xmrig | 2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768

Analysis

max time kernel
120s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
Size

1.8MB
MD5

6c226c1527195a3695652b42c0d213d0
SHA1

20e26a9a189bae06e6af22b44589d43d84c56802
SHA256

2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768
SHA512

f1aea74a155836e4ded8387d59ae64cd14932be13a3f60cc89115d094a530e57d645c8155336ba0a8070ef57c90abd7dfaccad299e3c0787f0053806ea41651f
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLvitT:GemTLkNdfE0pZyP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b0e-4.dat	xmrig
behavioral2/files/0x000a000000023b6e-7.dat	xmrig
behavioral2/files/0x000e000000023b6a-9.dat	xmrig
behavioral2/files/0x0031000000023b71-29.dat	xmrig
behavioral2/files/0x000a000000023b73-36.dat	xmrig
behavioral2/files/0x0031000000023b72-35.dat	xmrig
behavioral2/files/0x0031000000023b70-31.dat	xmrig
behavioral2/files/0x000a000000023b6f-22.dat	xmrig
behavioral2/files/0x000a000000023b74-44.dat	xmrig
behavioral2/files/0x000b000000023b6b-51.dat	xmrig
behavioral2/files/0x000a000000023b76-57.dat	xmrig
behavioral2/files/0x000a000000023b77-61.dat	xmrig
behavioral2/files/0x000a000000023b78-70.dat	xmrig
behavioral2/files/0x000a000000023b75-52.dat	xmrig
behavioral2/files/0x000a000000023b7a-79.dat	xmrig
behavioral2/files/0x000a000000023b7b-86.dat	xmrig
behavioral2/files/0x000a000000023b7c-87.dat	xmrig
behavioral2/files/0x000a000000023b7e-94.dat	xmrig
behavioral2/files/0x000a000000023b7f-99.dat	xmrig
behavioral2/files/0x000a000000023b80-108.dat	xmrig
behavioral2/files/0x000a000000023b81-118.dat	xmrig
behavioral2/files/0x000a000000023b82-120.dat	xmrig
behavioral2/files/0x000a000000023b8a-153.dat	xmrig
behavioral2/files/0x000a000000023b8f-173.dat	xmrig
behavioral2/files/0x000a000000023b8e-172.dat	xmrig
behavioral2/files/0x000a000000023b87-169.dat	xmrig
behavioral2/files/0x000a000000023b86-165.dat	xmrig
behavioral2/files/0x000a000000023b85-162.dat	xmrig
behavioral2/files/0x000a000000023b8c-159.dat	xmrig
behavioral2/files/0x000a000000023b8b-156.dat	xmrig
behavioral2/files/0x000a000000023b84-149.dat	xmrig
behavioral2/files/0x000a000000023b83-143.dat	xmrig
behavioral2/files/0x000a000000023b89-150.dat	xmrig
behavioral2/files/0x000a000000023b7d-103.dat	xmrig
behavioral2/files/0x000a000000023b79-74.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3280	inArBiQ.exe
1708	czkEfbq.exe
4820	ZkaIoQF.exe
3452	mYjHazb.exe
2232	tATXHOh.exe
4964	ZmyFtJm.exe
364	vZypUIV.exe
3028	cNQbURs.exe
1468	draQWcT.exe
764	cnCMgjW.exe
2136	KpsowkX.exe
2548	leiobDn.exe
2032	wylrTCy.exe
2440	VlhDkSb.exe
3628	qzPxenu.exe
1184	YmJGkWt.exe
4256	VOERdHE.exe
4216	ueEJxqw.exe
1464	LCpxcKp.exe
1916	UFfIPrn.exe
4264	jLwtcwI.exe
968	zFmuguK.exe
4584	akLQurC.exe
2220	wOrMHXB.exe
4484	ZEMjHnO.exe
1884	nUSCnMi.exe
3944	cdanGCL.exe
2656	mQBOzRC.exe
2988	yKKCSee.exe
4032	TKGUVVF.exe
2588	wxfOxUG.exe
908	TYIBkos.exe
3384	gFCmTQy.exe
2000	FYJrWyI.exe
2712	FIaXaWL.exe
552	slZglXT.exe
4320	yGGEuSq.exe
4992	DnQDGeK.exe
1768	FmUhpPY.exe
4804	jrNEcxU.exe
4852	FRsQqDQ.exe
4512	BuMsJOU.exe
688	SPNbylO.exe
4884	ACcLcZX.exe
3040	sttSCCe.exe
1128	CTiGJLI.exe
232	bJxLPUu.exe
4360	cjpQsli.exe
3404	RzCJWbT.exe
3352	xCSRXXR.exe
4140	MMEZfnd.exe
2180	DlUjhow.exe
1044	FeSBzNe.exe
4208	prDEyWy.exe
4708	VUIFLhD.exe
3720	koKhasW.exe
2952	bOuafcJ.exe
1648	ptORgUX.exe
3676	gFpUUmt.exe
4412	evojxlo.exe
5016	IOCwBTq.exe
1412	XSKfNrH.exe
3904	fcyowcI.exe
2100	dkaTxxv.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kIJFPta.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\kCxQyiO.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\vqDCMEX.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\JmeeOAI.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\HCeNwQb.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\LxguIgD.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\GPHshUU.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\ZdTCfdm.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\nnaabTl.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\OSNGNUv.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\vJkrFKs.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\PMycGPu.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\lDNrBHH.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\FuKAtln.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\DIOvbwY.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\XZZbJIc.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\WEkgNpD.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\ueEJxqw.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\PGxMSBV.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\faFaoia.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\sVXWqpH.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\RrOOtvj.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\jklzeOT.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\SNGUIGp.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\hMjiVIe.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\NuvwfLm.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\QzrpBxm.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\lDexByS.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\bfokyaI.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\RksTCje.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\DuNFXVa.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\IzYECja.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\KrZwWBG.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\bqxywoL.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\pfRIOso.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\rehOeFi.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\RmYRwZW.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\ryRGGgy.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\xCSRXXR.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\vfbEgUU.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\kVKNmbO.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\mslyctM.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\WAVXdvd.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\wylrTCy.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\gKybYbL.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\KJLNhZo.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\SUFijtd.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\jTTryio.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\ZWhTdTw.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\jgLqjnU.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\DDUalMq.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\yoLwyPH.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\XjKifHB.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\CjRcuDi.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\AtMfigI.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\lzjrKDu.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\yGGEuSq.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\BNoDubw.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\ONPYaIn.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\QmOWjrA.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\VEbZpmd.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\rkphRtL.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\ZsnLseI.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
File created	C:\Windows\System\WLBDghA.exe	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3280	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	84
PID 3020 wrote to memory of 3280	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	84
PID 3020 wrote to memory of 1708	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	85
PID 3020 wrote to memory of 1708	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	85
PID 3020 wrote to memory of 4820	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	86
PID 3020 wrote to memory of 4820	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	86
PID 3020 wrote to memory of 3452	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	87
PID 3020 wrote to memory of 3452	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	87
PID 3020 wrote to memory of 2232	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	88
PID 3020 wrote to memory of 2232	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	88
PID 3020 wrote to memory of 4964	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	89
PID 3020 wrote to memory of 4964	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	89
PID 3020 wrote to memory of 364	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	90
PID 3020 wrote to memory of 364	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	90
PID 3020 wrote to memory of 3028	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	91
PID 3020 wrote to memory of 3028	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	91
PID 3020 wrote to memory of 1468	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	92
PID 3020 wrote to memory of 1468	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	92
PID 3020 wrote to memory of 764	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	93
PID 3020 wrote to memory of 764	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	93
PID 3020 wrote to memory of 2136	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	94
PID 3020 wrote to memory of 2136	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	94
PID 3020 wrote to memory of 2548	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	95
PID 3020 wrote to memory of 2548	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	95
PID 3020 wrote to memory of 2032	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	96
PID 3020 wrote to memory of 2032	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	96
PID 3020 wrote to memory of 2440	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	97
PID 3020 wrote to memory of 2440	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	97
PID 3020 wrote to memory of 3628	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	98
PID 3020 wrote to memory of 3628	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	98
PID 3020 wrote to memory of 1184	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	100
PID 3020 wrote to memory of 1184	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	100
PID 3020 wrote to memory of 4256	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	101
PID 3020 wrote to memory of 4256	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	101
PID 3020 wrote to memory of 4216	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	102
PID 3020 wrote to memory of 4216	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	102
PID 3020 wrote to memory of 1464	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	103
PID 3020 wrote to memory of 1464	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	103
PID 3020 wrote to memory of 1916	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	104
PID 3020 wrote to memory of 1916	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	104
PID 3020 wrote to memory of 4264	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	105
PID 3020 wrote to memory of 4264	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	105
PID 3020 wrote to memory of 968	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	106
PID 3020 wrote to memory of 968	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	106
PID 3020 wrote to memory of 4584	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	107
PID 3020 wrote to memory of 4584	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	107
PID 3020 wrote to memory of 2220	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	108
PID 3020 wrote to memory of 2220	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	108
PID 3020 wrote to memory of 4484	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	109
PID 3020 wrote to memory of 4484	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	109
PID 3020 wrote to memory of 1884	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	110
PID 3020 wrote to memory of 1884	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	110
PID 3020 wrote to memory of 3944	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	111
PID 3020 wrote to memory of 3944	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	111
PID 3020 wrote to memory of 2656	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	112
PID 3020 wrote to memory of 2656	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	112
PID 3020 wrote to memory of 2988	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	113
PID 3020 wrote to memory of 2988	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	113
PID 3020 wrote to memory of 4320	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	114
PID 3020 wrote to memory of 4320	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	114
PID 3020 wrote to memory of 4032	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	115
PID 3020 wrote to memory of 4032	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	115
PID 3020 wrote to memory of 2588	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	116
PID 3020 wrote to memory of 2588	3020	2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe	116

C:\Users\Admin\AppData\Local\Temp\2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe
"C:\Users\Admin\AppData\Local\Temp\2408c56669a7efe3f0fc22edcdc1c78c92da5d497edb4ba1a26051ecb5130768.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System\inArBiQ.exe
  C:\Windows\System\inArBiQ.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\czkEfbq.exe
  C:\Windows\System\czkEfbq.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ZkaIoQF.exe
  C:\Windows\System\ZkaIoQF.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\mYjHazb.exe
  C:\Windows\System\mYjHazb.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\tATXHOh.exe
  C:\Windows\System\tATXHOh.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ZmyFtJm.exe
  C:\Windows\System\ZmyFtJm.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\vZypUIV.exe
  C:\Windows\System\vZypUIV.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\cNQbURs.exe
  C:\Windows\System\cNQbURs.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\draQWcT.exe
  C:\Windows\System\draQWcT.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\cnCMgjW.exe
  C:\Windows\System\cnCMgjW.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\KpsowkX.exe
  C:\Windows\System\KpsowkX.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\leiobDn.exe
  C:\Windows\System\leiobDn.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\wylrTCy.exe
  C:\Windows\System\wylrTCy.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\VlhDkSb.exe
  C:\Windows\System\VlhDkSb.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\qzPxenu.exe
  C:\Windows\System\qzPxenu.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\YmJGkWt.exe
  C:\Windows\System\YmJGkWt.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\VOERdHE.exe
  C:\Windows\System\VOERdHE.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\ueEJxqw.exe
  C:\Windows\System\ueEJxqw.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\LCpxcKp.exe
  C:\Windows\System\LCpxcKp.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\UFfIPrn.exe
  C:\Windows\System\UFfIPrn.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\jLwtcwI.exe
  C:\Windows\System\jLwtcwI.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\zFmuguK.exe
  C:\Windows\System\zFmuguK.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\akLQurC.exe
  C:\Windows\System\akLQurC.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\wOrMHXB.exe
  C:\Windows\System\wOrMHXB.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\ZEMjHnO.exe
  C:\Windows\System\ZEMjHnO.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\nUSCnMi.exe
  C:\Windows\System\nUSCnMi.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\cdanGCL.exe
  C:\Windows\System\cdanGCL.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\mQBOzRC.exe
  C:\Windows\System\mQBOzRC.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\yKKCSee.exe
  C:\Windows\System\yKKCSee.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\yGGEuSq.exe
  C:\Windows\System\yGGEuSq.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\TKGUVVF.exe
  C:\Windows\System\TKGUVVF.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\wxfOxUG.exe
  C:\Windows\System\wxfOxUG.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\TYIBkos.exe
  C:\Windows\System\TYIBkos.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\gFCmTQy.exe
  C:\Windows\System\gFCmTQy.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\jrNEcxU.exe
  C:\Windows\System\jrNEcxU.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\FYJrWyI.exe
  C:\Windows\System\FYJrWyI.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\FIaXaWL.exe
  C:\Windows\System\FIaXaWL.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\slZglXT.exe
  C:\Windows\System\slZglXT.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\DnQDGeK.exe
  C:\Windows\System\DnQDGeK.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\FmUhpPY.exe
  C:\Windows\System\FmUhpPY.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\FRsQqDQ.exe
  C:\Windows\System\FRsQqDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\BuMsJOU.exe
  C:\Windows\System\BuMsJOU.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\SPNbylO.exe
  C:\Windows\System\SPNbylO.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\ACcLcZX.exe
  C:\Windows\System\ACcLcZX.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\sttSCCe.exe
  C:\Windows\System\sttSCCe.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\CTiGJLI.exe
  C:\Windows\System\CTiGJLI.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\bJxLPUu.exe
  C:\Windows\System\bJxLPUu.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\cjpQsli.exe
  C:\Windows\System\cjpQsli.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\RzCJWbT.exe
  C:\Windows\System\RzCJWbT.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\xCSRXXR.exe
  C:\Windows\System\xCSRXXR.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\MMEZfnd.exe
  C:\Windows\System\MMEZfnd.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\DlUjhow.exe
  C:\Windows\System\DlUjhow.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\FeSBzNe.exe
  C:\Windows\System\FeSBzNe.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\prDEyWy.exe
  C:\Windows\System\prDEyWy.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\VUIFLhD.exe
  C:\Windows\System\VUIFLhD.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\koKhasW.exe
  C:\Windows\System\koKhasW.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\bOuafcJ.exe
  C:\Windows\System\bOuafcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\ptORgUX.exe
  C:\Windows\System\ptORgUX.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\gFpUUmt.exe
  C:\Windows\System\gFpUUmt.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\evojxlo.exe
  C:\Windows\System\evojxlo.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\IOCwBTq.exe
  C:\Windows\System\IOCwBTq.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\XSKfNrH.exe
  C:\Windows\System\XSKfNrH.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\fcyowcI.exe
  C:\Windows\System\fcyowcI.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\dkaTxxv.exe
  C:\Windows\System\dkaTxxv.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\rdJbBmk.exe
  C:\Windows\System\rdJbBmk.exe
  2⤵
  PID:4228
- C:\Windows\System\FjohciE.exe
  C:\Windows\System\FjohciE.exe
  2⤵
  PID:4756
- C:\Windows\System\afCiASV.exe
  C:\Windows\System\afCiASV.exe
  2⤵
  PID:1820
- C:\Windows\System\jDZEedc.exe
  C:\Windows\System\jDZEedc.exe
  2⤵
  PID:1612
- C:\Windows\System\BPTADGG.exe
  C:\Windows\System\BPTADGG.exe
  2⤵
  PID:2728
- C:\Windows\System\FoCIipf.exe
  C:\Windows\System\FoCIipf.exe
  2⤵
  PID:1172
- C:\Windows\System\QcGwVbq.exe
  C:\Windows\System\QcGwVbq.exe
  2⤵
  PID:1636
- C:\Windows\System\WBiPobU.exe
  C:\Windows\System\WBiPobU.exe
  2⤵
  PID:1944
- C:\Windows\System\NBTuQoZ.exe
  C:\Windows\System\NBTuQoZ.exe
  2⤵
  PID:4148
- C:\Windows\System\FaYnDUM.exe
  C:\Windows\System\FaYnDUM.exe
  2⤵
  PID:4268
- C:\Windows\System\qkJeSRq.exe
  C:\Windows\System\qkJeSRq.exe
  2⤵
  PID:2560
- C:\Windows\System\VEbZpmd.exe
  C:\Windows\System\VEbZpmd.exe
  2⤵
  PID:4488
- C:\Windows\System\NxWPsIZ.exe
  C:\Windows\System\NxWPsIZ.exe
  2⤵
  PID:220
- C:\Windows\System\weovcFp.exe
  C:\Windows\System\weovcFp.exe
  2⤵
  PID:404
- C:\Windows\System\htSkHAX.exe
  C:\Windows\System\htSkHAX.exe
  2⤵
  PID:960
- C:\Windows\System\mAGvMCa.exe
  C:\Windows\System\mAGvMCa.exe
  2⤵
  PID:1208
- C:\Windows\System\BALrXZE.exe
  C:\Windows\System\BALrXZE.exe
  2⤵
  PID:4940
- C:\Windows\System\irZUyPd.exe
  C:\Windows\System\irZUyPd.exe
  2⤵
  PID:1196
- C:\Windows\System\EccITnx.exe
  C:\Windows\System\EccITnx.exe
  2⤵
  PID:1140
- C:\Windows\System\fnEhzYK.exe
  C:\Windows\System\fnEhzYK.exe
  2⤵
  PID:3032
- C:\Windows\System\AmccHwP.exe
  C:\Windows\System\AmccHwP.exe
  2⤵
  PID:2408
- C:\Windows\System\vfbEgUU.exe
  C:\Windows\System\vfbEgUU.exe
  2⤵
  PID:3488
- C:\Windows\System\IdzpSMZ.exe
  C:\Windows\System\IdzpSMZ.exe
  2⤵
  PID:3312
- C:\Windows\System\BDxuQnE.exe
  C:\Windows\System\BDxuQnE.exe
  2⤵
  PID:3508
- C:\Windows\System\acsYgcG.exe
  C:\Windows\System\acsYgcG.exe
  2⤵
  PID:3880
- C:\Windows\System\fZdkLwU.exe
  C:\Windows\System\fZdkLwU.exe
  2⤵
  PID:4416
- C:\Windows\System\PGxMSBV.exe
  C:\Windows\System\PGxMSBV.exe
  2⤵
  PID:5004
- C:\Windows\System\jHFaAqK.exe
  C:\Windows\System\jHFaAqK.exe
  2⤵
  PID:1176
- C:\Windows\System\uhzNnWT.exe
  C:\Windows\System\uhzNnWT.exe
  2⤵
  PID:3512
- C:\Windows\System\eJlzUby.exe
  C:\Windows\System\eJlzUby.exe
  2⤵
  PID:4144
- C:\Windows\System\yxzFRbb.exe
  C:\Windows\System\yxzFRbb.exe
  2⤵
  PID:2096
- C:\Windows\System\LHMlwdh.exe
  C:\Windows\System\LHMlwdh.exe
  2⤵
  PID:5160
- C:\Windows\System\dhDraNn.exe
  C:\Windows\System\dhDraNn.exe
  2⤵
  PID:5180
- C:\Windows\System\YNxlQkV.exe
  C:\Windows\System\YNxlQkV.exe
  2⤵
  PID:5208
- C:\Windows\System\eWQqsUL.exe
  C:\Windows\System\eWQqsUL.exe
  2⤵
  PID:5232
- C:\Windows\System\bqxywoL.exe
  C:\Windows\System\bqxywoL.exe
  2⤵
  PID:5256
- C:\Windows\System\ZdTCfdm.exe
  C:\Windows\System\ZdTCfdm.exe
  2⤵
  PID:5284
- C:\Windows\System\pKvRZgn.exe
  C:\Windows\System\pKvRZgn.exe
  2⤵
  PID:5300
- C:\Windows\System\ErcVogV.exe
  C:\Windows\System\ErcVogV.exe
  2⤵
  PID:5324
- C:\Windows\System\elJcMCU.exe
  C:\Windows\System\elJcMCU.exe
  2⤵
  PID:5352
- C:\Windows\System\YRtKhpf.exe
  C:\Windows\System\YRtKhpf.exe
  2⤵
  PID:5380
- C:\Windows\System\GsooWqn.exe
  C:\Windows\System\GsooWqn.exe
  2⤵
  PID:5416
- C:\Windows\System\KxEOGtW.exe
  C:\Windows\System\KxEOGtW.exe
  2⤵
  PID:5452
- C:\Windows\System\jhyzefq.exe
  C:\Windows\System\jhyzefq.exe
  2⤵
  PID:5484
- C:\Windows\System\skpRZaV.exe
  C:\Windows\System\skpRZaV.exe
  2⤵
  PID:5520
- C:\Windows\System\pmBuVgf.exe
  C:\Windows\System\pmBuVgf.exe
  2⤵
  PID:5544
- C:\Windows\System\jTeLnNS.exe
  C:\Windows\System\jTeLnNS.exe
  2⤵
  PID:5572
- C:\Windows\System\DDUalMq.exe
  C:\Windows\System\DDUalMq.exe
  2⤵
  PID:5604
- C:\Windows\System\iQPhfhm.exe
  C:\Windows\System\iQPhfhm.exe
  2⤵
  PID:5636
- C:\Windows\System\gTBrwFC.exe
  C:\Windows\System\gTBrwFC.exe
  2⤵
  PID:5672
- C:\Windows\System\ISROxuy.exe
  C:\Windows\System\ISROxuy.exe
  2⤵
  PID:5700
- C:\Windows\System\DCLGEGS.exe
  C:\Windows\System\DCLGEGS.exe
  2⤵
  PID:5724
- C:\Windows\System\WbzpAhz.exe
  C:\Windows\System\WbzpAhz.exe
  2⤵
  PID:5752
- C:\Windows\System\GdrTZcn.exe
  C:\Windows\System\GdrTZcn.exe
  2⤵
  PID:5784
- C:\Windows\System\iOjnohX.exe
  C:\Windows\System\iOjnohX.exe
  2⤵
  PID:5808
- C:\Windows\System\LRfuuGN.exe
  C:\Windows\System\LRfuuGN.exe
  2⤵
  PID:5836
- C:\Windows\System\PwTqSUN.exe
  C:\Windows\System\PwTqSUN.exe
  2⤵
  PID:5876
- C:\Windows\System\yoLwyPH.exe
  C:\Windows\System\yoLwyPH.exe
  2⤵
  PID:5900
- C:\Windows\System\ElFftlt.exe
  C:\Windows\System\ElFftlt.exe
  2⤵
  PID:5920
- C:\Windows\System\ioZyDps.exe
  C:\Windows\System\ioZyDps.exe
  2⤵
  PID:5940
- C:\Windows\System\XCuVqko.exe
  C:\Windows\System\XCuVqko.exe
  2⤵
  PID:5964
- C:\Windows\System\eGUOcKo.exe
  C:\Windows\System\eGUOcKo.exe
  2⤵
  PID:5992
- C:\Windows\System\POdefKV.exe
  C:\Windows\System\POdefKV.exe
  2⤵
  PID:6024
- C:\Windows\System\GZgbmEN.exe
  C:\Windows\System\GZgbmEN.exe
  2⤵
  PID:6056
- C:\Windows\System\aUGPFvm.exe
  C:\Windows\System\aUGPFvm.exe
  2⤵
  PID:6088
- C:\Windows\System\MTOfkzP.exe
  C:\Windows\System\MTOfkzP.exe
  2⤵
  PID:6124
- C:\Windows\System\YicHLyQ.exe
  C:\Windows\System\YicHLyQ.exe
  2⤵
  PID:3348
- C:\Windows\System\nZeBfAy.exe
  C:\Windows\System\nZeBfAy.exe
  2⤵
  PID:5128
- C:\Windows\System\ymtjZkP.exe
  C:\Windows\System\ymtjZkP.exe
  2⤵
  PID:2740
- C:\Windows\System\EgBrBLT.exe
  C:\Windows\System\EgBrBLT.exe
  2⤵
  PID:5176
- C:\Windows\System\ZpSavoy.exe
  C:\Windows\System\ZpSavoy.exe
  2⤵
  PID:1568
- C:\Windows\System\ZgWAywg.exe
  C:\Windows\System\ZgWAywg.exe
  2⤵
  PID:5344
- C:\Windows\System\oWNcUQZ.exe
  C:\Windows\System\oWNcUQZ.exe
  2⤵
  PID:5372
- C:\Windows\System\LqwbZje.exe
  C:\Windows\System\LqwbZje.exe
  2⤵
  PID:5496
- C:\Windows\System\DdVaPkU.exe
  C:\Windows\System\DdVaPkU.exe
  2⤵
  PID:5504
- C:\Windows\System\sxRVkqt.exe
  C:\Windows\System\sxRVkqt.exe
  2⤵
  PID:5556
- C:\Windows\System\kUNlLAL.exe
  C:\Windows\System\kUNlLAL.exe
  2⤵
  PID:5656
- C:\Windows\System\FzAHwda.exe
  C:\Windows\System\FzAHwda.exe
  2⤵
  PID:5720
- C:\Windows\System\juNtCZu.exe
  C:\Windows\System\juNtCZu.exe
  2⤵
  PID:5800
- C:\Windows\System\SLKGSYY.exe
  C:\Windows\System\SLKGSYY.exe
  2⤵
  PID:5848
- C:\Windows\System\kVKNmbO.exe
  C:\Windows\System\kVKNmbO.exe
  2⤵
  PID:5932
- C:\Windows\System\URohLCb.exe
  C:\Windows\System\URohLCb.exe
  2⤵
  PID:5988
- C:\Windows\System\rnctZXu.exe
  C:\Windows\System\rnctZXu.exe
  2⤵
  PID:6052
- C:\Windows\System\hUCqsKf.exe
  C:\Windows\System\hUCqsKf.exe
  2⤵
  PID:6100
- C:\Windows\System\HuGBGfO.exe
  C:\Windows\System\HuGBGfO.exe
  2⤵
  PID:620
- C:\Windows\System\CwRwpLU.exe
  C:\Windows\System\CwRwpLU.exe
  2⤵
  PID:5252
- C:\Windows\System\dYOSoHy.exe
  C:\Windows\System\dYOSoHy.exe
  2⤵
  PID:5448
- C:\Windows\System\yYaGnRs.exe
  C:\Windows\System\yYaGnRs.exe
  2⤵
  PID:5564
- C:\Windows\System\yCVpvTb.exe
  C:\Windows\System\yCVpvTb.exe
  2⤵
  PID:5744
- C:\Windows\System\JLzALhS.exe
  C:\Windows\System\JLzALhS.exe
  2⤵
  PID:5768
- C:\Windows\System\XpqExDg.exe
  C:\Windows\System\XpqExDg.exe
  2⤵
  PID:5884
- C:\Windows\System\OlqVfcv.exe
  C:\Windows\System\OlqVfcv.exe
  2⤵
  PID:6132
- C:\Windows\System\jGzJDIB.exe
  C:\Windows\System\jGzJDIB.exe
  2⤵
  PID:5424
- C:\Windows\System\orjBkdg.exe
  C:\Windows\System\orjBkdg.exe
  2⤵
  PID:5708
- C:\Windows\System\jSUgSuH.exe
  C:\Windows\System\jSUgSuH.exe
  2⤵
  PID:4532
- C:\Windows\System\waXRzvN.exe
  C:\Windows\System\waXRzvN.exe
  2⤵
  PID:5632
- C:\Windows\System\qIOdtqo.exe
  C:\Windows\System\qIOdtqo.exe
  2⤵
  PID:6152
- C:\Windows\System\WuXTzff.exe
  C:\Windows\System\WuXTzff.exe
  2⤵
  PID:6184
- C:\Windows\System\fytxrNX.exe
  C:\Windows\System\fytxrNX.exe
  2⤵
  PID:6204
- C:\Windows\System\NTZUzsx.exe
  C:\Windows\System\NTZUzsx.exe
  2⤵
  PID:6220
- C:\Windows\System\XjKifHB.exe
  C:\Windows\System\XjKifHB.exe
  2⤵
  PID:6256
- C:\Windows\System\Glomala.exe
  C:\Windows\System\Glomala.exe
  2⤵
  PID:6284
- C:\Windows\System\UWYPLTN.exe
  C:\Windows\System\UWYPLTN.exe
  2⤵
  PID:6304
- C:\Windows\System\AeswqFt.exe
  C:\Windows\System\AeswqFt.exe
  2⤵
  PID:6336
- C:\Windows\System\rPjwlUc.exe
  C:\Windows\System\rPjwlUc.exe
  2⤵
  PID:6364
- C:\Windows\System\Rydpttj.exe
  C:\Windows\System\Rydpttj.exe
  2⤵
  PID:6392
- C:\Windows\System\nswiEXn.exe
  C:\Windows\System\nswiEXn.exe
  2⤵
  PID:6428
- C:\Windows\System\WHgbyFX.exe
  C:\Windows\System\WHgbyFX.exe
  2⤵
  PID:6452
- C:\Windows\System\dovuUoA.exe
  C:\Windows\System\dovuUoA.exe
  2⤵
  PID:6484
- C:\Windows\System\qkQueGx.exe
  C:\Windows\System\qkQueGx.exe
  2⤵
  PID:6520
- C:\Windows\System\jDXnlsM.exe
  C:\Windows\System\jDXnlsM.exe
  2⤵
  PID:6548
- C:\Windows\System\rcUqBaV.exe
  C:\Windows\System\rcUqBaV.exe
  2⤵
  PID:6580
- C:\Windows\System\HIgcorY.exe
  C:\Windows\System\HIgcorY.exe
  2⤵
  PID:6608
- C:\Windows\System\LtPvYuQ.exe
  C:\Windows\System\LtPvYuQ.exe
  2⤵
  PID:6636
- C:\Windows\System\JtdyvrT.exe
  C:\Windows\System\JtdyvrT.exe
  2⤵
  PID:6652
- C:\Windows\System\iiDpsla.exe
  C:\Windows\System\iiDpsla.exe
  2⤵
  PID:6680
- C:\Windows\System\ptCLwnw.exe
  C:\Windows\System\ptCLwnw.exe
  2⤵
  PID:6716
- C:\Windows\System\bJOJcDq.exe
  C:\Windows\System\bJOJcDq.exe
  2⤵
  PID:6744
- C:\Windows\System\nSKgqCR.exe
  C:\Windows\System\nSKgqCR.exe
  2⤵
  PID:6776
- C:\Windows\System\TCbchal.exe
  C:\Windows\System\TCbchal.exe
  2⤵
  PID:6792
- C:\Windows\System\zgrzBtg.exe
  C:\Windows\System\zgrzBtg.exe
  2⤵
  PID:6808
- C:\Windows\System\ElSpXIj.exe
  C:\Windows\System\ElSpXIj.exe
  2⤵
  PID:6828
- C:\Windows\System\UiLfdeC.exe
  C:\Windows\System\UiLfdeC.exe
  2⤵
  PID:6852
- C:\Windows\System\CQORSRD.exe
  C:\Windows\System\CQORSRD.exe
  2⤵
  PID:6868
- C:\Windows\System\CjRcuDi.exe
  C:\Windows\System\CjRcuDi.exe
  2⤵
  PID:6884
- C:\Windows\System\AmKtxeD.exe
  C:\Windows\System\AmKtxeD.exe
  2⤵
  PID:6904
- C:\Windows\System\CucwTCk.exe
  C:\Windows\System\CucwTCk.exe
  2⤵
  PID:6936
- C:\Windows\System\nygQOOO.exe
  C:\Windows\System\nygQOOO.exe
  2⤵
  PID:6956
- C:\Windows\System\FTjnDZC.exe
  C:\Windows\System\FTjnDZC.exe
  2⤵
  PID:6976
- C:\Windows\System\dkTsvUq.exe
  C:\Windows\System\dkTsvUq.exe
  2⤵
  PID:6996
- C:\Windows\System\wyNRmVk.exe
  C:\Windows\System\wyNRmVk.exe
  2⤵
  PID:7016
- C:\Windows\System\eGwhhMH.exe
  C:\Windows\System\eGwhhMH.exe
  2⤵
  PID:7040
- C:\Windows\System\QmCcXVo.exe
  C:\Windows\System\QmCcXVo.exe
  2⤵
  PID:7056
- C:\Windows\System\vuFWRtc.exe
  C:\Windows\System\vuFWRtc.exe
  2⤵
  PID:7072
- C:\Windows\System\YFioCpP.exe
  C:\Windows\System\YFioCpP.exe
  2⤵
  PID:7100
- C:\Windows\System\WRMPIIJ.exe
  C:\Windows\System\WRMPIIJ.exe
  2⤵
  PID:7128
- C:\Windows\System\GuTVYRr.exe
  C:\Windows\System\GuTVYRr.exe
  2⤵
  PID:7164
- C:\Windows\System\yKLluNI.exe
  C:\Windows\System\yKLluNI.exe
  2⤵
  PID:6240
- C:\Windows\System\kSqrcmH.exe
  C:\Windows\System\kSqrcmH.exe
  2⤵
  PID:6276
- C:\Windows\System\mQPppDb.exe
  C:\Windows\System\mQPppDb.exe
  2⤵
  PID:6344
- C:\Windows\System\TcawVrW.exe
  C:\Windows\System\TcawVrW.exe
  2⤵
  PID:6444
- C:\Windows\System\OxjCyxN.exe
  C:\Windows\System\OxjCyxN.exe
  2⤵
  PID:6532
- C:\Windows\System\AtMfigI.exe
  C:\Windows\System\AtMfigI.exe
  2⤵
  PID:6604
- C:\Windows\System\GmHPgZl.exe
  C:\Windows\System\GmHPgZl.exe
  2⤵
  PID:6696
- C:\Windows\System\jklzeOT.exe
  C:\Windows\System\jklzeOT.exe
  2⤵
  PID:6804
- C:\Windows\System\ardovcB.exe
  C:\Windows\System\ardovcB.exe
  2⤵
  PID:6864
- C:\Windows\System\DqffiOb.exe
  C:\Windows\System\DqffiOb.exe
  2⤵
  PID:6860
- C:\Windows\System\dXPLOFO.exe
  C:\Windows\System\dXPLOFO.exe
  2⤵
  PID:6988
- C:\Windows\System\qWWHDJm.exe
  C:\Windows\System\qWWHDJm.exe
  2⤵
  PID:7064
- C:\Windows\System\onjFHyy.exe
  C:\Windows\System\onjFHyy.exe
  2⤵
  PID:7136
- C:\Windows\System\pqlPiKx.exe
  C:\Windows\System\pqlPiKx.exe
  2⤵
  PID:6200
- C:\Windows\System\xFwkiPY.exe
  C:\Windows\System\xFwkiPY.exe
  2⤵
  PID:6292
- C:\Windows\System\VUSxfuD.exe
  C:\Windows\System\VUSxfuD.exe
  2⤵
  PID:7156
- C:\Windows\System\rJXemCc.exe
  C:\Windows\System\rJXemCc.exe
  2⤵
  PID:6576
- C:\Windows\System\EohYrsq.exe
  C:\Windows\System\EohYrsq.exe
  2⤵
  PID:6628
- C:\Windows\System\FuDrLTb.exe
  C:\Windows\System\FuDrLTb.exe
  2⤵
  PID:6840
- C:\Windows\System\gLQaWFX.exe
  C:\Windows\System\gLQaWFX.exe
  2⤵
  PID:6952
- C:\Windows\System\ObdYpPU.exe
  C:\Windows\System\ObdYpPU.exe
  2⤵
  PID:6408
- C:\Windows\System\sKdUpRN.exe
  C:\Windows\System\sKdUpRN.exe
  2⤵
  PID:6168
- C:\Windows\System\iNozEZo.exe
  C:\Windows\System\iNozEZo.exe
  2⤵
  PID:7116
- C:\Windows\System\OSNGNUv.exe
  C:\Windows\System\OSNGNUv.exe
  2⤵
  PID:7200
- C:\Windows\System\dXamqFu.exe
  C:\Windows\System\dXamqFu.exe
  2⤵
  PID:7228
- C:\Windows\System\BCQiZuf.exe
  C:\Windows\System\BCQiZuf.exe
  2⤵
  PID:7264
- C:\Windows\System\JDsHcMs.exe
  C:\Windows\System\JDsHcMs.exe
  2⤵
  PID:7300
- C:\Windows\System\eJQrajo.exe
  C:\Windows\System\eJQrajo.exe
  2⤵
  PID:7328
- C:\Windows\System\STmPJoi.exe
  C:\Windows\System\STmPJoi.exe
  2⤵
  PID:7364
- C:\Windows\System\bfokyaI.exe
  C:\Windows\System\bfokyaI.exe
  2⤵
  PID:7384
- C:\Windows\System\faFaoia.exe
  C:\Windows\System\faFaoia.exe
  2⤵
  PID:7416
- C:\Windows\System\BUtBqDL.exe
  C:\Windows\System\BUtBqDL.exe
  2⤵
  PID:7440
- C:\Windows\System\FsRUQWk.exe
  C:\Windows\System\FsRUQWk.exe
  2⤵
  PID:7472
- C:\Windows\System\SnrQWsg.exe
  C:\Windows\System\SnrQWsg.exe
  2⤵
  PID:7492
- C:\Windows\System\LkOSzIS.exe
  C:\Windows\System\LkOSzIS.exe
  2⤵
  PID:7520
- C:\Windows\System\zAHEisv.exe
  C:\Windows\System\zAHEisv.exe
  2⤵
  PID:7544
- C:\Windows\System\esQZdVd.exe
  C:\Windows\System\esQZdVd.exe
  2⤵
  PID:7560
- C:\Windows\System\pNUerCJ.exe
  C:\Windows\System\pNUerCJ.exe
  2⤵
  PID:7576
- C:\Windows\System\QOnvIyU.exe
  C:\Windows\System\QOnvIyU.exe
  2⤵
  PID:7600
- C:\Windows\System\nOBwzeD.exe
  C:\Windows\System\nOBwzeD.exe
  2⤵
  PID:7624
- C:\Windows\System\AfDMsJm.exe
  C:\Windows\System\AfDMsJm.exe
  2⤵
  PID:7648
- C:\Windows\System\LxHvwrn.exe
  C:\Windows\System\LxHvwrn.exe
  2⤵
  PID:7676
- C:\Windows\System\tlXrgoU.exe
  C:\Windows\System\tlXrgoU.exe
  2⤵
  PID:7708
- C:\Windows\System\dIzWXUy.exe
  C:\Windows\System\dIzWXUy.exe
  2⤵
  PID:7740
- C:\Windows\System\vruIZjo.exe
  C:\Windows\System\vruIZjo.exe
  2⤵
  PID:7760
- C:\Windows\System\neuYhzx.exe
  C:\Windows\System\neuYhzx.exe
  2⤵
  PID:7796
- C:\Windows\System\UwRpLAE.exe
  C:\Windows\System\UwRpLAE.exe
  2⤵
  PID:7824
- C:\Windows\System\yWArJeE.exe
  C:\Windows\System\yWArJeE.exe
  2⤵
  PID:7856
- C:\Windows\System\vhnPsYD.exe
  C:\Windows\System\vhnPsYD.exe
  2⤵
  PID:7884
- C:\Windows\System\inEEtmC.exe
  C:\Windows\System\inEEtmC.exe
  2⤵
  PID:7916
- C:\Windows\System\EKfPKWz.exe
  C:\Windows\System\EKfPKWz.exe
  2⤵
  PID:7944
- C:\Windows\System\aYVUQVM.exe
  C:\Windows\System\aYVUQVM.exe
  2⤵
  PID:7980
- C:\Windows\System\CrJjaXw.exe
  C:\Windows\System\CrJjaXw.exe
  2⤵
  PID:8016
- C:\Windows\System\pRfBcVB.exe
  C:\Windows\System\pRfBcVB.exe
  2⤵
  PID:8052
- C:\Windows\System\uQmnhbv.exe
  C:\Windows\System\uQmnhbv.exe
  2⤵
  PID:8072
- C:\Windows\System\rYIuKTA.exe
  C:\Windows\System\rYIuKTA.exe
  2⤵
  PID:8100
- C:\Windows\System\eWRVdXB.exe
  C:\Windows\System\eWRVdXB.exe
  2⤵
  PID:8124
- C:\Windows\System\EPbgvDk.exe
  C:\Windows\System\EPbgvDk.exe
  2⤵
  PID:8160
- C:\Windows\System\kVKlgIh.exe
  C:\Windows\System\kVKlgIh.exe
  2⤵
  PID:8184
- C:\Windows\System\rftPAhZ.exe
  C:\Windows\System\rftPAhZ.exe
  2⤵
  PID:7176
- C:\Windows\System\QIhEGjE.exe
  C:\Windows\System\QIhEGjE.exe
  2⤵
  PID:6824
- C:\Windows\System\PUmFXmb.exe
  C:\Windows\System\PUmFXmb.exe
  2⤵
  PID:7216
- C:\Windows\System\TmUotuq.exe
  C:\Windows\System\TmUotuq.exe
  2⤵
  PID:7312
- C:\Windows\System\YMtmOuT.exe
  C:\Windows\System\YMtmOuT.exe
  2⤵
  PID:7340
- C:\Windows\System\CTLxjdy.exe
  C:\Windows\System\CTLxjdy.exe
  2⤵
  PID:7452
- C:\Windows\System\nnaabTl.exe
  C:\Windows\System\nnaabTl.exe
  2⤵
  PID:7572
- C:\Windows\System\Ditkukr.exe
  C:\Windows\System\Ditkukr.exe
  2⤵
  PID:7608
- C:\Windows\System\kIJFPta.exe
  C:\Windows\System\kIJFPta.exe
  2⤵
  PID:7488
- C:\Windows\System\STPhtyl.exe
  C:\Windows\System\STPhtyl.exe
  2⤵
  PID:7720
- C:\Windows\System\cPfgAHc.exe
  C:\Windows\System\cPfgAHc.exe
  2⤵
  PID:3560
- C:\Windows\System\QyvxxEj.exe
  C:\Windows\System\QyvxxEj.exe
  2⤵
  PID:7808
- C:\Windows\System\YKwgrRq.exe
  C:\Windows\System\YKwgrRq.exe
  2⤵
  PID:7704
- C:\Windows\System\emgIqov.exe
  C:\Windows\System\emgIqov.exe
  2⤵
  PID:7864
- C:\Windows\System\gSwXnjM.exe
  C:\Windows\System\gSwXnjM.exe
  2⤵
  PID:7972
- C:\Windows\System\RJtnqBY.exe
  C:\Windows\System\RJtnqBY.exe
  2⤵
  PID:8040
- C:\Windows\System\DHwLMpd.exe
  C:\Windows\System\DHwLMpd.exe
  2⤵
  PID:8084
- C:\Windows\System\NFERqmf.exe
  C:\Windows\System\NFERqmf.exe
  2⤵
  PID:8136
- C:\Windows\System\EWQneiq.exe
  C:\Windows\System\EWQneiq.exe
  2⤵
  PID:7052
- C:\Windows\System\NzdTETv.exe
  C:\Windows\System\NzdTETv.exe
  2⤵
  PID:7288
- C:\Windows\System\UTThYpA.exe
  C:\Windows\System\UTThYpA.exe
  2⤵
  PID:7436
- C:\Windows\System\eJyFsdm.exe
  C:\Windows\System\eJyFsdm.exe
  2⤵
  PID:7568
- C:\Windows\System\iUePIXt.exe
  C:\Windows\System\iUePIXt.exe
  2⤵
  PID:7692
- C:\Windows\System\DiUlXmF.exe
  C:\Windows\System\DiUlXmF.exe
  2⤵
  PID:7732
- C:\Windows\System\HwAekEd.exe
  C:\Windows\System\HwAekEd.exe
  2⤵
  PID:7812
- C:\Windows\System\jCYZzSz.exe
  C:\Windows\System\jCYZzSz.exe
  2⤵
  PID:7940
- C:\Windows\System\QUiXoal.exe
  C:\Windows\System\QUiXoal.exe
  2⤵
  PID:7480
- C:\Windows\System\NpPPkZo.exe
  C:\Windows\System\NpPPkZo.exe
  2⤵
  PID:7372
- C:\Windows\System\WWMHzmE.exe
  C:\Windows\System\WWMHzmE.exe
  2⤵
  PID:7696
- C:\Windows\System\ZdoWINR.exe
  C:\Windows\System\ZdoWINR.exe
  2⤵
  PID:7900
- C:\Windows\System\lXJsuVv.exe
  C:\Windows\System\lXJsuVv.exe
  2⤵
  PID:8208
- C:\Windows\System\VGMtZsW.exe
  C:\Windows\System\VGMtZsW.exe
  2⤵
  PID:8232
- C:\Windows\System\NokfRqj.exe
  C:\Windows\System\NokfRqj.exe
  2⤵
  PID:8268
- C:\Windows\System\ZIgzYDl.exe
  C:\Windows\System\ZIgzYDl.exe
  2⤵
  PID:8292
- C:\Windows\System\RbJqnSU.exe
  C:\Windows\System\RbJqnSU.exe
  2⤵
  PID:8316
- C:\Windows\System\LcBGpJu.exe
  C:\Windows\System\LcBGpJu.exe
  2⤵
  PID:8332
- C:\Windows\System\CQHlsyg.exe
  C:\Windows\System\CQHlsyg.exe
  2⤵
  PID:8360
- C:\Windows\System\NASFmiE.exe
  C:\Windows\System\NASFmiE.exe
  2⤵
  PID:8384
- C:\Windows\System\hPowTck.exe
  C:\Windows\System\hPowTck.exe
  2⤵
  PID:8416
- C:\Windows\System\oLoZdDf.exe
  C:\Windows\System\oLoZdDf.exe
  2⤵
  PID:8448
- C:\Windows\System\OleAnXS.exe
  C:\Windows\System\OleAnXS.exe
  2⤵
  PID:8496
- C:\Windows\System\SOPfwwD.exe
  C:\Windows\System\SOPfwwD.exe
  2⤵
  PID:8520
- C:\Windows\System\DuZZPBI.exe
  C:\Windows\System\DuZZPBI.exe
  2⤵
  PID:8552
- C:\Windows\System\DMEaGYE.exe
  C:\Windows\System\DMEaGYE.exe
  2⤵
  PID:8588
- C:\Windows\System\OnWHuSd.exe
  C:\Windows\System\OnWHuSd.exe
  2⤵
  PID:8612
- C:\Windows\System\zaOPSDM.exe
  C:\Windows\System\zaOPSDM.exe
  2⤵
  PID:8632
- C:\Windows\System\LBrGcNE.exe
  C:\Windows\System\LBrGcNE.exe
  2⤵
  PID:8676
- C:\Windows\System\iaWxiIJ.exe
  C:\Windows\System\iaWxiIJ.exe
  2⤵
  PID:8696
- C:\Windows\System\CvWnRkn.exe
  C:\Windows\System\CvWnRkn.exe
  2⤵
  PID:8720
- C:\Windows\System\JAStXzf.exe
  C:\Windows\System\JAStXzf.exe
  2⤵
  PID:8744
- C:\Windows\System\KzVkZuH.exe
  C:\Windows\System\KzVkZuH.exe
  2⤵
  PID:8760
- C:\Windows\System\WrNfJuM.exe
  C:\Windows\System\WrNfJuM.exe
  2⤵
  PID:8784
- C:\Windows\System\fLxvjYf.exe
  C:\Windows\System\fLxvjYf.exe
  2⤵
  PID:8812
- C:\Windows\System\fHqHAaT.exe
  C:\Windows\System\fHqHAaT.exe
  2⤵
  PID:8840
- C:\Windows\System\ltCUrVD.exe
  C:\Windows\System\ltCUrVD.exe
  2⤵
  PID:8860
- C:\Windows\System\CKUhPYa.exe
  C:\Windows\System\CKUhPYa.exe
  2⤵
  PID:8892
- C:\Windows\System\oOwTGCH.exe
  C:\Windows\System\oOwTGCH.exe
  2⤵
  PID:8916
- C:\Windows\System\GvnsxsI.exe
  C:\Windows\System\GvnsxsI.exe
  2⤵
  PID:8944
- C:\Windows\System\CHqGuih.exe
  C:\Windows\System\CHqGuih.exe
  2⤵
  PID:8976
- C:\Windows\System\RKCnXuZ.exe
  C:\Windows\System\RKCnXuZ.exe
  2⤵
  PID:9000
- C:\Windows\System\LkdhhqE.exe
  C:\Windows\System\LkdhhqE.exe
  2⤵
  PID:9040
- C:\Windows\System\kkytOkw.exe
  C:\Windows\System\kkytOkw.exe
  2⤵
  PID:9068
- C:\Windows\System\GUTSArE.exe
  C:\Windows\System\GUTSArE.exe
  2⤵
  PID:9112
- C:\Windows\System\NbklYJi.exe
  C:\Windows\System\NbklYJi.exe
  2⤵
  PID:9136
- C:\Windows\System\kgZDkjD.exe
  C:\Windows\System\kgZDkjD.exe
  2⤵
  PID:9172
- C:\Windows\System\drEqcSy.exe
  C:\Windows\System\drEqcSy.exe
  2⤵
  PID:9196
- C:\Windows\System\FRjOQls.exe
  C:\Windows\System\FRjOQls.exe
  2⤵
  PID:7432
- C:\Windows\System\CcLzWTj.exe
  C:\Windows\System\CcLzWTj.exe
  2⤵
  PID:8220
- C:\Windows\System\YhrfREm.exe
  C:\Windows\System\YhrfREm.exe
  2⤵
  PID:8304
- C:\Windows\System\PBiLWIR.exe
  C:\Windows\System\PBiLWIR.exe
  2⤵
  PID:8328
- C:\Windows\System\vJkrFKs.exe
  C:\Windows\System\vJkrFKs.exe
  2⤵
  PID:8368
- C:\Windows\System\TmPzNVJ.exe
  C:\Windows\System\TmPzNVJ.exe
  2⤵
  PID:8456
- C:\Windows\System\SNGUIGp.exe
  C:\Windows\System\SNGUIGp.exe
  2⤵
  PID:8532
- C:\Windows\System\OiqURAQ.exe
  C:\Windows\System\OiqURAQ.exe
  2⤵
  PID:8604
- C:\Windows\System\zbSNKWl.exe
  C:\Windows\System\zbSNKWl.exe
  2⤵
  PID:8664
- C:\Windows\System\nLxdcyA.exe
  C:\Windows\System\nLxdcyA.exe
  2⤵
  PID:8708
- C:\Windows\System\RmbRBRW.exe
  C:\Windows\System\RmbRBRW.exe
  2⤵
  PID:8808
- C:\Windows\System\jphiogJ.exe
  C:\Windows\System\jphiogJ.exe
  2⤵
  PID:8852
- C:\Windows\System\mSvhybB.exe
  C:\Windows\System\mSvhybB.exe
  2⤵
  PID:8900
- C:\Windows\System\sVXWqpH.exe
  C:\Windows\System\sVXWqpH.exe
  2⤵
  PID:9032
- C:\Windows\System\YsEtQQE.exe
  C:\Windows\System\YsEtQQE.exe
  2⤵
  PID:9096
- C:\Windows\System\SJuxeqh.exe
  C:\Windows\System\SJuxeqh.exe
  2⤵
  PID:9056
- C:\Windows\System\PNYfqmp.exe
  C:\Windows\System\PNYfqmp.exe
  2⤵
  PID:9164
- C:\Windows\System\uKkktdv.exe
  C:\Windows\System\uKkktdv.exe
  2⤵
  PID:8216
- C:\Windows\System\VuYEGWg.exe
  C:\Windows\System\VuYEGWg.exe
  2⤵
  PID:8404
- C:\Windows\System\nYGCCbl.exe
  C:\Windows\System\nYGCCbl.exe
  2⤵
  PID:8440
- C:\Windows\System\tUGXgNM.exe
  C:\Windows\System\tUGXgNM.exe
  2⤵
  PID:8432
- C:\Windows\System\cgWrxGo.exe
  C:\Windows\System\cgWrxGo.exe
  2⤵
  PID:8728
- C:\Windows\System\TimrCCs.exe
  C:\Windows\System\TimrCCs.exe
  2⤵
  PID:8828
- C:\Windows\System\XMbLLWX.exe
  C:\Windows\System\XMbLLWX.exe
  2⤵
  PID:9080
- C:\Windows\System\zOLBFKX.exe
  C:\Windows\System\zOLBFKX.exe
  2⤵
  PID:9128
- C:\Windows\System\KGEsAzn.exe
  C:\Windows\System\KGEsAzn.exe
  2⤵
  PID:4904
- C:\Windows\System\chvgJVA.exe
  C:\Windows\System\chvgJVA.exe
  2⤵
  PID:3616
- C:\Windows\System\BUQlIAk.exe
  C:\Windows\System\BUQlIAk.exe
  2⤵
  PID:8736
- C:\Windows\System\VxpEyyT.exe
  C:\Windows\System\VxpEyyT.exe
  2⤵
  PID:8824
- C:\Windows\System\UTcyoVm.exe
  C:\Windows\System\UTcyoVm.exe
  2⤵
  PID:9024
- C:\Windows\System\OvSwesX.exe
  C:\Windows\System\OvSwesX.exe
  2⤵
  PID:8572
- C:\Windows\System\zryaVqq.exe
  C:\Windows\System\zryaVqq.exe
  2⤵
  PID:1124
- C:\Windows\System\OexWler.exe
  C:\Windows\System\OexWler.exe
  2⤵
  PID:9240
- C:\Windows\System\gKybYbL.exe
  C:\Windows\System\gKybYbL.exe
  2⤵
  PID:9260
- C:\Windows\System\uqFSHXs.exe
  C:\Windows\System\uqFSHXs.exe
  2⤵
  PID:9288
- C:\Windows\System\DIOvbwY.exe
  C:\Windows\System\DIOvbwY.exe
  2⤵
  PID:9316
- C:\Windows\System\unTGLPt.exe
  C:\Windows\System\unTGLPt.exe
  2⤵
  PID:9352
- C:\Windows\System\ghCMsnm.exe
  C:\Windows\System\ghCMsnm.exe
  2⤵
  PID:9396
- C:\Windows\System\PmiRghW.exe
  C:\Windows\System\PmiRghW.exe
  2⤵
  PID:9420
- C:\Windows\System\BPziowP.exe
  C:\Windows\System\BPziowP.exe
  2⤵
  PID:9452
- C:\Windows\System\UGTvEdU.exe
  C:\Windows\System\UGTvEdU.exe
  2⤵
  PID:9488
- C:\Windows\System\CTHTrFE.exe
  C:\Windows\System\CTHTrFE.exe
  2⤵
  PID:9520
- C:\Windows\System\dzTpLSB.exe
  C:\Windows\System\dzTpLSB.exe
  2⤵
  PID:9548
- C:\Windows\System\GaegsPC.exe
  C:\Windows\System\GaegsPC.exe
  2⤵
  PID:9576
- C:\Windows\System\rOprrvy.exe
  C:\Windows\System\rOprrvy.exe
  2⤵
  PID:9592
- C:\Windows\System\vqfvJIj.exe
  C:\Windows\System\vqfvJIj.exe
  2⤵
  PID:9620
- C:\Windows\System\ZWrFrKB.exe
  C:\Windows\System\ZWrFrKB.exe
  2⤵
  PID:9648
- C:\Windows\System\nUCjajU.exe
  C:\Windows\System\nUCjajU.exe
  2⤵
  PID:9680
- C:\Windows\System\oLBwekE.exe
  C:\Windows\System\oLBwekE.exe
  2⤵
  PID:9708
- C:\Windows\System\WSTXxtA.exe
  C:\Windows\System\WSTXxtA.exe
  2⤵
  PID:9732
- C:\Windows\System\QHSGtKk.exe
  C:\Windows\System\QHSGtKk.exe
  2⤵
  PID:9768
- C:\Windows\System\kVwdGnk.exe
  C:\Windows\System\kVwdGnk.exe
  2⤵
  PID:9796
- C:\Windows\System\FMadpys.exe
  C:\Windows\System\FMadpys.exe
  2⤵
  PID:9820
- C:\Windows\System\HaZjCOv.exe
  C:\Windows\System\HaZjCOv.exe
  2⤵
  PID:9848
- C:\Windows\System\aBhOvxF.exe
  C:\Windows\System\aBhOvxF.exe
  2⤵
  PID:9876
- C:\Windows\System\CSydFyV.exe
  C:\Windows\System\CSydFyV.exe
  2⤵
  PID:9912
- C:\Windows\System\bwSGBjO.exe
  C:\Windows\System\bwSGBjO.exe
  2⤵
  PID:9944
- C:\Windows\System\SdpxYsX.exe
  C:\Windows\System\SdpxYsX.exe
  2⤵
  PID:9972
- C:\Windows\System\LaLvmZL.exe
  C:\Windows\System\LaLvmZL.exe
  2⤵
  PID:10000
- C:\Windows\System\UzRGDYH.exe
  C:\Windows\System\UzRGDYH.exe
  2⤵
  PID:10032
- C:\Windows\System\BmydQqo.exe
  C:\Windows\System\BmydQqo.exe
  2⤵
  PID:10056
- C:\Windows\System\pbGZFGh.exe
  C:\Windows\System\pbGZFGh.exe
  2⤵
  PID:10084
- C:\Windows\System\hCoRfUg.exe
  C:\Windows\System\hCoRfUg.exe
  2⤵
  PID:10112
- C:\Windows\System\ISgfvyK.exe
  C:\Windows\System\ISgfvyK.exe
  2⤵
  PID:10140
- C:\Windows\System\BNoDubw.exe
  C:\Windows\System\BNoDubw.exe
  2⤵
  PID:10156
- C:\Windows\System\dGjXBKM.exe
  C:\Windows\System\dGjXBKM.exe
  2⤵
  PID:10196
- C:\Windows\System\QANzJPG.exe
  C:\Windows\System\QANzJPG.exe
  2⤵
  PID:10212
- C:\Windows\System\ZbDGJCH.exe
  C:\Windows\System\ZbDGJCH.exe
  2⤵
  PID:8960
- C:\Windows\System\pQEtTkr.exe
  C:\Windows\System\pQEtTkr.exe
  2⤵
  PID:9236
- C:\Windows\System\bFuaMwe.exe
  C:\Windows\System\bFuaMwe.exe
  2⤵
  PID:9248
- C:\Windows\System\NLtAbVE.exe
  C:\Windows\System\NLtAbVE.exe
  2⤵
  PID:9412
- C:\Windows\System\clqyaWp.exe
  C:\Windows\System\clqyaWp.exe
  2⤵
  PID:9440
- C:\Windows\System\KuWVtyh.exe
  C:\Windows\System\KuWVtyh.exe
  2⤵
  PID:9532
- C:\Windows\System\vQlXvnG.exe
  C:\Windows\System\vQlXvnG.exe
  2⤵
  PID:9608
- C:\Windows\System\RNSZApN.exe
  C:\Windows\System\RNSZApN.exe
  2⤵
  PID:9676
- C:\Windows\System\UhAJRJH.exe
  C:\Windows\System\UhAJRJH.exe
  2⤵
  PID:9776
- C:\Windows\System\BsUwFxm.exe
  C:\Windows\System\BsUwFxm.exe
  2⤵
  PID:8476
- C:\Windows\System\mslyctM.exe
  C:\Windows\System\mslyctM.exe
  2⤵
  PID:9840
- C:\Windows\System\faTAbOw.exe
  C:\Windows\System\faTAbOw.exe
  2⤵
  PID:9832
- C:\Windows\System\FJwMUHK.exe
  C:\Windows\System\FJwMUHK.exe
  2⤵
  PID:9928
- C:\Windows\System\UzgjkLD.exe
  C:\Windows\System\UzgjkLD.exe
  2⤵
  PID:9988
- C:\Windows\System\AaZKFOX.exe
  C:\Windows\System\AaZKFOX.exe
  2⤵
  PID:10052
- C:\Windows\System\VvBvBSK.exe
  C:\Windows\System\VvBvBSK.exe
  2⤵
  PID:10128
- C:\Windows\System\NlkgOLz.exe
  C:\Windows\System\NlkgOLz.exe
  2⤵
  PID:10180
- C:\Windows\System\GFshHRr.exe
  C:\Windows\System\GFshHRr.exe
  2⤵
  PID:10224
- C:\Windows\System\hdLBsna.exe
  C:\Windows\System\hdLBsna.exe
  2⤵
  PID:10232
- C:\Windows\System\VRSBSnu.exe
  C:\Windows\System\VRSBSnu.exe
  2⤵
  PID:9360
- C:\Windows\System\iIVcjyW.exe
  C:\Windows\System\iIVcjyW.exe
  2⤵
  PID:9416
- C:\Windows\System\qdRwGwo.exe
  C:\Windows\System\qdRwGwo.exe
  2⤵
  PID:9752
- C:\Windows\System\zvEnPIH.exe
  C:\Windows\System\zvEnPIH.exe
  2⤵
  PID:9872
- C:\Windows\System\irbotNF.exe
  C:\Windows\System\irbotNF.exe
  2⤵
  PID:9956
- C:\Windows\System\gTJcVNs.exe
  C:\Windows\System\gTJcVNs.exe
  2⤵
  PID:9300
- C:\Windows\System\CzOOeWz.exe
  C:\Windows\System\CzOOeWz.exe
  2⤵
  PID:9468
- C:\Windows\System\BjgYAvE.exe
  C:\Windows\System\BjgYAvE.exe
  2⤵
  PID:10256
- C:\Windows\System\dfqWPQP.exe
  C:\Windows\System\dfqWPQP.exe
  2⤵
  PID:10276
- C:\Windows\System\YNMBfSB.exe
  C:\Windows\System\YNMBfSB.exe
  2⤵
  PID:10304
- C:\Windows\System\qfeXgMs.exe
  C:\Windows\System\qfeXgMs.exe
  2⤵
  PID:10340
- C:\Windows\System\ikuKbwg.exe
  C:\Windows\System\ikuKbwg.exe
  2⤵
  PID:10368
- C:\Windows\System\FbzCIEl.exe
  C:\Windows\System\FbzCIEl.exe
  2⤵
  PID:10396
- C:\Windows\System\yYsvfNp.exe
  C:\Windows\System\yYsvfNp.exe
  2⤵
  PID:10420
- C:\Windows\System\kwUxqkW.exe
  C:\Windows\System\kwUxqkW.exe
  2⤵
  PID:10456
- C:\Windows\System\XZZbJIc.exe
  C:\Windows\System\XZZbJIc.exe
  2⤵
  PID:10480
- C:\Windows\System\sIQMDVB.exe
  C:\Windows\System\sIQMDVB.exe
  2⤵
  PID:10516
- C:\Windows\System\XjfEClp.exe
  C:\Windows\System\XjfEClp.exe
  2⤵
  PID:10544
- C:\Windows\System\kMkaWSz.exe
  C:\Windows\System\kMkaWSz.exe
  2⤵
  PID:10576
- C:\Windows\System\jWEpIZs.exe
  C:\Windows\System\jWEpIZs.exe
  2⤵
  PID:10600
- C:\Windows\System\uhZTRjH.exe
  C:\Windows\System\uhZTRjH.exe
  2⤵
  PID:10624
- C:\Windows\System\STsaVqk.exe
  C:\Windows\System\STsaVqk.exe
  2⤵
  PID:10648
- C:\Windows\System\hTldFqv.exe
  C:\Windows\System\hTldFqv.exe
  2⤵
  PID:10684
- C:\Windows\System\qkjAWNE.exe
  C:\Windows\System\qkjAWNE.exe
  2⤵
  PID:10712
- C:\Windows\System\snLlTri.exe
  C:\Windows\System\snLlTri.exe
  2⤵
  PID:10748
- C:\Windows\System\gfWseNw.exe
  C:\Windows\System\gfWseNw.exe
  2⤵
  PID:10780
- C:\Windows\System\FSsDQUa.exe
  C:\Windows\System\FSsDQUa.exe
  2⤵
  PID:10808
- C:\Windows\System\KGvUpQw.exe
  C:\Windows\System\KGvUpQw.exe
  2⤵
  PID:10832
- C:\Windows\System\QajhJaH.exe
  C:\Windows\System\QajhJaH.exe
  2⤵
  PID:10860
- C:\Windows\System\ysbUkLc.exe
  C:\Windows\System\ysbUkLc.exe
  2⤵
  PID:10896
- C:\Windows\System\uDZvGCR.exe
  C:\Windows\System\uDZvGCR.exe
  2⤵
  PID:10928
- C:\Windows\System\GgrwZRe.exe
  C:\Windows\System\GgrwZRe.exe
  2⤵
  PID:10952
- C:\Windows\System\CIIILDf.exe
  C:\Windows\System\CIIILDf.exe
  2⤵
  PID:10976
- C:\Windows\System\QQJaedp.exe
  C:\Windows\System\QQJaedp.exe
  2⤵
  PID:11012
- C:\Windows\System\jDtyZhx.exe
  C:\Windows\System\jDtyZhx.exe
  2⤵
  PID:11036
- C:\Windows\System\otllIVN.exe
  C:\Windows\System\otllIVN.exe
  2⤵
  PID:11072
- C:\Windows\System\DzQWRNb.exe
  C:\Windows\System\DzQWRNb.exe
  2⤵
  PID:11100
- C:\Windows\System\hXyUWHy.exe
  C:\Windows\System\hXyUWHy.exe
  2⤵
  PID:11124
- C:\Windows\System\tpulTvQ.exe
  C:\Windows\System\tpulTvQ.exe
  2⤵
  PID:11156
- C:\Windows\System\tiYEsAO.exe
  C:\Windows\System\tiYEsAO.exe
  2⤵
  PID:11184
- C:\Windows\System\koNsOAq.exe
  C:\Windows\System\koNsOAq.exe
  2⤵
  PID:11220
- C:\Windows\System\HjZszLU.exe
  C:\Windows\System\HjZszLU.exe
  2⤵
  PID:11244
- C:\Windows\System\RksTCje.exe
  C:\Windows\System\RksTCje.exe
  2⤵
  PID:10228
- C:\Windows\System\uNyAbNZ.exe
  C:\Windows\System\uNyAbNZ.exe
  2⤵
  PID:10252
- C:\Windows\System\LWvXKaB.exe
  C:\Windows\System\LWvXKaB.exe
  2⤵
  PID:9276
- C:\Windows\System\pyeCeeS.exe
  C:\Windows\System\pyeCeeS.exe
  2⤵
  PID:10288
- C:\Windows\System\jMiJogO.exe
  C:\Windows\System\jMiJogO.exe
  2⤵
  PID:10416
- C:\Windows\System\dHkANrN.exe
  C:\Windows\System\dHkANrN.exe
  2⤵
  PID:10476
- C:\Windows\System\NFHCuiY.exe
  C:\Windows\System\NFHCuiY.exe
  2⤵
  PID:10540
- C:\Windows\System\timUkAI.exe
  C:\Windows\System\timUkAI.exe
  2⤵
  PID:10588
- C:\Windows\System\XgdxibD.exe
  C:\Windows\System\XgdxibD.exe
  2⤵
  PID:10612
- C:\Windows\System\habiVuM.exe
  C:\Windows\System\habiVuM.exe
  2⤵
  PID:10744
- C:\Windows\System\kTaBByy.exe
  C:\Windows\System\kTaBByy.exe
  2⤵
  PID:10736
- C:\Windows\System\HCCWGCm.exe
  C:\Windows\System\HCCWGCm.exe
  2⤵
  PID:10872
- C:\Windows\System\hpjNHiA.exe
  C:\Windows\System\hpjNHiA.exe
  2⤵
  PID:2436
- C:\Windows\System\fyDVvvg.exe
  C:\Windows\System\fyDVvvg.exe
  2⤵
  PID:11004
- C:\Windows\System\DBvRlqM.exe
  C:\Windows\System\DBvRlqM.exe
  2⤵
  PID:11028
- C:\Windows\System\YyXbfdU.exe
  C:\Windows\System\YyXbfdU.exe
  2⤵
  PID:11084
- C:\Windows\System\lLLqPZW.exe
  C:\Windows\System\lLLqPZW.exe
  2⤵
  PID:11120
- C:\Windows\System\zuovYOw.exe
  C:\Windows\System\zuovYOw.exe
  2⤵
  PID:11232
- C:\Windows\System\hbuiasi.exe
  C:\Windows\System\hbuiasi.exe
  2⤵
  PID:9688
- C:\Windows\System\kCxQyiO.exe
  C:\Windows\System\kCxQyiO.exe
  2⤵
  PID:10244
- C:\Windows\System\krzICYu.exe
  C:\Windows\System\krzICYu.exe
  2⤵
  PID:10316
- C:\Windows\System\EkMSYAz.exe
  C:\Windows\System\EkMSYAz.exe
  2⤵
  PID:10660
- C:\Windows\System\LpMuGuB.exe
  C:\Windows\System\LpMuGuB.exe
  2⤵
  PID:10700
- C:\Windows\System\ALUMxTm.exe
  C:\Windows\System\ALUMxTm.exe
  2⤵
  PID:10972
- C:\Windows\System\zYWCVui.exe
  C:\Windows\System\zYWCVui.exe
  2⤵
  PID:11024
- C:\Windows\System\yVSjFcH.exe
  C:\Windows\System\yVSjFcH.exe
  2⤵
  PID:11208
- C:\Windows\System\mreUCVN.exe
  C:\Windows\System\mreUCVN.exe
  2⤵
  PID:9256
- C:\Windows\System\jbNuMhX.exe
  C:\Windows\System\jbNuMhX.exe
  2⤵
  PID:10468
- C:\Windows\System\JCmpMhk.exe
  C:\Windows\System\JCmpMhk.exe
  2⤵
  PID:10800
- C:\Windows\System\rhUYpiM.exe
  C:\Windows\System\rhUYpiM.exe
  2⤵
  PID:10988
- C:\Windows\System\kUwTbze.exe
  C:\Windows\System\kUwTbze.exe
  2⤵
  PID:10768
- C:\Windows\System\JJuwGvP.exe
  C:\Windows\System\JJuwGvP.exe
  2⤵
  PID:11272
- C:\Windows\System\KbHbMhn.exe
  C:\Windows\System\KbHbMhn.exe
  2⤵
  PID:11304
- C:\Windows\System\hMjiVIe.exe
  C:\Windows\System\hMjiVIe.exe
  2⤵
  PID:11332
- C:\Windows\System\UyxtKFB.exe
  C:\Windows\System\UyxtKFB.exe
  2⤵
  PID:11372
- C:\Windows\System\qNoEqJF.exe
  C:\Windows\System\qNoEqJF.exe
  2⤵
  PID:11396
- C:\Windows\System\vqDCMEX.exe
  C:\Windows\System\vqDCMEX.exe
  2⤵
  PID:11428
- C:\Windows\System\ZgjxqpU.exe
  C:\Windows\System\ZgjxqpU.exe
  2⤵
  PID:11460
- C:\Windows\System\bftBtwF.exe
  C:\Windows\System\bftBtwF.exe
  2⤵
  PID:11492
- C:\Windows\System\oOHFlKJ.exe
  C:\Windows\System\oOHFlKJ.exe
  2⤵
  PID:11536
- C:\Windows\System\jFmDxHw.exe
  C:\Windows\System\jFmDxHw.exe
  2⤵
  PID:11552
- C:\Windows\System\pOLRcYM.exe
  C:\Windows\System\pOLRcYM.exe
  2⤵
  PID:11572
- C:\Windows\System\HCeNwQb.exe
  C:\Windows\System\HCeNwQb.exe
  2⤵
  PID:11600
- C:\Windows\System\QUVKRET.exe
  C:\Windows\System\QUVKRET.exe
  2⤵
  PID:11628
- C:\Windows\System\MZDUDZY.exe
  C:\Windows\System\MZDUDZY.exe
  2⤵
  PID:11648
- C:\Windows\System\NuvwfLm.exe
  C:\Windows\System\NuvwfLm.exe
  2⤵
  PID:11680
- C:\Windows\System\wMJPbfU.exe
  C:\Windows\System\wMJPbfU.exe
  2⤵
  PID:11704
- C:\Windows\System\wkidbDK.exe
  C:\Windows\System\wkidbDK.exe
  2⤵
  PID:11736
- C:\Windows\System\hcomIwv.exe
  C:\Windows\System\hcomIwv.exe
  2⤵
  PID:11756
- C:\Windows\System\kihbANd.exe
  C:\Windows\System\kihbANd.exe
  2⤵
  PID:11776
- C:\Windows\System\bLhzyZQ.exe
  C:\Windows\System\bLhzyZQ.exe
  2⤵
  PID:11796
- C:\Windows\System\tjpxltx.exe
  C:\Windows\System\tjpxltx.exe
  2⤵
  PID:11812
- C:\Windows\System\MvWLKku.exe
  C:\Windows\System\MvWLKku.exe
  2⤵
  PID:11840
- C:\Windows\System\xpERuwj.exe
  C:\Windows\System\xpERuwj.exe
  2⤵
  PID:11872
- C:\Windows\System\DkxfjQq.exe
  C:\Windows\System\DkxfjQq.exe
  2⤵
  PID:11904
- C:\Windows\System\SkITkYL.exe
  C:\Windows\System\SkITkYL.exe
  2⤵
  PID:11940
- C:\Windows\System\iApOHHb.exe
  C:\Windows\System\iApOHHb.exe
  2⤵
  PID:11976
- C:\Windows\System\LxguIgD.exe
  C:\Windows\System\LxguIgD.exe
  2⤵
  PID:12016
- C:\Windows\System\hTSrUey.exe
  C:\Windows\System\hTSrUey.exe
  2⤵
  PID:12048
- C:\Windows\System\iDlZJki.exe
  C:\Windows\System\iDlZJki.exe
  2⤵
  PID:12064
- C:\Windows\System\WAVXdvd.exe
  C:\Windows\System\WAVXdvd.exe
  2⤵
  PID:12080
- C:\Windows\System\zQGyXXu.exe
  C:\Windows\System\zQGyXXu.exe
  2⤵
  PID:12104
- C:\Windows\System\QjhlrGg.exe
  C:\Windows\System\QjhlrGg.exe
  2⤵
  PID:12144
- C:\Windows\System\hDtVBUQ.exe
  C:\Windows\System\hDtVBUQ.exe
  2⤵
  PID:12176
- C:\Windows\System\wFBrnrC.exe
  C:\Windows\System\wFBrnrC.exe
  2⤵
  PID:12212
- C:\Windows\System\IxuQtte.exe
  C:\Windows\System\IxuQtte.exe
  2⤵
  PID:12240
- C:\Windows\System\tzRCguR.exe
  C:\Windows\System\tzRCguR.exe
  2⤵
  PID:12260
- C:\Windows\System\mmzgPRg.exe
  C:\Windows\System\mmzgPRg.exe
  2⤵
  PID:12276
- C:\Windows\System\PIDbXPy.exe
  C:\Windows\System\PIDbXPy.exe
  2⤵
  PID:9864
- C:\Windows\System\LHPqLeB.exe
  C:\Windows\System\LHPqLeB.exe
  2⤵
  PID:11284
- C:\Windows\System\qgXBQLr.exe
  C:\Windows\System\qgXBQLr.exe
  2⤵
  PID:11328
- C:\Windows\System\uumRsQq.exe
  C:\Windows\System\uumRsQq.exe
  2⤵
  PID:11472
- C:\Windows\System\UchZLdj.exe
  C:\Windows\System\UchZLdj.exe
  2⤵
  PID:11548
- C:\Windows\System\TMrXDoW.exe
  C:\Windows\System\TMrXDoW.exe
  2⤵
  PID:11596
- C:\Windows\System\CnFNesW.exe
  C:\Windows\System\CnFNesW.exe
  2⤵
  PID:11744
- C:\Windows\System\XfBJNtI.exe
  C:\Windows\System\XfBJNtI.exe
  2⤵
  PID:11788
- C:\Windows\System\qEMDgad.exe
  C:\Windows\System\qEMDgad.exe
  2⤵
  PID:11764
- C:\Windows\System\gTKvGFm.exe
  C:\Windows\System\gTKvGFm.exe
  2⤵
  PID:11892
- C:\Windows\System\EMmLSFI.exe
  C:\Windows\System\EMmLSFI.exe
  2⤵
  PID:11984
- C:\Windows\System\iPJqurV.exe
  C:\Windows\System\iPJqurV.exe
  2⤵
  PID:12036
- C:\Windows\System\RibVjrI.exe
  C:\Windows\System\RibVjrI.exe
  2⤵
  PID:12072
- C:\Windows\System\HfVcfsA.exe
  C:\Windows\System\HfVcfsA.exe
  2⤵
  PID:12208
- C:\Windows\System\QZzAjqt.exe
  C:\Windows\System\QZzAjqt.exe
  2⤵
  PID:12252
- C:\Windows\System\EXjCkrd.exe
  C:\Windows\System\EXjCkrd.exe
  2⤵
  PID:11096
- C:\Windows\System\ulFdzmh.exe
  C:\Windows\System\ulFdzmh.exe
  2⤵
  PID:11380
- C:\Windows\System\queniVp.exe
  C:\Windows\System\queniVp.exe
  2⤵
  PID:11612
- C:\Windows\System\etowpsj.exe
  C:\Windows\System\etowpsj.exe
  2⤵
  PID:11732
- C:\Windows\System\KsoFjpp.exe
  C:\Windows\System\KsoFjpp.exe
  2⤵
  PID:11724
- C:\Windows\System\UVUzZkL.exe
  C:\Windows\System\UVUzZkL.exe
  2⤵
  PID:11884
- C:\Windows\System\JERSuDr.exe
  C:\Windows\System\JERSuDr.exe
  2⤵
  PID:12100
- C:\Windows\System\iGugcSX.exe
  C:\Windows\System\iGugcSX.exe
  2⤵
  PID:12140
- C:\Windows\System\LrcdGwy.exe
  C:\Windows\System\LrcdGwy.exe
  2⤵
  PID:11364
- C:\Windows\System\IOMGeGM.exe
  C:\Windows\System\IOMGeGM.exe
  2⤵
  PID:11480
- C:\Windows\System\DuNFXVa.exe
  C:\Windows\System\DuNFXVa.exe
  2⤵
  PID:11936
- C:\Windows\System\QKUwGZO.exe
  C:\Windows\System\QKUwGZO.exe
  2⤵
  PID:12320
- C:\Windows\System\YsBnSQW.exe
  C:\Windows\System\YsBnSQW.exe
  2⤵
  PID:12340
- C:\Windows\System\pukLyck.exe
  C:\Windows\System\pukLyck.exe
  2⤵
  PID:12392
- C:\Windows\System\OgPISKf.exe
  C:\Windows\System\OgPISKf.exe
  2⤵
  PID:12412
- C:\Windows\System\FkTZcEO.exe
  C:\Windows\System\FkTZcEO.exe
  2⤵
  PID:12428
- C:\Windows\System\zbeTtDe.exe
  C:\Windows\System\zbeTtDe.exe
  2⤵
  PID:12460
- C:\Windows\System\vUFYVeB.exe
  C:\Windows\System\vUFYVeB.exe
  2⤵
  PID:12496
- C:\Windows\System\PKuipjd.exe
  C:\Windows\System\PKuipjd.exe
  2⤵
  PID:12524
- C:\Windows\System\PmwXfyc.exe
  C:\Windows\System\PmwXfyc.exe
  2⤵
  PID:12568
- C:\Windows\System\IznLZjf.exe
  C:\Windows\System\IznLZjf.exe
  2⤵
  PID:12588
- C:\Windows\System\KJLNhZo.exe
  C:\Windows\System\KJLNhZo.exe
  2⤵
  PID:12624
- C:\Windows\System\gzsDyVk.exe
  C:\Windows\System\gzsDyVk.exe
  2⤵
  PID:12652
- C:\Windows\System\yikTEWB.exe
  C:\Windows\System\yikTEWB.exe
  2⤵
  PID:12680
- C:\Windows\System\qJsjQAJ.exe
  C:\Windows\System\qJsjQAJ.exe
  2⤵
  PID:12708
- C:\Windows\System\gInmvyq.exe
  C:\Windows\System\gInmvyq.exe
  2⤵
  PID:12736
- C:\Windows\System\XBnpRdj.exe
  C:\Windows\System\XBnpRdj.exe
  2⤵
  PID:12752
- C:\Windows\System\mJMayZq.exe
  C:\Windows\System\mJMayZq.exe
  2⤵
  PID:12776
- C:\Windows\System\QzrpBxm.exe
  C:\Windows\System\QzrpBxm.exe
  2⤵
  PID:12800
- C:\Windows\System\RcsVNEN.exe
  C:\Windows\System\RcsVNEN.exe
  2⤵
  PID:12824
- C:\Windows\System\fDZbixd.exe
  C:\Windows\System\fDZbixd.exe
  2⤵
  PID:12848
- C:\Windows\System\uaSFYyb.exe
  C:\Windows\System\uaSFYyb.exe
  2⤵
  PID:12864
- C:\Windows\System\yzgLumC.exe
  C:\Windows\System\yzgLumC.exe
  2⤵
  PID:12892
- C:\Windows\System\rkphRtL.exe
  C:\Windows\System\rkphRtL.exe
  2⤵
  PID:12916
- C:\Windows\System\bkmSQAP.exe
  C:\Windows\System\bkmSQAP.exe
  2⤵
  PID:12936
- C:\Windows\System\lcYUhLJ.exe
  C:\Windows\System\lcYUhLJ.exe
  2⤵
  PID:12964
- C:\Windows\System\PrDzzYS.exe
  C:\Windows\System\PrDzzYS.exe
  2⤵
  PID:12984
- C:\Windows\System\ssEppCX.exe
  C:\Windows\System\ssEppCX.exe
  2⤵
  PID:13008
- C:\Windows\System\cmFZGVl.exe
  C:\Windows\System\cmFZGVl.exe
  2⤵
  PID:13036
- C:\Windows\System\mJDpYLb.exe
  C:\Windows\System\mJDpYLb.exe
  2⤵
  PID:13064
- C:\Windows\System\NkuOPUl.exe
  C:\Windows\System\NkuOPUl.exe
  2⤵
  PID:13096
- C:\Windows\System\UUevvOZ.exe
  C:\Windows\System\UUevvOZ.exe
  2⤵
  PID:13132
- C:\Windows\System\loFIESz.exe
  C:\Windows\System\loFIESz.exe
  2⤵
  PID:13152
- C:\Windows\System\tfegAvK.exe
  C:\Windows\System\tfegAvK.exe
  2⤵
  PID:13184
- C:\Windows\System\eRZpcBb.exe
  C:\Windows\System\eRZpcBb.exe
  2⤵
  PID:13212
- C:\Windows\System\jVmupgF.exe
  C:\Windows\System\jVmupgF.exe
  2⤵
  PID:13232
- C:\Windows\System\PdJomtU.exe
  C:\Windows\System\PdJomtU.exe
  2⤵
  PID:13264
- C:\Windows\System\qyYpbTU.exe
  C:\Windows\System\qyYpbTU.exe
  2⤵
  PID:13292
- C:\Windows\System\cmuofrr.exe
  C:\Windows\System\cmuofrr.exe
  2⤵
  PID:12228
- C:\Windows\System\bQBeSlV.exe
  C:\Windows\System\bQBeSlV.exe
  2⤵
  PID:12224
- C:\Windows\System\UWtfSPs.exe
  C:\Windows\System\UWtfSPs.exe
  2⤵
  PID:12348
- C:\Windows\System\YoIGyCj.exe
  C:\Windows\System\YoIGyCj.exe
  2⤵
  PID:12448
- C:\Windows\System\mkSaQop.exe
  C:\Windows\System\mkSaQop.exe
  2⤵
  PID:12508
- C:\Windows\System\EntAGze.exe
  C:\Windows\System\EntAGze.exe
  2⤵
  PID:12576
- C:\Windows\System\SriRvoo.exe
  C:\Windows\System\SriRvoo.exe
  2⤵
  PID:12596
- C:\Windows\System\HGpcxvj.exe
  C:\Windows\System\HGpcxvj.exe
  2⤵
  PID:12696
- C:\Windows\System\hZvpQCr.exe
  C:\Windows\System\hZvpQCr.exe
  2⤵
  PID:12764
- C:\Windows\System\hTIPIsz.exe
  C:\Windows\System\hTIPIsz.exe
  2⤵
  PID:12784
- C:\Windows\System\bGsRrjW.exe
  C:\Windows\System\bGsRrjW.exe
  2⤵
  PID:12876
- C:\Windows\System\yUzHGbs.exe
  C:\Windows\System\yUzHGbs.exe
  2⤵
  PID:12932
- C:\Windows\System\iuHEXiA.exe
  C:\Windows\System\iuHEXiA.exe
  2⤵
  PID:12972
- C:\Windows\System\QfXHUSc.exe
  C:\Windows\System\QfXHUSc.exe
  2⤵
  PID:13092
- C:\Windows\System\ccFwsVw.exe
  C:\Windows\System\ccFwsVw.exe
  2⤵
  PID:13108
- C:\Windows\System\tKROmVd.exe
  C:\Windows\System\tKROmVd.exe
  2⤵
  PID:13168
- C:\Windows\System\pGgxagY.exe
  C:\Windows\System\pGgxagY.exe
  2⤵
  PID:13300
- C:\Windows\System\qotQUeV.exe
  C:\Windows\System\qotQUeV.exe
  2⤵
  PID:12204
- C:\Windows\System\YyMDkYZ.exe
  C:\Windows\System\YyMDkYZ.exe
  2⤵
  PID:13252
- C:\Windows\System\TKazjxu.exe
  C:\Windows\System\TKazjxu.exe
  2⤵
  PID:12420
- C:\Windows\System\KoTdbXK.exe
  C:\Windows\System\KoTdbXK.exe
  2⤵
  PID:12644
- C:\Windows\System\PMycGPu.exe
  C:\Windows\System\PMycGPu.exe
  2⤵
  PID:12908
- C:\Windows\System\qXjJmIQ.exe
  C:\Windows\System\qXjJmIQ.exe
  2⤵
  PID:12812
- C:\Windows\System\FgqbCIC.exe
  C:\Windows\System\FgqbCIC.exe
  2⤵
  PID:12928
- C:\Windows\System\hIYSnNu.exe
  C:\Windows\System\hIYSnNu.exe
  2⤵
  PID:13024
- C:\Windows\System\hqQZvet.exe
  C:\Windows\System\hqQZvet.exe
  2⤵
  PID:13280
- C:\Windows\System\CqppWEL.exe
  C:\Windows\System\CqppWEL.exe
  2⤵
  PID:12384
- C:\Windows\System\mIOsABe.exe
  C:\Windows\System\mIOsABe.exe
  2⤵
  PID:13328
- C:\Windows\System\TmrJraH.exe
  C:\Windows\System\TmrJraH.exe
  2⤵
  PID:13360
- C:\Windows\System\WXVCgzw.exe
  C:\Windows\System\WXVCgzw.exe
  2⤵
  PID:13388
- C:\Windows\System\coZkjOs.exe
  C:\Windows\System\coZkjOs.exe
  2⤵
  PID:13408
- C:\Windows\System\idOkMby.exe
  C:\Windows\System\idOkMby.exe
  2⤵
  PID:13436
- C:\Windows\System\ONPYaIn.exe
  C:\Windows\System\ONPYaIn.exe
  2⤵
  PID:13468
- C:\Windows\System\IzYECja.exe
  C:\Windows\System\IzYECja.exe
  2⤵
  PID:13496
- C:\Windows\System\fyVEwph.exe
  C:\Windows\System\fyVEwph.exe
  2⤵
  PID:13520
- C:\Windows\System\oqhvAGk.exe
  C:\Windows\System\oqhvAGk.exe
  2⤵
  PID:13556
- C:\Windows\System\jTTryio.exe
  C:\Windows\System\jTTryio.exe
  2⤵
  PID:13584
- C:\Windows\System\LjJuDbN.exe
  C:\Windows\System\LjJuDbN.exe
  2⤵
  PID:13604
- C:\Windows\System\cQAyYFw.exe
  C:\Windows\System\cQAyYFw.exe
  2⤵
  PID:13640
- C:\Windows\System\VUKABZq.exe
  C:\Windows\System\VUKABZq.exe
  2⤵
  PID:13672
- C:\Windows\System\yDMmufw.exe
  C:\Windows\System\yDMmufw.exe
  2⤵
  PID:13700
- C:\Windows\System\RDCJHVT.exe
  C:\Windows\System\RDCJHVT.exe
  2⤵
  PID:13736
- C:\Windows\System\ogYtVsq.exe
  C:\Windows\System\ogYtVsq.exe
  2⤵
  PID:13756
- C:\Windows\System\lDezwOY.exe
  C:\Windows\System\lDezwOY.exe
  2⤵
  PID:13784
- C:\Windows\System\iujVdYQ.exe
  C:\Windows\System\iujVdYQ.exe
  2⤵
  PID:13812
- C:\Windows\System\jTsjSVa.exe
  C:\Windows\System\jTsjSVa.exe
  2⤵
  PID:13844
- C:\Windows\System\LpwdXbK.exe
  C:\Windows\System\LpwdXbK.exe
  2⤵
  PID:13868
- C:\Windows\System\PxEPPbt.exe
  C:\Windows\System\PxEPPbt.exe
  2⤵
  PID:13892
- C:\Windows\System\IjOLZhf.exe
  C:\Windows\System\IjOLZhf.exe
  2⤵
  PID:13920
- C:\Windows\System\gRyhMth.exe
  C:\Windows\System\gRyhMth.exe
  2⤵
  PID:13952
- C:\Windows\System\JqQabNc.exe
  C:\Windows\System\JqQabNc.exe
  2⤵
  PID:13976
- C:\Windows\System\whuuHRb.exe
  C:\Windows\System\whuuHRb.exe
  2⤵
  PID:13996
- C:\Windows\System\fQWmjFg.exe
  C:\Windows\System\fQWmjFg.exe
  2⤵
  PID:14024
- C:\Windows\System\JfEIxxJ.exe
  C:\Windows\System\JfEIxxJ.exe
  2⤵
  PID:14060
- C:\Windows\System\BjgyIaT.exe
  C:\Windows\System\BjgyIaT.exe
  2⤵
  PID:14088
- C:\Windows\System\rehOeFi.exe
  C:\Windows\System\rehOeFi.exe
  2⤵
  PID:14132
- C:\Windows\System\dRxOYnB.exe
  C:\Windows\System\dRxOYnB.exe
  2⤵
  PID:14148
- C:\Windows\System\IMNcjXm.exe
  C:\Windows\System\IMNcjXm.exe
  2⤵
  PID:14180
- C:\Windows\System\yLPmKym.exe
  C:\Windows\System\yLPmKym.exe
  2⤵
  PID:14200
- C:\Windows\System\zIJUnWc.exe
  C:\Windows\System\zIJUnWc.exe
  2⤵
  PID:14232
- C:\Windows\System\ueKVTQL.exe
  C:\Windows\System\ueKVTQL.exe
  2⤵
  PID:14252
- C:\Windows\System\cnrCoxd.exe
  C:\Windows\System\cnrCoxd.exe
  2⤵
  PID:14268
- C:\Windows\System\zmarCDl.exe
  C:\Windows\System\zmarCDl.exe
  2⤵
  PID:14312
- C:\Windows\System\yEakHsx.exe
  C:\Windows\System\yEakHsx.exe
  2⤵
  PID:12728
- C:\Windows\System\auryCHG.exe
  C:\Windows\System\auryCHG.exe
  2⤵
  PID:12608
- C:\Windows\System\liirMJI.exe
  C:\Windows\System\liirMJI.exe
  2⤵
  PID:13352
- C:\Windows\System\YokYGXN.exe
  C:\Windows\System\YokYGXN.exe
  2⤵
  PID:12032
- C:\Windows\System\kQMReLf.exe
  C:\Windows\System\kQMReLf.exe
  2⤵
  PID:13448
- C:\Windows\System\oCSHSZz.exe
  C:\Windows\System\oCSHSZz.exe
  2⤵
  PID:13532
- C:\Windows\System\npBbaSa.exe
  C:\Windows\System\npBbaSa.exe
  2⤵
  PID:13508
- C:\Windows\System\nTyhqvD.exe
  C:\Windows\System\nTyhqvD.exe
  2⤵
  PID:13688
- C:\Windows\System\oQVzBum.exe
  C:\Windows\System\oQVzBum.exe
  2⤵
  PID:13684
- C:\Windows\System\jInnKzl.exe
  C:\Windows\System\jInnKzl.exe
  2⤵
  PID:13656
- C:\Windows\System\wCpFDNg.exe
  C:\Windows\System\wCpFDNg.exe
  2⤵
  PID:13832
- C:\Windows\System\Kvfnyys.exe
  C:\Windows\System\Kvfnyys.exe
  2⤵
  PID:13856
- C:\Windows\System\qUCdabI.exe
  C:\Windows\System\qUCdabI.exe
  2⤵
  PID:13968
- C:\Windows\System\aHmKlRh.exe
  C:\Windows\System\aHmKlRh.exe
  2⤵
  PID:14056
- C:\Windows\System\SPHFfKe.exe
  C:\Windows\System\SPHFfKe.exe
  2⤵
  PID:14124
- C:\Windows\System\DuixlBF.exe
  C:\Windows\System\DuixlBF.exe
  2⤵
  PID:14172
- C:\Windows\System\WiSoZgP.exe
  C:\Windows\System\WiSoZgP.exe
  2⤵
  PID:14224
- C:\Windows\System\Xsbqnjf.exe
  C:\Windows\System\Xsbqnjf.exe
  2⤵
  PID:14228
- C:\Windows\System\LzvQUhI.exe
  C:\Windows\System\LzvQUhI.exe
  2⤵
  PID:13344
- C:\Windows\System\hWFbHfc.exe
  C:\Windows\System\hWFbHfc.exe
  2⤵
  PID:11932
- C:\Windows\System\BLbswYp.exe
  C:\Windows\System\BLbswYp.exe
  2⤵
  PID:13308
- C:\Windows\System\yzOMwSp.exe
  C:\Windows\System\yzOMwSp.exe
  2⤵
  PID:13824
- C:\Windows\System\uWEBZjr.exe
  C:\Windows\System\uWEBZjr.exe
  2⤵
  PID:14144
- C:\Windows\System\ovrjxcQ.exe
  C:\Windows\System\ovrjxcQ.exe
  2⤵
  PID:13972
- C:\Windows\System\nkySHuM.exe
  C:\Windows\System\nkySHuM.exe
  2⤵
  PID:14292
- C:\Windows\System\rKqwUNO.exe
  C:\Windows\System\rKqwUNO.exe
  2⤵
  PID:14332
- C:\Windows\System\fjyJfdm.exe
  C:\Windows\System\fjyJfdm.exe
  2⤵
  PID:13492
- C:\Windows\System\woWlnNR.exe
  C:\Windows\System\woWlnNR.exe
  2⤵
  PID:13912
- C:\Windows\System\ciHNtAH.exe
  C:\Windows\System\ciHNtAH.exe
  2⤵
  PID:14352
- C:\Windows\System\JKaXlJL.exe
  C:\Windows\System\JKaXlJL.exe
  2⤵
  PID:14380
- C:\Windows\System\PfiFErR.exe
  C:\Windows\System\PfiFErR.exe
  2⤵
  PID:14408
- C:\Windows\System\qZdlWSu.exe
  C:\Windows\System\qZdlWSu.exe
  2⤵
  PID:14452
- C:\Windows\System\OAVCxug.exe
  C:\Windows\System\OAVCxug.exe
  2⤵
  PID:14468
- C:\Windows\System\ZQhiLjc.exe
  C:\Windows\System\ZQhiLjc.exe
  2⤵
  PID:14496
- C:\Windows\System\yXayaLw.exe
  C:\Windows\System\yXayaLw.exe
  2⤵
  PID:14528
- C:\Windows\System\btHpxFP.exe
  C:\Windows\System\btHpxFP.exe
  2⤵
  PID:14556
- C:\Windows\System\GWQgQFQ.exe
  C:\Windows\System\GWQgQFQ.exe
  2⤵
  PID:14584
- C:\Windows\System\NtYgwxG.exe
  C:\Windows\System\NtYgwxG.exe
  2⤵
  PID:14616
- C:\Windows\System\Uorqhis.exe
  C:\Windows\System\Uorqhis.exe
  2⤵
  PID:14644
- C:\Windows\System\ZWhTdTw.exe
  C:\Windows\System\ZWhTdTw.exe
  2⤵
  PID:14664
- C:\Windows\System\jZElsMc.exe
  C:\Windows\System\jZElsMc.exe
  2⤵
  PID:14692
- C:\Windows\System\bKrbbZr.exe
  C:\Windows\System\bKrbbZr.exe
  2⤵
  PID:14724
- C:\Windows\System\PfGFVXx.exe
  C:\Windows\System\PfGFVXx.exe
  2⤵
  PID:14748
- C:\Windows\System\IMsAlLH.exe
  C:\Windows\System\IMsAlLH.exe
  2⤵
  PID:14780
- C:\Windows\System\dymJNVj.exe
  C:\Windows\System\dymJNVj.exe
  2⤵
  PID:14800
- C:\Windows\System\TvMNdIw.exe
  C:\Windows\System\TvMNdIw.exe
  2⤵
  PID:14820
- C:\Windows\System\doYdtLV.exe
  C:\Windows\System\doYdtLV.exe
  2⤵
  PID:14852
- C:\Windows\System\wjcxPUa.exe
  C:\Windows\System\wjcxPUa.exe
  2⤵
  PID:14888
- C:\Windows\System\UaFdscY.exe
  C:\Windows\System\UaFdscY.exe
  2⤵
  PID:14908
- C:\Windows\System\ClGZzzk.exe
  C:\Windows\System\ClGZzzk.exe
  2⤵
  PID:14940
- C:\Windows\System\tnRCFPO.exe
  C:\Windows\System\tnRCFPO.exe
  2⤵
  PID:14960
- C:\Windows\System\ZWFCPKE.exe
  C:\Windows\System\ZWFCPKE.exe
  2⤵
  PID:14980
- C:\Windows\System\BrRaTOC.exe
  C:\Windows\System\BrRaTOC.exe
  2⤵
  PID:15004
- C:\Windows\System\msCCpip.exe
  C:\Windows\System\msCCpip.exe
  2⤵
  PID:15032
- C:\Windows\System\iJcbiVN.exe
  C:\Windows\System\iJcbiVN.exe
  2⤵
  PID:15056
- C:\Windows\System\LxhERde.exe
  C:\Windows\System\LxhERde.exe
  2⤵
  PID:15084
- C:\Windows\System\jmzypvv.exe
  C:\Windows\System\jmzypvv.exe
  2⤵
  PID:15112
- C:\Windows\System\ybHLYAl.exe
  C:\Windows\System\ybHLYAl.exe
  2⤵
  PID:15136
- C:\Windows\System\QWmLrDL.exe
  C:\Windows\System\QWmLrDL.exe
  2⤵
  PID:15332
- C:\Windows\System\qdeYhzw.exe
  C:\Windows\System\qdeYhzw.exe
  2⤵
  PID:15348
- C:\Windows\System\mhrSSYa.exe
  C:\Windows\System\mhrSSYa.exe
  2⤵
  PID:13140
- C:\Windows\System\yCmJsfu.exe
  C:\Windows\System\yCmJsfu.exe
  2⤵
  PID:13320
- C:\Windows\System\kEtMEXA.exe
  C:\Windows\System\kEtMEXA.exe
  2⤵
  PID:14052
- C:\Windows\System\lDNrBHH.exe
  C:\Windows\System\lDNrBHH.exe
  2⤵
  PID:14552
- C:\Windows\System\tNpaxek.exe
  C:\Windows\System\tNpaxek.exe
  2⤵
  PID:14440
- C:\Windows\System\SATxlaN.exe
  C:\Windows\System\SATxlaN.exe
  2⤵
  PID:14548
- C:\Windows\System\coYZxcc.exe
  C:\Windows\System\coYZxcc.exe
  2⤵
  PID:14680
- C:\Windows\System\vMjloxs.exe
  C:\Windows\System\vMjloxs.exe
  2⤵
  PID:14628
- C:\Windows\System\cVCtRLL.exe
  C:\Windows\System\cVCtRLL.exe
  2⤵
  PID:14760
- C:\Windows\System\GtvnFmC.exe
  C:\Windows\System\GtvnFmC.exe
  2⤵
  PID:14788
- C:\Windows\System\ddFlbVY.exe
  C:\Windows\System\ddFlbVY.exe
  2⤵
  PID:14956
- C:\Windows\System\pfZbVBR.exe
  C:\Windows\System\pfZbVBR.exe
  2⤵
  PID:14992
- C:\Windows\System\TENBCdM.exe
  C:\Windows\System\TENBCdM.exe
  2⤵
  PID:14972
- C:\Windows\System\yfVHKtI.exe
  C:\Windows\System\yfVHKtI.exe
  2⤵
  PID:14952
- C:\Windows\System\NjlxCNi.exe
  C:\Windows\System\NjlxCNi.exe
  2⤵
  PID:15028
- C:\Windows\System\oPJhpqU.exe
  C:\Windows\System\oPJhpqU.exe
  2⤵
  PID:15132
- C:\Windows\System\eNDMkVw.exe
  C:\Windows\System\eNDMkVw.exe
  2⤵
  PID:15220
- C:\Windows\System\pcczgdY.exe
  C:\Windows\System\pcczgdY.exe
  2⤵
  PID:15320
- C:\Windows\System\HmQjeGi.exe
  C:\Windows\System\HmQjeGi.exe
  2⤵
  PID:14464
- C:\Windows\System\WBKfVrm.exe
  C:\Windows\System\WBKfVrm.exe
  2⤵
  PID:14436
- C:\Windows\System\Xkodyws.exe
  C:\Windows\System\Xkodyws.exe
  2⤵
  PID:14660
- C:\Windows\System\KUsQbka.exe
  C:\Windows\System\KUsQbka.exe
  2⤵
  PID:14772
- C:\Windows\System\FDjmzLs.exe
  C:\Windows\System\FDjmzLs.exe
  2⤵
  PID:15040
- C:\Windows\System\ZsnLseI.exe
  C:\Windows\System\ZsnLseI.exe
  2⤵
  PID:14816
- C:\Windows\System\wZlPciE.exe
  C:\Windows\System\wZlPciE.exe
  2⤵
  PID:13964
- C:\Windows\System\MkNPyNO.exe
  C:\Windows\System\MkNPyNO.exe
  2⤵
  PID:15124
- C:\Windows\System\ULelEoG.exe
  C:\Windows\System\ULelEoG.exe
  2⤵
  PID:14428
- C:\Windows\System\vvFuHOY.exe
  C:\Windows\System\vvFuHOY.exe
  2⤵
  PID:14076
- C:\Windows\System\JfewINw.exe
  C:\Windows\System\JfewINw.exe
  2⤵
  PID:14572
- C:\Windows\System\rgjYgwa.exe
  C:\Windows\System\rgjYgwa.exe
  2⤵
  PID:15388
- C:\Windows\System\Wsazeya.exe
  C:\Windows\System\Wsazeya.exe
  2⤵
  PID:15416
- C:\Windows\System\upHwkmC.exe
  C:\Windows\System\upHwkmC.exe
  2⤵
  PID:15440
- C:\Windows\System\YqJoCdz.exe
  C:\Windows\System\YqJoCdz.exe
  2⤵
  PID:15484
- C:\Windows\System\RNUYgop.exe
  C:\Windows\System\RNUYgop.exe
  2⤵
  PID:15512
- C:\Windows\System\jhboFbp.exe
  C:\Windows\System\jhboFbp.exe
  2⤵
  PID:15544
- C:\Windows\System\GPHshUU.exe
  C:\Windows\System\GPHshUU.exe
  2⤵
  PID:15576
- C:\Windows\System\sqXQrqE.exe
  C:\Windows\System\sqXQrqE.exe
  2⤵
  PID:15604
- C:\Windows\System\SUFijtd.exe
  C:\Windows\System\SUFijtd.exe
  2⤵
  PID:15632
- C:\Windows\System\WHppUJd.exe
  C:\Windows\System\WHppUJd.exe
  2⤵
  PID:15660
- C:\Windows\System\FGOxrYw.exe
  C:\Windows\System\FGOxrYw.exe
  2⤵
  PID:15684
- C:\Windows\System\pnpgjGk.exe
  C:\Windows\System\pnpgjGk.exe
  2⤵
  PID:15732
- C:\Windows\System\fuQcPIP.exe
  C:\Windows\System\fuQcPIP.exe
  2⤵
  PID:15752
- C:\Windows\System\vrpDluG.exe
  C:\Windows\System\vrpDluG.exe
  2⤵
  PID:15784
- C:\Windows\System\zdZtWoN.exe
  C:\Windows\System\zdZtWoN.exe
  2⤵
  PID:15812
- C:\Windows\System\YpedXEF.exe
  C:\Windows\System\YpedXEF.exe
  2⤵
  PID:15832
- C:\Windows\System\RmYRwZW.exe
  C:\Windows\System\RmYRwZW.exe
  2⤵
  PID:15860
- C:\Windows\System\iYJjPMn.exe
  C:\Windows\System\iYJjPMn.exe
  2⤵
  PID:15888
- C:\Windows\System\ckBYfzO.exe
  C:\Windows\System\ckBYfzO.exe
  2⤵
  PID:15912
- C:\Windows\System\eykRlfh.exe
  C:\Windows\System\eykRlfh.exe
  2⤵
  PID:15936
- C:\Windows\System\IGIsXFW.exe
  C:\Windows\System\IGIsXFW.exe
  2⤵
  PID:15952
- C:\Windows\System\qAFSRCq.exe
  C:\Windows\System\qAFSRCq.exe
  2⤵
  PID:15980
- C:\Windows\System\SyjXunf.exe
  C:\Windows\System\SyjXunf.exe
  2⤵
  PID:16016
- C:\Windows\System\fhLadvW.exe
  C:\Windows\System\fhLadvW.exe
  2⤵
  PID:16036
- C:\Windows\System\SaYAhgd.exe
  C:\Windows\System\SaYAhgd.exe
  2⤵
  PID:16060
- C:\Windows\System\gdeAVYU.exe
  C:\Windows\System\gdeAVYU.exe
  2⤵
  PID:16092
- C:\Windows\System\whLNUsd.exe
  C:\Windows\System\whLNUsd.exe
  2⤵
  PID:16124
- C:\Windows\System\mJzcbJe.exe
  C:\Windows\System\mJzcbJe.exe
  2⤵
  PID:16152
- C:\Windows\System\EDBNPkz.exe
  C:\Windows\System\EDBNPkz.exe
  2⤵
  PID:16188
- C:\Windows\System\NdURHen.exe
  C:\Windows\System\NdURHen.exe
  2⤵
  PID:16216
- C:\Windows\System\PYgEVTQ.exe
  C:\Windows\System\PYgEVTQ.exe
  2⤵
  PID:16244
- C:\Windows\System\dkZjoSm.exe
  C:\Windows\System\dkZjoSm.exe
  2⤵
  PID:16264
- C:\Windows\System\FyaGnUN.exe
  C:\Windows\System\FyaGnUN.exe
  2⤵
  PID:16300
- C:\Windows\System\KnSEFFQ.exe
  C:\Windows\System\KnSEFFQ.exe
  2⤵
  PID:16320
- C:\Windows\System\ZdUJlMs.exe
  C:\Windows\System\ZdUJlMs.exe
  2⤵
  PID:16344
- C:\Windows\System\OmeOoRh.exe
  C:\Windows\System\OmeOoRh.exe
  2⤵
  PID:16376
- C:\Windows\System\gofgemT.exe
  C:\Windows\System\gofgemT.exe
  2⤵
  PID:14636
- C:\Windows\System\wEyrdCI.exe
  C:\Windows\System\wEyrdCI.exe
  2⤵
  PID:15412
- C:\Windows\System\zhzZPvR.exe
  C:\Windows\System\zhzZPvR.exe
  2⤵
  PID:14656
- C:\Windows\System\PUcsAcd.exe
  C:\Windows\System\PUcsAcd.exe
  2⤵
  PID:14344
- C:\Windows\System\IiZturI.exe
  C:\Windows\System\IiZturI.exe
  2⤵
  PID:15472
- C:\Windows\System\MWZtKis.exe
  C:\Windows\System\MWZtKis.exe
  2⤵
  PID:15584
- C:\Windows\System\FTuRWnJ.exe
  C:\Windows\System\FTuRWnJ.exe
  2⤵
  PID:15696
- C:\Windows\System\KubTcuj.exe
  C:\Windows\System\KubTcuj.exe
  2⤵
  PID:15712
- C:\Windows\System\fsrXlgw.exe
  C:\Windows\System\fsrXlgw.exe
  2⤵
  PID:15772
- C:\Windows\System\SYZXVtd.exe
  C:\Windows\System\SYZXVtd.exe
  2⤵
  PID:15820
- C:\Windows\System\YcJCbJw.exe
  C:\Windows\System\YcJCbJw.exe
  2⤵
  PID:16008
- C:\Windows\System\WLBDghA.exe
  C:\Windows\System\WLBDghA.exe
  2⤵
  PID:15908
- C:\Windows\System\rzdMuzv.exe
  C:\Windows\System\rzdMuzv.exe
  2⤵
  PID:15972
- C:\Windows\System\jgLqjnU.exe
  C:\Windows\System\jgLqjnU.exe
  2⤵
  PID:16112
- C:\Windows\System\FesqxzS.exe
  C:\Windows\System\FesqxzS.exe
  2⤵
  PID:16048
- C:\Windows\System\wbWVCXl.exe
  C:\Windows\System\wbWVCXl.exe
  2⤵
  PID:16312
- C:\Windows\System\YPDkdSV.exe
  C:\Windows\System\YPDkdSV.exe
  2⤵
  PID:16236
- C:\Windows\System\QHswHHE.exe
  C:\Windows\System\QHswHHE.exe
  2⤵
  PID:16260
- C:\Windows\System\jsUXvcW.exe
  C:\Windows\System\jsUXvcW.exe
  2⤵
  PID:16340
- C:\Windows\System\SFmesFP.exe
  C:\Windows\System\SFmesFP.exe
  2⤵
  PID:15616
- C:\Windows\System\fUrEiwd.exe
  C:\Windows\System\fUrEiwd.exe
  2⤵
  PID:15540
- C:\Windows\System\JkOhNvT.exe
  C:\Windows\System\JkOhNvT.exe
  2⤵
  PID:15356
- C:\Windows\System\gYyOKrb.exe
  C:\Windows\System\gYyOKrb.exe
  2⤵
  PID:15964
- C:\Windows\System\cDSLcGv.exe
  C:\Windows\System\cDSLcGv.exe
  2⤵
  PID:16084
- C:\Windows\System\OEJCBBO.exe
  C:\Windows\System\OEJCBBO.exe
  2⤵
  PID:16164
- C:\Windows\System\tDUpsdb.exe
  C:\Windows\System\tDUpsdb.exe
  2⤵
  PID:16256
- C:\Windows\System\zYqSZrl.exe
  C:\Windows\System\zYqSZrl.exe
  2⤵
  PID:15792
- C:\Windows\System\VQiyicz.exe
  C:\Windows\System\VQiyicz.exe
  2⤵
  PID:16288
- C:\Windows\System\IzlheNW.exe
  C:\Windows\System\IzlheNW.exe
  2⤵
  PID:16388
- C:\Windows\System\mClCISr.exe
  C:\Windows\System\mClCISr.exe
  2⤵
  PID:16416
- C:\Windows\System\nJPTzjB.exe
  C:\Windows\System\nJPTzjB.exe
  2⤵
  PID:16440
- C:\Windows\System\FuKAtln.exe
  C:\Windows\System\FuKAtln.exe
  2⤵
  PID:16464
- C:\Windows\System\pHfhRAU.exe
  C:\Windows\System\pHfhRAU.exe
  2⤵
  PID:16488
- C:\Windows\System\ryRGGgy.exe
  C:\Windows\System\ryRGGgy.exe
  2⤵
  PID:16520
- C:\Windows\System\TmTBuEu.exe
  C:\Windows\System\TmTBuEu.exe
  2⤵
  PID:16552
- C:\Windows\System\iDCaXDv.exe
  C:\Windows\System\iDCaXDv.exe
  2⤵
  PID:16580
- C:\Windows\System\YAMniav.exe
  C:\Windows\System\YAMniav.exe
  2⤵
  PID:16596
- C:\Windows\System\mMnKuGv.exe
  C:\Windows\System\mMnKuGv.exe
  2⤵
  PID:16620
- C:\Windows\System\HWWxqJK.exe
  C:\Windows\System\HWWxqJK.exe
  2⤵
  PID:16648
- C:\Windows\System\ZBEQZzA.exe
  C:\Windows\System\ZBEQZzA.exe
  2⤵
  PID:16676
- C:\Windows\System\cmlEosq.exe
  C:\Windows\System\cmlEosq.exe
  2⤵
  PID:16700
- C:\Windows\System\CdbzhOy.exe
  C:\Windows\System\CdbzhOy.exe
  2⤵
  PID:16728
- C:\Windows\System\LYDNFMd.exe
  C:\Windows\System\LYDNFMd.exe
  2⤵
  PID:16752
- C:\Windows\System\APUBYls.exe
  C:\Windows\System\APUBYls.exe
  2⤵
  PID:16788
- C:\Windows\System\oiYBnEV.exe
  C:\Windows\System\oiYBnEV.exe
  2⤵
  PID:16812
- C:\Windows\System\zdaHMER.exe
  C:\Windows\System\zdaHMER.exe
  2⤵
  PID:16840
- C:\Windows\System\GiyaaEn.exe
  C:\Windows\System\GiyaaEn.exe
  2⤵
  PID:16872
- C:\Windows\System\IudzsEj.exe
  C:\Windows\System\IudzsEj.exe
  2⤵
  PID:16888
- C:\Windows\System\IVFvWqW.exe
  C:\Windows\System\IVFvWqW.exe
  2⤵
  PID:16920
- C:\Windows\System\KrZwWBG.exe
  C:\Windows\System\KrZwWBG.exe
  2⤵
  PID:16948
- C:\Windows\System\NGwOtyc.exe
  C:\Windows\System\NGwOtyc.exe
  2⤵
  PID:16972
- C:\Windows\System\erNuDeO.exe
  C:\Windows\System\erNuDeO.exe
  2⤵
  PID:17008
- C:\Windows\System\HlQJaoC.exe
  C:\Windows\System\HlQJaoC.exe
  2⤵
  PID:17024
- C:\Windows\System\ocCVJsC.exe
  C:\Windows\System\ocCVJsC.exe
  2⤵
  PID:17052
- C:\Windows\System\jriAOrp.exe
  C:\Windows\System\jriAOrp.exe
  2⤵
  PID:17084
- C:\Windows\System\pobPKPh.exe
  C:\Windows\System\pobPKPh.exe
  2⤵
  PID:17120
- C:\Windows\System\KYNPHCX.exe
  C:\Windows\System\KYNPHCX.exe
  2⤵
  PID:17144
- C:\Windows\System\IMQXikz.exe
  C:\Windows\System\IMQXikz.exe
  2⤵
  PID:17168
- C:\Windows\System\QIWZYnr.exe
  C:\Windows\System\QIWZYnr.exe
  2⤵
  PID:17196
- C:\Windows\System\rMEipmb.exe
  C:\Windows\System\rMEipmb.exe
  2⤵
  PID:17228
- C:\Windows\System\Ulwutil.exe
  C:\Windows\System\Ulwutil.exe
  2⤵
  PID:17252
- C:\Windows\System\sGHiLnV.exe
  C:\Windows\System\sGHiLnV.exe
  2⤵
  PID:17268
- C:\Windows\System\fEXWyKO.exe
  C:\Windows\System\fEXWyKO.exe
  2⤵
  PID:17308
- C:\Windows\System\cccDhUn.exe
  C:\Windows\System\cccDhUn.exe
  2⤵
  PID:17344
- C:\Windows\System\KtIbhqC.exe
  C:\Windows\System\KtIbhqC.exe
  2⤵
  PID:17380
- C:\Windows\System\XafpwdL.exe
  C:\Windows\System\XafpwdL.exe
  2⤵
  PID:15944
- C:\Windows\System\PcmUwYj.exe
  C:\Windows\System\PcmUwYj.exe
  2⤵
  PID:16336
- C:\Windows\System\AYOcewP.exe
  C:\Windows\System\AYOcewP.exe
  2⤵
  PID:16832
- C:\Windows\System\ebyhUdK.exe
  C:\Windows\System\ebyhUdK.exe
  2⤵
  PID:16884
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16884 -s 248
    3⤵
    PID:17376
- C:\Windows\System\sxZzCgh.exe
  C:\Windows\System\sxZzCgh.exe
  2⤵
  PID:17064
- C:\Windows\System\TQlDJJf.exe
  C:\Windows\System\TQlDJJf.exe
  2⤵
  PID:17236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\FIaXaWL.exe

Filesize
1.8MB

MD5
465a402e1e6b5392b293bd4f9259f4bc

SHA1
0473c038746221c34c89eeabe499627d9ea41cfc

SHA256
4d11a58dd7f333b53c5327cfc7c838bb92b52ab2eaa5b07e8521208fc3899066

SHA512
3274acaca67f4f79a3f3d5d8830f4637eca43bf49a57381b162d3c1b25633e6f3a3a2189040973b85964b141402801da0b42650c0c3ec7d34a5143e89e2faaf7

Download Submit
C:\Windows\System\FYJrWyI.exe

Filesize
1.8MB

MD5
a6863aec9e431c18aa940bd0e8f9218f

SHA1
f8e4eb7053006b1db0e15ed195adb5c3653da637

SHA256
cb9f8c773c338fc96e01f7d399585f463121c4d88598764f9657164424a18a35

SHA512
184b884be73d5a483a0abcd723fc3897735069b27a6f063779752acc74eeaf963f656a03c0e185bae993c37edad3dfdab61ab92fd1f36080b89fb48b0767c902

Download Submit
C:\Windows\System\KpsowkX.exe

Filesize
1.8MB

MD5
8a551082ecfbd1a449f6e93c5f305427

SHA1
9b8dfdd1644e42cbca8e4e9dfdebf5ed5fbd9a70

SHA256
7153905efc4d9194f82c7b7b16b2a37c9dedcd71904e5ee0ed3918db2aef3667

SHA512
ae769e0b1ac4889c458ebede194158672256e3f50812c9676ebe680daaf709afaa98753a1a0aed0d676cc2cc347bac31880112ad58845d58b466e3da772f7e71

Download Submit
C:\Windows\System\LCpxcKp.exe

Filesize
1.8MB

MD5
71aa98fcc4d63520719b9e1cb37899aa

SHA1
69abbce90e382ab912ba17ffb0b9618be976e212

SHA256
408bc3fbd7df434b3b404fe3de36cd892c14f47740474a006694b0d15fd38461

SHA512
6c71de9c1e3f15d21796400f548a24a54ab30aed0e7173ef8bdc2dba7e7ab0030cb09f70b4fe601c1d125db8193e6c3e88597e0e787c67fbbb83af1363fca83c

Download Submit
C:\Windows\System\TKGUVVF.exe

Filesize
1.8MB

MD5
6e8043fbf225b9278e321027b1139a8f

SHA1
f01f6e054282c81fceccd160508da1b47b6dcf5e

SHA256
4bb53f1a2ed9ae0c0fd0320ad005c650fdf14ff6eee024d03ae7725af79e73cc

SHA512
06d13b52764b281c875bd43fdc54bdde0b5972d37fb331cb46fe8efad9b9b0003f8d4622e398a2098f074521cfbc5c83d6d0516258325197e2180a1d05aab87e

Download Submit
C:\Windows\System\TYIBkos.exe

Filesize
1.8MB

MD5
2ee1c2040adb51bf8e02fa93539be6f0

SHA1
5fc95babc354b0a6e69113434fe29edf09cab03b

SHA256
a078c8fc451c38ac1150f2d3c1a36f0331c9f825f99407af6283736e025ff0c3

SHA512
3673d556423bb68cfe8836a700c73f68e9b8b99f58f1c6d539ee6b47d7e53e73074c49a036ddff7b2d2a26f32f22f8519822a1170034074d6cbfcba1800e7722

Download Submit
C:\Windows\System\UFfIPrn.exe

Filesize
1.8MB

MD5
92b3437e2d36c373923c9f3c7d3c91f0

SHA1
3a02e038d4d5c0925c3764af1f21062e34f7d3f2

SHA256
a8664f43f2a26b3d3e00acb46ef4a30f28a78977a0df915cfe72673ee198f2c8

SHA512
e37fc75b8b4eb4aa21fa0c06dbf96fcfa4b493d17e4468559a8269e96d81ca4446212c4ad6d988f2c5bcf828f6b538ceb5cad9cc5ac4cd2272bc9313b36fb0b3

Download Submit
C:\Windows\System\VOERdHE.exe

Filesize
1.8MB

MD5
a553c82cd730f661fb5513fd07095fb1

SHA1
d613b9a91665e87c5e4bef2157779ff49ee39b0e

SHA256
cef31a6ab5f91dfc176ec93610a64079e4269f53d0390e0b07d468338ee9ffa5

SHA512
7b10db00b1b5091d99900aaf47b3a4dfd31665aba0d0acbc9639cc6ee3bf1411d67642559952629f9ba56cbd0d39c5420f59507c0827bb9ec81911675f4320c6

Download Submit
C:\Windows\System\VlhDkSb.exe

Filesize
1.8MB

MD5
6341ebf94d2095b81a08da6d98300193

SHA1
094edbd269229f0ccfda9085e80d6ba78905fd19

SHA256
01969c116b71d871bb754b0c21b61d0e31a534d0c4ca43ef358a7bfbc947d769

SHA512
b7f30fb71a69791ab258858adfb1ee38ed60369ff682a663657186f7f5381e7291380b2686100d48e85dd6e615dbc07ba19415cd8e9a6d0d0a8255a30baf43c7

Download Submit
C:\Windows\System\YmJGkWt.exe

Filesize
1.8MB

MD5
4094a41e3a8df286ff93a157602785da

SHA1
9cf12ac62e194149a73f9a80ad1b7d5d18191460

SHA256
64c50651a19b60eeed19436e7dd6611085e61af8c1e27f4a8cec9ddd37b95d39

SHA512
a8039e666a62df2c551df4e3d762d12c7911bafd0e32e0239057e37f100221660d1581bea25b23d8bcb66586ca8bf7cada99e0347d9fcd6070a9f006c6300794

Download Submit
C:\Windows\System\ZEMjHnO.exe

Filesize
1.8MB

MD5
7ae3f1ce5a6645e9e67771cad610d660

SHA1
8de96553f3277b4a77cbbd65c1fcb6017e44c162

SHA256
b3b7d5035dddbe4f99b59f6bf86d45efd5e79329e5117e10fe7b3ac656a242d1

SHA512
01f94bf66d8b6e9057a758e4e5e62a697a184de8418b262e3933ef6a3d3bba9f4e841a29944d6c78b148d71e824a70bd5de29ef195c954dd17df6c86b8a3cb3b

Download Submit
C:\Windows\System\ZkaIoQF.exe

Filesize
1.8MB

MD5
99271fcc6b636f0625707dbe8620cf3f

SHA1
7753ab0d3c2aaed26697af533124c8c301a46fa5

SHA256
26dade7e0d6bddd9fdf16a2c10d8322386ac8c878ec84a0a58445065f5e089bf

SHA512
145d2b954c80e947e340076a5d91586fdf5f88464add748c149178034dbb52e346f1581b70f0873ade4ff7090681237ab9eac401066cc2fe765f66c931d87e3a

Download Submit
C:\Windows\System\ZmyFtJm.exe

Filesize
1.8MB

MD5
f96ed7e63484bb4097953c29dfb3a9a2

SHA1
800e80cffe187d9e5c19304a6ec0457f4cef1642

SHA256
01942419446a469ecb513b35de5c8021ee36ce16ec20e9b97a21336b9e22e141

SHA512
d57e3f89f2f3a316140a069a68b5cc89fec5b92e41a45a5bfae785f8f62f0827f627401c24643f1ba2eec898dfa56d47a248d13fd30b476ef4b779d3d75f0638

Download Submit
C:\Windows\System\akLQurC.exe

Filesize
1.8MB

MD5
39cea27a79ad1007f408af88c86894c1

SHA1
c6600328e6eb21bbd60ba6395fa75a54d73abf46

SHA256
71d5c18784ffc883fb97ee55ed04ff06aeeef3611b90f117e2a9bdfc926387bb

SHA512
717c601264a46ac1c80a90340fc03e63e94f27959f55905dac806a5504a0e2780a2f77bffb44b54058f7fec3c296422b420ca25e151d90f146541429edb14777

Download Submit
C:\Windows\System\cNQbURs.exe

Filesize
1.8MB

MD5
735d822166c3986ab70eb008e48edaf7

SHA1
6b0cc4beaf78ffa06da5861e2dc48db77dd7ffd7

SHA256
7c6aed757645f8ddf9c5885ad8f6d73213a6c99db51045badac9e231d3b2410f

SHA512
027ed0db0f0daca98a90cc1727434eb042c5b57b9ced6c46490a558676c2df40e57224e32a2434c489f17bfdbc6869f5fb88cb40d200130c6f3fa25ef72d4026

Download Submit
C:\Windows\System\cdanGCL.exe

Filesize
1.8MB

MD5
4ee19c8d2d7808572ef0b047056b68d9

SHA1
496097cb7ba7192c5da0c76a2b1027e0bfd6f3a9

SHA256
1481aead8cd653e751f8ace8a96dc1462c2e1c085a970b4c398f5889c93398d9

SHA512
44ff04d2c237eae4065cf9bb31c58d0f7dc321f4cb4f0d501265f611fc7f68dc92469f613fd21ec17b756cd3940cca0cca25f0d8fa23fb18fa82c9d98c67a779

Download Submit
C:\Windows\System\cnCMgjW.exe

Filesize
1.8MB

MD5
ea0bfe64a5a902d8ff19a98cb0bb9912

SHA1
136a10aacd28703bf7930e59d106dc8d12d0bda3

SHA256
d46e336f3d5cbda371816301839d45626f2786d79f68f98763456c4241b7c40e

SHA512
70b06f426bf12074d1797246fe03a44c5e1358cef2aba66ac27968ed5822fbf747f8a79ff5611382e5d181376fd2b28ec4ff37369fc9fc57d3f49bab47a211bd

Download Submit
C:\Windows\System\czkEfbq.exe

Filesize
1.8MB

MD5
f5a18da062cd4807ea96570145d6f103

SHA1
c7886cce09d346bdc38e1a9f4f92b9317ede618f

SHA256
d4e7309b0fba22298d709c3b8c44050da0f56150d652f4da01aa3a9c0cb23fe8

SHA512
e3d23a356a88936114990159dd2822d615161e39c9b8bee3d2a7bcf553f2b2aea723130f5ca2c44ac06606971207ec575868b870e0b64646ce89642e5d5ccdf1

Download Submit
C:\Windows\System\draQWcT.exe

Filesize
1.8MB

MD5
d5605db7bd4f0bb98655e4c6a9ae0559

SHA1
1b0adb9a675ad289486ae8927a39329ba00b2d61

SHA256
f09119a8310a2720f78662d52d55c00f0b433bb2e546d4f4c5600da25669fcc4

SHA512
de69ae6082e7d570f604f76dda0bf0f342938e61f9a24b82f1ec2cb096b4972a2b7247f98cfdb809b3ee0d05a3d752ca2d354b6b7aa1d7ca83616176e82d3436

Download Submit
C:\Windows\System\gFCmTQy.exe

Filesize
1.8MB

MD5
55b119e6d8c0946278aba91edc03576c

SHA1
6a6651ea0d1db2b79f3f2b012a7a3caffa15674c

SHA256
052e965f264329c82fedbfc6b6eb5a1fd30f1713b3470462c2cc15415f1857bb

SHA512
625e24dd8e4136e256fa5ba486790446c19c76ca672cf2f19f8d53013c790b89bf267887a7ccd7c3c0a509820f2b0986b6d084612d321a3b4e6f9d405c0f44bb

Download Submit
C:\Windows\System\inArBiQ.exe

Filesize
1.8MB

MD5
6a97ec77e925e507fe081a74ac70a671

SHA1
44c5d5641d01695bb6cfe9e102426e8ad36ad1eb

SHA256
f45c969043c8edebf88c36cb922b57124994bca60a83eeccde1b223da29b90bd

SHA512
b11d51bfd137db4c4b7fd7568c5ddffb83d4c5384d894f9fdaf3b1244440f275c979df0adcb209151b9a470906985c2537615baedc12083d78feba9218280448

Download Submit
C:\Windows\System\jLwtcwI.exe

Filesize
1.8MB

MD5
62765aef228488b95422cc1f83b10bd5

SHA1
6fb542b71e952ca83cf32ade0e19afcffd7697c3

SHA256
112819bdedf223cb59dea71a6a792e4e359971c0a80fee08f238f59e9d9e7a21

SHA512
82e786a3b7e0a642eebf1ab1b2368ecb60652c92178f94125c8185c4cfa34b1be5cee33a5fcaa4013d421504bbb64b8ea16ed863dbfee7bd56063ea82566fc14

Download Submit
C:\Windows\System\leiobDn.exe

Filesize
1.8MB

MD5
94943fbdcf570fb7f9b07922e45e23d4

SHA1
29b83177f49ae145c78df24795a01481795e242e

SHA256
dc54cb71a4c828e8021cb7fbecb85d3655acc57f0a223904f1b37cd31fbaa385

SHA512
9ac82c8a77e89e14c0db25ca39f9dfaf4b3c530b23b9f11f6640cf250b7f8b6154ad7d4e3008001381364884b05c270f4d8ba1b11bfba3ac30359bf8687c6a57

Download Submit
C:\Windows\System\mQBOzRC.exe

Filesize
1.8MB

MD5
42bf3a5b12fd848bdacd6073430bd9de

SHA1
c2f68872ad0b864977deb81a2b206e99fc0d897f

SHA256
e4a84d07661004e656d35a05c028b69d6039b0eeb99936720b1fbe7c96355dea

SHA512
12e7fb6b32ddd32c56eb960a5d8f59ef081296df549486bee73f461db28ddc498dc394939147ec69e00b67fc8040cdc4de3c3d97ef0a30dee2a2bd7fcb5a3150

Download Submit
C:\Windows\System\mYjHazb.exe

Filesize
1.8MB

MD5
35ea5eb803b9a22b742df454ca307858

SHA1
c4dbfa995332a683522d14c1b284ec753ba4ef5d

SHA256
458c59023fb9846067ff1a5d2175d6bd6fc0fac6b23819bcc3d23f9c7fd64f36

SHA512
222e4ed3de43ec5940cc1770bc51735b7fd8d435006ef4a3e94ad688c5f8a1faa9cf218e525c9d56546d6bbdb22352d124f616aafa11e82b04f1ac483e1cee83

Download Submit
C:\Windows\System\nUSCnMi.exe

Filesize
1.8MB

MD5
f2f9e393758863a180650803fef61b1f

SHA1
f8277719f4212aebbf113ea7f716adb4a3a9d2f2

SHA256
1463d264911aff8ac7d0ddb4846cc1c10a86312959ee6dcb50b8ffc060a68963

SHA512
5ceb4c24185abf2da0fa3af6b0357c50f2786ae8563ea6beeb411b47935809a97e13bb23ec1c7db220d11a802534d0c5f36eba2efddb48f4b60382466a0f95ed

Download Submit
C:\Windows\System\qzPxenu.exe

Filesize
1.8MB

MD5
04279146269e744a16de0933324f59fe

SHA1
07785efbd4b1f7e75dfa08e8e2ecf710f21a9ccc

SHA256
116c44d3e501dabbae0f6f72ef3bdd64e4711ff507eed31020829f99b812b344

SHA512
7fa13b437efea08ad4eb2fda5a5869939021c1d3acb81279aa307899e6b5765788c4f99331912e1569db819bc5b1f0ff5ad8bbe44b9c513b385fd97994eb8a0d

Download Submit
C:\Windows\System\tATXHOh.exe

Filesize
1.8MB

MD5
eb9e1f08cd94c983ae10cebba6d495d8

SHA1
b1fae8367de3dea3de070f282cfc523b5d1a41f5

SHA256
51f78131c9b93aefd1cbe5ff33d2b1a0024995f498e3f2af2cc47da0fb9630a0

SHA512
584237a575e420025a124e92c4fe48316258c9e2d71bb445ac1457139d8bd0144e1a9ac5086c56ee0a7d313f250f75a03193e288cb016262c01962a5339e4767

Download Submit
C:\Windows\System\ueEJxqw.exe

Filesize
1.8MB

MD5
833548cd85ab16b6bede6d6f658575b6

SHA1
dee04e7a1371f071eb4264c72dff69a9ed2ea733

SHA256
b3cf86176448d9484dbdcb09ec20bfda930b218d9d3d02f72d4646fc7a985f81

SHA512
de90bc73583eacdd2bd033da523baaabfb0c9ed0341781d7fcd273dd724d0eaad6ddb03e7bcd287d1f6f1709309186a1ade2bb6d4ffdcfdca2a616efed583474

Download Submit
C:\Windows\System\vZypUIV.exe

Filesize
1.8MB

MD5
8216f2bf6f2d7c8be1713b5670e2737d

SHA1
5aedee7178ebabe675fbba08aa3220ce2263e256

SHA256
78685b2531bd8cbb8a06ea1e4b37b60a8fbbe410cde9e3e0728c60b399736b29

SHA512
925fd0510d978328b30518c28882acc65ec75926cd768a9731ed5b878cc78bbaefe48c2fac726112afbf828a274930917e88fb0426201d9278165d7287cb08fa

Download Submit
C:\Windows\System\wOrMHXB.exe

Filesize
1.8MB

MD5
321f38f2992cdd1b691be45a0851245d

SHA1
671f8c7ec1a5689c52041456be4a176c88914d9c

SHA256
d2952bc1976d6e1677544d2900300db8c822352a59ffa2b449f6299c3c0976f3

SHA512
7594a4dbd730b1735f9445e56100f8109534800b860dd314f90841144b9c6a03099a04f889a7a16d2def84eb402f1c67d1221020c0dbca44af68b5f2aafffa29

Download Submit
C:\Windows\System\wxfOxUG.exe

Filesize
1.8MB

MD5
36f53b61f9a1c4f6d88313a92a341748

SHA1
6b369ecb482435c2e3fc5d122a718ae0fc94e2b8

SHA256
7c9538aa6ea89d8a0c3fe6e3347ca2e1a0a792285ebbb27932e445d47e5ef676

SHA512
fb2534600b59b200406edd038818d0d41f43c8f432d3532a0f5d22a421bd49f2552b07840f36ff3cb01e294966d2be7d8e0080ba1b4a1be143e98f85a33b2c61

Download Submit
C:\Windows\System\wylrTCy.exe

Filesize
1.8MB

MD5
78847e96d3cdca2a738d2c7ae4ef1326

SHA1
517af820bec88f3f973cfbde68b31a33a54654e4

SHA256
f90aca0286d16cb9171a6317ecfd2098cf54bb12c3017e8d2a5fb1b319ffb9ad

SHA512
d867a58a0817ac56fd93e7239ea90f8f2af04b8b85b36f4a4dfd1f064b468222f156d25497ed0b2cec79e5433213aa80c1f414df2d81a77333f0d2ac5c09e913

Download Submit
C:\Windows\System\yKKCSee.exe

Filesize
1.8MB

MD5
a50d8d0de2dcd81d2a657d754ad4e8b1

SHA1
e72f3524e6f9afc5f13eddffe2621ba7320d4197

SHA256
c3fa3ff4e840d0212de68b608464c778261860d69ef14b32b1cc0412186a9d35

SHA512
907da0ec8de89560690e081836e89a18b42be61fbbe102699095d396492f36a587457140fd27ceb7e58a4cb30602352fe37b57d402ddc2018d2130fbaba843ee

Download Submit
C:\Windows\System\zFmuguK.exe

Filesize
1.8MB

MD5
ba063845b8878220e147c4d19c918535

SHA1
eff5e089c1de5948ea3054cd1d04e19a1f1e22fe

SHA256
36cf6ec271310cfe2d82477fa7bf0eac38b72c9f8e4c256a09f349de6a60fb31

SHA512
0951f352607d9ac9f84ca96c6c9d79b24f9d72288e4af21bc98a0b160f4b54aad7efd69eb779b63e1f7fc90d63d07fc7535dc1beedd499d9229113165fa09784

Download Submit
memory/3020-0-0x000001CC90220000-0x000001CC90230000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads