xmrig | 35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
Size

1.1MB
MD5

c259e8495ebf9e44a06086cb9ef8884a
SHA1

007f5597fa970dfa3dfeac4e29d08a54e0775d8b
SHA256

35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7
SHA512

ecb6c2eb18749a3cd6bebd8de55e045f97932c261e86daff11add4e729dd91526ac697c1ac7aca769b5f03f147b5bce3824c8d62b03f89146e266542993d85cc
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPdxXiKcSD6S:GezaTF8FcNkNdfE0pZ9ozttwIRRWi3SV

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b27-4.dat	xmrig
behavioral2/files/0x000b000000023b7d-9.dat	xmrig
behavioral2/files/0x000a000000023b7e-18.dat	xmrig
behavioral2/files/0x000a000000023b80-23.dat	xmrig
behavioral2/files/0x000a000000023b83-38.dat	xmrig
behavioral2/files/0x000a000000023b81-34.dat	xmrig
behavioral2/files/0x000a000000023b8c-86.dat	xmrig
behavioral2/files/0x000a000000023b91-102.dat	xmrig
behavioral2/files/0x000a000000023b93-120.dat	xmrig
behavioral2/files/0x000a000000023b92-118.dat	xmrig
behavioral2/files/0x000a000000023b90-114.dat	xmrig
behavioral2/files/0x000a000000023b8f-112.dat	xmrig
behavioral2/files/0x000a000000023b8e-109.dat	xmrig
behavioral2/files/0x000a000000023b8d-107.dat	xmrig
behavioral2/files/0x000a000000023b8b-99.dat	xmrig
behavioral2/files/0x000a000000023b8a-75.dat	xmrig
behavioral2/files/0x000a000000023b89-73.dat	xmrig
behavioral2/files/0x000a000000023b88-71.dat	xmrig
behavioral2/files/0x000a000000023b87-69.dat	xmrig
behavioral2/files/0x000a000000023b86-65.dat	xmrig
behavioral2/files/0x000a000000023b85-63.dat	xmrig
behavioral2/files/0x000a000000023b84-61.dat	xmrig
behavioral2/files/0x000a000000023b82-51.dat	xmrig
behavioral2/files/0x000a000000023b7f-21.dat	xmrig
behavioral2/files/0x000a000000023b94-126.dat	xmrig
behavioral2/files/0x000a000000023b95-133.dat	xmrig
behavioral2/files/0x000a000000023b99-160.dat	xmrig
behavioral2/files/0x000b000000023b9b-163.dat	xmrig
behavioral2/files/0x000b000000023b9a-162.dat	xmrig
behavioral2/files/0x000b000000023b9c-156.dat	xmrig
behavioral2/files/0x000a000000023b97-152.dat	xmrig
behavioral2/files/0x000a000000023b98-146.dat	xmrig
behavioral2/files/0x000b000000023b7b-138.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5108	DWnwpph.exe
3516	GuRyxuA.exe
3944	rVZgwtr.exe
3988	xDvtOgm.exe
2956	HysYyuO.exe
1768	heqKnPV.exe
4376	jANhveE.exe
1696	nuhQfkP.exe
540	oJzmxCc.exe
1860	HqmjdVd.exe
3436	GTWKEWq.exe
4572	oeISqad.exe
3796	sfatZxy.exe
3992	CyzvVtE.exe
3680	PrLCkYi.exe
4420	kIAcjkJ.exe
920	HjKozRF.exe
1260	dlDUQAc.exe
748	mRyAjnb.exe
4928	povffvN.exe
1968	vMusiAo.exe
4544	WbMZARN.exe
780	HASbGoT.exe
4784	kfnIvZw.exe
3296	icsQPIw.exe
4476	CUHNoxn.exe
4480	wAyvXad.exe
1976	ONUhdzu.exe
2484	qtQkNQH.exe
3160	cvGQeYN.exe
2444	owNMqlN.exe
4516	jHdcTat.exe
2612	tGGbGRm.exe
1056	dFOreaQ.exe
1152	qtrpEzh.exe
4700	KlpsEDE.exe
3560	TeZuTVV.exe
1964	EnPKgTR.exe
4004	wURJoOD.exe
4196	TFIEDwj.exe
2580	kFPlbAd.exe
2104	oLCuLof.exe
2156	nklXHyc.exe
2064	WbsuJOv.exe
1520	zFHwoPX.exe
2392	ZQRLQka.exe
4528	bpPTNQN.exe
4804	aBEqbux.exe
3332	DAglSJd.exe
376	blitGyG.exe
1920	WrwXAPM.exe
3164	JbmIdQD.exe
1396	oVSbGNg.exe
3132	pMpuXuH.exe
1400	uMfDHnt.exe
336	WLNdTtC.exe
3912	mBOJaDO.exe
1324	AWAlxsq.exe
3728	aaqRtfP.exe
2216	bvnbepu.exe
1320	jvuKnal.exe
4996	hQUJczW.exe
4152	eGnIqXv.exe
2568	KLYTGZj.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oxbfknS.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\MAkAqVz.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\nehLZYB.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\KcUKBin.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\bVlvfqu.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\AtRZlRN.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\HBBaOsN.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\MGCMipN.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\NdMDLrJ.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\eHlOzGe.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\djSRjki.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\tAmyuPf.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\CGTFuiN.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\vewfiAF.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\NDTdYOa.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\MihSOPR.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\aoXFKJz.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\LPsVRXo.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\pcTOULT.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\dgIloPu.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\kecHMNf.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\xDvtOgm.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\ZzLkFxS.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\GGFgany.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\IBAnUaB.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\blitGyG.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\UNaviKA.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\QTvVRIq.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\iDCWSRQ.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\ZDoWGGC.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\gEzkrOc.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\YjAWKzG.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\fdsLgBx.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\XfSbWpX.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\fnBQdIr.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\BJWPcRn.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\rdsNKMn.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\EsTCCNE.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\cOTQZBG.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\LODkfxc.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\XTeTUtF.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\WbsuJOv.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\DxwkyXY.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\GtAhtMv.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\AIORYFT.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\TbXlQPg.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\FYsVKiY.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\TFYIwFE.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\dlDUQAc.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\nQpBCmN.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\okjlUmu.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\oUshnLh.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\zEIpEAt.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\fNwOJVD.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\XDswmTO.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\hkwVpiY.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\hikQpGm.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\WrwXAPM.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\MceFJAW.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\CUknraR.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\eGnIqXv.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\AFLqHDU.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\WwaNvim.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
File created	C:\Windows\System\yiFJKDR.exe	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 5108	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	84
PID 5100 wrote to memory of 5108	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	84
PID 5100 wrote to memory of 3516	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	85
PID 5100 wrote to memory of 3516	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	85
PID 5100 wrote to memory of 3944	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	86
PID 5100 wrote to memory of 3944	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	86
PID 5100 wrote to memory of 3988	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	87
PID 5100 wrote to memory of 3988	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	87
PID 5100 wrote to memory of 2956	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	88
PID 5100 wrote to memory of 2956	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	88
PID 5100 wrote to memory of 1768	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	89
PID 5100 wrote to memory of 1768	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	89
PID 5100 wrote to memory of 4376	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	90
PID 5100 wrote to memory of 4376	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	90
PID 5100 wrote to memory of 1696	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	91
PID 5100 wrote to memory of 1696	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	91
PID 5100 wrote to memory of 540	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	92
PID 5100 wrote to memory of 540	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	92
PID 5100 wrote to memory of 1860	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	93
PID 5100 wrote to memory of 1860	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	93
PID 5100 wrote to memory of 3436	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	94
PID 5100 wrote to memory of 3436	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	94
PID 5100 wrote to memory of 4572	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	95
PID 5100 wrote to memory of 4572	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	95
PID 5100 wrote to memory of 3796	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	96
PID 5100 wrote to memory of 3796	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	96
PID 5100 wrote to memory of 3992	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	97
PID 5100 wrote to memory of 3992	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	97
PID 5100 wrote to memory of 3680	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	98
PID 5100 wrote to memory of 3680	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	98
PID 5100 wrote to memory of 4420	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	99
PID 5100 wrote to memory of 4420	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	99
PID 5100 wrote to memory of 920	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	100
PID 5100 wrote to memory of 920	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	100
PID 5100 wrote to memory of 1260	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	101
PID 5100 wrote to memory of 1260	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	101
PID 5100 wrote to memory of 748	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	102
PID 5100 wrote to memory of 748	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	102
PID 5100 wrote to memory of 4928	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	103
PID 5100 wrote to memory of 4928	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	103
PID 5100 wrote to memory of 1968	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	104
PID 5100 wrote to memory of 1968	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	104
PID 5100 wrote to memory of 4544	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	105
PID 5100 wrote to memory of 4544	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	105
PID 5100 wrote to memory of 780	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	106
PID 5100 wrote to memory of 780	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	106
PID 5100 wrote to memory of 4784	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	107
PID 5100 wrote to memory of 4784	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	107
PID 5100 wrote to memory of 3296	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	108
PID 5100 wrote to memory of 3296	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	108
PID 5100 wrote to memory of 4476	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	109
PID 5100 wrote to memory of 4476	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	109
PID 5100 wrote to memory of 4480	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	110
PID 5100 wrote to memory of 4480	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	110
PID 5100 wrote to memory of 1976	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	111
PID 5100 wrote to memory of 1976	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	111
PID 5100 wrote to memory of 2484	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	112
PID 5100 wrote to memory of 2484	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	112
PID 5100 wrote to memory of 3160	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	113
PID 5100 wrote to memory of 3160	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	113
PID 5100 wrote to memory of 2444	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	114
PID 5100 wrote to memory of 2444	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	114
PID 5100 wrote to memory of 4516	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	115
PID 5100 wrote to memory of 4516	5100	35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe	115

C:\Users\Admin\AppData\Local\Temp\35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe
"C:\Users\Admin\AppData\Local\Temp\35a7a4d4125f2f9fc3dc39b4b199ab008173e755c840c8f484a465d83b12cfe7.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\System\DWnwpph.exe
  C:\Windows\System\DWnwpph.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\GuRyxuA.exe
  C:\Windows\System\GuRyxuA.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\rVZgwtr.exe
  C:\Windows\System\rVZgwtr.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\xDvtOgm.exe
  C:\Windows\System\xDvtOgm.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\HysYyuO.exe
  C:\Windows\System\HysYyuO.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\heqKnPV.exe
  C:\Windows\System\heqKnPV.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\jANhveE.exe
  C:\Windows\System\jANhveE.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\nuhQfkP.exe
  C:\Windows\System\nuhQfkP.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\oJzmxCc.exe
  C:\Windows\System\oJzmxCc.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\HqmjdVd.exe
  C:\Windows\System\HqmjdVd.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\GTWKEWq.exe
  C:\Windows\System\GTWKEWq.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\oeISqad.exe
  C:\Windows\System\oeISqad.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\sfatZxy.exe
  C:\Windows\System\sfatZxy.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\CyzvVtE.exe
  C:\Windows\System\CyzvVtE.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\PrLCkYi.exe
  C:\Windows\System\PrLCkYi.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\kIAcjkJ.exe
  C:\Windows\System\kIAcjkJ.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\HjKozRF.exe
  C:\Windows\System\HjKozRF.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\dlDUQAc.exe
  C:\Windows\System\dlDUQAc.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\mRyAjnb.exe
  C:\Windows\System\mRyAjnb.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\povffvN.exe
  C:\Windows\System\povffvN.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\vMusiAo.exe
  C:\Windows\System\vMusiAo.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\WbMZARN.exe
  C:\Windows\System\WbMZARN.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\HASbGoT.exe
  C:\Windows\System\HASbGoT.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\kfnIvZw.exe
  C:\Windows\System\kfnIvZw.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\icsQPIw.exe
  C:\Windows\System\icsQPIw.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\CUHNoxn.exe
  C:\Windows\System\CUHNoxn.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\wAyvXad.exe
  C:\Windows\System\wAyvXad.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\ONUhdzu.exe
  C:\Windows\System\ONUhdzu.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\qtQkNQH.exe
  C:\Windows\System\qtQkNQH.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\cvGQeYN.exe
  C:\Windows\System\cvGQeYN.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\owNMqlN.exe
  C:\Windows\System\owNMqlN.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\jHdcTat.exe
  C:\Windows\System\jHdcTat.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\tGGbGRm.exe
  C:\Windows\System\tGGbGRm.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\dFOreaQ.exe
  C:\Windows\System\dFOreaQ.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\qtrpEzh.exe
  C:\Windows\System\qtrpEzh.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\KlpsEDE.exe
  C:\Windows\System\KlpsEDE.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\TeZuTVV.exe
  C:\Windows\System\TeZuTVV.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\EnPKgTR.exe
  C:\Windows\System\EnPKgTR.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\wURJoOD.exe
  C:\Windows\System\wURJoOD.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\TFIEDwj.exe
  C:\Windows\System\TFIEDwj.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\kFPlbAd.exe
  C:\Windows\System\kFPlbAd.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\oLCuLof.exe
  C:\Windows\System\oLCuLof.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\nklXHyc.exe
  C:\Windows\System\nklXHyc.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\WbsuJOv.exe
  C:\Windows\System\WbsuJOv.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\zFHwoPX.exe
  C:\Windows\System\zFHwoPX.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\ZQRLQka.exe
  C:\Windows\System\ZQRLQka.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\bpPTNQN.exe
  C:\Windows\System\bpPTNQN.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\aBEqbux.exe
  C:\Windows\System\aBEqbux.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\DAglSJd.exe
  C:\Windows\System\DAglSJd.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\blitGyG.exe
  C:\Windows\System\blitGyG.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\WrwXAPM.exe
  C:\Windows\System\WrwXAPM.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\JbmIdQD.exe
  C:\Windows\System\JbmIdQD.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\oVSbGNg.exe
  C:\Windows\System\oVSbGNg.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\pMpuXuH.exe
  C:\Windows\System\pMpuXuH.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\uMfDHnt.exe
  C:\Windows\System\uMfDHnt.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\WLNdTtC.exe
  C:\Windows\System\WLNdTtC.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\mBOJaDO.exe
  C:\Windows\System\mBOJaDO.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\AWAlxsq.exe
  C:\Windows\System\AWAlxsq.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\aaqRtfP.exe
  C:\Windows\System\aaqRtfP.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\bvnbepu.exe
  C:\Windows\System\bvnbepu.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\jvuKnal.exe
  C:\Windows\System\jvuKnal.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\hQUJczW.exe
  C:\Windows\System\hQUJczW.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\KLYTGZj.exe
  C:\Windows\System\KLYTGZj.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\eGnIqXv.exe
  C:\Windows\System\eGnIqXv.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\YsgDQza.exe
  C:\Windows\System\YsgDQza.exe
  2⤵
  PID:2404
- C:\Windows\System\byRZYtI.exe
  C:\Windows\System\byRZYtI.exe
  2⤵
  PID:4924
- C:\Windows\System\gbYwgZc.exe
  C:\Windows\System\gbYwgZc.exe
  2⤵
  PID:4512
- C:\Windows\System\skXPVUJ.exe
  C:\Windows\System\skXPVUJ.exe
  2⤵
  PID:372
- C:\Windows\System\POQgzCP.exe
  C:\Windows\System\POQgzCP.exe
  2⤵
  PID:1584
- C:\Windows\System\RCkCoKm.exe
  C:\Windows\System\RCkCoKm.exe
  2⤵
  PID:1700
- C:\Windows\System\nRwobzC.exe
  C:\Windows\System\nRwobzC.exe
  2⤵
  PID:2904
- C:\Windows\System\HsLYdoW.exe
  C:\Windows\System\HsLYdoW.exe
  2⤵
  PID:3868
- C:\Windows\System\NXMNZoc.exe
  C:\Windows\System\NXMNZoc.exe
  2⤵
  PID:1384
- C:\Windows\System\oXtkDRn.exe
  C:\Windows\System\oXtkDRn.exe
  2⤵
  PID:536
- C:\Windows\System\FGJBPAB.exe
  C:\Windows\System\FGJBPAB.exe
  2⤵
  PID:2072
- C:\Windows\System\iMflyUe.exe
  C:\Windows\System\iMflyUe.exe
  2⤵
  PID:4148
- C:\Windows\System\TkRkfCo.exe
  C:\Windows\System\TkRkfCo.exe
  2⤵
  PID:776
- C:\Windows\System\FNsZmDI.exe
  C:\Windows\System\FNsZmDI.exe
  2⤵
  PID:556
- C:\Windows\System\dGpnCLZ.exe
  C:\Windows\System\dGpnCLZ.exe
  2⤵
  PID:4124
- C:\Windows\System\uObCVAk.exe
  C:\Windows\System\uObCVAk.exe
  2⤵
  PID:3704
- C:\Windows\System\tsLJZNl.exe
  C:\Windows\System\tsLJZNl.exe
  2⤵
  PID:208
- C:\Windows\System\BcCxNES.exe
  C:\Windows\System\BcCxNES.exe
  2⤵
  PID:4520
- C:\Windows\System\dMDQQAM.exe
  C:\Windows\System\dMDQQAM.exe
  2⤵
  PID:4860
- C:\Windows\System\iOesTdZ.exe
  C:\Windows\System\iOesTdZ.exe
  2⤵
  PID:3948
- C:\Windows\System\xOFtEWV.exe
  C:\Windows\System\xOFtEWV.exe
  2⤵
  PID:4156
- C:\Windows\System\faDGXrJ.exe
  C:\Windows\System\faDGXrJ.exe
  2⤵
  PID:2076
- C:\Windows\System\JBcEOJJ.exe
  C:\Windows\System\JBcEOJJ.exe
  2⤵
  PID:1932
- C:\Windows\System\PAguLoR.exe
  C:\Windows\System\PAguLoR.exe
  2⤵
  PID:2972
- C:\Windows\System\NSDOzuZ.exe
  C:\Windows\System\NSDOzuZ.exe
  2⤵
  PID:4132
- C:\Windows\System\cEztlxF.exe
  C:\Windows\System\cEztlxF.exe
  2⤵
  PID:3144
- C:\Windows\System\TQdVMsm.exe
  C:\Windows\System\TQdVMsm.exe
  2⤵
  PID:4940
- C:\Windows\System\WrOCJpI.exe
  C:\Windows\System\WrOCJpI.exe
  2⤵
  PID:724
- C:\Windows\System\ZtSIwcm.exe
  C:\Windows\System\ZtSIwcm.exe
  2⤵
  PID:3708
- C:\Windows\System\ZKldjaF.exe
  C:\Windows\System\ZKldjaF.exe
  2⤵
  PID:4684
- C:\Windows\System\DCjmDLU.exe
  C:\Windows\System\DCjmDLU.exe
  2⤵
  PID:4880
- C:\Windows\System\zTSjttV.exe
  C:\Windows\System\zTSjttV.exe
  2⤵
  PID:3716
- C:\Windows\System\yPeIheL.exe
  C:\Windows\System\yPeIheL.exe
  2⤵
  PID:3032
- C:\Windows\System\aZiYKbF.exe
  C:\Windows\System\aZiYKbF.exe
  2⤵
  PID:2984
- C:\Windows\System\wTzvCUz.exe
  C:\Windows\System\wTzvCUz.exe
  2⤵
  PID:3580
- C:\Windows\System\wBUKDnU.exe
  C:\Windows\System\wBUKDnU.exe
  2⤵
  PID:1756
- C:\Windows\System\sAlWjkh.exe
  C:\Windows\System\sAlWjkh.exe
  2⤵
  PID:1488
- C:\Windows\System\LzNLVDi.exe
  C:\Windows\System\LzNLVDi.exe
  2⤵
  PID:1800
- C:\Windows\System\pnzvqFT.exe
  C:\Windows\System\pnzvqFT.exe
  2⤵
  PID:4496
- C:\Windows\System\XfSbWpX.exe
  C:\Windows\System\XfSbWpX.exe
  2⤵
  PID:3472
- C:\Windows\System\eIurafn.exe
  C:\Windows\System\eIurafn.exe
  2⤵
  PID:4616
- C:\Windows\System\oxbfknS.exe
  C:\Windows\System\oxbfknS.exe
  2⤵
  PID:3972
- C:\Windows\System\HFCnlTy.exe
  C:\Windows\System\HFCnlTy.exe
  2⤵
  PID:1656
- C:\Windows\System\Zytwniz.exe
  C:\Windows\System\Zytwniz.exe
  2⤵
  PID:4416
- C:\Windows\System\iRqofEi.exe
  C:\Windows\System\iRqofEi.exe
  2⤵
  PID:4568
- C:\Windows\System\KFsRzlY.exe
  C:\Windows\System\KFsRzlY.exe
  2⤵
  PID:5148
- C:\Windows\System\JDRZLvx.exe
  C:\Windows\System\JDRZLvx.exe
  2⤵
  PID:5172
- C:\Windows\System\ShxssNA.exe
  C:\Windows\System\ShxssNA.exe
  2⤵
  PID:5196
- C:\Windows\System\YcxnwtJ.exe
  C:\Windows\System\YcxnwtJ.exe
  2⤵
  PID:5224
- C:\Windows\System\XIWIrCu.exe
  C:\Windows\System\XIWIrCu.exe
  2⤵
  PID:5256
- C:\Windows\System\IhOFWVC.exe
  C:\Windows\System\IhOFWVC.exe
  2⤵
  PID:5284
- C:\Windows\System\pzAzhJw.exe
  C:\Windows\System\pzAzhJw.exe
  2⤵
  PID:5308
- C:\Windows\System\AJvpfbZ.exe
  C:\Windows\System\AJvpfbZ.exe
  2⤵
  PID:5344
- C:\Windows\System\xibcrQA.exe
  C:\Windows\System\xibcrQA.exe
  2⤵
  PID:5372
- C:\Windows\System\tFyUwaJ.exe
  C:\Windows\System\tFyUwaJ.exe
  2⤵
  PID:5408
- C:\Windows\System\trmOvGJ.exe
  C:\Windows\System\trmOvGJ.exe
  2⤵
  PID:5436
- C:\Windows\System\CPHWxic.exe
  C:\Windows\System\CPHWxic.exe
  2⤵
  PID:5468
- C:\Windows\System\gceJMcT.exe
  C:\Windows\System\gceJMcT.exe
  2⤵
  PID:5512
- C:\Windows\System\rQXrNcU.exe
  C:\Windows\System\rQXrNcU.exe
  2⤵
  PID:5532
- C:\Windows\System\sCCHQEi.exe
  C:\Windows\System\sCCHQEi.exe
  2⤵
  PID:5560
- C:\Windows\System\eiNxoPW.exe
  C:\Windows\System\eiNxoPW.exe
  2⤵
  PID:5592
- C:\Windows\System\rMgpvPh.exe
  C:\Windows\System\rMgpvPh.exe
  2⤵
  PID:5624
- C:\Windows\System\YXGybLK.exe
  C:\Windows\System\YXGybLK.exe
  2⤵
  PID:5648
- C:\Windows\System\VAiTUYK.exe
  C:\Windows\System\VAiTUYK.exe
  2⤵
  PID:5676
- C:\Windows\System\HUchHEX.exe
  C:\Windows\System\HUchHEX.exe
  2⤵
  PID:5712
- C:\Windows\System\PmtQtbY.exe
  C:\Windows\System\PmtQtbY.exe
  2⤵
  PID:5740
- C:\Windows\System\iYBsHqw.exe
  C:\Windows\System\iYBsHqw.exe
  2⤵
  PID:5764
- C:\Windows\System\UPmnEMB.exe
  C:\Windows\System\UPmnEMB.exe
  2⤵
  PID:5796
- C:\Windows\System\ueaUGvv.exe
  C:\Windows\System\ueaUGvv.exe
  2⤵
  PID:5832
- C:\Windows\System\wAdoAJx.exe
  C:\Windows\System\wAdoAJx.exe
  2⤵
  PID:5860
- C:\Windows\System\ytzKuMp.exe
  C:\Windows\System\ytzKuMp.exe
  2⤵
  PID:5884
- C:\Windows\System\LdGxBGs.exe
  C:\Windows\System\LdGxBGs.exe
  2⤵
  PID:5912
- C:\Windows\System\orgqFxV.exe
  C:\Windows\System\orgqFxV.exe
  2⤵
  PID:5936
- C:\Windows\System\yiFJKDR.exe
  C:\Windows\System\yiFJKDR.exe
  2⤵
  PID:5976
- C:\Windows\System\bFwtYvf.exe
  C:\Windows\System\bFwtYvf.exe
  2⤵
  PID:6004
- C:\Windows\System\bMaqyth.exe
  C:\Windows\System\bMaqyth.exe
  2⤵
  PID:6032
- C:\Windows\System\bcVmTNt.exe
  C:\Windows\System\bcVmTNt.exe
  2⤵
  PID:6052
- C:\Windows\System\TXMyHFU.exe
  C:\Windows\System\TXMyHFU.exe
  2⤵
  PID:6068
- C:\Windows\System\eHGuhiN.exe
  C:\Windows\System\eHGuhiN.exe
  2⤵
  PID:6084
- C:\Windows\System\ZzLkFxS.exe
  C:\Windows\System\ZzLkFxS.exe
  2⤵
  PID:6120
- C:\Windows\System\NTMEHNq.exe
  C:\Windows\System\NTMEHNq.exe
  2⤵
  PID:6136
- C:\Windows\System\IjyKocI.exe
  C:\Windows\System\IjyKocI.exe
  2⤵
  PID:1708
- C:\Windows\System\EKVRmvI.exe
  C:\Windows\System\EKVRmvI.exe
  2⤵
  PID:5180
- C:\Windows\System\iZIYTNO.exe
  C:\Windows\System\iZIYTNO.exe
  2⤵
  PID:5192
- C:\Windows\System\eHlOzGe.exe
  C:\Windows\System\eHlOzGe.exe
  2⤵
  PID:5280
- C:\Windows\System\OaRSnNP.exe
  C:\Windows\System\OaRSnNP.exe
  2⤵
  PID:5356
- C:\Windows\System\dIJVRmk.exe
  C:\Windows\System\dIJVRmk.exe
  2⤵
  PID:5520
- C:\Windows\System\KYSacVl.exe
  C:\Windows\System\KYSacVl.exe
  2⤵
  PID:5552
- C:\Windows\System\GhKaXzS.exe
  C:\Windows\System\GhKaXzS.exe
  2⤵
  PID:5608
- C:\Windows\System\eULNDAZ.exe
  C:\Windows\System\eULNDAZ.exe
  2⤵
  PID:5636
- C:\Windows\System\leJcYYT.exe
  C:\Windows\System\leJcYYT.exe
  2⤵
  PID:5696
- C:\Windows\System\vnuWleT.exe
  C:\Windows\System\vnuWleT.exe
  2⤵
  PID:5724
- C:\Windows\System\nQpBCmN.exe
  C:\Windows\System\nQpBCmN.exe
  2⤵
  PID:5756
- C:\Windows\System\MSvIQly.exe
  C:\Windows\System\MSvIQly.exe
  2⤵
  PID:5792
- C:\Windows\System\sKdLxMD.exe
  C:\Windows\System\sKdLxMD.exe
  2⤵
  PID:5868
- C:\Windows\System\oeoPeRY.exe
  C:\Windows\System\oeoPeRY.exe
  2⤵
  PID:5896
- C:\Windows\System\kaqLwzx.exe
  C:\Windows\System\kaqLwzx.exe
  2⤵
  PID:5948
- C:\Windows\System\fZvuxdu.exe
  C:\Windows\System\fZvuxdu.exe
  2⤵
  PID:6020
- C:\Windows\System\ukJCSuZ.exe
  C:\Windows\System\ukJCSuZ.exe
  2⤵
  PID:6080
- C:\Windows\System\YebcLvw.exe
  C:\Windows\System\YebcLvw.exe
  2⤵
  PID:6104
- C:\Windows\System\athbpEM.exe
  C:\Windows\System\athbpEM.exe
  2⤵
  PID:1956
- C:\Windows\System\AYRGGeV.exe
  C:\Windows\System\AYRGGeV.exe
  2⤵
  PID:5244
- C:\Windows\System\RPfMvDY.exe
  C:\Windows\System\RPfMvDY.exe
  2⤵
  PID:5380
- C:\Windows\System\bMBPPrz.exe
  C:\Windows\System\bMBPPrz.exe
  2⤵
  PID:1556
- C:\Windows\System\zFgvoWf.exe
  C:\Windows\System\zFgvoWf.exe
  2⤵
  PID:5732
- C:\Windows\System\sXmVnvf.exe
  C:\Windows\System\sXmVnvf.exe
  2⤵
  PID:5928
- C:\Windows\System\wWUruNY.exe
  C:\Windows\System\wWUruNY.exe
  2⤵
  PID:5996
- C:\Windows\System\PbWMRhA.exe
  C:\Windows\System\PbWMRhA.exe
  2⤵
  PID:6128
- C:\Windows\System\KtWywkR.exe
  C:\Windows\System\KtWywkR.exe
  2⤵
  PID:5492
- C:\Windows\System\MjmliZY.exe
  C:\Windows\System\MjmliZY.exe
  2⤵
  PID:6152
- C:\Windows\System\gPtyyZK.exe
  C:\Windows\System\gPtyyZK.exe
  2⤵
  PID:6180
- C:\Windows\System\HcrzjFm.exe
  C:\Windows\System\HcrzjFm.exe
  2⤵
  PID:6200
- C:\Windows\System\vRmcCFq.exe
  C:\Windows\System\vRmcCFq.exe
  2⤵
  PID:6220
- C:\Windows\System\KCOEnns.exe
  C:\Windows\System\KCOEnns.exe
  2⤵
  PID:6252
- C:\Windows\System\DjwglZk.exe
  C:\Windows\System\DjwglZk.exe
  2⤵
  PID:6276
- C:\Windows\System\cdOkdeV.exe
  C:\Windows\System\cdOkdeV.exe
  2⤵
  PID:6300
- C:\Windows\System\ksKXRld.exe
  C:\Windows\System\ksKXRld.exe
  2⤵
  PID:6324
- C:\Windows\System\TVtuXWq.exe
  C:\Windows\System\TVtuXWq.exe
  2⤵
  PID:6348
- C:\Windows\System\GFgPtQz.exe
  C:\Windows\System\GFgPtQz.exe
  2⤵
  PID:6384
- C:\Windows\System\QMZnqoW.exe
  C:\Windows\System\QMZnqoW.exe
  2⤵
  PID:6412
- C:\Windows\System\AUfpvhE.exe
  C:\Windows\System\AUfpvhE.exe
  2⤵
  PID:6432
- C:\Windows\System\MpVaSFL.exe
  C:\Windows\System\MpVaSFL.exe
  2⤵
  PID:6468
- C:\Windows\System\nYaLgTA.exe
  C:\Windows\System\nYaLgTA.exe
  2⤵
  PID:6488
- C:\Windows\System\TiAKyfY.exe
  C:\Windows\System\TiAKyfY.exe
  2⤵
  PID:6516
- C:\Windows\System\UtNEKmn.exe
  C:\Windows\System\UtNEKmn.exe
  2⤵
  PID:6548
- C:\Windows\System\DxwkyXY.exe
  C:\Windows\System\DxwkyXY.exe
  2⤵
  PID:6568
- C:\Windows\System\gacJFwH.exe
  C:\Windows\System\gacJFwH.exe
  2⤵
  PID:6596
- C:\Windows\System\ABjvDvZ.exe
  C:\Windows\System\ABjvDvZ.exe
  2⤵
  PID:6624
- C:\Windows\System\VyQJfsO.exe
  C:\Windows\System\VyQJfsO.exe
  2⤵
  PID:6648
- C:\Windows\System\cFvotKy.exe
  C:\Windows\System\cFvotKy.exe
  2⤵
  PID:6680
- C:\Windows\System\UZjNJdD.exe
  C:\Windows\System\UZjNJdD.exe
  2⤵
  PID:6704
- C:\Windows\System\nDspfrS.exe
  C:\Windows\System\nDspfrS.exe
  2⤵
  PID:6728
- C:\Windows\System\yNeKDWS.exe
  C:\Windows\System\yNeKDWS.exe
  2⤵
  PID:6748
- C:\Windows\System\dUlRlUI.exe
  C:\Windows\System\dUlRlUI.exe
  2⤵
  PID:6780
- C:\Windows\System\qZBeREF.exe
  C:\Windows\System\qZBeREF.exe
  2⤵
  PID:6808
- C:\Windows\System\jDVDPBh.exe
  C:\Windows\System\jDVDPBh.exe
  2⤵
  PID:6832
- C:\Windows\System\iRwiKqz.exe
  C:\Windows\System\iRwiKqz.exe
  2⤵
  PID:6852
- C:\Windows\System\MiWDkvD.exe
  C:\Windows\System\MiWDkvD.exe
  2⤵
  PID:6876
- C:\Windows\System\aYddvEY.exe
  C:\Windows\System\aYddvEY.exe
  2⤵
  PID:6896
- C:\Windows\System\BKsuyup.exe
  C:\Windows\System\BKsuyup.exe
  2⤵
  PID:6924
- C:\Windows\System\ecOyJhh.exe
  C:\Windows\System\ecOyJhh.exe
  2⤵
  PID:6944
- C:\Windows\System\KRsxFbu.exe
  C:\Windows\System\KRsxFbu.exe
  2⤵
  PID:6972
- C:\Windows\System\IGSwDET.exe
  C:\Windows\System\IGSwDET.exe
  2⤵
  PID:6996
- C:\Windows\System\UUzsDhj.exe
  C:\Windows\System\UUzsDhj.exe
  2⤵
  PID:7020
- C:\Windows\System\rDpWBpX.exe
  C:\Windows\System\rDpWBpX.exe
  2⤵
  PID:7048
- C:\Windows\System\wBbtNnQ.exe
  C:\Windows\System\wBbtNnQ.exe
  2⤵
  PID:7080
- C:\Windows\System\jkkCHgO.exe
  C:\Windows\System\jkkCHgO.exe
  2⤵
  PID:7100
- C:\Windows\System\TCVGIix.exe
  C:\Windows\System\TCVGIix.exe
  2⤵
  PID:7120
- C:\Windows\System\MceFJAW.exe
  C:\Windows\System\MceFJAW.exe
  2⤵
  PID:7148
- C:\Windows\System\zoioDHG.exe
  C:\Windows\System\zoioDHG.exe
  2⤵
  PID:5788
- C:\Windows\System\joEstSJ.exe
  C:\Windows\System\joEstSJ.exe
  2⤵
  PID:5748
- C:\Windows\System\pdVmgow.exe
  C:\Windows\System\pdVmgow.exe
  2⤵
  PID:6216
- C:\Windows\System\RefAwUE.exe
  C:\Windows\System\RefAwUE.exe
  2⤵
  PID:6236
- C:\Windows\System\APVKkDZ.exe
  C:\Windows\System\APVKkDZ.exe
  2⤵
  PID:6212
- C:\Windows\System\kJuIeGv.exe
  C:\Windows\System\kJuIeGv.exe
  2⤵
  PID:6320
- C:\Windows\System\UYCopTz.exe
  C:\Windows\System\UYCopTz.exe
  2⤵
  PID:6376
- C:\Windows\System\KOdjeuL.exe
  C:\Windows\System\KOdjeuL.exe
  2⤵
  PID:6448
- C:\Windows\System\tsAnBec.exe
  C:\Windows\System\tsAnBec.exe
  2⤵
  PID:6500
- C:\Windows\System\TXuzHiU.exe
  C:\Windows\System\TXuzHiU.exe
  2⤵
  PID:6528
- C:\Windows\System\plvnQby.exe
  C:\Windows\System\plvnQby.exe
  2⤵
  PID:6524
- C:\Windows\System\pjZgLgU.exe
  C:\Windows\System\pjZgLgU.exe
  2⤵
  PID:6536
- C:\Windows\System\zgOkxxG.exe
  C:\Windows\System\zgOkxxG.exe
  2⤵
  PID:6712
- C:\Windows\System\okjlUmu.exe
  C:\Windows\System\okjlUmu.exe
  2⤵
  PID:6616
- C:\Windows\System\qCBQyOy.exe
  C:\Windows\System\qCBQyOy.exe
  2⤵
  PID:6936
- C:\Windows\System\wSvYdyr.exe
  C:\Windows\System\wSvYdyr.exe
  2⤵
  PID:7044
- C:\Windows\System\IaNAXgC.exe
  C:\Windows\System\IaNAXgC.exe
  2⤵
  PID:6864
- C:\Windows\System\ywfMxtT.exe
  C:\Windows\System\ywfMxtT.exe
  2⤵
  PID:6908
- C:\Windows\System\fZirmgy.exe
  C:\Windows\System\fZirmgy.exe
  2⤵
  PID:6988
- C:\Windows\System\yzFrfdb.exe
  C:\Windows\System\yzFrfdb.exe
  2⤵
  PID:7016
- C:\Windows\System\sMhHYaw.exe
  C:\Windows\System\sMhHYaw.exe
  2⤵
  PID:6480
- C:\Windows\System\pCXQYJR.exe
  C:\Windows\System\pCXQYJR.exe
  2⤵
  PID:7132
- C:\Windows\System\GOhLDAr.exe
  C:\Windows\System\GOhLDAr.exe
  2⤵
  PID:5708
- C:\Windows\System\dlUDDNy.exe
  C:\Windows\System\dlUDDNy.exe
  2⤵
  PID:6012
- C:\Windows\System\ZKzUCZw.exe
  C:\Windows\System\ZKzUCZw.exe
  2⤵
  PID:6868
- C:\Windows\System\mwtJtvs.exe
  C:\Windows\System\mwtJtvs.exe
  2⤵
  PID:7180
- C:\Windows\System\ADPWYcT.exe
  C:\Windows\System\ADPWYcT.exe
  2⤵
  PID:7208
- C:\Windows\System\YodDdEd.exe
  C:\Windows\System\YodDdEd.exe
  2⤵
  PID:7236
- C:\Windows\System\GwUAOrG.exe
  C:\Windows\System\GwUAOrG.exe
  2⤵
  PID:7260
- C:\Windows\System\edEsvfI.exe
  C:\Windows\System\edEsvfI.exe
  2⤵
  PID:7288
- C:\Windows\System\UNaviKA.exe
  C:\Windows\System\UNaviKA.exe
  2⤵
  PID:7308
- C:\Windows\System\YDiNmyc.exe
  C:\Windows\System\YDiNmyc.exe
  2⤵
  PID:7336
- C:\Windows\System\XiJxDgm.exe
  C:\Windows\System\XiJxDgm.exe
  2⤵
  PID:7356
- C:\Windows\System\xGOeTue.exe
  C:\Windows\System\xGOeTue.exe
  2⤵
  PID:7376
- C:\Windows\System\PTYaKzP.exe
  C:\Windows\System\PTYaKzP.exe
  2⤵
  PID:7404
- C:\Windows\System\YSunanh.exe
  C:\Windows\System\YSunanh.exe
  2⤵
  PID:7476
- C:\Windows\System\AmBTpQb.exe
  C:\Windows\System\AmBTpQb.exe
  2⤵
  PID:7500
- C:\Windows\System\oddLRPE.exe
  C:\Windows\System\oddLRPE.exe
  2⤵
  PID:7524
- C:\Windows\System\AkVUcKG.exe
  C:\Windows\System\AkVUcKG.exe
  2⤵
  PID:7548
- C:\Windows\System\joKUbuq.exe
  C:\Windows\System\joKUbuq.exe
  2⤵
  PID:7568
- C:\Windows\System\ZoLBZnV.exe
  C:\Windows\System\ZoLBZnV.exe
  2⤵
  PID:7592
- C:\Windows\System\migeHJA.exe
  C:\Windows\System\migeHJA.exe
  2⤵
  PID:7624
- C:\Windows\System\DZAMlMT.exe
  C:\Windows\System\DZAMlMT.exe
  2⤵
  PID:7644
- C:\Windows\System\hBaAStd.exe
  C:\Windows\System\hBaAStd.exe
  2⤵
  PID:7660
- C:\Windows\System\RMGteeQ.exe
  C:\Windows\System\RMGteeQ.exe
  2⤵
  PID:7688
- C:\Windows\System\OCKLUKF.exe
  C:\Windows\System\OCKLUKF.exe
  2⤵
  PID:7720
- C:\Windows\System\RZVrnzw.exe
  C:\Windows\System\RZVrnzw.exe
  2⤵
  PID:7756
- C:\Windows\System\mkmfKPY.exe
  C:\Windows\System\mkmfKPY.exe
  2⤵
  PID:7780
- C:\Windows\System\vepUqat.exe
  C:\Windows\System\vepUqat.exe
  2⤵
  PID:7816
- C:\Windows\System\VAPhlgK.exe
  C:\Windows\System\VAPhlgK.exe
  2⤵
  PID:7840
- C:\Windows\System\TDHirOx.exe
  C:\Windows\System\TDHirOx.exe
  2⤵
  PID:7864
- C:\Windows\System\ewCxSei.exe
  C:\Windows\System\ewCxSei.exe
  2⤵
  PID:7888
- C:\Windows\System\GtAhtMv.exe
  C:\Windows\System\GtAhtMv.exe
  2⤵
  PID:7908
- C:\Windows\System\tqnqUDl.exe
  C:\Windows\System\tqnqUDl.exe
  2⤵
  PID:7936
- C:\Windows\System\GGFgany.exe
  C:\Windows\System\GGFgany.exe
  2⤵
  PID:7968
- C:\Windows\System\ekUihPM.exe
  C:\Windows\System\ekUihPM.exe
  2⤵
  PID:7988
- C:\Windows\System\cyyrGdh.exe
  C:\Windows\System\cyyrGdh.exe
  2⤵
  PID:8020
- C:\Windows\System\ROaMSSh.exe
  C:\Windows\System\ROaMSSh.exe
  2⤵
  PID:8044
- C:\Windows\System\TsBfXyo.exe
  C:\Windows\System\TsBfXyo.exe
  2⤵
  PID:8072
- C:\Windows\System\vdcfQcn.exe
  C:\Windows\System\vdcfQcn.exe
  2⤵
  PID:8088
- C:\Windows\System\APZPEff.exe
  C:\Windows\System\APZPEff.exe
  2⤵
  PID:8120
- C:\Windows\System\uhUQieo.exe
  C:\Windows\System\uhUQieo.exe
  2⤵
  PID:8136
- C:\Windows\System\ToFbYeo.exe
  C:\Windows\System\ToFbYeo.exe
  2⤵
  PID:8156
- C:\Windows\System\WtZQBjB.exe
  C:\Windows\System\WtZQBjB.exe
  2⤵
  PID:8184
- C:\Windows\System\qMqpDkG.exe
  C:\Windows\System\qMqpDkG.exe
  2⤵
  PID:6292
- C:\Windows\System\QerlwFi.exe
  C:\Windows\System\QerlwFi.exe
  2⤵
  PID:5232
- C:\Windows\System\YcCmpdW.exe
  C:\Windows\System\YcCmpdW.exe
  2⤵
  PID:7076
- C:\Windows\System\StLWZML.exe
  C:\Windows\System\StLWZML.exe
  2⤵
  PID:7116
- C:\Windows\System\WevIudA.exe
  C:\Windows\System\WevIudA.exe
  2⤵
  PID:6244
- C:\Windows\System\vHooJJm.exe
  C:\Windows\System\vHooJJm.exe
  2⤵
  PID:7332
- C:\Windows\System\KjZyhIV.exe
  C:\Windows\System\KjZyhIV.exe
  2⤵
  PID:6892
- C:\Windows\System\gJiBTPc.exe
  C:\Windows\System\gJiBTPc.exe
  2⤵
  PID:7232
- C:\Windows\System\AQozucj.exe
  C:\Windows\System\AQozucj.exe
  2⤵
  PID:7316
- C:\Windows\System\sKyFNzu.exe
  C:\Windows\System\sKyFNzu.exe
  2⤵
  PID:7560
- C:\Windows\System\GXPsFuv.exe
  C:\Windows\System\GXPsFuv.exe
  2⤵
  PID:7296
- C:\Windows\System\kxHpLEJ.exe
  C:\Windows\System\kxHpLEJ.exe
  2⤵
  PID:7728
- C:\Windows\System\ASZPMCO.exe
  C:\Windows\System\ASZPMCO.exe
  2⤵
  PID:7776
- C:\Windows\System\WRCKIoR.exe
  C:\Windows\System\WRCKIoR.exe
  2⤵
  PID:7580
- C:\Windows\System\XbeWlVE.exe
  C:\Windows\System\XbeWlVE.exe
  2⤵
  PID:7608
- C:\Windows\System\WiKaLuZ.exe
  C:\Windows\System\WiKaLuZ.exe
  2⤵
  PID:7680
- C:\Windows\System\KqARwCH.exe
  C:\Windows\System\KqARwCH.exe
  2⤵
  PID:7508
- C:\Windows\System\WYByWbj.exe
  C:\Windows\System\WYByWbj.exe
  2⤵
  PID:7564
- C:\Windows\System\LODkfxc.exe
  C:\Windows\System\LODkfxc.exe
  2⤵
  PID:7848
- C:\Windows\System\aPFkhfB.exe
  C:\Windows\System\aPFkhfB.exe
  2⤵
  PID:7768
- C:\Windows\System\gRqCbtw.exe
  C:\Windows\System\gRqCbtw.exe
  2⤵
  PID:8032
- C:\Windows\System\WOYxQOh.exe
  C:\Windows\System\WOYxQOh.exe
  2⤵
  PID:6840
- C:\Windows\System\EqcBGnO.exe
  C:\Windows\System\EqcBGnO.exe
  2⤵
  PID:7884
- C:\Windows\System\pcTOULT.exe
  C:\Windows\System\pcTOULT.exe
  2⤵
  PID:7704
- C:\Windows\System\QTvVRIq.exe
  C:\Windows\System\QTvVRIq.exe
  2⤵
  PID:7496
- C:\Windows\System\tIATcJf.exe
  C:\Windows\System\tIATcJf.exe
  2⤵
  PID:7244
- C:\Windows\System\hhvycnD.exe
  C:\Windows\System\hhvycnD.exe
  2⤵
  PID:8112
- C:\Windows\System\kBMxfzQ.exe
  C:\Windows\System\kBMxfzQ.exe
  2⤵
  PID:8096
- C:\Windows\System\ypXaKrH.exe
  C:\Windows\System\ypXaKrH.exe
  2⤵
  PID:8208
- C:\Windows\System\JqEYnCA.exe
  C:\Windows\System\JqEYnCA.exe
  2⤵
  PID:8236
- C:\Windows\System\PuOeyKs.exe
  C:\Windows\System\PuOeyKs.exe
  2⤵
  PID:8260
- C:\Windows\System\gVLkVQD.exe
  C:\Windows\System\gVLkVQD.exe
  2⤵
  PID:8288
- C:\Windows\System\qNhoHxm.exe
  C:\Windows\System\qNhoHxm.exe
  2⤵
  PID:8304
- C:\Windows\System\msCvQMG.exe
  C:\Windows\System\msCvQMG.exe
  2⤵
  PID:8332
- C:\Windows\System\fnBQdIr.exe
  C:\Windows\System\fnBQdIr.exe
  2⤵
  PID:8352
- C:\Windows\System\vZEEBeb.exe
  C:\Windows\System\vZEEBeb.exe
  2⤵
  PID:8376
- C:\Windows\System\djSRjki.exe
  C:\Windows\System\djSRjki.exe
  2⤵
  PID:8400
- C:\Windows\System\BJWPcRn.exe
  C:\Windows\System\BJWPcRn.exe
  2⤵
  PID:8428
- C:\Windows\System\YodZiNa.exe
  C:\Windows\System\YodZiNa.exe
  2⤵
  PID:8456
- C:\Windows\System\GCIRyYJ.exe
  C:\Windows\System\GCIRyYJ.exe
  2⤵
  PID:8488
- C:\Windows\System\BQEJNar.exe
  C:\Windows\System\BQEJNar.exe
  2⤵
  PID:8508
- C:\Windows\System\OvMlJaS.exe
  C:\Windows\System\OvMlJaS.exe
  2⤵
  PID:8524
- C:\Windows\System\eCzVJKE.exe
  C:\Windows\System\eCzVJKE.exe
  2⤵
  PID:8544
- C:\Windows\System\jeguVRy.exe
  C:\Windows\System\jeguVRy.exe
  2⤵
  PID:8568
- C:\Windows\System\iDCWSRQ.exe
  C:\Windows\System\iDCWSRQ.exe
  2⤵
  PID:8600
- C:\Windows\System\EKuNFMD.exe
  C:\Windows\System\EKuNFMD.exe
  2⤵
  PID:8616
- C:\Windows\System\EFKHSdb.exe
  C:\Windows\System\EFKHSdb.exe
  2⤵
  PID:8644
- C:\Windows\System\WKjOECB.exe
  C:\Windows\System\WKjOECB.exe
  2⤵
  PID:8664
- C:\Windows\System\wZzmIMP.exe
  C:\Windows\System\wZzmIMP.exe
  2⤵
  PID:8696
- C:\Windows\System\KYnfpfY.exe
  C:\Windows\System\KYnfpfY.exe
  2⤵
  PID:8724
- C:\Windows\System\AcRFxxd.exe
  C:\Windows\System\AcRFxxd.exe
  2⤵
  PID:8756
- C:\Windows\System\ctQibPb.exe
  C:\Windows\System\ctQibPb.exe
  2⤵
  PID:8776
- C:\Windows\System\xIwcPLG.exe
  C:\Windows\System\xIwcPLG.exe
  2⤵
  PID:8800
- C:\Windows\System\YAyQAnI.exe
  C:\Windows\System\YAyQAnI.exe
  2⤵
  PID:8820
- C:\Windows\System\JLFBeQE.exe
  C:\Windows\System\JLFBeQE.exe
  2⤵
  PID:8844
- C:\Windows\System\SHQrkuf.exe
  C:\Windows\System\SHQrkuf.exe
  2⤵
  PID:8864
- C:\Windows\System\EQMErep.exe
  C:\Windows\System\EQMErep.exe
  2⤵
  PID:8888
- C:\Windows\System\ssIAlQN.exe
  C:\Windows\System\ssIAlQN.exe
  2⤵
  PID:8916
- C:\Windows\System\SFMMtYA.exe
  C:\Windows\System\SFMMtYA.exe
  2⤵
  PID:8940
- C:\Windows\System\tAmyuPf.exe
  C:\Windows\System\tAmyuPf.exe
  2⤵
  PID:8968
- C:\Windows\System\wwJvWMK.exe
  C:\Windows\System\wwJvWMK.exe
  2⤵
  PID:8988
- C:\Windows\System\lChzTae.exe
  C:\Windows\System\lChzTae.exe
  2⤵
  PID:9008
- C:\Windows\System\hgBbBVx.exe
  C:\Windows\System\hgBbBVx.exe
  2⤵
  PID:9036
- C:\Windows\System\UVFjOcb.exe
  C:\Windows\System\UVFjOcb.exe
  2⤵
  PID:9064
- C:\Windows\System\DxBBTBn.exe
  C:\Windows\System\DxBBTBn.exe
  2⤵
  PID:9104
- C:\Windows\System\mRtGsht.exe
  C:\Windows\System\mRtGsht.exe
  2⤵
  PID:9128
- C:\Windows\System\HMTERDE.exe
  C:\Windows\System\HMTERDE.exe
  2⤵
  PID:9144
- C:\Windows\System\ydXZSEA.exe
  C:\Windows\System\ydXZSEA.exe
  2⤵
  PID:9168
- C:\Windows\System\YNDePAT.exe
  C:\Windows\System\YNDePAT.exe
  2⤵
  PID:9184
- C:\Windows\System\ihrNrxx.exe
  C:\Windows\System\ihrNrxx.exe
  2⤵
  PID:9200
- C:\Windows\System\qoTduBv.exe
  C:\Windows\System\qoTduBv.exe
  2⤵
  PID:7392
- C:\Windows\System\HrVoHuM.exe
  C:\Windows\System\HrVoHuM.exe
  2⤵
  PID:8016
- C:\Windows\System\RBQjwxU.exe
  C:\Windows\System\RBQjwxU.exe
  2⤵
  PID:8060
- C:\Windows\System\YaeefPV.exe
  C:\Windows\System\YaeefPV.exe
  2⤵
  PID:8172
- C:\Windows\System\TRsmQjo.exe
  C:\Windows\System\TRsmQjo.exe
  2⤵
  PID:7432
- C:\Windows\System\NtIcaDW.exe
  C:\Windows\System\NtIcaDW.exe
  2⤵
  PID:8056
- C:\Windows\System\tpeqVJc.exe
  C:\Windows\System\tpeqVJc.exe
  2⤵
  PID:7584
- C:\Windows\System\AFLqHDU.exe
  C:\Windows\System\AFLqHDU.exe
  2⤵
  PID:6584
- C:\Windows\System\tVuQpUw.exe
  C:\Windows\System\tVuQpUw.exe
  2⤵
  PID:8132
- C:\Windows\System\YnadQji.exe
  C:\Windows\System\YnadQji.exe
  2⤵
  PID:7636
- C:\Windows\System\mcusZMp.exe
  C:\Windows\System\mcusZMp.exe
  2⤵
  PID:8396
- C:\Windows\System\ohDLIsz.exe
  C:\Windows\System\ohDLIsz.exe
  2⤵
  PID:8440
- C:\Windows\System\EiOhqBN.exe
  C:\Windows\System\EiOhqBN.exe
  2⤵
  PID:8480
- C:\Windows\System\FBMlcdE.exe
  C:\Windows\System\FBMlcdE.exe
  2⤵
  PID:8576
- C:\Windows\System\QhQpYzf.exe
  C:\Windows\System\QhQpYzf.exe
  2⤵
  PID:9020
- C:\Windows\System\zStTniQ.exe
  C:\Windows\System\zStTniQ.exe
  2⤵
  PID:9116
- C:\Windows\System\AIORYFT.exe
  C:\Windows\System\AIORYFT.exe
  2⤵
  PID:9140
- C:\Windows\System\trXpETv.exe
  C:\Windows\System\trXpETv.exe
  2⤵
  PID:8496
- C:\Windows\System\pCORRbQ.exe
  C:\Windows\System\pCORRbQ.exe
  2⤵
  PID:8936
- C:\Windows\System\jwqfzPL.exe
  C:\Windows\System\jwqfzPL.exe
  2⤵
  PID:7832
- C:\Windows\System\uLxfthm.exe
  C:\Windows\System\uLxfthm.exe
  2⤵
  PID:9248
- C:\Windows\System\ZTmqCaJ.exe
  C:\Windows\System\ZTmqCaJ.exe
  2⤵
  PID:9276
- C:\Windows\System\SnLnsCv.exe
  C:\Windows\System\SnLnsCv.exe
  2⤵
  PID:9312
- C:\Windows\System\VnuBJCy.exe
  C:\Windows\System\VnuBJCy.exe
  2⤵
  PID:9328
- C:\Windows\System\gpFDjtF.exe
  C:\Windows\System\gpFDjtF.exe
  2⤵
  PID:9352
- C:\Windows\System\YXJQezg.exe
  C:\Windows\System\YXJQezg.exe
  2⤵
  PID:9384
- C:\Windows\System\eRkNMhw.exe
  C:\Windows\System\eRkNMhw.exe
  2⤵
  PID:9420
- C:\Windows\System\eVOKWtj.exe
  C:\Windows\System\eVOKWtj.exe
  2⤵
  PID:9444
- C:\Windows\System\eGHgKTl.exe
  C:\Windows\System\eGHgKTl.exe
  2⤵
  PID:9472
- C:\Windows\System\raFTEfm.exe
  C:\Windows\System\raFTEfm.exe
  2⤵
  PID:9496
- C:\Windows\System\ZzVgHWj.exe
  C:\Windows\System\ZzVgHWj.exe
  2⤵
  PID:9520
- C:\Windows\System\WsoMlxl.exe
  C:\Windows\System\WsoMlxl.exe
  2⤵
  PID:9548
- C:\Windows\System\heFwRbP.exe
  C:\Windows\System\heFwRbP.exe
  2⤵
  PID:9576
- C:\Windows\System\xUXmzYy.exe
  C:\Windows\System\xUXmzYy.exe
  2⤵
  PID:9592
- C:\Windows\System\QXFAMBy.exe
  C:\Windows\System\QXFAMBy.exe
  2⤵
  PID:9616
- C:\Windows\System\dfvvHyK.exe
  C:\Windows\System\dfvvHyK.exe
  2⤵
  PID:9636
- C:\Windows\System\xmjTqKw.exe
  C:\Windows\System\xmjTqKw.exe
  2⤵
  PID:9652
- C:\Windows\System\XlFWJAY.exe
  C:\Windows\System\XlFWJAY.exe
  2⤵
  PID:9668
- C:\Windows\System\TFYIwFE.exe
  C:\Windows\System\TFYIwFE.exe
  2⤵
  PID:9704
- C:\Windows\System\KWXYxsz.exe
  C:\Windows\System\KWXYxsz.exe
  2⤵
  PID:9728
- C:\Windows\System\FOhBSAY.exe
  C:\Windows\System\FOhBSAY.exe
  2⤵
  PID:9752
- C:\Windows\System\WwaNvim.exe
  C:\Windows\System\WwaNvim.exe
  2⤵
  PID:9780
- C:\Windows\System\LltvdGi.exe
  C:\Windows\System\LltvdGi.exe
  2⤵
  PID:9808
- C:\Windows\System\tKGHQiM.exe
  C:\Windows\System\tKGHQiM.exe
  2⤵
  PID:9828
- C:\Windows\System\MAkAqVz.exe
  C:\Windows\System\MAkAqVz.exe
  2⤵
  PID:9856
- C:\Windows\System\oQZeQWE.exe
  C:\Windows\System\oQZeQWE.exe
  2⤵
  PID:9880
- C:\Windows\System\HyoMDDp.exe
  C:\Windows\System\HyoMDDp.exe
  2⤵
  PID:9904
- C:\Windows\System\DhiWFdT.exe
  C:\Windows\System\DhiWFdT.exe
  2⤵
  PID:9932
- C:\Windows\System\hGlVzgf.exe
  C:\Windows\System\hGlVzgf.exe
  2⤵
  PID:9956
- C:\Windows\System\uRQMEnc.exe
  C:\Windows\System\uRQMEnc.exe
  2⤵
  PID:9980
- C:\Windows\System\aDVvljj.exe
  C:\Windows\System\aDVvljj.exe
  2⤵
  PID:10004
- C:\Windows\System\JgWNEFG.exe
  C:\Windows\System\JgWNEFG.exe
  2⤵
  PID:10036
- C:\Windows\System\FwRRutq.exe
  C:\Windows\System\FwRRutq.exe
  2⤵
  PID:10052
- C:\Windows\System\mxwAxho.exe
  C:\Windows\System\mxwAxho.exe
  2⤵
  PID:10080
- C:\Windows\System\AZxnlQg.exe
  C:\Windows\System\AZxnlQg.exe
  2⤵
  PID:10100
- C:\Windows\System\YjAWKzG.exe
  C:\Windows\System\YjAWKzG.exe
  2⤵
  PID:10116
- C:\Windows\System\dCfBNxW.exe
  C:\Windows\System\dCfBNxW.exe
  2⤵
  PID:10148
- C:\Windows\System\ShtjmWk.exe
  C:\Windows\System\ShtjmWk.exe
  2⤵
  PID:10172
- C:\Windows\System\fdsLgBx.exe
  C:\Windows\System\fdsLgBx.exe
  2⤵
  PID:10192
- C:\Windows\System\ifrRYko.exe
  C:\Windows\System\ifrRYko.exe
  2⤵
  PID:10216
- C:\Windows\System\vTaiPmA.exe
  C:\Windows\System\vTaiPmA.exe
  2⤵
  PID:9000
- C:\Windows\System\zrtQrAa.exe
  C:\Windows\System\zrtQrAa.exe
  2⤵
  PID:8640
- C:\Windows\System\DvApGZw.exe
  C:\Windows\System\DvApGZw.exe
  2⤵
  PID:8688
- C:\Windows\System\RGXyvki.exe
  C:\Windows\System\RGXyvki.exe
  2⤵
  PID:9092
- C:\Windows\System\JCQsONf.exe
  C:\Windows\System\JCQsONf.exe
  2⤵
  PID:8532
- C:\Windows\System\GUZnleg.exe
  C:\Windows\System\GUZnleg.exe
  2⤵
  PID:8976
- C:\Windows\System\VAOJpld.exe
  C:\Windows\System\VAOJpld.exe
  2⤵
  PID:8908
- C:\Windows\System\lQoBlHF.exe
  C:\Windows\System\lQoBlHF.exe
  2⤵
  PID:9236
- C:\Windows\System\IjrgpGb.exe
  C:\Windows\System\IjrgpGb.exe
  2⤵
  PID:9048
- C:\Windows\System\YKpBqHZ.exe
  C:\Windows\System\YKpBqHZ.exe
  2⤵
  PID:9292
- C:\Windows\System\bTErkyJ.exe
  C:\Windows\System\bTErkyJ.exe
  2⤵
  PID:8504
- C:\Windows\System\yghcDIi.exe
  C:\Windows\System\yghcDIi.exe
  2⤵
  PID:7708
- C:\Windows\System\dhRINqx.exe
  C:\Windows\System\dhRINqx.exe
  2⤵
  PID:8340
- C:\Windows\System\CGTFuiN.exe
  C:\Windows\System\CGTFuiN.exe
  2⤵
  PID:6736
- C:\Windows\System\wUbmHBt.exe
  C:\Windows\System\wUbmHBt.exe
  2⤵
  PID:7328
- C:\Windows\System\QvsDGNV.exe
  C:\Windows\System\QvsDGNV.exe
  2⤵
  PID:9820
- C:\Windows\System\cKqHoeF.exe
  C:\Windows\System\cKqHoeF.exe
  2⤵
  PID:9864
- C:\Windows\System\WEjwriA.exe
  C:\Windows\System\WEjwriA.exe
  2⤵
  PID:8560
- C:\Windows\System\BRIhYKZ.exe
  C:\Windows\System\BRIhYKZ.exe
  2⤵
  PID:9392
- C:\Windows\System\cNUuTGa.exe
  C:\Windows\System\cNUuTGa.exe
  2⤵
  PID:10044
- C:\Windows\System\GAaEPHR.exe
  C:\Windows\System\GAaEPHR.exe
  2⤵
  PID:10256
- C:\Windows\System\ZSQcZFu.exe
  C:\Windows\System\ZSQcZFu.exe
  2⤵
  PID:10276
- C:\Windows\System\gvQMstY.exe
  C:\Windows\System\gvQMstY.exe
  2⤵
  PID:10292
- C:\Windows\System\zXfOuwQ.exe
  C:\Windows\System\zXfOuwQ.exe
  2⤵
  PID:10316
- C:\Windows\System\QtcVYIM.exe
  C:\Windows\System\QtcVYIM.exe
  2⤵
  PID:10336
- C:\Windows\System\VfbBAsf.exe
  C:\Windows\System\VfbBAsf.exe
  2⤵
  PID:10364
- C:\Windows\System\znIulej.exe
  C:\Windows\System\znIulej.exe
  2⤵
  PID:10388
- C:\Windows\System\ovRSlIU.exe
  C:\Windows\System\ovRSlIU.exe
  2⤵
  PID:10412
- C:\Windows\System\XebuUQg.exe
  C:\Windows\System\XebuUQg.exe
  2⤵
  PID:10428
- C:\Windows\System\AtRZlRN.exe
  C:\Windows\System\AtRZlRN.exe
  2⤵
  PID:10444
- C:\Windows\System\JfGpUhL.exe
  C:\Windows\System\JfGpUhL.exe
  2⤵
  PID:10464
- C:\Windows\System\frstchZ.exe
  C:\Windows\System\frstchZ.exe
  2⤵
  PID:10492
- C:\Windows\System\ClysFQL.exe
  C:\Windows\System\ClysFQL.exe
  2⤵
  PID:10524
- C:\Windows\System\eRtZbJW.exe
  C:\Windows\System\eRtZbJW.exe
  2⤵
  PID:10544
- C:\Windows\System\ajkfZlo.exe
  C:\Windows\System\ajkfZlo.exe
  2⤵
  PID:10564
- C:\Windows\System\TfrSYOm.exe
  C:\Windows\System\TfrSYOm.exe
  2⤵
  PID:10588
- C:\Windows\System\xgQxzRB.exe
  C:\Windows\System\xgQxzRB.exe
  2⤵
  PID:10616
- C:\Windows\System\MdrkCBH.exe
  C:\Windows\System\MdrkCBH.exe
  2⤵
  PID:10644
- C:\Windows\System\YepdcHa.exe
  C:\Windows\System\YepdcHa.exe
  2⤵
  PID:10676
- C:\Windows\System\hbxUBGy.exe
  C:\Windows\System\hbxUBGy.exe
  2⤵
  PID:10712
- C:\Windows\System\BhwNSvz.exe
  C:\Windows\System\BhwNSvz.exe
  2⤵
  PID:10736
- C:\Windows\System\pJwJZfb.exe
  C:\Windows\System\pJwJZfb.exe
  2⤵
  PID:10760
- C:\Windows\System\EOSekSL.exe
  C:\Windows\System\EOSekSL.exe
  2⤵
  PID:10788
- C:\Windows\System\QZpwiOb.exe
  C:\Windows\System\QZpwiOb.exe
  2⤵
  PID:10812
- C:\Windows\System\FREPGiR.exe
  C:\Windows\System\FREPGiR.exe
  2⤵
  PID:10836
- C:\Windows\System\rqlwpnB.exe
  C:\Windows\System\rqlwpnB.exe
  2⤵
  PID:10856
- C:\Windows\System\YTOCira.exe
  C:\Windows\System\YTOCira.exe
  2⤵
  PID:10884
- C:\Windows\System\ixJKAdY.exe
  C:\Windows\System\ixJKAdY.exe
  2⤵
  PID:10908
- C:\Windows\System\JAAFkbJ.exe
  C:\Windows\System\JAAFkbJ.exe
  2⤵
  PID:10932
- C:\Windows\System\eclgJOG.exe
  C:\Windows\System\eclgJOG.exe
  2⤵
  PID:10960
- C:\Windows\System\icOkOZu.exe
  C:\Windows\System\icOkOZu.exe
  2⤵
  PID:10980
- C:\Windows\System\WOLdlpF.exe
  C:\Windows\System\WOLdlpF.exe
  2⤵
  PID:11004
- C:\Windows\System\wGnTjHI.exe
  C:\Windows\System\wGnTjHI.exe
  2⤵
  PID:11024
- C:\Windows\System\mMZazuJ.exe
  C:\Windows\System\mMZazuJ.exe
  2⤵
  PID:11056
- C:\Windows\System\WYkRXvJ.exe
  C:\Windows\System\WYkRXvJ.exe
  2⤵
  PID:11076
- C:\Windows\System\kpaCXGI.exe
  C:\Windows\System\kpaCXGI.exe
  2⤵
  PID:11100
- C:\Windows\System\pICmofg.exe
  C:\Windows\System\pICmofg.exe
  2⤵
  PID:11120
- C:\Windows\System\dgIloPu.exe
  C:\Windows\System\dgIloPu.exe
  2⤵
  PID:11148
- C:\Windows\System\tODDnZE.exe
  C:\Windows\System\tODDnZE.exe
  2⤵
  PID:11172
- C:\Windows\System\EbLKrWN.exe
  C:\Windows\System\EbLKrWN.exe
  2⤵
  PID:11192
- C:\Windows\System\HBBaOsN.exe
  C:\Windows\System\HBBaOsN.exe
  2⤵
  PID:11216
- C:\Windows\System\NYLItaU.exe
  C:\Windows\System\NYLItaU.exe
  2⤵
  PID:11232
- C:\Windows\System\IxNAYpw.exe
  C:\Windows\System\IxNAYpw.exe
  2⤵
  PID:11256
- C:\Windows\System\BFnGAmB.exe
  C:\Windows\System\BFnGAmB.exe
  2⤵
  PID:9632
- C:\Windows\System\ahFwvUg.exe
  C:\Windows\System\ahFwvUg.exe
  2⤵
  PID:9700
- C:\Windows\System\TbXlQPg.exe
  C:\Windows\System\TbXlQPg.exe
  2⤵
  PID:8540
- C:\Windows\System\tNqFnbo.exe
  C:\Windows\System\tNqFnbo.exe
  2⤵
  PID:9240
- C:\Windows\System\QflQWkX.exe
  C:\Windows\System\QflQWkX.exe
  2⤵
  PID:9840
- C:\Windows\System\NaYtPkf.exe
  C:\Windows\System\NaYtPkf.exe
  2⤵
  PID:9976
- C:\Windows\System\paSnRwK.exe
  C:\Windows\System\paSnRwK.exe
  2⤵
  PID:9436
- C:\Windows\System\qVcpXGs.exe
  C:\Windows\System\qVcpXGs.exe
  2⤵
  PID:9788
- C:\Windows\System\BcpPjfW.exe
  C:\Windows\System\BcpPjfW.exe
  2⤵
  PID:7880
- C:\Windows\System\GwqnYKi.exe
  C:\Windows\System\GwqnYKi.exe
  2⤵
  PID:9540
- C:\Windows\System\tNMmmWg.exe
  C:\Windows\System\tNMmmWg.exe
  2⤵
  PID:10228
- C:\Windows\System\oIezJkK.exe
  C:\Windows\System\oIezJkK.exe
  2⤵
  PID:8704
- C:\Windows\System\FYsVKiY.exe
  C:\Windows\System\FYsVKiY.exe
  2⤵
  PID:1460
- C:\Windows\System\gTHONcX.exe
  C:\Windows\System\gTHONcX.exe
  2⤵
  PID:10408
- C:\Windows\System\IypgLWR.exe
  C:\Windows\System\IypgLWR.exe
  2⤵
  PID:9928
- C:\Windows\System\IBAnUaB.exe
  C:\Windows\System\IBAnUaB.exe
  2⤵
  PID:9972
- C:\Windows\System\KvApANY.exe
  C:\Windows\System\KvApANY.exe
  2⤵
  PID:10584
- C:\Windows\System\JJbeLdA.exe
  C:\Windows\System\JJbeLdA.exe
  2⤵
  PID:10064
- C:\Windows\System\yNsWGch.exe
  C:\Windows\System\yNsWGch.exe
  2⤵
  PID:10700
- C:\Windows\System\RBIaFza.exe
  C:\Windows\System\RBIaFza.exe
  2⤵
  PID:10140
- C:\Windows\System\lwcpOpf.exe
  C:\Windows\System\lwcpOpf.exe
  2⤵
  PID:10204
- C:\Windows\System\qhyupts.exe
  C:\Windows\System\qhyupts.exe
  2⤵
  PID:10880
- C:\Windows\System\RQelBpd.exe
  C:\Windows\System\RQelBpd.exe
  2⤵
  PID:11276
- C:\Windows\System\ZJORQEF.exe
  C:\Windows\System\ZJORQEF.exe
  2⤵
  PID:11304
- C:\Windows\System\SLjktYH.exe
  C:\Windows\System\SLjktYH.exe
  2⤵
  PID:11328
- C:\Windows\System\NWDHSZa.exe
  C:\Windows\System\NWDHSZa.exe
  2⤵
  PID:11364
- C:\Windows\System\uonPfaK.exe
  C:\Windows\System\uonPfaK.exe
  2⤵
  PID:11388
- C:\Windows\System\bYixrsB.exe
  C:\Windows\System\bYixrsB.exe
  2⤵
  PID:11416
- C:\Windows\System\HPGsngZ.exe
  C:\Windows\System\HPGsngZ.exe
  2⤵
  PID:11448
- C:\Windows\System\sYwUFXT.exe
  C:\Windows\System\sYwUFXT.exe
  2⤵
  PID:11464
- C:\Windows\System\MihSOPR.exe
  C:\Windows\System\MihSOPR.exe
  2⤵
  PID:11484
- C:\Windows\System\RXzHxlG.exe
  C:\Windows\System\RXzHxlG.exe
  2⤵
  PID:11508
- C:\Windows\System\juCBOqE.exe
  C:\Windows\System\juCBOqE.exe
  2⤵
  PID:11532
- C:\Windows\System\BLvROOt.exe
  C:\Windows\System\BLvROOt.exe
  2⤵
  PID:11568
- C:\Windows\System\LVQpOmg.exe
  C:\Windows\System\LVQpOmg.exe
  2⤵
  PID:11600
- C:\Windows\System\yrZLBuo.exe
  C:\Windows\System\yrZLBuo.exe
  2⤵
  PID:11616
- C:\Windows\System\UiDxJZW.exe
  C:\Windows\System\UiDxJZW.exe
  2⤵
  PID:11640
- C:\Windows\System\qNJyKCN.exe
  C:\Windows\System\qNJyKCN.exe
  2⤵
  PID:11664
- C:\Windows\System\LuIqvwj.exe
  C:\Windows\System\LuIqvwj.exe
  2⤵
  PID:11684
- C:\Windows\System\nYRVEBn.exe
  C:\Windows\System\nYRVEBn.exe
  2⤵
  PID:11704
- C:\Windows\System\QeOPjmg.exe
  C:\Windows\System\QeOPjmg.exe
  2⤵
  PID:11724
- C:\Windows\System\AoipBKN.exe
  C:\Windows\System\AoipBKN.exe
  2⤵
  PID:11752
- C:\Windows\System\RjXjNaA.exe
  C:\Windows\System\RjXjNaA.exe
  2⤵
  PID:11772
- C:\Windows\System\mkVVKZm.exe
  C:\Windows\System\mkVVKZm.exe
  2⤵
  PID:11796
- C:\Windows\System\XUMMiZR.exe
  C:\Windows\System\XUMMiZR.exe
  2⤵
  PID:11828
- C:\Windows\System\iWyGOzY.exe
  C:\Windows\System\iWyGOzY.exe
  2⤵
  PID:11864
- C:\Windows\System\bDyREXY.exe
  C:\Windows\System\bDyREXY.exe
  2⤵
  PID:11888
- C:\Windows\System\nfZcgQP.exe
  C:\Windows\System\nfZcgQP.exe
  2⤵
  PID:11916
- C:\Windows\System\BCTHwfG.exe
  C:\Windows\System\BCTHwfG.exe
  2⤵
  PID:11940
- C:\Windows\System\RzqCRXK.exe
  C:\Windows\System\RzqCRXK.exe
  2⤵
  PID:11972
- C:\Windows\System\WZIJWxe.exe
  C:\Windows\System\WZIJWxe.exe
  2⤵
  PID:11992
- C:\Windows\System\kBFFucz.exe
  C:\Windows\System\kBFFucz.exe
  2⤵
  PID:12016
- C:\Windows\System\hLdFGyi.exe
  C:\Windows\System\hLdFGyi.exe
  2⤵
  PID:12044
- C:\Windows\System\CYpIQnJ.exe
  C:\Windows\System\CYpIQnJ.exe
  2⤵
  PID:12072
- C:\Windows\System\eSshPSl.exe
  C:\Windows\System\eSshPSl.exe
  2⤵
  PID:12088
- C:\Windows\System\QTzWETl.exe
  C:\Windows\System\QTzWETl.exe
  2⤵
  PID:12112
- C:\Windows\System\pAGNLDf.exe
  C:\Windows\System\pAGNLDf.exe
  2⤵
  PID:12152
- C:\Windows\System\ALwJNOV.exe
  C:\Windows\System\ALwJNOV.exe
  2⤵
  PID:10976
- C:\Windows\System\RAkITZe.exe
  C:\Windows\System\RAkITZe.exe
  2⤵
  PID:11320
- C:\Windows\System\NahpWbg.exe
  C:\Windows\System\NahpWbg.exe
  2⤵
  PID:11160
- C:\Windows\System\fvgqGzU.exe
  C:\Windows\System\fvgqGzU.exe
  2⤵
  PID:8764
- C:\Windows\System\PqliTyF.exe
  C:\Windows\System\PqliTyF.exe
  2⤵
  PID:11648
- C:\Windows\System\HAWKVwM.exe
  C:\Windows\System\HAWKVwM.exe
  2⤵
  PID:9348
- C:\Windows\System\cfeAtFd.exe
  C:\Windows\System\cfeAtFd.exe
  2⤵
  PID:11748
- C:\Windows\System\OquSoML.exe
  C:\Windows\System\OquSoML.exe
  2⤵
  PID:11792
- C:\Windows\System\CXOfpTC.exe
  C:\Windows\System\CXOfpTC.exe
  2⤵
  PID:10824
- C:\Windows\System\hkwVpiY.exe
  C:\Windows\System\hkwVpiY.exe
  2⤵
  PID:9892
- C:\Windows\System\oeNJCnU.exe
  C:\Windows\System\oeNJCnU.exe
  2⤵
  PID:10892
- C:\Windows\System\HcwTqti.exe
  C:\Windows\System\HcwTqti.exe
  2⤵
  PID:10920
- C:\Windows\System\IjrQcfV.exe
  C:\Windows\System\IjrQcfV.exe
  2⤵
  PID:10992
- C:\Windows\System\FnLokwf.exe
  C:\Windows\System\FnLokwf.exe
  2⤵
  PID:11284
- C:\Windows\System\WDUoZmw.exe
  C:\Windows\System\WDUoZmw.exe
  2⤵
  PID:11396
- C:\Windows\System\apiAhWg.exe
  C:\Windows\System\apiAhWg.exe
  2⤵
  PID:11432
- C:\Windows\System\TJvGBEU.exe
  C:\Windows\System\TJvGBEU.exe
  2⤵
  PID:11552
- C:\Windows\System\QmfUKUt.exe
  C:\Windows\System\QmfUKUt.exe
  2⤵
  PID:11612
- C:\Windows\System\htfVkAW.exe
  C:\Windows\System\htfVkAW.exe
  2⤵
  PID:9816
- C:\Windows\System\fuoMvyY.exe
  C:\Windows\System\fuoMvyY.exe
  2⤵
  PID:11768
- C:\Windows\System\ZOtzlxu.exe
  C:\Windows\System\ZOtzlxu.exe
  2⤵
  PID:11836
- C:\Windows\System\rdsNKMn.exe
  C:\Windows\System\rdsNKMn.exe
  2⤵
  PID:9264
- C:\Windows\System\SzrmSDf.exe
  C:\Windows\System\SzrmSDf.exe
  2⤵
  PID:12244
- C:\Windows\System\SxYaWeJ.exe
  C:\Windows\System\SxYaWeJ.exe
  2⤵
  PID:12084
- C:\Windows\System\CghJNJz.exe
  C:\Windows\System\CghJNJz.exe
  2⤵
  PID:11096
- C:\Windows\System\DcxmqIz.exe
  C:\Windows\System\DcxmqIz.exe
  2⤵
  PID:11936
- C:\Windows\System\GcxfRdi.exe
  C:\Windows\System\GcxfRdi.exe
  2⤵
  PID:12292
- C:\Windows\System\CLYVzJk.exe
  C:\Windows\System\CLYVzJk.exe
  2⤵
  PID:12312
- C:\Windows\System\skROQyI.exe
  C:\Windows\System\skROQyI.exe
  2⤵
  PID:12332
- C:\Windows\System\pFhqDeC.exe
  C:\Windows\System\pFhqDeC.exe
  2⤵
  PID:12356
- C:\Windows\System\QcGFQFj.exe
  C:\Windows\System\QcGFQFj.exe
  2⤵
  PID:12376
- C:\Windows\System\aFPMwpS.exe
  C:\Windows\System\aFPMwpS.exe
  2⤵
  PID:12396
- C:\Windows\System\HnMFCju.exe
  C:\Windows\System\HnMFCju.exe
  2⤵
  PID:12420
- C:\Windows\System\SfXXyHm.exe
  C:\Windows\System\SfXXyHm.exe
  2⤵
  PID:12468
- C:\Windows\System\rkxkYjq.exe
  C:\Windows\System\rkxkYjq.exe
  2⤵
  PID:12504
- C:\Windows\System\rrHfgyZ.exe
  C:\Windows\System\rrHfgyZ.exe
  2⤵
  PID:12540
- C:\Windows\System\PcMlONv.exe
  C:\Windows\System\PcMlONv.exe
  2⤵
  PID:12640
- C:\Windows\System\JHvEBks.exe
  C:\Windows\System\JHvEBks.exe
  2⤵
  PID:12668
- C:\Windows\System\Mcrcdhj.exe
  C:\Windows\System\Mcrcdhj.exe
  2⤵
  PID:12700
- C:\Windows\System\lbbNEuR.exe
  C:\Windows\System\lbbNEuR.exe
  2⤵
  PID:12724
- C:\Windows\System\tRUGdeN.exe
  C:\Windows\System\tRUGdeN.exe
  2⤵
  PID:12748
- C:\Windows\System\BfnoVTG.exe
  C:\Windows\System\BfnoVTG.exe
  2⤵
  PID:12768
- C:\Windows\System\vWujHlf.exe
  C:\Windows\System\vWujHlf.exe
  2⤵
  PID:12792
- C:\Windows\System\ZBgAEFZ.exe
  C:\Windows\System\ZBgAEFZ.exe
  2⤵
  PID:12820
- C:\Windows\System\qfuENfJ.exe
  C:\Windows\System\qfuENfJ.exe
  2⤵
  PID:12844
- C:\Windows\System\qnLxfMK.exe
  C:\Windows\System\qnLxfMK.exe
  2⤵
  PID:12868
- C:\Windows\System\wDHPkTK.exe
  C:\Windows\System\wDHPkTK.exe
  2⤵
  PID:12900
- C:\Windows\System\tGalKBv.exe
  C:\Windows\System\tGalKBv.exe
  2⤵
  PID:12920
- C:\Windows\System\QzVkBjS.exe
  C:\Windows\System\QzVkBjS.exe
  2⤵
  PID:12944
- C:\Windows\System\nehLZYB.exe
  C:\Windows\System\nehLZYB.exe
  2⤵
  PID:12984
- C:\Windows\System\LFWlGaH.exe
  C:\Windows\System\LFWlGaH.exe
  2⤵
  PID:13008
- C:\Windows\System\CnhZgWz.exe
  C:\Windows\System\CnhZgWz.exe
  2⤵
  PID:13040
- C:\Windows\System\aoXFKJz.exe
  C:\Windows\System\aoXFKJz.exe
  2⤵
  PID:13064
- C:\Windows\System\IwYOOXC.exe
  C:\Windows\System\IwYOOXC.exe
  2⤵
  PID:13088
- C:\Windows\System\dJAdOwB.exe
  C:\Windows\System\dJAdOwB.exe
  2⤵
  PID:13112
- C:\Windows\System\yoLflxN.exe
  C:\Windows\System\yoLflxN.exe
  2⤵
  PID:13136
- C:\Windows\System\qWUPcgi.exe
  C:\Windows\System\qWUPcgi.exe
  2⤵
  PID:13168
- C:\Windows\System\YxyxkPb.exe
  C:\Windows\System\YxyxkPb.exe
  2⤵
  PID:13184
- C:\Windows\System\jrdXpyz.exe
  C:\Windows\System\jrdXpyz.exe
  2⤵
  PID:13208
- C:\Windows\System\UjBxqxW.exe
  C:\Windows\System\UjBxqxW.exe
  2⤵
  PID:13232
- C:\Windows\System\JEZIlqA.exe
  C:\Windows\System\JEZIlqA.exe
  2⤵
  PID:13252
- C:\Windows\System\iDYkuUw.exe
  C:\Windows\System\iDYkuUw.exe
  2⤵
  PID:13284
- C:\Windows\System\UsOBqjx.exe
  C:\Windows\System\UsOBqjx.exe
  2⤵
  PID:13300
- C:\Windows\System\wldfWHH.exe
  C:\Windows\System\wldfWHH.exe
  2⤵
  PID:10608
- C:\Windows\System\EhQMsbV.exe
  C:\Windows\System\EhQMsbV.exe
  2⤵
  PID:10632
- C:\Windows\System\kqHOCqH.exe
  C:\Windows\System\kqHOCqH.exe
  2⤵
  PID:9964
- C:\Windows\System\eaVjgjD.exe
  C:\Windows\System\eaVjgjD.exe
  2⤵
  PID:11424
- C:\Windows\System\XTeTUtF.exe
  C:\Windows\System\XTeTUtF.exe
  2⤵
  PID:11476
- C:\Windows\System\lJlsoga.exe
  C:\Windows\System\lJlsoga.exe
  2⤵
  PID:10232
- C:\Windows\System\qCmcbne.exe
  C:\Windows\System\qCmcbne.exe
  2⤵
  PID:11016
- C:\Windows\System\ejmCWcq.exe
  C:\Windows\System\ejmCWcq.exe
  2⤵
  PID:10484
- C:\Windows\System\FYFpwSe.exe
  C:\Windows\System\FYFpwSe.exe
  2⤵
  PID:9468
- C:\Windows\System\qFUXKTc.exe
  C:\Windows\System\qFUXKTc.exe
  2⤵
  PID:9912
- C:\Windows\System\VzgzKAp.exe
  C:\Windows\System\VzgzKAp.exe
  2⤵
  PID:11956
- C:\Windows\System\nPRRAVP.exe
  C:\Windows\System\nPRRAVP.exe
  2⤵
  PID:12032
- C:\Windows\System\PYXScxZ.exe
  C:\Windows\System\PYXScxZ.exe
  2⤵
  PID:11272
- C:\Windows\System\dueKBeY.exe
  C:\Windows\System\dueKBeY.exe
  2⤵
  PID:11672
- C:\Windows\System\wrGZklo.exe
  C:\Windows\System\wrGZklo.exe
  2⤵
  PID:12552
- C:\Windows\System\orQOXZR.exe
  C:\Windows\System\orQOXZR.exe
  2⤵
  PID:12348
- C:\Windows\System\KsaTYtw.exe
  C:\Windows\System\KsaTYtw.exe
  2⤵
  PID:11872
- C:\Windows\System\NSNWUTJ.exe
  C:\Windows\System\NSNWUTJ.exe
  2⤵
  PID:11112
- C:\Windows\System\CkgeqGv.exe
  C:\Windows\System\CkgeqGv.exe
  2⤵
  PID:12712
- C:\Windows\System\XWYnNWp.exe
  C:\Windows\System\XWYnNWp.exe
  2⤵
  PID:12404
- C:\Windows\System\KBBnCkX.exe
  C:\Windows\System\KBBnCkX.exe
  2⤵
  PID:12912
- C:\Windows\System\nPNvRSP.exe
  C:\Windows\System\nPNvRSP.exe
  2⤵
  PID:12556
- C:\Windows\System\dcNGnYM.exe
  C:\Windows\System\dcNGnYM.exe
  2⤵
  PID:12408
- C:\Windows\System\jcesInK.exe
  C:\Windows\System\jcesInK.exe
  2⤵
  PID:12304
- C:\Windows\System\dIetsxq.exe
  C:\Windows\System\dIetsxq.exe
  2⤵
  PID:13144
- C:\Windows\System\LPsVRXo.exe
  C:\Windows\System\LPsVRXo.exe
  2⤵
  PID:12856
- C:\Windows\System\uAptlNm.exe
  C:\Windows\System\uAptlNm.exe
  2⤵
  PID:8536
- C:\Windows\System\vTQtTFi.exe
  C:\Windows\System\vTQtTFi.exe
  2⤵
  PID:12972
- C:\Windows\System\UlilKun.exe
  C:\Windows\System\UlilKun.exe
  2⤵
  PID:12676
- C:\Windows\System\oUshnLh.exe
  C:\Windows\System\oUshnLh.exe
  2⤵
  PID:13096
- C:\Windows\System\Fnpnzoy.exe
  C:\Windows\System\Fnpnzoy.exe
  2⤵
  PID:12024
- C:\Windows\System\NNKvIjH.exe
  C:\Windows\System\NNKvIjH.exe
  2⤵
  PID:13320
- C:\Windows\System\ggRDwpj.exe
  C:\Windows\System\ggRDwpj.exe
  2⤵
  PID:13340
- C:\Windows\System\IPycMrK.exe
  C:\Windows\System\IPycMrK.exe
  2⤵
  PID:13364
- C:\Windows\System\wYVqCIL.exe
  C:\Windows\System\wYVqCIL.exe
  2⤵
  PID:13384
- C:\Windows\System\soSMPAn.exe
  C:\Windows\System\soSMPAn.exe
  2⤵
  PID:13408
- C:\Windows\System\fadymhk.exe
  C:\Windows\System\fadymhk.exe
  2⤵
  PID:13428
- C:\Windows\System\JFkFXPx.exe
  C:\Windows\System\JFkFXPx.exe
  2⤵
  PID:13452
- C:\Windows\System\ZUZeHeu.exe
  C:\Windows\System\ZUZeHeu.exe
  2⤵
  PID:13484
- C:\Windows\System\VOaPasC.exe
  C:\Windows\System\VOaPasC.exe
  2⤵
  PID:13508
- C:\Windows\System\RazjLxy.exe
  C:\Windows\System\RazjLxy.exe
  2⤵
  PID:13536
- C:\Windows\System\RTKIrzw.exe
  C:\Windows\System\RTKIrzw.exe
  2⤵
  PID:13556
- C:\Windows\System\izousri.exe
  C:\Windows\System\izousri.exe
  2⤵
  PID:13592
- C:\Windows\System\wFhoEKm.exe
  C:\Windows\System\wFhoEKm.exe
  2⤵
  PID:13620
- C:\Windows\System\znmrKXr.exe
  C:\Windows\System\znmrKXr.exe
  2⤵
  PID:13648
- C:\Windows\System\EDOScIu.exe
  C:\Windows\System\EDOScIu.exe
  2⤵
  PID:13664
- C:\Windows\System\ybSRcSl.exe
  C:\Windows\System\ybSRcSl.exe
  2⤵
  PID:13684
- C:\Windows\System\zEIpEAt.exe
  C:\Windows\System\zEIpEAt.exe
  2⤵
  PID:13712
- C:\Windows\System\bAJSsgr.exe
  C:\Windows\System\bAJSsgr.exe
  2⤵
  PID:13728
- C:\Windows\System\HBqZPpP.exe
  C:\Windows\System\HBqZPpP.exe
  2⤵
  PID:13760
- C:\Windows\System\crDGZaQ.exe
  C:\Windows\System\crDGZaQ.exe
  2⤵
  PID:13784
- C:\Windows\System\Ndkuxov.exe
  C:\Windows\System\Ndkuxov.exe
  2⤵
  PID:13804
- C:\Windows\System\sVDHkxo.exe
  C:\Windows\System\sVDHkxo.exe
  2⤵
  PID:13824
- C:\Windows\System\EsTCCNE.exe
  C:\Windows\System\EsTCCNE.exe
  2⤵
  PID:13852
- C:\Windows\System\ocrreqO.exe
  C:\Windows\System\ocrreqO.exe
  2⤵
  PID:13868
- C:\Windows\System\sUuIbgw.exe
  C:\Windows\System\sUuIbgw.exe
  2⤵
  PID:13896
- C:\Windows\System\mRzqRCN.exe
  C:\Windows\System\mRzqRCN.exe
  2⤵
  PID:13920
- C:\Windows\System\jEIJBHZ.exe
  C:\Windows\System\jEIJBHZ.exe
  2⤵
  PID:13944
- C:\Windows\System\RuILZVV.exe
  C:\Windows\System\RuILZVV.exe
  2⤵
  PID:13968
- C:\Windows\System\CnqdeIu.exe
  C:\Windows\System\CnqdeIu.exe
  2⤵
  PID:14140
- C:\Windows\System\crNSsxh.exe
  C:\Windows\System\crNSsxh.exe
  2⤵
  PID:14160
- C:\Windows\System\KNxSCog.exe
  C:\Windows\System\KNxSCog.exe
  2⤵
  PID:14184
- C:\Windows\System\bkBYDLC.exe
  C:\Windows\System\bkBYDLC.exe
  2⤵
  PID:14220
- C:\Windows\System\vGrvhWf.exe
  C:\Windows\System\vGrvhWf.exe
  2⤵
  PID:14244
- C:\Windows\System\ijHTGnM.exe
  C:\Windows\System\ijHTGnM.exe
  2⤵
  PID:14272
- C:\Windows\System\IscDNKZ.exe
  C:\Windows\System\IscDNKZ.exe
  2⤵
  PID:14308
- C:\Windows\System\RNluJrs.exe
  C:\Windows\System\RNluJrs.exe
  2⤵
  PID:11204
- C:\Windows\System\ateZANR.exe
  C:\Windows\System\ateZANR.exe
  2⤵
  PID:13276
- C:\Windows\System\fSJFTxO.exe
  C:\Windows\System\fSJFTxO.exe
  2⤵
  PID:6532
- C:\Windows\System\SpIMKWI.exe
  C:\Windows\System\SpIMKWI.exe
  2⤵
  PID:12956
- C:\Windows\System\kZIusEw.exe
  C:\Windows\System\kZIusEw.exe
  2⤵
  PID:11700
- C:\Windows\System\axZLifJ.exe
  C:\Windows\System\axZLifJ.exe
  2⤵
  PID:13060
- C:\Windows\System\mbjykUi.exe
  C:\Windows\System\mbjykUi.exe
  2⤵
  PID:10652
- C:\Windows\System\WLDTMVp.exe
  C:\Windows\System\WLDTMVp.exe
  2⤵
  PID:13160
- C:\Windows\System\vDPEcyM.exe
  C:\Windows\System\vDPEcyM.exe
  2⤵
  PID:12776
- C:\Windows\System\mkXPTEs.exe
  C:\Windows\System\mkXPTEs.exe
  2⤵
  PID:13336
- C:\Windows\System\KcUKBin.exe
  C:\Windows\System\KcUKBin.exe
  2⤵
  PID:12308
- C:\Windows\System\EPbPShg.exe
  C:\Windows\System\EPbPShg.exe
  2⤵
  PID:13576
- C:\Windows\System\LzHrfws.exe
  C:\Windows\System\LzHrfws.exe
  2⤵
  PID:13612
- C:\Windows\System\gMTDdAL.exe
  C:\Windows\System\gMTDdAL.exe
  2⤵
  PID:12428
- C:\Windows\System\AJplCcA.exe
  C:\Windows\System\AJplCcA.exe
  2⤵
  PID:12880
- C:\Windows\System\vewfiAF.exe
  C:\Windows\System\vewfiAF.exe
  2⤵
  PID:13316
- C:\Windows\System\tgNiSce.exe
  C:\Windows\System\tgNiSce.exe
  2⤵
  PID:13392
- C:\Windows\System\FaOyhln.exe
  C:\Windows\System\FaOyhln.exe
  2⤵
  PID:13480
- C:\Windows\System\lrXXvvC.exe
  C:\Windows\System\lrXXvvC.exe
  2⤵
  PID:13628
- C:\Windows\System\gmVNtDg.exe
  C:\Windows\System\gmVNtDg.exe
  2⤵
  PID:13692
- C:\Windows\System\MGCMipN.exe
  C:\Windows\System\MGCMipN.exe
  2⤵
  PID:13776
- C:\Windows\System\hCjxZbu.exe
  C:\Windows\System\hCjxZbu.exe
  2⤵
  PID:12908
- C:\Windows\System\plLrrxk.exe
  C:\Windows\System\plLrrxk.exe
  2⤵
  PID:13860
- C:\Windows\System\gWxFbLF.exe
  C:\Windows\System\gWxFbLF.exe
  2⤵
  PID:13360
- C:\Windows\System\kecHMNf.exe
  C:\Windows\System\kecHMNf.exe
  2⤵
  PID:13380
- C:\Windows\System\AmoDvbU.exe
  C:\Windows\System\AmoDvbU.exe
  2⤵
  PID:13448
- C:\Windows\System\tzCeLSi.exe
  C:\Windows\System\tzCeLSi.exe
  2⤵
  PID:13496
- C:\Windows\System\vaBPGDT.exe
  C:\Windows\System\vaBPGDT.exe
  2⤵
  PID:14064
- C:\Windows\System\yMfttBi.exe
  C:\Windows\System\yMfttBi.exe
  2⤵
  PID:14344
- C:\Windows\System\BMpEEIj.exe
  C:\Windows\System\BMpEEIj.exe
  2⤵
  PID:14380
- C:\Windows\System\NRrNgIl.exe
  C:\Windows\System\NRrNgIl.exe
  2⤵
  PID:14400
- C:\Windows\System\WzyUQYh.exe
  C:\Windows\System\WzyUQYh.exe
  2⤵
  PID:14420
- C:\Windows\System\cOTQZBG.exe
  C:\Windows\System\cOTQZBG.exe
  2⤵
  PID:14444
- C:\Windows\System\BLrlgbX.exe
  C:\Windows\System\BLrlgbX.exe
  2⤵
  PID:14472
- C:\Windows\System\aNNCDCb.exe
  C:\Windows\System\aNNCDCb.exe
  2⤵
  PID:14492
- C:\Windows\System\YAKPERs.exe
  C:\Windows\System\YAKPERs.exe
  2⤵
  PID:14508
- C:\Windows\System\eQBpmKH.exe
  C:\Windows\System\eQBpmKH.exe
  2⤵
  PID:14524
- C:\Windows\System\onZiTHp.exe
  C:\Windows\System\onZiTHp.exe
  2⤵
  PID:14548
- C:\Windows\System\LPnEBFR.exe
  C:\Windows\System\LPnEBFR.exe
  2⤵
  PID:14576
- C:\Windows\System\tMSXWuL.exe
  C:\Windows\System\tMSXWuL.exe
  2⤵
  PID:14596
- C:\Windows\System\NQlucXn.exe
  C:\Windows\System\NQlucXn.exe
  2⤵
  PID:14632
- C:\Windows\System\pcpGSwz.exe
  C:\Windows\System\pcpGSwz.exe
  2⤵
  PID:14648
- C:\Windows\System\oUBQxnF.exe
  C:\Windows\System\oUBQxnF.exe
  2⤵
  PID:14664
- C:\Windows\System\cNRaDcp.exe
  C:\Windows\System\cNRaDcp.exe
  2⤵
  PID:14696
- C:\Windows\System\NDTdYOa.exe
  C:\Windows\System\NDTdYOa.exe
  2⤵
  PID:14724
- C:\Windows\System\YCZIsRC.exe
  C:\Windows\System\YCZIsRC.exe
  2⤵
  PID:14748
- C:\Windows\System\VXIxTOw.exe
  C:\Windows\System\VXIxTOw.exe
  2⤵
  PID:14764
- C:\Windows\System\XbTiwpb.exe
  C:\Windows\System\XbTiwpb.exe
  2⤵
  PID:14784
- C:\Windows\System\mWrHxIb.exe
  C:\Windows\System\mWrHxIb.exe
  2⤵
  PID:14804
- C:\Windows\System\zOmHNIT.exe
  C:\Windows\System\zOmHNIT.exe
  2⤵
  PID:14828
- C:\Windows\System\zbFpSZA.exe
  C:\Windows\System\zbFpSZA.exe
  2⤵
  PID:14848
- C:\Windows\System\gpnOuCW.exe
  C:\Windows\System\gpnOuCW.exe
  2⤵
  PID:14872
- C:\Windows\System\lEHZQSu.exe
  C:\Windows\System\lEHZQSu.exe
  2⤵
  PID:14896
- C:\Windows\System\uNkCdYF.exe
  C:\Windows\System\uNkCdYF.exe
  2⤵
  PID:14924
- C:\Windows\System\viiMBoq.exe
  C:\Windows\System\viiMBoq.exe
  2⤵
  PID:14944
- C:\Windows\System\sLNwYDz.exe
  C:\Windows\System\sLNwYDz.exe
  2⤵
  PID:14960
- C:\Windows\System\TtcQPnk.exe
  C:\Windows\System\TtcQPnk.exe
  2⤵
  PID:14984
- C:\Windows\System\pgUIJds.exe
  C:\Windows\System\pgUIJds.exe
  2⤵
  PID:15012
- C:\Windows\System\bfTDgrP.exe
  C:\Windows\System\bfTDgrP.exe
  2⤵
  PID:15036
- C:\Windows\System\CUknraR.exe
  C:\Windows\System\CUknraR.exe
  2⤵
  PID:15056
- C:\Windows\System\LlHoqAT.exe
  C:\Windows\System\LlHoqAT.exe
  2⤵
  PID:15084
- C:\Windows\System\zVnnfVW.exe
  C:\Windows\System\zVnnfVW.exe
  2⤵
  PID:15100
- C:\Windows\System\ZDoWGGC.exe
  C:\Windows\System\ZDoWGGC.exe
  2⤵
  PID:15120
- C:\Windows\System\DqqLkab.exe
  C:\Windows\System\DqqLkab.exe
  2⤵
  PID:15144
- C:\Windows\System\simlwLD.exe
  C:\Windows\System\simlwLD.exe
  2⤵
  PID:15168
- C:\Windows\System\DhosugD.exe
  C:\Windows\System\DhosugD.exe
  2⤵
  PID:15204
- C:\Windows\System\SxtnBOW.exe
  C:\Windows\System\SxtnBOW.exe
  2⤵
  PID:15228
- C:\Windows\System\MLmIjfX.exe
  C:\Windows\System\MLmIjfX.exe
  2⤵
  PID:15252
- C:\Windows\System\nfWiCfR.exe
  C:\Windows\System\nfWiCfR.exe
  2⤵
  PID:15276
- C:\Windows\System\oMbfHmN.exe
  C:\Windows\System\oMbfHmN.exe
  2⤵
  PID:15296
- C:\Windows\System\ZowSlRX.exe
  C:\Windows\System\ZowSlRX.exe
  2⤵
  PID:15328
- C:\Windows\System\KUrotpl.exe
  C:\Windows\System\KUrotpl.exe
  2⤵
  PID:15356
- C:\Windows\System\PKygVML.exe
  C:\Windows\System\PKygVML.exe
  2⤵
  PID:13772
- C:\Windows\System\ZcJlFlV.exe
  C:\Windows\System\ZcJlFlV.exe
  2⤵
  PID:13936
- C:\Windows\System\qISrXks.exe
  C:\Windows\System\qISrXks.exe
  2⤵
  PID:13880
- C:\Windows\System\NdMDLrJ.exe
  C:\Windows\System\NdMDLrJ.exe
  2⤵
  PID:14024
- C:\Windows\System\XjEOXgv.exe
  C:\Windows\System\XjEOXgv.exe
  2⤵
  PID:14072
- C:\Windows\System\GAxGPnK.exe
  C:\Windows\System\GAxGPnK.exe
  2⤵
  PID:14052
- C:\Windows\System\kveWJCC.exe
  C:\Windows\System\kveWJCC.exe
  2⤵
  PID:14352
- C:\Windows\System\RegMlLQ.exe
  C:\Windows\System\RegMlLQ.exe
  2⤵
  PID:12060
- C:\Windows\System\PBFpHie.exe
  C:\Windows\System\PBFpHie.exe
  2⤵
  PID:14464
- C:\Windows\System\bnJFeGI.exe
  C:\Windows\System\bnJFeGI.exe
  2⤵
  PID:14504
- C:\Windows\System\gVGvGgg.exe
  C:\Windows\System\gVGvGgg.exe
  2⤵
  PID:14564
- C:\Windows\System\kWMXuPn.exe
  C:\Windows\System\kWMXuPn.exe
  2⤵
  PID:10756
- C:\Windows\System\LchaLUY.exe
  C:\Windows\System\LchaLUY.exe
  2⤵
  PID:14216
- C:\Windows\System\ClgIXOD.exe
  C:\Windows\System\ClgIXOD.exe
  2⤵
  PID:2284
- C:\Windows\System\QgUENIM.exe
  C:\Windows\System\QgUENIM.exe
  2⤵
  PID:13680
- C:\Windows\System\RUeKrMV.exe
  C:\Windows\System\RUeKrMV.exe
  2⤵
  PID:13744
- C:\Windows\System\YOmHMgw.exe
  C:\Windows\System\YOmHMgw.exe
  2⤵
  PID:13840
- C:\Windows\System\tMUjFqK.exe
  C:\Windows\System\tMUjFqK.exe
  2⤵
  PID:12756
- C:\Windows\System\rYiAayQ.exe
  C:\Windows\System\rYiAayQ.exe
  2⤵
  PID:12516
- C:\Windows\System\XixTBDH.exe
  C:\Windows\System\XixTBDH.exe
  2⤵
  PID:10344
- C:\Windows\System\zYtARbV.exe
  C:\Windows\System\zYtARbV.exe
  2⤵
  PID:14956
- C:\Windows\System\jdPUANk.exe
  C:\Windows\System\jdPUANk.exe
  2⤵
  PID:15000
- C:\Windows\System\HQgZXbw.exe
  C:\Windows\System\HQgZXbw.exe
  2⤵
  PID:13604
- C:\Windows\System\kfqpqYT.exe
  C:\Windows\System\kfqpqYT.exe
  2⤵
  PID:12480
- C:\Windows\System\aCAtMlN.exe
  C:\Windows\System\aCAtMlN.exe
  2⤵
  PID:14612
- C:\Windows\System\mKSDfru.exe
  C:\Windows\System\mKSDfru.exe
  2⤵
  PID:15372
- C:\Windows\System\ygxXhoQ.exe
  C:\Windows\System\ygxXhoQ.exe
  2⤵
  PID:15392
- C:\Windows\System\GBcPeaA.exe
  C:\Windows\System\GBcPeaA.exe
  2⤵
  PID:15416
- C:\Windows\System\HguUALM.exe
  C:\Windows\System\HguUALM.exe
  2⤵
  PID:15440
- C:\Windows\System\pJSnsZt.exe
  C:\Windows\System\pJSnsZt.exe
  2⤵
  PID:15456
- C:\Windows\System\fRtXcUp.exe
  C:\Windows\System\fRtXcUp.exe
  2⤵
  PID:15476
- C:\Windows\System\ptniorY.exe
  C:\Windows\System\ptniorY.exe
  2⤵
  PID:15508
- C:\Windows\System\PPtJoew.exe
  C:\Windows\System\PPtJoew.exe
  2⤵
  PID:15528
- C:\Windows\System\WSygXnf.exe
  C:\Windows\System\WSygXnf.exe
  2⤵
  PID:15556
- C:\Windows\System\qeiwrAF.exe
  C:\Windows\System\qeiwrAF.exe
  2⤵
  PID:15572
- C:\Windows\System\SQYZukh.exe
  C:\Windows\System\SQYZukh.exe
  2⤵
  PID:15604
- C:\Windows\System\RbRqhzH.exe
  C:\Windows\System\RbRqhzH.exe
  2⤵
  PID:15624
- C:\Windows\System\HihrIuM.exe
  C:\Windows\System\HihrIuM.exe
  2⤵
  PID:15644
- C:\Windows\System\gsVTyYq.exe
  C:\Windows\System\gsVTyYq.exe
  2⤵
  PID:15668
- C:\Windows\System\HtOPqTd.exe
  C:\Windows\System\HtOPqTd.exe
  2⤵
  PID:15688
- C:\Windows\System\juLjKBU.exe
  C:\Windows\System\juLjKBU.exe
  2⤵
  PID:15720
- C:\Windows\System\VNiMIWl.exe
  C:\Windows\System\VNiMIWl.exe
  2⤵
  PID:15744
- C:\Windows\System\GoRnKuE.exe
  C:\Windows\System\GoRnKuE.exe
  2⤵
  PID:15768
- C:\Windows\System\WINkvit.exe
  C:\Windows\System\WINkvit.exe
  2⤵
  PID:15784
- C:\Windows\System\WIMwNcy.exe
  C:\Windows\System\WIMwNcy.exe
  2⤵
  PID:15800
- C:\Windows\System\NDoHTLD.exe
  C:\Windows\System\NDoHTLD.exe
  2⤵
  PID:15820
- C:\Windows\System\bicfmEU.exe
  C:\Windows\System\bicfmEU.exe
  2⤵
  PID:15856
- C:\Windows\System\xhnoNVF.exe
  C:\Windows\System\xhnoNVF.exe
  2⤵
  PID:15872
- C:\Windows\System\ERsQoRI.exe
  C:\Windows\System\ERsQoRI.exe
  2⤵
  PID:15888
- C:\Windows\System\sMEnifa.exe
  C:\Windows\System\sMEnifa.exe
  2⤵
  PID:15912
- C:\Windows\System\HqitrLM.exe
  C:\Windows\System\HqitrLM.exe
  2⤵
  PID:15936
- C:\Windows\System\McqyEkr.exe
  C:\Windows\System\McqyEkr.exe
  2⤵
  PID:15960
- C:\Windows\System\kmaJIvP.exe
  C:\Windows\System\kmaJIvP.exe
  2⤵
  PID:15988
- C:\Windows\System\KTruRnC.exe
  C:\Windows\System\KTruRnC.exe
  2⤵
  PID:16012
- C:\Windows\System\vQdvRRi.exe
  C:\Windows\System\vQdvRRi.exe
  2⤵
  PID:16032
- C:\Windows\System\jrBgtEF.exe
  C:\Windows\System\jrBgtEF.exe
  2⤵
  PID:16056
- C:\Windows\System\itHLkXf.exe
  C:\Windows\System\itHLkXf.exe
  2⤵
  PID:16084
- C:\Windows\System\kbcECav.exe
  C:\Windows\System\kbcECav.exe
  2⤵
  PID:16108
- C:\Windows\System\KPKekWJ.exe
  C:\Windows\System\KPKekWJ.exe
  2⤵
  PID:16124
- C:\Windows\System\RSHSoFg.exe
  C:\Windows\System\RSHSoFg.exe
  2⤵
  PID:16144
- C:\Windows\System\yIeNXHM.exe
  C:\Windows\System\yIeNXHM.exe
  2⤵
  PID:16164
- C:\Windows\System\clcFREe.exe
  C:\Windows\System\clcFREe.exe
  2⤵
  PID:16188
- C:\Windows\System\SToRFtG.exe
  C:\Windows\System\SToRFtG.exe
  2⤵
  PID:16212
- C:\Windows\System\fBlKTPA.exe
  C:\Windows\System\fBlKTPA.exe
  2⤵
  PID:16240
- C:\Windows\System\xFvOTJD.exe
  C:\Windows\System\xFvOTJD.exe
  2⤵
  PID:16260
- C:\Windows\System\UItzUXp.exe
  C:\Windows\System\UItzUXp.exe
  2⤵
  PID:16284
- C:\Windows\System\aPlskkw.exe
  C:\Windows\System\aPlskkw.exe
  2⤵
  PID:16300
- C:\Windows\System\kJUloNs.exe
  C:\Windows\System\kJUloNs.exe
  2⤵
  PID:16324
- C:\Windows\System\LCuZCLp.exe
  C:\Windows\System\LCuZCLp.exe
  2⤵
  PID:16344
- C:\Windows\System\qQvLaJu.exe
  C:\Windows\System\qQvLaJu.exe
  2⤵
  PID:16364
- C:\Windows\System\zbIRMAZ.exe
  C:\Windows\System\zbIRMAZ.exe
  2⤵
  PID:3932
- C:\Windows\System\TpVmLsW.exe
  C:\Windows\System\TpVmLsW.exe
  2⤵
  PID:12512
- C:\Windows\System\PRoOfHQ.exe
  C:\Windows\System\PRoOfHQ.exe
  2⤵
  PID:14680
- C:\Windows\System\caCNKwE.exe
  C:\Windows\System\caCNKwE.exe
  2⤵
  PID:13888
- C:\Windows\System\jejRnvc.exe
  C:\Windows\System\jejRnvc.exe
  2⤵
  PID:13436
- C:\Windows\System\pQKWirS.exe
  C:\Windows\System\pQKWirS.exe
  2⤵
  PID:12992
- C:\Windows\System\CpZeStD.exe
  C:\Windows\System\CpZeStD.exe
  2⤵
  PID:14364
- C:\Windows\System\hSYmaxl.exe
  C:\Windows\System\hSYmaxl.exe
  2⤵
  PID:14388
- C:\Windows\System\lccDoqp.exe
  C:\Windows\System\lccDoqp.exe
  2⤵
  PID:14656
- C:\Windows\System\yBFQBHE.exe
  C:\Windows\System\yBFQBHE.exe
  2⤵
  PID:15032
- C:\Windows\System\pXDyQoH.exe
  C:\Windows\System\pXDyQoH.exe
  2⤵
  PID:15080
- C:\Windows\System\eqqWFfD.exe
  C:\Windows\System\eqqWFfD.exe
  2⤵
  PID:14812
- C:\Windows\System\ZVTjrtJ.exe
  C:\Windows\System\ZVTjrtJ.exe
  2⤵
  PID:15132
- C:\Windows\System\mTlqQPz.exe
  C:\Windows\System\mTlqQPz.exe
  2⤵
  PID:12968
- C:\Windows\System\bVlvfqu.exe
  C:\Windows\System\bVlvfqu.exe
  2⤵
  PID:15248
- C:\Windows\System\SPoqFRL.exe
  C:\Windows\System\SPoqFRL.exe
  2⤵
  PID:15448
- C:\Windows\System\gEzkrOc.exe
  C:\Windows\System\gEzkrOc.exe
  2⤵
  PID:14676
- C:\Windows\System\CyDWyMo.exe
  C:\Windows\System\CyDWyMo.exe
  2⤵
  PID:15568
- C:\Windows\System\XPrIchy.exe
  C:\Windows\System\XPrIchy.exe
  2⤵
  PID:13912
- C:\Windows\System\rFSdIZo.exe
  C:\Windows\System\rFSdIZo.exe
  2⤵
  PID:13352
- C:\Windows\System\qCPUKwN.exe
  C:\Windows\System\qCPUKwN.exe
  2⤵
  PID:15796
- C:\Windows\System\FvQrnjp.exe
  C:\Windows\System\FvQrnjp.exe
  2⤵
  PID:16408
- C:\Windows\System\cIExoGr.exe
  C:\Windows\System\cIExoGr.exe
  2⤵
  PID:16424
- C:\Windows\System\tYvKZLr.exe
  C:\Windows\System\tYvKZLr.exe
  2⤵
  PID:16444
- C:\Windows\System\Fwzdeee.exe
  C:\Windows\System\Fwzdeee.exe
  2⤵
  PID:16468
- C:\Windows\System\OiNechd.exe
  C:\Windows\System\OiNechd.exe
  2⤵
  PID:16496
- C:\Windows\System\OQcXXCX.exe
  C:\Windows\System\OQcXXCX.exe
  2⤵
  PID:16516
- C:\Windows\System\joAfhtv.exe
  C:\Windows\System\joAfhtv.exe
  2⤵
  PID:16548
- C:\Windows\System\oHAevHF.exe
  C:\Windows\System\oHAevHF.exe
  2⤵
  PID:16568
- C:\Windows\System\OoRitES.exe
  C:\Windows\System\OoRitES.exe
  2⤵
  PID:16588
- C:\Windows\System\hikQpGm.exe
  C:\Windows\System\hikQpGm.exe
  2⤵
  PID:16604
- C:\Windows\System\QzgotCe.exe
  C:\Windows\System\QzgotCe.exe
  2⤵
  PID:16624
- C:\Windows\System\lPewNqp.exe
  C:\Windows\System\lPewNqp.exe
  2⤵
  PID:16640
- C:\Windows\System\HWuuXKn.exe
  C:\Windows\System\HWuuXKn.exe
  2⤵
  PID:16664
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16664 -s 248
    3⤵
    PID:17268
- C:\Windows\System\WstGeOG.exe
  C:\Windows\System\WstGeOG.exe
  2⤵
  PID:16692
- C:\Windows\System\fNwOJVD.exe
  C:\Windows\System\fNwOJVD.exe
  2⤵
  PID:16712
- C:\Windows\System\FSOTpSm.exe
  C:\Windows\System\FSOTpSm.exe
  2⤵
  PID:16752
- C:\Windows\System\fdmxjaW.exe
  C:\Windows\System\fdmxjaW.exe
  2⤵
  PID:16776
- C:\Windows\System\TsTTrzI.exe
  C:\Windows\System\TsTTrzI.exe
  2⤵
  PID:16792
- C:\Windows\System\HjfyuSx.exe
  C:\Windows\System\HjfyuSx.exe
  2⤵
  PID:16828
- C:\Windows\System\NHeOHtX.exe
  C:\Windows\System\NHeOHtX.exe
  2⤵
  PID:16848
- C:\Windows\System\vKacgJh.exe
  C:\Windows\System\vKacgJh.exe
  2⤵
  PID:16876
- C:\Windows\System\rnXGyCh.exe
  C:\Windows\System\rnXGyCh.exe
  2⤵
  PID:16896
- C:\Windows\System\XDswmTO.exe
  C:\Windows\System\XDswmTO.exe
  2⤵
  PID:16920
- C:\Windows\System\PVyUfwd.exe
  C:\Windows\System\PVyUfwd.exe
  2⤵
  PID:16952
- C:\Windows\System\LKLMCqy.exe
  C:\Windows\System\LKLMCqy.exe
  2⤵
  PID:16968
- C:\Windows\System\JGWHvbb.exe
  C:\Windows\System\JGWHvbb.exe
  2⤵
  PID:16996
- C:\Windows\System\vCtkcxb.exe
  C:\Windows\System\vCtkcxb.exe
  2⤵
  PID:17020
- C:\Windows\System\nfIEFIO.exe
  C:\Windows\System\nfIEFIO.exe
  2⤵
  PID:17036
- C:\Windows\System\IkJdcwx.exe
  C:\Windows\System\IkJdcwx.exe
  2⤵
  PID:17056
- C:\Windows\System\tFCrHbY.exe
  C:\Windows\System\tFCrHbY.exe
  2⤵
  PID:17072
- C:\Windows\System\JGMZMMP.exe
  C:\Windows\System\JGMZMMP.exe
  2⤵
  PID:17088
- C:\Windows\System\TZMuWGj.exe
  C:\Windows\System\TZMuWGj.exe
  2⤵
  PID:17108
- C:\Windows\System\cDTCGRt.exe
  C:\Windows\System\cDTCGRt.exe
  2⤵
  PID:17128
- C:\Windows\System\xWCCuJX.exe
  C:\Windows\System\xWCCuJX.exe
  2⤵
  PID:17148

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:13840

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:15568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CUHNoxn.exe

Filesize
1.1MB

MD5
c331c4a67bf5db75ca6ace8e8367dce0

SHA1
a6266bb87480484ee7b4a009d9987b822d6e6fad

SHA256
0ddbe95597e39ac273067c5b690b193948feaf57c7392c6be5ccdb6706d3fcae

SHA512
b8888f71f9488302ab000493a60b3a31cacc4b57213c00a7f7f3a4177e3581889c63b2711b4f1d2d89d1581f0bfb3b8bd04eef441e24f852e2004c2fd4e2d03a

Download Submit
C:\Windows\System\CyzvVtE.exe

Filesize
1.1MB

MD5
1ea235349477c21288122a55875d506c

SHA1
c239ead5ebdde5c9f259195f8d9fbce11543027c

SHA256
34965ee6707c29295b02654a1457b93489735da27db998d3e758091743930b1a

SHA512
c7549de5cb5d80a695f36a8d16aaa450fad8fa1fd70820334788cd6cd980345036baf3c903b98909daa104507abfbc26fbb06eb3b4b6835d9e6350d55770db7b

Download Submit
C:\Windows\System\DWnwpph.exe

Filesize
1.1MB

MD5
28f9b172f98f48197f7b5cbdf171e75c

SHA1
a3ac6a2acb365c23eafb75a26d454374ddc81e16

SHA256
24d4cfd2616b2d05f6901a2bdf9e6a770ab2b3ad8d87c10cc5cee5d1d97779a4

SHA512
ea6d9fb1cabd49f52a6aa69ef612024de2972bdf881d82ee70496f4abe4c21fdc7517c3bbc8c2784ec2ecdb1c82b0aeddd380867389848675afd7215385b873c

Download Submit
C:\Windows\System\GTWKEWq.exe

Filesize
1.1MB

MD5
e19d749b09b07f36c49490869c98523b

SHA1
2b80ea82a6cfe4d9bec62539a18e31b045fd3c67

SHA256
856671319e37bd7af8075f102451364a76a64ec54cf0e036c8dd20d36e494bc8

SHA512
9836e5f284ba5eb7b431a623b58a4020f3adc1e19b2c6993acc95e14b195753b5cfff8d3f1c738575e6da55d4d64f3c1904168cbad0dfb95f29b460272c00d86

Download Submit
C:\Windows\System\GuRyxuA.exe

Filesize
1.1MB

MD5
47c49fd2e033932a609c949189a1a568

SHA1
8ebe120f95da242afc24afd41a4007387324cfa2

SHA256
a597a10e4fa2272fc8b81fde102cc567299f8893f7ee72b93fade54fecb3f9b3

SHA512
f8663cb0a99ba19dcdbaf3a8257a4ba6a1aee156c0f338ea2c5984a9b8db7ae73ee27c6dabc45df7438d1f6ef0aa483a5d9dca9ee95bbdfd124305d484acccfc

Download Submit
C:\Windows\System\HASbGoT.exe

Filesize
1.1MB

MD5
c3841dca271f5dcf9e3027e9144df6b3

SHA1
149bc8af5f1c2502fc04750ee4804d9b22a36bb5

SHA256
540f0836192a4e48f27e8a5c077d37937286f9d37ee736027640621e485415cc

SHA512
c7eec1aa7d8920f1ec4afdcc56b71e54c91d251019be11cfad36d66f8592613a37e472a5d7edbae90c488ced948b7039c080557b9d7c9e14842b1d85424f81cf

Download Submit
C:\Windows\System\HjKozRF.exe

Filesize
1.1MB

MD5
76a14814beeaf6d85fbe4c516ca9f1d7

SHA1
815848816306d0dd8803c7e5c67b5e77447a8a2c

SHA256
168376496ebe959776d8c702f0edb849486b6fa6819a516049a741463da611ef

SHA512
9498631ffeed2bcf7c5cc99d092f493a079f500f97347874f9771a58cd7642599fb7151b70981f8d06d0a87177838db01d82b0713561f13d725603f8498cbf4e

Download Submit
C:\Windows\System\HqmjdVd.exe

Filesize
1.1MB

MD5
2ffe1bbd49ffb3d4eebf003b8d791ed1

SHA1
3f4d2d6374dc94f9091b006a8f5b12f1db74a1d7

SHA256
c909958e28f1dae7f1d87d2466369c8e70969c292e063f90c77b45f0d0d619d2

SHA512
dd14c4cdb272e15d21fdb992553a0f6fdda4bd79db4d1faf0680d8ad8ffc07ee638829dbe3c941e028b511acbd18ce74e9707571ab4ad3bdf51ebf59783fe15a

Download Submit
C:\Windows\System\HysYyuO.exe

Filesize
1.1MB

MD5
f7f91a36ce043b4add3be79eafb36a03

SHA1
72ca3c4afc196dedec74fa55c16334c5303052a4

SHA256
542beadadf6901346d311e4ce089aa79a287b35b9ed1e1428347bf616a98eef7

SHA512
1fae2e42d5166ed33f5eabf699a6b2846d37124f906bdd756d7a8a9ea2b070586d3793859e5becf612bb0d23b64343eecab7d570c42940feb3d2e2844022fffd

Download Submit
C:\Windows\System\ONUhdzu.exe

Filesize
1.1MB

MD5
23aa5aad7d0ea104ec8be07549f344d4

SHA1
6fa25f2c8281dd5c262645c12509a9435dc84a36

SHA256
589252e80cc0e2615b6ce4e7a2d2db09a776ca09e3da72748ea44c4849eafafe

SHA512
8d6a349a9dbdbdeba7e3dc7d3e2db8ebaaf3080654100ccbb54db6379fc9c6cf7b7ad86a42d2128861acea1b51ef9e0a603f0976576ad9630417562e81b1ff3f

Download Submit
C:\Windows\System\PrLCkYi.exe

Filesize
1.1MB

MD5
65d6b67c9a15b6e572f97b2215c076cf

SHA1
02d2a30607f2925701712d85a00f36cef6cf43de

SHA256
5a520af206edc298fba9aae995b8c37793beba816a3d06e5e97173bd96fc9c01

SHA512
3a0f2f97f6d9039b4443e106e944f783bb9a520c6ea2320c7cd1f693a83cfa9dff8869a0700bde204277fc1f0e715aeba4ab14f5e483e6b213e0e59647ffa755

Download Submit
C:\Windows\System\WbMZARN.exe

Filesize
1.1MB

MD5
093a1bc9ea9f6fd3e9129a74bed74534

SHA1
f3012b989624646deed85e6e282598f9a0b4c206

SHA256
2ee2fcc93ffd0f217fa032cddf03934ee9475bc014ab671545792b254476bbbc

SHA512
3e6d6539bd2a052ff5d973a827b39f23b1abd693f7c5525451ffed796ceeb7e79f82c5f5bf7a3b709ccb82f0e12bd61164ad090f050c3a7e26e04e886f98d922

Download Submit
C:\Windows\System\cvGQeYN.exe

Filesize
1.1MB

MD5
a0d7c804b6e2fa8cf1ceeb1cb1fd7513

SHA1
63f65e8b5768cf02c886d4076cb4cdbf140e0e19

SHA256
3e8a5f1330db8786a6a8ce0f5e9d9b525c8c87e1d2b912b645e04658faa19698

SHA512
66d1718a7c6a44e7deff79c20bce55c34d6a6264c25c765fef5a6288cec73adab3020b4bcd0c7a181f9500ecdfe9a3f17d445aa835a9d518d42578e297f52668

Download Submit
C:\Windows\System\dlDUQAc.exe

Filesize
1.1MB

MD5
9a7f0d2e81e522268d5bab87b6a2cfba

SHA1
795fe1a11f80ca07944b70986adad6b744d766a2

SHA256
d333a4bc4eb578713b33632aebd5406644be665f7f7f809ed4b65d4a6150928c

SHA512
04c2aeb92037262097ae7300590c3fd15689129372676ec65b445aca716c5be1e6fc86c33e710e0ea339b0353164cf49544155ddf06808befa6efbc37433a914

Download Submit
C:\Windows\System\heqKnPV.exe

Filesize
1.1MB

MD5
42954fd2d1ba56f50d59a034ad1b4d3b

SHA1
eb9c5ce25bdcc2262702fe04592ca8fb64ea34f5

SHA256
449faaf7183c947a8ffafa58d6a0e48a949532a899b0e9336418a396469693cf

SHA512
1e1fbfeeac42e76a1315ef96763c5255f2abb2ead9a23cc495df88293849ecad583d6c5017d16ad327dfb7e50aa710ffdbd4d4c5d607edbc839fa8e79f329c6e

Download Submit
C:\Windows\System\icsQPIw.exe

Filesize
1.1MB

MD5
d97184b10c0d4114848c234ba3170e6b

SHA1
6f3014f7eebc25a8e4cdb4baaaf1b14124d13473

SHA256
a0ddc77086c8efa7d369ce9029b8776f78ac3cd3faef758528b6647e0a1e3051

SHA512
5f22775fe8d45ce7f6e405480ca86552fb76eeff2dc3ea5be981244d39f54d8d1fc47b3b7c51727935915ab79c938f105d0f321d857e5a52a0a4249bfadc7810

Download Submit
C:\Windows\System\jANhveE.exe

Filesize
1.1MB

MD5
b21c3cdd9db073e26bd5a163d7c60744

SHA1
f1a49b70e29db6f27d412a2cca4e4cd18c7d4e66

SHA256
48d924ae114b92b06738cefb88d9e249938ba311b182bcd12c15030f329f9ee3

SHA512
ca3a9319903b8ea140b5d4f53570337339dc93ec5ee8dd2d5ae49eb1116a27c846f61efbab867f400219b38875308cfefbf1d593d904e04eebf346334f6a8443

Download Submit
C:\Windows\System\jHdcTat.exe

Filesize
1.1MB

MD5
b589ec0093b79b6161a1556b349dfec7

SHA1
0fcdcd0b415892550910362e442bb9df8c7ad0c5

SHA256
5f877abd35195351df3bd59f7b5ac0162e76e68e119c6450069d10967d76946b

SHA512
21cb1614db5a13ea08e2e26298238ff22fde619d5a845b660bfe795b31a41a482feaa36680b110c5abe83bf99b7dc0c5e46d8eba49d7071d372ec8f061797b41

Download Submit
C:\Windows\System\kIAcjkJ.exe

Filesize
1.1MB

MD5
54342d73d2d0eb8dff0b596d78f3d31f

SHA1
471f4565d5da97d268a40d5b94516bb4df7c62c7

SHA256
25fe91dcb78a944fa85d175ad3004c7c7ee76cf71b1a56a7b96a8b63789bef77

SHA512
57dace2c813c9758755f32b8fdfccca4199c659a0297176cca28f374cdcee7f62761d6e05fbcf9c6dd26a8e7851cb07f74e6c6db05f640a2f863372a0e854c0c

Download Submit
C:\Windows\System\kfnIvZw.exe

Filesize
1.1MB

MD5
5cfa5c540a04e08c298dfdb4e281dc76

SHA1
4d961d4babd73a2af67297e309eb1516a6d09340

SHA256
fdec1fa06fa5833cc0c52bffbc8a13814a6e34b7b0c9c5c5524e0f3462faf201

SHA512
6fd69c19910820c64f34c6de20c2585c7393be9a8bfba5a3dc95ba50188e84b1e7d0f156e51f0629b45d43d903d7034d35efaa18e54111926be1a878407870e2

Download Submit
C:\Windows\System\mRyAjnb.exe

Filesize
1.1MB

MD5
e5425fc5e714f2005ac03982c4daf971

SHA1
1ad7c75a83c1a5271e3f2d46214ca8d2989226ca

SHA256
2237ace64481649eb19ae56987c032f6b50612d6a32d8365060c3907b532eb5b

SHA512
7f4f7b4fdd98d36101a18f1b2750afb0cf42deeed5d25b732c094c0024335cd2e43ceb387037e94fc2e3f06695365eb780b6e193da6a1c5b1092d66caecc6fac

Download Submit
C:\Windows\System\nuhQfkP.exe

Filesize
1.1MB

MD5
7922dbc82acd4e6601ca099f9a385727

SHA1
1fe56a1f4165f502195b42c0c8a8c517e2dfdb1d

SHA256
d34b46db9401ec8505eba5545b322a9f2483dfb1317ced8ec941fa8b229f27fe

SHA512
c89c34a31b8bc6e7572dbd820aab5ea47a627c2ce99b439f9d81cc1153be5dab758965bbff5d3643c9144725f6e7665fbfb74245917a31efc2980f4ae8d794fb

Download Submit
C:\Windows\System\oJzmxCc.exe

Filesize
1.1MB

MD5
b353401c65108962c46230942729e2fb

SHA1
861614ad146ff5f85dc694f9e7cbd0eeeae53095

SHA256
6b28ca31a046314e9424d27c86a6b38bac0228177cb922db6ff3cbc073086bba

SHA512
449af824b033f5a16c1ed04b3356e8589096469b9ed7f7af16072aba3432df7a592914e4a0cf27c024d61caf33ee95cc31f4fcd721bdbb4d918d4d461769f8c9

Download Submit
C:\Windows\System\oeISqad.exe

Filesize
1.1MB

MD5
67c16898533bae3a1bf19ca4e86b9506

SHA1
59109adb60744bc2e5b350093ccdfec0f3112b91

SHA256
12b67798d3c497c4030d2a738410b3757e8f06b734c1347a3f867c33eca401a6

SHA512
dc828e5214fa10567afa18244b72d1b13289a5171edf91ae57b93c64a09e578f110795b852a95f9630ebec96ce74237e887391efe948911874a22d79d02cbfcc

Download Submit
C:\Windows\System\owNMqlN.exe

Filesize
1.1MB

MD5
8bf0c5d5c38283931ac6a454aa21be21

SHA1
f46162e08b75b10ebfe6887fa1b8f4a155c910c6

SHA256
58bab91f59347cafc9142b5ab9a30c7976be4052d88373b5371f52ffcd6ff37d

SHA512
cde04e0d5e812135548aa64849b2ce5c01731b041fedbed374254a437d3bfd169670ab9d3ea838de6d54bd6e76e4b61079e160ff3f3c334aeb3dd0acc289be59

Download Submit
C:\Windows\System\povffvN.exe

Filesize
1.1MB

MD5
b385718cfb23d2a9869e2cdb01bc293c

SHA1
d3e4cdbca7ff25e5efa1d43f0828ff8ef82f8ac4

SHA256
7712d34c45ab516816f3531a194eb6702a42d7fb3679e685d2656b37a1fa63eb

SHA512
cb39671dc1e777aae4a0aaaafb57f2ad101082eaa351aa1372836db163ac3ff4844eebdd83efac5dfbe102c27903e82960878f70548f22b003c357da5f30e028

Download Submit
C:\Windows\System\qtQkNQH.exe

Filesize
1.1MB

MD5
d6602aa6c3e6bf63a657056383ee604c

SHA1
e6d55461a44f725e81838df54479674d6be0caf7

SHA256
2b20906fe715244a9f6ceb567eb4374534cea63e23fc6a6947541f82b4025621

SHA512
c10aa7b0bfc75688b5c471b862e674a08b74b6a63ddac4655cb809954930178f5b5a80c216133a38ca8e4382b5b06a8e5268bcdf86b3fab3d313ca04ab7c8ec7

Download Submit
C:\Windows\System\rVZgwtr.exe

Filesize
1.1MB

MD5
0ba66bf03a8d62739e602645e3af0306

SHA1
d0bc1dd38b982ea2ec1608e5e65a575da50884df

SHA256
47a37499b59654d5fcc1ea477807ad0ca481701324cd14a8ec13016978b85e4e

SHA512
1efd316e60ce46109266203cbc79302eb5e05acf619cf0fc6a99d31c12872088f94b098f7a93399e8c0af59b13f900013fd026a69101b41decf794cdd3c8e409

Download Submit
C:\Windows\System\sfatZxy.exe

Filesize
1.1MB

MD5
f2a38a62d7a8d704f67ca20a15fe3cbd

SHA1
89fa5679fd83b2c77d72a04197105918db5cd40c

SHA256
e29207a045d3cb558a8578bdba749673a8c69e578f878e97cf7600c7239c30a7

SHA512
d6c5775a9c93ae3a1485f91c0c6b11945b5dad92b3f922b9b2ae2b40a9184d8c7bc732ea75f7e5879facfc37aab5dffea9e5daafbc10a1629666db00cf35da0e

Download Submit
C:\Windows\System\tGGbGRm.exe

Filesize
1.1MB

MD5
e968dac2b674c9a711559e86c2861eb7

SHA1
cfb2fcd73fafc3b57f5dffed2331f438ac03737f

SHA256
5d44105164fd3b1a7b6069a003c53a0e5160ea098e00bdccd6951e5878515dc9

SHA512
607aaa6c9aa6106ea2725d4c97e5362fe31fa99e420a4e46a41e772dfc056eef2659ea05e08b3e5224e208d78ab1e1b4660d32c9f190bc28b222ed74e8155d97

Download Submit
C:\Windows\System\vMusiAo.exe

Filesize
1.1MB

MD5
85c7c88a3d239563854ac66104816300

SHA1
c681eccafef2754872658e82de55245e20516fd6

SHA256
11cb7a0a7453c42562efb4a7f648047fe43ca50f38e7726b6a448352261b6b94

SHA512
bfcb5c4e782344ae80c62537838acba0e91ae510cd3bd651ced312cb5330f556da58ef66aec3820f3834f325037d4b9d5a624c657f2323235237404361398c14

Download Submit
C:\Windows\System\wAyvXad.exe

Filesize
1.1MB

MD5
6ed0527812aed3f8800b4c33ef3425a8

SHA1
7492a19b76da5eeb9583dc6312d2539476829c43

SHA256
58a9abf6adf58318c2a47f3640b23d41d65cadb143b1634925d7f15a90eb67fc

SHA512
f86ddc73171526239f3e472f088bf83cb42d10bb7ab25242b5ffbe2ed4cbae1fa80b4e0b94388237e039d2d7cd984b5ee12a3b4ab21332c05387b4fc76e64de5

Download Submit
C:\Windows\System\xDvtOgm.exe

Filesize
1.1MB

MD5
db7d897adeed6120a1d0d17ad6ee9a26

SHA1
1c16f37f8ac872073041e37633e00e84ae5dafef

SHA256
1b860fa70fd29f5fcbedb9c9935fa611b144122c7a33590f73591c62ba60bacc

SHA512
b9b7b7b070a51cd2b1552ce561f2fbe30f5f377531953fd9e11f67e54eaed21d678c99a176941fd4b26fa0b5740fc1003cb2f5731522f38b2dbedbb57fedebca

Download Submit
memory/5100-0-0x00000180F9350000-0x00000180F9360000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads