2⤵
  PID:4424
- C:\Windows\System\UQgSjWv.exe
  C:\Windows\System\UQgSjWv.exe
  2⤵
  PID:5128
- C:\Windows\System\ptFlAMR.exe
  C:\Windows\System\ptFlAMR.exe
  2⤵
  PID:5152
- C:\Windows\System\wZQUzNr.exe
  C:\Windows\System\wZQUzNr.exe
  2⤵
  PID:5172
- C:\Windows\System\lDhiZnU.exe
  C:\Windows\System\lDhiZnU.exe
  2⤵
  PID:5188
- C:\Windows\System\WpsKYAg.exe
  C:\Windows\System\WpsKYAg.exe
  2⤵
  PID:5212
- C:\Windows\System\jNYYMLr.exe
  C:\Windows\System\jNYYMLr.exe
  2⤵
  PID:5244
- C:\Windows\System\wISABbt.exe
  C:\Windows\System\wISABbt.exe
  2⤵
  PID:5320
- C:\Windows\System\qdIyECE.exe
  C:\Windows\System\qdIyECE.exe
  2⤵
  PID:5340
- C:\Windows\System\ndXenEu.exe
  C:\Windows\System\ndXenEu.exe
  2⤵
  PID:5364
- C:\Windows\System\OtHAeEJ.exe
  C:\Windows\System\OtHAeEJ.exe
  2⤵
  PID:5396
- C:\Windows\System\DlbLQOX.exe
  C:\Windows\System\DlbLQOX.exe
  2⤵
  PID:5436
- C:\Windows\System\NdkYrAQ.exe
  C:\Windows\System\NdkYrAQ.exe
  2⤵
  PID:5476
- C:\Windows\System\mEVrrZx.exe
  C:\Windows\System\mEVrrZx.exe
  2⤵
  PID:5492
- C:\Windows\System\BzcnRYp.exe
  C:\Windows\System\BzcnRYp.exe
  2⤵
  PID:5516
- C:\Windows\System\DCMnwHO.exe
  C:\Windows\System\DCMnwHO.exe
  2⤵
  PID:5544
- C:\Windows\System\LTTfpXd.exe
  C:\Windows\System\LTTfpXd.exe
  2⤵
  PID:5568
- C:\Windows\System\eebABJY.exe
  C:\Windows\System\eebABJY.exe
  2⤵
  PID:5616
- C:\Windows\System\GnyshJv.exe
  C:\Windows\System\GnyshJv.exe
  2⤵
  PID:5636
- C:\Windows\System\PCHvntT.exe
  C:\Windows\System\PCHvntT.exe
  2⤵
  PID:5664
- C:\Windows\System\IjPqAqr.exe
  C:\Windows\System\IjPqAqr.exe
  2⤵
  PID:5688
- C:\Windows\System\OUYnKVt.exe
  C:\Windows\System\OUYnKVt.exe
  2⤵
  PID:5720
- C:\Windows\System\RKuXPID.exe
  C:\Windows\System\RKuXPID.exe
  2⤵
  PID:5748
- C:\Windows\System\MLutcTw.exe
  C:\Windows\System\MLutcTw.exe
  2⤵
  PID:5776
- C:\Windows\System\tBQILmz.exe
  C:\Windows\System\tBQILmz.exe
  2⤵
  PID:5792
- C:\Windows\System\XahIpfq.exe
  C:\Windows\System\XahIpfq.exe
  2⤵
  PID:5816
- C:\Windows\System\svLflYo.exe
  C:\Windows\System\svLflYo.exe
  2⤵
  PID:5844
- C:\Windows\System\szsAlfr.exe
  C:\Windows\System\szsAlfr.exe
  2⤵
  PID:5872
- C:\Windows\System\xPhKwUU.exe
  C:\Windows\System\xPhKwUU.exe
  2⤵
  PID:5900
- C:\Windows\System\ICKCBFq.exe
  C:\Windows\System\ICKCBFq.exe
  2⤵
  PID:5956
- C:\Windows\System\ncsBvKF.exe
  C:\Windows\System\ncsBvKF.exe
  2⤵
  PID:5972
- C:\Windows\System\iaSPepK.exe
  C:\Windows\System\iaSPepK.exe
  2⤵
  PID:6004
- C:\Windows\System\viPQrJl.exe
  C:\Windows\System\viPQrJl.exe
  2⤵
  PID:6028
- C:\Windows\System\KWDytXd.exe
  C:\Windows\System\KWDytXd.exe
  2⤵
  PID:6044
- C:\Windows\System\PzWFFvZ.exe
  C:\Windows\System\PzWFFvZ.exe
  2⤵
  PID:6068
- C:\Windows\System\bagKHzn.exe
  C:\Windows\System\bagKHzn.exe
  2⤵
  PID:6100
- C:\Windows\System\vnrTsxL.exe
  C:\Windows\System\vnrTsxL.exe
  2⤵
  PID:6132
- C:\Windows\System\CininfS.exe
  C:\Windows\System\CininfS.exe
  2⤵
  PID:5144
- C:\Windows\System\VwDFliC.exe
  C:\Windows\System\VwDFliC.exe
  2⤵
  PID:5168
- C:\Windows\System\odEPSZo.exe
  C:\Windows\System\odEPSZo.exe
  2⤵
  PID:5268
- C:\Windows\System\YsWUxWi.exe
  C:\Windows\System\YsWUxWi.exe
  2⤵
  PID:5332
- C:\Windows\System\rbAoNLC.exe
  C:\Windows\System\rbAoNLC.exe
  2⤵
  PID:5408
- C:\Windows\System\gVqOsmG.exe
  C:\Windows\System\gVqOsmG.exe
  2⤵
  PID:5488
- C:\Windows\System\CFfeNYF.exe
  C:\Windows\System\CFfeNYF.exe
  2⤵
  PID:5560
- C:\Windows\System\EBOqlJC.exe
  C:\Windows\System\EBOqlJC.exe
  2⤵
  PID:5648
- C:\Windows\System\OUSESAH.exe
  C:\Windows\System\OUSESAH.exe
  2⤵
  PID:5680
- C:\Windows\System\FtKCbNM.exe
  C:\Windows\System\FtKCbNM.exe
  2⤵
  PID:5700
- C:\Windows\System\mHEISTG.exe
  C:\Windows\System\mHEISTG.exe
  2⤵
  PID:5840
- C:\Windows\System\vmqaheB.exe
  C:\Windows\System\vmqaheB.exe
  2⤵
  PID:5856
- C:\Windows\System\fVfsLYH.exe
  C:\Windows\System\fVfsLYH.exe
  2⤵
  PID:5944
- C:\Windows\System\tzkwoHl.exe
  C:\Windows\System\tzkwoHl.exe
  2⤵
  PID:5968
- C:\Windows\System\jSKnyzB.exe
  C:\Windows\System\jSKnyzB.exe
  2⤵
  PID:6080
- C:\Windows\System\iGzBogo.exe
  C:\Windows\System\iGzBogo.exe
  2⤵
  PID:5140
- C:\Windows\System\kvJPkrW.exe
  C:\Windows\System\kvJPkrW.exe
  2⤵
  PID:5204
- C:\Windows\System\BittQxz.exe
  C:\Windows\System\BittQxz.exe
  2⤵
  PID:5468
- C:\Windows\System\RGAVEXi.exe
  C:\Windows\System\RGAVEXi.exe
  2⤵
  PID:5604
- C:\Windows\System\PKYifEB.exe
  C:\Windows\System\PKYifEB.exe
  2⤵
  PID:5672
- C:\Windows\System\SznRRPI.exe
  C:\Windows\System\SznRRPI.exe
  2⤵
  PID:5788
- C:\Windows\System\EUrXWjq.exe
  C:\Windows\System\EUrXWjq.exe
  2⤵
  PID:5988
- C:\Windows\System\ojhBOXz.exe
  C:\Windows\System\ojhBOXz.exe
  2⤵
  PID:5376
- C:\Windows\System\bfgYkTU.exe
  C:\Windows\System\bfgYkTU.exe
  2⤵
  PID:5784
- C:\Windows\System\YQkMOjo.exe
  C:\Windows\System\YQkMOjo.exe
  2⤵
  PID:1052
- C:\Windows\System\sUyhJyv.exe
  C:\Windows\System\sUyhJyv.exe
  2⤵
  PID:5940
- C:\Windows\System\uoTFADw.exe
  C:\Windows\System\uoTFADw.exe
  2⤵
  PID:6176
- C:\Windows\System\wjYneYQ.exe
  C:\Windows\System\wjYneYQ.exe
  2⤵
  PID:6200
- C:\Windows\System\voVwVxW.exe
  C:\Windows\System\voVwVxW.exe
  2⤵
  PID:6228
- C:\Windows\System\jgWSbyl.exe
  C:\Windows\System\jgWSbyl.exe
  2⤵
  PID:6256
- C:\Windows\System\rhPakdP.exe
  C:\Windows\System\rhPakdP.exe
  2⤵
  PID:6296
- C:\Windows\System\SaVnEKt.exe
  C:\Windows\System\SaVnEKt.exe
  2⤵
  PID:6336
- C:\Windows\System\kbInfdS.exe
  C:\Windows\System\kbInfdS.exe
  2⤵
  PID:6372
- C:\Windows\System\gmFdfrQ.exe
  C:\Windows\System\gmFdfrQ.exe
  2⤵
  PID:6412
- C:\Windows\System\CddYwvk.exe
  C:\Windows\System\CddYwvk.exe
  2⤵
  PID:6436
- C:\Windows\System\OGJtLfR.exe
  C:\Windows\System\OGJtLfR.exe
  2⤵
  PID:6460
- C:\Windows\System\uMQSfZi.exe
  C:\Windows\System\uMQSfZi.exe
  2⤵
  PID:6476
- C:\Windows\System\mxNSikT.exe
  C:\Windows\System\mxNSikT.exe
  2⤵
  PID:6504
- C:\Windows\System\SdVZAJi.exe
  C:\Windows\System\SdVZAJi.exe
  2⤵
  PID:6532
- C:\Windows\System\wnGeJzj.exe
  C:\Windows\System\wnGeJzj.exe
  2⤵
  PID:6560
- C:\Windows\System\fZzsXug.exe
  C:\Windows\System\fZzsXug.exe
  2⤵
  PID:6584
- C:\Windows\System\sjlhsgX.exe
  C:\Windows\System\sjlhsgX.exe
  2⤵
  PID:6616
- C:\Windows\System\AZmXbKH.exe
  C:\Windows\System\AZmXbKH.exe
  2⤵
  PID:6648
- C:\Windows\System\WHFsgvq.exe
  C:\Windows\System\WHFsgvq.exe
  2⤵
  PID:6672
- C:\Windows\System\cmUWVXs.exe
  C:\Windows\System\cmUWVXs.exe
  2⤵
  PID:6700
- C:\Windows\System\rQHDIkM.exe
  C:\Windows\System\rQHDIkM.exe
  2⤵
  PID:6720
- C:\Windows\System\zChSaYm.exe
  C:\Windows\System\zChSaYm.exe
  2⤵
  PID:6788
- C:\Windows\System\WJdZwdL.exe
  C:\Windows\System\WJdZwdL.exe
  2⤵
  PID:6816
- C:\Windows\System\aYriPyC.exe
  C:\Windows\System\aYriPyC.exe
  2⤵
  PID:6844
- C:\Windows\System\BfqgVKh.exe
  C:\Windows\System\BfqgVKh.exe
  2⤵
  PID:6864
- C:\Windows\System\CmyivSo.exe
  C:\Windows\System\CmyivSo.exe
  2⤵
  PID:6892
- C:\Windows\System\kJSSJLI.exe
  C:\Windows\System\kJSSJLI.exe
  2⤵
  PID:6912
- C:\Windows\System\CungJUA.exe
  C:\Windows\System\CungJUA.exe
  2⤵
  PID:6940
- C:\Windows\System\AeyEVGz.exe
  C:\Windows\System\AeyEVGz.exe
  2⤵
  PID:6964
- C:\Windows\System\jvrilcf.exe
  C:\Windows\System\jvrilcf.exe
  2⤵
  PID:7000
- C:\Windows\System\sjIKHjB.exe
  C:\Windows\System\sjIKHjB.exe
  2⤵
  PID:7068
- C:\Windows\System\UyjWIHZ.exe
  C:\Windows\System\UyjWIHZ.exe
  2⤵
  PID:7100
- C:\Windows\System\qayYfiD.exe
  C:\Windows\System\qayYfiD.exe
  2⤵
  PID:7132
- C:\Windows\System\NFfDETU.exe
  C:\Windows\System\NFfDETU.exe
  2⤵
  PID:5504
- C:\Windows\System\XLcPAVW.exe
  C:\Windows\System\XLcPAVW.exe
  2⤵
  PID:6192
- C:\Windows\System\lIuGHOf.exe
  C:\Windows\System\lIuGHOf.exe
  2⤵
  PID:6240
- C:\Windows\System\Flidhtt.exe
  C:\Windows\System\Flidhtt.exe
  2⤵
  PID:6324
- C:\Windows\System\yxmLhwP.exe
  C:\Windows\System\yxmLhwP.exe
  2⤵
  PID:6456
- C:\Windows\System\AoRWvrT.exe
  C:\Windows\System\AoRWvrT.exe
  2⤵
  PID:6488
- C:\Windows\System\XpXBBdt.exe
  C:\Windows\System\XpXBBdt.exe
  2⤵
  PID:6580
- C:\Windows\System\UYaVjpy.exe
  C:\Windows\System\UYaVjpy.exe
  2⤵
  PID:6632
- C:\Windows\System\QqfoPCP.exe
  C:\Windows\System\QqfoPCP.exe
  2⤵
  PID:6628
- C:\Windows\System\BgimlOG.exe
  C:\Windows\System\BgimlOG.exe
  2⤵
  PID:6828
- C:\Windows\System\UKFMfhb.exe
  C:\Windows\System\UKFMfhb.exe
  2⤵
  PID:6884
- C:\Windows\System\eaBVDMF.exe
  C:\Windows\System\eaBVDMF.exe
  2⤵
  PID:6924
- C:\Windows\System\XqlOwoi.exe
  C:\Windows\System\XqlOwoi.exe
  2⤵
  PID:6988
- C:\Windows\System\lobcauP.exe
  C:\Windows\System\lobcauP.exe
  2⤵
  PID:7124
- C:\Windows\System\bFSdTll.exe
  C:\Windows\System\bFSdTll.exe
  2⤵
  PID:6196
- C:\Windows\System\mGzsVOW.exe
  C:\Windows\System\mGzsVOW.exe
  2⤵
  PID:6400
- C:\Windows\System\JUcPRhG.exe
  C:\Windows\System\JUcPRhG.exe
  2⤵
  PID:6604
- C:\Windows\System\Aildacw.exe
  C:\Windows\System\Aildacw.exe
  2⤵
  PID:6836
- C:\Windows\System\ArWpQdm.exe
  C:\Windows\System\ArWpQdm.exe
  2⤵
  PID:6780
- C:\Windows\System\OEoDVSe.exe
  C:\Windows\System\OEoDVSe.exe
  2⤵
  PID:7116
- C:\Windows\System\cpXdHPQ.exe
  C:\Windows\System\cpXdHPQ.exe
  2⤵
  PID:7088
- C:\Windows\System\TFniNWL.exe
  C:\Windows\System\TFniNWL.exe
  2⤵
  PID:6448
- C:\Windows\System\rMpTBeA.exe
  C:\Windows\System\rMpTBeA.exe
  2⤵
  PID:6744
- C:\Windows\System\cuANyTY.exe
  C:\Windows\System\cuANyTY.exe
  2⤵
  PID:7180
- C:\Windows\System\BBYDqkP.exe
  C:\Windows\System\BBYDqkP.exe
  2⤵
  PID:7208
- C:\Windows\System\MxQDeyz.exe
  C:\Windows\System\MxQDeyz.exe
  2⤵
  PID:7236
- C:\Windows\System\avpqnli.exe
  C:\Windows\System\avpqnli.exe
  2⤵
  PID:7272
- C:\Windows\System\GZYGurD.exe
  C:\Windows\System\GZYGurD.exe
  2⤵
  PID:7312
- C:\Windows\System\BItZJKZ.exe
  C:\Windows\System\BItZJKZ.exe
  2⤵
  PID:7332
- C:\Windows\System\jLPQdiS.exe
  C:\Windows\System\jLPQdiS.exe
  2⤵
  PID:7356
- C:\Windows\System\YjYnnBw.exe
  C:\Windows\System\YjYnnBw.exe
  2⤵
  PID:7388
- C:\Windows\System\hCXpPHe.exe
  C:\Windows\System\hCXpPHe.exe
  2⤵
  PID:7436
- C:\Windows\System\NNKoigF.exe
  C:\Windows\System\NNKoigF.exe
  2⤵
  PID:7460
- C:\Windows\System\bpvoHST.exe
  C:\Windows\System\bpvoHST.exe
  2⤵
  PID:7488
- C:\Windows\System\wDaHjvz.exe
  C:\Windows\System\wDaHjvz.exe
  2⤵
  PID:7504
- C:\Windows\System\ZoViJkZ.exe
  C:\Windows\System\ZoViJkZ.exe
  2⤵
  PID:7524
- C:\Windows\System\PCkPkGv.exe
  C:\Windows\System\PCkPkGv.exe
  2⤵
  PID:7548
- C:\Windows\System\ieslsqU.exe
  C:\Windows\System\ieslsqU.exe
  2⤵
  PID:7596
- C:\Windows\System\XXhQUBy.exe
  C:\Windows\System\XXhQUBy.exe
  2⤵
  PID:7628
- C:\Windows\System\jUJPOFT.exe
  C:\Windows\System\jUJPOFT.exe
  2⤵
  PID:7652
- C:\Windows\System\LWbNnZs.exe
  C:\Windows\System\LWbNnZs.exe
  2⤵
  PID:7684
- C:\Windows\System\UdlCgbh.exe
  C:\Windows\System\UdlCgbh.exe
  2⤵
  PID:7712
- C:\Windows\System\oDOvjYY.exe
  C:\Windows\System\oDOvjYY.exe
  2⤵
  PID:7728
- C:\Windows\System\WzJzIYs.exe
  C:\Windows\System\WzJzIYs.exe
  2⤵
  PID:7768
- C:\Windows\System\ZsgDGjI.exe
  C:\Windows\System\ZsgDGjI.exe
  2⤵
  PID:7796
- C:\Windows\System\mmbJVNd.exe
  C:\Windows\System\mmbJVNd.exe
  2⤵
  PID:7824
- C:\Windows\System\NtlUFoq.exe
  C:\Windows\System\NtlUFoq.exe
  2⤵
  PID:7852
- C:\Windows\System\nYJgNKq.exe
  C:\Windows\System\nYJgNKq.exe
  2⤵
  PID:7868
- C:\Windows\System\nMTwvQf.exe
  C:\Windows\System\nMTwvQf.exe
  2⤵
  PID:7892
- C:\Windows\System\hZZghzH.exe
  C:\Windows\System\hZZghzH.exe
  2⤵
  PID:7924
- C:\Windows\System\EdcdTjt.exe
  C:\Windows\System\EdcdTjt.exe
  2⤵
  PID:7964
- C:\Windows\System\wzOGeWR.exe
  C:\Windows\System\wzOGeWR.exe
  2⤵
  PID:7984
- C:\Windows\System\YolYkoY.exe
  C:\Windows\System\YolYkoY.exe
  2⤵
  PID:8008
- C:\Windows\System\POedVLc.exe
  C:\Windows\System\POedVLc.exe
  2⤵
  PID:8048
- C:\Windows\System\vmYcPiL.exe
  C:\Windows\System\vmYcPiL.exe
  2⤵
  PID:8064
- C:\Windows\System\DhLbjPQ.exe
  C:\Windows\System\DhLbjPQ.exe
  2⤵
  PID:8092
- C:\Windows\System\GAlYHcG.exe
  C:\Windows\System\GAlYHcG.exe
  2⤵
  PID:8108
- C:\Windows\System\hnCWeEt.exe
  C:\Windows\System\hnCWeEt.exe
  2⤵
  PID:8144
- C:\Windows\System\gCZKqiL.exe
  C:\Windows\System\gCZKqiL.exe
  2⤵
  PID:8180
- C:\Windows\System\dYHFMIq.exe
  C:\Windows\System\dYHFMIq.exe
  2⤵
  PID:6492
- C:\Windows\System\jUIXEJg.exe
  C:\Windows\System\jUIXEJg.exe
  2⤵
  PID:7204
- C:\Windows\System\pqyjGwM.exe
  C:\Windows\System\pqyjGwM.exe
  2⤵
  PID:7308
- C:\Windows\System\NUWMueB.exe
  C:\Windows\System\NUWMueB.exe
  2⤵
  PID:7368
- C:\Windows\System\QnnEQgE.exe
  C:\Windows\System\QnnEQgE.exe
  2⤵
  PID:7472
- C:\Windows\System\PkEgLyg.exe
  C:\Windows\System\PkEgLyg.exe
  2⤵
  PID:7512
- C:\Windows\System\drjBgZb.exe
  C:\Windows\System\drjBgZb.exe
  2⤵
  PID:7588
- C:\Windows\System\qhQDeej.exe
  C:\Windows\System\qhQDeej.exe
  2⤵
  PID:7640
- C:\Windows\System\PVbgIvp.exe
  C:\Windows\System\PVbgIvp.exe
  2⤵
  PID:7660
- C:\Windows\System\WyyIyZG.exe
  C:\Windows\System\WyyIyZG.exe
  2⤵
  PID:7760
- C:\Windows\System\DuKrLjt.exe
  C:\Windows\System\DuKrLjt.exe
  2⤵
  PID:7836
- C:\Windows\System\gqRvNIz.exe
  C:\Windows\System\gqRvNIz.exe
  2⤵
  PID:7908
- C:\Windows\System\TbstHmE.exe
  C:\Windows\System\TbstHmE.exe
  2⤵
  PID:7956
- C:\Windows\System\bANRpFs.exe
  C:\Windows\System\bANRpFs.exe
  2⤵
  PID:7976
- C:\Windows\System\TWcLbeS.exe
  C:\Windows\System\TWcLbeS.exe
  2⤵
  PID:8076
- C:\Windows\System\TliVuty.exe
  C:\Windows\System\TliVuty.exe
  2⤵
  PID:8120
- C:\Windows\System\ZVlUVCg.exe
  C:\Windows\System\ZVlUVCg.exe
  2⤵
  PID:7172
- C:\Windows\System\sayNNxe.exe
  C:\Windows\System\sayNNxe.exe
  2⤵
  PID:7192
- C:\Windows\System\rrpMUMp.exe
  C:\Windows\System\rrpMUMp.exe
  2⤵
  PID:7260
- C:\Windows\System\FvEoyuj.exe
  C:\Windows\System\FvEoyuj.exe
  2⤵
  PID:7680
- C:\Windows\System\SCbwoFO.exe
  C:\Windows\System\SCbwoFO.exe
  2⤵
  PID:7940
- C:\Windows\System\IJTydtI.exe
  C:\Windows\System\IJTydtI.exe
  2⤵
  PID:6904
- C:\Windows\System\iFhXHPn.exe
  C:\Windows\System\iFhXHPn.exe
  2⤵
  PID:8160
- C:\Windows\System\oMAmqBi.exe
  C:\Windows\System\oMAmqBi.exe
  2⤵
  PID:7456
- C:\Windows\System\PbmNPdW.exe
  C:\Windows\System\PbmNPdW.exe
  2⤵
  PID:7808
- C:\Windows\System\BnJupjP.exe
  C:\Windows\System\BnJupjP.exe
  2⤵
  PID:7884
- C:\Windows\System\noStenz.exe
  C:\Windows\System\noStenz.exe
  2⤵
  PID:7612
- C:\Windows\System\GXXjEED.exe
  C:\Windows\System\GXXjEED.exe
  2⤵
  PID:8200
- C:\Windows\System\pVyutyS.exe
  C:\Windows\System\pVyutyS.exe
  2⤵
  PID:8224
- C:\Windows\System\vHvuYqy.exe
  C:\Windows\System\vHvuYqy.exe
  2⤵
  PID:8276
- C:\Windows\System\YWvrcTg.exe
  C:\Windows\System\YWvrcTg.exe
  2⤵
  PID:8304
- C:\Windows\System\VfjVaoS.exe
  C:\Windows\System\VfjVaoS.exe
  2⤵
  PID:8320
- C:\Windows\System\RbFVczk.exe
  C:\Windows\System\RbFVczk.exe
  2⤵
  PID:8348
- C:\Windows\System\TjfQTZz.exe
  C:\Windows\System\TjfQTZz.exe
  2⤵
  PID:8372
- C:\Windows\System\SGxJjUC.exe
  C:\Windows\System\SGxJjUC.exe
  2⤵
  PID:8404
- C:\Windows\System\JBKOOQD.exe
  C:\Windows\System\JBKOOQD.exe
  2⤵
  PID:8444
- C:\Windows\System\gfAaqdE.exe
  C:\Windows\System\gfAaqdE.exe
  2⤵
  PID:8460
- C:\Windows\System\uXtsKWr.exe
  C:\Windows\System\uXtsKWr.exe
  2⤵
  PID:8488
- C:\Windows\System\PtLjmkO.exe
  C:\Windows\System\PtLjmkO.exe
  2⤵
  PID:8516
- C:\Windows\System\dCeHCzS.exe
  C:\Windows\System\dCeHCzS.exe
  2⤵
  PID:8532
- C:\Windows\System\IgtViyA.exe
  C:\Windows\System\IgtViyA.exe
  2⤵
  PID:8556
- C:\Windows\System\DKvrHLa.exe
  C:\Windows\System\DKvrHLa.exe
  2⤵
  PID:8584
- C:\Windows\System\lZfgUBZ.exe
  C:\Windows\System\lZfgUBZ.exe
  2⤵
  PID:8612
- C:\Windows\System\muMjYOb.exe
  C:\Windows\System\muMjYOb.exe
  2⤵
  PID:8656
- C:\Windows\System\tSqDWxw.exe
  C:\Windows\System\tSqDWxw.exe
  2⤵
  PID:8684
- C:\Windows\System\bYVfTRi.exe
  C:\Windows\System\bYVfTRi.exe
  2⤵
  PID:8712
- C:\Windows\System\avefAgp.exe
  C:\Windows\System\avefAgp.exe
  2⤵
  PID:8740
- C:\Windows\System\FXrYMlY.exe
  C:\Windows\System\FXrYMlY.exe
  2⤵
  PID:8756
- C:\Windows\System\TPWjRdp.exe
  C:\Windows\System\TPWjRdp.exe
  2⤵
  PID:8792
- C:\Windows\System\BsOMKKm.exe
  C:\Windows\System\BsOMKKm.exe
  2⤵
  PID:8812
- C:\Windows\System\CBwytss.exe
  C:\Windows\System\CBwytss.exe
  2⤵
  PID:8832
- C:\Windows\System\nbCTOVc.exe
  C:\Windows\System\nbCTOVc.exe
  2⤵
  PID:8860
- C:\Windows\System\IstYmLC.exe
  C:\Windows\System\IstYmLC.exe
  2⤵
  PID:8892
- C:\Windows\System\FDkinHz.exe
  C:\Windows\System\FDkinHz.exe
  2⤵
  PID:8944
- C:\Windows\System\tdWcATv.exe
  C:\Windows\System\tdWcATv.exe
  2⤵
  PID:8972
- C:\Windows\System\fgxFxGg.exe
  C:\Windows\System\fgxFxGg.exe
  2⤵
  PID:8992
- C:\Windows\System\yZbQOVx.exe
  C:\Windows\System\yZbQOVx.exe
  2⤵
  PID:9032
- C:\Windows\System\utyEMQL.exe
  C:\Windows\System\utyEMQL.exe
  2⤵
  PID:9060
- C:\Windows\System\ukaeymn.exe
  C:\Windows\System\ukaeymn.exe
  2⤵
  PID:9088
- C:\Windows\System\cOCVRjb.exe
  C:\Windows\System\cOCVRjb.exe
  2⤵
  PID:9108
- C:\Windows\System\vHnyumJ.exe
  C:\Windows\System\vHnyumJ.exe
  2⤵
  PID:9148
- C:\Windows\System\yaMojrR.exe
  C:\Windows\System\yaMojrR.exe
  2⤵
  PID:9192
- C:\Windows\System\OPzZlyO.exe
  C:\Windows\System\OPzZlyO.exe
  2⤵
  PID:8212
- C:\Windows\System\wfzZHDY.exe
  C:\Windows\System\wfzZHDY.exe
  2⤵
  PID:8272
- C:\Windows\System\WgKNWCN.exe
  C:\Windows\System\WgKNWCN.exe
  2⤵
  PID:8316
- C:\Windows\System\zkzTxhw.exe
  C:\Windows\System\zkzTxhw.exe
  2⤵
  PID:8384
- C:\Windows\System\diUETPE.exe
  C:\Windows\System\diUETPE.exe
  2⤵
  PID:8428
- C:\Windows\System\ahjiXUM.exe
  C:\Windows\System\ahjiXUM.exe
  2⤵
  PID:8568
- C:\Windows\System\xRUmBEW.exe
  C:\Windows\System\xRUmBEW.exe
  2⤵
  PID:8596
- C:\Windows\System\nwdKWsh.exe
  C:\Windows\System\nwdKWsh.exe
  2⤵
  PID:8648
- C:\Windows\System\vMMWmOb.exe
  C:\Windows\System\vMMWmOb.exe
  2⤵
  PID:8692
- C:\Windows\System\FLyqtaM.exe
  C:\Windows\System\FLyqtaM.exe
  2⤵
  PID:8748
- C:\Windows\System\qfOvWhY.exe
  C:\Windows\System\qfOvWhY.exe
  2⤵
  PID:8828
- C:\Windows\System\CRcveSK.exe
  C:\Windows\System\CRcveSK.exe
  2⤵
  PID:8876
- C:\Windows\System\NoSYzlo.exe
  C:\Windows\System\NoSYzlo.exe
  2⤵
  PID:8940
- C:\Windows\System\dCRcpPp.exe
  C:\Windows\System\dCRcpPp.exe
  2⤵
  PID:8988
- C:\Windows\System\oDKvDyj.exe
  C:\Windows\System\oDKvDyj.exe
  2⤵
  PID:9080
- C:\Windows\System\IhPgbiD.exe
  C:\Windows\System\IhPgbiD.exe
  2⤵
  PID:9140
- C:\Windows\System\dTYrUHO.exe
  C:\Windows\System\dTYrUHO.exe
  2⤵
  PID:9212
- C:\Windows\System\ZQnouLG.exe
  C:\Windows\System\ZQnouLG.exe
  2⤵
  PID:8360
- C:\Windows\System\NbvCxQn.exe
  C:\Windows\System\NbvCxQn.exe
  2⤵
  PID:8668
- C:\Windows\System\XTIPZqC.exe
  C:\Windows\System\XTIPZqC.exe
  2⤵
  PID:8644
- C:\Windows\System\ddBhqxV.exe
  C:\Windows\System\ddBhqxV.exe
  2⤵
  PID:8808
- C:\Windows\System\DpjrdYZ.exe
  C:\Windows\System\DpjrdYZ.exe
  2⤵
  PID:9048
- C:\Windows\System\QTaNPbv.exe
  C:\Windows\System\QTaNPbv.exe
  2⤵
  PID:8364
- C:\Windows\System\JuVzmYU.exe
  C:\Windows\System\JuVzmYU.exe
  2⤵
  PID:8700
- C:\Windows\System\IiAXKtF.exe
  C:\Windows\System\IiAXKtF.exe
  2⤵
  PID:9072
- C:\Windows\System\qaWdwyc.exe
  C:\Windows\System\qaWdwyc.exe
  2⤵
  PID:9164
- C:\Windows\System\SfhapkT.exe
  C:\Windows\System\SfhapkT.exe
  2⤵
  PID:8932
- C:\Windows\System\aqdOzDJ.exe
  C:\Windows\System\aqdOzDJ.exe
  2⤵
  PID:9236
- C:\Windows\System\KoUJzhd.exe
  C:\Windows\System\KoUJzhd.exe
  2⤵
  PID:9256
- C:\Windows\System\GIieOzh.exe
  C:\Windows\System\GIieOzh.exe
  2⤵
  PID:9288
- C:\Windows\System\JJAgsoi.exe
  C:\Windows\System\JJAgsoi.exe
  2⤵
  PID:9316
- C:\Windows\System\rKaOybC.exe
  C:\Windows\System\rKaOybC.exe
  2⤵
  PID:9336
- C:\Windows\System\idfalpM.exe
  C:\Windows\System\idfalpM.exe
  2⤵
  PID:9368
- C:\Windows\System\XEpYyuQ.exe
  C:\Windows\System\XEpYyuQ.exe
  2⤵
  PID:9396
- C:\Windows\System\VslqFMx.exe
  C:\Windows\System\VslqFMx.exe
  2⤵
  PID:9432
- C:\Windows\System\ukzWHDp.exe
  C:\Windows\System\ukzWHDp.exe
  2⤵
  PID:9476
- C:\Windows\System\POvgNdP.exe
  C:\Windows\System\POvgNdP.exe
  2⤵
  PID:9492
- C:\Windows\System\fViLkSS.exe
  C:\Windows\System\fViLkSS.exe
  2⤵
  PID:9520
- C:\Windows\System\upVkJCi.exe
  C:\Windows\System\upVkJCi.exe
  2⤵
  PID:9548
- C:\Windows\System\GUMkdPP.exe
  C:\Windows\System\GUMkdPP.exe
  2⤵
  PID:9572
- C:\Windows\System\jUciYmg.exe
  C:\Windows\System\jUciYmg.exe
  2⤵
  PID:9604
- C:\Windows\System\YqSwBxq.exe
  C:\Windows\System\YqSwBxq.exe
  2⤵
  PID:9636
- C:\Windows\System\PxHvBoA.exe
  C:\Windows\System\PxHvBoA.exe
  2⤵
  PID:9660
- C:\Windows\System\AQcKUMZ.exe
  C:\Windows\System\AQcKUMZ.exe
  2⤵
  PID:9688
- C:\Windows\System\eFBExXn.exe
  C:\Windows\System\eFBExXn.exe
  2⤵
  PID:9720
- C:\Windows\System\SGJKrXX.exe
  C:\Windows\System\SGJKrXX.exe
  2⤵
  PID:9748
- C:\Windows\System\FYlTOsK.exe
  C:\Windows\System\FYlTOsK.exe
  2⤵
  PID:9776
- C:\Windows\System\NJTTMEC.exe
  C:\Windows\System\NJTTMEC.exe
  2⤵
  PID:9796
- C:\Windows\System\MrcPGEk.exe
  C:\Windows\System\MrcPGEk.exe
  2⤵
  PID:9816
- C:\Windows\System\cqvnyIB.exe
  C:\Windows\System\cqvnyIB.exe
  2⤵
  PID:9836
- C:\Windows\System\VZhfVNZ.exe
  C:\Windows\System\VZhfVNZ.exe
  2⤵
  PID:9868
- C:\Windows\System\mTZbRJw.exe
  C:\Windows\System\mTZbRJw.exe
  2⤵
  PID:9892
- C:\Windows\System\dsBXZqI.exe
  C:\Windows\System\dsBXZqI.exe
  2⤵
  PID:9916
- C:\Windows\System\unYlyfO.exe
  C:\Windows\System\unYlyfO.exe
  2⤵
  PID:9964
- C:\Windows\System\jxsdgJs.exe
  C:\Windows\System\jxsdgJs.exe
  2⤵
  PID:9992
- C:\Windows\System\JGctQoy.exe
  C:\Windows\System\JGctQoy.exe
  2⤵
  PID:10020
- C:\Windows\System\ZjpOrcj.exe
  C:\Windows\System\ZjpOrcj.exe
  2⤵
  PID:10044
- C:\Windows\System\xkceTXd.exe
  C:\Windows\System\xkceTXd.exe
  2⤵
  PID:10064
- C:\Windows\System\JdZJhhi.exe
  C:\Windows\System\JdZJhhi.exe
  2⤵
  PID:10096
- C:\Windows\System\ovFQfEx.exe
  C:\Windows\System\ovFQfEx.exe
  2⤵
  PID:10144
- C:\Windows\System\UKDpQYk.exe
  C:\Windows\System\UKDpQYk.exe
  2⤵
  PID:10180
- C:\Windows\System\CcGCjAX.exe
  C:\Windows\System\CcGCjAX.exe
  2⤵
  PID:10196
- C:\Windows\System\yFaXODI.exe
  C:\Windows\System\yFaXODI.exe
  2⤵
  PID:10216
- C:\Windows\System\ExXgodS.exe
  C:\Windows\System\ExXgodS.exe
  2⤵
  PID:10236
- C:\Windows\System\ghqknAy.exe
  C:\Windows\System\ghqknAy.exe
  2⤵
  PID:9304
- C:\Windows\System\iDRiFVG.exe
  C:\Windows\System\iDRiFVG.exe
  2⤵
  PID:9364
- C:\Windows\System\kVaAyAL.exe
  C:\Windows\System\kVaAyAL.exe
  2⤵
  PID:9460
- C:\Windows\System\gqDrBuM.exe
  C:\Windows\System\gqDrBuM.exe
  2⤵
  PID:9536
- C:\Windows\System\caNvrwm.exe
  C:\Windows\System\caNvrwm.exe
  2⤵
  PID:9592
- C:\Windows\System\ssGvWnq.exe
  C:\Windows\System\ssGvWnq.exe
  2⤵
  PID:9616
- C:\Windows\System\cfkAjFV.exe
  C:\Windows\System\cfkAjFV.exe
  2⤵
  PID:9680
- C:\Windows\System\WnmirQk.exe
  C:\Windows\System\WnmirQk.exe
  2⤵
  PID:9760
- C:\Windows\System\VELCPCP.exe
  C:\Windows\System\VELCPCP.exe
  2⤵
  PID:9792
- C:\Windows\System\cUkZAzH.exe
  C:\Windows\System\cUkZAzH.exe
  2⤵
  PID:9860
- C:\Windows\System\GQvVfXb.exe
  C:\Windows\System\GQvVfXb.exe
  2⤵
  PID:9912
- C:\Windows\System\PWHGNrt.exe
  C:\Windows\System\PWHGNrt.exe
  2⤵
  PID:10052
- C:\Windows\System\ltHPgZl.exe
  C:\Windows\System\ltHPgZl.exe
  2⤵
  PID:10084
- C:\Windows\System\UgjofCz.exe
  C:\Windows\System\UgjofCz.exe
  2⤵
  PID:10140
- C:\Windows\System\sjzanfY.exe
  C:\Windows\System\sjzanfY.exe
  2⤵
  PID:10188
- C:\Windows\System\DrZkeiT.exe
  C:\Windows\System\DrZkeiT.exe
  2⤵
  PID:9268
- C:\Windows\System\ECGSQAV.exe
  C:\Windows\System\ECGSQAV.exe
  2⤵
  PID:9360
- C:\Windows\System\BcHXSvA.exe
  C:\Windows\System\BcHXSvA.exe
  2⤵
  PID:9564
- C:\Windows\System\harzwbh.exe
  C:\Windows\System\harzwbh.exe
  2⤵
  PID:9708
- C:\Windows\System\CPwkIjp.exe
  C:\Windows\System\CPwkIjp.exe
  2⤵
  PID:9908
- C:\Windows\System\JJaMFIK.exe
  C:\Windows\System\JJaMFIK.exe
  2⤵
  PID:9952
- C:\Windows\System\eEwdOdn.exe
  C:\Windows\System\eEwdOdn.exe
  2⤵
  PID:10036
- C:\Windows\System\FcxOfSK.exe
  C:\Windows\System\FcxOfSK.exe
  2⤵
  PID:9220
- C:\Windows\System\tYMUzAR.exe
  C:\Windows\System\tYMUzAR.exe
  2⤵
  PID:9944
- C:\Windows\System\iKPjnUn.exe
  C:\Windows\System\iKPjnUn.exe
  2⤵
  PID:9972
- C:\Windows\System\nzoZTyj.exe
  C:\Windows\System\nzoZTyj.exe
  2⤵
  PID:10224
- C:\Windows\System\hqqDRri.exe
  C:\Windows\System\hqqDRri.exe
  2⤵
  PID:10260
- C:\Windows\System\BwjiDky.exe
  C:\Windows\System\BwjiDky.exe
  2⤵
  PID:10276
- C:\Windows\System\LICGqWE.exe
  C:\Windows\System\LICGqWE.exe
  2⤵
  PID:10304
- C:\Windows\System\CzPUrKX.exe
  C:\Windows\System\CzPUrKX.exe
  2⤵
  PID:10332
- C:\Windows\System\bhZDAAL.exe
  C:\Windows\System\bhZDAAL.exe
  2⤵
  PID:10360
- C:\Windows\System\vsEjlCX.exe
  C:\Windows\System\vsEjlCX.exe
  2⤵
  PID:10388
- C:\Windows\System\QWdkcjo.exe
  C:\Windows\System\QWdkcjo.exe
  2⤵
  PID:10404
- C:\Windows\System\HcKdOmD.exe
  C:\Windows\System\HcKdOmD.exe
  2⤵
  PID:10436
- C:\Windows\System\ZDqPNYN.exe
  C:\Windows\System\ZDqPNYN.exe
  2⤵
  PID:10464
- C:\Windows\System\hHUjmuz.exe
  C:\Windows\System\hHUjmuz.exe
  2⤵
  PID:10524
- C:\Windows\System\TuUrtTu.exe
  C:\Windows\System\TuUrtTu.exe
  2⤵
  PID:10540
- C:\Windows\System\dKPIlZx.exe
  C:\Windows\System\dKPIlZx.exe
  2⤵
  PID:10564
- C:\Windows\System\rrlvhFb.exe
  C:\Windows\System\rrlvhFb.exe
  2⤵
  PID:10584
- C:\Windows\System\IJWKOuR.exe
  C:\Windows\System\IJWKOuR.exe
  2⤵
  PID:10612
- C:\Windows\System\UNDDYda.exe
  C:\Windows\System\UNDDYda.exe
  2⤵
  PID:10644
- C:\Windows\System\xCFaGKn.exe
  C:\Windows\System\xCFaGKn.exe
  2⤵
  PID:10672
- C:\Windows\System\jwukjmK.exe
  C:\Windows\System\jwukjmK.exe
  2⤵
  PID:10700
- C:\Windows\System\dFicQGk.exe
  C:\Windows\System\dFicQGk.exe
  2⤵
  PID:10724
- C:\Windows\System\OpTJKyb.exe
  C:\Windows\System\OpTJKyb.exe
  2⤵
  PID:10752
- C:\Windows\System\yZbkAED.exe
  C:\Windows\System\yZbkAED.exe
  2⤵
  PID:10772
- C:\Windows\System\oiVFzQq.exe
  C:\Windows\System\oiVFzQq.exe
  2⤵
  PID:10792
- C:\Windows\System\iLMrlMP.exe
  C:\Windows\System\iLMrlMP.exe
  2⤵
  PID:10840
- C:\Windows\System\wAcuntD.exe
  C:\Windows\System\wAcuntD.exe
  2⤵
  PID:10860
- C:\Windows\System\VVjrJhD.exe
  C:\Windows\System\VVjrJhD.exe
  2⤵
  PID:10880
- C:\Windows\System\LJZdPhh.exe
  C:\Windows\System\LJZdPhh.exe
  2⤵
  PID:10908
- C:\Windows\System\rHRunwC.exe
  C:\Windows\System\rHRunwC.exe
  2⤵
  PID:10936
- C:\Windows\System\WvdCXmK.exe
  C:\Windows\System\WvdCXmK.exe
  2⤵
  PID:10968
- C:\Windows\System\ZWkCEYE.exe
  C:\Windows\System\ZWkCEYE.exe
  2⤵
  PID:10996
- C:\Windows\System\RCDgyeM.exe
  C:\Windows\System\RCDgyeM.exe
  2⤵
  PID:11048
- C:\Windows\System\wyQpWce.exe
  C:\Windows\System\wyQpWce.exe
  2⤵
  PID:11068
- C:\Windows\System\zzGIAQv.exe
  C:\Windows\System\zzGIAQv.exe
  2⤵
  PID:11104
- C:\Windows\System\NQwdbNb.exe
  C:\Windows\System\NQwdbNb.exe
  2⤵
  PID:11120
- C:\Windows\System\YjBhmcB.exe
  C:\Windows\System\YjBhmcB.exe
  2⤵
  PID:11144
- C:\Windows\System\yIefcdG.exe
  C:\Windows\System\yIefcdG.exe
  2⤵
  PID:11180
- C:\Windows\System\lnrtXEK.exe
  C:\Windows\System\lnrtXEK.exe
  2⤵
  PID:11200
- C:\Windows\System\pYsVLJn.exe
  C:\Windows\System\pYsVLJn.exe
  2⤵
  PID:11232
- C:\Windows\System\sHlNOKI.exe
  C:\Windows\System\sHlNOKI.exe
  2⤵
  PID:9740
- C:\Windows\System\oEdOWVx.exe
  C:\Windows\System\oEdOWVx.exe
  2⤵
  PID:10272
- C:\Windows\System\KhfxgiS.exe
  C:\Windows\System\KhfxgiS.exe
  2⤵
  PID:10324
- C:\Windows\System\kDGHouq.exe
  C:\Windows\System\kDGHouq.exe
  2⤵
  PID:10380
- C:\Windows\System\jJEWNXV.exe
  C:\Windows\System\jJEWNXV.exe
  2⤵
  PID:10576
- C:\Windows\System\lfFeArH.exe
  C:\Windows\System\lfFeArH.exe
  2⤵
  PID:10636
- C:\Windows\System\NOqnpkm.exe
  C:\Windows\System\NOqnpkm.exe
  2⤵
  PID:10668
- C:\Windows\System\zAekIJl.exe
  C:\Windows\System\zAekIJl.exe
  2⤵
  PID:10744
- C:\Windows\System\KYUcxSb.exe
  C:\Windows\System\KYUcxSb.exe
  2⤵
  PID:10832
- C:\Windows\System\cfmabuV.exe
  C:\Windows\System\cfmabuV.exe
  2⤵
  PID:10920
- C:\Windows\System\BqDpzrz.exe
  C:\Windows\System\BqDpzrz.exe
  2⤵
  PID:10928
- C:\Windows\System\RKtiROn.exe
  C:\Windows\System\RKtiROn.exe
  2⤵
  PID:10980
- C:\Windows\System\qyJBitK.exe
  C:\Windows\System\qyJBitK.exe
  2⤵
  PID:11088
- C:\Windows\System\tNkgWUX.exe
  C:\Windows\System\tNkgWUX.exe
  2⤵
  PID:11136
- C:\Windows\System\lnTDiob.exe
  C:\Windows\System\lnTDiob.exe
  2⤵
  PID:11208
- C:\Windows\System\yrCsftV.exe
  C:\Windows\System\yrCsftV.exe
  2⤵
  PID:11228
- C:\Windows\System\XDBqxDX.exe
  C:\Windows\System\XDBqxDX.exe
  2⤵
  PID:10396
- C:\Windows\System\lBmxijV.exe
  C:\Windows\System\lBmxijV.exe
  2⤵
  PID:10556
- C:\Windows\System\nDZZCxI.exe
  C:\Windows\System\nDZZCxI.exe
  2⤵
  PID:10820
- C:\Windows\System\QHbEbOX.exe
  C:\Windows\System\QHbEbOX.exe
  2⤵
  PID:11016
- C:\Windows\System\VbIzOBb.exe
  C:\Windows\System\VbIzOBb.exe
  2⤵
  PID:11064
- C:\Windows\System\hchJBQl.exe
  C:\Windows\System\hchJBQl.exe
  2⤵
  PID:10572
- C:\Windows\System\ksaXRwZ.exe
  C:\Windows\System\ksaXRwZ.exe
  2⤵
  PID:11332
- C:\Windows\System\adDeNbc.exe
  C:\Windows\System\adDeNbc.exe
  2⤵
  PID:11356
- C:\Windows\System\MscxEQr.exe
  C:\Windows\System\MscxEQr.exe
  2⤵
  PID:11376
- C:\Windows\System\HtKvtbA.exe
  C:\Windows\System\HtKvtbA.exe
  2⤵
  PID:11400
- C:\Windows\System\WrtyQeM.exe
  C:\Windows\System\WrtyQeM.exe
  2⤵
  PID:11424
- C:\Windows\System\PVJuzAg.exe
  C:\Windows\System\PVJuzAg.exe
  2⤵
  PID:11444
- C:\Windows\System\ETZSwzO.exe
  C:\Windows\System\ETZSwzO.exe
  2⤵
  PID:11480
- C:\Windows\System\oXaBeEM.exe
  C:\Windows\System\oXaBeEM.exe
  2⤵
  PID:11500
- C:\Windows\System\rMQgRtZ.exe
  C:\Windows\System\rMQgRtZ.exe
  2⤵
  PID:11524
- C:\Windows\System\TkpJCZQ.exe
  C:\Windows\System\TkpJCZQ.exe
  2⤵
  PID:11544
- C:\Windows\System\YJaksnC.exe
  C:\Windows\System\YJaksnC.exe
  2⤵
  PID:11568
- C:\Windows\System\pfaNhTz.exe
  C:\Windows\System\pfaNhTz.exe
  2⤵
  PID:11608
- C:\Windows\System\jKgpCYY.exe
  C:\Windows\System\jKgpCYY.exe
  2⤵
  PID:11644
- C:\Windows\System\hlDnvbQ.exe
  C:\Windows\System\hlDnvbQ.exe
  2⤵
  PID:11668
- C:\Windows\System\ycQqTls.exe
  C:\Windows\System\ycQqTls.exe
  2⤵
  PID:11704
- C:\Windows\System\VEzvAKs.exe
  C:\Windows\System\VEzvAKs.exe
  2⤵
  PID:11724
- C:\Windows\System\NeZcgrO.exe
  C:\Windows\System\NeZcgrO.exe
  2⤵
  PID:11744
- C:\Windows\System\IuajoEX.exe
  C:\Windows\System\IuajoEX.exe
  2⤵
  PID:11788
- C:\Windows\System\KkdPqWF.exe
  C:\Windows\System\KkdPqWF.exe
  2⤵
  PID:11820
- C:\Windows\System\tTgarDg.exe
  C:\Windows\System\tTgarDg.exe
  2⤵
  PID:11840
- C:\Windows\System\qoUofoP.exe
  C:\Windows\System\qoUofoP.exe
  2⤵
  PID:11876
- C:\Windows\System\KZIleAP.exe
  C:\Windows\System\KZIleAP.exe
  2⤵
  PID:11908
- C:\Windows\System\gKXsTQZ.exe
  C:\Windows\System\gKXsTQZ.exe
  2⤵
  PID:11964
- C:\Windows\System\fbdFyru.exe
  C:\Windows\System\fbdFyru.exe
  2⤵
  PID:11980
- C:\Windows\System\hNFcADY.exe
  C:\Windows\System\hNFcADY.exe
  2⤵
  PID:11996
- C:\Windows\System\IqfYotu.exe
  C:\Windows\System\IqfYotu.exe
  2⤵
  PID:12024
- C:\Windows\System\SkgjZfr.exe
  C:\Windows\System\SkgjZfr.exe
  2⤵
  PID:12044
- C:\Windows\System\edtZHTl.exe
  C:\Windows\System\edtZHTl.exe
  2⤵
  PID:12076
- C:\Windows\System\fIysOWe.exe
  C:\Windows\System\fIysOWe.exe
  2⤵
  PID:12104
- C:\Windows\System\SNjFIYo.exe
  C:\Windows\System\SNjFIYo.exe
  2⤵
  PID:12132
- C:\Windows\System\agzbEql.exe
  C:\Windows\System\agzbEql.exe
  2⤵
  PID:12196
- C:\Windows\System\NmjYkbP.exe
  C:\Windows\System\NmjYkbP.exe
  2⤵
  PID:12228
- C:\Windows\System\GalycQK.exe
  C:\Windows\System\GalycQK.exe
  2⤵
  PID:12244
- C:\Windows\System\FiJXdaB.exe
  C:\Windows\System\FiJXdaB.exe
  2⤵
  PID:12268
- C:\Windows\System\CHqXhse.exe
  C:\Windows\System\CHqXhse.exe
  2⤵
  PID:10992
- C:\Windows\System\mRcPsFY.exe
  C:\Windows\System\mRcPsFY.exe
  2⤵
  PID:11304
- C:\Windows\System\YJkcbdu.exe
  C:\Windows\System\YJkcbdu.exe
  2⤵
  PID:11372
- C:\Windows\System\IfzETWv.exe
  C:\Windows\System\IfzETWv.exe
  2⤵
  PID:11392
- C:\Windows\System\wDWAaDZ.exe
  C:\Windows\System\wDWAaDZ.exe
  2⤵
  PID:11492
- C:\Windows\System\dPoqMpX.exe
  C:\Windows\System\dPoqMpX.exe
  2⤵
  PID:11532
- C:\Windows\System\ElOVOuC.exe
  C:\Windows\System\ElOVOuC.exe
  2⤵
  PID:11636
- C:\Windows\System\QTbsxui.exe
  C:\Windows\System\QTbsxui.exe
  2⤵
  PID:11684
- C:\Windows\System\gtYYzvq.exe
  C:\Windows\System\gtYYzvq.exe
  2⤵
  PID:11712
- C:\Windows\System\IjDVcfR.exe
  C:\Windows\System\IjDVcfR.exe
  2⤵
  PID:11808
- C:\Windows\System\pcVGLDi.exe
  C:\Windows\System\pcVGLDi.exe
  2⤵
  PID:11892
- C:\Windows\System\AsKxjBU.exe
  C:\Windows\System\AsKxjBU.exe
  2⤵
  PID:11976
- C:\Windows\System\GDzgrCf.exe
  C:\Windows\System\GDzgrCf.exe
  2⤵
  PID:12012
- C:\Windows\System\HhlDNJS.exe
  C:\Windows\System\HhlDNJS.exe
  2⤵
  PID:12040
- C:\Windows\System\IrjpPlz.exe
  C:\Windows\System\IrjpPlz.exe
  2⤵
  PID:12192
- C:\Windows\System\KrkDtca.exe
  C:\Windows\System\KrkDtca.exe
  2⤵
  PID:12236
- C:\Windows\System\KqHVowl.exe
  C:\Windows\System\KqHVowl.exe
  2⤵
  PID:10924
- C:\Windows\System\sudcZyT.exe
  C:\Windows\System\sudcZyT.exe
  2⤵
  PID:11436
- C:\Windows\System\EmsEZIK.exe
  C:\Windows\System\EmsEZIK.exe
  2⤵
  PID:11556
- C:\Windows\System\AkOYeve.exe
  C:\Windows\System\AkOYeve.exe
  2⤵
  PID:11660
- C:\Windows\System\bTxtnoY.exe
  C:\Windows\System\bTxtnoY.exe
  2⤵
  PID:11888
- C:\Windows\System\EiWZVGR.exe
  C:\Windows\System\EiWZVGR.exe
  2⤵
  PID:12016
- C:\Windows\System\OlOUcEg.exe
  C:\Windows\System\OlOUcEg.exe
  2⤵
  PID:12224
- C:\Windows\System\KlWWOUK.exe
  C:\Windows\System\KlWWOUK.exe
  2⤵
  PID:11348
- C:\Windows\System\oYlHvxP.exe
  C:\Windows\System\oYlHvxP.exe
  2⤵
  PID:11564
- C:\Windows\System\SnzvinI.exe
  C:\Windows\System\SnzvinI.exe
  2⤵
  PID:12148
- C:\Windows\System\kuRiTea.exe
  C:\Windows\System\kuRiTea.exe
  2⤵
  PID:11716
- C:\Windows\System\yrPaESE.exe
  C:\Windows\System\yrPaESE.exe
  2⤵
  PID:12252
- C:\Windows\System\LnrWuwo.exe
  C:\Windows\System\LnrWuwo.exe
  2⤵
  PID:12308
- C:\Windows\System\GgggQxr.exe
  C:\Windows\System\GgggQxr.exe
  2⤵
  PID:12332
- C:\Windows\System\tfCPlXW.exe
  C:\Windows\System\tfCPlXW.exe
  2⤵
  PID:12360
- C:\Windows\System\mBPWopN.exe
  C:\Windows\System\mBPWopN.exe
  2⤵
  PID:12388
- C:\Windows\System\flzRZrJ.exe
  C:\Windows\System\flzRZrJ.exe
  2⤵
  PID:12424
- C:\Windows\System\YzjbUrx.exe
  C:\Windows\System\YzjbUrx.exe
  2⤵
  PID:12444
- C:\Windows\System\SOAxTVG.exe
  C:\Windows\System\SOAxTVG.exe
  2⤵
  PID:12484
- C:\Windows\System\pjRADIX.exe
  C:\Windows\System\pjRADIX.exe
  2⤵
  PID:12512
- C:\Windows\System\YShdlyt.exe
  C:\Windows\System\YShdlyt.exe
  2⤵
  PID:12532
- C:\Windows\System\XNrCnUh.exe
  C:\Windows\System\XNrCnUh.exe
  2⤵
  PID:12560
- C:\Windows\System\ZopwQik.exe
  C:\Windows\System\ZopwQik.exe
  2⤵
  PID:12588
- C:\Windows\System\xohxwQd.exe
  C:\Windows\System\xohxwQd.exe
  2⤵
  PID:12616
- C:\Windows\System\sCrtJjj.exe
  C:\Windows\System\sCrtJjj.exe
  2⤵
  PID:12632
- C:\Windows\System\xegMyiU.exe
  C:\Windows\System\xegMyiU.exe
  2⤵
  PID:12676
- C:\Windows\System\SXexWvz.exe
  C:\Windows\System\SXexWvz.exe
  2⤵
  PID:12700
- C:\Windows\System\PZvGYjb.exe
  C:\Windows\System\PZvGYjb.exe
  2⤵
  PID:12720
- C:\Windows\System\LjYxsZg.exe
  C:\Windows\System\LjYxsZg.exe
  2⤵
  PID:12740
- C:\Windows\System\xcrfZhJ.exe
  C:\Windows\System\xcrfZhJ.exe
  2⤵
  PID:12792
- C:\Windows\System\WPRitWs.exe
  C:\Windows\System\WPRitWs.exe
  2⤵
  PID:12812
- C:\Windows\System\ckrCKzE.exe
  C:\Windows\System\ckrCKzE.exe
  2⤵
  PID:12840
- C:\Windows\System\MmUsYSM.exe
  C:\Windows\System\MmUsYSM.exe
  2⤵
  PID:12868
- C:\Windows\System\JhRKtOl.exe
  C:\Windows\System\JhRKtOl.exe
  2⤵
  PID:12892
- C:\Windows\System\MFfAwXs.exe
  C:\Windows\System\MFfAwXs.exe
  2⤵
  PID:12912
- C:\Windows\System\MVvFcoc.exe
  C:\Windows\System\MVvFcoc.exe
  2⤵
  PID:12928
- C:\Windows\System\lhCcavP.exe
  C:\Windows\System\lhCcavP.exe
  2⤵
  PID:12952
- C:\Windows\System\GnLGDVg.exe
  C:\Windows\System\GnLGDVg.exe
  2⤵
  PID:13008
- C:\Windows\System\yFCgjjb.exe
  C:\Windows\System\yFCgjjb.exe
  2⤵
  PID:13024
- C:\Windows\System\ZNUoGaJ.exe
  C:\Windows\System\ZNUoGaJ.exe
  2⤵
  PID:13068
- C:\Windows\System\bOqnfAm.exe
  C:\Windows\System\bOqnfAm.exe
  2⤵
  PID:13092
- C:\Windows\System\wnyLWni.exe
  C:\Windows\System\wnyLWni.exe
  2⤵
  PID:13112
- C:\Windows\System\ciKxETU.exe
  C:\Windows\System\ciKxETU.exe
  2⤵
  PID:13132
- C:\Windows\System\VdHXjSi.exe
  C:\Windows\System\VdHXjSi.exe
  2⤵
  PID:13160
- C:\Windows\System\aYTDcHw.exe
  C:\Windows\System\aYTDcHw.exe
  2⤵
  PID:13216
- C:\Windows\System\fjPFnLH.exe
  C:\Windows\System\fjPFnLH.exe
  2⤵
  PID:13232
- C:\Windows\System\VSQfXAY.exe
  C:\Windows\System\VSQfXAY.exe
  2⤵
  PID:13272
- C:\Windows\System\SBUnxcp.exe
  C:\Windows\System\SBUnxcp.exe
  2⤵
  PID:13300
- C:\Windows\System\KQsckNd.exe
  C:\Windows\System\KQsckNd.exe
  2⤵
  PID:12068
- C:\Windows\System\aVXRztL.exe
  C:\Windows\System\aVXRztL.exe
  2⤵
  PID:12380
- C:\Windows\System\TGIoiqd.exe
  C:\Windows\System\TGIoiqd.exe
  2⤵
  PID:12432
- C:\Windows\System\NrBVjNQ.exe
  C:\Windows\System\NrBVjNQ.exe
  2⤵
  PID:12504
- C:\Windows\System\QNdGJXQ.exe
  C:\Windows\System\QNdGJXQ.exe
  2⤵
  PID:12556
- C:\Windows\System\VzsHzmM.exe
  C:\Windows\System\VzsHzmM.exe
  2⤵
  PID:12604
- C:\Windows\System\mfGzWGj.exe
  C:\Windows\System\mfGzWGj.exe
  2⤵
  PID:12684
- C:\Windows\System\wjMCebd.exe
  C:\Windows\System\wjMCebd.exe
  2⤵
  PID:12780
- C:\Windows\System\YjbIUmB.exe
  C:\Windows\System\YjbIUmB.exe
  2⤵
  PID:12856
- C:\Windows\System\RGtJHYr.exe
  C:\Windows\System\RGtJHYr.exe
  2⤵
  PID:12904
- C:\Windows\System\dIVqVWd.exe
  C:\Windows\System\dIVqVWd.exe
  2⤵
  PID:12924
- C:\Windows\System\StzNrqc.exe
  C:\Windows\System\StzNrqc.exe
  2⤵
  PID:12976
- C:\Windows\System\ajMsvEI.exe
  C:\Windows\System\ajMsvEI.exe
  2⤵
  PID:13020
- C:\Windows\System\WleUQeA.exe
  C:\Windows\System\WleUQeA.exe
  2⤵
  PID:13088
- C:\Windows\System\PfsztFG.exe
  C:\Windows\System\PfsztFG.exe
  2⤵
  PID:13188
- C:\Windows\System\yQDdYjY.exe
  C:\Windows\System\yQDdYjY.exe
  2⤵
  PID:13288
- C:\Windows\System\JRbPUwC.exe
  C:\Windows\System\JRbPUwC.exe
  2⤵
  PID:11696
- C:\Windows\System\XyoLbsS.exe
  C:\Windows\System\XyoLbsS.exe
  2⤵
  PID:12540
- C:\Windows\System\JQcZest.exe
  C:\Windows\System\JQcZest.exe
  2⤵
  PID:12600
- C:\Windows\System\uCLPkbV.exe
  C:\Windows\System\uCLPkbV.exe
  2⤵
  PID:12804
- C:\Windows\System\NVyogee.exe
  C:\Windows\System\NVyogee.exe
  2⤵
  PID:12888
- C:\Windows\System\fOHRUDb.exe
  C:\Windows\System\fOHRUDb.exe
  2⤵
  PID:13104
- C:\Windows\System\zjJeXve.exe
  C:\Windows\System\zjJeXve.exe
  2⤵
  PID:13264
- C:\Windows\System\OpZQYDz.exe
  C:\Windows\System\OpZQYDz.exe
  2⤵
  PID:12468
- C:\Windows\System\bQeWJdd.exe
  C:\Windows\System\bQeWJdd.exe
  2⤵
  PID:12880
- C:\Windows\System\eNjCHxy.exe
  C:\Windows\System\eNjCHxy.exe
  2⤵
  PID:13252
- C:\Windows\System\YzQPyTE.exe
  C:\Windows\System\YzQPyTE.exe
  2⤵
  PID:13180
- C:\Windows\System\SuCkKBL.exe
  C:\Windows\System\SuCkKBL.exe
  2⤵
  PID:12736
- C:\Windows\System\JFbUdDh.exe
  C:\Windows\System\JFbUdDh.exe
  2⤵
  PID:13340
- C:\Windows\System\OWxbjrW.exe
  C:\Windows\System\OWxbjrW.exe
  2⤵
  PID:13356
- C:\Windows\System\pSZFGoo.exe
  C:\Windows\System\pSZFGoo.exe
  2⤵
  PID:13376
- C:\Windows\System\nSglUDt.exe
  C:\Windows\System\nSglUDt.exe
  2⤵
  PID:13416
- C:\Windows\System\LvZHndx.exe
  C:\Windows\System\LvZHndx.exe
  2⤵
  PID:13444
- C:\Windows\System\nVEcfOj.exe
  C:\Windows\System\nVEcfOj.exe
  2⤵
  PID:13476
- C:\Windows\System\OURWAQi.exe
  C:\Windows\System\OURWAQi.exe
  2⤵
  PID:13496
- C:\Windows\System\mRCDcGH.exe
  C:\Windows\System\mRCDcGH.exe
  2⤵
  PID:13524
- C:\Windows\System\lfvDNOU.exe
  C:\Windows\System\lfvDNOU.exe
  2⤵
  PID:13552
- C:\Windows\System\PJSjzFy.exe
  C:\Windows\System\PJSjzFy.exe
  2⤵
  PID:13580
- C:\Windows\System\ioqEsdU.exe
  C:\Windows\System\ioqEsdU.exe
  2⤵
  PID:13600
- C:\Windows\System\rRDxkzO.exe
  C:\Windows\System\rRDxkzO.exe
  2⤵
  PID:13636
- C:\Windows\System\HabATZh.exe
  C:\Windows\System\HabATZh.exe
  2⤵
  PID:13660
- C:\Windows\System\MJpdrkO.exe
  C:\Windows\System\MJpdrkO.exe
  2⤵
  PID:13696
- C:\Windows\System\CjQNRNK.exe
  C:\Windows\System\CjQNRNK.exe
  2⤵
  PID:13724
- C:\Windows\System\rWAeDGz.exe
  C:\Windows\System\rWAeDGz.exe
  2⤵
  PID:13768
- C:\Windows\System\xYmnwen.exe
  C:\Windows\System\xYmnwen.exe
  2⤵
  PID:13796
- C:\Windows\System\KRxJEUx.exe
  C:\Windows\System\KRxJEUx.exe
  2⤵
  PID:13832
- C:\Windows\System\KPiMayA.exe
  C:\Windows\System\KPiMayA.exe
  2⤵
  PID:13848
- C:\Windows\System\kENUKmy.exe
  C:\Windows\System\kENUKmy.exe
  2⤵
  PID:13868
- C:\Windows\System\Mljbezq.exe
  C:\Windows\System\Mljbezq.exe
  2⤵
  PID:13928
- C:\Windows\System\veOvXAP.exe
  C:\Windows\System\veOvXAP.exe
  2⤵
  PID:13952
- C:\Windows\System\zkvXxtR.exe
  C:\Windows\System\zkvXxtR.exe
  2⤵
  PID:13972
- C:\Windows\System\KdxTKjK.exe
  C:\Windows\System\KdxTKjK.exe
  2⤵
  PID:13996
- C:\Windows\System\zbanctJ.exe
  C:\Windows\System\zbanctJ.exe
  2⤵
  PID:14024
- C:\Windows\System\pmelTWq.exe
  C:\Windows\System\pmelTWq.exe
  2⤵
  PID:14044
- C:\Windows\System\SBPsyYA.exe
  C:\Windows\System\SBPsyYA.exe
  2⤵
  PID:14060
- C:\Windows\System\ASbwnDf.exe
  C:\Windows\System\ASbwnDf.exe
  2⤵
  PID:14096
- C:\Windows\System\OhIUObz.exe
  C:\Windows\System\OhIUObz.exe
  2⤵
  PID:14120
- C:\Windows\System\VdCflmE.exe
  C:\Windows\System\VdCflmE.exe
  2⤵
  PID:14172
- C:\Windows\System\tmbtZRG.exe
  C:\Windows\System\tmbtZRG.exe
  2⤵
  PID:14196
- C:\Windows\System\qACqIep.exe
  C:\Windows\System\qACqIep.exe
  2⤵
  PID:14248
- C:\Windows\System\mnwfOoX.exe
  C:\Windows\System\mnwfOoX.exe
  2⤵
  PID:14264
- C:\Windows\System\bOlusab.exe
  C:\Windows\System\bOlusab.exe
  2⤵
  PID:14284
- C:\Windows\System\alztCCz.exe
  C:\Windows\System\alztCCz.exe
  2⤵
  PID:14312
- C:\Windows\System\TJktvuV.exe
  C:\Windows\System\TJktvuV.exe
  2⤵
  PID:13100
- C:\Windows\System\Mtaidkd.exe
  C:\Windows\System\Mtaidkd.exe
  2⤵
  PID:13348
- C:\Windows\System\ZBOdfHI.exe
  C:\Windows\System\ZBOdfHI.exe
  2⤵
  PID:13412
- C:\Windows\System\WZWnOnI.exe
  C:\Windows\System\WZWnOnI.exe
  2⤵
  PID:13472
- C:\Windows\System\OQnfMyf.exe
  C:\Windows\System\OQnfMyf.exe
  2⤵
  PID:13564
- C:\Windows\System\WNWwSKe.exe
  C:\Windows\System\WNWwSKe.exe
  2⤵
  PID:13652
- C:\Windows\System\OfJTwut.exe
  C:\Windows\System\OfJTwut.exe
  2⤵
  PID:13720
- C:\Windows\System\qmMKOwi.exe
  C:\Windows\System\qmMKOwi.exe
  2⤵
  PID:13840
- C:\Windows\System\hmuXmhX.exe
  C:\Windows\System\hmuXmhX.exe
  2⤵
  PID:13884
- C:\Windows\System\NqhRmEz.exe
  C:\Windows\System\NqhRmEz.exe
  2⤵
  PID:4372
- C:\Windows\System\WxOmyiC.exe
  C:\Windows\System\WxOmyiC.exe
  2⤵
  PID:13964
- C:\Windows\System\JPfdVcc.exe
  C:\Windows\System\JPfdVcc.exe
  2⤵
  PID:14036
- C:\Windows\System\juDubZt.exe
  C:\Windows\System\juDubZt.exe
  2⤵
  PID:14076
- C:\Windows\System\yOfjWvd.exe
  C:\Windows\System\yOfjWvd.exe
  2⤵
  PID:14204
- C:\Windows\System\NwlwHbj.exe
  C:\Windows\System\NwlwHbj.exe
  2⤵
  PID:14260
- C:\Windows\System\kPUadOi.exe
  C:\Windows\System\kPUadOi.exe
  2⤵
  PID:14308
- C:\Windows\System\aIoHGiN.exe
  C:\Windows\System\aIoHGiN.exe
  2⤵
  PID:13352
- C:\Windows\System\jvlmcPI.exe
  C:\Windows\System\jvlmcPI.exe
  2⤵
  PID:13440
- C:\Windows\System\pCLnWVc.exe
  C:\Windows\System\pCLnWVc.exe
  2⤵
  PID:13680
- C:\Windows\System\ukhyFZc.exe
  C:\Windows\System\ukhyFZc.exe
  2⤵
  PID:13856
- C:\Windows\System\Hsvjaxr.exe
  C:\Windows\System\Hsvjaxr.exe
  2⤵
  PID:14164
- C:\Windows\System\PihPTFD.exe
  C:\Windows\System\PihPTFD.exe
  2⤵
  PID:14156
- C:\Windows\System\GrAQgxE.exe
  C:\Windows\System\GrAQgxE.exe
  2⤵
  PID:13384
- C:\Windows\System\yyEOfnN.exe
  C:\Windows\System\yyEOfnN.exe
  2⤵
  PID:13644
- C:\Windows\System\PEpAcKz.exe
  C:\Windows\System\PEpAcKz.exe
  2⤵
  PID:14084
- C:\Windows\System\aYmJoWp.exe
  C:\Windows\System\aYmJoWp.exe
  2⤵
  PID:14280
- C:\Windows\System\QHPqUAo.exe
  C:\Windows\System\QHPqUAo.exe
  2⤵
  PID:14276
- C:\Windows\System\yanjEoi.exe
  C:\Windows\System\yanjEoi.exe
  2⤵
  PID:14356
- C:\Windows\System\BmxkItk.exe
  C:\Windows\System\BmxkItk.exe
  2⤵
  PID:14372
- C:\Windows\System\fgdhveS.exe
  C:\Windows\System\fgdhveS.exe
  2⤵
  PID:14400
- C:\Windows\System\UKvdAoM.exe
  C:\Windows\System\UKvdAoM.exe
  2⤵
  PID:14420
- C:\Windows\System\kyYsTgY.exe
  C:\Windows\System\kyYsTgY.exe
  2⤵
  PID:14440
- C:\Windows\System\VCUbIZV.exe
  C:\Windows\System\VCUbIZV.exe
  2⤵
  PID:14496
- C:\Windows\System\XkfJJlK.exe
  C:\Windows\System\XkfJJlK.exe
  2⤵
  PID:14520
- C:\Windows\System\ufRXjXm.exe
  C:\Windows\System\ufRXjXm.exe
  2⤵
  PID:14540
- C:\Windows\System\osLmADD.exe
  C:\Windows\System\osLmADD.exe
  2⤵
  PID:14576
- C:\Windows\System\VHmrJyd.exe
  C:\Windows\System\VHmrJyd.exe
  2⤵
  PID:14604
- C:\Windows\System\WHPYUpS.exe
  C:\Windows\System\WHPYUpS.exe
  2⤵
  PID:14624
- C:\Windows\System\criLCiC.exe
  C:\Windows\System\criLCiC.exe
  2⤵
  PID:14640
- C:\Windows\System\WATmRGO.exe
  C:\Windows\System\WATmRGO.exe
  2⤵
  PID:14668
- C:\Windows\System\qlOjjzS.exe
  C:\Windows\System\qlOjjzS.exe
  2⤵
  PID:14688
- C:\Windows\System\kPLvByZ.exe
  C:\Windows\System\kPLvByZ.exe
  2⤵
  PID:14736
- C:\Windows\System\qYmugLO.exe
  C:\Windows\System\qYmugLO.exe
  2⤵
  PID:14756
- C:\Windows\System\zBFrvTl.exe
  C:\Windows\System\zBFrvTl.exe
  2⤵
  PID:14776
- C:\Windows\System\ZPfvJKF.exe
  C:\Windows\System\ZPfvJKF.exe
  2⤵
  PID:14796
- C:\Windows\System\EwSciXx.exe
  C:\Windows\System\EwSciXx.exe
  2⤵
  PID:14824
- C:\Windows\System\QpxLRwh.exe
  C:\Windows\System\QpxLRwh.exe
  2⤵
  PID:14852
- C:\Windows\System\okiUnFB.exe
  C:\Windows\System\okiUnFB.exe
  2⤵
  PID:14872
- C:\Windows\System\cixhudL.exe
  C:\Windows\System\cixhudL.exe
  2⤵
  PID:14904
- C:\Windows\System\PbuLMnp.exe
  C:\Windows\System\PbuLMnp.exe
  2⤵
  PID:14960
- C:\Windows\System\kUPSmff.exe
  C:\Windows\System\kUPSmff.exe
  2⤵
  PID:14984
- C:\Windows\System\ydJmPkR.exe
  C:\Windows\System\ydJmPkR.exe
  2⤵
  PID:15028
- C:\Windows\System\munCMYT.exe
  C:\Windows\System\munCMYT.exe
  2⤵
  PID:15052
- C:\Windows\System\ebMUUMW.exe
  C:\Windows\System\ebMUUMW.exe
  2⤵
  PID:15080
- C:\Windows\System\RKOYNkb.exe
  C:\Windows\System\RKOYNkb.exe
  2⤵
  PID:15112
- C:\Windows\System\khQmyUe.exe
  C:\Windows\System\khQmyUe.exe
  2⤵
  PID:15140
- C:\Windows\System\LxEifFh.exe
  C:\Windows\System\LxEifFh.exe
  2⤵
  PID:15168
- C:\Windows\System\zTqOtEJ.exe
  C:\Windows\System\zTqOtEJ.exe
  2⤵
  PID:15184
- C:\Windows\System\gHiIxTz.exe
  C:\Windows\System\gHiIxTz.exe
  2⤵
  PID:15216
- C:\Windows\System\HhNkYms.exe
  C:\Windows\System\HhNkYms.exe
  2⤵
  PID:15244
- C:\Windows\System\WccHETS.exe
  C:\Windows\System\WccHETS.exe
  2⤵
  PID:15268
- C:\Windows\System\PofaDBS.exe
  C:\Windows\System\PofaDBS.exe
  2⤵
  PID:15308
- C:\Windows\System\ezkNhdP.exe
  C:\Windows\System\ezkNhdP.exe
  2⤵
  PID:15328
- C:\Windows\System\ytacWuH.exe
  C:\Windows\System\ytacWuH.exe
  2⤵
  PID:13988
- C:\Windows\System\lkLrEMR.exe
  C:\Windows\System\lkLrEMR.exe
  2⤵
  PID:14412
- C:\Windows\System\lzDBxZk.exe
  C:\Windows\System\lzDBxZk.exe
  2⤵
  PID:14384
- C:\Windows\System\Gxxuvnm.exe
  C:\Windows\System\Gxxuvnm.exe
  2⤵
  PID:14432
- C:\Windows\System\pxBZmwS.exe
  C:\Windows\System\pxBZmwS.exe
  2⤵
  PID:14516
- C:\Windows\System\cwFeOCQ.exe
  C:\Windows\System\cwFeOCQ.exe
  2⤵
  PID:14620
- C:\Windows\System\jMNsqaY.exe
  C:\Windows\System\jMNsqaY.exe
  2⤵
  PID:14664
- C:\Windows\System\jsYTMXZ.exe
  C:\Windows\System\jsYTMXZ.exe
  2⤵
  PID:14768
- C:\Windows\System\hQHqcET.exe
  C:\Windows\System\hQHqcET.exe
  2⤵
  PID:14808
- C:\Windows\System\qjTzsOi.exe
  C:\Windows\System\qjTzsOi.exe
  2⤵
  PID:14844
- C:\Windows\System\CsnrlLN.exe
  C:\Windows\System\CsnrlLN.exe
  2⤵
  PID:14972
- C:\Windows\System\FYfIWff.exe
  C:\Windows\System\FYfIWff.exe
  2⤵
  PID:15048
- C:\Windows\System\eYWrAOu.exe
  C:\Windows\System\eYWrAOu.exe
  2⤵
  PID:15124
- C:\Windows\System\Lvmbcvj.exe
  C:\Windows\System\Lvmbcvj.exe
  2⤵
  PID:15224
- C:\Windows\System\rCnComB.exe
  C:\Windows\System\rCnComB.exe
  2⤵
  PID:15208
- C:\Windows\System\JFpcMZI.exe
  C:\Windows\System\JFpcMZI.exe
  2⤵
  PID:15300
- C:\Windows\System\gUTTpuk.exe
  C:\Windows\System\gUTTpuk.exe
  2⤵
  PID:15344
- C:\Windows\System\fVbAKCm.exe
  C:\Windows\System\fVbAKCm.exe
  2⤵
  PID:13572
- C:\Windows\System\gdAKRzE.exe
  C:\Windows\System\gdAKRzE.exe
  2⤵
  PID:14488
- C:\Windows\System\ZSWklzT.exe
  C:\Windows\System\ZSWklzT.exe
  2⤵
  PID:14652
- C:\Windows\System\MmXqvXm.exe
  C:\Windows\System\MmXqvXm.exe
  2⤵
  PID:14860
- C:\Windows\System\bGXAlZW.exe
  C:\Windows\System\bGXAlZW.exe
  2⤵
  PID:14956
- C:\Windows\System\iFesMEA.exe
  C:\Windows\System\iFesMEA.exe
  2⤵
  PID:15180
- C:\Windows\System\SvUaAvB.exe
  C:\Windows\System\SvUaAvB.exe
  2⤵
  PID:15232
- C:\Windows\System\UQKeDaS.exe
  C:\Windows\System\UQKeDaS.exe
  2⤵
  PID:14352
- C:\Windows\System\EEeIrGf.exe
  C:\Windows\System\EEeIrGf.exe
  2⤵
  PID:14588
- C:\Windows\System\DZRqoLS.exe
  C:\Windows\System\DZRqoLS.exe
  2⤵
  PID:14940
- C:\Windows\System\lFPsrHh.exe
  C:\Windows\System\lFPsrHh.exe
  2⤵
  PID:15132
- C:\Windows\System\cnVuJOI.exe
  C:\Windows\System\cnVuJOI.exe
  2⤵
  PID:15368
- C:\Windows\System\yaTBooO.exe
  C:\Windows\System\yaTBooO.exe
  2⤵
  PID:15384
- C:\Windows\System\qCRmTxi.exe
  C:\Windows\System\qCRmTxi.exe
  2⤵
  PID:15416
- C:\Windows\System\OpXyfOS.exe
  C:\Windows\System\OpXyfOS.exe
  2⤵
  PID:15440
- C:\Windows\System\dtGDFdR.exe
  C:\Windows\System\dtGDFdR.exe
  2⤵
  PID:15460
- C:\Windows\System\ncBRWwh.exe
  C:\Windows\System\ncBRWwh.exe
  2⤵
  PID:15480
- C:\Windows\System\dhcotTR.exe
  C:\Windows\System\dhcotTR.exe
  2⤵
  PID:15500
- C:\Windows\System\fFZeDuE.exe
  C:\Windows\System\fFZeDuE.exe
  2⤵
  PID:15532
- C:\Windows\System\euDOvqT.exe
  C:\Windows\System\euDOvqT.exe
  2⤵
  PID:15548
- C:\Windows\System\fRGVjFw.exe
  C:\Windows\System\fRGVjFw.exe
  2⤵
  PID:15588
- C:\Windows\System\MUUExhE.exe
  C:\Windows\System\MUUExhE.exe
  2⤵
  PID:15608
- C:\Windows\System\yIHSHfi.exe
  C:\Windows\System\yIHSHfi.exe
  2⤵
  PID:15628
- C:\Windows\System\YJToeix.exe
  C:\Windows\System\YJToeix.exe
  2⤵
  PID:15664
- C:\Windows\System\uvHxBOK.exe
  C:\Windows\System\uvHxBOK.exe
  2⤵
  PID:15684
- C:\Windows\System\zfTwEUX.exe
  C:\Windows\System\zfTwEUX.exe
  2⤵
  PID:15708
- C:\Windows\System\uYbVLxk.exe
  C:\Windows\System\uYbVLxk.exe
  2⤵
  PID:15740
- C:\Windows\System\EguRcxz.exe
  C:\Windows\System\EguRcxz.exe
  2⤵
  PID:15764
- C:\Windows\System\iIPKtUg.exe
  C:\Windows\System\iIPKtUg.exe
  2⤵
  PID:15792
- C:\Windows\System\zpPtzIA.exe
  C:\Windows\System\zpPtzIA.exe
  2⤵
  PID:15808
- C:\Windows\System\CrinKrx.exe
  C:\Windows\System\CrinKrx.exe
  2⤵
  PID:15832
- C:\Windows\System\VIRBtCY.exe
  C:\Windows\System\VIRBtCY.exe
  2⤵
  PID:15860
- C:\Windows\System\mvqybAr.exe
  C:\Windows\System\mvqybAr.exe
  2⤵
  PID:15876
- C:\Windows\System\llAPAUl.exe
  C:\Windows\System\llAPAUl.exe
  2⤵
  PID:15908
- C:\Windows\System\nmftyBl.exe
  C:\Windows\System\nmftyBl.exe
  2⤵
  PID:15932
- C:\Windows\System\yckrVUh.exe
  C:\Windows\System\yckrVUh.exe
  2⤵
  PID:15948
- C:\Windows\System\ditJrHR.exe
  C:\Windows\System\ditJrHR.exe
  2⤵
  PID:15972
- C:\Windows\System\ZhoxbPz.exe
  C:\Windows\System\ZhoxbPz.exe
  2⤵
  PID:16004
- C:\Windows\System\GtJWSOU.exe
  C:\Windows\System\GtJWSOU.exe
  2⤵
  PID:16024
- C:\Windows\System\lCUNCGa.exe
  C:\Windows\System\lCUNCGa.exe
  2⤵
  PID:16048
- C:\Windows\System\nfOHpav.exe
  C:\Windows\System\nfOHpav.exe
  2⤵
  PID:16068
- C:\Windows\System\UaExtfZ.exe
  C:\Windows\System\UaExtfZ.exe
  2⤵
  PID:16092
- C:\Windows\System\GBuupWV.exe
  C:\Windows\System\GBuupWV.exe
  2⤵
  PID:16112
- C:\Windows\System\NVSjXfp.exe
  C:\Windows\System\NVSjXfp.exe
  2⤵
  PID:16136
- C:\Windows\System\VcPsSvJ.exe
  C:\Windows\System\VcPsSvJ.exe
  2⤵
  PID:16160
- C:\Windows\System\VPvMCaY.exe
  C:\Windows\System\VPvMCaY.exe
  2⤵
  PID:16196
- C:\Windows\System\HmYEklL.exe
  C:\Windows\System\HmYEklL.exe
  2⤵
  PID:16216
- C:\Windows\System\xoVlWgW.exe
  C:\Windows\System\xoVlWgW.exe
  2⤵
  PID:16240
- C:\Windows\System\HxuwXPJ.exe
  C:\Windows\System\HxuwXPJ.exe
  2⤵
  PID:16280
- C:\Windows\System\ostBXQP.exe
  C:\Windows\System\ostBXQP.exe
  2⤵
  PID:16312
- C:\Windows\System\ihbLMNz.exe
  C:\Windows\System\ihbLMNz.exe
  2⤵
  PID:16336
- C:\Windows\System\BoamUlI.exe
  C:\Windows\System\BoamUlI.exe
  2⤵
  PID:16364
- C:\Windows\System\WkbyQLC.exe
  C:\Windows\System\WkbyQLC.exe
  2⤵
  PID:14752
- C:\Windows\System\eoIotam.exe
  C:\Windows\System\eoIotam.exe
  2⤵
  PID:15204
- C:\Windows\System\VjohekB.exe
  C:\Windows\System\VjohekB.exe
  2⤵
  PID:15100
- C:\Windows\System\jShYRfp.exe
  C:\Windows\System\jShYRfp.exe
  2⤵
  PID:15396
- C:\Windows\System\waQGhcv.exe
  C:\Windows\System\waQGhcv.exe
  2⤵
  PID:15452
- C:\Windows\System\MTAOoJu.exe
  C:\Windows\System\MTAOoJu.exe
  2⤵
  PID:15600
- C:\Windows\System\zjXbPta.exe
  C:\Windows\System\zjXbPta.exe
  2⤵
  PID:15720
- C:\Windows\System\EfrtaRk.exe
  C:\Windows\System\EfrtaRk.exe
  2⤵
  PID:15676
- C:\Windows\System\yANCiqb.exe
  C:\Windows\System\yANCiqb.exe
  2⤵
  PID:15844
- C:\Windows\System\NBJMkhl.exe
  C:\Windows\System\NBJMkhl.exe
  2⤵
  PID:15784
- C:\Windows\System\WDbKTTm.exe
  C:\Windows\System\WDbKTTm.exe
  2⤵
  PID:15924
- C:\Windows\System\WNjEJos.exe
  C:\Windows\System\WNjEJos.exe
  2⤵
  PID:15988
- C:\Windows\System\lwzfpBS.exe
  C:\Windows\System\lwzfpBS.exe
  2⤵
  PID:16036
- C:\Windows\System\TAmHDWJ.exe
  C:\Windows\System\TAmHDWJ.exe
  2⤵
  PID:16088
- C:\Windows\System\reYetEz.exe
  C:\Windows\System\reYetEz.exe
  2⤵
  PID:16156
- C:\Windows\System\WXrNoEo.exe
  C:\Windows\System\WXrNoEo.exe
  2⤵
  PID:16084
- C:\Windows\System\NByaQST.exe
  C:\Windows\System\NByaQST.exe
  2⤵
  PID:16292
- C:\Windows\System\SulEwTh.exe
  C:\Windows\System\SulEwTh.exe
  2⤵
  PID:6688
- C:\Windows\System\btJkaVq.exe
  C:\Windows\System\btJkaVq.exe
  2⤵
  PID:15436
- C:\Windows\System\IeIkcbZ.exe
  C:\Windows\System\IeIkcbZ.exe
  2⤵
  PID:15520
- C:\Windows\System\SSVrhhS.exe
  C:\Windows\System\SSVrhhS.exe
  2⤵
  PID:16372
- C:\Windows\System\iyVXBZI.exe
  C:\Windows\System\iyVXBZI.exe
  2⤵
  PID:15820
- C:\Windows\System\kbqidbD.exe
  C:\Windows\System\kbqidbD.exe
  2⤵
  PID:16356
- C:\Windows\System\jfEwNrN.exe
  C:\Windows\System\jfEwNrN.exe
  2⤵
  PID:15904
- C:\Windows\System\TOGcMRN.exe
  C:\Windows\System\TOGcMRN.exe
  2⤵
  PID:16152
- C:\Windows\System\qCOtWEi.exe
  C:\Windows\System\qCOtWEi.exe
  2⤵
  PID:16404
- C:\Windows\System\tJUKWgT.exe
  C:\Windows\System\tJUKWgT.exe
  2⤵
  PID:16420
- C:\Windows\System\dhlwEQp.exe
  C:\Windows\System\dhlwEQp.exe
  2⤵
  PID:16448
- C:\Windows\System\eQXCzuI.exe
  C:\Windows\System\eQXCzuI.exe
  2⤵
  PID:16480
- C:\Windows\System\erVtYkO.exe
  C:\Windows\System\erVtYkO.exe
  2⤵
  PID:16504
- C:\Windows\System\mHRCpLL.exe
  C:\Windows\System\mHRCpLL.exe
  2⤵
  PID:16520
- C:\Windows\System\ICBRNtb.exe
  C:\Windows\System\ICBRNtb.exe
  2⤵
  PID:16540
- C:\Windows\System\sMNMmNV.exe
  C:\Windows\System\sMNMmNV.exe
  2⤵
  PID:16564
- C:\Windows\System\PQfPBJG.exe
  C:\Windows\System\PQfPBJG.exe
  2⤵
  PID:16588
- C:\Windows\System\oSzADAt.exe
  C:\Windows\System\oSzADAt.exe
  2⤵
  PID:16616
- C:\Windows\System\ZlPcEjW.exe
  C:\Windows\System\ZlPcEjW.exe
  2⤵
  PID:16636
- C:\Windows\System\OviOFCp.exe
  C:\Windows\System\OviOFCp.exe
  2⤵
  PID:16664
- C:\Windows\System\pweiAZm.exe
  C:\Windows\System\pweiAZm.exe
  2⤵
  PID:16684
- C:\Windows\System\qzjNiMk.exe
  C:\Windows\System\qzjNiMk.exe
  2⤵
  PID:16708
- C:\Windows\System\KKemrkN.exe
  C:\Windows\System\KKemrkN.exe
  2⤵
  PID:16728
- C:\Windows\System\ahedNxB.exe
  C:\Windows\System\ahedNxB.exe
  2⤵
  PID:16752
- C:\Windows\System\XJpwiWV.exe
  C:\Windows\System\XJpwiWV.exe
  2⤵
  PID:16768
- C:\Windows\System\VbVzdTY.exe
  C:\Windows\System\VbVzdTY.exe
  2⤵
  PID:16800
- C:\Windows\System\FZkYAxt.exe
  C:\Windows\System\FZkYAxt.exe
  2⤵
  PID:16824
- C:\Windows\System\UFpxcAX.exe
  C:\Windows\System\UFpxcAX.exe
  2⤵
  PID:16848
- C:\Windows\System\xAKhfMz.exe
  C:\Windows\System\xAKhfMz.exe
  2⤵
  PID:16872
- C:\Windows\System\lNfaidB.exe
  C:\Windows\System\lNfaidB.exe
  2⤵
  PID:16904
- C:\Windows\System\Pihnlvh.exe
  C:\Windows\System\Pihnlvh.exe
  2⤵
  PID:16928
- C:\Windows\System\OyCKHYo.exe
  C:\Windows\System\OyCKHYo.exe
  2⤵
  PID:16952
- C:\Windows\System\kZtNUaP.exe
  C:\Windows\System\kZtNUaP.exe
  2⤵
  PID:16976
- C:\Windows\System\rekLlAY.exe
  C:\Windows\System\rekLlAY.exe
  2⤵
  PID:17000
- C:\Windows\System\ViYdMGL.exe
  C:\Windows\System\ViYdMGL.exe
  2⤵
  PID:17020
- C:\Windows\System\DayACcJ.exe
  C:\Windows\System\DayACcJ.exe
  2⤵
  PID:17040
- C:\Windows\System\TVhtigD.exe
  C:\Windows\System\TVhtigD.exe
  2⤵
  PID:17072
- C:\Windows\System\LQFVDEj.exe
  C:\Windows\System\LQFVDEj.exe
  2⤵
  PID:17092
- C:\Windows\System\kAAUrxq.exe
  C:\Windows\System\kAAUrxq.exe
  2⤵
  PID:17128
- C:\Windows\System\LpInUFS.exe
  C:\Windows\System\LpInUFS.exe
  2⤵
  PID:17144
- C:\Windows\System\zUxpsPl.exe
  C:\Windows\System\zUxpsPl.exe
  2⤵
  PID:17172
- C:\Windows\System\YgTVRlG.exe
  C:\Windows\System\YgTVRlG.exe
  2⤵
  PID:17192
- C:\Windows\System\mUnqvNq.exe
  C:\Windows\System\mUnqvNq.exe
  2⤵
  PID:17328
- C:\Windows\System\zYotdtI.exe
  C:\Windows\System\zYotdtI.exe
  2⤵
  PID:17364
- C:\Windows\System\iGlaJyJ.exe
  C:\Windows\System\iGlaJyJ.exe
  2⤵
  PID:17384
- C:\Windows\System\FppehFQ.exe
  C:\Windows\System\FppehFQ.exe
  2⤵
  PID:17400
- C:\Windows\System\CRAKRCu.exe
  C:\Windows\System\CRAKRCu.exe
  2⤵
  PID:16108
- C:\Windows\System\Cxsjjry.exe
  C:\Windows\System\Cxsjjry.exe
  2⤵
  PID:15960
- C:\Windows\System\dzynOGM.exe
  C:\Windows\System\dzynOGM.exe
  2⤵
  PID:16348
- C:\Windows\System\LozjANY.exe
  C:\Windows\System\LozjANY.exe
  2⤵
  PID:15624
- C:\Windows\System\rxjusTx.exe
  C:\Windows\System\rxjusTx.exe
  2⤵
  PID:16396
- C:\Windows\System\zDUglhJ.exe
  C:\Windows\System\zDUglhJ.exe
  2⤵
  PID:15760
- C:\Windows\System\emBPwJI.exe
  C:\Windows\System\emBPwJI.exe
  2⤵
  PID:16624
- C:\Windows\System\nrrTgKS.exe
  C:\Windows\System\nrrTgKS.exe
  2⤵
  PID:16496
- C:\Windows\System\SgJxGLK.exe
  C:\Windows\System\SgJxGLK.exe
  2⤵
  PID:16532
- C:\Windows\System\ntcqkEJ.exe
  C:\Windows\System\ntcqkEJ.exe
  2⤵
  PID:16740
- C:\Windows\System\vRMNqRl.exe
  C:\Windows\System\vRMNqRl.exe
  2⤵
  PID:16868
- C:\Windows\System\OdRTcmp.exe
  C:\Windows\System\OdRTcmp.exe
  2⤵
  PID:15472
- C:\Windows\System\AzerttY.exe
  C:\Windows\System\AzerttY.exe
  2⤵
  PID:16392
- C:\Windows\System\rxfOgJa.exe
  C:\Windows\System\rxfOgJa.exe
  2⤵
  PID:17288
- C:\Windows\System\FGkdcjX.exe
  C:\Windows\System\FGkdcjX.exe
  2⤵
  PID:15984
- C:\Windows\System\roOrEAc.exe
  C:\Windows\System\roOrEAc.exe
  2⤵
  PID:17232
- C:\Windows\System\eFFFRfO.exe
  C:\Windows\System\eFFFRfO.exe
  2⤵
  PID:16844
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16844 -s 244
    3⤵
    PID:17160
- C:\Windows\System\pMcuECZ.exe
  C:\Windows\System\pMcuECZ.exe
  2⤵
  PID:16948

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ANNpNqG.exe

Filesize
1.5MB

MD5
ead8f2e6a41eb672e5d59248459c076c

SHA1
c06b40195f6b6d23e3cc2db5ae49824fff9207c2

SHA256
dad5c4e8c9aa2c5092bf26de13e76035093ccf8c51e317574f9f46b9335cef06

SHA512
dc32c972496b8e1fd0554d6dd78abc549e002e992dede31963525835229cea724dceeb92aeb16a59b219f3f392ddd6615d2d8737d0fefa6b408036784f029c8a

Download Submit
C:\Windows\System\BigtjMX.exe

Filesize
1.5MB

MD5
8a482144abe2bc7aeac72ffbf3b617e4

SHA1
adbc46f53bffb34175e34a3cb9ff151cbab42872

SHA256
e53c18ca18724aa3a65e6164e50303cd7ad2994568c66e7996126955d97c7766

SHA512
fe1769e019737f34aa91a80e841f9b876186f320a92b0516d8a0dca457e4c68a54be50d8669c9687bceb200e935ca3325e3435448e659f6bd0bfc9b9bec244b7

Download Submit
C:\Windows\System\DPwdZKI.exe

Filesize
1.5MB

MD5
bba16afb1ca8d68d4ea331f1fdcaa722

SHA1
3c02171a64fbb248f157fe6b3a74fcc589b3e7d7

SHA256
6650b65f8a93d2889f2a0507007a96cc004ea48a1acc1ee3b504299884181888

SHA512
19a9c0c2029782640890b7d285c19f363c276c269d50d406d32d32ffc894f687a76ef1e30da4829a60e15627647112c455fd2ab848e2c47e888902c383255463

Download Submit
C:\Windows\System\ESlcGEy.exe

Filesize
1.5MB

MD5
29180068d50ef646e05580794b39e189

SHA1
7d8b73a80ac765aba7e2cb5e337a1da47ddadd7e

SHA256
f7c02ad70bf300dfcbabd69e1efa86ead5d8adf11e4c64e8fee4e6b57170036f

SHA512
0bae815d3f4660a2440e75ebfbd84a8bea482299a00439da9566de862c16f5c13d9a241af29a714c6819db245694d03c2e6774ac015ed79eb3efdd4f14795046

Download Submit
C:\Windows\System\FFiPEDi.exe

Filesize
1.5MB

MD5
7e6805afc198b5b9cb0a76d290bd0e6d

SHA1
74b8aa9da5f1cd7e3feaaec4ae572540be27e77d

SHA256
c7317cd7bcc02a985befbf386679c5c704744d5e5bbf29fa3658a369002991b0

SHA512
efaf33a84774fa1e5a764cef13a978ea48a6d6282e3e85604359610b57fe535854805c7c86ddf6a57f8fcf6badcf8ee50780803739ae20519a2459996a42a9db

Download Submit
C:\Windows\System\FrDGkie.exe

Filesize
1.5MB

MD5
846ea9351dee53f9525b14ccface0cd1

SHA1
18f3513673f2f680d5713fb5aba1b26802d9b8ab

SHA256
579e9bf1103c18d678f5c6a8d31d911634ad3af6a42cce30177f41bc3febfd10

SHA512
9510fd51d81be39697483b2438dccf7154701cb33d06632ec2fca59685741e5983cad03dbc98ee9d7e35960dcf884aa0aba69bedbba4bd76ffbe6349f94f6793

Download Submit
C:\Windows\System\IoCrFzy.exe

Filesize
1.5MB

MD5
09619c6330dec2fa9251d1404edce226

SHA1
03e93d796d61aacaa25d260158921ae6755c7706

SHA256
4e1ed4137d59ce7b8c7af9296ed19c8420518e7398873a5a1d9265683f19a3f3

SHA512
55dd2b105c1fb1a0e559117fe55f85d5dacbf5d03ac510e45c4636ce410e40c2cb714cc84ff5ba9cf894dbe021f7400d4bc7005de61e425ece594d9d2aac5a04

Download Submit
C:\Windows\System\NPOmBle.exe

Filesize
1.5MB

MD5
e16a6fdd9982fdda9d266dde1bd69472

SHA1
badb81babcff87ee080f83531f1e9c818f13bad1

SHA256
6174c618b06ba69a594b2ea7b43963c47cfad7f7d7404c74a07aed5c10e8ac35

SHA512
ce8702d15e94bd53415945a58d27294cceeb205d36e04ef7b54e76ffa18f39661a2edea59e39edd62a7dca86e51624a6b45cd1f220be5558324723c2c383be05

Download Submit
C:\Windows\System\PtuezKb.exe

Filesize
1.5MB

MD5
d30268c429a1b892a0e35fcf720f05d3

SHA1
1269cb98c82644cc1ab3abf55dbf721e7fef5fa0

SHA256
ed75786a22cadd5eeb24fe9e2f211ac380a6d1eb95950d1f387ed7a826386f6e

SHA512
82be1a21db953769169a569bb5919ab598e83862bd7deb166ad8941c1247f94d74ebda9855f6d0dfc321e8082f30e67bd7429ad7d0ef061d3c7657a6247d7119

Download Submit
C:\Windows\System\QzPVmoT.exe

Filesize
1.5MB

MD5
cd7237f2f3b2ab26d858ccfb79f20d2e

SHA1
97f22cda4329a0cf2cef7d237556b21450a51677

SHA256
389c1e6b55706f5060db47f61e9b184d2e02dee51466ab29b6e2d2f82c11b4f1

SHA512
e6f53693f8ea34b6e5ab6d1114807ba9e1ba50220fdbfcde10591bd10343964b531eddc2a919d1b72cae35e656cc1b3e8e5c8a1142afd4ae88e8c78013cc86db

Download Submit
C:\Windows\System\SPoBNmS.exe

Filesize
1.5MB

MD5
c120dd299e81b8af9e5f21d52ec1e066

SHA1
278f6008933b497ad767662329e68a0580c0c95f

SHA256
4757038eea7970d5277ba12b4672137349ee88b6cf21c5d815bd071437b02d76

SHA512
97cce0bf3714ab9d048a80a20f35b0d6f3226e394a0c1b286ff2e012b3a10b5d3efdd50c08a6693ecc23217ec166cdee9588aecfd1778e98b498dedfa081ba5b

Download Submit
C:\Windows\System\SkxJavw.exe

Filesize
1.5MB

MD5
ff31e6ff3c49446772c646a312267ebe

SHA1
a5a37875b165ab49a1ca5c91b4dc89f049076811

SHA256
908d80612e9b1938a657dcf1f9cf4e17a13f09434e355172c04a611d36ee40fb

SHA512
4902b1f1538973d2b4b0ae441ed50229a1031b56857b3ed4eff24447f241b0b33bd3358feade12451498c6ec3eb3747c91a9a209d3b4dee675b20aaf5f17eaa4

Download Submit
C:\Windows\System\TWRjBea.exe

Filesize
1.5MB

MD5
90d8674bbe989e3e07125afb45608e6b

SHA1
572b5d60f7ae33ace77cb777cac2f1cbc2d667cf

SHA256
b2952c30ec7fc766d4ac5cbeff85fa1d7843b6bad7ad8a047a086f0bfe4d7330

SHA512
68f20143921f18077439116351323d81fb79ccc6c8d3894bf19ed14efd5a1a34ee927213424b5f1b3604d1d8ca17a13118c45889d38ec80abee6af9a0de5b96e

Download Submit
C:\Windows\System\VATRThA.exe

Filesize
1.5MB

MD5
8434faf90f95cc13f03bb1cc196b12bc

SHA1
ae48c3e121ab7ea5e080ca49627aef1bf57ef463

SHA256
78e39ec33d1df4aec864eb4e2e1b59730f4e36d0e2dde15cf6261af0d9ab9d5c

SHA512
036b2f0a0b996c6fd32f3a0cb0d79cab939b34b1dda8fa9c4f253907fb7c284782cf5568d0789bf53b586117bb08ae59233e7d030bf38258f2afb6c86669a391

Download Submit
C:\Windows\System\VQNJjzy.exe

Filesize
1.5MB

MD5
f84e21f5c6c053a218ff8d43d122b864

SHA1
48ba740f8b654911f2d0268068149616169aa490

SHA256
cb3fd209ad8f1e0d04682d1768af165d7e04a5c3ce24175967cd4f1c882c9ad6

SHA512
ef406857807b730cf5df6fa92973d3550bc429b4c93fba4bacf8127f89e5d974674013d66456baeb2c012cd530b6b3bee3c169827927217e7534be9ff2492458

Download Submit
C:\Windows\System\XxdcxhM.exe

Filesize
1.5MB

MD5
c467adfad1f1694110adea1f3749aeec

SHA1
70b10c8faa4f073a2648e27f078777d6823be532

SHA256
0d1297031f4bec3c54f684caa803d1032de4949356e6acea1b5eb0342b9121c8

SHA512
3d670dfec1875e37a920ba6ae5a74b550f83877dbd43c1d71b0ed63febcb07946218577d6e7016baf9f166d0455038204598912ab9b290e96cac317820c5171e

Download Submit
C:\Windows\System\YgIwlYF.exe

Filesize
1.5MB

MD5
9e77be5b36bbbc037c56c2204e86333c

SHA1
fbf4213d1bdc7412e1ae932e676e0829fbe3c28e

SHA256
6706b22c7033a7b2f79ad5baaa23ddff128caa87513293b0d27ea2b3262ca89d

SHA512
fcb925cbc6100bf30e2e860e7a7a7866edaad9f69af5444ca06e5ca78f863e93afab6100abee8c9edd77110372dc0212e389281278e40fb41fd772cf1301f195

Download Submit
C:\Windows\System\ZIKnren.exe

Filesize
1.5MB

MD5
a69de49e962c94d10e360368cf7285b7

SHA1
e04d88c6e43ff9c1c39ab7a71cc66b0b224db612

SHA256
ee0d72a3d4eab586810a81e39027c267ba5886bd0bdd60c01297bb89c8838a08

SHA512
37da241ed513397fbab9082d82dbef672061a3c1ae5f5c84aea2a21e1c4849e383c44dd178cafb9a522625abbfe4a4f8457ed60783e3dda1558984e8ccdfc89a

Download Submit
C:\Windows\System\hGgmmPW.exe

Filesize
1.5MB

MD5
dbfe29a905d2acf58bac660014ec3974

SHA1
b2f4f19a2831f3be8eeaa8eaff039783c03a2c9f

SHA256
c6158dbd49805ff155051913a48970761cdb390029170803a18371168f624110

SHA512
ff0c5a9895c91d6d6c8ce2e29aa4892920eded4328cc7ffdc2522e10820b10dd767c282c077857160dc12edffefae6c0c548213bf2771617988683823ee1c59c

Download Submit
C:\Windows\System\jgenHBJ.exe

Filesize
1.5MB

MD5
9d137953410c79be29c1bdb9bef69023

SHA1
1109f34f96d305501b571c27c615578fe302a68a

SHA256
876b66518631f5fc62d53f859dd5b3bf277fa4712b914b77484861b24e9cac5f

SHA512
d27f29836c6c69745ad6d3a18aadf70f83b8fc68f623f46a5f3bfe0a12e4d6f286417d20edbc4abe53b5bafd277bd608253ad9e19c1f4840e8289aa46c61e3f7

Download Submit
C:\Windows\System\kMaTbCk.exe

Filesize
1.5MB

MD5
cc49f13ffb02ded2715990ba0db96723

SHA1
22f22210903bc2d6eeffb1736503072d341ec0df

SHA256
7e2db149348d00597ef2b8fe4e76d506f31269c121f000dee1507feb579dd7ed

SHA512
def712f67e4901a8cd54877e3aef91c827bb92072813c74b693372b9e37f72d8609b42da59b2645057d2a92ad6a096c4e3c8c651acb99ebdb6d65832403c65d4

Download Submit
C:\Windows\System\ljVPnYT.exe

Filesize
1.5MB

MD5
4c9c17a88cebaa90e7817483c0a2b277

SHA1
ff1cf3d8dede49ef08dad12da621db8384e05ca9

SHA256
2d713b67e7f1ffc0b75da7df081a6e21a193d96dbe137053a760f039a1d9a4a2

SHA512
098034fa40a689b30b57e707bafd1bd5a93ebc8ad438423de94d263c23d0879a4cf1c2fdcba54fb1c582f58870948bd574f6119aba50287bfaf54e7fc0f85fef

Download Submit
C:\Windows\System\lpYXvsw.exe

Filesize
1.5MB

MD5
80f04bf7358523e8a63a46212ccd49e1

SHA1
7e702871915520b69c2ff65c8bdb8d395b2b2228

SHA256
8a12b45aa4f62812d6e27b016880353253e2d409aa61a400371eb3b3dcb480a6

SHA512
8e108bd1c10cbc8ba1d1bf6112927263f7aee9e802c5f338027b67294f59e79e33c4ec73a3a9d4639edd58cd7a940b368861133073a1311046e975a2fc6b1a1e

Download Submit
C:\Windows\System\maIxkku.exe

Filesize
1.5MB

MD5
613d88dbd68963a6e360aa4306ea9977

SHA1
abd48a96c41918ad7e31e7a6f6003d7d37fefcb0

SHA256
f5ac29df9945593a8abe066d653ceb62f19d2fa56c122a25f9b41106daaf61e9

SHA512
9f143630822d65429bdb58136127321c9d4ad1855970b214e576f23d84dd0b3824e4632bdb5583f1449cfda025656191aff48704765cf359b8835de9d7fc1a82

Download Submit
C:\Windows\System\mhYLjWp.exe

Filesize
1.5MB

MD5
c1e31ddf1a26a48030ac8ca2a4edbf69

SHA1
1dd5b962ad9383eec0ed48b7d7656a961fe8d507

SHA256
e535eb4ca8cb8ff28c3e9a1658620b75f3545abc3a54043a5968a43f4f9d14ba

SHA512
5921e874f46d6e5101de87ba735b221278d3310729b53559862786f9876cfd16ba9bbb20a3a19fa26f6a27d57f1549db982c753a42f82ec4ea44c74d6bb43e43

Download Submit
C:\Windows\System\oVKRqlo.exe

Filesize
1.5MB

MD5
5e4e3fca8a85616a632bf57a9582641f

SHA1
658705798233f4bf4dc6750dc5f6ecb69c5d5d87

SHA256
75fde2bc46e49749a854ac049e7cff85910fc4e034ab19288dae88887ea1b771

SHA512
3801e9f342b53551c0640ff9747ffe9b09dcc9a868b9de5a9ff323588925f75c766e0cb2ac173d677608de947a4025f4e538dd7cd4ad785406ee9d6d38a117e6

Download Submit
C:\Windows\System\pEgTdzM.exe

Filesize
1.5MB

MD5
61c5554e2df98733bb2996332ebac008

SHA1
a39460d69e597d64b9954b5a5a0ee47cd50512ea

SHA256
1a962f9d8492b646e628e228ea633d234c0b0863d0e1e816cf8e5bc2b16e4a72

SHA512
c5e9aead6ae00f9653d1a61eb8a80d673a61289a093df020089fdaf88f530e6b349185feb3e3d9a57b62f61567b4b1136674f025b2184e98142ddcf0e88a76b2

Download Submit
C:\Windows\System\qumcpyG.exe

Filesize
1.5MB

MD5
d8f648df97cf7c0a796a1cc13276781e

SHA1
e87faa8e0cacbf53fb873ecf2b3c82f5a8b597c0

SHA256
c34f790204e522367a4656586e847477367d3deea842e3d9aef1820d1e89c6e4

SHA512
11f2a5f0630c9a4f26d387494d48f4cef7aefd78ec84f55708c23ded0effe30809fb966e98e6a0a9bcbe71037c7f6611192ffa837acab4e704487097e8425e93

Download Submit
C:\Windows\System\tVJLsmZ.exe

Filesize
1.5MB

MD5
b70076e00a5bbe76399da183a09968b4

SHA1
a0e4e0153920a73141c4cddda9c2e16670ee0189

SHA256
80bd69f605823c532acd7d7a1264dfcaac872d78d8d8d5c0ff8f5a830560f7e9

SHA512
a3d89aee63f14cdf43dc16163d34ce141d7149e7350cdacd5cca9a679f05da9670aebca9378cc46efcdbc95a77adaf049c16465752b40a4aa146657fbc4e6235

Download Submit
C:\Windows\System\tXnXEwX.exe

Filesize
1.5MB

MD5
7559bab75da4341d35713100d94d437a

SHA1
53072861725c9b68b4c4c8df2fc4960ac131509c

SHA256
a622fe5daa4cdb7185dc6519f76b24265a72cdcd9b300f33a0e1d18550d6a415

SHA512
77b083dc16edb431fde0d18dc668b868ad2d04bb28e82e23e63adb139494d955973864969ebc641c429733a5a07d1a64c750ac602a2afa5b7a5a345b64aa5c58

Download Submit
C:\Windows\System\vCnZOTJ.exe

Filesize
1.5MB

MD5
6af9a5fca10fa925dfd3ef7992beb3eb

SHA1
e98a91b6626fad3752497c74a6cdab215bf9c12d

SHA256
40ffb5e9e24592d67c7d72514210cd9fa53f7d64fee24e76c8bd9722e1894702

SHA512
08d5fd36f45485da93847bf5dd8cf8c0499592f678df3dd6d2e00922ce67d0012c0bf47faa1ee348b52a5aa794ac0c783e0a32213e3c7bf65aba49f81614a7be

Download Submit
C:\Windows\System\yZpDEWW.exe

Filesize
1.5MB

MD5
e73b6c9c95304fbd360457d36bbc30d2

SHA1
e539ac032b4f7bb220321672f0e0a04607ae9e1c

SHA256
c94b0f4b38ab68c3f67ce44419ad976b922ca06dc42250865bc36792769f1ebb

SHA512
daa468c496215ac6ae80a09afe8badfdf8801986d201d3d2f1a3f8994700a53273bdddcb768a1356ba20493ce0ce6ff8a51a1037fe0d4fdd3f8679d0325fdebc

Download Submit
memory/868-0-0x00000196BCF00000-0x00000196BCF10000-memory.dmp

Filesize
64KB

Download