xmrig | 666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2

Analysis

max time kernel
110s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
Size

1.7MB
MD5

cd9847f305b03dd0f51179d36d0d6d4f
SHA1

36e27307ce04cddeb727c860eb6ed711d7435f9d
SHA256

666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2
SHA512

3cb98de807b3a378957089c36bf01693badce47b0a1aea6937f3040340316d75b523e2524ba030099fd501e012ef3353ea3fd19d71cc9132fa61ee9f8e3ba18b
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ8zoW:GemTLkNdfE0pZyr

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023bb9-4.dat	xmrig
behavioral2/files/0x0007000000023c86-8.dat	xmrig
behavioral2/files/0x0007000000023c87-18.dat	xmrig
behavioral2/files/0x0008000000023c82-10.dat	xmrig
behavioral2/files/0x0007000000023c88-23.dat	xmrig
behavioral2/files/0x0007000000023c8b-36.dat	xmrig
behavioral2/files/0x0007000000023c8c-37.dat	xmrig
behavioral2/files/0x0007000000023c8d-48.dat	xmrig
behavioral2/files/0x0007000000023c8f-55.dat	xmrig
behavioral2/files/0x0007000000023c95-74.dat	xmrig
behavioral2/files/0x0007000000023c91-97.dat	xmrig
behavioral2/files/0x0007000000023c99-115.dat	xmrig
behavioral2/files/0x0007000000023c9a-133.dat	xmrig
behavioral2/files/0x0007000000023ca8-169.dat	xmrig
behavioral2/files/0x0007000000023ca9-172.dat	xmrig
behavioral2/files/0x0007000000023ca7-166.dat	xmrig
behavioral2/files/0x0007000000023ca6-165.dat	xmrig
behavioral2/files/0x0007000000023ca3-162.dat	xmrig
behavioral2/files/0x0007000000023c9c-141.dat	xmrig
behavioral2/files/0x0007000000023ca1-158.dat	xmrig
behavioral2/files/0x0007000000023ca0-148.dat	xmrig
behavioral2/files/0x0007000000023c9f-144.dat	xmrig
behavioral2/files/0x0007000000023c9b-142.dat	xmrig
behavioral2/files/0x0007000000023c9e-139.dat	xmrig
behavioral2/files/0x0007000000023ca2-136.dat	xmrig
behavioral2/files/0x0007000000023c9d-132.dat	xmrig
behavioral2/files/0x0007000000023c98-124.dat	xmrig
behavioral2/files/0x0007000000023c97-120.dat	xmrig
behavioral2/files/0x0007000000023c96-107.dat	xmrig
behavioral2/files/0x0007000000023c92-96.dat	xmrig
behavioral2/files/0x0007000000023c90-83.dat	xmrig
behavioral2/files/0x0007000000023c94-79.dat	xmrig
behavioral2/files/0x0007000000023c93-75.dat	xmrig
behavioral2/files/0x0007000000023c8e-50.dat	xmrig
behavioral2/files/0x0007000000023c89-30.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2836	ZhJCyTR.exe
400	aPoRZRH.exe
1428	tpiKHjZ.exe
980	wLGYIOT.exe
2144	CFnkTdr.exe
4296	IIyDlMS.exe
2844	mGnQMte.exe
4204	bbjdzXP.exe
3000	IduwGsm.exe
1792	zGQOJhk.exe
912	NGXMDmy.exe
2272	JadtFZq.exe
2832	uHPwxEP.exe
5052	NxFJtaF.exe
2828	MAhMEzQ.exe
4728	OQiCVYf.exe
2632	OKpKQZT.exe
3560	aJZjNxD.exe
3700	KZYCATg.exe
4824	SDRdQxP.exe
3980	lSbRuCs.exe
3684	JfnPhIi.exe
1760	TKKDctc.exe
4484	ELvSYoD.exe
736	ZGOsjZc.exe
2448	ubhXGwZ.exe
4512	GxpmNda.exe
4316	CzgrBlQ.exe
1028	qvfeetF.exe
3468	dwtLeaY.exe
2684	eNBmBsg.exe
1800	jwlsHAC.exe
4588	jEtJiQg.exe
4580	wzmEbki.exe
2760	IKEwguT.exe
2584	GdivkFm.exe
3692	eyFpESO.exe
896	yhxFhjC.exe
3656	XvtiAFa.exe
1448	SiPgXOQ.exe
3616	dvcjDMp.exe
3288	mLGgqMx.exe
4012	PhUWtMs.exe
1772	gIGhgvY.exe
3472	PJGQbZg.exe
640	fPMqRur.exe
4240	GLthVPQ.exe
3772	yBMPizl.exe
3804	HnnwtBg.exe
1212	AgqkJCC.exe
2312	tbIcTwU.exe
1628	xWbBpCD.exe
1480	QLIFlXe.exe
4420	LAAsdYn.exe
4564	XCxiWDm.exe
4176	oCqBEAV.exe
4292	xfcHKqT.exe
1232	LGJfRzX.exe
532	ixNkwAV.exe
3540	LKSeHqw.exe
2408	ccDBeFc.exe
3592	jGKTjHP.exe
1168	Aufzyfi.exe
2468	zrJsORo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VzrEznt.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\tIdCWRN.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\gUkrcaD.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\ALiSMBr.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\soXaNXD.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\kRrfxSo.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\NqEHUZo.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\aFMqPxt.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\RCwSjgG.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\CtpRENu.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\DsDzcEW.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\QKEYGJm.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\abugYto.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\SybfDKe.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\aJZjNxD.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\bSBhdcN.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\jzIdbfE.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\kYjEMPG.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\IvSYrDW.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\UzsdNSn.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\LATXbtD.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\mYdlsdF.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\kihkygu.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\ruRsBdq.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\kAvMyrK.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\jDSuMGy.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\LAAsdYn.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\HXtCLmn.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\aNuSpku.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\wQtItdO.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\oDgZzDf.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\sfwKyqJ.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\nMRrNXX.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\ELvSYoD.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\XKbSxFt.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\hlUvWAX.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\JSrwjgX.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\DrPCZym.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\YdWpHGT.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\TBrHbEk.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\QLIFlXe.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\xhLANyE.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\oGXbdvH.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\GdwBWFv.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\QVRDNXh.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\MHKafPs.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\CWYwlwl.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\YTWGccZ.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\hCtiAju.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\qtlrGKT.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\wBsXzEz.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\xfQazrr.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\nMwjpng.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\JadtFZq.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\uIBfLMw.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\fpTjumd.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\RCLzNUm.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\cmUqNpW.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\QrZzuUp.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\WQMBlcN.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\mURXEQB.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\HngCouD.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\WTqGmoy.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
File created	C:\Windows\System\KWbMGnM.exe	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1620	dwm.exe
Token: SeChangeNotifyPrivilege	1620	dwm.exe
Token: 33	1620	dwm.exe
Token: SeIncBasePriorityPrivilege	1620	dwm.exe
Token: SeShutdownPrivilege	1620	dwm.exe
Token: SeCreatePagefilePrivilege	1620	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 2836	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	84
PID 432 wrote to memory of 2836	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	84
PID 432 wrote to memory of 400	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	85
PID 432 wrote to memory of 400	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	85
PID 432 wrote to memory of 1428	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	86
PID 432 wrote to memory of 1428	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	86
PID 432 wrote to memory of 980	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	87
PID 432 wrote to memory of 980	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	87
PID 432 wrote to memory of 2144	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	88
PID 432 wrote to memory of 2144	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	88
PID 432 wrote to memory of 4296	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	89
PID 432 wrote to memory of 4296	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	89
PID 432 wrote to memory of 2844	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	90
PID 432 wrote to memory of 2844	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	90
PID 432 wrote to memory of 4204	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	91
PID 432 wrote to memory of 4204	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	91
PID 432 wrote to memory of 3000	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	92
PID 432 wrote to memory of 3000	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	92
PID 432 wrote to memory of 1792	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	93
PID 432 wrote to memory of 1792	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	93
PID 432 wrote to memory of 912	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	94
PID 432 wrote to memory of 912	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	94
PID 432 wrote to memory of 2272	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	95
PID 432 wrote to memory of 2272	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	95
PID 432 wrote to memory of 2832	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	96
PID 432 wrote to memory of 2832	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	96
PID 432 wrote to memory of 5052	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	97
PID 432 wrote to memory of 5052	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	97
PID 432 wrote to memory of 2828	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	98
PID 432 wrote to memory of 2828	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	98
PID 432 wrote to memory of 4728	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	99
PID 432 wrote to memory of 4728	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	99
PID 432 wrote to memory of 2632	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	100
PID 432 wrote to memory of 2632	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	100
PID 432 wrote to memory of 3560	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	101
PID 432 wrote to memory of 3560	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	101
PID 432 wrote to memory of 3700	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	102
PID 432 wrote to memory of 3700	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	102
PID 432 wrote to memory of 4824	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	103
PID 432 wrote to memory of 4824	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	103
PID 432 wrote to memory of 3980	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	104
PID 432 wrote to memory of 3980	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	104
PID 432 wrote to memory of 3684	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	105
PID 432 wrote to memory of 3684	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	105
PID 432 wrote to memory of 1760	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	106
PID 432 wrote to memory of 1760	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	106
PID 432 wrote to memory of 4484	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	107
PID 432 wrote to memory of 4484	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	107
PID 432 wrote to memory of 1028	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	108
PID 432 wrote to memory of 1028	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	108
PID 432 wrote to memory of 736	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	109
PID 432 wrote to memory of 736	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	109
PID 432 wrote to memory of 2448	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	110
PID 432 wrote to memory of 2448	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	110
PID 432 wrote to memory of 4512	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	111
PID 432 wrote to memory of 4512	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	111
PID 432 wrote to memory of 4316	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	112
PID 432 wrote to memory of 4316	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	112
PID 432 wrote to memory of 3468	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	113
PID 432 wrote to memory of 3468	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	113
PID 432 wrote to memory of 2684	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	114
PID 432 wrote to memory of 2684	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	114
PID 432 wrote to memory of 2584	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	115
PID 432 wrote to memory of 2584	432	666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe	115

C:\Users\Admin\AppData\Local\Temp\666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe
"C:\Users\Admin\AppData\Local\Temp\666cbedfd8a024b291a5189d09243fc083017ad62baed0692481eab8def23ff2.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\System\ZhJCyTR.exe
  C:\Windows\System\ZhJCyTR.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\aPoRZRH.exe
  C:\Windows\System\aPoRZRH.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\tpiKHjZ.exe
  C:\Windows\System\tpiKHjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\wLGYIOT.exe
  C:\Windows\System\wLGYIOT.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\CFnkTdr.exe
  C:\Windows\System\CFnkTdr.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\IIyDlMS.exe
  C:\Windows\System\IIyDlMS.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\mGnQMte.exe
  C:\Windows\System\mGnQMte.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\bbjdzXP.exe
  C:\Windows\System\bbjdzXP.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\IduwGsm.exe
  C:\Windows\System\IduwGsm.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\zGQOJhk.exe
  C:\Windows\System\zGQOJhk.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\NGXMDmy.exe
  C:\Windows\System\NGXMDmy.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\JadtFZq.exe
  C:\Windows\System\JadtFZq.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\uHPwxEP.exe
  C:\Windows\System\uHPwxEP.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\NxFJtaF.exe
  C:\Windows\System\NxFJtaF.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\MAhMEzQ.exe
  C:\Windows\System\MAhMEzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\OQiCVYf.exe
  C:\Windows\System\OQiCVYf.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\OKpKQZT.exe
  C:\Windows\System\OKpKQZT.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\aJZjNxD.exe
  C:\Windows\System\aJZjNxD.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\KZYCATg.exe
  C:\Windows\System\KZYCATg.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\SDRdQxP.exe
  C:\Windows\System\SDRdQxP.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\lSbRuCs.exe
  C:\Windows\System\lSbRuCs.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\JfnPhIi.exe
  C:\Windows\System\JfnPhIi.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\TKKDctc.exe
  C:\Windows\System\TKKDctc.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ELvSYoD.exe
  C:\Windows\System\ELvSYoD.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\qvfeetF.exe
  C:\Windows\System\qvfeetF.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\ZGOsjZc.exe
  C:\Windows\System\ZGOsjZc.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\ubhXGwZ.exe
  C:\Windows\System\ubhXGwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\GxpmNda.exe
  C:\Windows\System\GxpmNda.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\CzgrBlQ.exe
  C:\Windows\System\CzgrBlQ.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\dwtLeaY.exe
  C:\Windows\System\dwtLeaY.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\eNBmBsg.exe
  C:\Windows\System\eNBmBsg.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\GdivkFm.exe
  C:\Windows\System\GdivkFm.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\mLGgqMx.exe
  C:\Windows\System\mLGgqMx.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\jwlsHAC.exe
  C:\Windows\System\jwlsHAC.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\jEtJiQg.exe
  C:\Windows\System\jEtJiQg.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\wzmEbki.exe
  C:\Windows\System\wzmEbki.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\IKEwguT.exe
  C:\Windows\System\IKEwguT.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\eyFpESO.exe
  C:\Windows\System\eyFpESO.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\yhxFhjC.exe
  C:\Windows\System\yhxFhjC.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\XvtiAFa.exe
  C:\Windows\System\XvtiAFa.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\SiPgXOQ.exe
  C:\Windows\System\SiPgXOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\dvcjDMp.exe
  C:\Windows\System\dvcjDMp.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\PhUWtMs.exe
  C:\Windows\System\PhUWtMs.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\gIGhgvY.exe
  C:\Windows\System\gIGhgvY.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\PJGQbZg.exe
  C:\Windows\System\PJGQbZg.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\fPMqRur.exe
  C:\Windows\System\fPMqRur.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\GLthVPQ.exe
  C:\Windows\System\GLthVPQ.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\yBMPizl.exe
  C:\Windows\System\yBMPizl.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\HnnwtBg.exe
  C:\Windows\System\HnnwtBg.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\AgqkJCC.exe
  C:\Windows\System\AgqkJCC.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\tbIcTwU.exe
  C:\Windows\System\tbIcTwU.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\xWbBpCD.exe
  C:\Windows\System\xWbBpCD.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\QLIFlXe.exe
  C:\Windows\System\QLIFlXe.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\LAAsdYn.exe
  C:\Windows\System\LAAsdYn.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\XCxiWDm.exe
  C:\Windows\System\XCxiWDm.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\oCqBEAV.exe
  C:\Windows\System\oCqBEAV.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\xfcHKqT.exe
  C:\Windows\System\xfcHKqT.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\LGJfRzX.exe
  C:\Windows\System\LGJfRzX.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\ixNkwAV.exe
  C:\Windows\System\ixNkwAV.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\LKSeHqw.exe
  C:\Windows\System\LKSeHqw.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\ccDBeFc.exe
  C:\Windows\System\ccDBeFc.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\jGKTjHP.exe
  C:\Windows\System\jGKTjHP.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\Aufzyfi.exe
  C:\Windows\System\Aufzyfi.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\zrJsORo.exe
  C:\Windows\System\zrJsORo.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\eXyLYbQ.exe
  C:\Windows\System\eXyLYbQ.exe
  2⤵
  PID:3576
- C:\Windows\System\bSBhdcN.exe
  C:\Windows\System\bSBhdcN.exe
  2⤵
  PID:1596
- C:\Windows\System\WlxNCUw.exe
  C:\Windows\System\WlxNCUw.exe
  2⤵
  PID:436
- C:\Windows\System\LgDcQzj.exe
  C:\Windows\System\LgDcQzj.exe
  2⤵
  PID:3156
- C:\Windows\System\kYegury.exe
  C:\Windows\System\kYegury.exe
  2⤵
  PID:3024
- C:\Windows\System\AeMnOCU.exe
  C:\Windows\System\AeMnOCU.exe
  2⤵
  PID:4536
- C:\Windows\System\tIJFkaU.exe
  C:\Windows\System\tIJFkaU.exe
  2⤵
  PID:4812
- C:\Windows\System\OrAvUvH.exe
  C:\Windows\System\OrAvUvH.exe
  2⤵
  PID:4192
- C:\Windows\System\HpBjrXC.exe
  C:\Windows\System\HpBjrXC.exe
  2⤵
  PID:1904
- C:\Windows\System\rXCCmmX.exe
  C:\Windows\System\rXCCmmX.exe
  2⤵
  PID:3588
- C:\Windows\System\plykbLR.exe
  C:\Windows\System\plykbLR.exe
  2⤵
  PID:2040
- C:\Windows\System\effkAew.exe
  C:\Windows\System\effkAew.exe
  2⤵
  PID:556
- C:\Windows\System\adnFHdN.exe
  C:\Windows\System\adnFHdN.exe
  2⤵
  PID:1408
- C:\Windows\System\erUtspI.exe
  C:\Windows\System\erUtspI.exe
  2⤵
  PID:5044
- C:\Windows\System\emftWYm.exe
  C:\Windows\System\emftWYm.exe
  2⤵
  PID:2180
- C:\Windows\System\yOSbhuJ.exe
  C:\Windows\System\yOSbhuJ.exe
  2⤵
  PID:1364
- C:\Windows\System\AjnMZhF.exe
  C:\Windows\System\AjnMZhF.exe
  2⤵
  PID:1528
- C:\Windows\System\bjsRcUD.exe
  C:\Windows\System\bjsRcUD.exe
  2⤵
  PID:1956
- C:\Windows\System\wJQtjxP.exe
  C:\Windows\System\wJQtjxP.exe
  2⤵
  PID:4576
- C:\Windows\System\nlgFhbY.exe
  C:\Windows\System\nlgFhbY.exe
  2⤵
  PID:3348
- C:\Windows\System\SrlvtTb.exe
  C:\Windows\System\SrlvtTb.exe
  2⤵
  PID:3936
- C:\Windows\System\qMOYNRc.exe
  C:\Windows\System\qMOYNRc.exe
  2⤵
  PID:3696
- C:\Windows\System\LMyvkRH.exe
  C:\Windows\System\LMyvkRH.exe
  2⤵
  PID:5060
- C:\Windows\System\iHrmMXc.exe
  C:\Windows\System\iHrmMXc.exe
  2⤵
  PID:1484
- C:\Windows\System\CTLfzsm.exe
  C:\Windows\System\CTLfzsm.exe
  2⤵
  PID:4976
- C:\Windows\System\WzteDru.exe
  C:\Windows\System\WzteDru.exe
  2⤵
  PID:5100
- C:\Windows\System\WuIvQdX.exe
  C:\Windows\System\WuIvQdX.exe
  2⤵
  PID:2440
- C:\Windows\System\kBhQkqM.exe
  C:\Windows\System\kBhQkqM.exe
  2⤵
  PID:3244
- C:\Windows\System\BEDTpZH.exe
  C:\Windows\System\BEDTpZH.exe
  2⤵
  PID:2984
- C:\Windows\System\DiySelz.exe
  C:\Windows\System\DiySelz.exe
  2⤵
  PID:376
- C:\Windows\System\aZcFeQe.exe
  C:\Windows\System\aZcFeQe.exe
  2⤵
  PID:4376
- C:\Windows\System\MSZBgGV.exe
  C:\Windows\System\MSZBgGV.exe
  2⤵
  PID:1816
- C:\Windows\System\ChWmkok.exe
  C:\Windows\System\ChWmkok.exe
  2⤵
  PID:836
- C:\Windows\System\gKKqZLB.exe
  C:\Windows\System\gKKqZLB.exe
  2⤵
  PID:3444
- C:\Windows\System\kjMmGyo.exe
  C:\Windows\System\kjMmGyo.exe
  2⤵
  PID:936
- C:\Windows\System\NjrZztv.exe
  C:\Windows\System\NjrZztv.exe
  2⤵
  PID:4816
- C:\Windows\System\RrqtKGo.exe
  C:\Windows\System\RrqtKGo.exe
  2⤵
  PID:2524
- C:\Windows\System\JHKhiIU.exe
  C:\Windows\System\JHKhiIU.exe
  2⤵
  PID:3052
- C:\Windows\System\uAUuIJQ.exe
  C:\Windows\System\uAUuIJQ.exe
  2⤵
  PID:4600
- C:\Windows\System\ykDWbuP.exe
  C:\Windows\System\ykDWbuP.exe
  2⤵
  PID:3056
- C:\Windows\System\SPUCKvz.exe
  C:\Windows\System\SPUCKvz.exe
  2⤵
  PID:4904
- C:\Windows\System\wBsXzEz.exe
  C:\Windows\System\wBsXzEz.exe
  2⤵
  PID:2228
- C:\Windows\System\gtWCorS.exe
  C:\Windows\System\gtWCorS.exe
  2⤵
  PID:3152
- C:\Windows\System\iWCLtlE.exe
  C:\Windows\System\iWCLtlE.exe
  2⤵
  PID:2800
- C:\Windows\System\XaWbiPf.exe
  C:\Windows\System\XaWbiPf.exe
  2⤵
  PID:1532
- C:\Windows\System\puxmKnE.exe
  C:\Windows\System\puxmKnE.exe
  2⤵
  PID:2936
- C:\Windows\System\ogDbjQH.exe
  C:\Windows\System\ogDbjQH.exe
  2⤵
  PID:868
- C:\Windows\System\wiHFZoS.exe
  C:\Windows\System\wiHFZoS.exe
  2⤵
  PID:768
- C:\Windows\System\sPkruEu.exe
  C:\Windows\System\sPkruEu.exe
  2⤵
  PID:2848
- C:\Windows\System\xhLANyE.exe
  C:\Windows\System\xhLANyE.exe
  2⤵
  PID:5144
- C:\Windows\System\jzIdbfE.exe
  C:\Windows\System\jzIdbfE.exe
  2⤵
  PID:5172
- C:\Windows\System\WTqGmoy.exe
  C:\Windows\System\WTqGmoy.exe
  2⤵
  PID:5200
- C:\Windows\System\zKwzzCN.exe
  C:\Windows\System\zKwzzCN.exe
  2⤵
  PID:5228
- C:\Windows\System\qLeTaVR.exe
  C:\Windows\System\qLeTaVR.exe
  2⤵
  PID:5256
- C:\Windows\System\wAfpFaD.exe
  C:\Windows\System\wAfpFaD.exe
  2⤵
  PID:5284
- C:\Windows\System\SZfoMMs.exe
  C:\Windows\System\SZfoMMs.exe
  2⤵
  PID:5324
- C:\Windows\System\bQevdXS.exe
  C:\Windows\System\bQevdXS.exe
  2⤵
  PID:5340
- C:\Windows\System\FYuGYkU.exe
  C:\Windows\System\FYuGYkU.exe
  2⤵
  PID:5368
- C:\Windows\System\EGvMxkC.exe
  C:\Windows\System\EGvMxkC.exe
  2⤵
  PID:5396
- C:\Windows\System\WSwLIhc.exe
  C:\Windows\System\WSwLIhc.exe
  2⤵
  PID:5424
- C:\Windows\System\Loefmyt.exe
  C:\Windows\System\Loefmyt.exe
  2⤵
  PID:5452
- C:\Windows\System\iNMNxch.exe
  C:\Windows\System\iNMNxch.exe
  2⤵
  PID:5480
- C:\Windows\System\zqJHbLk.exe
  C:\Windows\System\zqJHbLk.exe
  2⤵
  PID:5508
- C:\Windows\System\aNuSpku.exe
  C:\Windows\System\aNuSpku.exe
  2⤵
  PID:5536
- C:\Windows\System\BvqmHrw.exe
  C:\Windows\System\BvqmHrw.exe
  2⤵
  PID:5564
- C:\Windows\System\YcutANP.exe
  C:\Windows\System\YcutANP.exe
  2⤵
  PID:5592
- C:\Windows\System\PQMxvmC.exe
  C:\Windows\System\PQMxvmC.exe
  2⤵
  PID:5620
- C:\Windows\System\YTWGccZ.exe
  C:\Windows\System\YTWGccZ.exe
  2⤵
  PID:5648
- C:\Windows\System\fDDpebj.exe
  C:\Windows\System\fDDpebj.exe
  2⤵
  PID:5676
- C:\Windows\System\aNFdfMP.exe
  C:\Windows\System\aNFdfMP.exe
  2⤵
  PID:5704
- C:\Windows\System\OcqtVKg.exe
  C:\Windows\System\OcqtVKg.exe
  2⤵
  PID:5732
- C:\Windows\System\BIyxoti.exe
  C:\Windows\System\BIyxoti.exe
  2⤵
  PID:5768
- C:\Windows\System\tjPkcCT.exe
  C:\Windows\System\tjPkcCT.exe
  2⤵
  PID:5792
- C:\Windows\System\LHamaZZ.exe
  C:\Windows\System\LHamaZZ.exe
  2⤵
  PID:5816
- C:\Windows\System\FDPpsVv.exe
  C:\Windows\System\FDPpsVv.exe
  2⤵
  PID:5844
- C:\Windows\System\IVkCHem.exe
  C:\Windows\System\IVkCHem.exe
  2⤵
  PID:5872
- C:\Windows\System\PyPKXzB.exe
  C:\Windows\System\PyPKXzB.exe
  2⤵
  PID:5900
- C:\Windows\System\RQOAcvQ.exe
  C:\Windows\System\RQOAcvQ.exe
  2⤵
  PID:5928
- C:\Windows\System\HeIYQwN.exe
  C:\Windows\System\HeIYQwN.exe
  2⤵
  PID:5960
- C:\Windows\System\JYvFjpt.exe
  C:\Windows\System\JYvFjpt.exe
  2⤵
  PID:5984
- C:\Windows\System\EqfZLQs.exe
  C:\Windows\System\EqfZLQs.exe
  2⤵
  PID:6012
- C:\Windows\System\HXNrQEn.exe
  C:\Windows\System\HXNrQEn.exe
  2⤵
  PID:6040
- C:\Windows\System\jxxRYBI.exe
  C:\Windows\System\jxxRYBI.exe
  2⤵
  PID:6072
- C:\Windows\System\aEKnrhD.exe
  C:\Windows\System\aEKnrhD.exe
  2⤵
  PID:6096
- C:\Windows\System\rTPZHNt.exe
  C:\Windows\System\rTPZHNt.exe
  2⤵
  PID:6124
- C:\Windows\System\QKEYGJm.exe
  C:\Windows\System\QKEYGJm.exe
  2⤵
  PID:5156
- C:\Windows\System\BjQNpVf.exe
  C:\Windows\System\BjQNpVf.exe
  2⤵
  PID:5224
- C:\Windows\System\oSdnZoJ.exe
  C:\Windows\System\oSdnZoJ.exe
  2⤵
  PID:5320
- C:\Windows\System\RxPbEuI.exe
  C:\Windows\System\RxPbEuI.exe
  2⤵
  PID:5360
- C:\Windows\System\CvMtZyD.exe
  C:\Windows\System\CvMtZyD.exe
  2⤵
  PID:5420
- C:\Windows\System\SolPwTQ.exe
  C:\Windows\System\SolPwTQ.exe
  2⤵
  PID:5492
- C:\Windows\System\oKowPij.exe
  C:\Windows\System\oKowPij.exe
  2⤵
  PID:5556
- C:\Windows\System\NAWemzu.exe
  C:\Windows\System\NAWemzu.exe
  2⤵
  PID:5616
- C:\Windows\System\cOmrlHc.exe
  C:\Windows\System\cOmrlHc.exe
  2⤵
  PID:5688
- C:\Windows\System\XoGGLPw.exe
  C:\Windows\System\XoGGLPw.exe
  2⤵
  PID:5752
- C:\Windows\System\CCkknQO.exe
  C:\Windows\System\CCkknQO.exe
  2⤵
  PID:5812
- C:\Windows\System\EgVrbMJ.exe
  C:\Windows\System\EgVrbMJ.exe
  2⤵
  PID:5884
- C:\Windows\System\GLdhlVd.exe
  C:\Windows\System\GLdhlVd.exe
  2⤵
  PID:5948
- C:\Windows\System\JeAUZVQ.exe
  C:\Windows\System\JeAUZVQ.exe
  2⤵
  PID:6008
- C:\Windows\System\uImlktl.exe
  C:\Windows\System\uImlktl.exe
  2⤵
  PID:6080
- C:\Windows\System\tIdCWRN.exe
  C:\Windows\System\tIdCWRN.exe
  2⤵
  PID:5128
- C:\Windows\System\jRvdHFh.exe
  C:\Windows\System\jRvdHFh.exe
  2⤵
  PID:5276
- C:\Windows\System\EpLhjzS.exe
  C:\Windows\System\EpLhjzS.exe
  2⤵
  PID:5444
- C:\Windows\System\VwevQAX.exe
  C:\Windows\System\VwevQAX.exe
  2⤵
  PID:5604
- C:\Windows\System\oGXbdvH.exe
  C:\Windows\System\oGXbdvH.exe
  2⤵
  PID:5728
- C:\Windows\System\mXqXWuF.exe
  C:\Windows\System\mXqXWuF.exe
  2⤵
  PID:5912
- C:\Windows\System\uqNccIE.exe
  C:\Windows\System\uqNccIE.exe
  2⤵
  PID:6060
- C:\Windows\System\VVNImAJ.exe
  C:\Windows\System\VVNImAJ.exe
  2⤵
  PID:5252
- C:\Windows\System\MgXXXyJ.exe
  C:\Windows\System\MgXXXyJ.exe
  2⤵
  PID:5668
- C:\Windows\System\pMBfwPD.exe
  C:\Windows\System\pMBfwPD.exe
  2⤵
  PID:6004
- C:\Windows\System\EjvkNQH.exe
  C:\Windows\System\EjvkNQH.exe
  2⤵
  PID:5584
- C:\Windows\System\iBKzCeG.exe
  C:\Windows\System\iBKzCeG.exe
  2⤵
  PID:5976
- C:\Windows\System\XoUqzzi.exe
  C:\Windows\System\XoUqzzi.exe
  2⤵
  PID:6176
- C:\Windows\System\xysdeDw.exe
  C:\Windows\System\xysdeDw.exe
  2⤵
  PID:6192
- C:\Windows\System\yzFQtLT.exe
  C:\Windows\System\yzFQtLT.exe
  2⤵
  PID:6220
- C:\Windows\System\gkcGXOV.exe
  C:\Windows\System\gkcGXOV.exe
  2⤵
  PID:6252
- C:\Windows\System\GsGGMTH.exe
  C:\Windows\System\GsGGMTH.exe
  2⤵
  PID:6276
- C:\Windows\System\AMAsiFs.exe
  C:\Windows\System\AMAsiFs.exe
  2⤵
  PID:6304
- C:\Windows\System\DsDzcEW.exe
  C:\Windows\System\DsDzcEW.exe
  2⤵
  PID:6332
- C:\Windows\System\YBpDLiO.exe
  C:\Windows\System\YBpDLiO.exe
  2⤵
  PID:6360
- C:\Windows\System\nunGpfS.exe
  C:\Windows\System\nunGpfS.exe
  2⤵
  PID:6388
- C:\Windows\System\MuMxVqN.exe
  C:\Windows\System\MuMxVqN.exe
  2⤵
  PID:6416
- C:\Windows\System\imqUsmb.exe
  C:\Windows\System\imqUsmb.exe
  2⤵
  PID:6444
- C:\Windows\System\vtUqVTV.exe
  C:\Windows\System\vtUqVTV.exe
  2⤵
  PID:6472
- C:\Windows\System\youdRZl.exe
  C:\Windows\System\youdRZl.exe
  2⤵
  PID:6500
- C:\Windows\System\kOKlDow.exe
  C:\Windows\System\kOKlDow.exe
  2⤵
  PID:6528
- C:\Windows\System\nbGJEan.exe
  C:\Windows\System\nbGJEan.exe
  2⤵
  PID:6556
- C:\Windows\System\OfwKzFP.exe
  C:\Windows\System\OfwKzFP.exe
  2⤵
  PID:6584
- C:\Windows\System\fRoklPF.exe
  C:\Windows\System\fRoklPF.exe
  2⤵
  PID:6612
- C:\Windows\System\dZRypPX.exe
  C:\Windows\System\dZRypPX.exe
  2⤵
  PID:6640
- C:\Windows\System\ZupVzKf.exe
  C:\Windows\System\ZupVzKf.exe
  2⤵
  PID:6668
- C:\Windows\System\HzlblEb.exe
  C:\Windows\System\HzlblEb.exe
  2⤵
  PID:6696
- C:\Windows\System\hlUvWAX.exe
  C:\Windows\System\hlUvWAX.exe
  2⤵
  PID:6724
- C:\Windows\System\CWxlJMg.exe
  C:\Windows\System\CWxlJMg.exe
  2⤵
  PID:6752
- C:\Windows\System\VKukemF.exe
  C:\Windows\System\VKukemF.exe
  2⤵
  PID:6780
- C:\Windows\System\kgmsSgT.exe
  C:\Windows\System\kgmsSgT.exe
  2⤵
  PID:6808
- C:\Windows\System\EngnGcW.exe
  C:\Windows\System\EngnGcW.exe
  2⤵
  PID:6836
- C:\Windows\System\IWWafeK.exe
  C:\Windows\System\IWWafeK.exe
  2⤵
  PID:6864
- C:\Windows\System\NqEHUZo.exe
  C:\Windows\System\NqEHUZo.exe
  2⤵
  PID:6884
- C:\Windows\System\RJBWqKR.exe
  C:\Windows\System\RJBWqKR.exe
  2⤵
  PID:6908
- C:\Windows\System\PncIRYV.exe
  C:\Windows\System\PncIRYV.exe
  2⤵
  PID:6928
- C:\Windows\System\yysZQWR.exe
  C:\Windows\System\yysZQWR.exe
  2⤵
  PID:6956
- C:\Windows\System\ivESyMJ.exe
  C:\Windows\System\ivESyMJ.exe
  2⤵
  PID:6980
- C:\Windows\System\pKZLXbZ.exe
  C:\Windows\System\pKZLXbZ.exe
  2⤵
  PID:7000
- C:\Windows\System\SCbVALt.exe
  C:\Windows\System\SCbVALt.exe
  2⤵
  PID:7028
- C:\Windows\System\nkUyXeh.exe
  C:\Windows\System\nkUyXeh.exe
  2⤵
  PID:7052
- C:\Windows\System\ZdfBTuN.exe
  C:\Windows\System\ZdfBTuN.exe
  2⤵
  PID:7080
- C:\Windows\System\gUkrcaD.exe
  C:\Windows\System\gUkrcaD.exe
  2⤵
  PID:7096
- C:\Windows\System\vUjUGpe.exe
  C:\Windows\System\vUjUGpe.exe
  2⤵
  PID:7116
- C:\Windows\System\xBJCWli.exe
  C:\Windows\System\xBJCWli.exe
  2⤵
  PID:7144
- C:\Windows\System\GgebWlg.exe
  C:\Windows\System\GgebWlg.exe
  2⤵
  PID:6148
- C:\Windows\System\edAANjs.exe
  C:\Windows\System\edAANjs.exe
  2⤵
  PID:6212
- C:\Windows\System\KAKdCAC.exe
  C:\Windows\System\KAKdCAC.exe
  2⤵
  PID:6268
- C:\Windows\System\byVdFQf.exe
  C:\Windows\System\byVdFQf.exe
  2⤵
  PID:6328
- C:\Windows\System\KWbMGnM.exe
  C:\Windows\System\KWbMGnM.exe
  2⤵
  PID:6380
- C:\Windows\System\qNSTiuu.exe
  C:\Windows\System\qNSTiuu.exe
  2⤵
  PID:6440
- C:\Windows\System\gkLuyjv.exe
  C:\Windows\System\gkLuyjv.exe
  2⤵
  PID:6468
- C:\Windows\System\ejdfxZt.exe
  C:\Windows\System\ejdfxZt.exe
  2⤵
  PID:6552
- C:\Windows\System\fHSaMuk.exe
  C:\Windows\System\fHSaMuk.exe
  2⤵
  PID:6624
- C:\Windows\System\MNBArzT.exe
  C:\Windows\System\MNBArzT.exe
  2⤵
  PID:6688
- C:\Windows\System\JsUChwH.exe
  C:\Windows\System\JsUChwH.exe
  2⤵
  PID:6748
- C:\Windows\System\nFQczcj.exe
  C:\Windows\System\nFQczcj.exe
  2⤵
  PID:6804
- C:\Windows\System\ScJPVBa.exe
  C:\Windows\System\ScJPVBa.exe
  2⤵
  PID:6876
- C:\Windows\System\gjQHEhM.exe
  C:\Windows\System\gjQHEhM.exe
  2⤵
  PID:6900
- C:\Windows\System\iMRwMBZ.exe
  C:\Windows\System\iMRwMBZ.exe
  2⤵
  PID:6992
- C:\Windows\System\GRzDhSi.exe
  C:\Windows\System\GRzDhSi.exe
  2⤵
  PID:7108
- C:\Windows\System\gnEHqpN.exe
  C:\Windows\System\gnEHqpN.exe
  2⤵
  PID:7160
- C:\Windows\System\UwyVjcX.exe
  C:\Windows\System\UwyVjcX.exe
  2⤵
  PID:6232
- C:\Windows\System\BfdyxDk.exe
  C:\Windows\System\BfdyxDk.exe
  2⤵
  PID:6492
- C:\Windows\System\lZtYepa.exe
  C:\Windows\System\lZtYepa.exe
  2⤵
  PID:6580
- C:\Windows\System\JeFGPDd.exe
  C:\Windows\System\JeFGPDd.exe
  2⤵
  PID:6936
- C:\Windows\System\vFXfgFf.exe
  C:\Windows\System\vFXfgFf.exe
  2⤵
  PID:6800
- C:\Windows\System\IJJPGjO.exe
  C:\Windows\System\IJJPGjO.exe
  2⤵
  PID:7020
- C:\Windows\System\HmUgeXe.exe
  C:\Windows\System\HmUgeXe.exe
  2⤵
  PID:6652
- C:\Windows\System\iTPPXIo.exe
  C:\Windows\System\iTPPXIo.exe
  2⤵
  PID:6860
- C:\Windows\System\gtLudSK.exe
  C:\Windows\System\gtLudSK.exe
  2⤵
  PID:7204
- C:\Windows\System\IjXTRuX.exe
  C:\Windows\System\IjXTRuX.exe
  2⤵
  PID:7236
- C:\Windows\System\RCLGCFQ.exe
  C:\Windows\System\RCLGCFQ.exe
  2⤵
  PID:7268
- C:\Windows\System\cmUqNpW.exe
  C:\Windows\System\cmUqNpW.exe
  2⤵
  PID:7288
- C:\Windows\System\lMNchDV.exe
  C:\Windows\System\lMNchDV.exe
  2⤵
  PID:7312
- C:\Windows\System\kWMNmCz.exe
  C:\Windows\System\kWMNmCz.exe
  2⤵
  PID:7360
- C:\Windows\System\LSYrLEd.exe
  C:\Windows\System\LSYrLEd.exe
  2⤵
  PID:7380
- C:\Windows\System\ZGiQvZO.exe
  C:\Windows\System\ZGiQvZO.exe
  2⤵
  PID:7420
- C:\Windows\System\HXtCLmn.exe
  C:\Windows\System\HXtCLmn.exe
  2⤵
  PID:7452
- C:\Windows\System\ZqXQMGA.exe
  C:\Windows\System\ZqXQMGA.exe
  2⤵
  PID:7492
- C:\Windows\System\DYLtkKY.exe
  C:\Windows\System\DYLtkKY.exe
  2⤵
  PID:7508
- C:\Windows\System\FGvVupW.exe
  C:\Windows\System\FGvVupW.exe
  2⤵
  PID:7540
- C:\Windows\System\GdwBWFv.exe
  C:\Windows\System\GdwBWFv.exe
  2⤵
  PID:7576
- C:\Windows\System\uEkPpJg.exe
  C:\Windows\System\uEkPpJg.exe
  2⤵
  PID:7592
- C:\Windows\System\rwfMJYP.exe
  C:\Windows\System\rwfMJYP.exe
  2⤵
  PID:7608
- C:\Windows\System\KBfeldj.exe
  C:\Windows\System\KBfeldj.exe
  2⤵
  PID:7628
- C:\Windows\System\KszSPHL.exe
  C:\Windows\System\KszSPHL.exe
  2⤵
  PID:7652
- C:\Windows\System\bdqZvbn.exe
  C:\Windows\System\bdqZvbn.exe
  2⤵
  PID:7684
- C:\Windows\System\LOZPNLT.exe
  C:\Windows\System\LOZPNLT.exe
  2⤵
  PID:7716
- C:\Windows\System\GsLixzD.exe
  C:\Windows\System\GsLixzD.exe
  2⤵
  PID:7744
- C:\Windows\System\IBTLVYH.exe
  C:\Windows\System\IBTLVYH.exe
  2⤵
  PID:7776
- C:\Windows\System\QHDuzjb.exe
  C:\Windows\System\QHDuzjb.exe
  2⤵
  PID:7804
- C:\Windows\System\dpExPxC.exe
  C:\Windows\System\dpExPxC.exe
  2⤵
  PID:7832
- C:\Windows\System\qllNbtb.exe
  C:\Windows\System\qllNbtb.exe
  2⤵
  PID:7860
- C:\Windows\System\YbuQTRU.exe
  C:\Windows\System\YbuQTRU.exe
  2⤵
  PID:7904
- C:\Windows\System\aFMqPxt.exe
  C:\Windows\System\aFMqPxt.exe
  2⤵
  PID:7940
- C:\Windows\System\JSrwjgX.exe
  C:\Windows\System\JSrwjgX.exe
  2⤵
  PID:7956
- C:\Windows\System\pffJeWV.exe
  C:\Windows\System\pffJeWV.exe
  2⤵
  PID:7980
- C:\Windows\System\kqcgqiK.exe
  C:\Windows\System\kqcgqiK.exe
  2⤵
  PID:8000
- C:\Windows\System\MUbnppX.exe
  C:\Windows\System\MUbnppX.exe
  2⤵
  PID:8048
- C:\Windows\System\RpgtwHz.exe
  C:\Windows\System\RpgtwHz.exe
  2⤵
  PID:8080
- C:\Windows\System\XqPfQMz.exe
  C:\Windows\System\XqPfQMz.exe
  2⤵
  PID:8108
- C:\Windows\System\JztPJFU.exe
  C:\Windows\System\JztPJFU.exe
  2⤵
  PID:8136
- C:\Windows\System\PkBHJNa.exe
  C:\Windows\System\PkBHJNa.exe
  2⤵
  PID:8164
- C:\Windows\System\EIfKXtr.exe
  C:\Windows\System\EIfKXtr.exe
  2⤵
  PID:6412
- C:\Windows\System\vQefddN.exe
  C:\Windows\System\vQefddN.exe
  2⤵
  PID:6184
- C:\Windows\System\gzljNvo.exe
  C:\Windows\System\gzljNvo.exe
  2⤵
  PID:7224
- C:\Windows\System\UzcwIuy.exe
  C:\Windows\System\UzcwIuy.exe
  2⤵
  PID:7248
- C:\Windows\System\cydDPIT.exe
  C:\Windows\System\cydDPIT.exe
  2⤵
  PID:7276
- C:\Windows\System\RfbaHsL.exe
  C:\Windows\System\RfbaHsL.exe
  2⤵
  PID:7368
- C:\Windows\System\xfQazrr.exe
  C:\Windows\System\xfQazrr.exe
  2⤵
  PID:7448
- C:\Windows\System\GZYmPeO.exe
  C:\Windows\System\GZYmPeO.exe
  2⤵
  PID:7528
- C:\Windows\System\finijGm.exe
  C:\Windows\System\finijGm.exe
  2⤵
  PID:7604
- C:\Windows\System\GUCBitX.exe
  C:\Windows\System\GUCBitX.exe
  2⤵
  PID:7680
- C:\Windows\System\vGrUBGT.exe
  C:\Windows\System\vGrUBGT.exe
  2⤵
  PID:7704
- C:\Windows\System\wIRbjAD.exe
  C:\Windows\System\wIRbjAD.exe
  2⤵
  PID:7820
- C:\Windows\System\vaXyVfD.exe
  C:\Windows\System\vaXyVfD.exe
  2⤵
  PID:7892
- C:\Windows\System\olSYJZI.exe
  C:\Windows\System\olSYJZI.exe
  2⤵
  PID:7936
- C:\Windows\System\iNuUKRz.exe
  C:\Windows\System\iNuUKRz.exe
  2⤵
  PID:7996
- C:\Windows\System\oDlYvrR.exe
  C:\Windows\System\oDlYvrR.exe
  2⤵
  PID:8092
- C:\Windows\System\IKdwnps.exe
  C:\Windows\System\IKdwnps.exe
  2⤵
  PID:8132
- C:\Windows\System\YGHmgoM.exe
  C:\Windows\System\YGHmgoM.exe
  2⤵
  PID:6660
- C:\Windows\System\YQiIVpM.exe
  C:\Windows\System\YQiIVpM.exe
  2⤵
  PID:7252
- C:\Windows\System\LruTFDw.exe
  C:\Windows\System\LruTFDw.exe
  2⤵
  PID:7436
- C:\Windows\System\XyafKuQ.exe
  C:\Windows\System\XyafKuQ.exe
  2⤵
  PID:7600
- C:\Windows\System\GLJPtGG.exe
  C:\Windows\System\GLJPtGG.exe
  2⤵
  PID:7728
- C:\Windows\System\bPLrpSJ.exe
  C:\Windows\System\bPLrpSJ.exe
  2⤵
  PID:7952
- C:\Windows\System\wNrnJuO.exe
  C:\Windows\System\wNrnJuO.exe
  2⤵
  PID:8076
- C:\Windows\System\QileJnO.exe
  C:\Windows\System\QileJnO.exe
  2⤵
  PID:8188
- C:\Windows\System\HOKQsvs.exe
  C:\Windows\System\HOKQsvs.exe
  2⤵
  PID:7768
- C:\Windows\System\LvotFru.exe
  C:\Windows\System\LvotFru.exe
  2⤵
  PID:7968
- C:\Windows\System\ZZIUoKe.exe
  C:\Windows\System\ZZIUoKe.exe
  2⤵
  PID:3164
- C:\Windows\System\QfmPorj.exe
  C:\Windows\System\QfmPorj.exe
  2⤵
  PID:7280
- C:\Windows\System\alSRZbq.exe
  C:\Windows\System\alSRZbq.exe
  2⤵
  PID:7948
- C:\Windows\System\eYFNzsR.exe
  C:\Windows\System\eYFNzsR.exe
  2⤵
  PID:2516
- C:\Windows\System\zcyDaYZ.exe
  C:\Windows\System\zcyDaYZ.exe
  2⤵
  PID:8212
- C:\Windows\System\KOzIgpr.exe
  C:\Windows\System\KOzIgpr.exe
  2⤵
  PID:8228
- C:\Windows\System\TdMWzFH.exe
  C:\Windows\System\TdMWzFH.exe
  2⤵
  PID:8264
- C:\Windows\System\INSwSjz.exe
  C:\Windows\System\INSwSjz.exe
  2⤵
  PID:8296
- C:\Windows\System\zsoZrer.exe
  C:\Windows\System\zsoZrer.exe
  2⤵
  PID:8324
- C:\Windows\System\RCwSjgG.exe
  C:\Windows\System\RCwSjgG.exe
  2⤵
  PID:8352
- C:\Windows\System\plJHmOP.exe
  C:\Windows\System\plJHmOP.exe
  2⤵
  PID:8380
- C:\Windows\System\ZyJXSDI.exe
  C:\Windows\System\ZyJXSDI.exe
  2⤵
  PID:8408
- C:\Windows\System\xgTYEOu.exe
  C:\Windows\System\xgTYEOu.exe
  2⤵
  PID:8436
- C:\Windows\System\RtnitYv.exe
  C:\Windows\System\RtnitYv.exe
  2⤵
  PID:8464
- C:\Windows\System\jSIrtZp.exe
  C:\Windows\System\jSIrtZp.exe
  2⤵
  PID:8492
- C:\Windows\System\fqHtIim.exe
  C:\Windows\System\fqHtIim.exe
  2⤵
  PID:8520
- C:\Windows\System\WMOXAfK.exe
  C:\Windows\System\WMOXAfK.exe
  2⤵
  PID:8536
- C:\Windows\System\lsDKXTw.exe
  C:\Windows\System\lsDKXTw.exe
  2⤵
  PID:8564
- C:\Windows\System\aamefno.exe
  C:\Windows\System\aamefno.exe
  2⤵
  PID:8580
- C:\Windows\System\nKHmJPr.exe
  C:\Windows\System\nKHmJPr.exe
  2⤵
  PID:8612
- C:\Windows\System\EiToKWa.exe
  C:\Windows\System\EiToKWa.exe
  2⤵
  PID:8644
- C:\Windows\System\ULCxGda.exe
  C:\Windows\System\ULCxGda.exe
  2⤵
  PID:8676
- C:\Windows\System\AuarYWi.exe
  C:\Windows\System\AuarYWi.exe
  2⤵
  PID:8716
- C:\Windows\System\DgIhSEw.exe
  C:\Windows\System\DgIhSEw.exe
  2⤵
  PID:8744
- C:\Windows\System\ThHRKke.exe
  C:\Windows\System\ThHRKke.exe
  2⤵
  PID:8760
- C:\Windows\System\RNjXARs.exe
  C:\Windows\System\RNjXARs.exe
  2⤵
  PID:8784
- C:\Windows\System\tmnZMES.exe
  C:\Windows\System\tmnZMES.exe
  2⤵
  PID:8812
- C:\Windows\System\DjQNlwE.exe
  C:\Windows\System\DjQNlwE.exe
  2⤵
  PID:8844
- C:\Windows\System\eIfShrO.exe
  C:\Windows\System\eIfShrO.exe
  2⤵
  PID:8884
- C:\Windows\System\BhGyRIC.exe
  C:\Windows\System\BhGyRIC.exe
  2⤵
  PID:8912
- C:\Windows\System\WxXMJFY.exe
  C:\Windows\System\WxXMJFY.exe
  2⤵
  PID:8940
- C:\Windows\System\gRryFVw.exe
  C:\Windows\System\gRryFVw.exe
  2⤵
  PID:8972
- C:\Windows\System\AsjzzdZ.exe
  C:\Windows\System\AsjzzdZ.exe
  2⤵
  PID:8988
- C:\Windows\System\rrQnUhq.exe
  C:\Windows\System\rrQnUhq.exe
  2⤵
  PID:9012
- C:\Windows\System\TvCCLft.exe
  C:\Windows\System\TvCCLft.exe
  2⤵
  PID:9052
- C:\Windows\System\Bwdihqv.exe
  C:\Windows\System\Bwdihqv.exe
  2⤵
  PID:9084
- C:\Windows\System\VzrEznt.exe
  C:\Windows\System\VzrEznt.exe
  2⤵
  PID:9108
- C:\Windows\System\EADWyav.exe
  C:\Windows\System\EADWyav.exe
  2⤵
  PID:9136
- C:\Windows\System\abugYto.exe
  C:\Windows\System\abugYto.exe
  2⤵
  PID:9164
- C:\Windows\System\KzdRTju.exe
  C:\Windows\System\KzdRTju.exe
  2⤵
  PID:9192
- C:\Windows\System\tTyAEFO.exe
  C:\Windows\System\tTyAEFO.exe
  2⤵
  PID:8196
- C:\Windows\System\pNdHkDB.exe
  C:\Windows\System\pNdHkDB.exe
  2⤵
  PID:8252
- C:\Windows\System\VLnRYXi.exe
  C:\Windows\System\VLnRYXi.exe
  2⤵
  PID:8308
- C:\Windows\System\zyNYaFV.exe
  C:\Windows\System\zyNYaFV.exe
  2⤵
  PID:8376
- C:\Windows\System\HbZltTL.exe
  C:\Windows\System\HbZltTL.exe
  2⤵
  PID:8432
- C:\Windows\System\MBtjrjw.exe
  C:\Windows\System\MBtjrjw.exe
  2⤵
  PID:8484
- C:\Windows\System\XmOPRxd.exe
  C:\Windows\System\XmOPRxd.exe
  2⤵
  PID:8528
- C:\Windows\System\thcUFJl.exe
  C:\Windows\System\thcUFJl.exe
  2⤵
  PID:8628
- C:\Windows\System\oDgZzDf.exe
  C:\Windows\System\oDgZzDf.exe
  2⤵
  PID:8688
- C:\Windows\System\eLBTRkj.exe
  C:\Windows\System\eLBTRkj.exe
  2⤵
  PID:8756
- C:\Windows\System\wEaNGHi.exe
  C:\Windows\System\wEaNGHi.exe
  2⤵
  PID:8828
- C:\Windows\System\kbltXTy.exe
  C:\Windows\System\kbltXTy.exe
  2⤵
  PID:8856
- C:\Windows\System\trWlWmd.exe
  C:\Windows\System\trWlWmd.exe
  2⤵
  PID:8932
- C:\Windows\System\eOWcprw.exe
  C:\Windows\System\eOWcprw.exe
  2⤵
  PID:9000
- C:\Windows\System\hobWxPl.exe
  C:\Windows\System\hobWxPl.exe
  2⤵
  PID:9036
- C:\Windows\System\ySWDZQB.exe
  C:\Windows\System\ySWDZQB.exe
  2⤵
  PID:9104
- C:\Windows\System\EjpXDWP.exe
  C:\Windows\System\EjpXDWP.exe
  2⤵
  PID:9188
- C:\Windows\System\TlIfcWL.exe
  C:\Windows\System\TlIfcWL.exe
  2⤵
  PID:8292
- C:\Windows\System\HxVeEbY.exe
  C:\Windows\System\HxVeEbY.exe
  2⤵
  PID:8400
- C:\Windows\System\rqdGYNj.exe
  C:\Windows\System\rqdGYNj.exe
  2⤵
  PID:8560
- C:\Windows\System\lJsXRhB.exe
  C:\Windows\System\lJsXRhB.exe
  2⤵
  PID:8752
- C:\Windows\System\qPWESll.exe
  C:\Windows\System\qPWESll.exe
  2⤵
  PID:8924
- C:\Windows\System\plVbDFn.exe
  C:\Windows\System\plVbDFn.exe
  2⤵
  PID:9032
- C:\Windows\System\tnpCOQW.exe
  C:\Windows\System\tnpCOQW.exe
  2⤵
  PID:9184
- C:\Windows\System\OJUOPeB.exe
  C:\Windows\System\OJUOPeB.exe
  2⤵
  PID:8504
- C:\Windows\System\OpDRKux.exe
  C:\Windows\System\OpDRKux.exe
  2⤵
  PID:8896
- C:\Windows\System\tckqQzZ.exe
  C:\Windows\System\tckqQzZ.exe
  2⤵
  PID:8224
- C:\Windows\System\AfBpKfK.exe
  C:\Windows\System\AfBpKfK.exe
  2⤵
  PID:8728
- C:\Windows\System\smTJMas.exe
  C:\Windows\System\smTJMas.exe
  2⤵
  PID:9232
- C:\Windows\System\nxUPova.exe
  C:\Windows\System\nxUPova.exe
  2⤵
  PID:9248
- C:\Windows\System\BsNezGQ.exe
  C:\Windows\System\BsNezGQ.exe
  2⤵
  PID:9264
- C:\Windows\System\ZIJXYwp.exe
  C:\Windows\System\ZIJXYwp.exe
  2⤵
  PID:9280
- C:\Windows\System\qpMZasO.exe
  C:\Windows\System\qpMZasO.exe
  2⤵
  PID:9308
- C:\Windows\System\tXTXsTd.exe
  C:\Windows\System\tXTXsTd.exe
  2⤵
  PID:9328
- C:\Windows\System\iWygpzl.exe
  C:\Windows\System\iWygpzl.exe
  2⤵
  PID:9368
- C:\Windows\System\LATXbtD.exe
  C:\Windows\System\LATXbtD.exe
  2⤵
  PID:9404
- C:\Windows\System\TDNnsRZ.exe
  C:\Windows\System\TDNnsRZ.exe
  2⤵
  PID:9428
- C:\Windows\System\QVRDNXh.exe
  C:\Windows\System\QVRDNXh.exe
  2⤵
  PID:9456
- C:\Windows\System\JtXCqbz.exe
  C:\Windows\System\JtXCqbz.exe
  2⤵
  PID:9488
- C:\Windows\System\HxBFpnP.exe
  C:\Windows\System\HxBFpnP.exe
  2⤵
  PID:9528
- C:\Windows\System\aiCypTr.exe
  C:\Windows\System\aiCypTr.exe
  2⤵
  PID:9560
- C:\Windows\System\JSmvpym.exe
  C:\Windows\System\JSmvpym.exe
  2⤵
  PID:9584
- C:\Windows\System\pYJRUBH.exe
  C:\Windows\System\pYJRUBH.exe
  2⤵
  PID:9612
- C:\Windows\System\TaVHxpB.exe
  C:\Windows\System\TaVHxpB.exe
  2⤵
  PID:9640
- C:\Windows\System\cxMCEcz.exe
  C:\Windows\System\cxMCEcz.exe
  2⤵
  PID:9680
- C:\Windows\System\eDFAZcE.exe
  C:\Windows\System\eDFAZcE.exe
  2⤵
  PID:9712
- C:\Windows\System\JEKyKXZ.exe
  C:\Windows\System\JEKyKXZ.exe
  2⤵
  PID:9736
- C:\Windows\System\xxwKHTC.exe
  C:\Windows\System\xxwKHTC.exe
  2⤵
  PID:9764
- C:\Windows\System\GyoobSr.exe
  C:\Windows\System\GyoobSr.exe
  2⤵
  PID:9792
- C:\Windows\System\EDhnGVk.exe
  C:\Windows\System\EDhnGVk.exe
  2⤵
  PID:9820
- C:\Windows\System\LchnhrT.exe
  C:\Windows\System\LchnhrT.exe
  2⤵
  PID:9848
- C:\Windows\System\bWXGZgE.exe
  C:\Windows\System\bWXGZgE.exe
  2⤵
  PID:9876
- C:\Windows\System\shhWPvA.exe
  C:\Windows\System\shhWPvA.exe
  2⤵
  PID:9904
- C:\Windows\System\SHKApax.exe
  C:\Windows\System\SHKApax.exe
  2⤵
  PID:9932
- C:\Windows\System\eCQffaT.exe
  C:\Windows\System\eCQffaT.exe
  2⤵
  PID:9964
- C:\Windows\System\zFlyZQy.exe
  C:\Windows\System\zFlyZQy.exe
  2⤵
  PID:9988
- C:\Windows\System\lUsDoSu.exe
  C:\Windows\System\lUsDoSu.exe
  2⤵
  PID:10016
- C:\Windows\System\KSDAUGi.exe
  C:\Windows\System\KSDAUGi.exe
  2⤵
  PID:10044
- C:\Windows\System\QFHoJux.exe
  C:\Windows\System\QFHoJux.exe
  2⤵
  PID:10072
- C:\Windows\System\mBLbwAE.exe
  C:\Windows\System\mBLbwAE.exe
  2⤵
  PID:10100
- C:\Windows\System\JtoIkNI.exe
  C:\Windows\System\JtoIkNI.exe
  2⤵
  PID:10128
- C:\Windows\System\NbpzXQf.exe
  C:\Windows\System\NbpzXQf.exe
  2⤵
  PID:10156
- C:\Windows\System\dtXPJbG.exe
  C:\Windows\System\dtXPJbG.exe
  2⤵
  PID:10184
- C:\Windows\System\WQMBlcN.exe
  C:\Windows\System\WQMBlcN.exe
  2⤵
  PID:10212
- C:\Windows\System\aehdKeY.exe
  C:\Windows\System\aehdKeY.exe
  2⤵
  PID:10232
- C:\Windows\System\wpDhRiZ.exe
  C:\Windows\System\wpDhRiZ.exe
  2⤵
  PID:9272
- C:\Windows\System\AdGqdyv.exe
  C:\Windows\System\AdGqdyv.exe
  2⤵
  PID:9336
- C:\Windows\System\GLbksgy.exe
  C:\Windows\System\GLbksgy.exe
  2⤵
  PID:9388
- C:\Windows\System\WjBQTsV.exe
  C:\Windows\System\WjBQTsV.exe
  2⤵
  PID:9452
- C:\Windows\System\hnNQOxB.exe
  C:\Windows\System\hnNQOxB.exe
  2⤵
  PID:9512
- C:\Windows\System\DrPCZym.exe
  C:\Windows\System\DrPCZym.exe
  2⤵
  PID:9568
- C:\Windows\System\xsXvEQE.exe
  C:\Windows\System\xsXvEQE.exe
  2⤵
  PID:9636
- C:\Windows\System\ousfhEK.exe
  C:\Windows\System\ousfhEK.exe
  2⤵
  PID:9704
- C:\Windows\System\TVtqxZb.exe
  C:\Windows\System\TVtqxZb.exe
  2⤵
  PID:9776
- C:\Windows\System\aRopMFN.exe
  C:\Windows\System\aRopMFN.exe
  2⤵
  PID:9860
- C:\Windows\System\nqhSmMg.exe
  C:\Windows\System\nqhSmMg.exe
  2⤵
  PID:9928
- C:\Windows\System\wQtItdO.exe
  C:\Windows\System\wQtItdO.exe
  2⤵
  PID:10000
- C:\Windows\System\cnpZSrA.exe
  C:\Windows\System\cnpZSrA.exe
  2⤵
  PID:10068
- C:\Windows\System\vlQSQxd.exe
  C:\Windows\System\vlQSQxd.exe
  2⤵
  PID:10120
- C:\Windows\System\HCmCWHw.exe
  C:\Windows\System\HCmCWHw.exe
  2⤵
  PID:10180
- C:\Windows\System\pWgfHvc.exe
  C:\Windows\System\pWgfHvc.exe
  2⤵
  PID:9224
- C:\Windows\System\UepISqA.exe
  C:\Windows\System\UepISqA.exe
  2⤵
  PID:9384
- C:\Windows\System\JMcojcz.exe
  C:\Windows\System\JMcojcz.exe
  2⤵
  PID:9516
- C:\Windows\System\mJBFmmz.exe
  C:\Windows\System\mJBFmmz.exe
  2⤵
  PID:9576
- C:\Windows\System\EHUKEwm.exe
  C:\Windows\System\EHUKEwm.exe
  2⤵
  PID:9832
- C:\Windows\System\ZfgnVSb.exe
  C:\Windows\System\ZfgnVSb.exe
  2⤵
  PID:9924
- C:\Windows\System\oscrkky.exe
  C:\Windows\System\oscrkky.exe
  2⤵
  PID:10040
- C:\Windows\System\pYARQNo.exe
  C:\Windows\System\pYARQNo.exe
  2⤵
  PID:8532
- C:\Windows\System\fRpAhcI.exe
  C:\Windows\System\fRpAhcI.exe
  2⤵
  PID:9444
- C:\Windows\System\PJjpMFY.exe
  C:\Windows\System\PJjpMFY.exe
  2⤵
  PID:9896
- C:\Windows\System\pexNCBR.exe
  C:\Windows\System\pexNCBR.exe
  2⤵
  PID:9148
- C:\Windows\System\CBtekYf.exe
  C:\Windows\System\CBtekYf.exe
  2⤵
  PID:9548
- C:\Windows\System\gmPCNXh.exe
  C:\Windows\System\gmPCNXh.exe
  2⤵
  PID:10264
- C:\Windows\System\bJCyWyH.exe
  C:\Windows\System\bJCyWyH.exe
  2⤵
  PID:10292
- C:\Windows\System\MOWnSho.exe
  C:\Windows\System\MOWnSho.exe
  2⤵
  PID:10320
- C:\Windows\System\sAsdOnt.exe
  C:\Windows\System\sAsdOnt.exe
  2⤵
  PID:10348
- C:\Windows\System\OGiqnzA.exe
  C:\Windows\System\OGiqnzA.exe
  2⤵
  PID:10376
- C:\Windows\System\PPpGBVB.exe
  C:\Windows\System\PPpGBVB.exe
  2⤵
  PID:10404
- C:\Windows\System\CJXZNAk.exe
  C:\Windows\System\CJXZNAk.exe
  2⤵
  PID:10432
- C:\Windows\System\ChRFieK.exe
  C:\Windows\System\ChRFieK.exe
  2⤵
  PID:10452
- C:\Windows\System\kYjEMPG.exe
  C:\Windows\System\kYjEMPG.exe
  2⤵
  PID:10484
- C:\Windows\System\TavVGYO.exe
  C:\Windows\System\TavVGYO.exe
  2⤵
  PID:10504
- C:\Windows\System\UYTNaTo.exe
  C:\Windows\System\UYTNaTo.exe
  2⤵
  PID:10520
- C:\Windows\System\xOmbrQx.exe
  C:\Windows\System\xOmbrQx.exe
  2⤵
  PID:10536
- C:\Windows\System\OBOPIhz.exe
  C:\Windows\System\OBOPIhz.exe
  2⤵
  PID:10572
- C:\Windows\System\PtkWrVa.exe
  C:\Windows\System\PtkWrVa.exe
  2⤵
  PID:10604
- C:\Windows\System\unzlCPq.exe
  C:\Windows\System\unzlCPq.exe
  2⤵
  PID:10628
- C:\Windows\System\LvLNvkj.exe
  C:\Windows\System\LvLNvkj.exe
  2⤵
  PID:10644
- C:\Windows\System\CVrfnzg.exe
  C:\Windows\System\CVrfnzg.exe
  2⤵
  PID:10672
- C:\Windows\System\UroTfdt.exe
  C:\Windows\System\UroTfdt.exe
  2⤵
  PID:10708
- C:\Windows\System\vFnUeti.exe
  C:\Windows\System\vFnUeti.exe
  2⤵
  PID:10732
- C:\Windows\System\AMIWsSp.exe
  C:\Windows\System\AMIWsSp.exe
  2⤵
  PID:10764
- C:\Windows\System\JvupXeA.exe
  C:\Windows\System\JvupXeA.exe
  2⤵
  PID:10792
- C:\Windows\System\cztawVa.exe
  C:\Windows\System\cztawVa.exe
  2⤵
  PID:10824
- C:\Windows\System\SQdkbdY.exe
  C:\Windows\System\SQdkbdY.exe
  2⤵
  PID:10860
- C:\Windows\System\GAjXYpW.exe
  C:\Windows\System\GAjXYpW.exe
  2⤵
  PID:10892
- C:\Windows\System\QfzQhcX.exe
  C:\Windows\System\QfzQhcX.exe
  2⤵
  PID:10928
- C:\Windows\System\UaCfvlm.exe
  C:\Windows\System\UaCfvlm.exe
  2⤵
  PID:10964
- C:\Windows\System\nLmPLsU.exe
  C:\Windows\System\nLmPLsU.exe
  2⤵
  PID:10996
- C:\Windows\System\IEekQea.exe
  C:\Windows\System\IEekQea.exe
  2⤵
  PID:11024
- C:\Windows\System\WvJnyha.exe
  C:\Windows\System\WvJnyha.exe
  2⤵
  PID:11048
- C:\Windows\System\YmZYsHc.exe
  C:\Windows\System\YmZYsHc.exe
  2⤵
  PID:11072
- C:\Windows\System\wBoJQRS.exe
  C:\Windows\System\wBoJQRS.exe
  2⤵
  PID:11096
- C:\Windows\System\aVCcRsM.exe
  C:\Windows\System\aVCcRsM.exe
  2⤵
  PID:11132
- C:\Windows\System\sfwKyqJ.exe
  C:\Windows\System\sfwKyqJ.exe
  2⤵
  PID:11160
- C:\Windows\System\SmAIqNy.exe
  C:\Windows\System\SmAIqNy.exe
  2⤵
  PID:11184
- C:\Windows\System\UrKCpTI.exe
  C:\Windows\System\UrKCpTI.exe
  2⤵
  PID:11212
- C:\Windows\System\IvSYrDW.exe
  C:\Windows\System\IvSYrDW.exe
  2⤵
  PID:11240
- C:\Windows\System\wVSWSoq.exe
  C:\Windows\System\wVSWSoq.exe
  2⤵
  PID:10248
- C:\Windows\System\xjZuOAZ.exe
  C:\Windows\System\xjZuOAZ.exe
  2⤵
  PID:10312
- C:\Windows\System\hEAeXUA.exe
  C:\Windows\System\hEAeXUA.exe
  2⤵
  PID:10372
- C:\Windows\System\QhuHlJK.exe
  C:\Windows\System\QhuHlJK.exe
  2⤵
  PID:10428
- C:\Windows\System\MBgMJUw.exe
  C:\Windows\System\MBgMJUw.exe
  2⤵
  PID:10472
- C:\Windows\System\aFGrTsW.exe
  C:\Windows\System\aFGrTsW.exe
  2⤵
  PID:10564
- C:\Windows\System\EICVAcL.exe
  C:\Windows\System\EICVAcL.exe
  2⤵
  PID:10548
- C:\Windows\System\kmeMsyE.exe
  C:\Windows\System\kmeMsyE.exe
  2⤵
  PID:10620
- C:\Windows\System\MkdGVCo.exe
  C:\Windows\System\MkdGVCo.exe
  2⤵
  PID:10728
- C:\Windows\System\qFNhOup.exe
  C:\Windows\System\qFNhOup.exe
  2⤵
  PID:10756
- C:\Windows\System\SvJPSqZ.exe
  C:\Windows\System\SvJPSqZ.exe
  2⤵
  PID:10780
- C:\Windows\System\tkuoDWB.exe
  C:\Windows\System\tkuoDWB.exe
  2⤵
  PID:10900
- C:\Windows\System\hLYqHrg.exe
  C:\Windows\System\hLYqHrg.exe
  2⤵
  PID:10916
- C:\Windows\System\uulbMta.exe
  C:\Windows\System\uulbMta.exe
  2⤵
  PID:10948
- C:\Windows\System\tGtMRMo.exe
  C:\Windows\System\tGtMRMo.exe
  2⤵
  PID:11084
- C:\Windows\System\CnhrvKw.exe
  C:\Windows\System\CnhrvKw.exe
  2⤵
  PID:11124
- C:\Windows\System\PUpjyOV.exe
  C:\Windows\System\PUpjyOV.exe
  2⤵
  PID:11200
- C:\Windows\System\sNlVMlt.exe
  C:\Windows\System\sNlVMlt.exe
  2⤵
  PID:10112
- C:\Windows\System\mFyAjEP.exe
  C:\Windows\System\mFyAjEP.exe
  2⤵
  PID:10596
- C:\Windows\System\OnZRNdj.exe
  C:\Windows\System\OnZRNdj.exe
  2⤵
  PID:10400
- C:\Windows\System\xavYNfb.exe
  C:\Windows\System\xavYNfb.exe
  2⤵
  PID:10952
- C:\Windows\System\VfAuOYo.exe
  C:\Windows\System\VfAuOYo.exe
  2⤵
  PID:11112
- C:\Windows\System\iLdQLFj.exe
  C:\Windows\System\iLdQLFj.exe
  2⤵
  PID:10284
- C:\Windows\System\DnzXWNy.exe
  C:\Windows\System\DnzXWNy.exe
  2⤵
  PID:11036
- C:\Windows\System\EQMDUoG.exe
  C:\Windows\System\EQMDUoG.exe
  2⤵
  PID:10784
- C:\Windows\System\NWTcTPY.exe
  C:\Windows\System\NWTcTPY.exe
  2⤵
  PID:10960
- C:\Windows\System\QQhjNET.exe
  C:\Windows\System\QQhjNET.exe
  2⤵
  PID:11272
- C:\Windows\System\BHiDTfv.exe
  C:\Windows\System\BHiDTfv.exe
  2⤵
  PID:11296
- C:\Windows\System\tMDdjAW.exe
  C:\Windows\System\tMDdjAW.exe
  2⤵
  PID:11324
- C:\Windows\System\cLhZqHT.exe
  C:\Windows\System\cLhZqHT.exe
  2⤵
  PID:11356
- C:\Windows\System\TwuoXun.exe
  C:\Windows\System\TwuoXun.exe
  2⤵
  PID:11376
- C:\Windows\System\pGVCgnW.exe
  C:\Windows\System\pGVCgnW.exe
  2⤵
  PID:11404
- C:\Windows\System\lGFwWYK.exe
  C:\Windows\System\lGFwWYK.exe
  2⤵
  PID:11436
- C:\Windows\System\obSAmjW.exe
  C:\Windows\System\obSAmjW.exe
  2⤵
  PID:11476
- C:\Windows\System\VlfUoUk.exe
  C:\Windows\System\VlfUoUk.exe
  2⤵
  PID:11512
- C:\Windows\System\hGNbbAz.exe
  C:\Windows\System\hGNbbAz.exe
  2⤵
  PID:11540
- C:\Windows\System\HbUEIOE.exe
  C:\Windows\System\HbUEIOE.exe
  2⤵
  PID:11572
- C:\Windows\System\bWfImuq.exe
  C:\Windows\System\bWfImuq.exe
  2⤵
  PID:11604
- C:\Windows\System\yyUEbFA.exe
  C:\Windows\System\yyUEbFA.exe
  2⤵
  PID:11636
- C:\Windows\System\AsHHhQv.exe
  C:\Windows\System\AsHHhQv.exe
  2⤵
  PID:11660
- C:\Windows\System\SLEIpYf.exe
  C:\Windows\System\SLEIpYf.exe
  2⤵
  PID:11692
- C:\Windows\System\seZodrm.exe
  C:\Windows\System\seZodrm.exe
  2⤵
  PID:11720
- C:\Windows\System\RwchIgL.exe
  C:\Windows\System\RwchIgL.exe
  2⤵
  PID:11740
- C:\Windows\System\omHgDBU.exe
  C:\Windows\System\omHgDBU.exe
  2⤵
  PID:11768
- C:\Windows\System\TPhiOZn.exe
  C:\Windows\System\TPhiOZn.exe
  2⤵
  PID:11796
- C:\Windows\System\CPFbPbR.exe
  C:\Windows\System\CPFbPbR.exe
  2⤵
  PID:11820
- C:\Windows\System\JlSIlhv.exe
  C:\Windows\System\JlSIlhv.exe
  2⤵
  PID:11836
- C:\Windows\System\uEiQxMR.exe
  C:\Windows\System\uEiQxMR.exe
  2⤵
  PID:11868
- C:\Windows\System\VHRixHc.exe
  C:\Windows\System\VHRixHc.exe
  2⤵
  PID:11908
- C:\Windows\System\bExUiQg.exe
  C:\Windows\System\bExUiQg.exe
  2⤵
  PID:11944
- C:\Windows\System\AaNcsHL.exe
  C:\Windows\System\AaNcsHL.exe
  2⤵
  PID:11968
- C:\Windows\System\uWQaNhX.exe
  C:\Windows\System\uWQaNhX.exe
  2⤵
  PID:12000
- C:\Windows\System\abDZrUj.exe
  C:\Windows\System\abDZrUj.exe
  2⤵
  PID:12036
- C:\Windows\System\RDUHTyr.exe
  C:\Windows\System\RDUHTyr.exe
  2⤵
  PID:12056
- C:\Windows\System\rjJgSIl.exe
  C:\Windows\System\rjJgSIl.exe
  2⤵
  PID:12072
- C:\Windows\System\ALiSMBr.exe
  C:\Windows\System\ALiSMBr.exe
  2⤵
  PID:12092
- C:\Windows\System\vzNVPZG.exe
  C:\Windows\System\vzNVPZG.exe
  2⤵
  PID:12124
- C:\Windows\System\AAaqwfv.exe
  C:\Windows\System\AAaqwfv.exe
  2⤵
  PID:12152
- C:\Windows\System\tPMIfXo.exe
  C:\Windows\System\tPMIfXo.exe
  2⤵
  PID:12188
- C:\Windows\System\fdiFfZI.exe
  C:\Windows\System\fdiFfZI.exe
  2⤵
  PID:12216
- C:\Windows\System\dYALwvr.exe
  C:\Windows\System\dYALwvr.exe
  2⤵
  PID:12240
- C:\Windows\System\fxPGgPw.exe
  C:\Windows\System\fxPGgPw.exe
  2⤵
  PID:12268
- C:\Windows\System\CxqtzYg.exe
  C:\Windows\System\CxqtzYg.exe
  2⤵
  PID:11148
- C:\Windows\System\soXaNXD.exe
  C:\Windows\System\soXaNXD.exe
  2⤵
  PID:11304
- C:\Windows\System\xbXIEAz.exe
  C:\Windows\System\xbXIEAz.exe
  2⤵
  PID:11344
- C:\Windows\System\sjRFbKy.exe
  C:\Windows\System\sjRFbKy.exe
  2⤵
  PID:11388
- C:\Windows\System\UtmQYKj.exe
  C:\Windows\System\UtmQYKj.exe
  2⤵
  PID:11412
- C:\Windows\System\rmuUvkJ.exe
  C:\Windows\System\rmuUvkJ.exe
  2⤵
  PID:11560
- C:\Windows\System\MtugfwB.exe
  C:\Windows\System\MtugfwB.exe
  2⤵
  PID:11588
- C:\Windows\System\IPVeNGd.exe
  C:\Windows\System\IPVeNGd.exe
  2⤵
  PID:11688
- C:\Windows\System\IEJVllC.exe
  C:\Windows\System\IEJVllC.exe
  2⤵
  PID:11752
- C:\Windows\System\lFossQe.exe
  C:\Windows\System\lFossQe.exe
  2⤵
  PID:11736
- C:\Windows\System\YWcJEyl.exe
  C:\Windows\System\YWcJEyl.exe
  2⤵
  PID:11864
- C:\Windows\System\YfcayOM.exe
  C:\Windows\System\YfcayOM.exe
  2⤵
  PID:11956
- C:\Windows\System\UHSMcUn.exe
  C:\Windows\System\UHSMcUn.exe
  2⤵
  PID:11960
- C:\Windows\System\Yqhzmyi.exe
  C:\Windows\System\Yqhzmyi.exe
  2⤵
  PID:12116
- C:\Windows\System\QQerqpM.exe
  C:\Windows\System\QQerqpM.exe
  2⤵
  PID:12204
- C:\Windows\System\oqSNJMQ.exe
  C:\Windows\System\oqSNJMQ.exe
  2⤵
  PID:12164
- C:\Windows\System\nLIdUJe.exe
  C:\Windows\System\nLIdUJe.exe
  2⤵
  PID:10692
- C:\Windows\System\abDacQA.exe
  C:\Windows\System\abDacQA.exe
  2⤵
  PID:10424
- C:\Windows\System\wDOEjmc.exe
  C:\Windows\System\wDOEjmc.exe
  2⤵
  PID:11628
- C:\Windows\System\KllISkU.exe
  C:\Windows\System\KllISkU.exe
  2⤵
  PID:11668
- C:\Windows\System\ojbvmkk.exe
  C:\Windows\System\ojbvmkk.exe
  2⤵
  PID:11732
- C:\Windows\System\etbdvpi.exe
  C:\Windows\System\etbdvpi.exe
  2⤵
  PID:12068
- C:\Windows\System\kqlAZAW.exe
  C:\Windows\System\kqlAZAW.exe
  2⤵
  PID:12100
- C:\Windows\System\MDwytUE.exe
  C:\Windows\System\MDwytUE.exe
  2⤵
  PID:11492
- C:\Windows\System\ddnBAoj.exe
  C:\Windows\System\ddnBAoj.exe
  2⤵
  PID:11860
- C:\Windows\System\PcEMIFG.exe
  C:\Windows\System\PcEMIFG.exe
  2⤵
  PID:12140
- C:\Windows\System\pzYPSVe.exe
  C:\Windows\System\pzYPSVe.exe
  2⤵
  PID:11848
- C:\Windows\System\SNJKdxp.exe
  C:\Windows\System\SNJKdxp.exe
  2⤵
  PID:12024
- C:\Windows\System\oRYQsSt.exe
  C:\Windows\System\oRYQsSt.exe
  2⤵
  PID:12332
- C:\Windows\System\ExBFdXe.exe
  C:\Windows\System\ExBFdXe.exe
  2⤵
  PID:12352
- C:\Windows\System\ZfqsFNB.exe
  C:\Windows\System\ZfqsFNB.exe
  2⤵
  PID:12380
- C:\Windows\System\FemmQqj.exe
  C:\Windows\System\FemmQqj.exe
  2⤵
  PID:12400
- C:\Windows\System\ehKGFgB.exe
  C:\Windows\System\ehKGFgB.exe
  2⤵
  PID:12448
- C:\Windows\System\IJqFqiI.exe
  C:\Windows\System\IJqFqiI.exe
  2⤵
  PID:12472
- C:\Windows\System\MflHDDK.exe
  C:\Windows\System\MflHDDK.exe
  2⤵
  PID:12500
- C:\Windows\System\iCypUNA.exe
  C:\Windows\System\iCypUNA.exe
  2⤵
  PID:12540
- C:\Windows\System\dTumQLS.exe
  C:\Windows\System\dTumQLS.exe
  2⤵
  PID:12572
- C:\Windows\System\MHKafPs.exe
  C:\Windows\System\MHKafPs.exe
  2⤵
  PID:12600
- C:\Windows\System\zXQXgQT.exe
  C:\Windows\System\zXQXgQT.exe
  2⤵
  PID:12628
- C:\Windows\System\CVAfsDR.exe
  C:\Windows\System\CVAfsDR.exe
  2⤵
  PID:12656
- C:\Windows\System\RYSwPAb.exe
  C:\Windows\System\RYSwPAb.exe
  2⤵
  PID:12672
- C:\Windows\System\mguuCoH.exe
  C:\Windows\System\mguuCoH.exe
  2⤵
  PID:12700
- C:\Windows\System\mhHuEMp.exe
  C:\Windows\System\mhHuEMp.exe
  2⤵
  PID:12728
- C:\Windows\System\ighAUeP.exe
  C:\Windows\System\ighAUeP.exe
  2⤵
  PID:12744
- C:\Windows\System\DLUzFRJ.exe
  C:\Windows\System\DLUzFRJ.exe
  2⤵
  PID:12776
- C:\Windows\System\kuwrVgs.exe
  C:\Windows\System\kuwrVgs.exe
  2⤵
  PID:12808
- C:\Windows\System\RvjQxCb.exe
  C:\Windows\System\RvjQxCb.exe
  2⤵
  PID:12828
- C:\Windows\System\oGyMAbs.exe
  C:\Windows\System\oGyMAbs.exe
  2⤵
  PID:12852
- C:\Windows\System\HChoNPP.exe
  C:\Windows\System\HChoNPP.exe
  2⤵
  PID:12884
- C:\Windows\System\yaYBSiS.exe
  C:\Windows\System\yaYBSiS.exe
  2⤵
  PID:12916
- C:\Windows\System\wLdbgvQ.exe
  C:\Windows\System\wLdbgvQ.exe
  2⤵
  PID:12936
- C:\Windows\System\UzsdNSn.exe
  C:\Windows\System\UzsdNSn.exe
  2⤵
  PID:12960
- C:\Windows\System\XpUmmBW.exe
  C:\Windows\System\XpUmmBW.exe
  2⤵
  PID:12992
- C:\Windows\System\ismkgWU.exe
  C:\Windows\System\ismkgWU.exe
  2⤵
  PID:13020
- C:\Windows\System\GcDsxMw.exe
  C:\Windows\System\GcDsxMw.exe
  2⤵
  PID:13056
- C:\Windows\System\SJPrhRn.exe
  C:\Windows\System\SJPrhRn.exe
  2⤵
  PID:13080
- C:\Windows\System\MXqOyRl.exe
  C:\Windows\System\MXqOyRl.exe
  2⤵
  PID:13120
- C:\Windows\System\NVZtYOy.exe
  C:\Windows\System\NVZtYOy.exe
  2⤵
  PID:13148
- C:\Windows\System\plBKGQk.exe
  C:\Windows\System\plBKGQk.exe
  2⤵
  PID:13164
- C:\Windows\System\lcSvRfq.exe
  C:\Windows\System\lcSvRfq.exe
  2⤵
  PID:13192
- C:\Windows\System\VCWylRH.exe
  C:\Windows\System\VCWylRH.exe
  2⤵
  PID:13220
- C:\Windows\System\nkzjEAb.exe
  C:\Windows\System\nkzjEAb.exe
  2⤵
  PID:13248
- C:\Windows\System\TiujSLe.exe
  C:\Windows\System\TiujSLe.exe
  2⤵
  PID:13284
- C:\Windows\System\cTcBjCB.exe
  C:\Windows\System\cTcBjCB.exe
  2⤵
  PID:13300
- C:\Windows\System\qKipvrA.exe
  C:\Windows\System\qKipvrA.exe
  2⤵
  PID:12312
- C:\Windows\System\SybfDKe.exe
  C:\Windows\System\SybfDKe.exe
  2⤵
  PID:12368
- C:\Windows\System\vpWbMhv.exe
  C:\Windows\System\vpWbMhv.exe
  2⤵
  PID:12408
- C:\Windows\System\mURXEQB.exe
  C:\Windows\System\mURXEQB.exe
  2⤵
  PID:12492
- C:\Windows\System\CEuRWMn.exe
  C:\Windows\System\CEuRWMn.exe
  2⤵
  PID:12564
- C:\Windows\System\CTAJrko.exe
  C:\Windows\System\CTAJrko.exe
  2⤵
  PID:12620
- C:\Windows\System\KCwGuwm.exe
  C:\Windows\System\KCwGuwm.exe
  2⤵
  PID:12652
- C:\Windows\System\BMkpWhY.exe
  C:\Windows\System\BMkpWhY.exe
  2⤵
  PID:12720
- C:\Windows\System\JgOuLuF.exe
  C:\Windows\System\JgOuLuF.exe
  2⤵
  PID:12768
- C:\Windows\System\satKoWc.exe
  C:\Windows\System\satKoWc.exe
  2⤵
  PID:12848
- C:\Windows\System\ogrxoPh.exe
  C:\Windows\System\ogrxoPh.exe
  2⤵
  PID:12924
- C:\Windows\System\DumlHWg.exe
  C:\Windows\System\DumlHWg.exe
  2⤵
  PID:12952
- C:\Windows\System\dZSjFUZ.exe
  C:\Windows\System\dZSjFUZ.exe
  2⤵
  PID:12976
- C:\Windows\System\GDYTYPV.exe
  C:\Windows\System\GDYTYPV.exe
  2⤵
  PID:13064
- C:\Windows\System\BvPaRSw.exe
  C:\Windows\System\BvPaRSw.exe
  2⤵
  PID:13100
- C:\Windows\System\yhtQoVF.exe
  C:\Windows\System\yhtQoVF.exe
  2⤵
  PID:13268
- C:\Windows\System\hzQouro.exe
  C:\Windows\System\hzQouro.exe
  2⤵
  PID:12148
- C:\Windows\System\ZPwoBuK.exe
  C:\Windows\System\ZPwoBuK.exe
  2⤵
  PID:12532
- C:\Windows\System\qRZWWQD.exe
  C:\Windows\System\qRZWWQD.exe
  2⤵
  PID:12636
- C:\Windows\System\qSsSNrU.exe
  C:\Windows\System\qSsSNrU.exe
  2⤵
  PID:12784
- C:\Windows\System\dzLJqzW.exe
  C:\Windows\System\dzLJqzW.exe
  2⤵
  PID:13016
- C:\Windows\System\KrtznzQ.exe
  C:\Windows\System\KrtznzQ.exe
  2⤵
  PID:12984
- C:\Windows\System\pdODFqW.exe
  C:\Windows\System\pdODFqW.exe
  2⤵
  PID:13204
- C:\Windows\System\HyurvhA.exe
  C:\Windows\System\HyurvhA.exe
  2⤵
  PID:12552
- C:\Windows\System\AzqnfEz.exe
  C:\Windows\System\AzqnfEz.exe
  2⤵
  PID:12736
- C:\Windows\System\myNXlBX.exe
  C:\Windows\System\myNXlBX.exe
  2⤵
  PID:13104
- C:\Windows\System\KKIniEm.exe
  C:\Windows\System\KKIniEm.exe
  2⤵
  PID:12320
- C:\Windows\System\xKjOMvP.exe
  C:\Windows\System\xKjOMvP.exe
  2⤵
  PID:13332
- C:\Windows\System\PrHjHnZ.exe
  C:\Windows\System\PrHjHnZ.exe
  2⤵
  PID:13368
- C:\Windows\System\CWYwlwl.exe
  C:\Windows\System\CWYwlwl.exe
  2⤵
  PID:13388
- C:\Windows\System\nQssXpQ.exe
  C:\Windows\System\nQssXpQ.exe
  2⤵
  PID:13412
- C:\Windows\System\yUvzEGW.exe
  C:\Windows\System\yUvzEGW.exe
  2⤵
  PID:13444
- C:\Windows\System\RCjQaEe.exe
  C:\Windows\System\RCjQaEe.exe
  2⤵
  PID:13468
- C:\Windows\System\CHqPwhX.exe
  C:\Windows\System\CHqPwhX.exe
  2⤵
  PID:13500
- C:\Windows\System\oWOqTPa.exe
  C:\Windows\System\oWOqTPa.exe
  2⤵
  PID:13528
- C:\Windows\System\nSuMxDz.exe
  C:\Windows\System\nSuMxDz.exe
  2⤵
  PID:13560
- C:\Windows\System\nvoCHnc.exe
  C:\Windows\System\nvoCHnc.exe
  2⤵
  PID:13584
- C:\Windows\System\LkspYME.exe
  C:\Windows\System\LkspYME.exe
  2⤵
  PID:13612
- C:\Windows\System\iVLBExz.exe
  C:\Windows\System\iVLBExz.exe
  2⤵
  PID:13628
- C:\Windows\System\dYFngAn.exe
  C:\Windows\System\dYFngAn.exe
  2⤵
  PID:13652
- C:\Windows\System\oSJNhJp.exe
  C:\Windows\System\oSJNhJp.exe
  2⤵
  PID:13676
- C:\Windows\System\ymtkQfk.exe
  C:\Windows\System\ymtkQfk.exe
  2⤵
  PID:13708
- C:\Windows\System\ezjkmjb.exe
  C:\Windows\System\ezjkmjb.exe
  2⤵
  PID:13728
- C:\Windows\System\HAJjmPK.exe
  C:\Windows\System\HAJjmPK.exe
  2⤵
  PID:13744
- C:\Windows\System\SArQXRQ.exe
  C:\Windows\System\SArQXRQ.exe
  2⤵
  PID:13776
- C:\Windows\System\RhauqUb.exe
  C:\Windows\System\RhauqUb.exe
  2⤵
  PID:13796
- C:\Windows\System\dcEVMnw.exe
  C:\Windows\System\dcEVMnw.exe
  2⤵
  PID:13836
- C:\Windows\System\ehJxwJb.exe
  C:\Windows\System\ehJxwJb.exe
  2⤵
  PID:13856
- C:\Windows\System\FyORnWG.exe
  C:\Windows\System\FyORnWG.exe
  2⤵
  PID:13872
- C:\Windows\System\MCUQLwl.exe
  C:\Windows\System\MCUQLwl.exe
  2⤵
  PID:13904
- C:\Windows\System\wXXaKTe.exe
  C:\Windows\System\wXXaKTe.exe
  2⤵
  PID:13928
- C:\Windows\System\bPnUHpw.exe
  C:\Windows\System\bPnUHpw.exe
  2⤵
  PID:13952
- C:\Windows\System\BSVDvmH.exe
  C:\Windows\System\BSVDvmH.exe
  2⤵
  PID:13984
- C:\Windows\System\WJhwlgE.exe
  C:\Windows\System\WJhwlgE.exe
  2⤵
  PID:14004
- C:\Windows\System\VoOycby.exe
  C:\Windows\System\VoOycby.exe
  2⤵
  PID:14040
- C:\Windows\System\gKngiRq.exe
  C:\Windows\System\gKngiRq.exe
  2⤵
  PID:14084
- C:\Windows\System\hHzwIFs.exe
  C:\Windows\System\hHzwIFs.exe
  2⤵
  PID:14120
- C:\Windows\System\hUIEQwl.exe
  C:\Windows\System\hUIEQwl.exe
  2⤵
  PID:14152
- C:\Windows\System\aYWNzDl.exe
  C:\Windows\System\aYWNzDl.exe
  2⤵
  PID:14184
- C:\Windows\System\qtlrGKT.exe
  C:\Windows\System\qtlrGKT.exe
  2⤵
  PID:14204
- C:\Windows\System\HngCouD.exe
  C:\Windows\System\HngCouD.exe
  2⤵
  PID:14236
- C:\Windows\System\MvBGLIN.exe
  C:\Windows\System\MvBGLIN.exe
  2⤵
  PID:14268
- C:\Windows\System\ISjRgzu.exe
  C:\Windows\System\ISjRgzu.exe
  2⤵
  PID:14312
- C:\Windows\System\BROsAvx.exe
  C:\Windows\System\BROsAvx.exe
  2⤵
  PID:13236
- C:\Windows\System\JrkitEq.exe
  C:\Windows\System\JrkitEq.exe
  2⤵
  PID:13324
- C:\Windows\System\reXixMB.exe
  C:\Windows\System\reXixMB.exe
  2⤵
  PID:13352
- C:\Windows\System\YTiaTxy.exe
  C:\Windows\System\YTiaTxy.exe
  2⤵
  PID:13428
- C:\Windows\System\tXMAupp.exe
  C:\Windows\System\tXMAupp.exe
  2⤵
  PID:13460
- C:\Windows\System\NIOAAZc.exe
  C:\Windows\System\NIOAAZc.exe
  2⤵
  PID:13516
- C:\Windows\System\ZjGjuvd.exe
  C:\Windows\System\ZjGjuvd.exe
  2⤵
  PID:13548
- C:\Windows\System\hgAnQDt.exe
  C:\Windows\System\hgAnQDt.exe
  2⤵
  PID:13696
- C:\Windows\System\nRMlphi.exe
  C:\Windows\System\nRMlphi.exe
  2⤵
  PID:13736
- C:\Windows\System\WHMbYiD.exe
  C:\Windows\System\WHMbYiD.exe
  2⤵
  PID:13832
- C:\Windows\System\FtNsELI.exe
  C:\Windows\System\FtNsELI.exe
  2⤵
  PID:13900
- C:\Windows\System\ANwaGyw.exe
  C:\Windows\System\ANwaGyw.exe
  2⤵
  PID:13892
- C:\Windows\System\RzzUDVZ.exe
  C:\Windows\System\RzzUDVZ.exe
  2⤵
  PID:13992
- C:\Windows\System\bUMiDRs.exe
  C:\Windows\System\bUMiDRs.exe
  2⤵
  PID:14144
- C:\Windows\System\FsFrDuI.exe
  C:\Windows\System\FsFrDuI.exe
  2⤵
  PID:14096
- C:\Windows\System\FjkowLt.exe
  C:\Windows\System\FjkowLt.exe
  2⤵
  PID:14252
- C:\Windows\System\cYQzhbB.exe
  C:\Windows\System\cYQzhbB.exe
  2⤵
  PID:12488
- C:\Windows\System\LvCLNTY.exe
  C:\Windows\System\LvCLNTY.exe
  2⤵
  PID:13344
- C:\Windows\System\KusJjsJ.exe
  C:\Windows\System\KusJjsJ.exe
  2⤵
  PID:13648
- C:\Windows\System\jmVdLkx.exe
  C:\Windows\System\jmVdLkx.exe
  2⤵
  PID:13432
- C:\Windows\System\YCRazhJ.exe
  C:\Windows\System\YCRazhJ.exe
  2⤵
  PID:13768
- C:\Windows\System\Atbdaul.exe
  C:\Windows\System\Atbdaul.exe
  2⤵
  PID:13916
- C:\Windows\System\GcxEZqy.exe
  C:\Windows\System\GcxEZqy.exe
  2⤵
  PID:14072
- C:\Windows\System\pdWARzT.exe
  C:\Windows\System\pdWARzT.exe
  2⤵
  PID:14280
- C:\Windows\System\nxAgKcv.exe
  C:\Windows\System\nxAgKcv.exe
  2⤵
  PID:14332
- C:\Windows\System\HEyFtSp.exe
  C:\Windows\System\HEyFtSp.exe
  2⤵
  PID:13404
- C:\Windows\System\SuldUMd.exe
  C:\Windows\System\SuldUMd.exe
  2⤵
  PID:14076
- C:\Windows\System\okqEwBR.exe
  C:\Windows\System\okqEwBR.exe
  2⤵
  PID:14064
- C:\Windows\System\ygkNyJe.exe
  C:\Windows\System\ygkNyJe.exe
  2⤵
  PID:14364
- C:\Windows\System\ICUtqdF.exe
  C:\Windows\System\ICUtqdF.exe
  2⤵
  PID:14392
- C:\Windows\System\pDhzHYm.exe
  C:\Windows\System\pDhzHYm.exe
  2⤵
  PID:14428
- C:\Windows\System\DjBIBJR.exe
  C:\Windows\System\DjBIBJR.exe
  2⤵
  PID:14448
- C:\Windows\System\UFCFXAj.exe
  C:\Windows\System\UFCFXAj.exe
  2⤵
  PID:14472
- C:\Windows\System\cjWTdNy.exe
  C:\Windows\System\cjWTdNy.exe
  2⤵
  PID:14496
- C:\Windows\System\FeRfPbM.exe
  C:\Windows\System\FeRfPbM.exe
  2⤵
  PID:14524
- C:\Windows\System\MKYtsds.exe
  C:\Windows\System\MKYtsds.exe
  2⤵
  PID:14556
- C:\Windows\System\JzYWOkb.exe
  C:\Windows\System\JzYWOkb.exe
  2⤵
  PID:14588
- C:\Windows\System\YQhVHWI.exe
  C:\Windows\System\YQhVHWI.exe
  2⤵
  PID:14612
- C:\Windows\System\yMzNQfn.exe
  C:\Windows\System\yMzNQfn.exe
  2⤵
  PID:14640
- C:\Windows\System\zMdhNug.exe
  C:\Windows\System\zMdhNug.exe
  2⤵
  PID:14668
- C:\Windows\System\JbIgegF.exe
  C:\Windows\System\JbIgegF.exe
  2⤵
  PID:14704
- C:\Windows\System\nMRrNXX.exe
  C:\Windows\System\nMRrNXX.exe
  2⤵
  PID:14724
- C:\Windows\System\YdWpHGT.exe
  C:\Windows\System\YdWpHGT.exe
  2⤵
  PID:14748
- C:\Windows\System\nMwjpng.exe
  C:\Windows\System\nMwjpng.exe
  2⤵
  PID:14768
- C:\Windows\System\tekkpAC.exe
  C:\Windows\System\tekkpAC.exe
  2⤵
  PID:14792
- C:\Windows\System\gaRwayE.exe
  C:\Windows\System\gaRwayE.exe
  2⤵
  PID:14816
- C:\Windows\System\CoRToxp.exe
  C:\Windows\System\CoRToxp.exe
  2⤵
  PID:14840
- C:\Windows\System\wXrwPUG.exe
  C:\Windows\System\wXrwPUG.exe
  2⤵
  PID:14868
- C:\Windows\System\YMNHOkg.exe
  C:\Windows\System\YMNHOkg.exe
  2⤵
  PID:14888
- C:\Windows\System\QNsSkPE.exe
  C:\Windows\System\QNsSkPE.exe
  2⤵
  PID:14912
- C:\Windows\System\EPsOQNM.exe
  C:\Windows\System\EPsOQNM.exe
  2⤵
  PID:14936
- C:\Windows\System\EONYqCX.exe
  C:\Windows\System\EONYqCX.exe
  2⤵
  PID:14964
- C:\Windows\System\URMBerl.exe
  C:\Windows\System\URMBerl.exe
  2⤵
  PID:14996
- C:\Windows\System\FsyrdXN.exe
  C:\Windows\System\FsyrdXN.exe
  2⤵
  PID:15036
- C:\Windows\System\eSOUIZP.exe
  C:\Windows\System\eSOUIZP.exe
  2⤵
  PID:15060
- C:\Windows\System\tpsjqGe.exe
  C:\Windows\System\tpsjqGe.exe
  2⤵
  PID:15084
- C:\Windows\System\tHZmIvB.exe
  C:\Windows\System\tHZmIvB.exe
  2⤵
  PID:15112
- C:\Windows\System\CeaOBJW.exe
  C:\Windows\System\CeaOBJW.exe
  2⤵
  PID:15140
- C:\Windows\System\mYdlsdF.exe
  C:\Windows\System\mYdlsdF.exe
  2⤵
  PID:15168
- C:\Windows\System\kihkygu.exe
  C:\Windows\System\kihkygu.exe
  2⤵
  PID:15200
- C:\Windows\System\gUgdeKN.exe
  C:\Windows\System\gUgdeKN.exe
  2⤵
  PID:15232
- C:\Windows\System\LdaaELo.exe
  C:\Windows\System\LdaaELo.exe
  2⤵
  PID:15260
- C:\Windows\System\hCtiAju.exe
  C:\Windows\System\hCtiAju.exe
  2⤵
  PID:15280
- C:\Windows\System\jTgOSjc.exe
  C:\Windows\System\jTgOSjc.exe
  2⤵
  PID:15312
- C:\Windows\System\SCGQMaI.exe
  C:\Windows\System\SCGQMaI.exe
  2⤵
  PID:15344
- C:\Windows\System\IjnIpuY.exe
  C:\Windows\System\IjnIpuY.exe
  2⤵
  PID:13692
- C:\Windows\System\iglfMuq.exe
  C:\Windows\System\iglfMuq.exe
  2⤵
  PID:14344
- C:\Windows\System\iAOyjBo.exe
  C:\Windows\System\iAOyjBo.exe
  2⤵
  PID:14384
- C:\Windows\System\PHSPbWq.exe
  C:\Windows\System\PHSPbWq.exe
  2⤵
  PID:14440
- C:\Windows\System\PONbuqi.exe
  C:\Windows\System\PONbuqi.exe
  2⤵
  PID:14512
- C:\Windows\System\wXudWeO.exe
  C:\Windows\System\wXudWeO.exe
  2⤵
  PID:14636
- C:\Windows\System\UxEyiOR.exe
  C:\Windows\System\UxEyiOR.exe
  2⤵
  PID:14656
- C:\Windows\System\kuOyWvf.exe
  C:\Windows\System\kuOyWvf.exe
  2⤵
  PID:14744
- C:\Windows\System\bTvBcXs.exe
  C:\Windows\System\bTvBcXs.exe
  2⤵
  PID:14756
- C:\Windows\System\ABgPAcx.exe
  C:\Windows\System\ABgPAcx.exe
  2⤵
  PID:14856
- C:\Windows\System\BaBPXTm.exe
  C:\Windows\System\BaBPXTm.exe
  2⤵
  PID:14904
- C:\Windows\System\olDpYAT.exe
  C:\Windows\System\olDpYAT.exe
  2⤵
  PID:14860
- C:\Windows\System\kduKaZx.exe
  C:\Windows\System\kduKaZx.exe
  2⤵
  PID:14988
- C:\Windows\System\ABWLNqq.exe
  C:\Windows\System\ABWLNqq.exe
  2⤵
  PID:15012
- C:\Windows\System\WdjAowE.exe
  C:\Windows\System\WdjAowE.exe
  2⤵
  PID:15164
- C:\Windows\System\vqQnALc.exe
  C:\Windows\System\vqQnALc.exe
  2⤵
  PID:15132
- C:\Windows\System\yywObdw.exe
  C:\Windows\System\yywObdw.exe
  2⤵
  PID:15180
- C:\Windows\System\dKYIsBZ.exe
  C:\Windows\System\dKYIsBZ.exe
  2⤵
  PID:15248
- C:\Windows\System\JzqAmZq.exe
  C:\Windows\System\JzqAmZq.exe
  2⤵
  PID:13784
- C:\Windows\System\IqSduDT.exe
  C:\Windows\System\IqSduDT.exe
  2⤵
  PID:14404
- C:\Windows\System\FIRISRe.exe
  C:\Windows\System\FIRISRe.exe
  2⤵
  PID:14780
- C:\Windows\System\mFKrRnq.exe
  C:\Windows\System\mFKrRnq.exe
  2⤵
  PID:14808
- C:\Windows\System\iTiAiwF.exe
  C:\Windows\System\iTiAiwF.exe
  2⤵
  PID:15156
- C:\Windows\System\aTcSEBU.exe
  C:\Windows\System\aTcSEBU.exe
  2⤵
  PID:14992
- C:\Windows\System\yxjcNSD.exe
  C:\Windows\System\yxjcNSD.exe
  2⤵
  PID:15152
- C:\Windows\System\VDUpCLM.exe
  C:\Windows\System\VDUpCLM.exe
  2⤵
  PID:14372
- C:\Windows\System\xGhNQPj.exe
  C:\Windows\System\xGhNQPj.exe
  2⤵
  PID:14716
- C:\Windows\System\mgcbxGX.exe
  C:\Windows\System\mgcbxGX.exe
  2⤵
  PID:15392
- C:\Windows\System\nEBdpZf.exe
  C:\Windows\System\nEBdpZf.exe
  2⤵
  PID:15412
- C:\Windows\System\IwvXjdP.exe
  C:\Windows\System\IwvXjdP.exe
  2⤵
  PID:15436
- C:\Windows\System\dnZSgxj.exe
  C:\Windows\System\dnZSgxj.exe
  2⤵
  PID:15476
- C:\Windows\System\lXqnAYE.exe
  C:\Windows\System\lXqnAYE.exe
  2⤵
  PID:15496
- C:\Windows\System\QrZzuUp.exe
  C:\Windows\System\QrZzuUp.exe
  2⤵
  PID:15516
- C:\Windows\System\XKbSxFt.exe
  C:\Windows\System\XKbSxFt.exe
  2⤵
  PID:15548
- C:\Windows\System\LlwigJO.exe
  C:\Windows\System\LlwigJO.exe
  2⤵
  PID:15572
- C:\Windows\System\iLuzooh.exe
  C:\Windows\System\iLuzooh.exe
  2⤵
  PID:15596
- C:\Windows\System\qClKLQt.exe
  C:\Windows\System\qClKLQt.exe
  2⤵
  PID:15628
- C:\Windows\System\NcIGdol.exe
  C:\Windows\System\NcIGdol.exe
  2⤵
  PID:15652
- C:\Windows\System\CRyDdnO.exe
  C:\Windows\System\CRyDdnO.exe
  2⤵
  PID:15692
- C:\Windows\System\NGxJaxd.exe
  C:\Windows\System\NGxJaxd.exe
  2⤵
  PID:15728
- C:\Windows\System\CRjNnfr.exe
  C:\Windows\System\CRjNnfr.exe
  2⤵
  PID:15756
- C:\Windows\System\wuHAVBu.exe
  C:\Windows\System\wuHAVBu.exe
  2⤵
  PID:15776
- C:\Windows\System\TBrHbEk.exe
  C:\Windows\System\TBrHbEk.exe
  2⤵
  PID:15812
- C:\Windows\System\CtpRENu.exe
  C:\Windows\System\CtpRENu.exe
  2⤵
  PID:15844
- C:\Windows\System\DpraMhV.exe
  C:\Windows\System\DpraMhV.exe
  2⤵
  PID:15864
- C:\Windows\System\ruRsBdq.exe
  C:\Windows\System\ruRsBdq.exe
  2⤵
  PID:15884
- C:\Windows\System\UMyZmFp.exe
  C:\Windows\System\UMyZmFp.exe
  2⤵
  PID:15904
- C:\Windows\System\TSmpHFB.exe
  C:\Windows\System\TSmpHFB.exe
  2⤵
  PID:15920
- C:\Windows\System\qVeoTZd.exe
  C:\Windows\System\qVeoTZd.exe
  2⤵
  PID:15952
- C:\Windows\System\CebHSWZ.exe
  C:\Windows\System\CebHSWZ.exe
  2⤵
  PID:15984
- C:\Windows\System\EZVQJaM.exe
  C:\Windows\System\EZVQJaM.exe
  2⤵
  PID:16004
- C:\Windows\System\rdUWokw.exe
  C:\Windows\System\rdUWokw.exe
  2⤵
  PID:16032
- C:\Windows\System\PAHpDbc.exe
  C:\Windows\System\PAHpDbc.exe
  2⤵
  PID:16048
- C:\Windows\System\qnPlxSk.exe
  C:\Windows\System\qnPlxSk.exe
  2⤵
  PID:16080
- C:\Windows\System\QfhqBFj.exe
  C:\Windows\System\QfhqBFj.exe
  2⤵
  PID:16096
- C:\Windows\System\nDrotee.exe
  C:\Windows\System\nDrotee.exe
  2⤵
  PID:16132
- C:\Windows\System\DdauoAk.exe
  C:\Windows\System\DdauoAk.exe
  2⤵
  PID:16160
- C:\Windows\System\qjaRwZb.exe
  C:\Windows\System\qjaRwZb.exe
  2⤵
  PID:16192
- C:\Windows\System\hbUEXnS.exe
  C:\Windows\System\hbUEXnS.exe
  2⤵
  PID:16228
- C:\Windows\System\MJhenAg.exe
  C:\Windows\System\MJhenAg.exe
  2⤵
  PID:16264
- C:\Windows\System\dRmfPEz.exe
  C:\Windows\System\dRmfPEz.exe
  2⤵
  PID:16288
- C:\Windows\System\WwJCfKm.exe
  C:\Windows\System\WwJCfKm.exe
  2⤵
  PID:16328
- C:\Windows\System\haIJxOa.exe
  C:\Windows\System\haIJxOa.exe
  2⤵
  PID:16356
- C:\Windows\System\QLCNGCj.exe
  C:\Windows\System\QLCNGCj.exe
  2⤵
  PID:16376
- C:\Windows\System\MrTynmV.exe
  C:\Windows\System\MrTynmV.exe
  2⤵
  PID:15292
- C:\Windows\System\yXvImks.exe
  C:\Windows\System\yXvImks.exe
  2⤵
  PID:14976
- C:\Windows\System\AhEbewu.exe
  C:\Windows\System\AhEbewu.exe
  2⤵
  PID:15460
- C:\Windows\System\LyDVdrA.exe
  C:\Windows\System\LyDVdrA.exe
  2⤵
  PID:15400
- C:\Windows\System\mlLDkeK.exe
  C:\Windows\System\mlLDkeK.exe
  2⤵
  PID:15504
- C:\Windows\System\gevgdDB.exe
  C:\Windows\System\gevgdDB.exe
  2⤵
  PID:15676
- C:\Windows\System\YyPMpBl.exe
  C:\Windows\System\YyPMpBl.exe
  2⤵
  PID:15896
- C:\Windows\System\eyFXtTf.exe
  C:\Windows\System\eyFXtTf.exe
  2⤵
  PID:16044
- C:\Windows\System\kRrfxSo.exe
  C:\Windows\System\kRrfxSo.exe
  2⤵
  PID:15824
- C:\Windows\System\dqLOkFe.exe
  C:\Windows\System\dqLOkFe.exe
  2⤵
  PID:16124
- C:\Windows\System\qPsZmBI.exe
  C:\Windows\System\qPsZmBI.exe
  2⤵
  PID:16116
- C:\Windows\System\SZucdjn.exe
  C:\Windows\System\SZucdjn.exe
  2⤵
  PID:16152
- C:\Windows\System\iPPCAQr.exe
  C:\Windows\System\iPPCAQr.exe
  2⤵
  PID:16216
- C:\Windows\System\XltENpm.exe
  C:\Windows\System\XltENpm.exe
  2⤵
  PID:14540
- C:\Windows\System\uIBfLMw.exe
  C:\Windows\System\uIBfLMw.exe
  2⤵
  PID:15352
- C:\Windows\System\lgeoGln.exe
  C:\Windows\System\lgeoGln.exe
  2⤵
  PID:16352
- C:\Windows\System\AhXnfMK.exe
  C:\Windows\System\AhXnfMK.exe
  2⤵
  PID:15580
- C:\Windows\System\rfSKmFj.exe
  C:\Windows\System\rfSKmFj.exe
  2⤵
  PID:15624
- C:\Windows\System\LwVczgC.exe
  C:\Windows\System\LwVczgC.exe
  2⤵
  PID:15996
- C:\Windows\System\uNmfRIL.exe
  C:\Windows\System\uNmfRIL.exe
  2⤵
  PID:16072
- C:\Windows\System\MNvdevr.exe
  C:\Windows\System\MNvdevr.exe
  2⤵
  PID:16200
- C:\Windows\System\nRsaTOK.exe
  C:\Windows\System\nRsaTOK.exe
  2⤵
  PID:14812
- C:\Windows\System\qeZLrdQ.exe
  C:\Windows\System\qeZLrdQ.exe
  2⤵
  PID:16176
- C:\Windows\System\quVlILR.exe
  C:\Windows\System\quVlILR.exe
  2⤵
  PID:16028
- C:\Windows\System\FeprKLo.exe
  C:\Windows\System\FeprKLo.exe
  2⤵
  PID:15024
- C:\Windows\System\WzKsghE.exe
  C:\Windows\System\WzKsghE.exe
  2⤵
  PID:15800
- C:\Windows\System\DzxcyfV.exe
  C:\Windows\System\DzxcyfV.exe
  2⤵
  PID:16404
- C:\Windows\System\ndbDkeF.exe
  C:\Windows\System\ndbDkeF.exe
  2⤵
  PID:16420
- C:\Windows\System\QjxwlKa.exe
  C:\Windows\System\QjxwlKa.exe
  2⤵
  PID:16456
- C:\Windows\System\bwObZTa.exe
  C:\Windows\System\bwObZTa.exe
  2⤵
  PID:16472
- C:\Windows\System\JYgLCUi.exe
  C:\Windows\System\JYgLCUi.exe
  2⤵
  PID:16504
- C:\Windows\System\rbiaqFA.exe
  C:\Windows\System\rbiaqFA.exe
  2⤵
  PID:16520
- C:\Windows\System\PvmkCZU.exe
  C:\Windows\System\PvmkCZU.exe
  2⤵
  PID:16552
- C:\Windows\System\XUJQYrQ.exe
  C:\Windows\System\XUJQYrQ.exe
  2⤵
  PID:16576
- C:\Windows\System\bzATKGj.exe
  C:\Windows\System\bzATKGj.exe
  2⤵
  PID:16600
- C:\Windows\System\xUzqepL.exe
  C:\Windows\System\xUzqepL.exe
  2⤵
  PID:16632
- C:\Windows\System\vzBCHmy.exe
  C:\Windows\System\vzBCHmy.exe
  2⤵
  PID:16656
- C:\Windows\System\JzprFWD.exe
  C:\Windows\System\JzprFWD.exe
  2⤵
  PID:16688
- C:\Windows\System\kAvMyrK.exe
  C:\Windows\System\kAvMyrK.exe
  2⤵
  PID:16724
- C:\Windows\System\YAeGsbN.exe
  C:\Windows\System\YAeGsbN.exe
  2⤵
  PID:16756
- C:\Windows\System\KNWswZv.exe
  C:\Windows\System\KNWswZv.exe
  2⤵
  PID:16784
- C:\Windows\System\HBLhjbm.exe
  C:\Windows\System\HBLhjbm.exe
  2⤵
  PID:16812
- C:\Windows\System\AFmfzHH.exe
  C:\Windows\System\AFmfzHH.exe
  2⤵
  PID:16844
- C:\Windows\System\JuuzTmA.exe
  C:\Windows\System\JuuzTmA.exe
  2⤵
  PID:16880
- C:\Windows\System\tjbCmNz.exe
  C:\Windows\System\tjbCmNz.exe
  2⤵
  PID:16908
- C:\Windows\System\MdapEur.exe
  C:\Windows\System\MdapEur.exe
  2⤵
  PID:16924
- C:\Windows\System\jKAmqNh.exe
  C:\Windows\System\jKAmqNh.exe
  2⤵
  PID:16952
- C:\Windows\System\twEMRQh.exe
  C:\Windows\System\twEMRQh.exe
  2⤵
  PID:16992
- C:\Windows\System\RHeqrxB.exe
  C:\Windows\System\RHeqrxB.exe
  2⤵
  PID:17008
- C:\Windows\System\LWpuEvj.exe
  C:\Windows\System\LWpuEvj.exe
  2⤵
  PID:17032
- C:\Windows\System\fgukxjA.exe
  C:\Windows\System\fgukxjA.exe
  2⤵
  PID:17064
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17064 -s 248
    3⤵
    PID:16560
- C:\Windows\System\FGgUDCo.exe
  C:\Windows\System\FGgUDCo.exe
  2⤵
  PID:17092
- C:\Windows\System\oKOaSsU.exe
  C:\Windows\System\oKOaSsU.exe
  2⤵
  PID:17116

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CFnkTdr.exe

Filesize
1.7MB

MD5
7ea36c6275b61f98be96a44014dc82b7

SHA1
02860e075c25f6551ac597397521d46073369e9c

SHA256
483a7ab42fb13b2ca9ecb3f0b2f33d69c38ad98fe0525cdcb315383578ffc2a9

SHA512
1932796ebe016cb31ac5db84b01c3cc18d59a022b85015287122d36bc8a5efa745917d7257bf9c15bb94173cbcd3331b400b00cfb91095cca1257cf95ae24e32

Download Submit
C:\Windows\System\CzgrBlQ.exe

Filesize
1.7MB

MD5
999fc42cb5c6d304d4b9b5d7a5e5b117

SHA1
da3789a8a687fda960a54ce77e143bd7b963ad79

SHA256
a072e089fce596cc04d1a7e01e076d5d184c5d4d6fc4954b0fec45bbb7120346

SHA512
439561f2b782484076eaac79441438e0b6a6974cfc7cca6158e735bb7295aa06638fb6c6cb4eb54e9d47b66acbded969883e387ed659a42dcffaec83b6581b7f

Download Submit
C:\Windows\System\ELvSYoD.exe

Filesize
1.7MB

MD5
0e268d9ccdd95a0c071b231a4777f3f4

SHA1
b49b1ccccb602e0d0161aa4ceb476198dbcb0f29

SHA256
a11cc08aa3cf2efc607b6c3c1109be381e19b6170a4cb9bd7c6e25f4b74e5b5a

SHA512
34b04600fab63edf0dee8edf1db5f10eb226604720d133631a8e0e14ab8cabc8a057918529ba46d8b2984dc9c0cf389f6a4f239e2fb79ad9bf8cd8e7f691e564

Download Submit
C:\Windows\System\GxpmNda.exe

Filesize
1.7MB

MD5
348b98bb99eb44db73b687142afffd6c

SHA1
d9dfcda788efad7aa930a7b0bc3fc789187377a0

SHA256
7bb179b4c4fe469bddd2f729b78bb1a257e9455c96e6a7925164905170e48108

SHA512
2ab23358388ed98731af68fbd10b8e613393d330e319d57ffa1d9a1553bad376c1374f196db835c426025bf46ce45036d9543f61a03ac0bfaa4410cc5b9867d4

Download Submit
C:\Windows\System\IIyDlMS.exe

Filesize
1.7MB

MD5
d0da69857cdd8d32067c3fd9d8ca3640

SHA1
dc7ec33f0078dbb7f1021311ec8ea05e96293362

SHA256
86db618ed85c6f4967488e027ff76d0371c7e0e8704b4a1f09a87c940a85460d

SHA512
4eacd8e8cd2bd51ee5a59b0144d9a04836327465c768c56bea684ef9f141bdbe112c40958ea1fb2950d46b5aaf7ff696611a6b52adc50ea7187e0d07091e0c5c

Download Submit
C:\Windows\System\IKEwguT.exe

Filesize
1.7MB

MD5
3f332451e749527a40fb1bce09dcad3e

SHA1
0013aeeb01ccaa2ad1d46ec8a8b9b6cbc5947f4c

SHA256
e7383eabd5717022153a007856949e55f3186de72a5499a6adb0f8439c87adb9

SHA512
e3c561a382442a903790d0a6a4cfb8b90a11654c8534356973ec1716c22455892d133c38ca11d59839791a3e22541f6c5c380f191a5f5b804b8e48541625a49a

Download Submit
C:\Windows\System\IduwGsm.exe

Filesize
1.7MB

MD5
5f41435c157b313adc5d742c60414c85

SHA1
b8c0f0cc7ce727c5c3e72614ff0a9bb4ec50b2c3

SHA256
da598e4502e976d55a1ae223d8ccaa0f2181efcbb9695b1c7898454a479dd7a4

SHA512
f2659bc2a5909125705ebde4512c635c575850d4ea5cffc8cd0071390888dd729964e50f580a009adc4d9f647cffd9f4758da2c0e42061ddf8e2a2712ad51bd1

Download Submit
C:\Windows\System\JadtFZq.exe

Filesize
1.7MB

MD5
26ae7db996bfac7e383d274abe041009

SHA1
ee78e5c75048b35bff59a77af257f8b7aab9f3a7

SHA256
52e550e760f1a93698b6695d1a6cb7994c8e21acd2b0aad8871d2650d0f38be2

SHA512
30c0f5ce7f1f07af16eb82ff40b9bc051fba5331f3657b0ad94fa12a483cb4597bdac7b86928aef184742f37d09472c9553856dac41be0bcb58d27d54395891e

Download Submit
C:\Windows\System\JfnPhIi.exe

Filesize
1.7MB

MD5
54432b8e3eeae503850c6043714eceaa

SHA1
70e5b3a0ee0d0323f7698c8bb08abdc50172f6e5

SHA256
3a675ff1f955ed881c48b8916deb989131a71ef7f6905ad8f6400e26c7513400

SHA512
c90db65b173fd5f447db057181b0d606a294efb4aba1eebfc2348cdef42739988ca7198a14bc3e4b72274b5a1d888e8dca95456ba5ea19a938aa222931504cb2

Download Submit
C:\Windows\System\KZYCATg.exe

Filesize
1.7MB

MD5
5f1c19801e490c1d8f132e87878bb5a1

SHA1
d51a7196e4d329bc0c4e0c11732b4ade1216a21c

SHA256
0cd066dfe6c59c024a1076db1b801c8ba555f72503eb3ecd23979f1c9a568d8e

SHA512
09ffbac78a8a0fc896134cff8d6a04eb6202b155aa3662b2fd6c4db5f29caa8b6b81c5a515e7ac0a45e1fa54eaca3080f6d40d8ac656d6739720d24871695ae0

Download Submit
C:\Windows\System\MAhMEzQ.exe

Filesize
1.7MB

MD5
0006b3e13498e1f53863fb6ea1fb0fdf

SHA1
a0ba554913b0acfde5fdf46f44cc9c12061bd2fd

SHA256
8a1b8ab1da6544d7872e2643fb45bdd3468f338a29660a91faa3c5409614a7fa

SHA512
ac43bf35680379c00806420c05e474b43539a6512195b48b73f90887c391934e0b264104f6638144d058b3fb349ef85e2105000dc3470c1ff65b6e907d21bb43

Download Submit
C:\Windows\System\NGXMDmy.exe

Filesize
1.7MB

MD5
67c58dcc156f9f8bf8d21fb2c93ecbdd

SHA1
2915e83f91d9e03aeae35aa331f99a5d95737476

SHA256
24620e40cb99de7f5ecb18792725a01d2d0f426093d4f9d59846c08c6fa5e49c

SHA512
0a8e407bb61398511cca77c0a0c32645ce07e7e2fbe21972ad90ed94319052aa098c2ed1344374f299f0bc5cbdc4a09a3dc863b74c949bcedb2c6a7398122c34

Download Submit
C:\Windows\System\NxFJtaF.exe

Filesize
1.7MB

MD5
dadc4c94f80f2d274c5227b1c0706b09

SHA1
6d67ba8a5e001a11fe87665463a8c29d4ff4ffca

SHA256
ded8992963c0caf81b67d8f23ea8457cbd3561242040c5ef675cc24065866ca7

SHA512
9fec2728ec09874002586787894f219bc4784891507fd77f66de6e412f1f0a741badda417ed12a83d77b85df34f5dd406192cffb5d9645f7095c5f722dffe55e

Download Submit
C:\Windows\System\OKpKQZT.exe

Filesize
1.7MB

MD5
cdc6b132348be6d6beba6ae4bd66e378

SHA1
c9434ceb3d2cb29b89b3d2269da8dcfa68d2fe24

SHA256
ab759f80ce405ed90f536c5eb7229541e65eb1a48d2d34eb7e3c67a3db7d68df

SHA512
9b54b091e2932c0ae3c6598e13e1c36e0d888015376205e3e2ba6a5b861e25405825ec4aea4be31a15bc84ae56f7b89cee6c86ab7b6f73e794d3e064dc579d02

Download Submit
C:\Windows\System\OQiCVYf.exe

Filesize
1.7MB

MD5
4823e678318f1cb2698edea7661644ed

SHA1
877b82b5674281c764b55f9f04b944d9e149c8a6

SHA256
c66d31af7b5b91018600c6b76929fb7b6b9d13ac0177c01236e09a6725655819

SHA512
fb124fafb3a5672634ceb2dcb433433bf4fe4b66f6b288529d0c5f4224452208fde71801a63df9621bd32cab595a3d753ede5effa30333b1b07ae5e53aeea598

Download Submit
C:\Windows\System\SDRdQxP.exe

Filesize
1.7MB

MD5
181e6b05ed3b53ee3c53a46eac796c11

SHA1
e7821783ae7dd15853730f2c7a75b75800995d0f

SHA256
4803f32bad7946f1eaa49f5df4272f0b96998d5e1c6cd42c7e60e5197af4583f

SHA512
692089e7a185c05ebdf0dc33251ce94b0c8cfb0abcfce7f960538aacb86f30f66b963caffdba8e55c6e1e4aa2f9f74bb3990a373060ce1cedad6c3474e03a894

Download Submit
C:\Windows\System\TKKDctc.exe

Filesize
1.7MB

MD5
1d0f315527901a1fe082b46bfb725892

SHA1
f6b61ef5bcc2dc483b332eb7b2e3713ed0b0fd00

SHA256
b120360d335b1ebc88af4d9a9912716d6b33a4cccd526459abdc8ead9a3f1cfb

SHA512
a28e81d5dd5e7cbd7eecfa6796e80b77c9c4dac5deeffb545d4cd21ab128851095cb524e9dc638a68b533f43f449f7efc672cab71c795b48fb4f192b8011467e

Download Submit
C:\Windows\System\ZGOsjZc.exe

Filesize
1.7MB

MD5
d1db4bb7283db98cbe2efc0f2d01d2a4

SHA1
3d9860b699ace587d54e45ebfc367170a59e54b5

SHA256
80e29b07612550930e2968217770042196bf395f40737ddd3417801be9f79297

SHA512
c33501b0f71e4f24a1e0493773681e09bd5f8689eae29d8d4c61d5bfeff6af4445904beac45d146db1d93fb570a6094fe60f67c9d2b34cb56f6e62cf0527c735

Download Submit
C:\Windows\System\ZhJCyTR.exe

Filesize
1.7MB

MD5
531ea55785ca8e8b0b01ad255a3a8390

SHA1
03ef6e732a2d076d4976634ac589156e0d436698

SHA256
1ef9f4e777b1496d9df11d578dcada4fc2efa4ad6ff7cc775c4dfe8f343eb2c4

SHA512
d14aaf5e855cc8b9a8006af7ac15c94de73f4578afaad3a81a0e439af05736207071d4fc1264939859229fae2ad0e18dc8cf0b4510e7ea3307c3d564da494568

Download Submit
C:\Windows\System\aJZjNxD.exe

Filesize
1.7MB

MD5
2797930d66d30b27538306cb9387df8e

SHA1
3143a2def31ac07b40680427b6f4e3cca05c82e2

SHA256
b2aae629edb95c3e813eb7c33e715141edafbf765b5d6dda045495361cc4c53f

SHA512
4c2c2d40899aced6bc6f3312d1846a205a1b95331f80b113fe72436be539b5e5802257c7ccad9ec9931882e0bc6c817e7f48361aeaa6ced6d8f51a4c6d0af5df

Download Submit
C:\Windows\System\aPoRZRH.exe

Filesize
1.7MB

MD5
eba3daab112d0f38965f3e26226351f6

SHA1
617ba7af082034d06e53ff049661cf30ce5bf525

SHA256
c94ce78f359ba647a5adbcfa75952451d2ab8d024aadb4f2433beda68b4aee2d

SHA512
bf484ef3a748da5eb3e7b1f6b182c11f2af45e37d7291caf07b7ceb4e7b81a8cc83a1b90ecba99d57501c3d1b02c19a73c148a8b5404a1015b8b6ad498dbad4a

Download Submit
C:\Windows\System\bbjdzXP.exe

Filesize
1.7MB

MD5
97d6da780337e583c529644d5fb0a3e4

SHA1
65690e286cadad53d7e7364c82488906bffafc61

SHA256
26a224340fcc4831adf0404d75762cfdb7d6814621c8a8fffa33e3bee6a24763

SHA512
c276fd6a108b4a4b4133163286d72e3d5f4cd5f49adfc25acfed71271b58066ffb64e12dcaad2690b464272a360214caa917f942c07aae8017c843dec872f8a6

Download Submit
C:\Windows\System\dwtLeaY.exe

Filesize
1.7MB

MD5
fc48fcd9519147c19ec0cd3809cddb6a

SHA1
854d723af3d142c0a14bb9de689ebb74a3c3b831

SHA256
b563f3fd675f72adaec9a82d826636d72989e4694b287bb28caf6c07b9c036c7

SHA512
60acf5e788b095af8434abf3cc3d02bd3715b06adbd5928b009b94eef548587453a28d2d5cec68f494bd147eec2645b73fd3df1f58f2e7633e743cd1bc3dae63

Download Submit
C:\Windows\System\eNBmBsg.exe

Filesize
1.7MB

MD5
9067295c800b899293f616c2c1159417

SHA1
1abb0dc3dd670973c0e2a146278fd53db078ee09

SHA256
dd63ceecc1c799dce9050d0bb5894c6184a77e04bc63c5123a24340afbb05582

SHA512
f72f16a715ffa54bce42326597004e8281ca7baa7dcf530a46ff4828eaa4601fb209ec7ef6ab3d511df89864def06dab5658b8598fa69666160a963fb735da89

Download Submit
C:\Windows\System\jEtJiQg.exe

Filesize
1.7MB

MD5
64c1b4d704cebf0127bb0cec1b96b405

SHA1
726f007cc602c6f39a245a3e742dbba410b3ae29

SHA256
8b62b2dca398a226d6a0e8811ef4e4e9fc7c7b4d8afb6a92b88861730a92f3b9

SHA512
78cdafaaae30daf01ec6e7f4fe81df725aa6b06cd140d512634b426de79f7273d8f77002775cbfc7ffb34c8f39536fed3acbef749d7f80ce0b9f1c7ab75b40d0

Download Submit
C:\Windows\System\jwlsHAC.exe

Filesize
1.7MB

MD5
2f6ebe1af9f0372adfe254b1be48ee73

SHA1
50c1704bfea151249cc984240bc2abc5434ba7f0

SHA256
4da719bd17ae5fda41d53225dfab00f014121cbe7b80f4918c7f2b255499b119

SHA512
d32bd1860a88b59110ff8dec9278ba5fd98f1953e383494d50d4cab8911c8bdf6acf642c4e455351907d4c6d16e3a0de0ba37becaac5f03335625ab91649ddcc

Download Submit
C:\Windows\System\lSbRuCs.exe

Filesize
1.7MB

MD5
1001896b18135a3637ab9de0a3ff04d2

SHA1
8d039b8971b8bdcf89763eb232db23d0ff835317

SHA256
653a6b36809f3ea8d6703e0f516c44946f1b871ad2ddf8b3eefd8576f0b6c61e

SHA512
d3c8a1b45c69f6ba8ea9e7ba40fa4e9cfdbd7e75a324a2ede9b3c89adf3f6fc53a10a94f5708e7de5e4944c3483ecdbd5af19db3f4129489f8f3653a53478ff0

Download Submit
C:\Windows\System\mGnQMte.exe

Filesize
1.7MB

MD5
591c52006d81c8518a3f816f771be2e6

SHA1
de1433128694b9335564dd3b19f9570dca6bab6e

SHA256
e3ceebde9572cfec79274cfd04f970697ecd7a752d34da2ca7f171c948bb3d80

SHA512
582baefb5fc3feab77ee58f52f922662804adcf00f71105652e00005dbcf098f64af10f8e2efcf172896e7cf0cadc44422d7efcd59ad6a2f8ad020f6b49408de

Download Submit
C:\Windows\System\qvfeetF.exe

Filesize
1.7MB

MD5
5aee8862b696b0e95426b034cc234b48

SHA1
6302ad4f90361f639b83f4ea8e93af5377fc48f6

SHA256
293b7a06d4af931f0c05917d3c4e9a1867b8c7dfb5e0b86f0fae4b47512df5d1

SHA512
031e341fa1d0168d87aff398e45aaed16d79f11909a897b634334bb141d9d0428596f999576f3c7ed02d320563917b32a6a60421cf32aac20d476403b5a5b75e

Download Submit
C:\Windows\System\tpiKHjZ.exe

Filesize
1.7MB

MD5
e7649eaeefc3593735f0cbaf6c8df2de

SHA1
e2e20e80013b400f4d477d66c718952c84462f56

SHA256
f75fd381305dd3d1cc86956bc830fcc0a53f25e485f5693adb4fbf1b8b251ae7

SHA512
bee1999a3d398328814f795ecdea4790defebbf321b58654239280e48a23c0ea7c7dd0e28f514cafc70f6e683fff9c9b82425ceb625b1665ffbbbfdd62a4190b

Download Submit
C:\Windows\System\uHPwxEP.exe

Filesize
1.7MB

MD5
a029a8c265fda6766a992272cb5d626b

SHA1
26f50500bb1c543168f95b866ec31743f9bd6b94

SHA256
032328d119a59a10eac7888a90145e79babf3a3c452a7fe648444ce6059534ae

SHA512
2a1099059db88bbb03ad471f3229d93347183e02c427fc48b4257ea19157b23cbfd57649d5a805458d3b46c846b3048fb7e6b03477c2a68833f2db8f3639cd1d

Download Submit
C:\Windows\System\ubhXGwZ.exe

Filesize
1.7MB

MD5
72cd79e284574d0ea9bbe734efe77f1c

SHA1
6023195dd880568409417f3d4282db43bdbf7625

SHA256
371de68cb40f8c18c470a551f739de3ba772600c8eb4bcf826b89c44bee3e245

SHA512
67e0501a32bbef25794d69eddf4814201ca6afa1f93d37243e4eb8718512fa514fa1db33edebb19f440d6a2412017c5c4704181ed1eb8f45b47c46a9f281b9ac

Download Submit
C:\Windows\System\wLGYIOT.exe

Filesize
1.7MB

MD5
f84e6ce44c5deb5ae071ec9311712f64

SHA1
88ff702bfbb3a0589a5dd08299373518795a9cdf

SHA256
94e2b9d003c70d4209187a9e0b8b42ddb56b4af813122f6f35778ea558fdda09

SHA512
157efe37076195d4161bb6c7ff7a90f65d76dc8d7829a3a6c000437ae4921a0442a1647ae3aac28a65d63ab0fd47748a6d6d0cd1e61eb3b83aae9de66802749d

Download Submit
C:\Windows\System\wzmEbki.exe

Filesize
1.7MB

MD5
4733610049ce2c6ac539190219e1e31c

SHA1
fe35f7f585a3ef32fe198297b93f3b31069ad4d8

SHA256
8c5271bbf037011963ae1b6f173019f43aa1d43049daa508d6aadc90f4eb3dd9

SHA512
703bb60f9de6e593ad21700b26dc68bbc2c62cb972895282ed469e4cfc7542c0d74ac5df8d2db9166d4b86394a9163421123cabc0068dbb172f0a70644c0cf06

Download Submit
C:\Windows\System\zGQOJhk.exe

Filesize
1.7MB

MD5
804013ecb997ddbdd9e41bb6bf9de0e0

SHA1
90a06a1d049332620d44cf842e09c0ccd547039a

SHA256
bda4da2b7f3cb1c4afa1bea6793a38173fb61ac9ef5cfd4708e7b93b9aa85bdd

SHA512
b82338632b791ae312f703af12d0480ac9d5786206ec885f2aed449fd81d5f854f87c006433bc4172fee64fe5024c40d12c2771e16ab659e0e0ff067cb7dd98e

Download Submit
memory/432-0-0x00000285C6E10000-0x00000285C6E20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads