xmrig | 3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
Size

1.4MB
MD5

1ae5eb5a7134549c1ae262a463bfbf20
SHA1

3e02ab605360774aac1d54cc6231cacedee5f40b
SHA256

3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255
SHA512

d1df851304c7fcd83b51c5aaa8f0ef9c29a704ecd3575ab15a432d6a2291f5e3be1248e2bb7f1e13d058c0624905d1e13e23f9590b7317ad95aa69155b6100e2
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcm:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c58

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b92-4.dat	xmrig
behavioral2/files/0x0007000000023c85-20.dat	xmrig
behavioral2/files/0x0008000000023c84-19.dat	xmrig
behavioral2/files/0x0007000000023c87-18.dat	xmrig
behavioral2/files/0x0007000000023c86-17.dat	xmrig
behavioral2/files/0x0007000000023c8a-37.dat	xmrig
behavioral2/files/0x0007000000023c8b-48.dat	xmrig
behavioral2/files/0x0007000000023c8d-55.dat	xmrig
behavioral2/files/0x0007000000023c8e-66.dat	xmrig
behavioral2/files/0x0007000000023c96-117.dat	xmrig
behavioral2/files/0x0007000000023c9f-140.dat	xmrig
behavioral2/files/0x0007000000023c9c-161.dat	xmrig
behavioral2/files/0x0007000000023c9b-159.dat	xmrig
behavioral2/files/0x0007000000023ca1-157.dat	xmrig
behavioral2/files/0x0007000000023ca0-155.dat	xmrig
behavioral2/files/0x0007000000023c9e-151.dat	xmrig
behavioral2/files/0x0007000000023c9d-149.dat	xmrig
behavioral2/files/0x0007000000023ca3-148.dat	xmrig
behavioral2/files/0x0007000000023c99-146.dat	xmrig
behavioral2/files/0x0007000000023c98-144.dat	xmrig
behavioral2/files/0x0007000000023ca2-143.dat	xmrig
behavioral2/files/0x0007000000023c9a-132.dat	xmrig
behavioral2/files/0x0007000000023c97-127.dat	xmrig
behavioral2/files/0x0007000000023c94-107.dat	xmrig
behavioral2/files/0x0007000000023c91-105.dat	xmrig
behavioral2/files/0x0007000000023c95-99.dat	xmrig
behavioral2/files/0x0007000000023c93-91.dat	xmrig
behavioral2/files/0x0007000000023c92-88.dat	xmrig
behavioral2/files/0x0007000000023c90-86.dat	xmrig
behavioral2/files/0x0007000000023c8f-74.dat	xmrig
behavioral2/files/0x0007000000023c88-32.dat	xmrig
behavioral2/files/0x0007000000023c8c-50.dat	xmrig
behavioral2/files/0x0007000000023c89-44.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4200	Ybeajwn.exe
2484	OIVvrOQ.exe
464	JCcbHgB.exe
4572	WbGMkIn.exe
3016	YeRFbHk.exe
4708	qOeplzy.exe
396	shxMLzW.exe
3988	gFkxphp.exe
2132	BrwjhGT.exe
4372	QjXsgzN.exe
1112	eejiMuK.exe
3456	hrkXTQi.exe
1772	CfoJQKZ.exe
2704	wppuSOH.exe
2088	xSWrARZ.exe
4532	CiWdHUI.exe
2988	CPfAAhi.exe
3264	wGmubqF.exe
3772	PusJPWx.exe
4472	jVIykpN.exe
2120	OpCXNuf.exe
2208	hRiJZKV.exe
4800	nOCrxjb.exe
4196	CcYuTZE.exe
2400	bhABpio.exe
4872	qcGjrpN.exe
2976	nRPVmqV.exe
4692	AtKQWcs.exe
840	aNLkWpp.exe
2108	yBCMBEv.exe
2652	yEFUrjU.exe
1924	XcOjPjO.exe
2872	lHBHnXs.exe
1600	egBpspR.exe
4552	qGaizpr.exe
1204	JeNxaNp.exe
4568	NQRFaXk.exe
1660	lnZuiWG.exe
4188	RMyMGdm.exe
2396	StGrLem.exe
2940	MLdYJoF.exe
3308	IysljGJ.exe
3576	Cknajdn.exe
3260	DVnkDMt.exe
1512	mBqwKsV.exe
3228	EGDaMAi.exe
540	JJqGlNQ.exe
3972	DtGdBdh.exe
3824	QuPdHlb.exe
4972	ETivSXO.exe
5076	ZVkxWVB.exe
5088	xBfpCpM.exe
3976	xUcirJd.exe
4360	depClvK.exe
4860	teZEGfp.exe
3720	sFOHbYh.exe
3864	HLioZBf.exe
1280	GDoPVZT.exe
2544	sOywKcE.exe
2892	bDbDbGL.exe
32	KpNzOdq.exe
1476	XCOVVDZ.exe
4280	UWlycsI.exe
1664	dAvJImw.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sfQnZAP.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\iwVbhNl.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\ieoBXNq.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\PxoYBTA.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\lFoysFM.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\teZEGfp.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\hjVRvqk.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\TNrtFzF.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\tdrOBbd.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\OgitGAK.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\PusJPWx.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\Xoeinih.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\XchsJys.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\YeRFbHk.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\wppuSOH.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\vFByrAK.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\sHAtvcL.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\MApKoRQ.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\zHBYGgu.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\IThFMVE.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\xbSxAFR.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\vdDZaKt.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\YdzIWWW.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\FVIXGWG.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\dsXbvjk.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\oFnPcuK.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\YBjbmET.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\SyqydBr.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\lFpfCid.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\pBVpmWE.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\yCMqNCi.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\usjcCGt.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\drKTttu.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\AbTnYXW.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\SbPvwnQ.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\HHzQBcP.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\BFYFoxO.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\hFKQSip.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\fAFsCpV.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\iTXaoBW.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\dShQvvA.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\xwtWlhV.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\TsiMhEq.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\ZehSVdx.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\wzSSJsI.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\sMxyOOW.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\HsdJpJr.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\UDwriPh.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\MWcMRQA.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\iRfLeqU.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\aMjulBd.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\YtyDmfW.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\jhkfEVr.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\DVXKZZh.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\JCcbHgB.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\OpCXNuf.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\ncekYWl.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\iCHxZtg.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\yUSJyCa.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\PZvHXfy.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\PuCWEUz.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\ASuiTep.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\xfYszRU.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
File created	C:\Windows\System\UsSJIMN.exe	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4200	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	84
PID 3564 wrote to memory of 4200	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	84
PID 3564 wrote to memory of 2484	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	85
PID 3564 wrote to memory of 2484	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	85
PID 3564 wrote to memory of 464	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	86
PID 3564 wrote to memory of 464	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	86
PID 3564 wrote to memory of 4572	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	87
PID 3564 wrote to memory of 4572	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	87
PID 3564 wrote to memory of 3016	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	88
PID 3564 wrote to memory of 3016	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	88
PID 3564 wrote to memory of 4708	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	89
PID 3564 wrote to memory of 4708	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	89
PID 3564 wrote to memory of 396	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	90
PID 3564 wrote to memory of 396	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	90
PID 3564 wrote to memory of 3988	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	91
PID 3564 wrote to memory of 3988	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	91
PID 3564 wrote to memory of 2132	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	92
PID 3564 wrote to memory of 2132	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	92
PID 3564 wrote to memory of 4372	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	93
PID 3564 wrote to memory of 4372	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	93
PID 3564 wrote to memory of 1112	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	94
PID 3564 wrote to memory of 1112	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	94
PID 3564 wrote to memory of 3456	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	95
PID 3564 wrote to memory of 3456	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	95
PID 3564 wrote to memory of 1772	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	96
PID 3564 wrote to memory of 1772	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	96
PID 3564 wrote to memory of 2704	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	97
PID 3564 wrote to memory of 2704	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	97
PID 3564 wrote to memory of 2088	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	98
PID 3564 wrote to memory of 2088	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	98
PID 3564 wrote to memory of 4532	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	99
PID 3564 wrote to memory of 4532	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	99
PID 3564 wrote to memory of 2988	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	100
PID 3564 wrote to memory of 2988	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	100
PID 3564 wrote to memory of 3264	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	101
PID 3564 wrote to memory of 3264	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	101
PID 3564 wrote to memory of 3772	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	102
PID 3564 wrote to memory of 3772	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	102
PID 3564 wrote to memory of 4472	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	103
PID 3564 wrote to memory of 4472	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	103
PID 3564 wrote to memory of 2120	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	104
PID 3564 wrote to memory of 2120	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	104
PID 3564 wrote to memory of 2208	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	105
PID 3564 wrote to memory of 2208	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	105
PID 3564 wrote to memory of 4800	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	106
PID 3564 wrote to memory of 4800	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	106
PID 3564 wrote to memory of 4196	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	107
PID 3564 wrote to memory of 4196	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	107
PID 3564 wrote to memory of 2400	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	108
PID 3564 wrote to memory of 2400	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	108
PID 3564 wrote to memory of 4872	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	109
PID 3564 wrote to memory of 4872	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	109
PID 3564 wrote to memory of 2976	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	110
PID 3564 wrote to memory of 2976	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	110
PID 3564 wrote to memory of 4692	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	111
PID 3564 wrote to memory of 4692	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	111
PID 3564 wrote to memory of 840	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	112
PID 3564 wrote to memory of 840	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	112
PID 3564 wrote to memory of 2108	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	113
PID 3564 wrote to memory of 2108	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	113
PID 3564 wrote to memory of 2652	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	114
PID 3564 wrote to memory of 2652	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	114
PID 3564 wrote to memory of 1924	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	115
PID 3564 wrote to memory of 1924	3564	3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe	115

C:\Users\Admin\AppData\Local\Temp\3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe
"C:\Users\Admin\AppData\Local\Temp\3069ae30f378f3e2a220524fff730b0296fb60dab8588cb2b69addb22d110255.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\System\Ybeajwn.exe
  C:\Windows\System\Ybeajwn.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\OIVvrOQ.exe
  C:\Windows\System\OIVvrOQ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\JCcbHgB.exe
  C:\Windows\System\JCcbHgB.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\WbGMkIn.exe
  C:\Windows\System\WbGMkIn.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\YeRFbHk.exe
  C:\Windows\System\YeRFbHk.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\qOeplzy.exe
  C:\Windows\System\qOeplzy.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\shxMLzW.exe
  C:\Windows\System\shxMLzW.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\gFkxphp.exe
  C:\Windows\System\gFkxphp.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\BrwjhGT.exe
  C:\Windows\System\BrwjhGT.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\QjXsgzN.exe
  C:\Windows\System\QjXsgzN.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\eejiMuK.exe
  C:\Windows\System\eejiMuK.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\hrkXTQi.exe
  C:\Windows\System\hrkXTQi.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\CfoJQKZ.exe
  C:\Windows\System\CfoJQKZ.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\wppuSOH.exe
  C:\Windows\System\wppuSOH.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\xSWrARZ.exe
  C:\Windows\System\xSWrARZ.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\CiWdHUI.exe
  C:\Windows\System\CiWdHUI.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\CPfAAhi.exe
  C:\Windows\System\CPfAAhi.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\wGmubqF.exe
  C:\Windows\System\wGmubqF.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\PusJPWx.exe
  C:\Windows\System\PusJPWx.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\jVIykpN.exe
  C:\Windows\System\jVIykpN.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\OpCXNuf.exe
  C:\Windows\System\OpCXNuf.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\hRiJZKV.exe
  C:\Windows\System\hRiJZKV.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\nOCrxjb.exe
  C:\Windows\System\nOCrxjb.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\CcYuTZE.exe
  C:\Windows\System\CcYuTZE.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\bhABpio.exe
  C:\Windows\System\bhABpio.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\qcGjrpN.exe
  C:\Windows\System\qcGjrpN.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\nRPVmqV.exe
  C:\Windows\System\nRPVmqV.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\AtKQWcs.exe
  C:\Windows\System\AtKQWcs.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\aNLkWpp.exe
  C:\Windows\System\aNLkWpp.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\yBCMBEv.exe
  C:\Windows\System\yBCMBEv.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\yEFUrjU.exe
  C:\Windows\System\yEFUrjU.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\XcOjPjO.exe
  C:\Windows\System\XcOjPjO.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\lHBHnXs.exe
  C:\Windows\System\lHBHnXs.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\egBpspR.exe
  C:\Windows\System\egBpspR.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\qGaizpr.exe
  C:\Windows\System\qGaizpr.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\JeNxaNp.exe
  C:\Windows\System\JeNxaNp.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\NQRFaXk.exe
  C:\Windows\System\NQRFaXk.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\lnZuiWG.exe
  C:\Windows\System\lnZuiWG.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\RMyMGdm.exe
  C:\Windows\System\RMyMGdm.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\StGrLem.exe
  C:\Windows\System\StGrLem.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\MLdYJoF.exe
  C:\Windows\System\MLdYJoF.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\IysljGJ.exe
  C:\Windows\System\IysljGJ.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\Cknajdn.exe
  C:\Windows\System\Cknajdn.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\DVnkDMt.exe
  C:\Windows\System\DVnkDMt.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\mBqwKsV.exe
  C:\Windows\System\mBqwKsV.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\EGDaMAi.exe
  C:\Windows\System\EGDaMAi.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\JJqGlNQ.exe
  C:\Windows\System\JJqGlNQ.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\DtGdBdh.exe
  C:\Windows\System\DtGdBdh.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\QuPdHlb.exe
  C:\Windows\System\QuPdHlb.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\ETivSXO.exe
  C:\Windows\System\ETivSXO.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\ZVkxWVB.exe
  C:\Windows\System\ZVkxWVB.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\xBfpCpM.exe
  C:\Windows\System\xBfpCpM.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\xUcirJd.exe
  C:\Windows\System\xUcirJd.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\depClvK.exe
  C:\Windows\System\depClvK.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\teZEGfp.exe
  C:\Windows\System\teZEGfp.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\sFOHbYh.exe
  C:\Windows\System\sFOHbYh.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\HLioZBf.exe
  C:\Windows\System\HLioZBf.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\GDoPVZT.exe
  C:\Windows\System\GDoPVZT.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\bDbDbGL.exe
  C:\Windows\System\bDbDbGL.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\sOywKcE.exe
  C:\Windows\System\sOywKcE.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\KpNzOdq.exe
  C:\Windows\System\KpNzOdq.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\XCOVVDZ.exe
  C:\Windows\System\XCOVVDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\UWlycsI.exe
  C:\Windows\System\UWlycsI.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\dAvJImw.exe
  C:\Windows\System\dAvJImw.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\yXmWDFB.exe
  C:\Windows\System\yXmWDFB.exe
  2⤵
  PID:4104
- C:\Windows\System\SwOCDxX.exe
  C:\Windows\System\SwOCDxX.exe
  2⤵
  PID:2836
- C:\Windows\System\caahwLb.exe
  C:\Windows\System\caahwLb.exe
  2⤵
  PID:1692
- C:\Windows\System\kOgAfeY.exe
  C:\Windows\System\kOgAfeY.exe
  2⤵
  PID:2788
- C:\Windows\System\qoCQhdF.exe
  C:\Windows\System\qoCQhdF.exe
  2⤵
  PID:3628
- C:\Windows\System\PVRQaoA.exe
  C:\Windows\System\PVRQaoA.exe
  2⤵
  PID:4084
- C:\Windows\System\NgiJwGe.exe
  C:\Windows\System\NgiJwGe.exe
  2⤵
  PID:3240
- C:\Windows\System\mHTXzfa.exe
  C:\Windows\System\mHTXzfa.exe
  2⤵
  PID:4852
- C:\Windows\System\SZYXmDl.exe
  C:\Windows\System\SZYXmDl.exe
  2⤵
  PID:2864
- C:\Windows\System\FLQnfss.exe
  C:\Windows\System\FLQnfss.exe
  2⤵
  PID:3692
- C:\Windows\System\ktDMiZG.exe
  C:\Windows\System\ktDMiZG.exe
  2⤵
  PID:3312
- C:\Windows\System\RMGbded.exe
  C:\Windows\System\RMGbded.exe
  2⤵
  PID:632
- C:\Windows\System\arJDOsQ.exe
  C:\Windows\System\arJDOsQ.exe
  2⤵
  PID:404
- C:\Windows\System\qlLNHKE.exe
  C:\Windows\System\qlLNHKE.exe
  2⤵
  PID:1644
- C:\Windows\System\oehztfb.exe
  C:\Windows\System\oehztfb.exe
  2⤵
  PID:3248
- C:\Windows\System\hhdZkxA.exe
  C:\Windows\System\hhdZkxA.exe
  2⤵
  PID:4488
- C:\Windows\System\sttqYDf.exe
  C:\Windows\System\sttqYDf.exe
  2⤵
  PID:2884
- C:\Windows\System\lKRucYn.exe
  C:\Windows\System\lKRucYn.exe
  2⤵
  PID:928
- C:\Windows\System\JNzOrpw.exe
  C:\Windows\System\JNzOrpw.exe
  2⤵
  PID:4612
- C:\Windows\System\FwJSCGP.exe
  C:\Windows\System\FwJSCGP.exe
  2⤵
  PID:3836
- C:\Windows\System\IPAucGq.exe
  C:\Windows\System\IPAucGq.exe
  2⤵
  PID:3728
- C:\Windows\System\KBbKfky.exe
  C:\Windows\System\KBbKfky.exe
  2⤵
  PID:2972
- C:\Windows\System\TsiMhEq.exe
  C:\Windows\System\TsiMhEq.exe
  2⤵
  PID:3516
- C:\Windows\System\FHxdvCv.exe
  C:\Windows\System\FHxdvCv.exe
  2⤵
  PID:1480
- C:\Windows\System\ROrwwxu.exe
  C:\Windows\System\ROrwwxu.exe
  2⤵
  PID:2904
- C:\Windows\System\NdvwaRx.exe
  C:\Windows\System\NdvwaRx.exe
  2⤵
  PID:1108
- C:\Windows\System\vmGBmxB.exe
  C:\Windows\System\vmGBmxB.exe
  2⤵
  PID:3800
- C:\Windows\System\ZpIDKgW.exe
  C:\Windows\System\ZpIDKgW.exe
  2⤵
  PID:2456
- C:\Windows\System\XSujamP.exe
  C:\Windows\System\XSujamP.exe
  2⤵
  PID:2468
- C:\Windows\System\WIWycWw.exe
  C:\Windows\System\WIWycWw.exe
  2⤵
  PID:3724
- C:\Windows\System\ZehSVdx.exe
  C:\Windows\System\ZehSVdx.exe
  2⤵
  PID:2612
- C:\Windows\System\CrmDFaA.exe
  C:\Windows\System\CrmDFaA.exe
  2⤵
  PID:5092
- C:\Windows\System\CEkVHXh.exe
  C:\Windows\System\CEkVHXh.exe
  2⤵
  PID:4788
- C:\Windows\System\uHtAyok.exe
  C:\Windows\System\uHtAyok.exe
  2⤵
  PID:924
- C:\Windows\System\yFPgJwN.exe
  C:\Windows\System\yFPgJwN.exe
  2⤵
  PID:3700
- C:\Windows\System\Dnszlzt.exe
  C:\Windows\System\Dnszlzt.exe
  2⤵
  PID:640
- C:\Windows\System\qfiqsHb.exe
  C:\Windows\System\qfiqsHb.exe
  2⤵
  PID:4780
- C:\Windows\System\YPenvOr.exe
  C:\Windows\System\YPenvOr.exe
  2⤵
  PID:1248
- C:\Windows\System\EAnaWef.exe
  C:\Windows\System\EAnaWef.exe
  2⤵
  PID:1032
- C:\Windows\System\QioZWzO.exe
  C:\Windows\System\QioZWzO.exe
  2⤵
  PID:3856
- C:\Windows\System\aJlBUzP.exe
  C:\Windows\System\aJlBUzP.exe
  2⤵
  PID:2196
- C:\Windows\System\IUCOypO.exe
  C:\Windows\System\IUCOypO.exe
  2⤵
  PID:3060
- C:\Windows\System\GlLxYeN.exe
  C:\Windows\System\GlLxYeN.exe
  2⤵
  PID:3452
- C:\Windows\System\UnFRPzd.exe
  C:\Windows\System\UnFRPzd.exe
  2⤵
  PID:4904
- C:\Windows\System\SxeBuOX.exe
  C:\Windows\System\SxeBuOX.exe
  2⤵
  PID:4900
- C:\Windows\System\MuBmgZM.exe
  C:\Windows\System\MuBmgZM.exe
  2⤵
  PID:4212
- C:\Windows\System\cfmVPOx.exe
  C:\Windows\System\cfmVPOx.exe
  2⤵
  PID:5140
- C:\Windows\System\MeCXdHG.exe
  C:\Windows\System\MeCXdHG.exe
  2⤵
  PID:5160
- C:\Windows\System\yaTdMOS.exe
  C:\Windows\System\yaTdMOS.exe
  2⤵
  PID:5180
- C:\Windows\System\ZfYvtls.exe
  C:\Windows\System\ZfYvtls.exe
  2⤵
  PID:5216
- C:\Windows\System\TmJlLZs.exe
  C:\Windows\System\TmJlLZs.exe
  2⤵
  PID:5236
- C:\Windows\System\qeGfgxV.exe
  C:\Windows\System\qeGfgxV.exe
  2⤵
  PID:5276
- C:\Windows\System\pGCWiaS.exe
  C:\Windows\System\pGCWiaS.exe
  2⤵
  PID:5304
- C:\Windows\System\pQfGXHR.exe
  C:\Windows\System\pQfGXHR.exe
  2⤵
  PID:5332
- C:\Windows\System\tUomEZm.exe
  C:\Windows\System\tUomEZm.exe
  2⤵
  PID:5348
- C:\Windows\System\nzqqApU.exe
  C:\Windows\System\nzqqApU.exe
  2⤵
  PID:5388
- C:\Windows\System\yoJpWtd.exe
  C:\Windows\System\yoJpWtd.exe
  2⤵
  PID:5412
- C:\Windows\System\XWqherg.exe
  C:\Windows\System\XWqherg.exe
  2⤵
  PID:5440
- C:\Windows\System\ddrjzEB.exe
  C:\Windows\System\ddrjzEB.exe
  2⤵
  PID:5476
- C:\Windows\System\LekcsUv.exe
  C:\Windows\System\LekcsUv.exe
  2⤵
  PID:5500
- C:\Windows\System\XVHskKD.exe
  C:\Windows\System\XVHskKD.exe
  2⤵
  PID:5528
- C:\Windows\System\AiKvXOa.exe
  C:\Windows\System\AiKvXOa.exe
  2⤵
  PID:5560
- C:\Windows\System\aWrgSFD.exe
  C:\Windows\System\aWrgSFD.exe
  2⤵
  PID:5588
- C:\Windows\System\esQjhXE.exe
  C:\Windows\System\esQjhXE.exe
  2⤵
  PID:5620
- C:\Windows\System\GWWCblN.exe
  C:\Windows\System\GWWCblN.exe
  2⤵
  PID:5636
- C:\Windows\System\GWuhVdG.exe
  C:\Windows\System\GWuhVdG.exe
  2⤵
  PID:5672
- C:\Windows\System\Xoeinih.exe
  C:\Windows\System\Xoeinih.exe
  2⤵
  PID:5704
- C:\Windows\System\yBpcDfE.exe
  C:\Windows\System\yBpcDfE.exe
  2⤵
  PID:5732
- C:\Windows\System\YcMuOrq.exe
  C:\Windows\System\YcMuOrq.exe
  2⤵
  PID:5752
- C:\Windows\System\GDkwIDE.exe
  C:\Windows\System\GDkwIDE.exe
  2⤵
  PID:5788
- C:\Windows\System\GnTULEU.exe
  C:\Windows\System\GnTULEU.exe
  2⤵
  PID:5816
- C:\Windows\System\tLkZHYq.exe
  C:\Windows\System\tLkZHYq.exe
  2⤵
  PID:5844
- C:\Windows\System\aHIdQbk.exe
  C:\Windows\System\aHIdQbk.exe
  2⤵
  PID:5872
- C:\Windows\System\TprmGVD.exe
  C:\Windows\System\TprmGVD.exe
  2⤵
  PID:5940
- C:\Windows\System\uzMImZm.exe
  C:\Windows\System\uzMImZm.exe
  2⤵
  PID:5956
- C:\Windows\System\jVMMLjN.exe
  C:\Windows\System\jVMMLjN.exe
  2⤵
  PID:5972
- C:\Windows\System\DCAjrpx.exe
  C:\Windows\System\DCAjrpx.exe
  2⤵
  PID:6000
- C:\Windows\System\DBIhtgP.exe
  C:\Windows\System\DBIhtgP.exe
  2⤵
  PID:6028
- C:\Windows\System\VSzpryy.exe
  C:\Windows\System\VSzpryy.exe
  2⤵
  PID:6056
- C:\Windows\System\IThFMVE.exe
  C:\Windows\System\IThFMVE.exe
  2⤵
  PID:6084
- C:\Windows\System\NOrhuvV.exe
  C:\Windows\System\NOrhuvV.exe
  2⤵
  PID:6112
- C:\Windows\System\TNrtFzF.exe
  C:\Windows\System\TNrtFzF.exe
  2⤵
  PID:6132
- C:\Windows\System\slrOmNj.exe
  C:\Windows\System\slrOmNj.exe
  2⤵
  PID:5152
- C:\Windows\System\drKTttu.exe
  C:\Windows\System\drKTttu.exe
  2⤵
  PID:5264
- C:\Windows\System\ruDbpaN.exe
  C:\Windows\System\ruDbpaN.exe
  2⤵
  PID:5296
- C:\Windows\System\eGrgBoI.exe
  C:\Windows\System\eGrgBoI.exe
  2⤵
  PID:5340
- C:\Windows\System\hiRapPk.exe
  C:\Windows\System\hiRapPk.exe
  2⤵
  PID:5436
- C:\Windows\System\ZDYLRfG.exe
  C:\Windows\System\ZDYLRfG.exe
  2⤵
  PID:5492
- C:\Windows\System\qXCdnHp.exe
  C:\Windows\System\qXCdnHp.exe
  2⤵
  PID:5568
- C:\Windows\System\pBVpmWE.exe
  C:\Windows\System\pBVpmWE.exe
  2⤵
  PID:5600
- C:\Windows\System\wVHHVNg.exe
  C:\Windows\System\wVHHVNg.exe
  2⤵
  PID:5648
- C:\Windows\System\dRtXfBa.exe
  C:\Windows\System\dRtXfBa.exe
  2⤵
  PID:5728
- C:\Windows\System\pmzEISH.exe
  C:\Windows\System\pmzEISH.exe
  2⤵
  PID:5800
- C:\Windows\System\xbSxAFR.exe
  C:\Windows\System\xbSxAFR.exe
  2⤵
  PID:5868
- C:\Windows\System\LkiSsBP.exe
  C:\Windows\System\LkiSsBP.exe
  2⤵
  PID:5968
- C:\Windows\System\aMjulBd.exe
  C:\Windows\System\aMjulBd.exe
  2⤵
  PID:5984
- C:\Windows\System\mWVFzqL.exe
  C:\Windows\System\mWVFzqL.exe
  2⤵
  PID:6076
- C:\Windows\System\GAzCuAH.exe
  C:\Windows\System\GAzCuAH.exe
  2⤵
  PID:6128
- C:\Windows\System\tqagSab.exe
  C:\Windows\System\tqagSab.exe
  2⤵
  PID:5124
- C:\Windows\System\UwHnpvL.exe
  C:\Windows\System\UwHnpvL.exe
  2⤵
  PID:5344
- C:\Windows\System\fIRlMHq.exe
  C:\Windows\System\fIRlMHq.exe
  2⤵
  PID:5536
- C:\Windows\System\TsGOtQJ.exe
  C:\Windows\System\TsGOtQJ.exe
  2⤵
  PID:5664
- C:\Windows\System\yTfezYV.exe
  C:\Windows\System\yTfezYV.exe
  2⤵
  PID:5888
- C:\Windows\System\rinbEJV.exe
  C:\Windows\System\rinbEJV.exe
  2⤵
  PID:5188
- C:\Windows\System\aYlnYQs.exe
  C:\Windows\System\aYlnYQs.exe
  2⤵
  PID:5488
- C:\Windows\System\UXiCjcn.exe
  C:\Windows\System\UXiCjcn.exe
  2⤵
  PID:5464
- C:\Windows\System\OghfoUT.exe
  C:\Windows\System\OghfoUT.exe
  2⤵
  PID:5428
- C:\Windows\System\oonTrom.exe
  C:\Windows\System\oonTrom.exe
  2⤵
  PID:5836
- C:\Windows\System\PfDJkrl.exe
  C:\Windows\System\PfDJkrl.exe
  2⤵
  PID:6172
- C:\Windows\System\PuCWEUz.exe
  C:\Windows\System\PuCWEUz.exe
  2⤵
  PID:6200
- C:\Windows\System\UtGZdkr.exe
  C:\Windows\System\UtGZdkr.exe
  2⤵
  PID:6232
- C:\Windows\System\qNyjIus.exe
  C:\Windows\System\qNyjIus.exe
  2⤵
  PID:6260
- C:\Windows\System\Oprnmhf.exe
  C:\Windows\System\Oprnmhf.exe
  2⤵
  PID:6288
- C:\Windows\System\vFByrAK.exe
  C:\Windows\System\vFByrAK.exe
  2⤵
  PID:6304
- C:\Windows\System\ieoBXNq.exe
  C:\Windows\System\ieoBXNq.exe
  2⤵
  PID:6336
- C:\Windows\System\OPBbojP.exe
  C:\Windows\System\OPBbojP.exe
  2⤵
  PID:6368
- C:\Windows\System\DjPpCoz.exe
  C:\Windows\System\DjPpCoz.exe
  2⤵
  PID:6396
- C:\Windows\System\oLCyOiO.exe
  C:\Windows\System\oLCyOiO.exe
  2⤵
  PID:6420
- C:\Windows\System\xfYszRU.exe
  C:\Windows\System\xfYszRU.exe
  2⤵
  PID:6444
- C:\Windows\System\XHkYvaT.exe
  C:\Windows\System\XHkYvaT.exe
  2⤵
  PID:6460
- C:\Windows\System\hKXWsrV.exe
  C:\Windows\System\hKXWsrV.exe
  2⤵
  PID:6488
- C:\Windows\System\mvdHWux.exe
  C:\Windows\System\mvdHWux.exe
  2⤵
  PID:6516
- C:\Windows\System\MKVEZZe.exe
  C:\Windows\System\MKVEZZe.exe
  2⤵
  PID:6548
- C:\Windows\System\wWgxLXg.exe
  C:\Windows\System\wWgxLXg.exe
  2⤵
  PID:6568
- C:\Windows\System\dzDpYXT.exe
  C:\Windows\System\dzDpYXT.exe
  2⤵
  PID:6592
- C:\Windows\System\ZBGLRrV.exe
  C:\Windows\System\ZBGLRrV.exe
  2⤵
  PID:6620
- C:\Windows\System\cbhGNNs.exe
  C:\Windows\System\cbhGNNs.exe
  2⤵
  PID:6656
- C:\Windows\System\YvSHVbb.exe
  C:\Windows\System\YvSHVbb.exe
  2⤵
  PID:6680
- C:\Windows\System\pOOwsWD.exe
  C:\Windows\System\pOOwsWD.exe
  2⤵
  PID:6704
- C:\Windows\System\bmiuTMx.exe
  C:\Windows\System\bmiuTMx.exe
  2⤵
  PID:6736
- C:\Windows\System\TcDatdL.exe
  C:\Windows\System\TcDatdL.exe
  2⤵
  PID:6756
- C:\Windows\System\mgBejGM.exe
  C:\Windows\System\mgBejGM.exe
  2⤵
  PID:6784
- C:\Windows\System\gKsXRIn.exe
  C:\Windows\System\gKsXRIn.exe
  2⤵
  PID:6820
- C:\Windows\System\zVCJmtx.exe
  C:\Windows\System\zVCJmtx.exe
  2⤵
  PID:6848
- C:\Windows\System\BLvQKHL.exe
  C:\Windows\System\BLvQKHL.exe
  2⤵
  PID:6876
- C:\Windows\System\ASuiTep.exe
  C:\Windows\System\ASuiTep.exe
  2⤵
  PID:6896
- C:\Windows\System\AOHLipS.exe
  C:\Windows\System\AOHLipS.exe
  2⤵
  PID:6916
- C:\Windows\System\FVIXGWG.exe
  C:\Windows\System\FVIXGWG.exe
  2⤵
  PID:6948
- C:\Windows\System\lPvYFsh.exe
  C:\Windows\System\lPvYFsh.exe
  2⤵
  PID:6980
- C:\Windows\System\LyqCyts.exe
  C:\Windows\System\LyqCyts.exe
  2⤵
  PID:7004
- C:\Windows\System\ITQHmfb.exe
  C:\Windows\System\ITQHmfb.exe
  2⤵
  PID:7036
- C:\Windows\System\jNJWIZz.exe
  C:\Windows\System\jNJWIZz.exe
  2⤵
  PID:7068
- C:\Windows\System\huBgJwc.exe
  C:\Windows\System\huBgJwc.exe
  2⤵
  PID:7096
- C:\Windows\System\wPjfGiv.exe
  C:\Windows\System\wPjfGiv.exe
  2⤵
  PID:7120
- C:\Windows\System\xgBlUVA.exe
  C:\Windows\System\xgBlUVA.exe
  2⤵
  PID:7144
- C:\Windows\System\FGqAoxX.exe
  C:\Windows\System\FGqAoxX.exe
  2⤵
  PID:6024
- C:\Windows\System\PANVHpp.exe
  C:\Windows\System\PANVHpp.exe
  2⤵
  PID:6224
- C:\Windows\System\keGJUzk.exe
  C:\Windows\System\keGJUzk.exe
  2⤵
  PID:6284
- C:\Windows\System\XchsJys.exe
  C:\Windows\System\XchsJys.exe
  2⤵
  PID:6360
- C:\Windows\System\UmXQgaX.exe
  C:\Windows\System\UmXQgaX.exe
  2⤵
  PID:6428
- C:\Windows\System\NBIBKIX.exe
  C:\Windows\System\NBIBKIX.exe
  2⤵
  PID:6504
- C:\Windows\System\FaNRyYt.exe
  C:\Windows\System\FaNRyYt.exe
  2⤵
  PID:6528
- C:\Windows\System\ScULAyB.exe
  C:\Windows\System\ScULAyB.exe
  2⤵
  PID:6632
- C:\Windows\System\Zztgafi.exe
  C:\Windows\System\Zztgafi.exe
  2⤵
  PID:6724
- C:\Windows\System\FbxhrBP.exe
  C:\Windows\System\FbxhrBP.exe
  2⤵
  PID:6808
- C:\Windows\System\YBKtQtA.exe
  C:\Windows\System\YBKtQtA.exe
  2⤵
  PID:6780
- C:\Windows\System\MresOnA.exe
  C:\Windows\System\MresOnA.exe
  2⤵
  PID:6844
- C:\Windows\System\vyWhRvl.exe
  C:\Windows\System\vyWhRvl.exe
  2⤵
  PID:7020
- C:\Windows\System\UuVLfnH.exe
  C:\Windows\System\UuVLfnH.exe
  2⤵
  PID:7056
- C:\Windows\System\OACsEvK.exe
  C:\Windows\System\OACsEvK.exe
  2⤵
  PID:7088
- C:\Windows\System\kbftNvn.exe
  C:\Windows\System\kbftNvn.exe
  2⤵
  PID:7116
- C:\Windows\System\UgDTkHl.exe
  C:\Windows\System\UgDTkHl.exe
  2⤵
  PID:6300
- C:\Windows\System\KyyARNM.exe
  C:\Windows\System\KyyARNM.exe
  2⤵
  PID:6384
- C:\Windows\System\whNnJJL.exe
  C:\Windows\System\whNnJJL.exe
  2⤵
  PID:6452
- C:\Windows\System\sXGsPHd.exe
  C:\Windows\System\sXGsPHd.exe
  2⤵
  PID:6664
- C:\Windows\System\sISVzxB.exe
  C:\Windows\System\sISVzxB.exe
  2⤵
  PID:6768
- C:\Windows\System\iTXaoBW.exe
  C:\Windows\System\iTXaoBW.exe
  2⤵
  PID:6976
- C:\Windows\System\eTkTsHN.exe
  C:\Windows\System\eTkTsHN.exe
  2⤵
  PID:7000
- C:\Windows\System\yCMqNCi.exe
  C:\Windows\System\yCMqNCi.exe
  2⤵
  PID:6432
- C:\Windows\System\oUgBXXU.exe
  C:\Windows\System\oUgBXXU.exe
  2⤵
  PID:6972
- C:\Windows\System\rdpwCGw.exe
  C:\Windows\System\rdpwCGw.exe
  2⤵
  PID:6692
- C:\Windows\System\KJZhVEd.exe
  C:\Windows\System\KJZhVEd.exe
  2⤵
  PID:7196
- C:\Windows\System\lSOEZNe.exe
  C:\Windows\System\lSOEZNe.exe
  2⤵
  PID:7224
- C:\Windows\System\wSeEcyA.exe
  C:\Windows\System\wSeEcyA.exe
  2⤵
  PID:7248
- C:\Windows\System\sriejJg.exe
  C:\Windows\System\sriejJg.exe
  2⤵
  PID:7272
- C:\Windows\System\ISxLSFd.exe
  C:\Windows\System\ISxLSFd.exe
  2⤵
  PID:7316
- C:\Windows\System\JBqaMzt.exe
  C:\Windows\System\JBqaMzt.exe
  2⤵
  PID:7340
- C:\Windows\System\esXbnrv.exe
  C:\Windows\System\esXbnrv.exe
  2⤵
  PID:7372
- C:\Windows\System\KQtDupk.exe
  C:\Windows\System\KQtDupk.exe
  2⤵
  PID:7396
- C:\Windows\System\IoHzbQr.exe
  C:\Windows\System\IoHzbQr.exe
  2⤵
  PID:7420
- C:\Windows\System\ZipoCyf.exe
  C:\Windows\System\ZipoCyf.exe
  2⤵
  PID:7444
- C:\Windows\System\OBTwFLc.exe
  C:\Windows\System\OBTwFLc.exe
  2⤵
  PID:7472
- C:\Windows\System\fJbQeoo.exe
  C:\Windows\System\fJbQeoo.exe
  2⤵
  PID:7508
- C:\Windows\System\rpbllHR.exe
  C:\Windows\System\rpbllHR.exe
  2⤵
  PID:7532
- C:\Windows\System\ybxhTHe.exe
  C:\Windows\System\ybxhTHe.exe
  2⤵
  PID:7548
- C:\Windows\System\ppWgdJV.exe
  C:\Windows\System\ppWgdJV.exe
  2⤵
  PID:7576
- C:\Windows\System\LYgbOjv.exe
  C:\Windows\System\LYgbOjv.exe
  2⤵
  PID:7604
- C:\Windows\System\UmJHCMm.exe
  C:\Windows\System\UmJHCMm.exe
  2⤵
  PID:7632
- C:\Windows\System\wgRZeTs.exe
  C:\Windows\System\wgRZeTs.exe
  2⤵
  PID:7656
- C:\Windows\System\ncekYWl.exe
  C:\Windows\System\ncekYWl.exe
  2⤵
  PID:7688
- C:\Windows\System\kDHadOf.exe
  C:\Windows\System\kDHadOf.exe
  2⤵
  PID:7728
- C:\Windows\System\OLiTDQm.exe
  C:\Windows\System\OLiTDQm.exe
  2⤵
  PID:7748
- C:\Windows\System\zGNnxCF.exe
  C:\Windows\System\zGNnxCF.exe
  2⤵
  PID:7768
- C:\Windows\System\JllPTwP.exe
  C:\Windows\System\JllPTwP.exe
  2⤵
  PID:7804
- C:\Windows\System\wzSSJsI.exe
  C:\Windows\System\wzSSJsI.exe
  2⤵
  PID:7840
- C:\Windows\System\BLFxErv.exe
  C:\Windows\System\BLFxErv.exe
  2⤵
  PID:7864
- C:\Windows\System\MSRvITI.exe
  C:\Windows\System\MSRvITI.exe
  2⤵
  PID:7884
- C:\Windows\System\AsnnkEL.exe
  C:\Windows\System\AsnnkEL.exe
  2⤵
  PID:7904
- C:\Windows\System\iCHxZtg.exe
  C:\Windows\System\iCHxZtg.exe
  2⤵
  PID:7920
- C:\Windows\System\TyaCMNk.exe
  C:\Windows\System\TyaCMNk.exe
  2⤵
  PID:7944
- C:\Windows\System\QUyTtpt.exe
  C:\Windows\System\QUyTtpt.exe
  2⤵
  PID:7976
- C:\Windows\System\IUSMOPZ.exe
  C:\Windows\System\IUSMOPZ.exe
  2⤵
  PID:8004
- C:\Windows\System\dRXvToE.exe
  C:\Windows\System\dRXvToE.exe
  2⤵
  PID:8036
- C:\Windows\System\nsnFWWv.exe
  C:\Windows\System\nsnFWWv.exe
  2⤵
  PID:8068
- C:\Windows\System\iGaOJFM.exe
  C:\Windows\System\iGaOJFM.exe
  2⤵
  PID:8096
- C:\Windows\System\dShQvvA.exe
  C:\Windows\System\dShQvvA.exe
  2⤵
  PID:8120
- C:\Windows\System\ULWsYoL.exe
  C:\Windows\System\ULWsYoL.exe
  2⤵
  PID:8152
- C:\Windows\System\FBGZPnK.exe
  C:\Windows\System\FBGZPnK.exe
  2⤵
  PID:8168
- C:\Windows\System\DOaWvWm.exe
  C:\Windows\System\DOaWvWm.exe
  2⤵
  PID:6344
- C:\Windows\System\IpbdlYk.exe
  C:\Windows\System\IpbdlYk.exe
  2⤵
  PID:6536
- C:\Windows\System\jhkfEVr.exe
  C:\Windows\System\jhkfEVr.exe
  2⤵
  PID:7240
- C:\Windows\System\VVuEkOG.exe
  C:\Windows\System\VVuEkOG.exe
  2⤵
  PID:7288
- C:\Windows\System\HQDUcWq.exe
  C:\Windows\System\HQDUcWq.exe
  2⤵
  PID:7384
- C:\Windows\System\RzDsAig.exe
  C:\Windows\System\RzDsAig.exe
  2⤵
  PID:7492
- C:\Windows\System\RgDBcEf.exe
  C:\Windows\System\RgDBcEf.exe
  2⤵
  PID:7584
- C:\Windows\System\mfHatBD.exe
  C:\Windows\System\mfHatBD.exe
  2⤵
  PID:7544
- C:\Windows\System\waeWxzs.exe
  C:\Windows\System\waeWxzs.exe
  2⤵
  PID:7676
- C:\Windows\System\HjzmcUl.exe
  C:\Windows\System\HjzmcUl.exe
  2⤵
  PID:7652
- C:\Windows\System\uGNODJO.exe
  C:\Windows\System\uGNODJO.exe
  2⤵
  PID:7796
- C:\Windows\System\RJuraHL.exe
  C:\Windows\System\RJuraHL.exe
  2⤵
  PID:7856
- C:\Windows\System\HyDcVAw.exe
  C:\Windows\System\HyDcVAw.exe
  2⤵
  PID:7936
- C:\Windows\System\nmFjikS.exe
  C:\Windows\System\nmFjikS.exe
  2⤵
  PID:7876
- C:\Windows\System\zJhxTQY.exe
  C:\Windows\System\zJhxTQY.exe
  2⤵
  PID:7956
- C:\Windows\System\utDVSWD.exe
  C:\Windows\System\utDVSWD.exe
  2⤵
  PID:8080
- C:\Windows\System\tBIPGdF.exe
  C:\Windows\System\tBIPGdF.exe
  2⤵
  PID:6860
- C:\Windows\System\WpUfFLf.exe
  C:\Windows\System\WpUfFLf.exe
  2⤵
  PID:7360
- C:\Windows\System\THIDORh.exe
  C:\Windows\System\THIDORh.exe
  2⤵
  PID:6800
- C:\Windows\System\mGfIGJQ.exe
  C:\Windows\System\mGfIGJQ.exe
  2⤵
  PID:7572
- C:\Windows\System\DoEZIXD.exe
  C:\Windows\System\DoEZIXD.exe
  2⤵
  PID:7644
- C:\Windows\System\zVquWnf.exe
  C:\Windows\System\zVquWnf.exe
  2⤵
  PID:7820
- C:\Windows\System\dmLsSMH.exe
  C:\Windows\System\dmLsSMH.exe
  2⤵
  PID:7852
- C:\Windows\System\aXTuHKI.exe
  C:\Windows\System\aXTuHKI.exe
  2⤵
  PID:8180
- C:\Windows\System\YtyDmfW.exe
  C:\Windows\System\YtyDmfW.exe
  2⤵
  PID:7824
- C:\Windows\System\OgPQOus.exe
  C:\Windows\System\OgPQOus.exe
  2⤵
  PID:8144
- C:\Windows\System\VgmZLEs.exe
  C:\Windows\System\VgmZLEs.exe
  2⤵
  PID:7708
- C:\Windows\System\zmOxXWq.exe
  C:\Windows\System\zmOxXWq.exe
  2⤵
  PID:7964
- C:\Windows\System\PQzvlnP.exe
  C:\Windows\System\PQzvlnP.exe
  2⤵
  PID:8216
- C:\Windows\System\XnGPWNz.exe
  C:\Windows\System\XnGPWNz.exe
  2⤵
  PID:8248
- C:\Windows\System\WGWkOEt.exe
  C:\Windows\System\WGWkOEt.exe
  2⤵
  PID:8272
- C:\Windows\System\fRtDOMC.exe
  C:\Windows\System\fRtDOMC.exe
  2⤵
  PID:8300
- C:\Windows\System\DZJejyK.exe
  C:\Windows\System\DZJejyK.exe
  2⤵
  PID:8324
- C:\Windows\System\lSSICSk.exe
  C:\Windows\System\lSSICSk.exe
  2⤵
  PID:8348
- C:\Windows\System\GMHBgRq.exe
  C:\Windows\System\GMHBgRq.exe
  2⤵
  PID:8372
- C:\Windows\System\QdtJoSt.exe
  C:\Windows\System\QdtJoSt.exe
  2⤵
  PID:8400
- C:\Windows\System\jzwNIpj.exe
  C:\Windows\System\jzwNIpj.exe
  2⤵
  PID:8440
- C:\Windows\System\OwJoxyU.exe
  C:\Windows\System\OwJoxyU.exe
  2⤵
  PID:8472
- C:\Windows\System\zshJKEd.exe
  C:\Windows\System\zshJKEd.exe
  2⤵
  PID:8496
- C:\Windows\System\clEyeUD.exe
  C:\Windows\System\clEyeUD.exe
  2⤵
  PID:8524
- C:\Windows\System\hFKQSip.exe
  C:\Windows\System\hFKQSip.exe
  2⤵
  PID:8548
- C:\Windows\System\gfkAfst.exe
  C:\Windows\System\gfkAfst.exe
  2⤵
  PID:8580
- C:\Windows\System\nVglVtE.exe
  C:\Windows\System\nVglVtE.exe
  2⤵
  PID:8604
- C:\Windows\System\uTpemTC.exe
  C:\Windows\System\uTpemTC.exe
  2⤵
  PID:8628
- C:\Windows\System\nKcgLML.exe
  C:\Windows\System\nKcgLML.exe
  2⤵
  PID:8652
- C:\Windows\System\dQFSXbn.exe
  C:\Windows\System\dQFSXbn.exe
  2⤵
  PID:8680
- C:\Windows\System\frACJxf.exe
  C:\Windows\System\frACJxf.exe
  2⤵
  PID:8708
- C:\Windows\System\RmwqYFx.exe
  C:\Windows\System\RmwqYFx.exe
  2⤵
  PID:8732
- C:\Windows\System\rmEDkwG.exe
  C:\Windows\System\rmEDkwG.exe
  2⤵
  PID:8764
- C:\Windows\System\zJAydAh.exe
  C:\Windows\System\zJAydAh.exe
  2⤵
  PID:8800
- C:\Windows\System\VrPIYDJ.exe
  C:\Windows\System\VrPIYDJ.exe
  2⤵
  PID:8828
- C:\Windows\System\qKJRZKL.exe
  C:\Windows\System\qKJRZKL.exe
  2⤵
  PID:8856
- C:\Windows\System\lJUecJU.exe
  C:\Windows\System\lJUecJU.exe
  2⤵
  PID:8888
- C:\Windows\System\jfNHQaU.exe
  C:\Windows\System\jfNHQaU.exe
  2⤵
  PID:8920
- C:\Windows\System\TKmLFBj.exe
  C:\Windows\System\TKmLFBj.exe
  2⤵
  PID:8936
- C:\Windows\System\npjZpff.exe
  C:\Windows\System\npjZpff.exe
  2⤵
  PID:8960
- C:\Windows\System\wrBEgvB.exe
  C:\Windows\System\wrBEgvB.exe
  2⤵
  PID:8984
- C:\Windows\System\UIWEckD.exe
  C:\Windows\System\UIWEckD.exe
  2⤵
  PID:9012
- C:\Windows\System\pVVNzkK.exe
  C:\Windows\System\pVVNzkK.exe
  2⤵
  PID:9036
- C:\Windows\System\dJotGQB.exe
  C:\Windows\System\dJotGQB.exe
  2⤵
  PID:9068
- C:\Windows\System\oPFribp.exe
  C:\Windows\System\oPFribp.exe
  2⤵
  PID:9092
- C:\Windows\System\CWxzWQQ.exe
  C:\Windows\System\CWxzWQQ.exe
  2⤵
  PID:9128
- C:\Windows\System\FrYhjub.exe
  C:\Windows\System\FrYhjub.exe
  2⤵
  PID:9148
- C:\Windows\System\elvxvMU.exe
  C:\Windows\System\elvxvMU.exe
  2⤵
  PID:9180
- C:\Windows\System\MsnUScN.exe
  C:\Windows\System\MsnUScN.exe
  2⤵
  PID:9200
- C:\Windows\System\wuNhNfQ.exe
  C:\Windows\System\wuNhNfQ.exe
  2⤵
  PID:8140
- C:\Windows\System\rENcSmV.exe
  C:\Windows\System\rENcSmV.exe
  2⤵
  PID:8164
- C:\Windows\System\FASNpkn.exe
  C:\Windows\System\FASNpkn.exe
  2⤵
  PID:8312
- C:\Windows\System\caUPqqs.exe
  C:\Windows\System\caUPqqs.exe
  2⤵
  PID:8388
- C:\Windows\System\dEaKNoz.exe
  C:\Windows\System\dEaKNoz.exe
  2⤵
  PID:8504
- C:\Windows\System\DihbypJ.exe
  C:\Windows\System\DihbypJ.exe
  2⤵
  PID:8380
- C:\Windows\System\TTzVzGh.exe
  C:\Windows\System\TTzVzGh.exe
  2⤵
  PID:8484
- C:\Windows\System\dsXbvjk.exe
  C:\Windows\System\dsXbvjk.exe
  2⤵
  PID:8560
- C:\Windows\System\gxikJNv.exe
  C:\Windows\System\gxikJNv.exe
  2⤵
  PID:8668
- C:\Windows\System\pQqZKxR.exe
  C:\Windows\System\pQqZKxR.exe
  2⤵
  PID:8744
- C:\Windows\System\ICGPQYk.exe
  C:\Windows\System\ICGPQYk.exe
  2⤵
  PID:8872
- C:\Windows\System\GsEnMtz.exe
  C:\Windows\System\GsEnMtz.exe
  2⤵
  PID:8880
- C:\Windows\System\NNcFnqp.exe
  C:\Windows\System\NNcFnqp.exe
  2⤵
  PID:9020
- C:\Windows\System\hDYBYej.exe
  C:\Windows\System\hDYBYej.exe
  2⤵
  PID:9084
- C:\Windows\System\fpFGCpQ.exe
  C:\Windows\System\fpFGCpQ.exe
  2⤵
  PID:9104
- C:\Windows\System\EzMBRDI.exe
  C:\Windows\System\EzMBRDI.exe
  2⤵
  PID:8268
- C:\Windows\System\tdrOBbd.exe
  C:\Windows\System\tdrOBbd.exe
  2⤵
  PID:9112
- C:\Windows\System\kHnJvQu.exe
  C:\Windows\System\kHnJvQu.exe
  2⤵
  PID:8492
- C:\Windows\System\DDxDkfb.exe
  C:\Windows\System\DDxDkfb.exe
  2⤵
  PID:8292
- C:\Windows\System\KIoaEXN.exe
  C:\Windows\System\KIoaEXN.exe
  2⤵
  PID:8612
- C:\Windows\System\FONgZMe.exe
  C:\Windows\System\FONgZMe.exe
  2⤵
  PID:8852
- C:\Windows\System\LySekFj.exe
  C:\Windows\System\LySekFj.exe
  2⤵
  PID:8788
- C:\Windows\System\DMrVdgi.exe
  C:\Windows\System\DMrVdgi.exe
  2⤵
  PID:9052
- C:\Windows\System\gndYkWj.exe
  C:\Windows\System\gndYkWj.exe
  2⤵
  PID:9168
- C:\Windows\System\YxHpQto.exe
  C:\Windows\System\YxHpQto.exe
  2⤵
  PID:9140
- C:\Windows\System\QtFpPCt.exe
  C:\Windows\System\QtFpPCt.exe
  2⤵
  PID:9212
- C:\Windows\System\SkzqFlM.exe
  C:\Windows\System\SkzqFlM.exe
  2⤵
  PID:9240
- C:\Windows\System\yUxArJA.exe
  C:\Windows\System\yUxArJA.exe
  2⤵
  PID:9268
- C:\Windows\System\eDqOgPr.exe
  C:\Windows\System\eDqOgPr.exe
  2⤵
  PID:9296
- C:\Windows\System\fAFsCpV.exe
  C:\Windows\System\fAFsCpV.exe
  2⤵
  PID:9320
- C:\Windows\System\GirhNfi.exe
  C:\Windows\System\GirhNfi.exe
  2⤵
  PID:9352
- C:\Windows\System\XFjDPYv.exe
  C:\Windows\System\XFjDPYv.exe
  2⤵
  PID:9380
- C:\Windows\System\dLXYnRB.exe
  C:\Windows\System\dLXYnRB.exe
  2⤵
  PID:9404
- C:\Windows\System\HiLmEmw.exe
  C:\Windows\System\HiLmEmw.exe
  2⤵
  PID:9436
- C:\Windows\System\kGiEIrg.exe
  C:\Windows\System\kGiEIrg.exe
  2⤵
  PID:9452
- C:\Windows\System\SGCqBDr.exe
  C:\Windows\System\SGCqBDr.exe
  2⤵
  PID:9468
- C:\Windows\System\tPyMeYa.exe
  C:\Windows\System\tPyMeYa.exe
  2⤵
  PID:9484
- C:\Windows\System\LLbDfbY.exe
  C:\Windows\System\LLbDfbY.exe
  2⤵
  PID:9516
- C:\Windows\System\qsnBJqE.exe
  C:\Windows\System\qsnBJqE.exe
  2⤵
  PID:9544
- C:\Windows\System\IzYNieW.exe
  C:\Windows\System\IzYNieW.exe
  2⤵
  PID:9560
- C:\Windows\System\oSgnPUF.exe
  C:\Windows\System\oSgnPUF.exe
  2⤵
  PID:9588
- C:\Windows\System\LYLfjPw.exe
  C:\Windows\System\LYLfjPw.exe
  2⤵
  PID:9624
- C:\Windows\System\fvZerhI.exe
  C:\Windows\System\fvZerhI.exe
  2⤵
  PID:9644
- C:\Windows\System\LHpXzhL.exe
  C:\Windows\System\LHpXzhL.exe
  2⤵
  PID:9668
- C:\Windows\System\RXoJbPv.exe
  C:\Windows\System\RXoJbPv.exe
  2⤵
  PID:9692
- C:\Windows\System\YsNUqDh.exe
  C:\Windows\System\YsNUqDh.exe
  2⤵
  PID:9720
- C:\Windows\System\RDbMzCj.exe
  C:\Windows\System\RDbMzCj.exe
  2⤵
  PID:9740
- C:\Windows\System\WqaNekk.exe
  C:\Windows\System\WqaNekk.exe
  2⤵
  PID:9772
- C:\Windows\System\OgitGAK.exe
  C:\Windows\System\OgitGAK.exe
  2⤵
  PID:9796
- C:\Windows\System\XKxuaDB.exe
  C:\Windows\System\XKxuaDB.exe
  2⤵
  PID:9824
- C:\Windows\System\ClZyPwA.exe
  C:\Windows\System\ClZyPwA.exe
  2⤵
  PID:9856
- C:\Windows\System\iZdVYbX.exe
  C:\Windows\System\iZdVYbX.exe
  2⤵
  PID:9872
- C:\Windows\System\ghWDbqe.exe
  C:\Windows\System\ghWDbqe.exe
  2⤵
  PID:9888
- C:\Windows\System\aqdKSvf.exe
  C:\Windows\System\aqdKSvf.exe
  2⤵
  PID:9916
- C:\Windows\System\AqeDMhy.exe
  C:\Windows\System\AqeDMhy.exe
  2⤵
  PID:9944
- C:\Windows\System\diXiQLj.exe
  C:\Windows\System\diXiQLj.exe
  2⤵
  PID:9968
- C:\Windows\System\YrPbxRA.exe
  C:\Windows\System\YrPbxRA.exe
  2⤵
  PID:9996
- C:\Windows\System\ajdTesM.exe
  C:\Windows\System\ajdTesM.exe
  2⤵
  PID:10012
- C:\Windows\System\lnNTnRU.exe
  C:\Windows\System\lnNTnRU.exe
  2⤵
  PID:10040
- C:\Windows\System\XuXsxNR.exe
  C:\Windows\System\XuXsxNR.exe
  2⤵
  PID:10076
- C:\Windows\System\WDRwqnV.exe
  C:\Windows\System\WDRwqnV.exe
  2⤵
  PID:10104
- C:\Windows\System\dkIzvKC.exe
  C:\Windows\System\dkIzvKC.exe
  2⤵
  PID:10128
- C:\Windows\System\HsdJpJr.exe
  C:\Windows\System\HsdJpJr.exe
  2⤵
  PID:10156
- C:\Windows\System\DCHsOhh.exe
  C:\Windows\System\DCHsOhh.exe
  2⤵
  PID:10188
- C:\Windows\System\QRFlcCx.exe
  C:\Windows\System\QRFlcCx.exe
  2⤵
  PID:10216
- C:\Windows\System\gyMFkau.exe
  C:\Windows\System\gyMFkau.exe
  2⤵
  PID:8340
- C:\Windows\System\Ygtiqwh.exe
  C:\Windows\System\Ygtiqwh.exe
  2⤵
  PID:8816
- C:\Windows\System\VCexemp.exe
  C:\Windows\System\VCexemp.exe
  2⤵
  PID:9256
- C:\Windows\System\XlZdyNz.exe
  C:\Windows\System\XlZdyNz.exe
  2⤵
  PID:8344
- C:\Windows\System\ThThtZd.exe
  C:\Windows\System\ThThtZd.exe
  2⤵
  PID:9368
- C:\Windows\System\dYVkYzG.exe
  C:\Windows\System\dYVkYzG.exe
  2⤵
  PID:9448
- C:\Windows\System\tmQspcV.exe
  C:\Windows\System\tmQspcV.exe
  2⤵
  PID:9280
- C:\Windows\System\fFPBArU.exe
  C:\Windows\System\fFPBArU.exe
  2⤵
  PID:9580
- C:\Windows\System\nYtsjtb.exe
  C:\Windows\System\nYtsjtb.exe
  2⤵
  PID:9620
- C:\Windows\System\vnlQria.exe
  C:\Windows\System\vnlQria.exe
  2⤵
  PID:9688
- C:\Windows\System\LfIAdOu.exe
  C:\Windows\System\LfIAdOu.exe
  2⤵
  PID:9528
- C:\Windows\System\vdDZaKt.exe
  C:\Windows\System\vdDZaKt.exe
  2⤵
  PID:9808
- C:\Windows\System\aSPhFnQ.exe
  C:\Windows\System\aSPhFnQ.exe
  2⤵
  PID:9884
- C:\Windows\System\dbJNFMk.exe
  C:\Windows\System\dbJNFMk.exe
  2⤵
  PID:9940
- C:\Windows\System\DdVJsKV.exe
  C:\Windows\System\DdVJsKV.exe
  2⤵
  PID:9956
- C:\Windows\System\AaTIcrG.exe
  C:\Windows\System\AaTIcrG.exe
  2⤵
  PID:10024
- C:\Windows\System\jRMyuXC.exe
  C:\Windows\System\jRMyuXC.exe
  2⤵
  PID:10060
- C:\Windows\System\upWHfkT.exe
  C:\Windows\System\upWHfkT.exe
  2⤵
  PID:9144
- C:\Windows\System\huCKzAu.exe
  C:\Windows\System\huCKzAu.exe
  2⤵
  PID:10212
- C:\Windows\System\yiMDevv.exe
  C:\Windows\System\yiMDevv.exe
  2⤵
  PID:9328
- C:\Windows\System\bCpCvUE.exe
  C:\Windows\System\bCpCvUE.exe
  2⤵
  PID:9584
- C:\Windows\System\wMpHxGx.exe
  C:\Windows\System\wMpHxGx.exe
  2⤵
  PID:9984
- C:\Windows\System\bSzXCYu.exe
  C:\Windows\System\bSzXCYu.exe
  2⤵
  PID:9556
- C:\Windows\System\ylmRMMk.exe
  C:\Windows\System\ylmRMMk.exe
  2⤵
  PID:9964
- C:\Windows\System\bIqHtMV.exe
  C:\Windows\System\bIqHtMV.exe
  2⤵
  PID:8840
- C:\Windows\System\EibIQvk.exe
  C:\Windows\System\EibIQvk.exe
  2⤵
  PID:10252
- C:\Windows\System\RrVdMPs.exe
  C:\Windows\System\RrVdMPs.exe
  2⤵
  PID:10276
- C:\Windows\System\HcyfavF.exe
  C:\Windows\System\HcyfavF.exe
  2⤵
  PID:10308
- C:\Windows\System\CLfhXwS.exe
  C:\Windows\System\CLfhXwS.exe
  2⤵
  PID:10336
- C:\Windows\System\ySKaaCW.exe
  C:\Windows\System\ySKaaCW.exe
  2⤵
  PID:10352
- C:\Windows\System\SdFlfrr.exe
  C:\Windows\System\SdFlfrr.exe
  2⤵
  PID:10376
- C:\Windows\System\tZSLAMV.exe
  C:\Windows\System\tZSLAMV.exe
  2⤵
  PID:10400
- C:\Windows\System\MTEWKyB.exe
  C:\Windows\System\MTEWKyB.exe
  2⤵
  PID:10420
- C:\Windows\System\usjcCGt.exe
  C:\Windows\System\usjcCGt.exe
  2⤵
  PID:10444
- C:\Windows\System\mrdJoZX.exe
  C:\Windows\System\mrdJoZX.exe
  2⤵
  PID:10476
- C:\Windows\System\XufBrnF.exe
  C:\Windows\System\XufBrnF.exe
  2⤵
  PID:10500
- C:\Windows\System\FOdqYzA.exe
  C:\Windows\System\FOdqYzA.exe
  2⤵
  PID:10528
- C:\Windows\System\IMvIPvx.exe
  C:\Windows\System\IMvIPvx.exe
  2⤵
  PID:10556
- C:\Windows\System\ElBLPhx.exe
  C:\Windows\System\ElBLPhx.exe
  2⤵
  PID:10584
- C:\Windows\System\pHSBpTo.exe
  C:\Windows\System\pHSBpTo.exe
  2⤵
  PID:10600
- C:\Windows\System\VEbfAqM.exe
  C:\Windows\System\VEbfAqM.exe
  2⤵
  PID:10620
- C:\Windows\System\fwYsIYf.exe
  C:\Windows\System\fwYsIYf.exe
  2⤵
  PID:10648
- C:\Windows\System\ACXoiSa.exe
  C:\Windows\System\ACXoiSa.exe
  2⤵
  PID:10676
- C:\Windows\System\nbqFsEA.exe
  C:\Windows\System\nbqFsEA.exe
  2⤵
  PID:10696
- C:\Windows\System\YgVnUXA.exe
  C:\Windows\System\YgVnUXA.exe
  2⤵
  PID:10728
- C:\Windows\System\ZyoRFYh.exe
  C:\Windows\System\ZyoRFYh.exe
  2⤵
  PID:10752
- C:\Windows\System\rysTGfs.exe
  C:\Windows\System\rysTGfs.exe
  2⤵
  PID:10788
- C:\Windows\System\ipRDKoI.exe
  C:\Windows\System\ipRDKoI.exe
  2⤵
  PID:10812
- C:\Windows\System\KPJzCqN.exe
  C:\Windows\System\KPJzCqN.exe
  2⤵
  PID:10836
- C:\Windows\System\RtMdazM.exe
  C:\Windows\System\RtMdazM.exe
  2⤵
  PID:10868
- C:\Windows\System\wgjCiBa.exe
  C:\Windows\System\wgjCiBa.exe
  2⤵
  PID:10904
- C:\Windows\System\UsSJIMN.exe
  C:\Windows\System\UsSJIMN.exe
  2⤵
  PID:10920
- C:\Windows\System\LWsWoTZ.exe
  C:\Windows\System\LWsWoTZ.exe
  2⤵
  PID:10944
- C:\Windows\System\qkHYaUg.exe
  C:\Windows\System\qkHYaUg.exe
  2⤵
  PID:10964
- C:\Windows\System\qBEKVNL.exe
  C:\Windows\System\qBEKVNL.exe
  2⤵
  PID:10988
- C:\Windows\System\xwqtQzy.exe
  C:\Windows\System\xwqtQzy.exe
  2⤵
  PID:11020
- C:\Windows\System\vMePzJK.exe
  C:\Windows\System\vMePzJK.exe
  2⤵
  PID:11044
- C:\Windows\System\pVpWJgx.exe
  C:\Windows\System\pVpWJgx.exe
  2⤵
  PID:11076
- C:\Windows\System\bnpZbTJ.exe
  C:\Windows\System\bnpZbTJ.exe
  2⤵
  PID:11100
- C:\Windows\System\sHAtvcL.exe
  C:\Windows\System\sHAtvcL.exe
  2⤵
  PID:11124
- C:\Windows\System\oFxyAkG.exe
  C:\Windows\System\oFxyAkG.exe
  2⤵
  PID:11152
- C:\Windows\System\qUaMmak.exe
  C:\Windows\System\qUaMmak.exe
  2⤵
  PID:11176
- C:\Windows\System\ysvFSAM.exe
  C:\Windows\System\ysvFSAM.exe
  2⤵
  PID:11196
- C:\Windows\System\EiLEeFl.exe
  C:\Windows\System\EiLEeFl.exe
  2⤵
  PID:11216
- C:\Windows\System\mBckYzP.exe
  C:\Windows\System\mBckYzP.exe
  2⤵
  PID:11248
- C:\Windows\System\ZnEtEWF.exe
  C:\Windows\System\ZnEtEWF.exe
  2⤵
  PID:9656
- C:\Windows\System\gMmScrH.exe
  C:\Windows\System\gMmScrH.exe
  2⤵
  PID:10120
- C:\Windows\System\QeLhvbZ.exe
  C:\Windows\System\QeLhvbZ.exe
  2⤵
  PID:10168
- C:\Windows\System\SMtJdaW.exe
  C:\Windows\System\SMtJdaW.exe
  2⤵
  PID:10296
- C:\Windows\System\ovQurRb.exe
  C:\Windows\System\ovQurRb.exe
  2⤵
  PID:10116
- C:\Windows\System\fkhPsgM.exe
  C:\Windows\System\fkhPsgM.exe
  2⤵
  PID:10408
- C:\Windows\System\SPRJasG.exe
  C:\Windows\System\SPRJasG.exe
  2⤵
  PID:10344
- C:\Windows\System\rmmnXhI.exe
  C:\Windows\System\rmmnXhI.exe
  2⤵
  PID:10388
- C:\Windows\System\PThyzCG.exe
  C:\Windows\System\PThyzCG.exe
  2⤵
  PID:10468
- C:\Windows\System\vxlRJrx.exe
  C:\Windows\System\vxlRJrx.exe
  2⤵
  PID:10776
- C:\Windows\System\OBhSZBz.exe
  C:\Windows\System\OBhSZBz.exe
  2⤵
  PID:10456
- C:\Windows\System\tAxvfSu.exe
  C:\Windows\System\tAxvfSu.exe
  2⤵
  PID:10860
- C:\Windows\System\obXMycH.exe
  C:\Windows\System\obXMycH.exe
  2⤵
  PID:10772
- C:\Windows\System\LrcyIfc.exe
  C:\Windows\System\LrcyIfc.exe
  2⤵
  PID:11064
- C:\Windows\System\QeVmlTv.exe
  C:\Windows\System\QeVmlTv.exe
  2⤵
  PID:10708
- C:\Windows\System\VFjfory.exe
  C:\Windows\System\VFjfory.exe
  2⤵
  PID:10740
- C:\Windows\System\UynoyyR.exe
  C:\Windows\System\UynoyyR.exe
  2⤵
  PID:10996
- C:\Windows\System\uhJpAYj.exe
  C:\Windows\System\uhJpAYj.exe
  2⤵
  PID:11068
- C:\Windows\System\uLKgWkx.exe
  C:\Windows\System\uLKgWkx.exe
  2⤵
  PID:11116
- C:\Windows\System\CCjrzNX.exe
  C:\Windows\System\CCjrzNX.exe
  2⤵
  PID:11016
- C:\Windows\System\CSxcAdX.exe
  C:\Windows\System\CSxcAdX.exe
  2⤵
  PID:11204
- C:\Windows\System\lBwjJjL.exe
  C:\Windows\System\lBwjJjL.exe
  2⤵
  PID:11140
- C:\Windows\System\VTCZKof.exe
  C:\Windows\System\VTCZKof.exe
  2⤵
  PID:10372
- C:\Windows\System\uaAlxKs.exe
  C:\Windows\System\uaAlxKs.exe
  2⤵
  PID:11036
- C:\Windows\System\AbTnYXW.exe
  C:\Windows\System\AbTnYXW.exe
  2⤵
  PID:11112
- C:\Windows\System\pvDgzZQ.exe
  C:\Windows\System\pvDgzZQ.exe
  2⤵
  PID:11296
- C:\Windows\System\ipdGNBU.exe
  C:\Windows\System\ipdGNBU.exe
  2⤵
  PID:11332
- C:\Windows\System\EZBjsBZ.exe
  C:\Windows\System\EZBjsBZ.exe
  2⤵
  PID:11352
- C:\Windows\System\nbzPadS.exe
  C:\Windows\System\nbzPadS.exe
  2⤵
  PID:11372
- C:\Windows\System\ThrIoxE.exe
  C:\Windows\System\ThrIoxE.exe
  2⤵
  PID:11392
- C:\Windows\System\etfiafB.exe
  C:\Windows\System\etfiafB.exe
  2⤵
  PID:11420
- C:\Windows\System\ydvNYTW.exe
  C:\Windows\System\ydvNYTW.exe
  2⤵
  PID:11448
- C:\Windows\System\GtYVAvo.exe
  C:\Windows\System\GtYVAvo.exe
  2⤵
  PID:11480
- C:\Windows\System\OOFwyYB.exe
  C:\Windows\System\OOFwyYB.exe
  2⤵
  PID:11512
- C:\Windows\System\vBHsBBG.exe
  C:\Windows\System\vBHsBBG.exe
  2⤵
  PID:11532
- C:\Windows\System\dtXyOim.exe
  C:\Windows\System\dtXyOim.exe
  2⤵
  PID:11552
- C:\Windows\System\fStRwxi.exe
  C:\Windows\System\fStRwxi.exe
  2⤵
  PID:11580
- C:\Windows\System\kDlaceJ.exe
  C:\Windows\System\kDlaceJ.exe
  2⤵
  PID:11612
- C:\Windows\System\KqhnfKU.exe
  C:\Windows\System\KqhnfKU.exe
  2⤵
  PID:11640
- C:\Windows\System\jbAfkUr.exe
  C:\Windows\System\jbAfkUr.exe
  2⤵
  PID:11660
- C:\Windows\System\xlbSKho.exe
  C:\Windows\System\xlbSKho.exe
  2⤵
  PID:11688
- C:\Windows\System\RiTMnAV.exe
  C:\Windows\System\RiTMnAV.exe
  2⤵
  PID:11712
- C:\Windows\System\sfQnZAP.exe
  C:\Windows\System\sfQnZAP.exe
  2⤵
  PID:11740
- C:\Windows\System\qpBbOIJ.exe
  C:\Windows\System\qpBbOIJ.exe
  2⤵
  PID:11764
- C:\Windows\System\ODytytP.exe
  C:\Windows\System\ODytytP.exe
  2⤵
  PID:11800
- C:\Windows\System\Pmqqmny.exe
  C:\Windows\System\Pmqqmny.exe
  2⤵
  PID:11824
- C:\Windows\System\OfiMYpU.exe
  C:\Windows\System\OfiMYpU.exe
  2⤵
  PID:11852
- C:\Windows\System\ZynWVyB.exe
  C:\Windows\System\ZynWVyB.exe
  2⤵
  PID:11868
- C:\Windows\System\SgfIVpJ.exe
  C:\Windows\System\SgfIVpJ.exe
  2⤵
  PID:11896
- C:\Windows\System\CVbPisJ.exe
  C:\Windows\System\CVbPisJ.exe
  2⤵
  PID:11920
- C:\Windows\System\HHzQBcP.exe
  C:\Windows\System\HHzQBcP.exe
  2⤵
  PID:11944
- C:\Windows\System\XiywiKN.exe
  C:\Windows\System\XiywiKN.exe
  2⤵
  PID:11964
- C:\Windows\System\oSWROaR.exe
  C:\Windows\System\oSWROaR.exe
  2⤵
  PID:12000
- C:\Windows\System\RsKyTBd.exe
  C:\Windows\System\RsKyTBd.exe
  2⤵
  PID:12036
- C:\Windows\System\DOXeSEv.exe
  C:\Windows\System\DOXeSEv.exe
  2⤵
  PID:12072
- C:\Windows\System\hypzTpz.exe
  C:\Windows\System\hypzTpz.exe
  2⤵
  PID:12096
- C:\Windows\System\XmVJHZL.exe
  C:\Windows\System\XmVJHZL.exe
  2⤵
  PID:12128
- C:\Windows\System\ceOcwFU.exe
  C:\Windows\System\ceOcwFU.exe
  2⤵
  PID:12160
- C:\Windows\System\ZInoZTj.exe
  C:\Windows\System\ZInoZTj.exe
  2⤵
  PID:12180
- C:\Windows\System\ZldSCEr.exe
  C:\Windows\System\ZldSCEr.exe
  2⤵
  PID:12200
- C:\Windows\System\hTrqJIy.exe
  C:\Windows\System\hTrqJIy.exe
  2⤵
  PID:12232
- C:\Windows\System\eaiCEII.exe
  C:\Windows\System\eaiCEII.exe
  2⤵
  PID:12260
- C:\Windows\System\KWSxKxM.exe
  C:\Windows\System\KWSxKxM.exe
  2⤵
  PID:10808
- C:\Windows\System\krajSrs.exe
  C:\Windows\System\krajSrs.exe
  2⤵
  PID:10640
- C:\Windows\System\pLPsSmq.exe
  C:\Windows\System\pLPsSmq.exe
  2⤵
  PID:10512
- C:\Windows\System\KVXPyLf.exe
  C:\Windows\System\KVXPyLf.exe
  2⤵
  PID:9364
- C:\Windows\System\DnOGWox.exe
  C:\Windows\System\DnOGWox.exe
  2⤵
  PID:11344
- C:\Windows\System\YjeupyJ.exe
  C:\Windows\System\YjeupyJ.exe
  2⤵
  PID:10956
- C:\Windows\System\PxoYBTA.exe
  C:\Windows\System\PxoYBTA.exe
  2⤵
  PID:11292
- C:\Windows\System\QmxunOx.exe
  C:\Windows\System\QmxunOx.exe
  2⤵
  PID:10260
- C:\Windows\System\aoaAruC.exe
  C:\Windows\System\aoaAruC.exe
  2⤵
  PID:11568
- C:\Windows\System\zGhYGuZ.exe
  C:\Windows\System\zGhYGuZ.exe
  2⤵
  PID:11384
- C:\Windows\System\noHJPJc.exe
  C:\Windows\System\noHJPJc.exe
  2⤵
  PID:11444
- C:\Windows\System\ltcFrsI.exe
  C:\Windows\System\ltcFrsI.exe
  2⤵
  PID:10628
- C:\Windows\System\VFPAEpj.exe
  C:\Windows\System\VFPAEpj.exe
  2⤵
  PID:11752
- C:\Windows\System\XnbZuHS.exe
  C:\Windows\System\XnbZuHS.exe
  2⤵
  PID:11648
- C:\Windows\System\XVauSnL.exe
  C:\Windows\System\XVauSnL.exe
  2⤵
  PID:11888
- C:\Windows\System\TqAYAGo.exe
  C:\Windows\System\TqAYAGo.exe
  2⤵
  PID:11748
- C:\Windows\System\EQFiRkQ.exe
  C:\Windows\System\EQFiRkQ.exe
  2⤵
  PID:11820
- C:\Windows\System\hXUuEPl.exe
  C:\Windows\System\hXUuEPl.exe
  2⤵
  PID:11700
- C:\Windows\System\BEjuNLd.exe
  C:\Windows\System\BEjuNLd.exe
  2⤵
  PID:12224
- C:\Windows\System\KXiXcVY.exe
  C:\Windows\System\KXiXcVY.exe
  2⤵
  PID:12276
- C:\Windows\System\IRUpsnp.exe
  C:\Windows\System\IRUpsnp.exe
  2⤵
  PID:12048
- C:\Windows\System\LWSRUtb.exe
  C:\Windows\System\LWSRUtb.exe
  2⤵
  PID:10896
- C:\Windows\System\ACucSvw.exe
  C:\Windows\System\ACucSvw.exe
  2⤵
  PID:12240
- C:\Windows\System\KMBkpsR.exe
  C:\Windows\System\KMBkpsR.exe
  2⤵
  PID:11736
- C:\Windows\System\xHPsgbl.exe
  C:\Windows\System\xHPsgbl.exe
  2⤵
  PID:10880
- C:\Windows\System\fBYmdhb.exe
  C:\Windows\System\fBYmdhb.exe
  2⤵
  PID:12316
- C:\Windows\System\IZDkFdB.exe
  C:\Windows\System\IZDkFdB.exe
  2⤵
  PID:12332
- C:\Windows\System\mlKvdsf.exe
  C:\Windows\System\mlKvdsf.exe
  2⤵
  PID:12372
- C:\Windows\System\lqYFNFx.exe
  C:\Windows\System\lqYFNFx.exe
  2⤵
  PID:12412
- C:\Windows\System\oYPZepZ.exe
  C:\Windows\System\oYPZepZ.exe
  2⤵
  PID:12452
- C:\Windows\System\gDKKVJt.exe
  C:\Windows\System\gDKKVJt.exe
  2⤵
  PID:12480
- C:\Windows\System\PKNAOdv.exe
  C:\Windows\System\PKNAOdv.exe
  2⤵
  PID:12508
- C:\Windows\System\QUJPMqw.exe
  C:\Windows\System\QUJPMqw.exe
  2⤵
  PID:12544
- C:\Windows\System\liMbIAq.exe
  C:\Windows\System\liMbIAq.exe
  2⤵
  PID:12568
- C:\Windows\System\OPZLPOc.exe
  C:\Windows\System\OPZLPOc.exe
  2⤵
  PID:12596
- C:\Windows\System\rwLSbSY.exe
  C:\Windows\System\rwLSbSY.exe
  2⤵
  PID:12620
- C:\Windows\System\iMHzkwg.exe
  C:\Windows\System\iMHzkwg.exe
  2⤵
  PID:12648
- C:\Windows\System\QoErtDu.exe
  C:\Windows\System\QoErtDu.exe
  2⤵
  PID:12672
- C:\Windows\System\PjFSDOj.exe
  C:\Windows\System\PjFSDOj.exe
  2⤵
  PID:12692
- C:\Windows\System\atpnKpS.exe
  C:\Windows\System\atpnKpS.exe
  2⤵
  PID:12724
- C:\Windows\System\MUKjjGG.exe
  C:\Windows\System\MUKjjGG.exe
  2⤵
  PID:12756
- C:\Windows\System\ZRcqaiC.exe
  C:\Windows\System\ZRcqaiC.exe
  2⤵
  PID:12780
- C:\Windows\System\SyqydBr.exe
  C:\Windows\System\SyqydBr.exe
  2⤵
  PID:12812
- C:\Windows\System\jhVciBb.exe
  C:\Windows\System\jhVciBb.exe
  2⤵
  PID:12828
- C:\Windows\System\IzCpPtP.exe
  C:\Windows\System\IzCpPtP.exe
  2⤵
  PID:12844
- C:\Windows\System\UyRlFsI.exe
  C:\Windows\System\UyRlFsI.exe
  2⤵
  PID:12872
- C:\Windows\System\baCNyOw.exe
  C:\Windows\System\baCNyOw.exe
  2⤵
  PID:12892
- C:\Windows\System\GOHTSNF.exe
  C:\Windows\System\GOHTSNF.exe
  2⤵
  PID:12916
- C:\Windows\System\XgJEpZx.exe
  C:\Windows\System\XgJEpZx.exe
  2⤵
  PID:12940
- C:\Windows\System\hLKRDWk.exe
  C:\Windows\System\hLKRDWk.exe
  2⤵
  PID:12968
- C:\Windows\System\iYFshYr.exe
  C:\Windows\System\iYFshYr.exe
  2⤵
  PID:12992
- C:\Windows\System\iMlyuXk.exe
  C:\Windows\System\iMlyuXk.exe
  2⤵
  PID:13020
- C:\Windows\System\EHDAvmi.exe
  C:\Windows\System\EHDAvmi.exe
  2⤵
  PID:13044
- C:\Windows\System\CGYyMqi.exe
  C:\Windows\System\CGYyMqi.exe
  2⤵
  PID:13072
- C:\Windows\System\DxxQNdT.exe
  C:\Windows\System\DxxQNdT.exe
  2⤵
  PID:13100
- C:\Windows\System\zzLIxMk.exe
  C:\Windows\System\zzLIxMk.exe
  2⤵
  PID:13128
- C:\Windows\System\RvuuvuP.exe
  C:\Windows\System\RvuuvuP.exe
  2⤵
  PID:13148
- C:\Windows\System\wnmNueI.exe
  C:\Windows\System\wnmNueI.exe
  2⤵
  PID:13176
- C:\Windows\System\rQhCOov.exe
  C:\Windows\System\rQhCOov.exe
  2⤵
  PID:13196
- C:\Windows\System\NMoCLUw.exe
  C:\Windows\System\NMoCLUw.exe
  2⤵
  PID:13224
- C:\Windows\System\JxaIDId.exe
  C:\Windows\System\JxaIDId.exe
  2⤵
  PID:11520
- C:\Windows\System\ViwkUXe.exe
  C:\Windows\System\ViwkUXe.exe
  2⤵
  PID:11760
- C:\Windows\System\cnDrrtf.exe
  C:\Windows\System\cnDrrtf.exe
  2⤵
  PID:11404
- C:\Windows\System\qIGJmXJ.exe
  C:\Windows\System\qIGJmXJ.exe
  2⤵
  PID:12324
- C:\Windows\System\EvLyEYE.exe
  C:\Windows\System\EvLyEYE.exe
  2⤵
  PID:12024
- C:\Windows\System\nCednMc.exe
  C:\Windows\System\nCednMc.exe
  2⤵
  PID:12468
- C:\Windows\System\ATdJKsB.exe
  C:\Windows\System\ATdJKsB.exe
  2⤵
  PID:12328
- C:\Windows\System\yrOmOcQ.exe
  C:\Windows\System\yrOmOcQ.exe
  2⤵
  PID:11984
- C:\Windows\System\dEjoNTC.exe
  C:\Windows\System\dEjoNTC.exe
  2⤵
  PID:12592
- C:\Windows\System\hmTImsm.exe
  C:\Windows\System\hmTImsm.exe
  2⤵
  PID:12344
- C:\Windows\System\jVTYSAI.exe
  C:\Windows\System\jVTYSAI.exe
  2⤵
  PID:12792
- C:\Windows\System\TEtTTaM.exe
  C:\Windows\System\TEtTTaM.exe
  2⤵
  PID:12492
- C:\Windows\System\CWfmyfH.exe
  C:\Windows\System\CWfmyfH.exe
  2⤵
  PID:12576
- C:\Windows\System\EUdszKK.exe
  C:\Windows\System\EUdszKK.exe
  2⤵
  PID:13000
- C:\Windows\System\FVOVoKc.exe
  C:\Windows\System\FVOVoKc.exe
  2⤵
  PID:12688
- C:\Windows\System\DXIQMGe.exe
  C:\Windows\System\DXIQMGe.exe
  2⤵
  PID:13116
- C:\Windows\System\eFtvhII.exe
  C:\Windows\System\eFtvhII.exe
  2⤵
  PID:12796
- C:\Windows\System\USkdpeD.exe
  C:\Windows\System\USkdpeD.exe
  2⤵
  PID:12860
- C:\Windows\System\vRXXRje.exe
  C:\Windows\System\vRXXRje.exe
  2⤵
  PID:12936
- C:\Windows\System\dEffhwm.exe
  C:\Windows\System\dEffhwm.exe
  2⤵
  PID:13160
- C:\Windows\System\RESKHYo.exe
  C:\Windows\System\RESKHYo.exe
  2⤵
  PID:12060
- C:\Windows\System\hjVRvqk.exe
  C:\Windows\System\hjVRvqk.exe
  2⤵
  PID:13088
- C:\Windows\System\sCjlVpf.exe
  C:\Windows\System\sCjlVpf.exe
  2⤵
  PID:13308
- C:\Windows\System\AjcNrCM.exe
  C:\Windows\System\AjcNrCM.exe
  2⤵
  PID:12220
- C:\Windows\System\hKGnOED.exe
  C:\Windows\System\hKGnOED.exe
  2⤵
  PID:13216
- C:\Windows\System\XSDgxqF.exe
  C:\Windows\System\XSDgxqF.exe
  2⤵
  PID:12440
- C:\Windows\System\rpNHyep.exe
  C:\Windows\System\rpNHyep.exe
  2⤵
  PID:12840
- C:\Windows\System\FMmeBsl.exe
  C:\Windows\System\FMmeBsl.exe
  2⤵
  PID:11956
- C:\Windows\System\uFSeQfU.exe
  C:\Windows\System\uFSeQfU.exe
  2⤵
  PID:12772
- C:\Windows\System\QbBrjzi.exe
  C:\Windows\System\QbBrjzi.exe
  2⤵
  PID:12464
- C:\Windows\System\pfqNKxi.exe
  C:\Windows\System\pfqNKxi.exe
  2⤵
  PID:10848
- C:\Windows\System\XerRSyG.exe
  C:\Windows\System\XerRSyG.exe
  2⤵
  PID:12244
- C:\Windows\System\ZHaBakM.exe
  C:\Windows\System\ZHaBakM.exe
  2⤵
  PID:13324
- C:\Windows\System\PjRicar.exe
  C:\Windows\System\PjRicar.exe
  2⤵
  PID:13344
- C:\Windows\System\ypmducw.exe
  C:\Windows\System\ypmducw.exe
  2⤵
  PID:13372
- C:\Windows\System\Caqekbb.exe
  C:\Windows\System\Caqekbb.exe
  2⤵
  PID:13404
- C:\Windows\System\qAgPwCX.exe
  C:\Windows\System\qAgPwCX.exe
  2⤵
  PID:13428
- C:\Windows\System\soLAewq.exe
  C:\Windows\System\soLAewq.exe
  2⤵
  PID:13448
- C:\Windows\System\QFJaOvG.exe
  C:\Windows\System\QFJaOvG.exe
  2⤵
  PID:13472
- C:\Windows\System\xvHreVC.exe
  C:\Windows\System\xvHreVC.exe
  2⤵
  PID:13848
- C:\Windows\System\rfbwHWU.exe
  C:\Windows\System\rfbwHWU.exe
  2⤵
  PID:13872
- C:\Windows\System\qHAuMGk.exe
  C:\Windows\System\qHAuMGk.exe
  2⤵
  PID:13892
- C:\Windows\System\PiCmRsv.exe
  C:\Windows\System\PiCmRsv.exe
  2⤵
  PID:13920
- C:\Windows\System\DXtEouV.exe
  C:\Windows\System\DXtEouV.exe
  2⤵
  PID:13940
- C:\Windows\System\PXxjBWY.exe
  C:\Windows\System\PXxjBWY.exe
  2⤵
  PID:13964
- C:\Windows\System\oIUcuVN.exe
  C:\Windows\System\oIUcuVN.exe
  2⤵
  PID:13980
- C:\Windows\System\ZbcKgLn.exe
  C:\Windows\System\ZbcKgLn.exe
  2⤵
  PID:14000
- C:\Windows\System\deQHtnp.exe
  C:\Windows\System\deQHtnp.exe
  2⤵
  PID:14024
- C:\Windows\System\bbfpSlN.exe
  C:\Windows\System\bbfpSlN.exe
  2⤵
  PID:14040
- C:\Windows\System\oLtPFiw.exe
  C:\Windows\System\oLtPFiw.exe
  2⤵
  PID:14064
- C:\Windows\System\hfEDjUp.exe
  C:\Windows\System\hfEDjUp.exe
  2⤵
  PID:14088
- C:\Windows\System\HrYFcGV.exe
  C:\Windows\System\HrYFcGV.exe
  2⤵
  PID:14116
- C:\Windows\System\AsJDtNV.exe
  C:\Windows\System\AsJDtNV.exe
  2⤵
  PID:14148
- C:\Windows\System\JqrPHdX.exe
  C:\Windows\System\JqrPHdX.exe
  2⤵
  PID:14172
- C:\Windows\System\VUrmOqP.exe
  C:\Windows\System\VUrmOqP.exe
  2⤵
  PID:14196
- C:\Windows\System\BFYFoxO.exe
  C:\Windows\System\BFYFoxO.exe
  2⤵
  PID:14224
- C:\Windows\System\VSCVJCS.exe
  C:\Windows\System\VSCVJCS.exe
  2⤵
  PID:14248
- C:\Windows\System\DKOukFJ.exe
  C:\Windows\System\DKOukFJ.exe
  2⤵
  PID:14272
- C:\Windows\System\SKXXKUo.exe
  C:\Windows\System\SKXXKUo.exe
  2⤵
  PID:14296
- C:\Windows\System\TCHSbsI.exe
  C:\Windows\System\TCHSbsI.exe
  2⤵
  PID:14316
- C:\Windows\System\kXWmKwb.exe
  C:\Windows\System\kXWmKwb.exe
  2⤵
  PID:12588
- C:\Windows\System\LOUbTyZ.exe
  C:\Windows\System\LOUbTyZ.exe
  2⤵
  PID:13056
- C:\Windows\System\efUsppZ.exe
  C:\Windows\System\efUsppZ.exe
  2⤵
  PID:13296
- C:\Windows\System\inAclqW.exe
  C:\Windows\System\inAclqW.exe
  2⤵
  PID:13512
- C:\Windows\System\nOAtVcp.exe
  C:\Windows\System\nOAtVcp.exe
  2⤵
  PID:13548
- C:\Windows\System\HLsqqvP.exe
  C:\Windows\System\HLsqqvP.exe
  2⤵
  PID:12820
- C:\Windows\System\lywzoPo.exe
  C:\Windows\System\lywzoPo.exe
  2⤵
  PID:13488
- C:\Windows\System\wnYhUxE.exe
  C:\Windows\System\wnYhUxE.exe
  2⤵
  PID:13340
- C:\Windows\System\SPVeqoj.exe
  C:\Windows\System\SPVeqoj.exe
  2⤵
  PID:13484
- C:\Windows\System\XsfOfRI.exe
  C:\Windows\System\XsfOfRI.exe
  2⤵
  PID:13628
- C:\Windows\System\ZiHLxIK.exe
  C:\Windows\System\ZiHLxIK.exe
  2⤵
  PID:13716
- C:\Windows\System\mULRgpo.exe
  C:\Windows\System\mULRgpo.exe
  2⤵
  PID:13788
- C:\Windows\System\eddDEvh.exe
  C:\Windows\System\eddDEvh.exe
  2⤵
  PID:13860
- C:\Windows\System\IOkzHAg.exe
  C:\Windows\System\IOkzHAg.exe
  2⤵
  PID:9764
- C:\Windows\System\kTLLZSw.exe
  C:\Windows\System\kTLLZSw.exe
  2⤵
  PID:13996
- C:\Windows\System\pWlpQEg.exe
  C:\Windows\System\pWlpQEg.exe
  2⤵
  PID:14076
- C:\Windows\System\PHvPwJv.exe
  C:\Windows\System\PHvPwJv.exe
  2⤵
  PID:14084
- C:\Windows\System\hgWIbbL.exe
  C:\Windows\System\hgWIbbL.exe
  2⤵
  PID:14136
- C:\Windows\System\aOoOuZB.exe
  C:\Windows\System\aOoOuZB.exe
  2⤵
  PID:14164
- C:\Windows\System\SbPvwnQ.exe
  C:\Windows\System\SbPvwnQ.exe
  2⤵
  PID:14128
- C:\Windows\System\iNCPitb.exe
  C:\Windows\System\iNCPitb.exe
  2⤵
  PID:14280
- C:\Windows\System\DxeONTr.exe
  C:\Windows\System\DxeONTr.exe
  2⤵
  PID:14324
- C:\Windows\System\PgpfSec.exe
  C:\Windows\System\PgpfSec.exe
  2⤵
  PID:13112
- C:\Windows\System\BLOYfcG.exe
  C:\Windows\System\BLOYfcG.exe
  2⤵
  PID:12504
- C:\Windows\System\DCthgRb.exe
  C:\Windows\System\DCthgRb.exe
  2⤵
  PID:12432
- C:\Windows\System\ydZSgCj.exe
  C:\Windows\System\ydZSgCj.exe
  2⤵
  PID:13464
- C:\Windows\System\yQXBaCK.exe
  C:\Windows\System\yQXBaCK.exe
  2⤵
  PID:14080
- C:\Windows\System\CJMJsWo.exe
  C:\Windows\System\CJMJsWo.exe
  2⤵
  PID:13972
- C:\Windows\System\oXPbZgq.exe
  C:\Windows\System\oXPbZgq.exe
  2⤵
  PID:12884
- C:\Windows\System\uDlsGCh.exe
  C:\Windows\System\uDlsGCh.exe
  2⤵
  PID:14220
- C:\Windows\System\XtxFdFe.exe
  C:\Windows\System\XtxFdFe.exe
  2⤵
  PID:14360
- C:\Windows\System\vHflKGq.exe
  C:\Windows\System\vHflKGq.exe
  2⤵
  PID:14384
- C:\Windows\System\TxzTarK.exe
  C:\Windows\System\TxzTarK.exe
  2⤵
  PID:14408
- C:\Windows\System\dTIOzuN.exe
  C:\Windows\System\dTIOzuN.exe
  2⤵
  PID:14444
- C:\Windows\System\emFUMkc.exe
  C:\Windows\System\emFUMkc.exe
  2⤵
  PID:14464
- C:\Windows\System\xwtWlhV.exe
  C:\Windows\System\xwtWlhV.exe
  2⤵
  PID:14492
- C:\Windows\System\dUUHvAA.exe
  C:\Windows\System\dUUHvAA.exe
  2⤵
  PID:14516
- C:\Windows\System\dSezvST.exe
  C:\Windows\System\dSezvST.exe
  2⤵
  PID:14544
- C:\Windows\System\UUUPWEm.exe
  C:\Windows\System\UUUPWEm.exe
  2⤵
  PID:14568
- C:\Windows\System\XzSIGPF.exe
  C:\Windows\System\XzSIGPF.exe
  2⤵
  PID:14588
- C:\Windows\System\NbybulS.exe
  C:\Windows\System\NbybulS.exe
  2⤵
  PID:14612
- C:\Windows\System\gxLpvlS.exe
  C:\Windows\System\gxLpvlS.exe
  2⤵
  PID:14632
- C:\Windows\System\UDwriPh.exe
  C:\Windows\System\UDwriPh.exe
  2⤵
  PID:14656
- C:\Windows\System\DxBMscc.exe
  C:\Windows\System\DxBMscc.exe
  2⤵
  PID:14672
- C:\Windows\System\zPSmnGS.exe
  C:\Windows\System\zPSmnGS.exe
  2⤵
  PID:14696
- C:\Windows\System\mqtBoPD.exe
  C:\Windows\System\mqtBoPD.exe
  2⤵
  PID:14724
- C:\Windows\System\MnFNKWW.exe
  C:\Windows\System\MnFNKWW.exe
  2⤵
  PID:14744
- C:\Windows\System\qBoaTFK.exe
  C:\Windows\System\qBoaTFK.exe
  2⤵
  PID:14760
- C:\Windows\System\GhNWryi.exe
  C:\Windows\System\GhNWryi.exe
  2⤵
  PID:14780
- C:\Windows\System\IRzpmAn.exe
  C:\Windows\System\IRzpmAn.exe
  2⤵
  PID:14804
- C:\Windows\System\rYqoYDx.exe
  C:\Windows\System\rYqoYDx.exe
  2⤵
  PID:14840
- C:\Windows\System\dqlVKYW.exe
  C:\Windows\System\dqlVKYW.exe
  2⤵
  PID:14876
- C:\Windows\System\APwuBPF.exe
  C:\Windows\System\APwuBPF.exe
  2⤵
  PID:14904
- C:\Windows\System\ywcCdqi.exe
  C:\Windows\System\ywcCdqi.exe
  2⤵
  PID:14928
- C:\Windows\System\wrfVgeN.exe
  C:\Windows\System\wrfVgeN.exe
  2⤵
  PID:14956
- C:\Windows\System\XcQoyxY.exe
  C:\Windows\System\XcQoyxY.exe
  2⤵
  PID:14976
- C:\Windows\System\GVKiDaY.exe
  C:\Windows\System\GVKiDaY.exe
  2⤵
  PID:15004
- C:\Windows\System\qURJypR.exe
  C:\Windows\System\qURJypR.exe
  2⤵
  PID:15020
- C:\Windows\System\CsElbqB.exe
  C:\Windows\System\CsElbqB.exe
  2⤵
  PID:15044
- C:\Windows\System\WMRbgko.exe
  C:\Windows\System\WMRbgko.exe
  2⤵
  PID:15080
- C:\Windows\System\zKdHYdE.exe
  C:\Windows\System\zKdHYdE.exe
  2⤵
  PID:15112
- C:\Windows\System\ErPDgNd.exe
  C:\Windows\System\ErPDgNd.exe
  2⤵
  PID:15136
- C:\Windows\System\WBSVXLc.exe
  C:\Windows\System\WBSVXLc.exe
  2⤵
  PID:15164
- C:\Windows\System\OmMWizD.exe
  C:\Windows\System\OmMWizD.exe
  2⤵
  PID:15184
- C:\Windows\System\TgXUoBL.exe
  C:\Windows\System\TgXUoBL.exe
  2⤵
  PID:15212
- C:\Windows\System\zqscTvR.exe
  C:\Windows\System\zqscTvR.exe
  2⤵
  PID:15240
- C:\Windows\System\YxbANxE.exe
  C:\Windows\System\YxbANxE.exe
  2⤵
  PID:15272
- C:\Windows\System\glxkORp.exe
  C:\Windows\System\glxkORp.exe
  2⤵
  PID:15312
- C:\Windows\System\nouvpRi.exe
  C:\Windows\System\nouvpRi.exe
  2⤵
  PID:15336
- C:\Windows\System\xVvueKl.exe
  C:\Windows\System\xVvueKl.exe
  2⤵
  PID:15352
- C:\Windows\System\RzbffAg.exe
  C:\Windows\System\RzbffAg.exe
  2⤵
  PID:13688
- C:\Windows\System\syTmPgl.exe
  C:\Windows\System\syTmPgl.exe
  2⤵
  PID:13992
- C:\Windows\System\SZhCCbV.exe
  C:\Windows\System\SZhCCbV.exe
  2⤵
  PID:14264
- C:\Windows\System\zcCOGCb.exe
  C:\Windows\System\zcCOGCb.exe
  2⤵
  PID:13696
- C:\Windows\System\paJSirQ.exe
  C:\Windows\System\paJSirQ.exe
  2⤵
  PID:14428
- C:\Windows\System\uSxnNGr.exe
  C:\Windows\System\uSxnNGr.exe
  2⤵
  PID:13736
- C:\Windows\System\xHyMcWO.exe
  C:\Windows\System\xHyMcWO.exe
  2⤵
  PID:13460
- C:\Windows\System\hhUDdSg.exe
  C:\Windows\System\hhUDdSg.exe
  2⤵
  PID:14528
- C:\Windows\System\pKhaTIr.exe
  C:\Windows\System\pKhaTIr.exe
  2⤵
  PID:14400
- C:\Windows\System\KlQMKkt.exe
  C:\Windows\System\KlQMKkt.exe
  2⤵
  PID:14604
- C:\Windows\System\Mucblvz.exe
  C:\Windows\System\Mucblvz.exe
  2⤵
  PID:14552
- C:\Windows\System\LDGymUT.exe
  C:\Windows\System\LDGymUT.exe
  2⤵
  PID:14836
- C:\Windows\System\NkeVwmj.exe
  C:\Windows\System\NkeVwmj.exe
  2⤵
  PID:14608
- C:\Windows\System\ZKmcCpt.exe
  C:\Windows\System\ZKmcCpt.exe
  2⤵
  PID:14924
- C:\Windows\System\wZSxzIz.exe
  C:\Windows\System\wZSxzIz.exe
  2⤵
  PID:14644
- C:\Windows\System\hcDcpWb.exe
  C:\Windows\System\hcDcpWb.exe
  2⤵
  PID:15012
- C:\Windows\System\sMxyOOW.exe
  C:\Windows\System\sMxyOOW.exe
  2⤵
  PID:15108
- C:\Windows\System\xGYRlNP.exe
  C:\Windows\System\xGYRlNP.exe
  2⤵
  PID:15180
- C:\Windows\System\NbdrMdP.exe
  C:\Windows\System\NbdrMdP.exe
  2⤵
  PID:15256
- C:\Windows\System\PCirAmB.exe
  C:\Windows\System\PCirAmB.exe
  2⤵
  PID:15036
- C:\Windows\System\KavuEZi.exe
  C:\Windows\System\KavuEZi.exe
  2⤵
  PID:14916
- C:\Windows\System\ZKWkQjA.exe
  C:\Windows\System\ZKWkQjA.exe
  2⤵
  PID:15220
- C:\Windows\System\ypwIQhb.exe
  C:\Windows\System\ypwIQhb.exe
  2⤵
  PID:15040
- C:\Windows\System\nPeCIEe.exe
  C:\Windows\System\nPeCIEe.exe
  2⤵
  PID:15128
- C:\Windows\System\oXTOvkG.exe
  C:\Windows\System\oXTOvkG.exe
  2⤵
  PID:14860
- C:\Windows\System\ruTBMJB.exe
  C:\Windows\System\ruTBMJB.exe
  2⤵
  PID:15368
- C:\Windows\System\FHuzXLH.exe
  C:\Windows\System\FHuzXLH.exe
  2⤵
  PID:15392
- C:\Windows\System\nhlITVL.exe
  C:\Windows\System\nhlITVL.exe
  2⤵
  PID:15424
- C:\Windows\System\lQoMyYY.exe
  C:\Windows\System\lQoMyYY.exe
  2⤵
  PID:15444
- C:\Windows\System\QFmqznn.exe
  C:\Windows\System\QFmqznn.exe
  2⤵
  PID:15476
- C:\Windows\System\jtapYju.exe
  C:\Windows\System\jtapYju.exe
  2⤵
  PID:15492
- C:\Windows\System\eyjFWko.exe
  C:\Windows\System\eyjFWko.exe
  2⤵
  PID:15532
- C:\Windows\System\MWcMRQA.exe
  C:\Windows\System\MWcMRQA.exe
  2⤵
  PID:15560
- C:\Windows\System\TwOwOWA.exe
  C:\Windows\System\TwOwOWA.exe
  2⤵
  PID:15588
- C:\Windows\System\MApKoRQ.exe
  C:\Windows\System\MApKoRQ.exe
  2⤵
  PID:15616
- C:\Windows\System\MEwcHSt.exe
  C:\Windows\System\MEwcHSt.exe
  2⤵
  PID:15636
- C:\Windows\System\ftkVfEi.exe
  C:\Windows\System\ftkVfEi.exe
  2⤵
  PID:15664
- C:\Windows\System\KRQvMzu.exe
  C:\Windows\System\KRQvMzu.exe
  2⤵
  PID:15688
- C:\Windows\System\yylZUkx.exe
  C:\Windows\System\yylZUkx.exe
  2⤵
  PID:15712
- C:\Windows\System\FutiYGD.exe
  C:\Windows\System\FutiYGD.exe
  2⤵
  PID:15732
- C:\Windows\System\GqhzZEy.exe
  C:\Windows\System\GqhzZEy.exe
  2⤵
  PID:15760
- C:\Windows\System\UMDSXeF.exe
  C:\Windows\System\UMDSXeF.exe
  2⤵
  PID:15800
- C:\Windows\System\iRfLeqU.exe
  C:\Windows\System\iRfLeqU.exe
  2⤵
  PID:15832
- C:\Windows\System\ERfFfzp.exe
  C:\Windows\System\ERfFfzp.exe
  2⤵
  PID:15852
- C:\Windows\System\IxnnNBs.exe
  C:\Windows\System\IxnnNBs.exe
  2⤵
  PID:15880
- C:\Windows\System\EfHaBKg.exe
  C:\Windows\System\EfHaBKg.exe
  2⤵
  PID:15900
- C:\Windows\System\YvZcxvC.exe
  C:\Windows\System\YvZcxvC.exe
  2⤵
  PID:15924
- C:\Windows\System\XOWvdNu.exe
  C:\Windows\System\XOWvdNu.exe
  2⤵
  PID:15952
- C:\Windows\System\jkoezbl.exe
  C:\Windows\System\jkoezbl.exe
  2⤵
  PID:15980
- C:\Windows\System\iYxsgeI.exe
  C:\Windows\System\iYxsgeI.exe
  2⤵
  PID:16004
- C:\Windows\System\ZwOLEvf.exe
  C:\Windows\System\ZwOLEvf.exe
  2⤵
  PID:16024
- C:\Windows\System\UXlZLdD.exe
  C:\Windows\System\UXlZLdD.exe
  2⤵
  PID:16048
- C:\Windows\System\aMmNNwt.exe
  C:\Windows\System\aMmNNwt.exe
  2⤵
  PID:16076
- C:\Windows\System\DKPETTR.exe
  C:\Windows\System\DKPETTR.exe
  2⤵
  PID:16096
- C:\Windows\System\lFoysFM.exe
  C:\Windows\System\lFoysFM.exe
  2⤵
  PID:16132
- C:\Windows\System\inYlQoH.exe
  C:\Windows\System\inYlQoH.exe
  2⤵
  PID:16152
- C:\Windows\System\fjHJROk.exe
  C:\Windows\System\fjHJROk.exe
  2⤵
  PID:16168
- C:\Windows\System\wRMbigK.exe
  C:\Windows\System\wRMbigK.exe
  2⤵
  PID:16188
- C:\Windows\System\HzrOscX.exe
  C:\Windows\System\HzrOscX.exe
  2⤵
  PID:16212
- C:\Windows\System\rJGYWYJ.exe
  C:\Windows\System\rJGYWYJ.exe
  2⤵
  PID:16228
- C:\Windows\System\ALlAiSF.exe
  C:\Windows\System\ALlAiSF.exe
  2⤵
  PID:16252
- C:\Windows\System\DREoxUX.exe
  C:\Windows\System\DREoxUX.exe
  2⤵
  PID:16276
- C:\Windows\System\DVXKZZh.exe
  C:\Windows\System\DVXKZZh.exe
  2⤵
  PID:16300
- C:\Windows\System\wGVTFbp.exe
  C:\Windows\System\wGVTFbp.exe
  2⤵
  PID:16332
- C:\Windows\System\bCTBJSE.exe
  C:\Windows\System\bCTBJSE.exe
  2⤵
  PID:16348
- C:\Windows\System\bdpZPVf.exe
  C:\Windows\System\bdpZPVf.exe
  2⤵
  PID:14776
- C:\Windows\System\ZlDMsff.exe
  C:\Windows\System\ZlDMsff.exe
  2⤵
  PID:14416
- C:\Windows\System\ICexTPG.exe
  C:\Windows\System\ICexTPG.exe
  2⤵
  PID:14500
- C:\Windows\System\vnCqvXY.exe
  C:\Windows\System\vnCqvXY.exe
  2⤵
  PID:15204
- C:\Windows\System\LHVIxLb.exe
  C:\Windows\System\LHVIxLb.exe
  2⤵
  PID:11776
- C:\Windows\System\HEihRgo.exe
  C:\Windows\System\HEihRgo.exe
  2⤵
  PID:12908
- C:\Windows\System\yZHQgLh.exe
  C:\Windows\System\yZHQgLh.exe
  2⤵
  PID:14476
- C:\Windows\System\TBEQfae.exe
  C:\Windows\System\TBEQfae.exe
  2⤵
  PID:15268
- C:\Windows\System\RfegwHB.exe
  C:\Windows\System\RfegwHB.exe
  2⤵
  PID:14864
- C:\Windows\System\fHPrklC.exe
  C:\Windows\System\fHPrklC.exe
  2⤵
  PID:14944
- C:\Windows\System\KjLYnhz.exe
  C:\Windows\System\KjLYnhz.exe
  2⤵
  PID:15288
- C:\Windows\System\XJLwHJE.exe
  C:\Windows\System\XJLwHJE.exe
  2⤵
  PID:15420
- C:\Windows\System\hqQJDTG.exe
  C:\Windows\System\hqQJDTG.exe
  2⤵
  PID:15264
- C:\Windows\System\ZxTzlNJ.exe
  C:\Windows\System\ZxTzlNJ.exe
  2⤵
  PID:15840
- C:\Windows\System\BoTXuLy.exe
  C:\Windows\System\BoTXuLy.exe
  2⤵
  PID:15572
- C:\Windows\System\SLTUICY.exe
  C:\Windows\System\SLTUICY.exe
  2⤵
  PID:14556
- C:\Windows\System\HkuzQJu.exe
  C:\Windows\System\HkuzQJu.exe
  2⤵
  PID:15936
- C:\Windows\System\YdzIWWW.exe
  C:\Windows\System\YdzIWWW.exe
  2⤵
  PID:15680
- C:\Windows\System\BgRbXPD.exe
  C:\Windows\System\BgRbXPD.exe
  2⤵
  PID:15704
- C:\Windows\System\VoipOGk.exe
  C:\Windows\System\VoipOGk.exe
  2⤵
  PID:15780
- C:\Windows\System\AEVrWcP.exe
  C:\Windows\System\AEVrWcP.exe
  2⤵
  PID:15516
- C:\Windows\System\bWpecRq.exe
  C:\Windows\System\bWpecRq.exe
  2⤵
  PID:15888
- C:\Windows\System\DwCojHd.exe
  C:\Windows\System\DwCojHd.exe
  2⤵
  PID:16344
- C:\Windows\System\YkbHXnu.exe
  C:\Windows\System\YkbHXnu.exe
  2⤵
  PID:16044
- C:\Windows\System\OaifSbe.exe
  C:\Windows\System\OaifSbe.exe
  2⤵
  PID:16092
- C:\Windows\System\LsqejLt.exe
  C:\Windows\System\LsqejLt.exe
  2⤵
  PID:15820
- C:\Windows\System\ehrmAoU.exe
  C:\Windows\System\ehrmAoU.exe
  2⤵
  PID:16420
- C:\Windows\System\fKKMRve.exe
  C:\Windows\System\fKKMRve.exe
  2⤵
  PID:16444
- C:\Windows\System\PMfmAih.exe
  C:\Windows\System\PMfmAih.exe
  2⤵
  PID:16472
- C:\Windows\System\MHblqTB.exe
  C:\Windows\System\MHblqTB.exe
  2⤵
  PID:16504
- C:\Windows\System\xRDgHQv.exe
  C:\Windows\System\xRDgHQv.exe
  2⤵
  PID:16712
- C:\Windows\System\zHBYGgu.exe
  C:\Windows\System\zHBYGgu.exe
  2⤵
  PID:16740
- C:\Windows\System\yUSJyCa.exe
  C:\Windows\System\yUSJyCa.exe
  2⤵
  PID:16760
- C:\Windows\System\prVorFy.exe
  C:\Windows\System\prVorFy.exe
  2⤵
  PID:16776
- C:\Windows\System\hFQrOAI.exe
  C:\Windows\System\hFQrOAI.exe
  2⤵
  PID:16792
- C:\Windows\System\tznPkYN.exe
  C:\Windows\System\tznPkYN.exe
  2⤵
  PID:16808
- C:\Windows\System\uXYNMif.exe
  C:\Windows\System\uXYNMif.exe
  2⤵
  PID:16848
- C:\Windows\System\ruLtFcq.exe
  C:\Windows\System\ruLtFcq.exe
  2⤵
  PID:16896
- C:\Windows\System\PagQVka.exe
  C:\Windows\System\PagQVka.exe
  2⤵
  PID:16956
- C:\Windows\System\AHkcPWJ.exe
  C:\Windows\System\AHkcPWJ.exe
  2⤵
  PID:16996
- C:\Windows\System\diKXreB.exe
  C:\Windows\System\diKXreB.exe
  2⤵
  PID:17012
- C:\Windows\System\HvLcJmt.exe
  C:\Windows\System\HvLcJmt.exe
  2⤵
  PID:17032
- C:\Windows\System\bfwnHPu.exe
  C:\Windows\System\bfwnHPu.exe
  2⤵
  PID:15948
- C:\Windows\System\MGXMLPR.exe
  C:\Windows\System\MGXMLPR.exe
  2⤵
  PID:15844
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15844 -s 252
    3⤵
    PID:16112
- C:\Windows\System\sJOuNvB.exe
  C:\Windows\System\sJOuNvB.exe
  2⤵
  PID:15176
- C:\Windows\System\TeUYFtw.exe
  C:\Windows\System\TeUYFtw.exe
  2⤵
  PID:15092
- C:\Windows\System\UxStTyK.exe
  C:\Windows\System\UxStTyK.exe
  2⤵
  PID:14740
- C:\Windows\System\aIdJkfy.exe
  C:\Windows\System\aIdJkfy.exe
  2⤵
  PID:16264
- C:\Windows\System\WYHIfBd.exe
  C:\Windows\System\WYHIfBd.exe
  2⤵
  PID:15556
- C:\Windows\System\GXcCdLa.exe
  C:\Windows\System\GXcCdLa.exe
  2⤵
  PID:16376
- C:\Windows\System\zAJTOeC.exe
  C:\Windows\System\zAJTOeC.exe
  2⤵
  PID:15676
- C:\Windows\System\dxOflAe.exe
  C:\Windows\System\dxOflAe.exe
  2⤵
  PID:16500
- C:\Windows\System\wuPJeLQ.exe
  C:\Windows\System\wuPJeLQ.exe
  2⤵
  PID:16992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AtKQWcs.exe

Filesize
1.4MB

MD5
5874862541a1a868841315ab409a3589

SHA1
794bae5e47e94fb098748b2fe5b2c9a58a519627

SHA256
3bf7f2f8be791b027008d9b58a318e6c3708490b67c3430dc608788a3c526905

SHA512
7ca2b17ba3f242ff19bbc90ca78edc46dab303ace77657d829fdaab2d66f956aaccce898da758fbd6c825a6ded11936dbacf33396a4182104e3f615b73962ee5

Download Submit
C:\Windows\System\BrwjhGT.exe

Filesize
1.4MB

MD5
990e25c2b008c84b8ae87d8cad6737ae

SHA1
1d7ddf249ccd5953a886b36c7ce30dd38c281f2c

SHA256
1d87eebf9c6ad8f1ec3ebd75982f65bb5cbe172b6e61e9570bb0cb24a93c4174

SHA512
cdd3fca54b2e6b22ef094db3856c7bfe896d0e87295ac45066f1bcd294b819d2f809947eb5d74cdca5ff34d6ef1dde8290d3bf77c6d59e2c87a31b9ebdbfc173

Download Submit
C:\Windows\System\CPfAAhi.exe

Filesize
1.4MB

MD5
ea3a945f2a501e85cd049c89dbbba19a

SHA1
76a89d855fd78546b72b1ea62e8e8558f438e553

SHA256
aba52ceb2b6887ceac027eceb9504fe7a154d958516a44f24e018e0e84e9492a

SHA512
3e12d3502fb4a3c23a71daae1a31d8bc4b142e45deab9b704d3c5a7e5d92ce2b3ca9af2aa3fb8839ef16d62c57d426c25281900b909a5a86cedfe39630b0541d

Download Submit
C:\Windows\System\CcYuTZE.exe

Filesize
1.4MB

MD5
d0af66a8f02e6c3cab628e08a6af1cb3

SHA1
9b7bc26237e4d3aa15762bbd800080ba7eab57a2

SHA256
919804b4ab35f316bd4fd38f89cd400cc8263b7b4b1deb4b7d49aa6183cad905

SHA512
824e97c25cdc0671d4e106308164d794e0e198e9c0cd5ec2ca7af49d29ca68f8ef7fda601c3bf99e6e8113f766054fdfc414ce6af50ddd5646bd92f863696b7a

Download Submit
C:\Windows\System\CfoJQKZ.exe

Filesize
1.4MB

MD5
b67227d74a2fdd75cadfd898b20bdedd

SHA1
0a0e57d8700ab6267fb74b988d4c3883d116bf3a

SHA256
900bb1ef1c004ff74147eff175830e442666caff0d257ad4aeb43f5130051bc0

SHA512
4b90353214194e2ea3804256c4a854ead3a7efe1af9d62fdc42c7354a98e8f27f0937eced40856393e493f59531d03cc245e41a532e4268d96e4f50701ac1c2e

Download Submit
C:\Windows\System\CiWdHUI.exe

Filesize
1.4MB

MD5
2e11d019c11320d96f47287037bfccb8

SHA1
a472ff923adca3bae3f2e1a795894ea133a1d74f

SHA256
1c44c59b1658773eabed7b007f77fe8cf0e42b0a9f184bf126e2326cda749c3d

SHA512
d4ec5a7ce5261ae48527ad90f0e6ea1844faced4f159f3fc3b6a23551ad69bfcd883d156eea466d92516d303a8023e7c5964a83aac7b7ce4f5e54c51fdd0d34a

Download Submit
C:\Windows\System\JCcbHgB.exe

Filesize
1.4MB

MD5
791be73540b128f3a0f4e27884ca21f0

SHA1
3e0ead2e84c12e1782b06834f7008db08af1cd93

SHA256
e3e148ac98205af877f00d90e2652fc1b5f2cc2bde19e9c0d7cc4c03e45011d3

SHA512
e7c9d9ebc9e3761f13e77bf7ec9b0e3fac95087c771782d3c4b6f525fda7757b7a8665eb0c0900d921e07a33b31aca26e2856efed10b58b75f6ba3dd58f129fe

Download Submit
C:\Windows\System\OIVvrOQ.exe

Filesize
1.4MB

MD5
4ce9b6002f7763b47806f23ea10032af

SHA1
22318938d0c89ed6bdc17c75cdd7ab2fb86256cb

SHA256
a04abdc96c560b82ece7de2241924056532dac0f0299b142bd7c43eb89c4f3c8

SHA512
2acd25f8e0f28348f9d1d785535e28ee2356088ea164fe40f136488de8e9555993778d0481dc4863cef94d3228cc9537f2f8b95b91f07f52b4291a10177cac69

Download Submit
C:\Windows\System\OpCXNuf.exe

Filesize
1.4MB

MD5
ef228b540568ce54d6a3cd95a66ae5e0

SHA1
c3e63a02c7ff36bb08e46e737c1a721634dd374e

SHA256
20f483e8df1ff8585fe903826316bda94ce882badc600fd9a13770a8ab0dac59

SHA512
61a4006c9cf6faa483d12ecfba48d20c7efad242fdc8bdb219e2d8177d1bddec873e0b7836a151a356f31e9159b22a8735fd560a6d10be7b725536cffdbe08fa

Download Submit
C:\Windows\System\PusJPWx.exe

Filesize
1.4MB

MD5
f841f9744c21db740695d77fdd235fb4

SHA1
d9f69b6f50fbf997dcddc2c89304ded094cfae75

SHA256
097267ddbb16f33e80975d338f8a85d26969d036e186293dcca163bc0c505103

SHA512
16526d38d4453c092e20c41668da2b4d4016fe13d57d600f37f7a679a172ed7a928a1e5d6eac037507b721f51fc88cd4c55dc1ebbce10946413fe886cf8cdb7b

Download Submit
C:\Windows\System\QjXsgzN.exe

Filesize
1.4MB

MD5
f0ddf831ee42a7d73b20fa472f2ba900

SHA1
41a3cd123958d611d72d4c2f29727a5225b50d9b

SHA256
14e1e91f41842630b0a5dd7cd71d803f52c80916a547ddcb52be9df4cf2c5b64

SHA512
95317ec633565dce6eabcf1941d9b1d99e5148053117eb6a6ead6c88d00d0a478d460783ec28afe91e04b9a4d70ea0ed226f517fb47199a2eab43b9828bd7284

Download Submit
C:\Windows\System\WbGMkIn.exe

Filesize
1.4MB

MD5
031e37c11ac7f9aca65496204bc305bf

SHA1
34cc373ea1fc5bb54fd9598185231a3ec7abe2c5

SHA256
1edb582bfa8e7a0e2d1d0dcd2f1cecb4a2f9899dce3ebb343dac758bb7739aca

SHA512
57cfc6e7e5e31e2c53754a58e24dae3a44dbb56a3306b6f0691d6a05290901afafdf086e15f06842cbbd62751baa95f9dc0d337b7dac989814cb0fe5df4272b2

Download Submit
C:\Windows\System\XcOjPjO.exe

Filesize
1.4MB

MD5
b58ff5f469093b0af4b4fb391e88c64d

SHA1
4d55a345f869ae01f349b90f57a842d656dab3bd

SHA256
344473234ca664319d9c71fba6e917e03ad342181228657112c677d60c815856

SHA512
b2cdacf502f5587b579d7471f800b3a3831cf9df45f71e6a4023ca67406faf2b3caf078cb4ba924840c638ff3135e97c968036e2fbad09947eea573f1dbe2de4

Download Submit
C:\Windows\System\Ybeajwn.exe

Filesize
1.4MB

MD5
fbf961bb0d68ad95870a0f95de27f0e7

SHA1
3b62d7d3a3baed06d851f92d60330fee84b5c6cd

SHA256
a16b7c100c1e2cca0f9a26113cf1d945d7669e3a40cb61d9d7c02e80b8b2188c

SHA512
77c1193a5a17d8a32e8203a8d04314b00d142eb3445c6c5ea5eed239b305d1df1f722c6642cabd451232f126c76cc563de70f098fec05b95189e3c78dc1fe87c

Download Submit
C:\Windows\System\YeRFbHk.exe

Filesize
1.4MB

MD5
7bfe49f476fb6b2a0f5144ea4928c154

SHA1
df61d04497028eb7ce2761a0bdf28a138d5a0b12

SHA256
4743eeab55fcd8b4d73c606328fec31d981509d356e680b1f83f170888d96ccd

SHA512
439ecc0ad2ad6965c081a122f7a994917b4efc771a3068f1cd00ee8c27b2e5e4c21fb4913aeb53e5b990eeb42ee7f9c879e0959b170cd1434eeefb30bb37c194

Download Submit
C:\Windows\System\aNLkWpp.exe

Filesize
1.4MB

MD5
0acd97a764a6d12e9df58d4a2f8ed5fa

SHA1
f606fc7f3b538ec87dac2d34f9f6dda14439be4f

SHA256
c0a9e6f2eb4508dabf795d61dcb83a1df6a035f4d08bf15e08d6a41dd809fbc4

SHA512
90346a6116cce61175257d9484af67b87db089fe6c1a656360ee22f746bd712b9d67883bdafb2ad07a2bdc31816dc1a5bf28bec9e4b15c8f1d5ef4adfb5c74b5

Download Submit
C:\Windows\System\bhABpio.exe

Filesize
1.4MB

MD5
dbf54636fcc20144bed61b3ab15acd90

SHA1
0d6675fb8434f5026c8b2e165678aebd4e78aa09

SHA256
f82f3a211e5d610abb414ff3e34a42dbbcfb6dc56deb06e8a925a8c14b5de9a2

SHA512
0ebcdd680bed2fd868c51af096bd7b542f070d0ff76debd2932d43dcd3af160603ced2a2755af05d7f592389371ff5798df19e552190fc7a665abba1f63373cf

Download Submit
C:\Windows\System\eejiMuK.exe

Filesize
1.4MB

MD5
d1e562784286d33e0d54b80102439bcb

SHA1
ffc5a337075503482554b2bd7cbdd59ca4be0457

SHA256
0b9b67a09d854bd94903861b537bf8185b8ab80961adc9d9897d73348fb633c7

SHA512
a55cc48c93706378c8a3d780c92d7e02d22e2d5d42d08ad653ccc28e286107f38298ce9ac61a30b9f08412836d73c064ac34ea15f8e4f3175409e578c4330387

Download Submit
C:\Windows\System\gFkxphp.exe

Filesize
1.4MB

MD5
485e255261283fa8b9f9244f41a3afc9

SHA1
fab5e3f622d3c048b274835beee38a03eb77702a

SHA256
51db2236b5590310db7d4c59a1e70e37020df0295488db917457106a69fa235e

SHA512
08609ad87dd939afc02cd6fafd5dda170f8e5f5861d4019cb179bd55a0c850be94e98cb22e950b65dd9c0f6e91629d11a56898dd271601ce9be97f7fe923dc39

Download Submit
C:\Windows\System\hRiJZKV.exe

Filesize
1.4MB

MD5
07f6a1d99f6fd05c85ac15e23dfc8347

SHA1
a23c6246c37e01418becd4c7a13b027adf19ae09

SHA256
238200e63361138966431ca66a4f2a94a98c9eba78743d1a489c18e4d8039b9e

SHA512
5f8dede10c8392723ed2fca3d19efa1c0eca35f4990f595521bdfd31a1cd1de8dff20a3ef3db59ab63e2f38de313f35fbc3923461c3d3c2ec785784aa2de8e7f

Download Submit
C:\Windows\System\hrkXTQi.exe

Filesize
1.4MB

MD5
5bba5cc99e41803eb97b991183dc2356

SHA1
5136a4fe6607d5f1301fdc51ac2675abd31e61d6

SHA256
02c5630c8b0d626e130df99856ab290cb45a05382a0e187db077f61376ca5cf7

SHA512
600d680f2446337e4861077cc4001a7f45926f0aa8a1829fc7dc1302c6811945ee3af181789bbdcc44654a984c19c9517e2436b64797cfcc71d2d8c0cf95d270

Download Submit
C:\Windows\System\jVIykpN.exe

Filesize
1.4MB

MD5
f72ababb5131101b1234596900e1fd72

SHA1
95225e4604370d456108d130b4f45a9d9dd831ca

SHA256
a429bfaa0f9b67a43f0e5f167b2879ed832adec8068160ad7ed5c5311631d2bf

SHA512
bf10bc49b665443dbcbca9bdcf6d12d10635178dcd16974dbe49f2de887e0ff8078747a347e30c4a706a67a05aa178bfb778b96e3ca72ad6d4bbb521a01fd245

Download Submit
C:\Windows\System\lHBHnXs.exe

Filesize
1.4MB

MD5
0197ea38d0173708fb07d9df8d5aa507

SHA1
ebc56a774d5f500c0b89f21b52655f31216cf875

SHA256
720beb99e1d0aed9e29545e62b55750562aa8c3c7497e62c264968a0e9075025

SHA512
3b11d5c126574c2182f99dc39dcc87635bd22b9b5fc8a764af5ce638065dfeee1820d6598018e2dc53f6891dd8e81ce208977630347ab1780b42ccdbe90b8716

Download Submit
C:\Windows\System\nOCrxjb.exe

Filesize
1.4MB

MD5
908f41922ecce50d12cca30036ca1057

SHA1
56b71ea7169c709cfb4c98e69268169fd2370ce2

SHA256
d701052146d8c82d9e7930ee23692dc53e18b0ab1f1e183f46636d8815cddcba

SHA512
e19262f976de25bee6d69bf23ab215808bdb30e5ca9f0f7562e2ed4c5ade73cc7574b9a0544eea03abd765bb3b6a6e0a4f0a6b2cb24f14d4cbda96c96a34c4da

Download Submit
C:\Windows\System\nRPVmqV.exe

Filesize
1.4MB

MD5
fd48ccd6e89ce8f097617f16a5a97b00

SHA1
6865e9fa1d6bd15b2b68aa6de435a607504ad5e7

SHA256
d97cd78fe6af0639f46a642d20a2cf5e42232c530e5213940f87a96ad2f516a1

SHA512
e83ae60a22c6c145db25b86c1f958efda3ff61277dcaabb595b7558dcbe7ebefa0b4b2b0b236467196e0d96ee14712a9a2e28b3b4425d725993ec5a03d5bb214

Download Submit
C:\Windows\System\qOeplzy.exe

Filesize
1.4MB

MD5
f133ba4c86a482fec5cfad5059d37a85

SHA1
340bcf854d0191ba43a45f7b94801eda4a2a259b

SHA256
a88de50efbf914cb2b63c5374fbff4c898bb0d90b5cb923a3cb97eae4150540a

SHA512
ca468c7c1bebebae8e25214ca981410eda7ee93be3bf831c935df5a4024ccc299e51409951111e1e34be3eb265de92c2087ca83b7378c850646b5466e7d7fc5c

Download Submit
C:\Windows\System\qcGjrpN.exe

Filesize
1.4MB

MD5
3652cf72f4d6b654d92dfdd235d526c7

SHA1
cbd7dde8047d7166687708290c662d64c5576c3f

SHA256
bda9707f87a10bbb91eccb744ec28fb81c35f2286a0975182f83a4043391891c

SHA512
dd5edd84a116bcc741791fbd9d62a7a07a71b36d2c93a0c505d6139fa7a539c0f26588133d52e59b7cf5baf1dbceff082ac6842ea541553dfdb836a7b4ab9261

Download Submit
C:\Windows\System\shxMLzW.exe

Filesize
1.4MB

MD5
bab2b71691c1d93737c3128501cc7004

SHA1
779a8ca4f851291587c6edd23a70b3427b2a2c8e

SHA256
a235af1f206568a14718cb6a8fa2bd27b97d97f49dae7d62c6adcf190e689567

SHA512
1651c63bae7dd67f5dc04fa85ccfa062652bfa7fd5c6489bcb811c839ba9c36cd94a13444ca7e7fa519f567a02818d76c5be590b7abf5f8cd1d5eed121742170

Download Submit
C:\Windows\System\wGmubqF.exe

Filesize
1.4MB

MD5
b3b51cc1bb0d6c66323008fd0168c828

SHA1
da210b34433c7035050d09af2f61b02b0d8aa0f9

SHA256
5b025fd791863128ca5317ee7c8cfc14c09917699afebd0190b10d32f5ec1037

SHA512
5eb9a262222eb39bedb850f89fd34c47566824242fb162d9d44c3b989f79130257ec6264d4f0154cbbc34c7fcb8a82ddfd0ac41c5df2077c07514bd0948e0bc9

Download Submit
C:\Windows\System\wppuSOH.exe

Filesize
1.4MB

MD5
41a0cab05116c6e3400854ae02ae3848

SHA1
fbea19ef7bbc79952f061ded5506598b2eca85e3

SHA256
b1df8e123368f0dd2b16186a41253fd372ff57d117039ab5f34e03d99791b71f

SHA512
39fbe991e5a233607a8c24a6c179e76ecf6c56a8c1de01fed941ba894a8f5d186de2c52b6ca14e952093256a1c702c59352195f797e0283f525b55f01b10c4ea

Download Submit
C:\Windows\System\xSWrARZ.exe

Filesize
1.4MB

MD5
1ae2a048ddb51d3fd6251c57a34eae07

SHA1
c3623ca50ab9b53489b24e72c833162fb34021bd

SHA256
f298ccf7af6af4bcfbe74daac9e922dd2f85c69f3ed754c87026d870f7531d55

SHA512
1b0f2ec42609aa5967e13a613ea011bd8c7af916f8a02884a38d815486f7d0990e9ba7b3e11b2354841181b061230fa46448f47c23cfc298a7d3ed51f0fd5c55

Download Submit
C:\Windows\System\yBCMBEv.exe

Filesize
1.4MB

MD5
a8acdc12c721e0a66d38eaec26b66fd6

SHA1
a411b46a175e4c3bd00cbd6807bbd6060d795f8a

SHA256
2ca41400936a4848ed141817703c464f2b1aefd484a4a0abada88b4999d56d3d

SHA512
39abe45892b61c83797e48b2d820a3664b2d017dfaf251bf97a6d10d6637b4a1266e360718212e6b12db6ca3a6312b907e766602013227b3375c19165c097d5f

Download Submit
C:\Windows\System\yEFUrjU.exe

Filesize
1.4MB

MD5
cd4b1d6e969805841ef74d26da39e866

SHA1
662a7a1cfc088749cb88ed96ea98791b2d048bc5

SHA256
441683818dd8f3f1d1779d21e2a11d05125e466acf75a9598405c283bd97d3f0

SHA512
e25d6d58e30e3e96c7c48f5eb89c7bef036b214f6adffdc2aa96154e9106e1eba124c0c12f0efa6f4f417709e6fd2ebdb3ee6d51982c0f59b1207a54625f87e0

Download Submit
memory/3564-0-0x000002180EA10000-0x000002180EA20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads