xmrig | 51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
Size

1.1MB
MD5

a4f38aafa4e70af0146f0513e879ba5d
SHA1

d0d4526beb7635a1b47273627091a418ac6e5109
SHA256

51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b
SHA512

ac5bd5412edc5279abaa9368e0ab7ab943600d011eb5131e378803966ea9b671fc095da1b43862b2f3474bcd8d34f5ab04eacbbc5fbedd78360fe07acdd45245
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4Buaq9NdeC:GezaTF8FcNkNdfE0pZ9ozttwIRakGXYF

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023cba-5.dat	xmrig
behavioral2/files/0x0007000000023cc2-8.dat	xmrig
behavioral2/files/0x0007000000023cc3-15.dat	xmrig
behavioral2/files/0x0007000000023cc5-25.dat	xmrig
behavioral2/files/0x0007000000023cc6-29.dat	xmrig
behavioral2/files/0x0007000000023ccd-65.dat	xmrig
behavioral2/files/0x0007000000023cd9-128.dat	xmrig
behavioral2/files/0x0007000000023ce1-162.dat	xmrig
behavioral2/files/0x0007000000023ce0-159.dat	xmrig
behavioral2/files/0x0007000000023cdf-157.dat	xmrig
behavioral2/files/0x0007000000023cde-153.dat	xmrig
behavioral2/files/0x0007000000023cdd-147.dat	xmrig
behavioral2/files/0x0007000000023cdc-143.dat	xmrig
behavioral2/files/0x0007000000023cdb-137.dat	xmrig
behavioral2/files/0x0007000000023cda-133.dat	xmrig
behavioral2/files/0x0007000000023cd8-122.dat	xmrig
behavioral2/files/0x0007000000023cd7-118.dat	xmrig
behavioral2/files/0x0007000000023cd6-113.dat	xmrig
behavioral2/files/0x0007000000023cd5-108.dat	xmrig
behavioral2/files/0x0007000000023cd4-102.dat	xmrig
behavioral2/files/0x0007000000023cd3-98.dat	xmrig
behavioral2/files/0x0007000000023cd2-93.dat	xmrig
behavioral2/files/0x0007000000023cd1-88.dat	xmrig
behavioral2/files/0x0007000000023cd0-83.dat	xmrig
behavioral2/files/0x0007000000023ccf-78.dat	xmrig
behavioral2/files/0x0007000000023cce-73.dat	xmrig
behavioral2/files/0x0007000000023ccc-63.dat	xmrig
behavioral2/files/0x0007000000023ccb-57.dat	xmrig
behavioral2/files/0x0007000000023cca-53.dat	xmrig
behavioral2/files/0x0007000000023cc9-47.dat	xmrig
behavioral2/files/0x0007000000023cc8-43.dat	xmrig
behavioral2/files/0x0007000000023cc7-37.dat	xmrig
behavioral2/files/0x0007000000023cc4-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2268	SEMUhWJ.exe
3604	VaXjcOt.exe
1476	PIBWWVU.exe
1352	TVemnPP.exe
2456	ofrkCSN.exe
2132	sVZLtnP.exe
1988	eOjhRDi.exe
1664	LZeueCB.exe
2292	GlrPImh.exe
1040	eoEPKPP.exe
3956	upjDVMk.exe
1500	lGZQwoK.exe
3780	lONeZQi.exe
3128	tfyuFow.exe
3164	WPUkcVH.exe
1888	uUaauLo.exe
1940	moSPPTl.exe
4268	fWwxXYw.exe
4996	yHliXCm.exe
5092	FzKVuBh.exe
4532	BmSHihY.exe
3416	CjUbBNt.exe
2936	zFmkILk.exe
3100	qbVcZRf.exe
1372	ugsIoTd.exe
2064	ashIDYJ.exe
3524	hYLTpeQ.exe
2560	IRqwabW.exe
5036	OEvXJjD.exe
4964	tDftiqo.exe
2152	kqmsMYj.exe
3476	wqgNJTz.exe
2488	GUzBOBS.exe
2284	tXamziN.exe
336	MyFgMKK.exe
1652	GhAiPEt.exe
2260	usrpYCZ.exe
4240	AQFTfim.exe
4204	klaECJc.exe
2280	mtiPLAF.exe
1692	ipmebvW.exe
708	IouxtoP.exe
320	hsGLNbK.exe
4664	UrSWGua.exe
3172	YAKlofT.exe
4716	giGqjwp.exe
4756	aIyrYoG.exe
3864	galmajE.exe
4860	ijUOhHQ.exe
2812	fcgKszJ.exe
3380	HIgKAPP.exe
5056	xrJQWRl.exe
4864	udmfnrF.exe
2716	nwDVKhk.exe
4292	aKpThFb.exe
4904	wgTnFSh.exe
3064	tbJxVON.exe
1036	GqmBskx.exe
1844	btxFSgB.exe
4744	SaeMLLy.exe
1632	JnEUTle.exe
3760	twIFtlS.exe
4456	Iietlku.exe
4544	aPAUTId.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YTYLide.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\LZeueCB.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\XzKJIPz.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\sTiTojS.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\xYNtnkx.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\QMPajEJ.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\NTPeqka.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\ulpoEOY.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\zzvyyFZ.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\gITTMdy.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\AfaeVoD.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\mQJPHkp.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\tgnAWoz.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\csKxwuE.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\nvanPjr.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\WPUkcVH.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\UtgflXY.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\krcOIsI.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\emJZgyY.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\IXLROIm.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\HPFJwKk.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\LhwMsgk.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\nusjufn.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\ybJaBwb.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\lEnFpSh.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\RnuJVIn.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\NNvuLPt.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\Iietlku.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\xPLzQeC.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\rtbCZOB.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\hsjzPaK.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\ryiNGvA.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\aXdHsxn.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\jMDubFi.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\DPKleMz.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\dfievpK.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\bSuZUxZ.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\rhXxgnw.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\ImoqtOj.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\DqzpLxu.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\TVemnPP.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\ULtmDWU.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\iabKVrz.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\NNlsubL.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\ElqsdkM.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\aGGCqjs.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\ijchpyw.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\oTWWNFt.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\uZefLjD.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\qGqhMyB.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\PhqRByB.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\qETiqRm.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\AQFTfim.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\FBNKgUx.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\qqhLZlq.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\ZBiSQGA.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\SAnbhfv.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\SwttfeL.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\FzKVuBh.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\ooLwmqt.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\qryjbFQ.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\xuYdRIJ.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\RbjscHj.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
File created	C:\Windows\System\lqIejKj.exe	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 2268	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	84
PID 1312 wrote to memory of 2268	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	84
PID 1312 wrote to memory of 3604	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	85
PID 1312 wrote to memory of 3604	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	85
PID 1312 wrote to memory of 1476	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	86
PID 1312 wrote to memory of 1476	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	86
PID 1312 wrote to memory of 1352	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	87
PID 1312 wrote to memory of 1352	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	87
PID 1312 wrote to memory of 2456	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	88
PID 1312 wrote to memory of 2456	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	88
PID 1312 wrote to memory of 2132	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	89
PID 1312 wrote to memory of 2132	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	89
PID 1312 wrote to memory of 1988	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	90
PID 1312 wrote to memory of 1988	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	90
PID 1312 wrote to memory of 1664	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	91
PID 1312 wrote to memory of 1664	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	91
PID 1312 wrote to memory of 2292	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	92
PID 1312 wrote to memory of 2292	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	92
PID 1312 wrote to memory of 1040	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	93
PID 1312 wrote to memory of 1040	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	93
PID 1312 wrote to memory of 3956	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	94
PID 1312 wrote to memory of 3956	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	94
PID 1312 wrote to memory of 1500	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	95
PID 1312 wrote to memory of 1500	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	95
PID 1312 wrote to memory of 3780	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	96
PID 1312 wrote to memory of 3780	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	96
PID 1312 wrote to memory of 3128	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	97
PID 1312 wrote to memory of 3128	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	97
PID 1312 wrote to memory of 3164	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	98
PID 1312 wrote to memory of 3164	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	98
PID 1312 wrote to memory of 1888	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	99
PID 1312 wrote to memory of 1888	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	99
PID 1312 wrote to memory of 1940	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	100
PID 1312 wrote to memory of 1940	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	100
PID 1312 wrote to memory of 4268	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	101
PID 1312 wrote to memory of 4268	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	101
PID 1312 wrote to memory of 4996	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	102
PID 1312 wrote to memory of 4996	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	102
PID 1312 wrote to memory of 5092	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	103
PID 1312 wrote to memory of 5092	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	103
PID 1312 wrote to memory of 4532	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	104
PID 1312 wrote to memory of 4532	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	104
PID 1312 wrote to memory of 3416	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	105
PID 1312 wrote to memory of 3416	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	105
PID 1312 wrote to memory of 2936	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	106
PID 1312 wrote to memory of 2936	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	106
PID 1312 wrote to memory of 3100	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	107
PID 1312 wrote to memory of 3100	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	107
PID 1312 wrote to memory of 1372	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	108
PID 1312 wrote to memory of 1372	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	108
PID 1312 wrote to memory of 2064	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	109
PID 1312 wrote to memory of 2064	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	109
PID 1312 wrote to memory of 3524	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	110
PID 1312 wrote to memory of 3524	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	110
PID 1312 wrote to memory of 2560	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	111
PID 1312 wrote to memory of 2560	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	111
PID 1312 wrote to memory of 5036	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	112
PID 1312 wrote to memory of 5036	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	112
PID 1312 wrote to memory of 4964	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	113
PID 1312 wrote to memory of 4964	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	113
PID 1312 wrote to memory of 2152	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	114
PID 1312 wrote to memory of 2152	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	114
PID 1312 wrote to memory of 3476	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	115
PID 1312 wrote to memory of 3476	1312	51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe	115

C:\Users\Admin\AppData\Local\Temp\51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe
"C:\Users\Admin\AppData\Local\Temp\51a3fbca897d885b92e48dc16a315320db176f70eed2c3686325b539e482b44b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\System\SEMUhWJ.exe
  C:\Windows\System\SEMUhWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\VaXjcOt.exe
  C:\Windows\System\VaXjcOt.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\PIBWWVU.exe
  C:\Windows\System\PIBWWVU.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\TVemnPP.exe
  C:\Windows\System\TVemnPP.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\ofrkCSN.exe
  C:\Windows\System\ofrkCSN.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\sVZLtnP.exe
  C:\Windows\System\sVZLtnP.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\eOjhRDi.exe
  C:\Windows\System\eOjhRDi.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\LZeueCB.exe
  C:\Windows\System\LZeueCB.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\GlrPImh.exe
  C:\Windows\System\GlrPImh.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\eoEPKPP.exe
  C:\Windows\System\eoEPKPP.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\upjDVMk.exe
  C:\Windows\System\upjDVMk.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\lGZQwoK.exe
  C:\Windows\System\lGZQwoK.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\lONeZQi.exe
  C:\Windows\System\lONeZQi.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\tfyuFow.exe
  C:\Windows\System\tfyuFow.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\WPUkcVH.exe
  C:\Windows\System\WPUkcVH.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\uUaauLo.exe
  C:\Windows\System\uUaauLo.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\moSPPTl.exe
  C:\Windows\System\moSPPTl.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\fWwxXYw.exe
  C:\Windows\System\fWwxXYw.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\yHliXCm.exe
  C:\Windows\System\yHliXCm.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\FzKVuBh.exe
  C:\Windows\System\FzKVuBh.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\BmSHihY.exe
  C:\Windows\System\BmSHihY.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\CjUbBNt.exe
  C:\Windows\System\CjUbBNt.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\zFmkILk.exe
  C:\Windows\System\zFmkILk.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\qbVcZRf.exe
  C:\Windows\System\qbVcZRf.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\ugsIoTd.exe
  C:\Windows\System\ugsIoTd.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ashIDYJ.exe
  C:\Windows\System\ashIDYJ.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\hYLTpeQ.exe
  C:\Windows\System\hYLTpeQ.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\IRqwabW.exe
  C:\Windows\System\IRqwabW.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\OEvXJjD.exe
  C:\Windows\System\OEvXJjD.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\tDftiqo.exe
  C:\Windows\System\tDftiqo.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\kqmsMYj.exe
  C:\Windows\System\kqmsMYj.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\wqgNJTz.exe
  C:\Windows\System\wqgNJTz.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\GUzBOBS.exe
  C:\Windows\System\GUzBOBS.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\tXamziN.exe
  C:\Windows\System\tXamziN.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\MyFgMKK.exe
  C:\Windows\System\MyFgMKK.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\GhAiPEt.exe
  C:\Windows\System\GhAiPEt.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\usrpYCZ.exe
  C:\Windows\System\usrpYCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\AQFTfim.exe
  C:\Windows\System\AQFTfim.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\klaECJc.exe
  C:\Windows\System\klaECJc.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\mtiPLAF.exe
  C:\Windows\System\mtiPLAF.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ipmebvW.exe
  C:\Windows\System\ipmebvW.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\IouxtoP.exe
  C:\Windows\System\IouxtoP.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\hsGLNbK.exe
  C:\Windows\System\hsGLNbK.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\UrSWGua.exe
  C:\Windows\System\UrSWGua.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\YAKlofT.exe
  C:\Windows\System\YAKlofT.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\giGqjwp.exe
  C:\Windows\System\giGqjwp.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\aIyrYoG.exe
  C:\Windows\System\aIyrYoG.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\galmajE.exe
  C:\Windows\System\galmajE.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\ijUOhHQ.exe
  C:\Windows\System\ijUOhHQ.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\fcgKszJ.exe
  C:\Windows\System\fcgKszJ.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\HIgKAPP.exe
  C:\Windows\System\HIgKAPP.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\xrJQWRl.exe
  C:\Windows\System\xrJQWRl.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\udmfnrF.exe
  C:\Windows\System\udmfnrF.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\nwDVKhk.exe
  C:\Windows\System\nwDVKhk.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\aKpThFb.exe
  C:\Windows\System\aKpThFb.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\wgTnFSh.exe
  C:\Windows\System\wgTnFSh.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\tbJxVON.exe
  C:\Windows\System\tbJxVON.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\GqmBskx.exe
  C:\Windows\System\GqmBskx.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\btxFSgB.exe
  C:\Windows\System\btxFSgB.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\SaeMLLy.exe
  C:\Windows\System\SaeMLLy.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\JnEUTle.exe
  C:\Windows\System\JnEUTle.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\twIFtlS.exe
  C:\Windows\System\twIFtlS.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\Iietlku.exe
  C:\Windows\System\Iietlku.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\aPAUTId.exe
  C:\Windows\System\aPAUTId.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\PnGWUTa.exe
  C:\Windows\System\PnGWUTa.exe
  2⤵
  PID:3320
- C:\Windows\System\qggfQWq.exe
  C:\Windows\System\qggfQWq.exe
  2⤵
  PID:1388
- C:\Windows\System\xUkSwSa.exe
  C:\Windows\System\xUkSwSa.exe
  2⤵
  PID:2508
- C:\Windows\System\jzTtHoG.exe
  C:\Windows\System\jzTtHoG.exe
  2⤵
  PID:2144
- C:\Windows\System\HPFJwKk.exe
  C:\Windows\System\HPFJwKk.exe
  2⤵
  PID:4248
- C:\Windows\System\CxRHwJj.exe
  C:\Windows\System\CxRHwJj.exe
  2⤵
  PID:2920
- C:\Windows\System\XekaHur.exe
  C:\Windows\System\XekaHur.exe
  2⤵
  PID:3448
- C:\Windows\System\rvoyJIh.exe
  C:\Windows\System\rvoyJIh.exe
  2⤵
  PID:1332
- C:\Windows\System\QEyqcRC.exe
  C:\Windows\System\QEyqcRC.exe
  2⤵
  PID:3272
- C:\Windows\System\oZgJxEE.exe
  C:\Windows\System\oZgJxEE.exe
  2⤵
  PID:1936
- C:\Windows\System\MtSKuIL.exe
  C:\Windows\System\MtSKuIL.exe
  2⤵
  PID:1168
- C:\Windows\System\hqTGoeQ.exe
  C:\Windows\System\hqTGoeQ.exe
  2⤵
  PID:4520
- C:\Windows\System\HhpFNGN.exe
  C:\Windows\System\HhpFNGN.exe
  2⤵
  PID:1496
- C:\Windows\System\PevvrXa.exe
  C:\Windows\System\PevvrXa.exe
  2⤵
  PID:376
- C:\Windows\System\yxBQrBR.exe
  C:\Windows\System\yxBQrBR.exe
  2⤵
  PID:3316
- C:\Windows\System\ncQTGlW.exe
  C:\Windows\System\ncQTGlW.exe
  2⤵
  PID:3528
- C:\Windows\System\euIKEEm.exe
  C:\Windows\System\euIKEEm.exe
  2⤵
  PID:3068
- C:\Windows\System\FQUGukS.exe
  C:\Windows\System\FQUGukS.exe
  2⤵
  PID:5128
- C:\Windows\System\XFykmJs.exe
  C:\Windows\System\XFykmJs.exe
  2⤵
  PID:5156
- C:\Windows\System\afuolRB.exe
  C:\Windows\System\afuolRB.exe
  2⤵
  PID:5184
- C:\Windows\System\FpmkLxF.exe
  C:\Windows\System\FpmkLxF.exe
  2⤵
  PID:5216
- C:\Windows\System\fiNYBCo.exe
  C:\Windows\System\fiNYBCo.exe
  2⤵
  PID:5240
- C:\Windows\System\jOIDQXN.exe
  C:\Windows\System\jOIDQXN.exe
  2⤵
  PID:5268
- C:\Windows\System\bRvCTHV.exe
  C:\Windows\System\bRvCTHV.exe
  2⤵
  PID:5296
- C:\Windows\System\sgSdaUi.exe
  C:\Windows\System\sgSdaUi.exe
  2⤵
  PID:5324
- C:\Windows\System\KbNIPnB.exe
  C:\Windows\System\KbNIPnB.exe
  2⤵
  PID:5352
- C:\Windows\System\pqakPDN.exe
  C:\Windows\System\pqakPDN.exe
  2⤵
  PID:5380
- C:\Windows\System\MyaoJuN.exe
  C:\Windows\System\MyaoJuN.exe
  2⤵
  PID:5408
- C:\Windows\System\KzWHFJz.exe
  C:\Windows\System\KzWHFJz.exe
  2⤵
  PID:5440
- C:\Windows\System\vjbkHrm.exe
  C:\Windows\System\vjbkHrm.exe
  2⤵
  PID:5464
- C:\Windows\System\jBrJFLE.exe
  C:\Windows\System\jBrJFLE.exe
  2⤵
  PID:5492
- C:\Windows\System\uaxibcq.exe
  C:\Windows\System\uaxibcq.exe
  2⤵
  PID:5520
- C:\Windows\System\XMkWGRB.exe
  C:\Windows\System\XMkWGRB.exe
  2⤵
  PID:5548
- C:\Windows\System\HgILzFD.exe
  C:\Windows\System\HgILzFD.exe
  2⤵
  PID:5576
- C:\Windows\System\aBiQbKO.exe
  C:\Windows\System\aBiQbKO.exe
  2⤵
  PID:5600
- C:\Windows\System\xYNtnkx.exe
  C:\Windows\System\xYNtnkx.exe
  2⤵
  PID:5636
- C:\Windows\System\IYcpCoQ.exe
  C:\Windows\System\IYcpCoQ.exe
  2⤵
  PID:5660
- C:\Windows\System\lByzGWS.exe
  C:\Windows\System\lByzGWS.exe
  2⤵
  PID:5688
- C:\Windows\System\CtIbiMr.exe
  C:\Windows\System\CtIbiMr.exe
  2⤵
  PID:5716
- C:\Windows\System\SFpoblz.exe
  C:\Windows\System\SFpoblz.exe
  2⤵
  PID:5744
- C:\Windows\System\yjcPNQu.exe
  C:\Windows\System\yjcPNQu.exe
  2⤵
  PID:5772
- C:\Windows\System\wuFCsGA.exe
  C:\Windows\System\wuFCsGA.exe
  2⤵
  PID:5796
- C:\Windows\System\yRsIVME.exe
  C:\Windows\System\yRsIVME.exe
  2⤵
  PID:5828
- C:\Windows\System\qXnaFcP.exe
  C:\Windows\System\qXnaFcP.exe
  2⤵
  PID:5860
- C:\Windows\System\bRfxuYo.exe
  C:\Windows\System\bRfxuYo.exe
  2⤵
  PID:5884
- C:\Windows\System\MxWgEfC.exe
  C:\Windows\System\MxWgEfC.exe
  2⤵
  PID:5912
- C:\Windows\System\JAbvBWp.exe
  C:\Windows\System\JAbvBWp.exe
  2⤵
  PID:5944
- C:\Windows\System\wbjmiTi.exe
  C:\Windows\System\wbjmiTi.exe
  2⤵
  PID:5968
- C:\Windows\System\yibEmHe.exe
  C:\Windows\System\yibEmHe.exe
  2⤵
  PID:5996
- C:\Windows\System\SpVhpDO.exe
  C:\Windows\System\SpVhpDO.exe
  2⤵
  PID:6024
- C:\Windows\System\ZYOqxJQ.exe
  C:\Windows\System\ZYOqxJQ.exe
  2⤵
  PID:6056
- C:\Windows\System\NoQiKfG.exe
  C:\Windows\System\NoQiKfG.exe
  2⤵
  PID:6080
- C:\Windows\System\wQuzPUm.exe
  C:\Windows\System\wQuzPUm.exe
  2⤵
  PID:6108
- C:\Windows\System\PVhiuNM.exe
  C:\Windows\System\PVhiuNM.exe
  2⤵
  PID:6140
- C:\Windows\System\oGJMnNr.exe
  C:\Windows\System\oGJMnNr.exe
  2⤵
  PID:3664
- C:\Windows\System\uUtSJkt.exe
  C:\Windows\System\uUtSJkt.exe
  2⤵
  PID:4968
- C:\Windows\System\JeRQmgR.exe
  C:\Windows\System\JeRQmgR.exe
  2⤵
  PID:2336
- C:\Windows\System\IhWzrcd.exe
  C:\Windows\System\IhWzrcd.exe
  2⤵
  PID:3036
- C:\Windows\System\RbjscHj.exe
  C:\Windows\System\RbjscHj.exe
  2⤵
  PID:2540
- C:\Windows\System\sKoWoiL.exe
  C:\Windows\System\sKoWoiL.exe
  2⤵
  PID:4260
- C:\Windows\System\VkJFZjY.exe
  C:\Windows\System\VkJFZjY.exe
  2⤵
  PID:1084
- C:\Windows\System\VwFRgmo.exe
  C:\Windows\System\VwFRgmo.exe
  2⤵
  PID:4324
- C:\Windows\System\nGYOCyZ.exe
  C:\Windows\System\nGYOCyZ.exe
  2⤵
  PID:4440
- C:\Windows\System\anMEdTY.exe
  C:\Windows\System\anMEdTY.exe
  2⤵
  PID:5172
- C:\Windows\System\cATbwVO.exe
  C:\Windows\System\cATbwVO.exe
  2⤵
  PID:5236
- C:\Windows\System\kfWUycO.exe
  C:\Windows\System\kfWUycO.exe
  2⤵
  PID:5316
- C:\Windows\System\MBWHBRU.exe
  C:\Windows\System\MBWHBRU.exe
  2⤵
  PID:5372
- C:\Windows\System\GILJgrP.exe
  C:\Windows\System\GILJgrP.exe
  2⤵
  PID:5424
- C:\Windows\System\EnFUehE.exe
  C:\Windows\System\EnFUehE.exe
  2⤵
  PID:5484
- C:\Windows\System\vLqjoGF.exe
  C:\Windows\System\vLqjoGF.exe
  2⤵
  PID:5560
- C:\Windows\System\iVUzRZd.exe
  C:\Windows\System\iVUzRZd.exe
  2⤵
  PID:5624
- C:\Windows\System\gRzQmAs.exe
  C:\Windows\System\gRzQmAs.exe
  2⤵
  PID:5680
- C:\Windows\System\qGqhMyB.exe
  C:\Windows\System\qGqhMyB.exe
  2⤵
  PID:5756
- C:\Windows\System\iLCMrYR.exe
  C:\Windows\System\iLCMrYR.exe
  2⤵
  PID:5816
- C:\Windows\System\DDTWiSl.exe
  C:\Windows\System\DDTWiSl.exe
  2⤵
  PID:5880
- C:\Windows\System\gpSFBhg.exe
  C:\Windows\System\gpSFBhg.exe
  2⤵
  PID:5952
- C:\Windows\System\rALZtaI.exe
  C:\Windows\System\rALZtaI.exe
  2⤵
  PID:6008
- C:\Windows\System\gEtbGPq.exe
  C:\Windows\System\gEtbGPq.exe
  2⤵
  PID:6092
- C:\Windows\System\dryMEhB.exe
  C:\Windows\System\dryMEhB.exe
  2⤵
  PID:3888
- C:\Windows\System\qxVyVRM.exe
  C:\Windows\System\qxVyVRM.exe
  2⤵
  PID:4128
- C:\Windows\System\pHTclul.exe
  C:\Windows\System\pHTclul.exe
  2⤵
  PID:6148
- C:\Windows\System\RnDlgvs.exe
  C:\Windows\System\RnDlgvs.exe
  2⤵
  PID:6180
- C:\Windows\System\qoqRJLK.exe
  C:\Windows\System\qoqRJLK.exe
  2⤵
  PID:6208
- C:\Windows\System\FCVmBBL.exe
  C:\Windows\System\FCVmBBL.exe
  2⤵
  PID:6236
- C:\Windows\System\mQJPHkp.exe
  C:\Windows\System\mQJPHkp.exe
  2⤵
  PID:6264
- C:\Windows\System\nIXZyYl.exe
  C:\Windows\System\nIXZyYl.exe
  2⤵
  PID:6296
- C:\Windows\System\LRPCQbE.exe
  C:\Windows\System\LRPCQbE.exe
  2⤵
  PID:6320
- C:\Windows\System\priRNIe.exe
  C:\Windows\System\priRNIe.exe
  2⤵
  PID:6352
- C:\Windows\System\GOANZlG.exe
  C:\Windows\System\GOANZlG.exe
  2⤵
  PID:6376
- C:\Windows\System\mOEGWUN.exe
  C:\Windows\System\mOEGWUN.exe
  2⤵
  PID:6408
- C:\Windows\System\rJPWQfL.exe
  C:\Windows\System\rJPWQfL.exe
  2⤵
  PID:6436
- C:\Windows\System\jebkIaJ.exe
  C:\Windows\System\jebkIaJ.exe
  2⤵
  PID:6460
- C:\Windows\System\DyIJhKc.exe
  C:\Windows\System\DyIJhKc.exe
  2⤵
  PID:6492
- C:\Windows\System\MGrysIn.exe
  C:\Windows\System\MGrysIn.exe
  2⤵
  PID:6516
- C:\Windows\System\JOZGvvc.exe
  C:\Windows\System\JOZGvvc.exe
  2⤵
  PID:6548
- C:\Windows\System\duoWdEB.exe
  C:\Windows\System\duoWdEB.exe
  2⤵
  PID:6572
- C:\Windows\System\LOWIzpp.exe
  C:\Windows\System\LOWIzpp.exe
  2⤵
  PID:6644
- C:\Windows\System\NNvuLPt.exe
  C:\Windows\System\NNvuLPt.exe
  2⤵
  PID:6660
- C:\Windows\System\aIlKmdS.exe
  C:\Windows\System\aIlKmdS.exe
  2⤵
  PID:6676
- C:\Windows\System\UnCxxMz.exe
  C:\Windows\System\UnCxxMz.exe
  2⤵
  PID:6692
- C:\Windows\System\HITybYc.exe
  C:\Windows\System\HITybYc.exe
  2⤵
  PID:6716
- C:\Windows\System\msafKKZ.exe
  C:\Windows\System\msafKKZ.exe
  2⤵
  PID:6748
- C:\Windows\System\orjRHEV.exe
  C:\Windows\System\orjRHEV.exe
  2⤵
  PID:6772
- C:\Windows\System\cqyCWoV.exe
  C:\Windows\System\cqyCWoV.exe
  2⤵
  PID:6804
- C:\Windows\System\VoqgsQQ.exe
  C:\Windows\System\VoqgsQQ.exe
  2⤵
  PID:6832
- C:\Windows\System\FknwxrN.exe
  C:\Windows\System\FknwxrN.exe
  2⤵
  PID:6856
- C:\Windows\System\MbQrxvK.exe
  C:\Windows\System\MbQrxvK.exe
  2⤵
  PID:6888
- C:\Windows\System\PhLqEvq.exe
  C:\Windows\System\PhLqEvq.exe
  2⤵
  PID:6912
- C:\Windows\System\briKXsp.exe
  C:\Windows\System\briKXsp.exe
  2⤵
  PID:6944
- C:\Windows\System\fKlGibO.exe
  C:\Windows\System\fKlGibO.exe
  2⤵
  PID:6972
- C:\Windows\System\QiHXqhe.exe
  C:\Windows\System\QiHXqhe.exe
  2⤵
  PID:6996
- C:\Windows\System\ScrPMMk.exe
  C:\Windows\System\ScrPMMk.exe
  2⤵
  PID:7028
- C:\Windows\System\hkZDkPG.exe
  C:\Windows\System\hkZDkPG.exe
  2⤵
  PID:7056
- C:\Windows\System\WzAcYBK.exe
  C:\Windows\System\WzAcYBK.exe
  2⤵
  PID:7084
- C:\Windows\System\ICmzeDU.exe
  C:\Windows\System\ICmzeDU.exe
  2⤵
  PID:7108
- C:\Windows\System\ZMIBTtV.exe
  C:\Windows\System\ZMIBTtV.exe
  2⤵
  PID:7140
- C:\Windows\System\osvFDgG.exe
  C:\Windows\System\osvFDgG.exe
  2⤵
  PID:4552
- C:\Windows\System\jEjeYBD.exe
  C:\Windows\System\jEjeYBD.exe
  2⤵
  PID:868
- C:\Windows\System\lsmJvSN.exe
  C:\Windows\System\lsmJvSN.exe
  2⤵
  PID:5140
- C:\Windows\System\FBNKgUx.exe
  C:\Windows\System\FBNKgUx.exe
  2⤵
  PID:5284
- C:\Windows\System\ULtmDWU.exe
  C:\Windows\System\ULtmDWU.exe
  2⤵
  PID:5400
- C:\Windows\System\ooLwmqt.exe
  C:\Windows\System\ooLwmqt.exe
  2⤵
  PID:5532
- C:\Windows\System\RKzKIkM.exe
  C:\Windows\System\RKzKIkM.exe
  2⤵
  PID:5676
- C:\Windows\System\ZtnMhST.exe
  C:\Windows\System\ZtnMhST.exe
  2⤵
  PID:5844
- C:\Windows\System\HWYMtoH.exe
  C:\Windows\System\HWYMtoH.exe
  2⤵
  PID:5984
- C:\Windows\System\fifpwbg.exe
  C:\Windows\System\fifpwbg.exe
  2⤵
  PID:6128
- C:\Windows\System\kkmiFgZ.exe
  C:\Windows\System\kkmiFgZ.exe
  2⤵
  PID:1236
- C:\Windows\System\MTCKrdr.exe
  C:\Windows\System\MTCKrdr.exe
  2⤵
  PID:6224
- C:\Windows\System\ffZYhvv.exe
  C:\Windows\System\ffZYhvv.exe
  2⤵
  PID:6280
- C:\Windows\System\XPnQjpy.exe
  C:\Windows\System\XPnQjpy.exe
  2⤵
  PID:928
- C:\Windows\System\YamCBXO.exe
  C:\Windows\System\YamCBXO.exe
  2⤵
  PID:6396
- C:\Windows\System\soQISFG.exe
  C:\Windows\System\soQISFG.exe
  2⤵
  PID:6472
- C:\Windows\System\CYnwiTz.exe
  C:\Windows\System\CYnwiTz.exe
  2⤵
  PID:6528
- C:\Windows\System\TUajJZg.exe
  C:\Windows\System\TUajJZg.exe
  2⤵
  PID:6588
- C:\Windows\System\qqhLZlq.exe
  C:\Windows\System\qqhLZlq.exe
  2⤵
  PID:6652
- C:\Windows\System\WclPraU.exe
  C:\Windows\System\WclPraU.exe
  2⤵
  PID:6708
- C:\Windows\System\LGrTaPa.exe
  C:\Windows\System\LGrTaPa.exe
  2⤵
  PID:1516
- C:\Windows\System\WBHZImy.exe
  C:\Windows\System\WBHZImy.exe
  2⤵
  PID:6844
- C:\Windows\System\rJWIFSI.exe
  C:\Windows\System\rJWIFSI.exe
  2⤵
  PID:6908
- C:\Windows\System\HrMWnce.exe
  C:\Windows\System\HrMWnce.exe
  2⤵
  PID:6984
- C:\Windows\System\sQnXnpC.exe
  C:\Windows\System\sQnXnpC.exe
  2⤵
  PID:7020
- C:\Windows\System\UAnmmkh.exe
  C:\Windows\System\UAnmmkh.exe
  2⤵
  PID:7096
- C:\Windows\System\nmPgCCL.exe
  C:\Windows\System\nmPgCCL.exe
  2⤵
  PID:7132
- C:\Windows\System\yPcCPwO.exe
  C:\Windows\System\yPcCPwO.exe
  2⤵
  PID:888
- C:\Windows\System\IyKOMxz.exe
  C:\Windows\System\IyKOMxz.exe
  2⤵
  PID:5224
- C:\Windows\System\mbHuhJT.exe
  C:\Windows\System\mbHuhJT.exe
  2⤵
  PID:5616
- C:\Windows\System\ZEbvPkt.exe
  C:\Windows\System\ZEbvPkt.exe
  2⤵
  PID:2360
- C:\Windows\System\wHZYjiM.exe
  C:\Windows\System\wHZYjiM.exe
  2⤵
  PID:4064
- C:\Windows\System\okNEKtG.exe
  C:\Windows\System\okNEKtG.exe
  2⤵
  PID:4012
- C:\Windows\System\WlYxInF.exe
  C:\Windows\System\WlYxInF.exe
  2⤵
  PID:6428
- C:\Windows\System\Wjiguku.exe
  C:\Windows\System\Wjiguku.exe
  2⤵
  PID:6508
- C:\Windows\System\tXfuWHQ.exe
  C:\Windows\System\tXfuWHQ.exe
  2⤵
  PID:6568
- C:\Windows\System\vuOVNEM.exe
  C:\Windows\System\vuOVNEM.exe
  2⤵
  PID:6736
- C:\Windows\System\cBlBAUR.exe
  C:\Windows\System\cBlBAUR.exe
  2⤵
  PID:6936
- C:\Windows\System\NEHyINw.exe
  C:\Windows\System\NEHyINw.exe
  2⤵
  PID:1604
- C:\Windows\System\FkbwUyM.exe
  C:\Windows\System\FkbwUyM.exe
  2⤵
  PID:1584
- C:\Windows\System\BXUBzCJ.exe
  C:\Windows\System\BXUBzCJ.exe
  2⤵
  PID:5204
- C:\Windows\System\UzbrnRi.exe
  C:\Windows\System\UzbrnRi.exe
  2⤵
  PID:4696
- C:\Windows\System\epzDzMy.exe
  C:\Windows\System\epzDzMy.exe
  2⤵
  PID:5516
- C:\Windows\System\OOWzuHg.exe
  C:\Windows\System\OOWzuHg.exe
  2⤵
  PID:3488
- C:\Windows\System\mrwkExc.exe
  C:\Windows\System\mrwkExc.exe
  2⤵
  PID:3584
- C:\Windows\System\VXZSCHg.exe
  C:\Windows\System\VXZSCHg.exe
  2⤵
  PID:1344
- C:\Windows\System\PkqujmT.exe
  C:\Windows\System\PkqujmT.exe
  2⤵
  PID:4400
- C:\Windows\System\JszrsuP.exe
  C:\Windows\System\JszrsuP.exe
  2⤵
  PID:6444
- C:\Windows\System\oZUxTjz.exe
  C:\Windows\System\oZUxTjz.exe
  2⤵
  PID:7072
- C:\Windows\System\CHHKojS.exe
  C:\Windows\System\CHHKojS.exe
  2⤵
  PID:6956
- C:\Windows\System\ALWgNcF.exe
  C:\Windows\System\ALWgNcF.exe
  2⤵
  PID:4280
- C:\Windows\System\jINfFmX.exe
  C:\Windows\System\jINfFmX.exe
  2⤵
  PID:412
- C:\Windows\System\vLUAZmE.exe
  C:\Windows\System\vLUAZmE.exe
  2⤵
  PID:6192
- C:\Windows\System\kTqfWCq.exe
  C:\Windows\System\kTqfWCq.exe
  2⤵
  PID:3040
- C:\Windows\System\GteEANF.exe
  C:\Windows\System\GteEANF.exe
  2⤵
  PID:2656
- C:\Windows\System\gacuVrH.exe
  C:\Windows\System\gacuVrH.exe
  2⤵
  PID:640
- C:\Windows\System\xxrVTbN.exe
  C:\Windows\System\xxrVTbN.exe
  2⤵
  PID:4708
- C:\Windows\System\peRAUAz.exe
  C:\Windows\System\peRAUAz.exe
  2⤵
  PID:1812
- C:\Windows\System\qXBWMMJ.exe
  C:\Windows\System\qXBWMMJ.exe
  2⤵
  PID:7172
- C:\Windows\System\oexTSlK.exe
  C:\Windows\System\oexTSlK.exe
  2⤵
  PID:7188
- C:\Windows\System\bJscbYo.exe
  C:\Windows\System\bJscbYo.exe
  2⤵
  PID:7208
- C:\Windows\System\ntaOLWi.exe
  C:\Windows\System\ntaOLWi.exe
  2⤵
  PID:7232
- C:\Windows\System\dYJahLs.exe
  C:\Windows\System\dYJahLs.exe
  2⤵
  PID:7272
- C:\Windows\System\jXIOhBz.exe
  C:\Windows\System\jXIOhBz.exe
  2⤵
  PID:7296
- C:\Windows\System\RQPMZvn.exe
  C:\Windows\System\RQPMZvn.exe
  2⤵
  PID:7336
- C:\Windows\System\lqIejKj.exe
  C:\Windows\System\lqIejKj.exe
  2⤵
  PID:7376
- C:\Windows\System\iSTxjDF.exe
  C:\Windows\System\iSTxjDF.exe
  2⤵
  PID:7400
- C:\Windows\System\JPkHayl.exe
  C:\Windows\System\JPkHayl.exe
  2⤵
  PID:7428
- C:\Windows\System\eTywKoR.exe
  C:\Windows\System\eTywKoR.exe
  2⤵
  PID:7460
- C:\Windows\System\QMPajEJ.exe
  C:\Windows\System\QMPajEJ.exe
  2⤵
  PID:7484
- C:\Windows\System\mZipQTa.exe
  C:\Windows\System\mZipQTa.exe
  2⤵
  PID:7532
- C:\Windows\System\RaldIzQ.exe
  C:\Windows\System\RaldIzQ.exe
  2⤵
  PID:7636
- C:\Windows\System\JtAYNPu.exe
  C:\Windows\System\JtAYNPu.exe
  2⤵
  PID:7660
- C:\Windows\System\JOBshNC.exe
  C:\Windows\System\JOBshNC.exe
  2⤵
  PID:7680
- C:\Windows\System\pFQXREM.exe
  C:\Windows\System\pFQXREM.exe
  2⤵
  PID:7716
- C:\Windows\System\fMviPVm.exe
  C:\Windows\System\fMviPVm.exe
  2⤵
  PID:7744
- C:\Windows\System\CdjlwWL.exe
  C:\Windows\System\CdjlwWL.exe
  2⤵
  PID:7764
- C:\Windows\System\snOhkBD.exe
  C:\Windows\System\snOhkBD.exe
  2⤵
  PID:7788
- C:\Windows\System\qtwSYcI.exe
  C:\Windows\System\qtwSYcI.exe
  2⤵
  PID:7808
- C:\Windows\System\lGtXKFH.exe
  C:\Windows\System\lGtXKFH.exe
  2⤵
  PID:7860
- C:\Windows\System\dxHBBfv.exe
  C:\Windows\System\dxHBBfv.exe
  2⤵
  PID:7880
- C:\Windows\System\KwfyvgC.exe
  C:\Windows\System\KwfyvgC.exe
  2⤵
  PID:7896
- C:\Windows\System\kOqLVtB.exe
  C:\Windows\System\kOqLVtB.exe
  2⤵
  PID:7956
- C:\Windows\System\tUiwDjI.exe
  C:\Windows\System\tUiwDjI.exe
  2⤵
  PID:7984
- C:\Windows\System\XxvRtZS.exe
  C:\Windows\System\XxvRtZS.exe
  2⤵
  PID:8004
- C:\Windows\System\nkxjELv.exe
  C:\Windows\System\nkxjELv.exe
  2⤵
  PID:8024
- C:\Windows\System\xPLzQeC.exe
  C:\Windows\System\xPLzQeC.exe
  2⤵
  PID:8040
- C:\Windows\System\RHvcuMW.exe
  C:\Windows\System\RHvcuMW.exe
  2⤵
  PID:8084
- C:\Windows\System\StqXhLh.exe
  C:\Windows\System\StqXhLh.exe
  2⤵
  PID:8112
- C:\Windows\System\sQNKodF.exe
  C:\Windows\System\sQNKodF.exe
  2⤵
  PID:8128
- C:\Windows\System\UtgflXY.exe
  C:\Windows\System\UtgflXY.exe
  2⤵
  PID:8156
- C:\Windows\System\nRpsEmQ.exe
  C:\Windows\System\nRpsEmQ.exe
  2⤵
  PID:8176
- C:\Windows\System\FAhEYMm.exe
  C:\Windows\System\FAhEYMm.exe
  2⤵
  PID:1948
- C:\Windows\System\rctYyNp.exe
  C:\Windows\System\rctYyNp.exe
  2⤵
  PID:7200
- C:\Windows\System\SYfvszr.exe
  C:\Windows\System\SYfvszr.exe
  2⤵
  PID:7260
- C:\Windows\System\ybJaBwb.exe
  C:\Windows\System\ybJaBwb.exe
  2⤵
  PID:7292
- C:\Windows\System\vNIGoBu.exe
  C:\Windows\System\vNIGoBu.exe
  2⤵
  PID:7416
- C:\Windows\System\sgOFESO.exe
  C:\Windows\System\sgOFESO.exe
  2⤵
  PID:7476
- C:\Windows\System\EwtGtWB.exe
  C:\Windows\System\EwtGtWB.exe
  2⤵
  PID:7556
- C:\Windows\System\VHrpGNy.exe
  C:\Windows\System\VHrpGNy.exe
  2⤵
  PID:7596
- C:\Windows\System\GWklCnk.exe
  C:\Windows\System\GWklCnk.exe
  2⤵
  PID:7616
- C:\Windows\System\rtbCZOB.exe
  C:\Windows\System\rtbCZOB.exe
  2⤵
  PID:7756
- C:\Windows\System\BvAYbyK.exe
  C:\Windows\System\BvAYbyK.exe
  2⤵
  PID:7800
- C:\Windows\System\fBAXyLY.exe
  C:\Windows\System\fBAXyLY.exe
  2⤵
  PID:7872
- C:\Windows\System\IcWKghu.exe
  C:\Windows\System\IcWKghu.exe
  2⤵
  PID:7932
- C:\Windows\System\jzjgLbb.exe
  C:\Windows\System\jzjgLbb.exe
  2⤵
  PID:8076
- C:\Windows\System\uvdrjGl.exe
  C:\Windows\System\uvdrjGl.exe
  2⤵
  PID:8060
- C:\Windows\System\bkaFuxP.exe
  C:\Windows\System\bkaFuxP.exe
  2⤵
  PID:8120
- C:\Windows\System\YiCJIid.exe
  C:\Windows\System\YiCJIid.exe
  2⤵
  PID:2536
- C:\Windows\System\OmtYdmq.exe
  C:\Windows\System\OmtYdmq.exe
  2⤵
  PID:7184
- C:\Windows\System\pYFLYKv.exe
  C:\Windows\System\pYFLYKv.exe
  2⤵
  PID:7312
- C:\Windows\System\OPgiYfZ.exe
  C:\Windows\System\OPgiYfZ.exe
  2⤵
  PID:7608
- C:\Windows\System\tPUdeRn.exe
  C:\Windows\System\tPUdeRn.exe
  2⤵
  PID:7824
- C:\Windows\System\pEoJDgF.exe
  C:\Windows\System\pEoJDgF.exe
  2⤵
  PID:8012
- C:\Windows\System\YmZdodP.exe
  C:\Windows\System\YmZdodP.exe
  2⤵
  PID:8068
- C:\Windows\System\uGmhfqZ.exe
  C:\Windows\System\uGmhfqZ.exe
  2⤵
  PID:3244
- C:\Windows\System\haCfewT.exe
  C:\Windows\System\haCfewT.exe
  2⤵
  PID:6200
- C:\Windows\System\vmPRmwn.exe
  C:\Windows\System\vmPRmwn.exe
  2⤵
  PID:7364
- C:\Windows\System\urOyGhI.exe
  C:\Windows\System\urOyGhI.exe
  2⤵
  PID:7980
- C:\Windows\System\fOlJvPy.exe
  C:\Windows\System\fOlJvPy.exe
  2⤵
  PID:7524
- C:\Windows\System\HcPpyge.exe
  C:\Windows\System\HcPpyge.exe
  2⤵
  PID:8140
- C:\Windows\System\ilqJZpH.exe
  C:\Windows\System\ilqJZpH.exe
  2⤵
  PID:8216
- C:\Windows\System\XzKJIPz.exe
  C:\Windows\System\XzKJIPz.exe
  2⤵
  PID:8236
- C:\Windows\System\kgNgTUk.exe
  C:\Windows\System\kgNgTUk.exe
  2⤵
  PID:8288
- C:\Windows\System\kMLavFA.exe
  C:\Windows\System\kMLavFA.exe
  2⤵
  PID:8316
- C:\Windows\System\iLtVFeP.exe
  C:\Windows\System\iLtVFeP.exe
  2⤵
  PID:8344
- C:\Windows\System\yCZLEFF.exe
  C:\Windows\System\yCZLEFF.exe
  2⤵
  PID:8376
- C:\Windows\System\owMgwtj.exe
  C:\Windows\System\owMgwtj.exe
  2⤵
  PID:8404
- C:\Windows\System\HhJhLoE.exe
  C:\Windows\System\HhJhLoE.exe
  2⤵
  PID:8444
- C:\Windows\System\LjymzQm.exe
  C:\Windows\System\LjymzQm.exe
  2⤵
  PID:8464
- C:\Windows\System\ZVMoRRc.exe
  C:\Windows\System\ZVMoRRc.exe
  2⤵
  PID:8488
- C:\Windows\System\SJRDULt.exe
  C:\Windows\System\SJRDULt.exe
  2⤵
  PID:8516
- C:\Windows\System\ryiNGvA.exe
  C:\Windows\System\ryiNGvA.exe
  2⤵
  PID:8544
- C:\Windows\System\etpxEPd.exe
  C:\Windows\System\etpxEPd.exe
  2⤵
  PID:8572
- C:\Windows\System\JVeFXFc.exe
  C:\Windows\System\JVeFXFc.exe
  2⤵
  PID:8592
- C:\Windows\System\krcOIsI.exe
  C:\Windows\System\krcOIsI.exe
  2⤵
  PID:8616
- C:\Windows\System\JITeEdl.exe
  C:\Windows\System\JITeEdl.exe
  2⤵
  PID:8644
- C:\Windows\System\eBQnMbC.exe
  C:\Windows\System\eBQnMbC.exe
  2⤵
  PID:8668
- C:\Windows\System\EoTXWXN.exe
  C:\Windows\System\EoTXWXN.exe
  2⤵
  PID:8708
- C:\Windows\System\PFOLnHx.exe
  C:\Windows\System\PFOLnHx.exe
  2⤵
  PID:8728
- C:\Windows\System\EeFZIGB.exe
  C:\Windows\System\EeFZIGB.exe
  2⤵
  PID:8760
- C:\Windows\System\JUXPgvr.exe
  C:\Windows\System\JUXPgvr.exe
  2⤵
  PID:8796
- C:\Windows\System\gnsAzjv.exe
  C:\Windows\System\gnsAzjv.exe
  2⤵
  PID:8812
- C:\Windows\System\VreByNi.exe
  C:\Windows\System\VreByNi.exe
  2⤵
  PID:8832
- C:\Windows\System\pXmdUqP.exe
  C:\Windows\System\pXmdUqP.exe
  2⤵
  PID:8864
- C:\Windows\System\NSYpaUb.exe
  C:\Windows\System\NSYpaUb.exe
  2⤵
  PID:8900
- C:\Windows\System\hsjzPaK.exe
  C:\Windows\System\hsjzPaK.exe
  2⤵
  PID:8924
- C:\Windows\System\SVwLHTc.exe
  C:\Windows\System\SVwLHTc.exe
  2⤵
  PID:8976
- C:\Windows\System\iabKVrz.exe
  C:\Windows\System\iabKVrz.exe
  2⤵
  PID:8992
- C:\Windows\System\lQlTjCl.exe
  C:\Windows\System\lQlTjCl.exe
  2⤵
  PID:9016
- C:\Windows\System\XiCINsF.exe
  C:\Windows\System\XiCINsF.exe
  2⤵
  PID:9060
- C:\Windows\System\SGudawg.exe
  C:\Windows\System\SGudawg.exe
  2⤵
  PID:9092
- C:\Windows\System\pLWgpkZ.exe
  C:\Windows\System\pLWgpkZ.exe
  2⤵
  PID:9116
- C:\Windows\System\yVnluGE.exe
  C:\Windows\System\yVnluGE.exe
  2⤵
  PID:9132
- C:\Windows\System\pexShRi.exe
  C:\Windows\System\pexShRi.exe
  2⤵
  PID:9164
- C:\Windows\System\irxwtuz.exe
  C:\Windows\System\irxwtuz.exe
  2⤵
  PID:9188
- C:\Windows\System\iQQhNTH.exe
  C:\Windows\System\iQQhNTH.exe
  2⤵
  PID:9212
- C:\Windows\System\mVWYZwA.exe
  C:\Windows\System\mVWYZwA.exe
  2⤵
  PID:8232
- C:\Windows\System\YFElQRO.exe
  C:\Windows\System\YFElQRO.exe
  2⤵
  PID:8268
- C:\Windows\System\vpBnJGf.exe
  C:\Windows\System\vpBnJGf.exe
  2⤵
  PID:8340
- C:\Windows\System\kyJhSvD.exe
  C:\Windows\System\kyJhSvD.exe
  2⤵
  PID:8428
- C:\Windows\System\lWAloaW.exe
  C:\Windows\System\lWAloaW.exe
  2⤵
  PID:8456
- C:\Windows\System\xPoMloO.exe
  C:\Windows\System\xPoMloO.exe
  2⤵
  PID:8528
- C:\Windows\System\bvVNhBM.exe
  C:\Windows\System\bvVNhBM.exe
  2⤵
  PID:8612
- C:\Windows\System\lEnFpSh.exe
  C:\Windows\System\lEnFpSh.exe
  2⤵
  PID:8740
- C:\Windows\System\wewcJvG.exe
  C:\Windows\System\wewcJvG.exe
  2⤵
  PID:8784
- C:\Windows\System\WoMkaqc.exe
  C:\Windows\System\WoMkaqc.exe
  2⤵
  PID:8804
- C:\Windows\System\YkhOgZv.exe
  C:\Windows\System\YkhOgZv.exe
  2⤵
  PID:8876
- C:\Windows\System\YddEZub.exe
  C:\Windows\System\YddEZub.exe
  2⤵
  PID:8916
- C:\Windows\System\dVDhYyi.exe
  C:\Windows\System\dVDhYyi.exe
  2⤵
  PID:8988
- C:\Windows\System\NUIyMwb.exe
  C:\Windows\System\NUIyMwb.exe
  2⤵
  PID:9128
- C:\Windows\System\SRzBJVv.exe
  C:\Windows\System\SRzBJVv.exe
  2⤵
  PID:9184
- C:\Windows\System\uJMVMEE.exe
  C:\Windows\System\uJMVMEE.exe
  2⤵
  PID:9160
- C:\Windows\System\oRjbKst.exe
  C:\Windows\System\oRjbKst.exe
  2⤵
  PID:8224
- C:\Windows\System\sKKakFU.exe
  C:\Windows\System\sKKakFU.exe
  2⤵
  PID:8280
- C:\Windows\System\OxVYJiO.exe
  C:\Windows\System\OxVYJiO.exe
  2⤵
  PID:8580
- C:\Windows\System\MlFMgdb.exe
  C:\Windows\System\MlFMgdb.exe
  2⤵
  PID:8696
- C:\Windows\System\nTdMOHn.exe
  C:\Windows\System\nTdMOHn.exe
  2⤵
  PID:8720
- C:\Windows\System\vAQzNGH.exe
  C:\Windows\System\vAQzNGH.exe
  2⤵
  PID:8956
- C:\Windows\System\HZCMvKf.exe
  C:\Windows\System\HZCMvKf.exe
  2⤵
  PID:8328
- C:\Windows\System\JSJjBfD.exe
  C:\Windows\System\JSJjBfD.exe
  2⤵
  PID:8656
- C:\Windows\System\caPLBxF.exe
  C:\Windows\System\caPLBxF.exe
  2⤵
  PID:9108
- C:\Windows\System\PXMKDhb.exe
  C:\Windows\System\PXMKDhb.exe
  2⤵
  PID:8304
- C:\Windows\System\VwSAeoE.exe
  C:\Windows\System\VwSAeoE.exe
  2⤵
  PID:7784
- C:\Windows\System\XAALsjQ.exe
  C:\Windows\System\XAALsjQ.exe
  2⤵
  PID:9228
- C:\Windows\System\aWCCqvs.exe
  C:\Windows\System\aWCCqvs.exe
  2⤵
  PID:9280
- C:\Windows\System\vNXkVcW.exe
  C:\Windows\System\vNXkVcW.exe
  2⤵
  PID:9296
- C:\Windows\System\lfEWKev.exe
  C:\Windows\System\lfEWKev.exe
  2⤵
  PID:9336
- C:\Windows\System\cmbnlPb.exe
  C:\Windows\System\cmbnlPb.exe
  2⤵
  PID:9356
- C:\Windows\System\xzrqKAs.exe
  C:\Windows\System\xzrqKAs.exe
  2⤵
  PID:9376
- C:\Windows\System\UGoleDR.exe
  C:\Windows\System\UGoleDR.exe
  2⤵
  PID:9396
- C:\Windows\System\Nckdwld.exe
  C:\Windows\System\Nckdwld.exe
  2⤵
  PID:9420
- C:\Windows\System\anlrMcN.exe
  C:\Windows\System\anlrMcN.exe
  2⤵
  PID:9464
- C:\Windows\System\gCAyYGL.exe
  C:\Windows\System\gCAyYGL.exe
  2⤵
  PID:9504
- C:\Windows\System\AARYLUx.exe
  C:\Windows\System\AARYLUx.exe
  2⤵
  PID:9520
- C:\Windows\System\oEkkAXx.exe
  C:\Windows\System\oEkkAXx.exe
  2⤵
  PID:9548
- C:\Windows\System\wLaTzbR.exe
  C:\Windows\System\wLaTzbR.exe
  2⤵
  PID:9564
- C:\Windows\System\lapzkCy.exe
  C:\Windows\System\lapzkCy.exe
  2⤵
  PID:9588
- C:\Windows\System\YOZbEqu.exe
  C:\Windows\System\YOZbEqu.exe
  2⤵
  PID:9620
- C:\Windows\System\SWHnaei.exe
  C:\Windows\System\SWHnaei.exe
  2⤵
  PID:9636
- C:\Windows\System\SAQJKhY.exe
  C:\Windows\System\SAQJKhY.exe
  2⤵
  PID:9668
- C:\Windows\System\WXueXDk.exe
  C:\Windows\System\WXueXDk.exe
  2⤵
  PID:9700
- C:\Windows\System\POVuwkg.exe
  C:\Windows\System\POVuwkg.exe
  2⤵
  PID:9716
- C:\Windows\System\MsPOSFw.exe
  C:\Windows\System\MsPOSFw.exe
  2⤵
  PID:9744
- C:\Windows\System\FyjtkOF.exe
  C:\Windows\System\FyjtkOF.exe
  2⤵
  PID:9764
- C:\Windows\System\INmXnYc.exe
  C:\Windows\System\INmXnYc.exe
  2⤵
  PID:9824
- C:\Windows\System\cDWsIFO.exe
  C:\Windows\System\cDWsIFO.exe
  2⤵
  PID:9844
- C:\Windows\System\oGbPUag.exe
  C:\Windows\System\oGbPUag.exe
  2⤵
  PID:9860
- C:\Windows\System\yOWaNHP.exe
  C:\Windows\System\yOWaNHP.exe
  2⤵
  PID:9904
- C:\Windows\System\KHJzjcV.exe
  C:\Windows\System\KHJzjcV.exe
  2⤵
  PID:9928
- C:\Windows\System\eWESmwd.exe
  C:\Windows\System\eWESmwd.exe
  2⤵
  PID:9948
- C:\Windows\System\XCUwBaI.exe
  C:\Windows\System\XCUwBaI.exe
  2⤵
  PID:9968
- C:\Windows\System\QeYoCWH.exe
  C:\Windows\System\QeYoCWH.exe
  2⤵
  PID:9988
- C:\Windows\System\oYotmUK.exe
  C:\Windows\System\oYotmUK.exe
  2⤵
  PID:10012
- C:\Windows\System\TijjaEY.exe
  C:\Windows\System\TijjaEY.exe
  2⤵
  PID:10056
- C:\Windows\System\SDJKUBN.exe
  C:\Windows\System\SDJKUBN.exe
  2⤵
  PID:10088
- C:\Windows\System\BNlDZTg.exe
  C:\Windows\System\BNlDZTg.exe
  2⤵
  PID:10112
- C:\Windows\System\EWtfykR.exe
  C:\Windows\System\EWtfykR.exe
  2⤵
  PID:10140
- C:\Windows\System\USrkGwz.exe
  C:\Windows\System\USrkGwz.exe
  2⤵
  PID:10160
- C:\Windows\System\BLedwOB.exe
  C:\Windows\System\BLedwOB.exe
  2⤵
  PID:10180
- C:\Windows\System\OHLmPYH.exe
  C:\Windows\System\OHLmPYH.exe
  2⤵
  PID:10228
- C:\Windows\System\CmwOkGy.exe
  C:\Windows\System\CmwOkGy.exe
  2⤵
  PID:9240
- C:\Windows\System\nXMQEyw.exe
  C:\Windows\System\nXMQEyw.exe
  2⤵
  PID:9292
- C:\Windows\System\XLhcSty.exe
  C:\Windows\System\XLhcSty.exe
  2⤵
  PID:9344
- C:\Windows\System\ZEgDGtI.exe
  C:\Windows\System\ZEgDGtI.exe
  2⤵
  PID:9372
- C:\Windows\System\mqisSDU.exe
  C:\Windows\System\mqisSDU.exe
  2⤵
  PID:9540
- C:\Windows\System\VFvpuXq.exe
  C:\Windows\System\VFvpuXq.exe
  2⤵
  PID:9632
- C:\Windows\System\ecxrvFa.exe
  C:\Windows\System\ecxrvFa.exe
  2⤵
  PID:9736
- C:\Windows\System\fdZssqS.exe
  C:\Windows\System\fdZssqS.exe
  2⤵
  PID:9796
- C:\Windows\System\howkYjy.exe
  C:\Windows\System\howkYjy.exe
  2⤵
  PID:9840
- C:\Windows\System\zAehTUi.exe
  C:\Windows\System\zAehTUi.exe
  2⤵
  PID:9876
- C:\Windows\System\PaWRQvY.exe
  C:\Windows\System\PaWRQvY.exe
  2⤵
  PID:9976
- C:\Windows\System\uncBcqE.exe
  C:\Windows\System\uncBcqE.exe
  2⤵
  PID:10028
- C:\Windows\System\zqbeqpE.exe
  C:\Windows\System\zqbeqpE.exe
  2⤵
  PID:10040
- C:\Windows\System\nTuurPk.exe
  C:\Windows\System\nTuurPk.exe
  2⤵
  PID:10104
- C:\Windows\System\xkLXsbq.exe
  C:\Windows\System\xkLXsbq.exe
  2⤵
  PID:10152
- C:\Windows\System\ydCNdzV.exe
  C:\Windows\System\ydCNdzV.exe
  2⤵
  PID:9260
- C:\Windows\System\MBjEywE.exe
  C:\Windows\System\MBjEywE.exe
  2⤵
  PID:9408
- C:\Windows\System\ArtyTeZ.exe
  C:\Windows\System\ArtyTeZ.exe
  2⤵
  PID:9576
- C:\Windows\System\xqmWrpM.exe
  C:\Windows\System\xqmWrpM.exe
  2⤵
  PID:9656
- C:\Windows\System\ckJbtwL.exe
  C:\Windows\System\ckJbtwL.exe
  2⤵
  PID:9784
- C:\Windows\System\AxCeXhS.exe
  C:\Windows\System\AxCeXhS.exe
  2⤵
  PID:9920
- C:\Windows\System\FVXgasp.exe
  C:\Windows\System\FVXgasp.exe
  2⤵
  PID:10132
- C:\Windows\System\NkLVbTV.exe
  C:\Windows\System\NkLVbTV.exe
  2⤵
  PID:9412
- C:\Windows\System\tuLpxeS.exe
  C:\Windows\System\tuLpxeS.exe
  2⤵
  PID:9884
- C:\Windows\System\lTdEbwa.exe
  C:\Windows\System\lTdEbwa.exe
  2⤵
  PID:8228
- C:\Windows\System\JrsDHGS.exe
  C:\Windows\System\JrsDHGS.exe
  2⤵
  PID:9560
- C:\Windows\System\DZreGBr.exe
  C:\Windows\System\DZreGBr.exe
  2⤵
  PID:10260
- C:\Windows\System\DwQrdqp.exe
  C:\Windows\System\DwQrdqp.exe
  2⤵
  PID:10280
- C:\Windows\System\ZBiSQGA.exe
  C:\Windows\System\ZBiSQGA.exe
  2⤵
  PID:10296
- C:\Windows\System\mvgiflc.exe
  C:\Windows\System\mvgiflc.exe
  2⤵
  PID:10328
- C:\Windows\System\rzQWOqZ.exe
  C:\Windows\System\rzQWOqZ.exe
  2⤵
  PID:10356
- C:\Windows\System\PeSjXGf.exe
  C:\Windows\System\PeSjXGf.exe
  2⤵
  PID:10380
- C:\Windows\System\tXOMSNc.exe
  C:\Windows\System\tXOMSNc.exe
  2⤵
  PID:10408
- C:\Windows\System\MxVtavO.exe
  C:\Windows\System\MxVtavO.exe
  2⤵
  PID:10464
- C:\Windows\System\lmgKOaQ.exe
  C:\Windows\System\lmgKOaQ.exe
  2⤵
  PID:10484
- C:\Windows\System\GZLMASe.exe
  C:\Windows\System\GZLMASe.exe
  2⤵
  PID:10504
- C:\Windows\System\HceBqBi.exe
  C:\Windows\System\HceBqBi.exe
  2⤵
  PID:10528
- C:\Windows\System\uZefLjD.exe
  C:\Windows\System\uZefLjD.exe
  2⤵
  PID:10564
- C:\Windows\System\kopiwuB.exe
  C:\Windows\System\kopiwuB.exe
  2⤵
  PID:10584
- C:\Windows\System\fPPUhok.exe
  C:\Windows\System\fPPUhok.exe
  2⤵
  PID:10612
- C:\Windows\System\FkLuibK.exe
  C:\Windows\System\FkLuibK.exe
  2⤵
  PID:10644
- C:\Windows\System\ILKTRGk.exe
  C:\Windows\System\ILKTRGk.exe
  2⤵
  PID:10672
- C:\Windows\System\nvKnAou.exe
  C:\Windows\System\nvKnAou.exe
  2⤵
  PID:10696
- C:\Windows\System\QYDinYA.exe
  C:\Windows\System\QYDinYA.exe
  2⤵
  PID:10716
- C:\Windows\System\xfYEkOZ.exe
  C:\Windows\System\xfYEkOZ.exe
  2⤵
  PID:10732
- C:\Windows\System\xDLJjpS.exe
  C:\Windows\System\xDLJjpS.exe
  2⤵
  PID:10772
- C:\Windows\System\qryjbFQ.exe
  C:\Windows\System\qryjbFQ.exe
  2⤵
  PID:10796
- C:\Windows\System\BgWQSrz.exe
  C:\Windows\System\BgWQSrz.exe
  2⤵
  PID:10828
- C:\Windows\System\kPbthDF.exe
  C:\Windows\System\kPbthDF.exe
  2⤵
  PID:10880
- C:\Windows\System\tXvpdus.exe
  C:\Windows\System\tXvpdus.exe
  2⤵
  PID:10904
- C:\Windows\System\LEVRyTH.exe
  C:\Windows\System\LEVRyTH.exe
  2⤵
  PID:10924
- C:\Windows\System\NNlsubL.exe
  C:\Windows\System\NNlsubL.exe
  2⤵
  PID:10948
- C:\Windows\System\bSuZUxZ.exe
  C:\Windows\System\bSuZUxZ.exe
  2⤵
  PID:10972
- C:\Windows\System\FtlBaDe.exe
  C:\Windows\System\FtlBaDe.exe
  2⤵
  PID:11000
- C:\Windows\System\WffqGbN.exe
  C:\Windows\System\WffqGbN.exe
  2⤵
  PID:11024
- C:\Windows\System\dtsgsKo.exe
  C:\Windows\System\dtsgsKo.exe
  2⤵
  PID:11040
- C:\Windows\System\ohpkLFc.exe
  C:\Windows\System\ohpkLFc.exe
  2⤵
  PID:11104
- C:\Windows\System\jKvfGbn.exe
  C:\Windows\System\jKvfGbn.exe
  2⤵
  PID:11132
- C:\Windows\System\tPkiHzH.exe
  C:\Windows\System\tPkiHzH.exe
  2⤵
  PID:11160
- C:\Windows\System\aXdHsxn.exe
  C:\Windows\System\aXdHsxn.exe
  2⤵
  PID:11196
- C:\Windows\System\xZYlHjY.exe
  C:\Windows\System\xZYlHjY.exe
  2⤵
  PID:11216
- C:\Windows\System\HwkapTO.exe
  C:\Windows\System\HwkapTO.exe
  2⤵
  PID:11244
- C:\Windows\System\RrKgvDo.exe
  C:\Windows\System\RrKgvDo.exe
  2⤵
  PID:10292
- C:\Windows\System\FZrKyBV.exe
  C:\Windows\System\FZrKyBV.exe
  2⤵
  PID:10272
- C:\Windows\System\XAJlWGJ.exe
  C:\Windows\System\XAJlWGJ.exe
  2⤵
  PID:10308
- C:\Windows\System\vRmoKxX.exe
  C:\Windows\System\vRmoKxX.exe
  2⤵
  PID:10368
- C:\Windows\System\qGWVYpb.exe
  C:\Windows\System\qGWVYpb.exe
  2⤵
  PID:10480
- C:\Windows\System\kSZSOkF.exe
  C:\Windows\System\kSZSOkF.exe
  2⤵
  PID:10500
- C:\Windows\System\ZCIPpEU.exe
  C:\Windows\System\ZCIPpEU.exe
  2⤵
  PID:10580
- C:\Windows\System\tNCZhjs.exe
  C:\Windows\System\tNCZhjs.exe
  2⤵
  PID:10628
- C:\Windows\System\CaDiEuJ.exe
  C:\Windows\System\CaDiEuJ.exe
  2⤵
  PID:10708
- C:\Windows\System\ccEaBTo.exe
  C:\Windows\System\ccEaBTo.exe
  2⤵
  PID:10788
- C:\Windows\System\wKpmOFn.exe
  C:\Windows\System\wKpmOFn.exe
  2⤵
  PID:10824
- C:\Windows\System\iOyDARk.exe
  C:\Windows\System\iOyDARk.exe
  2⤵
  PID:10892
- C:\Windows\System\WLfLhCj.exe
  C:\Windows\System\WLfLhCj.exe
  2⤵
  PID:10916
- C:\Windows\System\MuQGnoG.exe
  C:\Windows\System\MuQGnoG.exe
  2⤵
  PID:10964
- C:\Windows\System\PSgedpr.exe
  C:\Windows\System\PSgedpr.exe
  2⤵
  PID:11012
- C:\Windows\System\JZZpPeS.exe
  C:\Windows\System\JZZpPeS.exe
  2⤵
  PID:11008
- C:\Windows\System\SvBKJtW.exe
  C:\Windows\System\SvBKJtW.exe
  2⤵
  PID:11100
- C:\Windows\System\ulpoEOY.exe
  C:\Windows\System\ulpoEOY.exe
  2⤵
  PID:11184
- C:\Windows\System\QtNXifv.exe
  C:\Windows\System\QtNXifv.exe
  2⤵
  PID:11232
- C:\Windows\System\CibEtiB.exe
  C:\Windows\System\CibEtiB.exe
  2⤵
  PID:10428
- C:\Windows\System\npfnykp.exe
  C:\Windows\System\npfnykp.exe
  2⤵
  PID:10520
- C:\Windows\System\NsChxRD.exe
  C:\Windows\System\NsChxRD.exe
  2⤵
  PID:10748
- C:\Windows\System\EizYBVb.exe
  C:\Windows\System\EizYBVb.exe
  2⤵
  PID:10764
- C:\Windows\System\OEOwdPZ.exe
  C:\Windows\System\OEOwdPZ.exe
  2⤵
  PID:10944
- C:\Windows\System\tgnAWoz.exe
  C:\Windows\System\tgnAWoz.exe
  2⤵
  PID:10988
- C:\Windows\System\coeIKSi.exe
  C:\Windows\System\coeIKSi.exe
  2⤵
  PID:10636
- C:\Windows\System\AsYeAmg.exe
  C:\Windows\System\AsYeAmg.exe
  2⤵
  PID:4340
- C:\Windows\System\psnOCbV.exe
  C:\Windows\System\psnOCbV.exe
  2⤵
  PID:10940
- C:\Windows\System\TcgkvPt.exe
  C:\Windows\System\TcgkvPt.exe
  2⤵
  PID:10572
- C:\Windows\System\dZlECry.exe
  C:\Windows\System\dZlECry.exe
  2⤵
  PID:11292
- C:\Windows\System\jMDubFi.exe
  C:\Windows\System\jMDubFi.exe
  2⤵
  PID:11364
- C:\Windows\System\EWewSac.exe
  C:\Windows\System\EWewSac.exe
  2⤵
  PID:11384
- C:\Windows\System\ynXoAlk.exe
  C:\Windows\System\ynXoAlk.exe
  2⤵
  PID:11400
- C:\Windows\System\mlZcjxa.exe
  C:\Windows\System\mlZcjxa.exe
  2⤵
  PID:11428
- C:\Windows\System\vvkxGtx.exe
  C:\Windows\System\vvkxGtx.exe
  2⤵
  PID:11468
- C:\Windows\System\oWUqipD.exe
  C:\Windows\System\oWUqipD.exe
  2⤵
  PID:11508
- C:\Windows\System\oPlqQQf.exe
  C:\Windows\System\oPlqQQf.exe
  2⤵
  PID:11524
- C:\Windows\System\zDbNTfL.exe
  C:\Windows\System\zDbNTfL.exe
  2⤵
  PID:11540
- C:\Windows\System\ScljtYz.exe
  C:\Windows\System\ScljtYz.exe
  2⤵
  PID:11564
- C:\Windows\System\rhXxgnw.exe
  C:\Windows\System\rhXxgnw.exe
  2⤵
  PID:11608
- C:\Windows\System\EUALHfh.exe
  C:\Windows\System\EUALHfh.exe
  2⤵
  PID:11636
- C:\Windows\System\aKkcENl.exe
  C:\Windows\System\aKkcENl.exe
  2⤵
  PID:11660
- C:\Windows\System\SygakWH.exe
  C:\Windows\System\SygakWH.exe
  2⤵
  PID:11680
- C:\Windows\System\upBBqYy.exe
  C:\Windows\System\upBBqYy.exe
  2⤵
  PID:11712
- C:\Windows\System\wbRXDrI.exe
  C:\Windows\System\wbRXDrI.exe
  2⤵
  PID:11748
- C:\Windows\System\ztNVPCr.exe
  C:\Windows\System\ztNVPCr.exe
  2⤵
  PID:11784
- C:\Windows\System\buzKRXL.exe
  C:\Windows\System\buzKRXL.exe
  2⤵
  PID:11804
- C:\Windows\System\iSGcXTV.exe
  C:\Windows\System\iSGcXTV.exe
  2⤵
  PID:11832
- C:\Windows\System\haPVALU.exe
  C:\Windows\System\haPVALU.exe
  2⤵
  PID:11848
- C:\Windows\System\xQEMJsX.exe
  C:\Windows\System\xQEMJsX.exe
  2⤵
  PID:11876
- C:\Windows\System\VWCNmGa.exe
  C:\Windows\System\VWCNmGa.exe
  2⤵
  PID:11896
- C:\Windows\System\zYRcFxv.exe
  C:\Windows\System\zYRcFxv.exe
  2⤵
  PID:11920
- C:\Windows\System\EtqGONJ.exe
  C:\Windows\System\EtqGONJ.exe
  2⤵
  PID:11960
- C:\Windows\System\UhCsquv.exe
  C:\Windows\System\UhCsquv.exe
  2⤵
  PID:11980
- C:\Windows\System\bIIrHLM.exe
  C:\Windows\System\bIIrHLM.exe
  2⤵
  PID:12004
- C:\Windows\System\EwKbHCO.exe
  C:\Windows\System\EwKbHCO.exe
  2⤵
  PID:12020
- C:\Windows\System\eaLNfyN.exe
  C:\Windows\System\eaLNfyN.exe
  2⤵
  PID:12048
- C:\Windows\System\emJZgyY.exe
  C:\Windows\System\emJZgyY.exe
  2⤵
  PID:12080
- C:\Windows\System\hfstUIK.exe
  C:\Windows\System\hfstUIK.exe
  2⤵
  PID:12116
- C:\Windows\System\JDMxNNm.exe
  C:\Windows\System\JDMxNNm.exe
  2⤵
  PID:12144
- C:\Windows\System\DOXOKpM.exe
  C:\Windows\System\DOXOKpM.exe
  2⤵
  PID:12160
- C:\Windows\System\hSoWyRj.exe
  C:\Windows\System\hSoWyRj.exe
  2⤵
  PID:12176
- C:\Windows\System\ZCKvBDB.exe
  C:\Windows\System\ZCKvBDB.exe
  2⤵
  PID:12216
- C:\Windows\System\dZuYknX.exe
  C:\Windows\System\dZuYknX.exe
  2⤵
  PID:12248
- C:\Windows\System\jPbRwva.exe
  C:\Windows\System\jPbRwva.exe
  2⤵
  PID:10724
- C:\Windows\System\rRiuies.exe
  C:\Windows\System\rRiuies.exe
  2⤵
  PID:840
- C:\Windows\System\RbwCudE.exe
  C:\Windows\System\RbwCudE.exe
  2⤵
  PID:11360
- C:\Windows\System\QEWzADS.exe
  C:\Windows\System\QEWzADS.exe
  2⤵
  PID:11412
- C:\Windows\System\ldyVnVm.exe
  C:\Windows\System\ldyVnVm.exe
  2⤵
  PID:11448
- C:\Windows\System\EpYycDr.exe
  C:\Windows\System\EpYycDr.exe
  2⤵
  PID:11464
- C:\Windows\System\YnrioWu.exe
  C:\Windows\System\YnrioWu.exe
  2⤵
  PID:11656
- C:\Windows\System\fwRmIrI.exe
  C:\Windows\System\fwRmIrI.exe
  2⤵
  PID:11692
- C:\Windows\System\fpbDgrP.exe
  C:\Windows\System\fpbDgrP.exe
  2⤵
  PID:11772
- C:\Windows\System\saWZukA.exe
  C:\Windows\System\saWZukA.exe
  2⤵
  PID:11796
- C:\Windows\System\jAQJoWQ.exe
  C:\Windows\System\jAQJoWQ.exe
  2⤵
  PID:11840
- C:\Windows\System\vYEcXEO.exe
  C:\Windows\System\vYEcXEO.exe
  2⤵
  PID:11872
- C:\Windows\System\ALYZDpQ.exe
  C:\Windows\System\ALYZDpQ.exe
  2⤵
  PID:11916
- C:\Windows\System\IxmKxlX.exe
  C:\Windows\System\IxmKxlX.exe
  2⤵
  PID:11972
- C:\Windows\System\vExSJyl.exe
  C:\Windows\System\vExSJyl.exe
  2⤵
  PID:11992
- C:\Windows\System\tmrfbqm.exe
  C:\Windows\System\tmrfbqm.exe
  2⤵
  PID:12036
- C:\Windows\System\gTeXORG.exe
  C:\Windows\System\gTeXORG.exe
  2⤵
  PID:12140
- C:\Windows\System\RLbPjSN.exe
  C:\Windows\System\RLbPjSN.exe
  2⤵
  PID:12208
- C:\Windows\System\GiqjIQy.exe
  C:\Windows\System\GiqjIQy.exe
  2⤵
  PID:11484
- C:\Windows\System\MRiorIq.exe
  C:\Windows\System\MRiorIq.exe
  2⤵
  PID:11552
- C:\Windows\System\sjFczVT.exe
  C:\Windows\System\sjFczVT.exe
  2⤵
  PID:11732
- C:\Windows\System\fAKopWr.exe
  C:\Windows\System\fAKopWr.exe
  2⤵
  PID:11800
- C:\Windows\System\bpsxZVr.exe
  C:\Windows\System\bpsxZVr.exe
  2⤵
  PID:11944
- C:\Windows\System\GVOdBns.exe
  C:\Windows\System\GVOdBns.exe
  2⤵
  PID:12168
- C:\Windows\System\pZExxjy.exe
  C:\Windows\System\pZExxjy.exe
  2⤵
  PID:11516
- C:\Windows\System\aAdyYqB.exe
  C:\Windows\System\aAdyYqB.exe
  2⤵
  PID:11860
- C:\Windows\System\ISCaYDC.exe
  C:\Windows\System\ISCaYDC.exe
  2⤵
  PID:12104
- C:\Windows\System\JZLHleo.exe
  C:\Windows\System\JZLHleo.exe
  2⤵
  PID:3048
- C:\Windows\System\vCFipGU.exe
  C:\Windows\System\vCFipGU.exe
  2⤵
  PID:12296
- C:\Windows\System\QDxfZvM.exe
  C:\Windows\System\QDxfZvM.exe
  2⤵
  PID:12312
- C:\Windows\System\JJfeQRG.exe
  C:\Windows\System\JJfeQRG.exe
  2⤵
  PID:12340
- C:\Windows\System\dAgJCFK.exe
  C:\Windows\System\dAgJCFK.exe
  2⤵
  PID:12364
- C:\Windows\System\SAnbhfv.exe
  C:\Windows\System\SAnbhfv.exe
  2⤵
  PID:12392
- C:\Windows\System\vTpHgFb.exe
  C:\Windows\System\vTpHgFb.exe
  2⤵
  PID:12440
- C:\Windows\System\CsYacLu.exe
  C:\Windows\System\CsYacLu.exe
  2⤵
  PID:12476
- C:\Windows\System\ablFBeQ.exe
  C:\Windows\System\ablFBeQ.exe
  2⤵
  PID:12504
- C:\Windows\System\dzBGkbD.exe
  C:\Windows\System\dzBGkbD.exe
  2⤵
  PID:12528
- C:\Windows\System\BXZVZnk.exe
  C:\Windows\System\BXZVZnk.exe
  2⤵
  PID:12572
- C:\Windows\System\NTPeqka.exe
  C:\Windows\System\NTPeqka.exe
  2⤵
  PID:12588
- C:\Windows\System\HbpjCfL.exe
  C:\Windows\System\HbpjCfL.exe
  2⤵
  PID:12604
- C:\Windows\System\eZtsRuu.exe
  C:\Windows\System\eZtsRuu.exe
  2⤵
  PID:12644
- C:\Windows\System\DLsYsmp.exe
  C:\Windows\System\DLsYsmp.exe
  2⤵
  PID:12664
- C:\Windows\System\ElqsdkM.exe
  C:\Windows\System\ElqsdkM.exe
  2⤵
  PID:12684
- C:\Windows\System\ZHeQRZY.exe
  C:\Windows\System\ZHeQRZY.exe
  2⤵
  PID:12708
- C:\Windows\System\XiFbMfM.exe
  C:\Windows\System\XiFbMfM.exe
  2⤵
  PID:12756
- C:\Windows\System\jDYVrub.exe
  C:\Windows\System\jDYVrub.exe
  2⤵
  PID:12772
- C:\Windows\System\AEtcMsY.exe
  C:\Windows\System\AEtcMsY.exe
  2⤵
  PID:12808
- C:\Windows\System\mQhCkNe.exe
  C:\Windows\System\mQhCkNe.exe
  2⤵
  PID:12828
- C:\Windows\System\qCGNMVP.exe
  C:\Windows\System\qCGNMVP.exe
  2⤵
  PID:12852
- C:\Windows\System\noTqxCe.exe
  C:\Windows\System\noTqxCe.exe
  2⤵
  PID:12884
- C:\Windows\System\jNACiGf.exe
  C:\Windows\System\jNACiGf.exe
  2⤵
  PID:12912
- C:\Windows\System\qZucLDG.exe
  C:\Windows\System\qZucLDG.exe
  2⤵
  PID:12928
- C:\Windows\System\pYILTQU.exe
  C:\Windows\System\pYILTQU.exe
  2⤵
  PID:12960
- C:\Windows\System\VCkOxMU.exe
  C:\Windows\System\VCkOxMU.exe
  2⤵
  PID:12976
- C:\Windows\System\Optgrtt.exe
  C:\Windows\System\Optgrtt.exe
  2⤵
  PID:13004
- C:\Windows\System\CRsNRpH.exe
  C:\Windows\System\CRsNRpH.exe
  2⤵
  PID:13024
- C:\Windows\System\ihqqLNy.exe
  C:\Windows\System\ihqqLNy.exe
  2⤵
  PID:13060
- C:\Windows\System\RaGVEfK.exe
  C:\Windows\System\RaGVEfK.exe
  2⤵
  PID:13084
- C:\Windows\System\QRlgQyT.exe
  C:\Windows\System\QRlgQyT.exe
  2⤵
  PID:13112
- C:\Windows\System\YBMQvCi.exe
  C:\Windows\System\YBMQvCi.exe
  2⤵
  PID:13140
- C:\Windows\System\QUuJLMT.exe
  C:\Windows\System\QUuJLMT.exe
  2⤵
  PID:13168
- C:\Windows\System\Aaxtjse.exe
  C:\Windows\System\Aaxtjse.exe
  2⤵
  PID:13208
- C:\Windows\System\MPldsnM.exe
  C:\Windows\System\MPldsnM.exe
  2⤵
  PID:13228
- C:\Windows\System\KxoxNny.exe
  C:\Windows\System\KxoxNny.exe
  2⤵
  PID:13300
- C:\Windows\System\CJfPRid.exe
  C:\Windows\System\CJfPRid.exe
  2⤵
  PID:12108
- C:\Windows\System\QYCmwYu.exe
  C:\Windows\System\QYCmwYu.exe
  2⤵
  PID:12324
- C:\Windows\System\RftxfWv.exe
  C:\Windows\System\RftxfWv.exe
  2⤵
  PID:12360
- C:\Windows\System\nTwbQDR.exe
  C:\Windows\System\nTwbQDR.exe
  2⤵
  PID:12420
- C:\Windows\System\KqDBjVU.exe
  C:\Windows\System\KqDBjVU.exe
  2⤵
  PID:12520
- C:\Windows\System\JpWdGkU.exe
  C:\Windows\System\JpWdGkU.exe
  2⤵
  PID:12556
- C:\Windows\System\BopcFsu.exe
  C:\Windows\System\BopcFsu.exe
  2⤵
  PID:12596
- C:\Windows\System\xeRCRkK.exe
  C:\Windows\System\xeRCRkK.exe
  2⤵
  PID:12660
- C:\Windows\System\NgZycGG.exe
  C:\Windows\System\NgZycGG.exe
  2⤵
  PID:12728
- C:\Windows\System\AKVuNym.exe
  C:\Windows\System\AKVuNym.exe
  2⤵
  PID:12840
- C:\Windows\System\YceGpuM.exe
  C:\Windows\System\YceGpuM.exe
  2⤵
  PID:12920
- C:\Windows\System\cbghaGA.exe
  C:\Windows\System\cbghaGA.exe
  2⤵
  PID:12972
- C:\Windows\System\ZJiaCpn.exe
  C:\Windows\System\ZJiaCpn.exe
  2⤵
  PID:13080
- C:\Windows\System\JRKXWhR.exe
  C:\Windows\System\JRKXWhR.exe
  2⤵
  PID:13076
- C:\Windows\System\ythVLnk.exe
  C:\Windows\System\ythVLnk.exe
  2⤵
  PID:13104
- C:\Windows\System\tNOlRDh.exe
  C:\Windows\System\tNOlRDh.exe
  2⤵
  PID:13180
- C:\Windows\System\HjcGpTF.exe
  C:\Windows\System\HjcGpTF.exe
  2⤵
  PID:13216
- C:\Windows\System\PTeSIml.exe
  C:\Windows\System\PTeSIml.exe
  2⤵
  PID:13236
- C:\Windows\System\EAgxCEp.exe
  C:\Windows\System\EAgxCEp.exe
  2⤵
  PID:13308
- C:\Windows\System\AMQBTpP.exe
  C:\Windows\System\AMQBTpP.exe
  2⤵
  PID:12304
- C:\Windows\System\csKxwuE.exe
  C:\Windows\System\csKxwuE.exe
  2⤵
  PID:12496
- C:\Windows\System\CNgIjkg.exe
  C:\Windows\System\CNgIjkg.exe
  2⤵
  PID:12564
- C:\Windows\System\qvSGBVp.exe
  C:\Windows\System\qvSGBVp.exe
  2⤵
  PID:12652
- C:\Windows\System\aWNxpus.exe
  C:\Windows\System\aWNxpus.exe
  2⤵
  PID:12820
- C:\Windows\System\amsbWog.exe
  C:\Windows\System\amsbWog.exe
  2⤵
  PID:12944
- C:\Windows\System\fnEIXEe.exe
  C:\Windows\System\fnEIXEe.exe
  2⤵
  PID:12996
- C:\Windows\System\RUGTYer.exe
  C:\Windows\System\RUGTYer.exe
  2⤵
  PID:13220
- C:\Windows\System\DPKleMz.exe
  C:\Windows\System\DPKleMz.exe
  2⤵
  PID:13256
- C:\Windows\System\aLGztRe.exe
  C:\Windows\System\aLGztRe.exe
  2⤵
  PID:12388
- C:\Windows\System\kVrwUhK.exe
  C:\Windows\System\kVrwUhK.exe
  2⤵
  PID:13340
- C:\Windows\System\iwYBiJV.exe
  C:\Windows\System\iwYBiJV.exe
  2⤵
  PID:13356
- C:\Windows\System\ORRjLzi.exe
  C:\Windows\System\ORRjLzi.exe
  2⤵
  PID:13380
- C:\Windows\System\fSWEJPK.exe
  C:\Windows\System\fSWEJPK.exe
  2⤵
  PID:13400
- C:\Windows\System\YTYLide.exe
  C:\Windows\System\YTYLide.exe
  2⤵
  PID:13420
- C:\Windows\System\aGGCqjs.exe
  C:\Windows\System\aGGCqjs.exe
  2⤵
  PID:13448
- C:\Windows\System\ZFQmsqh.exe
  C:\Windows\System\ZFQmsqh.exe
  2⤵
  PID:13464
- C:\Windows\System\PhqRByB.exe
  C:\Windows\System\PhqRByB.exe
  2⤵
  PID:13484
- C:\Windows\System\dfievpK.exe
  C:\Windows\System\dfievpK.exe
  2⤵
  PID:13508
- C:\Windows\System\yNFITlf.exe
  C:\Windows\System\yNFITlf.exe
  2⤵
  PID:13528
- C:\Windows\System\OoqdVJc.exe
  C:\Windows\System\OoqdVJc.exe
  2⤵
  PID:13544
- C:\Windows\System\sqwoSZr.exe
  C:\Windows\System\sqwoSZr.exe
  2⤵
  PID:13560
- C:\Windows\System\gfJghhK.exe
  C:\Windows\System\gfJghhK.exe
  2⤵
  PID:13592
- C:\Windows\System\bBHYelF.exe
  C:\Windows\System\bBHYelF.exe
  2⤵
  PID:13608
- C:\Windows\System\gqxIHYW.exe
  C:\Windows\System\gqxIHYW.exe
  2⤵
  PID:13628
- C:\Windows\System\uHwemwO.exe
  C:\Windows\System\uHwemwO.exe
  2⤵
  PID:13648
- C:\Windows\System\JNZzVFm.exe
  C:\Windows\System\JNZzVFm.exe
  2⤵
  PID:13668
- C:\Windows\System\VUItklb.exe
  C:\Windows\System\VUItklb.exe
  2⤵
  PID:13688
- C:\Windows\System\Wlzojwa.exe
  C:\Windows\System\Wlzojwa.exe
  2⤵
  PID:13764
- C:\Windows\System\nzPqgYL.exe
  C:\Windows\System\nzPqgYL.exe
  2⤵
  PID:13796
- C:\Windows\System\EqldfFq.exe
  C:\Windows\System\EqldfFq.exe
  2⤵
  PID:13812
- C:\Windows\System\udrFpKk.exe
  C:\Windows\System\udrFpKk.exe
  2⤵
  PID:13828
- C:\Windows\System\ifdDqra.exe
  C:\Windows\System\ifdDqra.exe
  2⤵
  PID:13844
- C:\Windows\System\NatbhHW.exe
  C:\Windows\System\NatbhHW.exe
  2⤵
  PID:13860
- C:\Windows\System\nPtibwQ.exe
  C:\Windows\System\nPtibwQ.exe
  2⤵
  PID:13892
- C:\Windows\System\QwbNjwf.exe
  C:\Windows\System\QwbNjwf.exe
  2⤵
  PID:13908
- C:\Windows\System\PQKXFub.exe
  C:\Windows\System\PQKXFub.exe
  2⤵
  PID:13924
- C:\Windows\System\sIXpqqa.exe
  C:\Windows\System\sIXpqqa.exe
  2⤵
  PID:13948
- C:\Windows\System\cgXkmcu.exe
  C:\Windows\System\cgXkmcu.exe
  2⤵
  PID:13964
- C:\Windows\System\XYgorSB.exe
  C:\Windows\System\XYgorSB.exe
  2⤵
  PID:13984
- C:\Windows\System\UrKVkxR.exe
  C:\Windows\System\UrKVkxR.exe
  2⤵
  PID:14000
- C:\Windows\System\JsmRZkH.exe
  C:\Windows\System\JsmRZkH.exe
  2⤵
  PID:14028
- C:\Windows\System\VvcHgJO.exe
  C:\Windows\System\VvcHgJO.exe
  2⤵
  PID:14056
- C:\Windows\System\miQatgd.exe
  C:\Windows\System\miQatgd.exe
  2⤵
  PID:14072
- C:\Windows\System\SrVaHQb.exe
  C:\Windows\System\SrVaHQb.exe
  2⤵
  PID:14104
- C:\Windows\System\aHlbxcE.exe
  C:\Windows\System\aHlbxcE.exe
  2⤵
  PID:14124
- C:\Windows\System\UiRlqHO.exe
  C:\Windows\System\UiRlqHO.exe
  2⤵
  PID:14140
- C:\Windows\System\NLctaKL.exe
  C:\Windows\System\NLctaKL.exe
  2⤵
  PID:14168
- C:\Windows\System\KvBMUfU.exe
  C:\Windows\System\KvBMUfU.exe
  2⤵
  PID:14184
- C:\Windows\System\TZHEtjP.exe
  C:\Windows\System\TZHEtjP.exe
  2⤵
  PID:14208
- C:\Windows\System\fFJQfzd.exe
  C:\Windows\System\fFJQfzd.exe
  2⤵
  PID:14240
- C:\Windows\System\WnAGMng.exe
  C:\Windows\System\WnAGMng.exe
  2⤵
  PID:14260
- C:\Windows\System\aSxhWpS.exe
  C:\Windows\System\aSxhWpS.exe
  2⤵
  PID:14280
- C:\Windows\System\MPWOHvV.exe
  C:\Windows\System\MPWOHvV.exe
  2⤵
  PID:14304
- C:\Windows\System\WmwodZn.exe
  C:\Windows\System\WmwodZn.exe
  2⤵
  PID:12356
- C:\Windows\System\iMxFEUZ.exe
  C:\Windows\System\iMxFEUZ.exe
  2⤵
  PID:13388
- C:\Windows\System\quuhsfP.exe
  C:\Windows\System\quuhsfP.exe
  2⤵
  PID:13416
- C:\Windows\System\WNHveOR.exe
  C:\Windows\System\WNHveOR.exe
  2⤵
  PID:13480
- C:\Windows\System\XydWmLH.exe
  C:\Windows\System\XydWmLH.exe
  2⤵
  PID:13524
- C:\Windows\System\ohOQltu.exe
  C:\Windows\System\ohOQltu.exe
  2⤵
  PID:13600
- C:\Windows\System\QvZnNgK.exe
  C:\Windows\System\QvZnNgK.exe
  2⤵
  PID:13656
- C:\Windows\System\rIYOkUR.exe
  C:\Windows\System\rIYOkUR.exe
  2⤵
  PID:13712
- C:\Windows\System\YXlYGnK.exe
  C:\Windows\System\YXlYGnK.exe
  2⤵
  PID:13724
- C:\Windows\System\wilBrTo.exe
  C:\Windows\System\wilBrTo.exe
  2⤵
  PID:13460
- C:\Windows\System\VQwovFt.exe
  C:\Windows\System\VQwovFt.exe
  2⤵
  PID:13880
- C:\Windows\System\AHkhvDD.exe
  C:\Windows\System\AHkhvDD.exe
  2⤵
  PID:13916
- C:\Windows\System\bbgTVGA.exe
  C:\Windows\System\bbgTVGA.exe
  2⤵
  PID:13972
- C:\Windows\System\UYTvmOI.exe
  C:\Windows\System\UYTvmOI.exe
  2⤵
  PID:14040
- C:\Windows\System\stREzfD.exe
  C:\Windows\System\stREzfD.exe
  2⤵
  PID:13852
- C:\Windows\System\FMueKZf.exe
  C:\Windows\System\FMueKZf.exe
  2⤵
  PID:13872
- C:\Windows\System\jpHtbZB.exe
  C:\Windows\System\jpHtbZB.exe
  2⤵
  PID:14136
- C:\Windows\System\TnhSmsl.exe
  C:\Windows\System\TnhSmsl.exe
  2⤵
  PID:13956
- C:\Windows\System\NxDJTMv.exe
  C:\Windows\System\NxDJTMv.exe
  2⤵
  PID:13840
- C:\Windows\System\UmEYRda.exe
  C:\Windows\System\UmEYRda.exe
  2⤵
  PID:13156
- C:\Windows\System\Skfeiiv.exe
  C:\Windows\System\Skfeiiv.exe
  2⤵
  PID:14196
- C:\Windows\System\FqhcZyd.exe
  C:\Windows\System\FqhcZyd.exe
  2⤵
  PID:13944
- C:\Windows\System\GFzndTQ.exe
  C:\Windows\System\GFzndTQ.exe
  2⤵
  PID:13636
- C:\Windows\System\OgfzleZ.exe
  C:\Windows\System\OgfzleZ.exe
  2⤵
  PID:14348
- C:\Windows\System\ImoqtOj.exe
  C:\Windows\System\ImoqtOj.exe
  2⤵
  PID:14364
- C:\Windows\System\DJiiWDN.exe
  C:\Windows\System\DJiiWDN.exe
  2⤵
  PID:14392
- C:\Windows\System\ZjqoRBm.exe
  C:\Windows\System\ZjqoRBm.exe
  2⤵
  PID:14408
- C:\Windows\System\DqzpLxu.exe
  C:\Windows\System\DqzpLxu.exe
  2⤵
  PID:14424
- C:\Windows\System\SwttfeL.exe
  C:\Windows\System\SwttfeL.exe
  2⤵
  PID:14448
- C:\Windows\System\OJklSmS.exe
  C:\Windows\System\OJklSmS.exe
  2⤵
  PID:14464
- C:\Windows\System\YQQWFeT.exe
  C:\Windows\System\YQQWFeT.exe
  2⤵
  PID:14480
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14480 -s 248
    3⤵
    PID:15908
- C:\Windows\System\skyNGND.exe
  C:\Windows\System\skyNGND.exe
  2⤵
  PID:14496
- C:\Windows\System\gWqTAQC.exe
  C:\Windows\System\gWqTAQC.exe
  2⤵
  PID:14512
- C:\Windows\System\wNKRVNq.exe
  C:\Windows\System\wNKRVNq.exe
  2⤵
  PID:14528
- C:\Windows\System\FSbflWN.exe
  C:\Windows\System\FSbflWN.exe
  2⤵
  PID:14544
- C:\Windows\System\cXDxpNv.exe
  C:\Windows\System\cXDxpNv.exe
  2⤵
  PID:14568
- C:\Windows\System\XohDDaW.exe
  C:\Windows\System\XohDDaW.exe
  2⤵
  PID:14588
- C:\Windows\System\gPnahvs.exe
  C:\Windows\System\gPnahvs.exe
  2⤵
  PID:14616
- C:\Windows\System\wkaKCgs.exe
  C:\Windows\System\wkaKCgs.exe
  2⤵
  PID:14636
- C:\Windows\System\OEDZObP.exe
  C:\Windows\System\OEDZObP.exe
  2⤵
  PID:14652
- C:\Windows\System\dWcPNYF.exe
  C:\Windows\System\dWcPNYF.exe
  2⤵
  PID:14672
- C:\Windows\System\SqtVEUl.exe
  C:\Windows\System\SqtVEUl.exe
  2⤵
  PID:14692
- C:\Windows\System\vRGinCR.exe
  C:\Windows\System\vRGinCR.exe
  2⤵
  PID:14716
- C:\Windows\System\svLjJbq.exe
  C:\Windows\System\svLjJbq.exe
  2⤵
  PID:14744
- C:\Windows\System\GpVzJmV.exe
  C:\Windows\System\GpVzJmV.exe
  2⤵
  PID:14764
- C:\Windows\System\RSoJNEg.exe
  C:\Windows\System\RSoJNEg.exe
  2⤵
  PID:14788
- C:\Windows\System\HTzYBLt.exe
  C:\Windows\System\HTzYBLt.exe
  2⤵
  PID:14812
- C:\Windows\System\wgSSQZj.exe
  C:\Windows\System\wgSSQZj.exe
  2⤵
  PID:14828
- C:\Windows\System\uCMTBPc.exe
  C:\Windows\System\uCMTBPc.exe
  2⤵
  PID:14844
- C:\Windows\System\YjdOheI.exe
  C:\Windows\System\YjdOheI.exe
  2⤵
  PID:14868
- C:\Windows\System\uqescWh.exe
  C:\Windows\System\uqescWh.exe
  2⤵
  PID:14888
- C:\Windows\System\IidXsUy.exe
  C:\Windows\System\IidXsUy.exe
  2⤵
  PID:14912
- C:\Windows\System\zkJqfeS.exe
  C:\Windows\System\zkJqfeS.exe
  2⤵
  PID:14936
- C:\Windows\System\XbTzmVs.exe
  C:\Windows\System\XbTzmVs.exe
  2⤵
  PID:14952
- C:\Windows\System\JojaiqK.exe
  C:\Windows\System\JojaiqK.exe
  2⤵
  PID:14968
- C:\Windows\System\fZlUMYn.exe
  C:\Windows\System\fZlUMYn.exe
  2⤵
  PID:14988
- C:\Windows\System\gGlkOTx.exe
  C:\Windows\System\gGlkOTx.exe
  2⤵
  PID:15008
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15008 -s 248
    3⤵
    PID:15864
- C:\Windows\System\bMNrstq.exe
  C:\Windows\System\bMNrstq.exe
  2⤵
  PID:15024
- C:\Windows\System\LUnXbMA.exe
  C:\Windows\System\LUnXbMA.exe
  2⤵
  PID:15040
- C:\Windows\System\WbsbDpN.exe
  C:\Windows\System\WbsbDpN.exe
  2⤵
  PID:15056
- C:\Windows\System\OCrajaj.exe
  C:\Windows\System\OCrajaj.exe
  2⤵
  PID:15072
- C:\Windows\System\iAKrjft.exe
  C:\Windows\System\iAKrjft.exe
  2⤵
  PID:15096
- C:\Windows\System\hdQpxXc.exe
  C:\Windows\System\hdQpxXc.exe
  2⤵
  PID:15112
- C:\Windows\System\kAQkwDD.exe
  C:\Windows\System\kAQkwDD.exe
  2⤵
  PID:15128
- C:\Windows\System\IXLROIm.exe
  C:\Windows\System\IXLROIm.exe
  2⤵
  PID:15148
- C:\Windows\System\tEPlHsP.exe
  C:\Windows\System\tEPlHsP.exe
  2⤵
  PID:15164
- C:\Windows\System\uCbiBqh.exe
  C:\Windows\System\uCbiBqh.exe
  2⤵
  PID:15192
- C:\Windows\System\phVkIvM.exe
  C:\Windows\System\phVkIvM.exe
  2⤵
  PID:15220
- C:\Windows\System\aHuqZMN.exe
  C:\Windows\System\aHuqZMN.exe
  2⤵
  PID:15236
- C:\Windows\System\FDnXtoC.exe
  C:\Windows\System\FDnXtoC.exe
  2⤵
  PID:15252
- C:\Windows\System\ijchpyw.exe
  C:\Windows\System\ijchpyw.exe
  2⤵
  PID:15280
- C:\Windows\System\EKvQigl.exe
  C:\Windows\System\EKvQigl.exe
  2⤵
  PID:15300
- C:\Windows\System\EgwqJsa.exe
  C:\Windows\System\EgwqJsa.exe
  2⤵
  PID:15332
- C:\Windows\System\tpIeHAw.exe
  C:\Windows\System\tpIeHAw.exe
  2⤵
  PID:15348
- C:\Windows\System\exOlRnu.exe
  C:\Windows\System\exOlRnu.exe
  2⤵
  PID:14152
- C:\Windows\System\CdGlPlM.exe
  C:\Windows\System\CdGlPlM.exe
  2⤵
  PID:13740
- C:\Windows\System\QhLaGdZ.exe
  C:\Windows\System\QhLaGdZ.exe
  2⤵
  PID:14276
- C:\Windows\System\AbdDpoi.exe
  C:\Windows\System\AbdDpoi.exe
  2⤵
  PID:14312
- C:\Windows\System\yeVXWEM.exe
  C:\Windows\System\yeVXWEM.exe
  2⤵
  PID:14100
- C:\Windows\System\JSqMSLK.exe
  C:\Windows\System\JSqMSLK.exe
  2⤵
  PID:13332
- C:\Windows\System\HKaqMMj.exe
  C:\Windows\System\HKaqMMj.exe
  2⤵
  PID:12512
- C:\Windows\System\KjJzgEU.exe
  C:\Windows\System\KjJzgEU.exe
  2⤵
  PID:13456
- C:\Windows\System\VlSePDi.exe
  C:\Windows\System\VlSePDi.exe
  2⤵
  PID:14380
- C:\Windows\System\xgqdXFI.exe
  C:\Windows\System\xgqdXFI.exe
  2⤵
  PID:14416
- C:\Windows\System\wfpOnZt.exe
  C:\Windows\System\wfpOnZt.exe
  2⤵
  PID:13792
- C:\Windows\System\AfaeVoD.exe
  C:\Windows\System\AfaeVoD.exe
  2⤵
  PID:14052
- C:\Windows\System\EjhAtHw.exe
  C:\Windows\System\EjhAtHw.exe
  2⤵
  PID:14488
- C:\Windows\System\RTOLEvs.exe
  C:\Windows\System\RTOLEvs.exe
  2⤵
  PID:14064
- C:\Windows\System\XDYNBQW.exe
  C:\Windows\System\XDYNBQW.exe
  2⤵
  PID:14580
- C:\Windows\System\dUVZadS.exe
  C:\Windows\System\dUVZadS.exe
  2⤵
  PID:14644
- C:\Windows\System\yGtUSus.exe
  C:\Windows\System\yGtUSus.exe
  2⤵
  PID:13992
- C:\Windows\System\mygPOGg.exe
  C:\Windows\System\mygPOGg.exe
  2⤵
  PID:4368
- C:\Windows\System\vRRFreZ.exe
  C:\Windows\System\vRRFreZ.exe
  2⤵
  PID:14756
- C:\Windows\System\GEfXOgM.exe
  C:\Windows\System\GEfXOgM.exe
  2⤵
  PID:13620
- C:\Windows\System\iOygyZN.exe
  C:\Windows\System\iOygyZN.exe
  2⤵
  PID:14900
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14900 -s 248
    3⤵
    PID:15848
- C:\Windows\System\hjZoplc.exe
  C:\Windows\System\hjZoplc.exe
  2⤵
  PID:14360
- C:\Windows\System\wTriAvP.exe
  C:\Windows\System\wTriAvP.exe
  2⤵
  PID:15380
- C:\Windows\System\VSCUPDv.exe
  C:\Windows\System\VSCUPDv.exe
  2⤵
  PID:15404
- C:\Windows\System\DyGvJjY.exe
  C:\Windows\System\DyGvJjY.exe
  2⤵
  PID:15420
- C:\Windows\System\FuTYYSp.exe
  C:\Windows\System\FuTYYSp.exe
  2⤵
  PID:15436
- C:\Windows\System\HgLMUzq.exe
  C:\Windows\System\HgLMUzq.exe
  2⤵
  PID:15460
- C:\Windows\System\PlOmsaT.exe
  C:\Windows\System\PlOmsaT.exe
  2⤵
  PID:15476
- C:\Windows\System\GuBTbor.exe
  C:\Windows\System\GuBTbor.exe
  2⤵
  PID:15496
- C:\Windows\System\aSMyPgE.exe
  C:\Windows\System\aSMyPgE.exe
  2⤵
  PID:15512
- C:\Windows\System\hNzEtoe.exe
  C:\Windows\System\hNzEtoe.exe
  2⤵
  PID:15540
- C:\Windows\System\MPBLFpn.exe
  C:\Windows\System\MPBLFpn.exe
  2⤵
  PID:15560
- C:\Windows\System\iQJQzsU.exe
  C:\Windows\System\iQJQzsU.exe
  2⤵
  PID:15580
- C:\Windows\System\KuJvljs.exe
  C:\Windows\System\KuJvljs.exe
  2⤵
  PID:15600
- C:\Windows\System\GHeONrJ.exe
  C:\Windows\System\GHeONrJ.exe
  2⤵
  PID:15616
- C:\Windows\System\RnuJVIn.exe
  C:\Windows\System\RnuJVIn.exe
  2⤵
  PID:15632
- C:\Windows\System\qstFnIc.exe
  C:\Windows\System\qstFnIc.exe
  2⤵
  PID:15648
- C:\Windows\System\UNnUFbY.exe
  C:\Windows\System\UNnUFbY.exe
  2⤵
  PID:15668
- C:\Windows\System\LxpqFJh.exe
  C:\Windows\System\LxpqFJh.exe
  2⤵
  PID:15684
- C:\Windows\System\yHUpizm.exe
  C:\Windows\System\yHUpizm.exe
  2⤵
  PID:15712
- C:\Windows\System\cdQsAGI.exe
  C:\Windows\System\cdQsAGI.exe
  2⤵
  PID:15732
- C:\Windows\System\TAZmgZQ.exe
  C:\Windows\System\TAZmgZQ.exe
  2⤵
  PID:15752
- C:\Windows\System\pGsGOJm.exe
  C:\Windows\System\pGsGOJm.exe
  2⤵
  PID:15772
- C:\Windows\System\sTiTojS.exe
  C:\Windows\System\sTiTojS.exe
  2⤵
  PID:15788
- C:\Windows\System\vHWvyBf.exe
  C:\Windows\System\vHWvyBf.exe
  2⤵
  PID:15820
- C:\Windows\System\FcnUPXe.exe
  C:\Windows\System\FcnUPXe.exe
  2⤵
  PID:15836
- C:\Windows\System\SlxnLjR.exe
  C:\Windows\System\SlxnLjR.exe
  2⤵
  PID:15856
- C:\Windows\System\tZRqVGC.exe
  C:\Windows\System\tZRqVGC.exe
  2⤵
  PID:16136
- C:\Windows\System\kJkkdRv.exe
  C:\Windows\System\kJkkdRv.exe
  2⤵
  PID:16152
- C:\Windows\System\BYJGfbo.exe
  C:\Windows\System\BYJGfbo.exe
  2⤵
  PID:16168
- C:\Windows\System\aALxqTZ.exe
  C:\Windows\System\aALxqTZ.exe
  2⤵
  PID:16188
- C:\Windows\System\lEFsrnf.exe
  C:\Windows\System\lEFsrnf.exe
  2⤵
  PID:16204
- C:\Windows\System\gfYLxuF.exe
  C:\Windows\System\gfYLxuF.exe
  2⤵
  PID:16220
- C:\Windows\System\OxZENim.exe
  C:\Windows\System\OxZENim.exe
  2⤵
  PID:16236
- C:\Windows\System\QULCkMr.exe
  C:\Windows\System\QULCkMr.exe
  2⤵
  PID:16252
- C:\Windows\System\NqfbZEY.exe
  C:\Windows\System\NqfbZEY.exe
  2⤵
  PID:16272
- C:\Windows\System\uXNFRoM.exe
  C:\Windows\System\uXNFRoM.exe
  2⤵
  PID:16304
- C:\Windows\System\YTOweda.exe
  C:\Windows\System\YTOweda.exe
  2⤵
  PID:16320
- C:\Windows\System\SVVFnHf.exe
  C:\Windows\System\SVVFnHf.exe
  2⤵
  PID:16336
- C:\Windows\System\RgMBqjY.exe
  C:\Windows\System\RgMBqjY.exe
  2⤵
  PID:16352
- C:\Windows\System\zzvyyFZ.exe
  C:\Windows\System\zzvyyFZ.exe
  2⤵
  PID:16368
- C:\Windows\System\LcLvHTS.exe
  C:\Windows\System\LcLvHTS.exe
  2⤵
  PID:14948
- C:\Windows\System\zhrTZzA.exe
  C:\Windows\System\zhrTZzA.exe
  2⤵
  PID:14976
- C:\Windows\System\jkldyAT.exe
  C:\Windows\System\jkldyAT.exe
  2⤵
  PID:15108
- C:\Windows\System\VvOXzIc.exe
  C:\Windows\System\VvOXzIc.exe
  2⤵
  PID:15156
- C:\Windows\System\kmERcUP.exe
  C:\Windows\System\kmERcUP.exe
  2⤵
  PID:14520
- C:\Windows\System\vHDEGYi.exe
  C:\Windows\System\vHDEGYi.exe
  2⤵
  PID:15228
- C:\Windows\System\MFXvBPr.exe
  C:\Windows\System\MFXvBPr.exe
  2⤵
  PID:15248
- C:\Windows\System\nSRezKT.exe
  C:\Windows\System\nSRezKT.exe
  2⤵
  PID:15276
- C:\Windows\System\hlInABV.exe
  C:\Windows\System\hlInABV.exe
  2⤵
  PID:14612
- C:\Windows\System\hRtfjPe.exe
  C:\Windows\System\hRtfjPe.exe
  2⤵
  PID:15344
- C:\Windows\System\HvHFZjG.exe
  C:\Windows\System\HvHFZjG.exe
  2⤵
  PID:14156
- C:\Windows\System\qETiqRm.exe
  C:\Windows\System\qETiqRm.exe
  2⤵
  PID:14236
- C:\Windows\System\WRvxOSI.exe
  C:\Windows\System\WRvxOSI.exe
  2⤵
  PID:14296
- C:\Windows\System\nvanPjr.exe
  C:\Windows\System\nvanPjr.exe
  2⤵
  PID:14680
- C:\Windows\System\qHTQquE.exe
  C:\Windows\System\qHTQquE.exe
  2⤵
  PID:13804
- C:\Windows\System\uwgIVQr.exe
  C:\Windows\System\uwgIVQr.exe
  2⤵
  PID:14836
- C:\Windows\System\uKXVKrD.exe
  C:\Windows\System\uKXVKrD.exe
  2⤵
  PID:14852
- C:\Windows\System\pzwDLuc.exe
  C:\Windows\System\pzwDLuc.exe
  2⤵
  PID:14864
- C:\Windows\System\cvFRRxc.exe
  C:\Windows\System\cvFRRxc.exe
  2⤵
  PID:14876
- C:\Windows\System\JaDCVhN.exe
  C:\Windows\System\JaDCVhN.exe
  2⤵
  PID:14224
- C:\Windows\System\IUJGyTZ.exe
  C:\Windows\System\IUJGyTZ.exe
  2⤵
  PID:15376
- C:\Windows\System\uHgPWED.exe
  C:\Windows\System\uHgPWED.exe
  2⤵
  PID:15396
- C:\Windows\System\BhOXrzv.exe
  C:\Windows\System\BhOXrzv.exe
  2⤵
  PID:15428
- C:\Windows\System\qXQwtkM.exe
  C:\Windows\System\qXQwtkM.exe
  2⤵
  PID:15456
- C:\Windows\System\ryPksjt.exe
  C:\Windows\System\ryPksjt.exe
  2⤵
  PID:15016
- C:\Windows\System\qWNhAvv.exe
  C:\Windows\System\qWNhAvv.exe
  2⤵
  PID:15644
- C:\Windows\System\kDxZVEN.exe
  C:\Windows\System\kDxZVEN.exe
  2⤵
  PID:15084
- C:\Windows\System\LLgEpui.exe
  C:\Windows\System\LLgEpui.exe
  2⤵
  PID:15680
- C:\Windows\System\FrDCuZe.exe
  C:\Windows\System\FrDCuZe.exe
  2⤵
  PID:15708
- C:\Windows\System\gITTMdy.exe
  C:\Windows\System\gITTMdy.exe
  2⤵
  PID:15748
- C:\Windows\System\xpluruI.exe
  C:\Windows\System\xpluruI.exe
  2⤵
  PID:2240
- C:\Windows\System\GyZgVhF.exe
  C:\Windows\System\GyZgVhF.exe
  2⤵
  PID:14784
- C:\Windows\System\LhwMsgk.exe
  C:\Windows\System\LhwMsgk.exe
  2⤵
  PID:14724
- C:\Windows\System\oTWWNFt.exe
  C:\Windows\System\oTWWNFt.exe
  2⤵
  PID:15468
- C:\Windows\System\eJrqWAQ.exe
  C:\Windows\System\eJrqWAQ.exe
  2⤵
  PID:15504
- C:\Windows\System\ZgWHCco.exe
  C:\Windows\System\ZgWHCco.exe
  2⤵
  PID:15536
- C:\Windows\System\LIreCIF.exe
  C:\Windows\System\LIreCIF.exe
  2⤵
  PID:15552
- C:\Windows\System\jixWhnC.exe
  C:\Windows\System\jixWhnC.exe
  2⤵
  PID:15032
- C:\Windows\System\FeItlFw.exe
  C:\Windows\System\FeItlFw.exe
  2⤵
  PID:16072
- C:\Windows\System\cfTeaCS.exe
  C:\Windows\System\cfTeaCS.exe
  2⤵
  PID:15816
- C:\Windows\System\BKWQhkt.exe
  C:\Windows\System\BKWQhkt.exe
  2⤵
  PID:14016
- C:\Windows\System\fwSROZz.exe
  C:\Windows\System\fwSROZz.exe
  2⤵
  PID:13540
- C:\Windows\System\xkmqDkE.exe
  C:\Windows\System\xkmqDkE.exe
  2⤵
  PID:13664
- C:\Windows\System\LGYmORU.exe
  C:\Windows\System\LGYmORU.exe
  2⤵
  PID:14536
- C:\Windows\System\BXpEqyT.exe
  C:\Windows\System\BXpEqyT.exe
  2⤵
  PID:15996
- C:\Windows\System\eoChbGe.exe
  C:\Windows\System\eoChbGe.exe
  2⤵
  PID:16396
- C:\Windows\System\jWpvYuq.exe
  C:\Windows\System\jWpvYuq.exe
  2⤵
  PID:16412
- C:\Windows\System\ZdkuHIf.exe
  C:\Windows\System\ZdkuHIf.exe
  2⤵
  PID:16428
- C:\Windows\System\ccjEckW.exe
  C:\Windows\System\ccjEckW.exe
  2⤵
  PID:16448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BmSHihY.exe

Filesize
1.1MB

MD5
9feee5068a5813b690aa19f6a1468879

SHA1
4ccee8dd7dc29dcf034da864ed2e49dddaa5bde1

SHA256
bd6696b9b59de03eb7a1e3ccd345d256d823b8b4228d699178e010be56da3605

SHA512
ce39f15d724809d578d85533f70598ed65299e01d0db988f3fa01e69c2658f11ca46744d879a74b294ea830d87caa7f0acc677710de6e4e3a256b22e6e821ee5

Download Submit
C:\Windows\System\CjUbBNt.exe

Filesize
1.1MB

MD5
f8aae8a22bdc57f89909170d984d7f5d

SHA1
7392f935ab0e59fb627c343502f51a2b76ed6fbb

SHA256
154f320134573f0a21b04c318f37aebd6734682e50f41953cf220ef6938705d0

SHA512
ad472e267ca11fcaa7f70c292d133bed53c6fadb4755337e7fdc264a3a3168c73719c8ffb619b90c9519b907c53800396416bf383ce3082d42d1e0cfbf2a2620

Download Submit
C:\Windows\System\FzKVuBh.exe

Filesize
1.1MB

MD5
f25a9af206b2749b8d0a1dd12beae899

SHA1
bf93c82824f1759fc6467cee087c1ca319fec8e0

SHA256
b3d3693d4929376407eb28785ffb48cf85ddd05e751868fa5ac12a8141e1561d

SHA512
51a4b88d5858ecbc78796c837d04a32b9e098f4f8730802c6df866a0f10a42a5a2f0a05082919b34b96340f765f231055c6306fa237f4ddd84dd58a90ef0d747

Download Submit
C:\Windows\System\GUzBOBS.exe

Filesize
1.1MB

MD5
47231e2ed2cf60aab37064b398afd3ed

SHA1
48a464e73aedb7d2c1c01a76263da79dbfcd8ee7

SHA256
36c5b3d6542552f738842ec59305ce5148227d1f73de3419e09364e29fae00d5

SHA512
fee540b75624a82506a8a81dc760009bfc7bd82860ad0fa14aa4aa7127c36cc66f48673879f2d950b24b546b3a51e359c2a503caa6721094de035547607a6b1f

Download Submit
C:\Windows\System\GlrPImh.exe

Filesize
1.1MB

MD5
d80940702e4b092bc0a80bbcca62fcca

SHA1
05f258e2bb0170ae545d734822753ee896c90970

SHA256
71ae95d08eb834b31fe981f7680b4cda5cc1d83290f1205a41a823e4c6643524

SHA512
3721379b17579ace36066a03a392f6c4d8d390122856133e1b3d579bcf402168b41686dfc9f60d5cf6e780a84e6818631f1921cebf62436b3397b94448b07833

Download Submit
C:\Windows\System\IRqwabW.exe

Filesize
1.1MB

MD5
2b8e9011354d312d800e719d52ae827e

SHA1
06acbeed1fe6d0766373321dc6306856b03530a1

SHA256
3a174fb84e5534e41f7be7e3d7b2a1542f3bae30663fd574d52005ba54a3adc9

SHA512
3b8a86ed2dc88cacf9e9bdedbd5d7e9b28faaeb9e9bd73749c5ef128c27d577a74c624d59a27d47be0b0337d4ae6d81e98d09888ae42083e400dfc7aef899aae

Download Submit
C:\Windows\System\LZeueCB.exe

Filesize
1.1MB

MD5
8c7e6ebb24483c4f91e9bf2e99f47a47

SHA1
c922110656fc5727a36f46f1f3d294dcce9d566b

SHA256
446efdeaf2dcfa1f06c20c964bc08a988829805c2dc0ff782a9000414e118069

SHA512
ea27fee08b6ebe75dc7741549b7f90e0e7060c6508f05994abbd025292b5e273ebb6efb894afc962a4514faa9e9edd0e490bf2b15290c5aa5bcbaa1be31ea630

Download Submit
C:\Windows\System\OEvXJjD.exe

Filesize
1.1MB

MD5
863dcff0465eb6ee71a5113c2dd6001f

SHA1
f2c51726a09b48a97df79ca5b761ef708b64b527

SHA256
af963a04d1c038ca3b3f94ce5c6d1c5028f7dd03868a416fe684c9f62293088b

SHA512
4de87523f48f8ba75be2458746afdeec74f66d190c2bbe20590f06b3cc2e7abaf8fd4fb17d3031fdb0283eb39298b3f609c1cddcdb7c4eb04f9d7658e4f3d7e8

Download Submit
C:\Windows\System\PIBWWVU.exe

Filesize
1.1MB

MD5
39d438ff54532f0a2cc1fa3fa7d7c5bd

SHA1
40f0dbb6e55550ee4aa9eb127991f6aa475c41a5

SHA256
4ff816e9d23d2e1a85ec9e62fe36327248e072dc76c43a52315ef77ecfb81fab

SHA512
c5f5e22a11a9195fb7540c883639f9bf8a8362ac07d301c68f516977eb1c58a97428296cab6efcdc710b7e28cd65f3e0458384c671b07a0ac5c92c13f68422f0

Download Submit
C:\Windows\System\SEMUhWJ.exe

Filesize
1.1MB

MD5
b064dff7dc1cb606066e111a234addf3

SHA1
def15b0e44e56e45f4390145bec1878c9a584245

SHA256
4ee8fc3097cafbb3294f7beb0a89d40539c7f7ad6e5be1ec2a2726c99f07f01a

SHA512
6cb3cec1393aa08e5269ddca42809c7d93c5d6ec1a03e29793a510eda555371df3f807ccf974f47dc0dd98590c14517efcc0a7f95bc720583e7e9d9464c37f98

Download Submit
C:\Windows\System\TVemnPP.exe

Filesize
1.1MB

MD5
48496c789f7199a6b4b1926f86a08e1f

SHA1
0d2f1136a59c5e3b33bc865d45ac46abd4d5c1cb

SHA256
33c8ab79636a294740a50f02a4019ce5418f7d546fd11e9bd683aac6e71fcfa8

SHA512
571dc7fc0267c84e87e41faf3af45a16983a43066d984fec8449f41c7453be4780ce72548f284ca196fea07adee1967ce4f366cfac5ae338568c935c249e786d

Download Submit
C:\Windows\System\VaXjcOt.exe

Filesize
1.1MB

MD5
6011fdd51100cd217449093925f49df4

SHA1
660128cc2f8aa270af00d2828745b223b20021f5

SHA256
edac694075d35f4dd2db20defb255f8e992f5cf26a8a44a7c84c8009f6cd89b3

SHA512
4c6f9b4fedbef848419158707f9b205b324025879c9c19b906b88b272105a360016aa1dcc112848227b255cf8ce679c0afd86aff7ddb0ca37cf7b2b1438b08dc

Download Submit
C:\Windows\System\WPUkcVH.exe

Filesize
1.1MB

MD5
a69b9ff00c5b10e395370cb7af279c2b

SHA1
9c98a0bb3d1f514bab1182e7a416d9a55c27b836

SHA256
d6df9e0086707c02b26b7ac9897883b3fd8907a47fe17d6d997c2a9c1837993e

SHA512
2a7f5b8353a28a63f334a924d3210ea9f37188fdd8c00f82d724cc4703f80def81485f6336bc4b2259a1efd64a94b623999b86dc5e5f051cacea5335cc987fe5

Download Submit
C:\Windows\System\ashIDYJ.exe

Filesize
1.1MB

MD5
c8a9ea1d6ff29af46a53ce0d3d8ed749

SHA1
3454f166240a80f5569716e2b4425be5cef80a08

SHA256
a121802337569e28690db9bfda8fcb74b03cda1d8e5ecbe845cdb7efc2f5cb94

SHA512
7194b4652015598920e064bc48b7d754bdeccc0db64f1ff901179f40ae512775b4db38f837a99564afd1c4d8bf2fdc98abf63c92b50e31f2294774e72cb44db4

Download Submit
C:\Windows\System\eOjhRDi.exe

Filesize
1.1MB

MD5
11084bb492414cf31c80a1e3ea143234

SHA1
060093a79cd62973f63485b7e9a0aa75a3862b19

SHA256
c2b02d87ae2719f1c9f3e773f85354f137717d2eaea93c8423ef11a37d870856

SHA512
0833ba4ffc15e191e0140ee8727d8efe71cf3c188bcef22653da88f5bc3730694c667e5585f506e1c26fcbd4fa150abe0949c023e899fc7a665f0246f028aaa0

Download Submit
C:\Windows\System\eoEPKPP.exe

Filesize
1.1MB

MD5
b7628847de2f777018671e1e2de115bd

SHA1
63c41836ae42a4654f07125339453d3165658b9e

SHA256
da968f2f38e9070997a63bb1495fbe04b403ae99cde2b65ec0e7cb22b646127d

SHA512
2316d967e2a21ba6449f81fc5e330931a2fda6220fa5b1a2f385060488d07bd49b9f49962169638e32d7646c05e1942b35664b5302ab61e60c88ca8c62ec7706

Download Submit
C:\Windows\System\fWwxXYw.exe

Filesize
1.1MB

MD5
11c6516a431f1f8b62f0fadf0cda94dd

SHA1
e7e969b36b05cbdc6736ce78e627d917362eb597

SHA256
fc7515821bb705e1894ffb0ccbd75ba7007302259b58289656476593960aace4

SHA512
f14e27b1950494199e6397ea989a2535100d9cdbe5668633cfc5c1f814549b5c50985ae11623424c8827984b5ca96dca2c6c0f742cf529143ecd72a172b96b13

Download Submit
C:\Windows\System\hYLTpeQ.exe

Filesize
1.1MB

MD5
2953bbf5263686568d0071373468a924

SHA1
da46b5ecac222a3070a6e06d7372797534dbb7e8

SHA256
4c455d1b86b680fc73d4002a5c886bc734f6a82a44bc761c3734776697ed86c5

SHA512
26c317970f202df4526392616800f47b41b697097b8ce4976e73022c0459d2936154fbdc29e6df8265f37fc8c8ccebcf2186d201005a8bbb6dd780395bbdea63

Download Submit
C:\Windows\System\kqmsMYj.exe

Filesize
1.1MB

MD5
cc8972d61e38f96129517e6ce35d6221

SHA1
409c5704b63ba599d193b5a172f4918273f25475

SHA256
8005cf34604b455a8c18e14e6f94b0a57e3aacf5eb502ae9d4c19d64e69f3230

SHA512
307631c7bbc06fdc4fc847b9c23f9cdbb58b9f266dced8e339d1d718221255ec9f58dde1a8fab02e4c61fbdb8078ccee0bcc288bb70604fdc971f33cf0bc4541

Download Submit
C:\Windows\System\lGZQwoK.exe

Filesize
1.1MB

MD5
fd2215251e837f2ccda4edc23412d09c

SHA1
e150213b380ee6b03695a2a28c9709e24b6bf10a

SHA256
12e5e02f411683dac272c908092583e39b1b8cd2fbd3fc4241799bb34be4200b

SHA512
15b00c06ba2f98c6d2f7966b8e9672ef0cd7cf74e066a27d2304f25afc63142b8014e330ef76bb22ae4aa8d1d62c2fb79a03bd3b775543c17def1575d7614dfd

Download Submit
C:\Windows\System\lONeZQi.exe

Filesize
1.1MB

MD5
61b106f8c1d9f4c9a9340039859554f7

SHA1
746a6a5ba62a0a879ac55ebeff8b8c377a3d2727

SHA256
482693dc1872754ccac1d91a91285a352310ce1ece82817a5a1358ab9a2881b1

SHA512
f00a5b32e3eecaab32f4f895ec836cfc0476a1bf06680c1589ad8dbfdf89c5fbca1c6ee4ff5453b82b4369aa93c3383daf5fb0be68a34c1007cc5dee64678d41

Download Submit
C:\Windows\System\moSPPTl.exe

Filesize
1.1MB

MD5
b378dc4df17e978deef9b192e0329d0c

SHA1
22e38fac994c0780db5f96a0028c3cb28e8b739c

SHA256
63000c82f75ee4e2287365f84ce494dbcbd89b697aad2e6150a59e5f7f7441da

SHA512
a04d1bb42b4d1ed760f785feb7e3621f08cdf39b1dcf730fb4964471117f2639eae20c6a0ed9d31cd94017a1954377fa440b5aff3c5a68315138b2a01d491970

Download Submit
C:\Windows\System\ofrkCSN.exe

Filesize
1.1MB

MD5
c86703cdc049cc45f278c6eaea7ccd02

SHA1
d45b5dd9cc07742c8af6b48cac2b37e6be097305

SHA256
3fb08163ecda1a577a14bf3943cd7228647909733e8d73c1ad8d9e6827ab2955

SHA512
6edb79757640f17632594200deef2d1d66fea4d9cbb66376ee12ef8954f9840b927b62f9bc1765f3f12f370a414431512f516478870f96b9eafb043b9db95439

Download Submit
C:\Windows\System\qbVcZRf.exe

Filesize
1.1MB

MD5
59dbcd0321c3b97f98dcd9f475c78360

SHA1
af4fb309dacc30c2619d6a2e1bf18e5b88a2d3dd

SHA256
898ada81b0b104edf1d344d459fe1883bebc9953d494e325421d56f7810fd2d0

SHA512
50d8bd3dd34949aee52e0f4ade164f99431f67b4311e229fadcf7009ee2c09327491da43578c8f33ab7a1006f0dc8540b89d64e2e6ee31dd6acca39e01aa878b

Download Submit
C:\Windows\System\sVZLtnP.exe

Filesize
1.1MB

MD5
8594e9ec9826018b0a089abd542a8ad8

SHA1
cb8af80c5a098d312a98524f5d03a0ae77231bef

SHA256
8e10721362b4197f21977b667c2597570d0b0db1d7c00e247bdcea04c334d538

SHA512
1574a51c7a1bb956a0922d75f4c1413e1f79376d29427fa6c658146ef4ae82e2a8c5f3b304d5c555cf2b20cdd15f42b29ca189b74f6cb74b09779984ea3dbff7

Download Submit
C:\Windows\System\tDftiqo.exe

Filesize
1.1MB

MD5
e9424ecaf6f902fbd3523c1d48c393de

SHA1
6b0045513e96f2eb140ef6f6955846fc29020296

SHA256
da737895b81fb40c649897e1e7a7830d84ddd7253dd2e88b15f5054d05c999dc

SHA512
2e5b923026d5c0753a4a95406bbfffc812b6f38b9a120307a743339f63271ed41c99983a2f06685483b4d7c6acb69819655df4ad836fa9fa5228d1362354b562

Download Submit
C:\Windows\System\tfyuFow.exe

Filesize
1.1MB

MD5
c5a47e3f5c6f8513035bac565ac1f7fe

SHA1
c26a20ad254f191dbd585d2555c0848cb67abce7

SHA256
79ada5f4e4ad57faedcdf6020f5dcd3a11708b7a3a1504df00cc357c6f471cb6

SHA512
89dd924f2a214b5356a50f68d30868d62011674405be024fc7d2496bd63ea857b00d57e3299f77bf23a35848ce9ba4c0e2e8c67ca01e48f6b1dbaed5fb292a39

Download Submit
C:\Windows\System\uUaauLo.exe

Filesize
1.1MB

MD5
b77794ded5ee40b738d419e3d2d6ab05

SHA1
c9b07a95f128f4e219d79fd5774b13dd8a781af7

SHA256
c929ca708ab295c375ba16f0e09f16841fd5ccb5d338bfe8e49e8317513b58f3

SHA512
fe68f26fae0d2f4d57eab0a1136e9f502d470280e19a8c5673efdbdbd86931ac93ce87d45a774de1dc71c271da759b0d450e843906121d02647087e1ba8ab385

Download Submit
C:\Windows\System\ugsIoTd.exe

Filesize
1.1MB

MD5
ca394453b7d473a9802e61db5d63fa11

SHA1
887f1e1d1298352bab3e4e6e51d68b8596a36286

SHA256
7599478a28e9e2fc6df2cff81d259361a3ad02dca0c05e53f83e9266286d4c40

SHA512
25758084e2972c2ca9b48b5610cda349854b6314ab1291e8b272c34187253a97d6d84ca0e47e0559560cad904a72b56e29da2e8c3bd301246a57a7afd7f3ef42

Download Submit
C:\Windows\System\upjDVMk.exe

Filesize
1.1MB

MD5
265f1bba1afb56d559ee338e57430dc5

SHA1
463b864fb71bb348a8817b3b90ec3935f18b5a33

SHA256
88aea12eb049604669b5261d26c77228defe2927d572ae5062f526f6cdf9a23a

SHA512
88c9ae7e588ec079e3bf7461f73e93414da14aeced51080c008861d30696a18758becab8b0a8770c0cc2d4224d27d1871301659995a65d86be2a6cad0b0a1dd3

Download Submit
C:\Windows\System\wqgNJTz.exe

Filesize
1.1MB

MD5
5d744f6de4ac861984efffbef31dec42

SHA1
06e4abb699aac87e83fdbe2d99fabbddd780b576

SHA256
e9838f8b9eea9380dbd618e222e95b019d0fe3a1a48917da02b256e9c32ebf67

SHA512
86de33e304b50c328c07b0245215057cb79b06c761c367facfc491053665899bb057868735ce8c731672efeeecb34b8e7501b705990776f46e4891871f111d37

Download Submit
C:\Windows\System\yHliXCm.exe

Filesize
1.1MB

MD5
1f1e6825ba783c3f04135dde40f56545

SHA1
4daf54a438dc5f8a567d7758393c8e939baf1832

SHA256
720efcf2cdd033dcc81163629678f6e20c971271a0643c9f860edc241ae9f2dc

SHA512
b1984112c21b8736766e0d3a721880795c964a989ea2803da563a85e14cdce9f13a4c48794eeb5eb662d14c8f2f2ecfa75857ad34392bbc154aed366dcd118d4

Download Submit
C:\Windows\System\zFmkILk.exe

Filesize
1.1MB

MD5
db6852f456d6d7c9cf36d9185995068a

SHA1
6eded95241393d7123e52a3c2c12dc48818e88a8

SHA256
36f7f422f822c24d56a0b2707e21e814577fde79dd9a9bfe944b362d9f8e7d40

SHA512
5ac82b75a30cc6c64a51edab15cd0dbb7546978b17f4482ed65d1fa4c0312bf26bdbb2f903ab49c0c29cfee33558f87c8673ecc68a4bb86e9ef429c5916116ba

Download Submit
memory/1312-0-0x0000020A0BD70000-0x0000020A0BD80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads