xmrig | 6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
Size

1.0MB
MD5

6f4391c5c2eecbe598bd5e2335e4d56d
SHA1

e744135a242874cc1bdd92d1190e794f13b47802
SHA256

6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f
SHA512

cf2235bb8e3bd5fa303346bae91dce6d8d1e0a2dddaa98d1577e05df13f4d2b09b2a6e56cbf4cfb37dad9a3c062089c45b14ad2809dfbc015a4fc484edbcd19c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPUzrD:GezaTF8FcNkNdfE0pZ9ozttwIRRp3

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b01-3.dat	xmrig
behavioral2/files/0x000b000000023b5a-9.dat	xmrig
behavioral2/files/0x0032000000023b5d-8.dat	xmrig
behavioral2/files/0x000a000000023b5e-19.dat	xmrig
behavioral2/files/0x000a000000023b67-57.dat	xmrig
behavioral2/files/0x000a000000023b68-63.dat	xmrig
behavioral2/files/0x000a000000023b69-67.dat	xmrig
behavioral2/files/0x000a000000023b6c-85.dat	xmrig
behavioral2/files/0x000a000000023b6b-83.dat	xmrig
behavioral2/files/0x000a000000023b6a-81.dat	xmrig
behavioral2/files/0x000a000000023b66-55.dat	xmrig
behavioral2/files/0x000a000000023b65-53.dat	xmrig
behavioral2/files/0x000a000000023b64-45.dat	xmrig
behavioral2/files/0x000a000000023b63-40.dat	xmrig
behavioral2/files/0x000a000000023b62-35.dat	xmrig
behavioral2/files/0x000a000000023b61-30.dat	xmrig
behavioral2/files/0x000a000000023b6d-89.dat	xmrig
behavioral2/files/0x000a000000023b60-25.dat	xmrig
behavioral2/files/0x000d000000023a20-95.dat	xmrig
behavioral2/files/0x0032000000023b5b-101.dat	xmrig
behavioral2/files/0x000b000000023b6e-105.dat	xmrig
behavioral2/files/0x000a000000023b72-119.dat	xmrig
behavioral2/files/0x000a000000023b74-125.dat	xmrig
behavioral2/files/0x000a000000023b77-160.dat	xmrig
behavioral2/files/0x000a000000023b7d-166.dat	xmrig
behavioral2/files/0x000a000000023b79-163.dat	xmrig
behavioral2/files/0x000a000000023b7b-161.dat	xmrig
behavioral2/files/0x000a000000023b78-158.dat	xmrig
behavioral2/files/0x000a000000023b75-157.dat	xmrig
behavioral2/files/0x000a000000023b76-152.dat	xmrig
behavioral2/files/0x000a000000023b7a-151.dat	xmrig
behavioral2/files/0x000a000000023b73-145.dat	xmrig
behavioral2/files/0x000a000000023b71-137.dat	xmrig
behavioral2/files/0x000b000000023b70-113.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2664	IxkyDhB.exe
4024	ZQoIWQz.exe
3976	tgORJkR.exe
2008	UZINVwu.exe
3076	VyeGZLM.exe
348	pVDCSsy.exe
4036	blNdhCR.exe
3476	XGyymws.exe
1540	alJuIvR.exe
3796	DzKUxry.exe
4820	rCmbUzg.exe
780	CUglRmg.exe
1084	PJMBFHX.exe
4876	QfNINik.exe
1692	kXirsdR.exe
1316	vOVpmIQ.exe
4516	uMWkEVl.exe
5092	texIzAY.exe
2364	dxkyFIF.exe
2084	Vjwscrn.exe
3792	nktEtuq.exe
3728	bWQIsyu.exe
3724	oWBiJan.exe
1500	DXCeqeo.exe
692	diYJAla.exe
3956	xYPExyv.exe
856	AeDyGfx.exe
528	kEOdlJt.exe
5056	ywdtrKl.exe
4732	axzFJmj.exe
2200	ZLBadht.exe
3160	fFhcWSm.exe
3532	vyMSdWq.exe
4676	NGZFNOO.exe
2488	zaAqOuI.exe
2680	QiEyVKG.exe
4256	NIohmUQ.exe
3968	pCSVeVP.exe
4468	zvnqqKg.exe
2332	RnfOTTl.exe
3860	dTDPqCU.exe
4568	KYNLIsP.exe
3432	hQpBNFl.exe
4460	KyKSlKi.exe
4428	upvFjwC.exe
488	pjSTrQU.exe
4028	gdNqYhy.exe
1108	cpIcKvr.exe
4556	omsIKNm.exe
1128	YkidWAC.exe
3692	jjLaeWB.exe
412	gaTyBMQ.exe
1224	JiXQMYf.exe
2816	aXOtjwG.exe
1768	oWEzdyH.exe
1228	uWzNSxs.exe
4076	puZwjSj.exe
3176	rDFVqgm.exe
3872	OBqAvOd.exe
1928	DCEpVLL.exe
3024	gvTETzj.exe
4060	hQvXjSw.exe
2832	EoUkMlx.exe
4688	jnOHELr.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bWQIsyu.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\jnOHELr.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\HHLjbNQ.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\QkGnkgS.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\CMedlit.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\KFbyvwC.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\vXAgQRI.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\aNKMzJx.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\WGrxaSV.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\XGyymws.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\JwvAvtn.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\ZevkCTj.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\HcThNJZ.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\LshnJPL.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\KyrMNdW.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\ZxiLffb.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\WTpcCUs.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\RoLlJcY.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\tyRNWwy.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\cHPJpPL.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\lFbubtT.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\IzgqCBW.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\zQZEdAh.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\SkuvcOr.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\AcmQsaA.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\CjIZQaI.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\QdCZGXg.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\ScNvHqA.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\nJGzcIH.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\xrijgWC.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\TwJsmcb.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\zTstfBM.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\giekJbW.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\WkRjWbM.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\lEbtRXo.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\AeosnJY.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\BAdATrc.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\dxkyFIF.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\rBfqxJo.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\poVSWjr.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\KGpviDr.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\CGlVvmP.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\FqCeVjL.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\mPXJzxR.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\mKjeNas.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\WqkfQaE.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\ONyRJKp.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\SppDwtw.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\WvkjOMP.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\BaxcKtF.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\yTJVLuc.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\CNerqUd.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\NcjlzUE.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\iwFbgdK.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\FyGyxld.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\sBHLcOk.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\sGUgqhy.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\cBzxxxO.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\pVDCSsy.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\qlQrDaK.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\SYbxDtu.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\hGdVNcK.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\izCDLxo.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
File created	C:\Windows\System\mpowUTe.exe	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2664	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	84
PID 1956 wrote to memory of 2664	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	84
PID 1956 wrote to memory of 4024	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	85
PID 1956 wrote to memory of 4024	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	85
PID 1956 wrote to memory of 3976	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	86
PID 1956 wrote to memory of 3976	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	86
PID 1956 wrote to memory of 2008	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	87
PID 1956 wrote to memory of 2008	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	87
PID 1956 wrote to memory of 3076	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	88
PID 1956 wrote to memory of 3076	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	88
PID 1956 wrote to memory of 348	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	89
PID 1956 wrote to memory of 348	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	89
PID 1956 wrote to memory of 4036	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	90
PID 1956 wrote to memory of 4036	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	90
PID 1956 wrote to memory of 3476	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	92
PID 1956 wrote to memory of 3476	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	92
PID 1956 wrote to memory of 1540	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	93
PID 1956 wrote to memory of 1540	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	93
PID 1956 wrote to memory of 3796	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	94
PID 1956 wrote to memory of 3796	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	94
PID 1956 wrote to memory of 4820	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	95
PID 1956 wrote to memory of 4820	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	95
PID 1956 wrote to memory of 780	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	96
PID 1956 wrote to memory of 780	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	96
PID 1956 wrote to memory of 1084	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	97
PID 1956 wrote to memory of 1084	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	97
PID 1956 wrote to memory of 4876	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	98
PID 1956 wrote to memory of 4876	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	98
PID 1956 wrote to memory of 1692	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	99
PID 1956 wrote to memory of 1692	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	99
PID 1956 wrote to memory of 1316	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	100
PID 1956 wrote to memory of 1316	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	100
PID 1956 wrote to memory of 4516	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	101
PID 1956 wrote to memory of 4516	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	101
PID 1956 wrote to memory of 5092	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	102
PID 1956 wrote to memory of 5092	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	102
PID 1956 wrote to memory of 2364	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	105
PID 1956 wrote to memory of 2364	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	105
PID 1956 wrote to memory of 2084	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	106
PID 1956 wrote to memory of 2084	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	106
PID 1956 wrote to memory of 3792	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	107
PID 1956 wrote to memory of 3792	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	107
PID 1956 wrote to memory of 3728	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	108
PID 1956 wrote to memory of 3728	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	108
PID 1956 wrote to memory of 3724	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	109
PID 1956 wrote to memory of 3724	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	109
PID 1956 wrote to memory of 1500	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	110
PID 1956 wrote to memory of 1500	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	110
PID 1956 wrote to memory of 692	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	111
PID 1956 wrote to memory of 692	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	111
PID 1956 wrote to memory of 3956	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	112
PID 1956 wrote to memory of 3956	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	112
PID 1956 wrote to memory of 856	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	113
PID 1956 wrote to memory of 856	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	113
PID 1956 wrote to memory of 528	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	114
PID 1956 wrote to memory of 528	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	114
PID 1956 wrote to memory of 5056	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	115
PID 1956 wrote to memory of 5056	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	115
PID 1956 wrote to memory of 3160	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	116
PID 1956 wrote to memory of 3160	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	116
PID 1956 wrote to memory of 4732	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	117
PID 1956 wrote to memory of 4732	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	117
PID 1956 wrote to memory of 2200	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	118
PID 1956 wrote to memory of 2200	1956	6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe	118

C:\Users\Admin\AppData\Local\Temp\6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe
"C:\Users\Admin\AppData\Local\Temp\6de7ace45fed6cc153477691e7124485443ea4e46ccb207f567cd492c787c28f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\System\IxkyDhB.exe
  C:\Windows\System\IxkyDhB.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\ZQoIWQz.exe
  C:\Windows\System\ZQoIWQz.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\tgORJkR.exe
  C:\Windows\System\tgORJkR.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\UZINVwu.exe
  C:\Windows\System\UZINVwu.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\VyeGZLM.exe
  C:\Windows\System\VyeGZLM.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\pVDCSsy.exe
  C:\Windows\System\pVDCSsy.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\blNdhCR.exe
  C:\Windows\System\blNdhCR.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\XGyymws.exe
  C:\Windows\System\XGyymws.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\alJuIvR.exe
  C:\Windows\System\alJuIvR.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\DzKUxry.exe
  C:\Windows\System\DzKUxry.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\rCmbUzg.exe
  C:\Windows\System\rCmbUzg.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\CUglRmg.exe
  C:\Windows\System\CUglRmg.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\PJMBFHX.exe
  C:\Windows\System\PJMBFHX.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\QfNINik.exe
  C:\Windows\System\QfNINik.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\kXirsdR.exe
  C:\Windows\System\kXirsdR.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\vOVpmIQ.exe
  C:\Windows\System\vOVpmIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\uMWkEVl.exe
  C:\Windows\System\uMWkEVl.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\texIzAY.exe
  C:\Windows\System\texIzAY.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\dxkyFIF.exe
  C:\Windows\System\dxkyFIF.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\Vjwscrn.exe
  C:\Windows\System\Vjwscrn.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\nktEtuq.exe
  C:\Windows\System\nktEtuq.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\bWQIsyu.exe
  C:\Windows\System\bWQIsyu.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\oWBiJan.exe
  C:\Windows\System\oWBiJan.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\DXCeqeo.exe
  C:\Windows\System\DXCeqeo.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\diYJAla.exe
  C:\Windows\System\diYJAla.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\xYPExyv.exe
  C:\Windows\System\xYPExyv.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\AeDyGfx.exe
  C:\Windows\System\AeDyGfx.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\kEOdlJt.exe
  C:\Windows\System\kEOdlJt.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\ywdtrKl.exe
  C:\Windows\System\ywdtrKl.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\fFhcWSm.exe
  C:\Windows\System\fFhcWSm.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\axzFJmj.exe
  C:\Windows\System\axzFJmj.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\ZLBadht.exe
  C:\Windows\System\ZLBadht.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\vyMSdWq.exe
  C:\Windows\System\vyMSdWq.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\pCSVeVP.exe
  C:\Windows\System\pCSVeVP.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\NGZFNOO.exe
  C:\Windows\System\NGZFNOO.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\zaAqOuI.exe
  C:\Windows\System\zaAqOuI.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\QiEyVKG.exe
  C:\Windows\System\QiEyVKG.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\NIohmUQ.exe
  C:\Windows\System\NIohmUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\zvnqqKg.exe
  C:\Windows\System\zvnqqKg.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\RnfOTTl.exe
  C:\Windows\System\RnfOTTl.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\dTDPqCU.exe
  C:\Windows\System\dTDPqCU.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\KYNLIsP.exe
  C:\Windows\System\KYNLIsP.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\hQpBNFl.exe
  C:\Windows\System\hQpBNFl.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\KyKSlKi.exe
  C:\Windows\System\KyKSlKi.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\upvFjwC.exe
  C:\Windows\System\upvFjwC.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\pjSTrQU.exe
  C:\Windows\System\pjSTrQU.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\gdNqYhy.exe
  C:\Windows\System\gdNqYhy.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\cpIcKvr.exe
  C:\Windows\System\cpIcKvr.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\omsIKNm.exe
  C:\Windows\System\omsIKNm.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\YkidWAC.exe
  C:\Windows\System\YkidWAC.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\aXOtjwG.exe
  C:\Windows\System\aXOtjwG.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\jjLaeWB.exe
  C:\Windows\System\jjLaeWB.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\gaTyBMQ.exe
  C:\Windows\System\gaTyBMQ.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\JiXQMYf.exe
  C:\Windows\System\JiXQMYf.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\oWEzdyH.exe
  C:\Windows\System\oWEzdyH.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\uWzNSxs.exe
  C:\Windows\System\uWzNSxs.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\OBqAvOd.exe
  C:\Windows\System\OBqAvOd.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\puZwjSj.exe
  C:\Windows\System\puZwjSj.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\rDFVqgm.exe
  C:\Windows\System\rDFVqgm.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\DCEpVLL.exe
  C:\Windows\System\DCEpVLL.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\gvTETzj.exe
  C:\Windows\System\gvTETzj.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\hQvXjSw.exe
  C:\Windows\System\hQvXjSw.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\BhYkdWP.exe
  C:\Windows\System\BhYkdWP.exe
  2⤵
  PID:1520
- C:\Windows\System\EoUkMlx.exe
  C:\Windows\System\EoUkMlx.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\jnOHELr.exe
  C:\Windows\System\jnOHELr.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\hgyBojq.exe
  C:\Windows\System\hgyBojq.exe
  2⤵
  PID:3252
- C:\Windows\System\yfiHCRy.exe
  C:\Windows\System\yfiHCRy.exe
  2⤵
  PID:3524
- C:\Windows\System\zQZEdAh.exe
  C:\Windows\System\zQZEdAh.exe
  2⤵
  PID:3952
- C:\Windows\System\gfDAehq.exe
  C:\Windows\System\gfDAehq.exe
  2⤵
  PID:5060
- C:\Windows\System\HHjesKW.exe
  C:\Windows\System\HHjesKW.exe
  2⤵
  PID:3144
- C:\Windows\System\uIarcUw.exe
  C:\Windows\System\uIarcUw.exe
  2⤵
  PID:4056
- C:\Windows\System\uslPgSY.exe
  C:\Windows\System\uslPgSY.exe
  2⤵
  PID:372
- C:\Windows\System\lDdNDKb.exe
  C:\Windows\System\lDdNDKb.exe
  2⤵
  PID:2348
- C:\Windows\System\NcjlzUE.exe
  C:\Windows\System\NcjlzUE.exe
  2⤵
  PID:2868
- C:\Windows\System\vpJFLXp.exe
  C:\Windows\System\vpJFLXp.exe
  2⤵
  PID:2108
- C:\Windows\System\TzhUBsz.exe
  C:\Windows\System\TzhUBsz.exe
  2⤵
  PID:3740
- C:\Windows\System\NMQVPKU.exe
  C:\Windows\System\NMQVPKU.exe
  2⤵
  PID:2412
- C:\Windows\System\JZmUchV.exe
  C:\Windows\System\JZmUchV.exe
  2⤵
  PID:828
- C:\Windows\System\xprEwDt.exe
  C:\Windows\System\xprEwDt.exe
  2⤵
  PID:3460
- C:\Windows\System\YLOgMaX.exe
  C:\Windows\System\YLOgMaX.exe
  2⤵
  PID:4524
- C:\Windows\System\ArzonvU.exe
  C:\Windows\System\ArzonvU.exe
  2⤵
  PID:1896
- C:\Windows\System\ruriwgv.exe
  C:\Windows\System\ruriwgv.exe
  2⤵
  PID:2448
- C:\Windows\System\aBZifTQ.exe
  C:\Windows\System\aBZifTQ.exe
  2⤵
  PID:2952
- C:\Windows\System\sBHLcOk.exe
  C:\Windows\System\sBHLcOk.exe
  2⤵
  PID:4852
- C:\Windows\System\IURxUFH.exe
  C:\Windows\System\IURxUFH.exe
  2⤵
  PID:1040
- C:\Windows\System\ztjqAMl.exe
  C:\Windows\System\ztjqAMl.exe
  2⤵
  PID:4656
- C:\Windows\System\SkuvcOr.exe
  C:\Windows\System\SkuvcOr.exe
  2⤵
  PID:5144
- C:\Windows\System\RxCzDKV.exe
  C:\Windows\System\RxCzDKV.exe
  2⤵
  PID:5184
- C:\Windows\System\wfRGWiY.exe
  C:\Windows\System\wfRGWiY.exe
  2⤵
  PID:5208
- C:\Windows\System\XDVDDLC.exe
  C:\Windows\System\XDVDDLC.exe
  2⤵
  PID:5256
- C:\Windows\System\UXnolnQ.exe
  C:\Windows\System\UXnolnQ.exe
  2⤵
  PID:5276
- C:\Windows\System\wtMTcol.exe
  C:\Windows\System\wtMTcol.exe
  2⤵
  PID:5308
- C:\Windows\System\qiZJovL.exe
  C:\Windows\System\qiZJovL.exe
  2⤵
  PID:5336
- C:\Windows\System\rBfqxJo.exe
  C:\Windows\System\rBfqxJo.exe
  2⤵
  PID:5352
- C:\Windows\System\JwvAvtn.exe
  C:\Windows\System\JwvAvtn.exe
  2⤵
  PID:5368
- C:\Windows\System\HfCMZZn.exe
  C:\Windows\System\HfCMZZn.exe
  2⤵
  PID:5392
- C:\Windows\System\lwnFRqz.exe
  C:\Windows\System\lwnFRqz.exe
  2⤵
  PID:5416
- C:\Windows\System\AcmQsaA.exe
  C:\Windows\System\AcmQsaA.exe
  2⤵
  PID:5436
- C:\Windows\System\dCyVCfO.exe
  C:\Windows\System\dCyVCfO.exe
  2⤵
  PID:5460
- C:\Windows\System\kKGTBFd.exe
  C:\Windows\System\kKGTBFd.exe
  2⤵
  PID:5480
- C:\Windows\System\BfZQIcV.exe
  C:\Windows\System\BfZQIcV.exe
  2⤵
  PID:5508
- C:\Windows\System\dXYvnQO.exe
  C:\Windows\System\dXYvnQO.exe
  2⤵
  PID:5528
- C:\Windows\System\StLYLsz.exe
  C:\Windows\System\StLYLsz.exe
  2⤵
  PID:5556
- C:\Windows\System\XHEieMN.exe
  C:\Windows\System\XHEieMN.exe
  2⤵
  PID:5576
- C:\Windows\System\oATtzOR.exe
  C:\Windows\System\oATtzOR.exe
  2⤵
  PID:5600
- C:\Windows\System\ytNgdCN.exe
  C:\Windows\System\ytNgdCN.exe
  2⤵
  PID:5628
- C:\Windows\System\DgwneCo.exe
  C:\Windows\System\DgwneCo.exe
  2⤵
  PID:5656
- C:\Windows\System\nkGVpsO.exe
  C:\Windows\System\nkGVpsO.exe
  2⤵
  PID:5684
- C:\Windows\System\zBdYNWC.exe
  C:\Windows\System\zBdYNWC.exe
  2⤵
  PID:5704
- C:\Windows\System\WEuCjGh.exe
  C:\Windows\System\WEuCjGh.exe
  2⤵
  PID:5728
- C:\Windows\System\kcHtDtU.exe
  C:\Windows\System\kcHtDtU.exe
  2⤵
  PID:5756
- C:\Windows\System\KGpviDr.exe
  C:\Windows\System\KGpviDr.exe
  2⤵
  PID:5780
- C:\Windows\System\oubBttO.exe
  C:\Windows\System\oubBttO.exe
  2⤵
  PID:5804
- C:\Windows\System\eSdxLIc.exe
  C:\Windows\System\eSdxLIc.exe
  2⤵
  PID:5824
- C:\Windows\System\LJKMudw.exe
  C:\Windows\System\LJKMudw.exe
  2⤵
  PID:5848
- C:\Windows\System\cWrbaLo.exe
  C:\Windows\System\cWrbaLo.exe
  2⤵
  PID:5868
- C:\Windows\System\vPzwDYT.exe
  C:\Windows\System\vPzwDYT.exe
  2⤵
  PID:5888
- C:\Windows\System\EDHfMkY.exe
  C:\Windows\System\EDHfMkY.exe
  2⤵
  PID:5912
- C:\Windows\System\WDwUdJD.exe
  C:\Windows\System\WDwUdJD.exe
  2⤵
  PID:5944
- C:\Windows\System\zTstfBM.exe
  C:\Windows\System\zTstfBM.exe
  2⤵
  PID:5968
- C:\Windows\System\BEOcvfK.exe
  C:\Windows\System\BEOcvfK.exe
  2⤵
  PID:6000
- C:\Windows\System\gVzPAcb.exe
  C:\Windows\System\gVzPAcb.exe
  2⤵
  PID:6040
- C:\Windows\System\sjlIjge.exe
  C:\Windows\System\sjlIjge.exe
  2⤵
  PID:6064
- C:\Windows\System\CaEbxyP.exe
  C:\Windows\System\CaEbxyP.exe
  2⤵
  PID:6084
- C:\Windows\System\ETwTArY.exe
  C:\Windows\System\ETwTArY.exe
  2⤵
  PID:6112
- C:\Windows\System\FfUlTqa.exe
  C:\Windows\System\FfUlTqa.exe
  2⤵
  PID:6136
- C:\Windows\System\HphJzKB.exe
  C:\Windows\System\HphJzKB.exe
  2⤵
  PID:3248
- C:\Windows\System\blhyDNo.exe
  C:\Windows\System\blhyDNo.exe
  2⤵
  PID:4652
- C:\Windows\System\kaakMMB.exe
  C:\Windows\System\kaakMMB.exe
  2⤵
  PID:2324
- C:\Windows\System\QbwLbrW.exe
  C:\Windows\System\QbwLbrW.exe
  2⤵
  PID:3536
- C:\Windows\System\dttmoVV.exe
  C:\Windows\System\dttmoVV.exe
  2⤵
  PID:4112
- C:\Windows\System\mBlnDRA.exe
  C:\Windows\System\mBlnDRA.exe
  2⤵
  PID:1068
- C:\Windows\System\LpsrwMa.exe
  C:\Windows\System\LpsrwMa.exe
  2⤵
  PID:5228
- C:\Windows\System\BTUBMUJ.exe
  C:\Windows\System\BTUBMUJ.exe
  2⤵
  PID:5244
- C:\Windows\System\GqkNmzn.exe
  C:\Windows\System\GqkNmzn.exe
  2⤵
  PID:5344
- C:\Windows\System\MyImXSW.exe
  C:\Windows\System\MyImXSW.exe
  2⤵
  PID:5408
- C:\Windows\System\aLMqBNz.exe
  C:\Windows\System\aLMqBNz.exe
  2⤵
  PID:5448
- C:\Windows\System\ZevkCTj.exe
  C:\Windows\System\ZevkCTj.exe
  2⤵
  PID:5472
- C:\Windows\System\GNZbWeA.exe
  C:\Windows\System\GNZbWeA.exe
  2⤵
  PID:5592
- C:\Windows\System\PQMjeai.exe
  C:\Windows\System\PQMjeai.exe
  2⤵
  PID:5668
- C:\Windows\System\auMSyDE.exe
  C:\Windows\System\auMSyDE.exe
  2⤵
  PID:5876
- C:\Windows\System\WYVWVgm.exe
  C:\Windows\System\WYVWVgm.exe
  2⤵
  PID:5904
- C:\Windows\System\qJyECho.exe
  C:\Windows\System\qJyECho.exe
  2⤵
  PID:5820
- C:\Windows\System\jBUnfGT.exe
  C:\Windows\System\jBUnfGT.exe
  2⤵
  PID:5544
- C:\Windows\System\jUXKWIC.exe
  C:\Windows\System\jUXKWIC.exe
  2⤵
  PID:5388
- C:\Windows\System\giRlyzv.exe
  C:\Windows\System\giRlyzv.exe
  2⤵
  PID:5364
- C:\Windows\System\CqzndTF.exe
  C:\Windows\System\CqzndTF.exe
  2⤵
  PID:5744
- C:\Windows\System\nhUBLtd.exe
  C:\Windows\System\nhUBLtd.exe
  2⤵
  PID:5444
- C:\Windows\System\YhwXciy.exe
  C:\Windows\System\YhwXciy.exe
  2⤵
  PID:5840
- C:\Windows\System\nTwnzqQ.exe
  C:\Windows\System\nTwnzqQ.exe
  2⤵
  PID:5700
- C:\Windows\System\ZkZDhhX.exe
  C:\Windows\System\ZkZDhhX.exe
  2⤵
  PID:1560
- C:\Windows\System\yTBudFf.exe
  C:\Windows\System\yTBudFf.exe
  2⤵
  PID:5192
- C:\Windows\System\DRInACW.exe
  C:\Windows\System\DRInACW.exe
  2⤵
  PID:5320
- C:\Windows\System\PtKGeOD.exe
  C:\Windows\System\PtKGeOD.exe
  2⤵
  PID:5864
- C:\Windows\System\TwcchpY.exe
  C:\Windows\System\TwcchpY.exe
  2⤵
  PID:5196
- C:\Windows\System\wdQgJMB.exe
  C:\Windows\System\wdQgJMB.exe
  2⤵
  PID:6092
- C:\Windows\System\WxZTFna.exe
  C:\Windows\System\WxZTFna.exe
  2⤵
  PID:6152
- C:\Windows\System\LnmIeRm.exe
  C:\Windows\System\LnmIeRm.exe
  2⤵
  PID:6184
- C:\Windows\System\xKdyUzy.exe
  C:\Windows\System\xKdyUzy.exe
  2⤵
  PID:6212
- C:\Windows\System\woCnpfX.exe
  C:\Windows\System\woCnpfX.exe
  2⤵
  PID:6232
- C:\Windows\System\nRzMMtP.exe
  C:\Windows\System\nRzMMtP.exe
  2⤵
  PID:6256
- C:\Windows\System\yGNJPCv.exe
  C:\Windows\System\yGNJPCv.exe
  2⤵
  PID:6280
- C:\Windows\System\LjDPAOj.exe
  C:\Windows\System\LjDPAOj.exe
  2⤵
  PID:6304
- C:\Windows\System\OoSHzIi.exe
  C:\Windows\System\OoSHzIi.exe
  2⤵
  PID:6340
- C:\Windows\System\FSFIwBZ.exe
  C:\Windows\System\FSFIwBZ.exe
  2⤵
  PID:6376
- C:\Windows\System\qgLrroT.exe
  C:\Windows\System\qgLrroT.exe
  2⤵
  PID:6396
- C:\Windows\System\KqcVKPV.exe
  C:\Windows\System\KqcVKPV.exe
  2⤵
  PID:6424
- C:\Windows\System\IXdTQLO.exe
  C:\Windows\System\IXdTQLO.exe
  2⤵
  PID:6452
- C:\Windows\System\NPoSuFR.exe
  C:\Windows\System\NPoSuFR.exe
  2⤵
  PID:6480
- C:\Windows\System\cLSrevF.exe
  C:\Windows\System\cLSrevF.exe
  2⤵
  PID:6512
- C:\Windows\System\LcvOUmv.exe
  C:\Windows\System\LcvOUmv.exe
  2⤵
  PID:6540
- C:\Windows\System\UAwoYSh.exe
  C:\Windows\System\UAwoYSh.exe
  2⤵
  PID:6576
- C:\Windows\System\PaWgkik.exe
  C:\Windows\System\PaWgkik.exe
  2⤵
  PID:6600
- C:\Windows\System\sGUgqhy.exe
  C:\Windows\System\sGUgqhy.exe
  2⤵
  PID:6628
- C:\Windows\System\cZqXwCO.exe
  C:\Windows\System\cZqXwCO.exe
  2⤵
  PID:6656
- C:\Windows\System\fDukzMg.exe
  C:\Windows\System\fDukzMg.exe
  2⤵
  PID:6676
- C:\Windows\System\JQTeiFK.exe
  C:\Windows\System\JQTeiFK.exe
  2⤵
  PID:6704
- C:\Windows\System\yAVudeU.exe
  C:\Windows\System\yAVudeU.exe
  2⤵
  PID:6728
- C:\Windows\System\msowdBw.exe
  C:\Windows\System\msowdBw.exe
  2⤵
  PID:6756
- C:\Windows\System\urAbUQH.exe
  C:\Windows\System\urAbUQH.exe
  2⤵
  PID:6784
- C:\Windows\System\csGnpmf.exe
  C:\Windows\System\csGnpmf.exe
  2⤵
  PID:6816
- C:\Windows\System\alVROJh.exe
  C:\Windows\System\alVROJh.exe
  2⤵
  PID:6836
- C:\Windows\System\dyhIsZT.exe
  C:\Windows\System\dyhIsZT.exe
  2⤵
  PID:6864
- C:\Windows\System\eTBytet.exe
  C:\Windows\System\eTBytet.exe
  2⤵
  PID:6892
- C:\Windows\System\lGzsBnc.exe
  C:\Windows\System\lGzsBnc.exe
  2⤵
  PID:6920
- C:\Windows\System\yocjRwZ.exe
  C:\Windows\System\yocjRwZ.exe
  2⤵
  PID:6968
- C:\Windows\System\IQakNoH.exe
  C:\Windows\System\IQakNoH.exe
  2⤵
  PID:6992
- C:\Windows\System\nRWwshv.exe
  C:\Windows\System\nRWwshv.exe
  2⤵
  PID:7024
- C:\Windows\System\TfiDuyC.exe
  C:\Windows\System\TfiDuyC.exe
  2⤵
  PID:7048
- C:\Windows\System\GICeGmz.exe
  C:\Windows\System\GICeGmz.exe
  2⤵
  PID:7076
- C:\Windows\System\RrgUzji.exe
  C:\Windows\System\RrgUzji.exe
  2⤵
  PID:7096
- C:\Windows\System\OtNidoN.exe
  C:\Windows\System\OtNidoN.exe
  2⤵
  PID:7120
- C:\Windows\System\pMjgiiL.exe
  C:\Windows\System\pMjgiiL.exe
  2⤵
  PID:7152
- C:\Windows\System\lodbSSI.exe
  C:\Windows\System\lodbSSI.exe
  2⤵
  PID:5644
- C:\Windows\System\zsYSand.exe
  C:\Windows\System\zsYSand.exe
  2⤵
  PID:6168
- C:\Windows\System\GMFoUWi.exe
  C:\Windows\System\GMFoUWi.exe
  2⤵
  PID:6224
- C:\Windows\System\DcgvaGD.exe
  C:\Windows\System\DcgvaGD.exe
  2⤵
  PID:6360
- C:\Windows\System\slbjPLn.exe
  C:\Windows\System\slbjPLn.exe
  2⤵
  PID:6392
- C:\Windows\System\ulsNrFm.exe
  C:\Windows\System\ulsNrFm.exe
  2⤵
  PID:6420
- C:\Windows\System\kdTlKce.exe
  C:\Windows\System\kdTlKce.exe
  2⤵
  PID:6468
- C:\Windows\System\ilorVhc.exe
  C:\Windows\System\ilorVhc.exe
  2⤵
  PID:6564
- C:\Windows\System\coQPxBs.exe
  C:\Windows\System\coQPxBs.exe
  2⤵
  PID:6640
- C:\Windows\System\sVIDuSx.exe
  C:\Windows\System\sVIDuSx.exe
  2⤵
  PID:6688
- C:\Windows\System\BfhILod.exe
  C:\Windows\System\BfhILod.exe
  2⤵
  PID:6804
- C:\Windows\System\SQjFduh.exe
  C:\Windows\System\SQjFduh.exe
  2⤵
  PID:6832
- C:\Windows\System\giekJbW.exe
  C:\Windows\System\giekJbW.exe
  2⤵
  PID:6932
- C:\Windows\System\AjXEfPY.exe
  C:\Windows\System\AjXEfPY.exe
  2⤵
  PID:6960
- C:\Windows\System\BaxcKtF.exe
  C:\Windows\System\BaxcKtF.exe
  2⤵
  PID:7036
- C:\Windows\System\OTQkLyn.exe
  C:\Windows\System\OTQkLyn.exe
  2⤵
  PID:7060
- C:\Windows\System\siWwwEq.exe
  C:\Windows\System\siWwwEq.exe
  2⤵
  PID:7084
- C:\Windows\System\JGbeNWY.exe
  C:\Windows\System\JGbeNWY.exe
  2⤵
  PID:7148
- C:\Windows\System\QkGnkgS.exe
  C:\Windows\System\QkGnkgS.exe
  2⤵
  PID:6348
- C:\Windows\System\XLnDkpj.exe
  C:\Windows\System\XLnDkpj.exe
  2⤵
  PID:6408
- C:\Windows\System\BGGbRsr.exe
  C:\Windows\System\BGGbRsr.exe
  2⤵
  PID:6548
- C:\Windows\System\cqtHKNm.exe
  C:\Windows\System\cqtHKNm.exe
  2⤵
  PID:6900
- C:\Windows\System\lFbubtT.exe
  C:\Windows\System\lFbubtT.exe
  2⤵
  PID:6664
- C:\Windows\System\zGQOoGf.exe
  C:\Windows\System\zGQOoGf.exe
  2⤵
  PID:7108
- C:\Windows\System\aQHLNfZ.exe
  C:\Windows\System\aQHLNfZ.exe
  2⤵
  PID:7000
- C:\Windows\System\cBzxxxO.exe
  C:\Windows\System\cBzxxxO.exe
  2⤵
  PID:6652
- C:\Windows\System\AKZRRbs.exe
  C:\Windows\System\AKZRRbs.exe
  2⤵
  PID:7176
- C:\Windows\System\QDkhAlo.exe
  C:\Windows\System\QDkhAlo.exe
  2⤵
  PID:7204
- C:\Windows\System\kYDQuJH.exe
  C:\Windows\System\kYDQuJH.exe
  2⤵
  PID:7232
- C:\Windows\System\dFVHndt.exe
  C:\Windows\System\dFVHndt.exe
  2⤵
  PID:7264
- C:\Windows\System\EARrnXd.exe
  C:\Windows\System\EARrnXd.exe
  2⤵
  PID:7292
- C:\Windows\System\zjGKSha.exe
  C:\Windows\System\zjGKSha.exe
  2⤵
  PID:7312
- C:\Windows\System\WkRjWbM.exe
  C:\Windows\System\WkRjWbM.exe
  2⤵
  PID:7336
- C:\Windows\System\ZgYJqHq.exe
  C:\Windows\System\ZgYJqHq.exe
  2⤵
  PID:7368
- C:\Windows\System\YMbCXDu.exe
  C:\Windows\System\YMbCXDu.exe
  2⤵
  PID:7396
- C:\Windows\System\zwRwJrX.exe
  C:\Windows\System\zwRwJrX.exe
  2⤵
  PID:7424
- C:\Windows\System\QznzZIH.exe
  C:\Windows\System\QznzZIH.exe
  2⤵
  PID:7444
- C:\Windows\System\rMXVwqg.exe
  C:\Windows\System\rMXVwqg.exe
  2⤵
  PID:7476
- C:\Windows\System\YnWtAAA.exe
  C:\Windows\System\YnWtAAA.exe
  2⤵
  PID:7504
- C:\Windows\System\KFbyvwC.exe
  C:\Windows\System\KFbyvwC.exe
  2⤵
  PID:7524
- C:\Windows\System\sBNbzuT.exe
  C:\Windows\System\sBNbzuT.exe
  2⤵
  PID:7544
- C:\Windows\System\aUqyebR.exe
  C:\Windows\System\aUqyebR.exe
  2⤵
  PID:7568
- C:\Windows\System\KKXJCBL.exe
  C:\Windows\System\KKXJCBL.exe
  2⤵
  PID:7596
- C:\Windows\System\eCLBXME.exe
  C:\Windows\System\eCLBXME.exe
  2⤵
  PID:7620
- C:\Windows\System\mbHaDQe.exe
  C:\Windows\System\mbHaDQe.exe
  2⤵
  PID:7652
- C:\Windows\System\EALrYuP.exe
  C:\Windows\System\EALrYuP.exe
  2⤵
  PID:7680
- C:\Windows\System\iFDhQgL.exe
  C:\Windows\System\iFDhQgL.exe
  2⤵
  PID:7712
- C:\Windows\System\KlhVPQR.exe
  C:\Windows\System\KlhVPQR.exe
  2⤵
  PID:7736
- C:\Windows\System\RqYEXOV.exe
  C:\Windows\System\RqYEXOV.exe
  2⤵
  PID:7768
- C:\Windows\System\QuvtUya.exe
  C:\Windows\System\QuvtUya.exe
  2⤵
  PID:7792
- C:\Windows\System\BrTKRZd.exe
  C:\Windows\System\BrTKRZd.exe
  2⤵
  PID:7824
- C:\Windows\System\QtpbTfU.exe
  C:\Windows\System\QtpbTfU.exe
  2⤵
  PID:7852
- C:\Windows\System\SOUrcNN.exe
  C:\Windows\System\SOUrcNN.exe
  2⤵
  PID:7880
- C:\Windows\System\ZPQXaJa.exe
  C:\Windows\System\ZPQXaJa.exe
  2⤵
  PID:7908
- C:\Windows\System\NrRswCI.exe
  C:\Windows\System\NrRswCI.exe
  2⤵
  PID:7924
- C:\Windows\System\liezbwR.exe
  C:\Windows\System\liezbwR.exe
  2⤵
  PID:7940
- C:\Windows\System\yTJVLuc.exe
  C:\Windows\System\yTJVLuc.exe
  2⤵
  PID:7956
- C:\Windows\System\rFVVEhu.exe
  C:\Windows\System\rFVVEhu.exe
  2⤵
  PID:7972
- C:\Windows\System\cJusdFi.exe
  C:\Windows\System\cJusdFi.exe
  2⤵
  PID:8004
- C:\Windows\System\EEjFdPG.exe
  C:\Windows\System\EEjFdPG.exe
  2⤵
  PID:8036
- C:\Windows\System\TneqziB.exe
  C:\Windows\System\TneqziB.exe
  2⤵
  PID:8060
- C:\Windows\System\LshnJPL.exe
  C:\Windows\System\LshnJPL.exe
  2⤵
  PID:8084
- C:\Windows\System\DigXplH.exe
  C:\Windows\System\DigXplH.exe
  2⤵
  PID:8104
- C:\Windows\System\CsDgPwE.exe
  C:\Windows\System\CsDgPwE.exe
  2⤵
  PID:8124
- C:\Windows\System\NQuDZmX.exe
  C:\Windows\System\NQuDZmX.exe
  2⤵
  PID:8140
- C:\Windows\System\wSunNcH.exe
  C:\Windows\System\wSunNcH.exe
  2⤵
  PID:8164
- C:\Windows\System\DZLtDfs.exe
  C:\Windows\System\DZLtDfs.exe
  2⤵
  PID:8188
- C:\Windows\System\LqsIxSW.exe
  C:\Windows\System\LqsIxSW.exe
  2⤵
  PID:6412
- C:\Windows\System\QSgIBpm.exe
  C:\Windows\System\QSgIBpm.exe
  2⤵
  PID:6988
- C:\Windows\System\zfShKgo.exe
  C:\Windows\System\zfShKgo.exe
  2⤵
  PID:7300
- C:\Windows\System\PbdGqUb.exe
  C:\Windows\System\PbdGqUb.exe
  2⤵
  PID:7272
- C:\Windows\System\AahrwEQ.exe
  C:\Windows\System\AahrwEQ.exe
  2⤵
  PID:7216
- C:\Windows\System\KyrMNdW.exe
  C:\Windows\System\KyrMNdW.exe
  2⤵
  PID:7324
- C:\Windows\System\IBqPXVn.exe
  C:\Windows\System\IBqPXVn.exe
  2⤵
  PID:7488
- C:\Windows\System\PYzJibT.exe
  C:\Windows\System\PYzJibT.exe
  2⤵
  PID:7560
- C:\Windows\System\kTigcTb.exe
  C:\Windows\System\kTigcTb.exe
  2⤵
  PID:7516
- C:\Windows\System\DqUdwqO.exe
  C:\Windows\System\DqUdwqO.exe
  2⤵
  PID:7784
- C:\Windows\System\HHxGmeP.exe
  C:\Windows\System\HHxGmeP.exe
  2⤵
  PID:7836
- C:\Windows\System\qEZChdF.exe
  C:\Windows\System\qEZChdF.exe
  2⤵
  PID:7780
- C:\Windows\System\RdSNuQY.exe
  C:\Windows\System\RdSNuQY.exe
  2⤵
  PID:7916
- C:\Windows\System\iqfZjMh.exe
  C:\Windows\System\iqfZjMh.exe
  2⤵
  PID:8000
- C:\Windows\System\CjIZQaI.exe
  C:\Windows\System\CjIZQaI.exe
  2⤵
  PID:8056
- C:\Windows\System\phBPJXi.exe
  C:\Windows\System\phBPJXi.exe
  2⤵
  PID:7936
- C:\Windows\System\cAKnhTi.exe
  C:\Windows\System\cAKnhTi.exe
  2⤵
  PID:7188
- C:\Windows\System\HQvqGrF.exe
  C:\Windows\System\HQvqGrF.exe
  2⤵
  PID:8136
- C:\Windows\System\AyPdpNx.exe
  C:\Windows\System\AyPdpNx.exe
  2⤵
  PID:8176
- C:\Windows\System\ucuGWIR.exe
  C:\Windows\System\ucuGWIR.exe
  2⤵
  PID:7332
- C:\Windows\System\QdCZGXg.exe
  C:\Windows\System\QdCZGXg.exe
  2⤵
  PID:7452
- C:\Windows\System\TvwtdSF.exe
  C:\Windows\System\TvwtdSF.exe
  2⤵
  PID:8200
- C:\Windows\System\smzvOny.exe
  C:\Windows\System\smzvOny.exe
  2⤵
  PID:8228
- C:\Windows\System\iOzYQCU.exe
  C:\Windows\System\iOzYQCU.exe
  2⤵
  PID:8260
- C:\Windows\System\AhfJqQP.exe
  C:\Windows\System\AhfJqQP.exe
  2⤵
  PID:8280
- C:\Windows\System\eiysYqk.exe
  C:\Windows\System\eiysYqk.exe
  2⤵
  PID:8308
- C:\Windows\System\Crvrxkg.exe
  C:\Windows\System\Crvrxkg.exe
  2⤵
  PID:8336
- C:\Windows\System\CxdYoRQ.exe
  C:\Windows\System\CxdYoRQ.exe
  2⤵
  PID:8360
- C:\Windows\System\XgmuqNV.exe
  C:\Windows\System\XgmuqNV.exe
  2⤵
  PID:8388
- C:\Windows\System\NaLXqzG.exe
  C:\Windows\System\NaLXqzG.exe
  2⤵
  PID:8412
- C:\Windows\System\FEUBZiX.exe
  C:\Windows\System\FEUBZiX.exe
  2⤵
  PID:8436
- C:\Windows\System\DiucWfO.exe
  C:\Windows\System\DiucWfO.exe
  2⤵
  PID:8472
- C:\Windows\System\TydKWwT.exe
  C:\Windows\System\TydKWwT.exe
  2⤵
  PID:8504
- C:\Windows\System\mcASKVr.exe
  C:\Windows\System\mcASKVr.exe
  2⤵
  PID:8528
- C:\Windows\System\QpvVJgO.exe
  C:\Windows\System\QpvVJgO.exe
  2⤵
  PID:8556
- C:\Windows\System\OkSwcrI.exe
  C:\Windows\System\OkSwcrI.exe
  2⤵
  PID:8592
- C:\Windows\System\QobVMgl.exe
  C:\Windows\System\QobVMgl.exe
  2⤵
  PID:8616
- C:\Windows\System\bXdEOOC.exe
  C:\Windows\System\bXdEOOC.exe
  2⤵
  PID:8644
- C:\Windows\System\rERHFPg.exe
  C:\Windows\System\rERHFPg.exe
  2⤵
  PID:8672
- C:\Windows\System\IuwpWbN.exe
  C:\Windows\System\IuwpWbN.exe
  2⤵
  PID:8692
- C:\Windows\System\brETDMB.exe
  C:\Windows\System\brETDMB.exe
  2⤵
  PID:8720
- C:\Windows\System\BqsiEgS.exe
  C:\Windows\System\BqsiEgS.exe
  2⤵
  PID:8744
- C:\Windows\System\ZxiLffb.exe
  C:\Windows\System\ZxiLffb.exe
  2⤵
  PID:8768
- C:\Windows\System\ErvzutT.exe
  C:\Windows\System\ErvzutT.exe
  2⤵
  PID:8784
- C:\Windows\System\kjoQmcE.exe
  C:\Windows\System\kjoQmcE.exe
  2⤵
  PID:8808
- C:\Windows\System\fozIWlg.exe
  C:\Windows\System\fozIWlg.exe
  2⤵
  PID:8832
- C:\Windows\System\klJTpOx.exe
  C:\Windows\System\klJTpOx.exe
  2⤵
  PID:8856
- C:\Windows\System\UtAosOn.exe
  C:\Windows\System\UtAosOn.exe
  2⤵
  PID:8880
- C:\Windows\System\CTnkLVX.exe
  C:\Windows\System\CTnkLVX.exe
  2⤵
  PID:8904
- C:\Windows\System\CtRPLeC.exe
  C:\Windows\System\CtRPLeC.exe
  2⤵
  PID:8936
- C:\Windows\System\hmJtiFd.exe
  C:\Windows\System\hmJtiFd.exe
  2⤵
  PID:8956
- C:\Windows\System\CIFovvx.exe
  C:\Windows\System\CIFovvx.exe
  2⤵
  PID:8980
- C:\Windows\System\uonmvQK.exe
  C:\Windows\System\uonmvQK.exe
  2⤵
  PID:9000
- C:\Windows\System\ZuhzRyg.exe
  C:\Windows\System\ZuhzRyg.exe
  2⤵
  PID:9032
- C:\Windows\System\ICtEHsT.exe
  C:\Windows\System\ICtEHsT.exe
  2⤵
  PID:9056
- C:\Windows\System\xAYHFwd.exe
  C:\Windows\System\xAYHFwd.exe
  2⤵
  PID:9076
- C:\Windows\System\EEEzEWU.exe
  C:\Windows\System\EEEzEWU.exe
  2⤵
  PID:9108
- C:\Windows\System\ZcbGqfJ.exe
  C:\Windows\System\ZcbGqfJ.exe
  2⤵
  PID:9136
- C:\Windows\System\njborMM.exe
  C:\Windows\System\njborMM.exe
  2⤵
  PID:9164
- C:\Windows\System\SWnRpVj.exe
  C:\Windows\System\SWnRpVj.exe
  2⤵
  PID:9188
- C:\Windows\System\Aubavhl.exe
  C:\Windows\System\Aubavhl.exe
  2⤵
  PID:8048
- C:\Windows\System\HYjVRBA.exe
  C:\Windows\System\HYjVRBA.exe
  2⤵
  PID:8116
- C:\Windows\System\jlcGcKP.exe
  C:\Windows\System\jlcGcKP.exe
  2⤵
  PID:7144
- C:\Windows\System\hMjdZxu.exe
  C:\Windows\System\hMjdZxu.exe
  2⤵
  PID:7804
- C:\Windows\System\tIHWAkH.exe
  C:\Windows\System\tIHWAkH.exe
  2⤵
  PID:8132
- C:\Windows\System\RoLlJcY.exe
  C:\Windows\System\RoLlJcY.exe
  2⤵
  PID:8272
- C:\Windows\System\hHJoAXS.exe
  C:\Windows\System\hHJoAXS.exe
  2⤵
  PID:8332
- C:\Windows\System\JRvDCSK.exe
  C:\Windows\System\JRvDCSK.exe
  2⤵
  PID:8220
- C:\Windows\System\GoMKusP.exe
  C:\Windows\System\GoMKusP.exe
  2⤵
  PID:8432
- C:\Windows\System\nYmNKru.exe
  C:\Windows\System\nYmNKru.exe
  2⤵
  PID:8300
- C:\Windows\System\zlldgqj.exe
  C:\Windows\System\zlldgqj.exe
  2⤵
  PID:8564
- C:\Windows\System\mPXJzxR.exe
  C:\Windows\System\mPXJzxR.exe
  2⤵
  PID:8400
- C:\Windows\System\YBZdtLj.exe
  C:\Windows\System\YBZdtLj.exe
  2⤵
  PID:8656
- C:\Windows\System\WwsBiZW.exe
  C:\Windows\System\WwsBiZW.exe
  2⤵
  PID:8740
- C:\Windows\System\uGIwUVZ.exe
  C:\Windows\System\uGIwUVZ.exe
  2⤵
  PID:8820
- C:\Windows\System\tyRNWwy.exe
  C:\Windows\System\tyRNWwy.exe
  2⤵
  PID:8920
- C:\Windows\System\CMedlit.exe
  C:\Windows\System\CMedlit.exe
  2⤵
  PID:8828
- C:\Windows\System\UzTnKJz.exe
  C:\Windows\System\UzTnKJz.exe
  2⤵
  PID:9052
- C:\Windows\System\SoEetZu.exe
  C:\Windows\System\SoEetZu.exe
  2⤵
  PID:9096
- C:\Windows\System\GPTrTKx.exe
  C:\Windows\System\GPTrTKx.exe
  2⤵
  PID:8948
- C:\Windows\System\fpMJreK.exe
  C:\Windows\System\fpMJreK.exe
  2⤵
  PID:8076
- C:\Windows\System\NoswVxH.exe
  C:\Windows\System\NoswVxH.exe
  2⤵
  PID:8888
- C:\Windows\System\xgzPqJE.exe
  C:\Windows\System\xgzPqJE.exe
  2⤵
  PID:7240
- C:\Windows\System\DeTMGFk.exe
  C:\Windows\System\DeTMGFk.exe
  2⤵
  PID:8964
- C:\Windows\System\xeZGovZ.exe
  C:\Windows\System\xeZGovZ.exe
  2⤵
  PID:8988
- C:\Windows\System\vSUQyfy.exe
  C:\Windows\System\vSUQyfy.exe
  2⤵
  PID:8780
- C:\Windows\System\ebyCLbc.exe
  C:\Windows\System\ebyCLbc.exe
  2⤵
  PID:8208
- C:\Windows\System\nsfDdqH.exe
  C:\Windows\System\nsfDdqH.exe
  2⤵
  PID:9240
- C:\Windows\System\sAVCaWX.exe
  C:\Windows\System\sAVCaWX.exe
  2⤵
  PID:9260
- C:\Windows\System\wGyzVCp.exe
  C:\Windows\System\wGyzVCp.exe
  2⤵
  PID:9284
- C:\Windows\System\AbiqaHn.exe
  C:\Windows\System\AbiqaHn.exe
  2⤵
  PID:9300
- C:\Windows\System\jmwPvVp.exe
  C:\Windows\System\jmwPvVp.exe
  2⤵
  PID:9328
- C:\Windows\System\zvnypVc.exe
  C:\Windows\System\zvnypVc.exe
  2⤵
  PID:9356
- C:\Windows\System\nFavTlq.exe
  C:\Windows\System\nFavTlq.exe
  2⤵
  PID:9380
- C:\Windows\System\HRUmlXt.exe
  C:\Windows\System\HRUmlXt.exe
  2⤵
  PID:9404
- C:\Windows\System\fmvyHGl.exe
  C:\Windows\System\fmvyHGl.exe
  2⤵
  PID:9428
- C:\Windows\System\LUgVoDx.exe
  C:\Windows\System\LUgVoDx.exe
  2⤵
  PID:9452
- C:\Windows\System\MEPMKpz.exe
  C:\Windows\System\MEPMKpz.exe
  2⤵
  PID:9480
- C:\Windows\System\aoJngrD.exe
  C:\Windows\System\aoJngrD.exe
  2⤵
  PID:9508
- C:\Windows\System\DARcFMm.exe
  C:\Windows\System\DARcFMm.exe
  2⤵
  PID:9532
- C:\Windows\System\etNgHwR.exe
  C:\Windows\System\etNgHwR.exe
  2⤵
  PID:9556
- C:\Windows\System\BxkzdJT.exe
  C:\Windows\System\BxkzdJT.exe
  2⤵
  PID:9580
- C:\Windows\System\HcThNJZ.exe
  C:\Windows\System\HcThNJZ.exe
  2⤵
  PID:9600
- C:\Windows\System\HMzxlCz.exe
  C:\Windows\System\HMzxlCz.exe
  2⤵
  PID:9632
- C:\Windows\System\zbpioHU.exe
  C:\Windows\System\zbpioHU.exe
  2⤵
  PID:9664
- C:\Windows\System\lXjySnS.exe
  C:\Windows\System\lXjySnS.exe
  2⤵
  PID:9696
- C:\Windows\System\jdficsM.exe
  C:\Windows\System\jdficsM.exe
  2⤵
  PID:9724
- C:\Windows\System\FFrTolC.exe
  C:\Windows\System\FFrTolC.exe
  2⤵
  PID:9756
- C:\Windows\System\rYRtHIL.exe
  C:\Windows\System\rYRtHIL.exe
  2⤵
  PID:9788
- C:\Windows\System\AihEaFc.exe
  C:\Windows\System\AihEaFc.exe
  2⤵
  PID:9812
- C:\Windows\System\kkzqiUZ.exe
  C:\Windows\System\kkzqiUZ.exe
  2⤵
  PID:9844
- C:\Windows\System\EsyxqjY.exe
  C:\Windows\System\EsyxqjY.exe
  2⤵
  PID:9872
- C:\Windows\System\PsxuTWE.exe
  C:\Windows\System\PsxuTWE.exe
  2⤵
  PID:9900
- C:\Windows\System\PuErJOx.exe
  C:\Windows\System\PuErJOx.exe
  2⤵
  PID:9928
- C:\Windows\System\nLIiFRr.exe
  C:\Windows\System\nLIiFRr.exe
  2⤵
  PID:9960
- C:\Windows\System\FMpATPT.exe
  C:\Windows\System\FMpATPT.exe
  2⤵
  PID:9984
- C:\Windows\System\EAVjJNi.exe
  C:\Windows\System\EAVjJNi.exe
  2⤵
  PID:10008
- C:\Windows\System\qhpKgZf.exe
  C:\Windows\System\qhpKgZf.exe
  2⤵
  PID:10040
- C:\Windows\System\fLUrypB.exe
  C:\Windows\System\fLUrypB.exe
  2⤵
  PID:10064
- C:\Windows\System\YBTZkss.exe
  C:\Windows\System\YBTZkss.exe
  2⤵
  PID:10092
- C:\Windows\System\XFwbEPz.exe
  C:\Windows\System\XFwbEPz.exe
  2⤵
  PID:10124
- C:\Windows\System\swOANri.exe
  C:\Windows\System\swOANri.exe
  2⤵
  PID:10152
- C:\Windows\System\SIbRLBc.exe
  C:\Windows\System\SIbRLBc.exe
  2⤵
  PID:10184
- C:\Windows\System\VfGbayV.exe
  C:\Windows\System\VfGbayV.exe
  2⤵
  PID:10208
- C:\Windows\System\TGGbBrd.exe
  C:\Windows\System\TGGbBrd.exe
  2⤵
  PID:10236
- C:\Windows\System\gIXgGyX.exe
  C:\Windows\System\gIXgGyX.exe
  2⤵
  PID:8932
- C:\Windows\System\xcWhUik.exe
  C:\Windows\System\xcWhUik.exe
  2⤵
  PID:8072
- C:\Windows\System\TdpEqeo.exe
  C:\Windows\System\TdpEqeo.exe
  2⤵
  PID:8288
- C:\Windows\System\xfmaEwl.exe
  C:\Windows\System\xfmaEwl.exe
  2⤵
  PID:8664
- C:\Windows\System\mgHcgaC.exe
  C:\Windows\System\mgHcgaC.exe
  2⤵
  PID:9296
- C:\Windows\System\PFeKhKv.exe
  C:\Windows\System\PFeKhKv.exe
  2⤵
  PID:8212
- C:\Windows\System\FwVOfmj.exe
  C:\Windows\System\FwVOfmj.exe
  2⤵
  PID:7688
- C:\Windows\System\UthsmcO.exe
  C:\Windows\System\UthsmcO.exe
  2⤵
  PID:9256
- C:\Windows\System\qCtkPGo.exe
  C:\Windows\System\qCtkPGo.exe
  2⤵
  PID:9184
- C:\Windows\System\UtqEOZt.exe
  C:\Windows\System\UtqEOZt.exe
  2⤵
  PID:3100
- C:\Windows\System\dVMQYgL.exe
  C:\Windows\System\dVMQYgL.exe
  2⤵
  PID:9620
- C:\Windows\System\rAvnmMJ.exe
  C:\Windows\System\rAvnmMJ.exe
  2⤵
  PID:9676
- C:\Windows\System\mUpkehZ.exe
  C:\Windows\System\mUpkehZ.exe
  2⤵
  PID:9784
- C:\Windows\System\OaCYcDH.exe
  C:\Windows\System\OaCYcDH.exe
  2⤵
  PID:9836
- C:\Windows\System\jcZpepF.exe
  C:\Windows\System\jcZpepF.exe
  2⤵
  PID:9880
- C:\Windows\System\bCksJkS.exe
  C:\Windows\System\bCksJkS.exe
  2⤵
  PID:9576
- C:\Windows\System\zjTbusu.exe
  C:\Windows\System\zjTbusu.exe
  2⤵
  PID:9952
- C:\Windows\System\FJHAOqO.exe
  C:\Windows\System\FJHAOqO.exe
  2⤵
  PID:9716
- C:\Windows\System\VslidyE.exe
  C:\Windows\System\VslidyE.exe
  2⤵
  PID:9496
- C:\Windows\System\eDmjhUX.exe
  C:\Windows\System\eDmjhUX.exe
  2⤵
  PID:10180
- C:\Windows\System\AuYJysg.exe
  C:\Windows\System\AuYJysg.exe
  2⤵
  PID:9592
- C:\Windows\System\iYkMuhS.exe
  C:\Windows\System\iYkMuhS.exe
  2⤵
  PID:9652
- C:\Windows\System\OhpgyzV.exe
  C:\Windows\System\OhpgyzV.exe
  2⤵
  PID:9324
- C:\Windows\System\PRrjAod.exe
  C:\Windows\System\PRrjAod.exe
  2⤵
  PID:10024
- C:\Windows\System\GFwIXfd.exe
  C:\Windows\System\GFwIXfd.exe
  2⤵
  PID:10056
- C:\Windows\System\DQJCVWn.exe
  C:\Windows\System\DQJCVWn.exe
  2⤵
  PID:10108
- C:\Windows\System\unRRRCR.exe
  C:\Windows\System\unRRRCR.exe
  2⤵
  PID:9420
- C:\Windows\System\iPTEunR.exe
  C:\Windows\System\iPTEunR.exe
  2⤵
  PID:10264
- C:\Windows\System\nBgtBeh.exe
  C:\Windows\System\nBgtBeh.exe
  2⤵
  PID:10284
- C:\Windows\System\ONyRJKp.exe
  C:\Windows\System\ONyRJKp.exe
  2⤵
  PID:10320
- C:\Windows\System\LbziSzz.exe
  C:\Windows\System\LbziSzz.exe
  2⤵
  PID:10336
- C:\Windows\System\YketnFO.exe
  C:\Windows\System\YketnFO.exe
  2⤵
  PID:10356
- C:\Windows\System\vXAgQRI.exe
  C:\Windows\System\vXAgQRI.exe
  2⤵
  PID:10384
- C:\Windows\System\MKLgRfV.exe
  C:\Windows\System\MKLgRfV.exe
  2⤵
  PID:10408
- C:\Windows\System\vNVebVB.exe
  C:\Windows\System\vNVebVB.exe
  2⤵
  PID:10436
- C:\Windows\System\NrrZisI.exe
  C:\Windows\System\NrrZisI.exe
  2⤵
  PID:10468
- C:\Windows\System\wZMxYmj.exe
  C:\Windows\System\wZMxYmj.exe
  2⤵
  PID:10492
- C:\Windows\System\QdhZCWV.exe
  C:\Windows\System\QdhZCWV.exe
  2⤵
  PID:10520
- C:\Windows\System\jJtaSYJ.exe
  C:\Windows\System\jJtaSYJ.exe
  2⤵
  PID:10540
- C:\Windows\System\ZZFqUrE.exe
  C:\Windows\System\ZZFqUrE.exe
  2⤵
  PID:10568
- C:\Windows\System\hfDuQGJ.exe
  C:\Windows\System\hfDuQGJ.exe
  2⤵
  PID:10588
- C:\Windows\System\aIQVpZT.exe
  C:\Windows\System\aIQVpZT.exe
  2⤵
  PID:10620
- C:\Windows\System\flfnnos.exe
  C:\Windows\System\flfnnos.exe
  2⤵
  PID:10644
- C:\Windows\System\OsFPBkp.exe
  C:\Windows\System\OsFPBkp.exe
  2⤵
  PID:10664
- C:\Windows\System\FeXQEiN.exe
  C:\Windows\System\FeXQEiN.exe
  2⤵
  PID:10680
- C:\Windows\System\ZOJVokY.exe
  C:\Windows\System\ZOJVokY.exe
  2⤵
  PID:10704
- C:\Windows\System\ITTskjl.exe
  C:\Windows\System\ITTskjl.exe
  2⤵
  PID:10732
- C:\Windows\System\KSjeHAV.exe
  C:\Windows\System\KSjeHAV.exe
  2⤵
  PID:10760
- C:\Windows\System\XVTeKTa.exe
  C:\Windows\System\XVTeKTa.exe
  2⤵
  PID:10792
- C:\Windows\System\JjoOTgs.exe
  C:\Windows\System\JjoOTgs.exe
  2⤵
  PID:10820
- C:\Windows\System\YiWpjFZ.exe
  C:\Windows\System\YiWpjFZ.exe
  2⤵
  PID:10836
- C:\Windows\System\runVrkD.exe
  C:\Windows\System\runVrkD.exe
  2⤵
  PID:10872
- C:\Windows\System\VNAWKvd.exe
  C:\Windows\System\VNAWKvd.exe
  2⤵
  PID:10896
- C:\Windows\System\cTADqZp.exe
  C:\Windows\System\cTADqZp.exe
  2⤵
  PID:10940
- C:\Windows\System\IJYaTdn.exe
  C:\Windows\System\IJYaTdn.exe
  2⤵
  PID:11140
- C:\Windows\System\CqJXjay.exe
  C:\Windows\System\CqJXjay.exe
  2⤵
  PID:11168
- C:\Windows\System\iwFbgdK.exe
  C:\Windows\System\iwFbgdK.exe
  2⤵
  PID:11196
- C:\Windows\System\aNKMzJx.exe
  C:\Windows\System\aNKMzJx.exe
  2⤵
  PID:11228
- C:\Windows\System\SsjXNHG.exe
  C:\Windows\System\SsjXNHG.exe
  2⤵
  PID:11260
- C:\Windows\System\wGgnMCM.exe
  C:\Windows\System\wGgnMCM.exe
  2⤵
  PID:10000
- C:\Windows\System\DFDhyPC.exe
  C:\Windows\System\DFDhyPC.exe
  2⤵
  PID:9704
- C:\Windows\System\zDstNVc.exe
  C:\Windows\System\zDstNVc.exe
  2⤵
  PID:2732
- C:\Windows\System\VEBDfNQ.exe
  C:\Windows\System\VEBDfNQ.exe
  2⤵
  PID:9472
- C:\Windows\System\XESUSOa.exe
  C:\Windows\System\XESUSOa.exe
  2⤵
  PID:4156
- C:\Windows\System\QZHswRH.exe
  C:\Windows\System\QZHswRH.exe
  2⤵
  PID:9616
- C:\Windows\System\NnfORJT.exe
  C:\Windows\System\NnfORJT.exe
  2⤵
  PID:10400
- C:\Windows\System\NpMaZYd.exe
  C:\Windows\System\NpMaZYd.exe
  2⤵
  PID:9980
- C:\Windows\System\ZRBudip.exe
  C:\Windows\System\ZRBudip.exe
  2⤵
  PID:4552
- C:\Windows\System\zLYjqBj.exe
  C:\Windows\System\zLYjqBj.exe
  2⤵
  PID:10036
- C:\Windows\System\SppDwtw.exe
  C:\Windows\System\SppDwtw.exe
  2⤵
  PID:9644
- C:\Windows\System\sfqmBdZ.exe
  C:\Windows\System\sfqmBdZ.exe
  2⤵
  PID:2852
- C:\Windows\System\UHABVDl.exe
  C:\Windows\System\UHABVDl.exe
  2⤵
  PID:9744
- C:\Windows\System\soswRpb.exe
  C:\Windows\System\soswRpb.exe
  2⤵
  PID:10508
- C:\Windows\System\IRcwZWE.exe
  C:\Windows\System\IRcwZWE.exe
  2⤵
  PID:10280
- C:\Windows\System\hsHeDPA.exe
  C:\Windows\System\hsHeDPA.exe
  2⤵
  PID:10372
- C:\Windows\System\JrJyHcs.exe
  C:\Windows\System\JrJyHcs.exe
  2⤵
  PID:10444
- C:\Windows\System\CyECMsg.exe
  C:\Windows\System\CyECMsg.exe
  2⤵
  PID:10916
- C:\Windows\System\rhEUsWR.exe
  C:\Windows\System\rhEUsWR.exe
  2⤵
  PID:10948
- C:\Windows\System\zuAjEUu.exe
  C:\Windows\System\zuAjEUu.exe
  2⤵
  PID:11108
- C:\Windows\System\shPbtua.exe
  C:\Windows\System\shPbtua.exe
  2⤵
  PID:10968
- C:\Windows\System\aMjvfyn.exe
  C:\Windows\System\aMjvfyn.exe
  2⤵
  PID:10728
- C:\Windows\System\qGGOQdr.exe
  C:\Windows\System\qGGOQdr.exe
  2⤵
  PID:10808
- C:\Windows\System\HrGDxxH.exe
  C:\Windows\System\HrGDxxH.exe
  2⤵
  PID:11216
- C:\Windows\System\vUYfIPb.exe
  C:\Windows\System\vUYfIPb.exe
  2⤵
  PID:9892
- C:\Windows\System\cqJiury.exe
  C:\Windows\System\cqJiury.exe
  2⤵
  PID:10276
- C:\Windows\System\EXLMNFI.exe
  C:\Windows\System\EXLMNFI.exe
  2⤵
  PID:11136
- C:\Windows\System\jYSAXAg.exe
  C:\Windows\System\jYSAXAg.exe
  2⤵
  PID:11204
- C:\Windows\System\tmqvGhp.exe
  C:\Windows\System\tmqvGhp.exe
  2⤵
  PID:10628
- C:\Windows\System\jpbVRsi.exe
  C:\Windows\System\jpbVRsi.exe
  2⤵
  PID:10432
- C:\Windows\System\vRDPQTP.exe
  C:\Windows\System\vRDPQTP.exe
  2⤵
  PID:2408
- C:\Windows\System\dpBOsVH.exe
  C:\Windows\System\dpBOsVH.exe
  2⤵
  PID:10516
- C:\Windows\System\yiJUrZZ.exe
  C:\Windows\System\yiJUrZZ.exe
  2⤵
  PID:11100
- C:\Windows\System\jKrqLbh.exe
  C:\Windows\System\jKrqLbh.exe
  2⤵
  PID:9084
- C:\Windows\System\thtmTMO.exe
  C:\Windows\System\thtmTMO.exe
  2⤵
  PID:10904
- C:\Windows\System\dgVTmwv.exe
  C:\Windows\System\dgVTmwv.exe
  2⤵
  PID:10248
- C:\Windows\System\SEnnflE.exe
  C:\Windows\System\SEnnflE.exe
  2⤵
  PID:11284
- C:\Windows\System\mCpjmvD.exe
  C:\Windows\System\mCpjmvD.exe
  2⤵
  PID:11316
- C:\Windows\System\srGvehD.exe
  C:\Windows\System\srGvehD.exe
  2⤵
  PID:11340
- C:\Windows\System\AdpeOdr.exe
  C:\Windows\System\AdpeOdr.exe
  2⤵
  PID:11356
- C:\Windows\System\JWxeFoR.exe
  C:\Windows\System\JWxeFoR.exe
  2⤵
  PID:11372
- C:\Windows\System\oRHlNXy.exe
  C:\Windows\System\oRHlNXy.exe
  2⤵
  PID:11404
- C:\Windows\System\XMqliGS.exe
  C:\Windows\System\XMqliGS.exe
  2⤵
  PID:11424
- C:\Windows\System\JicYMNW.exe
  C:\Windows\System\JicYMNW.exe
  2⤵
  PID:11456
- C:\Windows\System\oPOuEra.exe
  C:\Windows\System\oPOuEra.exe
  2⤵
  PID:11480
- C:\Windows\System\kaFaUhV.exe
  C:\Windows\System\kaFaUhV.exe
  2⤵
  PID:11504
- C:\Windows\System\bxqJBPj.exe
  C:\Windows\System\bxqJBPj.exe
  2⤵
  PID:11540
- C:\Windows\System\YrtNLvN.exe
  C:\Windows\System\YrtNLvN.exe
  2⤵
  PID:11560
- C:\Windows\System\zZUMjCr.exe
  C:\Windows\System\zZUMjCr.exe
  2⤵
  PID:11584
- C:\Windows\System\CntSgyA.exe
  C:\Windows\System\CntSgyA.exe
  2⤵
  PID:11612
- C:\Windows\System\cGdqbRz.exe
  C:\Windows\System\cGdqbRz.exe
  2⤵
  PID:11640
- C:\Windows\System\dhSufHr.exe
  C:\Windows\System\dhSufHr.exe
  2⤵
  PID:11664
- C:\Windows\System\mfYeyAb.exe
  C:\Windows\System\mfYeyAb.exe
  2⤵
  PID:11696
- C:\Windows\System\AsAFnUN.exe
  C:\Windows\System\AsAFnUN.exe
  2⤵
  PID:11712
- C:\Windows\System\qyhEtSM.exe
  C:\Windows\System\qyhEtSM.exe
  2⤵
  PID:11732
- C:\Windows\System\WKLcuiK.exe
  C:\Windows\System\WKLcuiK.exe
  2⤵
  PID:11752
- C:\Windows\System\xrBupZz.exe
  C:\Windows\System\xrBupZz.exe
  2⤵
  PID:11772
- C:\Windows\System\fOawOwM.exe
  C:\Windows\System\fOawOwM.exe
  2⤵
  PID:11800
- C:\Windows\System\GlhuWVf.exe
  C:\Windows\System\GlhuWVf.exe
  2⤵
  PID:11820
- C:\Windows\System\NubNEZQ.exe
  C:\Windows\System\NubNEZQ.exe
  2⤵
  PID:11840
- C:\Windows\System\cmvTGvN.exe
  C:\Windows\System\cmvTGvN.exe
  2⤵
  PID:11860
- C:\Windows\System\dcwRMQk.exe
  C:\Windows\System\dcwRMQk.exe
  2⤵
  PID:11888
- C:\Windows\System\PysCcjO.exe
  C:\Windows\System\PysCcjO.exe
  2⤵
  PID:11924
- C:\Windows\System\mdejRDk.exe
  C:\Windows\System\mdejRDk.exe
  2⤵
  PID:11956
- C:\Windows\System\cHPJpPL.exe
  C:\Windows\System\cHPJpPL.exe
  2⤵
  PID:11972
- C:\Windows\System\DxNiNwK.exe
  C:\Windows\System\DxNiNwK.exe
  2⤵
  PID:12004
- C:\Windows\System\QsfsGen.exe
  C:\Windows\System\QsfsGen.exe
  2⤵
  PID:12028
- C:\Windows\System\lpjthXl.exe
  C:\Windows\System\lpjthXl.exe
  2⤵
  PID:12052
- C:\Windows\System\bEPQBQt.exe
  C:\Windows\System\bEPQBQt.exe
  2⤵
  PID:12080
- C:\Windows\System\WGrxaSV.exe
  C:\Windows\System\WGrxaSV.exe
  2⤵
  PID:12108
- C:\Windows\System\JmMImWT.exe
  C:\Windows\System\JmMImWT.exe
  2⤵
  PID:12132
- C:\Windows\System\pqxLzNJ.exe
  C:\Windows\System\pqxLzNJ.exe
  2⤵
  PID:12160
- C:\Windows\System\HozMvab.exe
  C:\Windows\System\HozMvab.exe
  2⤵
  PID:12188
- C:\Windows\System\hwfMOoY.exe
  C:\Windows\System\hwfMOoY.exe
  2⤵
  PID:12216
- C:\Windows\System\xfRTpUl.exe
  C:\Windows\System\xfRTpUl.exe
  2⤵
  PID:12244
- C:\Windows\System\Oivjnxx.exe
  C:\Windows\System\Oivjnxx.exe
  2⤵
  PID:12268
- C:\Windows\System\vgQZPfY.exe
  C:\Windows\System\vgQZPfY.exe
  2⤵
  PID:11160
- C:\Windows\System\kviJjtU.exe
  C:\Windows\System\kviJjtU.exe
  2⤵
  PID:10380
- C:\Windows\System\vqVVwhR.exe
  C:\Windows\System\vqVVwhR.exe
  2⤵
  PID:10160
- C:\Windows\System\iasIoSN.exe
  C:\Windows\System\iasIoSN.exe
  2⤵
  PID:11076
- C:\Windows\System\GKjeiqV.exe
  C:\Windows\System\GKjeiqV.exe
  2⤵
  PID:3140
- C:\Windows\System\TiNQWIz.exe
  C:\Windows\System\TiNQWIz.exe
  2⤵
  PID:11352
- C:\Windows\System\cJNHNNq.exe
  C:\Windows\System\cJNHNNq.exe
  2⤵
  PID:11420
- C:\Windows\System\CorRKNQ.exe
  C:\Windows\System\CorRKNQ.exe
  2⤵
  PID:11516
- C:\Windows\System\zjsETQh.exe
  C:\Windows\System\zjsETQh.exe
  2⤵
  PID:10800
- C:\Windows\System\WUWgMCJ.exe
  C:\Windows\System\WUWgMCJ.exe
  2⤵
  PID:11632
- C:\Windows\System\CrliKre.exe
  C:\Windows\System\CrliKre.exe
  2⤵
  PID:11680
- C:\Windows\System\TcgEbxO.exe
  C:\Windows\System\TcgEbxO.exe
  2⤵
  PID:11708
- C:\Windows\System\mGRIspI.exe
  C:\Windows\System\mGRIspI.exe
  2⤵
  PID:11528
- C:\Windows\System\ItPdRWi.exe
  C:\Windows\System\ItPdRWi.exe
  2⤵
  PID:11936
- C:\Windows\System\vAXHuNu.exe
  C:\Windows\System\vAXHuNu.exe
  2⤵
  PID:12012
- C:\Windows\System\HzfZczA.exe
  C:\Windows\System\HzfZczA.exe
  2⤵
  PID:12088
- C:\Windows\System\spSyTmA.exe
  C:\Windows\System\spSyTmA.exe
  2⤵
  PID:11576
- C:\Windows\System\PYGXgUc.exe
  C:\Windows\System\PYGXgUc.exe
  2⤵
  PID:11968
- C:\Windows\System\pPlFLVa.exe
  C:\Windows\System\pPlFLVa.exe
  2⤵
  PID:12292
- C:\Windows\System\FyGyxld.exe
  C:\Windows\System\FyGyxld.exe
  2⤵
  PID:12320
- C:\Windows\System\VFyYwJK.exe
  C:\Windows\System\VFyYwJK.exe
  2⤵
  PID:12352
- C:\Windows\System\bMkOszk.exe
  C:\Windows\System\bMkOszk.exe
  2⤵
  PID:12372
- C:\Windows\System\gjRvjMg.exe
  C:\Windows\System\gjRvjMg.exe
  2⤵
  PID:12400
- C:\Windows\System\WlbZSuJ.exe
  C:\Windows\System\WlbZSuJ.exe
  2⤵
  PID:12428
- C:\Windows\System\MluFtNy.exe
  C:\Windows\System\MluFtNy.exe
  2⤵
  PID:12444
- C:\Windows\System\wJnTUrL.exe
  C:\Windows\System\wJnTUrL.exe
  2⤵
  PID:12476
- C:\Windows\System\nllcIMO.exe
  C:\Windows\System\nllcIMO.exe
  2⤵
  PID:12504
- C:\Windows\System\SYbxDtu.exe
  C:\Windows\System\SYbxDtu.exe
  2⤵
  PID:12540
- C:\Windows\System\FonoBdL.exe
  C:\Windows\System\FonoBdL.exe
  2⤵
  PID:12572
- C:\Windows\System\AHHpMMg.exe
  C:\Windows\System\AHHpMMg.exe
  2⤵
  PID:12592
- C:\Windows\System\TxhpFhW.exe
  C:\Windows\System\TxhpFhW.exe
  2⤵
  PID:12616
- C:\Windows\System\aneMLtV.exe
  C:\Windows\System\aneMLtV.exe
  2⤵
  PID:12636
- C:\Windows\System\dfxinXh.exe
  C:\Windows\System\dfxinXh.exe
  2⤵
  PID:12664
- C:\Windows\System\SIfQxnn.exe
  C:\Windows\System\SIfQxnn.exe
  2⤵
  PID:12692
- C:\Windows\System\rJLrHrt.exe
  C:\Windows\System\rJLrHrt.exe
  2⤵
  PID:12716
- C:\Windows\System\gElWeSe.exe
  C:\Windows\System\gElWeSe.exe
  2⤵
  PID:12740
- C:\Windows\System\LiUPGbv.exe
  C:\Windows\System\LiUPGbv.exe
  2⤵
  PID:12760
- C:\Windows\System\jfYXyui.exe
  C:\Windows\System\jfYXyui.exe
  2⤵
  PID:12796
- C:\Windows\System\UPuComm.exe
  C:\Windows\System\UPuComm.exe
  2⤵
  PID:12820
- C:\Windows\System\enNVIRq.exe
  C:\Windows\System\enNVIRq.exe
  2⤵
  PID:12840
- C:\Windows\System\yCZJrtt.exe
  C:\Windows\System\yCZJrtt.exe
  2⤵
  PID:12876
- C:\Windows\System\ISBNlzz.exe
  C:\Windows\System\ISBNlzz.exe
  2⤵
  PID:12908
- C:\Windows\System\lKmuEjJ.exe
  C:\Windows\System\lKmuEjJ.exe
  2⤵
  PID:12928
- C:\Windows\System\nJGzcIH.exe
  C:\Windows\System\nJGzcIH.exe
  2⤵
  PID:12956
- C:\Windows\System\CNerqUd.exe
  C:\Windows\System\CNerqUd.exe
  2⤵
  PID:12976
- C:\Windows\System\BSZpkxi.exe
  C:\Windows\System\BSZpkxi.exe
  2⤵
  PID:13000
- C:\Windows\System\FQlRhZd.exe
  C:\Windows\System\FQlRhZd.exe
  2⤵
  PID:13020
- C:\Windows\System\kHhtSPH.exe
  C:\Windows\System\kHhtSPH.exe
  2⤵
  PID:13048
- C:\Windows\System\AoyuZUd.exe
  C:\Windows\System\AoyuZUd.exe
  2⤵
  PID:13068
- C:\Windows\System\SrnsVhr.exe
  C:\Windows\System\SrnsVhr.exe
  2⤵
  PID:13084
- C:\Windows\System\joqlBvF.exe
  C:\Windows\System\joqlBvF.exe
  2⤵
  PID:13100
- C:\Windows\System\qYWXEvy.exe
  C:\Windows\System\qYWXEvy.exe
  2⤵
  PID:13120
- C:\Windows\System\aIHALTH.exe
  C:\Windows\System\aIHALTH.exe
  2⤵
  PID:13136
- C:\Windows\System\IfhqkVF.exe
  C:\Windows\System\IfhqkVF.exe
  2⤵
  PID:13156
- C:\Windows\System\WvkjOMP.exe
  C:\Windows\System\WvkjOMP.exe
  2⤵
  PID:13196
- C:\Windows\System\zrhnUDL.exe
  C:\Windows\System\zrhnUDL.exe
  2⤵
  PID:13224
- C:\Windows\System\jSGSbmJ.exe
  C:\Windows\System\jSGSbmJ.exe
  2⤵
  PID:13248
- C:\Windows\System\PeGzheZ.exe
  C:\Windows\System\PeGzheZ.exe
  2⤵
  PID:13280
- C:\Windows\System\SCxzANl.exe
  C:\Windows\System\SCxzANl.exe
  2⤵
  PID:13304
- C:\Windows\System\daLzcnZ.exe
  C:\Windows\System\daLzcnZ.exe
  2⤵
  PID:11332
- C:\Windows\System\zPZvxZG.exe
  C:\Windows\System\zPZvxZG.exe
  2⤵
  PID:8636
- C:\Windows\System\AHwlJjI.exe
  C:\Windows\System\AHwlJjI.exe
  2⤵
  PID:11552
- C:\Windows\System\tnyLOsF.exe
  C:\Windows\System\tnyLOsF.exe
  2⤵
  PID:12156
- C:\Windows\System\WVDFyoS.exe
  C:\Windows\System\WVDFyoS.exe
  2⤵
  PID:11092
- C:\Windows\System\YTRBDEm.exe
  C:\Windows\System\YTRBDEm.exe
  2⤵
  PID:11596
- C:\Windows\System\rdonGfT.exe
  C:\Windows\System\rdonGfT.exe
  2⤵
  PID:1236
- C:\Windows\System\ECanbeU.exe
  C:\Windows\System\ECanbeU.exe
  2⤵
  PID:11964
- C:\Windows\System\TdCcMVd.exe
  C:\Windows\System\TdCcMVd.exe
  2⤵
  PID:12016
- C:\Windows\System\NRUvQyY.exe
  C:\Windows\System\NRUvQyY.exe
  2⤵
  PID:12348
- C:\Windows\System\ZArAhoV.exe
  C:\Windows\System\ZArAhoV.exe
  2⤵
  PID:11396
- C:\Windows\System\aEXNyJL.exe
  C:\Windows\System\aEXNyJL.exe
  2⤵
  PID:12412
- C:\Windows\System\MGiRZYc.exe
  C:\Windows\System\MGiRZYc.exe
  2⤵
  PID:12468
- C:\Windows\System\NjvhAWR.exe
  C:\Windows\System\NjvhAWR.exe
  2⤵
  PID:12488
- C:\Windows\System\iFtPakd.exe
  C:\Windows\System\iFtPakd.exe
  2⤵
  PID:12264
- C:\Windows\System\AJUYdGC.exe
  C:\Windows\System\AJUYdGC.exe
  2⤵
  PID:9448
- C:\Windows\System\LDIcQJo.exe
  C:\Windows\System\LDIcQJo.exe
  2⤵
  PID:12700
- C:\Windows\System\QceaMFC.exe
  C:\Windows\System\QceaMFC.exe
  2⤵
  PID:12436
- C:\Windows\System\uNsgbVH.exe
  C:\Windows\System\uNsgbVH.exe
  2⤵
  PID:12492
- C:\Windows\System\CGlVvmP.exe
  C:\Windows\System\CGlVvmP.exe
  2⤵
  PID:12904
- C:\Windows\System\uqTMqxS.exe
  C:\Windows\System\uqTMqxS.exe
  2⤵
  PID:12944
- C:\Windows\System\kzIRjDv.exe
  C:\Windows\System\kzIRjDv.exe
  2⤵
  PID:4356
- C:\Windows\System\ScNvHqA.exe
  C:\Windows\System\ScNvHqA.exe
  2⤵
  PID:1568
- C:\Windows\System\uAPhHGB.exe
  C:\Windows\System\uAPhHGB.exe
  2⤵
  PID:12656
- C:\Windows\System\pkFphhi.exe
  C:\Windows\System\pkFphhi.exe
  2⤵
  PID:12724
- C:\Windows\System\zYLGioy.exe
  C:\Windows\System\zYLGioy.exe
  2⤵
  PID:13220
- C:\Windows\System\ohfpkkn.exe
  C:\Windows\System\ohfpkkn.exe
  2⤵
  PID:12856
- C:\Windows\System\MvaHCXs.exe
  C:\Windows\System\MvaHCXs.exe
  2⤵
  PID:12964
- C:\Windows\System\ZaoQXnc.exe
  C:\Windows\System\ZaoQXnc.exe
  2⤵
  PID:12988
- C:\Windows\System\LUitPaz.exe
  C:\Windows\System\LUitPaz.exe
  2⤵
  PID:12224
- C:\Windows\System\AToTDFO.exe
  C:\Windows\System\AToTDFO.exe
  2⤵
  PID:12100
- C:\Windows\System\MuLpGmX.exe
  C:\Windows\System\MuLpGmX.exe
  2⤵
  PID:13328
- C:\Windows\System\ABuiTcY.exe
  C:\Windows\System\ABuiTcY.exe
  2⤵
  PID:13352
- C:\Windows\System\uDxgBNv.exe
  C:\Windows\System\uDxgBNv.exe
  2⤵
  PID:13384
- C:\Windows\System\JTcHLhn.exe
  C:\Windows\System\JTcHLhn.exe
  2⤵
  PID:13408
- C:\Windows\System\gUJoXYe.exe
  C:\Windows\System\gUJoXYe.exe
  2⤵
  PID:13440
- C:\Windows\System\JYdtqvx.exe
  C:\Windows\System\JYdtqvx.exe
  2⤵
  PID:13464
- C:\Windows\System\SxFtVAD.exe
  C:\Windows\System\SxFtVAD.exe
  2⤵
  PID:13496
- C:\Windows\System\WvlPiKj.exe
  C:\Windows\System\WvlPiKj.exe
  2⤵
  PID:13528
- C:\Windows\System\mKjeNas.exe
  C:\Windows\System\mKjeNas.exe
  2⤵
  PID:13556
- C:\Windows\System\GrGqfFO.exe
  C:\Windows\System\GrGqfFO.exe
  2⤵
  PID:13576
- C:\Windows\System\JnLXpWM.exe
  C:\Windows\System\JnLXpWM.exe
  2⤵
  PID:13600
- C:\Windows\System\dUhPThI.exe
  C:\Windows\System\dUhPThI.exe
  2⤵
  PID:13624
- C:\Windows\System\gnBWgsR.exe
  C:\Windows\System\gnBWgsR.exe
  2⤵
  PID:13648
- C:\Windows\System\pVjFhhr.exe
  C:\Windows\System\pVjFhhr.exe
  2⤵
  PID:13668
- C:\Windows\System\QvBbnJC.exe
  C:\Windows\System\QvBbnJC.exe
  2⤵
  PID:13692
- C:\Windows\System\bNyWHoV.exe
  C:\Windows\System\bNyWHoV.exe
  2⤵
  PID:13720
- C:\Windows\System\TVGqflR.exe
  C:\Windows\System\TVGqflR.exe
  2⤵
  PID:13748
- C:\Windows\System\GtXRBee.exe
  C:\Windows\System\GtXRBee.exe
  2⤵
  PID:13768
- C:\Windows\System\KDKCVRI.exe
  C:\Windows\System\KDKCVRI.exe
  2⤵
  PID:13796
- C:\Windows\System\pjCFJSo.exe
  C:\Windows\System\pjCFJSo.exe
  2⤵
  PID:13824
- C:\Windows\System\dqaqnSa.exe
  C:\Windows\System\dqaqnSa.exe
  2⤵
  PID:13848
- C:\Windows\System\aUACFgo.exe
  C:\Windows\System\aUACFgo.exe
  2⤵
  PID:13876
- C:\Windows\System\oRjHeRD.exe
  C:\Windows\System\oRjHeRD.exe
  2⤵
  PID:13900
- C:\Windows\System\WTpcCUs.exe
  C:\Windows\System\WTpcCUs.exe
  2⤵
  PID:13920
- C:\Windows\System\pNohLQG.exe
  C:\Windows\System\pNohLQG.exe
  2⤵
  PID:13940
- C:\Windows\System\HZHypnr.exe
  C:\Windows\System\HZHypnr.exe
  2⤵
  PID:13968
- C:\Windows\System\ntlwpEd.exe
  C:\Windows\System\ntlwpEd.exe
  2⤵
  PID:14000
- C:\Windows\System\FjPZNWo.exe
  C:\Windows\System\FjPZNWo.exe
  2⤵
  PID:14020
- C:\Windows\System\sYDUlNJ.exe
  C:\Windows\System\sYDUlNJ.exe
  2⤵
  PID:14052
- C:\Windows\System\IoWCroD.exe
  C:\Windows\System\IoWCroD.exe
  2⤵
  PID:14076
- C:\Windows\System\JvbgwZc.exe
  C:\Windows\System\JvbgwZc.exe
  2⤵
  PID:14112
- C:\Windows\System\jTwPMzC.exe
  C:\Windows\System\jTwPMzC.exe
  2⤵
  PID:14148
- C:\Windows\System\vFdTKNZ.exe
  C:\Windows\System\vFdTKNZ.exe
  2⤵
  PID:14168
- C:\Windows\System\hgnnjRl.exe
  C:\Windows\System\hgnnjRl.exe
  2⤵
  PID:14192
- C:\Windows\System\uyWvnBj.exe
  C:\Windows\System\uyWvnBj.exe
  2⤵
  PID:14216
- C:\Windows\System\QsDBuKc.exe
  C:\Windows\System\QsDBuKc.exe
  2⤵
  PID:14240
- C:\Windows\System\OdyZpnV.exe
  C:\Windows\System\OdyZpnV.exe
  2⤵
  PID:14260
- C:\Windows\System\MAzpCdJ.exe
  C:\Windows\System\MAzpCdJ.exe
  2⤵
  PID:14284
- C:\Windows\System\pEdTlQz.exe
  C:\Windows\System\pEdTlQz.exe
  2⤵
  PID:14308
- C:\Windows\System\poVSWjr.exe
  C:\Windows\System\poVSWjr.exe
  2⤵
  PID:13164
- C:\Windows\System\ITSTcug.exe
  C:\Windows\System\ITSTcug.exe
  2⤵
  PID:12464
- C:\Windows\System\NPSgTkN.exe
  C:\Windows\System\NPSgTkN.exe
  2⤵
  PID:13192
- C:\Windows\System\zYgJQUY.exe
  C:\Windows\System\zYgJQUY.exe
  2⤵
  PID:11440
- C:\Windows\System\LxTsUfv.exe
  C:\Windows\System\LxTsUfv.exe
  2⤵
  PID:11312
- C:\Windows\System\VpfqZsY.exe
  C:\Windows\System\VpfqZsY.exe
  2⤵
  PID:12148
- C:\Windows\System\skQxsNR.exe
  C:\Windows\System\skQxsNR.exe
  2⤵
  PID:12144
- C:\Windows\System\BpTxrJA.exe
  C:\Windows\System\BpTxrJA.exe
  2⤵
  PID:12036
- C:\Windows\System\kmkaIEL.exe
  C:\Windows\System\kmkaIEL.exe
  2⤵
  PID:12380
- C:\Windows\System\NWaaJfE.exe
  C:\Windows\System\NWaaJfE.exe
  2⤵
  PID:9552
- C:\Windows\System\YNlQEEW.exe
  C:\Windows\System\YNlQEEW.exe
  2⤵
  PID:13436
- C:\Windows\System\FqCeVjL.exe
  C:\Windows\System\FqCeVjL.exe
  2⤵
  PID:10536
- C:\Windows\System\rYiqHEf.exe
  C:\Windows\System\rYiqHEf.exe
  2⤵
  PID:13552
- C:\Windows\System\CvZaFGg.exe
  C:\Windows\System\CvZaFGg.exe
  2⤵
  PID:13608
- C:\Windows\System\MdHfBcN.exe
  C:\Windows\System\MdHfBcN.exe
  2⤵
  PID:12768
- C:\Windows\System\IzgqCBW.exe
  C:\Windows\System\IzgqCBW.exe
  2⤵
  PID:12848
- C:\Windows\System\Tkrnnem.exe
  C:\Windows\System\Tkrnnem.exe
  2⤵
  PID:13740
- C:\Windows\System\KyUGDRD.exe
  C:\Windows\System\KyUGDRD.exe
  2⤵
  PID:11880
- C:\Windows\System\eUZAbiv.exe
  C:\Windows\System\eUZAbiv.exe
  2⤵
  PID:13868
- C:\Windows\System\DXkUdQS.exe
  C:\Windows\System\DXkUdQS.exe
  2⤵
  PID:13888
- C:\Windows\System\yMzQelm.exe
  C:\Windows\System\yMzQelm.exe
  2⤵
  PID:13340
- C:\Windows\System\NqFKoeF.exe
  C:\Windows\System\NqFKoeF.exe
  2⤵
  PID:12332
- C:\Windows\System\TAWowCV.exe
  C:\Windows\System\TAWowCV.exe
  2⤵
  PID:14068
- C:\Windows\System\rafEjOM.exe
  C:\Windows\System\rafEjOM.exe
  2⤵
  PID:13480
- C:\Windows\System\buMFTme.exe
  C:\Windows\System\buMFTme.exe
  2⤵
  PID:13520
- C:\Windows\System\XfpMleu.exe
  C:\Windows\System\XfpMleu.exe
  2⤵
  PID:14188
- C:\Windows\System\DbHPxYu.exe
  C:\Windows\System\DbHPxYu.exe
  2⤵
  PID:13616
- C:\Windows\System\POCAOyx.exe
  C:\Windows\System\POCAOyx.exe
  2⤵
  PID:14276
- C:\Windows\System\vJEhrCp.exe
  C:\Windows\System\vJEhrCp.exe
  2⤵
  PID:13180
- C:\Windows\System\haTCrQm.exe
  C:\Windows\System\haTCrQm.exe
  2⤵
  PID:12836
- C:\Windows\System\nxPqOHn.exe
  C:\Windows\System\nxPqOHn.exe
  2⤵
  PID:13808
- C:\Windows\System\HZrHBsw.exe
  C:\Windows\System\HZrHBsw.exe
  2⤵
  PID:13080
- C:\Windows\System\xuKGUfk.exe
  C:\Windows\System\xuKGUfk.exe
  2⤵
  PID:14356
- C:\Windows\System\rCPKUeh.exe
  C:\Windows\System\rCPKUeh.exe
  2⤵
  PID:14384
- C:\Windows\System\YLhNTgK.exe
  C:\Windows\System\YLhNTgK.exe
  2⤵
  PID:14408
- C:\Windows\System\CBJHdnz.exe
  C:\Windows\System\CBJHdnz.exe
  2⤵
  PID:14436
- C:\Windows\System\ckoublO.exe
  C:\Windows\System\ckoublO.exe
  2⤵
  PID:14452
- C:\Windows\System\RRZlmFU.exe
  C:\Windows\System\RRZlmFU.exe
  2⤵
  PID:14480
- C:\Windows\System\bQlCnAx.exe
  C:\Windows\System\bQlCnAx.exe
  2⤵
  PID:14496
- C:\Windows\System\BeqRmiO.exe
  C:\Windows\System\BeqRmiO.exe
  2⤵
  PID:14520
- C:\Windows\System\tIHkOTG.exe
  C:\Windows\System\tIHkOTG.exe
  2⤵
  PID:14540
- C:\Windows\System\LAaPDZS.exe
  C:\Windows\System\LAaPDZS.exe
  2⤵
  PID:14556
- C:\Windows\System\NzRtAUe.exe
  C:\Windows\System\NzRtAUe.exe
  2⤵
  PID:14584
- C:\Windows\System\sRamcwF.exe
  C:\Windows\System\sRamcwF.exe
  2⤵
  PID:14604
- C:\Windows\System\lfVxADG.exe
  C:\Windows\System\lfVxADG.exe
  2⤵
  PID:14632
- C:\Windows\System\ZKgHyye.exe
  C:\Windows\System\ZKgHyye.exe
  2⤵
  PID:14664
- C:\Windows\System\fNBMwua.exe
  C:\Windows\System\fNBMwua.exe
  2⤵
  PID:14688
- C:\Windows\System\sESIqSW.exe
  C:\Windows\System\sESIqSW.exe
  2⤵
  PID:14716
- C:\Windows\System\JzvxhVe.exe
  C:\Windows\System\JzvxhVe.exe
  2⤵
  PID:14740
- C:\Windows\System\SnlCKJM.exe
  C:\Windows\System\SnlCKJM.exe
  2⤵
  PID:14764
- C:\Windows\System\shKQxQH.exe
  C:\Windows\System\shKQxQH.exe
  2⤵
  PID:14780
- C:\Windows\System\PHIBggZ.exe
  C:\Windows\System\PHIBggZ.exe
  2⤵
  PID:14808
- C:\Windows\System\LpyTIXu.exe
  C:\Windows\System\LpyTIXu.exe
  2⤵
  PID:14828
- C:\Windows\System\LAXAmyk.exe
  C:\Windows\System\LAXAmyk.exe
  2⤵
  PID:14860
- C:\Windows\System\zWTXbIZ.exe
  C:\Windows\System\zWTXbIZ.exe
  2⤵
  PID:14884
- C:\Windows\System\jyeBHHK.exe
  C:\Windows\System\jyeBHHK.exe
  2⤵
  PID:14908
- C:\Windows\System\BMXjgDZ.exe
  C:\Windows\System\BMXjgDZ.exe
  2⤵
  PID:14928
- C:\Windows\System\CNVwexC.exe
  C:\Windows\System\CNVwexC.exe
  2⤵
  PID:14952
- C:\Windows\System\eAhNFXx.exe
  C:\Windows\System\eAhNFXx.exe
  2⤵
  PID:14984
- C:\Windows\System\stgoXQt.exe
  C:\Windows\System\stgoXQt.exe
  2⤵
  PID:15020
- C:\Windows\System\knDcOJM.exe
  C:\Windows\System\knDcOJM.exe
  2⤵
  PID:15048
- C:\Windows\System\nevvCrR.exe
  C:\Windows\System\nevvCrR.exe
  2⤵
  PID:15068
- C:\Windows\System\WPrdmIq.exe
  C:\Windows\System\WPrdmIq.exe
  2⤵
  PID:15092
- C:\Windows\System\zjGtnEN.exe
  C:\Windows\System\zjGtnEN.exe
  2⤵
  PID:15116
- C:\Windows\System\dzuDKyR.exe
  C:\Windows\System\dzuDKyR.exe
  2⤵
  PID:15136
- C:\Windows\System\XQeLlvZ.exe
  C:\Windows\System\XQeLlvZ.exe
  2⤵
  PID:15160
- C:\Windows\System\cnwCUDt.exe
  C:\Windows\System\cnwCUDt.exe
  2⤵
  PID:15188
- C:\Windows\System\DsldIkq.exe
  C:\Windows\System\DsldIkq.exe
  2⤵
  PID:15220
- C:\Windows\System\CgpHtjA.exe
  C:\Windows\System\CgpHtjA.exe
  2⤵
  PID:15244
- C:\Windows\System\IAIGHbk.exe
  C:\Windows\System\IAIGHbk.exe
  2⤵
  PID:15268
- C:\Windows\System\nHyPolp.exe
  C:\Windows\System\nHyPolp.exe
  2⤵
  PID:15292
- C:\Windows\System\FVlDVcG.exe
  C:\Windows\System\FVlDVcG.exe
  2⤵
  PID:15320
- C:\Windows\System\xrijgWC.exe
  C:\Windows\System\xrijgWC.exe
  2⤵
  PID:15352
- C:\Windows\System\lEbtRXo.exe
  C:\Windows\System\lEbtRXo.exe
  2⤵
  PID:13916
- C:\Windows\System\RAlKngP.exe
  C:\Windows\System\RAlKngP.exe
  2⤵
  PID:13548
- C:\Windows\System\FgWKyIo.exe
  C:\Windows\System\FgWKyIo.exe
  2⤵
  PID:10344
- C:\Windows\System\dgtXGHH.exe
  C:\Windows\System\dgtXGHH.exe
  2⤵
  PID:13316
- C:\Windows\System\SqKqOzY.exe
  C:\Windows\System\SqKqOzY.exe
  2⤵
  PID:13376
- C:\Windows\System\AcbYIKG.exe
  C:\Windows\System\AcbYIKG.exe
  2⤵
  PID:13656
- C:\Windows\System\ZMReHOk.exe
  C:\Windows\System\ZMReHOk.exe
  2⤵
  PID:13688
- C:\Windows\System\nLFlrER.exe
  C:\Windows\System\nLFlrER.exe
  2⤵
  PID:13188
- C:\Windows\System\UwBPISy.exe
  C:\Windows\System\UwBPISy.exe
  2⤵
  PID:13784
- C:\Windows\System\kTTZcyI.exe
  C:\Windows\System\kTTZcyI.exe
  2⤵
  PID:13404
- C:\Windows\System\eXowkDo.exe
  C:\Windows\System\eXowkDo.exe
  2⤵
  PID:14444
- C:\Windows\System\MGpFraU.exe
  C:\Windows\System\MGpFraU.exe
  2⤵
  PID:13256
- C:\Windows\System\aaqspdN.exe
  C:\Windows\System\aaqspdN.exe
  2⤵
  PID:14628
- C:\Windows\System\MdiBqPH.exe
  C:\Windows\System\MdiBqPH.exe
  2⤵
  PID:14320
- C:\Windows\System\DabfZLU.exe
  C:\Windows\System\DabfZLU.exe
  2⤵
  PID:12748
- C:\Windows\System\AeosnJY.exe
  C:\Windows\System\AeosnJY.exe
  2⤵
  PID:13596
- C:\Windows\System\WdTvAsa.exe
  C:\Windows\System\WdTvAsa.exe
  2⤵
  PID:14924
- C:\Windows\System\TwJsmcb.exe
  C:\Windows\System\TwJsmcb.exe
  2⤵
  PID:5008
- C:\Windows\System\qOTasuI.exe
  C:\Windows\System\qOTasuI.exe
  2⤵
  PID:12552
- C:\Windows\System\updtffa.exe
  C:\Windows\System\updtffa.exe
  2⤵
  PID:15368
- C:\Windows\System\SBzHKEZ.exe
  C:\Windows\System\SBzHKEZ.exe
  2⤵
  PID:15388
- C:\Windows\System\sKEJuJW.exe
  C:\Windows\System\sKEJuJW.exe
  2⤵
  PID:15412
- C:\Windows\System\FffpTIx.exe
  C:\Windows\System\FffpTIx.exe
  2⤵
  PID:15428
- C:\Windows\System\nAvPjTy.exe
  C:\Windows\System\nAvPjTy.exe
  2⤵
  PID:15460
- C:\Windows\System\HHLjbNQ.exe
  C:\Windows\System\HHLjbNQ.exe
  2⤵
  PID:15488
- C:\Windows\System\HSBPWge.exe
  C:\Windows\System\HSBPWge.exe
  2⤵
  PID:15520
- C:\Windows\System\aaDFFTQ.exe
  C:\Windows\System\aaDFFTQ.exe
  2⤵
  PID:15552
- C:\Windows\System\jdFtKpf.exe
  C:\Windows\System\jdFtKpf.exe
  2⤵
  PID:15580
- C:\Windows\System\qlQrDaK.exe
  C:\Windows\System\qlQrDaK.exe
  2⤵
  PID:15596
- C:\Windows\System\PyvpdQV.exe
  C:\Windows\System\PyvpdQV.exe
  2⤵
  PID:15620
- C:\Windows\System\gztdTOb.exe
  C:\Windows\System\gztdTOb.exe
  2⤵
  PID:15652
- C:\Windows\System\JrnUtAs.exe
  C:\Windows\System\JrnUtAs.exe
  2⤵
  PID:15676
- C:\Windows\System\ykiREYU.exe
  C:\Windows\System\ykiREYU.exe
  2⤵
  PID:15712
- C:\Windows\System\kkVdqWR.exe
  C:\Windows\System\kkVdqWR.exe
  2⤵
  PID:15748
- C:\Windows\System\UzCLQqk.exe
  C:\Windows\System\UzCLQqk.exe
  2⤵
  PID:15780
- C:\Windows\System\VoKrOUQ.exe
  C:\Windows\System\VoKrOUQ.exe
  2⤵
  PID:15812
- C:\Windows\System\qUMrpfT.exe
  C:\Windows\System\qUMrpfT.exe
  2⤵
  PID:15840
- C:\Windows\System\eLjzbDi.exe
  C:\Windows\System\eLjzbDi.exe
  2⤵
  PID:15856
- C:\Windows\System\uMuwgsQ.exe
  C:\Windows\System\uMuwgsQ.exe
  2⤵
  PID:15884
- C:\Windows\System\iORPnse.exe
  C:\Windows\System\iORPnse.exe
  2⤵
  PID:15916
- C:\Windows\System\JJRFCrA.exe
  C:\Windows\System\JJRFCrA.exe
  2⤵
  PID:15936
- C:\Windows\System\WiHdfow.exe
  C:\Windows\System\WiHdfow.exe
  2⤵
  PID:15960
- C:\Windows\System\ZQyAYqa.exe
  C:\Windows\System\ZQyAYqa.exe
  2⤵
  PID:15984
- C:\Windows\System\phGQWgR.exe
  C:\Windows\System\phGQWgR.exe
  2⤵
  PID:16020
- C:\Windows\System\nKYsBEe.exe
  C:\Windows\System\nKYsBEe.exe
  2⤵
  PID:16040
- C:\Windows\System\BDEVTmY.exe
  C:\Windows\System\BDEVTmY.exe
  2⤵
  PID:16064
- C:\Windows\System\JLWSJaF.exe
  C:\Windows\System\JLWSJaF.exe
  2⤵
  PID:16080
- C:\Windows\System\hGdVNcK.exe
  C:\Windows\System\hGdVNcK.exe
  2⤵
  PID:16112
- C:\Windows\System\jMQKBqJ.exe
  C:\Windows\System\jMQKBqJ.exe
  2⤵
  PID:16132
- C:\Windows\System\wqYrOhA.exe
  C:\Windows\System\wqYrOhA.exe
  2⤵
  PID:16168
- C:\Windows\System\poUKaJt.exe
  C:\Windows\System\poUKaJt.exe
  2⤵
  PID:16196
- C:\Windows\System\FEtHdsk.exe
  C:\Windows\System\FEtHdsk.exe
  2⤵
  PID:16212
- C:\Windows\System\BAdATrc.exe
  C:\Windows\System\BAdATrc.exe
  2⤵
  PID:16236
- C:\Windows\System\izCDLxo.exe
  C:\Windows\System\izCDLxo.exe
  2⤵
  PID:16256
- C:\Windows\System\NloGDxm.exe
  C:\Windows\System\NloGDxm.exe
  2⤵
  PID:16284
- C:\Windows\System\sWngDLg.exe
  C:\Windows\System\sWngDLg.exe
  2⤵
  PID:16308
- C:\Windows\System\wVmRyLd.exe
  C:\Windows\System\wVmRyLd.exe
  2⤵
  PID:16336
- C:\Windows\System\fRPEBuQ.exe
  C:\Windows\System\fRPEBuQ.exe
  2⤵
  PID:16364
- C:\Windows\System\GTBxNHm.exe
  C:\Windows\System\GTBxNHm.exe
  2⤵
  PID:16380
- C:\Windows\System\SsQZVUe.exe
  C:\Windows\System\SsQZVUe.exe
  2⤵
  PID:12588
- C:\Windows\System\QxDSHjU.exe
  C:\Windows\System\QxDSHjU.exe
  2⤵
  PID:15208
- C:\Windows\System\JmMipWV.exe
  C:\Windows\System\JmMipWV.exe
  2⤵
  PID:14672
- C:\Windows\System\WkhhFGU.exe
  C:\Windows\System\WkhhFGU.exe
  2⤵
  PID:12528
- C:\Windows\System\otgtXyL.exe
  C:\Windows\System\otgtXyL.exe
  2⤵
  PID:13460
- C:\Windows\System\fBVCqdp.exe
  C:\Windows\System\fBVCqdp.exe
  2⤵
  PID:14820
- C:\Windows\System\vCBfcxw.exe
  C:\Windows\System\vCBfcxw.exe
  2⤵
  PID:13400
- C:\Windows\System\jHaHgGU.exe
  C:\Windows\System\jHaHgGU.exe
  2⤵
  PID:13260
- C:\Windows\System\wPCPzii.exe
  C:\Windows\System\wPCPzii.exe
  2⤵
  PID:12892
- C:\Windows\System\UsteGcx.exe
  C:\Windows\System\UsteGcx.exe
  2⤵
  PID:14904
- C:\Windows\System\eMeWodR.exe
  C:\Windows\System\eMeWodR.exe
  2⤵
  PID:15384
- C:\Windows\System\DAYSegW.exe
  C:\Windows\System\DAYSegW.exe
  2⤵
  PID:15424
- C:\Windows\System\efrUwcK.exe
  C:\Windows\System\efrUwcK.exe
  2⤵
  PID:15108
- C:\Windows\System\tqiCGyf.exe
  C:\Windows\System\tqiCGyf.exe
  2⤵
  PID:15484
- C:\Windows\System\azvSoCo.exe
  C:\Windows\System\azvSoCo.exe
  2⤵
  PID:15532
- C:\Windows\System\kOsxcYo.exe
  C:\Windows\System\kOsxcYo.exe
  2⤵
  PID:14548
- C:\Windows\System\qdZCyvC.exe
  C:\Windows\System\qdZCyvC.exe
  2⤵
  PID:15252
- C:\Windows\System\glBZElN.exe
  C:\Windows\System\glBZElN.exe
  2⤵
  PID:15688
- C:\Windows\System\ffLjpeD.exe
  C:\Windows\System\ffLjpeD.exe
  2⤵
  PID:15332
- C:\Windows\System\wwMFrsI.exe
  C:\Windows\System\wwMFrsI.exe
  2⤵
  PID:13272
- C:\Windows\System\kdohcZX.exe
  C:\Windows\System\kdohcZX.exe
  2⤵
  PID:14792
- C:\Windows\System\OnoQgpn.exe
  C:\Windows\System\OnoQgpn.exe
  2⤵
  PID:14228
- C:\Windows\System\vUBbGZQ.exe
  C:\Windows\System\vUBbGZQ.exe
  2⤵
  PID:16000
- C:\Windows\System\EBUViAt.exe
  C:\Windows\System\EBUViAt.exe
  2⤵
  PID:14516
- C:\Windows\System\VIrptZE.exe
  C:\Windows\System\VIrptZE.exe
  2⤵
  PID:14684
- C:\Windows\System\EThMcUw.exe
  C:\Windows\System\EThMcUw.exe
  2⤵
  PID:14816
- C:\Windows\System\XolOrZP.exe
  C:\Windows\System\XolOrZP.exe
  2⤵
  PID:16404
- C:\Windows\System\APMVdtK.exe
  C:\Windows\System\APMVdtK.exe
  2⤵
  PID:16420
- C:\Windows\System\LLXFutC.exe
  C:\Windows\System\LLXFutC.exe
  2⤵
  PID:16456
- C:\Windows\System\qILVTOU.exe
  C:\Windows\System\qILVTOU.exe
  2⤵
  PID:16496
- C:\Windows\System\vEXBYbt.exe
  C:\Windows\System\vEXBYbt.exe
  2⤵
  PID:16512
- C:\Windows\System\YANhCwz.exe
  C:\Windows\System\YANhCwz.exe
  2⤵
  PID:16532
- C:\Windows\System\HBjivGo.exe
  C:\Windows\System\HBjivGo.exe
  2⤵
  PID:16568
- C:\Windows\System\AbcQrQM.exe
  C:\Windows\System\AbcQrQM.exe
  2⤵
  PID:16596
- C:\Windows\System\mpowUTe.exe
  C:\Windows\System\mpowUTe.exe
  2⤵
  PID:16612
- C:\Windows\System\jblxffD.exe
  C:\Windows\System\jblxffD.exe
  2⤵
  PID:16648
- C:\Windows\System\wrqItLA.exe
  C:\Windows\System\wrqItLA.exe
  2⤵
  PID:16668
- C:\Windows\System\ngFApls.exe
  C:\Windows\System\ngFApls.exe
  2⤵
  PID:16692
- C:\Windows\System\lCesuAY.exe
  C:\Windows\System\lCesuAY.exe
  2⤵
  PID:16712
- C:\Windows\System\EyKlAFs.exe
  C:\Windows\System\EyKlAFs.exe
  2⤵
  PID:16736
- C:\Windows\System\fQAxPKd.exe
  C:\Windows\System\fQAxPKd.exe
  2⤵
  PID:16756
- C:\Windows\System\LQSWGYa.exe
  C:\Windows\System\LQSWGYa.exe
  2⤵
  PID:16788
- C:\Windows\System\gUQYINr.exe
  C:\Windows\System\gUQYINr.exe
  2⤵
  PID:16816
- C:\Windows\System\YbcIhpW.exe
  C:\Windows\System\YbcIhpW.exe
  2⤵
  PID:16840
- C:\Windows\System\GumKDpU.exe
  C:\Windows\System\GumKDpU.exe
  2⤵
  PID:16872
- C:\Windows\System\jnKwKHu.exe
  C:\Windows\System\jnKwKHu.exe
  2⤵
  PID:16896
- C:\Windows\System\ZGCZYdo.exe
  C:\Windows\System\ZGCZYdo.exe
  2⤵
  PID:16916
- C:\Windows\System\WqkfQaE.exe
  C:\Windows\System\WqkfQaE.exe
  2⤵
  PID:16940
- C:\Windows\System\kYlojhG.exe
  C:\Windows\System\kYlojhG.exe
  2⤵
  PID:16956
- C:\Windows\System\nNXLghf.exe
  C:\Windows\System\nNXLghf.exe
  2⤵
  PID:16980
- C:\Windows\System\iBQzceJ.exe
  C:\Windows\System\iBQzceJ.exe
  2⤵
  PID:17012
- C:\Windows\System\QVMJulD.exe
  C:\Windows\System\QVMJulD.exe
  2⤵
  PID:17040
- C:\Windows\System\lLOEWUw.exe
  C:\Windows\System\lLOEWUw.exe
  2⤵
  PID:17064
- C:\Windows\System\vQHFaxV.exe
  C:\Windows\System\vQHFaxV.exe
  2⤵
  PID:17088
- C:\Windows\System\PmFMhnX.exe
  C:\Windows\System\PmFMhnX.exe
  2⤵
  PID:17112
- C:\Windows\System\IgZGbgH.exe
  C:\Windows\System\IgZGbgH.exe
  2⤵
  PID:17136
- C:\Windows\System\SHwYOcL.exe
  C:\Windows\System\SHwYOcL.exe
  2⤵
  PID:17168
- C:\Windows\System\kRdMxfn.exe
  C:\Windows\System\kRdMxfn.exe
  2⤵
  PID:17188
- C:\Windows\System\dKdZAYg.exe
  C:\Windows\System\dKdZAYg.exe
  2⤵
  PID:17212
- C:\Windows\System\oYYOdJC.exe
  C:\Windows\System\oYYOdJC.exe
  2⤵
  PID:17240
- C:\Windows\System\JJbfZud.exe
  C:\Windows\System\JJbfZud.exe
  2⤵
  PID:17264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AeDyGfx.exe

Filesize
1.0MB

MD5
4eb9ef9427755b3737e4eb27fdbe2258

SHA1
a161643b26a6b5c1b0d3bf2003e01e833ff922be

SHA256
924b9a1510126549869889f231033c8502ce3663e46bf8e2718ab5f30921b501

SHA512
301d6f67347e29830feb1aaa254b39d383aa05fabf6c3927894205b5744928ab0f29305bca8966c6611572643284cf908e1777e831ae9ac676ce779813bcbb1a

Download Submit
C:\Windows\System\CUglRmg.exe

Filesize
1.0MB

MD5
eb15189008d737013d45579641d8fa82

SHA1
8c4395804ff2a7570035f5da15f2ab5a7ba8bd09

SHA256
c1c5da338c2691d43cb28564ecbd82ca5cb4e858c89b6ad9e9a746aec764adb4

SHA512
22f864c3e153da47c0860686ab8789ac066bfafdcda521de56be0f1bf74b22df3dcea32e954c4b0a78fdb4817ade47806248914f247db2618534607c9bbb744d

Download Submit
C:\Windows\System\DXCeqeo.exe

Filesize
1.0MB

MD5
da814bb53ac50d129c20814a711100eb

SHA1
c403eff29401bf21d4f117bc16d82d8c0970d83c

SHA256
1bf824ea1508536e16f36b5fbb9498e67134b91a7570e84e3c6d27ae284ba200

SHA512
2b8bf13773a98182db7f71d71d87a97358352833f1af72cba1ce32335e42718a4af6749d0a8ad5a350688bc308802dfe505949593dc95a094c96320f119a3a5f

Download Submit
C:\Windows\System\DzKUxry.exe

Filesize
1.0MB

MD5
18ea14329db64a993859643d29666543

SHA1
c6a36ea0ecb56b999dd9f06e7fa9622802593cb6

SHA256
81b9f0cb7dbcc05a7ff510df429e6c86c3e58e43bd9006caeed011cd4b06f43d

SHA512
b94af3892a936eaac352141eda09d5e6ce025db4242d0a61fc1269075a5334569b394df170ce5113698a3dd6bf7cbd68d2347f5c3ebf727d49628989b8f3d128

Download Submit
C:\Windows\System\IxkyDhB.exe

Filesize
1.0MB

MD5
b9fe14f0f8f24ca74895b9624479d9f4

SHA1
d85dc51cc13d2ba95095dda81ff631dc10db2dc8

SHA256
2a2b8340c088340cb84d81771de98b9d14606da6acd7f0ac1f2ddfa5205702af

SHA512
fc9f74eaea8dd5b039d236f39987b5b03f4114b0e2bfaddedec3ea1bc5cefb79e7b052477e2203600f889c72722e7ff8f070993e3cc61a45fb3711984447e37c

Download Submit
C:\Windows\System\NGZFNOO.exe

Filesize
1.0MB

MD5
608c025e5733f2ced5b7568395376eb6

SHA1
8b592456540887643e5762daca10387721d3caa6

SHA256
fef580a476e176ecb7ced57b9bf36fb66d12f03aeff7280b93531aabc5f525ab

SHA512
fbf5e29b5505b03cd05e6e9664a766691a726fb7e87ccfdf8c072a31216c444bbf0ee1975dd038c5cd9f6a62bc03f01fe867a49c18ced6a39e1fba57cd9bd5d6

Download Submit
C:\Windows\System\PJMBFHX.exe

Filesize
1.0MB

MD5
76e716dcd7972a8cd9fd248a735b6f7f

SHA1
909e7e1398931b26af3bee51388db300ae3d5d8b

SHA256
fd60933496f8abe8a339de5f5f0da4143c977172497f642776820822677a4ef2

SHA512
d1520a687b18a71f84fe479d241d12be5ac344876e77f96a7e00ae2c5ce36a043705f1ca9fc80abfd20c29d97b280a82efb80d29432af5d0183cd8407fced9d8

Download Submit
C:\Windows\System\QfNINik.exe

Filesize
1.0MB

MD5
2bc9015ec1a1cdfe4240f400b73b4b0b

SHA1
dd003b75e07477800c946f4f47e7e346d908a20b

SHA256
672dba6edb2fa59def592dfda470fc3122bb6d1fbfecfb61c19934be09e2dcd7

SHA512
d70ec66d1d443b5b94e22b208beb555dd966d13ace359699ccaf8298e656c639cf0e6610bca92522147d6fbb271fb83e37481d971ab3b91fbf75208f6ec80f5e

Download Submit
C:\Windows\System\UZINVwu.exe

Filesize
1.0MB

MD5
c1689d9a13c3d21cc20484e311767ed6

SHA1
885d6dfa218ea0d8914322981aa9bb0f3c93ca52

SHA256
51eacff81415dd9de6bf9fa9b70103a859246b440b9bbb9a2e55667ec9279924

SHA512
30930ae7b880fa7657a6da0bea55931f2934202f33ac20d8683ac70e553d09ea05b5e7e4b799684eee49edbb0a4cd781a3a62464cbc60e4501fdfbd3efaa0d38

Download Submit
C:\Windows\System\Vjwscrn.exe

Filesize
1.0MB

MD5
ad4f3f21acabb2ba278b079c53a4a6f9

SHA1
95e64d50c726dc36031447411d1fd5c09c79a57e

SHA256
647d8b80bc9f51b8df7e4e5ce5dbb001b176aea0478e24ad430e2289346bb0f5

SHA512
6ab7ac79d77214b026bef7c9b50d16b8fa4866b5f5c6acec0b8017a93ea10ad25c37c3178d645708de4d1ba6795a4041db58917ab30c722f1be6e8754d5d39ab

Download Submit
C:\Windows\System\VyeGZLM.exe

Filesize
1.0MB

MD5
c45c0a8eb34381dadf410a3ef3226717

SHA1
56c49a5c5c22cb79758ec86e433124756d11583d

SHA256
b2c3c964e5a2b8a5fa2f0eb9692e91eaa2316113f6d9fabad2fc001533ef4c07

SHA512
6ff1f5681d6626df162c26849e2773fd8e73e31fce652531a4adcf5e54b7f6179b2d81cda9e6b4ae665e9fcb63c22abf7bf4f90c3c2dd2bbe77b3a4fb757409e

Download Submit
C:\Windows\System\XGyymws.exe

Filesize
1.0MB

MD5
03bff22ada9e385bb48687406b834dec

SHA1
78891de61e94e2d231bb4b4fb908e7c5359ef7fd

SHA256
da7fe0826d662037f00e294dfe52de16e3d006528831f9137b66f1ad473aa6c8

SHA512
6ef7607a8269cc78324f579791d395339eb6ff711c71aca6bc6b39a72d72b50c82f286fe6ae41f9d4bc6dbe66df17bba33015e67a82edf17ff6a6fb4b0b76d2b

Download Submit
C:\Windows\System\ZLBadht.exe

Filesize
1.0MB

MD5
f74abb5fdaffb3f5bacf6a620e745d20

SHA1
f23ee41314bd67b3b577d706e4f5a4cc8586b5d1

SHA256
889676e9e63937d5347bebc6cbb1be787375f21a85c2fa14bd5152356578c57c

SHA512
46081520c9199c8818d2cad11a498054eb041d4527ebf9cd21341b28d81717be1f17d0125771a0e072c5b991c02700a549cb7171c1e4fed955e194bc51a76202

Download Submit
C:\Windows\System\ZQoIWQz.exe

Filesize
1.0MB

MD5
20b40e08f3362a12878d24888e96bb24

SHA1
53b614482fa3f023e80f33a6b6e0f348240ebf8f

SHA256
7ed7ec8cf11b7f5e295f60f73a49f389f281184333993168003e2a4fe05e44f3

SHA512
a76484d9fcbb8180c79733fce790aefa1fc4f16b37115b56c0c4a4cf506412c70ed2fb44cfc3c09a827eba9fe5f59b81d182471d11bc360b07f1ad0344d42a51

Download Submit
C:\Windows\System\alJuIvR.exe

Filesize
1.0MB

MD5
657eb25f1c6e4dcbe087cdefcfcdfeb3

SHA1
8e491734c8079abcd970446339c9baed2c597430

SHA256
8549d6e182daa863d86a38eb4073d499dd411510d942791371dbdab05dc72a56

SHA512
9f8e0431209253f8ab82080285f4099852ce3c228ce5e0743a0164c58e9aa973f321b30df405c29344f7c1da259e4c4a68f20563079dd8397867689c6bde6f6c

Download Submit
C:\Windows\System\axzFJmj.exe

Filesize
1.0MB

MD5
4c1cd532c025004af8da7725a2e5f993

SHA1
9dacefd1b51aec6975623b9bbba78679140c83ef

SHA256
cf1684e00876494267283ab6b51de030737b0a28c3251e38821d53dc24be09d2

SHA512
4ceb5b4a5091d73138ac30e3f30b2b78d7b6081c1ec8e0545121cdde61da906151e0c48d6f5c639225c093c8b63d46af823c8502458bf3ac5889142e8c0fa31a

Download Submit
C:\Windows\System\bWQIsyu.exe

Filesize
1.0MB

MD5
18c13bc20f2deea2dc493980901d04df

SHA1
97925a4c73e4233f4808979009b076ad50aba521

SHA256
f5f971470bef339a12c467521c8483368e33e0576ea6ce09ca9ded418855f08f

SHA512
30eb17bb2681ec3a15649bc6400d84bb3d2e14e80ab0c05b08af509357859e216dc77f91fa0e40c9c396ba941f03d3cf7ed940125e3df06f73b4defa556c7c2b

Download Submit
C:\Windows\System\blNdhCR.exe

Filesize
1.0MB

MD5
16b5f6665a1e204668303287a3b08cc2

SHA1
d6e0df4bedef25ea32a916ec466e7e432cac7f67

SHA256
31dff3ab5452aa76b5a6fd8ea87980c8a5b7db77fecb9c674aa73ca3df773b54

SHA512
bfe5bec8445db47b4fc2859a8b74ac05c3f5ecbe4e194dca450182db59a3af2a1093e9da4c998bf0a9c72a674af34565cc4fbde1067c7a925d6c373cf87c1ef4

Download Submit
C:\Windows\System\diYJAla.exe

Filesize
1.0MB

MD5
d284d4fedde0fc12b1a1b1ceb2aba998

SHA1
5b3a07cdec737e2f4b636a106b2d6c333ece8ea2

SHA256
d6ed324afd63483f45a970a8360c83136a33098450130c5f63110cd1f9c68772

SHA512
06cc6708ba24a7e81c608b1e29d9ed3f1823d9e5d970b0ab1e587b6fb8126f7cec457a4e7dba011f7a424171d5ea23de29ddc60201dce5201510af5f364207f3

Download Submit
C:\Windows\System\dxkyFIF.exe

Filesize
1.0MB

MD5
ac753590224f8ea1803ae7cce3280783

SHA1
53f4b048ad1a6bc0f3106666a16a1674ed45cfd3

SHA256
1f36acce3ce377415b4c0b997dfe90bf1a7f30d91eac27ab0d941b4aa76c9067

SHA512
d2ae16bbbec20d76bbd9a110163c3b6b252cee3f09642832e2a91a9e14b868bfcb4f66304c64fa2e99c4dac27302119eb3edf1540dbcef2c2e3fd2911753527f

Download Submit
C:\Windows\System\fFhcWSm.exe

Filesize
1.0MB

MD5
cff7a3febfe25bf7b450c0f807bd9c20

SHA1
14903030f7c8dab9d6f4721a3a6942fd76639743

SHA256
c357e2481dba8369e8408695c532a98fe387036b463c39ccfcabfb84279501a8

SHA512
e51a0233c69c9c23eada10545638778f99fff89289d051845e08c403770ad50dd2586c1ae65935cd9841e5c3bc798ae2d09fa9a567d94c5be267eff12c6a6d1b

Download Submit
C:\Windows\System\kEOdlJt.exe

Filesize
1.0MB

MD5
23fb597da1084af615b5b23473f8b47c

SHA1
f4964bdc6f943be544ae5ce2b29a73997e69495f

SHA256
59bd55e038bbbddea2469df97eca9804eb32d547f73b0563b017aaacf5db9212

SHA512
16c08aa90f0b000c72c98dbe7e6948b57fa025607c30a6e3a4a5b66fe035843d05a0c35a60cabb4f10a741f47f0897e567aaed53f65905fa04660d4635903f12

Download Submit
C:\Windows\System\kXirsdR.exe

Filesize
1.0MB

MD5
3436522e0d6ca647f759ca33c382704e

SHA1
47f3a696a7e90e230c60ea9b6d5c6f95febd0e39

SHA256
9021a8dbdbfb22a020aa43a0fd3157afac9104860554d8c5724fb47189cce8f8

SHA512
7f649814d837dfeb36d82655a10a0ccb3a06391792793f28ce4512a1512afcf1fbd174001556e71d63dc3611f612304fdea3cc235d26ba3eab7a51a11042cdc5

Download Submit
C:\Windows\System\nktEtuq.exe

Filesize
1.0MB

MD5
47ce4deead27cca3923f580477c1fc6d

SHA1
fff0840d123c2e8aeffb2352401065475c5bf192

SHA256
bec359a326ea98841339e05d2e6f256477a5c9219f2f7fa4248bfe18ba2b3c1b

SHA512
c73022701cb10ffe7b5a057d61bbb26eb1e9883d7efdb760a0278a122fa6aeae670f6bbaddc3050ee761bd80b228f35c6e517c0e12aa74d3422d8b3e60faefb2

Download Submit
C:\Windows\System\oWBiJan.exe

Filesize
1.0MB

MD5
c8b0f059b70a9f287df672e972545169

SHA1
e89b233d99c6ff9de6c0c92a2e505fadae4ca3c2

SHA256
c0b915ab8b9246c24be162a8ed16aef6f7100f3622c53e0de3ac2aae00cd0423

SHA512
8b5771a88584a09377f79af60f5b7d8833fa783aaec7af3a6aa738639f7d1183cd6c4fb9fe57a9090dbcb81eb083c510988eea4b0eb4daeb57f79a14ee6c659c

Download Submit
C:\Windows\System\pVDCSsy.exe

Filesize
1.0MB

MD5
31ddb7d24aa3c526d043073972ede0cd

SHA1
393a5aeffff830b280a1652c25526aab20a02eb3

SHA256
758be87f414918b7da52224b91da287c3e3e2fe966e2c3b23e2350756ce038f6

SHA512
fd6938304b165debc64410dcd99941cb8f0815f6331250d8394858f40f99b697db9870034583655148dbb2dae21e9dc13d2ba855581b73236eec8972b79e5584

Download Submit
C:\Windows\System\rCmbUzg.exe

Filesize
1.0MB

MD5
8256c85d4b8b7d0e947142bf6461db2f

SHA1
3b6e37afb845b2dc5261b1f6692bc6e291805f2b

SHA256
207a9beca86fd45f4c853c8c74c6b0ed96a117ad31125f2a990f0df5e60fa993

SHA512
a318758c15f65205b6f04d3c609fc765738d0e759695a3318228787a855de7e7be41e22159a03eeec325afb3f27a2208b5b53a8c282ae18799b9ea4745aaf491

Download Submit
C:\Windows\System\texIzAY.exe

Filesize
1.0MB

MD5
0e7c6e0bfc47fc90131e4497594410ad

SHA1
0804b51856bbe95f9318b2b0ee248cf28bd6a8ad

SHA256
fcf4bca1edcd868cf66698602d3f90040d1f7556fe98eb35e0b3660c541ff106

SHA512
7865ca7b8151d0dd15879b6d875dea694a14099b7d3663d8858ec9b7bd7a3e6fbd653186b7ad2334cd4ccfc3fc77c560976bd8815aad07c886690fe7069e99f7

Download Submit
C:\Windows\System\tgORJkR.exe

Filesize
1.0MB

MD5
8a7da241d04560ed0356229d7e98089b

SHA1
4337efa03cf92de58abaa5ab49e7b6390b0bb133

SHA256
9511302ca6f3bd403d779b64b5141fa5072e6486db60d34a1ddf00867680d155

SHA512
ae5a9142e98537e259d95e33f2883b739119e96f3f4e6d74f0a714b6271beee6106fc9a67e58d11be254f4b99e00ffbeb457867cc8dd157d3e7852946ef0546c

Download Submit
C:\Windows\System\uMWkEVl.exe

Filesize
1.0MB

MD5
341fb1a174d2d82fedac58fde06d2c7f

SHA1
9e50f4c05da84a50a5b82a6dd85c14f1184d77b2

SHA256
018b46fdb6d1c6a54b9724d2f382bd95565d91f1d75a43887889b711a5b3c6f4

SHA512
e2ab50eb5d91b57e6c2fa54ccbbf8a593832361100f013cf01e52db5e4fc48afa6a2076daa1d98eda570ef75f53a71aeeb1910bf24d059b337ab0aeb35734590

Download Submit
C:\Windows\System\vOVpmIQ.exe

Filesize
1.0MB

MD5
b8c7b901b79ca3f9904342ed30fd5e5d

SHA1
ff66a20e8b5c22907391ca0671c7e3bcb576cf0a

SHA256
93f2f26535973023bde58cc6fe91f2260c033ac9db9fa307dc52f7119943bcfc

SHA512
888e04c20e90eacdedfab16c46ebe0892e1ba25f8b58fe51f78a74c0b392a5f3b71ea79cde4c6bda4b853ed103490d1d8120b87471452af1b3329bee95284a35

Download Submit
C:\Windows\System\vyMSdWq.exe

Filesize
1.0MB

MD5
3c6c823f044f975bf9c2649e835e7a9d

SHA1
942256d9fd3b6f93f5f153978427ee1c4651d244

SHA256
951dfc0b2659d6ae1220215197c2c310ac0bcd3fea211bd136a3adefc2b7a1f0

SHA512
20b0664e60ccad05274bc3c57205131ebb2f1a8ebdb07d9bcbf8e93d8f0e603c0b605ea759cdbd38df806e6a524f149a94ce363e08047be5e3f68429ce706fec

Download Submit
C:\Windows\System\xYPExyv.exe

Filesize
1.0MB

MD5
d67415a095529aec43abcec525a3a83a

SHA1
e3c663d9c5d3d3eca836bec3a036133b1c5c8e73

SHA256
76638ecdec6df7b7c28b97a58da86985218c541dc769eb6a47fd0a8526426012

SHA512
4ca56f0104232a5df105b26fa2cd26dda2f2d5bde9470bbfc5960bcedff6af79c7ad056b61d0c7d42eaa8da5ca8987b691a64456aa4471094eabbfa4f6fec952

Download Submit
C:\Windows\System\ywdtrKl.exe

Filesize
1.0MB

MD5
8f29c2cb52293fe5614aa75f306224c2

SHA1
a461c8017870fb06931d0d1e5b7fdbcd19f7e071

SHA256
02492a2fdd2c4dbff8a8f4624970738dae0e2de2e6e98ce15dba82c0f1629e16

SHA512
d3c4923386d7c72ef5cc298c23e9e559b06897fc69edd3226d2998f89e05c924ce853999a879a0be8ccc85be6df0645009eab8c3e1bc76f76ee852719c814b9c

Download Submit
memory/1956-0-0x000001E04FD20000-0x000001E04FD30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads