xmrig | 2fc6a2b6dd1997c3d08901289b47e5c33f5027ab334eaa984c63c86e521b62eb

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 12:22 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3e999759b78c1b1e560ae5a42e26b40N.exe
Size

1.7MB
MD5

a3e999759b78c1b1e560ae5a42e26b40
SHA1

b4738648b35fd74308994eef3f535901964ba00e
SHA256

2fc6a2b6dd1997c3d08901289b47e5c33f5027ab334eaa984c63c86e521b62eb
SHA512

c15b1692bd1a3421b3f673525fc02db80dc6f00c062cfa72323ba246e2a940d4f43e1bd9131988d5b9fdd7a4defc15b3fdb93851739d7efc75f0feef792f2eda
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8BoC09aYCmcDff91WgyNl+93nrBjn:ROdWCCi7/rahwNU6ff91TnFjex7vIYX4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/1532-155-0x00007FF609CA0000-0x00007FF609FF1000-memory.dmp	xmrig
behavioral2/memory/2184-227-0x00007FF63EED0000-0x00007FF63F221000-memory.dmp	xmrig
behavioral2/memory/2396-252-0x00007FF67D9D0000-0x00007FF67DD21000-memory.dmp	xmrig
behavioral2/memory/1960-259-0x00007FF76B1F0000-0x00007FF76B541000-memory.dmp	xmrig
behavioral2/memory/3648-317-0x00007FF7650F0000-0x00007FF765441000-memory.dmp	xmrig
behavioral2/memory/4272-322-0x00007FF76B070000-0x00007FF76B3C1000-memory.dmp	xmrig
behavioral2/memory/4500-353-0x00007FF7C8210000-0x00007FF7C8561000-memory.dmp	xmrig
behavioral2/memory/2788-355-0x00007FF719570000-0x00007FF7198C1000-memory.dmp	xmrig
behavioral2/memory/700-354-0x00007FF7705F0000-0x00007FF770941000-memory.dmp	xmrig
behavioral2/memory/2856-352-0x00007FF63DBD0000-0x00007FF63DF21000-memory.dmp	xmrig
behavioral2/memory/5084-335-0x00007FF620CB0000-0x00007FF621001000-memory.dmp	xmrig
behavioral2/memory/4984-333-0x00007FF777E90000-0x00007FF7781E1000-memory.dmp	xmrig
behavioral2/memory/2684-321-0x00007FF79E110000-0x00007FF79E461000-memory.dmp	xmrig
behavioral2/memory/5056-274-0x00007FF6D4330000-0x00007FF6D4681000-memory.dmp	xmrig
behavioral2/memory/2240-258-0x00007FF7AC660000-0x00007FF7AC9B1000-memory.dmp	xmrig
behavioral2/memory/4800-226-0x00007FF736E60000-0x00007FF7371B1000-memory.dmp	xmrig
behavioral2/memory/4888-212-0x00007FF71E0B0000-0x00007FF71E401000-memory.dmp	xmrig
behavioral2/memory/312-193-0x00007FF7A36D0000-0x00007FF7A3A21000-memory.dmp	xmrig
behavioral2/memory/4696-211-0x00007FF7A5F70000-0x00007FF7A62C1000-memory.dmp	xmrig
behavioral2/memory/3748-163-0x00007FF7881A0000-0x00007FF7884F1000-memory.dmp	xmrig
behavioral2/memory/3148-160-0x00007FF6EEBB0000-0x00007FF6EEF01000-memory.dmp	xmrig
behavioral2/memory/880-112-0x00007FF71C330000-0x00007FF71C681000-memory.dmp	xmrig
behavioral2/memory/4184-2158-0x00007FF73D390000-0x00007FF73D6E1000-memory.dmp	xmrig
behavioral2/memory/4760-2256-0x00007FF79F620000-0x00007FF79F971000-memory.dmp	xmrig
behavioral2/memory/2580-2258-0x00007FF785780000-0x00007FF785AD1000-memory.dmp	xmrig
behavioral2/memory/968-2257-0x00007FF65D840000-0x00007FF65DB91000-memory.dmp	xmrig
behavioral2/memory/1704-2260-0x00007FF6222E0000-0x00007FF622631000-memory.dmp	xmrig
behavioral2/memory/3840-2261-0x00007FF62CF40000-0x00007FF62D291000-memory.dmp	xmrig
behavioral2/memory/3088-2259-0x00007FF719D00000-0x00007FF71A051000-memory.dmp	xmrig
behavioral2/memory/1592-2293-0x00007FF6C1130000-0x00007FF6C1481000-memory.dmp	xmrig
behavioral2/memory/4760-2296-0x00007FF79F620000-0x00007FF79F971000-memory.dmp	xmrig
behavioral2/memory/4984-2298-0x00007FF777E90000-0x00007FF7781E1000-memory.dmp	xmrig
behavioral2/memory/1592-2300-0x00007FF6C1130000-0x00007FF6C1481000-memory.dmp	xmrig
behavioral2/memory/5084-2302-0x00007FF620CB0000-0x00007FF621001000-memory.dmp	xmrig
behavioral2/memory/968-2304-0x00007FF65D840000-0x00007FF65DB91000-memory.dmp	xmrig
behavioral2/memory/2580-2306-0x00007FF785780000-0x00007FF785AD1000-memory.dmp	xmrig
behavioral2/memory/3088-2325-0x00007FF719D00000-0x00007FF71A051000-memory.dmp	xmrig
behavioral2/memory/2856-2326-0x00007FF63DBD0000-0x00007FF63DF21000-memory.dmp	xmrig
behavioral2/memory/1704-2323-0x00007FF6222E0000-0x00007FF622631000-memory.dmp	xmrig
behavioral2/memory/880-2321-0x00007FF71C330000-0x00007FF71C681000-memory.dmp	xmrig
behavioral2/memory/1532-2317-0x00007FF609CA0000-0x00007FF609FF1000-memory.dmp	xmrig
behavioral2/memory/4500-2313-0x00007FF7C8210000-0x00007FF7C8561000-memory.dmp	xmrig
behavioral2/memory/3840-2311-0x00007FF62CF40000-0x00007FF62D291000-memory.dmp	xmrig
behavioral2/memory/3148-2319-0x00007FF6EEBB0000-0x00007FF6EEF01000-memory.dmp	xmrig
behavioral2/memory/5056-2315-0x00007FF6D4330000-0x00007FF6D4681000-memory.dmp	xmrig
behavioral2/memory/700-2309-0x00007FF7705F0000-0x00007FF770941000-memory.dmp	xmrig
behavioral2/memory/1960-2330-0x00007FF76B1F0000-0x00007FF76B541000-memory.dmp	xmrig
behavioral2/memory/3748-2332-0x00007FF7881A0000-0x00007FF7884F1000-memory.dmp	xmrig
behavioral2/memory/312-2334-0x00007FF7A36D0000-0x00007FF7A3A21000-memory.dmp	xmrig
behavioral2/memory/2240-2328-0x00007FF7AC660000-0x00007FF7AC9B1000-memory.dmp	xmrig
behavioral2/memory/2396-2375-0x00007FF67D9D0000-0x00007FF67DD21000-memory.dmp	xmrig
behavioral2/memory/3648-2373-0x00007FF7650F0000-0x00007FF765441000-memory.dmp	xmrig
behavioral2/memory/4800-2357-0x00007FF736E60000-0x00007FF7371B1000-memory.dmp	xmrig
behavioral2/memory/2788-2347-0x00007FF719570000-0x00007FF7198C1000-memory.dmp	xmrig
behavioral2/memory/4696-2372-0x00007FF7A5F70000-0x00007FF7A62C1000-memory.dmp	xmrig
behavioral2/memory/4888-2370-0x00007FF71E0B0000-0x00007FF71E401000-memory.dmp	xmrig
behavioral2/memory/4272-2341-0x00007FF76B070000-0x00007FF76B3C1000-memory.dmp	xmrig
behavioral2/memory/2184-2340-0x00007FF63EED0000-0x00007FF63F221000-memory.dmp	xmrig
behavioral2/memory/2684-2346-0x00007FF79E110000-0x00007FF79E461000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4760	tOwhfXS.exe
4984	yarUfhq.exe
968	inGqXhx.exe
5084	AFPkksq.exe
1592	DbQEACC.exe
2580	dVWXXHF.exe
2856	LfIXbza.exe
3088	eGaGxJT.exe
1704	NBsLUxO.exe
880	tAMWAoQ.exe
4500	pPmaGdA.exe
3840	zvwdaHe.exe
1532	qfFXgaZ.exe
700	HKNrlBf.exe
3148	sEquGLn.exe
3748	DVNcIxe.exe
312	BwtyFpR.exe
4696	SjajjWl.exe
4888	RWhxstH.exe
4800	YNBihKv.exe
2184	PbhCmmA.exe
2396	dIsBToc.exe
2788	HqNzijv.exe
2240	KDzGqEl.exe
1960	ZOULQfw.exe
5056	qMpFSTQ.exe
3648	RLpfusX.exe
2684	dXRXImf.exe
4272	SDQNhhL.exe
2152	ghXiSwn.exe
1768	HpzVxyy.exe
2356	pyaAuvC.exe
1388	NBYPCtw.exe
4280	hLzjziI.exe
3500	yGVTfzX.exe
428	aDfwsmA.exe
2244	HAykWYg.exe
1312	juDHdgx.exe
3584	JfVwFNS.exe
2080	soiIbAk.exe
3396	mleotCg.exe
3496	TwiaEIc.exe
4872	QSbnSXl.exe
4264	WZFsJXC.exe
4208	yBOkcGs.exe
3700	aKvxbig.exe
1588	lZGmLHj.exe
2320	pjCBKJT.exe
3680	gycskJt.exe
3320	QXeMhOz.exe
2236	FToysDN.exe
2256	wIjBRGn.exe
4652	ghdWuKl.exe
1460	fkpwRrG.exe
1576	jdzvTOf.exe
2428	bvEtHKi.exe
2572	HPsZoiK.exe
1932	hvwltPG.exe
1468	npPMVyy.exe
456	KZVxIfQ.exe
2168	ZaortIR.exe
1636	hcHVPDL.exe
4960	RDhzhOP.exe
4600	vChmczB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4184-0-0x00007FF73D390000-0x00007FF73D6E1000-memory.dmp	upx
behavioral2/files/0x00090000000233b9-5.dat	upx
behavioral2/files/0x000700000002341b-8.dat	upx
behavioral2/files/0x0007000000023422-39.dat	upx
behavioral2/files/0x000700000002341c-46.dat	upx
behavioral2/files/0x000700000002341e-80.dat	upx
behavioral2/memory/3840-133-0x00007FF62CF40000-0x00007FF62D291000-memory.dmp	upx
behavioral2/memory/1532-155-0x00007FF609CA0000-0x00007FF609FF1000-memory.dmp	upx
behavioral2/files/0x000700000002343b-191.dat	upx
behavioral2/memory/2184-227-0x00007FF63EED0000-0x00007FF63F221000-memory.dmp	upx
behavioral2/memory/2396-252-0x00007FF67D9D0000-0x00007FF67DD21000-memory.dmp	upx
behavioral2/memory/1960-259-0x00007FF76B1F0000-0x00007FF76B541000-memory.dmp	upx
behavioral2/memory/3648-317-0x00007FF7650F0000-0x00007FF765441000-memory.dmp	upx
behavioral2/memory/4272-322-0x00007FF76B070000-0x00007FF76B3C1000-memory.dmp	upx
behavioral2/memory/4500-353-0x00007FF7C8210000-0x00007FF7C8561000-memory.dmp	upx
behavioral2/memory/2788-355-0x00007FF719570000-0x00007FF7198C1000-memory.dmp	upx
behavioral2/memory/700-354-0x00007FF7705F0000-0x00007FF770941000-memory.dmp	upx
behavioral2/memory/2856-352-0x00007FF63DBD0000-0x00007FF63DF21000-memory.dmp	upx
behavioral2/memory/5084-335-0x00007FF620CB0000-0x00007FF621001000-memory.dmp	upx
behavioral2/memory/4984-333-0x00007FF777E90000-0x00007FF7781E1000-memory.dmp	upx
behavioral2/memory/2684-321-0x00007FF79E110000-0x00007FF79E461000-memory.dmp	upx
behavioral2/memory/5056-274-0x00007FF6D4330000-0x00007FF6D4681000-memory.dmp	upx
behavioral2/memory/2240-258-0x00007FF7AC660000-0x00007FF7AC9B1000-memory.dmp	upx
behavioral2/memory/4800-226-0x00007FF736E60000-0x00007FF7371B1000-memory.dmp	upx
behavioral2/memory/4888-212-0x00007FF71E0B0000-0x00007FF71E401000-memory.dmp	upx
behavioral2/memory/312-193-0x00007FF7A36D0000-0x00007FF7A3A21000-memory.dmp	upx
behavioral2/files/0x0007000000023435-186.dat	upx
behavioral2/memory/4696-211-0x00007FF7A5F70000-0x00007FF7A62C1000-memory.dmp	upx
behavioral2/files/0x000700000002342f-180.dat	upx
behavioral2/files/0x0007000000023434-173.dat	upx
behavioral2/files/0x000700000002343a-171.dat	upx
behavioral2/files/0x0007000000023439-168.dat	upx
behavioral2/files/0x0007000000023436-167.dat	upx
behavioral2/files/0x0007000000023438-166.dat	upx
behavioral2/files/0x0007000000023437-164.dat	upx
behavioral2/memory/3748-163-0x00007FF7881A0000-0x00007FF7884F1000-memory.dmp	upx
behavioral2/memory/3148-160-0x00007FF6EEBB0000-0x00007FF6EEF01000-memory.dmp	upx
behavioral2/files/0x000700000002342e-152.dat	upx
behavioral2/files/0x000700000002342d-151.dat	upx
behavioral2/files/0x000700000002342c-148.dat	upx
behavioral2/files/0x000700000002342b-147.dat	upx
behavioral2/files/0x0007000000023429-137.dat	upx
behavioral2/files/0x0007000000023428-134.dat	upx
behavioral2/files/0x0007000000023426-111.dat	upx
behavioral2/files/0x000700000002342a-146.dat	upx
behavioral2/files/0x0007000000023433-122.dat	upx
behavioral2/files/0x0007000000023423-119.dat	upx
behavioral2/files/0x0007000000023432-117.dat	upx
behavioral2/files/0x0007000000023431-116.dat	upx
behavioral2/files/0x0007000000023430-115.dat	upx
behavioral2/memory/880-112-0x00007FF71C330000-0x00007FF71C681000-memory.dmp	upx
behavioral2/memory/1704-108-0x00007FF6222E0000-0x00007FF622631000-memory.dmp	upx
behavioral2/files/0x0007000000023425-105.dat	upx
behavioral2/files/0x0007000000023424-126.dat	upx
behavioral2/files/0x0007000000023427-96.dat	upx
behavioral2/memory/3088-76-0x00007FF719D00000-0x00007FF71A051000-memory.dmp	upx
behavioral2/files/0x0007000000023421-83.dat	upx
behavioral2/files/0x0007000000023420-59.dat	upx
behavioral2/files/0x000700000002341f-53.dat	upx
behavioral2/memory/2580-47-0x00007FF785780000-0x00007FF785AD1000-memory.dmp	upx
behavioral2/memory/1592-33-0x00007FF6C1130000-0x00007FF6C1481000-memory.dmp	upx
behavioral2/files/0x000700000002341d-40.dat	upx
behavioral2/memory/968-26-0x00007FF65D840000-0x00007FF65DB91000-memory.dmp	upx
behavioral2/memory/4760-19-0x00007FF79F620000-0x00007FF79F971000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qTRuNmP.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\HvUZLEO.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\dVnBxwS.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\zQnazQq.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\WlHVMwW.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\qvcXMqb.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\EbpsMeP.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\emxpXEF.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\FlUYuWP.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\MNjeQGU.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\bzzxwVw.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\ysFJmtW.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\zCeuxfn.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\VJXrJks.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\BlUenSD.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\YGrxTce.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\GFpBWcu.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\jjHSCiW.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\zvwdaHe.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\IeXUEhN.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\idVkVug.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\wguBoTo.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\BPttJAM.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\pwBVKcm.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\fpgQuyv.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\jShggPt.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\QBuuPsn.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\IEwsNvh.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\KDuRsqs.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\ODTnsBx.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\CRsWsqW.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\CSIeAGR.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\UzRkcDp.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\fxfuOfd.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\uoZghiW.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\tngzPVy.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\wzwQrFM.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\UeMHbZV.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\QMPtKuQ.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\SFsdtJF.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\gshsFWv.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\mIxyPzV.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\WlqEvOV.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\sezgFDx.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\eRseXhF.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\uXSilba.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\rbdlUOP.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\IawohTJ.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\npPMVyy.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\lNYmELG.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\sRCAOCH.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\AWlbPGY.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\uslDyVT.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\uixlFnH.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\WZFsJXC.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\TwiaEIc.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\XfflFJF.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\AFVlnFM.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\cnSmyww.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\TsPwDfT.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\SzSDwbY.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\eIurexL.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\ghXiSwn.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe
File created	C:\Windows\System\EWtnevU.exe	a3e999759b78c1b1e560ae5a42e26b40N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4760	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	84
PID 4184 wrote to memory of 4760	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	84
PID 4184 wrote to memory of 4984	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	85
PID 4184 wrote to memory of 4984	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	85
PID 4184 wrote to memory of 968	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	86
PID 4184 wrote to memory of 968	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	86
PID 4184 wrote to memory of 5084	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	87
PID 4184 wrote to memory of 5084	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	87
PID 4184 wrote to memory of 1592	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	88
PID 4184 wrote to memory of 1592	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	88
PID 4184 wrote to memory of 3088	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	89
PID 4184 wrote to memory of 3088	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	89
PID 4184 wrote to memory of 2580	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	90
PID 4184 wrote to memory of 2580	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	90
PID 4184 wrote to memory of 2856	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	91
PID 4184 wrote to memory of 2856	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	91
PID 4184 wrote to memory of 1704	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	92
PID 4184 wrote to memory of 1704	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	92
PID 4184 wrote to memory of 880	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	93
PID 4184 wrote to memory of 880	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	93
PID 4184 wrote to memory of 4500	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	94
PID 4184 wrote to memory of 4500	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	94
PID 4184 wrote to memory of 3840	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	95
PID 4184 wrote to memory of 3840	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	95
PID 4184 wrote to memory of 1532	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	96
PID 4184 wrote to memory of 1532	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	96
PID 4184 wrote to memory of 700	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	97
PID 4184 wrote to memory of 700	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	97
PID 4184 wrote to memory of 3148	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	98
PID 4184 wrote to memory of 3148	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	98
PID 4184 wrote to memory of 3748	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	99
PID 4184 wrote to memory of 3748	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	99
PID 4184 wrote to memory of 312	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	100
PID 4184 wrote to memory of 312	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	100
PID 4184 wrote to memory of 4696	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	101
PID 4184 wrote to memory of 4696	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	101
PID 4184 wrote to memory of 4888	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	102
PID 4184 wrote to memory of 4888	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	102
PID 4184 wrote to memory of 4800	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	103
PID 4184 wrote to memory of 4800	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	103
PID 4184 wrote to memory of 2184	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	104
PID 4184 wrote to memory of 2184	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	104
PID 4184 wrote to memory of 2396	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	105
PID 4184 wrote to memory of 2396	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	105
PID 4184 wrote to memory of 2684	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	106
PID 4184 wrote to memory of 2684	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	106
PID 4184 wrote to memory of 2788	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	107
PID 4184 wrote to memory of 2788	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	107
PID 4184 wrote to memory of 2240	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	108
PID 4184 wrote to memory of 2240	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	108
PID 4184 wrote to memory of 1960	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	109
PID 4184 wrote to memory of 1960	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	109
PID 4184 wrote to memory of 5056	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	110
PID 4184 wrote to memory of 5056	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	110
PID 4184 wrote to memory of 3648	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	111
PID 4184 wrote to memory of 3648	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	111
PID 4184 wrote to memory of 4272	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	112
PID 4184 wrote to memory of 4272	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	112
PID 4184 wrote to memory of 2152	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	113
PID 4184 wrote to memory of 2152	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	113
PID 4184 wrote to memory of 1768	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	114
PID 4184 wrote to memory of 1768	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	114
PID 4184 wrote to memory of 2356	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	115
PID 4184 wrote to memory of 2356	4184	a3e999759b78c1b1e560ae5a42e26b40N.exe	115

C:\Users\Admin\AppData\Local\Temp\a3e999759b78c1b1e560ae5a42e26b40N.exe
"C:\Users\Admin\AppData\Local\Temp\a3e999759b78c1b1e560ae5a42e26b40N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\System\tOwhfXS.exe
  C:\Windows\System\tOwhfXS.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\yarUfhq.exe
  C:\Windows\System\yarUfhq.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\inGqXhx.exe
  C:\Windows\System\inGqXhx.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\AFPkksq.exe
  C:\Windows\System\AFPkksq.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\DbQEACC.exe
  C:\Windows\System\DbQEACC.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\eGaGxJT.exe
  C:\Windows\System\eGaGxJT.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\dVWXXHF.exe
  C:\Windows\System\dVWXXHF.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\LfIXbza.exe
  C:\Windows\System\LfIXbza.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\NBsLUxO.exe
  C:\Windows\System\NBsLUxO.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\tAMWAoQ.exe
  C:\Windows\System\tAMWAoQ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\pPmaGdA.exe
  C:\Windows\System\pPmaGdA.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\zvwdaHe.exe
  C:\Windows\System\zvwdaHe.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\qfFXgaZ.exe
  C:\Windows\System\qfFXgaZ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\HKNrlBf.exe
  C:\Windows\System\HKNrlBf.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\sEquGLn.exe
  C:\Windows\System\sEquGLn.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\DVNcIxe.exe
  C:\Windows\System\DVNcIxe.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\BwtyFpR.exe
  C:\Windows\System\BwtyFpR.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\SjajjWl.exe
  C:\Windows\System\SjajjWl.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\RWhxstH.exe
  C:\Windows\System\RWhxstH.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\YNBihKv.exe
  C:\Windows\System\YNBihKv.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\PbhCmmA.exe
  C:\Windows\System\PbhCmmA.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\dIsBToc.exe
  C:\Windows\System\dIsBToc.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\dXRXImf.exe
  C:\Windows\System\dXRXImf.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\HqNzijv.exe
  C:\Windows\System\HqNzijv.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\KDzGqEl.exe
  C:\Windows\System\KDzGqEl.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\ZOULQfw.exe
  C:\Windows\System\ZOULQfw.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\qMpFSTQ.exe
  C:\Windows\System\qMpFSTQ.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\RLpfusX.exe
  C:\Windows\System\RLpfusX.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\SDQNhhL.exe
  C:\Windows\System\SDQNhhL.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\ghXiSwn.exe
  C:\Windows\System\ghXiSwn.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\HpzVxyy.exe
  C:\Windows\System\HpzVxyy.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\pyaAuvC.exe
  C:\Windows\System\pyaAuvC.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\NBYPCtw.exe
  C:\Windows\System\NBYPCtw.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\hLzjziI.exe
  C:\Windows\System\hLzjziI.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\yGVTfzX.exe
  C:\Windows\System\yGVTfzX.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\aDfwsmA.exe
  C:\Windows\System\aDfwsmA.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\HAykWYg.exe
  C:\Windows\System\HAykWYg.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\juDHdgx.exe
  C:\Windows\System\juDHdgx.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\JfVwFNS.exe
  C:\Windows\System\JfVwFNS.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\soiIbAk.exe
  C:\Windows\System\soiIbAk.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\FToysDN.exe
  C:\Windows\System\FToysDN.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\mleotCg.exe
  C:\Windows\System\mleotCg.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\TwiaEIc.exe
  C:\Windows\System\TwiaEIc.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\QSbnSXl.exe
  C:\Windows\System\QSbnSXl.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\WZFsJXC.exe
  C:\Windows\System\WZFsJXC.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\yBOkcGs.exe
  C:\Windows\System\yBOkcGs.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\aKvxbig.exe
  C:\Windows\System\aKvxbig.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\lZGmLHj.exe
  C:\Windows\System\lZGmLHj.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\pjCBKJT.exe
  C:\Windows\System\pjCBKJT.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\gycskJt.exe
  C:\Windows\System\gycskJt.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\QXeMhOz.exe
  C:\Windows\System\QXeMhOz.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\wIjBRGn.exe
  C:\Windows\System\wIjBRGn.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\ghdWuKl.exe
  C:\Windows\System\ghdWuKl.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\fkpwRrG.exe
  C:\Windows\System\fkpwRrG.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\jdzvTOf.exe
  C:\Windows\System\jdzvTOf.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\bvEtHKi.exe
  C:\Windows\System\bvEtHKi.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\HPsZoiK.exe
  C:\Windows\System\HPsZoiK.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\hvwltPG.exe
  C:\Windows\System\hvwltPG.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\npPMVyy.exe
  C:\Windows\System\npPMVyy.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\KZVxIfQ.exe
  C:\Windows\System\KZVxIfQ.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\ZaortIR.exe
  C:\Windows\System\ZaortIR.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\hcHVPDL.exe
  C:\Windows\System\hcHVPDL.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\RDhzhOP.exe
  C:\Windows\System\RDhzhOP.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\vChmczB.exe
  C:\Windows\System\vChmczB.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\xdipKTl.exe
  C:\Windows\System\xdipKTl.exe
  2⤵
  PID:1780
- C:\Windows\System\ucPeVsO.exe
  C:\Windows\System\ucPeVsO.exe
  2⤵
  PID:5072
- C:\Windows\System\SMPPoWd.exe
  C:\Windows\System\SMPPoWd.exe
  2⤵
  PID:4996
- C:\Windows\System\mOtlCTh.exe
  C:\Windows\System\mOtlCTh.exe
  2⤵
  PID:4860
- C:\Windows\System\kIKpALl.exe
  C:\Windows\System\kIKpALl.exe
  2⤵
  PID:928
- C:\Windows\System\pjttftt.exe
  C:\Windows\System\pjttftt.exe
  2⤵
  PID:1036
- C:\Windows\System\BUNRjSo.exe
  C:\Windows\System\BUNRjSo.exe
  2⤵
  PID:4852
- C:\Windows\System\upZjErj.exe
  C:\Windows\System\upZjErj.exe
  2⤵
  PID:3536
- C:\Windows\System\rmieudJ.exe
  C:\Windows\System\rmieudJ.exe
  2⤵
  PID:2996
- C:\Windows\System\hZZrskJ.exe
  C:\Windows\System\hZZrskJ.exe
  2⤵
  PID:540
- C:\Windows\System\SvtQzbr.exe
  C:\Windows\System\SvtQzbr.exe
  2⤵
  PID:3092
- C:\Windows\System\xSwwWdX.exe
  C:\Windows\System\xSwwWdX.exe
  2⤵
  PID:5132
- C:\Windows\System\DGfEvam.exe
  C:\Windows\System\DGfEvam.exe
  2⤵
  PID:5148
- C:\Windows\System\rZrniIJ.exe
  C:\Windows\System\rZrniIJ.exe
  2⤵
  PID:5164
- C:\Windows\System\IawohTJ.exe
  C:\Windows\System\IawohTJ.exe
  2⤵
  PID:5180
- C:\Windows\System\mQjgqcE.exe
  C:\Windows\System\mQjgqcE.exe
  2⤵
  PID:5196
- C:\Windows\System\gIaXjpL.exe
  C:\Windows\System\gIaXjpL.exe
  2⤵
  PID:5212
- C:\Windows\System\ilaGoYt.exe
  C:\Windows\System\ilaGoYt.exe
  2⤵
  PID:5228
- C:\Windows\System\GhEMurh.exe
  C:\Windows\System\GhEMurh.exe
  2⤵
  PID:5244
- C:\Windows\System\qNVTMbs.exe
  C:\Windows\System\qNVTMbs.exe
  2⤵
  PID:5264
- C:\Windows\System\azZKwhr.exe
  C:\Windows\System\azZKwhr.exe
  2⤵
  PID:5364
- C:\Windows\System\PbnZMEC.exe
  C:\Windows\System\PbnZMEC.exe
  2⤵
  PID:5388
- C:\Windows\System\gshsFWv.exe
  C:\Windows\System\gshsFWv.exe
  2⤵
  PID:5404
- C:\Windows\System\RnyHmux.exe
  C:\Windows\System\RnyHmux.exe
  2⤵
  PID:5428
- C:\Windows\System\wfmwMBt.exe
  C:\Windows\System\wfmwMBt.exe
  2⤵
  PID:5452
- C:\Windows\System\RpyZgrH.exe
  C:\Windows\System\RpyZgrH.exe
  2⤵
  PID:5480
- C:\Windows\System\ThaIjsY.exe
  C:\Windows\System\ThaIjsY.exe
  2⤵
  PID:5500
- C:\Windows\System\RIBNhTx.exe
  C:\Windows\System\RIBNhTx.exe
  2⤵
  PID:5724
- C:\Windows\System\LVCGOMk.exe
  C:\Windows\System\LVCGOMk.exe
  2⤵
  PID:5744
- C:\Windows\System\HyacAsd.exe
  C:\Windows\System\HyacAsd.exe
  2⤵
  PID:5760
- C:\Windows\System\ZppemqE.exe
  C:\Windows\System\ZppemqE.exe
  2⤵
  PID:5780
- C:\Windows\System\SEKzjPL.exe
  C:\Windows\System\SEKzjPL.exe
  2⤵
  PID:5796
- C:\Windows\System\TtKogHF.exe
  C:\Windows\System\TtKogHF.exe
  2⤵
  PID:5816
- C:\Windows\System\FXJMAYL.exe
  C:\Windows\System\FXJMAYL.exe
  2⤵
  PID:5840
- C:\Windows\System\lNYmELG.exe
  C:\Windows\System\lNYmELG.exe
  2⤵
  PID:5860
- C:\Windows\System\XNufVml.exe
  C:\Windows\System\XNufVml.exe
  2⤵
  PID:5884
- C:\Windows\System\qtjxAiJ.exe
  C:\Windows\System\qtjxAiJ.exe
  2⤵
  PID:5900
- C:\Windows\System\lYGfzOA.exe
  C:\Windows\System\lYGfzOA.exe
  2⤵
  PID:5920
- C:\Windows\System\sYjuzUt.exe
  C:\Windows\System\sYjuzUt.exe
  2⤵
  PID:5940
- C:\Windows\System\zbxjxjX.exe
  C:\Windows\System\zbxjxjX.exe
  2⤵
  PID:5968
- C:\Windows\System\UzRkcDp.exe
  C:\Windows\System\UzRkcDp.exe
  2⤵
  PID:6000
- C:\Windows\System\YGrxTce.exe
  C:\Windows\System\YGrxTce.exe
  2⤵
  PID:6016
- C:\Windows\System\KsOkbes.exe
  C:\Windows\System\KsOkbes.exe
  2⤵
  PID:6044
- C:\Windows\System\GxquSxK.exe
  C:\Windows\System\GxquSxK.exe
  2⤵
  PID:6064
- C:\Windows\System\jShggPt.exe
  C:\Windows\System\jShggPt.exe
  2⤵
  PID:6084
- C:\Windows\System\ryXobFx.exe
  C:\Windows\System\ryXobFx.exe
  2⤵
  PID:6108
- C:\Windows\System\sGWGBBf.exe
  C:\Windows\System\sGWGBBf.exe
  2⤵
  PID:6132
- C:\Windows\System\WbPedrh.exe
  C:\Windows\System\WbPedrh.exe
  2⤵
  PID:4324
- C:\Windows\System\ugPULrg.exe
  C:\Windows\System\ugPULrg.exe
  2⤵
  PID:3668
- C:\Windows\System\DSWKAGY.exe
  C:\Windows\System\DSWKAGY.exe
  2⤵
  PID:960
- C:\Windows\System\EfLZsTc.exe
  C:\Windows\System\EfLZsTc.exe
  2⤵
  PID:1440
- C:\Windows\System\UtLXrQS.exe
  C:\Windows\System\UtLXrQS.exe
  2⤵
  PID:3360
- C:\Windows\System\YUdiGCl.exe
  C:\Windows\System\YUdiGCl.exe
  2⤵
  PID:3140
- C:\Windows\System\jodVKZK.exe
  C:\Windows\System\jodVKZK.exe
  2⤵
  PID:2632
- C:\Windows\System\CtiTlpf.exe
  C:\Windows\System\CtiTlpf.exe
  2⤵
  PID:5156
- C:\Windows\System\cqXoQXz.exe
  C:\Windows\System\cqXoQXz.exe
  2⤵
  PID:5192
- C:\Windows\System\ZiBGEKu.exe
  C:\Windows\System\ZiBGEKu.exe
  2⤵
  PID:5260
- C:\Windows\System\ixOoLXd.exe
  C:\Windows\System\ixOoLXd.exe
  2⤵
  PID:5296
- C:\Windows\System\eKwEUED.exe
  C:\Windows\System\eKwEUED.exe
  2⤵
  PID:5336
- C:\Windows\System\DuYHguN.exe
  C:\Windows\System\DuYHguN.exe
  2⤵
  PID:5380
- C:\Windows\System\dyVjYmh.exe
  C:\Windows\System\dyVjYmh.exe
  2⤵
  PID:5436
- C:\Windows\System\ZUpvFzJ.exe
  C:\Windows\System\ZUpvFzJ.exe
  2⤵
  PID:5472
- C:\Windows\System\xoPxZcP.exe
  C:\Windows\System\xoPxZcP.exe
  2⤵
  PID:5620
- C:\Windows\System\FshWzUX.exe
  C:\Windows\System\FshWzUX.exe
  2⤵
  PID:5652
- C:\Windows\System\GKpkjbL.exe
  C:\Windows\System\GKpkjbL.exe
  2⤵
  PID:2120
- C:\Windows\System\VlXinSb.exe
  C:\Windows\System\VlXinSb.exe
  2⤵
  PID:1720
- C:\Windows\System\FkAkule.exe
  C:\Windows\System\FkAkule.exe
  2⤵
  PID:2008
- C:\Windows\System\dRdVqZI.exe
  C:\Windows\System\dRdVqZI.exe
  2⤵
  PID:4584
- C:\Windows\System\gYXHBGH.exe
  C:\Windows\System\gYXHBGH.exe
  2⤵
  PID:5048
- C:\Windows\System\FpGSdlO.exe
  C:\Windows\System\FpGSdlO.exe
  2⤵
  PID:1396
- C:\Windows\System\hsieHoD.exe
  C:\Windows\System\hsieHoD.exe
  2⤵
  PID:3616
- C:\Windows\System\AOGYyKh.exe
  C:\Windows\System\AOGYyKh.exe
  2⤵
  PID:1828
- C:\Windows\System\GSejshg.exe
  C:\Windows\System\GSejshg.exe
  2⤵
  PID:1548
- C:\Windows\System\EbpsMeP.exe
  C:\Windows\System\EbpsMeP.exe
  2⤵
  PID:3908
- C:\Windows\System\HCETkaH.exe
  C:\Windows\System\HCETkaH.exe
  2⤵
  PID:2712
- C:\Windows\System\vXCTUOE.exe
  C:\Windows\System\vXCTUOE.exe
  2⤵
  PID:1012
- C:\Windows\System\kdhzStY.exe
  C:\Windows\System\kdhzStY.exe
  2⤵
  PID:4580
- C:\Windows\System\gdPyenm.exe
  C:\Windows\System\gdPyenm.exe
  2⤵
  PID:2612
- C:\Windows\System\Xfwuyby.exe
  C:\Windows\System\Xfwuyby.exe
  2⤵
  PID:5600
- C:\Windows\System\ALrACkb.exe
  C:\Windows\System\ALrACkb.exe
  2⤵
  PID:1688
- C:\Windows\System\zDpwTFp.exe
  C:\Windows\System\zDpwTFp.exe
  2⤵
  PID:3076
- C:\Windows\System\rTeGlcv.exe
  C:\Windows\System\rTeGlcv.exe
  2⤵
  PID:3656
- C:\Windows\System\dTnjJWx.exe
  C:\Windows\System\dTnjJWx.exe
  2⤵
  PID:452
- C:\Windows\System\BgqvNDo.exe
  C:\Windows\System\BgqvNDo.exe
  2⤵
  PID:1804
- C:\Windows\System\ESpXbtf.exe
  C:\Windows\System\ESpXbtf.exe
  2⤵
  PID:5560
- C:\Windows\System\xbDYwYv.exe
  C:\Windows\System\xbDYwYv.exe
  2⤵
  PID:5772
- C:\Windows\System\PDbokdf.exe
  C:\Windows\System\PDbokdf.exe
  2⤵
  PID:5824
- C:\Windows\System\RBHZnrg.exe
  C:\Windows\System\RBHZnrg.exe
  2⤵
  PID:5876
- C:\Windows\System\eViIluB.exe
  C:\Windows\System\eViIluB.exe
  2⤵
  PID:5828
- C:\Windows\System\UwQIApa.exe
  C:\Windows\System\UwQIApa.exe
  2⤵
  PID:5960
- C:\Windows\System\LSmkhDB.exe
  C:\Windows\System\LSmkhDB.exe
  2⤵
  PID:6040
- C:\Windows\System\KkDmqBW.exe
  C:\Windows\System\KkDmqBW.exe
  2⤵
  PID:4968
- C:\Windows\System\akIJJRz.exe
  C:\Windows\System\akIJJRz.exe
  2⤵
  PID:6124
- C:\Windows\System\QBuuPsn.exe
  C:\Windows\System\QBuuPsn.exe
  2⤵
  PID:3856
- C:\Windows\System\fIIdeyR.exe
  C:\Windows\System\fIIdeyR.exe
  2⤵
  PID:6072
- C:\Windows\System\lyibphR.exe
  C:\Windows\System\lyibphR.exe
  2⤵
  PID:2164
- C:\Windows\System\bnqlVGV.exe
  C:\Windows\System\bnqlVGV.exe
  2⤵
  PID:5140
- C:\Windows\System\zDHPzFr.exe
  C:\Windows\System\zDHPzFr.exe
  2⤵
  PID:5220
- C:\Windows\System\LrHOuhO.exe
  C:\Windows\System\LrHOuhO.exe
  2⤵
  PID:5372
- C:\Windows\System\sezgFDx.exe
  C:\Windows\System\sezgFDx.exe
  2⤵
  PID:5176
- C:\Windows\System\fpgQuyv.exe
  C:\Windows\System\fpgQuyv.exe
  2⤵
  PID:3716
- C:\Windows\System\vAgyAEf.exe
  C:\Windows\System\vAgyAEf.exe
  2⤵
  PID:3268
- C:\Windows\System\dMXKnKr.exe
  C:\Windows\System\dMXKnKr.exe
  2⤵
  PID:2708
- C:\Windows\System\YXQrLsh.exe
  C:\Windows\System\YXQrLsh.exe
  2⤵
  PID:5092
- C:\Windows\System\PCzpvaL.exe
  C:\Windows\System\PCzpvaL.exe
  2⤵
  PID:5616
- C:\Windows\System\IEwsNvh.exe
  C:\Windows\System\IEwsNvh.exe
  2⤵
  PID:5624
- C:\Windows\System\QbZfjXk.exe
  C:\Windows\System\QbZfjXk.exe
  2⤵
  PID:876
- C:\Windows\System\sRCAOCH.exe
  C:\Windows\System\sRCAOCH.exe
  2⤵
  PID:368
- C:\Windows\System\rPxRbgj.exe
  C:\Windows\System\rPxRbgj.exe
  2⤵
  PID:5012
- C:\Windows\System\oiqaNgm.exe
  C:\Windows\System\oiqaNgm.exe
  2⤵
  PID:3132
- C:\Windows\System\SYClWvO.exe
  C:\Windows\System\SYClWvO.exe
  2⤵
  PID:1652
- C:\Windows\System\NekXfdh.exe
  C:\Windows\System\NekXfdh.exe
  2⤵
  PID:5376
- C:\Windows\System\oIvvXlY.exe
  C:\Windows\System\oIvvXlY.exe
  2⤵
  PID:6168
- C:\Windows\System\AqEMGVw.exe
  C:\Windows\System\AqEMGVw.exe
  2⤵
  PID:6192
- C:\Windows\System\PQszHRH.exe
  C:\Windows\System\PQszHRH.exe
  2⤵
  PID:6212
- C:\Windows\System\ONxdPfE.exe
  C:\Windows\System\ONxdPfE.exe
  2⤵
  PID:6232
- C:\Windows\System\zoAorcO.exe
  C:\Windows\System\zoAorcO.exe
  2⤵
  PID:6252
- C:\Windows\System\vtKaxgp.exe
  C:\Windows\System\vtKaxgp.exe
  2⤵
  PID:6276
- C:\Windows\System\araTZlj.exe
  C:\Windows\System\araTZlj.exe
  2⤵
  PID:6304
- C:\Windows\System\gGlUFXw.exe
  C:\Windows\System\gGlUFXw.exe
  2⤵
  PID:6332
- C:\Windows\System\PQYCjnm.exe
  C:\Windows\System\PQYCjnm.exe
  2⤵
  PID:6360
- C:\Windows\System\PELnaeu.exe
  C:\Windows\System\PELnaeu.exe
  2⤵
  PID:6392
- C:\Windows\System\POcYAhR.exe
  C:\Windows\System\POcYAhR.exe
  2⤵
  PID:6412
- C:\Windows\System\IgdQHtz.exe
  C:\Windows\System\IgdQHtz.exe
  2⤵
  PID:6440
- C:\Windows\System\LzIsmbn.exe
  C:\Windows\System\LzIsmbn.exe
  2⤵
  PID:6468
- C:\Windows\System\WqYdOrj.exe
  C:\Windows\System\WqYdOrj.exe
  2⤵
  PID:6492
- C:\Windows\System\xIrSdTe.exe
  C:\Windows\System\xIrSdTe.exe
  2⤵
  PID:6512
- C:\Windows\System\OWBubHm.exe
  C:\Windows\System\OWBubHm.exe
  2⤵
  PID:6536
- C:\Windows\System\gJGCzjx.exe
  C:\Windows\System\gJGCzjx.exe
  2⤵
  PID:6556
- C:\Windows\System\rzOLxBa.exe
  C:\Windows\System\rzOLxBa.exe
  2⤵
  PID:6580
- C:\Windows\System\eBBXBKt.exe
  C:\Windows\System\eBBXBKt.exe
  2⤵
  PID:6600
- C:\Windows\System\QDfpBvO.exe
  C:\Windows\System\QDfpBvO.exe
  2⤵
  PID:6624
- C:\Windows\System\fxfuOfd.exe
  C:\Windows\System\fxfuOfd.exe
  2⤵
  PID:6644
- C:\Windows\System\WXgbkqj.exe
  C:\Windows\System\WXgbkqj.exe
  2⤵
  PID:6664
- C:\Windows\System\NjhCtrt.exe
  C:\Windows\System\NjhCtrt.exe
  2⤵
  PID:6688
- C:\Windows\System\gEnjQuu.exe
  C:\Windows\System\gEnjQuu.exe
  2⤵
  PID:6720
- C:\Windows\System\WLrwssH.exe
  C:\Windows\System\WLrwssH.exe
  2⤵
  PID:6740
- C:\Windows\System\mBKLJTT.exe
  C:\Windows\System\mBKLJTT.exe
  2⤵
  PID:6764
- C:\Windows\System\mKPLbsA.exe
  C:\Windows\System\mKPLbsA.exe
  2⤵
  PID:6784
- C:\Windows\System\NCdZgsI.exe
  C:\Windows\System\NCdZgsI.exe
  2⤵
  PID:6808
- C:\Windows\System\LsnyeSV.exe
  C:\Windows\System\LsnyeSV.exe
  2⤵
  PID:6828
- C:\Windows\System\uoZghiW.exe
  C:\Windows\System\uoZghiW.exe
  2⤵
  PID:6852
- C:\Windows\System\oiZDiwr.exe
  C:\Windows\System\oiZDiwr.exe
  2⤵
  PID:6876
- C:\Windows\System\wmgqKbw.exe
  C:\Windows\System\wmgqKbw.exe
  2⤵
  PID:6900
- C:\Windows\System\HYBcmZL.exe
  C:\Windows\System\HYBcmZL.exe
  2⤵
  PID:6924
- C:\Windows\System\ANSIPSn.exe
  C:\Windows\System\ANSIPSn.exe
  2⤵
  PID:6944
- C:\Windows\System\viGoZUP.exe
  C:\Windows\System\viGoZUP.exe
  2⤵
  PID:6964
- C:\Windows\System\RhZKhYZ.exe
  C:\Windows\System\RhZKhYZ.exe
  2⤵
  PID:6988
- C:\Windows\System\YiAhCoV.exe
  C:\Windows\System\YiAhCoV.exe
  2⤵
  PID:7016
- C:\Windows\System\sCNrGIk.exe
  C:\Windows\System\sCNrGIk.exe
  2⤵
  PID:7036
- C:\Windows\System\ncqfFBi.exe
  C:\Windows\System\ncqfFBi.exe
  2⤵
  PID:7060
- C:\Windows\System\FafHpiV.exe
  C:\Windows\System\FafHpiV.exe
  2⤵
  PID:7080
- C:\Windows\System\xeEoFPI.exe
  C:\Windows\System\xeEoFPI.exe
  2⤵
  PID:7100
- C:\Windows\System\emhMdZc.exe
  C:\Windows\System\emhMdZc.exe
  2⤵
  PID:7124
- C:\Windows\System\ZLZdTkk.exe
  C:\Windows\System\ZLZdTkk.exe
  2⤵
  PID:7156
- C:\Windows\System\YSPTbYD.exe
  C:\Windows\System\YSPTbYD.exe
  2⤵
  PID:4460
- C:\Windows\System\oPSdIAE.exe
  C:\Windows\System\oPSdIAE.exe
  2⤵
  PID:4948
- C:\Windows\System\ACsvaMl.exe
  C:\Windows\System\ACsvaMl.exe
  2⤵
  PID:5188
- C:\Windows\System\JRsEhHm.exe
  C:\Windows\System\JRsEhHm.exe
  2⤵
  PID:1488
- C:\Windows\System\HYZYvaR.exe
  C:\Windows\System\HYZYvaR.exe
  2⤵
  PID:3720
- C:\Windows\System\bggkUsd.exe
  C:\Windows\System\bggkUsd.exe
  2⤵
  PID:5892
- C:\Windows\System\dbsCCft.exe
  C:\Windows\System\dbsCCft.exe
  2⤵
  PID:6176
- C:\Windows\System\nGxrNdQ.exe
  C:\Windows\System\nGxrNdQ.exe
  2⤵
  PID:4764
- C:\Windows\System\mIxyPzV.exe
  C:\Windows\System\mIxyPzV.exe
  2⤵
  PID:6268
- C:\Windows\System\zisXWNW.exe
  C:\Windows\System\zisXWNW.exe
  2⤵
  PID:5356
- C:\Windows\System\OurkrKy.exe
  C:\Windows\System\OurkrKy.exe
  2⤵
  PID:6372
- C:\Windows\System\eRseXhF.exe
  C:\Windows\System\eRseXhF.exe
  2⤵
  PID:3768
- C:\Windows\System\QzGASfY.exe
  C:\Windows\System\QzGASfY.exe
  2⤵
  PID:3776
- C:\Windows\System\rbvpMSy.exe
  C:\Windows\System\rbvpMSy.exe
  2⤵
  PID:6504
- C:\Windows\System\TGMrpRq.exe
  C:\Windows\System\TGMrpRq.exe
  2⤵
  PID:6528
- C:\Windows\System\YfnYcOD.exe
  C:\Windows\System\YfnYcOD.exe
  2⤵
  PID:6620
- C:\Windows\System\HzZdEsL.exe
  C:\Windows\System\HzZdEsL.exe
  2⤵
  PID:6684
- C:\Windows\System\RwcLMIi.exe
  C:\Windows\System\RwcLMIi.exe
  2⤵
  PID:6748
- C:\Windows\System\ijbMFDn.exe
  C:\Windows\System\ijbMFDn.exe
  2⤵
  PID:6824
- C:\Windows\System\VwUzlRZ.exe
  C:\Windows\System\VwUzlRZ.exe
  2⤵
  PID:6864
- C:\Windows\System\GRUtZdz.exe
  C:\Windows\System\GRUtZdz.exe
  2⤵
  PID:6660
- C:\Windows\System\eikQtvc.exe
  C:\Windows\System\eikQtvc.exe
  2⤵
  PID:6732
- C:\Windows\System\wCVEgCn.exe
  C:\Windows\System\wCVEgCn.exe
  2⤵
  PID:7048
- C:\Windows\System\UxEjfuj.exe
  C:\Windows\System\UxEjfuj.exe
  2⤵
  PID:7088
- C:\Windows\System\LrNCSdq.exe
  C:\Windows\System\LrNCSdq.exe
  2⤵
  PID:6804
- C:\Windows\System\hUontrR.exe
  C:\Windows\System\hUontrR.exe
  2⤵
  PID:6908
- C:\Windows\System\BlUenSD.exe
  C:\Windows\System\BlUenSD.exe
  2⤵
  PID:6640
- C:\Windows\System\KHoVwlC.exe
  C:\Windows\System\KHoVwlC.exe
  2⤵
  PID:7184
- C:\Windows\System\fGneXpE.exe
  C:\Windows\System\fGneXpE.exe
  2⤵
  PID:7204
- C:\Windows\System\mvMJcQN.exe
  C:\Windows\System\mvMJcQN.exe
  2⤵
  PID:7224
- C:\Windows\System\ebMcufs.exe
  C:\Windows\System\ebMcufs.exe
  2⤵
  PID:7252
- C:\Windows\System\vTryJLY.exe
  C:\Windows\System\vTryJLY.exe
  2⤵
  PID:7276
- C:\Windows\System\PdUopMI.exe
  C:\Windows\System\PdUopMI.exe
  2⤵
  PID:7296
- C:\Windows\System\gEEvWRu.exe
  C:\Windows\System\gEEvWRu.exe
  2⤵
  PID:7316
- C:\Windows\System\jaVBmXk.exe
  C:\Windows\System\jaVBmXk.exe
  2⤵
  PID:7336
- C:\Windows\System\iKwaPeB.exe
  C:\Windows\System\iKwaPeB.exe
  2⤵
  PID:7360
- C:\Windows\System\hsQwQxz.exe
  C:\Windows\System\hsQwQxz.exe
  2⤵
  PID:7384
- C:\Windows\System\Xrgbarb.exe
  C:\Windows\System\Xrgbarb.exe
  2⤵
  PID:7404
- C:\Windows\System\IaVFZfn.exe
  C:\Windows\System\IaVFZfn.exe
  2⤵
  PID:7428
- C:\Windows\System\KKtfEZi.exe
  C:\Windows\System\KKtfEZi.exe
  2⤵
  PID:7456
- C:\Windows\System\AWlbPGY.exe
  C:\Windows\System\AWlbPGY.exe
  2⤵
  PID:7480
- C:\Windows\System\QSznbTy.exe
  C:\Windows\System\QSznbTy.exe
  2⤵
  PID:7504
- C:\Windows\System\IyEufag.exe
  C:\Windows\System\IyEufag.exe
  2⤵
  PID:7528
- C:\Windows\System\qTRuNmP.exe
  C:\Windows\System\qTRuNmP.exe
  2⤵
  PID:7548
- C:\Windows\System\canCjZI.exe
  C:\Windows\System\canCjZI.exe
  2⤵
  PID:7572
- C:\Windows\System\WriUDdF.exe
  C:\Windows\System\WriUDdF.exe
  2⤵
  PID:7596
- C:\Windows\System\HHtPPpB.exe
  C:\Windows\System\HHtPPpB.exe
  2⤵
  PID:7620
- C:\Windows\System\PGCwSYj.exe
  C:\Windows\System\PGCwSYj.exe
  2⤵
  PID:7640
- C:\Windows\System\lwStPeg.exe
  C:\Windows\System\lwStPeg.exe
  2⤵
  PID:7664
- C:\Windows\System\tngzPVy.exe
  C:\Windows\System\tngzPVy.exe
  2⤵
  PID:7692
- C:\Windows\System\oAMufNn.exe
  C:\Windows\System\oAMufNn.exe
  2⤵
  PID:7720
- C:\Windows\System\BwgDBYY.exe
  C:\Windows\System\BwgDBYY.exe
  2⤵
  PID:7744
- C:\Windows\System\zZcpTMK.exe
  C:\Windows\System\zZcpTMK.exe
  2⤵
  PID:7764
- C:\Windows\System\czXLril.exe
  C:\Windows\System\czXLril.exe
  2⤵
  PID:7792
- C:\Windows\System\LPtKNCw.exe
  C:\Windows\System\LPtKNCw.exe
  2⤵
  PID:7816
- C:\Windows\System\UhkClcy.exe
  C:\Windows\System\UhkClcy.exe
  2⤵
  PID:7840
- C:\Windows\System\VExJLoc.exe
  C:\Windows\System\VExJLoc.exe
  2⤵
  PID:7864
- C:\Windows\System\zGjxqph.exe
  C:\Windows\System\zGjxqph.exe
  2⤵
  PID:7884
- C:\Windows\System\wzwQrFM.exe
  C:\Windows\System\wzwQrFM.exe
  2⤵
  PID:7912
- C:\Windows\System\XfflFJF.exe
  C:\Windows\System\XfflFJF.exe
  2⤵
  PID:7940
- C:\Windows\System\ScjTnDT.exe
  C:\Windows\System\ScjTnDT.exe
  2⤵
  PID:7960
- C:\Windows\System\MMzSUwk.exe
  C:\Windows\System\MMzSUwk.exe
  2⤵
  PID:7992
- C:\Windows\System\qRGObLf.exe
  C:\Windows\System\qRGObLf.exe
  2⤵
  PID:8008
- C:\Windows\System\LslICoZ.exe
  C:\Windows\System\LslICoZ.exe
  2⤵
  PID:8032
- C:\Windows\System\reQOVDM.exe
  C:\Windows\System\reQOVDM.exe
  2⤵
  PID:8056
- C:\Windows\System\wODCQdG.exe
  C:\Windows\System\wODCQdG.exe
  2⤵
  PID:8084
- C:\Windows\System\OtwDfcy.exe
  C:\Windows\System\OtwDfcy.exe
  2⤵
  PID:8104
- C:\Windows\System\xrHaOff.exe
  C:\Windows\System\xrHaOff.exe
  2⤵
  PID:8124
- C:\Windows\System\jyZCqcX.exe
  C:\Windows\System\jyZCqcX.exe
  2⤵
  PID:8144
- C:\Windows\System\UmXLSqg.exe
  C:\Windows\System\UmXLSqg.exe
  2⤵
  PID:8168
- C:\Windows\System\snVHJkU.exe
  C:\Windows\System\snVHJkU.exe
  2⤵
  PID:4788
- C:\Windows\System\jJvWMfk.exe
  C:\Windows\System\jJvWMfk.exe
  2⤵
  PID:4000
- C:\Windows\System\MFFacIB.exe
  C:\Windows\System\MFFacIB.exe
  2⤵
  PID:6188
- C:\Windows\System\CzocqJz.exe
  C:\Windows\System\CzocqJz.exe
  2⤵
  PID:7028
- C:\Windows\System\SecFgJR.exe
  C:\Windows\System\SecFgJR.exe
  2⤵
  PID:6024
- C:\Windows\System\PxwZUgj.exe
  C:\Windows\System\PxwZUgj.exe
  2⤵
  PID:7148
- C:\Windows\System\fGcaNNx.exe
  C:\Windows\System\fGcaNNx.exe
  2⤵
  PID:6484
- C:\Windows\System\PKpRYPo.exe
  C:\Windows\System\PKpRYPo.exe
  2⤵
  PID:6704
- C:\Windows\System\hwTABMA.exe
  C:\Windows\System\hwTABMA.exe
  2⤵
  PID:7180
- C:\Windows\System\rzmuNKD.exe
  C:\Windows\System\rzmuNKD.exe
  2⤵
  PID:7244
- C:\Windows\System\nIkRouL.exe
  C:\Windows\System\nIkRouL.exe
  2⤵
  PID:7308
- C:\Windows\System\uBXWwOC.exe
  C:\Windows\System\uBXWwOC.exe
  2⤵
  PID:7368
- C:\Windows\System\ETFdbaL.exe
  C:\Windows\System\ETFdbaL.exe
  2⤵
  PID:7392
- C:\Windows\System\YWchjkg.exe
  C:\Windows\System\YWchjkg.exe
  2⤵
  PID:6248
- C:\Windows\System\CZIpwnm.exe
  C:\Windows\System\CZIpwnm.exe
  2⤵
  PID:1144
- C:\Windows\System\xeuFNNr.exe
  C:\Windows\System\xeuFNNr.exe
  2⤵
  PID:7608
- C:\Windows\System\aKGJPBq.exe
  C:\Windows\System\aKGJPBq.exe
  2⤵
  PID:6672
- C:\Windows\System\UeMHbZV.exe
  C:\Windows\System\UeMHbZV.exe
  2⤵
  PID:7120
- C:\Windows\System\qvCugEH.exe
  C:\Windows\System\qvCugEH.exe
  2⤵
  PID:7756
- C:\Windows\System\FAObfFl.exe
  C:\Windows\System\FAObfFl.exe
  2⤵
  PID:7784
- C:\Windows\System\HvUZLEO.exe
  C:\Windows\System\HvUZLEO.exe
  2⤵
  PID:7876
- C:\Windows\System\TdsbitR.exe
  C:\Windows\System\TdsbitR.exe
  2⤵
  PID:7968
- C:\Windows\System\keJwpNl.exe
  C:\Windows\System\keJwpNl.exe
  2⤵
  PID:3632
- C:\Windows\System\GprzIpk.exe
  C:\Windows\System\GprzIpk.exe
  2⤵
  PID:8004
- C:\Windows\System\HiJSiLI.exe
  C:\Windows\System\HiJSiLI.exe
  2⤵
  PID:8064
- C:\Windows\System\NwGhHDW.exe
  C:\Windows\System\NwGhHDW.exe
  2⤵
  PID:8216
- C:\Windows\System\RhQbdSB.exe
  C:\Windows\System\RhQbdSB.exe
  2⤵
  PID:8240
- C:\Windows\System\YJDGGdn.exe
  C:\Windows\System\YJDGGdn.exe
  2⤵
  PID:8264
- C:\Windows\System\tMIZtvt.exe
  C:\Windows\System\tMIZtvt.exe
  2⤵
  PID:8284
- C:\Windows\System\wOXabcv.exe
  C:\Windows\System\wOXabcv.exe
  2⤵
  PID:8312
- C:\Windows\System\bOjvdAe.exe
  C:\Windows\System\bOjvdAe.exe
  2⤵
  PID:8332
- C:\Windows\System\eqAUMog.exe
  C:\Windows\System\eqAUMog.exe
  2⤵
  PID:8348
- C:\Windows\System\LMUkIeV.exe
  C:\Windows\System\LMUkIeV.exe
  2⤵
  PID:8364
- C:\Windows\System\tjJYXLQ.exe
  C:\Windows\System\tjJYXLQ.exe
  2⤵
  PID:8384
- C:\Windows\System\FwGhThd.exe
  C:\Windows\System\FwGhThd.exe
  2⤵
  PID:8412
- C:\Windows\System\AHvYGEM.exe
  C:\Windows\System\AHvYGEM.exe
  2⤵
  PID:8436
- C:\Windows\System\KDuRsqs.exe
  C:\Windows\System\KDuRsqs.exe
  2⤵
  PID:8456
- C:\Windows\System\IeXUEhN.exe
  C:\Windows\System\IeXUEhN.exe
  2⤵
  PID:8476
- C:\Windows\System\lcOfjhT.exe
  C:\Windows\System\lcOfjhT.exe
  2⤵
  PID:8504
- C:\Windows\System\bNLPkhb.exe
  C:\Windows\System\bNLPkhb.exe
  2⤵
  PID:8524
- C:\Windows\System\idVkVug.exe
  C:\Windows\System\idVkVug.exe
  2⤵
  PID:8544
- C:\Windows\System\HvoqFeo.exe
  C:\Windows\System\HvoqFeo.exe
  2⤵
  PID:8576
- C:\Windows\System\dgYZVUU.exe
  C:\Windows\System\dgYZVUU.exe
  2⤵
  PID:8596
- C:\Windows\System\xuddkia.exe
  C:\Windows\System\xuddkia.exe
  2⤵
  PID:8620
- C:\Windows\System\bbdqXsz.exe
  C:\Windows\System\bbdqXsz.exe
  2⤵
  PID:8640
- C:\Windows\System\vPIaWRM.exe
  C:\Windows\System\vPIaWRM.exe
  2⤵
  PID:8664
- C:\Windows\System\sEMBAnO.exe
  C:\Windows\System\sEMBAnO.exe
  2⤵
  PID:8696
- C:\Windows\System\pgGpjuK.exe
  C:\Windows\System\pgGpjuK.exe
  2⤵
  PID:8716
- C:\Windows\System\dVnBxwS.exe
  C:\Windows\System\dVnBxwS.exe
  2⤵
  PID:8736
- C:\Windows\System\TniuSRe.exe
  C:\Windows\System\TniuSRe.exe
  2⤵
  PID:8760
- C:\Windows\System\WxTOsJE.exe
  C:\Windows\System\WxTOsJE.exe
  2⤵
  PID:8788
- C:\Windows\System\BeCuroq.exe
  C:\Windows\System\BeCuroq.exe
  2⤵
  PID:8812
- C:\Windows\System\AFVlnFM.exe
  C:\Windows\System\AFVlnFM.exe
  2⤵
  PID:8832
- C:\Windows\System\gpdechw.exe
  C:\Windows\System\gpdechw.exe
  2⤵
  PID:8852
- C:\Windows\System\rmysqWX.exe
  C:\Windows\System\rmysqWX.exe
  2⤵
  PID:8876
- C:\Windows\System\QZYMRFS.exe
  C:\Windows\System\QZYMRFS.exe
  2⤵
  PID:8900
- C:\Windows\System\tcqINPb.exe
  C:\Windows\System\tcqINPb.exe
  2⤵
  PID:8920
- C:\Windows\System\utELaVf.exe
  C:\Windows\System\utELaVf.exe
  2⤵
  PID:8940
- C:\Windows\System\mozpTGJ.exe
  C:\Windows\System\mozpTGJ.exe
  2⤵
  PID:8968
- C:\Windows\System\PCEgMhu.exe
  C:\Windows\System\PCEgMhu.exe
  2⤵
  PID:8988
- C:\Windows\System\ALZLzcP.exe
  C:\Windows\System\ALZLzcP.exe
  2⤵
  PID:9012
- C:\Windows\System\EwGyScn.exe
  C:\Windows\System\EwGyScn.exe
  2⤵
  PID:9032
- C:\Windows\System\KQPNiRT.exe
  C:\Windows\System\KQPNiRT.exe
  2⤵
  PID:9060
- C:\Windows\System\NDkdDFT.exe
  C:\Windows\System\NDkdDFT.exe
  2⤵
  PID:9080
- C:\Windows\System\bPGlWjV.exe
  C:\Windows\System\bPGlWjV.exe
  2⤵
  PID:9108
- C:\Windows\System\Fcphwkh.exe
  C:\Windows\System\Fcphwkh.exe
  2⤵
  PID:9124
- C:\Windows\System\zjWlAsc.exe
  C:\Windows\System\zjWlAsc.exe
  2⤵
  PID:9152
- C:\Windows\System\zQnazQq.exe
  C:\Windows\System\zQnazQq.exe
  2⤵
  PID:9176
- C:\Windows\System\ywuOZDf.exe
  C:\Windows\System\ywuOZDf.exe
  2⤵
  PID:9196
- C:\Windows\System\CXIjZPN.exe
  C:\Windows\System\CXIjZPN.exe
  2⤵
  PID:8132
- C:\Windows\System\MelVddb.exe
  C:\Windows\System\MelVddb.exe
  2⤵
  PID:8164
- C:\Windows\System\gnknbvi.exe
  C:\Windows\System\gnknbvi.exe
  2⤵
  PID:6288
- C:\Windows\System\uyPRRGE.exe
  C:\Windows\System\uyPRRGE.exe
  2⤵
  PID:7568
- C:\Windows\System\kwstjdQ.exe
  C:\Windows\System\kwstjdQ.exe
  2⤵
  PID:7712
- C:\Windows\System\DrGxzoW.exe
  C:\Windows\System\DrGxzoW.exe
  2⤵
  PID:3412
- C:\Windows\System\mKyKuSl.exe
  C:\Windows\System\mKyKuSl.exe
  2⤵
  PID:6780
- C:\Windows\System\gpdVhFS.exe
  C:\Windows\System\gpdVhFS.exe
  2⤵
  PID:7812
- C:\Windows\System\gfxhQDK.exe
  C:\Windows\System\gfxhQDK.exe
  2⤵
  PID:7856
- C:\Windows\System\VcctATr.exe
  C:\Windows\System\VcctATr.exe
  2⤵
  PID:7904
- C:\Windows\System\wszctsC.exe
  C:\Windows\System\wszctsC.exe
  2⤵
  PID:6892
- C:\Windows\System\vmGTWOg.exe
  C:\Windows\System\vmGTWOg.exe
  2⤵
  PID:8236
- C:\Windows\System\mKgNcWp.exe
  C:\Windows\System\mKgNcWp.exe
  2⤵
  PID:7580
- C:\Windows\System\ZCRZQfd.exe
  C:\Windows\System\ZCRZQfd.exe
  2⤵
  PID:1524
- C:\Windows\System\goJwiZQ.exe
  C:\Windows\System\goJwiZQ.exe
  2⤵
  PID:8484
- C:\Windows\System\pneDKfE.exe
  C:\Windows\System\pneDKfE.exe
  2⤵
  PID:8512
- C:\Windows\System\keFsmZf.exe
  C:\Windows\System\keFsmZf.exe
  2⤵
  PID:8564
- C:\Windows\System\kynjIIs.exe
  C:\Windows\System\kynjIIs.exe
  2⤵
  PID:7356
- C:\Windows\System\iYCpGLb.exe
  C:\Windows\System\iYCpGLb.exe
  2⤵
  PID:6152
- C:\Windows\System\DJRpqwN.exe
  C:\Windows\System\DJRpqwN.exe
  2⤵
  PID:7564
- C:\Windows\System\uuZyRWl.exe
  C:\Windows\System\uuZyRWl.exe
  2⤵
  PID:9232
- C:\Windows\System\tiylYhJ.exe
  C:\Windows\System\tiylYhJ.exe
  2⤵
  PID:9256
- C:\Windows\System\ibdnGoC.exe
  C:\Windows\System\ibdnGoC.exe
  2⤵
  PID:9272
- C:\Windows\System\LRoUyzK.exe
  C:\Windows\System\LRoUyzK.exe
  2⤵
  PID:9296
- C:\Windows\System\CPEMXDF.exe
  C:\Windows\System\CPEMXDF.exe
  2⤵
  PID:9316
- C:\Windows\System\vYtGbua.exe
  C:\Windows\System\vYtGbua.exe
  2⤵
  PID:9348
- C:\Windows\System\hgCHIkp.exe
  C:\Windows\System\hgCHIkp.exe
  2⤵
  PID:9380
- C:\Windows\System\AqjhtgB.exe
  C:\Windows\System\AqjhtgB.exe
  2⤵
  PID:9404
- C:\Windows\System\iUgmEeg.exe
  C:\Windows\System\iUgmEeg.exe
  2⤵
  PID:9424
- C:\Windows\System\aEQSana.exe
  C:\Windows\System\aEQSana.exe
  2⤵
  PID:9448
- C:\Windows\System\zoOXNIL.exe
  C:\Windows\System\zoOXNIL.exe
  2⤵
  PID:9472
- C:\Windows\System\weFzrfg.exe
  C:\Windows\System\weFzrfg.exe
  2⤵
  PID:9492
- C:\Windows\System\nPjaWcS.exe
  C:\Windows\System\nPjaWcS.exe
  2⤵
  PID:9516
- C:\Windows\System\emxpXEF.exe
  C:\Windows\System\emxpXEF.exe
  2⤵
  PID:9544
- C:\Windows\System\chRNBVU.exe
  C:\Windows\System\chRNBVU.exe
  2⤵
  PID:9572
- C:\Windows\System\MDUOkJR.exe
  C:\Windows\System\MDUOkJR.exe
  2⤵
  PID:9592
- C:\Windows\System\mLBeleb.exe
  C:\Windows\System\mLBeleb.exe
  2⤵
  PID:9612
- C:\Windows\System\FlUYuWP.exe
  C:\Windows\System\FlUYuWP.exe
  2⤵
  PID:9636
- C:\Windows\System\ZtmIOVD.exe
  C:\Windows\System\ZtmIOVD.exe
  2⤵
  PID:9656
- C:\Windows\System\qAkCqnG.exe
  C:\Windows\System\qAkCqnG.exe
  2⤵
  PID:9680
- C:\Windows\System\BhSECuk.exe
  C:\Windows\System\BhSECuk.exe
  2⤵
  PID:9708
- C:\Windows\System\oQISrtc.exe
  C:\Windows\System\oQISrtc.exe
  2⤵
  PID:9724
- C:\Windows\System\PrTSWXT.exe
  C:\Windows\System\PrTSWXT.exe
  2⤵
  PID:9744
- C:\Windows\System\hgyWowP.exe
  C:\Windows\System\hgyWowP.exe
  2⤵
  PID:9764
- C:\Windows\System\pHLmjdR.exe
  C:\Windows\System\pHLmjdR.exe
  2⤵
  PID:9788
- C:\Windows\System\bBfXruW.exe
  C:\Windows\System\bBfXruW.exe
  2⤵
  PID:9816
- C:\Windows\System\ZGEXgdd.exe
  C:\Windows\System\ZGEXgdd.exe
  2⤵
  PID:9836
- C:\Windows\System\dWsUluE.exe
  C:\Windows\System\dWsUluE.exe
  2⤵
  PID:9864
- C:\Windows\System\CIpTCda.exe
  C:\Windows\System\CIpTCda.exe
  2⤵
  PID:9888
- C:\Windows\System\uUeiRPR.exe
  C:\Windows\System\uUeiRPR.exe
  2⤵
  PID:9912
- C:\Windows\System\RrGtUKR.exe
  C:\Windows\System\RrGtUKR.exe
  2⤵
  PID:9936
- C:\Windows\System\aUebdFe.exe
  C:\Windows\System\aUebdFe.exe
  2⤵
  PID:9956
- C:\Windows\System\NKKoWNL.exe
  C:\Windows\System\NKKoWNL.exe
  2⤵
  PID:9980
- C:\Windows\System\ixsXbJl.exe
  C:\Windows\System\ixsXbJl.exe
  2⤵
  PID:10004
- C:\Windows\System\lRQnxTY.exe
  C:\Windows\System\lRQnxTY.exe
  2⤵
  PID:10024
- C:\Windows\System\mORVJsD.exe
  C:\Windows\System\mORVJsD.exe
  2⤵
  PID:10052
- C:\Windows\System\RLoipJD.exe
  C:\Windows\System\RLoipJD.exe
  2⤵
  PID:10072
- C:\Windows\System\cnSmyww.exe
  C:\Windows\System\cnSmyww.exe
  2⤵
  PID:10096
- C:\Windows\System\vFyCuji.exe
  C:\Windows\System\vFyCuji.exe
  2⤵
  PID:10124
- C:\Windows\System\gkesvjU.exe
  C:\Windows\System\gkesvjU.exe
  2⤵
  PID:10148
- C:\Windows\System\tjuOVCr.exe
  C:\Windows\System\tjuOVCr.exe
  2⤵
  PID:10168
- C:\Windows\System\uslDyVT.exe
  C:\Windows\System\uslDyVT.exe
  2⤵
  PID:10196
- C:\Windows\System\rdzJEsn.exe
  C:\Windows\System\rdzJEsn.exe
  2⤵
  PID:10216
- C:\Windows\System\LJKlEKs.exe
  C:\Windows\System\LJKlEKs.exe
  2⤵
  PID:10236
- C:\Windows\System\sfXwguq.exe
  C:\Windows\System\sfXwguq.exe
  2⤵
  PID:6636
- C:\Windows\System\MTOtFHr.exe
  C:\Windows\System\MTOtFHr.exe
  2⤵
  PID:8804
- C:\Windows\System\uixlFnH.exe
  C:\Windows\System\uixlFnH.exe
  2⤵
  PID:7420
- C:\Windows\System\ZkFsaKy.exe
  C:\Windows\System\ZkFsaKy.exe
  2⤵
  PID:8828
- C:\Windows\System\EMlxZGz.exe
  C:\Windows\System\EMlxZGz.exe
  2⤵
  PID:8052
- C:\Windows\System\owVjRCV.exe
  C:\Windows\System\owVjRCV.exe
  2⤵
  PID:8252
- C:\Windows\System\ZgsEwxp.exe
  C:\Windows\System\ZgsEwxp.exe
  2⤵
  PID:8300
- C:\Windows\System\jBOAllG.exe
  C:\Windows\System\jBOAllG.exe
  2⤵
  PID:8340
- C:\Windows\System\tVEhveY.exe
  C:\Windows\System\tVEhveY.exe
  2⤵
  PID:8392
- C:\Windows\System\ODTnsBx.exe
  C:\Windows\System\ODTnsBx.exe
  2⤵
  PID:9188
- C:\Windows\System\gYxjvLY.exe
  C:\Windows\System\gYxjvLY.exe
  2⤵
  PID:3512
- C:\Windows\System\jHymSmn.exe
  C:\Windows\System\jHymSmn.exe
  2⤵
  PID:8496
- C:\Windows\System\zsDEGpK.exe
  C:\Windows\System\zsDEGpK.exe
  2⤵
  PID:7232
- C:\Windows\System\lKhTzal.exe
  C:\Windows\System\lKhTzal.exe
  2⤵
  PID:8560
- C:\Windows\System\pIrXBkU.exe
  C:\Windows\System\pIrXBkU.exe
  2⤵
  PID:8424
- C:\Windows\System\ApJwIJB.exe
  C:\Windows\System\ApJwIJB.exe
  2⤵
  PID:7516
- C:\Windows\System\ycgIQVR.exe
  C:\Windows\System\ycgIQVR.exe
  2⤵
  PID:7192
- C:\Windows\System\GGzQYMk.exe
  C:\Windows\System\GGzQYMk.exe
  2⤵
  PID:8604
- C:\Windows\System\XGIBjIN.exe
  C:\Windows\System\XGIBjIN.exe
  2⤵
  PID:8728
- C:\Windows\System\icFBMLt.exe
  C:\Windows\System\icFBMLt.exe
  2⤵
  PID:9268
- C:\Windows\System\iXDXjOh.exe
  C:\Windows\System\iXDXjOh.exe
  2⤵
  PID:8800
- C:\Windows\System\lNRKpJZ.exe
  C:\Windows\System\lNRKpJZ.exe
  2⤵
  PID:8872
- C:\Windows\System\jsQFstC.exe
  C:\Windows\System\jsQFstC.exe
  2⤵
  PID:9440
- C:\Windows\System\uXSilba.exe
  C:\Windows\System\uXSilba.exe
  2⤵
  PID:8212
- C:\Windows\System\VYCWcyH.exe
  C:\Windows\System\VYCWcyH.exe
  2⤵
  PID:10248
- C:\Windows\System\unkzKyo.exe
  C:\Windows\System\unkzKyo.exe
  2⤵
  PID:10288
- C:\Windows\System\WHJemVR.exe
  C:\Windows\System\WHJemVR.exe
  2⤵
  PID:10308
- C:\Windows\System\NBZKWIe.exe
  C:\Windows\System\NBZKWIe.exe
  2⤵
  PID:10328
- C:\Windows\System\idLRlIq.exe
  C:\Windows\System\idLRlIq.exe
  2⤵
  PID:10348
- C:\Windows\System\QRwSTev.exe
  C:\Windows\System\QRwSTev.exe
  2⤵
  PID:10372
- C:\Windows\System\MdJyAqo.exe
  C:\Windows\System\MdJyAqo.exe
  2⤵
  PID:10400
- C:\Windows\System\kgGQCfr.exe
  C:\Windows\System\kgGQCfr.exe
  2⤵
  PID:10420
- C:\Windows\System\OKcevTT.exe
  C:\Windows\System\OKcevTT.exe
  2⤵
  PID:10440
- C:\Windows\System\tEUzktX.exe
  C:\Windows\System\tEUzktX.exe
  2⤵
  PID:10464
- C:\Windows\System\GEpDbqy.exe
  C:\Windows\System\GEpDbqy.exe
  2⤵
  PID:10488
- C:\Windows\System\MNjeQGU.exe
  C:\Windows\System\MNjeQGU.exe
  2⤵
  PID:10508
- C:\Windows\System\nnPOqgT.exe
  C:\Windows\System\nnPOqgT.exe
  2⤵
  PID:10532
- C:\Windows\System\OZOOpoW.exe
  C:\Windows\System\OZOOpoW.exe
  2⤵
  PID:10556
- C:\Windows\System\itKAIqC.exe
  C:\Windows\System\itKAIqC.exe
  2⤵
  PID:10584
- C:\Windows\System\fHYcDvJ.exe
  C:\Windows\System\fHYcDvJ.exe
  2⤵
  PID:10604
- C:\Windows\System\wguBoTo.exe
  C:\Windows\System\wguBoTo.exe
  2⤵
  PID:10628
- C:\Windows\System\TzLIlQz.exe
  C:\Windows\System\TzLIlQz.exe
  2⤵
  PID:10656
- C:\Windows\System\VAerrfD.exe
  C:\Windows\System\VAerrfD.exe
  2⤵
  PID:10680
- C:\Windows\System\EeoUFPR.exe
  C:\Windows\System\EeoUFPR.exe
  2⤵
  PID:10700
- C:\Windows\System\NyUXJIh.exe
  C:\Windows\System\NyUXJIh.exe
  2⤵
  PID:10724
- C:\Windows\System\xqsjyXx.exe
  C:\Windows\System\xqsjyXx.exe
  2⤵
  PID:10748
- C:\Windows\System\kGOCiRu.exe
  C:\Windows\System\kGOCiRu.exe
  2⤵
  PID:10776
- C:\Windows\System\PtcvySH.exe
  C:\Windows\System\PtcvySH.exe
  2⤵
  PID:10796
- C:\Windows\System\YuDGGRk.exe
  C:\Windows\System\YuDGGRk.exe
  2⤵
  PID:10824
- C:\Windows\System\sjAZNKA.exe
  C:\Windows\System\sjAZNKA.exe
  2⤵
  PID:10844
- C:\Windows\System\WMiVXMH.exe
  C:\Windows\System\WMiVXMH.exe
  2⤵
  PID:10860
- C:\Windows\System\CHKoQmW.exe
  C:\Windows\System\CHKoQmW.exe
  2⤵
  PID:10880
- C:\Windows\System\qkoSjaM.exe
  C:\Windows\System\qkoSjaM.exe
  2⤵
  PID:10896
- C:\Windows\System\aXaMaEt.exe
  C:\Windows\System\aXaMaEt.exe
  2⤵
  PID:10912
- C:\Windows\System\xEYPaCT.exe
  C:\Windows\System\xEYPaCT.exe
  2⤵
  PID:10928
- C:\Windows\System\GEZWOBL.exe
  C:\Windows\System\GEZWOBL.exe
  2⤵
  PID:10944
- C:\Windows\System\OUTiOeC.exe
  C:\Windows\System\OUTiOeC.exe
  2⤵
  PID:10972
- C:\Windows\System\RhEHbtu.exe
  C:\Windows\System\RhEHbtu.exe
  2⤵
  PID:10992
- C:\Windows\System\dyGikis.exe
  C:\Windows\System\dyGikis.exe
  2⤵
  PID:11012
- C:\Windows\System\fMigAaA.exe
  C:\Windows\System\fMigAaA.exe
  2⤵
  PID:11032
- C:\Windows\System\AejrGTc.exe
  C:\Windows\System\AejrGTc.exe
  2⤵
  PID:11060
- C:\Windows\System\jHuJbiC.exe
  C:\Windows\System\jHuJbiC.exe
  2⤵
  PID:11084
- C:\Windows\System\NWliqLp.exe
  C:\Windows\System\NWliqLp.exe
  2⤵
  PID:9588
- C:\Windows\System\hEYARMu.exe
  C:\Windows\System\hEYARMu.exe
  2⤵
  PID:9648
- C:\Windows\System\YdPwaSe.exe
  C:\Windows\System\YdPwaSe.exe
  2⤵
  PID:9740
- C:\Windows\System\GzHrzzp.exe
  C:\Windows\System\GzHrzzp.exe
  2⤵
  PID:10564
- C:\Windows\System\hPMyBQA.exe
  C:\Windows\System\hPMyBQA.exe
  2⤵
  PID:9132
- C:\Windows\System\KSwQYAB.exe
  C:\Windows\System\KSwQYAB.exe
  2⤵
  PID:9204
- C:\Windows\System\zwKuMyU.exe
  C:\Windows\System\zwKuMyU.exe
  2⤵
  PID:10692
- C:\Windows\System\BPttJAM.exe
  C:\Windows\System\BPttJAM.exe
  2⤵
  PID:10720
- C:\Windows\System\qtCODxu.exe
  C:\Windows\System\qtCODxu.exe
  2⤵
  PID:10924
- C:\Windows\System\UDhukMl.exe
  C:\Windows\System\UDhukMl.exe
  2⤵
  PID:11080
- C:\Windows\System\OidcBpZ.exe
  C:\Windows\System\OidcBpZ.exe
  2⤵
  PID:9240
- C:\Windows\System\qzqihSN.exe
  C:\Windows\System\qzqihSN.exe
  2⤵
  PID:9324
- C:\Windows\System\taAhDFm.exe
  C:\Windows\System\taAhDFm.exe
  2⤵
  PID:9456
- C:\Windows\System\RDyCTfE.exe
  C:\Windows\System\RDyCTfE.exe
  2⤵
  PID:9584
- C:\Windows\System\PFuMNqZ.exe
  C:\Windows\System\PFuMNqZ.exe
  2⤵
  PID:9720
- C:\Windows\System\dQnxgNe.exe
  C:\Windows\System\dQnxgNe.exe
  2⤵
  PID:9800
- C:\Windows\System\hQZmFkl.exe
  C:\Windows\System\hQZmFkl.exe
  2⤵
  PID:11100
- C:\Windows\System\sNGtoMC.exe
  C:\Windows\System\sNGtoMC.exe
  2⤵
  PID:10300
- C:\Windows\System\BlRTKdG.exe
  C:\Windows\System\BlRTKdG.exe
  2⤵
  PID:10920
- C:\Windows\System\TiQeQSC.exe
  C:\Windows\System\TiQeQSC.exe
  2⤵
  PID:11024
- C:\Windows\System\ByvtDSX.exe
  C:\Windows\System\ByvtDSX.exe
  2⤵
  PID:10768
- C:\Windows\System\bMoWudx.exe
  C:\Windows\System\bMoWudx.exe
  2⤵
  PID:10908
- C:\Windows\System\gZxRqxw.exe
  C:\Windows\System\gZxRqxw.exe
  2⤵
  PID:11288
- C:\Windows\System\lrybZIR.exe
  C:\Windows\System\lrybZIR.exe
  2⤵
  PID:11308
- C:\Windows\System\DqhLZMU.exe
  C:\Windows\System\DqhLZMU.exe
  2⤵
  PID:11332
- C:\Windows\System\icqjIEq.exe
  C:\Windows\System\icqjIEq.exe
  2⤵
  PID:11352
- C:\Windows\System\sOuCtxs.exe
  C:\Windows\System\sOuCtxs.exe
  2⤵
  PID:11368
- C:\Windows\System\MVZaNIH.exe
  C:\Windows\System\MVZaNIH.exe
  2⤵
  PID:11388
- C:\Windows\System\WlqEvOV.exe
  C:\Windows\System\WlqEvOV.exe
  2⤵
  PID:11412
- C:\Windows\System\YDGZkyK.exe
  C:\Windows\System\YDGZkyK.exe
  2⤵
  PID:11436
- C:\Windows\System\YmSlygh.exe
  C:\Windows\System\YmSlygh.exe
  2⤵
  PID:11452
- C:\Windows\System\KpOtAFf.exe
  C:\Windows\System\KpOtAFf.exe
  2⤵
  PID:11468
- C:\Windows\System\HaYXcdD.exe
  C:\Windows\System\HaYXcdD.exe
  2⤵
  PID:11484
- C:\Windows\System\kIsUjgz.exe
  C:\Windows\System\kIsUjgz.exe
  2⤵
  PID:11500
- C:\Windows\System\CvnKeeg.exe
  C:\Windows\System\CvnKeeg.exe
  2⤵
  PID:11520
- C:\Windows\System\nHzjJcQ.exe
  C:\Windows\System\nHzjJcQ.exe
  2⤵
  PID:11536
- C:\Windows\System\lUafdaa.exe
  C:\Windows\System\lUafdaa.exe
  2⤵
  PID:11560
- C:\Windows\System\PTVKgZo.exe
  C:\Windows\System\PTVKgZo.exe
  2⤵
  PID:11584
- C:\Windows\System\TAQczsE.exe
  C:\Windows\System\TAQczsE.exe
  2⤵
  PID:11604
- C:\Windows\System\QLCELzk.exe
  C:\Windows\System\QLCELzk.exe
  2⤵
  PID:11636
- C:\Windows\System\rISdXBO.exe
  C:\Windows\System\rISdXBO.exe
  2⤵
  PID:11660
- C:\Windows\System\jsGmraA.exe
  C:\Windows\System\jsGmraA.exe
  2⤵
  PID:11684
- C:\Windows\System\wKAiZwr.exe
  C:\Windows\System\wKAiZwr.exe
  2⤵
  PID:11720
- C:\Windows\System\YnxAJuY.exe
  C:\Windows\System\YnxAJuY.exe
  2⤵
  PID:11784
- C:\Windows\System\AfyerQv.exe
  C:\Windows\System\AfyerQv.exe
  2⤵
  PID:11808
- C:\Windows\System\ippzCcc.exe
  C:\Windows\System\ippzCcc.exe
  2⤵
  PID:11828
- C:\Windows\System\txFWsgC.exe
  C:\Windows\System\txFWsgC.exe
  2⤵
  PID:11856
- C:\Windows\System\YindGoz.exe
  C:\Windows\System\YindGoz.exe
  2⤵
  PID:11880
- C:\Windows\System\JqDaMeA.exe
  C:\Windows\System\JqDaMeA.exe
  2⤵
  PID:11904
- C:\Windows\System\pbSVKja.exe
  C:\Windows\System\pbSVKja.exe
  2⤵
  PID:11928
- C:\Windows\System\biexxCt.exe
  C:\Windows\System\biexxCt.exe
  2⤵
  PID:11952
- C:\Windows\System\sdzquEh.exe
  C:\Windows\System\sdzquEh.exe
  2⤵
  PID:11976
- C:\Windows\System\kLgIcNd.exe
  C:\Windows\System\kLgIcNd.exe
  2⤵
  PID:12004
- C:\Windows\System\FmJOQJr.exe
  C:\Windows\System\FmJOQJr.exe
  2⤵
  PID:12024
- C:\Windows\System\xBGdhOT.exe
  C:\Windows\System\xBGdhOT.exe
  2⤵
  PID:12056
- C:\Windows\System\rAGsTEc.exe
  C:\Windows\System\rAGsTEc.exe
  2⤵
  PID:12088
- C:\Windows\System\gwMddcP.exe
  C:\Windows\System\gwMddcP.exe
  2⤵
  PID:12108
- C:\Windows\System\aPvzixb.exe
  C:\Windows\System\aPvzixb.exe
  2⤵
  PID:12128
- C:\Windows\System\okEkWfd.exe
  C:\Windows\System\okEkWfd.exe
  2⤵
  PID:12148
- C:\Windows\System\rMhOEwf.exe
  C:\Windows\System\rMhOEwf.exe
  2⤵
  PID:12164
- C:\Windows\System\htUWQdW.exe
  C:\Windows\System\htUWQdW.exe
  2⤵
  PID:12200
- C:\Windows\System\GFpBWcu.exe
  C:\Windows\System\GFpBWcu.exe
  2⤵
  PID:12216
- C:\Windows\System\CRsWsqW.exe
  C:\Windows\System\CRsWsqW.exe
  2⤵
  PID:12232
- C:\Windows\System\zgoSWvA.exe
  C:\Windows\System\zgoSWvA.exe
  2⤵
  PID:12248
- C:\Windows\System\CkwXwoU.exe
  C:\Windows\System\CkwXwoU.exe
  2⤵
  PID:11028
- C:\Windows\System\zYbWxPG.exe
  C:\Windows\System\zYbWxPG.exe
  2⤵
  PID:10212
- C:\Windows\System\wtxMmpP.exe
  C:\Windows\System\wtxMmpP.exe
  2⤵
  PID:8028
- C:\Windows\System\bzzxwVw.exe
  C:\Windows\System\bzzxwVw.exe
  2⤵
  PID:8184
- C:\Windows\System\kzwGXol.exe
  C:\Windows\System\kzwGXol.exe
  2⤵
  PID:7896
- C:\Windows\System\HJmRzMe.exe
  C:\Windows\System\HJmRzMe.exe
  2⤵
  PID:10272
- C:\Windows\System\UZnkgfL.exe
  C:\Windows\System\UZnkgfL.exe
  2⤵
  PID:10388
- C:\Windows\System\HcbawvK.exe
  C:\Windows\System\HcbawvK.exe
  2⤵
  PID:10472
- C:\Windows\System\NHEKufp.exe
  C:\Windows\System\NHEKufp.exe
  2⤵
  PID:8780
- C:\Windows\System\BnCUVAX.exe
  C:\Windows\System\BnCUVAX.exe
  2⤵
  PID:11076
- C:\Windows\System\cUTOxoa.exe
  C:\Windows\System\cUTOxoa.exe
  2⤵
  PID:8708
- C:\Windows\System\liZuHoD.exe
  C:\Windows\System\liZuHoD.exe
  2⤵
  PID:10672
- C:\Windows\System\irxeqwE.exe
  C:\Windows\System\irxeqwE.exe
  2⤵
  PID:10760
- C:\Windows\System\eghQYva.exe
  C:\Windows\System\eghQYva.exe
  2⤵
  PID:10804
- C:\Windows\System\KeYlMBB.exe
  C:\Windows\System\KeYlMBB.exe
  2⤵
  PID:10892
- C:\Windows\System\WlHVMwW.exe
  C:\Windows\System\WlHVMwW.exe
  2⤵
  PID:12312
- C:\Windows\System\UVyPiuM.exe
  C:\Windows\System\UVyPiuM.exe
  2⤵
  PID:12340
- C:\Windows\System\APZMTzj.exe
  C:\Windows\System\APZMTzj.exe
  2⤵
  PID:12360
- C:\Windows\System\QMPtKuQ.exe
  C:\Windows\System\QMPtKuQ.exe
  2⤵
  PID:12380
- C:\Windows\System\LPkxtHe.exe
  C:\Windows\System\LPkxtHe.exe
  2⤵
  PID:12404
- C:\Windows\System\TsHIVDc.exe
  C:\Windows\System\TsHIVDc.exe
  2⤵
  PID:12424
- C:\Windows\System\zPHoIto.exe
  C:\Windows\System\zPHoIto.exe
  2⤵
  PID:12440
- C:\Windows\System\RyrNKmc.exe
  C:\Windows\System\RyrNKmc.exe
  2⤵
  PID:12460
- C:\Windows\System\rqhSgLg.exe
  C:\Windows\System\rqhSgLg.exe
  2⤵
  PID:12484
- C:\Windows\System\JPnjUpI.exe
  C:\Windows\System\JPnjUpI.exe
  2⤵
  PID:12504
- C:\Windows\System\SLnrRVy.exe
  C:\Windows\System\SLnrRVy.exe
  2⤵
  PID:12524
- C:\Windows\System\gasOYop.exe
  C:\Windows\System\gasOYop.exe
  2⤵
  PID:12552
- C:\Windows\System\oQrlhkV.exe
  C:\Windows\System\oQrlhkV.exe
  2⤵
  PID:12576
- C:\Windows\System\UVRVvHV.exe
  C:\Windows\System\UVRVvHV.exe
  2⤵
  PID:12600
- C:\Windows\System\BqbcCvq.exe
  C:\Windows\System\BqbcCvq.exe
  2⤵
  PID:12620
- C:\Windows\System\BvAvgWC.exe
  C:\Windows\System\BvAvgWC.exe
  2⤵
  PID:12640
- C:\Windows\System\BoBPaNz.exe
  C:\Windows\System\BoBPaNz.exe
  2⤵
  PID:12668
- C:\Windows\System\SfiBdTA.exe
  C:\Windows\System\SfiBdTA.exe
  2⤵
  PID:12692
- C:\Windows\System\ECEgeJx.exe
  C:\Windows\System\ECEgeJx.exe
  2⤵
  PID:12720
- C:\Windows\System\WncJXSk.exe
  C:\Windows\System\WncJXSk.exe
  2⤵
  PID:12748
- C:\Windows\System\fNNNUBW.exe
  C:\Windows\System\fNNNUBW.exe
  2⤵
  PID:12768
- C:\Windows\System\cDtKUXT.exe
  C:\Windows\System\cDtKUXT.exe
  2⤵
  PID:12792
- C:\Windows\System\ZyzQYCN.exe
  C:\Windows\System\ZyzQYCN.exe
  2⤵
  PID:12816
- C:\Windows\System\GUcLlCs.exe
  C:\Windows\System\GUcLlCs.exe
  2⤵
  PID:12832
- C:\Windows\System\vHfsHpy.exe
  C:\Windows\System\vHfsHpy.exe
  2⤵
  PID:12848
- C:\Windows\System\Fwdnnvg.exe
  C:\Windows\System\Fwdnnvg.exe
  2⤵
  PID:12868
- C:\Windows\System\VQuLSOP.exe
  C:\Windows\System\VQuLSOP.exe
  2⤵
  PID:12884
- C:\Windows\System\MivVNFi.exe
  C:\Windows\System\MivVNFi.exe
  2⤵
  PID:12900
- C:\Windows\System\YWwoJtn.exe
  C:\Windows\System\YWwoJtn.exe
  2⤵
  PID:12920
- C:\Windows\System\ctkNhdL.exe
  C:\Windows\System\ctkNhdL.exe
  2⤵
  PID:12936
- C:\Windows\System\iAuyfiO.exe
  C:\Windows\System\iAuyfiO.exe
  2⤵
  PID:12952
- C:\Windows\System\KMBGryK.exe
  C:\Windows\System\KMBGryK.exe
  2⤵
  PID:12968
- C:\Windows\System\nLPPCdx.exe
  C:\Windows\System\nLPPCdx.exe
  2⤵
  PID:12984
- C:\Windows\System\BrkgnuI.exe
  C:\Windows\System\BrkgnuI.exe
  2⤵
  PID:13000
- C:\Windows\System\HKFKYcN.exe
  C:\Windows\System\HKFKYcN.exe
  2⤵
  PID:13020
- C:\Windows\System\jjHSCiW.exe
  C:\Windows\System\jjHSCiW.exe
  2⤵
  PID:13048
- C:\Windows\System\PEhzvQP.exe
  C:\Windows\System\PEhzvQP.exe
  2⤵
  PID:13068
- C:\Windows\System\CMgzHPC.exe
  C:\Windows\System\CMgzHPC.exe
  2⤵
  PID:13096
- C:\Windows\System\qOQJRVS.exe
  C:\Windows\System\qOQJRVS.exe
  2⤵
  PID:13120
- C:\Windows\System\obQlrkU.exe
  C:\Windows\System\obQlrkU.exe
  2⤵
  PID:13140
- C:\Windows\System\BiDjbrv.exe
  C:\Windows\System\BiDjbrv.exe
  2⤵
  PID:13160
- C:\Windows\System\eYDvLIW.exe
  C:\Windows\System\eYDvLIW.exe
  2⤵
  PID:13176
- C:\Windows\System\KZTfwOm.exe
  C:\Windows\System\KZTfwOm.exe
  2⤵
  PID:13196
- C:\Windows\System\GtKhows.exe
  C:\Windows\System\GtKhows.exe
  2⤵
  PID:13220
- C:\Windows\System\pXySuRV.exe
  C:\Windows\System\pXySuRV.exe
  2⤵
  PID:13260
- C:\Windows\System\wWjIUIj.exe
  C:\Windows\System\wWjIUIj.exe
  2⤵
  PID:13284
- C:\Windows\System\PSkflPG.exe
  C:\Windows\System\PSkflPG.exe
  2⤵
  PID:13304
- C:\Windows\System\qtAiLzG.exe
  C:\Windows\System\qtAiLzG.exe
  2⤵
  PID:11276
- C:\Windows\System\ljYVclF.exe
  C:\Windows\System\ljYVclF.exe
  2⤵
  PID:10984
- C:\Windows\System\qViJnPa.exe
  C:\Windows\System\qViJnPa.exe
  2⤵
  PID:11380
- C:\Windows\System\qvcXMqb.exe
  C:\Windows\System\qvcXMqb.exe
  2⤵
  PID:11432
- C:\Windows\System\xYoOtoz.exe
  C:\Windows\System\xYoOtoz.exe
  2⤵
  PID:11492
- C:\Windows\System\noTBrVN.exe
  C:\Windows\System\noTBrVN.exe
  2⤵
  PID:11528
- C:\Windows\System\TwKZAJh.exe
  C:\Windows\System\TwKZAJh.exe
  2⤵
  PID:11600
- C:\Windows\System\CrsnSLR.exe
  C:\Windows\System\CrsnSLR.exe
  2⤵
  PID:11648
- C:\Windows\System\sqDEAmn.exe
  C:\Windows\System\sqDEAmn.exe
  2⤵
  PID:6200
- C:\Windows\System\CLfmulA.exe
  C:\Windows\System\CLfmulA.exe
  2⤵
  PID:8844
- C:\Windows\System\HNpXCcC.exe
  C:\Windows\System\HNpXCcC.exe
  2⤵
  PID:11800
- C:\Windows\System\jmtgZsW.exe
  C:\Windows\System\jmtgZsW.exe
  2⤵
  PID:11868
- C:\Windows\System\PJrrwrP.exe
  C:\Windows\System\PJrrwrP.exe
  2⤵
  PID:11948
- C:\Windows\System\mCPjNFy.exe
  C:\Windows\System\mCPjNFy.exe
  2⤵
  PID:12096
- C:\Windows\System\YloDgHe.exe
  C:\Windows\System\YloDgHe.exe
  2⤵
  PID:10816
- C:\Windows\System\ixQuihW.exe
  C:\Windows\System\ixQuihW.exe
  2⤵
  PID:10304
- C:\Windows\System\TsPwDfT.exe
  C:\Windows\System\TsPwDfT.exe
  2⤵
  PID:12240
- C:\Windows\System\AkQtfjN.exe
  C:\Windows\System\AkQtfjN.exe
  2⤵
  PID:12256
- C:\Windows\System\pFnJHrh.exe
  C:\Windows\System\pFnJHrh.exe
  2⤵
  PID:10208
- C:\Windows\System\VgtXAek.exe
  C:\Windows\System\VgtXAek.exe
  2⤵
  PID:10652
- C:\Windows\System\UxraFCI.exe
  C:\Windows\System\UxraFCI.exe
  2⤵
  PID:10568
- C:\Windows\System\prgBTOP.exe
  C:\Windows\System\prgBTOP.exe
  2⤵
  PID:8912
- C:\Windows\System\ysFJmtW.exe
  C:\Windows\System\ysFJmtW.exe
  2⤵
  PID:9224
- C:\Windows\System\SzSDwbY.exe
  C:\Windows\System\SzSDwbY.exe
  2⤵
  PID:8468
- C:\Windows\System\BMQuHld.exe
  C:\Windows\System\BMQuHld.exe
  2⤵
  PID:10228
- C:\Windows\System\hoZNtfD.exe
  C:\Windows\System\hoZNtfD.exe
  2⤵
  PID:10092
- C:\Windows\System\SpwdDYd.exe
  C:\Windows\System\SpwdDYd.exe
  2⤵
  PID:10364
- C:\Windows\System\DAxWUZh.exe
  C:\Windows\System\DAxWUZh.exe
  2⤵
  PID:10460
- C:\Windows\System\dgzBSgC.exe
  C:\Windows\System\dgzBSgC.exe
  2⤵
  PID:10264
- C:\Windows\System\nnsZxSv.exe
  C:\Windows\System\nnsZxSv.exe
  2⤵
  PID:10888
- C:\Windows\System\yvlRWcw.exe
  C:\Windows\System\yvlRWcw.exe
  2⤵
  PID:9336
- C:\Windows\System\SFsdtJF.exe
  C:\Windows\System\SFsdtJF.exe
  2⤵
  PID:9976
- C:\Windows\System\hdGpzKA.exe
  C:\Windows\System\hdGpzKA.exe
  2⤵
  PID:10840
- C:\Windows\System\NQFdsAb.exe
  C:\Windows\System\NQFdsAb.exe
  2⤵
  PID:11420
- C:\Windows\System\ztcYzIS.exe
  C:\Windows\System\ztcYzIS.exe
  2⤵
  PID:11544
- C:\Windows\System\hZuSsiw.exe
  C:\Windows\System\hZuSsiw.exe
  2⤵
  PID:12564
- C:\Windows\System\PUyzglf.exe
  C:\Windows\System\PUyzglf.exe
  2⤵
  PID:12592
- C:\Windows\System\SsDbiUC.exe
  C:\Windows\System\SsDbiUC.exe
  2⤵
  PID:7524
- C:\Windows\System\ADWJrAX.exe
  C:\Windows\System\ADWJrAX.exe
  2⤵
  PID:11820
- C:\Windows\System\VBdXWSt.exe
  C:\Windows\System\VBdXWSt.exe
  2⤵
  PID:12732
- C:\Windows\System\rJoTQHU.exe
  C:\Windows\System\rJoTQHU.exe
  2⤵
  PID:12780
- C:\Windows\System\KGpgugw.exe
  C:\Windows\System\KGpgugw.exe
  2⤵
  PID:11968
- C:\Windows\System\vIsmTXj.exe
  C:\Windows\System\vIsmTXj.exe
  2⤵
  PID:12908
- C:\Windows\System\fJzXvml.exe
  C:\Windows\System\fJzXvml.exe
  2⤵
  PID:12964
- C:\Windows\System\JcboQHQ.exe
  C:\Windows\System\JcboQHQ.exe
  2⤵
  PID:12020
- C:\Windows\System\zCeuxfn.exe
  C:\Windows\System\zCeuxfn.exe
  2⤵
  PID:12124
- C:\Windows\System\QhonHOi.exe
  C:\Windows\System\QhonHOi.exe
  2⤵
  PID:13328
- C:\Windows\System\VXrUhzM.exe
  C:\Windows\System\VXrUhzM.exe
  2⤵
  PID:13348
- C:\Windows\System\nIxjHLO.exe
  C:\Windows\System\nIxjHLO.exe
  2⤵
  PID:13364
- C:\Windows\System\rbdlUOP.exe
  C:\Windows\System\rbdlUOP.exe
  2⤵
  PID:13380
- C:\Windows\System\kTdKznC.exe
  C:\Windows\System\kTdKznC.exe
  2⤵
  PID:13396
- C:\Windows\System\jQiDRBX.exe
  C:\Windows\System\jQiDRBX.exe
  2⤵
  PID:13412
- C:\Windows\System\LPSTevX.exe
  C:\Windows\System\LPSTevX.exe
  2⤵
  PID:13428
- C:\Windows\System\xCmhNhn.exe
  C:\Windows\System\xCmhNhn.exe
  2⤵
  PID:13448
- C:\Windows\System\RThkeFz.exe
  C:\Windows\System\RThkeFz.exe
  2⤵
  PID:13468
- C:\Windows\System\SNihbEn.exe
  C:\Windows\System\SNihbEn.exe
  2⤵
  PID:13484
- C:\Windows\System\hhpSSYq.exe
  C:\Windows\System\hhpSSYq.exe
  2⤵
  PID:13500
- C:\Windows\System\bzWNaHG.exe
  C:\Windows\System\bzWNaHG.exe
  2⤵
  PID:13516
- C:\Windows\System\mQOTvPS.exe
  C:\Windows\System\mQOTvPS.exe
  2⤵
  PID:13536
- C:\Windows\System\XhRuZjR.exe
  C:\Windows\System\XhRuZjR.exe
  2⤵
  PID:13560
- C:\Windows\System\lgmChSO.exe
  C:\Windows\System\lgmChSO.exe
  2⤵
  PID:13584
- C:\Windows\System\VJXrJks.exe
  C:\Windows\System\VJXrJks.exe
  2⤵
  PID:13612
- C:\Windows\System\xtAmhrs.exe
  C:\Windows\System\xtAmhrs.exe
  2⤵
  PID:13640
- C:\Windows\System\mDrGMgz.exe
  C:\Windows\System\mDrGMgz.exe
  2⤵
  PID:13660
- C:\Windows\System\lsMLaSH.exe
  C:\Windows\System\lsMLaSH.exe
  2⤵
  PID:13680
- C:\Windows\System\nplklKn.exe
  C:\Windows\System\nplklKn.exe
  2⤵
  PID:13700
- C:\Windows\System\MbXNHsR.exe
  C:\Windows\System\MbXNHsR.exe
  2⤵
  PID:13724
- C:\Windows\System\eIurexL.exe
  C:\Windows\System\eIurexL.exe
  2⤵
  PID:13748
- C:\Windows\System\qgBUDUu.exe
  C:\Windows\System\qgBUDUu.exe
  2⤵
  PID:13772
- C:\Windows\System\ZsfeKHg.exe
  C:\Windows\System\ZsfeKHg.exe
  2⤵
  PID:13796
- C:\Windows\System\XIJbwet.exe
  C:\Windows\System\XIJbwet.exe
  2⤵
  PID:13820
- C:\Windows\System\TaNiRjF.exe
  C:\Windows\System\TaNiRjF.exe
  2⤵
  PID:13844
- C:\Windows\System\DHPwZsV.exe
  C:\Windows\System\DHPwZsV.exe
  2⤵
  PID:13868
- C:\Windows\System\pwBVKcm.exe
  C:\Windows\System\pwBVKcm.exe
  2⤵
  PID:13892
- C:\Windows\System\oSSdLjA.exe
  C:\Windows\System\oSSdLjA.exe
  2⤵
  PID:13920
- C:\Windows\System\JWsknsv.exe
  C:\Windows\System\JWsknsv.exe
  2⤵
  PID:13940
- C:\Windows\System\SconGjf.exe
  C:\Windows\System\SconGjf.exe
  2⤵
  PID:13968
- C:\Windows\System\aCYBcQD.exe
  C:\Windows\System\aCYBcQD.exe
  2⤵
  PID:13992
- C:\Windows\System\TCAuNyL.exe
  C:\Windows\System\TCAuNyL.exe
  2⤵
  PID:14032
- C:\Windows\System\wSnOpdI.exe
  C:\Windows\System\wSnOpdI.exe
  2⤵
  PID:14052
- C:\Windows\System\CdEXYyX.exe
  C:\Windows\System\CdEXYyX.exe
  2⤵
  PID:14076

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.dual-a-0034.a-msedge.net

g-bing-com.dual-a-0034.a-msedge.net

IN CNAME

dual-a-0034.a-msedge.net

dual-a-0034.a-msedge.net

IN A

204.79.197.237

dual-a-0034.a-msedge.net

IN A

13.107.21.237
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid=

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=0DE99CC5C7E467EC22E58816C65F66D8; domain=.bing.com; expires=Sun, 31-Aug-2025 12:23:01 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A9675815D6FE4D3BAD166BADC371D019 Ref B: LON04EDGE0914 Ref C: 2024-08-06T12:23:01Z
date: Tue, 06 Aug 2024 12:23:00 GMT
GET

https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid=

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0DE99CC5C7E467EC22E58816C65F66D8

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=2oHRc__WTjNxx3Ky5bo4lBHW-nzI2nB7oZdBOB2OB3o; domain=.bing.com; expires=Sun, 31-Aug-2025 12:23:01 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A11A63D613F349A386E6352E3AC14C2E Ref B: LON04EDGE0914 Ref C: 2024-08-06T12:23:01Z
date: Tue, 06 Aug 2024 12:23:01 GMT
GET

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid=

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0DE99CC5C7E467EC22E58816C65F66D8; MSPTC=2oHRc__WTjNxx3Ky5bo4lBHW-nzI2nB7oZdBOB2OB3o

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FAB0A891A09B4ECE83AD3CA6015CABC2 Ref B: LON04EDGE0914 Ref C: 2024-08-06T12:23:01Z
date: Tue, 06 Aug 2024 12:23:01 GMT
DNS

17.53.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

17.53.126.40.in-addr.arpa

IN PTR

Response
DNS

237.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

237.197.79.204.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

26.35.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.35.223.20.in-addr.arpa

IN PTR

Response
DNS

183.59.114.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.59.114.20.in-addr.arpa

IN PTR

Response
DNS

18.31.95.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.31.95.13.in-addr.arpa

IN PTR

Response
DNS

73.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.190.18.2.in-addr.arpa

IN PTR

Response

73.190.18.2.in-addr.arpa

IN PTR

a2-18-190-73deploystaticakamaitechnologiescom
DNS

14.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.227.111.52.in-addr.arpa

IN PTR

Response

204.79.197.237:443

https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid=

tls, http2

2.0kB
9.3kB
22
19

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid=

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=dd0fbf11098c48f2900d816254745ade&localId=w:58F15D5C-450D-8348-2910-A8A47129F4C2&deviceId=6825833575955334&anid=

HTTP Response

204

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

g.bing.com

dns

56 B
151 B
1
1

DNS Request

g.bing.com

DNS Response

204.79.197.237

13.107.21.237
8.8.8.8:53

17.53.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

17.53.126.40.in-addr.arpa
8.8.8.8:53

237.197.79.204.in-addr.arpa

dns

73 B
143 B
1
1

DNS Request

237.197.79.204.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

26.35.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

26.35.223.20.in-addr.arpa
8.8.8.8:53

183.59.114.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

183.59.114.20.in-addr.arpa
8.8.8.8:53

18.31.95.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

18.31.95.13.in-addr.arpa
8.8.8.8:53

73.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

73.190.18.2.in-addr.arpa
8.8.8.8:53

14.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.227.111.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AFPkksq.exe

Filesize
1.7MB

MD5
d4b0f4a8fbe34b11e604d7e51b20de0c

SHA1
9b4fddf9d6ce4a42fd93f856257d01ac4befb362

SHA256
c71b0e3355997f530eb0f7a8fa0895abd9bc362a41148d3e97b66d00e23e41f4

SHA512
208cb48cddcb050c2230c10f886ffd63456c6401999b0038f8a36719f139ad9c76e4b2b9590886d0990f4e61418bd6b7d770ecb6a7872c153253540cfa8702eb

Download Submit
C:\Windows\System\BwtyFpR.exe

Filesize
1.7MB

MD5
9d18813eb4314c77204a1a79829782d4

SHA1
f55d12be0843f8630f90f51ba9366384d4df9377

SHA256
80a4d5559893b4289ae43894b64b9b67470ac6f0d203382fee2a144e8644af44

SHA512
e99649e46f89aa71754a1e141a0352f44584d3062efbdb54780cb0e491760794ddd8dd1dd5c02dfeede672c665b67dcdc4f3cc384f92addb3fcb901b3d2b3d7e

Download Submit
C:\Windows\System\DVNcIxe.exe

Filesize
1.7MB

MD5
924a138a7e112e64f2945cdd58053036

SHA1
81d08cb179ded415c21b06a91db2c5c5f04454d2

SHA256
592cd492c3201432660989c7dcff6372d56f0b798e037df74f7e0d42c43ae3d1

SHA512
f99b212a1b1cfc5eb657238b7771c5d33c0dbcdfffac41d5b8a233a4099cd41fca4faf1a24039491ecce4d63cc8e63145554323b53f6c7e3405384053cf7a7ae

Download Submit
C:\Windows\System\DbQEACC.exe

Filesize
1.7MB

MD5
b52ad7ec0396b3553a259699079cd212

SHA1
3c031d8f3dba05ecfcc977c58d4a426220351b63

SHA256
09f7a6b6501528c47e8455832517b046d8e0bd8a5c34e6112950b2d7bb340f38

SHA512
fe1b2ba78924e451a2984b8dd9fdd5361349305b2e185679a057a9b7c9e955559b1b6bfe0fc985b5c017a920ff194ade011204c7ce2c643c2d24135e94ee4ec9

Download Submit
C:\Windows\System\HKNrlBf.exe

Filesize
1.7MB

MD5
6685cfd814be9e5ed824281eea0be091

SHA1
85caaac49bfccd7a83ef4ccfbec1fe0c39b0fbb2

SHA256
2939baa7fe02519d5d3a77054fd240521c394bcc5a2e2f536ea1c205a36f0b30

SHA512
5e0baecbb249296dd013264f43f0a3e2793f640bf3daaba63c678a6faaf3d0f01e1cc19b63a7bab2379b30968fc043caa23c628db0e72dfaf05202644009f17e

Download Submit
C:\Windows\System\HpzVxyy.exe

Filesize
1.7MB

MD5
d6ecaecd6c1e52d516d7c7320ac33d40

SHA1
2ca85932aaf7ef9a1be7cc847751ae900a0be78b

SHA256
78beba1aaf4a8a1e65a6f7570550fc4538c542da7294152169844c521924107b

SHA512
34270cee63b5250d935f412d06ff53a4a542d365e794e0f80977702f99c1195662f996497ab9b3bd5b49e7e8b12f22425d48a1d5874d1432850d9b91b60984ed

Download Submit
C:\Windows\System\HqNzijv.exe

Filesize
1.7MB

MD5
611523d2221677106f995970ee6fffbf

SHA1
c6d8fbe75004f2b18500cba8ba84468c3bb58684

SHA256
31da537d768a18adc19665894bbd6c367868dd16c3f26e096bb73ae534685b52

SHA512
a3ebadada55c5151c381c6e7cb214cd143d8f7752ffe374ccf5147c715f1eccf2f61fae43ebac85b4d03fb18eb9022957b61bb1a92415cd99a1a0a5bffc91552

Download Submit
C:\Windows\System\KDzGqEl.exe

Filesize
1.7MB

MD5
5390f859bc304869ff557f3e8b3a5a89

SHA1
f92295510b88865143bd757a9c059a4c1bb3ed5b

SHA256
f0cd9de89517b7be44ccf1d21be4358bebb5d4a849cee5fbcd8e999363de697a

SHA512
23c1d56be33f870712871b9b3b943a9e001d95078fdf1113f3c788d39727110c443e4ab6e2bdf69a55aca531b8d509b4abcc0d7b610db501c67e0f5005b93ca3

Download Submit
C:\Windows\System\LfIXbza.exe

Filesize
1.7MB

MD5
368f63ad58079a7383d71ea55db2e993

SHA1
c4a915ac5782c61aef8ec5df5334bd545341353e

SHA256
286ab56e823d93b902c115987e789f81b70ba07db377a7db4151565ead833216

SHA512
fbaf058ac711a2deeb55b30aba15b319021c4c9ecc0594482cf67e241fa727852e9a819b396f44d3760ef216051b5c473a2d9174f66587a9c37db691322380f5

Download Submit
C:\Windows\System\NBYPCtw.exe

Filesize
1.7MB

MD5
19b16edbc979f95d1a2eb64ff4424ea9

SHA1
5b3b0d9377184bf202ea6e8807b88c4d39c80fc4

SHA256
88ad3c3850f90aeb5da2d4006fd7f3107cabb4bec91e2391b440b11c205fb894

SHA512
497a11d9a59d422e557bf042d5179adecab595f482a4b7c9370108d303674d3198f1facc8ad00f33586ffbcd45ad7a3b299794dcde7d692da3bf6900067cd002

Download Submit
C:\Windows\System\NBsLUxO.exe

Filesize
1.7MB

MD5
43564ef508ccea8eb0b76120e74172ee

SHA1
0715b46e7fb0614c2908791e2d999d92ff430173

SHA256
eab40b100ed9f404a87886c695cc0db5953cb0a73bd0341011d05f3acc9d574a

SHA512
20a6e7f7944fc559ed13a1eb2933c04ec7ed0d280b1c808b2a130688279cff45c95b6ef1d5999a871e5b491a3ccebf3891be47b1e80afc984f7eaf5bd9a0c52a

Download Submit
C:\Windows\System\PbhCmmA.exe

Filesize
1.7MB

MD5
7bf3adc100658878eac953818e79be60

SHA1
4864034c69f88bccdca4b325dfa5b0814188224c

SHA256
897a4120087374c66994030fe2d4861254ca121e3bf2155b74615fd24c5ac456

SHA512
b85b8b3899a147be9ff582a0e2ba006310223fd17871af2856f0844bd77c2b34ce07ea9d73c3da8947e0c1ed9b9300d68ef44eddedbe1ae4748ea0736785c5d7

Download Submit
C:\Windows\System\RLpfusX.exe

Filesize
1.7MB

MD5
837a127dd8ac79c42d612f9401efc3ad

SHA1
d45c51c55dd77e0bfc581c1b9dabd500f8211546

SHA256
fadc57fe39fcedf211851afe8595c9ca534cbc23888826a5a015b4cec00a53da

SHA512
a0b0c0b868017b0d87cd10e6b299d66137ee0a0e9f483da877b8ccf53b42ed7d4598c306c21199395efd5a85367ec2643c38c46a24f6b99876805d31c458fef4

Download Submit
C:\Windows\System\RWhxstH.exe

Filesize
1.7MB

MD5
43a10d0e4456101f4eba90272b409951

SHA1
b405cc159e8a0744f94c3a6faa3df89585a6ba3a

SHA256
49ee7bfa2796543ce4bf3d5ed91ec00804159b039baba28847fa66f1fdbee8e7

SHA512
a554e0c1c824dde615ce948ab8eb16353d25cd886168f400434e6ccf4622ee224519244c0982d4ca9378c11c0cd195d6890dd0b472c75185365b7695d18b0425

Download Submit
C:\Windows\System\SDQNhhL.exe

Filesize
1.7MB

MD5
512293766846c89440564ca45007053e

SHA1
5606ed5e174eeea2bab89dd9ec9d8015de6165c9

SHA256
58a80a1039c2a18b7366a6f40479e7ddd4f6fc90dec792687442662e4be98b38

SHA512
14078c5295fe09779752e656bc39a5c094c72dec614d877c157ab2cbc3f865ec61a0cc3deab6ee02871f38b15def3f25d4dfa2df24fbaadb448ece0c9d1b13bb

Download Submit
C:\Windows\System\SjajjWl.exe

Filesize
1.7MB

MD5
5d288e37c0c8ba7e28164953e9dda636

SHA1
3381e256ea9ab2234e9a895a2b558aa623952f74

SHA256
221ba441e52c099212087a26b63183846fcf35f976effea0523b75b9d87cef4b

SHA512
b862cffa49bade559cae58e5f47b618b572e3541c7bc6292c53a6d810e82c0f8788a4dd2c0e45747ad2f6f78f49c9ec6d2291cefa8d0bb799b9270e668a8f5ee

Download Submit
C:\Windows\System\YNBihKv.exe

Filesize
1.7MB

MD5
6457966b09240bdb7e580a8c47b70584

SHA1
1494eea828a70de15a4dbf2f21df4c84b7b5da90

SHA256
e0ba66eba596c131ee5071cc0232b2afa6010eb889ffb217e379a15de2bea5da

SHA512
0386d931db8da4ad115ecd75a0a0cc0fd4a268b56d45ce49d0ac13206c04e5311b615f7484bd01534b0cbfde40ae9d1aa0927836274ac19251f114f2146451d4

Download Submit
C:\Windows\System\ZOULQfw.exe

Filesize
1.7MB

MD5
cc55011acb72042da02c2058c93bfc1a

SHA1
89e4fcf7a12eef8dc08d4052082975233e5bea39

SHA256
5996dcec554cf59ce284ffe439f19283f1fdfc77a57839653db1dc322800b3c7

SHA512
8a909ca331075588f416ca02d22beda53520c55c5c889a680497192ac296c07bee6880d7b97bb3cd8a87b790d5d1b2078c8d665861fee9d83d15ad9403865ca9

Download Submit
C:\Windows\System\dIsBToc.exe

Filesize
1.7MB

MD5
d76ad430aa827bba5d2124e934d88c5a

SHA1
2056c824d560b4ed3e07a7dd3433cd4fabc64aa6

SHA256
506e196c6eb3f9b0b524b83a7097d0fba0678050cf319cf6b6e7f662e7385199

SHA512
d7256f97a3b8ccdf34554f28d78ab1893f4556e6d3abd13c26a1c754007255003d418bc5127a2d01ae85779aad5da1d1cbc9b9eef0e45fe3b1e34a939cbb4310

Download Submit
C:\Windows\System\dVWXXHF.exe

Filesize
1.7MB

MD5
3d967c19a5d5b7e798313ed911f9cec4

SHA1
32b53599e3d934ee19372051011d5b2bdd8b01d6

SHA256
01b430316383326711804ee3952fbf754aa1b08583df2ca8f679393905e6e3c6

SHA512
111137f53bc0a19b881f4d3e1c038fc9d4035f4e38d799335a544e87f5d6e93577a70c4007838257f656eb914ac73ddef80ddaa39e7439ea84438271d05097d5

Download Submit
C:\Windows\System\dXRXImf.exe

Filesize
1.7MB

MD5
b77f5ffac2c1b94a6f9a87cc30bfacf6

SHA1
75b26a398f48d19ef55485a6d9dd75312f7dfac2

SHA256
8bcfd26bd48eb8728e5e172667df6a926ecbcb88a346e96a0a90d22dedba6a0b

SHA512
a92bffdc6f5ea54e7afd831049f84c14144ca4c351f542aaddd051cc0530029e9a45c995be7629e47972fe1512473b2fb6564b871a58f6d16d20fbde92be5907

Download Submit
C:\Windows\System\eGaGxJT.exe

Filesize
1.7MB

MD5
37dfd99507de3843143893aec20107c2

SHA1
18806f25f314ec988e8337acf388aa29b898de35

SHA256
d559ad69b644e3eeb9abff32a9f1007d32aeb0bd5bd6483a62787ca3e6437249

SHA512
096e01cf5afb8f126be14603774f7fa4f5c3a2b19651e71835b199ec14c9ecadb27340c7df74e6aa124a54b9739fbe5ff20c38de4174e490a092553dbd92a145

Download Submit
C:\Windows\System\ghXiSwn.exe

Filesize
1.7MB

MD5
6b5294712687e9aa6da329391e5005ed

SHA1
8d6565a57635ecae75fd43864bbbedd5fef43256

SHA256
cd92184e8373f2276ddd508b077fbbeb2f91c914b2d47c67f1157fff9e99c260

SHA512
386787e26e1d419109da99a2c8be8a6fcee760bf48a1a063d3806de0e3b9549ef17152863e61129a1373968668cd2f7538cf4958df09ad11d9b8a4e1d595e74e

Download Submit
C:\Windows\System\hLzjziI.exe

Filesize
1.7MB

MD5
615829472ab55f67a652ed1b5aa248f7

SHA1
150e93fef744a82350109bcdf01ba09d0c073ed3

SHA256
75d86c22baeb5543e6f8b7ee5663a205d2aefe6089010de916abf51a699833e4

SHA512
31b4e607353fa189d9b315f25ab77089f77020ca30b24cd5802720e1bb8499b9c032ee53d2c5faf269aff4f47e37f1e1e319a4283b74678820b7e3681dd4faf0

Download Submit
C:\Windows\System\inGqXhx.exe

Filesize
1.7MB

MD5
a76ad0d625734544536584fa99e4c2d9

SHA1
867e90ddc408a877c0ea55833c8faf14a4157ec1

SHA256
e474c2449cf208d01ddaa949aa40922d79b305a0400d76081fa0fe89f554462c

SHA512
1d3e61549eecf7425d874f79ec392829ac81e3e024d2f321404186ece29f14c3bcc9aec94f7c483220b2aa05c559f2a76416277a0195fa8fb2b25258b1013a8d

Download Submit
C:\Windows\System\pPmaGdA.exe

Filesize
1.7MB

MD5
dc952395e5ddd9334e71afe58ddb5fc8

SHA1
bd2d68674e8580fe9c05b167026580a07d6290ee

SHA256
8f072a7eb155099b7740aabf52c23501cf78c491715a3a87e522c5b839bec80e

SHA512
5b3ba4065c97e1ef3bbe16385ef9812cb7cbe01e1d7e8ad2ec56b7243dfe6da7a3382d5b0da5a7d437bb17cc474e523c8760c1a77ec231d693ffe987e3b76069

Download Submit
C:\Windows\System\pyaAuvC.exe

Filesize
1.7MB

MD5
1b3b47682e4519ba305d2016201a2775

SHA1
e4283a60824b22816b55b8cd6c0a096529e61d54

SHA256
ff7b16230f5019436c658ed12ce8e8c9e753a3e21c3536a52de345b5a3dfd806

SHA512
14c831a3910b10182053238161e0b0fe028fe618a4d3475994c0ec30114fa8d195c694f88f2fa7be73ca4ddd85a3fee22f9f07660cc9f0244cbf5157719cf9ec

Download Submit
C:\Windows\System\qMpFSTQ.exe

Filesize
1.7MB

MD5
ac49e1fceb1448fb02042b64c7cda3b5

SHA1
40b5fdb3700cc89aff6398b8bae3b37ee7a2c9bc

SHA256
ce6c9f14ad6000471a8684bfd01009322d5659900c3716f66540096114185f62

SHA512
822f13bd9be295c49d2bd03cd2e87e94f85f8ac21e592368f7b1e4022c7bed9cecff9cd20393a78b278a48437f846c38619e68b14201449678c12d48cf79c773

Download Submit
C:\Windows\System\qfFXgaZ.exe

Filesize
1.7MB

MD5
4604dc05ccd9311f49fc8f7d72e3ad20

SHA1
9437834711708645b3c08b43ffc94b42d4e03561

SHA256
7b9375026bb6eb7f64d1cd7bf7b2372a989c28703fee36a21237a4da53ff38ff

SHA512
782aba5d9036eb139ef154c448c3d7584430685eeb3d1ecb2ac45399741895aca765d7045cad627dd662e5f8efcffda691be64a0d1924d44a52460b99ad14be2

Download Submit
C:\Windows\System\sEquGLn.exe

Filesize
1.7MB

MD5
db15282a4d9c714d94483a73fa8af38c

SHA1
64895ff86360dcb9a9e75f39a45378cb8b048dc0

SHA256
ab2958c49ccf0d1f07318257a7a4d336b3dd76207b0dc5f96643ba21e208c7c3

SHA512
fda34f6dabd0725fde0f2d77a608c40f21292138bbe6e65b564f4bfaca939725a01ad7d229f7124220e9a65e7c55b2646ef60d3de1f318ba9df600c90e01f995

Download Submit
C:\Windows\System\tAMWAoQ.exe

Filesize
1.7MB

MD5
24dff8a642ebbad6110c0ca62fbf937f

SHA1
2001a0fe735394a9b6ae8bc74513fa49ee5ff994

SHA256
d57fde14b20bf3ecd374eab054fc25248ccb0423b8126f67cd62b1ddc4bc6cab

SHA512
e42a9f1fc173c6f014ebb64c8c3b7937e4bd21346ba41a33ffb0fc83ea59006620d60e380da28fb0188b3d775326a10aa889fb47ab02fceda7326aff2eb66e1a

Download Submit
C:\Windows\System\tOwhfXS.exe

Filesize
1.7MB

MD5
4eaacec1bfe446dd5211a2ee0c6b865d

SHA1
60ad948240ac21f82c71f303186f3828b93020d1

SHA256
d2915c24a73f40d52900519ac7344cdec892f4f13b1adb1846156a789a527e85

SHA512
5a36f091f5e0f97a39c76510b2193f5496e605bd834183fa10c95cfcdfc977839710ec149af84efac23d2b91881f276404a7802f2ac804843eb5ea1c86664b37

Download Submit
C:\Windows\System\yGVTfzX.exe

Filesize
1.7MB

MD5
562c6bca40b393d3af3b876fa657469f

SHA1
8e0aba3ae0238cda03d57f2e5fe2e31f66679160

SHA256
515164490a6c167cfd7a3ca50e0e8130cc6dd3d4ad7598f9017f720dba8fcd66

SHA512
e37555982cda066e3cc2d16d243e61ec85effa2c7ab75436f041a530d81cc7cc222243d2e55aa0f61ae29439474d12142082028106b950d126e90d242e1b590f

Download Submit
C:\Windows\System\yarUfhq.exe

Filesize
1.7MB

MD5
32f2291b8ebae09f8559f8bdbcc5f600

SHA1
af184fcd88504501e478b2abb8aa4e8cb9c76fbd

SHA256
a9259d3f6b92aaab7d25ea5442290ec56f3a751edb631fc870c57ac0200d6687

SHA512
1f898c1f36a6566d08143eb98df1826292fea012ea6cbfe33fc0f1fcd10e4e8914b240cd3956d7c284c223612aef0da61448ec33dd9644d08fed931ca8237257

Download Submit
C:\Windows\System\zvwdaHe.exe

Filesize
1.7MB

MD5
a21cd8ee95739ee87909c7ac19c22906

SHA1
478b377303f54890edd8ea1a50ac09544b03c5d5

SHA256
9d383b937fca3ae8c1c7d8a2043b6dad6aa93ebe031691bc2944da6040db8400

SHA512
3caef71e75ffd8486f505e64241914e9f884b25594f3dc527980614a82286ee2e1f1b7c44a6d753fc3458c6b56004dfeb32e8bc9491c3bfe9e5509953f7f5326

Download Submit
memory/312-193-0x00007FF7A36D0000-0x00007FF7A3A21000-memory.dmp

Filesize
3.3MB

Download
memory/312-2334-0x00007FF7A36D0000-0x00007FF7A3A21000-memory.dmp

Filesize
3.3MB

Download
memory/700-354-0x00007FF7705F0000-0x00007FF770941000-memory.dmp

Filesize
3.3MB

Download
memory/700-2309-0x00007FF7705F0000-0x00007FF770941000-memory.dmp

Filesize
3.3MB

Download
memory/880-2321-0x00007FF71C330000-0x00007FF71C681000-memory.dmp

Filesize
3.3MB

Download
memory/880-112-0x00007FF71C330000-0x00007FF71C681000-memory.dmp

Filesize
3.3MB

Download
memory/968-26-0x00007FF65D840000-0x00007FF65DB91000-memory.dmp

Filesize
3.3MB

Download
memory/968-2304-0x00007FF65D840000-0x00007FF65DB91000-memory.dmp

Filesize
3.3MB

Download
memory/968-2257-0x00007FF65D840000-0x00007FF65DB91000-memory.dmp

Filesize
3.3MB

Download
memory/1532-155-0x00007FF609CA0000-0x00007FF609FF1000-memory.dmp

Filesize
3.3MB

Download
memory/1532-2317-0x00007FF609CA0000-0x00007FF609FF1000-memory.dmp

Filesize
3.3MB

Download
memory/1592-33-0x00007FF6C1130000-0x00007FF6C1481000-memory.dmp

Filesize
3.3MB

Download
memory/1592-2300-0x00007FF6C1130000-0x00007FF6C1481000-memory.dmp

Filesize
3.3MB

Download
memory/1592-2293-0x00007FF6C1130000-0x00007FF6C1481000-memory.dmp

Filesize
3.3MB

Download
memory/1704-2323-0x00007FF6222E0000-0x00007FF622631000-memory.dmp

Filesize
3.3MB

Download
memory/1704-108-0x00007FF6222E0000-0x00007FF622631000-memory.dmp

Filesize
3.3MB

Download
memory/1704-2260-0x00007FF6222E0000-0x00007FF622631000-memory.dmp

Filesize
3.3MB

Download
memory/1960-259-0x00007FF76B1F0000-0x00007FF76B541000-memory.dmp

Filesize
3.3MB

Download
memory/1960-2330-0x00007FF76B1F0000-0x00007FF76B541000-memory.dmp

Filesize
3.3MB

Download
memory/2184-227-0x00007FF63EED0000-0x00007FF63F221000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2340-0x00007FF63EED0000-0x00007FF63F221000-memory.dmp

Filesize
3.3MB

Download
memory/2240-2328-0x00007FF7AC660000-0x00007FF7AC9B1000-memory.dmp

Filesize
3.3MB

Download
memory/2240-258-0x00007FF7AC660000-0x00007FF7AC9B1000-memory.dmp

Filesize
3.3MB

Download
memory/2396-2375-0x00007FF67D9D0000-0x00007FF67DD21000-memory.dmp

Filesize
3.3MB

Download
memory/2396-252-0x00007FF67D9D0000-0x00007FF67DD21000-memory.dmp

Filesize
3.3MB

Download
memory/2580-47-0x00007FF785780000-0x00007FF785AD1000-memory.dmp

Filesize
3.3MB

Download
memory/2580-2306-0x00007FF785780000-0x00007FF785AD1000-memory.dmp

Filesize
3.3MB

Download
memory/2580-2258-0x00007FF785780000-0x00007FF785AD1000-memory.dmp

Filesize
3.3MB

Download
memory/2684-321-0x00007FF79E110000-0x00007FF79E461000-memory.dmp

Filesize
3.3MB

Download
memory/2684-2346-0x00007FF79E110000-0x00007FF79E461000-memory.dmp

Filesize
3.3MB

Download
memory/2788-355-0x00007FF719570000-0x00007FF7198C1000-memory.dmp

Filesize
3.3MB

Download
memory/2788-2347-0x00007FF719570000-0x00007FF7198C1000-memory.dmp

Filesize
3.3MB

Download
memory/2856-2326-0x00007FF63DBD0000-0x00007FF63DF21000-memory.dmp

Filesize
3.3MB

Download
memory/2856-352-0x00007FF63DBD0000-0x00007FF63DF21000-memory.dmp

Filesize
3.3MB

Download
memory/3088-2325-0x00007FF719D00000-0x00007FF71A051000-memory.dmp

Filesize
3.3MB

Download
memory/3088-2259-0x00007FF719D00000-0x00007FF71A051000-memory.dmp

Filesize
3.3MB

Download
memory/3088-76-0x00007FF719D00000-0x00007FF71A051000-memory.dmp

Filesize
3.3MB

Download
memory/3148-2319-0x00007FF6EEBB0000-0x00007FF6EEF01000-memory.dmp

Filesize
3.3MB

Download
memory/3148-160-0x00007FF6EEBB0000-0x00007FF6EEF01000-memory.dmp

Filesize
3.3MB

Download
memory/3648-2373-0x00007FF7650F0000-0x00007FF765441000-memory.dmp

Filesize
3.3MB

Download
memory/3648-317-0x00007FF7650F0000-0x00007FF765441000-memory.dmp

Filesize
3.3MB

Download
memory/3748-163-0x00007FF7881A0000-0x00007FF7884F1000-memory.dmp

Filesize
3.3MB

Download
memory/3748-2332-0x00007FF7881A0000-0x00007FF7884F1000-memory.dmp

Filesize
3.3MB

Download
memory/3840-2261-0x00007FF62CF40000-0x00007FF62D291000-memory.dmp

Filesize
3.3MB

Download
memory/3840-2311-0x00007FF62CF40000-0x00007FF62D291000-memory.dmp

Filesize
3.3MB

Download
memory/3840-133-0x00007FF62CF40000-0x00007FF62D291000-memory.dmp

Filesize
3.3MB

Download
memory/4184-2158-0x00007FF73D390000-0x00007FF73D6E1000-memory.dmp

Filesize
3.3MB

Download
memory/4184-0-0x00007FF73D390000-0x00007FF73D6E1000-memory.dmp

Filesize
3.3MB

Download
memory/4184-1-0x000001724B880000-0x000001724B890000-memory.dmp

Filesize
64KB

Download
memory/4272-322-0x00007FF76B070000-0x00007FF76B3C1000-memory.dmp

Filesize
3.3MB

Download
memory/4272-2341-0x00007FF76B070000-0x00007FF76B3C1000-memory.dmp

Filesize
3.3MB

Download
memory/4500-353-0x00007FF7C8210000-0x00007FF7C8561000-memory.dmp

Filesize
3.3MB

Download
memory/4500-2313-0x00007FF7C8210000-0x00007FF7C8561000-memory.dmp

Filesize
3.3MB

Download
memory/4696-211-0x00007FF7A5F70000-0x00007FF7A62C1000-memory.dmp

Filesize
3.3MB

Download
memory/4696-2372-0x00007FF7A5F70000-0x00007FF7A62C1000-memory.dmp

Filesize
3.3MB

Download
memory/4760-2296-0x00007FF79F620000-0x00007FF79F971000-memory.dmp

Filesize
3.3MB

Download
memory/4760-2256-0x00007FF79F620000-0x00007FF79F971000-memory.dmp

Filesize
3.3MB

Download
memory/4760-19-0x00007FF79F620000-0x00007FF79F971000-memory.dmp

Filesize
3.3MB

Download
memory/4800-2357-0x00007FF736E60000-0x00007FF7371B1000-memory.dmp

Filesize
3.3MB

Download
memory/4800-226-0x00007FF736E60000-0x00007FF7371B1000-memory.dmp

Filesize
3.3MB

Download
memory/4888-212-0x00007FF71E0B0000-0x00007FF71E401000-memory.dmp

Filesize
3.3MB

Download
memory/4888-2370-0x00007FF71E0B0000-0x00007FF71E401000-memory.dmp

Filesize
3.3MB

Download
memory/4984-2298-0x00007FF777E90000-0x00007FF7781E1000-memory.dmp

Filesize
3.3MB

Download
memory/4984-333-0x00007FF777E90000-0x00007FF7781E1000-memory.dmp

Filesize
3.3MB

Download
memory/5056-2315-0x00007FF6D4330000-0x00007FF6D4681000-memory.dmp

Filesize
3.3MB

Download
memory/5056-274-0x00007FF6D4330000-0x00007FF6D4681000-memory.dmp

Filesize
3.3MB

Download
memory/5084-2302-0x00007FF620CB0000-0x00007FF621001000-memory.dmp

Filesize
3.3MB

Download
memory/5084-335-0x00007FF620CB0000-0x00007FF621001000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.