xmrig | 3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
Size

1.4MB
MD5

b03160437d054baaca22340acd9e2aea
SHA1

8f0b4b8fd36378dbd09e21049863c44ca287e746
SHA256

3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38
SHA512

4802176e4393b4d6575d6c90cc2a983d76aee6057ad63c85840a45814765318a7f1aacdbe5ce97db10603608ec18f82cdc8edc6ea4cae49828d1e3a18531222f
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc1:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c53

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b99-4.dat	xmrig
behavioral2/files/0x0008000000023c8c-8.dat	xmrig
behavioral2/files/0x0007000000023c90-14.dat	xmrig
behavioral2/files/0x0007000000023c94-30.dat	xmrig
behavioral2/files/0x0007000000023c91-31.dat	xmrig
behavioral2/files/0x0007000000023c93-40.dat	xmrig
behavioral2/files/0x0007000000023c97-48.dat	xmrig
behavioral2/files/0x0007000000023c9a-60.dat	xmrig
behavioral2/files/0x0007000000023c9f-93.dat	xmrig
behavioral2/files/0x0007000000023ca0-95.dat	xmrig
behavioral2/files/0x0007000000023c9e-91.dat	xmrig
behavioral2/files/0x0007000000023c9d-89.dat	xmrig
behavioral2/files/0x0007000000023c9c-87.dat	xmrig
behavioral2/files/0x0007000000023c99-83.dat	xmrig
behavioral2/files/0x0007000000023c96-74.dat	xmrig
behavioral2/files/0x0007000000023c9b-69.dat	xmrig
behavioral2/files/0x0007000000023c98-68.dat	xmrig
behavioral2/files/0x0007000000023c95-51.dat	xmrig
behavioral2/files/0x0007000000023c92-34.dat	xmrig
behavioral2/files/0x0007000000023ca1-101.dat	xmrig
behavioral2/files/0x0007000000023ca4-108.dat	xmrig
behavioral2/files/0x0007000000023ca6-114.dat	xmrig
behavioral2/files/0x0008000000023c8d-128.dat	xmrig
behavioral2/files/0x0007000000023cab-145.dat	xmrig
behavioral2/files/0x0007000000023cb1-168.dat	xmrig
behavioral2/files/0x0007000000023ca9-163.dat	xmrig
behavioral2/files/0x0007000000023ca8-158.dat	xmrig
behavioral2/files/0x0007000000023cb0-157.dat	xmrig
behavioral2/files/0x0007000000023caf-155.dat	xmrig
behavioral2/files/0x0007000000023caa-151.dat	xmrig
behavioral2/files/0x0007000000023cad-149.dat	xmrig
behavioral2/files/0x0007000000023ca7-144.dat	xmrig
behavioral2/files/0x0007000000023cae-150.dat	xmrig
behavioral2/files/0x0007000000023cac-148.dat	xmrig
behavioral2/files/0x0007000000023ca5-119.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4824	wJEgpXb.exe
3276	jDbmkKi.exe
4940	BIkrICy.exe
3672	IuKbQeU.exe
4132	LvsEBRX.exe
3152	UHckhRR.exe
1488	rbuseRi.exe
4548	udeEHcj.exe
2020	dIILiwr.exe
1068	KgriTKi.exe
1888	dRiGzeO.exe
2772	YpttvoB.exe
3392	cGLYZna.exe
1704	nSHHYDz.exe
684	cYhEigM.exe
4780	disBxwt.exe
2136	fctrLsO.exe
5092	XRNRcbM.exe
1484	aaOWlKQ.exe
884	SPRhats.exe
2220	LxBPsfb.exe
2452	vUpiANH.exe
852	tOEzIOy.exe
4656	KxtgNQT.exe
1732	wYdFQmY.exe
1604	NgfQibp.exe
2524	RvEUWmO.exe
1476	ucpXVLG.exe
1956	sjUQsOM.exe
4512	TlguomM.exe
964	iSnGERG.exe
4252	NiOoaTH.exe
4924	jTtOnHa.exe
4960	tpNjRYL.exe
3600	TaUcNUQ.exe
4932	xHPFMdm.exe
2256	uYygNlD.exe
976	WMcWcLG.exe
216	DQLQzma.exe
1388	BSKWKLL.exe
720	XGrqTFo.exe
1800	hwXGmJY.exe
1208	paHCQTU.exe
1608	BpXhrDU.exe
1760	IAQIgFA.exe
3348	zhqpZUb.exe
1264	sEmBABg.exe
3412	sFiJGfK.exe
2436	YzcqCON.exe
2688	FiqTIqS.exe
2448	wgGRWGY.exe
4304	KGWGHVb.exe
4204	fXKarhm.exe
4172	uOgxbyg.exe
2332	mukHOpq.exe
1588	CdwAodz.exe
1972	OkZaTrU.exe
4820	DXNvAvT.exe
3488	AYTKdQX.exe
3264	mxQtHyI.exe
4672	Vwhpaiu.exe
3108	tDZYtkD.exe
944	gqijqVC.exe
4040	spEXedY.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dzYRemw.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ODWYgmX.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\fFILxIh.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\MZOLXKY.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\nrbgsxR.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\MyKSmVT.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\jRCqwKS.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\jiMFJHs.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\XRNRcbM.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\tkdoHKj.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\qbSsczE.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\gaXoggF.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\pXTwxcG.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\vnXsVUw.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\SdpdfXP.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\aSHDRHe.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\zbtrqlb.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\tJYmRsX.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\BiCeuHk.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\WcdyGMz.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\MAUHnNc.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\TNjAMRG.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\TaUcNUQ.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\jSOtMnl.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\VSTdXUJ.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\SgolddJ.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ACsRSrB.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\oFhIiEv.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\QsNPgzv.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\oABfOdB.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\fkTDZNc.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ZNQJEOt.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ogYWYXM.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\NeKCvuC.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\mnvCsqx.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\yyHlgyE.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\TqLAowL.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\OKAZToC.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\jQLZXoT.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\SQaDzHY.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ewZbRQn.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\cRzdrFO.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\tPMFspi.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\YSajTsK.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\TOGAdXt.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ydpJnAy.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\BwgKYuQ.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\CZSsXps.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\QSWrNNU.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\FKFXeFD.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\pFMcZVu.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\JGAvfgJ.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\elPqQJr.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\hcLtAqe.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\WMcWcLG.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\aKyqwdY.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ysZWsLc.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\DLNSQkt.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\dRiGzeO.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\mEaJzoP.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\NqzLHbD.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ilwbnOD.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\jsRSuEG.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
File created	C:\Windows\System\ZZvjxWN.exe	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4824	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	84
PID 3304 wrote to memory of 4824	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	84
PID 3304 wrote to memory of 3276	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	85
PID 3304 wrote to memory of 3276	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	85
PID 3304 wrote to memory of 4940	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	86
PID 3304 wrote to memory of 4940	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	86
PID 3304 wrote to memory of 3672	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	87
PID 3304 wrote to memory of 3672	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	87
PID 3304 wrote to memory of 4132	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	88
PID 3304 wrote to memory of 4132	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	88
PID 3304 wrote to memory of 3152	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	89
PID 3304 wrote to memory of 3152	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	89
PID 3304 wrote to memory of 1488	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	90
PID 3304 wrote to memory of 1488	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	90
PID 3304 wrote to memory of 4548	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	91
PID 3304 wrote to memory of 4548	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	91
PID 3304 wrote to memory of 2020	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	92
PID 3304 wrote to memory of 2020	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	92
PID 3304 wrote to memory of 1068	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	93
PID 3304 wrote to memory of 1068	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	93
PID 3304 wrote to memory of 1888	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	94
PID 3304 wrote to memory of 1888	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	94
PID 3304 wrote to memory of 2772	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	95
PID 3304 wrote to memory of 2772	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	95
PID 3304 wrote to memory of 3392	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	96
PID 3304 wrote to memory of 3392	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	96
PID 3304 wrote to memory of 1704	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	97
PID 3304 wrote to memory of 1704	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	97
PID 3304 wrote to memory of 684	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	98
PID 3304 wrote to memory of 684	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	98
PID 3304 wrote to memory of 4780	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	99
PID 3304 wrote to memory of 4780	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	99
PID 3304 wrote to memory of 2136	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	100
PID 3304 wrote to memory of 2136	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	100
PID 3304 wrote to memory of 5092	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	101
PID 3304 wrote to memory of 5092	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	101
PID 3304 wrote to memory of 1484	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	102
PID 3304 wrote to memory of 1484	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	102
PID 3304 wrote to memory of 884	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	103
PID 3304 wrote to memory of 884	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	103
PID 3304 wrote to memory of 2220	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	104
PID 3304 wrote to memory of 2220	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	104
PID 3304 wrote to memory of 2452	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	105
PID 3304 wrote to memory of 2452	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	105
PID 3304 wrote to memory of 852	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	106
PID 3304 wrote to memory of 852	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	106
PID 3304 wrote to memory of 4656	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	107
PID 3304 wrote to memory of 4656	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	107
PID 3304 wrote to memory of 1732	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	108
PID 3304 wrote to memory of 1732	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	108
PID 3304 wrote to memory of 1604	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	109
PID 3304 wrote to memory of 1604	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	109
PID 3304 wrote to memory of 2524	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	110
PID 3304 wrote to memory of 2524	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	110
PID 3304 wrote to memory of 1476	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	111
PID 3304 wrote to memory of 1476	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	111
PID 3304 wrote to memory of 1956	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	112
PID 3304 wrote to memory of 1956	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	112
PID 3304 wrote to memory of 4512	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	113
PID 3304 wrote to memory of 4512	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	113
PID 3304 wrote to memory of 964	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	114
PID 3304 wrote to memory of 964	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	114
PID 3304 wrote to memory of 4252	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	115
PID 3304 wrote to memory of 4252	3304	3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe	115

C:\Users\Admin\AppData\Local\Temp\3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe
"C:\Users\Admin\AppData\Local\Temp\3eee6fb3d0b02a0e002a2e8635b6b3cb6206ad087b3f1490db369bcd9116cf38.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\System\wJEgpXb.exe
  C:\Windows\System\wJEgpXb.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\jDbmkKi.exe
  C:\Windows\System\jDbmkKi.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\BIkrICy.exe
  C:\Windows\System\BIkrICy.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\IuKbQeU.exe
  C:\Windows\System\IuKbQeU.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\LvsEBRX.exe
  C:\Windows\System\LvsEBRX.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\UHckhRR.exe
  C:\Windows\System\UHckhRR.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\rbuseRi.exe
  C:\Windows\System\rbuseRi.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\udeEHcj.exe
  C:\Windows\System\udeEHcj.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\dIILiwr.exe
  C:\Windows\System\dIILiwr.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\KgriTKi.exe
  C:\Windows\System\KgriTKi.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\dRiGzeO.exe
  C:\Windows\System\dRiGzeO.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\YpttvoB.exe
  C:\Windows\System\YpttvoB.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\cGLYZna.exe
  C:\Windows\System\cGLYZna.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\nSHHYDz.exe
  C:\Windows\System\nSHHYDz.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\cYhEigM.exe
  C:\Windows\System\cYhEigM.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\disBxwt.exe
  C:\Windows\System\disBxwt.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\fctrLsO.exe
  C:\Windows\System\fctrLsO.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\XRNRcbM.exe
  C:\Windows\System\XRNRcbM.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\aaOWlKQ.exe
  C:\Windows\System\aaOWlKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\SPRhats.exe
  C:\Windows\System\SPRhats.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\LxBPsfb.exe
  C:\Windows\System\LxBPsfb.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\vUpiANH.exe
  C:\Windows\System\vUpiANH.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\tOEzIOy.exe
  C:\Windows\System\tOEzIOy.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\KxtgNQT.exe
  C:\Windows\System\KxtgNQT.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\wYdFQmY.exe
  C:\Windows\System\wYdFQmY.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\NgfQibp.exe
  C:\Windows\System\NgfQibp.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\RvEUWmO.exe
  C:\Windows\System\RvEUWmO.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ucpXVLG.exe
  C:\Windows\System\ucpXVLG.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\sjUQsOM.exe
  C:\Windows\System\sjUQsOM.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\TlguomM.exe
  C:\Windows\System\TlguomM.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\iSnGERG.exe
  C:\Windows\System\iSnGERG.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\NiOoaTH.exe
  C:\Windows\System\NiOoaTH.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\jTtOnHa.exe
  C:\Windows\System\jTtOnHa.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\tpNjRYL.exe
  C:\Windows\System\tpNjRYL.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\TaUcNUQ.exe
  C:\Windows\System\TaUcNUQ.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\xHPFMdm.exe
  C:\Windows\System\xHPFMdm.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\uYygNlD.exe
  C:\Windows\System\uYygNlD.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\WMcWcLG.exe
  C:\Windows\System\WMcWcLG.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\DQLQzma.exe
  C:\Windows\System\DQLQzma.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\BSKWKLL.exe
  C:\Windows\System\BSKWKLL.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\XGrqTFo.exe
  C:\Windows\System\XGrqTFo.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\hwXGmJY.exe
  C:\Windows\System\hwXGmJY.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\paHCQTU.exe
  C:\Windows\System\paHCQTU.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\BpXhrDU.exe
  C:\Windows\System\BpXhrDU.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\IAQIgFA.exe
  C:\Windows\System\IAQIgFA.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\zhqpZUb.exe
  C:\Windows\System\zhqpZUb.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\sEmBABg.exe
  C:\Windows\System\sEmBABg.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\sFiJGfK.exe
  C:\Windows\System\sFiJGfK.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\YzcqCON.exe
  C:\Windows\System\YzcqCON.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\FiqTIqS.exe
  C:\Windows\System\FiqTIqS.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\wgGRWGY.exe
  C:\Windows\System\wgGRWGY.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\KGWGHVb.exe
  C:\Windows\System\KGWGHVb.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\fXKarhm.exe
  C:\Windows\System\fXKarhm.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\uOgxbyg.exe
  C:\Windows\System\uOgxbyg.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\mukHOpq.exe
  C:\Windows\System\mukHOpq.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\CdwAodz.exe
  C:\Windows\System\CdwAodz.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\OkZaTrU.exe
  C:\Windows\System\OkZaTrU.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\DXNvAvT.exe
  C:\Windows\System\DXNvAvT.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\AYTKdQX.exe
  C:\Windows\System\AYTKdQX.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\mxQtHyI.exe
  C:\Windows\System\mxQtHyI.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\Vwhpaiu.exe
  C:\Windows\System\Vwhpaiu.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\tDZYtkD.exe
  C:\Windows\System\tDZYtkD.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\gqijqVC.exe
  C:\Windows\System\gqijqVC.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\spEXedY.exe
  C:\Windows\System\spEXedY.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\RjQXTxN.exe
  C:\Windows\System\RjQXTxN.exe
  2⤵
  PID:4988
- C:\Windows\System\EmWHxpD.exe
  C:\Windows\System\EmWHxpD.exe
  2⤵
  PID:4384
- C:\Windows\System\KqPELtB.exe
  C:\Windows\System\KqPELtB.exe
  2⤵
  PID:4348
- C:\Windows\System\pTuPWgI.exe
  C:\Windows\System\pTuPWgI.exe
  2⤵
  PID:3428
- C:\Windows\System\qnHLMHU.exe
  C:\Windows\System\qnHLMHU.exe
  2⤵
  PID:4364
- C:\Windows\System\vnXsVUw.exe
  C:\Windows\System\vnXsVUw.exe
  2⤵
  PID:664
- C:\Windows\System\VTlTBCo.exe
  C:\Windows\System\VTlTBCo.exe
  2⤵
  PID:4772
- C:\Windows\System\dFwLEoP.exe
  C:\Windows\System\dFwLEoP.exe
  2⤵
  PID:4140
- C:\Windows\System\dclvmSr.exe
  C:\Windows\System\dclvmSr.exe
  2⤵
  PID:3768
- C:\Windows\System\QbYwEMC.exe
  C:\Windows\System\QbYwEMC.exe
  2⤵
  PID:5068
- C:\Windows\System\ZRzRhyU.exe
  C:\Windows\System\ZRzRhyU.exe
  2⤵
  PID:4104
- C:\Windows\System\PCasWYP.exe
  C:\Windows\System\PCasWYP.exe
  2⤵
  PID:116
- C:\Windows\System\CUKoHzA.exe
  C:\Windows\System\CUKoHzA.exe
  2⤵
  PID:4444
- C:\Windows\System\DwenkpQ.exe
  C:\Windows\System\DwenkpQ.exe
  2⤵
  PID:3580
- C:\Windows\System\GIrKZbz.exe
  C:\Windows\System\GIrKZbz.exe
  2⤵
  PID:4020
- C:\Windows\System\erRlQiG.exe
  C:\Windows\System\erRlQiG.exe
  2⤵
  PID:744
- C:\Windows\System\ZZvjxWN.exe
  C:\Windows\System\ZZvjxWN.exe
  2⤵
  PID:1968
- C:\Windows\System\rYljODo.exe
  C:\Windows\System\rYljODo.exe
  2⤵
  PID:2324
- C:\Windows\System\XugmCTl.exe
  C:\Windows\System\XugmCTl.exe
  2⤵
  PID:4284
- C:\Windows\System\CqSclNI.exe
  C:\Windows\System\CqSclNI.exe
  2⤵
  PID:1944
- C:\Windows\System\MNveXHB.exe
  C:\Windows\System\MNveXHB.exe
  2⤵
  PID:4420
- C:\Windows\System\vIjySMH.exe
  C:\Windows\System\vIjySMH.exe
  2⤵
  PID:1612
- C:\Windows\System\YSajTsK.exe
  C:\Windows\System\YSajTsK.exe
  2⤵
  PID:4844
- C:\Windows\System\PZQQDpK.exe
  C:\Windows\System\PZQQDpK.exe
  2⤵
  PID:864
- C:\Windows\System\pcGqHKX.exe
  C:\Windows\System\pcGqHKX.exe
  2⤵
  PID:740
- C:\Windows\System\LUaINiO.exe
  C:\Windows\System\LUaINiO.exe
  2⤵
  PID:4556
- C:\Windows\System\dcXNiWk.exe
  C:\Windows\System\dcXNiWk.exe
  2⤵
  PID:1324
- C:\Windows\System\qNdbowW.exe
  C:\Windows\System\qNdbowW.exe
  2⤵
  PID:3328
- C:\Windows\System\GRRtnrl.exe
  C:\Windows\System\GRRtnrl.exe
  2⤵
  PID:2456
- C:\Windows\System\obHbDRe.exe
  C:\Windows\System\obHbDRe.exe
  2⤵
  PID:436
- C:\Windows\System\ghLslst.exe
  C:\Windows\System\ghLslst.exe
  2⤵
  PID:4748
- C:\Windows\System\UGEIhhq.exe
  C:\Windows\System\UGEIhhq.exe
  2⤵
  PID:1092
- C:\Windows\System\HBEIauo.exe
  C:\Windows\System\HBEIauo.exe
  2⤵
  PID:3988
- C:\Windows\System\Rqsrmil.exe
  C:\Windows\System\Rqsrmil.exe
  2⤵
  PID:1332
- C:\Windows\System\nNTQcNE.exe
  C:\Windows\System\nNTQcNE.exe
  2⤵
  PID:4472
- C:\Windows\System\pAGFqRu.exe
  C:\Windows\System\pAGFqRu.exe
  2⤵
  PID:4580
- C:\Windows\System\jsKhfra.exe
  C:\Windows\System\jsKhfra.exe
  2⤵
  PID:3452
- C:\Windows\System\nYjpLvF.exe
  C:\Windows\System\nYjpLvF.exe
  2⤵
  PID:3612
- C:\Windows\System\SSXwsPC.exe
  C:\Windows\System\SSXwsPC.exe
  2⤵
  PID:5008
- C:\Windows\System\sUcqTij.exe
  C:\Windows\System\sUcqTij.exe
  2⤵
  PID:1948
- C:\Windows\System\vwZjcXb.exe
  C:\Windows\System\vwZjcXb.exe
  2⤵
  PID:4340
- C:\Windows\System\BiCeuHk.exe
  C:\Windows\System\BiCeuHk.exe
  2⤵
  PID:1644
- C:\Windows\System\jZGrhXB.exe
  C:\Windows\System\jZGrhXB.exe
  2⤵
  PID:724
- C:\Windows\System\MwRpPXg.exe
  C:\Windows\System\MwRpPXg.exe
  2⤵
  PID:5144
- C:\Windows\System\bbMNHtb.exe
  C:\Windows\System\bbMNHtb.exe
  2⤵
  PID:5172
- C:\Windows\System\nxWKymZ.exe
  C:\Windows\System\nxWKymZ.exe
  2⤵
  PID:5204
- C:\Windows\System\pgjVByr.exe
  C:\Windows\System\pgjVByr.exe
  2⤵
  PID:5228
- C:\Windows\System\HVCHjqp.exe
  C:\Windows\System\HVCHjqp.exe
  2⤵
  PID:5256
- C:\Windows\System\EoSdnZY.exe
  C:\Windows\System\EoSdnZY.exe
  2⤵
  PID:5284
- C:\Windows\System\giiYWkP.exe
  C:\Windows\System\giiYWkP.exe
  2⤵
  PID:5312
- C:\Windows\System\pVwJZJu.exe
  C:\Windows\System\pVwJZJu.exe
  2⤵
  PID:5348
- C:\Windows\System\oBubKeu.exe
  C:\Windows\System\oBubKeu.exe
  2⤵
  PID:5380
- C:\Windows\System\tSWbhqs.exe
  C:\Windows\System\tSWbhqs.exe
  2⤵
  PID:5416
- C:\Windows\System\YtxUVmQ.exe
  C:\Windows\System\YtxUVmQ.exe
  2⤵
  PID:5440
- C:\Windows\System\zcfsSys.exe
  C:\Windows\System\zcfsSys.exe
  2⤵
  PID:5472
- C:\Windows\System\bnzEWDb.exe
  C:\Windows\System\bnzEWDb.exe
  2⤵
  PID:5496
- C:\Windows\System\DCGBgew.exe
  C:\Windows\System\DCGBgew.exe
  2⤵
  PID:5532
- C:\Windows\System\Lizkyrz.exe
  C:\Windows\System\Lizkyrz.exe
  2⤵
  PID:5560
- C:\Windows\System\SgolddJ.exe
  C:\Windows\System\SgolddJ.exe
  2⤵
  PID:5604
- C:\Windows\System\ScpePSm.exe
  C:\Windows\System\ScpePSm.exe
  2⤵
  PID:5628
- C:\Windows\System\rKyHOFR.exe
  C:\Windows\System\rKyHOFR.exe
  2⤵
  PID:5644
- C:\Windows\System\ijdOKHs.exe
  C:\Windows\System\ijdOKHs.exe
  2⤵
  PID:5676
- C:\Windows\System\VdFZzJh.exe
  C:\Windows\System\VdFZzJh.exe
  2⤵
  PID:5712
- C:\Windows\System\RQMtLTa.exe
  C:\Windows\System\RQMtLTa.exe
  2⤵
  PID:5740
- C:\Windows\System\AlxwNKf.exe
  C:\Windows\System\AlxwNKf.exe
  2⤵
  PID:5768
- C:\Windows\System\EwBcLRC.exe
  C:\Windows\System\EwBcLRC.exe
  2⤵
  PID:5804
- C:\Windows\System\VGHgSVG.exe
  C:\Windows\System\VGHgSVG.exe
  2⤵
  PID:5836
- C:\Windows\System\EMQtoRA.exe
  C:\Windows\System\EMQtoRA.exe
  2⤵
  PID:5860
- C:\Windows\System\VPRGcFS.exe
  C:\Windows\System\VPRGcFS.exe
  2⤵
  PID:5888
- C:\Windows\System\XAgdrBT.exe
  C:\Windows\System\XAgdrBT.exe
  2⤵
  PID:5916
- C:\Windows\System\lzZvjVu.exe
  C:\Windows\System\lzZvjVu.exe
  2⤵
  PID:5932
- C:\Windows\System\fkTDZNc.exe
  C:\Windows\System\fkTDZNc.exe
  2⤵
  PID:5952
- C:\Windows\System\SsvphQf.exe
  C:\Windows\System\SsvphQf.exe
  2⤵
  PID:5976
- C:\Windows\System\RNpJefV.exe
  C:\Windows\System\RNpJefV.exe
  2⤵
  PID:6000
- C:\Windows\System\SMlggqQ.exe
  C:\Windows\System\SMlggqQ.exe
  2⤵
  PID:6032
- C:\Windows\System\TPVYlwx.exe
  C:\Windows\System\TPVYlwx.exe
  2⤵
  PID:6052
- C:\Windows\System\McFxiJF.exe
  C:\Windows\System\McFxiJF.exe
  2⤵
  PID:6076
- C:\Windows\System\IqwlzSg.exe
  C:\Windows\System\IqwlzSg.exe
  2⤵
  PID:6092
- C:\Windows\System\hYKCelx.exe
  C:\Windows\System\hYKCelx.exe
  2⤵
  PID:6120
- C:\Windows\System\beXtXNo.exe
  C:\Windows\System\beXtXNo.exe
  2⤵
  PID:4344
- C:\Windows\System\AasklqI.exe
  C:\Windows\System\AasklqI.exe
  2⤵
  PID:5124
- C:\Windows\System\RBNQxPL.exe
  C:\Windows\System\RBNQxPL.exe
  2⤵
  PID:5224
- C:\Windows\System\zcHBRJD.exe
  C:\Windows\System\zcHBRJD.exe
  2⤵
  PID:5248
- C:\Windows\System\zYtcTob.exe
  C:\Windows\System\zYtcTob.exe
  2⤵
  PID:5304
- C:\Windows\System\ZnSYIFG.exe
  C:\Windows\System\ZnSYIFG.exe
  2⤵
  PID:5368
- C:\Windows\System\nkTUoxn.exe
  C:\Windows\System\nkTUoxn.exe
  2⤵
  PID:5452
- C:\Windows\System\xSjltQW.exe
  C:\Windows\System\xSjltQW.exe
  2⤵
  PID:5484
- C:\Windows\System\kIDQidn.exe
  C:\Windows\System\kIDQidn.exe
  2⤵
  PID:5580
- C:\Windows\System\TZgKOIR.exe
  C:\Windows\System\TZgKOIR.exe
  2⤵
  PID:5640
- C:\Windows\System\faioeSe.exe
  C:\Windows\System\faioeSe.exe
  2⤵
  PID:5724
- C:\Windows\System\FrSqcMV.exe
  C:\Windows\System\FrSqcMV.exe
  2⤵
  PID:5784
- C:\Windows\System\TjIlewq.exe
  C:\Windows\System\TjIlewq.exe
  2⤵
  PID:5848
- C:\Windows\System\TxRXzAN.exe
  C:\Windows\System\TxRXzAN.exe
  2⤵
  PID:5928
- C:\Windows\System\fhcamaJ.exe
  C:\Windows\System\fhcamaJ.exe
  2⤵
  PID:5964
- C:\Windows\System\sApcihI.exe
  C:\Windows\System\sApcihI.exe
  2⤵
  PID:6064
- C:\Windows\System\nruYhTv.exe
  C:\Windows\System\nruYhTv.exe
  2⤵
  PID:6112
- C:\Windows\System\gzFAfQT.exe
  C:\Windows\System\gzFAfQT.exe
  2⤵
  PID:6132
- C:\Windows\System\RIzUwUi.exe
  C:\Windows\System\RIzUwUi.exe
  2⤵
  PID:5360
- C:\Windows\System\RPbEpvy.exe
  C:\Windows\System\RPbEpvy.exe
  2⤵
  PID:5480
- C:\Windows\System\OKAZToC.exe
  C:\Windows\System\OKAZToC.exe
  2⤵
  PID:5300
- C:\Windows\System\DXzGRhj.exe
  C:\Windows\System\DXzGRhj.exe
  2⤵
  PID:5508
- C:\Windows\System\WRfBhqY.exe
  C:\Windows\System\WRfBhqY.exe
  2⤵
  PID:5776
- C:\Windows\System\SEotwlW.exe
  C:\Windows\System\SEotwlW.exe
  2⤵
  PID:5944
- C:\Windows\System\JZDdFVa.exe
  C:\Windows\System\JZDdFVa.exe
  2⤵
  PID:6136
- C:\Windows\System\grFupsJ.exe
  C:\Windows\System\grFupsJ.exe
  2⤵
  PID:5512
- C:\Windows\System\rAhunXi.exe
  C:\Windows\System\rAhunXi.exe
  2⤵
  PID:5824
- C:\Windows\System\tPCQTHw.exe
  C:\Windows\System\tPCQTHw.exe
  2⤵
  PID:6160
- C:\Windows\System\NUpKfmB.exe
  C:\Windows\System\NUpKfmB.exe
  2⤵
  PID:6184
- C:\Windows\System\IAfZKot.exe
  C:\Windows\System\IAfZKot.exe
  2⤵
  PID:6208
- C:\Windows\System\xGMwKWQ.exe
  C:\Windows\System\xGMwKWQ.exe
  2⤵
  PID:6236
- C:\Windows\System\zZBgeVB.exe
  C:\Windows\System\zZBgeVB.exe
  2⤵
  PID:6264
- C:\Windows\System\qnmxZNX.exe
  C:\Windows\System\qnmxZNX.exe
  2⤵
  PID:6292
- C:\Windows\System\SdpdfXP.exe
  C:\Windows\System\SdpdfXP.exe
  2⤵
  PID:6316
- C:\Windows\System\WMmeSrr.exe
  C:\Windows\System\WMmeSrr.exe
  2⤵
  PID:6340
- C:\Windows\System\FQDQkOx.exe
  C:\Windows\System\FQDQkOx.exe
  2⤵
  PID:6360
- C:\Windows\System\TsozQGy.exe
  C:\Windows\System\TsozQGy.exe
  2⤵
  PID:6388
- C:\Windows\System\XPLTMLU.exe
  C:\Windows\System\XPLTMLU.exe
  2⤵
  PID:6416
- C:\Windows\System\zicVmRE.exe
  C:\Windows\System\zicVmRE.exe
  2⤵
  PID:6448
- C:\Windows\System\EukzeVu.exe
  C:\Windows\System\EukzeVu.exe
  2⤵
  PID:6480
- C:\Windows\System\zvncWqN.exe
  C:\Windows\System\zvncWqN.exe
  2⤵
  PID:6512
- C:\Windows\System\udCZJDB.exe
  C:\Windows\System\udCZJDB.exe
  2⤵
  PID:6528
- C:\Windows\System\ZoEulrd.exe
  C:\Windows\System\ZoEulrd.exe
  2⤵
  PID:6556
- C:\Windows\System\TOGAdXt.exe
  C:\Windows\System\TOGAdXt.exe
  2⤵
  PID:6576
- C:\Windows\System\QIxIfBg.exe
  C:\Windows\System\QIxIfBg.exe
  2⤵
  PID:6604
- C:\Windows\System\vcSQbxy.exe
  C:\Windows\System\vcSQbxy.exe
  2⤵
  PID:6624
- C:\Windows\System\ZAXtOYs.exe
  C:\Windows\System\ZAXtOYs.exe
  2⤵
  PID:6656
- C:\Windows\System\jxyEGEQ.exe
  C:\Windows\System\jxyEGEQ.exe
  2⤵
  PID:6672
- C:\Windows\System\FlgGltK.exe
  C:\Windows\System\FlgGltK.exe
  2⤵
  PID:6692
- C:\Windows\System\YchvOtC.exe
  C:\Windows\System\YchvOtC.exe
  2⤵
  PID:6724
- C:\Windows\System\fckESqE.exe
  C:\Windows\System\fckESqE.exe
  2⤵
  PID:6752
- C:\Windows\System\wBeEfBR.exe
  C:\Windows\System\wBeEfBR.exe
  2⤵
  PID:6776
- C:\Windows\System\zbZVkVY.exe
  C:\Windows\System\zbZVkVY.exe
  2⤵
  PID:6808
- C:\Windows\System\aMARCAv.exe
  C:\Windows\System\aMARCAv.exe
  2⤵
  PID:6840
- C:\Windows\System\pFMcZVu.exe
  C:\Windows\System\pFMcZVu.exe
  2⤵
  PID:6872
- C:\Windows\System\FXAuhjc.exe
  C:\Windows\System\FXAuhjc.exe
  2⤵
  PID:6900
- C:\Windows\System\kixagyQ.exe
  C:\Windows\System\kixagyQ.exe
  2⤵
  PID:6932
- C:\Windows\System\nxoIfMo.exe
  C:\Windows\System\nxoIfMo.exe
  2⤵
  PID:6960
- C:\Windows\System\VaeHprq.exe
  C:\Windows\System\VaeHprq.exe
  2⤵
  PID:6984
- C:\Windows\System\BFGHZLO.exe
  C:\Windows\System\BFGHZLO.exe
  2⤵
  PID:7012
- C:\Windows\System\MyKSmVT.exe
  C:\Windows\System\MyKSmVT.exe
  2⤵
  PID:7032
- C:\Windows\System\iPtdXTf.exe
  C:\Windows\System\iPtdXTf.exe
  2⤵
  PID:7052
- C:\Windows\System\uNPkBqd.exe
  C:\Windows\System\uNPkBqd.exe
  2⤵
  PID:7080
- C:\Windows\System\ilwbnOD.exe
  C:\Windows\System\ilwbnOD.exe
  2⤵
  PID:7104
- C:\Windows\System\rYFxUpZ.exe
  C:\Windows\System\rYFxUpZ.exe
  2⤵
  PID:7136
- C:\Windows\System\Ecqvhhs.exe
  C:\Windows\System\Ecqvhhs.exe
  2⤵
  PID:7152
- C:\Windows\System\PxxhRYw.exe
  C:\Windows\System\PxxhRYw.exe
  2⤵
  PID:6084
- C:\Windows\System\SRVcdDM.exe
  C:\Windows\System\SRVcdDM.exe
  2⤵
  PID:6012
- C:\Windows\System\hgCSIpa.exe
  C:\Windows\System\hgCSIpa.exe
  2⤵
  PID:6256
- C:\Windows\System\wnlbtGt.exe
  C:\Windows\System\wnlbtGt.exe
  2⤵
  PID:6228
- C:\Windows\System\lMFYQdA.exe
  C:\Windows\System\lMFYQdA.exe
  2⤵
  PID:6308
- C:\Windows\System\vqBFaXm.exe
  C:\Windows\System\vqBFaXm.exe
  2⤵
  PID:6280
- C:\Windows\System\EBeMiXS.exe
  C:\Windows\System\EBeMiXS.exe
  2⤵
  PID:6500
- C:\Windows\System\WKBCUMv.exe
  C:\Windows\System\WKBCUMv.exe
  2⤵
  PID:6460
- C:\Windows\System\QsNPgzv.exe
  C:\Windows\System\QsNPgzv.exe
  2⤵
  PID:6520
- C:\Windows\System\MZOLXKY.exe
  C:\Windows\System\MZOLXKY.exe
  2⤵
  PID:6588
- C:\Windows\System\RNgYPPa.exe
  C:\Windows\System\RNgYPPa.exe
  2⤵
  PID:6644
- C:\Windows\System\jzRYRSf.exe
  C:\Windows\System\jzRYRSf.exe
  2⤵
  PID:6736
- C:\Windows\System\eojTwTH.exe
  C:\Windows\System\eojTwTH.exe
  2⤵
  PID:6760
- C:\Windows\System\xMJOpik.exe
  C:\Windows\System\xMJOpik.exe
  2⤵
  PID:6788
- C:\Windows\System\owoAZmm.exe
  C:\Windows\System\owoAZmm.exe
  2⤵
  PID:6952
- C:\Windows\System\jKwhQZZ.exe
  C:\Windows\System\jKwhQZZ.exe
  2⤵
  PID:6884
- C:\Windows\System\neWokbA.exe
  C:\Windows\System\neWokbA.exe
  2⤵
  PID:7072
- C:\Windows\System\wXmwuKK.exe
  C:\Windows\System\wXmwuKK.exe
  2⤵
  PID:5684
- C:\Windows\System\MBIQjhr.exe
  C:\Windows\System\MBIQjhr.exe
  2⤵
  PID:6288
- C:\Windows\System\ykgaJkH.exe
  C:\Windows\System\ykgaJkH.exe
  2⤵
  PID:7120
- C:\Windows\System\SHaPHTw.exe
  C:\Windows\System\SHaPHTw.exe
  2⤵
  PID:6552
- C:\Windows\System\bLocPTm.exe
  C:\Windows\System\bLocPTm.exe
  2⤵
  PID:6488
- C:\Windows\System\aUhERQW.exe
  C:\Windows\System\aUhERQW.exe
  2⤵
  PID:6816
- C:\Windows\System\LvzCALo.exe
  C:\Windows\System\LvzCALo.exe
  2⤵
  PID:6880
- C:\Windows\System\twJVxjp.exe
  C:\Windows\System\twJVxjp.exe
  2⤵
  PID:7064
- C:\Windows\System\lQJJWYy.exe
  C:\Windows\System\lQJJWYy.exe
  2⤵
  PID:7172
- C:\Windows\System\agXVmTB.exe
  C:\Windows\System\agXVmTB.exe
  2⤵
  PID:7204
- C:\Windows\System\FxThvpo.exe
  C:\Windows\System\FxThvpo.exe
  2⤵
  PID:7232
- C:\Windows\System\QrZMCNm.exe
  C:\Windows\System\QrZMCNm.exe
  2⤵
  PID:7256
- C:\Windows\System\GyqobLf.exe
  C:\Windows\System\GyqobLf.exe
  2⤵
  PID:7288
- C:\Windows\System\LMCOQpv.exe
  C:\Windows\System\LMCOQpv.exe
  2⤵
  PID:7320
- C:\Windows\System\IQHrvIC.exe
  C:\Windows\System\IQHrvIC.exe
  2⤵
  PID:7356
- C:\Windows\System\sOqieeh.exe
  C:\Windows\System\sOqieeh.exe
  2⤵
  PID:7380
- C:\Windows\System\fiJutCz.exe
  C:\Windows\System\fiJutCz.exe
  2⤵
  PID:7408
- C:\Windows\System\YEYbxpd.exe
  C:\Windows\System\YEYbxpd.exe
  2⤵
  PID:7432
- C:\Windows\System\kzkbAte.exe
  C:\Windows\System\kzkbAte.exe
  2⤵
  PID:7460
- C:\Windows\System\HbpYquV.exe
  C:\Windows\System\HbpYquV.exe
  2⤵
  PID:7488
- C:\Windows\System\vxccpwc.exe
  C:\Windows\System\vxccpwc.exe
  2⤵
  PID:7520
- C:\Windows\System\fuaQeqt.exe
  C:\Windows\System\fuaQeqt.exe
  2⤵
  PID:7544
- C:\Windows\System\NNQacbx.exe
  C:\Windows\System\NNQacbx.exe
  2⤵
  PID:7568
- C:\Windows\System\jpFHFMm.exe
  C:\Windows\System\jpFHFMm.exe
  2⤵
  PID:7592
- C:\Windows\System\gHjCKNz.exe
  C:\Windows\System\gHjCKNz.exe
  2⤵
  PID:7620
- C:\Windows\System\HRWJaDO.exe
  C:\Windows\System\HRWJaDO.exe
  2⤵
  PID:7648
- C:\Windows\System\iIHhNlp.exe
  C:\Windows\System\iIHhNlp.exe
  2⤵
  PID:7680
- C:\Windows\System\CJfruHV.exe
  C:\Windows\System\CJfruHV.exe
  2⤵
  PID:7712
- C:\Windows\System\CGpYdSc.exe
  C:\Windows\System\CGpYdSc.exe
  2⤵
  PID:7736
- C:\Windows\System\kpUEdBM.exe
  C:\Windows\System\kpUEdBM.exe
  2⤵
  PID:7760
- C:\Windows\System\Nboffzc.exe
  C:\Windows\System\Nboffzc.exe
  2⤵
  PID:7788
- C:\Windows\System\NbHUCTP.exe
  C:\Windows\System\NbHUCTP.exe
  2⤵
  PID:7820
- C:\Windows\System\tPGApeK.exe
  C:\Windows\System\tPGApeK.exe
  2⤵
  PID:7848
- C:\Windows\System\UqYegbR.exe
  C:\Windows\System\UqYegbR.exe
  2⤵
  PID:7872
- C:\Windows\System\vxTzcrV.exe
  C:\Windows\System\vxTzcrV.exe
  2⤵
  PID:7900
- C:\Windows\System\HTpBuwp.exe
  C:\Windows\System\HTpBuwp.exe
  2⤵
  PID:7932
- C:\Windows\System\nwVyFUa.exe
  C:\Windows\System\nwVyFUa.exe
  2⤵
  PID:7956
- C:\Windows\System\gaXoggF.exe
  C:\Windows\System\gaXoggF.exe
  2⤵
  PID:7988
- C:\Windows\System\yHwdcuQ.exe
  C:\Windows\System\yHwdcuQ.exe
  2⤵
  PID:8008
- C:\Windows\System\EFwUmPF.exe
  C:\Windows\System\EFwUmPF.exe
  2⤵
  PID:8032
- C:\Windows\System\jQLZXoT.exe
  C:\Windows\System\jQLZXoT.exe
  2⤵
  PID:8056
- C:\Windows\System\PMFqSmG.exe
  C:\Windows\System\PMFqSmG.exe
  2⤵
  PID:8084
- C:\Windows\System\elUBoZM.exe
  C:\Windows\System\elUBoZM.exe
  2⤵
  PID:8112
- C:\Windows\System\ycVoisl.exe
  C:\Windows\System\ycVoisl.exe
  2⤵
  PID:8140
- C:\Windows\System\PfkeSBK.exe
  C:\Windows\System\PfkeSBK.exe
  2⤵
  PID:8168
- C:\Windows\System\WcjAalU.exe
  C:\Windows\System\WcjAalU.exe
  2⤵
  PID:6680
- C:\Windows\System\ibPQYzf.exe
  C:\Windows\System\ibPQYzf.exe
  2⤵
  PID:6792
- C:\Windows\System\cjyeuxL.exe
  C:\Windows\System\cjyeuxL.exe
  2⤵
  PID:6148
- C:\Windows\System\ZoAXynL.exe
  C:\Windows\System\ZoAXynL.exe
  2⤵
  PID:7216
- C:\Windows\System\QYGmZJO.exe
  C:\Windows\System\QYGmZJO.exe
  2⤵
  PID:7144
- C:\Windows\System\SiTBAJD.exe
  C:\Windows\System\SiTBAJD.exe
  2⤵
  PID:6832
- C:\Windows\System\oVpdsjM.exe
  C:\Windows\System\oVpdsjM.exe
  2⤵
  PID:7328
- C:\Windows\System\WcdyGMz.exe
  C:\Windows\System\WcdyGMz.exe
  2⤵
  PID:7244
- C:\Windows\System\vdKAXxv.exe
  C:\Windows\System\vdKAXxv.exe
  2⤵
  PID:7508
- C:\Windows\System\uUTFBIS.exe
  C:\Windows\System\uUTFBIS.exe
  2⤵
  PID:7428
- C:\Windows\System\jsRSuEG.exe
  C:\Windows\System\jsRSuEG.exe
  2⤵
  PID:7588
- C:\Windows\System\WRNrjEV.exe
  C:\Windows\System\WRNrjEV.exe
  2⤵
  PID:7640
- C:\Windows\System\BQziDUb.exe
  C:\Windows\System\BQziDUb.exe
  2⤵
  PID:7732
- C:\Windows\System\CZSsXps.exe
  C:\Windows\System\CZSsXps.exe
  2⤵
  PID:7664
- C:\Windows\System\jHENMKK.exe
  C:\Windows\System\jHENMKK.exe
  2⤵
  PID:7868
- C:\Windows\System\jtXGrVT.exe
  C:\Windows\System\jtXGrVT.exe
  2⤵
  PID:7928
- C:\Windows\System\tbiHIxz.exe
  C:\Windows\System\tbiHIxz.exe
  2⤵
  PID:7816
- C:\Windows\System\ripsbYP.exe
  C:\Windows\System\ripsbYP.exe
  2⤵
  PID:8048
- C:\Windows\System\hupLIvd.exe
  C:\Windows\System\hupLIvd.exe
  2⤵
  PID:7976
- C:\Windows\System\hWWkAZZ.exe
  C:\Windows\System\hWWkAZZ.exe
  2⤵
  PID:7044
- C:\Windows\System\kEBovsz.exe
  C:\Windows\System\kEBovsz.exe
  2⤵
  PID:7196
- C:\Windows\System\UYNKOwV.exe
  C:\Windows\System\UYNKOwV.exe
  2⤵
  PID:7368
- C:\Windows\System\LtOLfXr.exe
  C:\Windows\System\LtOLfXr.exe
  2⤵
  PID:7200
- C:\Windows\System\VvKhhfe.exe
  C:\Windows\System\VvKhhfe.exe
  2⤵
  PID:7752
- C:\Windows\System\uuDudhh.exe
  C:\Windows\System\uuDudhh.exe
  2⤵
  PID:7376
- C:\Windows\System\WjjgHJa.exe
  C:\Windows\System\WjjgHJa.exe
  2⤵
  PID:7616
- C:\Windows\System\GrAAYzo.exe
  C:\Windows\System\GrAAYzo.exe
  2⤵
  PID:7468
- C:\Windows\System\RnsduOt.exe
  C:\Windows\System\RnsduOt.exe
  2⤵
  PID:8208
- C:\Windows\System\ZNQJEOt.exe
  C:\Windows\System\ZNQJEOt.exe
  2⤵
  PID:8240
- C:\Windows\System\FAOUNRu.exe
  C:\Windows\System\FAOUNRu.exe
  2⤵
  PID:8272
- C:\Windows\System\wczSwHp.exe
  C:\Windows\System\wczSwHp.exe
  2⤵
  PID:8300
- C:\Windows\System\qcNeWca.exe
  C:\Windows\System\qcNeWca.exe
  2⤵
  PID:8324
- C:\Windows\System\AoiXcZQ.exe
  C:\Windows\System\AoiXcZQ.exe
  2⤵
  PID:8352
- C:\Windows\System\YTamRvS.exe
  C:\Windows\System\YTamRvS.exe
  2⤵
  PID:8380
- C:\Windows\System\xNrzESB.exe
  C:\Windows\System\xNrzESB.exe
  2⤵
  PID:8400
- C:\Windows\System\xKENysr.exe
  C:\Windows\System\xKENysr.exe
  2⤵
  PID:8424
- C:\Windows\System\KEfyNiZ.exe
  C:\Windows\System\KEfyNiZ.exe
  2⤵
  PID:8448
- C:\Windows\System\wiYjFgK.exe
  C:\Windows\System\wiYjFgK.exe
  2⤵
  PID:8476
- C:\Windows\System\xIQIepd.exe
  C:\Windows\System\xIQIepd.exe
  2⤵
  PID:8500
- C:\Windows\System\mxdaHki.exe
  C:\Windows\System\mxdaHki.exe
  2⤵
  PID:8528
- C:\Windows\System\OvdXsng.exe
  C:\Windows\System\OvdXsng.exe
  2⤵
  PID:8548
- C:\Windows\System\CBnWPaW.exe
  C:\Windows\System\CBnWPaW.exe
  2⤵
  PID:8576
- C:\Windows\System\fsvYLic.exe
  C:\Windows\System\fsvYLic.exe
  2⤵
  PID:8604
- C:\Windows\System\rvBYhkr.exe
  C:\Windows\System\rvBYhkr.exe
  2⤵
  PID:8636
- C:\Windows\System\DueDzQc.exe
  C:\Windows\System\DueDzQc.exe
  2⤵
  PID:8656
- C:\Windows\System\NSnScuK.exe
  C:\Windows\System\NSnScuK.exe
  2⤵
  PID:8680
- C:\Windows\System\nnJOYBm.exe
  C:\Windows\System\nnJOYBm.exe
  2⤵
  PID:8704
- C:\Windows\System\fHLanyr.exe
  C:\Windows\System\fHLanyr.exe
  2⤵
  PID:8736
- C:\Windows\System\vLUBpoo.exe
  C:\Windows\System\vLUBpoo.exe
  2⤵
  PID:8772
- C:\Windows\System\vbwwCIm.exe
  C:\Windows\System\vbwwCIm.exe
  2⤵
  PID:8796
- C:\Windows\System\XQbPnVh.exe
  C:\Windows\System\XQbPnVh.exe
  2⤵
  PID:8828
- C:\Windows\System\eDKjcIW.exe
  C:\Windows\System\eDKjcIW.exe
  2⤵
  PID:8856
- C:\Windows\System\ydpJnAy.exe
  C:\Windows\System\ydpJnAy.exe
  2⤵
  PID:8876
- C:\Windows\System\zwiUAPW.exe
  C:\Windows\System\zwiUAPW.exe
  2⤵
  PID:8908
- C:\Windows\System\LmNcuNV.exe
  C:\Windows\System\LmNcuNV.exe
  2⤵
  PID:8944
- C:\Windows\System\GuMbFPx.exe
  C:\Windows\System\GuMbFPx.exe
  2⤵
  PID:8972
- C:\Windows\System\MhhWdqJ.exe
  C:\Windows\System\MhhWdqJ.exe
  2⤵
  PID:9000
- C:\Windows\System\SSJEdMl.exe
  C:\Windows\System\SSJEdMl.exe
  2⤵
  PID:9024
- C:\Windows\System\HXRZLTy.exe
  C:\Windows\System\HXRZLTy.exe
  2⤵
  PID:9052
- C:\Windows\System\szxzqWd.exe
  C:\Windows\System\szxzqWd.exe
  2⤵
  PID:9084
- C:\Windows\System\CQHDOxw.exe
  C:\Windows\System\CQHDOxw.exe
  2⤵
  PID:9104
- C:\Windows\System\NxosKdr.exe
  C:\Windows\System\NxosKdr.exe
  2⤵
  PID:9132
- C:\Windows\System\igITaVq.exe
  C:\Windows\System\igITaVq.exe
  2⤵
  PID:9152
- C:\Windows\System\SNmrFvA.exe
  C:\Windows\System\SNmrFvA.exe
  2⤵
  PID:9180
- C:\Windows\System\IQpHgCF.exe
  C:\Windows\System\IQpHgCF.exe
  2⤵
  PID:9196
- C:\Windows\System\oGyiGji.exe
  C:\Windows\System\oGyiGji.exe
  2⤵
  PID:7188
- C:\Windows\System\IIGaJzM.exe
  C:\Windows\System\IIGaJzM.exe
  2⤵
  PID:7348
- C:\Windows\System\SOHpQKQ.exe
  C:\Windows\System\SOHpQKQ.exe
  2⤵
  PID:7804
- C:\Windows\System\QVvrMMC.exe
  C:\Windows\System\QVvrMMC.exe
  2⤵
  PID:7856
- C:\Windows\System\QkOWQsW.exe
  C:\Windows\System\QkOWQsW.exe
  2⤵
  PID:7564
- C:\Windows\System\DXnwbQV.exe
  C:\Windows\System\DXnwbQV.exe
  2⤵
  PID:6636
- C:\Windows\System\KusJKor.exe
  C:\Windows\System\KusJKor.exe
  2⤵
  PID:8252
- C:\Windows\System\ewZbRQn.exe
  C:\Windows\System\ewZbRQn.exe
  2⤵
  PID:8368
- C:\Windows\System\UvYFlWd.exe
  C:\Windows\System\UvYFlWd.exe
  2⤵
  PID:8396
- C:\Windows\System\RKkpKCE.exe
  C:\Windows\System\RKkpKCE.exe
  2⤵
  PID:8464
- C:\Windows\System\DoVbwbw.exe
  C:\Windows\System\DoVbwbw.exe
  2⤵
  PID:8544
- C:\Windows\System\uDIYunn.exe
  C:\Windows\System\uDIYunn.exe
  2⤵
  PID:8220
- C:\Windows\System\cRzdrFO.exe
  C:\Windows\System\cRzdrFO.exe
  2⤵
  PID:8284
- C:\Windows\System\VHjlonl.exe
  C:\Windows\System\VHjlonl.exe
  2⤵
  PID:8672
- C:\Windows\System\OawaZaT.exe
  C:\Windows\System\OawaZaT.exe
  2⤵
  PID:8744
- C:\Windows\System\BZYGPpT.exe
  C:\Windows\System\BZYGPpT.exe
  2⤵
  PID:8792
- C:\Windows\System\XCUUmGC.exe
  C:\Windows\System\XCUUmGC.exe
  2⤵
  PID:8872
- C:\Windows\System\ShZDWTL.exe
  C:\Windows\System\ShZDWTL.exe
  2⤵
  PID:8916
- C:\Windows\System\JXOPkBi.exe
  C:\Windows\System\JXOPkBi.exe
  2⤵
  PID:8724
- C:\Windows\System\IIdKJqU.exe
  C:\Windows\System\IIdKJqU.exe
  2⤵
  PID:9076
- C:\Windows\System\WGKlIgd.exe
  C:\Windows\System\WGKlIgd.exe
  2⤵
  PID:9144
- C:\Windows\System\tkdoHKj.exe
  C:\Windows\System\tkdoHKj.exe
  2⤵
  PID:8984
- C:\Windows\System\dbSMGOr.exe
  C:\Windows\System\dbSMGOr.exe
  2⤵
  PID:7276
- C:\Windows\System\RSGcXpu.exe
  C:\Windows\System\RSGcXpu.exe
  2⤵
  PID:8004
- C:\Windows\System\LQtYVGl.exe
  C:\Windows\System\LQtYVGl.exe
  2⤵
  PID:8520
- C:\Windows\System\OEsmMAw.exe
  C:\Windows\System\OEsmMAw.exe
  2⤵
  PID:7532
- C:\Windows\System\scAsoMf.exe
  C:\Windows\System\scAsoMf.exe
  2⤵
  PID:9244
- C:\Windows\System\ZbibRtu.exe
  C:\Windows\System\ZbibRtu.exe
  2⤵
  PID:9264
- C:\Windows\System\kNOYkPy.exe
  C:\Windows\System\kNOYkPy.exe
  2⤵
  PID:9292
- C:\Windows\System\RGgRKbA.exe
  C:\Windows\System\RGgRKbA.exe
  2⤵
  PID:9312
- C:\Windows\System\jSOtMnl.exe
  C:\Windows\System\jSOtMnl.exe
  2⤵
  PID:9332
- C:\Windows\System\bTmoiyA.exe
  C:\Windows\System\bTmoiyA.exe
  2⤵
  PID:9364
- C:\Windows\System\JGAvfgJ.exe
  C:\Windows\System\JGAvfgJ.exe
  2⤵
  PID:9388
- C:\Windows\System\owHLHKn.exe
  C:\Windows\System\owHLHKn.exe
  2⤵
  PID:9416
- C:\Windows\System\yObvNKN.exe
  C:\Windows\System\yObvNKN.exe
  2⤵
  PID:9440
- C:\Windows\System\lVTykOU.exe
  C:\Windows\System\lVTykOU.exe
  2⤵
  PID:9464
- C:\Windows\System\DLNSQkt.exe
  C:\Windows\System\DLNSQkt.exe
  2⤵
  PID:9492
- C:\Windows\System\rSpRcUG.exe
  C:\Windows\System\rSpRcUG.exe
  2⤵
  PID:9516
- C:\Windows\System\TlxeUER.exe
  C:\Windows\System\TlxeUER.exe
  2⤵
  PID:9540
- C:\Windows\System\kfFSncI.exe
  C:\Windows\System\kfFSncI.exe
  2⤵
  PID:9560
- C:\Windows\System\EyZnhjX.exe
  C:\Windows\System\EyZnhjX.exe
  2⤵
  PID:9592
- C:\Windows\System\jqpwpMF.exe
  C:\Windows\System\jqpwpMF.exe
  2⤵
  PID:9616
- C:\Windows\System\KNSiMPp.exe
  C:\Windows\System\KNSiMPp.exe
  2⤵
  PID:9648
- C:\Windows\System\YIwqEPX.exe
  C:\Windows\System\YIwqEPX.exe
  2⤵
  PID:9664
- C:\Windows\System\LQcicwC.exe
  C:\Windows\System\LQcicwC.exe
  2⤵
  PID:9700
- C:\Windows\System\NluPeGn.exe
  C:\Windows\System\NluPeGn.exe
  2⤵
  PID:9720
- C:\Windows\System\kAamxJX.exe
  C:\Windows\System\kAamxJX.exe
  2⤵
  PID:9748
- C:\Windows\System\UcYNvVT.exe
  C:\Windows\System\UcYNvVT.exe
  2⤵
  PID:9768
- C:\Windows\System\SsSoIzJ.exe
  C:\Windows\System\SsSoIzJ.exe
  2⤵
  PID:9784
- C:\Windows\System\jcOWhgI.exe
  C:\Windows\System\jcOWhgI.exe
  2⤵
  PID:9812
- C:\Windows\System\qyeSIOY.exe
  C:\Windows\System\qyeSIOY.exe
  2⤵
  PID:9828
- C:\Windows\System\VJwSZIq.exe
  C:\Windows\System\VJwSZIq.exe
  2⤵
  PID:9844
- C:\Windows\System\COxawPl.exe
  C:\Windows\System\COxawPl.exe
  2⤵
  PID:9888
- C:\Windows\System\zJnQFhF.exe
  C:\Windows\System\zJnQFhF.exe
  2⤵
  PID:9916
- C:\Windows\System\qRVqohT.exe
  C:\Windows\System\qRVqohT.exe
  2⤵
  PID:9944
- C:\Windows\System\iLYoXCL.exe
  C:\Windows\System\iLYoXCL.exe
  2⤵
  PID:9968
- C:\Windows\System\nhsIcwi.exe
  C:\Windows\System\nhsIcwi.exe
  2⤵
  PID:9988
- C:\Windows\System\kwrluZB.exe
  C:\Windows\System\kwrluZB.exe
  2⤵
  PID:10008
- C:\Windows\System\xAKFNpm.exe
  C:\Windows\System\xAKFNpm.exe
  2⤵
  PID:10032
- C:\Windows\System\fQiKkWb.exe
  C:\Windows\System\fQiKkWb.exe
  2⤵
  PID:10056
- C:\Windows\System\kAQvuMo.exe
  C:\Windows\System\kAQvuMo.exe
  2⤵
  PID:10088
- C:\Windows\System\wQmTJBD.exe
  C:\Windows\System\wQmTJBD.exe
  2⤵
  PID:10112
- C:\Windows\System\mEaJzoP.exe
  C:\Windows\System\mEaJzoP.exe
  2⤵
  PID:10136
- C:\Windows\System\hNMJAzg.exe
  C:\Windows\System\hNMJAzg.exe
  2⤵
  PID:10160
- C:\Windows\System\EufeLWi.exe
  C:\Windows\System\EufeLWi.exe
  2⤵
  PID:10176
- C:\Windows\System\gcKewiv.exe
  C:\Windows\System\gcKewiv.exe
  2⤵
  PID:10200
- C:\Windows\System\jKNmgHX.exe
  C:\Windows\System\jKNmgHX.exe
  2⤵
  PID:10228
- C:\Windows\System\iyLazlF.exe
  C:\Windows\System\iyLazlF.exe
  2⤵
  PID:8348
- C:\Windows\System\dtqbJcn.exe
  C:\Windows\System\dtqbJcn.exe
  2⤵
  PID:8204
- C:\Windows\System\UZbwpwp.exe
  C:\Windows\System\UZbwpwp.exe
  2⤵
  PID:8364
- C:\Windows\System\ogYWYXM.exe
  C:\Windows\System\ogYWYXM.exe
  2⤵
  PID:8080
- C:\Windows\System\LRJpVHA.exe
  C:\Windows\System\LRJpVHA.exe
  2⤵
  PID:8596
- C:\Windows\System\auTTlCE.exe
  C:\Windows\System\auTTlCE.exe
  2⤵
  PID:9208
- C:\Windows\System\OwALHxU.exe
  C:\Windows\System\OwALHxU.exe
  2⤵
  PID:9232
- C:\Windows\System\wSliOXR.exe
  C:\Windows\System\wSliOXR.exe
  2⤵
  PID:9300
- C:\Windows\System\vEzlFeE.exe
  C:\Windows\System\vEzlFeE.exe
  2⤵
  PID:8264
- C:\Windows\System\tPMFspi.exe
  C:\Windows\System\tPMFspi.exe
  2⤵
  PID:9176
- C:\Windows\System\YkRHoDA.exe
  C:\Windows\System\YkRHoDA.exe
  2⤵
  PID:8488
- C:\Windows\System\GcXNmbj.exe
  C:\Windows\System\GcXNmbj.exe
  2⤵
  PID:9256
- C:\Windows\System\AlrojOk.exe
  C:\Windows\System\AlrojOk.exe
  2⤵
  PID:9680
- C:\Windows\System\ZHajsPc.exe
  C:\Windows\System\ZHajsPc.exe
  2⤵
  PID:9360
- C:\Windows\System\yKQKlIM.exe
  C:\Windows\System\yKQKlIM.exe
  2⤵
  PID:9356
- C:\Windows\System\IEWVsKI.exe
  C:\Windows\System\IEWVsKI.exe
  2⤵
  PID:9456
- C:\Windows\System\KpvtiLF.exe
  C:\Windows\System\KpvtiLF.exe
  2⤵
  PID:9876
- C:\Windows\System\mPXNkRj.exe
  C:\Windows\System\mPXNkRj.exe
  2⤵
  PID:9640
- C:\Windows\System\RASfVHn.exe
  C:\Windows\System\RASfVHn.exe
  2⤵
  PID:9976
- C:\Windows\System\pEosnPb.exe
  C:\Windows\System\pEosnPb.exe
  2⤵
  PID:9732
- C:\Windows\System\vJUSRjJ.exe
  C:\Windows\System\vJUSRjJ.exe
  2⤵
  PID:9460
- C:\Windows\System\AxqZWlI.exe
  C:\Windows\System\AxqZWlI.exe
  2⤵
  PID:10156
- C:\Windows\System\FMkYBeq.exe
  C:\Windows\System\FMkYBeq.exe
  2⤵
  PID:9572
- C:\Windows\System\GpAUWnK.exe
  C:\Windows\System\GpAUWnK.exe
  2⤵
  PID:10220
- C:\Windows\System\axTzBiq.exe
  C:\Windows\System\axTzBiq.exe
  2⤵
  PID:9940
- C:\Windows\System\aKyqwdY.exe
  C:\Windows\System\aKyqwdY.exe
  2⤵
  PID:10252
- C:\Windows\System\bVXOvKH.exe
  C:\Windows\System\bVXOvKH.exe
  2⤵
  PID:10272
- C:\Windows\System\GlBKKBv.exe
  C:\Windows\System\GlBKKBv.exe
  2⤵
  PID:10292
- C:\Windows\System\qMiQQEG.exe
  C:\Windows\System\qMiQQEG.exe
  2⤵
  PID:10320
- C:\Windows\System\vmoqbNJ.exe
  C:\Windows\System\vmoqbNJ.exe
  2⤵
  PID:10348
- C:\Windows\System\bhYPILY.exe
  C:\Windows\System\bhYPILY.exe
  2⤵
  PID:10372
- C:\Windows\System\vzWYppK.exe
  C:\Windows\System\vzWYppK.exe
  2⤵
  PID:10404
- C:\Windows\System\ADOEGYw.exe
  C:\Windows\System\ADOEGYw.exe
  2⤵
  PID:10424
- C:\Windows\System\VSTdXUJ.exe
  C:\Windows\System\VSTdXUJ.exe
  2⤵
  PID:10444
- C:\Windows\System\fhpZycr.exe
  C:\Windows\System\fhpZycr.exe
  2⤵
  PID:10472
- C:\Windows\System\lSCfIGH.exe
  C:\Windows\System\lSCfIGH.exe
  2⤵
  PID:10500
- C:\Windows\System\gyNlDRX.exe
  C:\Windows\System\gyNlDRX.exe
  2⤵
  PID:10516
- C:\Windows\System\nXtVqjU.exe
  C:\Windows\System\nXtVqjU.exe
  2⤵
  PID:10532
- C:\Windows\System\qbSsczE.exe
  C:\Windows\System\qbSsczE.exe
  2⤵
  PID:10564
- C:\Windows\System\MOcLpfN.exe
  C:\Windows\System\MOcLpfN.exe
  2⤵
  PID:10580
- C:\Windows\System\fWgjoQa.exe
  C:\Windows\System\fWgjoQa.exe
  2⤵
  PID:10600
- C:\Windows\System\kDZVBCj.exe
  C:\Windows\System\kDZVBCj.exe
  2⤵
  PID:10620
- C:\Windows\System\JQQtWyg.exe
  C:\Windows\System\JQQtWyg.exe
  2⤵
  PID:10648
- C:\Windows\System\vbwrZjT.exe
  C:\Windows\System\vbwrZjT.exe
  2⤵
  PID:10672
- C:\Windows\System\RkIJqGj.exe
  C:\Windows\System\RkIJqGj.exe
  2⤵
  PID:10700
- C:\Windows\System\HFLhitI.exe
  C:\Windows\System\HFLhitI.exe
  2⤵
  PID:10724
- C:\Windows\System\PbSZVje.exe
  C:\Windows\System\PbSZVje.exe
  2⤵
  PID:10748
- C:\Windows\System\RIqIJtf.exe
  C:\Windows\System\RIqIJtf.exe
  2⤵
  PID:10776
- C:\Windows\System\OCVEeCz.exe
  C:\Windows\System\OCVEeCz.exe
  2⤵
  PID:10804
- C:\Windows\System\YGQKGIi.exe
  C:\Windows\System\YGQKGIi.exe
  2⤵
  PID:10832
- C:\Windows\System\xZqOAYI.exe
  C:\Windows\System\xZqOAYI.exe
  2⤵
  PID:10856
- C:\Windows\System\vkEvWCu.exe
  C:\Windows\System\vkEvWCu.exe
  2⤵
  PID:10880
- C:\Windows\System\gDDFuhH.exe
  C:\Windows\System\gDDFuhH.exe
  2⤵
  PID:10904
- C:\Windows\System\mciSziP.exe
  C:\Windows\System\mciSziP.exe
  2⤵
  PID:10928
- C:\Windows\System\hfdRKTm.exe
  C:\Windows\System\hfdRKTm.exe
  2⤵
  PID:10956
- C:\Windows\System\wPkSDQh.exe
  C:\Windows\System\wPkSDQh.exe
  2⤵
  PID:10980
- C:\Windows\System\AIUDKLJ.exe
  C:\Windows\System\AIUDKLJ.exe
  2⤵
  PID:11008
- C:\Windows\System\yywanRf.exe
  C:\Windows\System\yywanRf.exe
  2⤵
  PID:11028
- C:\Windows\System\rWytEHw.exe
  C:\Windows\System\rWytEHw.exe
  2⤵
  PID:11052
- C:\Windows\System\jnkxoDS.exe
  C:\Windows\System\jnkxoDS.exe
  2⤵
  PID:11072
- C:\Windows\System\eiuIKBF.exe
  C:\Windows\System\eiuIKBF.exe
  2⤵
  PID:11092
- C:\Windows\System\AHWvbcS.exe
  C:\Windows\System\AHWvbcS.exe
  2⤵
  PID:11116
- C:\Windows\System\mezKpuZ.exe
  C:\Windows\System\mezKpuZ.exe
  2⤵
  PID:11144
- C:\Windows\System\KhVwUEt.exe
  C:\Windows\System\KhVwUEt.exe
  2⤵
  PID:11172
- C:\Windows\System\QQkbRVF.exe
  C:\Windows\System\QQkbRVF.exe
  2⤵
  PID:11192
- C:\Windows\System\YIlknoT.exe
  C:\Windows\System\YIlknoT.exe
  2⤵
  PID:11216
- C:\Windows\System\jQCSWuq.exe
  C:\Windows\System\jQCSWuq.exe
  2⤵
  PID:11240
- C:\Windows\System\WkfUCAQ.exe
  C:\Windows\System\WkfUCAQ.exe
  2⤵
  PID:11260
- C:\Windows\System\EVckZXs.exe
  C:\Windows\System\EVckZXs.exe
  2⤵
  PID:9708
- C:\Windows\System\uyMOLpb.exe
  C:\Windows\System\uyMOLpb.exe
  2⤵
  PID:10052
- C:\Windows\System\LjAIFsi.exe
  C:\Windows\System\LjAIFsi.exe
  2⤵
  PID:8492
- C:\Windows\System\HWshSzU.exe
  C:\Windows\System\HWshSzU.exe
  2⤵
  PID:8892
- C:\Windows\System\WswTKOF.exe
  C:\Windows\System\WswTKOF.exe
  2⤵
  PID:10144
- C:\Windows\System\icFgyVJ.exe
  C:\Windows\System\icFgyVJ.exe
  2⤵
  PID:10196
- C:\Windows\System\ACkKKeD.exe
  C:\Windows\System\ACkKKeD.exe
  2⤵
  PID:9908
- C:\Windows\System\DHLhaWL.exe
  C:\Windows\System\DHLhaWL.exe
  2⤵
  PID:9608
- C:\Windows\System\ysZWsLc.exe
  C:\Windows\System\ysZWsLc.exe
  2⤵
  PID:10248
- C:\Windows\System\QdhKRWf.exe
  C:\Windows\System\QdhKRWf.exe
  2⤵
  PID:8188
- C:\Windows\System\RyAoBxf.exe
  C:\Windows\System\RyAoBxf.exe
  2⤵
  PID:9260
- C:\Windows\System\DCSjqvx.exe
  C:\Windows\System\DCSjqvx.exe
  2⤵
  PID:10360
- C:\Windows\System\RiACTLa.exe
  C:\Windows\System\RiACTLa.exe
  2⤵
  PID:10068
- C:\Windows\System\yzknwGr.exe
  C:\Windows\System\yzknwGr.exe
  2⤵
  PID:10488
- C:\Windows\System\JMBMHXW.exe
  C:\Windows\System\JMBMHXW.exe
  2⤵
  PID:10024
- C:\Windows\System\fpVNWbg.exe
  C:\Windows\System\fpVNWbg.exe
  2⤵
  PID:10184
- C:\Windows\System\hqTvNZi.exe
  C:\Windows\System\hqTvNZi.exe
  2⤵
  PID:10784
- C:\Windows\System\HbIIrzj.exe
  C:\Windows\System\HbIIrzj.exe
  2⤵
  PID:10312
- C:\Windows\System\wKIiAsG.exe
  C:\Windows\System\wKIiAsG.exe
  2⤵
  PID:9412
- C:\Windows\System\DDcDqbk.exe
  C:\Windows\System\DDcDqbk.exe
  2⤵
  PID:10964
- C:\Windows\System\sEdhcpr.exe
  C:\Windows\System\sEdhcpr.exe
  2⤵
  PID:11036
- C:\Windows\System\vYqNdEc.exe
  C:\Windows\System\vYqNdEc.exe
  2⤵
  PID:10552
- C:\Windows\System\aFgEfQa.exe
  C:\Windows\System\aFgEfQa.exe
  2⤵
  PID:11272
- C:\Windows\System\KJvpHWu.exe
  C:\Windows\System\KJvpHWu.exe
  2⤵
  PID:11292
- C:\Windows\System\wXHIUbj.exe
  C:\Windows\System\wXHIUbj.exe
  2⤵
  PID:11312
- C:\Windows\System\HbWibPt.exe
  C:\Windows\System\HbWibPt.exe
  2⤵
  PID:11332
- C:\Windows\System\lgwmZBq.exe
  C:\Windows\System\lgwmZBq.exe
  2⤵
  PID:11352
- C:\Windows\System\aspBWQA.exe
  C:\Windows\System\aspBWQA.exe
  2⤵
  PID:11376
- C:\Windows\System\GBKvcOI.exe
  C:\Windows\System\GBKvcOI.exe
  2⤵
  PID:11396
- C:\Windows\System\mhYoYcg.exe
  C:\Windows\System\mhYoYcg.exe
  2⤵
  PID:11416
- C:\Windows\System\QYmWOQI.exe
  C:\Windows\System\QYmWOQI.exe
  2⤵
  PID:11440
- C:\Windows\System\QMqGHqG.exe
  C:\Windows\System\QMqGHqG.exe
  2⤵
  PID:11468
- C:\Windows\System\hTArIkk.exe
  C:\Windows\System\hTArIkk.exe
  2⤵
  PID:11496
- C:\Windows\System\fSjlCxF.exe
  C:\Windows\System\fSjlCxF.exe
  2⤵
  PID:11516
- C:\Windows\System\sasAJDR.exe
  C:\Windows\System\sasAJDR.exe
  2⤵
  PID:11540
- C:\Windows\System\BRCEfIn.exe
  C:\Windows\System\BRCEfIn.exe
  2⤵
  PID:11560
- C:\Windows\System\SGnmvAk.exe
  C:\Windows\System\SGnmvAk.exe
  2⤵
  PID:11588
- C:\Windows\System\wmeZcRT.exe
  C:\Windows\System\wmeZcRT.exe
  2⤵
  PID:11608
- C:\Windows\System\RUpxKcl.exe
  C:\Windows\System\RUpxKcl.exe
  2⤵
  PID:11636
- C:\Windows\System\bRUCwLn.exe
  C:\Windows\System\bRUCwLn.exe
  2⤵
  PID:11656
- C:\Windows\System\FaJlSny.exe
  C:\Windows\System\FaJlSny.exe
  2⤵
  PID:11672
- C:\Windows\System\sLlXCSD.exe
  C:\Windows\System\sLlXCSD.exe
  2⤵
  PID:11688
- C:\Windows\System\WciXxre.exe
  C:\Windows\System\WciXxre.exe
  2⤵
  PID:11728
- C:\Windows\System\HgOSjBx.exe
  C:\Windows\System\HgOSjBx.exe
  2⤵
  PID:11752
- C:\Windows\System\nAcIGDg.exe
  C:\Windows\System\nAcIGDg.exe
  2⤵
  PID:11780
- C:\Windows\System\NRTDpmB.exe
  C:\Windows\System\NRTDpmB.exe
  2⤵
  PID:11808
- C:\Windows\System\sBtRFpM.exe
  C:\Windows\System\sBtRFpM.exe
  2⤵
  PID:11824
- C:\Windows\System\NcGCPdp.exe
  C:\Windows\System\NcGCPdp.exe
  2⤵
  PID:11856
- C:\Windows\System\NeKCvuC.exe
  C:\Windows\System\NeKCvuC.exe
  2⤵
  PID:11876
- C:\Windows\System\RFlChvI.exe
  C:\Windows\System\RFlChvI.exe
  2⤵
  PID:11896
- C:\Windows\System\dtHQjWa.exe
  C:\Windows\System\dtHQjWa.exe
  2⤵
  PID:11920
- C:\Windows\System\jZybpQB.exe
  C:\Windows\System\jZybpQB.exe
  2⤵
  PID:11936
- C:\Windows\System\TiLhzWY.exe
  C:\Windows\System\TiLhzWY.exe
  2⤵
  PID:11964
- C:\Windows\System\mOoUgyU.exe
  C:\Windows\System\mOoUgyU.exe
  2⤵
  PID:11984
- C:\Windows\System\ffwYdQV.exe
  C:\Windows\System\ffwYdQV.exe
  2⤵
  PID:12012
- C:\Windows\System\lbleFJl.exe
  C:\Windows\System\lbleFJl.exe
  2⤵
  PID:12040
- C:\Windows\System\dxxhoYM.exe
  C:\Windows\System\dxxhoYM.exe
  2⤵
  PID:12068
- C:\Windows\System\KYnmTou.exe
  C:\Windows\System\KYnmTou.exe
  2⤵
  PID:12108
- C:\Windows\System\wHsRXWI.exe
  C:\Windows\System\wHsRXWI.exe
  2⤵
  PID:12124
- C:\Windows\System\dzYRemw.exe
  C:\Windows\System\dzYRemw.exe
  2⤵
  PID:12152
- C:\Windows\System\ACsRSrB.exe
  C:\Windows\System\ACsRSrB.exe
  2⤵
  PID:12172
- C:\Windows\System\LSgROBs.exe
  C:\Windows\System\LSgROBs.exe
  2⤵
  PID:12196
- C:\Windows\System\GMmWijb.exe
  C:\Windows\System\GMmWijb.exe
  2⤵
  PID:12228
- C:\Windows\System\GcoYfsp.exe
  C:\Windows\System\GcoYfsp.exe
  2⤵
  PID:12256
- C:\Windows\System\zAQarXW.exe
  C:\Windows\System\zAQarXW.exe
  2⤵
  PID:12284
- C:\Windows\System\aSHDRHe.exe
  C:\Windows\System\aSHDRHe.exe
  2⤵
  PID:10004
- C:\Windows\System\fCEiAkO.exe
  C:\Windows\System\fCEiAkO.exe
  2⤵
  PID:9760
- C:\Windows\System\exYUyYm.exe
  C:\Windows\System\exYUyYm.exe
  2⤵
  PID:9980
- C:\Windows\System\OmryDiR.exe
  C:\Windows\System\OmryDiR.exe
  2⤵
  PID:10744
- C:\Windows\System\VIWPxPG.exe
  C:\Windows\System\VIWPxPG.exe
  2⤵
  PID:9228
- C:\Windows\System\pnuyLPy.exe
  C:\Windows\System\pnuyLPy.exe
  2⤵
  PID:8296
- C:\Windows\System\eimPdnP.exe
  C:\Windows\System\eimPdnP.exe
  2⤵
  PID:10268
- C:\Windows\System\cmwMzNy.exe
  C:\Windows\System\cmwMzNy.exe
  2⤵
  PID:10920
- C:\Windows\System\cbXIpYK.exe
  C:\Windows\System\cbXIpYK.exe
  2⤵
  PID:10460
- C:\Windows\System\YAIOusQ.exe
  C:\Windows\System\YAIOusQ.exe
  2⤵
  PID:10764
- C:\Windows\System\VwqRNFw.exe
  C:\Windows\System\VwqRNFw.exe
  2⤵
  PID:11064
- C:\Windows\System\pfSZHVT.exe
  C:\Windows\System\pfSZHVT.exe
  2⤵
  PID:10436
- C:\Windows\System\pmxStQp.exe
  C:\Windows\System\pmxStQp.exe
  2⤵
  PID:11124
- C:\Windows\System\jRCqwKS.exe
  C:\Windows\System\jRCqwKS.exe
  2⤵
  PID:11328
- C:\Windows\System\ebjdVdx.exe
  C:\Windows\System\ebjdVdx.exe
  2⤵
  PID:11392
- C:\Windows\System\pHSQWIa.exe
  C:\Windows\System\pHSQWIa.exe
  2⤵
  PID:11432
- C:\Windows\System\vptICbC.exe
  C:\Windows\System\vptICbC.exe
  2⤵
  PID:10124
- C:\Windows\System\VLsHLrJ.exe
  C:\Windows\System\VLsHLrJ.exe
  2⤵
  PID:10100
- C:\Windows\System\QBglLnw.exe
  C:\Windows\System\QBglLnw.exe
  2⤵
  PID:11628
- C:\Windows\System\MkiYrXc.exe
  C:\Windows\System\MkiYrXc.exe
  2⤵
  PID:11664
- C:\Windows\System\DaGLsji.exe
  C:\Windows\System\DaGLsji.exe
  2⤵
  PID:9612
- C:\Windows\System\Ltzcqoh.exe
  C:\Windows\System\Ltzcqoh.exe
  2⤵
  PID:11816
- C:\Windows\System\CRqJuhF.exe
  C:\Windows\System\CRqJuhF.exe
  2⤵
  PID:11080
- C:\Windows\System\tKkIFeR.exe
  C:\Windows\System\tKkIFeR.exe
  2⤵
  PID:11268
- C:\Windows\System\PUrUyps.exe
  C:\Windows\System\PUrUyps.exe
  2⤵
  PID:12308
- C:\Windows\System\OytJPjL.exe
  C:\Windows\System\OytJPjL.exe
  2⤵
  PID:12332
- C:\Windows\System\hbIusIV.exe
  C:\Windows\System\hbIusIV.exe
  2⤵
  PID:12356
- C:\Windows\System\kUJYgdl.exe
  C:\Windows\System\kUJYgdl.exe
  2⤵
  PID:12376
- C:\Windows\System\fqNmuVZ.exe
  C:\Windows\System\fqNmuVZ.exe
  2⤵
  PID:12400
- C:\Windows\System\pEqAiOh.exe
  C:\Windows\System\pEqAiOh.exe
  2⤵
  PID:12424
- C:\Windows\System\sOUTuFp.exe
  C:\Windows\System\sOUTuFp.exe
  2⤵
  PID:12448
- C:\Windows\System\IfEJSqy.exe
  C:\Windows\System\IfEJSqy.exe
  2⤵
  PID:12476
- C:\Windows\System\kgQLVei.exe
  C:\Windows\System\kgQLVei.exe
  2⤵
  PID:12500
- C:\Windows\System\SQaDzHY.exe
  C:\Windows\System\SQaDzHY.exe
  2⤵
  PID:12520
- C:\Windows\System\dcQsCJY.exe
  C:\Windows\System\dcQsCJY.exe
  2⤵
  PID:12536
- C:\Windows\System\bFHrJXz.exe
  C:\Windows\System\bFHrJXz.exe
  2⤵
  PID:12564
- C:\Windows\System\nrbgsxR.exe
  C:\Windows\System\nrbgsxR.exe
  2⤵
  PID:12596
- C:\Windows\System\HkrCJxO.exe
  C:\Windows\System\HkrCJxO.exe
  2⤵
  PID:12628
- C:\Windows\System\sFKnfab.exe
  C:\Windows\System\sFKnfab.exe
  2⤵
  PID:12648
- C:\Windows\System\zrmBftn.exe
  C:\Windows\System\zrmBftn.exe
  2⤵
  PID:12672
- C:\Windows\System\neeceNB.exe
  C:\Windows\System\neeceNB.exe
  2⤵
  PID:12700
- C:\Windows\System\AoCtHHo.exe
  C:\Windows\System\AoCtHHo.exe
  2⤵
  PID:12724
- C:\Windows\System\giOYHpl.exe
  C:\Windows\System\giOYHpl.exe
  2⤵
  PID:12744
- C:\Windows\System\FalBumq.exe
  C:\Windows\System\FalBumq.exe
  2⤵
  PID:12772
- C:\Windows\System\RzvDNxe.exe
  C:\Windows\System\RzvDNxe.exe
  2⤵
  PID:12792
- C:\Windows\System\omtealc.exe
  C:\Windows\System\omtealc.exe
  2⤵
  PID:12820
- C:\Windows\System\VAVGXTf.exe
  C:\Windows\System\VAVGXTf.exe
  2⤵
  PID:12856
- C:\Windows\System\pMsrgny.exe
  C:\Windows\System\pMsrgny.exe
  2⤵
  PID:12884
- C:\Windows\System\GVPjyPF.exe
  C:\Windows\System\GVPjyPF.exe
  2⤵
  PID:12908
- C:\Windows\System\whZvlFc.exe
  C:\Windows\System\whZvlFc.exe
  2⤵
  PID:12932
- C:\Windows\System\dKYrYMB.exe
  C:\Windows\System\dKYrYMB.exe
  2⤵
  PID:12948
- C:\Windows\System\XXldPjT.exe
  C:\Windows\System\XXldPjT.exe
  2⤵
  PID:12972
- C:\Windows\System\qpYqfsT.exe
  C:\Windows\System\qpYqfsT.exe
  2⤵
  PID:13000
- C:\Windows\System\EaoFibn.exe
  C:\Windows\System\EaoFibn.exe
  2⤵
  PID:13020
- C:\Windows\System\RwzNQdQ.exe
  C:\Windows\System\RwzNQdQ.exe
  2⤵
  PID:13036
- C:\Windows\System\AyAPXkJ.exe
  C:\Windows\System\AyAPXkJ.exe
  2⤵
  PID:13064
- C:\Windows\System\FpijtLK.exe
  C:\Windows\System\FpijtLK.exe
  2⤵
  PID:13080
- C:\Windows\System\oTZMqKG.exe
  C:\Windows\System\oTZMqKG.exe
  2⤵
  PID:13104
- C:\Windows\System\HsjNJQa.exe
  C:\Windows\System\HsjNJQa.exe
  2⤵
  PID:13136
- C:\Windows\System\lyCpqka.exe
  C:\Windows\System\lyCpqka.exe
  2⤵
  PID:13160
- C:\Windows\System\JKYlmGU.exe
  C:\Windows\System\JKYlmGU.exe
  2⤵
  PID:13184
- C:\Windows\System\mcRoCaE.exe
  C:\Windows\System\mcRoCaE.exe
  2⤵
  PID:13204
- C:\Windows\System\WwnCrWu.exe
  C:\Windows\System\WwnCrWu.exe
  2⤵
  PID:13220
- C:\Windows\System\CxQzyxm.exe
  C:\Windows\System\CxQzyxm.exe
  2⤵
  PID:13244
- C:\Windows\System\AHwuqfN.exe
  C:\Windows\System\AHwuqfN.exe
  2⤵
  PID:13268
- C:\Windows\System\lbYDhUo.exe
  C:\Windows\System\lbYDhUo.exe
  2⤵
  PID:13288
- C:\Windows\System\HOYWUat.exe
  C:\Windows\System\HOYWUat.exe
  2⤵
  PID:13308
- C:\Windows\System\PItPLoO.exe
  C:\Windows\System\PItPLoO.exe
  2⤵
  PID:11348
- C:\Windows\System\oDLmFUY.exe
  C:\Windows\System\oDLmFUY.exe
  2⤵
  PID:12104
- C:\Windows\System\XqtlIMR.exe
  C:\Windows\System\XqtlIMR.exe
  2⤵
  PID:11484
- C:\Windows\System\NqzLHbD.exe
  C:\Windows\System\NqzLHbD.exe
  2⤵
  PID:12216
- C:\Windows\System\MWXdPci.exe
  C:\Windows\System\MWXdPci.exe
  2⤵
  PID:11556
- C:\Windows\System\NePjFJZ.exe
  C:\Windows\System\NePjFJZ.exe
  2⤵
  PID:11596
- C:\Windows\System\FebsMKr.exe
  C:\Windows\System\FebsMKr.exe
  2⤵
  PID:8848
- C:\Windows\System\OIKrNjp.exe
  C:\Windows\System\OIKrNjp.exe
  2⤵
  PID:10452
- C:\Windows\System\iWuBiOw.exe
  C:\Windows\System\iWuBiOw.exe
  2⤵
  PID:10844
- C:\Windows\System\SPnoInZ.exe
  C:\Windows\System\SPnoInZ.exe
  2⤵
  PID:10684
- C:\Windows\System\tOtCMLy.exe
  C:\Windows\System\tOtCMLy.exe
  2⤵
  PID:11368
- C:\Windows\System\qmQiCzt.exe
  C:\Windows\System\qmQiCzt.exe
  2⤵
  PID:10284
- C:\Windows\System\VRZosjT.exe
  C:\Windows\System\VRZosjT.exe
  2⤵
  PID:10356
- C:\Windows\System\ghYCkGp.exe
  C:\Windows\System\ghYCkGp.exe
  2⤵
  PID:12304
- C:\Windows\System\aDIEgLu.exe
  C:\Windows\System\aDIEgLu.exe
  2⤵
  PID:12420
- C:\Windows\System\bVcXJka.exe
  C:\Windows\System\bVcXJka.exe
  2⤵
  PID:12472
- C:\Windows\System\YwZQEkp.exe
  C:\Windows\System\YwZQEkp.exe
  2⤵
  PID:12168
- C:\Windows\System\LmKVDXj.exe
  C:\Windows\System\LmKVDXj.exe
  2⤵
  PID:12224
- C:\Windows\System\dqoOlqh.exe
  C:\Windows\System\dqoOlqh.exe
  2⤵
  PID:12272
- C:\Windows\System\AOEXFnF.exe
  C:\Windows\System\AOEXFnF.exe
  2⤵
  PID:13320
- C:\Windows\System\VqkHflx.exe
  C:\Windows\System\VqkHflx.exe
  2⤵
  PID:13348
- C:\Windows\System\cPVHElF.exe
  C:\Windows\System\cPVHElF.exe
  2⤵
  PID:13372
- C:\Windows\System\ivaAfqx.exe
  C:\Windows\System\ivaAfqx.exe
  2⤵
  PID:13396
- C:\Windows\System\qJQGrVb.exe
  C:\Windows\System\qJQGrVb.exe
  2⤵
  PID:13416
- C:\Windows\System\fwGPMAR.exe
  C:\Windows\System\fwGPMAR.exe
  2⤵
  PID:13436
- C:\Windows\System\vuXkAnD.exe
  C:\Windows\System\vuXkAnD.exe
  2⤵
  PID:13464
- C:\Windows\System\opUwtPC.exe
  C:\Windows\System\opUwtPC.exe
  2⤵
  PID:13488
- C:\Windows\System\ZtQtbrY.exe
  C:\Windows\System\ZtQtbrY.exe
  2⤵
  PID:13520
- C:\Windows\System\WZIytuv.exe
  C:\Windows\System\WZIytuv.exe
  2⤵
  PID:13536
- C:\Windows\System\HEKHbyn.exe
  C:\Windows\System\HEKHbyn.exe
  2⤵
  PID:13564
- C:\Windows\System\SYJiWMF.exe
  C:\Windows\System\SYJiWMF.exe
  2⤵
  PID:13584
- C:\Windows\System\kwWJSvH.exe
  C:\Windows\System\kwWJSvH.exe
  2⤵
  PID:13612
- C:\Windows\System\sWtZzBS.exe
  C:\Windows\System\sWtZzBS.exe
  2⤵
  PID:13640
- C:\Windows\System\FLRWQlh.exe
  C:\Windows\System\FLRWQlh.exe
  2⤵
  PID:13664
- C:\Windows\System\mxUxzIY.exe
  C:\Windows\System\mxUxzIY.exe
  2⤵
  PID:13684
- C:\Windows\System\qRCJpHP.exe
  C:\Windows\System\qRCJpHP.exe
  2⤵
  PID:13708
- C:\Windows\System\pXTwxcG.exe
  C:\Windows\System\pXTwxcG.exe
  2⤵
  PID:13732
- C:\Windows\System\PBlGhDB.exe
  C:\Windows\System\PBlGhDB.exe
  2⤵
  PID:13760
- C:\Windows\System\xKRnGsh.exe
  C:\Windows\System\xKRnGsh.exe
  2⤵
  PID:13776
- C:\Windows\System\NkHNLpn.exe
  C:\Windows\System\NkHNLpn.exe
  2⤵
  PID:13804
- C:\Windows\System\dApcQEL.exe
  C:\Windows\System\dApcQEL.exe
  2⤵
  PID:13832
- C:\Windows\System\cbabuEG.exe
  C:\Windows\System\cbabuEG.exe
  2⤵
  PID:13848
- C:\Windows\System\WAzhJrt.exe
  C:\Windows\System\WAzhJrt.exe
  2⤵
  PID:13868
- C:\Windows\System\pRPgmUe.exe
  C:\Windows\System\pRPgmUe.exe
  2⤵
  PID:13888
- C:\Windows\System\MAUHnNc.exe
  C:\Windows\System\MAUHnNc.exe
  2⤵
  PID:13908
- C:\Windows\System\HPLGGdT.exe
  C:\Windows\System\HPLGGdT.exe
  2⤵
  PID:13928
- C:\Windows\System\elPqQJr.exe
  C:\Windows\System\elPqQJr.exe
  2⤵
  PID:13948
- C:\Windows\System\mCqfBFW.exe
  C:\Windows\System\mCqfBFW.exe
  2⤵
  PID:13968
- C:\Windows\System\IWZOCvG.exe
  C:\Windows\System\IWZOCvG.exe
  2⤵
  PID:13992
- C:\Windows\System\lCsrDCp.exe
  C:\Windows\System\lCsrDCp.exe
  2⤵
  PID:14016
- C:\Windows\System\mRjLiBc.exe
  C:\Windows\System\mRjLiBc.exe
  2⤵
  PID:14036
- C:\Windows\System\ZBUOqYn.exe
  C:\Windows\System\ZBUOqYn.exe
  2⤵
  PID:14060
- C:\Windows\System\CGSYcQR.exe
  C:\Windows\System\CGSYcQR.exe
  2⤵
  PID:14076
- C:\Windows\System\lcHdbEy.exe
  C:\Windows\System\lcHdbEy.exe
  2⤵
  PID:14104
- C:\Windows\System\IVCWSba.exe
  C:\Windows\System\IVCWSba.exe
  2⤵
  PID:14128
- C:\Windows\System\JPWNBvB.exe
  C:\Windows\System\JPWNBvB.exe
  2⤵
  PID:14152
- C:\Windows\System\rOmyRQK.exe
  C:\Windows\System\rOmyRQK.exe
  2⤵
  PID:14172
- C:\Windows\System\TNjAMRG.exe
  C:\Windows\System\TNjAMRG.exe
  2⤵
  PID:14204
- C:\Windows\System\cFuzkcZ.exe
  C:\Windows\System\cFuzkcZ.exe
  2⤵
  PID:14220
- C:\Windows\System\wtAZCkn.exe
  C:\Windows\System\wtAZCkn.exe
  2⤵
  PID:14244
- C:\Windows\System\odEUhCQ.exe
  C:\Windows\System\odEUhCQ.exe
  2⤵
  PID:14268
- C:\Windows\System\LJMedeE.exe
  C:\Windows\System\LJMedeE.exe
  2⤵
  PID:14300
- C:\Windows\System\PTgcSVI.exe
  C:\Windows\System\PTgcSVI.exe
  2⤵
  PID:14320
- C:\Windows\System\AKpMSob.exe
  C:\Windows\System\AKpMSob.exe
  2⤵
  PID:10720
- C:\Windows\System\CKMSKZX.exe
  C:\Windows\System\CKMSKZX.exe
  2⤵
  PID:10768
- C:\Windows\System\qMAAKHd.exe
  C:\Windows\System\qMAAKHd.exe
  2⤵
  PID:12960
- C:\Windows\System\bhTZvCZ.exe
  C:\Windows\System\bhTZvCZ.exe
  2⤵
  PID:11112
- C:\Windows\System\CqScESf.exe
  C:\Windows\System\CqScESf.exe
  2⤵
  PID:13028
- C:\Windows\System\clJSLDU.exe
  C:\Windows\System\clJSLDU.exe
  2⤵
  PID:11848
- C:\Windows\System\MeRIrUQ.exe
  C:\Windows\System\MeRIrUQ.exe
  2⤵
  PID:11428
- C:\Windows\System\mdEhcyF.exe
  C:\Windows\System\mdEhcyF.exe
  2⤵
  PID:10120
- C:\Windows\System\GqvMOXM.exe
  C:\Windows\System\GqvMOXM.exe
  2⤵
  PID:11788
- C:\Windows\System\IlBTYZi.exe
  C:\Windows\System\IlBTYZi.exe
  2⤵
  PID:11884
- C:\Windows\System\DaYdQaM.exe
  C:\Windows\System\DaYdQaM.exe
  2⤵
  PID:11464
- C:\Windows\System\hAefIXb.exe
  C:\Windows\System\hAefIXb.exe
  2⤵
  PID:12348
- C:\Windows\System\jVSALSK.exe
  C:\Windows\System\jVSALSK.exe
  2⤵
  PID:12396
- C:\Windows\System\XDEAXPH.exe
  C:\Windows\System\XDEAXPH.exe
  2⤵
  PID:12432
- C:\Windows\System\PdNGqkN.exe
  C:\Windows\System\PdNGqkN.exe
  2⤵
  PID:10944
- C:\Windows\System\iqYlRbI.exe
  C:\Windows\System\iqYlRbI.exe
  2⤵
  PID:11108
- C:\Windows\System\ycEhYND.exe
  C:\Windows\System\ycEhYND.exe
  2⤵
  PID:12544
- C:\Windows\System\WJWHNYu.exe
  C:\Windows\System\WJWHNYu.exe
  2⤵
  PID:12468
- C:\Windows\System\RJLKIIl.exe
  C:\Windows\System\RJLKIIl.exe
  2⤵
  PID:10572
- C:\Windows\System\nvQlmUg.exe
  C:\Windows\System\nvQlmUg.exe
  2⤵
  PID:11212
- C:\Windows\System\bALqLHE.exe
  C:\Windows\System\bALqLHE.exe
  2⤵
  PID:12716
- C:\Windows\System\VOFWaCM.exe
  C:\Windows\System\VOFWaCM.exe
  2⤵
  PID:12768
- C:\Windows\System\LBtoykJ.exe
  C:\Windows\System\LBtoykJ.exe
  2⤵
  PID:12840
- C:\Windows\System\OTnaPmS.exe
  C:\Windows\System\OTnaPmS.exe
  2⤵
  PID:12852
- C:\Windows\System\bRTWseA.exe
  C:\Windows\System\bRTWseA.exe
  2⤵
  PID:12880
- C:\Windows\System\EIlHvxR.exe
  C:\Windows\System\EIlHvxR.exe
  2⤵
  PID:13648
- C:\Windows\System\tUVKMWM.exe
  C:\Windows\System\tUVKMWM.exe
  2⤵
  PID:14348
- C:\Windows\System\liTCPqH.exe
  C:\Windows\System\liTCPqH.exe
  2⤵
  PID:14372
- C:\Windows\System\zQalUYn.exe
  C:\Windows\System\zQalUYn.exe
  2⤵
  PID:14400
- C:\Windows\System\gmoHuuP.exe
  C:\Windows\System\gmoHuuP.exe
  2⤵
  PID:14436
- C:\Windows\System\OgGoQxB.exe
  C:\Windows\System\OgGoQxB.exe
  2⤵
  PID:14456
- C:\Windows\System\tLzQmlZ.exe
  C:\Windows\System\tLzQmlZ.exe
  2⤵
  PID:14484
- C:\Windows\System\bQgAkGb.exe
  C:\Windows\System\bQgAkGb.exe
  2⤵
  PID:14504
- C:\Windows\System\PDSgrdW.exe
  C:\Windows\System\PDSgrdW.exe
  2⤵
  PID:14532
- C:\Windows\System\iZKIOWL.exe
  C:\Windows\System\iZKIOWL.exe
  2⤵
  PID:14552
- C:\Windows\System\mnvCsqx.exe
  C:\Windows\System\mnvCsqx.exe
  2⤵
  PID:14568
- C:\Windows\System\hSkNlDv.exe
  C:\Windows\System\hSkNlDv.exe
  2⤵
  PID:14592
- C:\Windows\System\ihHvJMP.exe
  C:\Windows\System\ihHvJMP.exe
  2⤵
  PID:14612
- C:\Windows\System\MVidPTs.exe
  C:\Windows\System\MVidPTs.exe
  2⤵
  PID:14640
- C:\Windows\System\VjuIaCT.exe
  C:\Windows\System\VjuIaCT.exe
  2⤵
  PID:14668
- C:\Windows\System\Ysfetjw.exe
  C:\Windows\System\Ysfetjw.exe
  2⤵
  PID:14692
- C:\Windows\System\KgipCdg.exe
  C:\Windows\System\KgipCdg.exe
  2⤵
  PID:14716
- C:\Windows\System\jqiCkPL.exe
  C:\Windows\System\jqiCkPL.exe
  2⤵
  PID:14732
- C:\Windows\System\gqzxYMh.exe
  C:\Windows\System\gqzxYMh.exe
  2⤵
  PID:14760
- C:\Windows\System\DjmXBXC.exe
  C:\Windows\System\DjmXBXC.exe
  2⤵
  PID:14788
- C:\Windows\System\KHnjWXl.exe
  C:\Windows\System\KHnjWXl.exe
  2⤵
  PID:14820
- C:\Windows\System\KhdedOg.exe
  C:\Windows\System\KhdedOg.exe
  2⤵
  PID:14836
- C:\Windows\System\YqyhYVd.exe
  C:\Windows\System\YqyhYVd.exe
  2⤵
  PID:14860
- C:\Windows\System\SIpnavF.exe
  C:\Windows\System\SIpnavF.exe
  2⤵
  PID:14892
- C:\Windows\System\qVDhIal.exe
  C:\Windows\System\qVDhIal.exe
  2⤵
  PID:14912
- C:\Windows\System\DSFYglM.exe
  C:\Windows\System\DSFYglM.exe
  2⤵
  PID:14932
- C:\Windows\System\tdjQRqy.exe
  C:\Windows\System\tdjQRqy.exe
  2⤵
  PID:14948
- C:\Windows\System\ODWYgmX.exe
  C:\Windows\System\ODWYgmX.exe
  2⤵
  PID:14972
- C:\Windows\System\nttcNYT.exe
  C:\Windows\System\nttcNYT.exe
  2⤵
  PID:14996
- C:\Windows\System\KTPxQMi.exe
  C:\Windows\System\KTPxQMi.exe
  2⤵
  PID:15020
- C:\Windows\System\fGjkLtv.exe
  C:\Windows\System\fGjkLtv.exe
  2⤵
  PID:15040
- C:\Windows\System\xweptuH.exe
  C:\Windows\System\xweptuH.exe
  2⤵
  PID:15072
- C:\Windows\System\miIRMyW.exe
  C:\Windows\System\miIRMyW.exe
  2⤵
  PID:15092
- C:\Windows\System\jufsGTC.exe
  C:\Windows\System\jufsGTC.exe
  2⤵
  PID:15116
- C:\Windows\System\zbtrqlb.exe
  C:\Windows\System\zbtrqlb.exe
  2⤵
  PID:15136
- C:\Windows\System\PPDmAvM.exe
  C:\Windows\System\PPDmAvM.exe
  2⤵
  PID:15160
- C:\Windows\System\xXRFWtA.exe
  C:\Windows\System\xXRFWtA.exe
  2⤵
  PID:15180
- C:\Windows\System\HnlUUME.exe
  C:\Windows\System\HnlUUME.exe
  2⤵
  PID:15204
- C:\Windows\System\wxdslbf.exe
  C:\Windows\System\wxdslbf.exe
  2⤵
  PID:15224
- C:\Windows\System\IhFKmXj.exe
  C:\Windows\System\IhFKmXj.exe
  2⤵
  PID:15252
- C:\Windows\System\RqWrUYl.exe
  C:\Windows\System\RqWrUYl.exe
  2⤵
  PID:15272
- C:\Windows\System\rTSaxOE.exe
  C:\Windows\System\rTSaxOE.exe
  2⤵
  PID:15296
- C:\Windows\System\bBfKuoY.exe
  C:\Windows\System\bBfKuoY.exe
  2⤵
  PID:15312
- C:\Windows\System\YTQOUTT.exe
  C:\Windows\System\YTQOUTT.exe
  2⤵
  PID:15332
- C:\Windows\System\qWYeVPU.exe
  C:\Windows\System\qWYeVPU.exe
  2⤵
  PID:15352
- C:\Windows\System\fqpulpj.exe
  C:\Windows\System\fqpulpj.exe
  2⤵
  PID:13704
- C:\Windows\System\BwgKYuQ.exe
  C:\Windows\System\BwgKYuQ.exe
  2⤵
  PID:11456
- C:\Windows\System\hcLtAqe.exe
  C:\Windows\System\hcLtAqe.exe
  2⤵
  PID:13916
- C:\Windows\System\LkCWFXf.exe
  C:\Windows\System\LkCWFXf.exe
  2⤵
  PID:13260
- C:\Windows\System\LUqmFKo.exe
  C:\Windows\System\LUqmFKo.exe
  2⤵
  PID:10508
- C:\Windows\System\yDOCSdD.exe
  C:\Windows\System\yDOCSdD.exe
  2⤵
  PID:12144
- C:\Windows\System\JBPcDhE.exe
  C:\Windows\System\JBPcDhE.exe
  2⤵
  PID:12392
- C:\Windows\System\pXzIooY.exe
  C:\Windows\System\pXzIooY.exe
  2⤵
  PID:11652
- C:\Windows\System\utoTjEo.exe
  C:\Windows\System\utoTjEo.exe
  2⤵
  PID:11252
- C:\Windows\System\kvpZggN.exe
  C:\Windows\System\kvpZggN.exe
  2⤵
  PID:11700
- C:\Windows\System\MdYDsbp.exe
  C:\Windows\System\MdYDsbp.exe
  2⤵
  PID:12492
- C:\Windows\System\QaBSNWL.exe
  C:\Windows\System\QaBSNWL.exe
  2⤵
  PID:12660
- C:\Windows\System\LKzfVxi.exe
  C:\Windows\System\LKzfVxi.exe
  2⤵
  PID:12324
- C:\Windows\System\rhdKqsQ.exe
  C:\Windows\System\rhdKqsQ.exe
  2⤵
  PID:12780
- C:\Windows\System\jmZDgWL.exe
  C:\Windows\System\jmZDgWL.exe
  2⤵
  PID:15384
- C:\Windows\System\PAGEanl.exe
  C:\Windows\System\PAGEanl.exe
  2⤵
  PID:15408
- C:\Windows\System\XIULqxl.exe
  C:\Windows\System\XIULqxl.exe
  2⤵
  PID:15424
- C:\Windows\System\YxRoJCR.exe
  C:\Windows\System\YxRoJCR.exe
  2⤵
  PID:15444
- C:\Windows\System\DsvmVYP.exe
  C:\Windows\System\DsvmVYP.exe
  2⤵
  PID:15472
- C:\Windows\System\hwWRBNa.exe
  C:\Windows\System\hwWRBNa.exe
  2⤵
  PID:15488
- C:\Windows\System\HViLuhI.exe
  C:\Windows\System\HViLuhI.exe
  2⤵
  PID:15512
- C:\Windows\System\KkpeIMg.exe
  C:\Windows\System\KkpeIMg.exe
  2⤵
  PID:15532
- C:\Windows\System\zsPzUje.exe
  C:\Windows\System\zsPzUje.exe
  2⤵
  PID:15564
- C:\Windows\System\oOhcHns.exe
  C:\Windows\System\oOhcHns.exe
  2⤵
  PID:15596
- C:\Windows\System\fYlyVZG.exe
  C:\Windows\System\fYlyVZG.exe
  2⤵
  PID:15620
- C:\Windows\System\gZWajPy.exe
  C:\Windows\System\gZWajPy.exe
  2⤵
  PID:15640
- C:\Windows\System\YevImtC.exe
  C:\Windows\System\YevImtC.exe
  2⤵
  PID:15656
- C:\Windows\System\zgZezwt.exe
  C:\Windows\System\zgZezwt.exe
  2⤵
  PID:15676
- C:\Windows\System\LqAipjr.exe
  C:\Windows\System\LqAipjr.exe
  2⤵
  PID:15692
- C:\Windows\System\DZEpBfr.exe
  C:\Windows\System\DZEpBfr.exe
  2⤵
  PID:15708
- C:\Windows\System\uLhvJCg.exe
  C:\Windows\System\uLhvJCg.exe
  2⤵
  PID:15736
- C:\Windows\System\LyIthIC.exe
  C:\Windows\System\LyIthIC.exe
  2⤵
  PID:15764
- C:\Windows\System\CZJCQOX.exe
  C:\Windows\System\CZJCQOX.exe
  2⤵
  PID:15792
- C:\Windows\System\YDepvYL.exe
  C:\Windows\System\YDepvYL.exe
  2⤵
  PID:15816
- C:\Windows\System\Tiwvktq.exe
  C:\Windows\System\Tiwvktq.exe
  2⤵
  PID:15844
- C:\Windows\System\gjSTiMm.exe
  C:\Windows\System\gjSTiMm.exe
  2⤵
  PID:15868
- C:\Windows\System\NEadYcD.exe
  C:\Windows\System\NEadYcD.exe
  2⤵
  PID:15888
- C:\Windows\System\cdazGUN.exe
  C:\Windows\System\cdazGUN.exe
  2⤵
  PID:15912
- C:\Windows\System\GxsEvZx.exe
  C:\Windows\System\GxsEvZx.exe
  2⤵
  PID:14116
- C:\Windows\System\sUynvqo.exe
  C:\Windows\System\sUynvqo.exe
  2⤵
  PID:15036
- C:\Windows\System\SsBsHGq.exe
  C:\Windows\System\SsBsHGq.exe
  2⤵
  PID:15080
- C:\Windows\System\InoLePR.exe
  C:\Windows\System\InoLePR.exe
  2⤵
  PID:14240
- C:\Windows\System\aAnWpia.exe
  C:\Windows\System\aAnWpia.exe
  2⤵
  PID:15240
- C:\Windows\System\JRgWWHp.exe
  C:\Windows\System\JRgWWHp.exe
  2⤵
  PID:15268
- C:\Windows\System\xBSBrli.exe
  C:\Windows\System\xBSBrli.exe
  2⤵
  PID:10344
- C:\Windows\System\dFOZXhD.exe
  C:\Windows\System\dFOZXhD.exe
  2⤵
  PID:13056
- C:\Windows\System\xankRnm.exe
  C:\Windows\System\xankRnm.exe
  2⤵
  PID:12636
- C:\Windows\System\PTAdEli.exe
  C:\Windows\System\PTAdEli.exe
  2⤵
  PID:13356
- C:\Windows\System\kGhOEzy.exe
  C:\Windows\System\kGhOEzy.exe
  2⤵
  PID:11576
- C:\Windows\System\tJYmRsX.exe
  C:\Windows\System\tJYmRsX.exe
  2⤵
  PID:12496
- C:\Windows\System\QVeFELv.exe
  C:\Windows\System\QVeFELv.exe
  2⤵
  PID:12512
- C:\Windows\System\yHAmFnf.exe
  C:\Windows\System\yHAmFnf.exe
  2⤵
  PID:10828
- C:\Windows\System\qXjnaPI.exe
  C:\Windows\System\qXjnaPI.exe
  2⤵
  PID:12184
- C:\Windows\System\yBOhOko.exe
  C:\Windows\System\yBOhOko.exe
  2⤵
  PID:15436
- C:\Windows\System\btlAiud.exe
  C:\Windows\System\btlAiud.exe
  2⤵
  PID:13592
- C:\Windows\System\xsNyZgK.exe
  C:\Windows\System\xsNyZgK.exe
  2⤵
  PID:13636
- C:\Windows\System\YCJXekH.exe
  C:\Windows\System\YCJXekH.exe
  2⤵
  PID:15484
- C:\Windows\System\NKJAtJr.exe
  C:\Windows\System\NKJAtJr.exe
  2⤵
  PID:14344
- C:\Windows\System\TCVPvTx.exe
  C:\Windows\System\TCVPvTx.exe
  2⤵
  PID:15576
- C:\Windows\System\WGChBKG.exe
  C:\Windows\System\WGChBKG.exe
  2⤵
  PID:14424
- C:\Windows\System\vGfEMqm.exe
  C:\Windows\System\vGfEMqm.exe
  2⤵
  PID:15608
- C:\Windows\System\ZqlZgXE.exe
  C:\Windows\System\ZqlZgXE.exe
  2⤵
  PID:15632
- C:\Windows\System\TxzXUDU.exe
  C:\Windows\System\TxzXUDU.exe
  2⤵
  PID:14564
- C:\Windows\System\MzIyAHW.exe
  C:\Windows\System\MzIyAHW.exe
  2⤵
  PID:14576
- C:\Windows\System\QDbKtuH.exe
  C:\Windows\System\QDbKtuH.exe
  2⤵
  PID:15836
- C:\Windows\System\wxszyCB.exe
  C:\Windows\System\wxszyCB.exe
  2⤵
  PID:15876
- C:\Windows\System\vwIRsPV.exe
  C:\Windows\System\vwIRsPV.exe
  2⤵
  PID:15904
- C:\Windows\System\fFILxIh.exe
  C:\Windows\System\fFILxIh.exe
  2⤵
  PID:14704
- C:\Windows\System\fdkPmTP.exe
  C:\Windows\System\fdkPmTP.exe
  2⤵
  PID:14728
- C:\Windows\System\QKwnMCo.exe
  C:\Windows\System\QKwnMCo.exe
  2⤵
  PID:15944
- C:\Windows\System\YqyeSOt.exe
  C:\Windows\System\YqyeSOt.exe
  2⤵
  PID:14920
- C:\Windows\System\GuDcldo.exe
  C:\Windows\System\GuDcldo.exe
  2⤵
  PID:15052
- C:\Windows\System\GKJKPPk.exe
  C:\Windows\System\GKJKPPk.exe
  2⤵
  PID:15292
- C:\Windows\System\eyVRkdI.exe
  C:\Windows\System\eyVRkdI.exe
  2⤵
  PID:12292
- C:\Windows\System\QpNwlON.exe
  C:\Windows\System\QpNwlON.exe
  2⤵
  PID:9308
- C:\Windows\System\swLkjfN.exe
  C:\Windows\System\swLkjfN.exe
  2⤵
  PID:14384
- C:\Windows\System\sekDYTA.exe
  C:\Windows\System\sekDYTA.exe
  2⤵
  PID:12868
- C:\Windows\System\ospBCSE.exe
  C:\Windows\System\ospBCSE.exe
  2⤵
  PID:15808
- C:\Windows\System\sJJGtIb.exe
  C:\Windows\System\sJJGtIb.exe
  2⤵
  PID:14812
- C:\Windows\System\RlruTkX.exe
  C:\Windows\System\RlruTkX.exe
  2⤵
  PID:16000
- C:\Windows\System\oABfOdB.exe
  C:\Windows\System\oABfOdB.exe
  2⤵
  PID:15112
- C:\Windows\System\WeSqEvG.exe
  C:\Windows\System\WeSqEvG.exe
  2⤵
  PID:15132
- C:\Windows\System\yyHlgyE.exe
  C:\Windows\System\yyHlgyE.exe
  2⤵
  PID:15188
- C:\Windows\System\cOyEqDa.exe
  C:\Windows\System\cOyEqDa.exe
  2⤵
  PID:15220
- C:\Windows\System\owYwARZ.exe
  C:\Windows\System\owYwARZ.exe
  2⤵
  PID:12992
- C:\Windows\System\QaKvYtW.exe
  C:\Windows\System\QaKvYtW.exe
  2⤵
  PID:13192
- C:\Windows\System\zhRenhR.exe
  C:\Windows\System\zhRenhR.exe
  2⤵
  PID:13984
- C:\Windows\System\oFhIiEv.exe
  C:\Windows\System\oFhIiEv.exe
  2⤵
  PID:14308
- C:\Windows\System\QSWrNNU.exe
  C:\Windows\System\QSWrNNU.exe
  2⤵
  PID:12532
- C:\Windows\System\ihcglSW.exe
  C:\Windows\System\ihcglSW.exe
  2⤵
  PID:15400
- C:\Windows\System\FKFXeFD.exe
  C:\Windows\System\FKFXeFD.exe
  2⤵
  PID:15524
- C:\Windows\System\cmalZlI.exe
  C:\Windows\System\cmalZlI.exe
  2⤵
  PID:15668
- C:\Windows\System\zupgJCF.exe
  C:\Windows\System\zupgJCF.exe
  2⤵
  PID:15704
- C:\Windows\System\hQzFYGc.exe
  C:\Windows\System\hQzFYGc.exe
  2⤵
  PID:15176
- C:\Windows\System\bFjCIrI.exe
  C:\Windows\System\bFjCIrI.exe
  2⤵
  PID:11952
- C:\Windows\System\OZKDrtQ.exe
  C:\Windows\System\OZKDrtQ.exe
  2⤵
  PID:16396
- C:\Windows\System\RuiNpQT.exe
  C:\Windows\System\RuiNpQT.exe
  2⤵
  PID:16412
- C:\Windows\System\CBKltnC.exe
  C:\Windows\System\CBKltnC.exe
  2⤵
  PID:16444
- C:\Windows\System\BUZXkAT.exe
  C:\Windows\System\BUZXkAT.exe
  2⤵
  PID:16464
- C:\Windows\System\nEYzKus.exe
  C:\Windows\System\nEYzKus.exe
  2⤵
  PID:16480
- C:\Windows\System\lwiYIVF.exe
  C:\Windows\System\lwiYIVF.exe
  2⤵
  PID:16504
- C:\Windows\System\wFbSnuq.exe
  C:\Windows\System\wFbSnuq.exe
  2⤵
  PID:16524
- C:\Windows\System\aAMrHlM.exe
  C:\Windows\System\aAMrHlM.exe
  2⤵
  PID:16544
- C:\Windows\System\goeyRBR.exe
  C:\Windows\System\goeyRBR.exe
  2⤵
  PID:16564
- C:\Windows\System\LvToBMX.exe
  C:\Windows\System\LvToBMX.exe
  2⤵
  PID:16584
- C:\Windows\System\TqLAowL.exe
  C:\Windows\System\TqLAowL.exe
  2⤵
  PID:16608
- C:\Windows\System\wYWVNsW.exe
  C:\Windows\System\wYWVNsW.exe
  2⤵
  PID:16648
- C:\Windows\System\OxaMWrQ.exe
  C:\Windows\System\OxaMWrQ.exe
  2⤵
  PID:16672
- C:\Windows\System\hOGxyNi.exe
  C:\Windows\System\hOGxyNi.exe
  2⤵
  PID:16696
- C:\Windows\System\DGeNcTF.exe
  C:\Windows\System\DGeNcTF.exe
  2⤵
  PID:16736
- C:\Windows\System\ttSyNBG.exe
  C:\Windows\System\ttSyNBG.exe
  2⤵
  PID:16776
- C:\Windows\System\WrQwgHY.exe
  C:\Windows\System\WrQwgHY.exe
  2⤵
  PID:16812
- C:\Windows\System\ofwdroL.exe
  C:\Windows\System\ofwdroL.exe
  2⤵
  PID:16832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BIkrICy.exe

Filesize
1.4MB

MD5
2296f5b9b4b0fd2844f371b5d04c643d

SHA1
7cbcdad3b23ad6bc94087e76bfadbd9e4de97808

SHA256
3ddc41678eeb5356473fb0eb456263cb5380657b8324f301b4174f0bb84cccce

SHA512
e1379397ea03a39aa40bb61ef19e8067d269d0b001c7edb428429952d4ff5481033d0faaac0f8c05c82c48ee20e8d4d2aa737f929f09eb8838327f0d9a493a70

Download Submit
C:\Windows\System\IuKbQeU.exe

Filesize
1.4MB

MD5
e5465807af556e67984cb7068933e80e

SHA1
cd6b1596f1d1999dd6cdba25467274ea36073fba

SHA256
a0be068b955110df34ac0291c7b8df827e7683a5ed97c5c3d36aa43ea319175c

SHA512
77aeb84ca23bc5f47d07d128c68d713c77b58df06e43404525c2337750090b41d40b07ddfdf08d46acc1b0a70fa0ee51c5853bc927af2382259934d0bed6b34d

Download Submit
C:\Windows\System\KgriTKi.exe

Filesize
1.4MB

MD5
7b422807e6c549ffd48638e4c2a48997

SHA1
90471a4cc503a79132ab497e563339dc5d0f648a

SHA256
8b7898054f608823ab561a9edebf1ac5662ae585fd217999418663948496e746

SHA512
57bf0f63cf94f67373cfac4a05818321d222d6521e4bd88411fa1e330923ed8f24bdb878e339f8eca5c28f406628c29e82eb65431a83d7bcc33369caca02bd5a

Download Submit
C:\Windows\System\KxtgNQT.exe

Filesize
1.4MB

MD5
cf26e7b3aa20f65587e6927cf840e27e

SHA1
a86172f8460de310dee05616bc504c416edba54c

SHA256
a816df6ce71ed06c16f85f2dd399f95aa622048d4ba9ca70ad86dd12a0718f45

SHA512
76d50be22c0a429a7dd81237d64469f7d4291a73054e575b6257521845176877d7bfcd7fa1a9dcaba058d99f7e2948c3ea8e6bb77d06da72a459a04631e0cc6b

Download Submit
C:\Windows\System\LvsEBRX.exe

Filesize
1.4MB

MD5
b0fdfe4e923b4cc4cab69d93a5881741

SHA1
447d538060a0c4314b03b6a3f65e1ac6d2816746

SHA256
c0856f9c14e6b9a5a88a4868e89e2c290fdd3c25d07bc43d37e547d66638a238

SHA512
5948e03daa05fc870ff8bc3f3e4c851721fc5d4dbcd88e9521b060a1f912ef009517daae90ab6cfdd9d6ff2ae304a51ac4571b32f63fd3a439355761847d51c5

Download Submit
C:\Windows\System\LxBPsfb.exe

Filesize
1.4MB

MD5
d9f63cfe7ba84ecf56fb9b618352e71c

SHA1
120cba18c110b41ee074ce4d4b6eafed72dc9d76

SHA256
a064feea7824c12c35ba63521f74b3aa517413bd7a5d73eb7d8d76ef26dc2d13

SHA512
35714313b53750d7426fec9e4aa753da44c4a72d35811ca9ceee2ba32ca83b09b0d7b3776e2c72b4909a2b2d2a6bf56724bf1f3a88062174f1c876fa9dc8b238

Download Submit
C:\Windows\System\NgfQibp.exe

Filesize
1.4MB

MD5
ca831b91e42da0cbfe39dc56ddfae305

SHA1
f8425d03b936ed081ad9cafd2dfd0703480dc45e

SHA256
9686effe7e2bc61c9ead22883000777cf042a0d0001136d85bd63930ddd3c108

SHA512
5d1ee57b764a2ca9328a32e99505545944dac2b7d3434d38f7fe5c3ca609daed4ec06d7a60f40b6139b94092119dbfcbe4ff04206d77d8474cc61a2cdec244cc

Download Submit
C:\Windows\System\NiOoaTH.exe

Filesize
1.4MB

MD5
641d1f6fba2a2cdce1dbe48f53719801

SHA1
0b76e901c422f437889ee09788e5730f488d0d43

SHA256
4e4ad6802424be78ea4d0172249ff2f532bc524ea2c47e293838e5e8af514a9d

SHA512
77a36657d25b8101c2a3f9d4702c820042088aaba5add42af5fbe06fd1620e47c8d663931a9af1c7c67a20c90b5e9e399d26e12881fba66295b718c3610ca7c1

Download Submit
C:\Windows\System\RvEUWmO.exe

Filesize
1.4MB

MD5
e9f9bc13cca2841aa814d4d19071a431

SHA1
7c01a647b8484c9b8d79579f8316ce4e23efc1f6

SHA256
cd21a7bc20cae4d951c02695d1bef6a1b0dac16c61dce69cf355e982868ed3ed

SHA512
aca4024b26e763738be9fbc58f6948a868a296d418db08c984161cbf8bd1a20d7c125d0b12972da851d67fdc1b7f63ee5388362b268d15ec8ac27113d3c54f2f

Download Submit
C:\Windows\System\SPRhats.exe

Filesize
1.4MB

MD5
45dfcab675d0b3c53fb8f73ddd2845cb

SHA1
cfe6aecb417716e32dc2c8f5ed7c850645a210da

SHA256
24f2cfce7d0ffd21e9c00ce75b8c084f51e28583985b61eaf2eaff126e6eb11a

SHA512
d71be6b9dd953b73daeb521dc61485810a04911f7e82b656d0cb9b408e6cb47e32ffa217a230f97e6521767bce30d125dd53c140b1d33cfccb81788c314f935d

Download Submit
C:\Windows\System\TaUcNUQ.exe

Filesize
1.4MB

MD5
c9ab58cfafafcb12769deeae38e6f816

SHA1
16ae120b270f5b46d73c0b74e5a3e3a2e88f7998

SHA256
1ed43acbfa7cceac895208bbef82105949718715ca5387069d51328d3966f283

SHA512
26189466ec8926e2e8433663b3f47bb13d1a1a1ca881c14cc6902484696a269be2ad24d8da9c6cfa0de1bfc32dbda0f3540b6d113237700e5aceafdb6646f399

Download Submit
C:\Windows\System\TlguomM.exe

Filesize
1.4MB

MD5
dcacbb7246caa70550fab41ced7e19d0

SHA1
bc516f738d594eede92acd5d2e1904913bf6973b

SHA256
1ae572ece8cbf95e8b89c70d5eb1d3e3ec56ad7d909eed979f745f99c9055da3

SHA512
fb9bbc71002eeec54d8f6de94bce08f59baf940f0df25419de6441de34e4ec2c4cd8b0855d82c609f42cbdb106901d66655bab5ce5336bc36292ba872a292cd3

Download Submit
C:\Windows\System\UHckhRR.exe

Filesize
1.4MB

MD5
eb6fd91c19d8eaac5890ac71f1eedc49

SHA1
63e5755deb3e0b6c9b91011599b97d77d994b9fe

SHA256
09efbae6ee5716d58f5d855ed90d35cc516bcab69d354739b635c9a27af8e57f

SHA512
b2a311353264f3d8336dc2f9a0e4dc685ce082e50326828fd0a2a652807ec42d6a5593fca1c42fff09e4690e434b302db680f4f634044abed158043be8d79d34

Download Submit
C:\Windows\System\XRNRcbM.exe

Filesize
1.4MB

MD5
238b3ca28a1163cd921140dfff611db4

SHA1
cb84190b057d2091ad83658d269784683721106b

SHA256
8c8fb9d48be7b89501a2a69a4a6686d627a67e8a7599f92018e02166456068f8

SHA512
7057788f39bd9b2df90d8d1ebf509db8a6f2c85c1f1d15f61b72913bede6690782907305c65b90239eeb8fd6d104c75aeafd40c30cd618bb7e4af8a03a34bab2

Download Submit
C:\Windows\System\YpttvoB.exe

Filesize
1.4MB

MD5
bf7c77227f8b0e3e9334e1cbc4c0b730

SHA1
522bffdf06c75827d8752fda143faf6f685a2cf6

SHA256
a9b70bd09972b1eff114b300a131f796383c798c6af8212d931ed95104d21b30

SHA512
f21f8e54237e143a4f7741a8010ab12424781369d370fb86205225f5e2924c80526dcd201dce00aa05738cbb2bbbfb5efdcacbf6d471ecc87c73f6e799441141

Download Submit
C:\Windows\System\aaOWlKQ.exe

Filesize
1.4MB

MD5
38b6f0bac176f479b4537eef6c98f2d2

SHA1
67e1db7b6b22f98d1b0cd031063dd3a52ae4d85a

SHA256
e88c1ea1d138b6c272049bf44252119153d63519738e54218d2bfea75508e26c

SHA512
a38ef92a306cc8679288fcb770857d0fb6b51b44ec851400a7ab5ba4e448ef56ed8fe754c5723b71e4c7b3c6e0b36ffeb38112b0de9c16fd16dad9fe9645723f

Download Submit
C:\Windows\System\cGLYZna.exe

Filesize
1.4MB

MD5
825e718e42b3a56d42c0b006b96f5b06

SHA1
fcf93a0ed2a277a308c00589e4ad1a4f431ee079

SHA256
8458a2a53a6e1d3080880a426f6b8a8e160549edd604666fdebed59d1f93d3b7

SHA512
26af489740c3b6941f0288b9998eb6ca425d5d8b8c2d4ab83f75299c8b48fe9287fd5aec660fc8597e9f1fc38344abb7dab65213fcd30e5626fb40047a9cbe38

Download Submit
C:\Windows\System\cYhEigM.exe

Filesize
1.4MB

MD5
80db01c11b2b54840c40d932a80738de

SHA1
ef77838ec84c5b231374bd2996156b380f4e9c5a

SHA256
93c351af3aebb0536a0df00613b0cac878d782d266845561daa61b3438a1afce

SHA512
5e4d44cec47951b6b0d5a435017179b220513b9a837c067ee887de6c297bb91f7c3374ae06621b13f3cdaf9aaaf110b2cf601f4af983f762fb30b7c421f2cfa1

Download Submit
C:\Windows\System\dIILiwr.exe

Filesize
1.4MB

MD5
4598d8227608ce36e8f2111718b6947b

SHA1
02e6dfcda234ca0a1f9de2af2fb64ed6fb49c5f4

SHA256
04a5bb3467484461be4f6c30d3e1a9aade0304b39779213e458fdb1dd0be4246

SHA512
f8752df738ad3a647d4f2237f9b9bdeec1f588fb96d2cae3f1298de691e2a365a03c3f26291aa30d5ac7f39ba43a8d48d39c9fc65076c98848857098bcf7fb8f

Download Submit
C:\Windows\System\dRiGzeO.exe

Filesize
1.4MB

MD5
ebdeba5ef98c63fb535181d320918c7a

SHA1
aa46e13db5935a100db5bdd1f6fb0f82befde224

SHA256
49d11a14a4bfc760641508672ab362466271a1349064a64dfb38115ea4d2ff85

SHA512
667213a710d4085db0778b33b2c1821a3e6f3ea21a09e8782c2181874651a774268b40138fa7fb097252ad82065438136cd2bb9a3be15c25a0c69869fd58c5b8

Download Submit
C:\Windows\System\disBxwt.exe

Filesize
1.4MB

MD5
fbaf21c12c19d30c854ad87c36372141

SHA1
a152027de81ec026dc3162bca14613e1d77e9dc6

SHA256
5294a449304c499e9c5666fa5916bb7c04df0b3ec45035b13385900799249b52

SHA512
a1392c3397821ba8ae2caa7747598b888b50af45012cc8a3e20a2055ecadb3552622f4f20ad04df0db870f454612188457bf7db771f91a5045f2197a9959a0ef

Download Submit
C:\Windows\System\fctrLsO.exe

Filesize
1.4MB

MD5
bc07bb723ed2ece1b999f5e9e6bb0514

SHA1
c414c9af1837f02fe665130a2bc93917a1c60f4d

SHA256
44095954cdaf7c2bb9704fef521374eb20e337c3f17b885adc8fe6cf772d1a4b

SHA512
e559fde79926598c5f6a298c41c4e26fe052a103cf14b220cb9d0b769b3bfebdc163246cdb235d7ca83e51d6f3c2adc5bff30cf052e2c5d65c65fd03a31665d3

Download Submit
C:\Windows\System\iSnGERG.exe

Filesize
1.4MB

MD5
1c302d762e7afebf16225e814c15a24f

SHA1
51465eca176a1c47d115ea83025cc34c23ca4deb

SHA256
dc927bd942cd3507af66a9488c726ceb4be0ff63c721fdfaa46dbd6dd832fe77

SHA512
5bcddf70896aa948f35a96f55a0b221cd7d654fffb43790c2a20676b3a3793a47f0689660299d4506ec5cd18483107b4bdc49ff076ea9a40c0e0a4af599101a1

Download Submit
C:\Windows\System\jDbmkKi.exe

Filesize
1.4MB

MD5
3ebd5e77b2ce106c16b359fc440640d7

SHA1
9c9c8cac8119366166ad0b9df0d3f4f995f2b7a6

SHA256
d630f1f24a9dede8ba85b620d9472d90bcbbbfec9024ab724c3706756f181765

SHA512
ffa8ddcff5779bf3e4c6f677a6755d5497062b18536f1fd97fc74f9e92a8e383ea594f427c771337e6486c0a56ad5e01cd50747f158d204d8f7b29cbeac1fef2

Download Submit
C:\Windows\System\jTtOnHa.exe

Filesize
1.4MB

MD5
40eb8045ee0730d987fdbcf4fe9f2c47

SHA1
ab416f9b7f5774ec5fd23025059b870be1d6218b

SHA256
161b51baf20476caae1f40edd7828591ae1302eeb91a88e988f0e381ae6033e5

SHA512
61fcbf51d993ec47be1e59d54d34b27b8f3dec3e56db53230b1d0ca88d7edaf807f2d7db3f7b80aa8f91993bac85c33c037ded6f32627cc5806e105784a52d10

Download Submit
C:\Windows\System\nSHHYDz.exe

Filesize
1.4MB

MD5
448608c42f07950b5ff42a4531d713a6

SHA1
efec49a092fc80fe9eb9cad02c46bdb5ed1d5119

SHA256
9c14e519fce33e166a7e83915cc8fc5041e9ff596c19a89669f4be52d9100460

SHA512
45b2d9caf343f40029105f91ee9b9254f018d29d9a64e6eb9ea27238383edc0949f56c5a6e7e5ad747e579eb9d95b2b0a510071d6c186b22718993d25077d615

Download Submit
C:\Windows\System\rbuseRi.exe

Filesize
1.4MB

MD5
5ca77089bce0688df28f7abc7331a907

SHA1
29726cf6341583477736571304a063f10dc097db

SHA256
8b45344448d102c64f81195da44797b4b5fdc2a30f16f334da618fff274fe6de

SHA512
83dc345880ef86321781a8cc24fd82c4b5d0a9a2fe7c8ac334679319e00743f4d8ab9f1cf95946e1901fb76b0c782934cc269d6c066d7d4bdfa4578298ef6e95

Download Submit
C:\Windows\System\sjUQsOM.exe

Filesize
1.4MB

MD5
ba7cb9c6b237f034257a223054132804

SHA1
c301b969b909b07293207c82458f5793289deee1

SHA256
4887acfb297ecdfad6c7a9df96be0846a5592595b90e34d5e25c2c700835e30c

SHA512
5412d48d771eefae326ae798501933b240e8fe35292e70488d6a8b0c60cd60f8017742b4c773398ae9ee39f8fe1f30b4613e2f575bece60dec74b737d7cc338f

Download Submit
C:\Windows\System\tOEzIOy.exe

Filesize
1.4MB

MD5
ac020a760f8a3f3077136c299fb9032f

SHA1
aac6ead1694f76c3552cdc531b6ad42a893a22da

SHA256
395e66e9590770c8ee05869f235be2097d5f7e4b83d9ff8d0838ed032705f220

SHA512
5e9ad302fb5e8d06cba871be1d9daaa63e418997823e8556d5fa21190e02ba3dbf9ce3380d204fe691aa4a67a89a87d9b4cfa36c993ddb8c1f8a0a21e82e6d85

Download Submit
C:\Windows\System\tpNjRYL.exe

Filesize
1.4MB

MD5
a7d75e2bbb2f92a3483a31d3bc268e32

SHA1
0bc2eac567bb7f22ee6d35354ca989b63a1d398e

SHA256
a345cb642732cc2bea39ced041a797942b1d643495f3912a74522c3d412fb93c

SHA512
c5fed57ea016960c62aa05f41dde957c7d2b8f24a452cd2b3b9663fc17a1a0641c14b8f6128b81017cbe6e06549352f9e86bb0df6e18dd5e9b5360e665a6935b

Download Submit
C:\Windows\System\ucpXVLG.exe

Filesize
1.4MB

MD5
b8fabd7d000bc4aa2c257dc6cb91ff88

SHA1
3b2fe2b4878ad8e6a704d1065f4d40d43ac8eb86

SHA256
ea3f44e846b6a405ae0509e0ecf52e9726b228f9e23e464b7b46c692487a61e1

SHA512
a5291214af1d3312f62a3c0e58ae72845c9820d071918feffcf44fc391d53b5cc4abd1b252d37435dd2e026bc38d8c685b13ecf41beb79d0849134b6604d6fb9

Download Submit
C:\Windows\System\udeEHcj.exe

Filesize
1.4MB

MD5
ca2d6f99f2b34e8ebad807ccb6f70c58

SHA1
1ac0d2c8560d5c0839acd36b429d98991e1cd9cf

SHA256
debb313c962af30fdc60753740cfaaa5251b067139b5e07bc198495f68d12687

SHA512
8fcd8df900a071a150500ea99d33e27b00e577ea6bd0ee7f5934adb4edb5de4231c516a19a1ac9f3a14155d62124a34fd574501d29affe7c4fc94501f89a5fa3

Download Submit
C:\Windows\System\vUpiANH.exe

Filesize
1.4MB

MD5
061920018758624c5cd744670b9be7fa

SHA1
1f744855ede4d18f3460e5023af8e6ca804a0529

SHA256
77694664ae510749164bf885ac2f7133a2ff9164643a16c3fdd58235cbd05bd4

SHA512
3556aa592ac32423616de089f9c9570a7ab201ed8b4ad98fb3604be2306c30d2e475a0121dd85b80e1cdef97f3aee818ac5a3e45d7b74efb55cd71d6ee4dee14

Download Submit
C:\Windows\System\wJEgpXb.exe

Filesize
1.4MB

MD5
d8ec97e5de53930aeb723ffad5d3460f

SHA1
11ffe3d1536557dd2e32f802b4e9a114421f2faf

SHA256
8ddf397430961bf9d4e425cd0577984f20b552424048849889a25132d59ae32a

SHA512
dca1f509fc38c83e3a7a1eadd566cfd8239a8601da3d9fa232b386b1a9d3f447d979633ba4102531740de30424f8f15ac2dc432f5ff8247ff1f7c0620f26ee0e

Download Submit
C:\Windows\System\wYdFQmY.exe

Filesize
1.4MB

MD5
becdfb9618e7729e95223c5e52086912

SHA1
de8b3bc144c22f629dbe95479e25bcdb3546359e

SHA256
1650010469cb5bf4ddf363618a7bc689fca8617778e59213e5f9cfeba022e7f4

SHA512
ccee4e7161214b49c6156c9bbaaf6889f402fda744a638565eb4b09bd839bbae1e0bf8f1564ac5d19b2a81ee1098e9db7715788d28ae6278bfcfed002dc2acdf

Download Submit
memory/3304-0-0x0000017452880000-0x0000017452890000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads