xmrig | 84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac

Analysis

max time kernel
145s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2025, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
Size

1.9MB
MD5

41c5e7831f987803a2c15d10321a356e
SHA1

8dd05fbb43e6602b4de28862363658f9e7e318bf
SHA256

84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac
SHA512

c779a2e6cb8297bab7b527397919333681cb8da152f55dc542dc0df82f571f063eea85362b873dd491008b28182f5ac9a66bbd01b4e5ab769cba7ffbf8d4d774
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYFu4/qPXSYPf0P:GemTLkNdfE0pZy8

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x001300000001e6d0-4.dat	xmrig
behavioral2/files/0x0009000000023c59-7.dat	xmrig
behavioral2/files/0x0007000000023c5f-21.dat	xmrig
behavioral2/files/0x0007000000023c60-29.dat	xmrig
behavioral2/files/0x0007000000023c5e-22.dat	xmrig
behavioral2/files/0x0007000000023c62-37.dat	xmrig
behavioral2/files/0x0007000000023c63-43.dat	xmrig
behavioral2/files/0x0007000000023c64-50.dat	xmrig
behavioral2/files/0x0007000000023c65-58.dat	xmrig
behavioral2/files/0x0007000000023c67-67.dat	xmrig
behavioral2/files/0x0007000000023c68-70.dat	xmrig
behavioral2/files/0x0007000000023c6a-77.dat	xmrig
behavioral2/files/0x0007000000023c6c-90.dat	xmrig
behavioral2/files/0x0007000000023c6d-105.dat	xmrig
behavioral2/files/0x0007000000023c6f-120.dat	xmrig
behavioral2/files/0x0007000000023c73-142.dat	xmrig
behavioral2/files/0x0007000000023c7a-160.dat	xmrig
behavioral2/files/0x0007000000023c79-158.dat	xmrig
behavioral2/files/0x0007000000023c78-156.dat	xmrig
behavioral2/files/0x0007000000023c77-154.dat	xmrig
behavioral2/files/0x0007000000023c76-152.dat	xmrig
behavioral2/files/0x0007000000023c75-150.dat	xmrig
behavioral2/files/0x0007000000023c71-148.dat	xmrig
behavioral2/files/0x0007000000023c74-145.dat	xmrig
behavioral2/files/0x0007000000023c72-140.dat	xmrig
behavioral2/files/0x0007000000023c70-130.dat	xmrig
behavioral2/files/0x0007000000023c6e-115.dat	xmrig
behavioral2/files/0x0007000000023c6b-85.dat	xmrig
behavioral2/files/0x0007000000023c69-79.dat	xmrig
behavioral2/files/0x0007000000023c66-60.dat	xmrig
behavioral2/files/0x0007000000023c61-41.dat	xmrig
behavioral2/files/0x000b000000023bca-13.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3288	CbLbEey.exe
4656	vAWSpxz.exe
4360	jsKfDKC.exe
4704	gnnWsFU.exe
4964	JMRlAlc.exe
2420	NJCytjK.exe
3120	AXTQepa.exe
232	RkmcIrY.exe
5028	ggzRVKV.exe
4988	BfFEakK.exe
3612	lzUjNAm.exe
3104	NoOpVMT.exe
528	LNCoTDZ.exe
1384	xRwwvFz.exe
2316	kVdmyHc.exe
1892	vrsUGec.exe
2544	AdHxQdC.exe
408	cNWxOQD.exe
2568	MkQUNoK.exe
1672	yOHNtlX.exe
2244	UEHsYxK.exe
2564	UHjskGW.exe
2596	zyVjLhg.exe
3012	rLXsYQm.exe
2808	lQUlXhE.exe
2888	jVJtgnV.exe
4496	csMwyzl.exe
1056	mraSFkb.exe
1976	jvgYZOo.exe
5004	CPugaVm.exe
1664	acRKcoH.exe
3356	zaeUVxN.exe
4828	LFCphDT.exe
4516	NDEUgve.exe
5104	kPTZVwv.exe
760	SprFuud.exe
2024	aNYXLZc.exe
1964	wOxsHsJ.exe
4716	DgISaIV.exe
2588	smhOYny.exe
3048	sOFFRiT.exe
4308	uWLVOMM.exe
3816	dTrKQIc.exe
1244	lWLZaGz.exe
1636	viMqzMu.exe
5020	gOUwJNc.exe
3696	IxYEclB.exe
4660	SnVRzpI.exe
3008	jvkpgJX.exe
4304	pMJaMKM.exe
3996	YwSNuai.exe
2388	sZFfLGm.exe
456	NFclXkl.exe
3496	FQQERrl.exe
3616	nhKDBhS.exe
2324	BBqxjTS.exe
856	jpdGOUz.exe
692	IyYTCob.exe
3044	vecBoBG.exe
2712	BlOZFIc.exe
1656	ZQOhjFL.exe
976	RtDCVOe.exe
2744	cohaMaJ.exe
2616	mBlnzml.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oBAVnkv.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\ddSwRZc.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\qJovpyY.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\oDYzKtR.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\guXicHs.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\dPpKhHt.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\DaHFVSC.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\AMbJUCd.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\lJEFxJZ.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\aYlRQuP.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\kPTZVwv.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\ytVnpYZ.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\ooZOiFs.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\dtIdZIX.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\zYNndPl.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\hqigZbZ.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\ljvWjSB.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\ALNRHiD.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\fyIVdOY.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\yutcJwX.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\ENYNZke.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\wJObuOY.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\tIrcUQw.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\IPuThlK.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\CpNdLkc.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\mraSFkb.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\CFVHrPI.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\pMJaMKM.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\ZIIiXHU.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\EeIRzyF.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\Iroijox.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\WfQcCVs.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\JXlRSvS.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\pgvArMF.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\cohaMaJ.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\xyBNWAT.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\sYsOTtB.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\PSFFsMT.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\OrzmlLS.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\orSfCwy.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\mhduxVe.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\hWOYcvs.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\plsmKgB.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\pVGlWnZ.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\vAWSpxz.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\CGKQqZm.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\eRMttTL.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\GXEVwId.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\ZAnudTA.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\HLixzjm.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\LHSmjJu.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\xTuLRso.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\zINZcWP.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\gURcmWD.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\SalfAXT.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\MuOBBoJ.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\LNCoTDZ.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\AifISYL.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\bwlOTyR.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\QvrhWyD.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\YgQCOAU.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\YUGUsuX.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\BOkjtjK.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
File created	C:\Windows\System\LZEVKXR.exe	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17116	dwm.exe
Token: SeChangeNotifyPrivilege	17116	dwm.exe
Token: 33	17116	dwm.exe
Token: SeIncBasePriorityPrivilege	17116	dwm.exe
Token: SeShutdownPrivilege	17116	dwm.exe
Token: SeCreatePagefilePrivilege	17116	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 3288	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	84
PID 3108 wrote to memory of 3288	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	84
PID 3108 wrote to memory of 4656	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	85
PID 3108 wrote to memory of 4656	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	85
PID 3108 wrote to memory of 4360	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	86
PID 3108 wrote to memory of 4360	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	86
PID 3108 wrote to memory of 4704	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	87
PID 3108 wrote to memory of 4704	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	87
PID 3108 wrote to memory of 4964	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	88
PID 3108 wrote to memory of 4964	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	88
PID 3108 wrote to memory of 2420	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	89
PID 3108 wrote to memory of 2420	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	89
PID 3108 wrote to memory of 3120	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	90
PID 3108 wrote to memory of 3120	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	90
PID 3108 wrote to memory of 232	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	91
PID 3108 wrote to memory of 232	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	91
PID 3108 wrote to memory of 5028	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	92
PID 3108 wrote to memory of 5028	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	92
PID 3108 wrote to memory of 4988	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	93
PID 3108 wrote to memory of 4988	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	93
PID 3108 wrote to memory of 3612	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	94
PID 3108 wrote to memory of 3612	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	94
PID 3108 wrote to memory of 3104	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	95
PID 3108 wrote to memory of 3104	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	95
PID 3108 wrote to memory of 528	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	96
PID 3108 wrote to memory of 528	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	96
PID 3108 wrote to memory of 1384	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	97
PID 3108 wrote to memory of 1384	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	97
PID 3108 wrote to memory of 2316	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	98
PID 3108 wrote to memory of 2316	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	98
PID 3108 wrote to memory of 1892	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	99
PID 3108 wrote to memory of 1892	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	99
PID 3108 wrote to memory of 2544	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	100
PID 3108 wrote to memory of 2544	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	100
PID 3108 wrote to memory of 408	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	101
PID 3108 wrote to memory of 408	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	101
PID 3108 wrote to memory of 2568	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	102
PID 3108 wrote to memory of 2568	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	102
PID 3108 wrote to memory of 1672	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	103
PID 3108 wrote to memory of 1672	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	103
PID 3108 wrote to memory of 2244	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	104
PID 3108 wrote to memory of 2244	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	104
PID 3108 wrote to memory of 2564	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	105
PID 3108 wrote to memory of 2564	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	105
PID 3108 wrote to memory of 2596	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	106
PID 3108 wrote to memory of 2596	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	106
PID 3108 wrote to memory of 3012	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	107
PID 3108 wrote to memory of 3012	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	107
PID 3108 wrote to memory of 2808	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	108
PID 3108 wrote to memory of 2808	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	108
PID 3108 wrote to memory of 2888	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	109
PID 3108 wrote to memory of 2888	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	109
PID 3108 wrote to memory of 4496	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	110
PID 3108 wrote to memory of 4496	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	110
PID 3108 wrote to memory of 1056	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	111
PID 3108 wrote to memory of 1056	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	111
PID 3108 wrote to memory of 1976	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	112
PID 3108 wrote to memory of 1976	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	112
PID 3108 wrote to memory of 5004	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	113
PID 3108 wrote to memory of 5004	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	113
PID 3108 wrote to memory of 1664	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	114
PID 3108 wrote to memory of 1664	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	114
PID 3108 wrote to memory of 3356	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	115
PID 3108 wrote to memory of 3356	3108	84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe	115

C:\Users\Admin\AppData\Local\Temp\84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe
"C:\Users\Admin\AppData\Local\Temp\84c61ff158b8bcca6530c6795d2507104afa4be86c99285d0760737fcc9fb8ac.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\System\CbLbEey.exe
  C:\Windows\System\CbLbEey.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\vAWSpxz.exe
  C:\Windows\System\vAWSpxz.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\jsKfDKC.exe
  C:\Windows\System\jsKfDKC.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\gnnWsFU.exe
  C:\Windows\System\gnnWsFU.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\JMRlAlc.exe
  C:\Windows\System\JMRlAlc.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\NJCytjK.exe
  C:\Windows\System\NJCytjK.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\AXTQepa.exe
  C:\Windows\System\AXTQepa.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\RkmcIrY.exe
  C:\Windows\System\RkmcIrY.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\ggzRVKV.exe
  C:\Windows\System\ggzRVKV.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\BfFEakK.exe
  C:\Windows\System\BfFEakK.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\lzUjNAm.exe
  C:\Windows\System\lzUjNAm.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\NoOpVMT.exe
  C:\Windows\System\NoOpVMT.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\LNCoTDZ.exe
  C:\Windows\System\LNCoTDZ.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\xRwwvFz.exe
  C:\Windows\System\xRwwvFz.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\kVdmyHc.exe
  C:\Windows\System\kVdmyHc.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\vrsUGec.exe
  C:\Windows\System\vrsUGec.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\AdHxQdC.exe
  C:\Windows\System\AdHxQdC.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\cNWxOQD.exe
  C:\Windows\System\cNWxOQD.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\MkQUNoK.exe
  C:\Windows\System\MkQUNoK.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\yOHNtlX.exe
  C:\Windows\System\yOHNtlX.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\UEHsYxK.exe
  C:\Windows\System\UEHsYxK.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\UHjskGW.exe
  C:\Windows\System\UHjskGW.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\zyVjLhg.exe
  C:\Windows\System\zyVjLhg.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\rLXsYQm.exe
  C:\Windows\System\rLXsYQm.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\lQUlXhE.exe
  C:\Windows\System\lQUlXhE.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\jVJtgnV.exe
  C:\Windows\System\jVJtgnV.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\csMwyzl.exe
  C:\Windows\System\csMwyzl.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\mraSFkb.exe
  C:\Windows\System\mraSFkb.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\jvgYZOo.exe
  C:\Windows\System\jvgYZOo.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\CPugaVm.exe
  C:\Windows\System\CPugaVm.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\acRKcoH.exe
  C:\Windows\System\acRKcoH.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\zaeUVxN.exe
  C:\Windows\System\zaeUVxN.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\LFCphDT.exe
  C:\Windows\System\LFCphDT.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\NDEUgve.exe
  C:\Windows\System\NDEUgve.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\kPTZVwv.exe
  C:\Windows\System\kPTZVwv.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\SprFuud.exe
  C:\Windows\System\SprFuud.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\aNYXLZc.exe
  C:\Windows\System\aNYXLZc.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\wOxsHsJ.exe
  C:\Windows\System\wOxsHsJ.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\DgISaIV.exe
  C:\Windows\System\DgISaIV.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\smhOYny.exe
  C:\Windows\System\smhOYny.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\sOFFRiT.exe
  C:\Windows\System\sOFFRiT.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\uWLVOMM.exe
  C:\Windows\System\uWLVOMM.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\dTrKQIc.exe
  C:\Windows\System\dTrKQIc.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\lWLZaGz.exe
  C:\Windows\System\lWLZaGz.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\viMqzMu.exe
  C:\Windows\System\viMqzMu.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\gOUwJNc.exe
  C:\Windows\System\gOUwJNc.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\IxYEclB.exe
  C:\Windows\System\IxYEclB.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\SnVRzpI.exe
  C:\Windows\System\SnVRzpI.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\jvkpgJX.exe
  C:\Windows\System\jvkpgJX.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\pMJaMKM.exe
  C:\Windows\System\pMJaMKM.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\YwSNuai.exe
  C:\Windows\System\YwSNuai.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\sZFfLGm.exe
  C:\Windows\System\sZFfLGm.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\NFclXkl.exe
  C:\Windows\System\NFclXkl.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\FQQERrl.exe
  C:\Windows\System\FQQERrl.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\nhKDBhS.exe
  C:\Windows\System\nhKDBhS.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\BBqxjTS.exe
  C:\Windows\System\BBqxjTS.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\jpdGOUz.exe
  C:\Windows\System\jpdGOUz.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\IyYTCob.exe
  C:\Windows\System\IyYTCob.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\vecBoBG.exe
  C:\Windows\System\vecBoBG.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\BlOZFIc.exe
  C:\Windows\System\BlOZFIc.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\ZQOhjFL.exe
  C:\Windows\System\ZQOhjFL.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\RtDCVOe.exe
  C:\Windows\System\RtDCVOe.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\cohaMaJ.exe
  C:\Windows\System\cohaMaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\mBlnzml.exe
  C:\Windows\System\mBlnzml.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\KZZQQUl.exe
  C:\Windows\System\KZZQQUl.exe
  2⤵
  PID:2320
- C:\Windows\System\dePFRBu.exe
  C:\Windows\System\dePFRBu.exe
  2⤵
  PID:2924
- C:\Windows\System\PiRqJtF.exe
  C:\Windows\System\PiRqJtF.exe
  2⤵
  PID:4024
- C:\Windows\System\eNUhTId.exe
  C:\Windows\System\eNUhTId.exe
  2⤵
  PID:1952
- C:\Windows\System\tKXfAzI.exe
  C:\Windows\System\tKXfAzI.exe
  2⤵
  PID:3748
- C:\Windows\System\dxRzrSm.exe
  C:\Windows\System\dxRzrSm.exe
  2⤵
  PID:3140
- C:\Windows\System\iflfhDs.exe
  C:\Windows\System\iflfhDs.exe
  2⤵
  PID:3016
- C:\Windows\System\YzztpYA.exe
  C:\Windows\System\YzztpYA.exe
  2⤵
  PID:396
- C:\Windows\System\Knlfoxz.exe
  C:\Windows\System\Knlfoxz.exe
  2⤵
  PID:3828
- C:\Windows\System\jjQdlte.exe
  C:\Windows\System\jjQdlte.exe
  2⤵
  PID:2364
- C:\Windows\System\CqrrECY.exe
  C:\Windows\System\CqrrECY.exe
  2⤵
  PID:1596
- C:\Windows\System\uiszgDo.exe
  C:\Windows\System\uiszgDo.exe
  2⤵
  PID:3416
- C:\Windows\System\ZfLDSgx.exe
  C:\Windows\System\ZfLDSgx.exe
  2⤵
  PID:2136
- C:\Windows\System\emepWgw.exe
  C:\Windows\System\emepWgw.exe
  2⤵
  PID:3184
- C:\Windows\System\TNZoGlm.exe
  C:\Windows\System\TNZoGlm.exe
  2⤵
  PID:3380
- C:\Windows\System\oselhkQ.exe
  C:\Windows\System\oselhkQ.exe
  2⤵
  PID:3188
- C:\Windows\System\yWoUsRo.exe
  C:\Windows\System\yWoUsRo.exe
  2⤵
  PID:4984
- C:\Windows\System\CGKQqZm.exe
  C:\Windows\System\CGKQqZm.exe
  2⤵
  PID:2896
- C:\Windows\System\qucsJdS.exe
  C:\Windows\System\qucsJdS.exe
  2⤵
  PID:1460
- C:\Windows\System\VlTbiPg.exe
  C:\Windows\System\VlTbiPg.exe
  2⤵
  PID:2260
- C:\Windows\System\mgHSiSw.exe
  C:\Windows\System\mgHSiSw.exe
  2⤵
  PID:384
- C:\Windows\System\PfNzNbI.exe
  C:\Windows\System\PfNzNbI.exe
  2⤵
  PID:32
- C:\Windows\System\ZXBlCWG.exe
  C:\Windows\System\ZXBlCWG.exe
  2⤵
  PID:4876
- C:\Windows\System\xzvpptF.exe
  C:\Windows\System\xzvpptF.exe
  2⤵
  PID:1684
- C:\Windows\System\nDZKeKe.exe
  C:\Windows\System\nDZKeKe.exe
  2⤵
  PID:3804
- C:\Windows\System\JLMfnRV.exe
  C:\Windows\System\JLMfnRV.exe
  2⤵
  PID:1840
- C:\Windows\System\JRKtRqO.exe
  C:\Windows\System\JRKtRqO.exe
  2⤵
  PID:5076
- C:\Windows\System\TqvqNyf.exe
  C:\Windows\System\TqvqNyf.exe
  2⤵
  PID:4568
- C:\Windows\System\QPXXPDb.exe
  C:\Windows\System\QPXXPDb.exe
  2⤵
  PID:5096
- C:\Windows\System\CsTXBbi.exe
  C:\Windows\System\CsTXBbi.exe
  2⤵
  PID:4728
- C:\Windows\System\UveyvgY.exe
  C:\Windows\System\UveyvgY.exe
  2⤵
  PID:1348
- C:\Windows\System\eomcLyn.exe
  C:\Windows\System\eomcLyn.exe
  2⤵
  PID:4460
- C:\Windows\System\DrWMqvi.exe
  C:\Windows\System\DrWMqvi.exe
  2⤵
  PID:1032
- C:\Windows\System\dPpKhHt.exe
  C:\Windows\System\dPpKhHt.exe
  2⤵
  PID:4252
- C:\Windows\System\VntBRlC.exe
  C:\Windows\System\VntBRlC.exe
  2⤵
  PID:5168
- C:\Windows\System\fnyZWba.exe
  C:\Windows\System\fnyZWba.exe
  2⤵
  PID:5200
- C:\Windows\System\kjrKawl.exe
  C:\Windows\System\kjrKawl.exe
  2⤵
  PID:5228
- C:\Windows\System\TDbbhJQ.exe
  C:\Windows\System\TDbbhJQ.exe
  2⤵
  PID:5256
- C:\Windows\System\jXmBEXc.exe
  C:\Windows\System\jXmBEXc.exe
  2⤵
  PID:5288
- C:\Windows\System\YPVWLip.exe
  C:\Windows\System\YPVWLip.exe
  2⤵
  PID:5312
- C:\Windows\System\zLbnTRi.exe
  C:\Windows\System\zLbnTRi.exe
  2⤵
  PID:5348
- C:\Windows\System\OhYKMxW.exe
  C:\Windows\System\OhYKMxW.exe
  2⤵
  PID:5372
- C:\Windows\System\kJrmyis.exe
  C:\Windows\System\kJrmyis.exe
  2⤵
  PID:5416
- C:\Windows\System\dcZWAAJ.exe
  C:\Windows\System\dcZWAAJ.exe
  2⤵
  PID:5452
- C:\Windows\System\CSsbMTC.exe
  C:\Windows\System\CSsbMTC.exe
  2⤵
  PID:5476
- C:\Windows\System\HVbcjwi.exe
  C:\Windows\System\HVbcjwi.exe
  2⤵
  PID:5500
- C:\Windows\System\edRfcwq.exe
  C:\Windows\System\edRfcwq.exe
  2⤵
  PID:5532
- C:\Windows\System\JXlRSvS.exe
  C:\Windows\System\JXlRSvS.exe
  2⤵
  PID:5560
- C:\Windows\System\xNrOJDd.exe
  C:\Windows\System\xNrOJDd.exe
  2⤵
  PID:5592
- C:\Windows\System\cCgvBKz.exe
  C:\Windows\System\cCgvBKz.exe
  2⤵
  PID:5620
- C:\Windows\System\bjlEIBf.exe
  C:\Windows\System\bjlEIBf.exe
  2⤵
  PID:5648
- C:\Windows\System\eRMttTL.exe
  C:\Windows\System\eRMttTL.exe
  2⤵
  PID:5676
- C:\Windows\System\KoteBid.exe
  C:\Windows\System\KoteBid.exe
  2⤵
  PID:5704
- C:\Windows\System\cVYIKuK.exe
  C:\Windows\System\cVYIKuK.exe
  2⤵
  PID:5732
- C:\Windows\System\HsXUnOF.exe
  C:\Windows\System\HsXUnOF.exe
  2⤵
  PID:5760
- C:\Windows\System\cjNtmfl.exe
  C:\Windows\System\cjNtmfl.exe
  2⤵
  PID:5792
- C:\Windows\System\TPSaMNV.exe
  C:\Windows\System\TPSaMNV.exe
  2⤵
  PID:5824
- C:\Windows\System\MoMBdDx.exe
  C:\Windows\System\MoMBdDx.exe
  2⤵
  PID:5852
- C:\Windows\System\DvfCPEe.exe
  C:\Windows\System\DvfCPEe.exe
  2⤵
  PID:5884
- C:\Windows\System\wqPlvRi.exe
  C:\Windows\System\wqPlvRi.exe
  2⤵
  PID:5912
- C:\Windows\System\wBdakxr.exe
  C:\Windows\System\wBdakxr.exe
  2⤵
  PID:5940
- C:\Windows\System\QBIEvIz.exe
  C:\Windows\System\QBIEvIz.exe
  2⤵
  PID:5968
- C:\Windows\System\CwhbQrM.exe
  C:\Windows\System\CwhbQrM.exe
  2⤵
  PID:6000
- C:\Windows\System\sbXzNsl.exe
  C:\Windows\System\sbXzNsl.exe
  2⤵
  PID:6024
- C:\Windows\System\JPQtnmb.exe
  C:\Windows\System\JPQtnmb.exe
  2⤵
  PID:6052
- C:\Windows\System\uIftgzq.exe
  C:\Windows\System\uIftgzq.exe
  2⤵
  PID:6080
- C:\Windows\System\yYvcHIp.exe
  C:\Windows\System\yYvcHIp.exe
  2⤵
  PID:6108
- C:\Windows\System\zENhzSs.exe
  C:\Windows\System\zENhzSs.exe
  2⤵
  PID:2940
- C:\Windows\System\ZIIiXHU.exe
  C:\Windows\System\ZIIiXHU.exe
  2⤵
  PID:5184
- C:\Windows\System\sTRTSRs.exe
  C:\Windows\System\sTRTSRs.exe
  2⤵
  PID:5248
- C:\Windows\System\JMHdCJk.exe
  C:\Windows\System\JMHdCJk.exe
  2⤵
  PID:5324
- C:\Windows\System\QdWbaOg.exe
  C:\Windows\System\QdWbaOg.exe
  2⤵
  PID:2032
- C:\Windows\System\jPoMRrD.exe
  C:\Windows\System\jPoMRrD.exe
  2⤵
  PID:5460
- C:\Windows\System\ilCibGe.exe
  C:\Windows\System\ilCibGe.exe
  2⤵
  PID:5524
- C:\Windows\System\oDYzKtR.exe
  C:\Windows\System\oDYzKtR.exe
  2⤵
  PID:5588
- C:\Windows\System\USWoxRH.exe
  C:\Windows\System\USWoxRH.exe
  2⤵
  PID:5660
- C:\Windows\System\JUqGEae.exe
  C:\Windows\System\JUqGEae.exe
  2⤵
  PID:5728
- C:\Windows\System\SANYKCv.exe
  C:\Windows\System\SANYKCv.exe
  2⤵
  PID:5772
- C:\Windows\System\BKhRrKW.exe
  C:\Windows\System\BKhRrKW.exe
  2⤵
  PID:5872
- C:\Windows\System\CgbyIjX.exe
  C:\Windows\System\CgbyIjX.exe
  2⤵
  PID:5932
- C:\Windows\System\BkVOKQp.exe
  C:\Windows\System\BkVOKQp.exe
  2⤵
  PID:5988
- C:\Windows\System\ytVnpYZ.exe
  C:\Windows\System\ytVnpYZ.exe
  2⤵
  PID:6036
- C:\Windows\System\NHnBcKv.exe
  C:\Windows\System\NHnBcKv.exe
  2⤵
  PID:6072
- C:\Windows\System\PFonIFB.exe
  C:\Windows\System\PFonIFB.exe
  2⤵
  PID:5160
- C:\Windows\System\dCRTstm.exe
  C:\Windows\System\dCRTstm.exe
  2⤵
  PID:5304
- C:\Windows\System\tIrcUQw.exe
  C:\Windows\System\tIrcUQw.exe
  2⤵
  PID:5440
- C:\Windows\System\ExvpXPm.exe
  C:\Windows\System\ExvpXPm.exe
  2⤵
  PID:5700
- C:\Windows\System\JvgDOYQ.exe
  C:\Windows\System\JvgDOYQ.exe
  2⤵
  PID:5844
- C:\Windows\System\cbbVzTa.exe
  C:\Windows\System\cbbVzTa.exe
  2⤵
  PID:5980
- C:\Windows\System\hphNyIp.exe
  C:\Windows\System\hphNyIp.exe
  2⤵
  PID:5572
- C:\Windows\System\guXicHs.exe
  C:\Windows\System\guXicHs.exe
  2⤵
  PID:5840
- C:\Windows\System\YKxxRru.exe
  C:\Windows\System\YKxxRru.exe
  2⤵
  PID:6096
- C:\Windows\System\fGVahlL.exe
  C:\Windows\System\fGVahlL.exe
  2⤵
  PID:6092
- C:\Windows\System\LOBJKYt.exe
  C:\Windows\System\LOBJKYt.exe
  2⤵
  PID:5784
- C:\Windows\System\NzBEMyX.exe
  C:\Windows\System\NzBEMyX.exe
  2⤵
  PID:6168
- C:\Windows\System\bBIANhh.exe
  C:\Windows\System\bBIANhh.exe
  2⤵
  PID:6196
- C:\Windows\System\SyLNKSv.exe
  C:\Windows\System\SyLNKSv.exe
  2⤵
  PID:6224
- C:\Windows\System\yKMbmvJ.exe
  C:\Windows\System\yKMbmvJ.exe
  2⤵
  PID:6252
- C:\Windows\System\QymewzD.exe
  C:\Windows\System\QymewzD.exe
  2⤵
  PID:6268
- C:\Windows\System\ZbpebuZ.exe
  C:\Windows\System\ZbpebuZ.exe
  2⤵
  PID:6300
- C:\Windows\System\QNtMVsw.exe
  C:\Windows\System\QNtMVsw.exe
  2⤵
  PID:6324
- C:\Windows\System\CdFzVZV.exe
  C:\Windows\System\CdFzVZV.exe
  2⤵
  PID:6356
- C:\Windows\System\vnFCIgW.exe
  C:\Windows\System\vnFCIgW.exe
  2⤵
  PID:6380
- C:\Windows\System\tGPZVKO.exe
  C:\Windows\System\tGPZVKO.exe
  2⤵
  PID:6420
- C:\Windows\System\HyubSDL.exe
  C:\Windows\System\HyubSDL.exe
  2⤵
  PID:6440
- C:\Windows\System\sDMjBAx.exe
  C:\Windows\System\sDMjBAx.exe
  2⤵
  PID:6464
- C:\Windows\System\Vauejyo.exe
  C:\Windows\System\Vauejyo.exe
  2⤵
  PID:6496
- C:\Windows\System\EeIRzyF.exe
  C:\Windows\System\EeIRzyF.exe
  2⤵
  PID:6528
- C:\Windows\System\PwWksAk.exe
  C:\Windows\System\PwWksAk.exe
  2⤵
  PID:6560
- C:\Windows\System\luyOyie.exe
  C:\Windows\System\luyOyie.exe
  2⤵
  PID:6596
- C:\Windows\System\NaMhCeG.exe
  C:\Windows\System\NaMhCeG.exe
  2⤵
  PID:6616
- C:\Windows\System\jDjGJDA.exe
  C:\Windows\System\jDjGJDA.exe
  2⤵
  PID:6644
- C:\Windows\System\PLmUYUR.exe
  C:\Windows\System\PLmUYUR.exe
  2⤵
  PID:6668
- C:\Windows\System\JHuBKLi.exe
  C:\Windows\System\JHuBKLi.exe
  2⤵
  PID:6700
- C:\Windows\System\wObXhxY.exe
  C:\Windows\System\wObXhxY.exe
  2⤵
  PID:6728
- C:\Windows\System\tRgGzeG.exe
  C:\Windows\System\tRgGzeG.exe
  2⤵
  PID:6756
- C:\Windows\System\MWMInBa.exe
  C:\Windows\System\MWMInBa.exe
  2⤵
  PID:6784
- C:\Windows\System\KnhrdEK.exe
  C:\Windows\System\KnhrdEK.exe
  2⤵
  PID:6800
- C:\Windows\System\bUFkHae.exe
  C:\Windows\System\bUFkHae.exe
  2⤵
  PID:6832
- C:\Windows\System\UQKAQEx.exe
  C:\Windows\System\UQKAQEx.exe
  2⤵
  PID:6852
- C:\Windows\System\ySQsIVD.exe
  C:\Windows\System\ySQsIVD.exe
  2⤵
  PID:6888
- C:\Windows\System\nRfIYPX.exe
  C:\Windows\System\nRfIYPX.exe
  2⤵
  PID:6916
- C:\Windows\System\IPuThlK.exe
  C:\Windows\System\IPuThlK.exe
  2⤵
  PID:6956
- C:\Windows\System\TphHHGC.exe
  C:\Windows\System\TphHHGC.exe
  2⤵
  PID:6972
- C:\Windows\System\sKOnMek.exe
  C:\Windows\System\sKOnMek.exe
  2⤵
  PID:7012
- C:\Windows\System\iqvdyAj.exe
  C:\Windows\System\iqvdyAj.exe
  2⤵
  PID:7032
- C:\Windows\System\DFteKXD.exe
  C:\Windows\System\DFteKXD.exe
  2⤵
  PID:7056
- C:\Windows\System\MLjvLfZ.exe
  C:\Windows\System\MLjvLfZ.exe
  2⤵
  PID:7092
- C:\Windows\System\UHYPLuk.exe
  C:\Windows\System\UHYPLuk.exe
  2⤵
  PID:7108
- C:\Windows\System\UheInuf.exe
  C:\Windows\System\UheInuf.exe
  2⤵
  PID:7136
- C:\Windows\System\VgDUgRO.exe
  C:\Windows\System\VgDUgRO.exe
  2⤵
  PID:6152
- C:\Windows\System\gYiLBTv.exe
  C:\Windows\System\gYiLBTv.exe
  2⤵
  PID:6244
- C:\Windows\System\ApLlRfh.exe
  C:\Windows\System\ApLlRfh.exe
  2⤵
  PID:6296
- C:\Windows\System\rSOsOuY.exe
  C:\Windows\System\rSOsOuY.exe
  2⤵
  PID:6336
- C:\Windows\System\LjSpwXT.exe
  C:\Windows\System\LjSpwXT.exe
  2⤵
  PID:6416
- C:\Windows\System\aeYdaAY.exe
  C:\Windows\System\aeYdaAY.exe
  2⤵
  PID:6520
- C:\Windows\System\VYHDrUK.exe
  C:\Windows\System\VYHDrUK.exe
  2⤵
  PID:6580
- C:\Windows\System\uTTwQhv.exe
  C:\Windows\System\uTTwQhv.exe
  2⤵
  PID:6608
- C:\Windows\System\MQsgHtk.exe
  C:\Windows\System\MQsgHtk.exe
  2⤵
  PID:6688
- C:\Windows\System\BTJqPSp.exe
  C:\Windows\System\BTJqPSp.exe
  2⤵
  PID:6752
- C:\Windows\System\DZcFexH.exe
  C:\Windows\System\DZcFexH.exe
  2⤵
  PID:6820
- C:\Windows\System\afpJVnc.exe
  C:\Windows\System\afpJVnc.exe
  2⤵
  PID:6872
- C:\Windows\System\AjdHqRB.exe
  C:\Windows\System\AjdHqRB.exe
  2⤵
  PID:6952
- C:\Windows\System\GwWzCrU.exe
  C:\Windows\System\GwWzCrU.exe
  2⤵
  PID:7020
- C:\Windows\System\SHetlaU.exe
  C:\Windows\System\SHetlaU.exe
  2⤵
  PID:7104
- C:\Windows\System\UMSTozg.exe
  C:\Windows\System\UMSTozg.exe
  2⤵
  PID:7164
- C:\Windows\System\jwwGXll.exe
  C:\Windows\System\jwwGXll.exe
  2⤵
  PID:6184
- C:\Windows\System\SKKZrmY.exe
  C:\Windows\System\SKKZrmY.exe
  2⤵
  PID:6368
- C:\Windows\System\KQGtFFB.exe
  C:\Windows\System\KQGtFFB.exe
  2⤵
  PID:6572
- C:\Windows\System\SWWnIro.exe
  C:\Windows\System\SWWnIro.exe
  2⤵
  PID:6640
- C:\Windows\System\GfdwqDh.exe
  C:\Windows\System\GfdwqDh.exe
  2⤵
  PID:6816
- C:\Windows\System\auNtWHo.exe
  C:\Windows\System\auNtWHo.exe
  2⤵
  PID:6992
- C:\Windows\System\hxiLKng.exe
  C:\Windows\System\hxiLKng.exe
  2⤵
  PID:6192
- C:\Windows\System\OZewssa.exe
  C:\Windows\System\OZewssa.exe
  2⤵
  PID:6456
- C:\Windows\System\AifISYL.exe
  C:\Windows\System\AifISYL.exe
  2⤵
  PID:6928
- C:\Windows\System\lbniUPc.exe
  C:\Windows\System\lbniUPc.exe
  2⤵
  PID:7068
- C:\Windows\System\UsCVjoc.exe
  C:\Windows\System\UsCVjoc.exe
  2⤵
  PID:6604
- C:\Windows\System\fmMNsAu.exe
  C:\Windows\System\fmMNsAu.exe
  2⤵
  PID:7180
- C:\Windows\System\GoTYysN.exe
  C:\Windows\System\GoTYysN.exe
  2⤵
  PID:7208
- C:\Windows\System\yNxEqAz.exe
  C:\Windows\System\yNxEqAz.exe
  2⤵
  PID:7236
- C:\Windows\System\xyBNWAT.exe
  C:\Windows\System\xyBNWAT.exe
  2⤵
  PID:7272
- C:\Windows\System\dNmBfFC.exe
  C:\Windows\System\dNmBfFC.exe
  2⤵
  PID:7292
- C:\Windows\System\dsuoDuo.exe
  C:\Windows\System\dsuoDuo.exe
  2⤵
  PID:7328
- C:\Windows\System\ijNdepq.exe
  C:\Windows\System\ijNdepq.exe
  2⤵
  PID:7356
- C:\Windows\System\FCmbHlf.exe
  C:\Windows\System\FCmbHlf.exe
  2⤵
  PID:7372
- C:\Windows\System\plsmKgB.exe
  C:\Windows\System\plsmKgB.exe
  2⤵
  PID:7412
- C:\Windows\System\ngchVZC.exe
  C:\Windows\System\ngchVZC.exe
  2⤵
  PID:7428
- C:\Windows\System\oBAVnkv.exe
  C:\Windows\System\oBAVnkv.exe
  2⤵
  PID:7448
- C:\Windows\System\ehekkDf.exe
  C:\Windows\System\ehekkDf.exe
  2⤵
  PID:7484
- C:\Windows\System\AgWsXLM.exe
  C:\Windows\System\AgWsXLM.exe
  2⤵
  PID:7524
- C:\Windows\System\IiDvlOF.exe
  C:\Windows\System\IiDvlOF.exe
  2⤵
  PID:7540
- C:\Windows\System\GdPDIPF.exe
  C:\Windows\System\GdPDIPF.exe
  2⤵
  PID:7576
- C:\Windows\System\RewZTtW.exe
  C:\Windows\System\RewZTtW.exe
  2⤵
  PID:7608
- C:\Windows\System\bwlOTyR.exe
  C:\Windows\System\bwlOTyR.exe
  2⤵
  PID:7636
- C:\Windows\System\fljgyjg.exe
  C:\Windows\System\fljgyjg.exe
  2⤵
  PID:7664
- C:\Windows\System\tCoAnkH.exe
  C:\Windows\System\tCoAnkH.exe
  2⤵
  PID:7692
- C:\Windows\System\dDqBAEH.exe
  C:\Windows\System\dDqBAEH.exe
  2⤵
  PID:7716
- C:\Windows\System\PYTySYy.exe
  C:\Windows\System\PYTySYy.exe
  2⤵
  PID:7736
- C:\Windows\System\WIcPKbi.exe
  C:\Windows\System\WIcPKbi.exe
  2⤵
  PID:7776
- C:\Windows\System\GXEVwId.exe
  C:\Windows\System\GXEVwId.exe
  2⤵
  PID:7792
- C:\Windows\System\zkGWEtj.exe
  C:\Windows\System\zkGWEtj.exe
  2⤵
  PID:7820
- C:\Windows\System\PGirOBl.exe
  C:\Windows\System\PGirOBl.exe
  2⤵
  PID:7848
- C:\Windows\System\DaHFVSC.exe
  C:\Windows\System\DaHFVSC.exe
  2⤵
  PID:7876
- C:\Windows\System\TRCEyFh.exe
  C:\Windows\System\TRCEyFh.exe
  2⤵
  PID:7912
- C:\Windows\System\BxzISFG.exe
  C:\Windows\System\BxzISFG.exe
  2⤵
  PID:7932
- C:\Windows\System\CZlyuve.exe
  C:\Windows\System\CZlyuve.exe
  2⤵
  PID:7960
- C:\Windows\System\AqHkHrj.exe
  C:\Windows\System\AqHkHrj.exe
  2⤵
  PID:7988
- C:\Windows\System\WxrPMhd.exe
  C:\Windows\System\WxrPMhd.exe
  2⤵
  PID:8024
- C:\Windows\System\tJeIvop.exe
  C:\Windows\System\tJeIvop.exe
  2⤵
  PID:8056
- C:\Windows\System\coOEYMe.exe
  C:\Windows\System\coOEYMe.exe
  2⤵
  PID:8084
- C:\Windows\System\QubPdWo.exe
  C:\Windows\System\QubPdWo.exe
  2⤵
  PID:8100
- C:\Windows\System\pbBDcMu.exe
  C:\Windows\System\pbBDcMu.exe
  2⤵
  PID:8132
- C:\Windows\System\PYkbMes.exe
  C:\Windows\System\PYkbMes.exe
  2⤵
  PID:8160
- C:\Windows\System\ARfAdmg.exe
  C:\Windows\System\ARfAdmg.exe
  2⤵
  PID:7172
- C:\Windows\System\bgqHxzT.exe
  C:\Windows\System\bgqHxzT.exe
  2⤵
  PID:7232
- C:\Windows\System\xhlgtvM.exe
  C:\Windows\System\xhlgtvM.exe
  2⤵
  PID:7288
- C:\Windows\System\QChnzJy.exe
  C:\Windows\System\QChnzJy.exe
  2⤵
  PID:7348
- C:\Windows\System\tOrYYjo.exe
  C:\Windows\System\tOrYYjo.exe
  2⤵
  PID:7396
- C:\Windows\System\kCGQknd.exe
  C:\Windows\System\kCGQknd.exe
  2⤵
  PID:7452
- C:\Windows\System\qXFfKFi.exe
  C:\Windows\System\qXFfKFi.exe
  2⤵
  PID:7536
- C:\Windows\System\taPjfAD.exe
  C:\Windows\System\taPjfAD.exe
  2⤵
  PID:7596
- C:\Windows\System\cPnJFxE.exe
  C:\Windows\System\cPnJFxE.exe
  2⤵
  PID:7676
- C:\Windows\System\ZgvIUav.exe
  C:\Windows\System\ZgvIUav.exe
  2⤵
  PID:7748
- C:\Windows\System\hpdnOXZ.exe
  C:\Windows\System\hpdnOXZ.exe
  2⤵
  PID:7812
- C:\Windows\System\KoxIjpi.exe
  C:\Windows\System\KoxIjpi.exe
  2⤵
  PID:7900
- C:\Windows\System\GsZUIPp.exe
  C:\Windows\System\GsZUIPp.exe
  2⤵
  PID:7928
- C:\Windows\System\tHDcfUb.exe
  C:\Windows\System\tHDcfUb.exe
  2⤵
  PID:8016
- C:\Windows\System\MCYIsFl.exe
  C:\Windows\System\MCYIsFl.exe
  2⤵
  PID:8076
- C:\Windows\System\QbtPDYS.exe
  C:\Windows\System\QbtPDYS.exe
  2⤵
  PID:8184
- C:\Windows\System\raSvSDt.exe
  C:\Windows\System\raSvSDt.exe
  2⤵
  PID:8156
- C:\Windows\System\uTLYKhA.exe
  C:\Windows\System\uTLYKhA.exe
  2⤵
  PID:6568
- C:\Windows\System\fgNhcyV.exe
  C:\Windows\System\fgNhcyV.exe
  2⤵
  PID:7492
- C:\Windows\System\cdaejul.exe
  C:\Windows\System\cdaejul.exe
  2⤵
  PID:7632
- C:\Windows\System\UJNxJiG.exe
  C:\Windows\System\UJNxJiG.exe
  2⤵
  PID:7764
- C:\Windows\System\bvXtLSG.exe
  C:\Windows\System\bvXtLSG.exe
  2⤵
  PID:7892
- C:\Windows\System\hwUfVfE.exe
  C:\Windows\System\hwUfVfE.exe
  2⤵
  PID:8068
- C:\Windows\System\yLZeXeR.exe
  C:\Windows\System\yLZeXeR.exe
  2⤵
  PID:7268
- C:\Windows\System\ooZOiFs.exe
  C:\Windows\System\ooZOiFs.exe
  2⤵
  PID:7564
- C:\Windows\System\igdJYCG.exe
  C:\Windows\System\igdJYCG.exe
  2⤵
  PID:8044
- C:\Windows\System\CtydwSc.exe
  C:\Windows\System\CtydwSc.exe
  2⤵
  PID:7684
- C:\Windows\System\rJtYQMJ.exe
  C:\Windows\System\rJtYQMJ.exe
  2⤵
  PID:7340
- C:\Windows\System\OrzmlLS.exe
  C:\Windows\System\OrzmlLS.exe
  2⤵
  PID:8212
- C:\Windows\System\bDbumkh.exe
  C:\Windows\System\bDbumkh.exe
  2⤵
  PID:8228
- C:\Windows\System\GclUrpf.exe
  C:\Windows\System\GclUrpf.exe
  2⤵
  PID:8256
- C:\Windows\System\vALSZpC.exe
  C:\Windows\System\vALSZpC.exe
  2⤵
  PID:8284
- C:\Windows\System\aGmCTXk.exe
  C:\Windows\System\aGmCTXk.exe
  2⤵
  PID:8324
- C:\Windows\System\TlcpiaB.exe
  C:\Windows\System\TlcpiaB.exe
  2⤵
  PID:8344
- C:\Windows\System\KhOTHbj.exe
  C:\Windows\System\KhOTHbj.exe
  2⤵
  PID:8392
- C:\Windows\System\gJNGFLX.exe
  C:\Windows\System\gJNGFLX.exe
  2⤵
  PID:8412
- C:\Windows\System\zCgXpHY.exe
  C:\Windows\System\zCgXpHY.exe
  2⤵
  PID:8448
- C:\Windows\System\SeIeUxZ.exe
  C:\Windows\System\SeIeUxZ.exe
  2⤵
  PID:8476
- C:\Windows\System\QbohpDo.exe
  C:\Windows\System\QbohpDo.exe
  2⤵
  PID:8504
- C:\Windows\System\MWGUWvy.exe
  C:\Windows\System\MWGUWvy.exe
  2⤵
  PID:8520
- C:\Windows\System\hwamIco.exe
  C:\Windows\System\hwamIco.exe
  2⤵
  PID:8556
- C:\Windows\System\gSXXeEe.exe
  C:\Windows\System\gSXXeEe.exe
  2⤵
  PID:8576
- C:\Windows\System\Fqnimev.exe
  C:\Windows\System\Fqnimev.exe
  2⤵
  PID:8604
- C:\Windows\System\ZrPePMo.exe
  C:\Windows\System\ZrPePMo.exe
  2⤵
  PID:8636
- C:\Windows\System\cLuglWb.exe
  C:\Windows\System\cLuglWb.exe
  2⤵
  PID:8660
- C:\Windows\System\gUSWfAG.exe
  C:\Windows\System\gUSWfAG.exe
  2⤵
  PID:8688
- C:\Windows\System\SozVBSG.exe
  C:\Windows\System\SozVBSG.exe
  2⤵
  PID:8724
- C:\Windows\System\aDuYqfJ.exe
  C:\Windows\System\aDuYqfJ.exe
  2⤵
  PID:8756
- C:\Windows\System\zPOwPvn.exe
  C:\Windows\System\zPOwPvn.exe
  2⤵
  PID:8784
- C:\Windows\System\Wtrafld.exe
  C:\Windows\System\Wtrafld.exe
  2⤵
  PID:8800
- C:\Windows\System\MqVLuqC.exe
  C:\Windows\System\MqVLuqC.exe
  2⤵
  PID:8832
- C:\Windows\System\VojDZbh.exe
  C:\Windows\System\VojDZbh.exe
  2⤵
  PID:8856
- C:\Windows\System\glQRlhy.exe
  C:\Windows\System\glQRlhy.exe
  2⤵
  PID:8884
- C:\Windows\System\CAKRocp.exe
  C:\Windows\System\CAKRocp.exe
  2⤵
  PID:8900
- C:\Windows\System\bRsIIwG.exe
  C:\Windows\System\bRsIIwG.exe
  2⤵
  PID:8932
- C:\Windows\System\zeuDRwZ.exe
  C:\Windows\System\zeuDRwZ.exe
  2⤵
  PID:8972
- C:\Windows\System\gYdZQZu.exe
  C:\Windows\System\gYdZQZu.exe
  2⤵
  PID:9008
- C:\Windows\System\YoaStat.exe
  C:\Windows\System\YoaStat.exe
  2⤵
  PID:9036
- C:\Windows\System\ANWxbYq.exe
  C:\Windows\System\ANWxbYq.exe
  2⤵
  PID:9052
- C:\Windows\System\UsgtSKu.exe
  C:\Windows\System\UsgtSKu.exe
  2⤵
  PID:9080
- C:\Windows\System\xnlFnnb.exe
  C:\Windows\System\xnlFnnb.exe
  2⤵
  PID:9116
- C:\Windows\System\YNMGyYE.exe
  C:\Windows\System\YNMGyYE.exe
  2⤵
  PID:9132
- C:\Windows\System\gSyrpJQ.exe
  C:\Windows\System\gSyrpJQ.exe
  2⤵
  PID:9152
- C:\Windows\System\lWcNQRu.exe
  C:\Windows\System\lWcNQRu.exe
  2⤵
  PID:9176
- C:\Windows\System\pgvArMF.exe
  C:\Windows\System\pgvArMF.exe
  2⤵
  PID:9208
- C:\Windows\System\uXIyaNF.exe
  C:\Windows\System\uXIyaNF.exe
  2⤵
  PID:8244
- C:\Windows\System\aTQXXLL.exe
  C:\Windows\System\aTQXXLL.exe
  2⤵
  PID:8300
- C:\Windows\System\yFpqJsk.exe
  C:\Windows\System\yFpqJsk.exe
  2⤵
  PID:8352
- C:\Windows\System\brxmYvZ.exe
  C:\Windows\System\brxmYvZ.exe
  2⤵
  PID:8440
- C:\Windows\System\uXqYKaW.exe
  C:\Windows\System\uXqYKaW.exe
  2⤵
  PID:8496
- C:\Windows\System\fyIVdOY.exe
  C:\Windows\System\fyIVdOY.exe
  2⤵
  PID:8568
- C:\Windows\System\KRAaBEI.exe
  C:\Windows\System\KRAaBEI.exe
  2⤵
  PID:8656
- C:\Windows\System\cnxvyqa.exe
  C:\Windows\System\cnxvyqa.exe
  2⤵
  PID:8716
- C:\Windows\System\UPkVBEH.exe
  C:\Windows\System\UPkVBEH.exe
  2⤵
  PID:8792
- C:\Windows\System\tcRioKI.exe
  C:\Windows\System\tcRioKI.exe
  2⤵
  PID:8848
- C:\Windows\System\qOoHlqZ.exe
  C:\Windows\System\qOoHlqZ.exe
  2⤵
  PID:8912
- C:\Windows\System\VidOabv.exe
  C:\Windows\System\VidOabv.exe
  2⤵
  PID:8960
- C:\Windows\System\bvZvdKs.exe
  C:\Windows\System\bvZvdKs.exe
  2⤵
  PID:9048
- C:\Windows\System\vgJleXn.exe
  C:\Windows\System\vgJleXn.exe
  2⤵
  PID:9092
- C:\Windows\System\tgDTRsn.exe
  C:\Windows\System\tgDTRsn.exe
  2⤵
  PID:9148
- C:\Windows\System\EbdKUFC.exe
  C:\Windows\System\EbdKUFC.exe
  2⤵
  PID:9188
- C:\Windows\System\yuaJlnH.exe
  C:\Windows\System\yuaJlnH.exe
  2⤵
  PID:8336
- C:\Windows\System\lUUvLFh.exe
  C:\Windows\System\lUUvLFh.exe
  2⤵
  PID:8400
- C:\Windows\System\cNYQjsF.exe
  C:\Windows\System\cNYQjsF.exe
  2⤵
  PID:8500
- C:\Windows\System\RihoNLi.exe
  C:\Windows\System\RihoNLi.exe
  2⤵
  PID:8700
- C:\Windows\System\cxbvdwm.exe
  C:\Windows\System\cxbvdwm.exe
  2⤵
  PID:8776
- C:\Windows\System\KiOZlpp.exe
  C:\Windows\System\KiOZlpp.exe
  2⤵
  PID:9072
- C:\Windows\System\qfontZp.exe
  C:\Windows\System\qfontZp.exe
  2⤵
  PID:9200
- C:\Windows\System\pbKJkIG.exe
  C:\Windows\System\pbKJkIG.exe
  2⤵
  PID:8532
- C:\Windows\System\eCabSCS.exe
  C:\Windows\System\eCabSCS.exe
  2⤵
  PID:8980
- C:\Windows\System\uJZfWsb.exe
  C:\Windows\System\uJZfWsb.exe
  2⤵
  PID:9064
- C:\Windows\System\LdLHJSv.exe
  C:\Windows\System\LdLHJSv.exe
  2⤵
  PID:8616
- C:\Windows\System\JpjuGqZ.exe
  C:\Windows\System\JpjuGqZ.exe
  2⤵
  PID:9232
- C:\Windows\System\PCTCsIY.exe
  C:\Windows\System\PCTCsIY.exe
  2⤵
  PID:9268
- C:\Windows\System\LTYFMnP.exe
  C:\Windows\System\LTYFMnP.exe
  2⤵
  PID:9300
- C:\Windows\System\tCaxFJD.exe
  C:\Windows\System\tCaxFJD.exe
  2⤵
  PID:9336
- C:\Windows\System\kTWQXHa.exe
  C:\Windows\System\kTWQXHa.exe
  2⤵
  PID:9356
- C:\Windows\System\vWRudwr.exe
  C:\Windows\System\vWRudwr.exe
  2⤵
  PID:9372
- C:\Windows\System\PITrZcG.exe
  C:\Windows\System\PITrZcG.exe
  2⤵
  PID:9400
- C:\Windows\System\NgbZXTT.exe
  C:\Windows\System\NgbZXTT.exe
  2⤵
  PID:9448
- C:\Windows\System\tbUKqYF.exe
  C:\Windows\System\tbUKqYF.exe
  2⤵
  PID:9480
- C:\Windows\System\CqoJpUP.exe
  C:\Windows\System\CqoJpUP.exe
  2⤵
  PID:9508
- C:\Windows\System\rMvxSGv.exe
  C:\Windows\System\rMvxSGv.exe
  2⤵
  PID:9528
- C:\Windows\System\uYjOfqY.exe
  C:\Windows\System\uYjOfqY.exe
  2⤵
  PID:9564
- C:\Windows\System\rAGogdI.exe
  C:\Windows\System\rAGogdI.exe
  2⤵
  PID:9592
- C:\Windows\System\qYGYSLs.exe
  C:\Windows\System\qYGYSLs.exe
  2⤵
  PID:9608
- C:\Windows\System\fHjsLBD.exe
  C:\Windows\System\fHjsLBD.exe
  2⤵
  PID:9636
- C:\Windows\System\SriztMz.exe
  C:\Windows\System\SriztMz.exe
  2⤵
  PID:9672
- C:\Windows\System\pDrFRRT.exe
  C:\Windows\System\pDrFRRT.exe
  2⤵
  PID:9704
- C:\Windows\System\hVSOWzp.exe
  C:\Windows\System\hVSOWzp.exe
  2⤵
  PID:9732
- C:\Windows\System\EVNiCRn.exe
  C:\Windows\System\EVNiCRn.exe
  2⤵
  PID:9760
- C:\Windows\System\vBQNBdd.exe
  C:\Windows\System\vBQNBdd.exe
  2⤵
  PID:9776
- C:\Windows\System\VSkiGcs.exe
  C:\Windows\System\VSkiGcs.exe
  2⤵
  PID:9804
- C:\Windows\System\TaJhDNd.exe
  C:\Windows\System\TaJhDNd.exe
  2⤵
  PID:9828
- C:\Windows\System\dCiOpmN.exe
  C:\Windows\System\dCiOpmN.exe
  2⤵
  PID:9864
- C:\Windows\System\ksXxuug.exe
  C:\Windows\System\ksXxuug.exe
  2⤵
  PID:9888
- C:\Windows\System\xGqmdQG.exe
  C:\Windows\System\xGqmdQG.exe
  2⤵
  PID:9924
- C:\Windows\System\JwFPRKW.exe
  C:\Windows\System\JwFPRKW.exe
  2⤵
  PID:9956
- C:\Windows\System\sLxQRsn.exe
  C:\Windows\System\sLxQRsn.exe
  2⤵
  PID:9984
- C:\Windows\System\tpSTihi.exe
  C:\Windows\System\tpSTihi.exe
  2⤵
  PID:10012
- C:\Windows\System\LKQjugf.exe
  C:\Windows\System\LKQjugf.exe
  2⤵
  PID:10028
- C:\Windows\System\fSxEjmP.exe
  C:\Windows\System\fSxEjmP.exe
  2⤵
  PID:10056
- C:\Windows\System\qvuaEem.exe
  C:\Windows\System\qvuaEem.exe
  2⤵
  PID:10088
- C:\Windows\System\NGhKpLp.exe
  C:\Windows\System\NGhKpLp.exe
  2⤵
  PID:10112
- C:\Windows\System\CghzTlX.exe
  C:\Windows\System\CghzTlX.exe
  2⤵
  PID:10140
- C:\Windows\System\MdnHgVq.exe
  C:\Windows\System\MdnHgVq.exe
  2⤵
  PID:10180
- C:\Windows\System\EwuYVTK.exe
  C:\Windows\System\EwuYVTK.exe
  2⤵
  PID:10208
- C:\Windows\System\LBuGArK.exe
  C:\Windows\System\LBuGArK.exe
  2⤵
  PID:10224
- C:\Windows\System\dfegdOI.exe
  C:\Windows\System\dfegdOI.exe
  2⤵
  PID:9224
- C:\Windows\System\DpoZWVA.exe
  C:\Windows\System\DpoZWVA.exe
  2⤵
  PID:9248
- C:\Windows\System\SePwupC.exe
  C:\Windows\System\SePwupC.exe
  2⤵
  PID:9352
- C:\Windows\System\xfZFrMj.exe
  C:\Windows\System\xfZFrMj.exe
  2⤵
  PID:9412
- C:\Windows\System\JKYeqqS.exe
  C:\Windows\System\JKYeqqS.exe
  2⤵
  PID:9472
- C:\Windows\System\axmShFJ.exe
  C:\Windows\System\axmShFJ.exe
  2⤵
  PID:9524
- C:\Windows\System\mVtnowC.exe
  C:\Windows\System\mVtnowC.exe
  2⤵
  PID:9604
- C:\Windows\System\iCpzIie.exe
  C:\Windows\System\iCpzIie.exe
  2⤵
  PID:9716
- C:\Windows\System\uKNsDVV.exe
  C:\Windows\System\uKNsDVV.exe
  2⤵
  PID:9752
- C:\Windows\System\dtIdZIX.exe
  C:\Windows\System\dtIdZIX.exe
  2⤵
  PID:9788
- C:\Windows\System\RkCGzpK.exe
  C:\Windows\System\RkCGzpK.exe
  2⤵
  PID:9880
- C:\Windows\System\xQtmVBc.exe
  C:\Windows\System\xQtmVBc.exe
  2⤵
  PID:9940
- C:\Windows\System\AMbJUCd.exe
  C:\Windows\System\AMbJUCd.exe
  2⤵
  PID:10040
- C:\Windows\System\EsPAwfP.exe
  C:\Windows\System\EsPAwfP.exe
  2⤵
  PID:10076
- C:\Windows\System\YQYDjrt.exe
  C:\Windows\System\YQYDjrt.exe
  2⤵
  PID:10172
- C:\Windows\System\qurJxMy.exe
  C:\Windows\System\qurJxMy.exe
  2⤵
  PID:10232
- C:\Windows\System\izGyCsj.exe
  C:\Windows\System\izGyCsj.exe
  2⤵
  PID:9240
- C:\Windows\System\hEfCzhK.exe
  C:\Windows\System\hEfCzhK.exe
  2⤵
  PID:9396
- C:\Windows\System\aEHfoXw.exe
  C:\Windows\System\aEHfoXw.exe
  2⤵
  PID:9664
- C:\Windows\System\mNFqITm.exe
  C:\Windows\System\mNFqITm.exe
  2⤵
  PID:9744
- C:\Windows\System\hrKihsl.exe
  C:\Windows\System\hrKihsl.exe
  2⤵
  PID:9916
- C:\Windows\System\xnKgFJF.exe
  C:\Windows\System\xnKgFJF.exe
  2⤵
  PID:10020
- C:\Windows\System\pCGfwvX.exe
  C:\Windows\System\pCGfwvX.exe
  2⤵
  PID:10136
- C:\Windows\System\CAFvguj.exe
  C:\Windows\System\CAFvguj.exe
  2⤵
  PID:9420
- C:\Windows\System\jVfwBnp.exe
  C:\Windows\System\jVfwBnp.exe
  2⤵
  PID:9792
- C:\Windows\System\vLCpbfL.exe
  C:\Windows\System\vLCpbfL.exe
  2⤵
  PID:9964
- C:\Windows\System\pJlmJRc.exe
  C:\Windows\System\pJlmJRc.exe
  2⤵
  PID:9660
- C:\Windows\System\gdDeyFe.exe
  C:\Windows\System\gdDeyFe.exe
  2⤵
  PID:9280
- C:\Windows\System\ckscSnG.exe
  C:\Windows\System\ckscSnG.exe
  2⤵
  PID:10264
- C:\Windows\System\jHQJfXK.exe
  C:\Windows\System\jHQJfXK.exe
  2⤵
  PID:10296
- C:\Windows\System\zINZcWP.exe
  C:\Windows\System\zINZcWP.exe
  2⤵
  PID:10328
- C:\Windows\System\HWmDqpD.exe
  C:\Windows\System\HWmDqpD.exe
  2⤵
  PID:10360
- C:\Windows\System\sXfaysU.exe
  C:\Windows\System\sXfaysU.exe
  2⤵
  PID:10380
- C:\Windows\System\NlBwLye.exe
  C:\Windows\System\NlBwLye.exe
  2⤵
  PID:10404
- C:\Windows\System\uzxdhIL.exe
  C:\Windows\System\uzxdhIL.exe
  2⤵
  PID:10432
- C:\Windows\System\PKzUJjs.exe
  C:\Windows\System\PKzUJjs.exe
  2⤵
  PID:10460
- C:\Windows\System\jadncNx.exe
  C:\Windows\System\jadncNx.exe
  2⤵
  PID:10492
- C:\Windows\System\ImJjzqL.exe
  C:\Windows\System\ImJjzqL.exe
  2⤵
  PID:10516
- C:\Windows\System\KUEGvrG.exe
  C:\Windows\System\KUEGvrG.exe
  2⤵
  PID:10548
- C:\Windows\System\sPkOBcA.exe
  C:\Windows\System\sPkOBcA.exe
  2⤵
  PID:10572
- C:\Windows\System\EeTtFYN.exe
  C:\Windows\System\EeTtFYN.exe
  2⤵
  PID:10600
- C:\Windows\System\GarJWfb.exe
  C:\Windows\System\GarJWfb.exe
  2⤵
  PID:10620
- C:\Windows\System\geNUkwq.exe
  C:\Windows\System\geNUkwq.exe
  2⤵
  PID:10668
- C:\Windows\System\tiDUUVj.exe
  C:\Windows\System\tiDUUVj.exe
  2⤵
  PID:10692
- C:\Windows\System\OphjnQa.exe
  C:\Windows\System\OphjnQa.exe
  2⤵
  PID:10720
- C:\Windows\System\inTonKI.exe
  C:\Windows\System\inTonKI.exe
  2⤵
  PID:10748
- C:\Windows\System\UBawcJH.exe
  C:\Windows\System\UBawcJH.exe
  2⤵
  PID:10792
- C:\Windows\System\gURcmWD.exe
  C:\Windows\System\gURcmWD.exe
  2⤵
  PID:10820
- C:\Windows\System\gTcMilq.exe
  C:\Windows\System\gTcMilq.exe
  2⤵
  PID:10840
- C:\Windows\System\KRZlDCV.exe
  C:\Windows\System\KRZlDCV.exe
  2⤵
  PID:10864
- C:\Windows\System\WzwnySj.exe
  C:\Windows\System\WzwnySj.exe
  2⤵
  PID:10892
- C:\Windows\System\UzRPqpX.exe
  C:\Windows\System\UzRPqpX.exe
  2⤵
  PID:10908
- C:\Windows\System\KtpwTng.exe
  C:\Windows\System\KtpwTng.exe
  2⤵
  PID:10944
- C:\Windows\System\QBSXkby.exe
  C:\Windows\System\QBSXkby.exe
  2⤵
  PID:10976
- C:\Windows\System\vRtpmpp.exe
  C:\Windows\System\vRtpmpp.exe
  2⤵
  PID:11008
- C:\Windows\System\LkrWQuO.exe
  C:\Windows\System\LkrWQuO.exe
  2⤵
  PID:11032
- C:\Windows\System\sbiuvoo.exe
  C:\Windows\System\sbiuvoo.exe
  2⤵
  PID:11052
- C:\Windows\System\PWWxYDa.exe
  C:\Windows\System\PWWxYDa.exe
  2⤵
  PID:11080
- C:\Windows\System\LWicGjF.exe
  C:\Windows\System\LWicGjF.exe
  2⤵
  PID:11116
- C:\Windows\System\QzxXwYI.exe
  C:\Windows\System\QzxXwYI.exe
  2⤵
  PID:11144
- C:\Windows\System\TFilVyd.exe
  C:\Windows\System\TFilVyd.exe
  2⤵
  PID:11168
- C:\Windows\System\ILOnomL.exe
  C:\Windows\System\ILOnomL.exe
  2⤵
  PID:11200
- C:\Windows\System\TlAAJrl.exe
  C:\Windows\System\TlAAJrl.exe
  2⤵
  PID:11228
- C:\Windows\System\MNsZXYq.exe
  C:\Windows\System\MNsZXYq.exe
  2⤵
  PID:11244
- C:\Windows\System\BkbMvKz.exe
  C:\Windows\System\BkbMvKz.exe
  2⤵
  PID:3760
- C:\Windows\System\hObpqbn.exe
  C:\Windows\System\hObpqbn.exe
  2⤵
  PID:10276
- C:\Windows\System\FnbDmny.exe
  C:\Windows\System\FnbDmny.exe
  2⤵
  PID:10344
- C:\Windows\System\WhyQgBy.exe
  C:\Windows\System\WhyQgBy.exe
  2⤵
  PID:10400
- C:\Windows\System\uhrstMp.exe
  C:\Windows\System\uhrstMp.exe
  2⤵
  PID:10508
- C:\Windows\System\bMQHWai.exe
  C:\Windows\System\bMQHWai.exe
  2⤵
  PID:10504
- C:\Windows\System\DPuxPEh.exe
  C:\Windows\System\DPuxPEh.exe
  2⤵
  PID:10636
- C:\Windows\System\xTuLRso.exe
  C:\Windows\System\xTuLRso.exe
  2⤵
  PID:10680
- C:\Windows\System\BgAqrcA.exe
  C:\Windows\System\BgAqrcA.exe
  2⤵
  PID:10756
- C:\Windows\System\kXDidYk.exe
  C:\Windows\System\kXDidYk.exe
  2⤵
  PID:10804
- C:\Windows\System\cBExjCX.exe
  C:\Windows\System\cBExjCX.exe
  2⤵
  PID:10880
- C:\Windows\System\ddqZCss.exe
  C:\Windows\System\ddqZCss.exe
  2⤵
  PID:10992
- C:\Windows\System\zYNndPl.exe
  C:\Windows\System\zYNndPl.exe
  2⤵
  PID:11072
- C:\Windows\System\dOeXOEI.exe
  C:\Windows\System\dOeXOEI.exe
  2⤵
  PID:11160
- C:\Windows\System\LoqEows.exe
  C:\Windows\System\LoqEows.exe
  2⤵
  PID:11192
- C:\Windows\System\CinFzHI.exe
  C:\Windows\System\CinFzHI.exe
  2⤵
  PID:10256
- C:\Windows\System\KKuSbXZ.exe
  C:\Windows\System\KKuSbXZ.exe
  2⤵
  PID:10452
- C:\Windows\System\YxuIgcX.exe
  C:\Windows\System\YxuIgcX.exe
  2⤵
  PID:10448
- C:\Windows\System\SuwOuIy.exe
  C:\Windows\System\SuwOuIy.exe
  2⤵
  PID:10688
- C:\Windows\System\qjsNkob.exe
  C:\Windows\System\qjsNkob.exe
  2⤵
  PID:10900
- C:\Windows\System\GmDtsYb.exe
  C:\Windows\System\GmDtsYb.exe
  2⤵
  PID:10964
- C:\Windows\System\hSHTWSO.exe
  C:\Windows\System\hSHTWSO.exe
  2⤵
  PID:11088
- C:\Windows\System\pVGlWnZ.exe
  C:\Windows\System\pVGlWnZ.exe
  2⤵
  PID:11256
- C:\Windows\System\VKFxiew.exe
  C:\Windows\System\VKFxiew.exe
  2⤵
  PID:10568
- C:\Windows\System\KuiGigk.exe
  C:\Windows\System\KuiGigk.exe
  2⤵
  PID:10832
- C:\Windows\System\SPISIoQ.exe
  C:\Windows\System\SPISIoQ.exe
  2⤵
  PID:11236
- C:\Windows\System\tzSoeSI.exe
  C:\Windows\System\tzSoeSI.exe
  2⤵
  PID:10712
- C:\Windows\System\QHqxCEB.exe
  C:\Windows\System\QHqxCEB.exe
  2⤵
  PID:10420
- C:\Windows\System\jMlcvUi.exe
  C:\Windows\System\jMlcvUi.exe
  2⤵
  PID:11296
- C:\Windows\System\TRpBIFa.exe
  C:\Windows\System\TRpBIFa.exe
  2⤵
  PID:11320
- C:\Windows\System\UFsegOU.exe
  C:\Windows\System\UFsegOU.exe
  2⤵
  PID:11348
- C:\Windows\System\orSfCwy.exe
  C:\Windows\System\orSfCwy.exe
  2⤵
  PID:11380
- C:\Windows\System\diQMuag.exe
  C:\Windows\System\diQMuag.exe
  2⤵
  PID:11416
- C:\Windows\System\wcTBISy.exe
  C:\Windows\System\wcTBISy.exe
  2⤵
  PID:11456
- C:\Windows\System\ygXFibT.exe
  C:\Windows\System\ygXFibT.exe
  2⤵
  PID:11472
- C:\Windows\System\DjaHJtu.exe
  C:\Windows\System\DjaHJtu.exe
  2⤵
  PID:11504
- C:\Windows\System\oeyigVD.exe
  C:\Windows\System\oeyigVD.exe
  2⤵
  PID:11540
- C:\Windows\System\uILODTa.exe
  C:\Windows\System\uILODTa.exe
  2⤵
  PID:11564
- C:\Windows\System\sYsOTtB.exe
  C:\Windows\System\sYsOTtB.exe
  2⤵
  PID:11584
- C:\Windows\System\Kvjxhaq.exe
  C:\Windows\System\Kvjxhaq.exe
  2⤵
  PID:11612
- C:\Windows\System\OowPAQT.exe
  C:\Windows\System\OowPAQT.exe
  2⤵
  PID:11640
- C:\Windows\System\bHTmWAu.exe
  C:\Windows\System\bHTmWAu.exe
  2⤵
  PID:11668
- C:\Windows\System\liayYxQ.exe
  C:\Windows\System\liayYxQ.exe
  2⤵
  PID:11700
- C:\Windows\System\eQbKmfT.exe
  C:\Windows\System\eQbKmfT.exe
  2⤵
  PID:11724
- C:\Windows\System\jHbEiFH.exe
  C:\Windows\System\jHbEiFH.exe
  2⤵
  PID:11752
- C:\Windows\System\TmRgdAV.exe
  C:\Windows\System\TmRgdAV.exe
  2⤵
  PID:11780
- C:\Windows\System\lxdJYDB.exe
  C:\Windows\System\lxdJYDB.exe
  2⤵
  PID:11808
- C:\Windows\System\cgMddjh.exe
  C:\Windows\System\cgMddjh.exe
  2⤵
  PID:11840
- C:\Windows\System\ZAnudTA.exe
  C:\Windows\System\ZAnudTA.exe
  2⤵
  PID:11864
- C:\Windows\System\DcEsjUZ.exe
  C:\Windows\System\DcEsjUZ.exe
  2⤵
  PID:11892
- C:\Windows\System\yFTPFdE.exe
  C:\Windows\System\yFTPFdE.exe
  2⤵
  PID:11924
- C:\Windows\System\iBKiqSy.exe
  C:\Windows\System\iBKiqSy.exe
  2⤵
  PID:11952
- C:\Windows\System\qcQFSMZ.exe
  C:\Windows\System\qcQFSMZ.exe
  2⤵
  PID:11984
- C:\Windows\System\OvWZwTB.exe
  C:\Windows\System\OvWZwTB.exe
  2⤵
  PID:12012
- C:\Windows\System\QekJWYM.exe
  C:\Windows\System\QekJWYM.exe
  2⤵
  PID:12040
- C:\Windows\System\pAwnZqE.exe
  C:\Windows\System\pAwnZqE.exe
  2⤵
  PID:12076
- C:\Windows\System\mAWBoai.exe
  C:\Windows\System\mAWBoai.exe
  2⤵
  PID:12104
- C:\Windows\System\cyFboWt.exe
  C:\Windows\System\cyFboWt.exe
  2⤵
  PID:12120
- C:\Windows\System\RrbJaru.exe
  C:\Windows\System\RrbJaru.exe
  2⤵
  PID:12144
- C:\Windows\System\QvrhWyD.exe
  C:\Windows\System\QvrhWyD.exe
  2⤵
  PID:12164
- C:\Windows\System\vIrcNOa.exe
  C:\Windows\System\vIrcNOa.exe
  2⤵
  PID:12196
- C:\Windows\System\IZpEitH.exe
  C:\Windows\System\IZpEitH.exe
  2⤵
  PID:12232
- C:\Windows\System\WxRVBfN.exe
  C:\Windows\System\WxRVBfN.exe
  2⤵
  PID:12260
- C:\Windows\System\xyCprQc.exe
  C:\Windows\System\xyCprQc.exe
  2⤵
  PID:11280
- C:\Windows\System\kZjUbiS.exe
  C:\Windows\System\kZjUbiS.exe
  2⤵
  PID:11316
- C:\Windows\System\evpFpdn.exe
  C:\Windows\System\evpFpdn.exe
  2⤵
  PID:11396
- C:\Windows\System\ZgIEFPi.exe
  C:\Windows\System\ZgIEFPi.exe
  2⤵
  PID:11448
- C:\Windows\System\BibrNjC.exe
  C:\Windows\System\BibrNjC.exe
  2⤵
  PID:11524
- C:\Windows\System\nGncCaT.exe
  C:\Windows\System\nGncCaT.exe
  2⤵
  PID:11604
- C:\Windows\System\bIiRxTG.exe
  C:\Windows\System\bIiRxTG.exe
  2⤵
  PID:11624
- C:\Windows\System\JblYJwB.exe
  C:\Windows\System\JblYJwB.exe
  2⤵
  PID:11712
- C:\Windows\System\RqRQMVg.exe
  C:\Windows\System\RqRQMVg.exe
  2⤵
  PID:11764
- C:\Windows\System\iGSQOBU.exe
  C:\Windows\System\iGSQOBU.exe
  2⤵
  PID:11820
- C:\Windows\System\cfITVKy.exe
  C:\Windows\System\cfITVKy.exe
  2⤵
  PID:11888
- C:\Windows\System\nIWWuHC.exe
  C:\Windows\System\nIWWuHC.exe
  2⤵
  PID:11920
- C:\Windows\System\OZZFGtF.exe
  C:\Windows\System\OZZFGtF.exe
  2⤵
  PID:12020
- C:\Windows\System\pJnHbkA.exe
  C:\Windows\System\pJnHbkA.exe
  2⤵
  PID:12100
- C:\Windows\System\hqigZbZ.exe
  C:\Windows\System\hqigZbZ.exe
  2⤵
  PID:12156
- C:\Windows\System\LbnmMSs.exe
  C:\Windows\System\LbnmMSs.exe
  2⤵
  PID:12272
- C:\Windows\System\OaEEfZR.exe
  C:\Windows\System\OaEEfZR.exe
  2⤵
  PID:10988
- C:\Windows\System\oRcHQgk.exe
  C:\Windows\System\oRcHQgk.exe
  2⤵
  PID:11360
- C:\Windows\System\uRFuatg.exe
  C:\Windows\System\uRFuatg.exe
  2⤵
  PID:11528
- C:\Windows\System\mhduxVe.exe
  C:\Windows\System\mhduxVe.exe
  2⤵
  PID:11696
- C:\Windows\System\LUeLDVx.exe
  C:\Windows\System\LUeLDVx.exe
  2⤵
  PID:11856
- C:\Windows\System\SalfAXT.exe
  C:\Windows\System\SalfAXT.exe
  2⤵
  PID:12028
- C:\Windows\System\FXYQRlW.exe
  C:\Windows\System\FXYQRlW.exe
  2⤵
  PID:12176
- C:\Windows\System\WQDwgcE.exe
  C:\Windows\System\WQDwgcE.exe
  2⤵
  PID:11332
- C:\Windows\System\lhjldmI.exe
  C:\Windows\System\lhjldmI.exe
  2⤵
  PID:11600
- C:\Windows\System\XOnljGA.exe
  C:\Windows\System\XOnljGA.exe
  2⤵
  PID:11904
- C:\Windows\System\uSRwRDp.exe
  C:\Windows\System\uSRwRDp.exe
  2⤵
  PID:12244
- C:\Windows\System\jubTdVv.exe
  C:\Windows\System\jubTdVv.exe
  2⤵
  PID:12292
- C:\Windows\System\pdwFmJB.exe
  C:\Windows\System\pdwFmJB.exe
  2⤵
  PID:12308
- C:\Windows\System\hlarlPo.exe
  C:\Windows\System\hlarlPo.exe
  2⤵
  PID:12340
- C:\Windows\System\WfLYqqd.exe
  C:\Windows\System\WfLYqqd.exe
  2⤵
  PID:12372
- C:\Windows\System\CZOSnje.exe
  C:\Windows\System\CZOSnje.exe
  2⤵
  PID:12400
- C:\Windows\System\lwzVLlz.exe
  C:\Windows\System\lwzVLlz.exe
  2⤵
  PID:12440
- C:\Windows\System\cMDzIln.exe
  C:\Windows\System\cMDzIln.exe
  2⤵
  PID:12472
- C:\Windows\System\BOkjtjK.exe
  C:\Windows\System\BOkjtjK.exe
  2⤵
  PID:12508
- C:\Windows\System\FjSDhhm.exe
  C:\Windows\System\FjSDhhm.exe
  2⤵
  PID:12532
- C:\Windows\System\YgQCOAU.exe
  C:\Windows\System\YgQCOAU.exe
  2⤵
  PID:12552
- C:\Windows\System\xjcXuHY.exe
  C:\Windows\System\xjcXuHY.exe
  2⤵
  PID:12568
- C:\Windows\System\gyZIUTo.exe
  C:\Windows\System\gyZIUTo.exe
  2⤵
  PID:12596
- C:\Windows\System\PaauksV.exe
  C:\Windows\System\PaauksV.exe
  2⤵
  PID:12624
- C:\Windows\System\rsFBuGA.exe
  C:\Windows\System\rsFBuGA.exe
  2⤵
  PID:12664
- C:\Windows\System\lFflItZ.exe
  C:\Windows\System\lFflItZ.exe
  2⤵
  PID:12680
- C:\Windows\System\GfKzeOG.exe
  C:\Windows\System\GfKzeOG.exe
  2⤵
  PID:12708
- C:\Windows\System\aDVmFNk.exe
  C:\Windows\System\aDVmFNk.exe
  2⤵
  PID:12736
- C:\Windows\System\sWlDEeg.exe
  C:\Windows\System\sWlDEeg.exe
  2⤵
  PID:12764
- C:\Windows\System\TaGnvFP.exe
  C:\Windows\System\TaGnvFP.exe
  2⤵
  PID:12800
- C:\Windows\System\XOfaBVc.exe
  C:\Windows\System\XOfaBVc.exe
  2⤵
  PID:12840
- C:\Windows\System\QnrXBly.exe
  C:\Windows\System\QnrXBly.exe
  2⤵
  PID:12872
- C:\Windows\System\glDZJOx.exe
  C:\Windows\System\glDZJOx.exe
  2⤵
  PID:12888
- C:\Windows\System\nwFgYrs.exe
  C:\Windows\System\nwFgYrs.exe
  2⤵
  PID:12924
- C:\Windows\System\BBdsKzO.exe
  C:\Windows\System\BBdsKzO.exe
  2⤵
  PID:12948
- C:\Windows\System\eNidGXL.exe
  C:\Windows\System\eNidGXL.exe
  2⤵
  PID:12984
- C:\Windows\System\yutcJwX.exe
  C:\Windows\System\yutcJwX.exe
  2⤵
  PID:13012
- C:\Windows\System\NglofpR.exe
  C:\Windows\System\NglofpR.exe
  2⤵
  PID:13028
- C:\Windows\System\oqchSuO.exe
  C:\Windows\System\oqchSuO.exe
  2⤵
  PID:13056
- C:\Windows\System\bztVWDD.exe
  C:\Windows\System\bztVWDD.exe
  2⤵
  PID:13092
- C:\Windows\System\WGSSSCt.exe
  C:\Windows\System\WGSSSCt.exe
  2⤵
  PID:13116
- C:\Windows\System\GTJQEsI.exe
  C:\Windows\System\GTJQEsI.exe
  2⤵
  PID:13156
- C:\Windows\System\AhPRdxZ.exe
  C:\Windows\System\AhPRdxZ.exe
  2⤵
  PID:13172
- C:\Windows\System\FQtjnmq.exe
  C:\Windows\System\FQtjnmq.exe
  2⤵
  PID:13204
- C:\Windows\System\mecefFX.exe
  C:\Windows\System\mecefFX.exe
  2⤵
  PID:13228
- C:\Windows\System\DASBzVq.exe
  C:\Windows\System\DASBzVq.exe
  2⤵
  PID:13260
- C:\Windows\System\vkykJEZ.exe
  C:\Windows\System\vkykJEZ.exe
  2⤵
  PID:13300
- C:\Windows\System\EoteQNN.exe
  C:\Windows\System\EoteQNN.exe
  2⤵
  PID:12204
- C:\Windows\System\mtNYJvI.exe
  C:\Windows\System\mtNYJvI.exe
  2⤵
  PID:12336
- C:\Windows\System\PJZoooL.exe
  C:\Windows\System\PJZoooL.exe
  2⤵
  PID:12480
- C:\Windows\System\PSFFsMT.exe
  C:\Windows\System\PSFFsMT.exe
  2⤵
  PID:12460
- C:\Windows\System\cjObMLY.exe
  C:\Windows\System\cjObMLY.exe
  2⤵
  PID:12544
- C:\Windows\System\hVSDBev.exe
  C:\Windows\System\hVSDBev.exe
  2⤵
  PID:12580
- C:\Windows\System\szLPUKT.exe
  C:\Windows\System\szLPUKT.exe
  2⤵
  PID:12644
- C:\Windows\System\HKsuFHF.exe
  C:\Windows\System\HKsuFHF.exe
  2⤵
  PID:12728
- C:\Windows\System\ljvWjSB.exe
  C:\Windows\System\ljvWjSB.exe
  2⤵
  PID:12756
- C:\Windows\System\EOkTwFG.exe
  C:\Windows\System\EOkTwFG.exe
  2⤵
  PID:12836
- C:\Windows\System\MWfSdWR.exe
  C:\Windows\System\MWfSdWR.exe
  2⤵
  PID:12900
- C:\Windows\System\JDoIgAY.exe
  C:\Windows\System\JDoIgAY.exe
  2⤵
  PID:12964
- C:\Windows\System\ebkKxvX.exe
  C:\Windows\System\ebkKxvX.exe
  2⤵
  PID:13052
- C:\Windows\System\BIChRKK.exe
  C:\Windows\System\BIChRKK.exe
  2⤵
  PID:13104
- C:\Windows\System\DjqArgF.exe
  C:\Windows\System\DjqArgF.exe
  2⤵
  PID:13164
- C:\Windows\System\BbXfSuk.exe
  C:\Windows\System\BbXfSuk.exe
  2⤵
  PID:13220
- C:\Windows\System\ddSwRZc.exe
  C:\Windows\System\ddSwRZc.exe
  2⤵
  PID:13272
- C:\Windows\System\uQJQYiM.exe
  C:\Windows\System\uQJQYiM.exe
  2⤵
  PID:12412
- C:\Windows\System\juxLAGj.exe
  C:\Windows\System\juxLAGj.exe
  2⤵
  PID:12524
- C:\Windows\System\ZsmwLuh.exe
  C:\Windows\System\ZsmwLuh.exe
  2⤵
  PID:12788
- C:\Windows\System\qRalnsp.exe
  C:\Windows\System\qRalnsp.exe
  2⤵
  PID:12776
- C:\Windows\System\NNjtrQk.exe
  C:\Windows\System\NNjtrQk.exe
  2⤵
  PID:12944
- C:\Windows\System\ZTkDWRK.exe
  C:\Windows\System\ZTkDWRK.exe
  2⤵
  PID:13084
- C:\Windows\System\FoqYOQh.exe
  C:\Windows\System\FoqYOQh.exe
  2⤵
  PID:13288
- C:\Windows\System\tCMiiOg.exe
  C:\Windows\System\tCMiiOg.exe
  2⤵
  PID:12428
- C:\Windows\System\fxVqJhu.exe
  C:\Windows\System\fxVqJhu.exe
  2⤵
  PID:12632
- C:\Windows\System\exfVnJl.exe
  C:\Windows\System\exfVnJl.exe
  2⤵
  PID:13008
- C:\Windows\System\gJULJXA.exe
  C:\Windows\System\gJULJXA.exe
  2⤵
  PID:12676
- C:\Windows\System\yhlRNow.exe
  C:\Windows\System\yhlRNow.exe
  2⤵
  PID:12608
- C:\Windows\System\LqcBazu.exe
  C:\Windows\System\LqcBazu.exe
  2⤵
  PID:13344
- C:\Windows\System\egJjleV.exe
  C:\Windows\System\egJjleV.exe
  2⤵
  PID:13372
- C:\Windows\System\FfllGDn.exe
  C:\Windows\System\FfllGDn.exe
  2⤵
  PID:13400
- C:\Windows\System\fAnTeaM.exe
  C:\Windows\System\fAnTeaM.exe
  2⤵
  PID:13424
- C:\Windows\System\xftFZSz.exe
  C:\Windows\System\xftFZSz.exe
  2⤵
  PID:13456
- C:\Windows\System\FqtpPCg.exe
  C:\Windows\System\FqtpPCg.exe
  2⤵
  PID:13496
- C:\Windows\System\wXYxWdi.exe
  C:\Windows\System\wXYxWdi.exe
  2⤵
  PID:13520
- C:\Windows\System\IWWjGSP.exe
  C:\Windows\System\IWWjGSP.exe
  2⤵
  PID:13552
- C:\Windows\System\fXAeyDH.exe
  C:\Windows\System\fXAeyDH.exe
  2⤵
  PID:13568
- C:\Windows\System\FKHfpZg.exe
  C:\Windows\System\FKHfpZg.exe
  2⤵
  PID:13596
- C:\Windows\System\uuMsDDw.exe
  C:\Windows\System\uuMsDDw.exe
  2⤵
  PID:13628
- C:\Windows\System\UbDzjBi.exe
  C:\Windows\System\UbDzjBi.exe
  2⤵
  PID:13664
- C:\Windows\System\vbNnRas.exe
  C:\Windows\System\vbNnRas.exe
  2⤵
  PID:13688
- C:\Windows\System\CFVHrPI.exe
  C:\Windows\System\CFVHrPI.exe
  2⤵
  PID:13708
- C:\Windows\System\mKDsBpb.exe
  C:\Windows\System\mKDsBpb.exe
  2⤵
  PID:13724
- C:\Windows\System\PRoFwdD.exe
  C:\Windows\System\PRoFwdD.exe
  2⤵
  PID:13764
- C:\Windows\System\IqOFFau.exe
  C:\Windows\System\IqOFFau.exe
  2⤵
  PID:13792
- C:\Windows\System\CHRIeBC.exe
  C:\Windows\System\CHRIeBC.exe
  2⤵
  PID:13824
- C:\Windows\System\nghvrtj.exe
  C:\Windows\System\nghvrtj.exe
  2⤵
  PID:13848
- C:\Windows\System\lJEFxJZ.exe
  C:\Windows\System\lJEFxJZ.exe
  2⤵
  PID:13868
- C:\Windows\System\bzjuHdT.exe
  C:\Windows\System\bzjuHdT.exe
  2⤵
  PID:13896
- C:\Windows\System\rLJnufb.exe
  C:\Windows\System\rLJnufb.exe
  2⤵
  PID:13920
- C:\Windows\System\hWOYcvs.exe
  C:\Windows\System\hWOYcvs.exe
  2⤵
  PID:13976
- C:\Windows\System\uNeIYwa.exe
  C:\Windows\System\uNeIYwa.exe
  2⤵
  PID:14004
- C:\Windows\System\wOPmMAs.exe
  C:\Windows\System\wOPmMAs.exe
  2⤵
  PID:14032
- C:\Windows\System\BCmJJpb.exe
  C:\Windows\System\BCmJJpb.exe
  2⤵
  PID:14048
- C:\Windows\System\BOmUdkC.exe
  C:\Windows\System\BOmUdkC.exe
  2⤵
  PID:14076
- C:\Windows\System\vyEGesD.exe
  C:\Windows\System\vyEGesD.exe
  2⤵
  PID:14104
- C:\Windows\System\GdRfWcZ.exe
  C:\Windows\System\GdRfWcZ.exe
  2⤵
  PID:14128
- C:\Windows\System\EqOfoPD.exe
  C:\Windows\System\EqOfoPD.exe
  2⤵
  PID:14160
- C:\Windows\System\AzsktSW.exe
  C:\Windows\System\AzsktSW.exe
  2⤵
  PID:14188
- C:\Windows\System\yeLIGYR.exe
  C:\Windows\System\yeLIGYR.exe
  2⤵
  PID:14224
- C:\Windows\System\pQsANes.exe
  C:\Windows\System\pQsANes.exe
  2⤵
  PID:14256
- C:\Windows\System\LZEVKXR.exe
  C:\Windows\System\LZEVKXR.exe
  2⤵
  PID:14284
- C:\Windows\System\BheiGmq.exe
  C:\Windows\System\BheiGmq.exe
  2⤵
  PID:14300
- C:\Windows\System\LzbHvcJ.exe
  C:\Windows\System\LzbHvcJ.exe
  2⤵
  PID:14328
- C:\Windows\System\aYlRQuP.exe
  C:\Windows\System\aYlRQuP.exe
  2⤵
  PID:13332
- C:\Windows\System\lLmtkrI.exe
  C:\Windows\System\lLmtkrI.exe
  2⤵
  PID:13408
- C:\Windows\System\ndkFrRs.exe
  C:\Windows\System\ndkFrRs.exe
  2⤵
  PID:13468
- C:\Windows\System\CDYgmeh.exe
  C:\Windows\System\CDYgmeh.exe
  2⤵
  PID:13548
- C:\Windows\System\rwgCVDo.exe
  C:\Windows\System\rwgCVDo.exe
  2⤵
  PID:13608
- C:\Windows\System\gaobsxC.exe
  C:\Windows\System\gaobsxC.exe
  2⤵
  PID:13672
- C:\Windows\System\iofNzKb.exe
  C:\Windows\System\iofNzKb.exe
  2⤵
  PID:13776
- C:\Windows\System\uCDthVD.exe
  C:\Windows\System\uCDthVD.exe
  2⤵
  PID:13812
- C:\Windows\System\KvYFukI.exe
  C:\Windows\System\KvYFukI.exe
  2⤵
  PID:13892
- C:\Windows\System\AdOwcRm.exe
  C:\Windows\System\AdOwcRm.exe
  2⤵
  PID:13876
- C:\Windows\System\xBaxDAX.exe
  C:\Windows\System\xBaxDAX.exe
  2⤵
  PID:13928
- C:\Windows\System\cgUDbug.exe
  C:\Windows\System\cgUDbug.exe
  2⤵
  PID:13992
- C:\Windows\System\CmDgAVQ.exe
  C:\Windows\System\CmDgAVQ.exe
  2⤵
  PID:14072
- C:\Windows\System\MuOBBoJ.exe
  C:\Windows\System\MuOBBoJ.exe
  2⤵
  PID:14120
- C:\Windows\System\MhwlorB.exe
  C:\Windows\System\MhwlorB.exe
  2⤵
  PID:14204
- C:\Windows\System\wWwWIpB.exe
  C:\Windows\System\wWwWIpB.exe
  2⤵
  PID:14240
- C:\Windows\System\RLLHbei.exe
  C:\Windows\System\RLLHbei.exe
  2⤵
  PID:13356
- C:\Windows\System\ArZAwFb.exe
  C:\Windows\System\ArZAwFb.exe
  2⤵
  PID:13504
- C:\Windows\System\SrlurJH.exe
  C:\Windows\System\SrlurJH.exe
  2⤵
  PID:13580
- C:\Windows\System\GiVmOjS.exe
  C:\Windows\System\GiVmOjS.exe
  2⤵
  PID:13788
- C:\Windows\System\JZeUSUj.exe
  C:\Windows\System\JZeUSUj.exe
  2⤵
  PID:14068
- C:\Windows\System\AFflxHA.exe
  C:\Windows\System\AFflxHA.exe
  2⤵
  PID:14244
- C:\Windows\System\ozstkCm.exe
  C:\Windows\System\ozstkCm.exe
  2⤵
  PID:14276
- C:\Windows\System\GjmdcZk.exe
  C:\Windows\System\GjmdcZk.exe
  2⤵
  PID:14324
- C:\Windows\System\Sewzwfb.exe
  C:\Windows\System\Sewzwfb.exe
  2⤵
  PID:13916
- C:\Windows\System\rresTpT.exe
  C:\Windows\System\rresTpT.exe
  2⤵
  PID:14200
- C:\Windows\System\suKxZYn.exe
  C:\Windows\System\suKxZYn.exe
  2⤵
  PID:14044
- C:\Windows\System\wejtbak.exe
  C:\Windows\System\wejtbak.exe
  2⤵
  PID:14352
- C:\Windows\System\whLMFmH.exe
  C:\Windows\System\whLMFmH.exe
  2⤵
  PID:14384
- C:\Windows\System\Iroijox.exe
  C:\Windows\System\Iroijox.exe
  2⤵
  PID:14404
- C:\Windows\System\YcdsEOL.exe
  C:\Windows\System\YcdsEOL.exe
  2⤵
  PID:14432
- C:\Windows\System\UGbgtNY.exe
  C:\Windows\System\UGbgtNY.exe
  2⤵
  PID:14476
- C:\Windows\System\BMLLFqx.exe
  C:\Windows\System\BMLLFqx.exe
  2⤵
  PID:14540
- C:\Windows\System\XyFUNjx.exe
  C:\Windows\System\XyFUNjx.exe
  2⤵
  PID:14556
- C:\Windows\System\EbyDPMg.exe
  C:\Windows\System\EbyDPMg.exe
  2⤵
  PID:14580
- C:\Windows\System\SKCOwjH.exe
  C:\Windows\System\SKCOwjH.exe
  2⤵
  PID:14612
- C:\Windows\System\seXVycy.exe
  C:\Windows\System\seXVycy.exe
  2⤵
  PID:14640
- C:\Windows\System\BFSEuWa.exe
  C:\Windows\System\BFSEuWa.exe
  2⤵
  PID:14668
- C:\Windows\System\LnvekRX.exe
  C:\Windows\System\LnvekRX.exe
  2⤵
  PID:14684
- C:\Windows\System\mYDcviz.exe
  C:\Windows\System\mYDcviz.exe
  2⤵
  PID:14712
- C:\Windows\System\IWFYaoS.exe
  C:\Windows\System\IWFYaoS.exe
  2⤵
  PID:14728
- C:\Windows\System\NcRuqjb.exe
  C:\Windows\System\NcRuqjb.exe
  2⤵
  PID:14756
- C:\Windows\System\AwyxPCw.exe
  C:\Windows\System\AwyxPCw.exe
  2⤵
  PID:14796
- C:\Windows\System\nkYRITR.exe
  C:\Windows\System\nkYRITR.exe
  2⤵
  PID:14816
- C:\Windows\System\iGpbWkI.exe
  C:\Windows\System\iGpbWkI.exe
  2⤵
  PID:14840
- C:\Windows\System\xRpjKsL.exe
  C:\Windows\System\xRpjKsL.exe
  2⤵
  PID:14868
- C:\Windows\System\aOtFyAg.exe
  C:\Windows\System\aOtFyAg.exe
  2⤵
  PID:14908
- C:\Windows\System\PGXPQSE.exe
  C:\Windows\System\PGXPQSE.exe
  2⤵
  PID:14936
- C:\Windows\System\qPLqLDU.exe
  C:\Windows\System\qPLqLDU.exe
  2⤵
  PID:14964
- C:\Windows\System\ZRQVAhA.exe
  C:\Windows\System\ZRQVAhA.exe
  2⤵
  PID:14992
- C:\Windows\System\zmQUXoj.exe
  C:\Windows\System\zmQUXoj.exe
  2⤵
  PID:15012
- C:\Windows\System\BjCakhu.exe
  C:\Windows\System\BjCakhu.exe
  2⤵
  PID:15032
- C:\Windows\System\npghDMR.exe
  C:\Windows\System\npghDMR.exe
  2⤵
  PID:15048
- C:\Windows\System\ERbgKzU.exe
  C:\Windows\System\ERbgKzU.exe
  2⤵
  PID:15088
- C:\Windows\System\WfQcCVs.exe
  C:\Windows\System\WfQcCVs.exe
  2⤵
  PID:15112
- C:\Windows\System\kUmfhVA.exe
  C:\Windows\System\kUmfhVA.exe
  2⤵
  PID:15144
- C:\Windows\System\SkASrZf.exe
  C:\Windows\System\SkASrZf.exe
  2⤵
  PID:15180
- C:\Windows\System\jsGWAcH.exe
  C:\Windows\System\jsGWAcH.exe
  2⤵
  PID:15216
- C:\Windows\System\DgfCQjn.exe
  C:\Windows\System\DgfCQjn.exe
  2⤵
  PID:15236
- C:\Windows\System\yCuPfOC.exe
  C:\Windows\System\yCuPfOC.exe
  2⤵
  PID:15252
- C:\Windows\System\SZumWgy.exe
  C:\Windows\System\SZumWgy.exe
  2⤵
  PID:15284
- C:\Windows\System\uPDqyVW.exe
  C:\Windows\System\uPDqyVW.exe
  2⤵
  PID:15316
- C:\Windows\System\oaAeMjm.exe
  C:\Windows\System\oaAeMjm.exe
  2⤵
  PID:15348
- C:\Windows\System\TcwAFsP.exe
  C:\Windows\System\TcwAFsP.exe
  2⤵
  PID:14340
- C:\Windows\System\WJWZRXZ.exe
  C:\Windows\System\WJWZRXZ.exe
  2⤵
  PID:14368
- C:\Windows\System\kZuFQrp.exe
  C:\Windows\System\kZuFQrp.exe
  2⤵
  PID:14452
- C:\Windows\System\wiqVRGG.exe
  C:\Windows\System\wiqVRGG.exe
  2⤵
  PID:14552
- C:\Windows\System\sEegFsA.exe
  C:\Windows\System\sEegFsA.exe
  2⤵
  PID:14600
- C:\Windows\System\GyAeRIO.exe
  C:\Windows\System\GyAeRIO.exe
  2⤵
  PID:14664
- C:\Windows\System\AyWGaQL.exe
  C:\Windows\System\AyWGaQL.exe
  2⤵
  PID:14740
- C:\Windows\System\dQjGSgf.exe
  C:\Windows\System\dQjGSgf.exe
  2⤵
  PID:14804
- C:\Windows\System\WJCwCpI.exe
  C:\Windows\System\WJCwCpI.exe
  2⤵
  PID:14856
- C:\Windows\System\wJsNxqH.exe
  C:\Windows\System\wJsNxqH.exe
  2⤵
  PID:13912
- C:\Windows\System\WEcrLxE.exe
  C:\Windows\System\WEcrLxE.exe
  2⤵
  PID:14980
- C:\Windows\System\JHbjJRi.exe
  C:\Windows\System\JHbjJRi.exe
  2⤵
  PID:15120
- C:\Windows\System\Kukjugv.exe
  C:\Windows\System\Kukjugv.exe
  2⤵
  PID:15164
- C:\Windows\System\JXeIvRP.exe
  C:\Windows\System\JXeIvRP.exe
  2⤵
  PID:15248
- C:\Windows\System\ZvXfIWo.exe
  C:\Windows\System\ZvXfIWo.exe
  2⤵
  PID:15268
- C:\Windows\System\kAdocMp.exe
  C:\Windows\System\kAdocMp.exe
  2⤵
  PID:13544
- C:\Windows\System\JzhsoaX.exe
  C:\Windows\System\JzhsoaX.exe
  2⤵
  PID:14424
- C:\Windows\System\oDCvLKG.exe
  C:\Windows\System\oDCvLKG.exe
  2⤵
  PID:14596
- C:\Windows\System\nzjIceI.exe
  C:\Windows\System\nzjIceI.exe
  2⤵
  PID:14656
- C:\Windows\System\gwfwzNe.exe
  C:\Windows\System\gwfwzNe.exe
  2⤵
  PID:14852
- C:\Windows\System\NQPluVK.exe
  C:\Windows\System\NQPluVK.exe
  2⤵
  PID:15028
- C:\Windows\System\DMYewYb.exe
  C:\Windows\System\DMYewYb.exe
  2⤵
  PID:15200
- C:\Windows\System\vcitWXU.exe
  C:\Windows\System\vcitWXU.exe
  2⤵
  PID:15308
- C:\Windows\System\XHvRwzS.exe
  C:\Windows\System\XHvRwzS.exe
  2⤵
  PID:14724
- C:\Windows\System\NLoMJlh.exe
  C:\Windows\System\NLoMJlh.exe
  2⤵
  PID:15264
- C:\Windows\System\UsfZbIL.exe
  C:\Windows\System\UsfZbIL.exe
  2⤵
  PID:14516
- C:\Windows\System\tEvDKKZ.exe
  C:\Windows\System\tEvDKKZ.exe
  2⤵
  PID:14984
- C:\Windows\System\BnXfwXK.exe
  C:\Windows\System\BnXfwXK.exe
  2⤵
  PID:15384
- C:\Windows\System\KtjXyjP.exe
  C:\Windows\System\KtjXyjP.exe
  2⤵
  PID:15416
- C:\Windows\System\ZwlYoCB.exe
  C:\Windows\System\ZwlYoCB.exe
  2⤵
  PID:15436
- C:\Windows\System\ZQvOjlH.exe
  C:\Windows\System\ZQvOjlH.exe
  2⤵
  PID:15456
- C:\Windows\System\GbklLlu.exe
  C:\Windows\System\GbklLlu.exe
  2⤵
  PID:15504
- C:\Windows\System\ALNRHiD.exe
  C:\Windows\System\ALNRHiD.exe
  2⤵
  PID:15524
- C:\Windows\System\lJSLrxS.exe
  C:\Windows\System\lJSLrxS.exe
  2⤵
  PID:15540
- C:\Windows\System\npAWKGL.exe
  C:\Windows\System\npAWKGL.exe
  2⤵
  PID:15556
- C:\Windows\System\CSLdDwq.exe
  C:\Windows\System\CSLdDwq.exe
  2⤵
  PID:15572
- C:\Windows\System\QIvecyC.exe
  C:\Windows\System\QIvecyC.exe
  2⤵
  PID:15604
- C:\Windows\System\aHJlezO.exe
  C:\Windows\System\aHJlezO.exe
  2⤵
  PID:15644
- C:\Windows\System\RWugYXP.exe
  C:\Windows\System\RWugYXP.exe
  2⤵
  PID:15668
- C:\Windows\System\ctfiKTE.exe
  C:\Windows\System\ctfiKTE.exe
  2⤵
  PID:15708
- C:\Windows\System\GApkqAB.exe
  C:\Windows\System\GApkqAB.exe
  2⤵
  PID:15732
- C:\Windows\System\IrFTcmP.exe
  C:\Windows\System\IrFTcmP.exe
  2⤵
  PID:15760
- C:\Windows\System\qWwkoLr.exe
  C:\Windows\System\qWwkoLr.exe
  2⤵
  PID:15780
- C:\Windows\System\YKVyyzK.exe
  C:\Windows\System\YKVyyzK.exe
  2⤵
  PID:15812
- C:\Windows\System\aVgcmVt.exe
  C:\Windows\System\aVgcmVt.exe
  2⤵
  PID:15836
- C:\Windows\System\Vtcdrqr.exe
  C:\Windows\System\Vtcdrqr.exe
  2⤵
  PID:15860
- C:\Windows\System\YUGUsuX.exe
  C:\Windows\System\YUGUsuX.exe
  2⤵
  PID:15884
- C:\Windows\System\FNNKqDz.exe
  C:\Windows\System\FNNKqDz.exe
  2⤵
  PID:15916
- C:\Windows\System\bqRFjos.exe
  C:\Windows\System\bqRFjos.exe
  2⤵
  PID:15944
- C:\Windows\System\FXAkEDY.exe
  C:\Windows\System\FXAkEDY.exe
  2⤵
  PID:15968
- C:\Windows\System\FXGsRUR.exe
  C:\Windows\System\FXGsRUR.exe
  2⤵
  PID:16012
- C:\Windows\System\OBmAhPK.exe
  C:\Windows\System\OBmAhPK.exe
  2⤵
  PID:16040
- C:\Windows\System\UKAuJQO.exe
  C:\Windows\System\UKAuJQO.exe
  2⤵
  PID:16068
- C:\Windows\System\zkjAths.exe
  C:\Windows\System\zkjAths.exe
  2⤵
  PID:16088
- C:\Windows\System\eAlhTNI.exe
  C:\Windows\System\eAlhTNI.exe
  2⤵
  PID:16112
- C:\Windows\System\LywLxed.exe
  C:\Windows\System\LywLxed.exe
  2⤵
  PID:16136
- C:\Windows\System\wmHYUQd.exe
  C:\Windows\System\wmHYUQd.exe
  2⤵
  PID:16164
- C:\Windows\System\WprjheU.exe
  C:\Windows\System\WprjheU.exe
  2⤵
  PID:16204
- C:\Windows\System\cdxWrqr.exe
  C:\Windows\System\cdxWrqr.exe
  2⤵
  PID:16236
- C:\Windows\System\jkFgAOV.exe
  C:\Windows\System\jkFgAOV.exe
  2⤵
  PID:16268
- C:\Windows\System\NeBsBCC.exe
  C:\Windows\System\NeBsBCC.exe
  2⤵
  PID:16292
- C:\Windows\System\FODISnU.exe
  C:\Windows\System\FODISnU.exe
  2⤵
  PID:16324
- C:\Windows\System\JKDGxFp.exe
  C:\Windows\System\JKDGxFp.exe
  2⤵
  PID:16364
- C:\Windows\System\uleAJDo.exe
  C:\Windows\System\uleAJDo.exe
  2⤵
  PID:15060
- C:\Windows\System\GNfZLhh.exe
  C:\Windows\System\GNfZLhh.exe
  2⤵
  PID:15404
- C:\Windows\System\uTDucUG.exe
  C:\Windows\System\uTDucUG.exe
  2⤵
  PID:15480
- C:\Windows\System\xCMmsAP.exe
  C:\Windows\System\xCMmsAP.exe
  2⤵
  PID:15568
- C:\Windows\System\ObSFnhM.exe
  C:\Windows\System\ObSFnhM.exe
  2⤵
  PID:15564
- C:\Windows\System\SmSFSpC.exe
  C:\Windows\System\SmSFSpC.exe
  2⤵
  PID:15692
- C:\Windows\System\jEfuQnU.exe
  C:\Windows\System\jEfuQnU.exe
  2⤵
  PID:15772
- C:\Windows\System\gjErxGI.exe
  C:\Windows\System\gjErxGI.exe
  2⤵
  PID:15756
- C:\Windows\System\Aswdzlq.exe
  C:\Windows\System\Aswdzlq.exe
  2⤵
  PID:544
- C:\Windows\System\yKTObGL.exe
  C:\Windows\System\yKTObGL.exe
  2⤵
  PID:1712
- C:\Windows\System\mENjKgu.exe
  C:\Windows\System\mENjKgu.exe
  2⤵
  PID:15928
- C:\Windows\System\NWwpxeG.exe
  C:\Windows\System\NWwpxeG.exe
  2⤵
  PID:15964
- C:\Windows\System\oUHAUju.exe
  C:\Windows\System\oUHAUju.exe
  2⤵
  PID:16036
- C:\Windows\System\AJIcfqA.exe
  C:\Windows\System\AJIcfqA.exe
  2⤵
  PID:16124
- C:\Windows\System\FrnIyCK.exe
  C:\Windows\System\FrnIyCK.exe
  2⤵
  PID:16216
- C:\Windows\System\GEIPYTB.exe
  C:\Windows\System\GEIPYTB.exe
  2⤵
  PID:16144
- C:\Windows\System\moMCNUM.exe
  C:\Windows\System\moMCNUM.exe
  2⤵
  PID:16284
- C:\Windows\System\wOMSvhZ.exe
  C:\Windows\System\wOMSvhZ.exe
  2⤵
  PID:16352
- C:\Windows\System\mkliFEJ.exe
  C:\Windows\System\mkliFEJ.exe
  2⤵
  PID:15372
- C:\Windows\System\TRotjPh.exe
  C:\Windows\System\TRotjPh.exe
  2⤵
  PID:15616
- C:\Windows\System\MFAGfOe.exe
  C:\Windows\System\MFAGfOe.exe
  2⤵
  PID:15724
- C:\Windows\System\TAfacWl.exe
  C:\Windows\System\TAfacWl.exe
  2⤵
  PID:15868
- C:\Windows\System\nOlZuSM.exe
  C:\Windows\System\nOlZuSM.exe
  2⤵
  PID:16000
- C:\Windows\System\RVLvdvT.exe
  C:\Windows\System\RVLvdvT.exe
  2⤵
  PID:16100
- C:\Windows\System\WETSNbQ.exe
  C:\Windows\System\WETSNbQ.exe
  2⤵
  PID:16280
- C:\Windows\System\tmUjiui.exe
  C:\Windows\System\tmUjiui.exe
  2⤵
  PID:15448
- C:\Windows\System\uozllgV.exe
  C:\Windows\System\uozllgV.exe
  2⤵
  PID:15800
- C:\Windows\System\gVrrlgv.exe
  C:\Windows\System\gVrrlgv.exe
  2⤵
  PID:15980
- C:\Windows\System\IjqeXqv.exe
  C:\Windows\System\IjqeXqv.exe
  2⤵
  PID:15532
- C:\Windows\System\noSPMTo.exe
  C:\Windows\System\noSPMTo.exe
  2⤵
  PID:16404
- C:\Windows\System\JGBMKAj.exe
  C:\Windows\System\JGBMKAj.exe
  2⤵
  PID:16432
- C:\Windows\System\dtkdsVM.exe
  C:\Windows\System\dtkdsVM.exe
  2⤵
  PID:16468
- C:\Windows\System\zKpsMWY.exe
  C:\Windows\System\zKpsMWY.exe
  2⤵
  PID:16496
- C:\Windows\System\NHiKFXn.exe
  C:\Windows\System\NHiKFXn.exe
  2⤵
  PID:16516
- C:\Windows\System\YjxRjYG.exe
  C:\Windows\System\YjxRjYG.exe
  2⤵
  PID:16544
- C:\Windows\System\FcyNkSd.exe
  C:\Windows\System\FcyNkSd.exe
  2⤵
  PID:16572
- C:\Windows\System\pZKnvFQ.exe
  C:\Windows\System\pZKnvFQ.exe
  2⤵
  PID:16600
- C:\Windows\System\CGtxOxb.exe
  C:\Windows\System\CGtxOxb.exe
  2⤵
  PID:16616
- C:\Windows\System\eUpRFyj.exe
  C:\Windows\System\eUpRFyj.exe
  2⤵
  PID:16648
- C:\Windows\System\Ynvaoea.exe
  C:\Windows\System\Ynvaoea.exe
  2⤵
  PID:16672
- C:\Windows\System\MtgoKkk.exe
  C:\Windows\System\MtgoKkk.exe
  2⤵
  PID:16704
- C:\Windows\System\PveBIMY.exe
  C:\Windows\System\PveBIMY.exe
  2⤵
  PID:16740
- C:\Windows\System\bheYYjf.exe
  C:\Windows\System\bheYYjf.exe
  2⤵
  PID:16760
- C:\Windows\System\MHKqSpo.exe
  C:\Windows\System\MHKqSpo.exe
  2⤵
  PID:16804
- C:\Windows\System\dWSYESQ.exe
  C:\Windows\System\dWSYESQ.exe
  2⤵
  PID:16828
- C:\Windows\System\CqJcpmc.exe
  C:\Windows\System\CqJcpmc.exe
  2⤵
  PID:16852
- C:\Windows\System\aDszjaj.exe
  C:\Windows\System\aDszjaj.exe
  2⤵
  PID:16876
- C:\Windows\System\TgXfoLe.exe
  C:\Windows\System\TgXfoLe.exe
  2⤵
  PID:16908
- C:\Windows\System\EmtUFUR.exe
  C:\Windows\System\EmtUFUR.exe
  2⤵
  PID:16932
- C:\Windows\System\AthLmDN.exe
  C:\Windows\System\AthLmDN.exe
  2⤵
  PID:16964
- C:\Windows\System\bRxMfza.exe
  C:\Windows\System\bRxMfza.exe
  2⤵
  PID:16992
- C:\Windows\System\qXmPncW.exe
  C:\Windows\System\qXmPncW.exe
  2⤵
  PID:17028
- C:\Windows\System\HLixzjm.exe
  C:\Windows\System\HLixzjm.exe
  2⤵
  PID:17048
- C:\Windows\System\vaFcMXT.exe
  C:\Windows\System\vaFcMXT.exe
  2⤵
  PID:17084
- C:\Windows\System\SVVfDgH.exe
  C:\Windows\System\SVVfDgH.exe
  2⤵
  PID:17100
- C:\Windows\System\cdAYLWy.exe
  C:\Windows\System\cdAYLWy.exe
  2⤵
  PID:17120
- C:\Windows\System\fxkPNll.exe
  C:\Windows\System\fxkPNll.exe
  2⤵
  PID:17144
- C:\Windows\System\dKPBCcq.exe
  C:\Windows\System\dKPBCcq.exe
  2⤵
  PID:17176
- C:\Windows\System\SnYHyyP.exe
  C:\Windows\System\SnYHyyP.exe
  2⤵
  PID:17196
- C:\Windows\System\uxyRyVY.exe
  C:\Windows\System\uxyRyVY.exe
  2⤵
  PID:17232
- C:\Windows\System\lfCTCys.exe
  C:\Windows\System\lfCTCys.exe
  2⤵
  PID:17268
- C:\Windows\System\UYWjRel.exe
  C:\Windows\System\UYWjRel.exe
  2⤵
  PID:17288

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:3188

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AXTQepa.exe

Filesize
1.9MB

MD5
afece4da716e5721b6c625c9eb02d0b6

SHA1
f294aa42af53e38f7d289ab29b79bb9a35581ac2

SHA256
23529d1a43249990806087c16edca9389b2c7ecc40c190fbc2bfe8577095ab2a

SHA512
ee8491651e9a51ec7f6d3893d8ef0a51c24b1f894351f63ec67cf1be53dc41e70a848e415fd3bbb2c4f6588e1136d8d50dce75f11da406c4b790145bf3e3a4be

Download Submit
C:\Windows\System\AdHxQdC.exe

Filesize
1.9MB

MD5
c727d89ca339a61d40a0d316738be30e

SHA1
e10d0b6b57ece7e8524f6fd9ead37be25800af65

SHA256
e21aae4aa38857cbb5b1452bffb6a8755626d90a3f0f9604655962c7ec63524f

SHA512
41f061fdbb2080b8fb3a50d02e7dd571c3697bbc1c34c31a3144eb3d479a8794f2b8b1deb71b828a2c06dd02113c618581c3185fd5545d941571fa67f142c416

Download Submit
C:\Windows\System\BfFEakK.exe

Filesize
1.9MB

MD5
6cef9864c66391a3acd104d3c3708cd7

SHA1
7242e3da3dbc4c7b6b750044dbf5d2f7d45c773d

SHA256
f7f3a44312b7e3f0af6dedd13028187779534a47105b303f6053ba9517939c90

SHA512
65c6a7d7178b36735bb7b0c766ee66d451e20d2225172800667e323210bc86d3ee0b4045d66acb7a7b14ace9685c3e1409493b357786e843d158df2d08327918

Download Submit
C:\Windows\System\CPugaVm.exe

Filesize
1.9MB

MD5
010b4c49f00ceec800465e8cf3cf0a97

SHA1
9dbadf4d08d89c216ad0377978f06df134a5e180

SHA256
3e9073393f01082d91bd47813e25be8f747475edf7b854ee91371fed687e727b

SHA512
cc70da3a78764110ff5e248aa5f7fee86bbf85914aa6d0c3b70f86a1c237a775d98b1aaee417d2b2263797475fc650b3d9c74a25f294e0419d632a5964afcc45

Download Submit
C:\Windows\System\CbLbEey.exe

Filesize
1.9MB

MD5
7fee212390b6603105c41108f0248737

SHA1
fbea4b7640350172e2e2c5d677023ea04caf0866

SHA256
5ef35ff2117a442ffc834773ad46fae5d8ded77fb44986ae8dd99c688f775324

SHA512
6fef562da022da35e9dec596b3a79c7bb6ec566e6f8b436cafbdb794843fca7cf3701a6a448ac213f09ede626c45ba672f51421d4286ac90405677608b717c34

Download Submit
C:\Windows\System\JMRlAlc.exe

Filesize
1.9MB

MD5
3d242835271513a8132f151c4a9b5719

SHA1
6fade9260a46b8b34653f3d1d803572dc0668c96

SHA256
fc1985f65539b59482b4ad9cc2c66b47ae6851ee00675d8a372f4c86f745864a

SHA512
84820a984975bc4a1aa7c245c2327409f7cc99eff9fc83dd2251cd9ec9185332c92c199f6b1bba2db99a0222c4d012724be9565096dc7989d982ae009a292e47

Download Submit
C:\Windows\System\LNCoTDZ.exe

Filesize
1.9MB

MD5
b3ecf9850abb5f628d24da375fa3a91e

SHA1
a317d8f93fbf1d7014e37b0195115abf9d097d1d

SHA256
c02024c52a66970cbda3ed640579fa9f0627bd0b17944f789a9b9005aec2f81a

SHA512
6cc489f457dec1259baedf74f708c68eff3891fc29e211c9f3eb934984a857e35929ce50f8ee7b435032fce7a73ae7bde450c0cd7c497e9832597f54d8bd3a4c

Download Submit
C:\Windows\System\MkQUNoK.exe

Filesize
1.9MB

MD5
643f3697f557168cf01817af51f9da01

SHA1
3591c686a6f1ad9107316e471fc8bac01480e9ea

SHA256
f0a1ee13cb5ba2b8eb1109414d5758118a5987179f29030fc169721df66e095a

SHA512
f7914ddb278953853bca59103ba65d7b5fc4b6707d992987b821fe124a4e8b9778438676a16459b8326a1b37fba066a9d38a55f9d25f07563d76be13d32621c2

Download Submit
C:\Windows\System\NJCytjK.exe

Filesize
1.9MB

MD5
84e24fa7acc49ae6c11660f633d0477f

SHA1
ec439e030c19396cc0573c52293b8f3c43ecf2ff

SHA256
05f2277e87ed872ede8ab0f12092973b6b4054c7e453ffa91380f052ac12b2d7

SHA512
b1e8912c16eec75affbcdea1c0d826e275fb495662772cd0087a10b1405f16ff21a2bca23e5f21be77fccc28e596fa39516f1adf2f537a9736c19967171966aa

Download Submit
C:\Windows\System\NoOpVMT.exe

Filesize
1.9MB

MD5
c79dacb6d779483579136975d123af4e

SHA1
5f6dcbf58fe969bf2a37f3bdeeac1fbbe1a72340

SHA256
d39d14ac0dcf7f9eb91c989abb7861ace4afa88611b7f63b4c6cee827ff51880

SHA512
737f6a00feb2d288800497fd13332a1afbdc8b11c947d8072f6082f9c6c03546f8016a33058e1d5204bdc5b1ecdda0c384b6bea00109a49ab19289c718d1e977

Download Submit
C:\Windows\System\RkmcIrY.exe

Filesize
1.9MB

MD5
6e1c6731cc9482618f8ecac044ee008f

SHA1
2349f2bb974626b68db4413c312e739a5e7f7525

SHA256
066bb4f993496ba2b672f3b168a4b57cdfa81af3526f139150a869e540768007

SHA512
e9a465bac9c10835557f7431b360d9b84da40111838772f73be01bb32bab74f172e2a8b36d73510cee3e96448a9bcfc46e914d6501044d17e8e7cd2c44c5406d

Download Submit
C:\Windows\System\UEHsYxK.exe

Filesize
1.9MB

MD5
378d74205779dfe09e73e1d9012f0c77

SHA1
3310ee5434486cefd87227d15b0b0eefbd8a3266

SHA256
999b01b2967b4fd44612fb5b9c79a379939adbaf64ed6720dacb86ff8e7e1767

SHA512
5581282fb710d7df2df087148eb68fda3b6e08cc5d6dc4939c5da05c3814a76cca528c2f0057617c0066786f5357c91af1872041be198fbfb7a1c535e0b5879c

Download Submit
C:\Windows\System\UHjskGW.exe

Filesize
1.9MB

MD5
00437728a6b16a2e94d86ca74e4b7bcb

SHA1
27c1f5e7c9ad45f536d713d8208c52e58601d83f

SHA256
8d1f966f548890ca997fb57616be41ed67bc6ff1360cb24d33c84543f7591936

SHA512
65574cd72d6d1ad41513ce7bd63f3c8b6b671333059baa0fc5fb0834f3d24257383d14e19cfc81857d75714488fe477bafe55a78d3a7921a00f98c7d087c3d54

Download Submit
C:\Windows\System\acRKcoH.exe

Filesize
1.9MB

MD5
e2f30ecad81deb954474c1be0775e2a5

SHA1
9f4ff38bdde0180b65e8b9dd7e48d01dd199ad5b

SHA256
8b549b62223f73fa65dc878f9e73579c930622c9411b8c3ad56e719da4c39d66

SHA512
2f7a4698fc14a408c2598927b911b8c50b6553fda72baf8743e8b74c0fda6e90a91976afccedbf7804dd25e7dd37cbda935a0a1a2abb8822059ea6495ba446ae

Download Submit
C:\Windows\System\cNWxOQD.exe

Filesize
1.9MB

MD5
671262770a8af45ac601a148118d3000

SHA1
29e5f9ac393fe014a6a229a69a08ca674dbc0561

SHA256
b300c589e88b6709c479d726a830f6a9576307bc35bd63f5888d1990e1d5be16

SHA512
d68f299f56cd39722a446d5eed4953ef79a290007f05b147ff093d6138d97d959c0dcb9dac5d8ddac10451c165162e0fc331b944ccdbad263c27519ab6d26adc

Download Submit
C:\Windows\System\csMwyzl.exe

Filesize
1.9MB

MD5
4b2f56f50db7a66bb6e3d87c8b864241

SHA1
89a604001da002717995208895fe0af60c5415e3

SHA256
4d379c6b466900f04c3abf06105551ce8fa715ad89063ef2fd1ef2b5af030a9d

SHA512
9fa55441c3fed00a2c04510d244e845cf39294f7b259cbe6b1bd973c855ee92acf578ea8656f1141fc0f8dae63087567b435671553c80fb6b75412d232d58175

Download Submit
C:\Windows\System\ggzRVKV.exe

Filesize
1.9MB

MD5
78ad66102ef13fcdc9f94a3dd8f5af15

SHA1
8e068be17f094f39583f0fa9b32cf55a565b3048

SHA256
0a942b9ead93d4871253108834c38189079d39cabd312b92b827780729dd919a

SHA512
d89502fb3b38c821a984f74ea73be8305a7db0d10ec03399e14da5f9a698aced4513e701d9210ce0e82e88bee428181ca7db654eb916848fa59c04588fc38cbc

Download Submit
C:\Windows\System\gnnWsFU.exe

Filesize
1.9MB

MD5
cd8705ba1b3bdd9eacd120ac5f49df29

SHA1
3a4f9c21718537f15d618c9f6059999b5256a865

SHA256
ac302dd937ec65ba79ddd3ba806b16089b7a163849d5ad9db155c3d228878656

SHA512
bee974ce321fbec3e69ca0556fa0a065d0c239adde34ad8c5c5843b29f400eb717aa15836cb0d2c53c23a37d0133efe767056b847b57d7ccd69ce49541fa1bae

Download Submit
C:\Windows\System\jVJtgnV.exe

Filesize
1.9MB

MD5
b29cede143b9bbc0074296239924b719

SHA1
7f592adcd2c5edc10a63aac031592318983dbd34

SHA256
7a486bcd67332448d19cbc79f026c6a87235defa4a39a64e374cd47b222d9de1

SHA512
df715f280e41a6e5f7dc4dc4c9e40732c31f1e0a0fd08cd34e7afdc05d3b6ce096ade93b7f695f949bf640845afb6fb4b57294eed963b546cb05f5b0936bbcc5

Download Submit
C:\Windows\System\jsKfDKC.exe

Filesize
1.9MB

MD5
f1f74e962b61536147867b025a89ddce

SHA1
1727590517e808030af7f8535ee6fcce73b3217f

SHA256
4ffed5cdcceb1a4119a12fa189b1cc888e488143eb9ffe9693a589e8a4c3cf34

SHA512
c84a215b9074b5a736c04f3f7f0be72fa91f00be6936d112c864c20ce2d0a4ae4aa4538fe0101ed4f8defbae1d5790bf3b52f8857906e9491be38783fc5e5471

Download Submit
C:\Windows\System\jvgYZOo.exe

Filesize
1.9MB

MD5
9e10f365e53ce9404d19aa8f5c6d7024

SHA1
aaa8d4e5ce618a14f7b87ae956b78dcb75a39574

SHA256
7f2537274523ea40a92b6e1c714962fcec1a8c59e9279988302e02b394933583

SHA512
eec4f5eeaf20f47dc5cefed7f94946f96b57d6463ee131f185c5ffd0465acbaebd5cfc44971b22a9dbbbd9f8c5cf922be8b72823f08e7e60fbe31d02b7e93d04

Download Submit
C:\Windows\System\kVdmyHc.exe

Filesize
1.9MB

MD5
ff54658b207de5c3787389f077fad931

SHA1
edafb370160b19185c8dd031675eff09bf624935

SHA256
70b770a1ad4d8964da44f450db44d6b5c1919b9cfcb318b7a46b12c6a7ea7c66

SHA512
7c6752660a0baaf93cb172a2c3ea3f80741cb3102c42451f02eb849ff8be8b4c6936a8988551f8a7d39e97a0c9e0eff07f4fc8583cb873ee5f7a5fda966fa3f7

Download Submit
C:\Windows\System\lQUlXhE.exe

Filesize
1.9MB

MD5
46c0ddb2c5c5e781ae963a45a5b27065

SHA1
0503e73ae8a198c379724c6b460da2ab1c1b17cd

SHA256
bf5cc54c27530da92e7be737e05b6278fbf9f7b451d8045723b966d60f1a4766

SHA512
37791bb5fc506ce7e427ba364d1cba1955d0925657db4f7556e96f4b40a689890e73bc5275864035f7de719df6910d1ec6578b461de8ccb3443b754acd28624e

Download Submit
C:\Windows\System\lzUjNAm.exe

Filesize
1.9MB

MD5
18192e8b2862ba4d5a31037eec0ffb2b

SHA1
9d8bb56549f6d32383262a870e5bb7a302093fc3

SHA256
cf198d5b28adc7aeb60c981c5ce564f93dda10ad073ef495a23435fcecffc67c

SHA512
076e599068e746655b7465f05259c365b649b850c90282b7c60df332048ccf76f80b2269ab2430c658ff804d330dcfd64cd5bb1eff82487561493adfb31b0e67

Download Submit
C:\Windows\System\mraSFkb.exe

Filesize
1.9MB

MD5
23003ac95f88d2c72c5f405869d90c7b

SHA1
2c0184171bba25f9766558416ab300386a9d2beb

SHA256
68e4d3f893a726fa6054a91eb938a28bda49e539950cec0ffc55268f57323f5c

SHA512
7450d2cb40d6381905ef06928d1807e89a99c9d09b4e469bdc5cec5c03500b8498d1df04807f4317e19f8d842f4d55298e5b76e4f0640e6caee5ede3cc6682a3

Download Submit
C:\Windows\System\rLXsYQm.exe

Filesize
1.9MB

MD5
b651c5f12c3b1144ebd31d0b356e7f0e

SHA1
776f1d7c0af1b127978de1b082ee3b1a56d4cc60

SHA256
e8625bda41a4b965d171fa3f14515c5d926377c3b805989d15b2295d9ebb455a

SHA512
43278e044c6238a9455b1152c5bf3f831e9cc09d7bf7a99fa64352998b38a38794a2344710462aeff34f0775756f44f2fee54b4c80caeea415760d37ff3a22da

Download Submit
C:\Windows\System\vAWSpxz.exe

Filesize
1.9MB

MD5
2375771e3fceaee2e79b04f84f5b69eb

SHA1
82e82c877cbb5c2c471d5bd6714e0cce2a6179ba

SHA256
c537d3a128f0d11f16c2968fdf355e9c5a777754bdd6057eb022697c3f0c41f5

SHA512
11e4a5c5ad7caecd896129d475d5162558b1e9adda997d546fdd39abfd6ea3fe9ec36bb07bd275f50aef99779b2e73d0ee891a57eb140cc5aa1190022518c348

Download Submit
C:\Windows\System\vrsUGec.exe

Filesize
1.9MB

MD5
05a77b174e116579af5b353d23bb4295

SHA1
7fbb974281f4f29cc4da362c729e5580ba752a4b

SHA256
6e89057195b32e829b72cc13da07661b0581eeff5475da4099736c59581f1468

SHA512
077a8a39a9cfd317bdf782ed9aef2161df12a5540fbeee5a27bb247f263e316d028d521af198bddffaacac7852f691ad4452b374213fd3864e9ef48919de1953

Download Submit
C:\Windows\System\xRwwvFz.exe

Filesize
1.9MB

MD5
5e688cf72c1c832c8748009da165df63

SHA1
efa6b3bc3fa7ab3f762ea682c5e32fc1463b6501

SHA256
800fde45f65d7441567cd7187b7547364ebf5a8ee242c99c07a36e6517a67e6f

SHA512
955a9a0a125ddd1a20fd1aa6687b0cdaafb713da972b6a7da46f8021d1216c22c03f51db5a15dcd8646b0f45469279681415ec0491ead3cd5946f1e342cd0238

Download Submit
C:\Windows\System\yOHNtlX.exe

Filesize
1.9MB

MD5
a316771ac3c80487693f1b28b0454aa5

SHA1
cafd961fd960f1e4fd87fc712458c7ad9477dfe9

SHA256
5a69a8355d2a988ae598810f58d34ce607d4b4d67c02cb14467b7de16164f602

SHA512
67386f3822b18874798d0e3e12e7c2bca5d7a14e490f1e599cdeca1b09eec275fe46c3756ac023c12a3b4dea25867fa705aeee716d495ec8b54be8b6c95f300c

Download Submit
C:\Windows\System\zaeUVxN.exe

Filesize
1.9MB

MD5
ff24d634d0bf6c5abb5f90c7f3131fbd

SHA1
503fb83d3341fadbe82a5e9bec59a14a15e15073

SHA256
6adadce60e06a2fa66666d2f3f619598d1d36a07a1519e0ac459790db2be2be8

SHA512
ce8e2424a557c326736d1da9a0cb8b47bdebca01204a30cc9b5a8af14045db0168ddca25ae87a9fd019548b26a1b957bc4e8704f7acf3b00580c8927d0637faa

Download Submit
C:\Windows\System\zyVjLhg.exe

Filesize
1.9MB

MD5
f2b3e87a4a18e6ba711f8fc9c252c8dd

SHA1
4fdb65be4b651a6ccbced68259f09383f5c094e3

SHA256
ad6f023d26b520109a10a3a12cb2bc1cfa32e77b9abdb3da4468bd5d9ac9c594

SHA512
92b40382b1507da7e0c1a953b571ca8d4fd9f328a55051cadc3144f97f0eb9881c42f54d572856d06186a973f0ab4db23eaf4cc3a1953fc3a706cada07196dc6

Download Submit
memory/3108-0-0x0000025679990000-0x00000256799A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads