xmrig | 99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5

Analysis

max time kernel
94s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
Size

1.6MB
MD5

adef34c6e83e0cd1649ac7cd6a4d8a79
SHA1

8b4cd0ffbbb0757c7017fae90c3630707f785cd8
SHA256

99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5
SHA512

071b8470dc9b39417cc417a17974f039a35747f4ce276d0f708e810d8be605128ed6944277adee265ddb896332978c5c81475fc1c6e30378edc2ef7e8c83014e
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZbSZ:GemTLkNdfE0pZy4

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b8f-4.dat	xmrig
behavioral2/files/0x000a000000023b94-8.dat	xmrig
behavioral2/files/0x000a000000023b93-10.dat	xmrig
behavioral2/files/0x000a000000023b95-18.dat	xmrig
behavioral2/files/0x000a000000023b98-33.dat	xmrig
behavioral2/files/0x000a000000023b99-38.dat	xmrig
behavioral2/files/0x000a000000023b9a-41.dat	xmrig
behavioral2/files/0x000a000000023b9c-59.dat	xmrig
behavioral2/files/0x000a000000023bad-101.dat	xmrig
behavioral2/files/0x0009000000023bc2-116.dat	xmrig
behavioral2/files/0x0009000000023bc4-134.dat	xmrig
behavioral2/files/0x0008000000023bff-161.dat	xmrig
behavioral2/files/0x0008000000023bd0-158.dat	xmrig
behavioral2/files/0x0008000000023bcf-156.dat	xmrig
behavioral2/files/0x0008000000023bce-152.dat	xmrig
behavioral2/files/0x0008000000023bcd-144.dat	xmrig
behavioral2/files/0x0008000000023bca-142.dat	xmrig
behavioral2/files/0x000e000000023bc8-139.dat	xmrig
behavioral2/files/0x0009000000023bc3-129.dat	xmrig
behavioral2/files/0x0008000000023bbd-119.dat	xmrig
behavioral2/files/0x000e000000023bb4-114.dat	xmrig
behavioral2/files/0x000b000000023ba5-104.dat	xmrig
behavioral2/files/0x000b000000023ba4-99.dat	xmrig
behavioral2/files/0x000b000000023ba3-94.dat	xmrig
behavioral2/files/0x000a000000023ba2-89.dat	xmrig
behavioral2/files/0x000a000000023ba1-84.dat	xmrig
behavioral2/files/0x000a000000023ba0-79.dat	xmrig
behavioral2/files/0x000a000000023b9f-74.dat	xmrig
behavioral2/files/0x000a000000023b9e-69.dat	xmrig
behavioral2/files/0x000a000000023b9d-64.dat	xmrig
behavioral2/files/0x000a000000023b9b-54.dat	xmrig
behavioral2/files/0x000a000000023b97-29.dat	xmrig
behavioral2/files/0x000a000000023b96-24.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1160	bPMGHpp.exe
2660	uJsGlKp.exe
2796	VYXxdIO.exe
2880	PdpnwOJ.exe
1844	geNdGSt.exe
3060	LgOPmof.exe
2564	FKCFqeE.exe
544	BufFkvT.exe
920	fYJfsLG.exe
348	YBswXsy.exe
1308	DKIrJtc.exe
2288	PLGUhjF.exe
3780	BQXcOuG.exe
3548	IpQyEQm.exe
1620	IHWMvlJ.exe
2936	NoUfzSu.exe
3340	Estimwr.exe
1400	cVErTKO.exe
4976	ORMeNNt.exe
5068	hPeCiUU.exe
3536	dHFALfg.exe
1520	PdeqNQP.exe
4592	XQOGeCG.exe
2736	rREGQan.exe
740	HiRVolA.exe
820	AwEZemx.exe
3820	yrxTlgt.exe
4556	hFbJHJX.exe
4688	jcVMQKo.exe
2260	SdYXVBP.exe
4800	YexEYso.exe
452	ksCriCQ.exe
2144	eDgTuCE.exe
876	nwPAcVM.exe
1032	koiiBBL.exe
2264	HEjMTIM.exe
2804	dbZwDHP.exe
3444	fCrfhCV.exe
1276	wNDYWsn.exe
1224	MfmHuUQ.exe
400	xOFWPWY.exe
4864	bGKdQmq.exe
1512	GLSapHW.exe
1868	wIAtTWj.exe
4032	UoCcmuk.exe
2108	iiYaYuK.exe
3028	rqwLqEI.exe
4984	ppPnOQJ.exe
4964	lcRMMGQ.exe
4068	RVBXPNG.exe
2560	POlrgdh.exe
3280	RbIcRfd.exe
3684	VGafhKv.exe
3976	ZnCqYzT.exe
4448	BqWDecP.exe
1444	RshSnYV.exe
2588	hpiNCti.exe
636	limNjZI.exe
3160	sZHhpHG.exe
2364	vmzfoti.exe
3056	aApfxYT.exe
4340	GhjSoWt.exe
4612	FJWjzjB.exe
4248	jWueeun.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MddXGaF.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\gHaguJJ.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\qNighTM.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\nZpfOKr.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\zEHJvvc.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\jVSkvJW.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\DCPsblS.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\jBESvjn.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\VPiggUM.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\aVYRgZk.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\xbyGzMw.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\sOSblYW.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\QJqCsJi.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\GYcDuZR.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\YsxLOMb.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\rREGQan.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\ctwTHWa.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\YXfnZrR.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\LOYddAs.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\HvkyFFR.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\NzVARFK.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\HiFbdAN.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\POlrgdh.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\tJTHTRZ.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\vNqojPK.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\zHBAGOq.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\tPXQSZa.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\lmSDfDa.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\sbdeETK.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\fYJfsLG.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\JwfURdF.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\KxStCvd.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\ZyQHYno.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\fjRxnRU.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\BjhZQUG.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\GhjSoWt.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\PzwHZzV.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\oItwuor.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\lQsopwZ.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\Yeiqexa.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\RmoVssd.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\eFuJPgM.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\BBPPhyZ.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\aApfxYT.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\hwcXDOW.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\dPTyCjQ.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\YkeVWxW.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\FJWjzjB.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\amOuSNm.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\LxMfJHB.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\ZfYhMjy.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\HiRVolA.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\JJEKKzT.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\MfatpUp.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\LMruVmg.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\khpkCKs.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\ukFcwie.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\YOSPSYm.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\iSmGIHj.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\Quozmjt.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\wVcVpKC.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\oCzSRqd.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\XVcbnjN.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
File created	C:\Windows\System\VrClOGp.exe	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1160	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	84
PID 4408 wrote to memory of 1160	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	84
PID 4408 wrote to memory of 2660	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	85
PID 4408 wrote to memory of 2660	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	85
PID 4408 wrote to memory of 2796	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	86
PID 4408 wrote to memory of 2796	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	86
PID 4408 wrote to memory of 2880	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	87
PID 4408 wrote to memory of 2880	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	87
PID 4408 wrote to memory of 1844	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	88
PID 4408 wrote to memory of 1844	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	88
PID 4408 wrote to memory of 3060	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	89
PID 4408 wrote to memory of 3060	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	89
PID 4408 wrote to memory of 2564	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	90
PID 4408 wrote to memory of 2564	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	90
PID 4408 wrote to memory of 544	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	91
PID 4408 wrote to memory of 544	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	91
PID 4408 wrote to memory of 920	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	92
PID 4408 wrote to memory of 920	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	92
PID 4408 wrote to memory of 348	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	93
PID 4408 wrote to memory of 348	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	93
PID 4408 wrote to memory of 1308	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	94
PID 4408 wrote to memory of 1308	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	94
PID 4408 wrote to memory of 2288	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	95
PID 4408 wrote to memory of 2288	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	95
PID 4408 wrote to memory of 3780	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	96
PID 4408 wrote to memory of 3780	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	96
PID 4408 wrote to memory of 3548	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	97
PID 4408 wrote to memory of 3548	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	97
PID 4408 wrote to memory of 1620	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	98
PID 4408 wrote to memory of 1620	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	98
PID 4408 wrote to memory of 2936	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	99
PID 4408 wrote to memory of 2936	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	99
PID 4408 wrote to memory of 3340	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	100
PID 4408 wrote to memory of 3340	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	100
PID 4408 wrote to memory of 1400	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	101
PID 4408 wrote to memory of 1400	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	101
PID 4408 wrote to memory of 4976	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	102
PID 4408 wrote to memory of 4976	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	102
PID 4408 wrote to memory of 5068	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	103
PID 4408 wrote to memory of 5068	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	103
PID 4408 wrote to memory of 3536	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	104
PID 4408 wrote to memory of 3536	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	104
PID 4408 wrote to memory of 1520	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	105
PID 4408 wrote to memory of 1520	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	105
PID 4408 wrote to memory of 4592	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	106
PID 4408 wrote to memory of 4592	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	106
PID 4408 wrote to memory of 2736	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	107
PID 4408 wrote to memory of 2736	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	107
PID 4408 wrote to memory of 740	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	108
PID 4408 wrote to memory of 740	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	108
PID 4408 wrote to memory of 820	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	109
PID 4408 wrote to memory of 820	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	109
PID 4408 wrote to memory of 3820	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	110
PID 4408 wrote to memory of 3820	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	110
PID 4408 wrote to memory of 4556	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	111
PID 4408 wrote to memory of 4556	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	111
PID 4408 wrote to memory of 4688	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	112
PID 4408 wrote to memory of 4688	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	112
PID 4408 wrote to memory of 2260	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	113
PID 4408 wrote to memory of 2260	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	113
PID 4408 wrote to memory of 4800	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	114
PID 4408 wrote to memory of 4800	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	114
PID 4408 wrote to memory of 452	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	115
PID 4408 wrote to memory of 452	4408	99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe	115

C:\Users\Admin\AppData\Local\Temp\99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe
"C:\Users\Admin\AppData\Local\Temp\99cffde8402e7ae6cdfc6e79c110c7360af0ff63015a447ace9ef8fffdfc5fd5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\System\bPMGHpp.exe
  C:\Windows\System\bPMGHpp.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\uJsGlKp.exe
  C:\Windows\System\uJsGlKp.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\VYXxdIO.exe
  C:\Windows\System\VYXxdIO.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\PdpnwOJ.exe
  C:\Windows\System\PdpnwOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\geNdGSt.exe
  C:\Windows\System\geNdGSt.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\LgOPmof.exe
  C:\Windows\System\LgOPmof.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\FKCFqeE.exe
  C:\Windows\System\FKCFqeE.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\BufFkvT.exe
  C:\Windows\System\BufFkvT.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\fYJfsLG.exe
  C:\Windows\System\fYJfsLG.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\YBswXsy.exe
  C:\Windows\System\YBswXsy.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\DKIrJtc.exe
  C:\Windows\System\DKIrJtc.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\PLGUhjF.exe
  C:\Windows\System\PLGUhjF.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\BQXcOuG.exe
  C:\Windows\System\BQXcOuG.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\IpQyEQm.exe
  C:\Windows\System\IpQyEQm.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\IHWMvlJ.exe
  C:\Windows\System\IHWMvlJ.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\NoUfzSu.exe
  C:\Windows\System\NoUfzSu.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\Estimwr.exe
  C:\Windows\System\Estimwr.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\cVErTKO.exe
  C:\Windows\System\cVErTKO.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\ORMeNNt.exe
  C:\Windows\System\ORMeNNt.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\hPeCiUU.exe
  C:\Windows\System\hPeCiUU.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\dHFALfg.exe
  C:\Windows\System\dHFALfg.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\PdeqNQP.exe
  C:\Windows\System\PdeqNQP.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\XQOGeCG.exe
  C:\Windows\System\XQOGeCG.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\rREGQan.exe
  C:\Windows\System\rREGQan.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\HiRVolA.exe
  C:\Windows\System\HiRVolA.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\AwEZemx.exe
  C:\Windows\System\AwEZemx.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\yrxTlgt.exe
  C:\Windows\System\yrxTlgt.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\hFbJHJX.exe
  C:\Windows\System\hFbJHJX.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\jcVMQKo.exe
  C:\Windows\System\jcVMQKo.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\SdYXVBP.exe
  C:\Windows\System\SdYXVBP.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\YexEYso.exe
  C:\Windows\System\YexEYso.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\ksCriCQ.exe
  C:\Windows\System\ksCriCQ.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\eDgTuCE.exe
  C:\Windows\System\eDgTuCE.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\nwPAcVM.exe
  C:\Windows\System\nwPAcVM.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\koiiBBL.exe
  C:\Windows\System\koiiBBL.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\HEjMTIM.exe
  C:\Windows\System\HEjMTIM.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\dbZwDHP.exe
  C:\Windows\System\dbZwDHP.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\fCrfhCV.exe
  C:\Windows\System\fCrfhCV.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\wNDYWsn.exe
  C:\Windows\System\wNDYWsn.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\MfmHuUQ.exe
  C:\Windows\System\MfmHuUQ.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\xOFWPWY.exe
  C:\Windows\System\xOFWPWY.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\bGKdQmq.exe
  C:\Windows\System\bGKdQmq.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\GLSapHW.exe
  C:\Windows\System\GLSapHW.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\wIAtTWj.exe
  C:\Windows\System\wIAtTWj.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\UoCcmuk.exe
  C:\Windows\System\UoCcmuk.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\iiYaYuK.exe
  C:\Windows\System\iiYaYuK.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\rqwLqEI.exe
  C:\Windows\System\rqwLqEI.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\ppPnOQJ.exe
  C:\Windows\System\ppPnOQJ.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\lcRMMGQ.exe
  C:\Windows\System\lcRMMGQ.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\RVBXPNG.exe
  C:\Windows\System\RVBXPNG.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\POlrgdh.exe
  C:\Windows\System\POlrgdh.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\RbIcRfd.exe
  C:\Windows\System\RbIcRfd.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\VGafhKv.exe
  C:\Windows\System\VGafhKv.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\ZnCqYzT.exe
  C:\Windows\System\ZnCqYzT.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\BqWDecP.exe
  C:\Windows\System\BqWDecP.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\RshSnYV.exe
  C:\Windows\System\RshSnYV.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\hpiNCti.exe
  C:\Windows\System\hpiNCti.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\limNjZI.exe
  C:\Windows\System\limNjZI.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\sZHhpHG.exe
  C:\Windows\System\sZHhpHG.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\vmzfoti.exe
  C:\Windows\System\vmzfoti.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\aApfxYT.exe
  C:\Windows\System\aApfxYT.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\GhjSoWt.exe
  C:\Windows\System\GhjSoWt.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\FJWjzjB.exe
  C:\Windows\System\FJWjzjB.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\jWueeun.exe
  C:\Windows\System\jWueeun.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\LMruVmg.exe
  C:\Windows\System\LMruVmg.exe
  2⤵
  PID:3040
- C:\Windows\System\aaPznKn.exe
  C:\Windows\System\aaPznKn.exe
  2⤵
  PID:1348
- C:\Windows\System\ViJNpGb.exe
  C:\Windows\System\ViJNpGb.exe
  2⤵
  PID:1220
- C:\Windows\System\Vxcerwf.exe
  C:\Windows\System\Vxcerwf.exe
  2⤵
  PID:3696
- C:\Windows\System\CuJgLBz.exe
  C:\Windows\System\CuJgLBz.exe
  2⤵
  PID:3604
- C:\Windows\System\UWOtBoj.exe
  C:\Windows\System\UWOtBoj.exe
  2⤵
  PID:4224
- C:\Windows\System\gllneEV.exe
  C:\Windows\System\gllneEV.exe
  2⤵
  PID:1956
- C:\Windows\System\JOjsdKV.exe
  C:\Windows\System\JOjsdKV.exe
  2⤵
  PID:2180
- C:\Windows\System\dSwgMNk.exe
  C:\Windows\System\dSwgMNk.exe
  2⤵
  PID:3968
- C:\Windows\System\fzewdMi.exe
  C:\Windows\System\fzewdMi.exe
  2⤵
  PID:3580
- C:\Windows\System\ZSchYae.exe
  C:\Windows\System\ZSchYae.exe
  2⤵
  PID:2956
- C:\Windows\System\ShUiFbs.exe
  C:\Windows\System\ShUiFbs.exe
  2⤵
  PID:2372
- C:\Windows\System\MddXGaF.exe
  C:\Windows\System\MddXGaF.exe
  2⤵
  PID:692
- C:\Windows\System\utDFtTA.exe
  C:\Windows\System\utDFtTA.exe
  2⤵
  PID:4696
- C:\Windows\System\utSVHGG.exe
  C:\Windows\System\utSVHGG.exe
  2⤵
  PID:2620
- C:\Windows\System\iwgVpNU.exe
  C:\Windows\System\iwgVpNU.exe
  2⤵
  PID:2168
- C:\Windows\System\zRIktJw.exe
  C:\Windows\System\zRIktJw.exe
  2⤵
  PID:3756
- C:\Windows\System\hyViFBo.exe
  C:\Windows\System\hyViFBo.exe
  2⤵
  PID:2140
- C:\Windows\System\yUKPfWN.exe
  C:\Windows\System\yUKPfWN.exe
  2⤵
  PID:220
- C:\Windows\System\cfHVYnt.exe
  C:\Windows\System\cfHVYnt.exe
  2⤵
  PID:2728
- C:\Windows\System\jVSkvJW.exe
  C:\Windows\System\jVSkvJW.exe
  2⤵
  PID:1876
- C:\Windows\System\HhaJqjx.exe
  C:\Windows\System\HhaJqjx.exe
  2⤵
  PID:2460
- C:\Windows\System\ybCjYhq.exe
  C:\Windows\System\ybCjYhq.exe
  2⤵
  PID:2772
- C:\Windows\System\RdyrNxy.exe
  C:\Windows\System\RdyrNxy.exe
  2⤵
  PID:5144
- C:\Windows\System\sUAGfDx.exe
  C:\Windows\System\sUAGfDx.exe
  2⤵
  PID:5172
- C:\Windows\System\ZyldlaO.exe
  C:\Windows\System\ZyldlaO.exe
  2⤵
  PID:5200
- C:\Windows\System\fDsVtqU.exe
  C:\Windows\System\fDsVtqU.exe
  2⤵
  PID:5228
- C:\Windows\System\Yeiqexa.exe
  C:\Windows\System\Yeiqexa.exe
  2⤵
  PID:5256
- C:\Windows\System\McchfCP.exe
  C:\Windows\System\McchfCP.exe
  2⤵
  PID:5284
- C:\Windows\System\oZnQMFH.exe
  C:\Windows\System\oZnQMFH.exe
  2⤵
  PID:5316
- C:\Windows\System\gisgCJD.exe
  C:\Windows\System\gisgCJD.exe
  2⤵
  PID:5340
- C:\Windows\System\hiaGgkp.exe
  C:\Windows\System\hiaGgkp.exe
  2⤵
  PID:5368
- C:\Windows\System\ekgltZp.exe
  C:\Windows\System\ekgltZp.exe
  2⤵
  PID:5396
- C:\Windows\System\MXsnVtZ.exe
  C:\Windows\System\MXsnVtZ.exe
  2⤵
  PID:5424
- C:\Windows\System\mTKGbqC.exe
  C:\Windows\System\mTKGbqC.exe
  2⤵
  PID:5452
- C:\Windows\System\dgfRXeX.exe
  C:\Windows\System\dgfRXeX.exe
  2⤵
  PID:5480
- C:\Windows\System\TGAUQaS.exe
  C:\Windows\System\TGAUQaS.exe
  2⤵
  PID:5508
- C:\Windows\System\YfXLBzm.exe
  C:\Windows\System\YfXLBzm.exe
  2⤵
  PID:5536
- C:\Windows\System\lqNeBWb.exe
  C:\Windows\System\lqNeBWb.exe
  2⤵
  PID:5564
- C:\Windows\System\JwfURdF.exe
  C:\Windows\System\JwfURdF.exe
  2⤵
  PID:5592
- C:\Windows\System\QBfsXfR.exe
  C:\Windows\System\QBfsXfR.exe
  2⤵
  PID:5620
- C:\Windows\System\gjrDqqe.exe
  C:\Windows\System\gjrDqqe.exe
  2⤵
  PID:5652
- C:\Windows\System\ESepJHB.exe
  C:\Windows\System\ESepJHB.exe
  2⤵
  PID:5676
- C:\Windows\System\lHNgnNe.exe
  C:\Windows\System\lHNgnNe.exe
  2⤵
  PID:5704
- C:\Windows\System\kWonMJC.exe
  C:\Windows\System\kWonMJC.exe
  2⤵
  PID:5732
- C:\Windows\System\mkRVsAX.exe
  C:\Windows\System\mkRVsAX.exe
  2⤵
  PID:5760
- C:\Windows\System\lnRuLen.exe
  C:\Windows\System\lnRuLen.exe
  2⤵
  PID:5788
- C:\Windows\System\wTXuYnz.exe
  C:\Windows\System\wTXuYnz.exe
  2⤵
  PID:5820
- C:\Windows\System\hRQUIwP.exe
  C:\Windows\System\hRQUIwP.exe
  2⤵
  PID:5844
- C:\Windows\System\YfAhHOP.exe
  C:\Windows\System\YfAhHOP.exe
  2⤵
  PID:5868
- C:\Windows\System\nLVLQjC.exe
  C:\Windows\System\nLVLQjC.exe
  2⤵
  PID:5900
- C:\Windows\System\TUxFkbU.exe
  C:\Windows\System\TUxFkbU.exe
  2⤵
  PID:5928
- C:\Windows\System\bsXodwm.exe
  C:\Windows\System\bsXodwm.exe
  2⤵
  PID:5960
- C:\Windows\System\uvWUqgq.exe
  C:\Windows\System\uvWUqgq.exe
  2⤵
  PID:6036
- C:\Windows\System\ynIQgWK.exe
  C:\Windows\System\ynIQgWK.exe
  2⤵
  PID:6052
- C:\Windows\System\coMiOhC.exe
  C:\Windows\System\coMiOhC.exe
  2⤵
  PID:6068
- C:\Windows\System\JUomQLT.exe
  C:\Windows\System\JUomQLT.exe
  2⤵
  PID:6084
- C:\Windows\System\xnWPqai.exe
  C:\Windows\System\xnWPqai.exe
  2⤵
  PID:6112
- C:\Windows\System\PoWvCML.exe
  C:\Windows\System\PoWvCML.exe
  2⤵
  PID:6136
- C:\Windows\System\oxoMGYY.exe
  C:\Windows\System\oxoMGYY.exe
  2⤵
  PID:2428
- C:\Windows\System\khpkCKs.exe
  C:\Windows\System\khpkCKs.exe
  2⤵
  PID:1872
- C:\Windows\System\ubkfXNF.exe
  C:\Windows\System\ubkfXNF.exe
  2⤵
  PID:976
- C:\Windows\System\GFOJGdN.exe
  C:\Windows\System\GFOJGdN.exe
  2⤵
  PID:5112
- C:\Windows\System\rHeTnQp.exe
  C:\Windows\System\rHeTnQp.exe
  2⤵
  PID:4812
- C:\Windows\System\nCUmtCP.exe
  C:\Windows\System\nCUmtCP.exe
  2⤵
  PID:4500
- C:\Windows\System\QSdOlEm.exe
  C:\Windows\System\QSdOlEm.exe
  2⤵
  PID:760
- C:\Windows\System\jGPktoh.exe
  C:\Windows\System\jGPktoh.exe
  2⤵
  PID:5156
- C:\Windows\System\DRdeUjk.exe
  C:\Windows\System\DRdeUjk.exe
  2⤵
  PID:5216
- C:\Windows\System\eAYJgQT.exe
  C:\Windows\System\eAYJgQT.exe
  2⤵
  PID:5280
- C:\Windows\System\CmLXGRO.exe
  C:\Windows\System\CmLXGRO.exe
  2⤵
  PID:5352
- C:\Windows\System\mUphcww.exe
  C:\Windows\System\mUphcww.exe
  2⤵
  PID:5412
- C:\Windows\System\gHaguJJ.exe
  C:\Windows\System\gHaguJJ.exe
  2⤵
  PID:5472
- C:\Windows\System\KjMWbxN.exe
  C:\Windows\System\KjMWbxN.exe
  2⤵
  PID:5552
- C:\Windows\System\PaDkPsr.exe
  C:\Windows\System\PaDkPsr.exe
  2⤵
  PID:5608
- C:\Windows\System\uooVTOa.exe
  C:\Windows\System\uooVTOa.exe
  2⤵
  PID:5672
- C:\Windows\System\FyfRoMD.exe
  C:\Windows\System\FyfRoMD.exe
  2⤵
  PID:5744
- C:\Windows\System\lwNkJSd.exe
  C:\Windows\System\lwNkJSd.exe
  2⤵
  PID:1080
- C:\Windows\System\UBGEQUQ.exe
  C:\Windows\System\UBGEQUQ.exe
  2⤵
  PID:5856
- C:\Windows\System\UyYDqdD.exe
  C:\Windows\System\UyYDqdD.exe
  2⤵
  PID:5916
- C:\Windows\System\gSvNXwz.exe
  C:\Windows\System\gSvNXwz.exe
  2⤵
  PID:5988
- C:\Windows\System\ahMiawh.exe
  C:\Windows\System\ahMiawh.exe
  2⤵
  PID:6060
- C:\Windows\System\NJtwjEb.exe
  C:\Windows\System\NJtwjEb.exe
  2⤵
  PID:6124
- C:\Windows\System\sxzOJKh.exe
  C:\Windows\System\sxzOJKh.exe
  2⤵
  PID:2268
- C:\Windows\System\fEslwwx.exe
  C:\Windows\System\fEslwwx.exe
  2⤵
  PID:4972
- C:\Windows\System\IGWvPXB.exe
  C:\Windows\System\IGWvPXB.exe
  2⤵
  PID:1116
- C:\Windows\System\wtSpMgh.exe
  C:\Windows\System\wtSpMgh.exe
  2⤵
  PID:5192
- C:\Windows\System\UmeMxKs.exe
  C:\Windows\System\UmeMxKs.exe
  2⤵
  PID:5332
- C:\Windows\System\FeGbuky.exe
  C:\Windows\System\FeGbuky.exe
  2⤵
  PID:5464
- C:\Windows\System\WZRvEPl.exe
  C:\Windows\System\WZRvEPl.exe
  2⤵
  PID:5604
- C:\Windows\System\EakUUvI.exe
  C:\Windows\System\EakUUvI.exe
  2⤵
  PID:5720
- C:\Windows\System\KxStCvd.exe
  C:\Windows\System\KxStCvd.exe
  2⤵
  PID:5888
- C:\Windows\System\PjOwvXg.exe
  C:\Windows\System\PjOwvXg.exe
  2⤵
  PID:4580
- C:\Windows\System\aXyyuuD.exe
  C:\Windows\System\aXyyuuD.exe
  2⤵
  PID:2360
- C:\Windows\System\OdTCVGn.exe
  C:\Windows\System\OdTCVGn.exe
  2⤵
  PID:780
- C:\Windows\System\FCtImDh.exe
  C:\Windows\System\FCtImDh.exe
  2⤵
  PID:6148
- C:\Windows\System\lWegZab.exe
  C:\Windows\System\lWegZab.exe
  2⤵
  PID:6176
- C:\Windows\System\vpyERVh.exe
  C:\Windows\System\vpyERVh.exe
  2⤵
  PID:6204
- C:\Windows\System\cnQiRCz.exe
  C:\Windows\System\cnQiRCz.exe
  2⤵
  PID:6228
- C:\Windows\System\dLsEdyL.exe
  C:\Windows\System\dLsEdyL.exe
  2⤵
  PID:6256
- C:\Windows\System\PzwHZzV.exe
  C:\Windows\System\PzwHZzV.exe
  2⤵
  PID:6284
- C:\Windows\System\qXLqVFy.exe
  C:\Windows\System\qXLqVFy.exe
  2⤵
  PID:6316
- C:\Windows\System\ukFcwie.exe
  C:\Windows\System\ukFcwie.exe
  2⤵
  PID:6344
- C:\Windows\System\tPXQSZa.exe
  C:\Windows\System\tPXQSZa.exe
  2⤵
  PID:6372
- C:\Windows\System\lzHskGP.exe
  C:\Windows\System\lzHskGP.exe
  2⤵
  PID:6400
- C:\Windows\System\QsZywOW.exe
  C:\Windows\System\QsZywOW.exe
  2⤵
  PID:6428
- C:\Windows\System\wlwPAVk.exe
  C:\Windows\System\wlwPAVk.exe
  2⤵
  PID:6452
- C:\Windows\System\jrNnYHB.exe
  C:\Windows\System\jrNnYHB.exe
  2⤵
  PID:6484
- C:\Windows\System\yibzINM.exe
  C:\Windows\System\yibzINM.exe
  2⤵
  PID:6512
- C:\Windows\System\qNighTM.exe
  C:\Windows\System\qNighTM.exe
  2⤵
  PID:6536
- C:\Windows\System\tODwaIr.exe
  C:\Windows\System\tODwaIr.exe
  2⤵
  PID:6568
- C:\Windows\System\bczXzlt.exe
  C:\Windows\System\bczXzlt.exe
  2⤵
  PID:6592
- C:\Windows\System\ikhIGaX.exe
  C:\Windows\System\ikhIGaX.exe
  2⤵
  PID:6624
- C:\Windows\System\EpJAfwh.exe
  C:\Windows\System\EpJAfwh.exe
  2⤵
  PID:6648
- C:\Windows\System\wStuMmJ.exe
  C:\Windows\System\wStuMmJ.exe
  2⤵
  PID:6676
- C:\Windows\System\yFXGgRh.exe
  C:\Windows\System\yFXGgRh.exe
  2⤵
  PID:6704
- C:\Windows\System\rgofGtm.exe
  C:\Windows\System\rgofGtm.exe
  2⤵
  PID:6732
- C:\Windows\System\fvOsdOZ.exe
  C:\Windows\System\fvOsdOZ.exe
  2⤵
  PID:6764
- C:\Windows\System\yTLKeBU.exe
  C:\Windows\System\yTLKeBU.exe
  2⤵
  PID:6792
- C:\Windows\System\innycFw.exe
  C:\Windows\System\innycFw.exe
  2⤵
  PID:6848
- C:\Windows\System\qmCVliR.exe
  C:\Windows\System\qmCVliR.exe
  2⤵
  PID:6872
- C:\Windows\System\IDHcAua.exe
  C:\Windows\System\IDHcAua.exe
  2⤵
  PID:6892
- C:\Windows\System\TCyfViR.exe
  C:\Windows\System\TCyfViR.exe
  2⤵
  PID:6912
- C:\Windows\System\lFkdutU.exe
  C:\Windows\System\lFkdutU.exe
  2⤵
  PID:6932
- C:\Windows\System\NgvDKJt.exe
  C:\Windows\System\NgvDKJt.exe
  2⤵
  PID:6992
- C:\Windows\System\IEhfYof.exe
  C:\Windows\System\IEhfYof.exe
  2⤵
  PID:7028
- C:\Windows\System\yguqzRg.exe
  C:\Windows\System\yguqzRg.exe
  2⤵
  PID:7048
- C:\Windows\System\fVrTrcN.exe
  C:\Windows\System\fVrTrcN.exe
  2⤵
  PID:7092
- C:\Windows\System\hWqnIWo.exe
  C:\Windows\System\hWqnIWo.exe
  2⤵
  PID:7116
- C:\Windows\System\sSWfnqJ.exe
  C:\Windows\System\sSWfnqJ.exe
  2⤵
  PID:7136
- C:\Windows\System\oabbUfn.exe
  C:\Windows\System\oabbUfn.exe
  2⤵
  PID:7164
- C:\Windows\System\TXXpFao.exe
  C:\Windows\System\TXXpFao.exe
  2⤵
  PID:5408
- C:\Windows\System\BAaKyVD.exe
  C:\Windows\System\BAaKyVD.exe
  2⤵
  PID:5660
- C:\Windows\System\RDyNpHY.exe
  C:\Windows\System\RDyNpHY.exe
  2⤵
  PID:5976
- C:\Windows\System\YbJSyUA.exe
  C:\Windows\System\YbJSyUA.exe
  2⤵
  PID:5132
- C:\Windows\System\lLHkQmj.exe
  C:\Windows\System\lLHkQmj.exe
  2⤵
  PID:6192
- C:\Windows\System\luEAfjW.exe
  C:\Windows\System\luEAfjW.exe
  2⤵
  PID:4980
- C:\Windows\System\IEeRnKV.exe
  C:\Windows\System\IEeRnKV.exe
  2⤵
  PID:6280
- C:\Windows\System\SzGxlDt.exe
  C:\Windows\System\SzGxlDt.exe
  2⤵
  PID:208
- C:\Windows\System\wfGUbWW.exe
  C:\Windows\System\wfGUbWW.exe
  2⤵
  PID:6336
- C:\Windows\System\vTgVMgF.exe
  C:\Windows\System\vTgVMgF.exe
  2⤵
  PID:4056
- C:\Windows\System\wVcVpKC.exe
  C:\Windows\System\wVcVpKC.exe
  2⤵
  PID:6472
- C:\Windows\System\ClHjpvw.exe
  C:\Windows\System\ClHjpvw.exe
  2⤵
  PID:6524
- C:\Windows\System\KaLqbae.exe
  C:\Windows\System\KaLqbae.exe
  2⤵
  PID:6580
- C:\Windows\System\VdtBJTT.exe
  C:\Windows\System\VdtBJTT.exe
  2⤵
  PID:3964
- C:\Windows\System\yBFpCAI.exe
  C:\Windows\System\yBFpCAI.exe
  2⤵
  PID:6640
- C:\Windows\System\jVwUNaM.exe
  C:\Windows\System\jVwUNaM.exe
  2⤵
  PID:6696
- C:\Windows\System\zwzkIhj.exe
  C:\Windows\System\zwzkIhj.exe
  2⤵
  PID:5064
- C:\Windows\System\WMQxiTB.exe
  C:\Windows\System\WMQxiTB.exe
  2⤵
  PID:5104
- C:\Windows\System\HXlwvsJ.exe
  C:\Windows\System\HXlwvsJ.exe
  2⤵
  PID:6752
- C:\Windows\System\dUwSFzF.exe
  C:\Windows\System\dUwSFzF.exe
  2⤵
  PID:2236
- C:\Windows\System\TgwyEAq.exe
  C:\Windows\System\TgwyEAq.exe
  2⤵
  PID:2524
- C:\Windows\System\nsilfuT.exe
  C:\Windows\System\nsilfuT.exe
  2⤵
  PID:2612
- C:\Windows\System\gimxzFg.exe
  C:\Windows\System\gimxzFg.exe
  2⤵
  PID:4060
- C:\Windows\System\mwTmvjY.exe
  C:\Windows\System\mwTmvjY.exe
  2⤵
  PID:6908
- C:\Windows\System\GJbbaEz.exe
  C:\Windows\System\GJbbaEz.exe
  2⤵
  PID:6888
- C:\Windows\System\qobTPbs.exe
  C:\Windows\System\qobTPbs.exe
  2⤵
  PID:6988
- C:\Windows\System\fynFyOx.exe
  C:\Windows\System\fynFyOx.exe
  2⤵
  PID:7112
- C:\Windows\System\INoNVlJ.exe
  C:\Windows\System\INoNVlJ.exe
  2⤵
  PID:7156
- C:\Windows\System\ihHcQnK.exe
  C:\Windows\System\ihHcQnK.exe
  2⤵
  PID:5968
- C:\Windows\System\iTNteTH.exe
  C:\Windows\System\iTNteTH.exe
  2⤵
  PID:776
- C:\Windows\System\Dasborx.exe
  C:\Windows\System\Dasborx.exe
  2⤵
  PID:6272
- C:\Windows\System\lkSzJea.exe
  C:\Windows\System\lkSzJea.exe
  2⤵
  PID:1884
- C:\Windows\System\qRipsBZ.exe
  C:\Windows\System\qRipsBZ.exe
  2⤵
  PID:6500
- C:\Windows\System\lujOMti.exe
  C:\Windows\System\lujOMti.exe
  2⤵
  PID:4824
- C:\Windows\System\jxRvXTM.exe
  C:\Windows\System\jxRvXTM.exe
  2⤵
  PID:6728
- C:\Windows\System\gEIVgCi.exe
  C:\Windows\System\gEIVgCi.exe
  2⤵
  PID:3492
- C:\Windows\System\SffnZpI.exe
  C:\Windows\System\SffnZpI.exe
  2⤵
  PID:2308
- C:\Windows\System\fjjrXKe.exe
  C:\Windows\System\fjjrXKe.exe
  2⤵
  PID:3668
- C:\Windows\System\gfhBHGa.exe
  C:\Windows\System\gfhBHGa.exe
  2⤵
  PID:632
- C:\Windows\System\WdvSigK.exe
  C:\Windows\System\WdvSigK.exe
  2⤵
  PID:7088
- C:\Windows\System\MxHPoDW.exe
  C:\Windows\System\MxHPoDW.exe
  2⤵
  PID:4924
- C:\Windows\System\eVuvMzu.exe
  C:\Windows\System\eVuvMzu.exe
  2⤵
  PID:6444
- C:\Windows\System\rizzHAU.exe
  C:\Windows\System\rizzHAU.exe
  2⤵
  PID:6776
- C:\Windows\System\unKQOBC.exe
  C:\Windows\System\unKQOBC.exe
  2⤵
  PID:4968
- C:\Windows\System\NNqsFuS.exe
  C:\Windows\System\NNqsFuS.exe
  2⤵
  PID:5584
- C:\Windows\System\aWDoNoQ.exe
  C:\Windows\System\aWDoNoQ.exe
  2⤵
  PID:6216
- C:\Windows\System\swuyPBq.exe
  C:\Windows\System\swuyPBq.exe
  2⤵
  PID:3232
- C:\Windows\System\bPquoWk.exe
  C:\Windows\System\bPquoWk.exe
  2⤵
  PID:5836
- C:\Windows\System\HUZXouy.exe
  C:\Windows\System\HUZXouy.exe
  2⤵
  PID:6804
- C:\Windows\System\mMzuBxv.exe
  C:\Windows\System\mMzuBxv.exe
  2⤵
  PID:7200
- C:\Windows\System\pXFbGfC.exe
  C:\Windows\System\pXFbGfC.exe
  2⤵
  PID:7220
- C:\Windows\System\nOBZMJB.exe
  C:\Windows\System\nOBZMJB.exe
  2⤵
  PID:7256
- C:\Windows\System\fwXgROJ.exe
  C:\Windows\System\fwXgROJ.exe
  2⤵
  PID:7292
- C:\Windows\System\JlXKIFc.exe
  C:\Windows\System\JlXKIFc.exe
  2⤵
  PID:7320
- C:\Windows\System\oCzSRqd.exe
  C:\Windows\System\oCzSRqd.exe
  2⤵
  PID:7340
- C:\Windows\System\QvcREGN.exe
  C:\Windows\System\QvcREGN.exe
  2⤵
  PID:7388
- C:\Windows\System\dIhBzSj.exe
  C:\Windows\System\dIhBzSj.exe
  2⤵
  PID:7416
- C:\Windows\System\GbWGpPh.exe
  C:\Windows\System\GbWGpPh.exe
  2⤵
  PID:7432
- C:\Windows\System\ehkuNtj.exe
  C:\Windows\System\ehkuNtj.exe
  2⤵
  PID:7464
- C:\Windows\System\aSytani.exe
  C:\Windows\System\aSytani.exe
  2⤵
  PID:7496
- C:\Windows\System\okOTeoE.exe
  C:\Windows\System\okOTeoE.exe
  2⤵
  PID:7512
- C:\Windows\System\mqUFSjo.exe
  C:\Windows\System\mqUFSjo.exe
  2⤵
  PID:7536
- C:\Windows\System\pjhsDxK.exe
  C:\Windows\System\pjhsDxK.exe
  2⤵
  PID:7564
- C:\Windows\System\GxjYydI.exe
  C:\Windows\System\GxjYydI.exe
  2⤵
  PID:7592
- C:\Windows\System\eSKlFXR.exe
  C:\Windows\System\eSKlFXR.exe
  2⤵
  PID:7628
- C:\Windows\System\PPVnfHC.exe
  C:\Windows\System\PPVnfHC.exe
  2⤵
  PID:7652
- C:\Windows\System\dUvvvJK.exe
  C:\Windows\System\dUvvvJK.exe
  2⤵
  PID:7684
- C:\Windows\System\ZjlZrBp.exe
  C:\Windows\System\ZjlZrBp.exe
  2⤵
  PID:7704
- C:\Windows\System\gBtHWyd.exe
  C:\Windows\System\gBtHWyd.exe
  2⤵
  PID:7728
- C:\Windows\System\ILRSAtU.exe
  C:\Windows\System\ILRSAtU.exe
  2⤵
  PID:7748
- C:\Windows\System\adUwphp.exe
  C:\Windows\System\adUwphp.exe
  2⤵
  PID:7772
- C:\Windows\System\HulyvRk.exe
  C:\Windows\System\HulyvRk.exe
  2⤵
  PID:7792
- C:\Windows\System\QYYifWo.exe
  C:\Windows\System\QYYifWo.exe
  2⤵
  PID:7828
- C:\Windows\System\yEOtnES.exe
  C:\Windows\System\yEOtnES.exe
  2⤵
  PID:7888
- C:\Windows\System\WHbAEVt.exe
  C:\Windows\System\WHbAEVt.exe
  2⤵
  PID:7912
- C:\Windows\System\IElnMHq.exe
  C:\Windows\System\IElnMHq.exe
  2⤵
  PID:7952
- C:\Windows\System\MfatpUp.exe
  C:\Windows\System\MfatpUp.exe
  2⤵
  PID:7980
- C:\Windows\System\MCSWctg.exe
  C:\Windows\System\MCSWctg.exe
  2⤵
  PID:8012
- C:\Windows\System\GwENDKX.exe
  C:\Windows\System\GwENDKX.exe
  2⤵
  PID:8040
- C:\Windows\System\SaWbIwG.exe
  C:\Windows\System\SaWbIwG.exe
  2⤵
  PID:8056
- C:\Windows\System\pJyxWpi.exe
  C:\Windows\System\pJyxWpi.exe
  2⤵
  PID:8092
- C:\Windows\System\lIsOSXQ.exe
  C:\Windows\System\lIsOSXQ.exe
  2⤵
  PID:8112
- C:\Windows\System\onLYkCK.exe
  C:\Windows\System\onLYkCK.exe
  2⤵
  PID:8152
- C:\Windows\System\pjOQlvQ.exe
  C:\Windows\System\pjOQlvQ.exe
  2⤵
  PID:8180
- C:\Windows\System\uSKohwO.exe
  C:\Windows\System\uSKohwO.exe
  2⤵
  PID:6928
- C:\Windows\System\gAFhQgt.exe
  C:\Windows\System\gAFhQgt.exe
  2⤵
  PID:7216
- C:\Windows\System\GPlPsty.exe
  C:\Windows\System\GPlPsty.exe
  2⤵
  PID:7280
- C:\Windows\System\pLluvaF.exe
  C:\Windows\System\pLluvaF.exe
  2⤵
  PID:7348
- C:\Windows\System\WKsdDAS.exe
  C:\Windows\System\WKsdDAS.exe
  2⤵
  PID:7460
- C:\Windows\System\JRNfgUc.exe
  C:\Windows\System\JRNfgUc.exe
  2⤵
  PID:7508
- C:\Windows\System\ecnamJD.exe
  C:\Windows\System\ecnamJD.exe
  2⤵
  PID:7548
- C:\Windows\System\WAuAuGz.exe
  C:\Windows\System\WAuAuGz.exe
  2⤵
  PID:7588
- C:\Windows\System\roOWFwm.exe
  C:\Windows\System\roOWFwm.exe
  2⤵
  PID:7720
- C:\Windows\System\NLXdEAP.exe
  C:\Windows\System\NLXdEAP.exe
  2⤵
  PID:7744
- C:\Windows\System\QSQfBGb.exe
  C:\Windows\System\QSQfBGb.exe
  2⤵
  PID:7848
- C:\Windows\System\sHMaeGS.exe
  C:\Windows\System\sHMaeGS.exe
  2⤵
  PID:7884
- C:\Windows\System\WhTcKws.exe
  C:\Windows\System\WhTcKws.exe
  2⤵
  PID:7976
- C:\Windows\System\XpiRWQH.exe
  C:\Windows\System\XpiRWQH.exe
  2⤵
  PID:8032
- C:\Windows\System\HFqnoxq.exe
  C:\Windows\System\HFqnoxq.exe
  2⤵
  PID:8068
- C:\Windows\System\NkIWPXN.exe
  C:\Windows\System\NkIWPXN.exe
  2⤵
  PID:8140
- C:\Windows\System\fjUXLkG.exe
  C:\Windows\System\fjUXLkG.exe
  2⤵
  PID:7244
- C:\Windows\System\HYmISND.exe
  C:\Windows\System\HYmISND.exe
  2⤵
  PID:7456
- C:\Windows\System\YGyJVMJ.exe
  C:\Windows\System\YGyJVMJ.exe
  2⤵
  PID:7476
- C:\Windows\System\mjSkQPe.exe
  C:\Windows\System\mjSkQPe.exe
  2⤵
  PID:7640
- C:\Windows\System\ApkaYHQ.exe
  C:\Windows\System\ApkaYHQ.exe
  2⤵
  PID:7700
- C:\Windows\System\HYPEqLn.exe
  C:\Windows\System\HYPEqLn.exe
  2⤵
  PID:8048
- C:\Windows\System\RtXOBBt.exe
  C:\Windows\System\RtXOBBt.exe
  2⤵
  PID:8148
- C:\Windows\System\CcnBAkx.exe
  C:\Windows\System\CcnBAkx.exe
  2⤵
  PID:7424
- C:\Windows\System\vFfBNRa.exe
  C:\Windows\System\vFfBNRa.exe
  2⤵
  PID:7716
- C:\Windows\System\ctwTHWa.exe
  C:\Windows\System\ctwTHWa.exe
  2⤵
  PID:8196
- C:\Windows\System\QAhMGzT.exe
  C:\Windows\System\QAhMGzT.exe
  2⤵
  PID:8228
- C:\Windows\System\AiSABWc.exe
  C:\Windows\System\AiSABWc.exe
  2⤵
  PID:8244
- C:\Windows\System\qJGzxsv.exe
  C:\Windows\System\qJGzxsv.exe
  2⤵
  PID:8260
- C:\Windows\System\VMsVuab.exe
  C:\Windows\System\VMsVuab.exe
  2⤵
  PID:8276
- C:\Windows\System\FKPQCEb.exe
  C:\Windows\System\FKPQCEb.exe
  2⤵
  PID:8320
- C:\Windows\System\IFkpcGh.exe
  C:\Windows\System\IFkpcGh.exe
  2⤵
  PID:8340
- C:\Windows\System\YrpzdFd.exe
  C:\Windows\System\YrpzdFd.exe
  2⤵
  PID:8364
- C:\Windows\System\TOYWkFh.exe
  C:\Windows\System\TOYWkFh.exe
  2⤵
  PID:8396
- C:\Windows\System\wNsRKsT.exe
  C:\Windows\System\wNsRKsT.exe
  2⤵
  PID:8444
- C:\Windows\System\KFhHDFS.exe
  C:\Windows\System\KFhHDFS.exe
  2⤵
  PID:8484
- C:\Windows\System\vIhXLGm.exe
  C:\Windows\System\vIhXLGm.exe
  2⤵
  PID:8508
- C:\Windows\System\LFHxxjN.exe
  C:\Windows\System\LFHxxjN.exe
  2⤵
  PID:8536
- C:\Windows\System\qvGWnaw.exe
  C:\Windows\System\qvGWnaw.exe
  2⤵
  PID:8556
- C:\Windows\System\CvDgWyv.exe
  C:\Windows\System\CvDgWyv.exe
  2⤵
  PID:8596
- C:\Windows\System\FHJOUmq.exe
  C:\Windows\System\FHJOUmq.exe
  2⤵
  PID:8636
- C:\Windows\System\ssSpDsp.exe
  C:\Windows\System\ssSpDsp.exe
  2⤵
  PID:8660
- C:\Windows\System\pPNCtJG.exe
  C:\Windows\System\pPNCtJG.exe
  2⤵
  PID:8680
- C:\Windows\System\nJyPJKn.exe
  C:\Windows\System\nJyPJKn.exe
  2⤵
  PID:8696
- C:\Windows\System\azRAysK.exe
  C:\Windows\System\azRAysK.exe
  2⤵
  PID:8736
- C:\Windows\System\GdhQico.exe
  C:\Windows\System\GdhQico.exe
  2⤵
  PID:8752
- C:\Windows\System\onAEoXl.exe
  C:\Windows\System\onAEoXl.exe
  2⤵
  PID:8772
- C:\Windows\System\DjFRXQB.exe
  C:\Windows\System\DjFRXQB.exe
  2⤵
  PID:8812
- C:\Windows\System\zqpHXnK.exe
  C:\Windows\System\zqpHXnK.exe
  2⤵
  PID:8844
- C:\Windows\System\BOFrdLT.exe
  C:\Windows\System\BOFrdLT.exe
  2⤵
  PID:8868
- C:\Windows\System\kCAgWyA.exe
  C:\Windows\System\kCAgWyA.exe
  2⤵
  PID:8892
- C:\Windows\System\SPIRNMR.exe
  C:\Windows\System\SPIRNMR.exe
  2⤵
  PID:8916
- C:\Windows\System\DDciyJX.exe
  C:\Windows\System\DDciyJX.exe
  2⤵
  PID:8932
- C:\Windows\System\SsdiIDn.exe
  C:\Windows\System\SsdiIDn.exe
  2⤵
  PID:8984
- C:\Windows\System\SCYhMcw.exe
  C:\Windows\System\SCYhMcw.exe
  2⤵
  PID:9012
- C:\Windows\System\unEwhZI.exe
  C:\Windows\System\unEwhZI.exe
  2⤵
  PID:9032
- C:\Windows\System\yzfdKTK.exe
  C:\Windows\System\yzfdKTK.exe
  2⤵
  PID:9056
- C:\Windows\System\ZwryOCP.exe
  C:\Windows\System\ZwryOCP.exe
  2⤵
  PID:9084
- C:\Windows\System\GjrBjxd.exe
  C:\Windows\System\GjrBjxd.exe
  2⤵
  PID:9144
- C:\Windows\System\ceYhHZx.exe
  C:\Windows\System\ceYhHZx.exe
  2⤵
  PID:9176
- C:\Windows\System\GzEApLV.exe
  C:\Windows\System\GzEApLV.exe
  2⤵
  PID:9196
- C:\Windows\System\NzVARFK.exe
  C:\Windows\System\NzVARFK.exe
  2⤵
  PID:8128
- C:\Windows\System\vAsPdut.exe
  C:\Windows\System\vAsPdut.exe
  2⤵
  PID:7996
- C:\Windows\System\amOuSNm.exe
  C:\Windows\System\amOuSNm.exe
  2⤵
  PID:8292
- C:\Windows\System\hgKAopW.exe
  C:\Windows\System\hgKAopW.exe
  2⤵
  PID:8272
- C:\Windows\System\GWDRyxo.exe
  C:\Windows\System\GWDRyxo.exe
  2⤵
  PID:8332
- C:\Windows\System\MzVCPKY.exe
  C:\Windows\System\MzVCPKY.exe
  2⤵
  PID:8452
- C:\Windows\System\zQqJmua.exe
  C:\Windows\System\zQqJmua.exe
  2⤵
  PID:8500
- C:\Windows\System\DVPUMAu.exe
  C:\Windows\System\DVPUMAu.exe
  2⤵
  PID:8532
- C:\Windows\System\whQTgLX.exe
  C:\Windows\System\whQTgLX.exe
  2⤵
  PID:8656
- C:\Windows\System\wrnuaor.exe
  C:\Windows\System\wrnuaor.exe
  2⤵
  PID:8716
- C:\Windows\System\Qyxoqor.exe
  C:\Windows\System\Qyxoqor.exe
  2⤵
  PID:8788
- C:\Windows\System\BvmIfTC.exe
  C:\Windows\System\BvmIfTC.exe
  2⤵
  PID:8804
- C:\Windows\System\HvkyFFR.exe
  C:\Windows\System\HvkyFFR.exe
  2⤵
  PID:8880
- C:\Windows\System\JyMHFvV.exe
  C:\Windows\System\JyMHFvV.exe
  2⤵
  PID:8904
- C:\Windows\System\igNdXKn.exe
  C:\Windows\System\igNdXKn.exe
  2⤵
  PID:8968
- C:\Windows\System\EHgWhvs.exe
  C:\Windows\System\EHgWhvs.exe
  2⤵
  PID:9068
- C:\Windows\System\mrXdaaT.exe
  C:\Windows\System\mrXdaaT.exe
  2⤵
  PID:9168
- C:\Windows\System\ximZCLC.exe
  C:\Windows\System\ximZCLC.exe
  2⤵
  PID:7616
- C:\Windows\System\jHdAPWi.exe
  C:\Windows\System\jHdAPWi.exe
  2⤵
  PID:8252
- C:\Windows\System\YOSPSYm.exe
  C:\Windows\System\YOSPSYm.exe
  2⤵
  PID:8552
- C:\Windows\System\ZvfMmxE.exe
  C:\Windows\System\ZvfMmxE.exe
  2⤵
  PID:8648
- C:\Windows\System\MIIlxTw.exe
  C:\Windows\System\MIIlxTw.exe
  2⤵
  PID:8912
- C:\Windows\System\YmXUjBb.exe
  C:\Windows\System\YmXUjBb.exe
  2⤵
  PID:9020
- C:\Windows\System\KaorjGA.exe
  C:\Windows\System\KaorjGA.exe
  2⤵
  PID:8084
- C:\Windows\System\FOIBScm.exe
  C:\Windows\System\FOIBScm.exe
  2⤵
  PID:7240
- C:\Windows\System\GuiuPeP.exe
  C:\Windows\System\GuiuPeP.exe
  2⤵
  PID:8504
- C:\Windows\System\mtAiYdG.exe
  C:\Windows\System\mtAiYdG.exe
  2⤵
  PID:8992
- C:\Windows\System\VcITTGp.exe
  C:\Windows\System\VcITTGp.exe
  2⤵
  PID:2488
- C:\Windows\System\siMxizZ.exe
  C:\Windows\System\siMxizZ.exe
  2⤵
  PID:9224
- C:\Windows\System\wuNGiIO.exe
  C:\Windows\System\wuNGiIO.exe
  2⤵
  PID:9280
- C:\Windows\System\fKUhFJG.exe
  C:\Windows\System\fKUhFJG.exe
  2⤵
  PID:9308
- C:\Windows\System\IoKKNUx.exe
  C:\Windows\System\IoKKNUx.exe
  2⤵
  PID:9332
- C:\Windows\System\wDOxmYP.exe
  C:\Windows\System\wDOxmYP.exe
  2⤵
  PID:9352
- C:\Windows\System\DCPsblS.exe
  C:\Windows\System\DCPsblS.exe
  2⤵
  PID:9392
- C:\Windows\System\NrguCYN.exe
  C:\Windows\System\NrguCYN.exe
  2⤵
  PID:9420
- C:\Windows\System\RXXSrFl.exe
  C:\Windows\System\RXXSrFl.exe
  2⤵
  PID:9448
- C:\Windows\System\WBzZDsX.exe
  C:\Windows\System\WBzZDsX.exe
  2⤵
  PID:9476
- C:\Windows\System\hzjggMw.exe
  C:\Windows\System\hzjggMw.exe
  2⤵
  PID:9504
- C:\Windows\System\rkOHXYx.exe
  C:\Windows\System\rkOHXYx.exe
  2⤵
  PID:9532
- C:\Windows\System\IyIIQKL.exe
  C:\Windows\System\IyIIQKL.exe
  2⤵
  PID:9548
- C:\Windows\System\QDpeQVP.exe
  C:\Windows\System\QDpeQVP.exe
  2⤵
  PID:9588
- C:\Windows\System\kjPKlzH.exe
  C:\Windows\System\kjPKlzH.exe
  2⤵
  PID:9616
- C:\Windows\System\jbgARwL.exe
  C:\Windows\System\jbgARwL.exe
  2⤵
  PID:9644
- C:\Windows\System\eJqnXOX.exe
  C:\Windows\System\eJqnXOX.exe
  2⤵
  PID:9672
- C:\Windows\System\ZIDsVkv.exe
  C:\Windows\System\ZIDsVkv.exe
  2⤵
  PID:9696
- C:\Windows\System\SniJBPB.exe
  C:\Windows\System\SniJBPB.exe
  2⤵
  PID:9724
- C:\Windows\System\ZydkHcy.exe
  C:\Windows\System\ZydkHcy.exe
  2⤵
  PID:9752
- C:\Windows\System\dlrJuVV.exe
  C:\Windows\System\dlrJuVV.exe
  2⤵
  PID:9780
- C:\Windows\System\knCWzmW.exe
  C:\Windows\System\knCWzmW.exe
  2⤵
  PID:9804
- C:\Windows\System\VLsgeMV.exe
  C:\Windows\System\VLsgeMV.exe
  2⤵
  PID:9832
- C:\Windows\System\qOTplkM.exe
  C:\Windows\System\qOTplkM.exe
  2⤵
  PID:9872
- C:\Windows\System\iQhwheO.exe
  C:\Windows\System\iQhwheO.exe
  2⤵
  PID:9900
- C:\Windows\System\kKAmvoP.exe
  C:\Windows\System\kKAmvoP.exe
  2⤵
  PID:9916
- C:\Windows\System\yNcZBcZ.exe
  C:\Windows\System\yNcZBcZ.exe
  2⤵
  PID:9936
- C:\Windows\System\jZNrwWG.exe
  C:\Windows\System\jZNrwWG.exe
  2⤵
  PID:9984
- C:\Windows\System\gzIRicn.exe
  C:\Windows\System\gzIRicn.exe
  2⤵
  PID:10012
- C:\Windows\System\BkBjsvS.exe
  C:\Windows\System\BkBjsvS.exe
  2⤵
  PID:10028
- C:\Windows\System\DvBlMnV.exe
  C:\Windows\System\DvBlMnV.exe
  2⤵
  PID:10068
- C:\Windows\System\RmoVssd.exe
  C:\Windows\System\RmoVssd.exe
  2⤵
  PID:10096
- C:\Windows\System\FeJFKYb.exe
  C:\Windows\System\FeJFKYb.exe
  2⤵
  PID:10116
- C:\Windows\System\EIqBZYy.exe
  C:\Windows\System\EIqBZYy.exe
  2⤵
  PID:10136
- C:\Windows\System\CaMClzy.exe
  C:\Windows\System\CaMClzy.exe
  2⤵
  PID:10160
- C:\Windows\System\hXoJNbs.exe
  C:\Windows\System\hXoJNbs.exe
  2⤵
  PID:10180
- C:\Windows\System\EKmOvim.exe
  C:\Windows\System\EKmOvim.exe
  2⤵
  PID:10212
- C:\Windows\System\UWLSagf.exe
  C:\Windows\System\UWLSagf.exe
  2⤵
  PID:10236
- C:\Windows\System\EPpIdHk.exe
  C:\Windows\System\EPpIdHk.exe
  2⤵
  PID:9108
- C:\Windows\System\EkXUNkH.exe
  C:\Windows\System\EkXUNkH.exe
  2⤵
  PID:9292
- C:\Windows\System\wxrDtJZ.exe
  C:\Windows\System\wxrDtJZ.exe
  2⤵
  PID:9348
- C:\Windows\System\HawvfOZ.exe
  C:\Windows\System\HawvfOZ.exe
  2⤵
  PID:9500
- C:\Windows\System\SfGuUMM.exe
  C:\Windows\System\SfGuUMM.exe
  2⤵
  PID:9540
- C:\Windows\System\OuWmyIl.exe
  C:\Windows\System\OuWmyIl.exe
  2⤵
  PID:9628
- C:\Windows\System\iyOvVAE.exe
  C:\Windows\System\iyOvVAE.exe
  2⤵
  PID:9680
- C:\Windows\System\LxMfJHB.exe
  C:\Windows\System\LxMfJHB.exe
  2⤵
  PID:9708
- C:\Windows\System\THNZujc.exe
  C:\Windows\System\THNZujc.exe
  2⤵
  PID:9776
- C:\Windows\System\WRZxoQv.exe
  C:\Windows\System\WRZxoQv.exe
  2⤵
  PID:9892
- C:\Windows\System\qKECoQc.exe
  C:\Windows\System\qKECoQc.exe
  2⤵
  PID:9932
- C:\Windows\System\DGFPTxg.exe
  C:\Windows\System\DGFPTxg.exe
  2⤵
  PID:10000
- C:\Windows\System\OqKQiRN.exe
  C:\Windows\System\OqKQiRN.exe
  2⤵
  PID:10060
- C:\Windows\System\GzmOrFh.exe
  C:\Windows\System\GzmOrFh.exe
  2⤵
  PID:10104
- C:\Windows\System\PWLefdd.exe
  C:\Windows\System\PWLefdd.exe
  2⤵
  PID:10172
- C:\Windows\System\slcZJNG.exe
  C:\Windows\System\slcZJNG.exe
  2⤵
  PID:10204
- C:\Windows\System\EJVyYUe.exe
  C:\Windows\System\EJVyYUe.exe
  2⤵
  PID:9460
- C:\Windows\System\ymjvWrr.exe
  C:\Windows\System\ymjvWrr.exe
  2⤵
  PID:9612
- C:\Windows\System\tChsAFW.exe
  C:\Windows\System\tChsAFW.exe
  2⤵
  PID:9664
- C:\Windows\System\xUUTlYP.exe
  C:\Windows\System\xUUTlYP.exe
  2⤵
  PID:9704
- C:\Windows\System\cuzOeEt.exe
  C:\Windows\System\cuzOeEt.exe
  2⤵
  PID:9908
- C:\Windows\System\sTkDBTO.exe
  C:\Windows\System\sTkDBTO.exe
  2⤵
  PID:10168
- C:\Windows\System\SBYDPMp.exe
  C:\Windows\System\SBYDPMp.exe
  2⤵
  PID:9796
- C:\Windows\System\ybPCUbp.exe
  C:\Windows\System\ybPCUbp.exe
  2⤵
  PID:10200
- C:\Windows\System\pktCpjK.exe
  C:\Windows\System\pktCpjK.exe
  2⤵
  PID:3416
- C:\Windows\System\KhnTyjS.exe
  C:\Windows\System\KhnTyjS.exe
  2⤵
  PID:9384
- C:\Windows\System\EkvifQQ.exe
  C:\Windows\System\EkvifQQ.exe
  2⤵
  PID:10248
- C:\Windows\System\itnlxEJ.exe
  C:\Windows\System\itnlxEJ.exe
  2⤵
  PID:10268
- C:\Windows\System\EhGeZeM.exe
  C:\Windows\System\EhGeZeM.exe
  2⤵
  PID:10292
- C:\Windows\System\tkGtSgQ.exe
  C:\Windows\System\tkGtSgQ.exe
  2⤵
  PID:10316
- C:\Windows\System\HxxbSdh.exe
  C:\Windows\System\HxxbSdh.exe
  2⤵
  PID:10336
- C:\Windows\System\AaZmQtR.exe
  C:\Windows\System\AaZmQtR.exe
  2⤵
  PID:10372
- C:\Windows\System\jfTHwFi.exe
  C:\Windows\System\jfTHwFi.exe
  2⤵
  PID:10424
- C:\Windows\System\mRGfrJc.exe
  C:\Windows\System\mRGfrJc.exe
  2⤵
  PID:10452
- C:\Windows\System\iSmGIHj.exe
  C:\Windows\System\iSmGIHj.exe
  2⤵
  PID:10480
- C:\Windows\System\QduaKLu.exe
  C:\Windows\System\QduaKLu.exe
  2⤵
  PID:10496
- C:\Windows\System\hwqAQuE.exe
  C:\Windows\System\hwqAQuE.exe
  2⤵
  PID:10536
- C:\Windows\System\dChZDzM.exe
  C:\Windows\System\dChZDzM.exe
  2⤵
  PID:10564
- C:\Windows\System\GtSQxud.exe
  C:\Windows\System\GtSQxud.exe
  2⤵
  PID:10592
- C:\Windows\System\FpjHgEN.exe
  C:\Windows\System\FpjHgEN.exe
  2⤵
  PID:10608
- C:\Windows\System\gQDkXLy.exe
  C:\Windows\System\gQDkXLy.exe
  2⤵
  PID:10652
- C:\Windows\System\bXXdeCC.exe
  C:\Windows\System\bXXdeCC.exe
  2⤵
  PID:10680
- C:\Windows\System\QIcflcj.exe
  C:\Windows\System\QIcflcj.exe
  2⤵
  PID:10712
- C:\Windows\System\UJaGPwj.exe
  C:\Windows\System\UJaGPwj.exe
  2⤵
  PID:10752
- C:\Windows\System\DGNtHqT.exe
  C:\Windows\System\DGNtHqT.exe
  2⤵
  PID:10784
- C:\Windows\System\SmPhCJD.exe
  C:\Windows\System\SmPhCJD.exe
  2⤵
  PID:10804
- C:\Windows\System\mlchfBh.exe
  C:\Windows\System\mlchfBh.exe
  2⤵
  PID:10824
- C:\Windows\System\zttZjqq.exe
  C:\Windows\System\zttZjqq.exe
  2⤵
  PID:10844
- C:\Windows\System\QJqCsJi.exe
  C:\Windows\System\QJqCsJi.exe
  2⤵
  PID:10868
- C:\Windows\System\chWXVFX.exe
  C:\Windows\System\chWXVFX.exe
  2⤵
  PID:10900
- C:\Windows\System\VkrZKWS.exe
  C:\Windows\System\VkrZKWS.exe
  2⤵
  PID:10928
- C:\Windows\System\FDnABwQ.exe
  C:\Windows\System\FDnABwQ.exe
  2⤵
  PID:10952
- C:\Windows\System\BNKaSkW.exe
  C:\Windows\System\BNKaSkW.exe
  2⤵
  PID:10984
- C:\Windows\System\nMNvKXJ.exe
  C:\Windows\System\nMNvKXJ.exe
  2⤵
  PID:11016
- C:\Windows\System\DZrzGOE.exe
  C:\Windows\System\DZrzGOE.exe
  2⤵
  PID:11040
- C:\Windows\System\oPKKZho.exe
  C:\Windows\System\oPKKZho.exe
  2⤵
  PID:11056
- C:\Windows\System\HOBkEJu.exe
  C:\Windows\System\HOBkEJu.exe
  2⤵
  PID:11080
- C:\Windows\System\DAZryaF.exe
  C:\Windows\System\DAZryaF.exe
  2⤵
  PID:11144
- C:\Windows\System\jBESvjn.exe
  C:\Windows\System\jBESvjn.exe
  2⤵
  PID:11164
- C:\Windows\System\xGhzwJL.exe
  C:\Windows\System\xGhzwJL.exe
  2⤵
  PID:11188
- C:\Windows\System\OIxEdRe.exe
  C:\Windows\System\OIxEdRe.exe
  2⤵
  PID:11216
- C:\Windows\System\PeEQEjG.exe
  C:\Windows\System\PeEQEjG.exe
  2⤵
  PID:11256
- C:\Windows\System\IArHacM.exe
  C:\Windows\System\IArHacM.exe
  2⤵
  PID:9912
- C:\Windows\System\QdDdQtf.exe
  C:\Windows\System\QdDdQtf.exe
  2⤵
  PID:10304
- C:\Windows\System\ITQYSXZ.exe
  C:\Windows\System\ITQYSXZ.exe
  2⤵
  PID:10356
- C:\Windows\System\FWdoTpf.exe
  C:\Windows\System\FWdoTpf.exe
  2⤵
  PID:10400
- C:\Windows\System\TChIklj.exe
  C:\Windows\System\TChIklj.exe
  2⤵
  PID:10520
- C:\Windows\System\yDBHlvO.exe
  C:\Windows\System\yDBHlvO.exe
  2⤵
  PID:10492
- C:\Windows\System\pTkagMs.exe
  C:\Windows\System\pTkagMs.exe
  2⤵
  PID:10628
- C:\Windows\System\IedeNjh.exe
  C:\Windows\System\IedeNjh.exe
  2⤵
  PID:10696
- C:\Windows\System\PEUMmzC.exe
  C:\Windows\System\PEUMmzC.exe
  2⤵
  PID:10740
- C:\Windows\System\yQeslVX.exe
  C:\Windows\System\yQeslVX.exe
  2⤵
  PID:10812
- C:\Windows\System\UqvvKxO.exe
  C:\Windows\System\UqvvKxO.exe
  2⤵
  PID:10856
- C:\Windows\System\pDbSgSy.exe
  C:\Windows\System\pDbSgSy.exe
  2⤵
  PID:10940
- C:\Windows\System\vwqSCiy.exe
  C:\Windows\System\vwqSCiy.exe
  2⤵
  PID:11012
- C:\Windows\System\IesutJQ.exe
  C:\Windows\System\IesutJQ.exe
  2⤵
  PID:11072
- C:\Windows\System\zdNmlqZ.exe
  C:\Windows\System\zdNmlqZ.exe
  2⤵
  PID:11140
- C:\Windows\System\TzdpQLY.exe
  C:\Windows\System\TzdpQLY.exe
  2⤵
  PID:11244
- C:\Windows\System\NKVSSzs.exe
  C:\Windows\System\NKVSSzs.exe
  2⤵
  PID:548
- C:\Windows\System\XTLydJX.exe
  C:\Windows\System\XTLydJX.exe
  2⤵
  PID:10448
- C:\Windows\System\eCnGSpg.exe
  C:\Windows\System\eCnGSpg.exe
  2⤵
  PID:10532
- C:\Windows\System\kpfDjCH.exe
  C:\Windows\System\kpfDjCH.exe
  2⤵
  PID:10664
- C:\Windows\System\WUueDoJ.exe
  C:\Windows\System\WUueDoJ.exe
  2⤵
  PID:10792
- C:\Windows\System\TDEkpaL.exe
  C:\Windows\System\TDEkpaL.exe
  2⤵
  PID:11052
- C:\Windows\System\wHcoWvZ.exe
  C:\Windows\System\wHcoWvZ.exe
  2⤵
  PID:11204
- C:\Windows\System\WxoBkEV.exe
  C:\Windows\System\WxoBkEV.exe
  2⤵
  PID:10264
- C:\Windows\System\fSKiLqm.exe
  C:\Windows\System\fSKiLqm.exe
  2⤵
  PID:10584
- C:\Windows\System\vYGpFTb.exe
  C:\Windows\System\vYGpFTb.exe
  2⤵
  PID:10736
- C:\Windows\System\yLCEbDm.exe
  C:\Windows\System\yLCEbDm.exe
  2⤵
  PID:11212
- C:\Windows\System\fNuyTrm.exe
  C:\Windows\System\fNuyTrm.exe
  2⤵
  PID:11284
- C:\Windows\System\uzONxjN.exe
  C:\Windows\System\uzONxjN.exe
  2⤵
  PID:11316
- C:\Windows\System\WBRgjJW.exe
  C:\Windows\System\WBRgjJW.exe
  2⤵
  PID:11360
- C:\Windows\System\wfNpuaq.exe
  C:\Windows\System\wfNpuaq.exe
  2⤵
  PID:11392
- C:\Windows\System\goLDTvA.exe
  C:\Windows\System\goLDTvA.exe
  2⤵
  PID:11420
- C:\Windows\System\sbjXPVB.exe
  C:\Windows\System\sbjXPVB.exe
  2⤵
  PID:11448
- C:\Windows\System\UExzsDb.exe
  C:\Windows\System\UExzsDb.exe
  2⤵
  PID:11472
- C:\Windows\System\aOjcNYb.exe
  C:\Windows\System\aOjcNYb.exe
  2⤵
  PID:11492
- C:\Windows\System\HXZUZbp.exe
  C:\Windows\System\HXZUZbp.exe
  2⤵
  PID:11508
- C:\Windows\System\PsXPSXR.exe
  C:\Windows\System\PsXPSXR.exe
  2⤵
  PID:11548
- C:\Windows\System\MzEKeKa.exe
  C:\Windows\System\MzEKeKa.exe
  2⤵
  PID:11564
- C:\Windows\System\hKLlvxT.exe
  C:\Windows\System\hKLlvxT.exe
  2⤵
  PID:11604
- C:\Windows\System\GYcDuZR.exe
  C:\Windows\System\GYcDuZR.exe
  2⤵
  PID:11644
- C:\Windows\System\GmfnOlI.exe
  C:\Windows\System\GmfnOlI.exe
  2⤵
  PID:11660
- C:\Windows\System\LWXMLdy.exe
  C:\Windows\System\LWXMLdy.exe
  2⤵
  PID:11676
- C:\Windows\System\zbaJFXu.exe
  C:\Windows\System\zbaJFXu.exe
  2⤵
  PID:11728
- C:\Windows\System\YXfnZrR.exe
  C:\Windows\System\YXfnZrR.exe
  2⤵
  PID:11756
- C:\Windows\System\BuvptTO.exe
  C:\Windows\System\BuvptTO.exe
  2⤵
  PID:11772
- C:\Windows\System\dApbZMj.exe
  C:\Windows\System\dApbZMj.exe
  2⤵
  PID:11800
- C:\Windows\System\ElolEro.exe
  C:\Windows\System\ElolEro.exe
  2⤵
  PID:11824
- C:\Windows\System\FuoHpxN.exe
  C:\Windows\System\FuoHpxN.exe
  2⤵
  PID:11844
- C:\Windows\System\RCEoMdq.exe
  C:\Windows\System\RCEoMdq.exe
  2⤵
  PID:11896
- C:\Windows\System\ZfYhMjy.exe
  C:\Windows\System\ZfYhMjy.exe
  2⤵
  PID:11912
- C:\Windows\System\pocHOad.exe
  C:\Windows\System\pocHOad.exe
  2⤵
  PID:11932
- C:\Windows\System\aTKQLBU.exe
  C:\Windows\System\aTKQLBU.exe
  2⤵
  PID:11952
- C:\Windows\System\MtCvZQc.exe
  C:\Windows\System\MtCvZQc.exe
  2⤵
  PID:11980
- C:\Windows\System\QzpdKNS.exe
  C:\Windows\System\QzpdKNS.exe
  2⤵
  PID:12012
- C:\Windows\System\DUpIZdy.exe
  C:\Windows\System\DUpIZdy.exe
  2⤵
  PID:12036
- C:\Windows\System\IOhKlth.exe
  C:\Windows\System\IOhKlth.exe
  2⤵
  PID:12068
- C:\Windows\System\YsxLOMb.exe
  C:\Windows\System\YsxLOMb.exe
  2⤵
  PID:12084
- C:\Windows\System\YWgIsMy.exe
  C:\Windows\System\YWgIsMy.exe
  2⤵
  PID:12116
- C:\Windows\System\FrMmQvV.exe
  C:\Windows\System\FrMmQvV.exe
  2⤵
  PID:12140
- C:\Windows\System\OejOFQJ.exe
  C:\Windows\System\OejOFQJ.exe
  2⤵
  PID:12164
- C:\Windows\System\KwxMmsi.exe
  C:\Windows\System\KwxMmsi.exe
  2⤵
  PID:12184
- C:\Windows\System\tJTHTRZ.exe
  C:\Windows\System\tJTHTRZ.exe
  2⤵
  PID:12252
- C:\Windows\System\myUinql.exe
  C:\Windows\System\myUinql.exe
  2⤵
  PID:12280
- C:\Windows\System\jquBPQY.exe
  C:\Windows\System\jquBPQY.exe
  2⤵
  PID:10708
- C:\Windows\System\Xnaqteg.exe
  C:\Windows\System\Xnaqteg.exe
  2⤵
  PID:10896
- C:\Windows\System\UjsIloq.exe
  C:\Windows\System\UjsIloq.exe
  2⤵
  PID:11356
- C:\Windows\System\hpXfTqm.exe
  C:\Windows\System\hpXfTqm.exe
  2⤵
  PID:11404
- C:\Windows\System\unwAiUj.exe
  C:\Windows\System\unwAiUj.exe
  2⤵
  PID:11464
- C:\Windows\System\LOYddAs.exe
  C:\Windows\System\LOYddAs.exe
  2⤵
  PID:11528
- C:\Windows\System\XVcbnjN.exe
  C:\Windows\System\XVcbnjN.exe
  2⤵
  PID:11588
- C:\Windows\System\nKHTlOH.exe
  C:\Windows\System\nKHTlOH.exe
  2⤵
  PID:11672
- C:\Windows\System\UMXcFZK.exe
  C:\Windows\System\UMXcFZK.exe
  2⤵
  PID:11764
- C:\Windows\System\TghUbCC.exe
  C:\Windows\System\TghUbCC.exe
  2⤵
  PID:11840
- C:\Windows\System\KnkyrRz.exe
  C:\Windows\System\KnkyrRz.exe
  2⤵
  PID:11868
- C:\Windows\System\Quozmjt.exe
  C:\Windows\System\Quozmjt.exe
  2⤵
  PID:11908
- C:\Windows\System\nRRoeJw.exe
  C:\Windows\System\nRRoeJw.exe
  2⤵
  PID:11976
- C:\Windows\System\BFqSPKj.exe
  C:\Windows\System\BFqSPKj.exe
  2⤵
  PID:12056
- C:\Windows\System\gTXkHlR.exe
  C:\Windows\System\gTXkHlR.exe
  2⤵
  PID:12156
- C:\Windows\System\gARgTUo.exe
  C:\Windows\System\gARgTUo.exe
  2⤵
  PID:12228
- C:\Windows\System\bgbPBep.exe
  C:\Windows\System\bgbPBep.exe
  2⤵
  PID:11280
- C:\Windows\System\VxjQpRj.exe
  C:\Windows\System\VxjQpRj.exe
  2⤵
  PID:10948
- C:\Windows\System\ygrQnLB.exe
  C:\Windows\System\ygrQnLB.exe
  2⤵
  PID:11408
- C:\Windows\System\mcZkQNb.exe
  C:\Windows\System\mcZkQNb.exe
  2⤵
  PID:11500
- C:\Windows\System\mnTnumy.exe
  C:\Windows\System\mnTnumy.exe
  2⤵
  PID:11816
- C:\Windows\System\IrrkVZH.exe
  C:\Windows\System\IrrkVZH.exe
  2⤵
  PID:11920
- C:\Windows\System\gTYYhgA.exe
  C:\Windows\System\gTYYhgA.exe
  2⤵
  PID:12028
- C:\Windows\System\dAtmIXp.exe
  C:\Windows\System\dAtmIXp.exe
  2⤵
  PID:12076
- C:\Windows\System\LiDtfNp.exe
  C:\Windows\System\LiDtfNp.exe
  2⤵
  PID:10384
- C:\Windows\System\QwAoEEZ.exe
  C:\Windows\System\QwAoEEZ.exe
  2⤵
  PID:11584
- C:\Windows\System\JdzIjOt.exe
  C:\Windows\System\JdzIjOt.exe
  2⤵
  PID:11752
- C:\Windows\System\pNnpBbH.exe
  C:\Windows\System\pNnpBbH.exe
  2⤵
  PID:11832
- C:\Windows\System\oJzxVFx.exe
  C:\Windows\System\oJzxVFx.exe
  2⤵
  PID:12296
- C:\Windows\System\xlvZKRa.exe
  C:\Windows\System\xlvZKRa.exe
  2⤵
  PID:12320
- C:\Windows\System\VsehOhA.exe
  C:\Windows\System\VsehOhA.exe
  2⤵
  PID:12348
- C:\Windows\System\ctsSNfT.exe
  C:\Windows\System\ctsSNfT.exe
  2⤵
  PID:12376
- C:\Windows\System\ZBgAMht.exe
  C:\Windows\System\ZBgAMht.exe
  2⤵
  PID:12396
- C:\Windows\System\UHcFYov.exe
  C:\Windows\System\UHcFYov.exe
  2⤵
  PID:12424
- C:\Windows\System\vCmlGik.exe
  C:\Windows\System\vCmlGik.exe
  2⤵
  PID:12472
- C:\Windows\System\mnVICwq.exe
  C:\Windows\System\mnVICwq.exe
  2⤵
  PID:12512
- C:\Windows\System\NAoiuGy.exe
  C:\Windows\System\NAoiuGy.exe
  2⤵
  PID:12540
- C:\Windows\System\RPJFCcK.exe
  C:\Windows\System\RPJFCcK.exe
  2⤵
  PID:12560
- C:\Windows\System\yiFFqUv.exe
  C:\Windows\System\yiFFqUv.exe
  2⤵
  PID:12584
- C:\Windows\System\yvYGvha.exe
  C:\Windows\System\yvYGvha.exe
  2⤵
  PID:12604
- C:\Windows\System\JdqjeXa.exe
  C:\Windows\System\JdqjeXa.exe
  2⤵
  PID:12628
- C:\Windows\System\RBUIoIU.exe
  C:\Windows\System\RBUIoIU.exe
  2⤵
  PID:12648
- C:\Windows\System\kPdOAUu.exe
  C:\Windows\System\kPdOAUu.exe
  2⤵
  PID:12696
- C:\Windows\System\PYQcIvI.exe
  C:\Windows\System\PYQcIvI.exe
  2⤵
  PID:12716
- C:\Windows\System\UPgxKVq.exe
  C:\Windows\System\UPgxKVq.exe
  2⤵
  PID:12764
- C:\Windows\System\nbTbfXt.exe
  C:\Windows\System\nbTbfXt.exe
  2⤵
  PID:12780
- C:\Windows\System\QAoqfnh.exe
  C:\Windows\System\QAoqfnh.exe
  2⤵
  PID:12804
- C:\Windows\System\KwRFOGd.exe
  C:\Windows\System\KwRFOGd.exe
  2⤵
  PID:12832
- C:\Windows\System\aVYRgZk.exe
  C:\Windows\System\aVYRgZk.exe
  2⤵
  PID:12852
- C:\Windows\System\GmvhNQM.exe
  C:\Windows\System\GmvhNQM.exe
  2⤵
  PID:12896
- C:\Windows\System\MkFYXSc.exe
  C:\Windows\System\MkFYXSc.exe
  2⤵
  PID:12920
- C:\Windows\System\kCFuUmg.exe
  C:\Windows\System\kCFuUmg.exe
  2⤵
  PID:12956
- C:\Windows\System\IZLzLed.exe
  C:\Windows\System\IZLzLed.exe
  2⤵
  PID:12980
- C:\Windows\System\klOeGwa.exe
  C:\Windows\System\klOeGwa.exe
  2⤵
  PID:13008
- C:\Windows\System\yXZEIBG.exe
  C:\Windows\System\yXZEIBG.exe
  2⤵
  PID:13024
- C:\Windows\System\aPBemUF.exe
  C:\Windows\System\aPBemUF.exe
  2⤵
  PID:13064
- C:\Windows\System\zhErclC.exe
  C:\Windows\System\zhErclC.exe
  2⤵
  PID:13084
- C:\Windows\System\bRzJLua.exe
  C:\Windows\System\bRzJLua.exe
  2⤵
  PID:13104
- C:\Windows\System\jVUYapL.exe
  C:\Windows\System\jVUYapL.exe
  2⤵
  PID:13148
- C:\Windows\System\BtuShld.exe
  C:\Windows\System\BtuShld.exe
  2⤵
  PID:13172
- C:\Windows\System\YPzlHpP.exe
  C:\Windows\System\YPzlHpP.exe
  2⤵
  PID:13208
- C:\Windows\System\geKWYaB.exe
  C:\Windows\System\geKWYaB.exe
  2⤵
  PID:13244
- C:\Windows\System\WaIKWGk.exe
  C:\Windows\System\WaIKWGk.exe
  2⤵
  PID:13272
- C:\Windows\System\iPMZDwr.exe
  C:\Windows\System\iPMZDwr.exe
  2⤵
  PID:13296
- C:\Windows\System\OYsJSoL.exe
  C:\Windows\System\OYsJSoL.exe
  2⤵
  PID:11560
- C:\Windows\System\HXZcYnE.exe
  C:\Windows\System\HXZcYnE.exe
  2⤵
  PID:12316
- C:\Windows\System\fhBIUwB.exe
  C:\Windows\System\fhBIUwB.exe
  2⤵
  PID:12360
- C:\Windows\System\pchAUBZ.exe
  C:\Windows\System\pchAUBZ.exe
  2⤵
  PID:12368
- C:\Windows\System\cEpAAVR.exe
  C:\Windows\System\cEpAAVR.exe
  2⤵
  PID:12464
- C:\Windows\System\auYrtEt.exe
  C:\Windows\System\auYrtEt.exe
  2⤵
  PID:12496
- C:\Windows\System\OKTJYjF.exe
  C:\Windows\System\OKTJYjF.exe
  2⤵
  PID:12556
- C:\Windows\System\qEHFtKJ.exe
  C:\Windows\System\qEHFtKJ.exe
  2⤵
  PID:12644
- C:\Windows\System\KztaFfM.exe
  C:\Windows\System\KztaFfM.exe
  2⤵
  PID:12680
- C:\Windows\System\NhVuUtr.exe
  C:\Windows\System\NhVuUtr.exe
  2⤵
  PID:12692
- C:\Windows\System\qyANvKb.exe
  C:\Windows\System\qyANvKb.exe
  2⤵
  PID:12772
- C:\Windows\System\dXYNakN.exe
  C:\Windows\System\dXYNakN.exe
  2⤵
  PID:12816
- C:\Windows\System\GStSGyt.exe
  C:\Windows\System\GStSGyt.exe
  2⤵
  PID:12880
- C:\Windows\System\ffaiWbj.exe
  C:\Windows\System\ffaiWbj.exe
  2⤵
  PID:12940
- C:\Windows\System\uLEltEz.exe
  C:\Windows\System\uLEltEz.exe
  2⤵
  PID:12964
- C:\Windows\System\lmSDfDa.exe
  C:\Windows\System\lmSDfDa.exe
  2⤵
  PID:13036
- C:\Windows\System\RcpgzEb.exe
  C:\Windows\System\RcpgzEb.exe
  2⤵
  PID:13096
- C:\Windows\System\rtzIwis.exe
  C:\Windows\System\rtzIwis.exe
  2⤵
  PID:13144
- C:\Windows\System\lZYGEnd.exe
  C:\Windows\System\lZYGEnd.exe
  2⤵
  PID:13220
- C:\Windows\System\EARVGlH.exe
  C:\Windows\System\EARVGlH.exe
  2⤵
  PID:13256
- C:\Windows\System\RpBEkIZ.exe
  C:\Windows\System\RpBEkIZ.exe
  2⤵
  PID:13268
- C:\Windows\System\FRuTdwM.exe
  C:\Windows\System\FRuTdwM.exe
  2⤵
  PID:12404
- C:\Windows\System\ipiXVOu.exe
  C:\Windows\System\ipiXVOu.exe
  2⤵
  PID:12384
- C:\Windows\System\qpYtddg.exe
  C:\Windows\System\qpYtddg.exe
  2⤵
  PID:12528
- C:\Windows\System\KbCgySj.exe
  C:\Windows\System\KbCgySj.exe
  2⤵
  PID:12568
- C:\Windows\System\SYFscmR.exe
  C:\Windows\System\SYFscmR.exe
  2⤵
  PID:12672
- C:\Windows\System\nyJLQRF.exe
  C:\Windows\System\nyJLQRF.exe
  2⤵
  PID:12824
- C:\Windows\System\eIbYzOW.exe
  C:\Windows\System\eIbYzOW.exe
  2⤵
  PID:12736
- C:\Windows\System\oItwuor.exe
  C:\Windows\System\oItwuor.exe
  2⤵
  PID:13020
- C:\Windows\System\sbdeETK.exe
  C:\Windows\System\sbdeETK.exe
  2⤵
  PID:13320
- C:\Windows\System\lXvRedg.exe
  C:\Windows\System\lXvRedg.exe
  2⤵
  PID:13352
- C:\Windows\System\oOQLnuP.exe
  C:\Windows\System\oOQLnuP.exe
  2⤵
  PID:13384
- C:\Windows\System\xfvfRjj.exe
  C:\Windows\System\xfvfRjj.exe
  2⤵
  PID:13400
- C:\Windows\System\yYhSdPq.exe
  C:\Windows\System\yYhSdPq.exe
  2⤵
  PID:13424
- C:\Windows\System\vcRDKrU.exe
  C:\Windows\System\vcRDKrU.exe
  2⤵
  PID:13452
- C:\Windows\System\xBeybPN.exe
  C:\Windows\System\xBeybPN.exe
  2⤵
  PID:13468
- C:\Windows\System\CVNVFHy.exe
  C:\Windows\System\CVNVFHy.exe
  2⤵
  PID:13492
- C:\Windows\System\iwfLVjm.exe
  C:\Windows\System\iwfLVjm.exe
  2⤵
  PID:13508
- C:\Windows\System\GfVaKdS.exe
  C:\Windows\System\GfVaKdS.exe
  2⤵
  PID:13532
- C:\Windows\System\WvbMiwr.exe
  C:\Windows\System\WvbMiwr.exe
  2⤵
  PID:13556
- C:\Windows\System\SbHBuVR.exe
  C:\Windows\System\SbHBuVR.exe
  2⤵
  PID:13572
- C:\Windows\System\qpHbhOV.exe
  C:\Windows\System\qpHbhOV.exe
  2⤵
  PID:13592
- C:\Windows\System\uPzRbAt.exe
  C:\Windows\System\uPzRbAt.exe
  2⤵
  PID:13620
- C:\Windows\System\ifGaWuL.exe
  C:\Windows\System\ifGaWuL.exe
  2⤵
  PID:13636
- C:\Windows\System\pubQyEb.exe
  C:\Windows\System\pubQyEb.exe
  2⤵
  PID:13652
- C:\Windows\System\twMObai.exe
  C:\Windows\System\twMObai.exe
  2⤵
  PID:13668
- C:\Windows\System\pvBcxyr.exe
  C:\Windows\System\pvBcxyr.exe
  2⤵
  PID:13684
- C:\Windows\System\nGqOrSI.exe
  C:\Windows\System\nGqOrSI.exe
  2⤵
  PID:13700
- C:\Windows\System\xlLxwtE.exe
  C:\Windows\System\xlLxwtE.exe
  2⤵
  PID:13724
- C:\Windows\System\JKVRmrf.exe
  C:\Windows\System\JKVRmrf.exe
  2⤵
  PID:13740
- C:\Windows\System\noihtTy.exe
  C:\Windows\System\noihtTy.exe
  2⤵
  PID:13760
- C:\Windows\System\lkxAeWR.exe
  C:\Windows\System\lkxAeWR.exe
  2⤵
  PID:13780
- C:\Windows\System\jzZmJUR.exe
  C:\Windows\System\jzZmJUR.exe
  2⤵
  PID:13808
- C:\Windows\System\zpHVNNq.exe
  C:\Windows\System\zpHVNNq.exe
  2⤵
  PID:13824
- C:\Windows\System\yatGukD.exe
  C:\Windows\System\yatGukD.exe
  2⤵
  PID:13840
- C:\Windows\System\MGuJRxs.exe
  C:\Windows\System\MGuJRxs.exe
  2⤵
  PID:13856
- C:\Windows\System\pdNzLeY.exe
  C:\Windows\System\pdNzLeY.exe
  2⤵
  PID:13888
- C:\Windows\System\MwvDHXf.exe
  C:\Windows\System\MwvDHXf.exe
  2⤵
  PID:13904
- C:\Windows\System\jfkjBvP.exe
  C:\Windows\System\jfkjBvP.exe
  2⤵
  PID:13928
- C:\Windows\System\QtgYlOe.exe
  C:\Windows\System\QtgYlOe.exe
  2⤵
  PID:13948
- C:\Windows\System\HkPNHro.exe
  C:\Windows\System\HkPNHro.exe
  2⤵
  PID:13992
- C:\Windows\System\DQNdLZK.exe
  C:\Windows\System\DQNdLZK.exe
  2⤵
  PID:14008
- C:\Windows\System\WUETdFI.exe
  C:\Windows\System\WUETdFI.exe
  2⤵
  PID:14024
- C:\Windows\System\bNdkJMF.exe
  C:\Windows\System\bNdkJMF.exe
  2⤵
  PID:14044
- C:\Windows\System\HnFomLo.exe
  C:\Windows\System\HnFomLo.exe
  2⤵
  PID:14064
- C:\Windows\System\yRrMTQx.exe
  C:\Windows\System\yRrMTQx.exe
  2⤵
  PID:14088
- C:\Windows\System\DbMROui.exe
  C:\Windows\System\DbMROui.exe
  2⤵
  PID:14104
- C:\Windows\System\HiFbdAN.exe
  C:\Windows\System\HiFbdAN.exe
  2⤵
  PID:14128
- C:\Windows\System\FNSSAKv.exe
  C:\Windows\System\FNSSAKv.exe
  2⤵
  PID:14148
- C:\Windows\System\eyGViKQ.exe
  C:\Windows\System\eyGViKQ.exe
  2⤵
  PID:14188
- C:\Windows\System\PgcBuju.exe
  C:\Windows\System\PgcBuju.exe
  2⤵
  PID:14208
- C:\Windows\System\IPdnrjq.exe
  C:\Windows\System\IPdnrjq.exe
  2⤵
  PID:14228
- C:\Windows\System\OMFxJEA.exe
  C:\Windows\System\OMFxJEA.exe
  2⤵
  PID:14252
- C:\Windows\System\UdYfmDM.exe
  C:\Windows\System\UdYfmDM.exe
  2⤵
  PID:14284
- C:\Windows\System\RsVQxVB.exe
  C:\Windows\System\RsVQxVB.exe
  2⤵
  PID:14300
- C:\Windows\System\JSnDbJG.exe
  C:\Windows\System\JSnDbJG.exe
  2⤵
  PID:14324
- C:\Windows\System\tPClNkp.exe
  C:\Windows\System\tPClNkp.exe
  2⤵
  PID:12484
- C:\Windows\System\hwcXDOW.exe
  C:\Windows\System\hwcXDOW.exe
  2⤵
  PID:13236
- C:\Windows\System\rwFQPim.exe
  C:\Windows\System\rwFQPim.exe
  2⤵
  PID:12788
- C:\Windows\System\zQNvAcn.exe
  C:\Windows\System\zQNvAcn.exe
  2⤵
  PID:13376
- C:\Windows\System\iFeXMtF.exe
  C:\Windows\System\iFeXMtF.exe
  2⤵
  PID:13420
- C:\Windows\System\gOvLfrp.exe
  C:\Windows\System\gOvLfrp.exe
  2⤵
  PID:13292
- C:\Windows\System\ktCRXIk.exe
  C:\Windows\System\ktCRXIk.exe
  2⤵
  PID:13588
- C:\Windows\System\ZSBYoxU.exe
  C:\Windows\System\ZSBYoxU.exe
  2⤵
  PID:13460
- C:\Windows\System\LfDtbjG.exe
  C:\Windows\System\LfDtbjG.exe
  2⤵
  PID:13648
- C:\Windows\System\vKdqQgd.exe
  C:\Windows\System\vKdqQgd.exe
  2⤵
  PID:13488
- C:\Windows\System\vkrgxMB.exe
  C:\Windows\System\vkrgxMB.exe
  2⤵
  PID:13344
- C:\Windows\System\iRwQHox.exe
  C:\Windows\System\iRwQHox.exe
  2⤵
  PID:13380
- C:\Windows\System\OvjdhOx.exe
  C:\Windows\System\OvjdhOx.exe
  2⤵
  PID:13796
- C:\Windows\System\ydFuAjS.exe
  C:\Windows\System\ydFuAjS.exe
  2⤵
  PID:13676
- C:\Windows\System\cmsInjk.exe
  C:\Windows\System\cmsInjk.exe
  2⤵
  PID:13876
- C:\Windows\System\RgNKiRh.exe
  C:\Windows\System\RgNKiRh.exe
  2⤵
  PID:14164
- C:\Windows\System\xzsQRpk.exe
  C:\Windows\System\xzsQRpk.exe
  2⤵
  PID:13832
- C:\Windows\System\PdYbRoZ.exe
  C:\Windows\System\PdYbRoZ.exe
  2⤵
  PID:14268
- C:\Windows\System\IZuYpFs.exe
  C:\Windows\System\IZuYpFs.exe
  2⤵
  PID:14052
- C:\Windows\System\VrClOGp.exe
  C:\Windows\System\VrClOGp.exe
  2⤵
  PID:12752
- C:\Windows\System\LAapbZe.exe
  C:\Windows\System\LAapbZe.exe
  2⤵
  PID:13372
- C:\Windows\System\dzAamiy.exe
  C:\Windows\System\dzAamiy.exe
  2⤵
  PID:13092
- C:\Windows\System\ntIqUGz.exe
  C:\Windows\System\ntIqUGz.exe
  2⤵
  PID:13332
- C:\Windows\System\KVjjMmd.exe
  C:\Windows\System\KVjjMmd.exe
  2⤵
  PID:13364
- C:\Windows\System\MRXJlCS.exe
  C:\Windows\System\MRXJlCS.exe
  2⤵
  PID:13792
- C:\Windows\System\AyXlWnV.exe
  C:\Windows\System\AyXlWnV.exe
  2⤵
  PID:14308
- C:\Windows\System\YyMOCHF.exe
  C:\Windows\System\YyMOCHF.exe
  2⤵
  PID:13664
- C:\Windows\System\vXrLTMg.exe
  C:\Windows\System\vXrLTMg.exe
  2⤵
  PID:14340
- C:\Windows\System\WnPqCat.exe
  C:\Windows\System\WnPqCat.exe
  2⤵
  PID:14364
- C:\Windows\System\xbyGzMw.exe
  C:\Windows\System\xbyGzMw.exe
  2⤵
  PID:14384
- C:\Windows\System\ITuNlWf.exe
  C:\Windows\System\ITuNlWf.exe
  2⤵
  PID:14404
- C:\Windows\System\HaeXpNP.exe
  C:\Windows\System\HaeXpNP.exe
  2⤵
  PID:14420
- C:\Windows\System\akeDLtz.exe
  C:\Windows\System\akeDLtz.exe
  2⤵
  PID:14440
- C:\Windows\System\HheVxuL.exe
  C:\Windows\System\HheVxuL.exe
  2⤵
  PID:14468
- C:\Windows\System\sqVMIpT.exe
  C:\Windows\System\sqVMIpT.exe
  2⤵
  PID:14488
- C:\Windows\System\lotUSwf.exe
  C:\Windows\System\lotUSwf.exe
  2⤵
  PID:14516
- C:\Windows\System\GfFgjsa.exe
  C:\Windows\System\GfFgjsa.exe
  2⤵
  PID:14564
- C:\Windows\System\vZyvXer.exe
  C:\Windows\System\vZyvXer.exe
  2⤵
  PID:14604
- C:\Windows\System\CMNapZv.exe
  C:\Windows\System\CMNapZv.exe
  2⤵
  PID:14624
- C:\Windows\System\kltVECu.exe
  C:\Windows\System\kltVECu.exe
  2⤵
  PID:14648
- C:\Windows\System\OBAGqYE.exe
  C:\Windows\System\OBAGqYE.exe
  2⤵
  PID:14664
- C:\Windows\System\HsVoOcu.exe
  C:\Windows\System\HsVoOcu.exe
  2⤵
  PID:14680
- C:\Windows\System\fOIeEwk.exe
  C:\Windows\System\fOIeEwk.exe
  2⤵
  PID:14708
- C:\Windows\System\jUgBGLB.exe
  C:\Windows\System\jUgBGLB.exe
  2⤵
  PID:14736
- C:\Windows\System\NkaqWuL.exe
  C:\Windows\System\NkaqWuL.exe
  2⤵
  PID:14760
- C:\Windows\System\wUHzUcA.exe
  C:\Windows\System\wUHzUcA.exe
  2⤵
  PID:14784
- C:\Windows\System\vNqojPK.exe
  C:\Windows\System\vNqojPK.exe
  2⤵
  PID:14800
- C:\Windows\System\AmgGifE.exe
  C:\Windows\System\AmgGifE.exe
  2⤵
  PID:14828
- C:\Windows\System\eQBmlmx.exe
  C:\Windows\System\eQBmlmx.exe
  2⤵
  PID:14848
- C:\Windows\System\OWQJdLm.exe
  C:\Windows\System\OWQJdLm.exe
  2⤵
  PID:14880
- C:\Windows\System\IYjXxVp.exe
  C:\Windows\System\IYjXxVp.exe
  2⤵
  PID:14904
- C:\Windows\System\jpfoNJp.exe
  C:\Windows\System\jpfoNJp.exe
  2⤵
  PID:14928
- C:\Windows\System\RAtKZfJ.exe
  C:\Windows\System\RAtKZfJ.exe
  2⤵
  PID:14944
- C:\Windows\System\nxsAiNU.exe
  C:\Windows\System\nxsAiNU.exe
  2⤵
  PID:14980
- C:\Windows\System\QEwHlCT.exe
  C:\Windows\System\QEwHlCT.exe
  2⤵
  PID:15008
- C:\Windows\System\XsCOLrC.exe
  C:\Windows\System\XsCOLrC.exe
  2⤵
  PID:15032
- C:\Windows\System\nZpfOKr.exe
  C:\Windows\System\nZpfOKr.exe
  2⤵
  PID:15060
- C:\Windows\System\pdQUOVr.exe
  C:\Windows\System\pdQUOVr.exe
  2⤵
  PID:15088
- C:\Windows\System\mvxsRSQ.exe
  C:\Windows\System\mvxsRSQ.exe
  2⤵
  PID:15112
- C:\Windows\System\bBnuGqy.exe
  C:\Windows\System\bBnuGqy.exe
  2⤵
  PID:15128
- C:\Windows\System\RHVoBZE.exe
  C:\Windows\System\RHVoBZE.exe
  2⤵
  PID:15152
- C:\Windows\System\GVGnnJz.exe
  C:\Windows\System\GVGnnJz.exe
  2⤵
  PID:15176
- C:\Windows\System\VmzwKWT.exe
  C:\Windows\System\VmzwKWT.exe
  2⤵
  PID:15200
- C:\Windows\System\zXpjfex.exe
  C:\Windows\System\zXpjfex.exe
  2⤵
  PID:15228
- C:\Windows\System\cLUFRkd.exe
  C:\Windows\System\cLUFRkd.exe
  2⤵
  PID:15248
- C:\Windows\System\zEHJvvc.exe
  C:\Windows\System\zEHJvvc.exe
  2⤵
  PID:15268
- C:\Windows\System\VydlyxX.exe
  C:\Windows\System\VydlyxX.exe
  2⤵
  PID:15300
- C:\Windows\System\ZyQHYno.exe
  C:\Windows\System\ZyQHYno.exe
  2⤵
  PID:15332
- C:\Windows\System\AvpZlWV.exe
  C:\Windows\System\AvpZlWV.exe
  2⤵
  PID:15348
- C:\Windows\System\eFuJPgM.exe
  C:\Windows\System\eFuJPgM.exe
  2⤵
  PID:13340
- C:\Windows\System\TFaZcnW.exe
  C:\Windows\System\TFaZcnW.exe
  2⤵
  PID:13884
- C:\Windows\System\fZsaehP.exe
  C:\Windows\System\fZsaehP.exe
  2⤵
  PID:13128
- C:\Windows\System\eQXvpEb.exe
  C:\Windows\System\eQXvpEb.exe
  2⤵
  PID:14352
- C:\Windows\System\kfuvgGI.exe
  C:\Windows\System\kfuvgGI.exe
  2⤵
  PID:13192
- C:\Windows\System\uZschVJ.exe
  C:\Windows\System\uZschVJ.exe
  2⤵
  PID:14416
- C:\Windows\System\LtAkLuS.exe
  C:\Windows\System\LtAkLuS.exe
  2⤵
  PID:14436
- C:\Windows\System\dULeQKZ.exe
  C:\Windows\System\dULeQKZ.exe
  2⤵
  PID:14496
- C:\Windows\System\lQsopwZ.exe
  C:\Windows\System\lQsopwZ.exe
  2⤵
  PID:14588
- C:\Windows\System\WikZzur.exe
  C:\Windows\System\WikZzur.exe
  2⤵
  PID:14644
- C:\Windows\System\DyjTccS.exe
  C:\Windows\System\DyjTccS.exe
  2⤵
  PID:14672
- C:\Windows\System\WFNNGfI.exe
  C:\Windows\System\WFNNGfI.exe
  2⤵
  PID:14792
- C:\Windows\System\yzgNIqf.exe
  C:\Windows\System\yzgNIqf.exe
  2⤵
  PID:14836
- C:\Windows\System\BjhZQUG.exe
  C:\Windows\System\BjhZQUG.exe
  2⤵
  PID:14560
- C:\Windows\System\NIxfjYA.exe
  C:\Windows\System\NIxfjYA.exe
  2⤵
  PID:15048
- C:\Windows\System\iCvmEmO.exe
  C:\Windows\System\iCvmEmO.exe
  2⤵
  PID:15372
- C:\Windows\System\ToTFYRH.exe
  C:\Windows\System\ToTFYRH.exe
  2⤵
  PID:15392
- C:\Windows\System\wqdmgWB.exe
  C:\Windows\System\wqdmgWB.exe
  2⤵
  PID:15416
- C:\Windows\System\lriDFkL.exe
  C:\Windows\System\lriDFkL.exe
  2⤵
  PID:15436
- C:\Windows\System\eBShFaw.exe
  C:\Windows\System\eBShFaw.exe
  2⤵
  PID:15460
- C:\Windows\System\mLkAsKX.exe
  C:\Windows\System\mLkAsKX.exe
  2⤵
  PID:15492
- C:\Windows\System\RTDwaYe.exe
  C:\Windows\System\RTDwaYe.exe
  2⤵
  PID:15512
- C:\Windows\System\wzsiSxE.exe
  C:\Windows\System\wzsiSxE.exe
  2⤵
  PID:15532
- C:\Windows\System\XIOemHe.exe
  C:\Windows\System\XIOemHe.exe
  2⤵
  PID:15552
- C:\Windows\System\OzEfYyP.exe
  C:\Windows\System\OzEfYyP.exe
  2⤵
  PID:15572
- C:\Windows\System\KTHJwJN.exe
  C:\Windows\System\KTHJwJN.exe
  2⤵
  PID:15596
- C:\Windows\System\iYKOLEE.exe
  C:\Windows\System\iYKOLEE.exe
  2⤵
  PID:15612
- C:\Windows\System\nDXLHga.exe
  C:\Windows\System\nDXLHga.exe
  2⤵
  PID:15632
- C:\Windows\System\lJayVzb.exe
  C:\Windows\System\lJayVzb.exe
  2⤵
  PID:15648
- C:\Windows\System\RMFDKnk.exe
  C:\Windows\System\RMFDKnk.exe
  2⤵
  PID:15668
- C:\Windows\System\GNxnngB.exe
  C:\Windows\System\GNxnngB.exe
  2⤵
  PID:15688
- C:\Windows\System\KufFvTc.exe
  C:\Windows\System\KufFvTc.exe
  2⤵
  PID:15716
- C:\Windows\System\GtnAVZd.exe
  C:\Windows\System\GtnAVZd.exe
  2⤵
  PID:15744
- C:\Windows\System\JQhgXBf.exe
  C:\Windows\System\JQhgXBf.exe
  2⤵
  PID:15764
- C:\Windows\System\CPrUztx.exe
  C:\Windows\System\CPrUztx.exe
  2⤵
  PID:15788
- C:\Windows\System\tGUGoiy.exe
  C:\Windows\System\tGUGoiy.exe
  2⤵
  PID:15804
- C:\Windows\System\HzRBFYN.exe
  C:\Windows\System\HzRBFYN.exe
  2⤵
  PID:15820
- C:\Windows\System\bkSRWDj.exe
  C:\Windows\System\bkSRWDj.exe
  2⤵
  PID:15836
- C:\Windows\System\OBopCnC.exe
  C:\Windows\System\OBopCnC.exe
  2⤵
  PID:15856
- C:\Windows\System\jLyQZKH.exe
  C:\Windows\System\jLyQZKH.exe
  2⤵
  PID:15884
- C:\Windows\System\ReNpENL.exe
  C:\Windows\System\ReNpENL.exe
  2⤵
  PID:15900
- C:\Windows\System\fjRxnRU.exe
  C:\Windows\System\fjRxnRU.exe
  2⤵
  PID:15916
- C:\Windows\System\mlDyyjH.exe
  C:\Windows\System\mlDyyjH.exe
  2⤵
  PID:15940
- C:\Windows\System\ZdAndAl.exe
  C:\Windows\System\ZdAndAl.exe
  2⤵
  PID:15968
- C:\Windows\System\FndlFmq.exe
  C:\Windows\System\FndlFmq.exe
  2⤵
  PID:15984
- C:\Windows\System\wylGAUX.exe
  C:\Windows\System\wylGAUX.exe
  2⤵
  PID:16000
- C:\Windows\System\IqWpAox.exe
  C:\Windows\System\IqWpAox.exe
  2⤵
  PID:16028
- C:\Windows\System\mPEOBCg.exe
  C:\Windows\System\mPEOBCg.exe
  2⤵
  PID:16052
- C:\Windows\System\GKNNShY.exe
  C:\Windows\System\GKNNShY.exe
  2⤵
  PID:16068
- C:\Windows\System\MtVxSrX.exe
  C:\Windows\System\MtVxSrX.exe
  2⤵
  PID:16084
- C:\Windows\System\xxpHQRo.exe
  C:\Windows\System\xxpHQRo.exe
  2⤵
  PID:16100
- C:\Windows\System\JJEKKzT.exe
  C:\Windows\System\JJEKKzT.exe
  2⤵
  PID:16116
- C:\Windows\System\dgYDUqx.exe
  C:\Windows\System\dgYDUqx.exe
  2⤵
  PID:16132
- C:\Windows\System\QoJivNr.exe
  C:\Windows\System\QoJivNr.exe
  2⤵
  PID:16152
- C:\Windows\System\SGzKlmt.exe
  C:\Windows\System\SGzKlmt.exe
  2⤵
  PID:16180
- C:\Windows\System\pfkBKey.exe
  C:\Windows\System\pfkBKey.exe
  2⤵
  PID:16196
- C:\Windows\System\SQvBZik.exe
  C:\Windows\System\SQvBZik.exe
  2⤵
  PID:16216
- C:\Windows\System\VPiggUM.exe
  C:\Windows\System\VPiggUM.exe
  2⤵
  PID:16232
- C:\Windows\System\HBSZQqU.exe
  C:\Windows\System\HBSZQqU.exe
  2⤵
  PID:16248
- C:\Windows\System\DrnNQan.exe
  C:\Windows\System\DrnNQan.exe
  2⤵
  PID:16268
- C:\Windows\System\xQjjQWW.exe
  C:\Windows\System\xQjjQWW.exe
  2⤵
  PID:16288
- C:\Windows\System\JqIyoDk.exe
  C:\Windows\System\JqIyoDk.exe
  2⤵
  PID:16304
- C:\Windows\System\CHRUWzP.exe
  C:\Windows\System\CHRUWzP.exe
  2⤵
  PID:16332
- C:\Windows\System\sDgOrfK.exe
  C:\Windows\System\sDgOrfK.exe
  2⤵
  PID:16364
- C:\Windows\System\XiElmcU.exe
  C:\Windows\System\XiElmcU.exe
  2⤵
  PID:15052
- C:\Windows\System\ytmNzkc.exe
  C:\Windows\System\ytmNzkc.exe
  2⤵
  PID:15168
- C:\Windows\System\sOSblYW.exe
  C:\Windows\System\sOSblYW.exe
  2⤵
  PID:15192
- C:\Windows\System\hhYCkXm.exe
  C:\Windows\System\hhYCkXm.exe
  2⤵
  PID:15244
- C:\Windows\System\mEYbKxC.exe
  C:\Windows\System\mEYbKxC.exe
  2⤵
  PID:15264
- C:\Windows\System\HrIqBJL.exe
  C:\Windows\System\HrIqBJL.exe
  2⤵
  PID:14400
- C:\Windows\System\AtupCsb.exe
  C:\Windows\System\AtupCsb.exe
  2⤵
  PID:13916
- C:\Windows\System\Oqfgfli.exe
  C:\Windows\System\Oqfgfli.exe
  2⤵
  PID:15708
- C:\Windows\System\VtCgKoA.exe
  C:\Windows\System\VtCgKoA.exe
  2⤵
  PID:15732
- C:\Windows\System\kluGaqp.exe
  C:\Windows\System\kluGaqp.exe
  2⤵
  PID:15756
- C:\Windows\System\mScyfaY.exe
  C:\Windows\System\mScyfaY.exe
  2⤵
  PID:14360
- C:\Windows\System\HjGHlLP.exe
  C:\Windows\System\HjGHlLP.exe
  2⤵
  PID:15828
- C:\Windows\System\JYugAaY.exe
  C:\Windows\System\JYugAaY.exe
  2⤵
  PID:15844
- C:\Windows\System\YgPxEnl.exe
  C:\Windows\System\YgPxEnl.exe
  2⤵
  PID:15864
- C:\Windows\System\qsFiDoh.exe
  C:\Windows\System\qsFiDoh.exe
  2⤵
  PID:15880
- C:\Windows\System\IJQRSfj.exe
  C:\Windows\System\IJQRSfj.exe
  2⤵
  PID:15976
- C:\Windows\System\IONGpbC.exe
  C:\Windows\System\IONGpbC.exe
  2⤵
  PID:15100
- C:\Windows\System\QHiSnFn.exe
  C:\Windows\System\QHiSnFn.exe
  2⤵
  PID:16012
- C:\Windows\System\OSBdTGm.exe
  C:\Windows\System\OSBdTGm.exe
  2⤵
  PID:16096
- C:\Windows\System\UlWmGcB.exe
  C:\Windows\System\UlWmGcB.exe
  2⤵
  PID:15164
- C:\Windows\System\ocrsBVM.exe
  C:\Windows\System\ocrsBVM.exe
  2⤵
  PID:15312
- C:\Windows\System\zlwpWsX.exe
  C:\Windows\System\zlwpWsX.exe
  2⤵
  PID:14096
- C:\Windows\System\JSDiTJW.exe
  C:\Windows\System\JSDiTJW.exe
  2⤵
  PID:14036
- C:\Windows\System\yHpcrPA.exe
  C:\Windows\System\yHpcrPA.exe
  2⤵
  PID:14372
- C:\Windows\System\pIRCGHk.exe
  C:\Windows\System\pIRCGHk.exe
  2⤵
  PID:14412
- C:\Windows\System\waklaKt.exe
  C:\Windows\System\waklaKt.exe
  2⤵
  PID:15924
- C:\Windows\System\zHBAGOq.exe
  C:\Windows\System\zHBAGOq.exe
  2⤵
  PID:14636
- C:\Windows\System\AVIUEJs.exe
  C:\Windows\System\AVIUEJs.exe
  2⤵
  PID:15412
- C:\Windows\System\HNrykuC.exe
  C:\Windows\System\HNrykuC.exe
  2⤵
  PID:16400
- C:\Windows\System\FLXRVNW.exe
  C:\Windows\System\FLXRVNW.exe
  2⤵
  PID:16416
- C:\Windows\System\QPiyCFO.exe
  C:\Windows\System\QPiyCFO.exe
  2⤵
  PID:16432
- C:\Windows\System\PLTliWo.exe
  C:\Windows\System\PLTliWo.exe
  2⤵
  PID:16448
- C:\Windows\System\ACWMWrP.exe
  C:\Windows\System\ACWMWrP.exe
  2⤵
  PID:16472
- C:\Windows\System\lYWzHaO.exe
  C:\Windows\System\lYWzHaO.exe
  2⤵
  PID:16496
- C:\Windows\System\NWgSZQN.exe
  C:\Windows\System\NWgSZQN.exe
  2⤵
  PID:16512
- C:\Windows\System\YGmzVOH.exe
  C:\Windows\System\YGmzVOH.exe
  2⤵
  PID:16528
- C:\Windows\System\nGVivPD.exe
  C:\Windows\System\nGVivPD.exe
  2⤵
  PID:16544
- C:\Windows\System\BbEDRhn.exe
  C:\Windows\System\BbEDRhn.exe
  2⤵
  PID:16560
- C:\Windows\System\NDcqoRV.exe
  C:\Windows\System\NDcqoRV.exe
  2⤵
  PID:16576
- C:\Windows\System\rZBItpJ.exe
  C:\Windows\System\rZBItpJ.exe
  2⤵
  PID:16592
- C:\Windows\System\lOXLldD.exe
  C:\Windows\System\lOXLldD.exe
  2⤵
  PID:16608
- C:\Windows\System\vcQvZpl.exe
  C:\Windows\System\vcQvZpl.exe
  2⤵
  PID:16628
- C:\Windows\System\XauwXPw.exe
  C:\Windows\System\XauwXPw.exe
  2⤵
  PID:16648
- C:\Windows\System\YxUBDnQ.exe
  C:\Windows\System\YxUBDnQ.exe
  2⤵
  PID:16664
- C:\Windows\System\wQHOXWl.exe
  C:\Windows\System\wQHOXWl.exe
  2⤵
  PID:16684
- C:\Windows\System\uNvngnn.exe
  C:\Windows\System\uNvngnn.exe
  2⤵
  PID:16708
- C:\Windows\System\tSrqcVM.exe
  C:\Windows\System\tSrqcVM.exe
  2⤵
  PID:16756
- C:\Windows\System\JQuMAAo.exe
  C:\Windows\System\JQuMAAo.exe
  2⤵
  PID:16772
- C:\Windows\System\jxEyNJx.exe
  C:\Windows\System\jxEyNJx.exe
  2⤵
  PID:16796
- C:\Windows\System\dPTyCjQ.exe
  C:\Windows\System\dPTyCjQ.exe
  2⤵
  PID:16820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AwEZemx.exe

Filesize
1.7MB

MD5
a71f16a9643ca86a471ded85662076c8

SHA1
2649b055f35da4f77f50845fb697e92a03fec191

SHA256
6d271de41c4139685daf55d3e0fc6880859889ef8b0bb111d2a3fcd1c0818c40

SHA512
07f2c1ac3b2fb38fe9f4927e242e8f98f318758cc0a67d9418cc92287963df50daf409edd2b9d83e86fc50089a86663a0bf9600e65362a976a42b147b94dd2b8

Download Submit
C:\Windows\System\BQXcOuG.exe

Filesize
1.7MB

MD5
8489308f0da3755191f86f1d66a78e36

SHA1
cdc85a4c652f7f7d03fdfe921a909c9c2ba91083

SHA256
14dab324388dac6960672c1766aac3b4ede60cba98ef1a9846747d692102d92d

SHA512
531e824678c0d2324bb7907f46e0ada6c09e9e39ddd899c35f0f93cf382ea03ac90624607e26269e341f0d15c4e4bb9528eab20f1286ef0abd5fc360243510ee

Download Submit
C:\Windows\System\BufFkvT.exe

Filesize
1.7MB

MD5
253e686f5eee12d2ce80d0a1510fbcf8

SHA1
fea8f1e428235d569a758cd0676fe5f0fb1cb6fe

SHA256
c17da42e2b54fb4a2c48ec5ca2e69f0deeb787ab7b19f5dbfac02ce2c6ddb007

SHA512
c42caf1887eaffc3133fa4231c108b8b7bfba117122f1f99348c5e526eda9fe4f44c6b6cd5a2f69bb4dadf1ba330d93b5dcd4ce6bfc464116f1f6cbe133712f7

Download Submit
C:\Windows\System\DKIrJtc.exe

Filesize
1.7MB

MD5
5733203a27c79793031a3d60a05be314

SHA1
fd613225a7458182da8e46860b6e95a9c7841fcf

SHA256
879db94db29dddf11c37bd174699fc35d8f2c404ba742fac510b9a4aac6bf101

SHA512
7d04588d6adcdc4d9281e781360d6d6b405ee068f5e037249d0107d4900a0814e55c29129a1dc69d9bbc9d2537a2998dae22fccb11f19c18bba289d20ef69f07

Download Submit
C:\Windows\System\Estimwr.exe

Filesize
1.7MB

MD5
e719235b4f9bda8c3f643f4a543c14d8

SHA1
a5eec58fee4efc25cbeecbffc1cda7ac39cd98ab

SHA256
d863ac994fb7d902ec9ae684a76c3f46e51f8d6f831044d08761ff72b369350f

SHA512
d2c29490b482fc6597a656c4762fcf67427df3e61e508960af2d3392b5492d826b74a6461f61c4b39c3591c799bc73e180963b73b4e1fb7ef27bfab565f040d4

Download Submit
C:\Windows\System\FKCFqeE.exe

Filesize
1.6MB

MD5
a7d2750401afd8ac2d7536601f796ad7

SHA1
1b33cfdbb2c6586a6c36926e22689513ad08b957

SHA256
a21d8ca18b2f2c43782cb65f716af4c94b225b5c438eb870d52bd1ca71117f35

SHA512
df63119982d9a86a339227d39dae9a9ccf1d17ae46eb3b01ccefa54455c9d377fb89b267f57e1a18d35590d6eede96682efdc88fb584ed4c7596f103639f6ef8

Download Submit
C:\Windows\System\HiRVolA.exe

Filesize
1.7MB

MD5
13dabad096d560be3efb6dcbd3035c62

SHA1
66ce5f3711ca67a1640604da7df38cc3db550c08

SHA256
56b400cae476b79f87e7b92a255aad3bac8374c1bab1e346b8596fd91e9e1b70

SHA512
98dd5b1ebb288d8e7f3d209056750b5bf4a247a560657f7efd478e8d06f9aa585c914258a1ad6cff74993af6e146724fbe4205b2a12ec43e6637408ae0cd72db

Download Submit
C:\Windows\System\IHWMvlJ.exe

Filesize
1.7MB

MD5
cc8f83c152c1ded51d79b5e9af7533e5

SHA1
dd368a27337143c0b7033e2623ddbd6f96c9bdb5

SHA256
50f81be62f347cd3cd156e06c2c9a31110449a522019799ae501e438544cfdf5

SHA512
aa14b50af58df13339c82d78cee5ea6a892f7c6b202841aade28533d87bf37e91edba64f626d1c119a76dba4c04422378206acf3b8cb28b33cdb9f68f8ec46b1

Download Submit
C:\Windows\System\IpQyEQm.exe

Filesize
1.7MB

MD5
0d014ffa6407a8665cc9a9a71300f861

SHA1
a15701a4c2a8b125c556b19f841a2eb178a91208

SHA256
f2a65fa361d73cc4768b2eb3cf8ac47f93e8c751e8ae0eab6da6499dd47d4384

SHA512
53c2984409816ec216a576576f40a264ed74fe9a808427cbd0f1a2c0ce20bf3e7b2b77cf52aba85d6497df4462d2648e609f7559c03bf6483ac6b659c2cbefe1

Download Submit
C:\Windows\System\LgOPmof.exe

Filesize
1.6MB

MD5
f110566cb4318bc8f0582c3c8d0c6aed

SHA1
1309f75d8bc0eae43fcd7bfa9b8296a51f974eef

SHA256
997701a904ae6fcef591b702d8c84722420780638d568186ace3eeabb8d35539

SHA512
e5f506d544737eb42de3e7084442714af345d8cfdcc9c7a0fda4882e76a4620ff715331c03348393665e31a8d4ab907dca999552c3b37f02f4837576336dd8b1

Download Submit
C:\Windows\System\NoUfzSu.exe

Filesize
1.7MB

MD5
b5a092af7c07c2f1f177cb1f2e99c293

SHA1
e174bed3ae6a82582b80e09c3cece1b41358b8ed

SHA256
cadcf6fc30c12285481684df4ed17a5b88156719c30dbe66abf6e680d8d7ee40

SHA512
d3704229d484af3cf03d89f34cfec63cb3e1bdbad6021debcccbb3e327f2cd66b7b625db1e6be125623495217f4fec7e001242dea0894c6f6580b8b6d7dee2fd

Download Submit
C:\Windows\System\ORMeNNt.exe

Filesize
1.7MB

MD5
ef1d085a60f874d76645cd1d8d0b9bad

SHA1
a1495195fc1ede1126dc6dc5a3f341552d9ccffc

SHA256
e10afb82e9966bf079225ae8d9ba6bd4bd759e9bb456f913bc7873514e2c4496

SHA512
27b3f276e31ba781737e8b7b385fe1b05d051a1a301540a5520e16666ab9c81a0244abee99cfb380d40328e34494e52ed0317e6ce9c4b2fbeea11399f7a12548

Download Submit
C:\Windows\System\PLGUhjF.exe

Filesize
1.7MB

MD5
6d571b2417602c213d59d7c3974e779f

SHA1
96b9eadea8a00e71fc4062f5ab4d48a9bc114512

SHA256
fcffd382182ec7e1a8d10907ecc3d4d77ee708c07e7addb1748b9333ddaa91d3

SHA512
bf46dc26349ed9f6d37277ad367668492a3baa23bd1fc1697e7cb3ac73f75c9618553b770bf4158187b82c3060c735dde00cc5203b3e177ad8b52c9cd1c3d4fd

Download Submit
C:\Windows\System\PdeqNQP.exe

Filesize
1.7MB

MD5
79e670c7385b178cfe9c354eb604721e

SHA1
de68e633c6627cd743aca86002d12d817d45169f

SHA256
92b46d2e24626d6fd1c519aa715defa4f774259b824cdcf11a5efeca78718c11

SHA512
98af5b08468f5d13d7cc0b6d2a0b92377d0475bad4f56376269423bc250b8908769b408025077ed1b4a633cd0be025d92fd4115b9a7465093311ffcd7a4a9b63

Download Submit
C:\Windows\System\PdpnwOJ.exe

Filesize
1.6MB

MD5
482f64c43c6fdccdeb1c27a65a1651aa

SHA1
3e01b98f05dcb4f308f3cc5306f037b41f038a4f

SHA256
0868becbea0893e0b50d11cc914ed518cc0204135c3f7f7d1f9fe96a72cb565f

SHA512
96aa5440de80402c6a6c38b5cc2cfba8ac23094db94523526c455f38b523ac985a1e43002c84cb49e83579be1c1a39fadb93e19216df60ae382eaf55341ead43

Download Submit
C:\Windows\System\SdYXVBP.exe

Filesize
1.7MB

MD5
49d613280b06de01ba17ab8ae837d644

SHA1
0125e5d3dcdb793a2f88656ef354659cb93b5f82

SHA256
c331a0b3d835c66aa6b4c7cb19524de0ce625d2faea6a6a6e66921852155ceba

SHA512
12b2298cc9aad0d63786914a5b1b0acf79bd74c97d50c91e3e9083c2bbff1dc1a0f6b8aad3bc7486568cdcd8668da0eb3e80180553369504cb0e4172fac61365

Download Submit
C:\Windows\System\VYXxdIO.exe

Filesize
1.6MB

MD5
74eb10f49f81ad6d0de664f2c0303fb0

SHA1
e8e11a1aff95b8cd0883964fc4b97b3adc2a7d84

SHA256
24b36135ad2bf5aedc37bec3b4fb61991af3943ff2a107cdf02d7c7cbc39d462

SHA512
59fd096ad7e6240c21e5e688807149b70360e3f46667dde138a43f94421b9bc177802212a06b6ca0ac3579050c62f1881238d5950b8b600a6fe6fd65c8372590

Download Submit
C:\Windows\System\XQOGeCG.exe

Filesize
1.7MB

MD5
90e09bda8679930d86ab7f62d7fe61f7

SHA1
6005b5515da434fd6402ed5f9c5a2772e06cf796

SHA256
2303bbf365c81d30e87b1ae046b3114580b41863049858c6cd048c9847216a47

SHA512
bb8f3758813c52cec6bc2d2e5a4f827efe699da12f8c04e4431c2ea4b6997de257210515891f2886224d666c86b8199b7eb177a4c6a0f2d14d0faa9949a67752

Download Submit
C:\Windows\System\YBswXsy.exe

Filesize
1.7MB

MD5
146ad11a1246f4cb1ab33cf18540abf6

SHA1
35c778a8fafa41ccba07779a1a5087e6cf9a0104

SHA256
fd6c80b4c3369ce6fb7da921c592c38fb42de989628fc2bfd7a2f51a78c334fc

SHA512
493c4e6843fa4694c33497506e13e3c80c60acbb4def0fc6bb941aec9becaf1c02b39af578414a795ae3a91dc946d79625ad9953e08137061088af9dcff10ce2

Download Submit
C:\Windows\System\YexEYso.exe

Filesize
1.7MB

MD5
2e73c0dc3d5f57e8a8c3ad36bca6b76d

SHA1
5ca5e5281f2e0d459d2ff03fc8ea890422a112de

SHA256
767e0b4b3724b226837442a1499e4adb3467e0b0b8db6c6f2aebc30fe7c1bd79

SHA512
4f86c87f32b80c5dab02ff2c6c22e1e0681380939effbbaa23a5bf7d38b3cbae88908bbc8cac27cddbcadd17b924b320a196bb7df6b01bf3fb2fd09791841098

Download Submit
C:\Windows\System\bPMGHpp.exe

Filesize
1.6MB

MD5
2235931ab9865ecf516b55ebbc1103a2

SHA1
a50445e00fa867cdbee5965fb84444ba4aa4a865

SHA256
64a44a90182da39eee0a86b17adfa3e396af57ac7b34a2a5062941b14dc8a67d

SHA512
63c2ad62760afa79d684686cfa911f30a23595bfb8de37494661a7b46c9103d2a2fb7a271bcb1697b823c4f888770ea3929b7c0e3a52d4da4578e5cf33c3ce23

Download Submit
C:\Windows\System\cVErTKO.exe

Filesize
1.7MB

MD5
47a9777508d06c9e552c5b3f915d74b0

SHA1
1bed85a301c57abb7b960a11b3ee1eaf9755a43d

SHA256
6d5cc79ba3909e630564cddd8b9b2371c752519c9c2093ea06c96eedeaa606f6

SHA512
f1f704c4fc5420106347ed3dbb3a3e7edac6b004eb6c74802b6b9890cffa08719287736ec077ccdfdc63dda04b881eda4d6bb2f7f28c36a0bb7fc8522833f541

Download Submit
C:\Windows\System\dHFALfg.exe

Filesize
1.7MB

MD5
130b86503e0c302d81b98b59644122e5

SHA1
7c354a05cab7680d245753653708821aefe7ded1

SHA256
8acc1cd6a6edfb664e4fa2995feed2a3ff20ca64f9373d14c9801edaf0985f4e

SHA512
b5fc60b64f8ab5c105db160281a8289a8fc697b6366b0b94e01dd91922f7400ec4627f0cb46f23dcf6dd11f8a33efa8c25232d0a58a806c00c782bdf2ecac5d4

Download Submit
C:\Windows\System\eDgTuCE.exe

Filesize
1.7MB

MD5
cac88c5e829d3461903ae942a96478f1

SHA1
2bf120876f427d718cab5479bfc6a95959c3904d

SHA256
ad8b6ed1703bb97aafd027cb13d7c71d7b4b608600ff533cecc3d18e2ef4f611

SHA512
f25962127ab8719199306b03e841cc88962df5b3b3569b787df68d55fe7f552c3f94796192b50183bc0dafac9e29a44f6eaac03b8cf3f5a85b1d4e4823c99e7d

Download Submit
C:\Windows\System\fYJfsLG.exe

Filesize
1.7MB

MD5
f226ff8b44677681babd1ecfe9e8327e

SHA1
34f9219de01bed4635fecce700476c8b9ad1336b

SHA256
60bc7a5a025701be626526411edf485e25888d918a3e68effb168a0f08c92c84

SHA512
561e7c8c66c6022a7eb80492818b4e604f1c9a8aeb3fb9ef2148d40a345e0822f0ce82245c5b6a506533c69a475dc16ba9dd0f1d9c82c7c5a7ef0f8a45c7b458

Download Submit
C:\Windows\System\geNdGSt.exe

Filesize
1.6MB

MD5
ff0ffcda55a56426e7460b7bcfa98453

SHA1
748da28b419178136bad74096dd34db276051e5f

SHA256
cb6df735aaa7d23bf1b2401fb5a8b820c4e53c0fce5daa1f4016b15def31c24e

SHA512
a1c1bfc6496fe043f4d6df14f4fe97deb5216d714a8f9ceae978c0689ecb3aaf9a644a2f063b69d05322a2c23cea37bcb13a94bcc3eca2f5c5d9eeffa86f15ca

Download Submit
C:\Windows\System\hFbJHJX.exe

Filesize
1.7MB

MD5
b16a6eb65ee7fb2f01420bd31c90b220

SHA1
8d1a962fdc21ce4b16e248ef0955ca27a86a3779

SHA256
59a8aaf12d6fb29b12357c9f89f93180fa03429d57539373638dcac99dd63ab2

SHA512
d2d10d7862ba6829ab40588810b02835f572b641c1666f61863b1e49ed675150bbf6ff40b0fd275499b250265f4ea8f49870a994f0c738c1af67a57c661d6ebc

Download Submit
C:\Windows\System\hPeCiUU.exe

Filesize
1.7MB

MD5
c67fa9996082817babb0af796abd880a

SHA1
79a1823980469911ea6f509ddc096b7fa0bf1289

SHA256
f71f14fe997468cc490adb6581bc89192c6db44787b2738a374b40bb8ca82407

SHA512
e9b4cb5ff7af60c92fefd566e11ecc272aef3ae56e7e2a3a63faa948cf5a25a7f816932817c2b014c41573747c459ca18380f7751cadc1e38652567f41621c86

Download Submit
C:\Windows\System\jcVMQKo.exe

Filesize
1.7MB

MD5
23831550b4100a4a9406897b6f77bdbb

SHA1
66150f1a3f123ad6cd8d5260e4d16edbb98b0e41

SHA256
50b12789522d2956294190d2306bdb4bbfe060e13a2c73b0db72a277f61b4dd8

SHA512
fa265ca7ed5d58009c73e3779f3d3806374ef5e590b7d872fc3553b5bf21d17c3b4bad036ca3ddb6e7c59a483539826d897b1d689d6b58a1b4f20fc22304ba06

Download Submit
C:\Windows\System\ksCriCQ.exe

Filesize
1.7MB

MD5
f080b29b02845caae434cf94d35298e5

SHA1
1d8694965233e44c3da96943cde0297d621a4054

SHA256
a3ee0984c027c086ac067a54e8dd73b591682a2e86e56842267de7a1167d17d7

SHA512
103e4b1b1b6d7bdb5eb12ac718ac14b6c60d6daf0228d6faa0d2ee461503dffbcb89bd014cbdee0fa1975f3ed53633262e394874bd4b04a283f750b768c9b53c

Download Submit
C:\Windows\System\rREGQan.exe

Filesize
1.7MB

MD5
cb0137f3d5e2f354d4b3266cbafa9a0d

SHA1
985b3a4ff8835f3df1552a95cd26c3d060647485

SHA256
cc43689feec17880acae6d487a48670c1e7e0cbe462267248de29c8ca3e45b4f

SHA512
34945b78578579c3865de9a36dc0700bb31abc632574555ea2c4ebfe3348e8ce3629ad64ecf121ccb4061e4c683cc1f321465743ad1f79c1692593088de59cbf

Download Submit
C:\Windows\System\uJsGlKp.exe

Filesize
1.6MB

MD5
0ee101fedf3806ffcb136488fc037dc9

SHA1
633aa15ddc08701ff55addfe834d907032eede56

SHA256
4b3b72c34aa8ae237e8d9faf1e3f7d42e0d1774849304294f9823678242f54e9

SHA512
fbb86707d2d69a37866c727cd23d8f98969398fda174f31bee72bdce2b5ede36835fd033b06f8b0c5b92109f9c2c0cc1cb06210783a6db440a099124f5336074

Download Submit
C:\Windows\System\yrxTlgt.exe

Filesize
1.7MB

MD5
049580e50ddc43d4b19a3a6b9d4ca084

SHA1
0beebfcbe559b6614a068d761cc6acdc7cad5284

SHA256
d919ab0ba1b2d8ac77d20c03388663481a03546281ac6b5cf9c261a5d35fa15a

SHA512
9d14842f1fa0c8608c4fea02a1a76d5f8c6f31c97ac20de3b464fe82fe94df70d027bf50f3e9e016780d027f3c115dbab67c58f6769666d9065fbeef90a3b0b9

Download Submit
memory/4408-0-0x000001640B880000-0x000001640B890000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads