xmrig | 1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf

Analysis

max time kernel
121s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2025, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
Size

1.5MB
MD5

5a0d38a44d409bde015a8623d0574f6b
SHA1

a5353f93c880153a501ae60b0ed47fa77acd787b
SHA256

1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf
SHA512

f4c4fa8d0e60b7577bb66a0ac5ece4025c5532e8c7ea45c7e8c58fb47b912972882f7b25e0438938917dd7d79b995d373a144b49d83e48727189c9f97d8073d7
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5WrmzN5qlxF:GezaTF8FcNkNdfE0pZ9ozttwIRxTzkxF

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023af6-4.dat	xmrig
behavioral2/files/0x000a000000023b52-7.dat	xmrig
behavioral2/files/0x000a000000023b53-25.dat	xmrig
behavioral2/files/0x000a000000023b57-40.dat	xmrig
behavioral2/files/0x000a000000023b56-38.dat	xmrig
behavioral2/files/0x000a000000023b55-36.dat	xmrig
behavioral2/files/0x000a000000023b54-34.dat	xmrig
behavioral2/files/0x000c000000023b4e-16.dat	xmrig
behavioral2/files/0x000a000000023b58-44.dat	xmrig
behavioral2/files/0x000300000001e7b6-69.dat	xmrig
behavioral2/files/0x000200000001e7a1-76.dat	xmrig
behavioral2/files/0x000200000001e81b-87.dat	xmrig
behavioral2/files/0x000200000001e9ab-93.dat	xmrig
behavioral2/files/0x000300000001e9ad-94.dat	xmrig
behavioral2/files/0x000200000001e868-92.dat	xmrig
behavioral2/files/0x000200000001e9c0-91.dat	xmrig
behavioral2/files/0x000200000001e863-90.dat	xmrig
behavioral2/files/0x000200000001e7a2-89.dat	xmrig
behavioral2/files/0x000200000001e7a0-62.dat	xmrig
behavioral2/files/0x000700000001e59a-58.dat	xmrig
behavioral2/files/0x000200000001e9d4-104.dat	xmrig
behavioral2/files/0x000200000001ea0c-110.dat	xmrig
behavioral2/files/0x000200000001ea10-114.dat	xmrig
behavioral2/files/0x000200000001eaaf-122.dat	xmrig
behavioral2/files/0x000200000001eab5-124.dat	xmrig
behavioral2/files/0x000b000000023b4f-129.dat	xmrig
behavioral2/files/0x000b000000023b59-133.dat	xmrig
behavioral2/files/0x000b000000023b5b-139.dat	xmrig
behavioral2/files/0x000a000000023b5c-151.dat	xmrig
behavioral2/files/0x000a000000023b60-162.dat	xmrig
behavioral2/files/0x000a000000023b61-166.dat	xmrig
behavioral2/files/0x000a000000023b5f-163.dat	xmrig
behavioral2/files/0x000a000000023b5e-156.dat	xmrig
behavioral2/files/0x000a000000023b5d-149.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3432	ZIeqvoD.exe
4268	tfoUGqH.exe
3932	afvqMkc.exe
3216	ZntunCB.exe
3248	BvjzRap.exe
2896	BygolrM.exe
3448	RukbSdB.exe
4648	SjnfpJa.exe
4672	AyIpcGa.exe
312	iegjdNV.exe
3444	jwZUcre.exe
4352	lSKdHWU.exe
4620	TjpfjTu.exe
3412	BjENAKg.exe
3296	acAmydl.exe
60	oYyfLbM.exe
1296	xeuslEg.exe
2948	CeXnCmG.exe
2420	XGodMeN.exe
3160	tpoSbVV.exe
2148	hFKtbFt.exe
4232	szefZiw.exe
904	nuZMcbS.exe
5016	SDCffFE.exe
3488	JtsGfXj.exe
4396	kSTqssM.exe
4856	gmnlVgg.exe
2240	ztwJbPw.exe
1704	AapebtJ.exe
3308	YzzoIQp.exe
4808	OhOzjMj.exe
2980	QJdWSla.exe
2456	myoRfwY.exe
3236	HhawMuf.exe
4380	aJAByEd.exe
4772	QZIqJTj.exe
3956	kDxhyjs.exe
3784	nhjSvQn.exe
1772	dLQZPMm.exe
3016	GhFGWEj.exe
2596	yHNZsde.exe
2800	vrluLbe.exe
4308	NZNXpNx.exe
3984	jGxByxB.exe
4692	ciFwfdx.exe
3508	DWSmSbe.exe
4804	kGhrLtM.exe
3232	nlFoXFL.exe
2336	BnTOGPI.exe
2588	kAYAOdn.exe
3300	VkAiRXl.exe
3860	MrXuiWe.exe
2112	MVuVSSJ.exe
220	OAYIEaW.exe
1984	GFdCZQf.exe
5084	ikfLWQH.exe
3464	oGfKaag.exe
1624	AEuOjtJ.exe
420	ZWIWGFS.exe
2996	bExEOKK.exe
3064	wUUlDei.exe
1548	uPVKmPq.exe
3176	HOPzQvk.exe
2032	zgeFsPS.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CpZFLRA.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\XglOVUF.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\cHahxvd.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\qoRtYKu.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\Asvnlvo.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\dEdkaWQ.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\xQeAunk.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\tmzMjpA.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\OTZfbsw.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\qplgcFm.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\MmPnZfW.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\fKYzsLi.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\bFsfDiB.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\IRZCKub.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\xliUesh.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\WXjDfgZ.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\OzgJymQ.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\qTvemjO.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\WqdBPik.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\TjpfjTu.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\kDxhyjs.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\pIQGFVW.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\BrWzRpL.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\nuZMcbS.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\tsaaZKL.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\IMyGsAy.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\CJsZPme.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\jnoFplE.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\xIUmTII.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\coBRVUQ.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\rRerQhv.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\truohXw.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\VLuUMBh.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\LnhXWqs.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\bcnbqzo.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\PlUYwCJ.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\BaJcRUb.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\EkEJUYG.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\rncnhpC.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\BtjSEdp.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\hjMPsLK.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\HYFUNFW.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\muguqAf.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\NVZDXAS.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\Ecetamm.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\IsRGueg.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\Axvqxhh.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\KMMDohj.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\GMUCsmh.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\tJEDEcL.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\YsXScXd.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\KhxBZEg.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\SjnfpJa.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\GNYoWfv.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\coqqFGu.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\egZPaBw.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\BxCjTBT.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\UTwmLqM.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\EIWbTYB.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\dxlQbTv.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\hdzHESa.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\DgUdxoG.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\dKuheYM.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
File created	C:\Windows\System\HbPHzPi.exe	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3696	dwm.exe
Token: SeChangeNotifyPrivilege	3696	dwm.exe
Token: 33	3696	dwm.exe
Token: SeIncBasePriorityPrivilege	3696	dwm.exe
Token: SeShutdownPrivilege	3696	dwm.exe
Token: SeCreatePagefilePrivilege	3696	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 3432	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	85
PID 3768 wrote to memory of 3432	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	85
PID 3768 wrote to memory of 4268	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	86
PID 3768 wrote to memory of 4268	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	86
PID 3768 wrote to memory of 3932	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	87
PID 3768 wrote to memory of 3932	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	87
PID 3768 wrote to memory of 3216	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	88
PID 3768 wrote to memory of 3216	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	88
PID 3768 wrote to memory of 3248	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	89
PID 3768 wrote to memory of 3248	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	89
PID 3768 wrote to memory of 2896	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	90
PID 3768 wrote to memory of 2896	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	90
PID 3768 wrote to memory of 3448	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	91
PID 3768 wrote to memory of 3448	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	91
PID 3768 wrote to memory of 4648	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	92
PID 3768 wrote to memory of 4648	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	92
PID 3768 wrote to memory of 4672	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	93
PID 3768 wrote to memory of 4672	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	93
PID 3768 wrote to memory of 312	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	96
PID 3768 wrote to memory of 312	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	96
PID 3768 wrote to memory of 3444	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	97
PID 3768 wrote to memory of 3444	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	97
PID 3768 wrote to memory of 4352	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	98
PID 3768 wrote to memory of 4352	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	98
PID 3768 wrote to memory of 4620	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	99
PID 3768 wrote to memory of 4620	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	99
PID 3768 wrote to memory of 3412	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	100
PID 3768 wrote to memory of 3412	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	100
PID 3768 wrote to memory of 3296	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	101
PID 3768 wrote to memory of 3296	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	101
PID 3768 wrote to memory of 60	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	102
PID 3768 wrote to memory of 60	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	102
PID 3768 wrote to memory of 1296	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	103
PID 3768 wrote to memory of 1296	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	103
PID 3768 wrote to memory of 2948	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	104
PID 3768 wrote to memory of 2948	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	104
PID 3768 wrote to memory of 2420	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	105
PID 3768 wrote to memory of 2420	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	105
PID 3768 wrote to memory of 3160	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	106
PID 3768 wrote to memory of 3160	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	106
PID 3768 wrote to memory of 2148	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	107
PID 3768 wrote to memory of 2148	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	107
PID 3768 wrote to memory of 4232	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	108
PID 3768 wrote to memory of 4232	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	108
PID 3768 wrote to memory of 904	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	109
PID 3768 wrote to memory of 904	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	109
PID 3768 wrote to memory of 5016	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	110
PID 3768 wrote to memory of 5016	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	110
PID 3768 wrote to memory of 3488	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	111
PID 3768 wrote to memory of 3488	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	111
PID 3768 wrote to memory of 4396	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	112
PID 3768 wrote to memory of 4396	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	112
PID 3768 wrote to memory of 4856	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	113
PID 3768 wrote to memory of 4856	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	113
PID 3768 wrote to memory of 2240	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	114
PID 3768 wrote to memory of 2240	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	114
PID 3768 wrote to memory of 1704	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	115
PID 3768 wrote to memory of 1704	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	115
PID 3768 wrote to memory of 3308	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	116
PID 3768 wrote to memory of 3308	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	116
PID 3768 wrote to memory of 4808	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	117
PID 3768 wrote to memory of 4808	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	117
PID 3768 wrote to memory of 2980	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	118
PID 3768 wrote to memory of 2980	3768	1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe	118

C:\Users\Admin\AppData\Local\Temp\1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe
"C:\Users\Admin\AppData\Local\Temp\1f98b0666d52e1ffcf108ff80d93df332030a77d70ec41c4f611be898e804cdf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\System\ZIeqvoD.exe
  C:\Windows\System\ZIeqvoD.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\tfoUGqH.exe
  C:\Windows\System\tfoUGqH.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\afvqMkc.exe
  C:\Windows\System\afvqMkc.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\ZntunCB.exe
  C:\Windows\System\ZntunCB.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\BvjzRap.exe
  C:\Windows\System\BvjzRap.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\BygolrM.exe
  C:\Windows\System\BygolrM.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\RukbSdB.exe
  C:\Windows\System\RukbSdB.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\SjnfpJa.exe
  C:\Windows\System\SjnfpJa.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\AyIpcGa.exe
  C:\Windows\System\AyIpcGa.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\iegjdNV.exe
  C:\Windows\System\iegjdNV.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\jwZUcre.exe
  C:\Windows\System\jwZUcre.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\lSKdHWU.exe
  C:\Windows\System\lSKdHWU.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\TjpfjTu.exe
  C:\Windows\System\TjpfjTu.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\BjENAKg.exe
  C:\Windows\System\BjENAKg.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\acAmydl.exe
  C:\Windows\System\acAmydl.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\oYyfLbM.exe
  C:\Windows\System\oYyfLbM.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\xeuslEg.exe
  C:\Windows\System\xeuslEg.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\CeXnCmG.exe
  C:\Windows\System\CeXnCmG.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\XGodMeN.exe
  C:\Windows\System\XGodMeN.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\tpoSbVV.exe
  C:\Windows\System\tpoSbVV.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\hFKtbFt.exe
  C:\Windows\System\hFKtbFt.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\szefZiw.exe
  C:\Windows\System\szefZiw.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\nuZMcbS.exe
  C:\Windows\System\nuZMcbS.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\SDCffFE.exe
  C:\Windows\System\SDCffFE.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\JtsGfXj.exe
  C:\Windows\System\JtsGfXj.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\kSTqssM.exe
  C:\Windows\System\kSTqssM.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\gmnlVgg.exe
  C:\Windows\System\gmnlVgg.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\ztwJbPw.exe
  C:\Windows\System\ztwJbPw.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\AapebtJ.exe
  C:\Windows\System\AapebtJ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\YzzoIQp.exe
  C:\Windows\System\YzzoIQp.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\OhOzjMj.exe
  C:\Windows\System\OhOzjMj.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\QJdWSla.exe
  C:\Windows\System\QJdWSla.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\myoRfwY.exe
  C:\Windows\System\myoRfwY.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\HhawMuf.exe
  C:\Windows\System\HhawMuf.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\aJAByEd.exe
  C:\Windows\System\aJAByEd.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\QZIqJTj.exe
  C:\Windows\System\QZIqJTj.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\kDxhyjs.exe
  C:\Windows\System\kDxhyjs.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\nhjSvQn.exe
  C:\Windows\System\nhjSvQn.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\dLQZPMm.exe
  C:\Windows\System\dLQZPMm.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\GhFGWEj.exe
  C:\Windows\System\GhFGWEj.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\yHNZsde.exe
  C:\Windows\System\yHNZsde.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\vrluLbe.exe
  C:\Windows\System\vrluLbe.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\NZNXpNx.exe
  C:\Windows\System\NZNXpNx.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\ciFwfdx.exe
  C:\Windows\System\ciFwfdx.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\jGxByxB.exe
  C:\Windows\System\jGxByxB.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\DWSmSbe.exe
  C:\Windows\System\DWSmSbe.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\kGhrLtM.exe
  C:\Windows\System\kGhrLtM.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\nlFoXFL.exe
  C:\Windows\System\nlFoXFL.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\BnTOGPI.exe
  C:\Windows\System\BnTOGPI.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\kAYAOdn.exe
  C:\Windows\System\kAYAOdn.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\VkAiRXl.exe
  C:\Windows\System\VkAiRXl.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\MrXuiWe.exe
  C:\Windows\System\MrXuiWe.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\MVuVSSJ.exe
  C:\Windows\System\MVuVSSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\OAYIEaW.exe
  C:\Windows\System\OAYIEaW.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\GFdCZQf.exe
  C:\Windows\System\GFdCZQf.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ikfLWQH.exe
  C:\Windows\System\ikfLWQH.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\oGfKaag.exe
  C:\Windows\System\oGfKaag.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\AEuOjtJ.exe
  C:\Windows\System\AEuOjtJ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\ZWIWGFS.exe
  C:\Windows\System\ZWIWGFS.exe
  2⤵
  - Executes dropped EXE
  PID:420
- C:\Windows\System\bExEOKK.exe
  C:\Windows\System\bExEOKK.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\wUUlDei.exe
  C:\Windows\System\wUUlDei.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\uPVKmPq.exe
  C:\Windows\System\uPVKmPq.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\HOPzQvk.exe
  C:\Windows\System\HOPzQvk.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\zgeFsPS.exe
  C:\Windows\System\zgeFsPS.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\OYoPZfD.exe
  C:\Windows\System\OYoPZfD.exe
  2⤵
  PID:1504
- C:\Windows\System\SzuDbWM.exe
  C:\Windows\System\SzuDbWM.exe
  2⤵
  PID:3276
- C:\Windows\System\YiaTUxy.exe
  C:\Windows\System\YiaTUxy.exe
  2⤵
  PID:184
- C:\Windows\System\WpisJDO.exe
  C:\Windows\System\WpisJDO.exe
  2⤵
  PID:876
- C:\Windows\System\QNEAbeW.exe
  C:\Windows\System\QNEAbeW.exe
  2⤵
  PID:3948
- C:\Windows\System\wemiMwg.exe
  C:\Windows\System\wemiMwg.exe
  2⤵
  PID:4840
- C:\Windows\System\KCirPJt.exe
  C:\Windows\System\KCirPJt.exe
  2⤵
  PID:3436
- C:\Windows\System\apvWJeu.exe
  C:\Windows\System\apvWJeu.exe
  2⤵
  PID:1900
- C:\Windows\System\vUGWeEh.exe
  C:\Windows\System\vUGWeEh.exe
  2⤵
  PID:4024
- C:\Windows\System\CpZFLRA.exe
  C:\Windows\System\CpZFLRA.exe
  2⤵
  PID:4912
- C:\Windows\System\UQKRgRL.exe
  C:\Windows\System\UQKRgRL.exe
  2⤵
  PID:2132
- C:\Windows\System\EQjRTDH.exe
  C:\Windows\System\EQjRTDH.exe
  2⤵
  PID:5096
- C:\Windows\System\ggrTsWI.exe
  C:\Windows\System\ggrTsWI.exe
  2⤵
  PID:436
- C:\Windows\System\pIQGFVW.exe
  C:\Windows\System\pIQGFVW.exe
  2⤵
  PID:1324
- C:\Windows\System\nIkMwGi.exe
  C:\Windows\System\nIkMwGi.exe
  2⤵
  PID:2268
- C:\Windows\System\truohXw.exe
  C:\Windows\System\truohXw.exe
  2⤵
  PID:4628
- C:\Windows\System\GNYoWfv.exe
  C:\Windows\System\GNYoWfv.exe
  2⤵
  PID:2076
- C:\Windows\System\KzIqIzo.exe
  C:\Windows\System\KzIqIzo.exe
  2⤵
  PID:4180
- C:\Windows\System\eEEIMmf.exe
  C:\Windows\System\eEEIMmf.exe
  2⤵
  PID:1388
- C:\Windows\System\gpAxFwn.exe
  C:\Windows\System\gpAxFwn.exe
  2⤵
  PID:2976
- C:\Windows\System\WaZtlEz.exe
  C:\Windows\System\WaZtlEz.exe
  2⤵
  PID:3992
- C:\Windows\System\MuPcuTM.exe
  C:\Windows\System\MuPcuTM.exe
  2⤵
  PID:3120
- C:\Windows\System\BDQAMhW.exe
  C:\Windows\System\BDQAMhW.exe
  2⤵
  PID:4496
- C:\Windows\System\AIldBbi.exe
  C:\Windows\System\AIldBbi.exe
  2⤵
  PID:4536
- C:\Windows\System\hdzHESa.exe
  C:\Windows\System\hdzHESa.exe
  2⤵
  PID:1328
- C:\Windows\System\ETcNERu.exe
  C:\Windows\System\ETcNERu.exe
  2⤵
  PID:2036
- C:\Windows\System\hjMPsLK.exe
  C:\Windows\System\hjMPsLK.exe
  2⤵
  PID:1748
- C:\Windows\System\WgKhnVj.exe
  C:\Windows\System\WgKhnVj.exe
  2⤵
  PID:548
- C:\Windows\System\QrqGJlJ.exe
  C:\Windows\System\QrqGJlJ.exe
  2⤵
  PID:5124
- C:\Windows\System\tBwFRJc.exe
  C:\Windows\System\tBwFRJc.exe
  2⤵
  PID:5152
- C:\Windows\System\LhfVzhb.exe
  C:\Windows\System\LhfVzhb.exe
  2⤵
  PID:5188
- C:\Windows\System\OUfhoJG.exe
  C:\Windows\System\OUfhoJG.exe
  2⤵
  PID:5216
- C:\Windows\System\JAISRdE.exe
  C:\Windows\System\JAISRdE.exe
  2⤵
  PID:5240
- C:\Windows\System\EZUNmrY.exe
  C:\Windows\System\EZUNmrY.exe
  2⤵
  PID:5272
- C:\Windows\System\ETaAHNv.exe
  C:\Windows\System\ETaAHNv.exe
  2⤵
  PID:5304
- C:\Windows\System\PhEQSOr.exe
  C:\Windows\System\PhEQSOr.exe
  2⤵
  PID:5336
- C:\Windows\System\ItvJzgs.exe
  C:\Windows\System\ItvJzgs.exe
  2⤵
  PID:5368
- C:\Windows\System\EyTUBfT.exe
  C:\Windows\System\EyTUBfT.exe
  2⤵
  PID:5392
- C:\Windows\System\SvaPoNQ.exe
  C:\Windows\System\SvaPoNQ.exe
  2⤵
  PID:5420
- C:\Windows\System\OaFyeFL.exe
  C:\Windows\System\OaFyeFL.exe
  2⤵
  PID:5440
- C:\Windows\System\EBXpaHr.exe
  C:\Windows\System\EBXpaHr.exe
  2⤵
  PID:5468
- C:\Windows\System\NoYgXtX.exe
  C:\Windows\System\NoYgXtX.exe
  2⤵
  PID:5496
- C:\Windows\System\PZEonQI.exe
  C:\Windows\System\PZEonQI.exe
  2⤵
  PID:5528
- C:\Windows\System\ikqegHW.exe
  C:\Windows\System\ikqegHW.exe
  2⤵
  PID:5552
- C:\Windows\System\idLzTgT.exe
  C:\Windows\System\idLzTgT.exe
  2⤵
  PID:5588
- C:\Windows\System\MbTFjju.exe
  C:\Windows\System\MbTFjju.exe
  2⤵
  PID:5604
- C:\Windows\System\jkEVgBk.exe
  C:\Windows\System\jkEVgBk.exe
  2⤵
  PID:5648
- C:\Windows\System\tmWEvva.exe
  C:\Windows\System\tmWEvva.exe
  2⤵
  PID:5672
- C:\Windows\System\FdzqiBW.exe
  C:\Windows\System\FdzqiBW.exe
  2⤵
  PID:5700
- C:\Windows\System\vvkIJLq.exe
  C:\Windows\System\vvkIJLq.exe
  2⤵
  PID:5724
- C:\Windows\System\ztsSkvr.exe
  C:\Windows\System\ztsSkvr.exe
  2⤵
  PID:5744
- C:\Windows\System\ORFxHEH.exe
  C:\Windows\System\ORFxHEH.exe
  2⤵
  PID:5772
- C:\Windows\System\yzGYuXd.exe
  C:\Windows\System\yzGYuXd.exe
  2⤵
  PID:5792
- C:\Windows\System\rdkFIed.exe
  C:\Windows\System\rdkFIed.exe
  2⤵
  PID:5828
- C:\Windows\System\khZVuiM.exe
  C:\Windows\System\khZVuiM.exe
  2⤵
  PID:5860
- C:\Windows\System\kQhyLKN.exe
  C:\Windows\System\kQhyLKN.exe
  2⤵
  PID:5888
- C:\Windows\System\LlOJUqU.exe
  C:\Windows\System\LlOJUqU.exe
  2⤵
  PID:5920
- C:\Windows\System\tFAUdRJ.exe
  C:\Windows\System\tFAUdRJ.exe
  2⤵
  PID:5944
- C:\Windows\System\HQPreuL.exe
  C:\Windows\System\HQPreuL.exe
  2⤵
  PID:5976
- C:\Windows\System\ubvyzVr.exe
  C:\Windows\System\ubvyzVr.exe
  2⤵
  PID:5996
- C:\Windows\System\WMECdae.exe
  C:\Windows\System\WMECdae.exe
  2⤵
  PID:6048
- C:\Windows\System\DtPdgcf.exe
  C:\Windows\System\DtPdgcf.exe
  2⤵
  PID:6064
- C:\Windows\System\aYShAfU.exe
  C:\Windows\System\aYShAfU.exe
  2⤵
  PID:6088
- C:\Windows\System\aIhngJB.exe
  C:\Windows\System\aIhngJB.exe
  2⤵
  PID:6112
- C:\Windows\System\brDkKLu.exe
  C:\Windows\System\brDkKLu.exe
  2⤵
  PID:6132
- C:\Windows\System\qBndlrG.exe
  C:\Windows\System\qBndlrG.exe
  2⤵
  PID:2100
- C:\Windows\System\NPobBlB.exe
  C:\Windows\System\NPobBlB.exe
  2⤵
  PID:5148
- C:\Windows\System\rncnhpC.exe
  C:\Windows\System\rncnhpC.exe
  2⤵
  PID:5248
- C:\Windows\System\dkDPReB.exe
  C:\Windows\System\dkDPReB.exe
  2⤵
  PID:5328
- C:\Windows\System\TxkshOk.exe
  C:\Windows\System\TxkshOk.exe
  2⤵
  PID:5412
- C:\Windows\System\EdhQajs.exe
  C:\Windows\System\EdhQajs.exe
  2⤵
  PID:5464
- C:\Windows\System\ccCHlrL.exe
  C:\Windows\System\ccCHlrL.exe
  2⤵
  PID:5560
- C:\Windows\System\WiRvFHn.exe
  C:\Windows\System\WiRvFHn.exe
  2⤵
  PID:5596
- C:\Windows\System\BSRappg.exe
  C:\Windows\System\BSRappg.exe
  2⤵
  PID:5668
- C:\Windows\System\TdnZxCs.exe
  C:\Windows\System\TdnZxCs.exe
  2⤵
  PID:5716
- C:\Windows\System\mmodOOi.exe
  C:\Windows\System\mmodOOi.exe
  2⤵
  PID:5784
- C:\Windows\System\SOYJNJj.exe
  C:\Windows\System\SOYJNJj.exe
  2⤵
  PID:5840
- C:\Windows\System\GhyzopA.exe
  C:\Windows\System\GhyzopA.exe
  2⤵
  PID:5876
- C:\Windows\System\wAVHUxu.exe
  C:\Windows\System\wAVHUxu.exe
  2⤵
  PID:5940
- C:\Windows\System\rdSbLHl.exe
  C:\Windows\System\rdSbLHl.exe
  2⤵
  PID:5992
- C:\Windows\System\oRoYRYN.exe
  C:\Windows\System\oRoYRYN.exe
  2⤵
  PID:6096
- C:\Windows\System\ghYjbpj.exe
  C:\Windows\System\ghYjbpj.exe
  2⤵
  PID:6140
- C:\Windows\System\LLLRrxO.exe
  C:\Windows\System\LLLRrxO.exe
  2⤵
  PID:5292
- C:\Windows\System\EZgthdo.exe
  C:\Windows\System\EZgthdo.exe
  2⤵
  PID:5388
- C:\Windows\System\FomjUjx.exe
  C:\Windows\System\FomjUjx.exe
  2⤵
  PID:5512
- C:\Windows\System\TVOFxmL.exe
  C:\Windows\System\TVOFxmL.exe
  2⤵
  PID:5740
- C:\Windows\System\rXxUusN.exe
  C:\Windows\System\rXxUusN.exe
  2⤵
  PID:5804
- C:\Windows\System\lsSyeIQ.exe
  C:\Windows\System\lsSyeIQ.exe
  2⤵
  PID:5968
- C:\Windows\System\AjDpsLY.exe
  C:\Windows\System\AjDpsLY.exe
  2⤵
  PID:6080
- C:\Windows\System\uCxisPE.exe
  C:\Windows\System\uCxisPE.exe
  2⤵
  PID:5376
- C:\Windows\System\rRxvyax.exe
  C:\Windows\System\rRxvyax.exe
  2⤵
  PID:5408
- C:\Windows\System\uvtWluC.exe
  C:\Windows\System\uvtWluC.exe
  2⤵
  PID:6108
- C:\Windows\System\FOyQXpi.exe
  C:\Windows\System\FOyQXpi.exe
  2⤵
  PID:5928
- C:\Windows\System\HbPHzPi.exe
  C:\Windows\System\HbPHzPi.exe
  2⤵
  PID:5572
- C:\Windows\System\cNkTaIC.exe
  C:\Windows\System\cNkTaIC.exe
  2⤵
  PID:6148
- C:\Windows\System\SlYzSAA.exe
  C:\Windows\System\SlYzSAA.exe
  2⤵
  PID:6192
- C:\Windows\System\MNqgtdO.exe
  C:\Windows\System\MNqgtdO.exe
  2⤵
  PID:6240
- C:\Windows\System\atgoIrX.exe
  C:\Windows\System\atgoIrX.exe
  2⤵
  PID:6268
- C:\Windows\System\QugJbdL.exe
  C:\Windows\System\QugJbdL.exe
  2⤵
  PID:6296
- C:\Windows\System\eUsHVoD.exe
  C:\Windows\System\eUsHVoD.exe
  2⤵
  PID:6324
- C:\Windows\System\bFsfDiB.exe
  C:\Windows\System\bFsfDiB.exe
  2⤵
  PID:6340
- C:\Windows\System\iLAqVZL.exe
  C:\Windows\System\iLAqVZL.exe
  2⤵
  PID:6372
- C:\Windows\System\HdCCEMB.exe
  C:\Windows\System\HdCCEMB.exe
  2⤵
  PID:6404
- C:\Windows\System\XbrMuWV.exe
  C:\Windows\System\XbrMuWV.exe
  2⤵
  PID:6436
- C:\Windows\System\njjBbsX.exe
  C:\Windows\System\njjBbsX.exe
  2⤵
  PID:6456
- C:\Windows\System\JVCjXWu.exe
  C:\Windows\System\JVCjXWu.exe
  2⤵
  PID:6484
- C:\Windows\System\DvbfqjP.exe
  C:\Windows\System\DvbfqjP.exe
  2⤵
  PID:6516
- C:\Windows\System\ZqMNETH.exe
  C:\Windows\System\ZqMNETH.exe
  2⤵
  PID:6540
- C:\Windows\System\Yzkagrj.exe
  C:\Windows\System\Yzkagrj.exe
  2⤵
  PID:6572
- C:\Windows\System\IbNRAEq.exe
  C:\Windows\System\IbNRAEq.exe
  2⤵
  PID:6600
- C:\Windows\System\eFwsDSo.exe
  C:\Windows\System\eFwsDSo.exe
  2⤵
  PID:6632
- C:\Windows\System\MQbejUm.exe
  C:\Windows\System\MQbejUm.exe
  2⤵
  PID:6660
- C:\Windows\System\wpluYUc.exe
  C:\Windows\System\wpluYUc.exe
  2⤵
  PID:6692
- C:\Windows\System\lVMPTIC.exe
  C:\Windows\System\lVMPTIC.exe
  2⤵
  PID:6708
- C:\Windows\System\XXGRMGy.exe
  C:\Windows\System\XXGRMGy.exe
  2⤵
  PID:6736
- C:\Windows\System\jacFvrY.exe
  C:\Windows\System\jacFvrY.exe
  2⤵
  PID:6776
- C:\Windows\System\ymJVmsf.exe
  C:\Windows\System\ymJVmsf.exe
  2⤵
  PID:6804
- C:\Windows\System\NChObvU.exe
  C:\Windows\System\NChObvU.exe
  2⤵
  PID:6836
- C:\Windows\System\eJSsOqZ.exe
  C:\Windows\System\eJSsOqZ.exe
  2⤵
  PID:6856
- C:\Windows\System\AeKthPs.exe
  C:\Windows\System\AeKthPs.exe
  2⤵
  PID:6888
- C:\Windows\System\fQTBETY.exe
  C:\Windows\System\fQTBETY.exe
  2⤵
  PID:6916
- C:\Windows\System\IkSxbkz.exe
  C:\Windows\System\IkSxbkz.exe
  2⤵
  PID:6944
- C:\Windows\System\fHtTnXl.exe
  C:\Windows\System\fHtTnXl.exe
  2⤵
  PID:6968
- C:\Windows\System\uejdRSg.exe
  C:\Windows\System\uejdRSg.exe
  2⤵
  PID:6992
- C:\Windows\System\XFomXer.exe
  C:\Windows\System\XFomXer.exe
  2⤵
  PID:7028
- C:\Windows\System\MruJrvW.exe
  C:\Windows\System\MruJrvW.exe
  2⤵
  PID:7044
- C:\Windows\System\hNazRpi.exe
  C:\Windows\System\hNazRpi.exe
  2⤵
  PID:7072
- C:\Windows\System\PlUYwCJ.exe
  C:\Windows\System\PlUYwCJ.exe
  2⤵
  PID:7112
- C:\Windows\System\Axvqxhh.exe
  C:\Windows\System\Axvqxhh.exe
  2⤵
  PID:7136
- C:\Windows\System\IFLSTjl.exe
  C:\Windows\System\IFLSTjl.exe
  2⤵
  PID:7164
- C:\Windows\System\sdSumpq.exe
  C:\Windows\System\sdSumpq.exe
  2⤵
  PID:6260
- C:\Windows\System\lEgCCty.exe
  C:\Windows\System\lEgCCty.exe
  2⤵
  PID:6280
- C:\Windows\System\NMaFkFY.exe
  C:\Windows\System\NMaFkFY.exe
  2⤵
  PID:6312
- C:\Windows\System\rrADYTL.exe
  C:\Windows\System\rrADYTL.exe
  2⤵
  PID:6352
- C:\Windows\System\lUalvzC.exe
  C:\Windows\System\lUalvzC.exe
  2⤵
  PID:6424
- C:\Windows\System\BcgWavC.exe
  C:\Windows\System\BcgWavC.exe
  2⤵
  PID:6464
- C:\Windows\System\FMlpLQd.exe
  C:\Windows\System\FMlpLQd.exe
  2⤵
  PID:6560
- C:\Windows\System\CtNFrsq.exe
  C:\Windows\System\CtNFrsq.exe
  2⤵
  PID:6612
- C:\Windows\System\MAHcdfm.exe
  C:\Windows\System\MAHcdfm.exe
  2⤵
  PID:6680
- C:\Windows\System\NcPyaGA.exe
  C:\Windows\System\NcPyaGA.exe
  2⤵
  PID:6792
- C:\Windows\System\jKxSjss.exe
  C:\Windows\System\jKxSjss.exe
  2⤵
  PID:6876
- C:\Windows\System\eNUBJcm.exe
  C:\Windows\System\eNUBJcm.exe
  2⤵
  PID:6904
- C:\Windows\System\pEQOyRi.exe
  C:\Windows\System\pEQOyRi.exe
  2⤵
  PID:6964
- C:\Windows\System\QEoRRyE.exe
  C:\Windows\System\QEoRRyE.exe
  2⤵
  PID:7040
- C:\Windows\System\BbgVDqa.exe
  C:\Windows\System\BbgVDqa.exe
  2⤵
  PID:7080
- C:\Windows\System\lxXHWGD.exe
  C:\Windows\System\lxXHWGD.exe
  2⤵
  PID:5536
- C:\Windows\System\SINFDwJ.exe
  C:\Windows\System\SINFDwJ.exe
  2⤵
  PID:6448
- C:\Windows\System\zAamczM.exe
  C:\Windows\System\zAamczM.exe
  2⤵
  PID:6396
- C:\Windows\System\dcjUmKd.exe
  C:\Windows\System\dcjUmKd.exe
  2⤵
  PID:6548
- C:\Windows\System\XoCHfmo.exe
  C:\Windows\System\XoCHfmo.exe
  2⤵
  PID:6652
- C:\Windows\System\FKPaXlr.exe
  C:\Windows\System\FKPaXlr.exe
  2⤵
  PID:6932
- C:\Windows\System\UsrGTus.exe
  C:\Windows\System\UsrGTus.exe
  2⤵
  PID:6864
- C:\Windows\System\EKpzNmt.exe
  C:\Windows\System\EKpzNmt.exe
  2⤵
  PID:7128
- C:\Windows\System\jOACYkg.exe
  C:\Windows\System\jOACYkg.exe
  2⤵
  PID:6480
- C:\Windows\System\ESknxoK.exe
  C:\Windows\System\ESknxoK.exe
  2⤵
  PID:6988
- C:\Windows\System\OxxHJwk.exe
  C:\Windows\System\OxxHJwk.exe
  2⤵
  PID:7092
- C:\Windows\System\YKZkhtv.exe
  C:\Windows\System\YKZkhtv.exe
  2⤵
  PID:6816
- C:\Windows\System\AcLZAGP.exe
  C:\Windows\System\AcLZAGP.exe
  2⤵
  PID:7200
- C:\Windows\System\lgbJuxY.exe
  C:\Windows\System\lgbJuxY.exe
  2⤵
  PID:7224
- C:\Windows\System\hLpPQvm.exe
  C:\Windows\System\hLpPQvm.exe
  2⤵
  PID:7252
- C:\Windows\System\PZACqOo.exe
  C:\Windows\System\PZACqOo.exe
  2⤵
  PID:7272
- C:\Windows\System\LYYCevv.exe
  C:\Windows\System\LYYCevv.exe
  2⤵
  PID:7296
- C:\Windows\System\hURVAdg.exe
  C:\Windows\System\hURVAdg.exe
  2⤵
  PID:7332
- C:\Windows\System\abWXirK.exe
  C:\Windows\System\abWXirK.exe
  2⤵
  PID:7364
- C:\Windows\System\vSBRwGv.exe
  C:\Windows\System\vSBRwGv.exe
  2⤵
  PID:7384
- C:\Windows\System\TfaBYgV.exe
  C:\Windows\System\TfaBYgV.exe
  2⤵
  PID:7408
- C:\Windows\System\VkjZfwV.exe
  C:\Windows\System\VkjZfwV.exe
  2⤵
  PID:7440
- C:\Windows\System\aXpdnSA.exe
  C:\Windows\System\aXpdnSA.exe
  2⤵
  PID:7468
- C:\Windows\System\fwnxGOO.exe
  C:\Windows\System\fwnxGOO.exe
  2⤵
  PID:7492
- C:\Windows\System\bNrqnzi.exe
  C:\Windows\System\bNrqnzi.exe
  2⤵
  PID:7524
- C:\Windows\System\eLYZYts.exe
  C:\Windows\System\eLYZYts.exe
  2⤵
  PID:7544
- C:\Windows\System\DgUdxoG.exe
  C:\Windows\System\DgUdxoG.exe
  2⤵
  PID:7564
- C:\Windows\System\cdElJxs.exe
  C:\Windows\System\cdElJxs.exe
  2⤵
  PID:7588
- C:\Windows\System\IbIJuvk.exe
  C:\Windows\System\IbIJuvk.exe
  2⤵
  PID:7616
- C:\Windows\System\FDpckxD.exe
  C:\Windows\System\FDpckxD.exe
  2⤵
  PID:7644
- C:\Windows\System\KMMDohj.exe
  C:\Windows\System\KMMDohj.exe
  2⤵
  PID:7680
- C:\Windows\System\fCMIVyw.exe
  C:\Windows\System\fCMIVyw.exe
  2⤵
  PID:7704
- C:\Windows\System\QkioyVn.exe
  C:\Windows\System\QkioyVn.exe
  2⤵
  PID:7740
- C:\Windows\System\xyISgFH.exe
  C:\Windows\System\xyISgFH.exe
  2⤵
  PID:7760
- C:\Windows\System\kHZWkNT.exe
  C:\Windows\System\kHZWkNT.exe
  2⤵
  PID:7792
- C:\Windows\System\YfPJDpR.exe
  C:\Windows\System\YfPJDpR.exe
  2⤵
  PID:7820
- C:\Windows\System\OiUVDDR.exe
  C:\Windows\System\OiUVDDR.exe
  2⤵
  PID:7848
- C:\Windows\System\UwYnrQg.exe
  C:\Windows\System\UwYnrQg.exe
  2⤵
  PID:7876
- C:\Windows\System\dKuheYM.exe
  C:\Windows\System\dKuheYM.exe
  2⤵
  PID:7908
- C:\Windows\System\oapmeiH.exe
  C:\Windows\System\oapmeiH.exe
  2⤵
  PID:8004
- C:\Windows\System\iVXwBTZ.exe
  C:\Windows\System\iVXwBTZ.exe
  2⤵
  PID:8020
- C:\Windows\System\oAiSgDI.exe
  C:\Windows\System\oAiSgDI.exe
  2⤵
  PID:8040
- C:\Windows\System\igrsqdn.exe
  C:\Windows\System\igrsqdn.exe
  2⤵
  PID:8068
- C:\Windows\System\xwzglCO.exe
  C:\Windows\System\xwzglCO.exe
  2⤵
  PID:8092
- C:\Windows\System\uImWdjI.exe
  C:\Windows\System\uImWdjI.exe
  2⤵
  PID:8120
- C:\Windows\System\EGreBVA.exe
  C:\Windows\System\EGreBVA.exe
  2⤵
  PID:8148
- C:\Windows\System\HkyEEzW.exe
  C:\Windows\System\HkyEEzW.exe
  2⤵
  PID:8176
- C:\Windows\System\VUZkShm.exe
  C:\Windows\System\VUZkShm.exe
  2⤵
  PID:6852
- C:\Windows\System\YabtFfJ.exe
  C:\Windows\System\YabtFfJ.exe
  2⤵
  PID:7180
- C:\Windows\System\BxCjTBT.exe
  C:\Windows\System\BxCjTBT.exe
  2⤵
  PID:7244
- C:\Windows\System\yRMSejo.exe
  C:\Windows\System\yRMSejo.exe
  2⤵
  PID:7324
- C:\Windows\System\yaUizvZ.exe
  C:\Windows\System\yaUizvZ.exe
  2⤵
  PID:7380
- C:\Windows\System\zKkaNYd.exe
  C:\Windows\System\zKkaNYd.exe
  2⤵
  PID:7424
- C:\Windows\System\WCjrGAI.exe
  C:\Windows\System\WCjrGAI.exe
  2⤵
  PID:7420
- C:\Windows\System\bmdNufF.exe
  C:\Windows\System\bmdNufF.exe
  2⤵
  PID:7560
- C:\Windows\System\oxuUzHB.exe
  C:\Windows\System\oxuUzHB.exe
  2⤵
  PID:7580
- C:\Windows\System\RVDPJHQ.exe
  C:\Windows\System\RVDPJHQ.exe
  2⤵
  PID:7608
- C:\Windows\System\EMutCDC.exe
  C:\Windows\System\EMutCDC.exe
  2⤵
  PID:7640
- C:\Windows\System\MtHMkwN.exe
  C:\Windows\System\MtHMkwN.exe
  2⤵
  PID:7656
- C:\Windows\System\GMUCsmh.exe
  C:\Windows\System\GMUCsmh.exe
  2⤵
  PID:7808
- C:\Windows\System\vBAIVne.exe
  C:\Windows\System\vBAIVne.exe
  2⤵
  PID:7896
- C:\Windows\System\SDzGqPo.exe
  C:\Windows\System\SDzGqPo.exe
  2⤵
  PID:7916
- C:\Windows\System\fQOpTUr.exe
  C:\Windows\System\fQOpTUr.exe
  2⤵
  PID:8000
- C:\Windows\System\OteTOCC.exe
  C:\Windows\System\OteTOCC.exe
  2⤵
  PID:8084
- C:\Windows\System\PjliZqR.exe
  C:\Windows\System\PjliZqR.exe
  2⤵
  PID:8132
- C:\Windows\System\AODAbzG.exe
  C:\Windows\System\AODAbzG.exe
  2⤵
  PID:6316
- C:\Windows\System\vvJDEff.exe
  C:\Windows\System\vvJDEff.exe
  2⤵
  PID:6452
- C:\Windows\System\wCuHttC.exe
  C:\Windows\System\wCuHttC.exe
  2⤵
  PID:7432
- C:\Windows\System\HqHCftZ.exe
  C:\Windows\System\HqHCftZ.exe
  2⤵
  PID:7516
- C:\Windows\System\oZuIKPQ.exe
  C:\Windows\System\oZuIKPQ.exe
  2⤵
  PID:7672
- C:\Windows\System\NHvAlrh.exe
  C:\Windows\System\NHvAlrh.exe
  2⤵
  PID:7696
- C:\Windows\System\xEjGgWJ.exe
  C:\Windows\System\xEjGgWJ.exe
  2⤵
  PID:7872
- C:\Windows\System\VLuUMBh.exe
  C:\Windows\System\VLuUMBh.exe
  2⤵
  PID:7156
- C:\Windows\System\LTLofnY.exe
  C:\Windows\System\LTLofnY.exe
  2⤵
  PID:7216
- C:\Windows\System\FjGdDbB.exe
  C:\Windows\System\FjGdDbB.exe
  2⤵
  PID:7536
- C:\Windows\System\yowgowa.exe
  C:\Windows\System\yowgowa.exe
  2⤵
  PID:7676
- C:\Windows\System\FRosXPn.exe
  C:\Windows\System\FRosXPn.exe
  2⤵
  PID:8196
- C:\Windows\System\eTqhtAa.exe
  C:\Windows\System\eTqhtAa.exe
  2⤵
  PID:8220
- C:\Windows\System\tXEODRO.exe
  C:\Windows\System\tXEODRO.exe
  2⤵
  PID:8240
- C:\Windows\System\TVMBKYd.exe
  C:\Windows\System\TVMBKYd.exe
  2⤵
  PID:8264
- C:\Windows\System\vEznkPv.exe
  C:\Windows\System\vEznkPv.exe
  2⤵
  PID:8296
- C:\Windows\System\BaJcRUb.exe
  C:\Windows\System\BaJcRUb.exe
  2⤵
  PID:8328
- C:\Windows\System\VSCHhHY.exe
  C:\Windows\System\VSCHhHY.exe
  2⤵
  PID:8352
- C:\Windows\System\FNoFALS.exe
  C:\Windows\System\FNoFALS.exe
  2⤵
  PID:8376
- C:\Windows\System\VDyRUon.exe
  C:\Windows\System\VDyRUon.exe
  2⤵
  PID:8404
- C:\Windows\System\GWFJjGI.exe
  C:\Windows\System\GWFJjGI.exe
  2⤵
  PID:8428
- C:\Windows\System\gcZRvis.exe
  C:\Windows\System\gcZRvis.exe
  2⤵
  PID:8448
- C:\Windows\System\OZxGHdA.exe
  C:\Windows\System\OZxGHdA.exe
  2⤵
  PID:8464
- C:\Windows\System\HOvTccs.exe
  C:\Windows\System\HOvTccs.exe
  2⤵
  PID:8500
- C:\Windows\System\yYxqXki.exe
  C:\Windows\System\yYxqXki.exe
  2⤵
  PID:8528
- C:\Windows\System\OxoVYPh.exe
  C:\Windows\System\OxoVYPh.exe
  2⤵
  PID:8552
- C:\Windows\System\CGjKrPX.exe
  C:\Windows\System\CGjKrPX.exe
  2⤵
  PID:8580
- C:\Windows\System\xPQeaQm.exe
  C:\Windows\System\xPQeaQm.exe
  2⤵
  PID:8604
- C:\Windows\System\sTHRDCJ.exe
  C:\Windows\System\sTHRDCJ.exe
  2⤵
  PID:8632
- C:\Windows\System\KVPbglR.exe
  C:\Windows\System\KVPbglR.exe
  2⤵
  PID:8660
- C:\Windows\System\jCNibpU.exe
  C:\Windows\System\jCNibpU.exe
  2⤵
  PID:8692
- C:\Windows\System\KYQZpmh.exe
  C:\Windows\System\KYQZpmh.exe
  2⤵
  PID:8720
- C:\Windows\System\pUpTMvU.exe
  C:\Windows\System\pUpTMvU.exe
  2⤵
  PID:8740
- C:\Windows\System\KMePcwO.exe
  C:\Windows\System\KMePcwO.exe
  2⤵
  PID:8768
- C:\Windows\System\MpgYsVZ.exe
  C:\Windows\System\MpgYsVZ.exe
  2⤵
  PID:8800
- C:\Windows\System\EyDnqwB.exe
  C:\Windows\System\EyDnqwB.exe
  2⤵
  PID:8828
- C:\Windows\System\XzIfrLz.exe
  C:\Windows\System\XzIfrLz.exe
  2⤵
  PID:8856
- C:\Windows\System\WnpxUBa.exe
  C:\Windows\System\WnpxUBa.exe
  2⤵
  PID:8884
- C:\Windows\System\YssnTbl.exe
  C:\Windows\System\YssnTbl.exe
  2⤵
  PID:8904
- C:\Windows\System\ekmKjSU.exe
  C:\Windows\System\ekmKjSU.exe
  2⤵
  PID:8932
- C:\Windows\System\EDjHYjh.exe
  C:\Windows\System\EDjHYjh.exe
  2⤵
  PID:8956
- C:\Windows\System\dqJlVGp.exe
  C:\Windows\System\dqJlVGp.exe
  2⤵
  PID:8984
- C:\Windows\System\epBEclh.exe
  C:\Windows\System\epBEclh.exe
  2⤵
  PID:9008
- C:\Windows\System\zksPFZu.exe
  C:\Windows\System\zksPFZu.exe
  2⤵
  PID:9040
- C:\Windows\System\HTNuHiB.exe
  C:\Windows\System\HTNuHiB.exe
  2⤵
  PID:9076
- C:\Windows\System\opHyULZ.exe
  C:\Windows\System\opHyULZ.exe
  2⤵
  PID:9108
- C:\Windows\System\DWDEhqH.exe
  C:\Windows\System\DWDEhqH.exe
  2⤵
  PID:9140
- C:\Windows\System\WJFfrGu.exe
  C:\Windows\System\WJFfrGu.exe
  2⤵
  PID:9164
- C:\Windows\System\kDiTYsm.exe
  C:\Windows\System\kDiTYsm.exe
  2⤵
  PID:9192
- C:\Windows\System\seKmYmx.exe
  C:\Windows\System\seKmYmx.exe
  2⤵
  PID:8108
- C:\Windows\System\ueFNxxb.exe
  C:\Windows\System\ueFNxxb.exe
  2⤵
  PID:8228
- C:\Windows\System\vMKmgYf.exe
  C:\Windows\System\vMKmgYf.exe
  2⤵
  PID:8372
- C:\Windows\System\ggiFkKQ.exe
  C:\Windows\System\ggiFkKQ.exe
  2⤵
  PID:8488
- C:\Windows\System\QatCbjK.exe
  C:\Windows\System\QatCbjK.exe
  2⤵
  PID:8524
- C:\Windows\System\btYQJTl.exe
  C:\Windows\System\btYQJTl.exe
  2⤵
  PID:8676
- C:\Windows\System\rHhXHeg.exe
  C:\Windows\System\rHhXHeg.exe
  2⤵
  PID:8576
- C:\Windows\System\NyotLXW.exe
  C:\Windows\System\NyotLXW.exe
  2⤵
  PID:8476
- C:\Windows\System\nuoSFcR.exe
  C:\Windows\System\nuoSFcR.exe
  2⤵
  PID:8836
- C:\Windows\System\vrvAVAQ.exe
  C:\Windows\System\vrvAVAQ.exe
  2⤵
  PID:8752
- C:\Windows\System\nxFvKZd.exe
  C:\Windows\System\nxFvKZd.exe
  2⤵
  PID:8812
- C:\Windows\System\AxwbAry.exe
  C:\Windows\System\AxwbAry.exe
  2⤵
  PID:9004
- C:\Windows\System\AbHQODs.exe
  C:\Windows\System\AbHQODs.exe
  2⤵
  PID:8788
- C:\Windows\System\cnRtIEu.exe
  C:\Windows\System\cnRtIEu.exe
  2⤵
  PID:8876
- C:\Windows\System\kDHUYXY.exe
  C:\Windows\System\kDHUYXY.exe
  2⤵
  PID:8028
- C:\Windows\System\vmHuHhw.exe
  C:\Windows\System\vmHuHhw.exe
  2⤵
  PID:7480
- C:\Windows\System\yqJMblh.exe
  C:\Windows\System\yqJMblh.exe
  2⤵
  PID:7768
- C:\Windows\System\xppxcfs.exe
  C:\Windows\System\xppxcfs.exe
  2⤵
  PID:8340
- C:\Windows\System\TYdpxEJ.exe
  C:\Windows\System\TYdpxEJ.exe
  2⤵
  PID:8568
- C:\Windows\System\agOOjrZ.exe
  C:\Windows\System\agOOjrZ.exe
  2⤵
  PID:8416
- C:\Windows\System\oTycSXf.exe
  C:\Windows\System\oTycSXf.exe
  2⤵
  PID:8648
- C:\Windows\System\ltPmCnV.exe
  C:\Windows\System\ltPmCnV.exe
  2⤵
  PID:8920
- C:\Windows\System\ejINNiz.exe
  C:\Windows\System\ejINNiz.exe
  2⤵
  PID:9120
- C:\Windows\System\InFtmdj.exe
  C:\Windows\System\InFtmdj.exe
  2⤵
  PID:9100
- C:\Windows\System\JNEDjEV.exe
  C:\Windows\System\JNEDjEV.exe
  2⤵
  PID:9228
- C:\Windows\System\pgtSybW.exe
  C:\Windows\System\pgtSybW.exe
  2⤵
  PID:9256
- C:\Windows\System\riCjwOq.exe
  C:\Windows\System\riCjwOq.exe
  2⤵
  PID:9292
- C:\Windows\System\jSzVmYG.exe
  C:\Windows\System\jSzVmYG.exe
  2⤵
  PID:9324
- C:\Windows\System\AFbAhon.exe
  C:\Windows\System\AFbAhon.exe
  2⤵
  PID:9352
- C:\Windows\System\CVZcZQu.exe
  C:\Windows\System\CVZcZQu.exe
  2⤵
  PID:9384
- C:\Windows\System\EKZyaiR.exe
  C:\Windows\System\EKZyaiR.exe
  2⤵
  PID:9412
- C:\Windows\System\jXwNWzy.exe
  C:\Windows\System\jXwNWzy.exe
  2⤵
  PID:9432
- C:\Windows\System\ZlWgqJl.exe
  C:\Windows\System\ZlWgqJl.exe
  2⤵
  PID:9460
- C:\Windows\System\OCLftDf.exe
  C:\Windows\System\OCLftDf.exe
  2⤵
  PID:9480
- C:\Windows\System\vbKxKTs.exe
  C:\Windows\System\vbKxKTs.exe
  2⤵
  PID:9508
- C:\Windows\System\cwJuZNe.exe
  C:\Windows\System\cwJuZNe.exe
  2⤵
  PID:9540
- C:\Windows\System\XONfgdm.exe
  C:\Windows\System\XONfgdm.exe
  2⤵
  PID:9568
- C:\Windows\System\pGEESyR.exe
  C:\Windows\System\pGEESyR.exe
  2⤵
  PID:9596
- C:\Windows\System\hpWPEUy.exe
  C:\Windows\System\hpWPEUy.exe
  2⤵
  PID:9620
- C:\Windows\System\lzpFupG.exe
  C:\Windows\System\lzpFupG.exe
  2⤵
  PID:9652
- C:\Windows\System\BhyRKcH.exe
  C:\Windows\System\BhyRKcH.exe
  2⤵
  PID:9676
- C:\Windows\System\GQBhAZu.exe
  C:\Windows\System\GQBhAZu.exe
  2⤵
  PID:9692
- C:\Windows\System\mDhIwyD.exe
  C:\Windows\System\mDhIwyD.exe
  2⤵
  PID:9716
- C:\Windows\System\soueVVT.exe
  C:\Windows\System\soueVVT.exe
  2⤵
  PID:9748
- C:\Windows\System\MUNBMhQ.exe
  C:\Windows\System\MUNBMhQ.exe
  2⤵
  PID:9780
- C:\Windows\System\myWgkhb.exe
  C:\Windows\System\myWgkhb.exe
  2⤵
  PID:9804
- C:\Windows\System\iqtHByo.exe
  C:\Windows\System\iqtHByo.exe
  2⤵
  PID:9832
- C:\Windows\System\oKFpUNj.exe
  C:\Windows\System\oKFpUNj.exe
  2⤵
  PID:9856
- C:\Windows\System\EYFdlIk.exe
  C:\Windows\System\EYFdlIk.exe
  2⤵
  PID:9888
- C:\Windows\System\uJphxRx.exe
  C:\Windows\System\uJphxRx.exe
  2⤵
  PID:9916
- C:\Windows\System\SKkLnfd.exe
  C:\Windows\System\SKkLnfd.exe
  2⤵
  PID:9948
- C:\Windows\System\emYgNYR.exe
  C:\Windows\System\emYgNYR.exe
  2⤵
  PID:9980
- C:\Windows\System\Umwmhdg.exe
  C:\Windows\System\Umwmhdg.exe
  2⤵
  PID:10004
- C:\Windows\System\UdIJGaS.exe
  C:\Windows\System\UdIJGaS.exe
  2⤵
  PID:10028
- C:\Windows\System\XglOVUF.exe
  C:\Windows\System\XglOVUF.exe
  2⤵
  PID:10064
- C:\Windows\System\CnWvNrC.exe
  C:\Windows\System\CnWvNrC.exe
  2⤵
  PID:10092
- C:\Windows\System\RQIdfsH.exe
  C:\Windows\System\RQIdfsH.exe
  2⤵
  PID:10120
- C:\Windows\System\IUqgufq.exe
  C:\Windows\System\IUqgufq.exe
  2⤵
  PID:10144
- C:\Windows\System\xhqlLpD.exe
  C:\Windows\System\xhqlLpD.exe
  2⤵
  PID:10172
- C:\Windows\System\zHZGiZF.exe
  C:\Windows\System\zHZGiZF.exe
  2⤵
  PID:10208
- C:\Windows\System\Asvnlvo.exe
  C:\Windows\System\Asvnlvo.exe
  2⤵
  PID:10236
- C:\Windows\System\ITbniBy.exe
  C:\Windows\System\ITbniBy.exe
  2⤵
  PID:8588
- C:\Windows\System\LWzrpdp.exe
  C:\Windows\System\LWzrpdp.exe
  2⤵
  PID:9220
- C:\Windows\System\NuotRHW.exe
  C:\Windows\System\NuotRHW.exe
  2⤵
  PID:8872
- C:\Windows\System\OGVXFLq.exe
  C:\Windows\System\OGVXFLq.exe
  2⤵
  PID:9312
- C:\Windows\System\fjpXcDG.exe
  C:\Windows\System\fjpXcDG.exe
  2⤵
  PID:9376
- C:\Windows\System\vVJbOZX.exe
  C:\Windows\System\vVJbOZX.exe
  2⤵
  PID:9420
- C:\Windows\System\hBaIzLA.exe
  C:\Windows\System\hBaIzLA.exe
  2⤵
  PID:9500
- C:\Windows\System\qrIJoSw.exe
  C:\Windows\System\qrIJoSw.exe
  2⤵
  PID:9472
- C:\Windows\System\LagItBQ.exe
  C:\Windows\System\LagItBQ.exe
  2⤵
  PID:9648
- C:\Windows\System\KPmiKgV.exe
  C:\Windows\System\KPmiKgV.exe
  2⤵
  PID:9608
- C:\Windows\System\pqOnszA.exe
  C:\Windows\System\pqOnszA.exe
  2⤵
  PID:9684
- C:\Windows\System\WiiNQut.exe
  C:\Windows\System\WiiNQut.exe
  2⤵
  PID:9788
- C:\Windows\System\GoBtjWk.exe
  C:\Windows\System\GoBtjWk.exe
  2⤵
  PID:9848
- C:\Windows\System\gAyLmMQ.exe
  C:\Windows\System\gAyLmMQ.exe
  2⤵
  PID:9796
- C:\Windows\System\hHhgRwj.exe
  C:\Windows\System\hHhgRwj.exe
  2⤵
  PID:9972
- C:\Windows\System\baHqUdR.exe
  C:\Windows\System\baHqUdR.exe
  2⤵
  PID:10088
- C:\Windows\System\JNcADnE.exe
  C:\Windows\System\JNcADnE.exe
  2⤵
  PID:9928
- C:\Windows\System\bUnonzX.exe
  C:\Windows\System\bUnonzX.exe
  2⤵
  PID:10196
- C:\Windows\System\BYGWIDr.exe
  C:\Windows\System\BYGWIDr.exe
  2⤵
  PID:10116
- C:\Windows\System\mQmXjIb.exe
  C:\Windows\System\mQmXjIb.exe
  2⤵
  PID:9172
- C:\Windows\System\VibljFw.exe
  C:\Windows\System\VibljFw.exe
  2⤵
  PID:9452
- C:\Windows\System\HNoBtOI.exe
  C:\Windows\System\HNoBtOI.exe
  2⤵
  PID:9576
- C:\Windows\System\tPnVpVM.exe
  C:\Windows\System\tPnVpVM.exe
  2⤵
  PID:9588
- C:\Windows\System\BFgbgbq.exe
  C:\Windows\System\BFgbgbq.exe
  2⤵
  PID:9812
- C:\Windows\System\ZbAiSfk.exe
  C:\Windows\System\ZbAiSfk.exe
  2⤵
  PID:9628
- C:\Windows\System\pYUJVue.exe
  C:\Windows\System\pYUJVue.exe
  2⤵
  PID:9908
- C:\Windows\System\bkKUFWP.exe
  C:\Windows\System\bkKUFWP.exe
  2⤵
  PID:9988
- C:\Windows\System\tCwSFjM.exe
  C:\Windows\System\tCwSFjM.exe
  2⤵
  PID:9664
- C:\Windows\System\DRKGNFD.exe
  C:\Windows\System\DRKGNFD.exe
  2⤵
  PID:9884
- C:\Windows\System\VWVUHKs.exe
  C:\Windows\System\VWVUHKs.exe
  2⤵
  PID:10252
- C:\Windows\System\RABFpBq.exe
  C:\Windows\System\RABFpBq.exe
  2⤵
  PID:10280
- C:\Windows\System\QYZgsWp.exe
  C:\Windows\System\QYZgsWp.exe
  2⤵
  PID:10308
- C:\Windows\System\aNfZJSN.exe
  C:\Windows\System\aNfZJSN.exe
  2⤵
  PID:10344
- C:\Windows\System\DZLvYFA.exe
  C:\Windows\System\DZLvYFA.exe
  2⤵
  PID:10368
- C:\Windows\System\zdmEsaq.exe
  C:\Windows\System\zdmEsaq.exe
  2⤵
  PID:10396
- C:\Windows\System\ZjbNVdB.exe
  C:\Windows\System\ZjbNVdB.exe
  2⤵
  PID:10412
- C:\Windows\System\dEdkaWQ.exe
  C:\Windows\System\dEdkaWQ.exe
  2⤵
  PID:10444
- C:\Windows\System\hWvCvyU.exe
  C:\Windows\System\hWvCvyU.exe
  2⤵
  PID:10480
- C:\Windows\System\VtBkCGX.exe
  C:\Windows\System\VtBkCGX.exe
  2⤵
  PID:10504
- C:\Windows\System\lmIshQQ.exe
  C:\Windows\System\lmIshQQ.exe
  2⤵
  PID:10528
- C:\Windows\System\sGEHndp.exe
  C:\Windows\System\sGEHndp.exe
  2⤵
  PID:10548
- C:\Windows\System\pZFhQUt.exe
  C:\Windows\System\pZFhQUt.exe
  2⤵
  PID:10588
- C:\Windows\System\BrgHVbG.exe
  C:\Windows\System\BrgHVbG.exe
  2⤵
  PID:10624
- C:\Windows\System\IRZCKub.exe
  C:\Windows\System\IRZCKub.exe
  2⤵
  PID:10652
- C:\Windows\System\oAXQKHe.exe
  C:\Windows\System\oAXQKHe.exe
  2⤵
  PID:10668
- C:\Windows\System\aeIqFef.exe
  C:\Windows\System\aeIqFef.exe
  2⤵
  PID:10708
- C:\Windows\System\nwerAxz.exe
  C:\Windows\System\nwerAxz.exe
  2⤵
  PID:10736
- C:\Windows\System\ZJfahdI.exe
  C:\Windows\System\ZJfahdI.exe
  2⤵
  PID:10756
- C:\Windows\System\aRIwjDZ.exe
  C:\Windows\System\aRIwjDZ.exe
  2⤵
  PID:10784
- C:\Windows\System\QGNREVZ.exe
  C:\Windows\System\QGNREVZ.exe
  2⤵
  PID:10816
- C:\Windows\System\FLkXNmy.exe
  C:\Windows\System\FLkXNmy.exe
  2⤵
  PID:10840
- C:\Windows\System\ugMcxat.exe
  C:\Windows\System\ugMcxat.exe
  2⤵
  PID:10876
- C:\Windows\System\SvopKRH.exe
  C:\Windows\System\SvopKRH.exe
  2⤵
  PID:10904
- C:\Windows\System\AVmnizI.exe
  C:\Windows\System\AVmnizI.exe
  2⤵
  PID:10932
- C:\Windows\System\coqqFGu.exe
  C:\Windows\System\coqqFGu.exe
  2⤵
  PID:10956
- C:\Windows\System\sTSzjRM.exe
  C:\Windows\System\sTSzjRM.exe
  2⤵
  PID:10988
- C:\Windows\System\tWmoGCu.exe
  C:\Windows\System\tWmoGCu.exe
  2⤵
  PID:11012
- C:\Windows\System\HagloaT.exe
  C:\Windows\System\HagloaT.exe
  2⤵
  PID:11040
- C:\Windows\System\qNlJuON.exe
  C:\Windows\System\qNlJuON.exe
  2⤵
  PID:11068
- C:\Windows\System\SBEbufr.exe
  C:\Windows\System\SBEbufr.exe
  2⤵
  PID:11092
- C:\Windows\System\tsaaZKL.exe
  C:\Windows\System\tsaaZKL.exe
  2⤵
  PID:11112
- C:\Windows\System\bhybrmT.exe
  C:\Windows\System\bhybrmT.exe
  2⤵
  PID:11132
- C:\Windows\System\qPZHoZw.exe
  C:\Windows\System\qPZHoZw.exe
  2⤵
  PID:11156
- C:\Windows\System\OgvXCLd.exe
  C:\Windows\System\OgvXCLd.exe
  2⤵
  PID:11188
- C:\Windows\System\KRrURSt.exe
  C:\Windows\System\KRrURSt.exe
  2⤵
  PID:11212
- C:\Windows\System\xIUmTII.exe
  C:\Windows\System\xIUmTII.exe
  2⤵
  PID:11236
- C:\Windows\System\cDOSOtL.exe
  C:\Windows\System\cDOSOtL.exe
  2⤵
  PID:11260
- C:\Windows\System\fqpRbWi.exe
  C:\Windows\System\fqpRbWi.exe
  2⤵
  PID:9640
- C:\Windows\System\rTNfTxW.exe
  C:\Windows\System\rTNfTxW.exe
  2⤵
  PID:10292
- C:\Windows\System\raFcBLe.exe
  C:\Windows\System\raFcBLe.exe
  2⤵
  PID:10268
- C:\Windows\System\bLfIZZr.exe
  C:\Windows\System\bLfIZZr.exe
  2⤵
  PID:10472
- C:\Windows\System\zXzEwZL.exe
  C:\Windows\System\zXzEwZL.exe
  2⤵
  PID:10536
- C:\Windows\System\OyZgUpS.exe
  C:\Windows\System\OyZgUpS.exe
  2⤵
  PID:10456
- C:\Windows\System\nUyAcCf.exe
  C:\Windows\System\nUyAcCf.exe
  2⤵
  PID:10564
- C:\Windows\System\aHCgFSD.exe
  C:\Windows\System\aHCgFSD.exe
  2⤵
  PID:10600
- C:\Windows\System\RiOdNdf.exe
  C:\Windows\System\RiOdNdf.exe
  2⤵
  PID:10796
- C:\Windows\System\cHahxvd.exe
  C:\Windows\System\cHahxvd.exe
  2⤵
  PID:10852
- C:\Windows\System\pndQTAd.exe
  C:\Windows\System\pndQTAd.exe
  2⤵
  PID:10872
- C:\Windows\System\PJcGnXb.exe
  C:\Windows\System\PJcGnXb.exe
  2⤵
  PID:10968
- C:\Windows\System\RIWuLeg.exe
  C:\Windows\System\RIWuLeg.exe
  2⤵
  PID:10944
- C:\Windows\System\nSJDJEC.exe
  C:\Windows\System\nSJDJEC.exe
  2⤵
  PID:10892
- C:\Windows\System\cmbqCaM.exe
  C:\Windows\System\cmbqCaM.exe
  2⤵
  PID:10976
- C:\Windows\System\cXZsEQw.exe
  C:\Windows\System\cXZsEQw.exe
  2⤵
  PID:11144
- C:\Windows\System\CiMxiRb.exe
  C:\Windows\System\CiMxiRb.exe
  2⤵
  PID:10360
- C:\Windows\System\ewYoCSc.exe
  C:\Windows\System\ewYoCSc.exe
  2⤵
  PID:10468
- C:\Windows\System\PGUtPFn.exe
  C:\Windows\System\PGUtPFn.exe
  2⤵
  PID:11244
- C:\Windows\System\gZhBLgr.exe
  C:\Windows\System\gZhBLgr.exe
  2⤵
  PID:10276
- C:\Windows\System\YwNhqXe.exe
  C:\Windows\System\YwNhqXe.exe
  2⤵
  PID:10432
- C:\Windows\System\OPubogt.exe
  C:\Windows\System\OPubogt.exe
  2⤵
  PID:11004
- C:\Windows\System\WCwreyu.exe
  C:\Windows\System\WCwreyu.exe
  2⤵
  PID:11128
- C:\Windows\System\kTTSMbI.exe
  C:\Windows\System\kTTSMbI.exe
  2⤵
  PID:10052
- C:\Windows\System\izRWBgW.exe
  C:\Windows\System\izRWBgW.exe
  2⤵
  PID:11228
- C:\Windows\System\TQKeIQW.exe
  C:\Windows\System\TQKeIQW.exe
  2⤵
  PID:11276
- C:\Windows\System\HNBMgMG.exe
  C:\Windows\System\HNBMgMG.exe
  2⤵
  PID:11308
- C:\Windows\System\qCwWWdY.exe
  C:\Windows\System\qCwWWdY.exe
  2⤵
  PID:11340
- C:\Windows\System\PZFzujc.exe
  C:\Windows\System\PZFzujc.exe
  2⤵
  PID:11364
- C:\Windows\System\KwPlnZv.exe
  C:\Windows\System\KwPlnZv.exe
  2⤵
  PID:11392
- C:\Windows\System\ZGbsSHl.exe
  C:\Windows\System\ZGbsSHl.exe
  2⤵
  PID:11420
- C:\Windows\System\yBAfFko.exe
  C:\Windows\System\yBAfFko.exe
  2⤵
  PID:11452
- C:\Windows\System\NcyLeap.exe
  C:\Windows\System\NcyLeap.exe
  2⤵
  PID:11476
- C:\Windows\System\GMOsXeX.exe
  C:\Windows\System\GMOsXeX.exe
  2⤵
  PID:11504
- C:\Windows\System\LVekdcf.exe
  C:\Windows\System\LVekdcf.exe
  2⤵
  PID:11520
- C:\Windows\System\nGGBclb.exe
  C:\Windows\System\nGGBclb.exe
  2⤵
  PID:11548
- C:\Windows\System\xIaomvw.exe
  C:\Windows\System\xIaomvw.exe
  2⤵
  PID:11568
- C:\Windows\System\QCRWrRp.exe
  C:\Windows\System\QCRWrRp.exe
  2⤵
  PID:11592
- C:\Windows\System\AjqiRAu.exe
  C:\Windows\System\AjqiRAu.exe
  2⤵
  PID:11616
- C:\Windows\System\ImCHoEc.exe
  C:\Windows\System\ImCHoEc.exe
  2⤵
  PID:11640
- C:\Windows\System\zRdcsuP.exe
  C:\Windows\System\zRdcsuP.exe
  2⤵
  PID:11660
- C:\Windows\System\Bhrhcfs.exe
  C:\Windows\System\Bhrhcfs.exe
  2⤵
  PID:11692
- C:\Windows\System\XQbVIzW.exe
  C:\Windows\System\XQbVIzW.exe
  2⤵
  PID:11720
- C:\Windows\System\TwwCeWK.exe
  C:\Windows\System\TwwCeWK.exe
  2⤵
  PID:11748
- C:\Windows\System\vnjyawh.exe
  C:\Windows\System\vnjyawh.exe
  2⤵
  PID:11772
- C:\Windows\System\GwcjrXe.exe
  C:\Windows\System\GwcjrXe.exe
  2⤵
  PID:11796
- C:\Windows\System\UQgFvZm.exe
  C:\Windows\System\UQgFvZm.exe
  2⤵
  PID:11816
- C:\Windows\System\HROXBwb.exe
  C:\Windows\System\HROXBwb.exe
  2⤵
  PID:11840
- C:\Windows\System\UIVbTuB.exe
  C:\Windows\System\UIVbTuB.exe
  2⤵
  PID:11864
- C:\Windows\System\pGDnzQa.exe
  C:\Windows\System\pGDnzQa.exe
  2⤵
  PID:11892
- C:\Windows\System\LsVgHlp.exe
  C:\Windows\System\LsVgHlp.exe
  2⤵
  PID:11920
- C:\Windows\System\HutEHrS.exe
  C:\Windows\System\HutEHrS.exe
  2⤵
  PID:11952
- C:\Windows\System\aleehdJ.exe
  C:\Windows\System\aleehdJ.exe
  2⤵
  PID:11980
- C:\Windows\System\NPsTpIZ.exe
  C:\Windows\System\NPsTpIZ.exe
  2⤵
  PID:11996
- C:\Windows\System\NVZDXAS.exe
  C:\Windows\System\NVZDXAS.exe
  2⤵
  PID:12024
- C:\Windows\System\BtjSEdp.exe
  C:\Windows\System\BtjSEdp.exe
  2⤵
  PID:12052
- C:\Windows\System\yeVhXYz.exe
  C:\Windows\System\yeVhXYz.exe
  2⤵
  PID:12076
- C:\Windows\System\UalqQbW.exe
  C:\Windows\System\UalqQbW.exe
  2⤵
  PID:12104
- C:\Windows\System\lMjLhRS.exe
  C:\Windows\System\lMjLhRS.exe
  2⤵
  PID:12124
- C:\Windows\System\WrfINfS.exe
  C:\Windows\System\WrfINfS.exe
  2⤵
  PID:12152
- C:\Windows\System\ClZdKmy.exe
  C:\Windows\System\ClZdKmy.exe
  2⤵
  PID:12180
- C:\Windows\System\MStdjkz.exe
  C:\Windows\System\MStdjkz.exe
  2⤵
  PID:12208
- C:\Windows\System\WwwIeCd.exe
  C:\Windows\System\WwwIeCd.exe
  2⤵
  PID:12232
- C:\Windows\System\lWLOcfV.exe
  C:\Windows\System\lWLOcfV.exe
  2⤵
  PID:12264
- C:\Windows\System\BdibzOp.exe
  C:\Windows\System\BdibzOp.exe
  2⤵
  PID:8732
- C:\Windows\System\lnXLuur.exe
  C:\Windows\System\lnXLuur.exe
  2⤵
  PID:10568
- C:\Windows\System\nrGyTUx.exe
  C:\Windows\System\nrGyTUx.exe
  2⤵
  PID:10612
- C:\Windows\System\VvpUsQJ.exe
  C:\Windows\System\VvpUsQJ.exe
  2⤵
  PID:11360
- C:\Windows\System\yDEIFvv.exe
  C:\Windows\System\yDEIFvv.exe
  2⤵
  PID:11320
- C:\Windows\System\eRaygWv.exe
  C:\Windows\System\eRaygWv.exe
  2⤵
  PID:11472
- C:\Windows\System\jblEfjq.exe
  C:\Windows\System\jblEfjq.exe
  2⤵
  PID:11652
- C:\Windows\System\KemUaZf.exe
  C:\Windows\System\KemUaZf.exe
  2⤵
  PID:11532
- C:\Windows\System\QuupDNt.exe
  C:\Windows\System\QuupDNt.exe
  2⤵
  PID:11744
- C:\Windows\System\LXKbbAf.exe
  C:\Windows\System\LXKbbAf.exe
  2⤵
  PID:11636
- C:\Windows\System\atFpvLu.exe
  C:\Windows\System\atFpvLu.exe
  2⤵
  PID:11852
- C:\Windows\System\gXglAnu.exe
  C:\Windows\System\gXglAnu.exe
  2⤵
  PID:11876
- C:\Windows\System\wDYFqjQ.exe
  C:\Windows\System\wDYFqjQ.exe
  2⤵
  PID:11612
- C:\Windows\System\ZnwUVjG.exe
  C:\Windows\System\ZnwUVjG.exe
  2⤵
  PID:11936
- C:\Windows\System\PGGcadO.exe
  C:\Windows\System\PGGcadO.exe
  2⤵
  PID:12036
- C:\Windows\System\agXmwNB.exe
  C:\Windows\System\agXmwNB.exe
  2⤵
  PID:12148
- C:\Windows\System\OvXVHsr.exe
  C:\Windows\System\OvXVHsr.exe
  2⤵
  PID:11812
- C:\Windows\System\OMpOxrZ.exe
  C:\Windows\System\OMpOxrZ.exe
  2⤵
  PID:12220
- C:\Windows\System\nzaiDeI.exe
  C:\Windows\System\nzaiDeI.exe
  2⤵
  PID:11880
- C:\Windows\System\fvsqWVU.exe
  C:\Windows\System\fvsqWVU.exe
  2⤵
  PID:11296
- C:\Windows\System\eBJOomH.exe
  C:\Windows\System\eBJOomH.exe
  2⤵
  PID:12196
- C:\Windows\System\joBEkGq.exe
  C:\Windows\System\joBEkGq.exe
  2⤵
  PID:12260
- C:\Windows\System\tzPYeBY.exe
  C:\Windows\System\tzPYeBY.exe
  2⤵
  PID:11828
- C:\Windows\System\UHKqcoS.exe
  C:\Windows\System\UHKqcoS.exe
  2⤵
  PID:11080
- C:\Windows\System\mUSnUev.exe
  C:\Windows\System\mUSnUev.exe
  2⤵
  PID:11916
- C:\Windows\System\xxwzTBN.exe
  C:\Windows\System\xxwzTBN.exe
  2⤵
  PID:12188
- C:\Windows\System\BpuKzke.exe
  C:\Windows\System\BpuKzke.exe
  2⤵
  PID:12296
- C:\Windows\System\UPJsNdK.exe
  C:\Windows\System\UPJsNdK.exe
  2⤵
  PID:12316
- C:\Windows\System\coBRVUQ.exe
  C:\Windows\System\coBRVUQ.exe
  2⤵
  PID:12344
- C:\Windows\System\iqbvQCF.exe
  C:\Windows\System\iqbvQCF.exe
  2⤵
  PID:12368
- C:\Windows\System\EZejVVm.exe
  C:\Windows\System\EZejVVm.exe
  2⤵
  PID:12400
- C:\Windows\System\CugsTGn.exe
  C:\Windows\System\CugsTGn.exe
  2⤵
  PID:12428
- C:\Windows\System\lCJiWND.exe
  C:\Windows\System\lCJiWND.exe
  2⤵
  PID:12456
- C:\Windows\System\ppuTFlT.exe
  C:\Windows\System\ppuTFlT.exe
  2⤵
  PID:12480
- C:\Windows\System\awyeSbx.exe
  C:\Windows\System\awyeSbx.exe
  2⤵
  PID:12508
- C:\Windows\System\xbdAhRL.exe
  C:\Windows\System\xbdAhRL.exe
  2⤵
  PID:12544
- C:\Windows\System\jEDeTZE.exe
  C:\Windows\System\jEDeTZE.exe
  2⤵
  PID:12568
- C:\Windows\System\MpoJwzk.exe
  C:\Windows\System\MpoJwzk.exe
  2⤵
  PID:12596
- C:\Windows\System\gPDxyPQ.exe
  C:\Windows\System\gPDxyPQ.exe
  2⤵
  PID:12616
- C:\Windows\System\xdfKLgC.exe
  C:\Windows\System\xdfKLgC.exe
  2⤵
  PID:12644
- C:\Windows\System\LROforD.exe
  C:\Windows\System\LROforD.exe
  2⤵
  PID:12676
- C:\Windows\System\jkTwCYf.exe
  C:\Windows\System\jkTwCYf.exe
  2⤵
  PID:12696
- C:\Windows\System\YvMtZmx.exe
  C:\Windows\System\YvMtZmx.exe
  2⤵
  PID:12720
- C:\Windows\System\rXClZSJ.exe
  C:\Windows\System\rXClZSJ.exe
  2⤵
  PID:12744
- C:\Windows\System\Enbgjbs.exe
  C:\Windows\System\Enbgjbs.exe
  2⤵
  PID:12768
- C:\Windows\System\yDxUzcG.exe
  C:\Windows\System\yDxUzcG.exe
  2⤵
  PID:12792
- C:\Windows\System\WXjDfgZ.exe
  C:\Windows\System\WXjDfgZ.exe
  2⤵
  PID:12816
- C:\Windows\System\EJLFaMF.exe
  C:\Windows\System\EJLFaMF.exe
  2⤵
  PID:12840
- C:\Windows\System\qfTfTfE.exe
  C:\Windows\System\qfTfTfE.exe
  2⤵
  PID:12864
- C:\Windows\System\xvJFsHe.exe
  C:\Windows\System\xvJFsHe.exe
  2⤵
  PID:12892
- C:\Windows\System\pPhxDUa.exe
  C:\Windows\System\pPhxDUa.exe
  2⤵
  PID:12908
- C:\Windows\System\mjQfzgl.exe
  C:\Windows\System\mjQfzgl.exe
  2⤵
  PID:12940
- C:\Windows\System\nheUbMC.exe
  C:\Windows\System\nheUbMC.exe
  2⤵
  PID:12964
- C:\Windows\System\mTkjWbc.exe
  C:\Windows\System\mTkjWbc.exe
  2⤵
  PID:12996
- C:\Windows\System\FSRbddO.exe
  C:\Windows\System\FSRbddO.exe
  2⤵
  PID:13028
- C:\Windows\System\VOkqZAe.exe
  C:\Windows\System\VOkqZAe.exe
  2⤵
  PID:13052
- C:\Windows\System\OyAXrfa.exe
  C:\Windows\System\OyAXrfa.exe
  2⤵
  PID:13068
- C:\Windows\System\lxYpnde.exe
  C:\Windows\System\lxYpnde.exe
  2⤵
  PID:13100
- C:\Windows\System\LHYmKmA.exe
  C:\Windows\System\LHYmKmA.exe
  2⤵
  PID:13128
- C:\Windows\System\peemjHA.exe
  C:\Windows\System\peemjHA.exe
  2⤵
  PID:13148
- C:\Windows\System\YVHmnNN.exe
  C:\Windows\System\YVHmnNN.exe
  2⤵
  PID:13180
- C:\Windows\System\yGAaOgI.exe
  C:\Windows\System\yGAaOgI.exe
  2⤵
  PID:13204
- C:\Windows\System\kafEsID.exe
  C:\Windows\System\kafEsID.exe
  2⤵
  PID:13236
- C:\Windows\System\FGbwJJc.exe
  C:\Windows\System\FGbwJJc.exe
  2⤵
  PID:13256
- C:\Windows\System\gBoiOkD.exe
  C:\Windows\System\gBoiOkD.exe
  2⤵
  PID:13288
- C:\Windows\System\NSBouaS.exe
  C:\Windows\System\NSBouaS.exe
  2⤵
  PID:9280
- C:\Windows\System\PrRIXif.exe
  C:\Windows\System\PrRIXif.exe
  2⤵
  PID:11992
- C:\Windows\System\DgEtqlW.exe
  C:\Windows\System\DgEtqlW.exe
  2⤵
  PID:12176
- C:\Windows\System\bhtAfFw.exe
  C:\Windows\System\bhtAfFw.exe
  2⤵
  PID:10496
- C:\Windows\System\WVVYXFb.exe
  C:\Windows\System\WVVYXFb.exe
  2⤵
  PID:12304
- C:\Windows\System\tDLruYm.exe
  C:\Windows\System\tDLruYm.exe
  2⤵
  PID:12396
- C:\Windows\System\wDFyQfc.exe
  C:\Windows\System\wDFyQfc.exe
  2⤵
  PID:12452
- C:\Windows\System\YdUalDN.exe
  C:\Windows\System\YdUalDN.exe
  2⤵
  PID:12532
- C:\Windows\System\xUNANcO.exe
  C:\Windows\System\xUNANcO.exe
  2⤵
  PID:12588
- C:\Windows\System\jwHDhSq.exe
  C:\Windows\System\jwHDhSq.exe
  2⤵
  PID:12356
- C:\Windows\System\WIJords.exe
  C:\Windows\System\WIJords.exe
  2⤵
  PID:12420
- C:\Windows\System\asFrhAN.exe
  C:\Windows\System\asFrhAN.exe
  2⤵
  PID:12608
- C:\Windows\System\fbbcnrO.exe
  C:\Windows\System\fbbcnrO.exe
  2⤵
  PID:12672
- C:\Windows\System\QYLoNMd.exe
  C:\Windows\System\QYLoNMd.exe
  2⤵
  PID:12704
- C:\Windows\System\ujMGRGc.exe
  C:\Windows\System\ujMGRGc.exe
  2⤵
  PID:12524
- C:\Windows\System\ycgJucO.exe
  C:\Windows\System\ycgJucO.exe
  2⤵
  PID:12852
- C:\Windows\System\naEzsIY.exe
  C:\Windows\System\naEzsIY.exe
  2⤵
  PID:13200
- C:\Windows\System\AnhECwZ.exe
  C:\Windows\System\AnhECwZ.exe
  2⤵
  PID:13480
- C:\Windows\System\SMhnjUp.exe
  C:\Windows\System\SMhnjUp.exe
  2⤵
  PID:13500
- C:\Windows\System\igRJqda.exe
  C:\Windows\System\igRJqda.exe
  2⤵
  PID:13532
- C:\Windows\System\TAZPueK.exe
  C:\Windows\System\TAZPueK.exe
  2⤵
  PID:13552
- C:\Windows\System\qkNQnAq.exe
  C:\Windows\System\qkNQnAq.exe
  2⤵
  PID:13592
- C:\Windows\System\VdARPAa.exe
  C:\Windows\System\VdARPAa.exe
  2⤵
  PID:13616
- C:\Windows\System\Gwxvsho.exe
  C:\Windows\System\Gwxvsho.exe
  2⤵
  PID:13632
- C:\Windows\System\FTugmzW.exe
  C:\Windows\System\FTugmzW.exe
  2⤵
  PID:13648
- C:\Windows\System\HYFUNFW.exe
  C:\Windows\System\HYFUNFW.exe
  2⤵
  PID:13684
- C:\Windows\System\igyOeYj.exe
  C:\Windows\System\igyOeYj.exe
  2⤵
  PID:13704
- C:\Windows\System\DAdpkdh.exe
  C:\Windows\System\DAdpkdh.exe
  2⤵
  PID:13736
- C:\Windows\System\KtlVydl.exe
  C:\Windows\System\KtlVydl.exe
  2⤵
  PID:13756
- C:\Windows\System\WVFArPw.exe
  C:\Windows\System\WVFArPw.exe
  2⤵
  PID:13784
- C:\Windows\System\tJEDEcL.exe
  C:\Windows\System\tJEDEcL.exe
  2⤵
  PID:13812
- C:\Windows\System\ViyRnGh.exe
  C:\Windows\System\ViyRnGh.exe
  2⤵
  PID:13836
- C:\Windows\System\OUFoGrs.exe
  C:\Windows\System\OUFoGrs.exe
  2⤵
  PID:13860
- C:\Windows\System\kWzZVke.exe
  C:\Windows\System\kWzZVke.exe
  2⤵
  PID:13888
- C:\Windows\System\vfdfIPJ.exe
  C:\Windows\System\vfdfIPJ.exe
  2⤵
  PID:13916
- C:\Windows\System\HhjfAjG.exe
  C:\Windows\System\HhjfAjG.exe
  2⤵
  PID:13952
- C:\Windows\System\YsXScXd.exe
  C:\Windows\System\YsXScXd.exe
  2⤵
  PID:13980
- C:\Windows\System\rgqInWi.exe
  C:\Windows\System\rgqInWi.exe
  2⤵
  PID:14016
- C:\Windows\System\cvTofVW.exe
  C:\Windows\System\cvTofVW.exe
  2⤵
  PID:14044
- C:\Windows\System\GMsqSmx.exe
  C:\Windows\System\GMsqSmx.exe
  2⤵
  PID:14064
- C:\Windows\System\IMyGsAy.exe
  C:\Windows\System\IMyGsAy.exe
  2⤵
  PID:14092
- C:\Windows\System\KxKtzvy.exe
  C:\Windows\System\KxKtzvy.exe
  2⤵
  PID:14116
- C:\Windows\System\qOWYvGb.exe
  C:\Windows\System\qOWYvGb.exe
  2⤵
  PID:14140
- C:\Windows\System\yVKVkmw.exe
  C:\Windows\System\yVKVkmw.exe
  2⤵
  PID:14172
- C:\Windows\System\CdOpILq.exe
  C:\Windows\System\CdOpILq.exe
  2⤵
  PID:14196
- C:\Windows\System\OzgJymQ.exe
  C:\Windows\System\OzgJymQ.exe
  2⤵
  PID:14224
- C:\Windows\System\LiAnixA.exe
  C:\Windows\System\LiAnixA.exe
  2⤵
  PID:14248
- C:\Windows\System\oCKzFTP.exe
  C:\Windows\System\oCKzFTP.exe
  2⤵
  PID:14268
- C:\Windows\System\AZecJZT.exe
  C:\Windows\System\AZecJZT.exe
  2⤵
  PID:14292
- C:\Windows\System\rRerQhv.exe
  C:\Windows\System\rRerQhv.exe
  2⤵
  PID:14320
- C:\Windows\System\lwFiZkI.exe
  C:\Windows\System\lwFiZkI.exe
  2⤵
  PID:12976
- C:\Windows\System\yXlgaTV.exe
  C:\Windows\System\yXlgaTV.exe
  2⤵
  PID:13356
- C:\Windows\System\jXoPygt.exe
  C:\Windows\System\jXoPygt.exe
  2⤵
  PID:13380
- C:\Windows\System\ExtKoaL.exe
  C:\Windows\System\ExtKoaL.exe
  2⤵
  PID:13412
- C:\Windows\System\EpAwWqg.exe
  C:\Windows\System\EpAwWqg.exe
  2⤵
  PID:13436
- C:\Windows\System\bmHztkA.exe
  C:\Windows\System\bmHztkA.exe
  2⤵
  PID:13476
- C:\Windows\System\MWBPayD.exe
  C:\Windows\System\MWBPayD.exe
  2⤵
  PID:13548
- C:\Windows\System\pWwHEYF.exe
  C:\Windows\System\pWwHEYF.exe
  2⤵
  PID:13520
- C:\Windows\System\ZFixDcY.exe
  C:\Windows\System\ZFixDcY.exe
  2⤵
  PID:13516
- C:\Windows\System\kSLOUYF.exe
  C:\Windows\System\kSLOUYF.exe
  2⤵
  PID:13544
- C:\Windows\System\YioRcps.exe
  C:\Windows\System\YioRcps.exe
  2⤵
  PID:13692
- C:\Windows\System\ZNxTrZy.exe
  C:\Windows\System\ZNxTrZy.exe
  2⤵
  PID:13780
- C:\Windows\System\mkmRvql.exe
  C:\Windows\System\mkmRvql.exe
  2⤵
  PID:13668
- C:\Windows\System\iHXSXjY.exe
  C:\Windows\System\iHXSXjY.exe
  2⤵
  PID:13852
- C:\Windows\System\ztatRvt.exe
  C:\Windows\System\ztatRvt.exe
  2⤵
  PID:13820
- C:\Windows\System\YrwYpdM.exe
  C:\Windows\System\YrwYpdM.exe
  2⤵
  PID:13904
- C:\Windows\System\FEEfike.exe
  C:\Windows\System\FEEfike.exe
  2⤵
  PID:14028
- C:\Windows\System\aNZysjq.exe
  C:\Windows\System\aNZysjq.exe
  2⤵
  PID:14052
- C:\Windows\System\KHRWnhG.exe
  C:\Windows\System\KHRWnhG.exe
  2⤵
  PID:14104
- C:\Windows\System\UhxslhY.exe
  C:\Windows\System\UhxslhY.exe
  2⤵
  PID:14188
- C:\Windows\System\gdiHZhj.exe
  C:\Windows\System\gdiHZhj.exe
  2⤵
  PID:14240
- C:\Windows\System\fYmrsvx.exe
  C:\Windows\System\fYmrsvx.exe
  2⤵
  PID:14328
- C:\Windows\System\BIETXkP.exe
  C:\Windows\System\BIETXkP.exe
  2⤵
  PID:13372
- C:\Windows\System\gFZyxsR.exe
  C:\Windows\System\gFZyxsR.exe
  2⤵
  PID:13428
- C:\Windows\System\ANrIMNd.exe
  C:\Windows\System\ANrIMNd.exe
  2⤵
  PID:13612
- C:\Windows\System\NuiLQlL.exe
  C:\Windows\System\NuiLQlL.exe
  2⤵
  PID:13364
- C:\Windows\System\BjDaAdV.exe
  C:\Windows\System\BjDaAdV.exe
  2⤵
  PID:13964
- C:\Windows\System\wYYKNvK.exe
  C:\Windows\System\wYYKNvK.exe
  2⤵
  PID:13624
- C:\Windows\System\ADsEuGT.exe
  C:\Windows\System\ADsEuGT.exe
  2⤵
  PID:14220
- C:\Windows\System\DFhaXyA.exe
  C:\Windows\System\DFhaXyA.exe
  2⤵
  PID:13932
- C:\Windows\System\DVaiMUM.exe
  C:\Windows\System\DVaiMUM.exe
  2⤵
  PID:13344
- C:\Windows\System\kLwXiss.exe
  C:\Windows\System\kLwXiss.exe
  2⤵
  PID:14360
- C:\Windows\System\xliUesh.exe
  C:\Windows\System\xliUesh.exe
  2⤵
  PID:14380
- C:\Windows\System\zErTpEV.exe
  C:\Windows\System\zErTpEV.exe
  2⤵
  PID:14408
- C:\Windows\System\AQChCMd.exe
  C:\Windows\System\AQChCMd.exe
  2⤵
  PID:14428
- C:\Windows\System\mQWWAfG.exe
  C:\Windows\System\mQWWAfG.exe
  2⤵
  PID:14456
- C:\Windows\System\VdSHrsO.exe
  C:\Windows\System\VdSHrsO.exe
  2⤵
  PID:14476
- C:\Windows\System\DkJJvzX.exe
  C:\Windows\System\DkJJvzX.exe
  2⤵
  PID:14512
- C:\Windows\System\nfsjRkb.exe
  C:\Windows\System\nfsjRkb.exe
  2⤵
  PID:14540
- C:\Windows\System\FeUegYV.exe
  C:\Windows\System\FeUegYV.exe
  2⤵
  PID:14568
- C:\Windows\System\EVNJyof.exe
  C:\Windows\System\EVNJyof.exe
  2⤵
  PID:14608
- C:\Windows\System\tmzMjpA.exe
  C:\Windows\System\tmzMjpA.exe
  2⤵
  PID:14624
- C:\Windows\System\KLLvrNt.exe
  C:\Windows\System\KLLvrNt.exe
  2⤵
  PID:14656
- C:\Windows\System\uzPpqEU.exe
  C:\Windows\System\uzPpqEU.exe
  2⤵
  PID:14676
- C:\Windows\System\RavaCJb.exe
  C:\Windows\System\RavaCJb.exe
  2⤵
  PID:14708
- C:\Windows\System\pnQRLod.exe
  C:\Windows\System\pnQRLod.exe
  2⤵
  PID:14736
- C:\Windows\System\NxPrXFG.exe
  C:\Windows\System\NxPrXFG.exe
  2⤵
  PID:14760
- C:\Windows\System\XoRwiSX.exe
  C:\Windows\System\XoRwiSX.exe
  2⤵
  PID:14792
- C:\Windows\System\pfynhHn.exe
  C:\Windows\System\pfynhHn.exe
  2⤵
  PID:14820
- C:\Windows\System\dXGqGVp.exe
  C:\Windows\System\dXGqGVp.exe
  2⤵
  PID:14852
- C:\Windows\System\wDzeuIS.exe
  C:\Windows\System\wDzeuIS.exe
  2⤵
  PID:14884
- C:\Windows\System\onttYpu.exe
  C:\Windows\System\onttYpu.exe
  2⤵
  PID:14908
- C:\Windows\System\NSqomMr.exe
  C:\Windows\System\NSqomMr.exe
  2⤵
  PID:14936
- C:\Windows\System\qTvemjO.exe
  C:\Windows\System\qTvemjO.exe
  2⤵
  PID:14956
- C:\Windows\System\PrYHyMn.exe
  C:\Windows\System\PrYHyMn.exe
  2⤵
  PID:14976
- C:\Windows\System\fWZKBBr.exe
  C:\Windows\System\fWZKBBr.exe
  2⤵
  PID:15004
- C:\Windows\System\OoqczNQ.exe
  C:\Windows\System\OoqczNQ.exe
  2⤵
  PID:15032
- C:\Windows\System\zosgxEM.exe
  C:\Windows\System\zosgxEM.exe
  2⤵
  PID:15052
- C:\Windows\System\OTZfbsw.exe
  C:\Windows\System\OTZfbsw.exe
  2⤵
  PID:15084
- C:\Windows\System\NSpJuJF.exe
  C:\Windows\System\NSpJuJF.exe
  2⤵
  PID:15100
- C:\Windows\System\BxnLDRp.exe
  C:\Windows\System\BxnLDRp.exe
  2⤵
  PID:15128
- C:\Windows\System\KoiURTE.exe
  C:\Windows\System\KoiURTE.exe
  2⤵
  PID:15160
- C:\Windows\System\wNSnTrG.exe
  C:\Windows\System\wNSnTrG.exe
  2⤵
  PID:15188
- C:\Windows\System\quoqkgm.exe
  C:\Windows\System\quoqkgm.exe
  2⤵
  PID:15208
- C:\Windows\System\kpcOuhN.exe
  C:\Windows\System\kpcOuhN.exe
  2⤵
  PID:15232
- C:\Windows\System\KeXLElW.exe
  C:\Windows\System\KeXLElW.exe
  2⤵
  PID:15256
- C:\Windows\System\ojOkbnu.exe
  C:\Windows\System\ojOkbnu.exe
  2⤵
  PID:15280
- C:\Windows\System\ctIPzSJ.exe
  C:\Windows\System\ctIPzSJ.exe
  2⤵
  PID:15316
- C:\Windows\System\kZfhcQf.exe
  C:\Windows\System\kZfhcQf.exe
  2⤵
  PID:15336
- C:\Windows\System\HKbjYGV.exe
  C:\Windows\System\HKbjYGV.exe
  2⤵
  PID:15352
- C:\Windows\System\iZOIZnt.exe
  C:\Windows\System\iZOIZnt.exe
  2⤵
  PID:14316
- C:\Windows\System\ohgoZjF.exe
  C:\Windows\System\ohgoZjF.exe
  2⤵
  PID:14396
- C:\Windows\System\NnvIaPs.exe
  C:\Windows\System\NnvIaPs.exe
  2⤵
  PID:14448
- C:\Windows\System\uMvUZme.exe
  C:\Windows\System\uMvUZme.exe
  2⤵
  PID:14352
- C:\Windows\System\OWmQEsY.exe
  C:\Windows\System\OWmQEsY.exe
  2⤵
  PID:14376
- C:\Windows\System\YxmderG.exe
  C:\Windows\System\YxmderG.exe
  2⤵
  PID:13896
- C:\Windows\System\mPdhtTS.exe
  C:\Windows\System\mPdhtTS.exe
  2⤵
  PID:14420
- C:\Windows\System\wCsOpYk.exe
  C:\Windows\System\wCsOpYk.exe
  2⤵
  PID:14620
- C:\Windows\System\YfhwlXG.exe
  C:\Windows\System\YfhwlXG.exe
  2⤵
  PID:14488
- C:\Windows\System\YzhfZKs.exe
  C:\Windows\System\YzhfZKs.exe
  2⤵
  PID:14840
- C:\Windows\System\cQeNkUx.exe
  C:\Windows\System\cQeNkUx.exe
  2⤵
  PID:14896
- C:\Windows\System\UfAbJAK.exe
  C:\Windows\System\UfAbJAK.exe
  2⤵
  PID:14968
- C:\Windows\System\uGiiOzZ.exe
  C:\Windows\System\uGiiOzZ.exe
  2⤵
  PID:14588
- C:\Windows\System\qplgcFm.exe
  C:\Windows\System\qplgcFm.exe
  2⤵
  PID:14828
- C:\Windows\System\OZrLDji.exe
  C:\Windows\System\OZrLDji.exe
  2⤵
  PID:14688
- C:\Windows\System\LfGNVZE.exe
  C:\Windows\System\LfGNVZE.exe
  2⤵
  PID:15120
- C:\Windows\System\KhxBZEg.exe
  C:\Windows\System\KhxBZEg.exe
  2⤵
  PID:14756
- C:\Windows\System\ujgdnfD.exe
  C:\Windows\System\ujgdnfD.exe
  2⤵
  PID:14812
- C:\Windows\System\SxjpvuK.exe
  C:\Windows\System\SxjpvuK.exe
  2⤵
  PID:15328
- C:\Windows\System\vWpOPBf.exe
  C:\Windows\System\vWpOPBf.exe
  2⤵
  PID:15156
- C:\Windows\System\ATRwqgX.exe
  C:\Windows\System\ATRwqgX.exe
  2⤵
  PID:15204
- C:\Windows\System\NlsktBn.exe
  C:\Windows\System\NlsktBn.exe
  2⤵
  PID:14532
- C:\Windows\System\xJPmjKs.exe
  C:\Windows\System\xJPmjKs.exe
  2⤵
  PID:13992
- C:\Windows\System\DpsLHmd.exe
  C:\Windows\System\DpsLHmd.exe
  2⤵
  PID:14636
- C:\Windows\System\RacXDMJ.exe
  C:\Windows\System\RacXDMJ.exe
  2⤵
  PID:15380
- C:\Windows\System\FrNxVWr.exe
  C:\Windows\System\FrNxVWr.exe
  2⤵
  PID:15396
- C:\Windows\System\UupPkek.exe
  C:\Windows\System\UupPkek.exe
  2⤵
  PID:15416
- C:\Windows\System\fyZDLKu.exe
  C:\Windows\System\fyZDLKu.exe
  2⤵
  PID:15444
- C:\Windows\System\FbYBQzQ.exe
  C:\Windows\System\FbYBQzQ.exe
  2⤵
  PID:15468
- C:\Windows\System\TxKnNlT.exe
  C:\Windows\System\TxKnNlT.exe
  2⤵
  PID:15496
- C:\Windows\System\zyPzCAw.exe
  C:\Windows\System\zyPzCAw.exe
  2⤵
  PID:15528
- C:\Windows\System\MryLwmu.exe
  C:\Windows\System\MryLwmu.exe
  2⤵
  PID:15556
- C:\Windows\System\EkEJUYG.exe
  C:\Windows\System\EkEJUYG.exe
  2⤵
  PID:15580
- C:\Windows\System\gRJiKZf.exe
  C:\Windows\System\gRJiKZf.exe
  2⤵
  PID:15604
- C:\Windows\System\CJsZPme.exe
  C:\Windows\System\CJsZPme.exe
  2⤵
  PID:15620
- C:\Windows\System\ENQJaBn.exe
  C:\Windows\System\ENQJaBn.exe
  2⤵
  PID:15652
- C:\Windows\System\qUfeeXI.exe
  C:\Windows\System\qUfeeXI.exe
  2⤵
  PID:15668
- C:\Windows\System\gLYYZBV.exe
  C:\Windows\System\gLYYZBV.exe
  2⤵
  PID:15692
- C:\Windows\System\IcBuoay.exe
  C:\Windows\System\IcBuoay.exe
  2⤵
  PID:15728
- C:\Windows\System\GXbBZIR.exe
  C:\Windows\System\GXbBZIR.exe
  2⤵
  PID:15748
- C:\Windows\System\WrQChHZ.exe
  C:\Windows\System\WrQChHZ.exe
  2⤵
  PID:15772
- C:\Windows\System\dNkdtim.exe
  C:\Windows\System\dNkdtim.exe
  2⤵
  PID:15792
- C:\Windows\System\ICoIkIU.exe
  C:\Windows\System\ICoIkIU.exe
  2⤵
  PID:15816
- C:\Windows\System\CAFgzCV.exe
  C:\Windows\System\CAFgzCV.exe
  2⤵
  PID:15840
- C:\Windows\System\AJRoyby.exe
  C:\Windows\System\AJRoyby.exe
  2⤵
  PID:15868
- C:\Windows\System\TLrcVvz.exe
  C:\Windows\System\TLrcVvz.exe
  2⤵
  PID:15884
- C:\Windows\System\AGxbOwx.exe
  C:\Windows\System\AGxbOwx.exe
  2⤵
  PID:15908
- C:\Windows\System\WdbeJdv.exe
  C:\Windows\System\WdbeJdv.exe
  2⤵
  PID:15928
- C:\Windows\System\IGJGwEh.exe
  C:\Windows\System\IGJGwEh.exe
  2⤵
  PID:15960
- C:\Windows\System\obZvMBG.exe
  C:\Windows\System\obZvMBG.exe
  2⤵
  PID:15984
- C:\Windows\System\jnoFplE.exe
  C:\Windows\System\jnoFplE.exe
  2⤵
  PID:16004
- C:\Windows\System\atFqqmi.exe
  C:\Windows\System\atFqqmi.exe
  2⤵
  PID:16036
- C:\Windows\System\qoRtYKu.exe
  C:\Windows\System\qoRtYKu.exe
  2⤵
  PID:16060
- C:\Windows\System\xKIjiiL.exe
  C:\Windows\System\xKIjiiL.exe
  2⤵
  PID:16076
- C:\Windows\System\cquZQRK.exe
  C:\Windows\System\cquZQRK.exe
  2⤵
  PID:16100
- C:\Windows\System\NqLyEpV.exe
  C:\Windows\System\NqLyEpV.exe
  2⤵
  PID:16120
- C:\Windows\System\nThEIpp.exe
  C:\Windows\System\nThEIpp.exe
  2⤵
  PID:16144
- C:\Windows\System\VYHhBwc.exe
  C:\Windows\System\VYHhBwc.exe
  2⤵
  PID:16176
- C:\Windows\System\MmPnZfW.exe
  C:\Windows\System\MmPnZfW.exe
  2⤵
  PID:16200
- C:\Windows\System\dyJBGDH.exe
  C:\Windows\System\dyJBGDH.exe
  2⤵
  PID:16220
- C:\Windows\System\xeVyefy.exe
  C:\Windows\System\xeVyefy.exe
  2⤵
  PID:16256
- C:\Windows\System\LnhXWqs.exe
  C:\Windows\System\LnhXWqs.exe
  2⤵
  PID:16284
- C:\Windows\System\PrJJmVX.exe
  C:\Windows\System\PrJJmVX.exe
  2⤵
  PID:16308
- C:\Windows\System\kpBHiKJ.exe
  C:\Windows\System\kpBHiKJ.exe
  2⤵
  PID:16328
- C:\Windows\System\RFKzVTF.exe
  C:\Windows\System\RFKzVTF.exe
  2⤵
  PID:16352
- C:\Windows\System\ijtFvhV.exe
  C:\Windows\System\ijtFvhV.exe
  2⤵
  PID:14344
- C:\Windows\System\VOhseUj.exe
  C:\Windows\System\VOhseUj.exe
  2⤵
  PID:15152
- C:\Windows\System\nkyRObM.exe
  C:\Windows\System\nkyRObM.exe
  2⤵
  PID:15196
- C:\Windows\System\JtwXGhy.exe
  C:\Windows\System\JtwXGhy.exe
  2⤵
  PID:12416
- C:\Windows\System\xcHJgjf.exe
  C:\Windows\System\xcHJgjf.exe
  2⤵
  PID:13728
- C:\Windows\System\EIWbTYB.exe
  C:\Windows\System\EIWbTYB.exe
  2⤵
  PID:15372
- C:\Windows\System\PYFjezg.exe
  C:\Windows\System\PYFjezg.exe
  2⤵
  PID:14920
- C:\Windows\System\SuUxAqz.exe
  C:\Windows\System\SuUxAqz.exe
  2⤵
  PID:14952
- C:\Windows\System\FyWgbFD.exe
  C:\Windows\System\FyWgbFD.exe
  2⤵
  PID:15240
- C:\Windows\System\WvEsATH.exe
  C:\Windows\System\WvEsATH.exe
  2⤵
  PID:15632
- C:\Windows\System\zaeqnhW.exe
  C:\Windows\System\zaeqnhW.exe
  2⤵
  PID:14604
- C:\Windows\System\mwMRffr.exe
  C:\Windows\System\mwMRffr.exe
  2⤵
  PID:15432
- C:\Windows\System\GipfPxW.exe
  C:\Windows\System\GipfPxW.exe
  2⤵
  PID:15492
- C:\Windows\System\nKnxoIv.exe
  C:\Windows\System\nKnxoIv.exe
  2⤵
  PID:15564
- C:\Windows\System\qRvUpQi.exe
  C:\Windows\System\qRvUpQi.exe
  2⤵
  PID:14524
- C:\Windows\System\afqWUXb.exe
  C:\Windows\System\afqWUXb.exe
  2⤵
  PID:15948
- C:\Windows\System\TkJtbsY.exe
  C:\Windows\System\TkJtbsY.exe
  2⤵
  PID:15784
- C:\Windows\System\EBLCwtJ.exe
  C:\Windows\System\EBLCwtJ.exe
  2⤵
  PID:15572
- C:\Windows\System\rgUTmsr.exe
  C:\Windows\System\rgUTmsr.exe
  2⤵
  PID:15596
- C:\Windows\System\qSLjiaB.exe
  C:\Windows\System\qSLjiaB.exe
  2⤵
  PID:15876
- C:\Windows\System\VoEXRyW.exe
  C:\Windows\System\VoEXRyW.exe
  2⤵
  PID:16244
- C:\Windows\System\nYZpMla.exe
  C:\Windows\System\nYZpMla.exe
  2⤵
  PID:16348
- C:\Windows\System\fFQpQHZ.exe
  C:\Windows\System\fFQpQHZ.exe
  2⤵
  PID:16068
- C:\Windows\System\dxlQbTv.exe
  C:\Windows\System\dxlQbTv.exe
  2⤵
  PID:16388
- C:\Windows\System\iCTxqBR.exe
  C:\Windows\System\iCTxqBR.exe
  2⤵
  PID:16412
- C:\Windows\System\UqZqcVa.exe
  C:\Windows\System\UqZqcVa.exe
  2⤵
  PID:16428
- C:\Windows\System\hWGKysc.exe
  C:\Windows\System\hWGKysc.exe
  2⤵
  PID:16456
- C:\Windows\System\imMtxRp.exe
  C:\Windows\System\imMtxRp.exe
  2⤵
  PID:16480
- C:\Windows\System\TkpKvnx.exe
  C:\Windows\System\TkpKvnx.exe
  2⤵
  PID:16508
- C:\Windows\System\TFPGunT.exe
  C:\Windows\System\TFPGunT.exe
  2⤵
  PID:16528
- C:\Windows\System\UTwmLqM.exe
  C:\Windows\System\UTwmLqM.exe
  2⤵
  PID:16552
- C:\Windows\System\aXvhYoa.exe
  C:\Windows\System\aXvhYoa.exe
  2⤵
  PID:16580
- C:\Windows\System\SrXCqjM.exe
  C:\Windows\System\SrXCqjM.exe
  2⤵
  PID:16612
- C:\Windows\System\YRpJvNF.exe
  C:\Windows\System\YRpJvNF.exe
  2⤵
  PID:16632
- C:\Windows\System\WClxSho.exe
  C:\Windows\System\WClxSho.exe
  2⤵
  PID:16652
- C:\Windows\System\GRomHia.exe
  C:\Windows\System\GRomHia.exe
  2⤵
  PID:16672
- C:\Windows\System\McghgOq.exe
  C:\Windows\System\McghgOq.exe
  2⤵
  PID:16704
- C:\Windows\System\BoCCaex.exe
  C:\Windows\System\BoCCaex.exe
  2⤵
  PID:16720
- C:\Windows\System\qrXXJCs.exe
  C:\Windows\System\qrXXJCs.exe
  2⤵
  PID:16748
- C:\Windows\System\KvpDPtt.exe
  C:\Windows\System\KvpDPtt.exe
  2⤵
  PID:16780
- C:\Windows\System\geUdDwB.exe
  C:\Windows\System\geUdDwB.exe
  2⤵
  PID:16800
- C:\Windows\System\CBXdRnk.exe
  C:\Windows\System\CBXdRnk.exe
  2⤵
  PID:16816
- C:\Windows\System\YqnRZHm.exe
  C:\Windows\System\YqnRZHm.exe
  2⤵
  PID:16848
- C:\Windows\System\YzwasvK.exe
  C:\Windows\System\YzwasvK.exe
  2⤵
  PID:16868
- C:\Windows\System\kqtaqli.exe
  C:\Windows\System\kqtaqli.exe
  2⤵
  PID:16908
- C:\Windows\System\KljhiHs.exe
  C:\Windows\System\KljhiHs.exe
  2⤵
  PID:16924
- C:\Windows\System\tvRjZFG.exe
  C:\Windows\System\tvRjZFG.exe
  2⤵
  PID:16940
- C:\Windows\System\PQxYPnU.exe
  C:\Windows\System\PQxYPnU.exe
  2⤵
  PID:16956
- C:\Windows\System\acKpNHp.exe
  C:\Windows\System\acKpNHp.exe
  2⤵
  PID:16976
- C:\Windows\System\jwjbObT.exe
  C:\Windows\System\jwjbObT.exe
  2⤵
  PID:17004
- C:\Windows\System\nTpnbAx.exe
  C:\Windows\System\nTpnbAx.exe
  2⤵
  PID:17036
- C:\Windows\System\HheEsOT.exe
  C:\Windows\System\HheEsOT.exe
  2⤵
  PID:17060
- C:\Windows\System\gnjsCwW.exe
  C:\Windows\System\gnjsCwW.exe
  2⤵
  PID:17088
- C:\Windows\System\REAOBoc.exe
  C:\Windows\System\REAOBoc.exe
  2⤵
  PID:17112
- C:\Windows\System\zEiswhl.exe
  C:\Windows\System\zEiswhl.exe
  2⤵
  PID:17136
- C:\Windows\System\gHjXyWK.exe
  C:\Windows\System\gHjXyWK.exe
  2⤵
  PID:17168
- C:\Windows\System\zJIBdOm.exe
  C:\Windows\System\zJIBdOm.exe
  2⤵
  PID:17184
- C:\Windows\System\zmXQVEB.exe
  C:\Windows\System\zmXQVEB.exe
  2⤵
  PID:17200
- C:\Windows\System\qtBtJhB.exe
  C:\Windows\System\qtBtJhB.exe
  2⤵
  PID:17232
- C:\Windows\System\ChJgIxR.exe
  C:\Windows\System\ChJgIxR.exe
  2⤵
  PID:17256
- C:\Windows\System\LzmeqOR.exe
  C:\Windows\System\LzmeqOR.exe
  2⤵
  PID:17272
- C:\Windows\System\IXzPbGg.exe
  C:\Windows\System\IXzPbGg.exe
  2⤵
  PID:17296
- C:\Windows\System\JoQYCnh.exe
  C:\Windows\System\JoQYCnh.exe
  2⤵
  PID:17328
- C:\Windows\System\TPRMAPN.exe
  C:\Windows\System\TPRMAPN.exe
  2⤵
  PID:17348
- C:\Windows\System\donnAAb.exe
  C:\Windows\System\donnAAb.exe
  2⤵
  PID:17380
- C:\Windows\System\SbkNZyx.exe
  C:\Windows\System\SbkNZyx.exe
  2⤵
  PID:15460
- C:\Windows\System\NKkMABj.exe
  C:\Windows\System\NKkMABj.exe
  2⤵
  PID:16336
- C:\Windows\System\bcnbqzo.exe
  C:\Windows\System\bcnbqzo.exe
  2⤵
  PID:16024
- C:\Windows\System\cYagjkC.exe
  C:\Windows\System\cYagjkC.exe
  2⤵
  PID:2012
- C:\Windows\System\QHjsJwx.exe
  C:\Windows\System\QHjsJwx.exe
  2⤵
  PID:16232
- C:\Windows\System\RNMkRTW.exe
  C:\Windows\System\RNMkRTW.exe
  2⤵
  PID:16136
- C:\Windows\System\DvSKESu.exe
  C:\Windows\System\DvSKESu.exe
  2⤵
  PID:3764
- C:\Windows\System\KxpVoCJ.exe
  C:\Windows\System\KxpVoCJ.exe
  2⤵
  PID:16164
- C:\Windows\System\UuAfiON.exe
  C:\Windows\System\UuAfiON.exe
  2⤵
  PID:16196
- C:\Windows\System\JfzwcOs.exe
  C:\Windows\System\JfzwcOs.exe
  2⤵
  PID:16468
- C:\Windows\System\muguqAf.exe
  C:\Windows\System\muguqAf.exe
  2⤵
  PID:15664
- C:\Windows\System\ZRfxCZn.exe
  C:\Windows\System\ZRfxCZn.exe
  2⤵
  PID:16272
- C:\Windows\System\hhfieBI.exe
  C:\Windows\System\hhfieBI.exe
  2⤵
  PID:15828
- C:\Windows\System\ufxnetb.exe
  C:\Windows\System\ufxnetb.exe
  2⤵
  PID:16664
- C:\Windows\System\YMBpdCC.exe
  C:\Windows\System\YMBpdCC.exe
  2⤵
  PID:16828
- C:\Windows\System\BVfUden.exe
  C:\Windows\System\BVfUden.exe
  2⤵
  PID:17372
- C:\Windows\System\LjnkVav.exe
  C:\Windows\System\LjnkVav.exe
  2⤵
  PID:15920
- C:\Windows\System\XdzTfHq.exe
  C:\Windows\System\XdzTfHq.exe
  2⤵
  PID:16112
- C:\Windows\System\FmXbbSC.exe
  C:\Windows\System\FmXbbSC.exe
  2⤵
  PID:16504
- C:\Windows\System\KyXsgsV.exe
  C:\Windows\System\KyXsgsV.exe
  2⤵
  PID:16368
- C:\Windows\System\TVMDKTe.exe
  C:\Windows\System\TVMDKTe.exe
  2⤵
  PID:16564
- C:\Windows\System\qFSzown.exe
  C:\Windows\System\qFSzown.exe
  2⤵
  PID:17016
- C:\Windows\System\KArOlTH.exe
  C:\Windows\System\KArOlTH.exe
  2⤵
  PID:17076
- C:\Windows\System\egZPaBw.exe
  C:\Windows\System\egZPaBw.exe
  2⤵
  PID:15716
- C:\Windows\System\IDmKjbh.exe
  C:\Windows\System\IDmKjbh.exe
  2⤵
  PID:15028
- C:\Windows\System\XHelLZy.exe
  C:\Windows\System\XHelLZy.exe
  2⤵
  PID:17252
- C:\Windows\System\KMGDlOb.exe
  C:\Windows\System\KMGDlOb.exe
  2⤵
  PID:16964
- C:\Windows\System\pYiqyZg.exe
  C:\Windows\System\pYiqyZg.exe
  2⤵
  PID:17244
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17244 -s 248
    3⤵
    PID:17396
- C:\Windows\System\iFaFykc.exe
  C:\Windows\System\iFaFykc.exe
  2⤵
  PID:17292

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AapebtJ.exe

Filesize
1.5MB

MD5
bebc2d6b8bab7af8e70a548745f0f3b2

SHA1
3a040088577e25178c7473730143f0485b21e613

SHA256
55a7758938c40faa344c2ebe27b01dd76704f46eb0090b7477961a6e7a1c898d

SHA512
9870ae64a19494be67f19618406ad23bec2c90ac2c3b951efca5c1985f83da04b272cc8d9fd0feac2762ddb5621e601b5b5b77782121636db9630941d72ce91c

Download Submit
C:\Windows\System\AyIpcGa.exe

Filesize
1.5MB

MD5
56468d4eadc887dc401d9fc8359aed3e

SHA1
0e9f7e20b8b45e58251dbcdfb70551a09411c778

SHA256
73f01476e445d39bc7d7ced2ca7506cca638095f74f20075502aee7957791658

SHA512
5613f8f0c69ecce56c79e36293a5b2c196dd6f74995cbf7da4266e246ca978c7a1d8f51b9ca1ce191d74488b4b6229421c59a2471d4ecb4c3bb153b3520e5df5

Download Submit
C:\Windows\System\BjENAKg.exe

Filesize
1.5MB

MD5
d90688016976fd778920a485b4b2008a

SHA1
210b9b806061e3ad2f0cd462708e0d1d7a186963

SHA256
726cc928964d82938453036cedfc9de68e0221307e9a8f4fb99dfc49d95b8ef3

SHA512
0654425624aae44d588128e05680068d4ffabfe3e54370fac40e73321083956d316a3b6e7eab09c1320f8e651b88a6082b17d0aed0ff11de9b254a3f10a554b4

Download Submit
C:\Windows\System\BvjzRap.exe

Filesize
1.5MB

MD5
d030cf2311d1c38af02cfb9338853f11

SHA1
40bf0d0dd52a279bee017c25747753db8d1bfe47

SHA256
369b59d2d13bfc591b6f94215eeea18e7cb005e0125458369f3248cdc789f21c

SHA512
a29de7dee814b1c924a7136f6f2542dc3a2bfae2e5abad689290f81bcdedfd16401a9790109fe89f417196fe6d645e32a4d057096220e4660d168a73ca6bef0a

Download Submit
C:\Windows\System\BygolrM.exe

Filesize
1.5MB

MD5
f624294936e799b2003529ed151d32d8

SHA1
b611760560b7c76055f30b2918eab7546128728a

SHA256
b6e2e3b667dc90ddf77fdef5b4c3d9727044126be559544278b480c302336a61

SHA512
8cc2257308123f9833f4aa0e98dde6958ac8c7d302bbe5e5fec7e8910b58a553f2cd9d58713b8963d58e2a3fff30f2fe4085270c20a556b9f28990946f1b49a2

Download Submit
C:\Windows\System\CeXnCmG.exe

Filesize
1.5MB

MD5
8271c27dfa1b99553ca4ccdfe4f5bfc2

SHA1
d8dfd8e8a4cd1e24dc68db9584fab7ecb672f8f6

SHA256
4513e0e08d8b29cc4aa777ce7b047c88b8f4908e1dcc2d71503144cb35e2f4ce

SHA512
3e002a68285239d173de01caaa1f39d75cc93c66db184c8d7b94d1fb7695698eea36a05edb851522707cef1904865d278446a8f51c08ae095591b05eafa4d652

Download Submit
C:\Windows\System\HhawMuf.exe

Filesize
1.5MB

MD5
75b84cb559eeff23d0daa0f04290e83f

SHA1
4e79da4109d41bc87166763e2ffb1d21ecae1156

SHA256
790bad8d54beb8e772cba584c11af0355b661bed3970535d44df6774717d906b

SHA512
3d7c85971d417fc248e3ca8ded4493b83131b4882ba07f59a924fb2bb72c2fd71faca81d6bb466a2fe66154ef0922b41a3b3ebb9c70c995188d8c84c38bbf156

Download Submit
C:\Windows\System\JtsGfXj.exe

Filesize
1.5MB

MD5
6b39e38d0b4be91ab72d07c3897979d3

SHA1
3446eae3e10922aa88462c66f5ccc5e308889443

SHA256
447c3824eada1d5ab5157e6bf34aabea6264390c584580ce5920bf5e6609658b

SHA512
91e4b29103c9ff39ff257825289e4c5e97b0adfaf91747306ac4b8109c0f03df5a596db679db3c4e2e1b2e15d20f14454aa6994ac05c8071081704caebacf70b

Download Submit
C:\Windows\System\OhOzjMj.exe

Filesize
1.5MB

MD5
f6fc2023d3ed479937812b0990899768

SHA1
6c04be9089b6b3d5e2f7452300f41a8d7deb6408

SHA256
748d3107da5e13c233a243143e89cef2ecc5d8c1b502022949f00d64a33884a0

SHA512
97afe372b16bc756bd7aff0fd12e8e2d9c9c053a74cf5eaf6709953fa7769ead6c466b3abef9045ef0fee7a29c1754cb21607f341fe595bc2d443ff193384d38

Download Submit
C:\Windows\System\QJdWSla.exe

Filesize
1.5MB

MD5
ac768d63534d88c98ecdcc09be011b86

SHA1
c3d132d1f988fa2751938daaab58abeefb93e91e

SHA256
cf173b0e2b56bddb872e1b6d11aa903f1f338a5c9e44c3e225a6ae2ba9035dbf

SHA512
430ad0b636ba928397caf9ff43153f45b217bf923b7e0cb2fded7e5c742f3ecb21ff1f64e80f5845a91de4afb25c27e5d7b508ecd7fe1d253fcb2f6c959656e9

Download Submit
C:\Windows\System\RukbSdB.exe

Filesize
1.5MB

MD5
b8ad16a11a37d199b08a40d392a4ef41

SHA1
66152187197c60c1ef86aeb753b6248b406fedd0

SHA256
1e246657cf27b23f70cdf061dee7f14cfd8ebf9fdf16d57d9c3b20420b80d182

SHA512
c16bebd97e498a45964bc0e4ecf28e538edf66fb2ffcf73ae41c0d53063a6f4881573dcf5a88dddf9aef22e00cfdc0f261f6a988ceab1e465f00427d12a299c0

Download Submit
C:\Windows\System\SDCffFE.exe

Filesize
1.5MB

MD5
b51236b151847118984211106d38af12

SHA1
dd9b0b33fac20f71bd05df778a2885cb9fb40a30

SHA256
d7f211cffaaeb07c4e1712da3e974ff06fc3cf1dc35d18b371fcc512e71839ef

SHA512
c7cf65d77308727ad38fc374ec99d21dbb34fbd86f5578c359cc6d41ef1b570f442dcc3965502f5c5910676f1c2fcf0048bece037571e33e9d87218440d430d3

Download Submit
C:\Windows\System\SjnfpJa.exe

Filesize
1.5MB

MD5
66ab0cc7ad7bac223dcd29f1e1e1cd24

SHA1
69f35bcde771296e2db3c148742459652525cb80

SHA256
e2e4ac3c28bde5d073035cb790fef427572b0e967d89340e55bbe2b34870bb4f

SHA512
fa260e80a14ca90233c1794830de8a5e393c546919a4e543fe3d8b3c5396b3d5725a577536e26666209628fccc79e73e50895c2e8c59ec56210b2c33b2299be8

Download Submit
C:\Windows\System\TjpfjTu.exe

Filesize
1.5MB

MD5
f24a26912f47489ec718e55c2f022be2

SHA1
3e6c617581ab30e2468c69386edf332777299bd3

SHA256
e6fb718b812e9b8c539f482701a717844869e1822fa630abd3b800ac6e4a118b

SHA512
e6af811fc9e0ecebc25459dea99de6161f5be18337789bdd152175996771922a85890ed2fa3e813a5d19538d1158f9a0f2ea94907420d5d2e4aeecfb3f4da460

Download Submit
C:\Windows\System\XGodMeN.exe

Filesize
1.5MB

MD5
c6accb036481646cb34be4e65b748f12

SHA1
75c19eefffa84bb5bff696543783ae56a3b336a9

SHA256
50061852f65a188071d135e4a1d226381f4d590ae3bfb80b0f8b42ca233a6f0b

SHA512
05f8937d2499333b4ef1d2ff64a3ce76302a928f9f79b7d5639cd898f759364b6009af8a7987a32ce90ddc5463853744abfd8f856ce89634230a5af4d1dd473b

Download Submit
C:\Windows\System\YzzoIQp.exe

Filesize
1.5MB

MD5
e3ee79e26a96c5074139504b20d90430

SHA1
c1148b8bf97fc452e0dbc9f836440d683d572c3a

SHA256
fae9073f8e542b0fe143ae23fee0cf8bc4029e706eeb03b5a4698b504f09fe98

SHA512
146b154fdc82a90a129e59001a132936baa8bb214f53ec7b980613506de7f418c11ab00f8a9cbe210d856698a7fae46821c1ffc071cc7f9a408077491847a4b5

Download Submit
C:\Windows\System\ZIeqvoD.exe

Filesize
1.5MB

MD5
89ac8183dca46453c850d334242b02d8

SHA1
9e9095ff06c47e79e373bfcd03e40ee14cabeb72

SHA256
f5338111ac8977acaea09f6fa50f9dc9676965fad14f241cceaf96faa1364b41

SHA512
390f05c12107207989fb51c723c248a92fa9cef3ae1b774a202b85969f5a48a15aba02d99e700bebbb3a6e74a248bff5b0fd86a168565c37c26a92eac52df6b7

Download Submit
C:\Windows\System\ZntunCB.exe

Filesize
1.5MB

MD5
11842d05d4cd0b8b0af6741c4f8eb983

SHA1
92e103e66beb21259534182ec6fb16a7a4267363

SHA256
8d49044448955b7a5d6a8a7e78477890f927b20ea1a3debafdb4457fbd812f0c

SHA512
ff5e91f946dc28baf597056c9b4f6ce01f38579f8546bccb2ce549fe259945dc9c9c72c461e7214b3263b45aad1a82ce1309fae463ca66a7b6115e799c9848b4

Download Submit
C:\Windows\System\acAmydl.exe

Filesize
1.5MB

MD5
1fa71bd7b47c70add7b57fa978bb4762

SHA1
45beb3e52829703453c2125200692a58d6024075

SHA256
84ea93bb70877a376bf05d01e39423557ae85515f558777b4cd9ffad680f1efd

SHA512
debef018aab35fd3b97c26952be55ef405c1cbd451fe077788759f88524e0b53973281c388e285a1bc0e9a90c8ef4a28728858e6fe8d9c63c436e34fdd669c50

Download Submit
C:\Windows\System\afvqMkc.exe

Filesize
1.5MB

MD5
90d92b36753a0872c2482fdb565350ad

SHA1
95164d33ee9ff9fdc40d900d041737a3a8e50774

SHA256
aa919272818f705da89c0620e7e6d3eb02c05d23dbd1e4d368d9f44281266730

SHA512
dc1ecb5916d9e76f26213f2f6f89117a309fa7ea844e49379a4338d607dd17ae00bed82a0f75c7a6dbc95be8dc87c083ac8506f059f06fb0dc19eb5919b662ec

Download Submit
C:\Windows\System\gmnlVgg.exe

Filesize
1.5MB

MD5
fc770f5303bee49ef56607a8ee1f50ba

SHA1
eab462db594eb9026dfe781088717298e21b755c

SHA256
3f30f5924250f5fc4bff441ab1fa2806b838a62c8ea8514a439add0263728eb0

SHA512
f32b61e92f412da5d8a15d182a14b8ff13db67f8939f74f22808b4f8172a341b6fedde5dc8f424826dbcdf970ea7e322c574a0af8e864735df660e79d04049d3

Download Submit
C:\Windows\System\hFKtbFt.exe

Filesize
1.5MB

MD5
188bb039214976e1a5042c62330ce4f8

SHA1
2fa0d59b2ed632086fc3614830ddc9892cff2efa

SHA256
a0ab579485d434dd5f697e3d1e595169af8cebe177a1b5fdf15b769c54c14611

SHA512
0b2a800f473d59292e3fe4afd57a2e0e3a6062421d1402e977e54e1dc97a1bc0e957a14f95eb9be0e644ee8e92f6f4dd26d41aff7aaa927620df92c76a8b9905

Download Submit
C:\Windows\System\iegjdNV.exe

Filesize
1.5MB

MD5
e345f0e19a548395a261ab57926de0b6

SHA1
5e8cfbf4d2abe0b5ed520dde6c5b4eb19493a036

SHA256
d932b1e80181cb9e091e5ceae9fa6c3cc096ddbff4d675209119cb007696e43b

SHA512
525d16a7f9e811ee81a65e4419e1526ef24e9a25858424c203b36ace4030c790e22efd186ce8a96c6b4401ee5e8509767e3e8734b3b41c7cd665feed96a6fee7

Download Submit
C:\Windows\System\jwZUcre.exe

Filesize
1.5MB

MD5
c3526cf95bba730331c62aa5797a70b5

SHA1
b0ab1e3312f81c344be7dec4617aec522a70e501

SHA256
1801dedbcce92aef1c9842656f214ad888551fb3da1298e641c4d4abccd59170

SHA512
313dceed8357c58f874e7a2c3d660cf5f4e85f32fc442aef9747e622a2fadfb022186b9ea204239676c4eae054dea719efb7bdf6d3309a0c5da9d34dfdf8b9f5

Download Submit
C:\Windows\System\kSTqssM.exe

Filesize
1.5MB

MD5
6cc3355b9212c5f0d4e907d6f688a88a

SHA1
78672de6dd6550fec4cb8e300a05120a95d32026

SHA256
a2f5540e69667da199393d353cd4d215f51758836a7006a35ba95951c520799b

SHA512
e613d7e26e16fc977b5d4a98b83372d14d2293a722a1b8c49fa8a60887712b5fb0b5c0d07d216c0aef1bd1de2a96e8a4a72f2d0c9b8ba2f3b11b4a2e8c0a8083

Download Submit
C:\Windows\System\lSKdHWU.exe

Filesize
1.5MB

MD5
66d9e4a821bad3f023c29cf631e2f7e0

SHA1
05a6712a371c3a07d6734fb2082dc3ef625391f0

SHA256
8d91f7584818aa79f120445798faa3569ed2aa1300662f93b6847e6279cefc87

SHA512
13ea13b48fcbcefc4b53761f6386d62e62fedd34cd1adf400399325bd10b490fdf6b4ec9f3fb70ae7af6e4a5513ecd52b00bfd5df153a1d1b149b0edc492e2cc

Download Submit
C:\Windows\System\myoRfwY.exe

Filesize
1.5MB

MD5
5c91939065a1855adc05dd3d832227ea

SHA1
4494b04de96670b7a0f59cedab175d76dd02fa80

SHA256
8e88e5a5d9a1e083b621d2ac8aad2494bbbacda2eb395c80bf8eccd8383986a2

SHA512
3bd858e4f08cb1731669739e8697b38ad77de9a280fc30dac5852d012883066e29480aa2705a594cb1b2ad60a8267f024526620ebec50b84d6817cf777ec0ec9

Download Submit
C:\Windows\System\nuZMcbS.exe

Filesize
1.5MB

MD5
567d94e0d7220f33eda5e26584ec6b12

SHA1
51f0c8331cc607502b54530f013e1c680c24da43

SHA256
b690fdab2806981e21087faf52dab4b7a084dd203c317fdb4ca0ba3702b025ff

SHA512
c554be610250064096634e2836d03b8c0b3169dfd2f3228c32bea73f38417a3f2e1a442d28db5f7e30eab8c89b5edef93194faedc6f321820ab0386127073932

Download Submit
C:\Windows\System\oYyfLbM.exe

Filesize
1.5MB

MD5
b909f69e3601e445134be4cdbda370ae

SHA1
8f36e7ea222ad5077f2f7318ee2d63d617686971

SHA256
81b0c3af190b793cd14b7d3ca6ef88d598e8dd97106bfe9d0b036711ec04a27e

SHA512
e6410b6a403ccdbec5095c5535e30cc3e5002977597a56b077a4d76157049f303e6e8d5bc75ade8c78272a270765d7e364b79d5d3b6c9552075c886ef7d78937

Download Submit
C:\Windows\System\szefZiw.exe

Filesize
1.5MB

MD5
d46385708b7871cec2ad4312ec1311f2

SHA1
ce9c8b21367e749337a1cd9b8aedc7aecf103738

SHA256
1c21ff60c6f125053fb6bb37c147a24f388a2a4476aba620a6ab04e8fff4a11b

SHA512
cba5cf28a91fa6f4e64729157551118b800bfc407c2d3a7b8c44530860290628ad40ba12bc2f1c99283f83e615694d87007c4db104d524f5131c4e012321d20e

Download Submit
C:\Windows\System\tfoUGqH.exe

Filesize
1.5MB

MD5
a483ed6b1527e8a0366a82f053879cc6

SHA1
f7d651122370a3fa52196293aeaec3709503b430

SHA256
a0913e4c2806491e3321e12f0c198824824ff5fe181250963fceeb5e4bdf9a54

SHA512
ccf4da415dd4498ff57bcaf0f8a42befb641719fbcf6bc11ec738ab98bb7477fd0a9e3ed6e914ae67cc9cf57fd6774a99ed88e93c9e2746d3548c346dc2113fb

Download Submit
C:\Windows\System\tpoSbVV.exe

Filesize
1.5MB

MD5
e88f0b05661d0414f69e5757c5de67ff

SHA1
7ad60629769d0360ba855aa02d0dc83a3f718ddc

SHA256
efc674064b781dbc1d72dd74f4173cd7f30c9d60a5ec612d72e1f75b644f0f71

SHA512
b2f0ff8288b7a77f804742dd6c16738c34bd39f571630220eb7cffb07ca721e8473413ff4f0965b82633e2d05b644e88baac8777cf32f7b8c7875642017931c8

Download Submit
C:\Windows\System\xeuslEg.exe

Filesize
1.5MB

MD5
a4153a91b0c87c453ee2cfa6b8c86250

SHA1
ba12427d6e33bf0fcb10dd2d8ecd74ffede86cde

SHA256
f294df7e8ccbf8829be9be8d325aa471bf18a1243f701655e743aac0ba3d02c9

SHA512
4bad7e0bb997386cb48664a27a80e179665aefd46153b1098d7753366c2243a5fae3a18c3e4e410a8e174abbdebc24a797f3b59333e31cccac1488c32d1b6e54

Download Submit
C:\Windows\System\ztwJbPw.exe

Filesize
1.5MB

MD5
6f6e801f6331465cfe0ae7678c858e5a

SHA1
569dd96f26b6695eae81cfb30a0bda413d650269

SHA256
91b777887eb69fab59171ae2e293e7cbd129b016cef1b0475292b64c3c4d35ee

SHA512
da60df2011e034360b0989cbb9caa1de8f198ac443d88e399f721ae47f9390af2497bb2017e4c162452563a37fb1816240263502054957c6c204a2578072b2b7

Download Submit
memory/3768-0-0x00000286D2A50000-0x00000286D2A60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads