kpot | edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
Size

1.9MB
MD5

9597e6c7facbf1d3cf9a6ba089c9727c
SHA1

0c3983adff63603f6b7e46f95dda45cccb477292
SHA256

edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f
SHA512

a851c6bf5533cb9caa837aa85f69c681a134d3118bc94d2528cc59b696367f32debef399c4d81e84f69b98837c39803effef2933c79fcb6aed0399a2f89c5744
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIi5aIwC+Agr6S/FFC+Y:GemTLkNdfE0pZaQd

Score

10^/10

kpot xmrig miner stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 32 IoCs

resource	yara_rule
behavioral2/files/0x000800000002327d-4.dat	family_kpot
behavioral2/files/0x000800000002340f-7.dat	family_kpot
behavioral2/files/0x0007000000023413-14.dat	family_kpot
behavioral2/files/0x0007000000023414-16.dat	family_kpot
behavioral2/files/0x0007000000023416-23.dat	family_kpot
behavioral2/files/0x0007000000023417-30.dat	family_kpot
behavioral2/files/0x0007000000023418-35.dat	family_kpot
behavioral2/files/0x0008000000023410-39.dat	family_kpot
behavioral2/files/0x0007000000023419-43.dat	family_kpot
behavioral2/files/0x000700000002341a-49.dat	family_kpot
behavioral2/files/0x000700000002341b-58.dat	family_kpot
behavioral2/files/0x000700000002341c-62.dat	family_kpot
behavioral2/files/0x000700000002341e-70.dat	family_kpot
behavioral2/files/0x0007000000023420-80.dat	family_kpot
behavioral2/files/0x0007000000023421-84.dat	family_kpot
behavioral2/files/0x0007000000023424-98.dat	family_kpot
behavioral2/files/0x0007000000023426-108.dat	family_kpot
behavioral2/files/0x0007000000023427-113.dat	family_kpot
behavioral2/files/0x000700000002342b-133.dat	family_kpot
behavioral2/files/0x000700000002342e-148.dat	family_kpot
behavioral2/files/0x0007000000023431-162.dat	family_kpot
behavioral2/files/0x0007000000023430-158.dat	family_kpot
behavioral2/files/0x000700000002342f-153.dat	family_kpot
behavioral2/files/0x000700000002342d-143.dat	family_kpot
behavioral2/files/0x000700000002342c-138.dat	family_kpot
behavioral2/files/0x000700000002342a-128.dat	family_kpot
behavioral2/files/0x0007000000023429-123.dat	family_kpot
behavioral2/files/0x0007000000023428-117.dat	family_kpot
behavioral2/files/0x0007000000023425-102.dat	family_kpot
behavioral2/files/0x0007000000023422-92.dat	family_kpot
behavioral2/files/0x000700000002341f-75.dat	family_kpot
behavioral2/files/0x000700000002341d-64.dat	family_kpot

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000800000002327d-4.dat	xmrig
behavioral2/files/0x000800000002340f-7.dat	xmrig
behavioral2/files/0x0007000000023413-14.dat	xmrig
behavioral2/files/0x0007000000023414-16.dat	xmrig
behavioral2/files/0x0007000000023416-23.dat	xmrig
behavioral2/files/0x0007000000023417-30.dat	xmrig
behavioral2/files/0x0007000000023418-35.dat	xmrig
behavioral2/files/0x0008000000023410-39.dat	xmrig
behavioral2/files/0x0007000000023419-43.dat	xmrig
behavioral2/files/0x000700000002341a-49.dat	xmrig
behavioral2/files/0x000700000002341b-58.dat	xmrig
behavioral2/files/0x000700000002341c-62.dat	xmrig
behavioral2/files/0x000700000002341e-70.dat	xmrig
behavioral2/files/0x0007000000023420-80.dat	xmrig
behavioral2/files/0x0007000000023421-84.dat	xmrig
behavioral2/files/0x0007000000023424-98.dat	xmrig
behavioral2/files/0x0007000000023426-108.dat	xmrig
behavioral2/files/0x0007000000023427-113.dat	xmrig
behavioral2/files/0x000700000002342b-133.dat	xmrig
behavioral2/files/0x000700000002342e-148.dat	xmrig
behavioral2/files/0x0007000000023431-162.dat	xmrig
behavioral2/files/0x0007000000023430-158.dat	xmrig
behavioral2/files/0x000700000002342f-153.dat	xmrig
behavioral2/files/0x000700000002342d-143.dat	xmrig
behavioral2/files/0x000700000002342c-138.dat	xmrig
behavioral2/files/0x000700000002342a-128.dat	xmrig
behavioral2/files/0x0007000000023429-123.dat	xmrig
behavioral2/files/0x0007000000023428-117.dat	xmrig
behavioral2/files/0x0007000000023425-102.dat	xmrig
behavioral2/files/0x0007000000023422-92.dat	xmrig
behavioral2/files/0x000700000002341f-75.dat	xmrig
behavioral2/files/0x000700000002341d-64.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4624	ltKuDda.exe
468	wwCYdNv.exe
1704	FijhPuH.exe
1524	QvZnuAD.exe
3800	NAOKgKz.exe
2740	jMshFky.exe
4128	HnVxkKI.exe
3360	mUUBZDB.exe
4856	JPiPxGL.exe
4864	PNDDCSd.exe
4592	OASiGXh.exe
5036	RKzATvq.exe
5004	DFhRjhC.exe
5032	NhEJAaT.exe
3932	uLmPkgb.exe
1320	fYumBih.exe
216	oFGXDMi.exe
4480	ScZHAUv.exe
4356	RcnLnCQ.exe
4160	hdKzYzz.exe
2540	EZtDkUP.exe
2280	zjTZoKL.exe
2976	bDBkvFt.exe
448	uylelAK.exe
1964	NdcVUpf.exe
1060	LllpuOZ.exe
4332	tkLbVKB.exe
60	FjuRAIl.exe
1328	BfQjoaD.exe
960	XeUQeFS.exe
5108	EmDBbla.exe
2440	xIUCeze.exe
3996	GseLcqB.exe
4080	AUSQuMd.exe
2120	JjNiYUG.exe
4504	oPJwlky.exe
3428	rHUyJhx.exe
1876	hAnSJfp.exe
4596	GXZcLRT.exe
2956	rrdtPiP.exe
3548	ThoCKyF.exe
2536	fIqzRwQ.exe
2516	TtxDKFg.exe
2092	OWANcky.exe
4372	cteNNof.exe
4376	TZFZkpZ.exe
2752	EDqAqQD.exe
1540	CJSyjdQ.exe
3848	bbVIhiN.exe
2012	umFXtPG.exe
4724	rjyhtUY.exe
920	AeJgJZj.exe
3972	RvOwAEH.exe
4144	jacJpOq.exe
3860	lsQIgQx.exe
544	ffqpPnJ.exe
856	PyIUELL.exe
4120	jCfVsDY.exe
2124	WflkMoQ.exe
3380	TjkyAXA.exe
1480	vQanxJi.exe
64	zjwtbgJ.exe
1036	vlOzNbG.exe
3472	BIrezQJ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FoNImCp.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\RpiqKCw.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\mvXqLpt.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\KyotByP.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\LvZPgLM.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\JhmOCIg.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\PyIUELL.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\plyDyja.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\WDShadN.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\vSAOUwH.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\kPunFVo.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\naOVYRZ.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\DGcMhTN.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\hdKzYzz.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\hyzAiRa.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\uPdVMlv.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\oeNcCei.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\FkWHxDP.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\OxVQdRh.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\pJwtTmH.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\QDVRXrJ.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\flveZQl.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\XeUQeFS.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\siPNqPQ.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\AkaOgtg.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\urJStRB.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\mBWfLmK.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\PyPapQy.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\wpoqimz.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\UtXmryq.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\bRXCCco.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\bYuTMuH.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\MfghAkw.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\PdqAgts.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\URIPzBC.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\TRvmuIe.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\gZeBUkJ.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\vlOzNbG.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\OHpHdbP.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\PqrvnLv.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\rjyhtUY.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\zvMiZvf.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\cRmKBst.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\EtImCwz.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\BELwjsG.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\yJTuSez.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\feHIthF.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\MYruduJ.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\SExhKcq.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\YZSmvmh.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\RFrzJWq.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\cgyttzk.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\sVPmWle.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\ESBFPgA.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\RPwXjfn.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\nJVjPQm.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\uHoLUSk.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\OhkgGkK.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\zjTZoKL.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\EvnIHtN.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\wzzRjTI.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\zuZGazL.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\oLlRfyS.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
File created	C:\Windows\System\PDScUrp.exe	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4624	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	83
PID 4140 wrote to memory of 4624	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	83
PID 4140 wrote to memory of 468	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	84
PID 4140 wrote to memory of 468	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	84
PID 4140 wrote to memory of 1704	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	85
PID 4140 wrote to memory of 1704	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	85
PID 4140 wrote to memory of 1524	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	86
PID 4140 wrote to memory of 1524	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	86
PID 4140 wrote to memory of 3800	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	87
PID 4140 wrote to memory of 3800	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	87
PID 4140 wrote to memory of 2740	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	88
PID 4140 wrote to memory of 2740	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	88
PID 4140 wrote to memory of 4128	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	89
PID 4140 wrote to memory of 4128	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	89
PID 4140 wrote to memory of 3360	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	90
PID 4140 wrote to memory of 3360	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	90
PID 4140 wrote to memory of 4856	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	91
PID 4140 wrote to memory of 4856	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	91
PID 4140 wrote to memory of 4864	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	94
PID 4140 wrote to memory of 4864	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	94
PID 4140 wrote to memory of 4592	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	95
PID 4140 wrote to memory of 4592	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	95
PID 4140 wrote to memory of 5036	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	96
PID 4140 wrote to memory of 5036	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	96
PID 4140 wrote to memory of 5004	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	97
PID 4140 wrote to memory of 5004	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	97
PID 4140 wrote to memory of 5032	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	98
PID 4140 wrote to memory of 5032	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	98
PID 4140 wrote to memory of 3932	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	99
PID 4140 wrote to memory of 3932	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	99
PID 4140 wrote to memory of 1320	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	100
PID 4140 wrote to memory of 1320	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	100
PID 4140 wrote to memory of 216	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	101
PID 4140 wrote to memory of 216	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	101
PID 4140 wrote to memory of 4480	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	103
PID 4140 wrote to memory of 4480	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	103
PID 4140 wrote to memory of 4356	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	104
PID 4140 wrote to memory of 4356	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	104
PID 4140 wrote to memory of 4160	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	105
PID 4140 wrote to memory of 4160	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	105
PID 4140 wrote to memory of 2540	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	106
PID 4140 wrote to memory of 2540	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	106
PID 4140 wrote to memory of 2280	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	107
PID 4140 wrote to memory of 2280	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	107
PID 4140 wrote to memory of 2976	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	108
PID 4140 wrote to memory of 2976	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	108
PID 4140 wrote to memory of 448	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	109
PID 4140 wrote to memory of 448	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	109
PID 4140 wrote to memory of 1964	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	110
PID 4140 wrote to memory of 1964	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	110
PID 4140 wrote to memory of 1060	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	111
PID 4140 wrote to memory of 1060	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	111
PID 4140 wrote to memory of 4332	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	112
PID 4140 wrote to memory of 4332	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	112
PID 4140 wrote to memory of 60	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	113
PID 4140 wrote to memory of 60	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	113
PID 4140 wrote to memory of 1328	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	114
PID 4140 wrote to memory of 1328	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	114
PID 4140 wrote to memory of 960	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	115
PID 4140 wrote to memory of 960	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	115
PID 4140 wrote to memory of 5108	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	116
PID 4140 wrote to memory of 5108	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	116
PID 4140 wrote to memory of 2440	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	117
PID 4140 wrote to memory of 2440	4140	edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe	117

C:\Users\Admin\AppData\Local\Temp\edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe
"C:\Users\Admin\AppData\Local\Temp\edc10dbcbfef317dfc089954265c46ab0cc13bf22c68062db02993f2951f0d8f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\System\ltKuDda.exe
  C:\Windows\System\ltKuDda.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\wwCYdNv.exe
  C:\Windows\System\wwCYdNv.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\FijhPuH.exe
  C:\Windows\System\FijhPuH.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\QvZnuAD.exe
  C:\Windows\System\QvZnuAD.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\NAOKgKz.exe
  C:\Windows\System\NAOKgKz.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\jMshFky.exe
  C:\Windows\System\jMshFky.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\HnVxkKI.exe
  C:\Windows\System\HnVxkKI.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\mUUBZDB.exe
  C:\Windows\System\mUUBZDB.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\JPiPxGL.exe
  C:\Windows\System\JPiPxGL.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\PNDDCSd.exe
  C:\Windows\System\PNDDCSd.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\OASiGXh.exe
  C:\Windows\System\OASiGXh.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\RKzATvq.exe
  C:\Windows\System\RKzATvq.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\DFhRjhC.exe
  C:\Windows\System\DFhRjhC.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\NhEJAaT.exe
  C:\Windows\System\NhEJAaT.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\uLmPkgb.exe
  C:\Windows\System\uLmPkgb.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\fYumBih.exe
  C:\Windows\System\fYumBih.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\oFGXDMi.exe
  C:\Windows\System\oFGXDMi.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\ScZHAUv.exe
  C:\Windows\System\ScZHAUv.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\RcnLnCQ.exe
  C:\Windows\System\RcnLnCQ.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\hdKzYzz.exe
  C:\Windows\System\hdKzYzz.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\EZtDkUP.exe
  C:\Windows\System\EZtDkUP.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\zjTZoKL.exe
  C:\Windows\System\zjTZoKL.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\bDBkvFt.exe
  C:\Windows\System\bDBkvFt.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\uylelAK.exe
  C:\Windows\System\uylelAK.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\NdcVUpf.exe
  C:\Windows\System\NdcVUpf.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\LllpuOZ.exe
  C:\Windows\System\LllpuOZ.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\tkLbVKB.exe
  C:\Windows\System\tkLbVKB.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\FjuRAIl.exe
  C:\Windows\System\FjuRAIl.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\BfQjoaD.exe
  C:\Windows\System\BfQjoaD.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\XeUQeFS.exe
  C:\Windows\System\XeUQeFS.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\EmDBbla.exe
  C:\Windows\System\EmDBbla.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\xIUCeze.exe
  C:\Windows\System\xIUCeze.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\GseLcqB.exe
  C:\Windows\System\GseLcqB.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\AUSQuMd.exe
  C:\Windows\System\AUSQuMd.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\JjNiYUG.exe
  C:\Windows\System\JjNiYUG.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\oPJwlky.exe
  C:\Windows\System\oPJwlky.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\rHUyJhx.exe
  C:\Windows\System\rHUyJhx.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\hAnSJfp.exe
  C:\Windows\System\hAnSJfp.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\GXZcLRT.exe
  C:\Windows\System\GXZcLRT.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\rrdtPiP.exe
  C:\Windows\System\rrdtPiP.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\ThoCKyF.exe
  C:\Windows\System\ThoCKyF.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\fIqzRwQ.exe
  C:\Windows\System\fIqzRwQ.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\TtxDKFg.exe
  C:\Windows\System\TtxDKFg.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\OWANcky.exe
  C:\Windows\System\OWANcky.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\cteNNof.exe
  C:\Windows\System\cteNNof.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\TZFZkpZ.exe
  C:\Windows\System\TZFZkpZ.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\EDqAqQD.exe
  C:\Windows\System\EDqAqQD.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\CJSyjdQ.exe
  C:\Windows\System\CJSyjdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\bbVIhiN.exe
  C:\Windows\System\bbVIhiN.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\umFXtPG.exe
  C:\Windows\System\umFXtPG.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\rjyhtUY.exe
  C:\Windows\System\rjyhtUY.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\AeJgJZj.exe
  C:\Windows\System\AeJgJZj.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\RvOwAEH.exe
  C:\Windows\System\RvOwAEH.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\jacJpOq.exe
  C:\Windows\System\jacJpOq.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\lsQIgQx.exe
  C:\Windows\System\lsQIgQx.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\ffqpPnJ.exe
  C:\Windows\System\ffqpPnJ.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\PyIUELL.exe
  C:\Windows\System\PyIUELL.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\jCfVsDY.exe
  C:\Windows\System\jCfVsDY.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\WflkMoQ.exe
  C:\Windows\System\WflkMoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\TjkyAXA.exe
  C:\Windows\System\TjkyAXA.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\vQanxJi.exe
  C:\Windows\System\vQanxJi.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\zjwtbgJ.exe
  C:\Windows\System\zjwtbgJ.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\vlOzNbG.exe
  C:\Windows\System\vlOzNbG.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\BIrezQJ.exe
  C:\Windows\System\BIrezQJ.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\QDVRXrJ.exe
  C:\Windows\System\QDVRXrJ.exe
  2⤵
  PID:3540
- C:\Windows\System\aIvRFQf.exe
  C:\Windows\System\aIvRFQf.exe
  2⤵
  PID:4452
- C:\Windows\System\UEfVDmY.exe
  C:\Windows\System\UEfVDmY.exe
  2⤵
  PID:4060
- C:\Windows\System\hDHETvH.exe
  C:\Windows\System\hDHETvH.exe
  2⤵
  PID:964
- C:\Windows\System\ehCSVbm.exe
  C:\Windows\System\ehCSVbm.exe
  2⤵
  PID:3976
- C:\Windows\System\wsMzEhV.exe
  C:\Windows\System\wsMzEhV.exe
  2⤵
  PID:3028
- C:\Windows\System\UpbFkbK.exe
  C:\Windows\System\UpbFkbK.exe
  2⤵
  PID:3796
- C:\Windows\System\EAmDcPW.exe
  C:\Windows\System\EAmDcPW.exe
  2⤵
  PID:2200
- C:\Windows\System\eumSHzJ.exe
  C:\Windows\System\eumSHzJ.exe
  2⤵
  PID:1892
- C:\Windows\System\LLfknmA.exe
  C:\Windows\System\LLfknmA.exe
  2⤵
  PID:4732
- C:\Windows\System\CKhwaSd.exe
  C:\Windows\System\CKhwaSd.exe
  2⤵
  PID:548
- C:\Windows\System\XlGiVbL.exe
  C:\Windows\System\XlGiVbL.exe
  2⤵
  PID:4752
- C:\Windows\System\QpRNTbY.exe
  C:\Windows\System\QpRNTbY.exe
  2⤵
  PID:4848
- C:\Windows\System\jxBZjJI.exe
  C:\Windows\System\jxBZjJI.exe
  2⤵
  PID:4728
- C:\Windows\System\UQDAQaC.exe
  C:\Windows\System\UQDAQaC.exe
  2⤵
  PID:2348
- C:\Windows\System\oCEjPWH.exe
  C:\Windows\System\oCEjPWH.exe
  2⤵
  PID:4300
- C:\Windows\System\ETNnLyv.exe
  C:\Windows\System\ETNnLyv.exe
  2⤵
  PID:3644
- C:\Windows\System\UMQCKUn.exe
  C:\Windows\System\UMQCKUn.exe
  2⤵
  PID:4472
- C:\Windows\System\yoAvGRP.exe
  C:\Windows\System\yoAvGRP.exe
  2⤵
  PID:4772
- C:\Windows\System\dItDXYe.exe
  C:\Windows\System\dItDXYe.exe
  2⤵
  PID:4132
- C:\Windows\System\fZKMCRa.exe
  C:\Windows\System\fZKMCRa.exe
  2⤵
  PID:2780
- C:\Windows\System\FDuUusM.exe
  C:\Windows\System\FDuUusM.exe
  2⤵
  PID:5148
- C:\Windows\System\PyPapQy.exe
  C:\Windows\System\PyPapQy.exe
  2⤵
  PID:5172
- C:\Windows\System\cipprtD.exe
  C:\Windows\System\cipprtD.exe
  2⤵
  PID:5192
- C:\Windows\System\kdxWrnE.exe
  C:\Windows\System\kdxWrnE.exe
  2⤵
  PID:5220
- C:\Windows\System\MlsleYK.exe
  C:\Windows\System\MlsleYK.exe
  2⤵
  PID:5248
- C:\Windows\System\OHpHdbP.exe
  C:\Windows\System\OHpHdbP.exe
  2⤵
  PID:5272
- C:\Windows\System\SLFZzRm.exe
  C:\Windows\System\SLFZzRm.exe
  2⤵
  PID:5304
- C:\Windows\System\eXrZWRC.exe
  C:\Windows\System\eXrZWRC.exe
  2⤵
  PID:5328
- C:\Windows\System\PThiWqf.exe
  C:\Windows\System\PThiWqf.exe
  2⤵
  PID:5356
- C:\Windows\System\TzwUfQH.exe
  C:\Windows\System\TzwUfQH.exe
  2⤵
  PID:5388
- C:\Windows\System\NOybxUT.exe
  C:\Windows\System\NOybxUT.exe
  2⤵
  PID:5416
- C:\Windows\System\plyDyja.exe
  C:\Windows\System\plyDyja.exe
  2⤵
  PID:5444
- C:\Windows\System\rbNfInw.exe
  C:\Windows\System\rbNfInw.exe
  2⤵
  PID:5472
- C:\Windows\System\NgvADkp.exe
  C:\Windows\System\NgvADkp.exe
  2⤵
  PID:5500
- C:\Windows\System\VqPFTOg.exe
  C:\Windows\System\VqPFTOg.exe
  2⤵
  PID:5528
- C:\Windows\System\bZIWijG.exe
  C:\Windows\System\bZIWijG.exe
  2⤵
  PID:5556
- C:\Windows\System\CrAYiMe.exe
  C:\Windows\System\CrAYiMe.exe
  2⤵
  PID:5584
- C:\Windows\System\muKyXzk.exe
  C:\Windows\System\muKyXzk.exe
  2⤵
  PID:5612
- C:\Windows\System\eGFMNGD.exe
  C:\Windows\System\eGFMNGD.exe
  2⤵
  PID:5636
- C:\Windows\System\eMPXUcf.exe
  C:\Windows\System\eMPXUcf.exe
  2⤵
  PID:5664
- C:\Windows\System\CLOPamt.exe
  C:\Windows\System\CLOPamt.exe
  2⤵
  PID:5696
- C:\Windows\System\fRAUPWZ.exe
  C:\Windows\System\fRAUPWZ.exe
  2⤵
  PID:5720
- C:\Windows\System\fGRuFsY.exe
  C:\Windows\System\fGRuFsY.exe
  2⤵
  PID:5748
- C:\Windows\System\HQBfLvx.exe
  C:\Windows\System\HQBfLvx.exe
  2⤵
  PID:5776
- C:\Windows\System\cJkEXyW.exe
  C:\Windows\System\cJkEXyW.exe
  2⤵
  PID:5804
- C:\Windows\System\eKpevtk.exe
  C:\Windows\System\eKpevtk.exe
  2⤵
  PID:5836
- C:\Windows\System\uEoaZMr.exe
  C:\Windows\System\uEoaZMr.exe
  2⤵
  PID:5864
- C:\Windows\System\AksZyYE.exe
  C:\Windows\System\AksZyYE.exe
  2⤵
  PID:5892
- C:\Windows\System\epXAOjl.exe
  C:\Windows\System\epXAOjl.exe
  2⤵
  PID:5920
- C:\Windows\System\KudHHvj.exe
  C:\Windows\System\KudHHvj.exe
  2⤵
  PID:5948
- C:\Windows\System\gXdpZyY.exe
  C:\Windows\System\gXdpZyY.exe
  2⤵
  PID:5976
- C:\Windows\System\wcDdLjX.exe
  C:\Windows\System\wcDdLjX.exe
  2⤵
  PID:6004
- C:\Windows\System\VoRlJIK.exe
  C:\Windows\System\VoRlJIK.exe
  2⤵
  PID:6028
- C:\Windows\System\LAChFEu.exe
  C:\Windows\System\LAChFEu.exe
  2⤵
  PID:6056
- C:\Windows\System\HWESDsJ.exe
  C:\Windows\System\HWESDsJ.exe
  2⤵
  PID:6084
- C:\Windows\System\xuInnrA.exe
  C:\Windows\System\xuInnrA.exe
  2⤵
  PID:6116
- C:\Windows\System\XLGxEYy.exe
  C:\Windows\System\XLGxEYy.exe
  2⤵
  PID:6140
- C:\Windows\System\eQXcwbb.exe
  C:\Windows\System\eQXcwbb.exe
  2⤵
  PID:4972
- C:\Windows\System\WDShadN.exe
  C:\Windows\System\WDShadN.exe
  2⤵
  PID:4536
- C:\Windows\System\pEvCOMX.exe
  C:\Windows\System\pEvCOMX.exe
  2⤵
  PID:4880
- C:\Windows\System\qkkaviN.exe
  C:\Windows\System\qkkaviN.exe
  2⤵
  PID:4188
- C:\Windows\System\vEgivdh.exe
  C:\Windows\System\vEgivdh.exe
  2⤵
  PID:5184
- C:\Windows\System\UvqMDHQ.exe
  C:\Windows\System\UvqMDHQ.exe
  2⤵
  PID:5236
- C:\Windows\System\AChtbPw.exe
  C:\Windows\System\AChtbPw.exe
  2⤵
  PID:5296
- C:\Windows\System\DCZWZrA.exe
  C:\Windows\System\DCZWZrA.exe
  2⤵
  PID:5372
- C:\Windows\System\uYsxMjj.exe
  C:\Windows\System\uYsxMjj.exe
  2⤵
  PID:5432
- C:\Windows\System\CBzDvNm.exe
  C:\Windows\System\CBzDvNm.exe
  2⤵
  PID:5492
- C:\Windows\System\WwyCrXc.exe
  C:\Windows\System\WwyCrXc.exe
  2⤵
  PID:5540
- C:\Windows\System\lECSaxF.exe
  C:\Windows\System\lECSaxF.exe
  2⤵
  PID:5600
- C:\Windows\System\DkfPISz.exe
  C:\Windows\System\DkfPISz.exe
  2⤵
  PID:5660
- C:\Windows\System\lmrYQzR.exe
  C:\Windows\System\lmrYQzR.exe
  2⤵
  PID:5688
- C:\Windows\System\AKcdQiP.exe
  C:\Windows\System\AKcdQiP.exe
  2⤵
  PID:5764
- C:\Windows\System\mYXNgra.exe
  C:\Windows\System\mYXNgra.exe
  2⤵
  PID:5824
- C:\Windows\System\luYRvhE.exe
  C:\Windows\System\luYRvhE.exe
  2⤵
  PID:5936
- C:\Windows\System\mgKVbdQ.exe
  C:\Windows\System\mgKVbdQ.exe
  2⤵
  PID:5992
- C:\Windows\System\kfqpBGM.exe
  C:\Windows\System\kfqpBGM.exe
  2⤵
  PID:6072
- C:\Windows\System\qBzLCXu.exe
  C:\Windows\System\qBzLCXu.exe
  2⤵
  PID:6132
- C:\Windows\System\nVHrfyM.exe
  C:\Windows\System\nVHrfyM.exe
  2⤵
  PID:756
- C:\Windows\System\EnqnSLP.exe
  C:\Windows\System\EnqnSLP.exe
  2⤵
  PID:3180
- C:\Windows\System\RGBlOXk.exe
  C:\Windows\System\RGBlOXk.exe
  2⤵
  PID:5140
- C:\Windows\System\RvkJNpF.exe
  C:\Windows\System\RvkJNpF.exe
  2⤵
  PID:5212
- C:\Windows\System\WOZLfsM.exe
  C:\Windows\System\WOZLfsM.exe
  2⤵
  PID:5324
- C:\Windows\System\OoCBUNd.exe
  C:\Windows\System\OoCBUNd.exe
  2⤵
  PID:5464
- C:\Windows\System\GsWIBiU.exe
  C:\Windows\System\GsWIBiU.exe
  2⤵
  PID:5576
- C:\Windows\System\ojgsopW.exe
  C:\Windows\System\ojgsopW.exe
  2⤵
  PID:1952
- C:\Windows\System\QaQOFtD.exe
  C:\Windows\System\QaQOFtD.exe
  2⤵
  PID:5792
- C:\Windows\System\kxQohrv.exe
  C:\Windows\System\kxQohrv.exe
  2⤵
  PID:516
- C:\Windows\System\hdMwMVV.exe
  C:\Windows\System\hdMwMVV.exe
  2⤵
  PID:3628
- C:\Windows\System\vAAtPHh.exe
  C:\Windows\System\vAAtPHh.exe
  2⤵
  PID:2964
- C:\Windows\System\ahrjRJH.exe
  C:\Windows\System\ahrjRJH.exe
  2⤵
  PID:5968
- C:\Windows\System\PrCPBJi.exe
  C:\Windows\System\PrCPBJi.exe
  2⤵
  PID:5040
- C:\Windows\System\iqijilq.exe
  C:\Windows\System\iqijilq.exe
  2⤵
  PID:5268
- C:\Windows\System\BsRSeZf.exe
  C:\Windows\System\BsRSeZf.exe
  2⤵
  PID:5716
- C:\Windows\System\TJnZqVQ.exe
  C:\Windows\System\TJnZqVQ.exe
  2⤵
  PID:1812
- C:\Windows\System\ImdgdVH.exe
  C:\Windows\System\ImdgdVH.exe
  2⤵
  PID:3924
- C:\Windows\System\WOfEuHP.exe
  C:\Windows\System\WOfEuHP.exe
  2⤵
  PID:2096
- C:\Windows\System\OMBeIzU.exe
  C:\Windows\System\OMBeIzU.exe
  2⤵
  PID:5740
- C:\Windows\System\NzeqChL.exe
  C:\Windows\System\NzeqChL.exe
  2⤵
  PID:6108
- C:\Windows\System\zKsRZDN.exe
  C:\Windows\System\zKsRZDN.exe
  2⤵
  PID:5800
- C:\Windows\System\apsRELB.exe
  C:\Windows\System\apsRELB.exe
  2⤵
  PID:6172
- C:\Windows\System\khXEVnE.exe
  C:\Windows\System\khXEVnE.exe
  2⤵
  PID:6204
- C:\Windows\System\vRqbeou.exe
  C:\Windows\System\vRqbeou.exe
  2⤵
  PID:6240
- C:\Windows\System\Nnwzwyo.exe
  C:\Windows\System\Nnwzwyo.exe
  2⤵
  PID:6264
- C:\Windows\System\DEUywNR.exe
  C:\Windows\System\DEUywNR.exe
  2⤵
  PID:6296
- C:\Windows\System\pWPQZtz.exe
  C:\Windows\System\pWPQZtz.exe
  2⤵
  PID:6324
- C:\Windows\System\GuEZMgx.exe
  C:\Windows\System\GuEZMgx.exe
  2⤵
  PID:6356
- C:\Windows\System\hddgqQh.exe
  C:\Windows\System\hddgqQh.exe
  2⤵
  PID:6372
- C:\Windows\System\oSoAjuM.exe
  C:\Windows\System\oSoAjuM.exe
  2⤵
  PID:6408
- C:\Windows\System\BmSwNRA.exe
  C:\Windows\System\BmSwNRA.exe
  2⤵
  PID:6436
- C:\Windows\System\SGOiQpg.exe
  C:\Windows\System\SGOiQpg.exe
  2⤵
  PID:6476
- C:\Windows\System\KelyJoc.exe
  C:\Windows\System\KelyJoc.exe
  2⤵
  PID:6504
- C:\Windows\System\KFqkXpE.exe
  C:\Windows\System\KFqkXpE.exe
  2⤵
  PID:6528
- C:\Windows\System\cngwHQm.exe
  C:\Windows\System\cngwHQm.exe
  2⤵
  PID:6548
- C:\Windows\System\PgsFzfH.exe
  C:\Windows\System\PgsFzfH.exe
  2⤵
  PID:6588
- C:\Windows\System\RpAoMlR.exe
  C:\Windows\System\RpAoMlR.exe
  2⤵
  PID:6624
- C:\Windows\System\fMgxWKp.exe
  C:\Windows\System\fMgxWKp.exe
  2⤵
  PID:6640
- C:\Windows\System\tvbWAkS.exe
  C:\Windows\System\tvbWAkS.exe
  2⤵
  PID:6668
- C:\Windows\System\GQyAJqf.exe
  C:\Windows\System\GQyAJqf.exe
  2⤵
  PID:6700
- C:\Windows\System\tQCnFSL.exe
  C:\Windows\System\tQCnFSL.exe
  2⤵
  PID:6724
- C:\Windows\System\cLWsExt.exe
  C:\Windows\System\cLWsExt.exe
  2⤵
  PID:6752
- C:\Windows\System\WkVQGlq.exe
  C:\Windows\System\WkVQGlq.exe
  2⤵
  PID:6784
- C:\Windows\System\qHxwgzc.exe
  C:\Windows\System\qHxwgzc.exe
  2⤵
  PID:6812
- C:\Windows\System\GYKqYOl.exe
  C:\Windows\System\GYKqYOl.exe
  2⤵
  PID:6840
- C:\Windows\System\vSAOUwH.exe
  C:\Windows\System\vSAOUwH.exe
  2⤵
  PID:6864
- C:\Windows\System\yeCZiPS.exe
  C:\Windows\System\yeCZiPS.exe
  2⤵
  PID:6904
- C:\Windows\System\QURgQtg.exe
  C:\Windows\System\QURgQtg.exe
  2⤵
  PID:6924
- C:\Windows\System\bIAZbqx.exe
  C:\Windows\System\bIAZbqx.exe
  2⤵
  PID:6948
- C:\Windows\System\dBIbVuL.exe
  C:\Windows\System\dBIbVuL.exe
  2⤵
  PID:6976
- C:\Windows\System\Amirzzw.exe
  C:\Windows\System\Amirzzw.exe
  2⤵
  PID:7004
- C:\Windows\System\jCloBow.exe
  C:\Windows\System\jCloBow.exe
  2⤵
  PID:7032
- C:\Windows\System\QyEHCtd.exe
  C:\Windows\System\QyEHCtd.exe
  2⤵
  PID:7060
- C:\Windows\System\RxFZmtk.exe
  C:\Windows\System\RxFZmtk.exe
  2⤵
  PID:7084
- C:\Windows\System\sRrzjAB.exe
  C:\Windows\System\sRrzjAB.exe
  2⤵
  PID:7128
- C:\Windows\System\LLeCPEJ.exe
  C:\Windows\System\LLeCPEJ.exe
  2⤵
  PID:7148
- C:\Windows\System\KexkagR.exe
  C:\Windows\System\KexkagR.exe
  2⤵
  PID:2464
- C:\Windows\System\EKwTMMN.exe
  C:\Windows\System\EKwTMMN.exe
  2⤵
  PID:6200
- C:\Windows\System\cggtnQd.exe
  C:\Windows\System\cggtnQd.exe
  2⤵
  PID:6256
- C:\Windows\System\YZTqZZA.exe
  C:\Windows\System\YZTqZZA.exe
  2⤵
  PID:6316
- C:\Windows\System\KVJeDhu.exe
  C:\Windows\System\KVJeDhu.exe
  2⤵
  PID:6400
- C:\Windows\System\PoDofmD.exe
  C:\Windows\System\PoDofmD.exe
  2⤵
  PID:6428
- C:\Windows\System\WGoGMAo.exe
  C:\Windows\System\WGoGMAo.exe
  2⤵
  PID:6520
- C:\Windows\System\vgxEaxj.exe
  C:\Windows\System\vgxEaxj.exe
  2⤵
  PID:6620
- C:\Windows\System\oCjzixu.exe
  C:\Windows\System\oCjzixu.exe
  2⤵
  PID:6664
- C:\Windows\System\EBHkVDS.exe
  C:\Windows\System\EBHkVDS.exe
  2⤵
  PID:6720
- C:\Windows\System\BwfDVSB.exe
  C:\Windows\System\BwfDVSB.exe
  2⤵
  PID:6832
- C:\Windows\System\RniKllI.exe
  C:\Windows\System\RniKllI.exe
  2⤵
  PID:6856
- C:\Windows\System\MYSYZjc.exe
  C:\Windows\System\MYSYZjc.exe
  2⤵
  PID:6940
- C:\Windows\System\jxnAWcT.exe
  C:\Windows\System\jxnAWcT.exe
  2⤵
  PID:7016
- C:\Windows\System\YgDKhsQ.exe
  C:\Windows\System\YgDKhsQ.exe
  2⤵
  PID:7080
- C:\Windows\System\GqfoFFE.exe
  C:\Windows\System\GqfoFFE.exe
  2⤵
  PID:7104
- C:\Windows\System\BSsnBtY.exe
  C:\Windows\System\BSsnBtY.exe
  2⤵
  PID:6196
- C:\Windows\System\bnVcpYq.exe
  C:\Windows\System\bnVcpYq.exe
  2⤵
  PID:6364
- C:\Windows\System\uWjoJee.exe
  C:\Windows\System\uWjoJee.exe
  2⤵
  PID:6492
- C:\Windows\System\aOBzKDR.exe
  C:\Windows\System\aOBzKDR.exe
  2⤵
  PID:6660
- C:\Windows\System\yRiymjj.exe
  C:\Windows\System\yRiymjj.exe
  2⤵
  PID:6848
- C:\Windows\System\FoNImCp.exe
  C:\Windows\System\FoNImCp.exe
  2⤵
  PID:6992
- C:\Windows\System\riOkAwo.exe
  C:\Windows\System\riOkAwo.exe
  2⤵
  PID:6188
- C:\Windows\System\dvBbIdV.exe
  C:\Windows\System\dvBbIdV.exe
  2⤵
  PID:6420
- C:\Windows\System\rZIlyrl.exe
  C:\Windows\System\rZIlyrl.exe
  2⤵
  PID:6736
- C:\Windows\System\wbXzWBQ.exe
  C:\Windows\System\wbXzWBQ.exe
  2⤵
  PID:7112
- C:\Windows\System\cohgsvv.exe
  C:\Windows\System\cohgsvv.exe
  2⤵
  PID:7048
- C:\Windows\System\gpxMyPH.exe
  C:\Windows\System\gpxMyPH.exe
  2⤵
  PID:6260
- C:\Windows\System\WGXWiqi.exe
  C:\Windows\System\WGXWiqi.exe
  2⤵
  PID:7188
- C:\Windows\System\JcPIorZ.exe
  C:\Windows\System\JcPIorZ.exe
  2⤵
  PID:7220
- C:\Windows\System\sFZKAJW.exe
  C:\Windows\System\sFZKAJW.exe
  2⤵
  PID:7244
- C:\Windows\System\WkjNZXx.exe
  C:\Windows\System\WkjNZXx.exe
  2⤵
  PID:7284
- C:\Windows\System\rLIRcMY.exe
  C:\Windows\System\rLIRcMY.exe
  2⤵
  PID:7324
- C:\Windows\System\JckKowr.exe
  C:\Windows\System\JckKowr.exe
  2⤵
  PID:7352
- C:\Windows\System\GTPcQpQ.exe
  C:\Windows\System\GTPcQpQ.exe
  2⤵
  PID:7368
- C:\Windows\System\szXSnWC.exe
  C:\Windows\System\szXSnWC.exe
  2⤵
  PID:7396
- C:\Windows\System\sSLUCaj.exe
  C:\Windows\System\sSLUCaj.exe
  2⤵
  PID:7432
- C:\Windows\System\BGrZQdF.exe
  C:\Windows\System\BGrZQdF.exe
  2⤵
  PID:7464
- C:\Windows\System\AbKieHp.exe
  C:\Windows\System\AbKieHp.exe
  2⤵
  PID:7484
- C:\Windows\System\XehYIft.exe
  C:\Windows\System\XehYIft.exe
  2⤵
  PID:7520
- C:\Windows\System\daDOhcM.exe
  C:\Windows\System\daDOhcM.exe
  2⤵
  PID:7556
- C:\Windows\System\QCRkXMr.exe
  C:\Windows\System\QCRkXMr.exe
  2⤵
  PID:7576
- C:\Windows\System\SvuFuGu.exe
  C:\Windows\System\SvuFuGu.exe
  2⤵
  PID:7600
- C:\Windows\System\skTazMS.exe
  C:\Windows\System\skTazMS.exe
  2⤵
  PID:7628
- C:\Windows\System\QrQAjvj.exe
  C:\Windows\System\QrQAjvj.exe
  2⤵
  PID:7652
- C:\Windows\System\oLlRfyS.exe
  C:\Windows\System\oLlRfyS.exe
  2⤵
  PID:7672
- C:\Windows\System\yLAVCaV.exe
  C:\Windows\System\yLAVCaV.exe
  2⤵
  PID:7700
- C:\Windows\System\fNsJMkM.exe
  C:\Windows\System\fNsJMkM.exe
  2⤵
  PID:7736
- C:\Windows\System\flTbnYA.exe
  C:\Windows\System\flTbnYA.exe
  2⤵
  PID:7768
- C:\Windows\System\gINnMie.exe
  C:\Windows\System\gINnMie.exe
  2⤵
  PID:7796
- C:\Windows\System\IeRnYLk.exe
  C:\Windows\System\IeRnYLk.exe
  2⤵
  PID:7816
- C:\Windows\System\FBvESsL.exe
  C:\Windows\System\FBvESsL.exe
  2⤵
  PID:7848
- C:\Windows\System\DmZQRti.exe
  C:\Windows\System\DmZQRti.exe
  2⤵
  PID:7872
- C:\Windows\System\TAFBzhR.exe
  C:\Windows\System\TAFBzhR.exe
  2⤵
  PID:7904
- C:\Windows\System\XVnGQrS.exe
  C:\Windows\System\XVnGQrS.exe
  2⤵
  PID:7924
- C:\Windows\System\mhTzzYD.exe
  C:\Windows\System\mhTzzYD.exe
  2⤵
  PID:7952
- C:\Windows\System\UNDRxng.exe
  C:\Windows\System\UNDRxng.exe
  2⤵
  PID:7996
- C:\Windows\System\nJVjPQm.exe
  C:\Windows\System\nJVjPQm.exe
  2⤵
  PID:8020
- C:\Windows\System\vdkLuDe.exe
  C:\Windows\System\vdkLuDe.exe
  2⤵
  PID:8048
- C:\Windows\System\wDakgyz.exe
  C:\Windows\System\wDakgyz.exe
  2⤵
  PID:8072
- C:\Windows\System\MNolALd.exe
  C:\Windows\System\MNolALd.exe
  2⤵
  PID:8104
- C:\Windows\System\nRFcuPu.exe
  C:\Windows\System\nRFcuPu.exe
  2⤵
  PID:8132
- C:\Windows\System\cvZxLFx.exe
  C:\Windows\System\cvZxLFx.exe
  2⤵
  PID:8148
- C:\Windows\System\kPunFVo.exe
  C:\Windows\System\kPunFVo.exe
  2⤵
  PID:8184
- C:\Windows\System\parBlBM.exe
  C:\Windows\System\parBlBM.exe
  2⤵
  PID:7176
- C:\Windows\System\UKHyzdX.exe
  C:\Windows\System\UKHyzdX.exe
  2⤵
  PID:7264
- C:\Windows\System\lOUhLWv.exe
  C:\Windows\System\lOUhLWv.exe
  2⤵
  PID:7316
- C:\Windows\System\xDbehuT.exe
  C:\Windows\System\xDbehuT.exe
  2⤵
  PID:7384
- C:\Windows\System\kSSlykg.exe
  C:\Windows\System\kSSlykg.exe
  2⤵
  PID:7460
- C:\Windows\System\qMErDef.exe
  C:\Windows\System\qMErDef.exe
  2⤵
  PID:7536
- C:\Windows\System\LwzbkXx.exe
  C:\Windows\System\LwzbkXx.exe
  2⤵
  PID:7584
- C:\Windows\System\EStCLPy.exe
  C:\Windows\System\EStCLPy.exe
  2⤵
  PID:7668
- C:\Windows\System\qoZbPvG.exe
  C:\Windows\System\qoZbPvG.exe
  2⤵
  PID:7708
- C:\Windows\System\LBwBmKv.exe
  C:\Windows\System\LBwBmKv.exe
  2⤵
  PID:7844
- C:\Windows\System\UkjJyjT.exe
  C:\Windows\System\UkjJyjT.exe
  2⤵
  PID:7888
- C:\Windows\System\vzzRkCR.exe
  C:\Windows\System\vzzRkCR.exe
  2⤵
  PID:8004
- C:\Windows\System\WoHWBJU.exe
  C:\Windows\System\WoHWBJU.exe
  2⤵
  PID:8036
- C:\Windows\System\AdcknCx.exe
  C:\Windows\System\AdcknCx.exe
  2⤵
  PID:8064
- C:\Windows\System\NWxmJeq.exe
  C:\Windows\System\NWxmJeq.exe
  2⤵
  PID:6336
- C:\Windows\System\VzcvPTJ.exe
  C:\Windows\System\VzcvPTJ.exe
  2⤵
  PID:7252
- C:\Windows\System\MqwVuvL.exe
  C:\Windows\System\MqwVuvL.exe
  2⤵
  PID:7308
- C:\Windows\System\FUwNpTX.exe
  C:\Windows\System\FUwNpTX.exe
  2⤵
  PID:7612
- C:\Windows\System\INvXQOp.exe
  C:\Windows\System\INvXQOp.exe
  2⤵
  PID:7792
- C:\Windows\System\shwqtOV.exe
  C:\Windows\System\shwqtOV.exe
  2⤵
  PID:7832
- C:\Windows\System\KHvAfIT.exe
  C:\Windows\System\KHvAfIT.exe
  2⤵
  PID:7976
- C:\Windows\System\LxElgvG.exe
  C:\Windows\System\LxElgvG.exe
  2⤵
  PID:7344
- C:\Windows\System\zRBTWxd.exe
  C:\Windows\System\zRBTWxd.exe
  2⤵
  PID:7424
- C:\Windows\System\jWMvNbm.exe
  C:\Windows\System\jWMvNbm.exe
  2⤵
  PID:7756
- C:\Windows\System\wbHtkpZ.exe
  C:\Windows\System\wbHtkpZ.exe
  2⤵
  PID:8116
- C:\Windows\System\uZtryWe.exe
  C:\Windows\System\uZtryWe.exe
  2⤵
  PID:7752
- C:\Windows\System\pLAuSAs.exe
  C:\Windows\System\pLAuSAs.exe
  2⤵
  PID:8204
- C:\Windows\System\SZUJwli.exe
  C:\Windows\System\SZUJwli.exe
  2⤵
  PID:8232
- C:\Windows\System\SvoYucM.exe
  C:\Windows\System\SvoYucM.exe
  2⤵
  PID:8264
- C:\Windows\System\LBLjNbc.exe
  C:\Windows\System\LBLjNbc.exe
  2⤵
  PID:8292
- C:\Windows\System\kRkxpxY.exe
  C:\Windows\System\kRkxpxY.exe
  2⤵
  PID:8320
- C:\Windows\System\dlvdOdb.exe
  C:\Windows\System\dlvdOdb.exe
  2⤵
  PID:8348
- C:\Windows\System\wKkLNVS.exe
  C:\Windows\System\wKkLNVS.exe
  2⤵
  PID:8372
- C:\Windows\System\gBdkjGV.exe
  C:\Windows\System\gBdkjGV.exe
  2⤵
  PID:8404
- C:\Windows\System\vioYgpf.exe
  C:\Windows\System\vioYgpf.exe
  2⤵
  PID:8428
- C:\Windows\System\FiWCXxK.exe
  C:\Windows\System\FiWCXxK.exe
  2⤵
  PID:8460
- C:\Windows\System\IHvZlip.exe
  C:\Windows\System\IHvZlip.exe
  2⤵
  PID:8492
- C:\Windows\System\lBvyOCZ.exe
  C:\Windows\System\lBvyOCZ.exe
  2⤵
  PID:8516
- C:\Windows\System\EtImCwz.exe
  C:\Windows\System\EtImCwz.exe
  2⤵
  PID:8556
- C:\Windows\System\MIyLLZq.exe
  C:\Windows\System\MIyLLZq.exe
  2⤵
  PID:8580
- C:\Windows\System\TdJxPwp.exe
  C:\Windows\System\TdJxPwp.exe
  2⤵
  PID:8600
- C:\Windows\System\hRXqCVC.exe
  C:\Windows\System\hRXqCVC.exe
  2⤵
  PID:8628
- C:\Windows\System\ffolCkr.exe
  C:\Windows\System\ffolCkr.exe
  2⤵
  PID:8652
- C:\Windows\System\cfaztNX.exe
  C:\Windows\System\cfaztNX.exe
  2⤵
  PID:8684
- C:\Windows\System\bePmlQQ.exe
  C:\Windows\System\bePmlQQ.exe
  2⤵
  PID:8712
- C:\Windows\System\cgyttzk.exe
  C:\Windows\System\cgyttzk.exe
  2⤵
  PID:8740
- C:\Windows\System\XfbmoHG.exe
  C:\Windows\System\XfbmoHG.exe
  2⤵
  PID:8760
- C:\Windows\System\lKEnqHF.exe
  C:\Windows\System\lKEnqHF.exe
  2⤵
  PID:8796
- C:\Windows\System\csJbbzK.exe
  C:\Windows\System\csJbbzK.exe
  2⤵
  PID:8832
- C:\Windows\System\uHoLUSk.exe
  C:\Windows\System\uHoLUSk.exe
  2⤵
  PID:8864
- C:\Windows\System\GfkqoRh.exe
  C:\Windows\System\GfkqoRh.exe
  2⤵
  PID:8896
- C:\Windows\System\LOCXaNA.exe
  C:\Windows\System\LOCXaNA.exe
  2⤵
  PID:8924
- C:\Windows\System\CkZUcsT.exe
  C:\Windows\System\CkZUcsT.exe
  2⤵
  PID:8952
- C:\Windows\System\PDScUrp.exe
  C:\Windows\System\PDScUrp.exe
  2⤵
  PID:8972
- C:\Windows\System\BIpMZZn.exe
  C:\Windows\System\BIpMZZn.exe
  2⤵
  PID:8996
- C:\Windows\System\FeAniOK.exe
  C:\Windows\System\FeAniOK.exe
  2⤵
  PID:9028
- C:\Windows\System\xzXVYzV.exe
  C:\Windows\System\xzXVYzV.exe
  2⤵
  PID:9056
- C:\Windows\System\KpIwPMi.exe
  C:\Windows\System\KpIwPMi.exe
  2⤵
  PID:9080
- C:\Windows\System\ibmTaVZ.exe
  C:\Windows\System\ibmTaVZ.exe
  2⤵
  PID:9108
- C:\Windows\System\PfQCsgM.exe
  C:\Windows\System\PfQCsgM.exe
  2⤵
  PID:9124
- C:\Windows\System\VsGkmxk.exe
  C:\Windows\System\VsGkmxk.exe
  2⤵
  PID:9176
- C:\Windows\System\UglKHSy.exe
  C:\Windows\System\UglKHSy.exe
  2⤵
  PID:9204
- C:\Windows\System\RBZJuZh.exe
  C:\Windows\System\RBZJuZh.exe
  2⤵
  PID:8200
- C:\Windows\System\SExhKcq.exe
  C:\Windows\System\SExhKcq.exe
  2⤵
  PID:8276
- C:\Windows\System\ogUpwYR.exe
  C:\Windows\System\ogUpwYR.exe
  2⤵
  PID:8336
- C:\Windows\System\eArzugW.exe
  C:\Windows\System\eArzugW.exe
  2⤵
  PID:8396
- C:\Windows\System\lnNMIdr.exe
  C:\Windows\System\lnNMIdr.exe
  2⤵
  PID:8456
- C:\Windows\System\GzaWFbw.exe
  C:\Windows\System\GzaWFbw.exe
  2⤵
  PID:8504
- C:\Windows\System\njhBRiy.exe
  C:\Windows\System\njhBRiy.exe
  2⤵
  PID:8572
- C:\Windows\System\rzemDeW.exe
  C:\Windows\System\rzemDeW.exe
  2⤵
  PID:8664
- C:\Windows\System\eKYCMJH.exe
  C:\Windows\System\eKYCMJH.exe
  2⤵
  PID:8708
- C:\Windows\System\zmbewox.exe
  C:\Windows\System\zmbewox.exe
  2⤵
  PID:8780
- C:\Windows\System\QAkGdyh.exe
  C:\Windows\System\QAkGdyh.exe
  2⤵
  PID:8828
- C:\Windows\System\ImuAXzd.exe
  C:\Windows\System\ImuAXzd.exe
  2⤵
  PID:8920
- C:\Windows\System\ezrvomQ.exe
  C:\Windows\System\ezrvomQ.exe
  2⤵
  PID:8944
- C:\Windows\System\NBUsJXd.exe
  C:\Windows\System\NBUsJXd.exe
  2⤵
  PID:9016
- C:\Windows\System\vmXEIdT.exe
  C:\Windows\System\vmXEIdT.exe
  2⤵
  PID:9140
- C:\Windows\System\kjpXapM.exe
  C:\Windows\System\kjpXapM.exe
  2⤵
  PID:9172
- C:\Windows\System\ENdQUSE.exe
  C:\Windows\System\ENdQUSE.exe
  2⤵
  PID:8240
- C:\Windows\System\tlHQdkL.exe
  C:\Windows\System\tlHQdkL.exe
  2⤵
  PID:8392
- C:\Windows\System\SRgDEnp.exe
  C:\Windows\System\SRgDEnp.exe
  2⤵
  PID:8500
- C:\Windows\System\dfZRUoM.exe
  C:\Windows\System\dfZRUoM.exe
  2⤵
  PID:8700
- C:\Windows\System\FUqNQTT.exe
  C:\Windows\System\FUqNQTT.exe
  2⤵
  PID:8164
- C:\Windows\System\OTiBNVg.exe
  C:\Windows\System\OTiBNVg.exe
  2⤵
  PID:8940
- C:\Windows\System\bRXCCco.exe
  C:\Windows\System\bRXCCco.exe
  2⤵
  PID:9044
- C:\Windows\System\UQPtXpC.exe
  C:\Windows\System\UQPtXpC.exe
  2⤵
  PID:9120
- C:\Windows\System\fIDUeQG.exe
  C:\Windows\System\fIDUeQG.exe
  2⤵
  PID:8620
- C:\Windows\System\HaaUCVX.exe
  C:\Windows\System\HaaUCVX.exe
  2⤵
  PID:8908
- C:\Windows\System\Qbuxktj.exe
  C:\Windows\System\Qbuxktj.exe
  2⤵
  PID:8196
- C:\Windows\System\qgppMWj.exe
  C:\Windows\System\qgppMWj.exe
  2⤵
  PID:9116
- C:\Windows\System\lYwgUOv.exe
  C:\Windows\System\lYwgUOv.exe
  2⤵
  PID:9228
- C:\Windows\System\roEhSsi.exe
  C:\Windows\System\roEhSsi.exe
  2⤵
  PID:9276
- C:\Windows\System\MsPMJpy.exe
  C:\Windows\System\MsPMJpy.exe
  2⤵
  PID:9304
- C:\Windows\System\jiPNSsm.exe
  C:\Windows\System\jiPNSsm.exe
  2⤵
  PID:9332
- C:\Windows\System\OhFSWEO.exe
  C:\Windows\System\OhFSWEO.exe
  2⤵
  PID:9360
- C:\Windows\System\uyhafOV.exe
  C:\Windows\System\uyhafOV.exe
  2⤵
  PID:9388
- C:\Windows\System\UnQhHYG.exe
  C:\Windows\System\UnQhHYG.exe
  2⤵
  PID:9408
- C:\Windows\System\hbJjFPQ.exe
  C:\Windows\System\hbJjFPQ.exe
  2⤵
  PID:9432
- C:\Windows\System\bRQPWCc.exe
  C:\Windows\System\bRQPWCc.exe
  2⤵
  PID:9460
- C:\Windows\System\VHaWMoE.exe
  C:\Windows\System\VHaWMoE.exe
  2⤵
  PID:9492
- C:\Windows\System\JFBpnBz.exe
  C:\Windows\System\JFBpnBz.exe
  2⤵
  PID:9520
- C:\Windows\System\ErqLhvb.exe
  C:\Windows\System\ErqLhvb.exe
  2⤵
  PID:9556
- C:\Windows\System\JjsXmDx.exe
  C:\Windows\System\JjsXmDx.exe
  2⤵
  PID:9576
- C:\Windows\System\nVdsNYL.exe
  C:\Windows\System\nVdsNYL.exe
  2⤵
  PID:9600
- C:\Windows\System\MbgsBGR.exe
  C:\Windows\System\MbgsBGR.exe
  2⤵
  PID:9620
- C:\Windows\System\uAulAeC.exe
  C:\Windows\System\uAulAeC.exe
  2⤵
  PID:9652
- C:\Windows\System\yZeYfau.exe
  C:\Windows\System\yZeYfau.exe
  2⤵
  PID:9696
- C:\Windows\System\jBmMAzh.exe
  C:\Windows\System\jBmMAzh.exe
  2⤵
  PID:9724
- C:\Windows\System\ACXRdrS.exe
  C:\Windows\System\ACXRdrS.exe
  2⤵
  PID:9744
- C:\Windows\System\MfHAIgl.exe
  C:\Windows\System\MfHAIgl.exe
  2⤵
  PID:9764
- C:\Windows\System\mEcQknS.exe
  C:\Windows\System\mEcQknS.exe
  2⤵
  PID:9796
- C:\Windows\System\bYuTMuH.exe
  C:\Windows\System\bYuTMuH.exe
  2⤵
  PID:9824
- C:\Windows\System\PqrvnLv.exe
  C:\Windows\System\PqrvnLv.exe
  2⤵
  PID:9844
- C:\Windows\System\UVoNjAh.exe
  C:\Windows\System\UVoNjAh.exe
  2⤵
  PID:9872
- C:\Windows\System\WDAEhIL.exe
  C:\Windows\System\WDAEhIL.exe
  2⤵
  PID:9900
- C:\Windows\System\wpoqimz.exe
  C:\Windows\System\wpoqimz.exe
  2⤵
  PID:9924
- C:\Windows\System\pTYifMM.exe
  C:\Windows\System\pTYifMM.exe
  2⤵
  PID:9956
- C:\Windows\System\KKMSVBr.exe
  C:\Windows\System\KKMSVBr.exe
  2⤵
  PID:9988
- C:\Windows\System\pneUZGE.exe
  C:\Windows\System\pneUZGE.exe
  2⤵
  PID:10012
- C:\Windows\System\FEjFIHR.exe
  C:\Windows\System\FEjFIHR.exe
  2⤵
  PID:10048
- C:\Windows\System\VpepodA.exe
  C:\Windows\System\VpepodA.exe
  2⤵
  PID:10076
- C:\Windows\System\TalPPHK.exe
  C:\Windows\System\TalPPHK.exe
  2⤵
  PID:10092
- C:\Windows\System\fggqorT.exe
  C:\Windows\System\fggqorT.exe
  2⤵
  PID:10152
- C:\Windows\System\uVRBhDv.exe
  C:\Windows\System\uVRBhDv.exe
  2⤵
  PID:10168
- C:\Windows\System\PcrdOFg.exe
  C:\Windows\System\PcrdOFg.exe
  2⤵
  PID:10196
- C:\Windows\System\UCWwORQ.exe
  C:\Windows\System\UCWwORQ.exe
  2⤵
  PID:10212
- C:\Windows\System\TsUnFHZ.exe
  C:\Windows\System\TsUnFHZ.exe
  2⤵
  PID:8648
- C:\Windows\System\RpiqKCw.exe
  C:\Windows\System\RpiqKCw.exe
  2⤵
  PID:9264
- C:\Windows\System\FwWAJaN.exe
  C:\Windows\System\FwWAJaN.exe
  2⤵
  PID:9316
- C:\Windows\System\haqxjmE.exe
  C:\Windows\System\haqxjmE.exe
  2⤵
  PID:9372
- C:\Windows\System\cbmnOop.exe
  C:\Windows\System\cbmnOop.exe
  2⤵
  PID:9500
- C:\Windows\System\OCOWnFW.exe
  C:\Windows\System\OCOWnFW.exe
  2⤵
  PID:9564
- C:\Windows\System\CpCruDI.exe
  C:\Windows\System\CpCruDI.exe
  2⤵
  PID:9632
- C:\Windows\System\vUDMNnL.exe
  C:\Windows\System\vUDMNnL.exe
  2⤵
  PID:9708
- C:\Windows\System\xZfqDid.exe
  C:\Windows\System\xZfqDid.exe
  2⤵
  PID:9752
- C:\Windows\System\WeosgfQ.exe
  C:\Windows\System\WeosgfQ.exe
  2⤵
  PID:9816
- C:\Windows\System\xbWcMCZ.exe
  C:\Windows\System\xbWcMCZ.exe
  2⤵
  PID:9856
- C:\Windows\System\SbvsKeC.exe
  C:\Windows\System\SbvsKeC.exe
  2⤵
  PID:9912
- C:\Windows\System\YkHkEpy.exe
  C:\Windows\System\YkHkEpy.exe
  2⤵
  PID:10000
- C:\Windows\System\xzOeyNn.exe
  C:\Windows\System\xzOeyNn.exe
  2⤵
  PID:10064
- C:\Windows\System\gggNnrD.exe
  C:\Windows\System\gggNnrD.exe
  2⤵
  PID:10184
- C:\Windows\System\PAmiBpW.exe
  C:\Windows\System\PAmiBpW.exe
  2⤵
  PID:10208
- C:\Windows\System\fgEveVy.exe
  C:\Windows\System\fgEveVy.exe
  2⤵
  PID:9248
- C:\Windows\System\PgdmaIo.exe
  C:\Windows\System\PgdmaIo.exe
  2⤵
  PID:9376
- C:\Windows\System\IeQkbvR.exe
  C:\Windows\System\IeQkbvR.exe
  2⤵
  PID:9548
- C:\Windows\System\LOcRfcS.exe
  C:\Windows\System\LOcRfcS.exe
  2⤵
  PID:9692
- C:\Windows\System\RhKDCAO.exe
  C:\Windows\System\RhKDCAO.exe
  2⤵
  PID:9864
- C:\Windows\System\yElwFNU.exe
  C:\Windows\System\yElwFNU.exe
  2⤵
  PID:9948
- C:\Windows\System\RZojcuR.exe
  C:\Windows\System\RZojcuR.exe
  2⤵
  PID:10148
- C:\Windows\System\wFvKrvD.exe
  C:\Windows\System\wFvKrvD.exe
  2⤵
  PID:9348
- C:\Windows\System\lkaXGWz.exe
  C:\Windows\System\lkaXGWz.exe
  2⤵
  PID:9736
- C:\Windows\System\YuGDlgY.exe
  C:\Windows\System\YuGDlgY.exe
  2⤵
  PID:10128
- C:\Windows\System\MWhxoEb.exe
  C:\Windows\System\MWhxoEb.exe
  2⤵
  PID:9444
- C:\Windows\System\zsYdJEZ.exe
  C:\Windows\System\zsYdJEZ.exe
  2⤵
  PID:10244
- C:\Windows\System\MfghAkw.exe
  C:\Windows\System\MfghAkw.exe
  2⤵
  PID:10272
- C:\Windows\System\siPNqPQ.exe
  C:\Windows\System\siPNqPQ.exe
  2⤵
  PID:10304
- C:\Windows\System\KvMuTIv.exe
  C:\Windows\System\KvMuTIv.exe
  2⤵
  PID:10332
- C:\Windows\System\HQEfReV.exe
  C:\Windows\System\HQEfReV.exe
  2⤵
  PID:10360
- C:\Windows\System\dnFFuuR.exe
  C:\Windows\System\dnFFuuR.exe
  2⤵
  PID:10380
- C:\Windows\System\nrkRLxE.exe
  C:\Windows\System\nrkRLxE.exe
  2⤵
  PID:10420
- C:\Windows\System\jTgODbB.exe
  C:\Windows\System\jTgODbB.exe
  2⤵
  PID:10456
- C:\Windows\System\eJnoiCi.exe
  C:\Windows\System\eJnoiCi.exe
  2⤵
  PID:10484
- C:\Windows\System\NyZaprb.exe
  C:\Windows\System\NyZaprb.exe
  2⤵
  PID:10500
- C:\Windows\System\sUuVils.exe
  C:\Windows\System\sUuVils.exe
  2⤵
  PID:10528
- C:\Windows\System\TztJoPt.exe
  C:\Windows\System\TztJoPt.exe
  2⤵
  PID:10556
- C:\Windows\System\GcFXmky.exe
  C:\Windows\System\GcFXmky.exe
  2⤵
  PID:10596
- C:\Windows\System\jOOGAxP.exe
  C:\Windows\System\jOOGAxP.exe
  2⤵
  PID:10624
- C:\Windows\System\zwHOrfF.exe
  C:\Windows\System\zwHOrfF.exe
  2⤵
  PID:10652
- C:\Windows\System\FkWHxDP.exe
  C:\Windows\System\FkWHxDP.exe
  2⤵
  PID:10668
- C:\Windows\System\IfMaNMS.exe
  C:\Windows\System\IfMaNMS.exe
  2⤵
  PID:10700
- C:\Windows\System\KdYHtKs.exe
  C:\Windows\System\KdYHtKs.exe
  2⤵
  PID:10736
- C:\Windows\System\VyZcseK.exe
  C:\Windows\System\VyZcseK.exe
  2⤵
  PID:10764
- C:\Windows\System\eqmzBtY.exe
  C:\Windows\System\eqmzBtY.exe
  2⤵
  PID:10792
- C:\Windows\System\XGcLQac.exe
  C:\Windows\System\XGcLQac.exe
  2⤵
  PID:10820
- C:\Windows\System\iFnwUlW.exe
  C:\Windows\System\iFnwUlW.exe
  2⤵
  PID:10848
- C:\Windows\System\nPvowLE.exe
  C:\Windows\System\nPvowLE.exe
  2⤵
  PID:10872
- C:\Windows\System\yCdWRji.exe
  C:\Windows\System\yCdWRji.exe
  2⤵
  PID:10892
- C:\Windows\System\cJSNwhq.exe
  C:\Windows\System\cJSNwhq.exe
  2⤵
  PID:10932
- C:\Windows\System\SKQyXwM.exe
  C:\Windows\System\SKQyXwM.exe
  2⤵
  PID:10948
- C:\Windows\System\EvnIHtN.exe
  C:\Windows\System\EvnIHtN.exe
  2⤵
  PID:10976
- C:\Windows\System\ajdxZIN.exe
  C:\Windows\System\ajdxZIN.exe
  2⤵
  PID:11004
- C:\Windows\System\rbVQwfo.exe
  C:\Windows\System\rbVQwfo.exe
  2⤵
  PID:11044
- C:\Windows\System\NwsVlxt.exe
  C:\Windows\System\NwsVlxt.exe
  2⤵
  PID:11060
- C:\Windows\System\XnslFqo.exe
  C:\Windows\System\XnslFqo.exe
  2⤵
  PID:11088
- C:\Windows\System\VxhddHJ.exe
  C:\Windows\System\VxhddHJ.exe
  2⤵
  PID:11116
- C:\Windows\System\UMtHGZZ.exe
  C:\Windows\System\UMtHGZZ.exe
  2⤵
  PID:11132
- C:\Windows\System\kjyBmZc.exe
  C:\Windows\System\kjyBmZc.exe
  2⤵
  PID:11164
- C:\Windows\System\AWqzQbB.exe
  C:\Windows\System\AWqzQbB.exe
  2⤵
  PID:11188
- C:\Windows\System\CcpIWTk.exe
  C:\Windows\System\CcpIWTk.exe
  2⤵
  PID:11232
- C:\Windows\System\sKiiZhY.exe
  C:\Windows\System\sKiiZhY.exe
  2⤵
  PID:11256
- C:\Windows\System\qIVWaAt.exe
  C:\Windows\System\qIVWaAt.exe
  2⤵
  PID:10312
- C:\Windows\System\lHZHJjP.exe
  C:\Windows\System\lHZHJjP.exe
  2⤵
  PID:10356
- C:\Windows\System\mTVjHmG.exe
  C:\Windows\System\mTVjHmG.exe
  2⤵
  PID:10428
- C:\Windows\System\tMnVkzr.exe
  C:\Windows\System\tMnVkzr.exe
  2⤵
  PID:10480
- C:\Windows\System\flveZQl.exe
  C:\Windows\System\flveZQl.exe
  2⤵
  PID:10548
- C:\Windows\System\xYttVHP.exe
  C:\Windows\System\xYttVHP.exe
  2⤵
  PID:10636
- C:\Windows\System\zUCrXuq.exe
  C:\Windows\System\zUCrXuq.exe
  2⤵
  PID:10644
- C:\Windows\System\TbFSApC.exe
  C:\Windows\System\TbFSApC.exe
  2⤵
  PID:10692
- C:\Windows\System\qMAAtxj.exe
  C:\Windows\System\qMAAtxj.exe
  2⤵
  PID:10760
- C:\Windows\System\vrGbnVs.exe
  C:\Windows\System\vrGbnVs.exe
  2⤵
  PID:10816
- C:\Windows\System\ZBsbJmA.exe
  C:\Windows\System\ZBsbJmA.exe
  2⤵
  PID:10928
- C:\Windows\System\BxaatwU.exe
  C:\Windows\System\BxaatwU.exe
  2⤵
  PID:10972
- C:\Windows\System\wwHZJQf.exe
  C:\Windows\System\wwHZJQf.exe
  2⤵
  PID:11040
- C:\Windows\System\dePgJgn.exe
  C:\Windows\System\dePgJgn.exe
  2⤵
  PID:11100
- C:\Windows\System\OuUDgwf.exe
  C:\Windows\System\OuUDgwf.exe
  2⤵
  PID:11204
- C:\Windows\System\yIoZaNK.exe
  C:\Windows\System\yIoZaNK.exe
  2⤵
  PID:9300
- C:\Windows\System\kcAErHV.exe
  C:\Windows\System\kcAErHV.exe
  2⤵
  PID:10396
- C:\Windows\System\NjsTemS.exe
  C:\Windows\System\NjsTemS.exe
  2⤵
  PID:10516
- C:\Windows\System\QiEdYDO.exe
  C:\Windows\System\QiEdYDO.exe
  2⤵
  PID:10684
- C:\Windows\System\RGRYEGT.exe
  C:\Windows\System\RGRYEGT.exe
  2⤵
  PID:10832
- C:\Windows\System\IdypASU.exe
  C:\Windows\System\IdypASU.exe
  2⤵
  PID:11000
- C:\Windows\System\WvIurWu.exe
  C:\Windows\System\WvIurWu.exe
  2⤵
  PID:11072
- C:\Windows\System\IdURynf.exe
  C:\Windows\System\IdURynf.exe
  2⤵
  PID:10284
- C:\Windows\System\vyDhYSW.exe
  C:\Windows\System\vyDhYSW.exe
  2⤵
  PID:10468
- C:\Windows\System\wxwLVnw.exe
  C:\Windows\System\wxwLVnw.exe
  2⤵
  PID:10808
- C:\Windows\System\aDwrsPl.exe
  C:\Windows\System\aDwrsPl.exe
  2⤵
  PID:11160
- C:\Windows\System\bTpYOpO.exe
  C:\Windows\System\bTpYOpO.exe
  2⤵
  PID:10732
- C:\Windows\System\lMQaedP.exe
  C:\Windows\System\lMQaedP.exe
  2⤵
  PID:10348
- C:\Windows\System\zOxCdOj.exe
  C:\Windows\System\zOxCdOj.exe
  2⤵
  PID:11296
- C:\Windows\System\TqHlbrR.exe
  C:\Windows\System\TqHlbrR.exe
  2⤵
  PID:11332
- C:\Windows\System\uVwqQGV.exe
  C:\Windows\System\uVwqQGV.exe
  2⤵
  PID:11364
- C:\Windows\System\SKYkJsO.exe
  C:\Windows\System\SKYkJsO.exe
  2⤵
  PID:11392
- C:\Windows\System\BFfBVeX.exe
  C:\Windows\System\BFfBVeX.exe
  2⤵
  PID:11408
- C:\Windows\System\ChChhnK.exe
  C:\Windows\System\ChChhnK.exe
  2⤵
  PID:11436
- C:\Windows\System\ClMnvHF.exe
  C:\Windows\System\ClMnvHF.exe
  2⤵
  PID:11464
- C:\Windows\System\VoPraId.exe
  C:\Windows\System\VoPraId.exe
  2⤵
  PID:11492
- C:\Windows\System\PdqAgts.exe
  C:\Windows\System\PdqAgts.exe
  2⤵
  PID:11520
- C:\Windows\System\vPxMpJy.exe
  C:\Windows\System\vPxMpJy.exe
  2⤵
  PID:11552
- C:\Windows\System\DekQcgH.exe
  C:\Windows\System\DekQcgH.exe
  2⤵
  PID:11576
- C:\Windows\System\njJSHys.exe
  C:\Windows\System\njJSHys.exe
  2⤵
  PID:11604
- C:\Windows\System\OWifeJR.exe
  C:\Windows\System\OWifeJR.exe
  2⤵
  PID:11632
- C:\Windows\System\lrmWXgy.exe
  C:\Windows\System\lrmWXgy.exe
  2⤵
  PID:11660
- C:\Windows\System\MfsVSmO.exe
  C:\Windows\System\MfsVSmO.exe
  2⤵
  PID:11700
- C:\Windows\System\DjEZeOG.exe
  C:\Windows\System\DjEZeOG.exe
  2⤵
  PID:11716
- C:\Windows\System\AkaOgtg.exe
  C:\Windows\System\AkaOgtg.exe
  2⤵
  PID:11744
- C:\Windows\System\OxVQdRh.exe
  C:\Windows\System\OxVQdRh.exe
  2⤵
  PID:11760
- C:\Windows\System\FTLZANW.exe
  C:\Windows\System\FTLZANW.exe
  2⤵
  PID:11816
- C:\Windows\System\IvRtqhB.exe
  C:\Windows\System\IvRtqhB.exe
  2⤵
  PID:11832
- C:\Windows\System\TjVKjKC.exe
  C:\Windows\System\TjVKjKC.exe
  2⤵
  PID:11864
- C:\Windows\System\cqpzsqG.exe
  C:\Windows\System\cqpzsqG.exe
  2⤵
  PID:11892
- C:\Windows\System\dpPBgIj.exe
  C:\Windows\System\dpPBgIj.exe
  2⤵
  PID:11928
- C:\Windows\System\NJSiBJU.exe
  C:\Windows\System\NJSiBJU.exe
  2⤵
  PID:11956
- C:\Windows\System\xrswWcf.exe
  C:\Windows\System\xrswWcf.exe
  2⤵
  PID:11984
- C:\Windows\System\nwCeSQZ.exe
  C:\Windows\System\nwCeSQZ.exe
  2⤵
  PID:12004
- C:\Windows\System\fjTiiWK.exe
  C:\Windows\System\fjTiiWK.exe
  2⤵
  PID:12032
- C:\Windows\System\oODuILK.exe
  C:\Windows\System\oODuILK.exe
  2⤵
  PID:12060
- C:\Windows\System\zMpALrO.exe
  C:\Windows\System\zMpALrO.exe
  2⤵
  PID:12084
- C:\Windows\System\FOfOGjf.exe
  C:\Windows\System\FOfOGjf.exe
  2⤵
  PID:12104
- C:\Windows\System\PoxUvyQ.exe
  C:\Windows\System\PoxUvyQ.exe
  2⤵
  PID:12132
- C:\Windows\System\naOVYRZ.exe
  C:\Windows\System\naOVYRZ.exe
  2⤵
  PID:12160
- C:\Windows\System\oVcMNEe.exe
  C:\Windows\System\oVcMNEe.exe
  2⤵
  PID:12180
- C:\Windows\System\ZWMxrHA.exe
  C:\Windows\System\ZWMxrHA.exe
  2⤵
  PID:12208
- C:\Windows\System\qNdMxgc.exe
  C:\Windows\System\qNdMxgc.exe
  2⤵
  PID:12264
- C:\Windows\System\nEWXOKz.exe
  C:\Windows\System\nEWXOKz.exe
  2⤵
  PID:10320
- C:\Windows\System\XEArHEW.exe
  C:\Windows\System\XEArHEW.exe
  2⤵
  PID:11312
- C:\Windows\System\OCGfjGO.exe
  C:\Windows\System\OCGfjGO.exe
  2⤵
  PID:11384
- C:\Windows\System\qlDWzqF.exe
  C:\Windows\System\qlDWzqF.exe
  2⤵
  PID:11424
- C:\Windows\System\ODGbMOF.exe
  C:\Windows\System\ODGbMOF.exe
  2⤵
  PID:11480
- C:\Windows\System\IagZGos.exe
  C:\Windows\System\IagZGos.exe
  2⤵
  PID:11560
- C:\Windows\System\TkJkdTL.exe
  C:\Windows\System\TkJkdTL.exe
  2⤵
  PID:11620
- C:\Windows\System\pfXMPYs.exe
  C:\Windows\System\pfXMPYs.exe
  2⤵
  PID:11712
- C:\Windows\System\eNKgooP.exe
  C:\Windows\System\eNKgooP.exe
  2⤵
  PID:11792
- C:\Windows\System\wsUXjuR.exe
  C:\Windows\System\wsUXjuR.exe
  2⤵
  PID:11808
- C:\Windows\System\JYTQNNb.exe
  C:\Windows\System\JYTQNNb.exe
  2⤵
  PID:11844
- C:\Windows\System\QBPlOnh.exe
  C:\Windows\System\QBPlOnh.exe
  2⤵
  PID:11980
- C:\Windows\System\ZHLqHFK.exe
  C:\Windows\System\ZHLqHFK.exe
  2⤵
  PID:12048
- C:\Windows\System\gyIWKhG.exe
  C:\Windows\System\gyIWKhG.exe
  2⤵
  PID:12168
- C:\Windows\System\IQZakcx.exe
  C:\Windows\System\IQZakcx.exe
  2⤵
  PID:12176
- C:\Windows\System\lxqmRYL.exe
  C:\Windows\System\lxqmRYL.exe
  2⤵
  PID:12252
- C:\Windows\System\LeFLAGc.exe
  C:\Windows\System\LeFLAGc.exe
  2⤵
  PID:12280
- C:\Windows\System\pUGaDPr.exe
  C:\Windows\System\pUGaDPr.exe
  2⤵
  PID:11388
- C:\Windows\System\Buigtvo.exe
  C:\Windows\System\Buigtvo.exe
  2⤵
  PID:11484
- C:\Windows\System\Yssehci.exe
  C:\Windows\System\Yssehci.exe
  2⤵
  PID:11772
- C:\Windows\System\oyRMtPJ.exe
  C:\Windows\System\oyRMtPJ.exe
  2⤵
  PID:11944
- C:\Windows\System\rkiOsFA.exe
  C:\Windows\System\rkiOsFA.exe
  2⤵
  PID:12028
- C:\Windows\System\hRuMyLv.exe
  C:\Windows\System\hRuMyLv.exe
  2⤵
  PID:12224
- C:\Windows\System\UdisXqs.exe
  C:\Windows\System\UdisXqs.exe
  2⤵
  PID:11344
- C:\Windows\System\KBOBGWU.exe
  C:\Windows\System\KBOBGWU.exe
  2⤵
  PID:11736
- C:\Windows\System\YqEFraF.exe
  C:\Windows\System\YqEFraF.exe
  2⤵
  PID:12080
- C:\Windows\System\dokCeMD.exe
  C:\Windows\System\dokCeMD.exe
  2⤵
  PID:11696
- C:\Windows\System\xDUXtSi.exe
  C:\Windows\System\xDUXtSi.exe
  2⤵
  PID:12200
- C:\Windows\System\JgPpuBh.exe
  C:\Windows\System\JgPpuBh.exe
  2⤵
  PID:12308
- C:\Windows\System\gLBTjeg.exe
  C:\Windows\System\gLBTjeg.exe
  2⤵
  PID:12324
- C:\Windows\System\pxShxEP.exe
  C:\Windows\System\pxShxEP.exe
  2⤵
  PID:12360
- C:\Windows\System\HFNnkmD.exe
  C:\Windows\System\HFNnkmD.exe
  2⤵
  PID:12392
- C:\Windows\System\dyAtiTe.exe
  C:\Windows\System\dyAtiTe.exe
  2⤵
  PID:12420
- C:\Windows\System\mvXqLpt.exe
  C:\Windows\System\mvXqLpt.exe
  2⤵
  PID:12444
- C:\Windows\System\uozbXgt.exe
  C:\Windows\System\uozbXgt.exe
  2⤵
  PID:12464
- C:\Windows\System\DKYsNTf.exe
  C:\Windows\System\DKYsNTf.exe
  2⤵
  PID:12504
- C:\Windows\System\ILtwxRs.exe
  C:\Windows\System\ILtwxRs.exe
  2⤵
  PID:12520
- C:\Windows\System\tHPzxIz.exe
  C:\Windows\System\tHPzxIz.exe
  2⤵
  PID:12552
- C:\Windows\System\NYljVbS.exe
  C:\Windows\System\NYljVbS.exe
  2⤵
  PID:12572
- C:\Windows\System\bOgscXl.exe
  C:\Windows\System\bOgscXl.exe
  2⤵
  PID:12608
- C:\Windows\System\TQNGuJY.exe
  C:\Windows\System\TQNGuJY.exe
  2⤵
  PID:12628
- C:\Windows\System\zqptnYg.exe
  C:\Windows\System\zqptnYg.exe
  2⤵
  PID:12644
- C:\Windows\System\bSsgXMf.exe
  C:\Windows\System\bSsgXMf.exe
  2⤵
  PID:12672
- C:\Windows\System\nYzfglg.exe
  C:\Windows\System\nYzfglg.exe
  2⤵
  PID:12728
- C:\Windows\System\EkqhVGe.exe
  C:\Windows\System\EkqhVGe.exe
  2⤵
  PID:12756
- C:\Windows\System\NOgYwCe.exe
  C:\Windows\System\NOgYwCe.exe
  2⤵
  PID:12772
- C:\Windows\System\CiIrLFH.exe
  C:\Windows\System\CiIrLFH.exe
  2⤵
  PID:12796
- C:\Windows\System\xVKqqJw.exe
  C:\Windows\System\xVKqqJw.exe
  2⤵
  PID:12820
- C:\Windows\System\BjrTIUA.exe
  C:\Windows\System\BjrTIUA.exe
  2⤵
  PID:12868
- C:\Windows\System\KyotByP.exe
  C:\Windows\System\KyotByP.exe
  2⤵
  PID:12892
- C:\Windows\System\viGXTVX.exe
  C:\Windows\System\viGXTVX.exe
  2⤵
  PID:12924
- C:\Windows\System\OfyDQVm.exe
  C:\Windows\System\OfyDQVm.exe
  2⤵
  PID:12940
- C:\Windows\System\npFxaLW.exe
  C:\Windows\System\npFxaLW.exe
  2⤵
  PID:12968
- C:\Windows\System\SbAtuhP.exe
  C:\Windows\System\SbAtuhP.exe
  2⤵
  PID:12996
- C:\Windows\System\eHBXRHS.exe
  C:\Windows\System\eHBXRHS.exe
  2⤵
  PID:13024
- C:\Windows\System\OgwMrLv.exe
  C:\Windows\System\OgwMrLv.exe
  2⤵
  PID:13052
- C:\Windows\System\YNlbMjz.exe
  C:\Windows\System\YNlbMjz.exe
  2⤵
  PID:13092
- C:\Windows\System\NGENtMI.exe
  C:\Windows\System\NGENtMI.exe
  2⤵
  PID:13116
- C:\Windows\System\lyAhlMf.exe
  C:\Windows\System\lyAhlMf.exe
  2⤵
  PID:13148
- C:\Windows\System\URIPzBC.exe
  C:\Windows\System\URIPzBC.exe
  2⤵
  PID:13176
- C:\Windows\System\HJeFmMt.exe
  C:\Windows\System\HJeFmMt.exe
  2⤵
  PID:13192
- C:\Windows\System\TRvmuIe.exe
  C:\Windows\System\TRvmuIe.exe
  2⤵
  PID:13224
- C:\Windows\System\VseiYcC.exe
  C:\Windows\System\VseiYcC.exe
  2⤵
  PID:13244
- C:\Windows\System\nboePsM.exe
  C:\Windows\System\nboePsM.exe
  2⤵
  PID:13272
- C:\Windows\System\IiLszPD.exe
  C:\Windows\System\IiLszPD.exe
  2⤵
  PID:12296
- C:\Windows\System\QFtWfqq.exe
  C:\Windows\System\QFtWfqq.exe
  2⤵
  PID:12344
- C:\Windows\System\dBhgVcQ.exe
  C:\Windows\System\dBhgVcQ.exe
  2⤵
  PID:12404
- C:\Windows\System\hpVQnKD.exe
  C:\Windows\System\hpVQnKD.exe
  2⤵
  PID:12492
- C:\Windows\System\sPzeWQI.exe
  C:\Windows\System\sPzeWQI.exe
  2⤵
  PID:12536
- C:\Windows\System\ddJrzFs.exe
  C:\Windows\System\ddJrzFs.exe
  2⤵
  PID:12596
- C:\Windows\System\AjJuqiI.exe
  C:\Windows\System\AjJuqiI.exe
  2⤵
  PID:12636
- C:\Windows\System\dvfbKUW.exe
  C:\Windows\System\dvfbKUW.exe
  2⤵
  PID:12752
- C:\Windows\System\keYRpjC.exe
  C:\Windows\System\keYRpjC.exe
  2⤵
  PID:12856
- C:\Windows\System\jZdQfvg.exe
  C:\Windows\System\jZdQfvg.exe
  2⤵
  PID:12912
- C:\Windows\System\PqhuagD.exe
  C:\Windows\System\PqhuagD.exe
  2⤵
  PID:12936
- C:\Windows\System\CAdyxYI.exe
  C:\Windows\System\CAdyxYI.exe
  2⤵
  PID:13072
- C:\Windows\System\aWOPchA.exe
  C:\Windows\System\aWOPchA.exe
  2⤵
  PID:13140
- C:\Windows\System\LnIWVmL.exe
  C:\Windows\System\LnIWVmL.exe
  2⤵
  PID:13236
- C:\Windows\System\RhPHdAx.exe
  C:\Windows\System\RhPHdAx.exe
  2⤵
  PID:13220
- C:\Windows\System\KBeMkzn.exe
  C:\Windows\System\KBeMkzn.exe
  2⤵
  PID:13308
- C:\Windows\System\wzzRjTI.exe
  C:\Windows\System\wzzRjTI.exe
  2⤵
  PID:12516
- C:\Windows\System\UtXmryq.exe
  C:\Windows\System\UtXmryq.exe
  2⤵
  PID:12720
- C:\Windows\System\GHpcEbF.exe
  C:\Windows\System\GHpcEbF.exe
  2⤵
  PID:12852
- C:\Windows\System\zBMOIaY.exe
  C:\Windows\System\zBMOIaY.exe
  2⤵
  PID:13016
- C:\Windows\System\dHHFYWv.exe
  C:\Windows\System\dHHFYWv.exe
  2⤵
  PID:13188
- C:\Windows\System\UVGHdEu.exe
  C:\Windows\System\UVGHdEu.exe
  2⤵
  PID:12496
- C:\Windows\System\rZqJHpi.exe
  C:\Windows\System\rZqJHpi.exe
  2⤵
  PID:12748
- C:\Windows\System\yGupycZ.exe
  C:\Windows\System\yGupycZ.exe
  2⤵
  PID:13164
- C:\Windows\System\simECaH.exe
  C:\Windows\System\simECaH.exe
  2⤵
  PID:12964
- C:\Windows\System\WgOYclu.exe
  C:\Windows\System\WgOYclu.exe
  2⤵
  PID:13336
- C:\Windows\System\luSeDbA.exe
  C:\Windows\System\luSeDbA.exe
  2⤵
  PID:13380
- C:\Windows\System\CdEylHZ.exe
  C:\Windows\System\CdEylHZ.exe
  2⤵
  PID:13408
- C:\Windows\System\RubWkDj.exe
  C:\Windows\System\RubWkDj.exe
  2⤵
  PID:13428
- C:\Windows\System\NnJbiGI.exe
  C:\Windows\System\NnJbiGI.exe
  2⤵
  PID:13452
- C:\Windows\System\LXqEwBI.exe
  C:\Windows\System\LXqEwBI.exe
  2⤵
  PID:13480
- C:\Windows\System\EpNlEel.exe
  C:\Windows\System\EpNlEel.exe
  2⤵
  PID:13500
- C:\Windows\System\KcpuRDM.exe
  C:\Windows\System\KcpuRDM.exe
  2⤵
  PID:13536
- C:\Windows\System\wSRelPU.exe
  C:\Windows\System\wSRelPU.exe
  2⤵
  PID:13564
- C:\Windows\System\LvZPgLM.exe
  C:\Windows\System\LvZPgLM.exe
  2⤵
  PID:13592
- C:\Windows\System\cOpgkkY.exe
  C:\Windows\System\cOpgkkY.exe
  2⤵
  PID:13624
- C:\Windows\System\pvByIEH.exe
  C:\Windows\System\pvByIEH.exe
  2⤵
  PID:13648
- C:\Windows\System\lUVAzbd.exe
  C:\Windows\System\lUVAzbd.exe
  2⤵
  PID:13676
- C:\Windows\System\xcJFTBM.exe
  C:\Windows\System\xcJFTBM.exe
  2⤵
  PID:13704
- C:\Windows\System\pePBKUs.exe
  C:\Windows\System\pePBKUs.exe
  2⤵
  PID:13720
- C:\Windows\System\nglRVZq.exe
  C:\Windows\System\nglRVZq.exe
  2⤵
  PID:13772
- C:\Windows\System\ULppHGu.exe
  C:\Windows\System\ULppHGu.exe
  2⤵
  PID:13800
- C:\Windows\System\GbPfGKZ.exe
  C:\Windows\System\GbPfGKZ.exe
  2⤵
  PID:13828
- C:\Windows\System\RZeEgBp.exe
  C:\Windows\System\RZeEgBp.exe
  2⤵
  PID:13852
- C:\Windows\System\qOeLMVe.exe
  C:\Windows\System\qOeLMVe.exe
  2⤵
  PID:13884
- C:\Windows\System\pqjySTe.exe
  C:\Windows\System\pqjySTe.exe
  2⤵
  PID:13904
- C:\Windows\System\tiAKnty.exe
  C:\Windows\System\tiAKnty.exe
  2⤵
  PID:13944
- C:\Windows\System\iPDkDCO.exe
  C:\Windows\System\iPDkDCO.exe
  2⤵
  PID:13968
- C:\Windows\System\lxAdAjt.exe
  C:\Windows\System\lxAdAjt.exe
  2⤵
  PID:14000
- C:\Windows\System\JhmOCIg.exe
  C:\Windows\System\JhmOCIg.exe
  2⤵
  PID:14020
- C:\Windows\System\urJStRB.exe
  C:\Windows\System\urJStRB.exe
  2⤵
  PID:14056
- C:\Windows\System\qXIOBjn.exe
  C:\Windows\System\qXIOBjn.exe
  2⤵
  PID:14088
- C:\Windows\System\iHWRJYE.exe
  C:\Windows\System\iHWRJYE.exe
  2⤵
  PID:14116
- C:\Windows\System\rZoFcGC.exe
  C:\Windows\System\rZoFcGC.exe
  2⤵
  PID:14144
- C:\Windows\System\bVklGoa.exe
  C:\Windows\System\bVklGoa.exe
  2⤵
  PID:14172
- C:\Windows\System\iRssyqJ.exe
  C:\Windows\System\iRssyqJ.exe
  2⤵
  PID:14200
- C:\Windows\System\IdSQyTF.exe
  C:\Windows\System\IdSQyTF.exe
  2⤵
  PID:14228
- C:\Windows\System\dIRjpAB.exe
  C:\Windows\System\dIRjpAB.exe
  2⤵
  PID:14256
- C:\Windows\System\JuDCIrn.exe
  C:\Windows\System\JuDCIrn.exe
  2⤵
  PID:14284
- C:\Windows\System\hdQtLRG.exe
  C:\Windows\System\hdQtLRG.exe
  2⤵
  PID:14312
- C:\Windows\System\sVPmWle.exe
  C:\Windows\System\sVPmWle.exe
  2⤵
  PID:12604
- C:\Windows\System\dAVYUcp.exe
  C:\Windows\System\dAVYUcp.exe
  2⤵
  PID:13368
- C:\Windows\System\UBoPZCi.exe
  C:\Windows\System\UBoPZCi.exe
  2⤵
  PID:13436
- C:\Windows\System\uZgtErE.exe
  C:\Windows\System\uZgtErE.exe
  2⤵
  PID:13476
- C:\Windows\System\hyzAiRa.exe
  C:\Windows\System\hyzAiRa.exe
  2⤵
  PID:13544
- C:\Windows\System\zvMiZvf.exe
  C:\Windows\System\zvMiZvf.exe
  2⤵
  PID:13588
- C:\Windows\System\UcaGqRv.exe
  C:\Windows\System\UcaGqRv.exe
  2⤵
  PID:13696
- C:\Windows\System\vkoegwH.exe
  C:\Windows\System\vkoegwH.exe
  2⤵
  PID:13732
- C:\Windows\System\YUyrQFX.exe
  C:\Windows\System\YUyrQFX.exe
  2⤵
  PID:13816
- C:\Windows\System\JvCwSvm.exe
  C:\Windows\System\JvCwSvm.exe
  2⤵
  PID:13876
- C:\Windows\System\kkJMUff.exe
  C:\Windows\System\kkJMUff.exe
  2⤵
  PID:13940
- C:\Windows\System\ZEIbQnZ.exe
  C:\Windows\System\ZEIbQnZ.exe
  2⤵
  PID:14028
- C:\Windows\System\hGyOLLL.exe
  C:\Windows\System\hGyOLLL.exe
  2⤵
  PID:14140
- C:\Windows\System\fStHmSO.exe
  C:\Windows\System\fStHmSO.exe
  2⤵
  PID:14212
- C:\Windows\System\rUSiCNS.exe
  C:\Windows\System\rUSiCNS.exe
  2⤵
  PID:14296
- C:\Windows\System\DGcMhTN.exe
  C:\Windows\System\DGcMhTN.exe
  2⤵
  PID:13400
- C:\Windows\System\UWDCILG.exe
  C:\Windows\System\UWDCILG.exe
  2⤵
  PID:13640
- C:\Windows\System\xPNKNnu.exe
  C:\Windows\System\xPNKNnu.exe
  2⤵
  PID:13768
- C:\Windows\System\yJYEzkM.exe
  C:\Windows\System\yJYEzkM.exe
  2⤵
  PID:13964
- C:\Windows\System\MyIrrIP.exe
  C:\Windows\System\MyIrrIP.exe
  2⤵
  PID:14276
- C:\Windows\System\PHIuHVe.exe
  C:\Windows\System\PHIuHVe.exe
  2⤵
  PID:13548
- C:\Windows\System\kvpAGod.exe
  C:\Windows\System\kvpAGod.exe
  2⤵
  PID:14080
- C:\Windows\System\bLjVlJj.exe
  C:\Windows\System\bLjVlJj.exe
  2⤵
  PID:14344
- C:\Windows\System\JxJiXJV.exe
  C:\Windows\System\JxJiXJV.exe
  2⤵
  PID:14368
- C:\Windows\System\SVCVHpV.exe
  C:\Windows\System\SVCVHpV.exe
  2⤵
  PID:14400
- C:\Windows\System\BELwjsG.exe
  C:\Windows\System\BELwjsG.exe
  2⤵
  PID:14440
- C:\Windows\System\oNtesXb.exe
  C:\Windows\System\oNtesXb.exe
  2⤵
  PID:14484
- C:\Windows\System\oQAoVdb.exe
  C:\Windows\System\oQAoVdb.exe
  2⤵
  PID:14520
- C:\Windows\System\UqavqrZ.exe
  C:\Windows\System\UqavqrZ.exe
  2⤵
  PID:14548
- C:\Windows\System\gqCVklc.exe
  C:\Windows\System\gqCVklc.exe
  2⤵
  PID:14576
- C:\Windows\System\mBWfLmK.exe
  C:\Windows\System\mBWfLmK.exe
  2⤵
  PID:14596
- C:\Windows\System\eDwcKap.exe
  C:\Windows\System\eDwcKap.exe
  2⤵
  PID:14620
- C:\Windows\System\LPGgSYh.exe
  C:\Windows\System\LPGgSYh.exe
  2⤵
  PID:14676
- C:\Windows\System\YZSmvmh.exe
  C:\Windows\System\YZSmvmh.exe
  2⤵
  PID:14692
- C:\Windows\System\YjKjsXz.exe
  C:\Windows\System\YjKjsXz.exe
  2⤵
  PID:14732
- C:\Windows\System\fprWiPs.exe
  C:\Windows\System\fprWiPs.exe
  2⤵
  PID:14748
- C:\Windows\System\aGezwLf.exe
  C:\Windows\System\aGezwLf.exe
  2⤵
  PID:14776
- C:\Windows\System\PaBzBTr.exe
  C:\Windows\System\PaBzBTr.exe
  2⤵
  PID:14804
- C:\Windows\System\xYZlhZX.exe
  C:\Windows\System\xYZlhZX.exe
  2⤵
  PID:14832
- C:\Windows\System\gwBggiX.exe
  C:\Windows\System\gwBggiX.exe
  2⤵
  PID:14852
- C:\Windows\System\vsjppeN.exe
  C:\Windows\System\vsjppeN.exe
  2⤵
  PID:14884
- C:\Windows\System\sXmGqLN.exe
  C:\Windows\System\sXmGqLN.exe
  2⤵
  PID:14916
- C:\Windows\System\ZzFblkR.exe
  C:\Windows\System\ZzFblkR.exe
  2⤵
  PID:14944
- C:\Windows\System\srrZkJq.exe
  C:\Windows\System\srrZkJq.exe
  2⤵
  PID:14984
- C:\Windows\System\VHZXeFv.exe
  C:\Windows\System\VHZXeFv.exe
  2⤵
  PID:15024
- C:\Windows\System\HBwKaSZ.exe
  C:\Windows\System\HBwKaSZ.exe
  2⤵
  PID:15040
- C:\Windows\System\vTRkUnz.exe
  C:\Windows\System\vTRkUnz.exe
  2⤵
  PID:15068
- C:\Windows\System\uPdVMlv.exe
  C:\Windows\System\uPdVMlv.exe
  2⤵
  PID:15112
- C:\Windows\System\lApbZCC.exe
  C:\Windows\System\lApbZCC.exe
  2⤵
  PID:15144
- C:\Windows\System\NtSEcRg.exe
  C:\Windows\System\NtSEcRg.exe
  2⤵
  PID:15172
- C:\Windows\System\YBMVHSD.exe
  C:\Windows\System\YBMVHSD.exe
  2⤵
  PID:15196
- C:\Windows\System\gBaAMjk.exe
  C:\Windows\System\gBaAMjk.exe
  2⤵
  PID:15216
- C:\Windows\System\dammUcY.exe
  C:\Windows\System\dammUcY.exe
  2⤵
  PID:15244
- C:\Windows\System\WlpkqFs.exe
  C:\Windows\System\WlpkqFs.exe
  2⤵
  PID:15276
- C:\Windows\System\ewNZahr.exe
  C:\Windows\System\ewNZahr.exe
  2⤵
  PID:15320
- C:\Windows\System\GSjnnSq.exe
  C:\Windows\System\GSjnnSq.exe
  2⤵
  PID:15348
- C:\Windows\System\eRZnPQG.exe
  C:\Windows\System\eRZnPQG.exe
  2⤵
  PID:1528
- C:\Windows\System\oqpeeYI.exe
  C:\Windows\System\oqpeeYI.exe
  2⤵
  PID:14452
- C:\Windows\System\AtvWcMc.exe
  C:\Windows\System\AtvWcMc.exe
  2⤵
  PID:14504
- C:\Windows\System\gHZCoIb.exe
  C:\Windows\System\gHZCoIb.exe
  2⤵
  PID:14592
- C:\Windows\System\GpNoJNW.exe
  C:\Windows\System\GpNoJNW.exe
  2⤵
  PID:14684
- C:\Windows\System\yPJThOT.exe
  C:\Windows\System\yPJThOT.exe
  2⤵
  PID:14728
- C:\Windows\System\vbQAdgm.exe
  C:\Windows\System\vbQAdgm.exe
  2⤵
  PID:14812
- C:\Windows\System\APMvZxP.exe
  C:\Windows\System\APMvZxP.exe
  2⤵
  PID:14880
- C:\Windows\System\WhvNpFG.exe
  C:\Windows\System\WhvNpFG.exe
  2⤵
  PID:3456
- C:\Windows\System\KaMWvRB.exe
  C:\Windows\System\KaMWvRB.exe
  2⤵
  PID:15000
- C:\Windows\System\ONuHEwo.exe
  C:\Windows\System\ONuHEwo.exe
  2⤵
  PID:15052
- C:\Windows\System\tofagYA.exe
  C:\Windows\System\tofagYA.exe
  2⤵
  PID:15136
- C:\Windows\System\FkQNSkj.exe
  C:\Windows\System\FkQNSkj.exe
  2⤵
  PID:15180
- C:\Windows\System\HFlkDrM.exe
  C:\Windows\System\HFlkDrM.exe
  2⤵
  PID:15288
- C:\Windows\System\xBmXZoO.exe
  C:\Windows\System\xBmXZoO.exe
  2⤵
  PID:15344
- C:\Windows\System\NKOELas.exe
  C:\Windows\System\NKOELas.exe
  2⤵
  PID:14468
- C:\Windows\System\gNrtmou.exe
  C:\Windows\System\gNrtmou.exe
  2⤵
  PID:2244
- C:\Windows\System\gEQtSpH.exe
  C:\Windows\System\gEQtSpH.exe
  2⤵
  PID:14712
- C:\Windows\System\cUyWjwZ.exe
  C:\Windows\System\cUyWjwZ.exe
  2⤵
  PID:2204
- C:\Windows\System\ahIhypb.exe
  C:\Windows\System\ahIhypb.exe
  2⤵
  PID:1600
- C:\Windows\System\NQwKrnm.exe
  C:\Windows\System\NQwKrnm.exe
  2⤵
  PID:2880
- C:\Windows\System\kInntzJ.exe
  C:\Windows\System\kInntzJ.exe
  2⤵
  PID:15156
- C:\Windows\System\okVsCKm.exe
  C:\Windows\System\okVsCKm.exe
  2⤵
  PID:13396
- C:\Windows\System\MmnEuVd.exe
  C:\Windows\System\MmnEuVd.exe
  2⤵
  PID:14652
- C:\Windows\System\XiLKbAF.exe
  C:\Windows\System\XiLKbAF.exe
  2⤵
  PID:14932
- C:\Windows\System\eJRZCdX.exe
  C:\Windows\System\eJRZCdX.exe
  2⤵
  PID:15140
- C:\Windows\System\ODWYuSk.exe
  C:\Windows\System\ODWYuSk.exe
  2⤵
  PID:4116
- C:\Windows\System\DvNnNzc.exe
  C:\Windows\System\DvNnNzc.exe
  2⤵
  PID:15372
- C:\Windows\System\KhmXUIT.exe
  C:\Windows\System\KhmXUIT.exe
  2⤵
  PID:15392
- C:\Windows\System\FJqjDoj.exe
  C:\Windows\System\FJqjDoj.exe
  2⤵
  PID:15428
- C:\Windows\System\WVvDOyZ.exe
  C:\Windows\System\WVvDOyZ.exe
  2⤵
  PID:15444
- C:\Windows\System\GTGKYgP.exe
  C:\Windows\System\GTGKYgP.exe
  2⤵
  PID:15480
- C:\Windows\System\BrsplRj.exe
  C:\Windows\System\BrsplRj.exe
  2⤵
  PID:15500
- C:\Windows\System\UjroyEU.exe
  C:\Windows\System\UjroyEU.exe
  2⤵
  PID:15540
- C:\Windows\System\QWUbqLi.exe
  C:\Windows\System\QWUbqLi.exe
  2⤵
  PID:15556
- C:\Windows\System\ESBFPgA.exe
  C:\Windows\System\ESBFPgA.exe
  2⤵
  PID:15596
- C:\Windows\System\gZeBUkJ.exe
  C:\Windows\System\gZeBUkJ.exe
  2⤵
  PID:15624
- C:\Windows\System\DVYQEEK.exe
  C:\Windows\System\DVYQEEK.exe
  2⤵
  PID:15640
- C:\Windows\System\IARWGfo.exe
  C:\Windows\System\IARWGfo.exe
  2⤵
  PID:15680
- C:\Windows\System\pjUSAMo.exe
  C:\Windows\System\pjUSAMo.exe
  2⤵
  PID:15708
- C:\Windows\System\Rqfszfb.exe
  C:\Windows\System\Rqfszfb.exe
  2⤵
  PID:15728
- C:\Windows\System\PenSYcN.exe
  C:\Windows\System\PenSYcN.exe
  2⤵
  PID:15764
- C:\Windows\System\cuyJJJQ.exe
  C:\Windows\System\cuyJJJQ.exe
  2⤵
  PID:15780
- C:\Windows\System\LKigsEy.exe
  C:\Windows\System\LKigsEy.exe
  2⤵
  PID:15820
- C:\Windows\System\ihXjtcZ.exe
  C:\Windows\System\ihXjtcZ.exe
  2⤵
  PID:15848
- C:\Windows\System\jKzGhqe.exe
  C:\Windows\System\jKzGhqe.exe
  2⤵
  PID:15876
- C:\Windows\System\QooMMGe.exe
  C:\Windows\System\QooMMGe.exe
  2⤵
  PID:15900
- C:\Windows\System\KVarZQA.exe
  C:\Windows\System\KVarZQA.exe
  2⤵
  PID:15924
- C:\Windows\System\OBLqCPl.exe
  C:\Windows\System\OBLqCPl.exe
  2⤵
  PID:15964
- C:\Windows\System\rdbnXEG.exe
  C:\Windows\System\rdbnXEG.exe
  2⤵
  PID:15992
- C:\Windows\System\sEWRdrP.exe
  C:\Windows\System\sEWRdrP.exe
  2⤵
  PID:16020
- C:\Windows\System\cRmKBst.exe
  C:\Windows\System\cRmKBst.exe
  2⤵
  PID:16048
- C:\Windows\System\bNZtcpN.exe
  C:\Windows\System\bNZtcpN.exe
  2⤵
  PID:16076
- C:\Windows\System\XrxaEJL.exe
  C:\Windows\System\XrxaEJL.exe
  2⤵
  PID:16104
- C:\Windows\System\IpVCRSJ.exe
  C:\Windows\System\IpVCRSJ.exe
  2⤵
  PID:16132
- C:\Windows\System\yJTuSez.exe
  C:\Windows\System\yJTuSez.exe
  2⤵
  PID:16164
- C:\Windows\System\oeNcCei.exe
  C:\Windows\System\oeNcCei.exe
  2⤵
  PID:16192
- C:\Windows\System\vbwlAPY.exe
  C:\Windows\System\vbwlAPY.exe
  2⤵
  PID:16220
- C:\Windows\System\WPALpwb.exe
  C:\Windows\System\WPALpwb.exe
  2⤵
  PID:16236
- C:\Windows\System\vxwpXej.exe
  C:\Windows\System\vxwpXej.exe
  2⤵
  PID:16276
- C:\Windows\System\vJAbahC.exe
  C:\Windows\System\vJAbahC.exe
  2⤵
  PID:16292
- C:\Windows\System\feHIthF.exe
  C:\Windows\System\feHIthF.exe
  2⤵
  PID:16320
- C:\Windows\System\MSYnmvm.exe
  C:\Windows\System\MSYnmvm.exe
  2⤵
  PID:16360
- C:\Windows\System\ccxJjdT.exe
  C:\Windows\System\ccxJjdT.exe
  2⤵
  PID:15332
- C:\Windows\System\PbhbFuM.exe
  C:\Windows\System\PbhbFuM.exe
  2⤵
  PID:15404
- C:\Windows\System\zuZGazL.exe
  C:\Windows\System\zuZGazL.exe
  2⤵
  PID:15476
- C:\Windows\System\oEfKbic.exe
  C:\Windows\System\oEfKbic.exe
  2⤵
  PID:15536
- C:\Windows\System\yKQdqJU.exe
  C:\Windows\System\yKQdqJU.exe
  2⤵
  PID:15612
- C:\Windows\System\Hbngayx.exe
  C:\Windows\System\Hbngayx.exe
  2⤵
  PID:15664
- C:\Windows\System\cyyUImA.exe
  C:\Windows\System\cyyUImA.exe
  2⤵
  PID:15092
- C:\Windows\System\OhkgGkK.exe
  C:\Windows\System\OhkgGkK.exe
  2⤵
  PID:15740
- C:\Windows\System\PFQQETD.exe
  C:\Windows\System\PFQQETD.exe
  2⤵
  PID:3888
- C:\Windows\System\lqZywsy.exe
  C:\Windows\System\lqZywsy.exe
  2⤵
  PID:15864
- C:\Windows\System\HSrbHDQ.exe
  C:\Windows\System\HSrbHDQ.exe
  2⤵
  PID:15936
- C:\Windows\System\YzQMYLc.exe
  C:\Windows\System\YzQMYLc.exe
  2⤵
  PID:16036
- C:\Windows\System\WQgpDPJ.exe
  C:\Windows\System\WQgpDPJ.exe
  2⤵
  PID:16096
- C:\Windows\System\wdRInbK.exe
  C:\Windows\System\wdRInbK.exe
  2⤵
  PID:1992
- C:\Windows\System\MnQrBxt.exe
  C:\Windows\System\MnQrBxt.exe
  2⤵
  PID:16228
- C:\Windows\System\ruLsMqa.exe
  C:\Windows\System\ruLsMqa.exe
  2⤵
  PID:16284
- C:\Windows\System\tGxpSkw.exe
  C:\Windows\System\tGxpSkw.exe
  2⤵
  PID:16356
- C:\Windows\System\uevlSGR.exe
  C:\Windows\System\uevlSGR.exe
  2⤵
  PID:15380
- C:\Windows\System\CvJqGEa.exe
  C:\Windows\System\CvJqGEa.exe
  2⤵
  PID:15524
- C:\Windows\System\zvuwjtk.exe
  C:\Windows\System\zvuwjtk.exe
  2⤵
  PID:15632
- C:\Windows\System\NziZGZS.exe
  C:\Windows\System\NziZGZS.exe
  2⤵
  PID:15672
- C:\Windows\System\QtyqnYM.exe
  C:\Windows\System\QtyqnYM.exe
  2⤵
  PID:3224
- C:\Windows\System\WzWVjck.exe
  C:\Windows\System\WzWVjck.exe
  2⤵
  PID:15988
- C:\Windows\System\HvOjoBm.exe
  C:\Windows\System\HvOjoBm.exe
  2⤵
  PID:16268
- C:\Windows\System\DpCpstm.exe
  C:\Windows\System\DpCpstm.exe
  2⤵
  PID:16372
- C:\Windows\System\sLUQmvn.exe
  C:\Windows\System\sLUQmvn.exe
  2⤵
  PID:3176
- C:\Windows\System\ieykJAa.exe
  C:\Windows\System\ieykJAa.exe
  2⤵
  PID:15636
- C:\Windows\System\ugdtWgn.exe
  C:\Windows\System\ugdtWgn.exe
  2⤵
  PID:16092
- C:\Windows\System\CQzNCyM.exe
  C:\Windows\System\CQzNCyM.exe
  2⤵
  PID:16340
- C:\Windows\System\MCQsfvl.exe
  C:\Windows\System\MCQsfvl.exe
  2⤵
  PID:4760
- C:\Windows\System\YQxAYrC.exe
  C:\Windows\System\YQxAYrC.exe
  2⤵
  PID:16212
- C:\Windows\System\fjZUJRo.exe
  C:\Windows\System\fjZUJRo.exe
  2⤵
  PID:16416
- C:\Windows\System\qAaRCbr.exe
  C:\Windows\System\qAaRCbr.exe
  2⤵
  PID:16440
- C:\Windows\System\pqEwydx.exe
  C:\Windows\System\pqEwydx.exe
  2⤵
  PID:16484
- C:\Windows\System\PcgLmtc.exe
  C:\Windows\System\PcgLmtc.exe
  2⤵
  PID:16508
- C:\Windows\System\ADzjiCL.exe
  C:\Windows\System\ADzjiCL.exe
  2⤵
  PID:16552
- C:\Windows\System\RFrzJWq.exe
  C:\Windows\System\RFrzJWq.exe
  2⤵
  PID:16572
- C:\Windows\System\vTunvzz.exe
  C:\Windows\System\vTunvzz.exe
  2⤵
  PID:16592
- C:\Windows\System\cdlwmmj.exe
  C:\Windows\System\cdlwmmj.exe
  2⤵
  PID:16616
- C:\Windows\System\sIiTRiW.exe
  C:\Windows\System\sIiTRiW.exe
  2⤵
  PID:16652
- C:\Windows\System\HRMbbYJ.exe
  C:\Windows\System\HRMbbYJ.exe
  2⤵
  PID:16672
- C:\Windows\System\VRuFnRO.exe
  C:\Windows\System\VRuFnRO.exe
  2⤵
  PID:16700
- C:\Windows\System\pJwtTmH.exe
  C:\Windows\System\pJwtTmH.exe
  2⤵
  PID:16736
- C:\Windows\System\DHmvEMH.exe
  C:\Windows\System\DHmvEMH.exe
  2⤵
  PID:16780
- C:\Windows\System\xEEntbV.exe
  C:\Windows\System\xEEntbV.exe
  2⤵
  PID:16796
- C:\Windows\System\cMkqWxh.exe
  C:\Windows\System\cMkqWxh.exe
  2⤵
  PID:16828
- C:\Windows\System\lLouHIN.exe
  C:\Windows\System\lLouHIN.exe
  2⤵
  PID:16852
- C:\Windows\System\RxAAqNN.exe
  C:\Windows\System\RxAAqNN.exe
  2⤵
  PID:16904
- C:\Windows\System\AZDWTPL.exe
  C:\Windows\System\AZDWTPL.exe
  2⤵
  PID:16932
- C:\Windows\System\SvGpWOk.exe
  C:\Windows\System\SvGpWOk.exe
  2⤵
  PID:16960
- C:\Windows\System\cWJQUJa.exe
  C:\Windows\System\cWJQUJa.exe
  2⤵
  PID:16976
- C:\Windows\System\XQaSezw.exe
  C:\Windows\System\XQaSezw.exe
  2⤵
  PID:17004
- C:\Windows\System\lrjUhlI.exe
  C:\Windows\System\lrjUhlI.exe
  2⤵
  PID:17020
- C:\Windows\System\YxZPjfm.exe
  C:\Windows\System\YxZPjfm.exe
  2⤵
  PID:17072
- C:\Windows\System\zuQKlju.exe
  C:\Windows\System\zuQKlju.exe
  2⤵
  PID:17092
- C:\Windows\System\DLbzpMb.exe
  C:\Windows\System\DLbzpMb.exe
  2⤵
  PID:17124
- C:\Windows\System\Bljikgu.exe
  C:\Windows\System\Bljikgu.exe
  2⤵
  PID:17144
- C:\Windows\System\KewjStL.exe
  C:\Windows\System\KewjStL.exe
  2⤵
  PID:17168
- C:\Windows\System\hjLuBGu.exe
  C:\Windows\System\hjLuBGu.exe
  2⤵
  PID:17196
- C:\Windows\System\SLMRnOt.exe
  C:\Windows\System\SLMRnOt.exe
  2⤵
  PID:17228
- C:\Windows\System\wxjsuHx.exe
  C:\Windows\System\wxjsuHx.exe
  2⤵
  PID:17244
- C:\Windows\System\wUSrdfp.exe
  C:\Windows\System\wUSrdfp.exe
  2⤵
  PID:17296
- C:\Windows\System\uvDGETG.exe
  C:\Windows\System\uvDGETG.exe
  2⤵
  PID:17312
- C:\Windows\System\rsmGRsI.exe
  C:\Windows\System\rsmGRsI.exe
  2⤵
  PID:17352
- C:\Windows\System\mQQGXZv.exe
  C:\Windows\System\mQQGXZv.exe
  2⤵
  PID:17368
- C:\Windows\System\OaxAxzC.exe
  C:\Windows\System\OaxAxzC.exe
  2⤵
  PID:17396
- C:\Windows\System\hYyROGg.exe
  C:\Windows\System\hYyROGg.exe
  2⤵
  PID:16412
- C:\Windows\System\rCSGbgC.exe
  C:\Windows\System\rCSGbgC.exe
  2⤵
  PID:16568
- C:\Windows\System\VtmWnkC.exe
  C:\Windows\System\VtmWnkC.exe
  2⤵
  PID:16564
- C:\Windows\System\cUVAPNC.exe
  C:\Windows\System\cUVAPNC.exe
  2⤵
  PID:16612
- C:\Windows\System\HypkeVi.exe
  C:\Windows\System\HypkeVi.exe
  2⤵
  PID:4904
- C:\Windows\System\eTiGmvW.exe
  C:\Windows\System\eTiGmvW.exe
  2⤵
  PID:16728
- C:\Windows\System\ZAEqbUt.exe
  C:\Windows\System\ZAEqbUt.exe
  2⤵
  PID:16752
- C:\Windows\System\NPBUCuT.exe
  C:\Windows\System\NPBUCuT.exe
  2⤵
  PID:16808
- C:\Windows\System\OZqIspF.exe
  C:\Windows\System\OZqIspF.exe
  2⤵
  PID:16916
- C:\Windows\System\UwubNuq.exe
  C:\Windows\System\UwubNuq.exe
  2⤵
  PID:16944
- C:\Windows\System\MYruduJ.exe
  C:\Windows\System\MYruduJ.exe
  2⤵
  PID:17048
- C:\Windows\System\WJWsybz.exe
  C:\Windows\System\WJWsybz.exe
  2⤵
  PID:17120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BfQjoaD.exe

Filesize
1.9MB

MD5
6256ad6fbe1e1045c5a098ec90cd8bd9

SHA1
cf1a4df851a288c1a65c88d860e452757052346a

SHA256
3e40aa96225093acff556af45e9591b4c0cf41000a46369da5965968fa07533f

SHA512
ba1b4e855276fec44930d8f9b477feea0a0d2c520cfcaa80be43e3d57803b89a1a866ebc2daea0defa8f0b52ae8feef2204961fb0fe389b599cf2fb8c7e3e45e

Download Submit
C:\Windows\System\DFhRjhC.exe

Filesize
1.9MB

MD5
471e6c3a90fb057c1775d8ad87d2626b

SHA1
4a2a5f4c30bcbe3c984db414a9a6409895fa068e

SHA256
7f6ae1cd9f2c2811bd4c8eb6c93f791791edee76b7de2ca7790300a9774b367c

SHA512
dc90a4e2b693c54e6c5623dc3ded5301654e3afac96ad742e2e15c04253060a7b5d2b952f11ca5de3e89db97fe4a7314d375904d0e5e4113272227330c702d46

Download Submit
C:\Windows\System\EZtDkUP.exe

Filesize
1.9MB

MD5
d872a8541543c2bd55419e3d6eec261f

SHA1
bc12ed7263baf9e380724904b218b8fd8f9e468b

SHA256
a97ac86baa388071f147ccc45a65874d376f6db00505fef7d6c6b0f39efaf1e2

SHA512
ae8e6cc52753c2aa5166f608cac154225cd816b2c59bdc2810b0262fd00865423cd7d2e504850ad912f6d0c826c83113be192ee5c699aedd085c2f850aee1a85

Download Submit
C:\Windows\System\EmDBbla.exe

Filesize
1.9MB

MD5
8aa5afeaefe15d1a22ebb2cac678962d

SHA1
2221f850ad7282966f14226fbd5697d759d2f4cf

SHA256
1db379cd2cf599721c69978bccfc6c01b96eb693d701094bfe08bf08e7e49d7b

SHA512
4831ded228b4a66040f32623f6cbc0bcd28c365c7e4b74f65670a58e30097e4c5edadbde9a817cc05ae7c37731b2e0801a692d43dbb4d573187176ab2fd1b989

Download Submit
C:\Windows\System\FijhPuH.exe

Filesize
1.9MB

MD5
6079f03b3912e206173c3257ada9c0ca

SHA1
41dd9b9f231a495fabd56adc87f2b6054a950985

SHA256
5e87040bf0992e711efe9e5764de870654335c36eebebfab2b55014b97a6dd67

SHA512
1dbfec22331157aa9886b095cab84861a47d3434bbb1eb9b09e018c7c658925601dd0bf4994c59a47d2f3ddb9906f08b557e6b0ad8002b15a6fa0a05f7fba3b3

Download Submit
C:\Windows\System\FjuRAIl.exe

Filesize
1.9MB

MD5
8f0cb5f26e3d82efe5b493df269893c8

SHA1
7595f5e1074691ecfab60a864c48b7b028b16c1b

SHA256
0e7ad9bcd99847882e21231fdb2290d6d7bbf738cfcf6ed1e6442e0d8ddbf584

SHA512
ceb7f1d1f71952a1cd9ec59a34e726b817497ea6980daac124fc78366f17a6b473aa317a9fe3630e3d0818f62bdda418988cf238d4e37087be82a955ab916552

Download Submit
C:\Windows\System\HnVxkKI.exe

Filesize
1.9MB

MD5
6ecfd6f512264689539204bdbc588cec

SHA1
c87af9583fec5346a0be7e169eed1d78f2308ed6

SHA256
cafd05515a88ba86849a0afc89df8e42f9c96696b67da3b865630b7390acbccf

SHA512
2bb0c78929825dff08e91bf6696a38ec53a99f5eed2c850591ee0c90725bcfae57b889db4311af1bf5419bc8dfaa425e912df3d0eb79bf7615927b674a3d51d6

Download Submit
C:\Windows\System\JPiPxGL.exe

Filesize
1.9MB

MD5
3816fd8cd7446498265f0e9b311aa607

SHA1
72d8dbe7684d9633263862f6d7547636c4ffe408

SHA256
40db4dd9992cdf30ddf9bfe82f7a3c2f79ee222d587e65cb6fc05c611699f78d

SHA512
f7f8fd1ec00c0286fb292393b3c76fb598be5cb8febacc91795497a913d180754a7719a3abd3e34eb5ca2a2581a16333ccb0a75913c466c3b2288251320c339b

Download Submit
C:\Windows\System\LllpuOZ.exe

Filesize
1.9MB

MD5
d2afc50ae129479d07ae652637f19bee

SHA1
fc835cfd6a1b6367fa6199a7eb515aec673f81f8

SHA256
cd1dc37270592289d2c456f99de30c664a300007c9dea064bb5551b63d6e513d

SHA512
5376ca130b9b94c1763b10837ead2b7bff413bb740d0ff077ced4801633b95a01c3b0d59589b683e52a8f5f22fb8c0e3c43bbcb21a463a98c01932683086e59c

Download Submit
C:\Windows\System\NAOKgKz.exe

Filesize
1.9MB

MD5
62940bed434361d43fd2a4ebe955b93b

SHA1
0d436303c680ac3253d04e2e5fc422eefeb47a3f

SHA256
5214c0946918858c44214a7b8244804f4e3e291a8d6fd6072d7e8d3d609fc9bd

SHA512
6a340086351f9ab3d89cc9ce3c199c247a801ba1e21dacb8fefff6f89f05e5d95b0adc9583509fdc632e365548cce676e552ee1ef7d0f8b8cc2a672b7955eff0

Download Submit
C:\Windows\System\NdcVUpf.exe

Filesize
1.9MB

MD5
2132dcc0033ae1e23245516eb09414d4

SHA1
e8bf8907ae5588574cabd5d9cb2d3be98b77c29f

SHA256
1cd856bbe83882d1b2c652696df43426f32d49c1b0ae83691754cb59a1dc62da

SHA512
64ad0f785efa4a203bfe2c24650aa0a9aeaccbdec9a216cba327f440683ee0f0776ea79a665418488b021b15ea431aeba0be5bb00a342954dacdc459130ac0af

Download Submit
C:\Windows\System\NhEJAaT.exe

Filesize
1.9MB

MD5
082d23872338a4cb2e5a25e31ea3879c

SHA1
367ba52830d84b6ed335793ad4aa81e86f69c65c

SHA256
88b5b74ef791bf4be44cc5ca6d09ab346c8411506151da641d44903e18d6386b

SHA512
bb950ba9921b2a87f5766da6370d0428c71e3db7281b1f67be1662bee4e36780b8435a559ad6effa1feb33a60d7720ca96e7268b8231e508b728a0eedc103028

Download Submit
C:\Windows\System\OASiGXh.exe

Filesize
1.9MB

MD5
ca0e4ee5dd244402cd55fb493fcdbb4e

SHA1
c3eea9f02c080681142100f3174a49c11031267d

SHA256
0828bcd2bb895fee471f747f8b98fc0599ae2c2c3c6bc719b5b2ecf049861c1b

SHA512
0bee17619497482d6ed62e5b178e2755f407318c6bb37a44d5c858c071dd3eedbfd4bbcc31b8b762614910dfa3014b3ca7d6c842bb295a18c8f86491b5564219

Download Submit
C:\Windows\System\PNDDCSd.exe

Filesize
1.9MB

MD5
469ee1ec72044b95e8598ea40b5f19ec

SHA1
233e5439e6da9b312df5c33f5e4996e50508aca5

SHA256
f36889bc4398f074aee7b94096bc670cf46c46d0ab343582d74dddbebe640fed

SHA512
436ca7d3542d99f9ae2f18b0ee2259054ecf4c660ae6d11b8969ebea82aff39c3296ffa5bdaaa799f664f5e2afdb93d5b04e7169c76154b9d7abd64ee05b1d3a

Download Submit
C:\Windows\System\QvZnuAD.exe

Filesize
1.9MB

MD5
1afe25808c258dcd801274ddf06dfff2

SHA1
6621863818d5b2684ccffd7a09c69eb5ea1976d9

SHA256
fe63cd12a7f1c57efc8aa55a38a08ec0ab761bf4b66066f316c0158a21479952

SHA512
58f122b18f22533787177a295b3e9ead5abcfbb2e8fdfeefa658806c6a75882a84f1390fb7b6ef9b2060407b65e2f2f256d90c0241de3c298e664bad76c0d3ce

Download Submit
C:\Windows\System\RKzATvq.exe

Filesize
1.9MB

MD5
542e492d1bc929d668f7643a6bed0785

SHA1
9e55215c09d761dee56f229eab8d111cbd593bfa

SHA256
22d41b2156ea5650b70064019a1a175bc407ceb57c8c3f8b973d07b478ebbf4f

SHA512
af6a8938e0ff40a4990d6686155c7743c7605ceb93cf8769347191e4fdb55a7b9c4294ab87412d1dfc0d15be8e5cd47b849a598725c943e36655f220318575e1

Download Submit
C:\Windows\System\RcnLnCQ.exe

Filesize
1.9MB

MD5
44f42ec7324c353acf3b16b2a0f70429

SHA1
1dfc2a4660f831d4a7f6bd7c65dc1d238ab7c7fc

SHA256
61af3a81c73c236d48a23da364815d9910a6f74530754e469c04c5c173067ad0

SHA512
d59320ba90de9c6f4fea7971d4a947b89084896d9e3fa596956626f7ca989fb6b11758e7bd6a3f09da52326e6ffa60aee7a6022d5588d825f8fb4e9553d4bb29

Download Submit
C:\Windows\System\ScZHAUv.exe

Filesize
1.9MB

MD5
b3b458af60ab6faef32d8aea7b0e9cc5

SHA1
6a489d63c5a2e1825ec737e74202bef64f7d66f8

SHA256
0081c17e5eda5b7b84e549c1ddd4a64f704e5b0cd6133ab075147af98238d5c5

SHA512
1f83fd9e9368bba1a8ec419be6ffee038a434697d9028fdb7574b84bdcfac69940d91f306b922218bff82e648f9196947567aacb6b3c82fda1f7f31b1f0577be

Download Submit
C:\Windows\System\XeUQeFS.exe

Filesize
1.9MB

MD5
6d160737b36078d94d645473d267d2bc

SHA1
2b1110f2f95ef78be47a9bc61ea620be9fb451c9

SHA256
5c870f7d2ef9e0b78c5f6ea83c8d3c55a57e137f8506320b8cadb257d3bb6513

SHA512
6fe78292f33dcd81ce4fdf6ebc890dd81faf4c245acc340ced8e9f4dd907384df9cee4d189ced848036241f169208573edfa522dbeb78a1e83c13d409e044be3

Download Submit
C:\Windows\System\bDBkvFt.exe

Filesize
1.9MB

MD5
8f86f231b9cdfc91efa6540341aa9d7b

SHA1
4bb250985c2eef970cfb4da15347515089193c10

SHA256
ef1b94c0ae584dbc45f455481460cb795eab8fbcac455bf1b424dc6e2530237a

SHA512
e52d309425011c6fe0c4fe7917a88e498c8e9883c309c9511a64137da3b955c94a62a4afd72969d3e080b0e2089a6c0a969b6f19fda0ba2411329094743ca203

Download Submit
C:\Windows\System\fYumBih.exe

Filesize
1.9MB

MD5
29ac37fa2d471745899e31b0fa560821

SHA1
8524f432655f65a44c14ca6be57acbfd6c339576

SHA256
b1d3036ad9efd1b1fd848b6315b25ee0e4a1273ffbc32405758cfbdf1da2c728

SHA512
52ce37c68a45524838f263a53e003580d25bb448c54cdd62271dfc4afccde6e978d1c6006977b1271f3e90a094ea8367001d99052a1478d4805a4c039991b75d

Download Submit
C:\Windows\System\hdKzYzz.exe

Filesize
1.9MB

MD5
cb12e51dd14064f73c6fe02fce2d378a

SHA1
30c8de833f97d10010ef91323e1a51a93b3f2277

SHA256
af6eee325909e9410173094efe8ea15693aa2f7678fe4f978fca9f7de7a1a54e

SHA512
a339ef076ba307654edb32a66ccde8c7f0b8dab0e877c8961f7b4df6ffc0b4cb0fde2f5317e14d55aaef75a38ff75c9184e0a4bc3e8fc2d852ef841272ad2df1

Download Submit
C:\Windows\System\jMshFky.exe

Filesize
1.9MB

MD5
8e5dacde5ae2083ebd7fe39306deae70

SHA1
da2303f9d52ad13f3b7dd0f3ebb2dd8b06b68c86

SHA256
27af4d9f034b522716a1e89876ca0abcf02318752901a3905a2462741cd5e951

SHA512
0694497bde9dd8b512d9e31e2ccff4adbe04431ef083cf72e2db79645e366343d91d8a5a8d68b6119bf3a42fa9beeebe90374e6d919737d5f165c28f21542080

Download Submit
C:\Windows\System\ltKuDda.exe

Filesize
1.9MB

MD5
8397940b68c435f0c9bfe00d55a91a9b

SHA1
eac4d660f393fd11e57dfa756daccd79561cc7a2

SHA256
e91cc88e3a01e2aa120533546400db6ff4fb408dc442df451cb2e2f4f04b5188

SHA512
640066f540f64209d082b23b5b71696a438b4daf567dec8117a8811de5f571502fad818b615540794ef0a0129df27d80b4e0741c18d5dfe01bd7caebe31dae9a

Download Submit
C:\Windows\System\mUUBZDB.exe

Filesize
1.9MB

MD5
be7ddb43661a883aeb28c9e03b2ca664

SHA1
8d0c239d7e376b6d5a926a0b91aa8b85595511f7

SHA256
4b93c49f84f7a8da9dd21448972594bf436d4ece9fc516b160228c734278c53b

SHA512
2091a7b30784f0d61d676aee0538c88405d4f1fa7f9b8d2dc802edc5a01d648aca09527003486f3e18de3d1310b9b3305afc8b35f44edab713e392b21c51f56b

Download Submit
C:\Windows\System\oFGXDMi.exe

Filesize
1.9MB

MD5
376c599e8d641c5dfcadba6434ab46a3

SHA1
0983d61997581d06f7fad3bad9fd315c845308ae

SHA256
aefd06d8ba44161aff20275c90a71479a7731ae8f55d612e6a90b830b8c60d09

SHA512
eb2544ee68276a0396ed7ad393a1ae5e53e5ce9a8898f64c3cf8815f19640a0c91b1fa8bd54af2e1a2f71220dfc54a427780a1499fa527b0e4a0c35ee5e21c27

Download Submit
C:\Windows\System\tkLbVKB.exe

Filesize
1.9MB

MD5
9e46a37d481089fd1774533df90593cc

SHA1
fab4a71b79817a619984fb97bf89826b729d7f23

SHA256
35a84245335607d4c84be94890d57382d090ba3488ba9f1fe3a888da58c67959

SHA512
10c9df7f39e41a207e2b430962a6321ab945e4dcf770632f14d559ccae98cd1ca3d19ddedff405db53fbe0d79cf32b0638e807332d66e30f70f52e9a4f22fa3e

Download Submit
C:\Windows\System\uLmPkgb.exe

Filesize
1.9MB

MD5
84134cc47cd41fab7ad03549908a70e7

SHA1
b1624569677d8e5d6fb716dd1300ceadcf5647c3

SHA256
10df5468ec1f5ea361df21ad8011a5a29d7ef5b9bd0b39126edb405ab117d1bc

SHA512
7449e6aea5abce536d210781a13204f2ec4e7e80c11d539944efb9fe081790172388dd030a26547aa778c3d6acb40cf2247109d3c14c535dc0301cdddd8491fb

Download Submit
C:\Windows\System\uylelAK.exe

Filesize
1.9MB

MD5
8f83b175aadfcdb66a186286f36573ae

SHA1
b1b2d9a8ad1f599243cb8abc87c94acaf9c616f0

SHA256
9188b3560d5a4436cf252caf2cfc3e11d40503918897ea9baa056796ed8e8fbe

SHA512
734931f3c5ce92a3e55afc28a671e3c3d027ce14fd04c83ab6f6719cb5aa1aa7367e7e06c2056989c7e6f112eb3fdd34868375bd57af7fa212da85db8a9d9f8c

Download Submit
C:\Windows\System\wwCYdNv.exe

Filesize
1.9MB

MD5
be8e10cd67b6fbfe4f4f011fc36a4c27

SHA1
427967abf6b330433c31a9fd5a05ee00dfbbd292

SHA256
b0df95ec6fc82d5835e65bc8e4654ad5b6d25f8ba882cb6aeec9a8df48529df2

SHA512
38dfcffa3a534232eb4561116fe8c414a76a0f4d39f5defb5f317d4bbbfd0dd1f690c5d7f0212419b6c62fa43f14dfccd37f0791c6cc309c5c690869c07741ec

Download Submit
C:\Windows\System\xIUCeze.exe

Filesize
1.9MB

MD5
ea1647fb8c47413488d2564e99e37a33

SHA1
d60a69a670de668fa948c767188ab2b0a3e75fa2

SHA256
40c304f09223078eda111b36e536b8136f4876fff021c6b526b06fc8dd00e387

SHA512
0f0de5efc151c970f939d9fbc31fe165ca33c78857ba9dea3d146d4d358835b1f64e74f879d1e53912d9ab9762d3d1f4bfdd0252e3f94e956bb623067b07fcd1

Download Submit
C:\Windows\System\zjTZoKL.exe

Filesize
1.9MB

MD5
bf33f848d433479e9e13dcd16af0f6b4

SHA1
7436e9e29ce97335ff35faa5bae052daf44e7949

SHA256
52716a858af418fdf532e0063e70905b8f06ddb6db543960e716428e37228636

SHA512
01fbf720f7715999cb0a853a6db7cd5a10505731ec9e2aadc043e063085cae2b044716da1be9d0539256b56cac5c066ebf36532fd2c9c3d5546c7532370f5bbf

Download Submit
memory/4140-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads