xmrig | 3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
Size

1.5MB
MD5

c77c38a7ae8db8258e01182e142fa118
SHA1

403e67750de2e8561406a49bfdeba108fad3cbca
SHA256

3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03
SHA512

d9ef5d4cd6dc1a53b55a31bc758a1127b21f40a10348f481350d47fcbbbdcf35819585c5f6d076adce86b621abdeb436af702843947bbcc923262494cb5e6311
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbch:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5T

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b9a-4.dat	xmrig
behavioral2/files/0x000e000000023bae-6.dat	xmrig
behavioral2/files/0x000b000000023ba7-13.dat	xmrig
behavioral2/files/0x0009000000023bbe-30.dat	xmrig
behavioral2/files/0x0009000000023bbd-36.dat	xmrig
behavioral2/files/0x0008000000023bc4-42.dat	xmrig
behavioral2/files/0x0008000000023bc8-52.dat	xmrig
behavioral2/files/0x0008000000023bf9-69.dat	xmrig
behavioral2/files/0x0008000000023c20-138.dat	xmrig
behavioral2/files/0x0008000000023c22-149.dat	xmrig
behavioral2/files/0x0008000000023c42-162.dat	xmrig
behavioral2/files/0x0016000000023c38-160.dat	xmrig
behavioral2/files/0x0008000000023c3e-157.dat	xmrig
behavioral2/files/0x000b000000023c37-155.dat	xmrig
behavioral2/files/0x0008000000023c21-142.dat	xmrig
behavioral2/files/0x0008000000023c1f-132.dat	xmrig
behavioral2/files/0x0008000000023c1e-128.dat	xmrig
behavioral2/files/0x0008000000023c1d-122.dat	xmrig
behavioral2/files/0x0008000000023c17-118.dat	xmrig
behavioral2/files/0x0008000000023c05-112.dat	xmrig
behavioral2/files/0x0008000000023c04-108.dat	xmrig
behavioral2/files/0x0008000000023c03-102.dat	xmrig
behavioral2/files/0x0008000000023bfe-98.dat	xmrig
behavioral2/files/0x0008000000023bfd-92.dat	xmrig
behavioral2/files/0x0008000000023bfc-88.dat	xmrig
behavioral2/files/0x0008000000023bfb-82.dat	xmrig
behavioral2/files/0x0008000000023bfa-78.dat	xmrig
behavioral2/files/0x0008000000023bca-67.dat	xmrig
behavioral2/files/0x0008000000023bc9-63.dat	xmrig
behavioral2/files/0x0008000000023bc7-55.dat	xmrig
behavioral2/files/0x000e000000023bc2-45.dat	xmrig
behavioral2/files/0x0009000000023bbc-33.dat	xmrig
behavioral2/files/0x0008000000023bb7-27.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
784	rfJTBMr.exe
2676	PpYyetY.exe
3688	TYIlhEN.exe
2660	BqlrAVQ.exe
2396	dLmKwuz.exe
4616	mDkndLV.exe
1660	wMBxgzp.exe
2324	KDFXwaw.exe
4636	OMCFprR.exe
4940	pvRMAWN.exe
4900	pzOmmOE.exe
4436	rYpfRfN.exe
756	IFLlANS.exe
2004	VrzdaWk.exe
3168	zyYaSER.exe
4008	hQrqCjg.exe
1988	pxCVFRf.exe
4656	SFWGWOh.exe
3784	muyIJuD.exe
4136	XUdzHCU.exe
4624	bbUMttj.exe
4944	KpdCuGL.exe
2476	BIKxyRf.exe
2620	kpewNgs.exe
2320	SqnTxaz.exe
1244	weBvNEy.exe
1576	uYdbnGy.exe
2632	gqXjmMS.exe
396	CVIDgal.exe
4816	IEyMKfi.exe
4924	ktpeRTM.exe
1728	EOYssWY.exe
2648	kFRdSDe.exe
1604	PaTGBLC.exe
3560	SUCzqxg.exe
3820	WbGTDHJ.exe
4048	zhdZeVb.exe
5096	PjjFiJU.exe
556	AscuONT.exe
4728	eOsqnoL.exe
3200	znikXos.exe
4804	uXTGjtb.exe
3632	eiOXpeS.exe
1180	WlfBKNR.exe
4544	yGZuMVt.exe
724	DkMcZNs.exe
4776	MhaSfWH.exe
4000	BwVBdmT.exe
3276	FQwCWWW.exe
60	sNJnYjH.exe
4608	LYtwOgH.exe
2436	kSyDgyy.exe
3008	geUpAjE.exe
2092	hGryPiq.exe
812	KtXhcpD.exe
3940	wNksHlS.exe
1344	avnDcTu.exe
3944	reDWwwv.exe
4752	tQlUNXh.exe
1764	ChUCkae.exe
4724	JgWNgdw.exe
696	zONyEkA.exe
3116	MIHcfeC.exe
2968	SLHxbPs.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CZyJuDj.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\YofsYlq.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\sIyxIlC.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\uYhXgSt.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\zuwnGDb.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\sjstcht.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\TGIBBnG.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\heBIDuR.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\oTMCtlH.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\voGYTuk.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\fPfaoDg.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\SHKAisp.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\Zdqiofi.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\pCkRxsM.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\PjjFiJU.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\GeuaEeM.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\YXxaGlL.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\rgGImff.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\aFvhAhy.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\zhdZeVb.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\OuHQjwZ.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\MxxgBqF.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\QLgAyGL.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\hsFNHGk.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\EmrpMpZ.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\LNwrSqZ.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\KpdCuGL.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\ZTSLXxl.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\ElkEeri.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\wMBxgzp.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\qqgbCqp.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\IPUGQbO.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\XjaEmYF.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\EeRbQkS.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\WbGTDHJ.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\QIqZOGQ.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\artBukT.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\UlfEtgt.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\RTCZwJk.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\PkNdJcF.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\hrbLDLr.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\WlfBKNR.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\TMwQISW.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\CsFTUDi.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\AfmaLVb.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\tuZGGRK.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\AiTMRoL.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\cOqWLvn.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\RDDRDft.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\mDkndLV.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\RncynIb.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\fkitQWV.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\QoSOKcd.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\SUCzqxg.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\hmdeGoZ.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\eglosaK.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\CnXfhZU.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\kWrvuFf.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\kpewNgs.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\bRaYsbY.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\vecwpGG.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\nwdnvGB.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\LxhrUYU.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
File created	C:\Windows\System\IOlKpjg.exe	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 784	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	84
PID 1116 wrote to memory of 784	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	84
PID 1116 wrote to memory of 2676	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	85
PID 1116 wrote to memory of 2676	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	85
PID 1116 wrote to memory of 3688	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	86
PID 1116 wrote to memory of 3688	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	86
PID 1116 wrote to memory of 2660	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	87
PID 1116 wrote to memory of 2660	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	87
PID 1116 wrote to memory of 2396	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	88
PID 1116 wrote to memory of 2396	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	88
PID 1116 wrote to memory of 4616	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	89
PID 1116 wrote to memory of 4616	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	89
PID 1116 wrote to memory of 1660	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	90
PID 1116 wrote to memory of 1660	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	90
PID 1116 wrote to memory of 2324	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	91
PID 1116 wrote to memory of 2324	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	91
PID 1116 wrote to memory of 4636	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	92
PID 1116 wrote to memory of 4636	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	92
PID 1116 wrote to memory of 4940	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	93
PID 1116 wrote to memory of 4940	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	93
PID 1116 wrote to memory of 4900	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	94
PID 1116 wrote to memory of 4900	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	94
PID 1116 wrote to memory of 4436	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	95
PID 1116 wrote to memory of 4436	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	95
PID 1116 wrote to memory of 756	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	96
PID 1116 wrote to memory of 756	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	96
PID 1116 wrote to memory of 2004	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	97
PID 1116 wrote to memory of 2004	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	97
PID 1116 wrote to memory of 3168	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	98
PID 1116 wrote to memory of 3168	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	98
PID 1116 wrote to memory of 4008	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	99
PID 1116 wrote to memory of 4008	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	99
PID 1116 wrote to memory of 1988	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	100
PID 1116 wrote to memory of 1988	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	100
PID 1116 wrote to memory of 4656	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	101
PID 1116 wrote to memory of 4656	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	101
PID 1116 wrote to memory of 3784	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	102
PID 1116 wrote to memory of 3784	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	102
PID 1116 wrote to memory of 4136	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	103
PID 1116 wrote to memory of 4136	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	103
PID 1116 wrote to memory of 4624	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	104
PID 1116 wrote to memory of 4624	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	104
PID 1116 wrote to memory of 4944	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	105
PID 1116 wrote to memory of 4944	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	105
PID 1116 wrote to memory of 2476	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	106
PID 1116 wrote to memory of 2476	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	106
PID 1116 wrote to memory of 2620	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	107
PID 1116 wrote to memory of 2620	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	107
PID 1116 wrote to memory of 2320	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	108
PID 1116 wrote to memory of 2320	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	108
PID 1116 wrote to memory of 1244	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	109
PID 1116 wrote to memory of 1244	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	109
PID 1116 wrote to memory of 1576	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	110
PID 1116 wrote to memory of 1576	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	110
PID 1116 wrote to memory of 2632	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	111
PID 1116 wrote to memory of 2632	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	111
PID 1116 wrote to memory of 396	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	112
PID 1116 wrote to memory of 396	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	112
PID 1116 wrote to memory of 4816	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	113
PID 1116 wrote to memory of 4816	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	113
PID 1116 wrote to memory of 4924	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	114
PID 1116 wrote to memory of 4924	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	114
PID 1116 wrote to memory of 1728	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	115
PID 1116 wrote to memory of 1728	1116	3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe	115

C:\Users\Admin\AppData\Local\Temp\3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe
"C:\Users\Admin\AppData\Local\Temp\3b393bfc84ca081abad14cdca1d496701fb05cdd3e5564bb663bf3de3c7ccf03.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\System\rfJTBMr.exe
  C:\Windows\System\rfJTBMr.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\PpYyetY.exe
  C:\Windows\System\PpYyetY.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\TYIlhEN.exe
  C:\Windows\System\TYIlhEN.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\BqlrAVQ.exe
  C:\Windows\System\BqlrAVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\dLmKwuz.exe
  C:\Windows\System\dLmKwuz.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\mDkndLV.exe
  C:\Windows\System\mDkndLV.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\wMBxgzp.exe
  C:\Windows\System\wMBxgzp.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\KDFXwaw.exe
  C:\Windows\System\KDFXwaw.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\OMCFprR.exe
  C:\Windows\System\OMCFprR.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\pvRMAWN.exe
  C:\Windows\System\pvRMAWN.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\pzOmmOE.exe
  C:\Windows\System\pzOmmOE.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\rYpfRfN.exe
  C:\Windows\System\rYpfRfN.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\IFLlANS.exe
  C:\Windows\System\IFLlANS.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\VrzdaWk.exe
  C:\Windows\System\VrzdaWk.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\zyYaSER.exe
  C:\Windows\System\zyYaSER.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\hQrqCjg.exe
  C:\Windows\System\hQrqCjg.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\pxCVFRf.exe
  C:\Windows\System\pxCVFRf.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\SFWGWOh.exe
  C:\Windows\System\SFWGWOh.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\muyIJuD.exe
  C:\Windows\System\muyIJuD.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\XUdzHCU.exe
  C:\Windows\System\XUdzHCU.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\bbUMttj.exe
  C:\Windows\System\bbUMttj.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\KpdCuGL.exe
  C:\Windows\System\KpdCuGL.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\BIKxyRf.exe
  C:\Windows\System\BIKxyRf.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\kpewNgs.exe
  C:\Windows\System\kpewNgs.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\SqnTxaz.exe
  C:\Windows\System\SqnTxaz.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\weBvNEy.exe
  C:\Windows\System\weBvNEy.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\uYdbnGy.exe
  C:\Windows\System\uYdbnGy.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\gqXjmMS.exe
  C:\Windows\System\gqXjmMS.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\CVIDgal.exe
  C:\Windows\System\CVIDgal.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\IEyMKfi.exe
  C:\Windows\System\IEyMKfi.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\ktpeRTM.exe
  C:\Windows\System\ktpeRTM.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\EOYssWY.exe
  C:\Windows\System\EOYssWY.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\kFRdSDe.exe
  C:\Windows\System\kFRdSDe.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\PaTGBLC.exe
  C:\Windows\System\PaTGBLC.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\SUCzqxg.exe
  C:\Windows\System\SUCzqxg.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\WbGTDHJ.exe
  C:\Windows\System\WbGTDHJ.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\zhdZeVb.exe
  C:\Windows\System\zhdZeVb.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\PjjFiJU.exe
  C:\Windows\System\PjjFiJU.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\AscuONT.exe
  C:\Windows\System\AscuONT.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\eOsqnoL.exe
  C:\Windows\System\eOsqnoL.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\znikXos.exe
  C:\Windows\System\znikXos.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\uXTGjtb.exe
  C:\Windows\System\uXTGjtb.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\eiOXpeS.exe
  C:\Windows\System\eiOXpeS.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\WlfBKNR.exe
  C:\Windows\System\WlfBKNR.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\yGZuMVt.exe
  C:\Windows\System\yGZuMVt.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\DkMcZNs.exe
  C:\Windows\System\DkMcZNs.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\MhaSfWH.exe
  C:\Windows\System\MhaSfWH.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\BwVBdmT.exe
  C:\Windows\System\BwVBdmT.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\FQwCWWW.exe
  C:\Windows\System\FQwCWWW.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\sNJnYjH.exe
  C:\Windows\System\sNJnYjH.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\LYtwOgH.exe
  C:\Windows\System\LYtwOgH.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\kSyDgyy.exe
  C:\Windows\System\kSyDgyy.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\geUpAjE.exe
  C:\Windows\System\geUpAjE.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\hGryPiq.exe
  C:\Windows\System\hGryPiq.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\KtXhcpD.exe
  C:\Windows\System\KtXhcpD.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\wNksHlS.exe
  C:\Windows\System\wNksHlS.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\avnDcTu.exe
  C:\Windows\System\avnDcTu.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\reDWwwv.exe
  C:\Windows\System\reDWwwv.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\tQlUNXh.exe
  C:\Windows\System\tQlUNXh.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\ChUCkae.exe
  C:\Windows\System\ChUCkae.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\JgWNgdw.exe
  C:\Windows\System\JgWNgdw.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\zONyEkA.exe
  C:\Windows\System\zONyEkA.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\MIHcfeC.exe
  C:\Windows\System\MIHcfeC.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\SLHxbPs.exe
  C:\Windows\System\SLHxbPs.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\QRrtNeZ.exe
  C:\Windows\System\QRrtNeZ.exe
  2⤵
  PID:2816
- C:\Windows\System\XEPSTIh.exe
  C:\Windows\System\XEPSTIh.exe
  2⤵
  PID:1732
- C:\Windows\System\ffAceFs.exe
  C:\Windows\System\ffAceFs.exe
  2⤵
  PID:4864
- C:\Windows\System\edHiAMP.exe
  C:\Windows\System\edHiAMP.exe
  2⤵
  PID:4508
- C:\Windows\System\QyvvfJK.exe
  C:\Windows\System\QyvvfJK.exe
  2⤵
  PID:4400
- C:\Windows\System\KCVNVrj.exe
  C:\Windows\System\KCVNVrj.exe
  2⤵
  PID:4368
- C:\Windows\System\tcNoSuX.exe
  C:\Windows\System\tcNoSuX.exe
  2⤵
  PID:4716
- C:\Windows\System\CGJLArx.exe
  C:\Windows\System\CGJLArx.exe
  2⤵
  PID:1676
- C:\Windows\System\LMbmdyf.exe
  C:\Windows\System\LMbmdyf.exe
  2⤵
  PID:752
- C:\Windows\System\fDPyqLR.exe
  C:\Windows\System\fDPyqLR.exe
  2⤵
  PID:1304
- C:\Windows\System\iBGbKsA.exe
  C:\Windows\System\iBGbKsA.exe
  2⤵
  PID:1080
- C:\Windows\System\uaHBhSZ.exe
  C:\Windows\System\uaHBhSZ.exe
  2⤵
  PID:3980
- C:\Windows\System\TToHAdF.exe
  C:\Windows\System\TToHAdF.exe
  2⤵
  PID:2812
- C:\Windows\System\hsFNHGk.exe
  C:\Windows\System\hsFNHGk.exe
  2⤵
  PID:4336
- C:\Windows\System\qfWKRun.exe
  C:\Windows\System\qfWKRun.exe
  2⤵
  PID:5124
- C:\Windows\System\vttSXEX.exe
  C:\Windows\System\vttSXEX.exe
  2⤵
  PID:5144
- C:\Windows\System\FhAqZtX.exe
  C:\Windows\System\FhAqZtX.exe
  2⤵
  PID:5172
- C:\Windows\System\SuWPQIX.exe
  C:\Windows\System\SuWPQIX.exe
  2⤵
  PID:5200
- C:\Windows\System\gwMCclx.exe
  C:\Windows\System\gwMCclx.exe
  2⤵
  PID:5228
- C:\Windows\System\ezJbtRq.exe
  C:\Windows\System\ezJbtRq.exe
  2⤵
  PID:5256
- C:\Windows\System\kmtCfAe.exe
  C:\Windows\System\kmtCfAe.exe
  2⤵
  PID:5284
- C:\Windows\System\ZGqeNLG.exe
  C:\Windows\System\ZGqeNLG.exe
  2⤵
  PID:5316
- C:\Windows\System\GgwYVOH.exe
  C:\Windows\System\GgwYVOH.exe
  2⤵
  PID:5340
- C:\Windows\System\LmztlJi.exe
  C:\Windows\System\LmztlJi.exe
  2⤵
  PID:5372
- C:\Windows\System\ICFMxDr.exe
  C:\Windows\System\ICFMxDr.exe
  2⤵
  PID:5400
- C:\Windows\System\jMwkNhE.exe
  C:\Windows\System\jMwkNhE.exe
  2⤵
  PID:5428
- C:\Windows\System\rtSGYEp.exe
  C:\Windows\System\rtSGYEp.exe
  2⤵
  PID:5456
- C:\Windows\System\YfWUvhf.exe
  C:\Windows\System\YfWUvhf.exe
  2⤵
  PID:5480
- C:\Windows\System\goeKpdB.exe
  C:\Windows\System\goeKpdB.exe
  2⤵
  PID:5508
- C:\Windows\System\gIaQIEZ.exe
  C:\Windows\System\gIaQIEZ.exe
  2⤵
  PID:5536
- C:\Windows\System\TlXtbFb.exe
  C:\Windows\System\TlXtbFb.exe
  2⤵
  PID:5564
- C:\Windows\System\RTCZwJk.exe
  C:\Windows\System\RTCZwJk.exe
  2⤵
  PID:5592
- C:\Windows\System\GeuaEeM.exe
  C:\Windows\System\GeuaEeM.exe
  2⤵
  PID:5620
- C:\Windows\System\BuODNjk.exe
  C:\Windows\System\BuODNjk.exe
  2⤵
  PID:5648
- C:\Windows\System\IOlKpjg.exe
  C:\Windows\System\IOlKpjg.exe
  2⤵
  PID:5676
- C:\Windows\System\IcaaUyI.exe
  C:\Windows\System\IcaaUyI.exe
  2⤵
  PID:5704
- C:\Windows\System\WDgwZwI.exe
  C:\Windows\System\WDgwZwI.exe
  2⤵
  PID:5732
- C:\Windows\System\PJeCnVt.exe
  C:\Windows\System\PJeCnVt.exe
  2⤵
  PID:5760
- C:\Windows\System\AJJjMuu.exe
  C:\Windows\System\AJJjMuu.exe
  2⤵
  PID:5788
- C:\Windows\System\jZsvGLB.exe
  C:\Windows\System\jZsvGLB.exe
  2⤵
  PID:5816
- C:\Windows\System\egorORg.exe
  C:\Windows\System\egorORg.exe
  2⤵
  PID:5844
- C:\Windows\System\MpHvSYu.exe
  C:\Windows\System\MpHvSYu.exe
  2⤵
  PID:5872
- C:\Windows\System\THIGdkN.exe
  C:\Windows\System\THIGdkN.exe
  2⤵
  PID:5900
- C:\Windows\System\gnuJyGD.exe
  C:\Windows\System\gnuJyGD.exe
  2⤵
  PID:5928
- C:\Windows\System\qACZPuY.exe
  C:\Windows\System\qACZPuY.exe
  2⤵
  PID:5956
- C:\Windows\System\lGDRava.exe
  C:\Windows\System\lGDRava.exe
  2⤵
  PID:5984
- C:\Windows\System\UijGbbF.exe
  C:\Windows\System\UijGbbF.exe
  2⤵
  PID:6012
- C:\Windows\System\mLqsaph.exe
  C:\Windows\System\mLqsaph.exe
  2⤵
  PID:6044
- C:\Windows\System\xfCmMKh.exe
  C:\Windows\System\xfCmMKh.exe
  2⤵
  PID:6068
- C:\Windows\System\RBEpcmS.exe
  C:\Windows\System\RBEpcmS.exe
  2⤵
  PID:6096
- C:\Windows\System\jaSXTrG.exe
  C:\Windows\System\jaSXTrG.exe
  2⤵
  PID:6124
- C:\Windows\System\fsJjXFD.exe
  C:\Windows\System\fsJjXFD.exe
  2⤵
  PID:4840
- C:\Windows\System\xHDBGAy.exe
  C:\Windows\System\xHDBGAy.exe
  2⤵
  PID:3076
- C:\Windows\System\haSSgfp.exe
  C:\Windows\System\haSSgfp.exe
  2⤵
  PID:3452
- C:\Windows\System\SultGkU.exe
  C:\Windows\System\SultGkU.exe
  2⤵
  PID:5216
- C:\Windows\System\VSZqird.exe
  C:\Windows\System\VSZqird.exe
  2⤵
  PID:5276
- C:\Windows\System\GEiZnur.exe
  C:\Windows\System\GEiZnur.exe
  2⤵
  PID:5384
- C:\Windows\System\dKlBocN.exe
  C:\Windows\System\dKlBocN.exe
  2⤵
  PID:5416
- C:\Windows\System\tuZGGRK.exe
  C:\Windows\System\tuZGGRK.exe
  2⤵
  PID:5520
- C:\Windows\System\sjstcht.exe
  C:\Windows\System\sjstcht.exe
  2⤵
  PID:5552
- C:\Windows\System\UzkhHyI.exe
  C:\Windows\System\UzkhHyI.exe
  2⤵
  PID:5604
- C:\Windows\System\hzZDhLU.exe
  C:\Windows\System\hzZDhLU.exe
  2⤵
  PID:5660
- C:\Windows\System\nrPXGxV.exe
  C:\Windows\System\nrPXGxV.exe
  2⤵
  PID:5724
- C:\Windows\System\mubUkxf.exe
  C:\Windows\System\mubUkxf.exe
  2⤵
  PID:5800
- C:\Windows\System\KQDCUtk.exe
  C:\Windows\System\KQDCUtk.exe
  2⤵
  PID:5856
- C:\Windows\System\xUtbVRr.exe
  C:\Windows\System\xUtbVRr.exe
  2⤵
  PID:5892
- C:\Windows\System\vZWxwkw.exe
  C:\Windows\System\vZWxwkw.exe
  2⤵
  PID:4832
- C:\Windows\System\hlqgbIJ.exe
  C:\Windows\System\hlqgbIJ.exe
  2⤵
  PID:5972
- C:\Windows\System\xWwpyci.exe
  C:\Windows\System\xWwpyci.exe
  2⤵
  PID:6004
- C:\Windows\System\fPfaoDg.exe
  C:\Windows\System\fPfaoDg.exe
  2⤵
  PID:6084
- C:\Windows\System\HHMaXNs.exe
  C:\Windows\System\HHMaXNs.exe
  2⤵
  PID:2080
- C:\Windows\System\JitFNHT.exe
  C:\Windows\System\JitFNHT.exe
  2⤵
  PID:2400
- C:\Windows\System\ZTSLXxl.exe
  C:\Windows\System\ZTSLXxl.exe
  2⤵
  PID:2188
- C:\Windows\System\oTMCtlH.exe
  C:\Windows\System\oTMCtlH.exe
  2⤵
  PID:3124
- C:\Windows\System\ZDNdiNt.exe
  C:\Windows\System\ZDNdiNt.exe
  2⤵
  PID:3080
- C:\Windows\System\PRDGIJo.exe
  C:\Windows\System\PRDGIJo.exe
  2⤵
  PID:4480
- C:\Windows\System\vFoiBrN.exe
  C:\Windows\System\vFoiBrN.exe
  2⤵
  PID:2528
- C:\Windows\System\FTFYPRc.exe
  C:\Windows\System\FTFYPRc.exe
  2⤵
  PID:2084
- C:\Windows\System\jDhpaDt.exe
  C:\Windows\System\jDhpaDt.exe
  2⤵
  PID:4216
- C:\Windows\System\cyTfNPk.exe
  C:\Windows\System\cyTfNPk.exe
  2⤵
  PID:3592
- C:\Windows\System\OzpCspy.exe
  C:\Windows\System\OzpCspy.exe
  2⤵
  PID:4372
- C:\Windows\System\YXxaGlL.exe
  C:\Windows\System\YXxaGlL.exe
  2⤵
  PID:3304
- C:\Windows\System\pdyykKN.exe
  C:\Windows\System\pdyykKN.exe
  2⤵
  PID:4460
- C:\Windows\System\xgCWBnD.exe
  C:\Windows\System\xgCWBnD.exe
  2⤵
  PID:3420
- C:\Windows\System\BFuhuof.exe
  C:\Windows\System\BFuhuof.exe
  2⤵
  PID:2972
- C:\Windows\System\xOoWXgl.exe
  C:\Windows\System\xOoWXgl.exe
  2⤵
  PID:3868
- C:\Windows\System\kiTSSXa.exe
  C:\Windows\System\kiTSSXa.exe
  2⤵
  PID:2428
- C:\Windows\System\OuHQjwZ.exe
  C:\Windows\System\OuHQjwZ.exe
  2⤵
  PID:3408
- C:\Windows\System\CwWUbEy.exe
  C:\Windows\System\CwWUbEy.exe
  2⤵
  PID:2788
- C:\Windows\System\pCkRxsM.exe
  C:\Windows\System\pCkRxsM.exe
  2⤵
  PID:1020
- C:\Windows\System\TFsrdxw.exe
  C:\Windows\System\TFsrdxw.exe
  2⤵
  PID:4148
- C:\Windows\System\ERzpKas.exe
  C:\Windows\System\ERzpKas.exe
  2⤵
  PID:5940
- C:\Windows\System\ZbnzWfy.exe
  C:\Windows\System\ZbnzWfy.exe
  2⤵
  PID:3000
- C:\Windows\System\ILvHIBS.exe
  C:\Windows\System\ILvHIBS.exe
  2⤵
  PID:2636
- C:\Windows\System\OznnYgG.exe
  C:\Windows\System\OznnYgG.exe
  2⤵
  PID:1968
- C:\Windows\System\MNkOBzl.exe
  C:\Windows\System\MNkOBzl.exe
  2⤵
  PID:5192
- C:\Windows\System\YQgLsZH.exe
  C:\Windows\System\YQgLsZH.exe
  2⤵
  PID:5272
- C:\Windows\System\kmQUdKz.exe
  C:\Windows\System\kmQUdKz.exe
  2⤵
  PID:1164
- C:\Windows\System\MNLHhYp.exe
  C:\Windows\System\MNLHhYp.exe
  2⤵
  PID:3236
- C:\Windows\System\TMwQISW.exe
  C:\Windows\System\TMwQISW.exe
  2⤵
  PID:4044
- C:\Windows\System\PcrBRNb.exe
  C:\Windows\System\PcrBRNb.exe
  2⤵
  PID:1692
- C:\Windows\System\YmPbTdf.exe
  C:\Windows\System\YmPbTdf.exe
  2⤵
  PID:2124
- C:\Windows\System\oxIWHjB.exe
  C:\Windows\System\oxIWHjB.exe
  2⤵
  PID:6000
- C:\Windows\System\HMnFGIr.exe
  C:\Windows\System\HMnFGIr.exe
  2⤵
  PID:1504
- C:\Windows\System\rQYhDeT.exe
  C:\Windows\System\rQYhDeT.exe
  2⤵
  PID:5156
- C:\Windows\System\IPqVFOi.exe
  C:\Windows\System\IPqVFOi.exe
  2⤵
  PID:2940
- C:\Windows\System\ZPtbhLZ.exe
  C:\Windows\System\ZPtbhLZ.exe
  2⤵
  PID:1876
- C:\Windows\System\WDGPwIA.exe
  C:\Windows\System\WDGPwIA.exe
  2⤵
  PID:2136
- C:\Windows\System\ACCEKeV.exe
  C:\Windows\System\ACCEKeV.exe
  2⤵
  PID:2496
- C:\Windows\System\faQeREX.exe
  C:\Windows\System\faQeREX.exe
  2⤵
  PID:3956
- C:\Windows\System\BgUkRlv.exe
  C:\Windows\System\BgUkRlv.exe
  2⤵
  PID:4464
- C:\Windows\System\WrVkATZ.exe
  C:\Windows\System\WrVkATZ.exe
  2⤵
  PID:6188
- C:\Windows\System\igRRIqU.exe
  C:\Windows\System\igRRIqU.exe
  2⤵
  PID:6216
- C:\Windows\System\AiTMRoL.exe
  C:\Windows\System\AiTMRoL.exe
  2⤵
  PID:6248
- C:\Windows\System\JjwjFFK.exe
  C:\Windows\System\JjwjFFK.exe
  2⤵
  PID:6280
- C:\Windows\System\PkNdJcF.exe
  C:\Windows\System\PkNdJcF.exe
  2⤵
  PID:6312
- C:\Windows\System\owGutEZ.exe
  C:\Windows\System\owGutEZ.exe
  2⤵
  PID:6336
- C:\Windows\System\BdkOLUL.exe
  C:\Windows\System\BdkOLUL.exe
  2⤵
  PID:6368
- C:\Windows\System\OpOpGbw.exe
  C:\Windows\System\OpOpGbw.exe
  2⤵
  PID:6396
- C:\Windows\System\hmdeGoZ.exe
  C:\Windows\System\hmdeGoZ.exe
  2⤵
  PID:6424
- C:\Windows\System\GoDbFJM.exe
  C:\Windows\System\GoDbFJM.exe
  2⤵
  PID:6452
- C:\Windows\System\SSuRAyc.exe
  C:\Windows\System\SSuRAyc.exe
  2⤵
  PID:6488
- C:\Windows\System\JtMdgNd.exe
  C:\Windows\System\JtMdgNd.exe
  2⤵
  PID:6516
- C:\Windows\System\XzCIbpY.exe
  C:\Windows\System\XzCIbpY.exe
  2⤵
  PID:6536
- C:\Windows\System\eWFuapL.exe
  C:\Windows\System\eWFuapL.exe
  2⤵
  PID:6568
- C:\Windows\System\wfocJTL.exe
  C:\Windows\System\wfocJTL.exe
  2⤵
  PID:6792
- C:\Windows\System\bRaYsbY.exe
  C:\Windows\System\bRaYsbY.exe
  2⤵
  PID:6808
- C:\Windows\System\tiXAlaL.exe
  C:\Windows\System\tiXAlaL.exe
  2⤵
  PID:6832
- C:\Windows\System\kWJWOUp.exe
  C:\Windows\System\kWJWOUp.exe
  2⤵
  PID:6884
- C:\Windows\System\mASmIgo.exe
  C:\Windows\System\mASmIgo.exe
  2⤵
  PID:6916
- C:\Windows\System\dQpiCmy.exe
  C:\Windows\System\dQpiCmy.exe
  2⤵
  PID:6944
- C:\Windows\System\HoCKggw.exe
  C:\Windows\System\HoCKggw.exe
  2⤵
  PID:6988
- C:\Windows\System\yxANKgQ.exe
  C:\Windows\System\yxANKgQ.exe
  2⤵
  PID:7016
- C:\Windows\System\UOnmBHF.exe
  C:\Windows\System\UOnmBHF.exe
  2⤵
  PID:7044
- C:\Windows\System\egDLehQ.exe
  C:\Windows\System\egDLehQ.exe
  2⤵
  PID:7072
- C:\Windows\System\SVcHXxC.exe
  C:\Windows\System\SVcHXxC.exe
  2⤵
  PID:7100
- C:\Windows\System\UUOOvMa.exe
  C:\Windows\System\UUOOvMa.exe
  2⤵
  PID:7132
- C:\Windows\System\YrtWdWX.exe
  C:\Windows\System\YrtWdWX.exe
  2⤵
  PID:7160
- C:\Windows\System\rucgCPQ.exe
  C:\Windows\System\rucgCPQ.exe
  2⤵
  PID:5248
- C:\Windows\System\LKkitxD.exe
  C:\Windows\System\LKkitxD.exe
  2⤵
  PID:6204
- C:\Windows\System\vUwziDj.exe
  C:\Windows\System\vUwziDj.exe
  2⤵
  PID:6272
- C:\Windows\System\FkvueAb.exe
  C:\Windows\System\FkvueAb.exe
  2⤵
  PID:6344
- C:\Windows\System\vBintNr.exe
  C:\Windows\System\vBintNr.exe
  2⤵
  PID:6408
- C:\Windows\System\ckVengf.exe
  C:\Windows\System\ckVengf.exe
  2⤵
  PID:6480
- C:\Windows\System\bMqVNBN.exe
  C:\Windows\System\bMqVNBN.exe
  2⤵
  PID:6532
- C:\Windows\System\hUsJlkJ.exe
  C:\Windows\System\hUsJlkJ.exe
  2⤵
  PID:6596
- C:\Windows\System\xrTbIxm.exe
  C:\Windows\System\xrTbIxm.exe
  2⤵
  PID:6620
- C:\Windows\System\tcVAIyU.exe
  C:\Windows\System\tcVAIyU.exe
  2⤵
  PID:6644
- C:\Windows\System\kJawJPB.exe
  C:\Windows\System\kJawJPB.exe
  2⤵
  PID:6664
- C:\Windows\System\avFFkhL.exe
  C:\Windows\System\avFFkhL.exe
  2⤵
  PID:6704
- C:\Windows\System\TXZbaRs.exe
  C:\Windows\System\TXZbaRs.exe
  2⤵
  PID:6728
- C:\Windows\System\jXPcRiO.exe
  C:\Windows\System\jXPcRiO.exe
  2⤵
  PID:6752
- C:\Windows\System\MIzvgtR.exe
  C:\Windows\System\MIzvgtR.exe
  2⤵
  PID:6788
- C:\Windows\System\dIPMKie.exe
  C:\Windows\System\dIPMKie.exe
  2⤵
  PID:6848
- C:\Windows\System\COZgTce.exe
  C:\Windows\System\COZgTce.exe
  2⤵
  PID:6776
- C:\Windows\System\RuehkcV.exe
  C:\Windows\System\RuehkcV.exe
  2⤵
  PID:6932
- C:\Windows\System\QOkYfrK.exe
  C:\Windows\System\QOkYfrK.exe
  2⤵
  PID:7004
- C:\Windows\System\dUeJAnA.exe
  C:\Windows\System\dUeJAnA.exe
  2⤵
  PID:7084
- C:\Windows\System\qMckzzt.exe
  C:\Windows\System\qMckzzt.exe
  2⤵
  PID:3520
- C:\Windows\System\ayiVCSI.exe
  C:\Windows\System\ayiVCSI.exe
  2⤵
  PID:6244
- C:\Windows\System\OtcjnUE.exe
  C:\Windows\System\OtcjnUE.exe
  2⤵
  PID:6392
- C:\Windows\System\bmNHyyQ.exe
  C:\Windows\System\bmNHyyQ.exe
  2⤵
  PID:6544
- C:\Windows\System\QIqZOGQ.exe
  C:\Windows\System\QIqZOGQ.exe
  2⤵
  PID:6628
- C:\Windows\System\uuwtTaN.exe
  C:\Windows\System\uuwtTaN.exe
  2⤵
  PID:6652
- C:\Windows\System\ztJfCUU.exe
  C:\Windows\System\ztJfCUU.exe
  2⤵
  PID:6736
- C:\Windows\System\yYyOZxw.exe
  C:\Windows\System\yYyOZxw.exe
  2⤵
  PID:6804
- C:\Windows\System\RbpxqtP.exe
  C:\Windows\System\RbpxqtP.exe
  2⤵
  PID:3932
- C:\Windows\System\GAGISvo.exe
  C:\Windows\System\GAGISvo.exe
  2⤵
  PID:6308
- C:\Windows\System\MapeXLC.exe
  C:\Windows\System\MapeXLC.exe
  2⤵
  PID:6580
- C:\Windows\System\MxxgBqF.exe
  C:\Windows\System\MxxgBqF.exe
  2⤵
  PID:6716
- C:\Windows\System\DUipmFz.exe
  C:\Windows\System\DUipmFz.exe
  2⤵
  PID:7068
- C:\Windows\System\JKUBUdZ.exe
  C:\Windows\System\JKUBUdZ.exe
  2⤵
  PID:3216
- C:\Windows\System\xJaxOjo.exe
  C:\Windows\System\xJaxOjo.exe
  2⤵
  PID:4856
- C:\Windows\System\zwWGjlo.exe
  C:\Windows\System\zwWGjlo.exe
  2⤵
  PID:7184
- C:\Windows\System\exoOSCB.exe
  C:\Windows\System\exoOSCB.exe
  2⤵
  PID:7212
- C:\Windows\System\FWlJafG.exe
  C:\Windows\System\FWlJafG.exe
  2⤵
  PID:7240
- C:\Windows\System\YPpwbSr.exe
  C:\Windows\System\YPpwbSr.exe
  2⤵
  PID:7260
- C:\Windows\System\SHKAisp.exe
  C:\Windows\System\SHKAisp.exe
  2⤵
  PID:7296
- C:\Windows\System\CxpsAlN.exe
  C:\Windows\System\CxpsAlN.exe
  2⤵
  PID:7324
- C:\Windows\System\LTXzNum.exe
  C:\Windows\System\LTXzNum.exe
  2⤵
  PID:7352
- C:\Windows\System\vecwpGG.exe
  C:\Windows\System\vecwpGG.exe
  2⤵
  PID:7380
- C:\Windows\System\yqboxxl.exe
  C:\Windows\System\yqboxxl.exe
  2⤵
  PID:7408
- C:\Windows\System\njsDpfF.exe
  C:\Windows\System\njsDpfF.exe
  2⤵
  PID:7436
- C:\Windows\System\LfhqzuH.exe
  C:\Windows\System\LfhqzuH.exe
  2⤵
  PID:7464
- C:\Windows\System\INuMpFV.exe
  C:\Windows\System\INuMpFV.exe
  2⤵
  PID:7492
- C:\Windows\System\iGGPVDc.exe
  C:\Windows\System\iGGPVDc.exe
  2⤵
  PID:7512
- C:\Windows\System\HfbFuXh.exe
  C:\Windows\System\HfbFuXh.exe
  2⤵
  PID:7536
- C:\Windows\System\SldFcIL.exe
  C:\Windows\System\SldFcIL.exe
  2⤵
  PID:7568
- C:\Windows\System\CtiYiun.exe
  C:\Windows\System\CtiYiun.exe
  2⤵
  PID:7608
- C:\Windows\System\rtQHkWv.exe
  C:\Windows\System\rtQHkWv.exe
  2⤵
  PID:7636
- C:\Windows\System\PsKZZSK.exe
  C:\Windows\System\PsKZZSK.exe
  2⤵
  PID:7664
- C:\Windows\System\yJTxqQF.exe
  C:\Windows\System\yJTxqQF.exe
  2⤵
  PID:7692
- C:\Windows\System\bmcFTvv.exe
  C:\Windows\System\bmcFTvv.exe
  2⤵
  PID:7716
- C:\Windows\System\uAstgeh.exe
  C:\Windows\System\uAstgeh.exe
  2⤵
  PID:7740
- C:\Windows\System\BXHARRa.exe
  C:\Windows\System\BXHARRa.exe
  2⤵
  PID:7768
- C:\Windows\System\HdpSAAJ.exe
  C:\Windows\System\HdpSAAJ.exe
  2⤵
  PID:7796
- C:\Windows\System\dVEVjOE.exe
  C:\Windows\System\dVEVjOE.exe
  2⤵
  PID:7820
- C:\Windows\System\GzwxZzS.exe
  C:\Windows\System\GzwxZzS.exe
  2⤵
  PID:7860
- C:\Windows\System\xzNjLQR.exe
  C:\Windows\System\xzNjLQR.exe
  2⤵
  PID:7888
- C:\Windows\System\SBaTmhA.exe
  C:\Windows\System\SBaTmhA.exe
  2⤵
  PID:7916
- C:\Windows\System\beIwKfe.exe
  C:\Windows\System\beIwKfe.exe
  2⤵
  PID:7944
- C:\Windows\System\ToOctFg.exe
  C:\Windows\System\ToOctFg.exe
  2⤵
  PID:7972
- C:\Windows\System\YkvFsIJ.exe
  C:\Windows\System\YkvFsIJ.exe
  2⤵
  PID:8000
- C:\Windows\System\FGDxdMa.exe
  C:\Windows\System\FGDxdMa.exe
  2⤵
  PID:8028
- C:\Windows\System\RWIkwVu.exe
  C:\Windows\System\RWIkwVu.exe
  2⤵
  PID:8056
- C:\Windows\System\LjqAfEa.exe
  C:\Windows\System\LjqAfEa.exe
  2⤵
  PID:8076
- C:\Windows\System\dJIZoON.exe
  C:\Windows\System\dJIZoON.exe
  2⤵
  PID:8100
- C:\Windows\System\CZyJuDj.exe
  C:\Windows\System\CZyJuDj.exe
  2⤵
  PID:8120
- C:\Windows\System\xaGTpFb.exe
  C:\Windows\System\xaGTpFb.exe
  2⤵
  PID:8152
- C:\Windows\System\FxueRYo.exe
  C:\Windows\System\FxueRYo.exe
  2⤵
  PID:8188
- C:\Windows\System\PVQspex.exe
  C:\Windows\System\PVQspex.exe
  2⤵
  PID:7208
- C:\Windows\System\yNCGill.exe
  C:\Windows\System\yNCGill.exe
  2⤵
  PID:7288
- C:\Windows\System\pgOFNwZ.exe
  C:\Windows\System\pgOFNwZ.exe
  2⤵
  PID:7348
- C:\Windows\System\jHaXPHV.exe
  C:\Windows\System\jHaXPHV.exe
  2⤵
  PID:7368
- C:\Windows\System\SxrPYmi.exe
  C:\Windows\System\SxrPYmi.exe
  2⤵
  PID:7428
- C:\Windows\System\ibOpPRF.exe
  C:\Windows\System\ibOpPRF.exe
  2⤵
  PID:7484
- C:\Windows\System\QiTVErM.exe
  C:\Windows\System\QiTVErM.exe
  2⤵
  PID:7548
- C:\Windows\System\gzFAjhS.exe
  C:\Windows\System\gzFAjhS.exe
  2⤵
  PID:7620
- C:\Windows\System\LKtXxKN.exe
  C:\Windows\System\LKtXxKN.exe
  2⤵
  PID:7704
- C:\Windows\System\qBeIQiy.exe
  C:\Windows\System\qBeIQiy.exe
  2⤵
  PID:7776
- C:\Windows\System\JqFbZJu.exe
  C:\Windows\System\JqFbZJu.exe
  2⤵
  PID:7856
- C:\Windows\System\OSfaeUc.exe
  C:\Windows\System\OSfaeUc.exe
  2⤵
  PID:7884
- C:\Windows\System\XSbEVNw.exe
  C:\Windows\System\XSbEVNw.exe
  2⤵
  PID:7964
- C:\Windows\System\THvJAAN.exe
  C:\Windows\System\THvJAAN.exe
  2⤵
  PID:8040
- C:\Windows\System\dUCaRrx.exe
  C:\Windows\System\dUCaRrx.exe
  2⤵
  PID:8108
- C:\Windows\System\guiToAz.exe
  C:\Windows\System\guiToAz.exe
  2⤵
  PID:8128
- C:\Windows\System\dyrILHw.exe
  C:\Windows\System\dyrILHw.exe
  2⤵
  PID:7224
- C:\Windows\System\KeVVEyC.exe
  C:\Windows\System\KeVVEyC.exe
  2⤵
  PID:1668
- C:\Windows\System\BbOOfmy.exe
  C:\Windows\System\BbOOfmy.exe
  2⤵
  PID:7452
- C:\Windows\System\kwGVuFU.exe
  C:\Windows\System\kwGVuFU.exe
  2⤵
  PID:6616
- C:\Windows\System\CLTnTWh.exe
  C:\Windows\System\CLTnTWh.exe
  2⤵
  PID:7784
- C:\Windows\System\TUUYjwm.exe
  C:\Windows\System\TUUYjwm.exe
  2⤵
  PID:7876
- C:\Windows\System\hicqhkc.exe
  C:\Windows\System\hicqhkc.exe
  2⤵
  PID:7988
- C:\Windows\System\dbrhWMB.exe
  C:\Windows\System\dbrhWMB.exe
  2⤵
  PID:7176
- C:\Windows\System\jYzILcC.exe
  C:\Windows\System\jYzILcC.exe
  2⤵
  PID:7524
- C:\Windows\System\JnQqILZ.exe
  C:\Windows\System\JnQqILZ.exe
  2⤵
  PID:7940
- C:\Windows\System\knKLKyY.exe
  C:\Windows\System\knKLKyY.exe
  2⤵
  PID:7344
- C:\Windows\System\SBDlQXN.exe
  C:\Windows\System\SBDlQXN.exe
  2⤵
  PID:7836
- C:\Windows\System\wtFjyQm.exe
  C:\Windows\System\wtFjyQm.exe
  2⤵
  PID:8208
- C:\Windows\System\WtgjtqN.exe
  C:\Windows\System\WtgjtqN.exe
  2⤵
  PID:8240
- C:\Windows\System\mAQugGZ.exe
  C:\Windows\System\mAQugGZ.exe
  2⤵
  PID:8268
- C:\Windows\System\vYMVwSR.exe
  C:\Windows\System\vYMVwSR.exe
  2⤵
  PID:8304
- C:\Windows\System\Vjmvwwh.exe
  C:\Windows\System\Vjmvwwh.exe
  2⤵
  PID:8324
- C:\Windows\System\YofsYlq.exe
  C:\Windows\System\YofsYlq.exe
  2⤵
  PID:8356
- C:\Windows\System\EbFYxKp.exe
  C:\Windows\System\EbFYxKp.exe
  2⤵
  PID:8388
- C:\Windows\System\UBbGOma.exe
  C:\Windows\System\UBbGOma.exe
  2⤵
  PID:8404
- C:\Windows\System\pODtPOx.exe
  C:\Windows\System\pODtPOx.exe
  2⤵
  PID:8432
- C:\Windows\System\IEMAjXr.exe
  C:\Windows\System\IEMAjXr.exe
  2⤵
  PID:8456
- C:\Windows\System\pgeTkMi.exe
  C:\Windows\System\pgeTkMi.exe
  2⤵
  PID:8480
- C:\Windows\System\gWDRnhr.exe
  C:\Windows\System\gWDRnhr.exe
  2⤵
  PID:8512
- C:\Windows\System\XypiAzP.exe
  C:\Windows\System\XypiAzP.exe
  2⤵
  PID:8556
- C:\Windows\System\qNKikER.exe
  C:\Windows\System\qNKikER.exe
  2⤵
  PID:8584
- C:\Windows\System\pwagWUE.exe
  C:\Windows\System\pwagWUE.exe
  2⤵
  PID:8604
- C:\Windows\System\rdBypOJ.exe
  C:\Windows\System\rdBypOJ.exe
  2⤵
  PID:8632
- C:\Windows\System\EmrpMpZ.exe
  C:\Windows\System\EmrpMpZ.exe
  2⤵
  PID:8656
- C:\Windows\System\iRCQFVA.exe
  C:\Windows\System\iRCQFVA.exe
  2⤵
  PID:8692
- C:\Windows\System\ygUIOWI.exe
  C:\Windows\System\ygUIOWI.exe
  2⤵
  PID:8716
- C:\Windows\System\RoZhwZQ.exe
  C:\Windows\System\RoZhwZQ.exe
  2⤵
  PID:8752
- C:\Windows\System\gqoctHb.exe
  C:\Windows\System\gqoctHb.exe
  2⤵
  PID:8776
- C:\Windows\System\LVxObgT.exe
  C:\Windows\System\LVxObgT.exe
  2⤵
  PID:8796
- C:\Windows\System\iAILIvB.exe
  C:\Windows\System\iAILIvB.exe
  2⤵
  PID:8824
- C:\Windows\System\FLfXTwv.exe
  C:\Windows\System\FLfXTwv.exe
  2⤵
  PID:8844
- C:\Windows\System\hQwngQt.exe
  C:\Windows\System\hQwngQt.exe
  2⤵
  PID:8880
- C:\Windows\System\BFoUFHr.exe
  C:\Windows\System\BFoUFHr.exe
  2⤵
  PID:8908
- C:\Windows\System\HnEacCn.exe
  C:\Windows\System\HnEacCn.exe
  2⤵
  PID:8936
- C:\Windows\System\IoyHSyH.exe
  C:\Windows\System\IoyHSyH.exe
  2⤵
  PID:8960
- C:\Windows\System\Hvdaiyv.exe
  C:\Windows\System\Hvdaiyv.exe
  2⤵
  PID:8980
- C:\Windows\System\WsLfkQg.exe
  C:\Windows\System\WsLfkQg.exe
  2⤵
  PID:9032
- C:\Windows\System\CYvTDmb.exe
  C:\Windows\System\CYvTDmb.exe
  2⤵
  PID:9060
- C:\Windows\System\lVXUjbh.exe
  C:\Windows\System\lVXUjbh.exe
  2⤵
  PID:9080
- C:\Windows\System\rXcRJMW.exe
  C:\Windows\System\rXcRJMW.exe
  2⤵
  PID:9104
- C:\Windows\System\yPnGdwh.exe
  C:\Windows\System\yPnGdwh.exe
  2⤵
  PID:9128
- C:\Windows\System\UWvggxZ.exe
  C:\Windows\System\UWvggxZ.exe
  2⤵
  PID:9160
- C:\Windows\System\fawXpfo.exe
  C:\Windows\System\fawXpfo.exe
  2⤵
  PID:9184
- C:\Windows\System\EndbHRi.exe
  C:\Windows\System\EndbHRi.exe
  2⤵
  PID:9212
- C:\Windows\System\XlgCqIC.exe
  C:\Windows\System\XlgCqIC.exe
  2⤵
  PID:8204
- C:\Windows\System\SAmnRXm.exe
  C:\Windows\System\SAmnRXm.exe
  2⤵
  PID:8260
- C:\Windows\System\FViEBAC.exe
  C:\Windows\System\FViEBAC.exe
  2⤵
  PID:8332
- C:\Windows\System\OOMSxwE.exe
  C:\Windows\System\OOMSxwE.exe
  2⤵
  PID:8376
- C:\Windows\System\BApnXHZ.exe
  C:\Windows\System\BApnXHZ.exe
  2⤵
  PID:8420
- C:\Windows\System\kHwamoa.exe
  C:\Windows\System\kHwamoa.exe
  2⤵
  PID:8536
- C:\Windows\System\qVzGFSj.exe
  C:\Windows\System\qVzGFSj.exe
  2⤵
  PID:8568
- C:\Windows\System\HvCnYRO.exe
  C:\Windows\System\HvCnYRO.exe
  2⤵
  PID:8704
- C:\Windows\System\IPUGQbO.exe
  C:\Windows\System\IPUGQbO.exe
  2⤵
  PID:8760
- C:\Windows\System\mdlvwVR.exe
  C:\Windows\System\mdlvwVR.exe
  2⤵
  PID:8856
- C:\Windows\System\NEmDaSt.exe
  C:\Windows\System\NEmDaSt.exe
  2⤵
  PID:8928
- C:\Windows\System\kTvPGQi.exe
  C:\Windows\System\kTvPGQi.exe
  2⤵
  PID:8996
- C:\Windows\System\zVQOPYL.exe
  C:\Windows\System\zVQOPYL.exe
  2⤵
  PID:9012
- C:\Windows\System\ZxeUdGq.exe
  C:\Windows\System\ZxeUdGq.exe
  2⤵
  PID:9100
- C:\Windows\System\UyzsaZb.exe
  C:\Windows\System\UyzsaZb.exe
  2⤵
  PID:9120
- C:\Windows\System\OBFQVOj.exe
  C:\Windows\System\OBFQVOj.exe
  2⤵
  PID:9208
- C:\Windows\System\CJskMiA.exe
  C:\Windows\System\CJskMiA.exe
  2⤵
  PID:8448
- C:\Windows\System\epwfspi.exe
  C:\Windows\System\epwfspi.exe
  2⤵
  PID:8620
- C:\Windows\System\TvIHGyx.exe
  C:\Windows\System\TvIHGyx.exe
  2⤵
  PID:8700
- C:\Windows\System\oKnUWwf.exe
  C:\Windows\System\oKnUWwf.exe
  2⤵
  PID:8840
- C:\Windows\System\jzuCQLm.exe
  C:\Windows\System\jzuCQLm.exe
  2⤵
  PID:9004
- C:\Windows\System\TIchSGC.exe
  C:\Windows\System\TIchSGC.exe
  2⤵
  PID:9116
- C:\Windows\System\mqVmDsC.exe
  C:\Windows\System\mqVmDsC.exe
  2⤵
  PID:8348
- C:\Windows\System\VVXkiWY.exe
  C:\Windows\System\VVXkiWY.exe
  2⤵
  PID:8816
- C:\Windows\System\ZxlFyJN.exe
  C:\Windows\System\ZxlFyJN.exe
  2⤵
  PID:9088
- C:\Windows\System\OlJqLcu.exe
  C:\Windows\System\OlJqLcu.exe
  2⤵
  PID:8744
- C:\Windows\System\bXgzXhG.exe
  C:\Windows\System\bXgzXhG.exe
  2⤵
  PID:9200
- C:\Windows\System\SGszACL.exe
  C:\Windows\System\SGszACL.exe
  2⤵
  PID:9236
- C:\Windows\System\utTSZiC.exe
  C:\Windows\System\utTSZiC.exe
  2⤵
  PID:9268
- C:\Windows\System\ZEwytCH.exe
  C:\Windows\System\ZEwytCH.exe
  2⤵
  PID:9296
- C:\Windows\System\rOSsbOe.exe
  C:\Windows\System\rOSsbOe.exe
  2⤵
  PID:9324
- C:\Windows\System\fFiGUwC.exe
  C:\Windows\System\fFiGUwC.exe
  2⤵
  PID:9352
- C:\Windows\System\OSsEJgH.exe
  C:\Windows\System\OSsEJgH.exe
  2⤵
  PID:9380
- C:\Windows\System\HFnsiMV.exe
  C:\Windows\System\HFnsiMV.exe
  2⤵
  PID:9456
- C:\Windows\System\WKGbdgD.exe
  C:\Windows\System\WKGbdgD.exe
  2⤵
  PID:9476
- C:\Windows\System\rAdKjyk.exe
  C:\Windows\System\rAdKjyk.exe
  2⤵
  PID:9512
- C:\Windows\System\sAjqxaI.exe
  C:\Windows\System\sAjqxaI.exe
  2⤵
  PID:9540
- C:\Windows\System\oCkeyzS.exe
  C:\Windows\System\oCkeyzS.exe
  2⤵
  PID:9564
- C:\Windows\System\VrLRRhr.exe
  C:\Windows\System\VrLRRhr.exe
  2⤵
  PID:9584
- C:\Windows\System\LVPFkmG.exe
  C:\Windows\System\LVPFkmG.exe
  2⤵
  PID:9624
- C:\Windows\System\yfZdrof.exe
  C:\Windows\System\yfZdrof.exe
  2⤵
  PID:9652
- C:\Windows\System\voGYTuk.exe
  C:\Windows\System\voGYTuk.exe
  2⤵
  PID:9680
- C:\Windows\System\XvscZhs.exe
  C:\Windows\System\XvscZhs.exe
  2⤵
  PID:9708
- C:\Windows\System\SGCPigG.exe
  C:\Windows\System\SGCPigG.exe
  2⤵
  PID:9736
- C:\Windows\System\VgIvjsx.exe
  C:\Windows\System\VgIvjsx.exe
  2⤵
  PID:9772
- C:\Windows\System\SkDhEuV.exe
  C:\Windows\System\SkDhEuV.exe
  2⤵
  PID:9788
- C:\Windows\System\qIBfgbd.exe
  C:\Windows\System\qIBfgbd.exe
  2⤵
  PID:9808
- C:\Windows\System\aNhZlDe.exe
  C:\Windows\System\aNhZlDe.exe
  2⤵
  PID:9824
- C:\Windows\System\IaahYUE.exe
  C:\Windows\System\IaahYUE.exe
  2⤵
  PID:9848
- C:\Windows\System\fIDqyBH.exe
  C:\Windows\System\fIDqyBH.exe
  2⤵
  PID:9876
- C:\Windows\System\McMlAYr.exe
  C:\Windows\System\McMlAYr.exe
  2⤵
  PID:9932
- C:\Windows\System\NbwNDzE.exe
  C:\Windows\System\NbwNDzE.exe
  2⤵
  PID:9956
- C:\Windows\System\OEeCBsz.exe
  C:\Windows\System\OEeCBsz.exe
  2⤵
  PID:9988
- C:\Windows\System\PupHoSb.exe
  C:\Windows\System\PupHoSb.exe
  2⤵
  PID:10016
- C:\Windows\System\rNmTTtD.exe
  C:\Windows\System\rNmTTtD.exe
  2⤵
  PID:10032
- C:\Windows\System\pKPBoHv.exe
  C:\Windows\System\pKPBoHv.exe
  2⤵
  PID:10052
- C:\Windows\System\NTpppoi.exe
  C:\Windows\System\NTpppoi.exe
  2⤵
  PID:10084
- C:\Windows\System\xXeeGsC.exe
  C:\Windows\System\xXeeGsC.exe
  2⤵
  PID:10108
- C:\Windows\System\rgGImff.exe
  C:\Windows\System\rgGImff.exe
  2⤵
  PID:10140
- C:\Windows\System\esZBUub.exe
  C:\Windows\System\esZBUub.exe
  2⤵
  PID:10164
- C:\Windows\System\yUcQpDw.exe
  C:\Windows\System\yUcQpDw.exe
  2⤵
  PID:10188
- C:\Windows\System\rByZmxz.exe
  C:\Windows\System\rByZmxz.exe
  2⤵
  PID:10228
- C:\Windows\System\vndWCET.exe
  C:\Windows\System\vndWCET.exe
  2⤵
  PID:9224
- C:\Windows\System\MhFPmnw.exe
  C:\Windows\System\MhFPmnw.exe
  2⤵
  PID:9312
- C:\Windows\System\lPsihvC.exe
  C:\Windows\System\lPsihvC.exe
  2⤵
  PID:9372
- C:\Windows\System\tUteqwR.exe
  C:\Windows\System\tUteqwR.exe
  2⤵
  PID:9496
- C:\Windows\System\Htrhmuv.exe
  C:\Windows\System\Htrhmuv.exe
  2⤵
  PID:9572
- C:\Windows\System\vlGYVhG.exe
  C:\Windows\System\vlGYVhG.exe
  2⤵
  PID:9648
- C:\Windows\System\tBgiHTP.exe
  C:\Windows\System\tBgiHTP.exe
  2⤵
  PID:9696
- C:\Windows\System\sBrzDqw.exe
  C:\Windows\System\sBrzDqw.exe
  2⤵
  PID:9760
- C:\Windows\System\eglosaK.exe
  C:\Windows\System\eglosaK.exe
  2⤵
  PID:9836
- C:\Windows\System\CAdcUCc.exe
  C:\Windows\System\CAdcUCc.exe
  2⤵
  PID:9860
- C:\Windows\System\fOHPihi.exe
  C:\Windows\System\fOHPihi.exe
  2⤵
  PID:9972
- C:\Windows\System\pBBYsXJ.exe
  C:\Windows\System\pBBYsXJ.exe
  2⤵
  PID:10072
- C:\Windows\System\HHmqeMp.exe
  C:\Windows\System\HHmqeMp.exe
  2⤵
  PID:10076
- C:\Windows\System\OyNiNjD.exe
  C:\Windows\System\OyNiNjD.exe
  2⤵
  PID:10180
- C:\Windows\System\QLgAyGL.exe
  C:\Windows\System\QLgAyGL.exe
  2⤵
  PID:9264
- C:\Windows\System\qkXZhRz.exe
  C:\Windows\System\qkXZhRz.exe
  2⤵
  PID:9452
- C:\Windows\System\yngmRHw.exe
  C:\Windows\System\yngmRHw.exe
  2⤵
  PID:9676
- C:\Windows\System\Zdqiofi.exe
  C:\Windows\System\Zdqiofi.exe
  2⤵
  PID:9664
- C:\Windows\System\LNwrSqZ.exe
  C:\Windows\System\LNwrSqZ.exe
  2⤵
  PID:9756
- C:\Windows\System\pyRkPzY.exe
  C:\Windows\System\pyRkPzY.exe
  2⤵
  PID:9916
- C:\Windows\System\XbfYwqF.exe
  C:\Windows\System\XbfYwqF.exe
  2⤵
  PID:10156
- C:\Windows\System\XqMAtew.exe
  C:\Windows\System\XqMAtew.exe
  2⤵
  PID:9620
- C:\Windows\System\uHkEupP.exe
  C:\Windows\System\uHkEupP.exe
  2⤵
  PID:9920
- C:\Windows\System\mIKnOvg.exe
  C:\Windows\System\mIKnOvg.exe
  2⤵
  PID:10160
- C:\Windows\System\VBrxEeB.exe
  C:\Windows\System\VBrxEeB.exe
  2⤵
  PID:9604
- C:\Windows\System\uCTlVeK.exe
  C:\Windows\System\uCTlVeK.exe
  2⤵
  PID:10184
- C:\Windows\System\KGswSHl.exe
  C:\Windows\System\KGswSHl.exe
  2⤵
  PID:10280
- C:\Windows\System\rAjfZrC.exe
  C:\Windows\System\rAjfZrC.exe
  2⤵
  PID:10308
- C:\Windows\System\HgIQViq.exe
  C:\Windows\System\HgIQViq.exe
  2⤵
  PID:10332
- C:\Windows\System\NVYyVog.exe
  C:\Windows\System\NVYyVog.exe
  2⤵
  PID:10360
- C:\Windows\System\xhhGOIo.exe
  C:\Windows\System\xhhGOIo.exe
  2⤵
  PID:10388
- C:\Windows\System\BehOPWw.exe
  C:\Windows\System\BehOPWw.exe
  2⤵
  PID:10408
- C:\Windows\System\RnfLiop.exe
  C:\Windows\System\RnfLiop.exe
  2⤵
  PID:10436
- C:\Windows\System\YbCnoeV.exe
  C:\Windows\System\YbCnoeV.exe
  2⤵
  PID:10476
- C:\Windows\System\Qnzfpcr.exe
  C:\Windows\System\Qnzfpcr.exe
  2⤵
  PID:10504
- C:\Windows\System\RncynIb.exe
  C:\Windows\System\RncynIb.exe
  2⤵
  PID:10524
- C:\Windows\System\lJiyPZA.exe
  C:\Windows\System\lJiyPZA.exe
  2⤵
  PID:10560
- C:\Windows\System\uUgyiaQ.exe
  C:\Windows\System\uUgyiaQ.exe
  2⤵
  PID:10588
- C:\Windows\System\uNdebzT.exe
  C:\Windows\System\uNdebzT.exe
  2⤵
  PID:10616
- C:\Windows\System\WWnIKzF.exe
  C:\Windows\System\WWnIKzF.exe
  2⤵
  PID:10648
- C:\Windows\System\JYeigkE.exe
  C:\Windows\System\JYeigkE.exe
  2⤵
  PID:10676
- C:\Windows\System\YUBUIyj.exe
  C:\Windows\System\YUBUIyj.exe
  2⤵
  PID:10704
- C:\Windows\System\PsZYoEB.exe
  C:\Windows\System\PsZYoEB.exe
  2⤵
  PID:10732
- C:\Windows\System\rHmONRh.exe
  C:\Windows\System\rHmONRh.exe
  2⤵
  PID:10756
- C:\Windows\System\kPddwRi.exe
  C:\Windows\System\kPddwRi.exe
  2⤵
  PID:10776
- C:\Windows\System\wvHFbrU.exe
  C:\Windows\System\wvHFbrU.exe
  2⤵
  PID:10812
- C:\Windows\System\eQPkrRg.exe
  C:\Windows\System\eQPkrRg.exe
  2⤵
  PID:10844
- C:\Windows\System\XaDaQpd.exe
  C:\Windows\System\XaDaQpd.exe
  2⤵
  PID:10864
- C:\Windows\System\xBSaemg.exe
  C:\Windows\System\xBSaemg.exe
  2⤵
  PID:10896
- C:\Windows\System\TgmziZT.exe
  C:\Windows\System\TgmziZT.exe
  2⤵
  PID:10916
- C:\Windows\System\RJlXXYZ.exe
  C:\Windows\System\RJlXXYZ.exe
  2⤵
  PID:10948
- C:\Windows\System\uMGqhug.exe
  C:\Windows\System\uMGqhug.exe
  2⤵
  PID:10976
- C:\Windows\System\sIyxIlC.exe
  C:\Windows\System\sIyxIlC.exe
  2⤵
  PID:11000
- C:\Windows\System\KZXjgzr.exe
  C:\Windows\System\KZXjgzr.exe
  2⤵
  PID:11020
- C:\Windows\System\uIkpNaC.exe
  C:\Windows\System\uIkpNaC.exe
  2⤵
  PID:11040
- C:\Windows\System\sQQjnKy.exe
  C:\Windows\System\sQQjnKy.exe
  2⤵
  PID:11064
- C:\Windows\System\adxESSV.exe
  C:\Windows\System\adxESSV.exe
  2⤵
  PID:11092
- C:\Windows\System\tBRxjWR.exe
  C:\Windows\System\tBRxjWR.exe
  2⤵
  PID:11108
- C:\Windows\System\ARpZNkf.exe
  C:\Windows\System\ARpZNkf.exe
  2⤵
  PID:11140
- C:\Windows\System\bpdXqRi.exe
  C:\Windows\System\bpdXqRi.exe
  2⤵
  PID:11192
- C:\Windows\System\XKyjPTx.exe
  C:\Windows\System\XKyjPTx.exe
  2⤵
  PID:11228
- C:\Windows\System\duFAiMb.exe
  C:\Windows\System\duFAiMb.exe
  2⤵
  PID:9308
- C:\Windows\System\jWEHqRC.exe
  C:\Windows\System\jWEHqRC.exe
  2⤵
  PID:10300
- C:\Windows\System\nuOgeWo.exe
  C:\Windows\System\nuOgeWo.exe
  2⤵
  PID:10380
- C:\Windows\System\bBKencH.exe
  C:\Windows\System\bBKencH.exe
  2⤵
  PID:10404
- C:\Windows\System\yPNRFqF.exe
  C:\Windows\System\yPNRFqF.exe
  2⤵
  PID:10488
- C:\Windows\System\oXKYKqZ.exe
  C:\Windows\System\oXKYKqZ.exe
  2⤵
  PID:10548
- C:\Windows\System\eAgDAHq.exe
  C:\Windows\System\eAgDAHq.exe
  2⤵
  PID:10628
- C:\Windows\System\yQaARPP.exe
  C:\Windows\System\yQaARPP.exe
  2⤵
  PID:10696
- C:\Windows\System\cOqWLvn.exe
  C:\Windows\System\cOqWLvn.exe
  2⤵
  PID:10716
- C:\Windows\System\ZODKHdz.exe
  C:\Windows\System\ZODKHdz.exe
  2⤵
  PID:10772
- C:\Windows\System\WeTPjnN.exe
  C:\Windows\System\WeTPjnN.exe
  2⤵
  PID:10220
- C:\Windows\System\hWqDzEu.exe
  C:\Windows\System\hWqDzEu.exe
  2⤵
  PID:10908
- C:\Windows\System\HxJKseM.exe
  C:\Windows\System\HxJKseM.exe
  2⤵
  PID:10936
- C:\Windows\System\iUsQibF.exe
  C:\Windows\System\iUsQibF.exe
  2⤵
  PID:11036
- C:\Windows\System\WYUSsvf.exe
  C:\Windows\System\WYUSsvf.exe
  2⤵
  PID:11104
- C:\Windows\System\vUTYEKB.exe
  C:\Windows\System\vUTYEKB.exe
  2⤵
  PID:11184
- C:\Windows\System\cDhzvyc.exe
  C:\Windows\System\cDhzvyc.exe
  2⤵
  PID:10256
- C:\Windows\System\hAofSJE.exe
  C:\Windows\System\hAofSJE.exe
  2⤵
  PID:10452
- C:\Windows\System\XVmZOhH.exe
  C:\Windows\System\XVmZOhH.exe
  2⤵
  PID:10520
- C:\Windows\System\ffcWpoQ.exe
  C:\Windows\System\ffcWpoQ.exe
  2⤵
  PID:10692
- C:\Windows\System\zYfcLio.exe
  C:\Windows\System\zYfcLio.exe
  2⤵
  PID:10820
- C:\Windows\System\dbmUPCx.exe
  C:\Windows\System\dbmUPCx.exe
  2⤵
  PID:11028
- C:\Windows\System\DMKPZar.exe
  C:\Windows\System\DMKPZar.exe
  2⤵
  PID:11220
- C:\Windows\System\XScclTY.exe
  C:\Windows\System\XScclTY.exe
  2⤵
  PID:5640
- C:\Windows\System\mkcTxjV.exe
  C:\Windows\System\mkcTxjV.exe
  2⤵
  PID:10764
- C:\Windows\System\LsRglYK.exe
  C:\Windows\System\LsRglYK.exe
  2⤵
  PID:11056
- C:\Windows\System\xuGZsBR.exe
  C:\Windows\System\xuGZsBR.exe
  2⤵
  PID:10544
- C:\Windows\System\qHIYHSO.exe
  C:\Windows\System\qHIYHSO.exe
  2⤵
  PID:10668
- C:\Windows\System\WrSXcoD.exe
  C:\Windows\System\WrSXcoD.exe
  2⤵
  PID:7120
- C:\Windows\System\IZQXBlk.exe
  C:\Windows\System\IZQXBlk.exe
  2⤵
  PID:11272
- C:\Windows\System\GLWYrhD.exe
  C:\Windows\System\GLWYrhD.exe
  2⤵
  PID:11300
- C:\Windows\System\dHFMVsF.exe
  C:\Windows\System\dHFMVsF.exe
  2⤵
  PID:11320
- C:\Windows\System\FryJsOw.exe
  C:\Windows\System\FryJsOw.exe
  2⤵
  PID:11348
- C:\Windows\System\ycXIDJM.exe
  C:\Windows\System\ycXIDJM.exe
  2⤵
  PID:11388
- C:\Windows\System\ppgVhfd.exe
  C:\Windows\System\ppgVhfd.exe
  2⤵
  PID:11416
- C:\Windows\System\VIsseYO.exe
  C:\Windows\System\VIsseYO.exe
  2⤵
  PID:11444
- C:\Windows\System\AGilave.exe
  C:\Windows\System\AGilave.exe
  2⤵
  PID:11472
- C:\Windows\System\fGXtQnW.exe
  C:\Windows\System\fGXtQnW.exe
  2⤵
  PID:11500
- C:\Windows\System\ORYBBeH.exe
  C:\Windows\System\ORYBBeH.exe
  2⤵
  PID:11528
- C:\Windows\System\EmbxUHp.exe
  C:\Windows\System\EmbxUHp.exe
  2⤵
  PID:11548
- C:\Windows\System\FukNPCa.exe
  C:\Windows\System\FukNPCa.exe
  2⤵
  PID:11572
- C:\Windows\System\XjkLKqr.exe
  C:\Windows\System\XjkLKqr.exe
  2⤵
  PID:11612
- C:\Windows\System\yfFmJPE.exe
  C:\Windows\System\yfFmJPE.exe
  2⤵
  PID:11640
- C:\Windows\System\nQdowBn.exe
  C:\Windows\System\nQdowBn.exe
  2⤵
  PID:11668
- C:\Windows\System\RzSJZBW.exe
  C:\Windows\System\RzSJZBW.exe
  2⤵
  PID:11696
- C:\Windows\System\NirqAwq.exe
  C:\Windows\System\NirqAwq.exe
  2⤵
  PID:11724
- C:\Windows\System\evdsEGz.exe
  C:\Windows\System\evdsEGz.exe
  2⤵
  PID:11752
- C:\Windows\System\GJgRhtL.exe
  C:\Windows\System\GJgRhtL.exe
  2⤵
  PID:11780
- C:\Windows\System\HvynKOF.exe
  C:\Windows\System\HvynKOF.exe
  2⤵
  PID:11808
- C:\Windows\System\ywVavog.exe
  C:\Windows\System\ywVavog.exe
  2⤵
  PID:11836
- C:\Windows\System\pKoKjYN.exe
  C:\Windows\System\pKoKjYN.exe
  2⤵
  PID:11864
- C:\Windows\System\UpuaXEU.exe
  C:\Windows\System\UpuaXEU.exe
  2⤵
  PID:11892
- C:\Windows\System\SkbufFx.exe
  C:\Windows\System\SkbufFx.exe
  2⤵
  PID:11916
- C:\Windows\System\XjaEmYF.exe
  C:\Windows\System\XjaEmYF.exe
  2⤵
  PID:11940
- C:\Windows\System\XAMDwlm.exe
  C:\Windows\System\XAMDwlm.exe
  2⤵
  PID:11956
- C:\Windows\System\lyONyFi.exe
  C:\Windows\System\lyONyFi.exe
  2⤵
  PID:12000
- C:\Windows\System\YcHQYPG.exe
  C:\Windows\System\YcHQYPG.exe
  2⤵
  PID:12028
- C:\Windows\System\kZpJKDR.exe
  C:\Windows\System\kZpJKDR.exe
  2⤵
  PID:12056
- C:\Windows\System\OrBGVtl.exe
  C:\Windows\System\OrBGVtl.exe
  2⤵
  PID:12080
- C:\Windows\System\imEugJN.exe
  C:\Windows\System\imEugJN.exe
  2⤵
  PID:12108
- C:\Windows\System\ssqKLjU.exe
  C:\Windows\System\ssqKLjU.exe
  2⤵
  PID:12148
- C:\Windows\System\gOeBDMg.exe
  C:\Windows\System\gOeBDMg.exe
  2⤵
  PID:12172
- C:\Windows\System\YgzNzkg.exe
  C:\Windows\System\YgzNzkg.exe
  2⤵
  PID:12192
- C:\Windows\System\PSApzrT.exe
  C:\Windows\System\PSApzrT.exe
  2⤵
  PID:12232
- C:\Windows\System\hrWePaP.exe
  C:\Windows\System\hrWePaP.exe
  2⤵
  PID:12260
- C:\Windows\System\cUYDbEA.exe
  C:\Windows\System\cUYDbEA.exe
  2⤵
  PID:12276
- C:\Windows\System\EVMnMmR.exe
  C:\Windows\System\EVMnMmR.exe
  2⤵
  PID:11308
- C:\Windows\System\BmHQdVw.exe
  C:\Windows\System\BmHQdVw.exe
  2⤵
  PID:11356
- C:\Windows\System\CGkHIsS.exe
  C:\Windows\System\CGkHIsS.exe
  2⤵
  PID:11428
- C:\Windows\System\nVFSeSl.exe
  C:\Windows\System\nVFSeSl.exe
  2⤵
  PID:11512
- C:\Windows\System\aoWkfdR.exe
  C:\Windows\System\aoWkfdR.exe
  2⤵
  PID:11536
- C:\Windows\System\qgauLpk.exe
  C:\Windows\System\qgauLpk.exe
  2⤵
  PID:11608
- C:\Windows\System\yRfWUxb.exe
  C:\Windows\System\yRfWUxb.exe
  2⤵
  PID:11692
- C:\Windows\System\fPZsYtA.exe
  C:\Windows\System\fPZsYtA.exe
  2⤵
  PID:11768
- C:\Windows\System\oNRVhNK.exe
  C:\Windows\System\oNRVhNK.exe
  2⤵
  PID:11828
- C:\Windows\System\rRLIDcc.exe
  C:\Windows\System\rRLIDcc.exe
  2⤵
  PID:11876
- C:\Windows\System\TGIBBnG.exe
  C:\Windows\System\TGIBBnG.exe
  2⤵
  PID:11952
- C:\Windows\System\CnXfhZU.exe
  C:\Windows\System\CnXfhZU.exe
  2⤵
  PID:12048
- C:\Windows\System\XwTFgGK.exe
  C:\Windows\System\XwTFgGK.exe
  2⤵
  PID:12076
- C:\Windows\System\DfGiYwo.exe
  C:\Windows\System\DfGiYwo.exe
  2⤵
  PID:12168
- C:\Windows\System\LqWUvhR.exe
  C:\Windows\System\LqWUvhR.exe
  2⤵
  PID:12208
- C:\Windows\System\cyAMqEo.exe
  C:\Windows\System\cyAMqEo.exe
  2⤵
  PID:10888
- C:\Windows\System\xpawPEb.exe
  C:\Windows\System\xpawPEb.exe
  2⤵
  PID:11404
- C:\Windows\System\zwrqNvZ.exe
  C:\Windows\System\zwrqNvZ.exe
  2⤵
  PID:11488
- C:\Windows\System\bXLATXz.exe
  C:\Windows\System\bXLATXz.exe
  2⤵
  PID:11088
- C:\Windows\System\fouBTnB.exe
  C:\Windows\System\fouBTnB.exe
  2⤵
  PID:11832
- C:\Windows\System\keKClYM.exe
  C:\Windows\System\keKClYM.exe
  2⤵
  PID:11912
- C:\Windows\System\sfTspcH.exe
  C:\Windows\System\sfTspcH.exe
  2⤵
  PID:12124
- C:\Windows\System\WtIxNxy.exe
  C:\Windows\System\WtIxNxy.exe
  2⤵
  PID:12272
- C:\Windows\System\HcKcAGD.exe
  C:\Windows\System\HcKcAGD.exe
  2⤵
  PID:11596
- C:\Windows\System\OCfRtXK.exe
  C:\Windows\System\OCfRtXK.exe
  2⤵
  PID:11932
- C:\Windows\System\SCFxCAQ.exe
  C:\Windows\System\SCFxCAQ.exe
  2⤵
  PID:11328
- C:\Windows\System\hcFPQYN.exe
  C:\Windows\System\hcFPQYN.exe
  2⤵
  PID:11736
- C:\Windows\System\CuOgXff.exe
  C:\Windows\System\CuOgXff.exe
  2⤵
  PID:12304
- C:\Windows\System\oysjiNe.exe
  C:\Windows\System\oysjiNe.exe
  2⤵
  PID:12328
- C:\Windows\System\PsIoYKR.exe
  C:\Windows\System\PsIoYKR.exe
  2⤵
  PID:12368
- C:\Windows\System\pWaWGUA.exe
  C:\Windows\System\pWaWGUA.exe
  2⤵
  PID:12404
- C:\Windows\System\CsFTUDi.exe
  C:\Windows\System\CsFTUDi.exe
  2⤵
  PID:12424
- C:\Windows\System\CbpAJby.exe
  C:\Windows\System\CbpAJby.exe
  2⤵
  PID:12452
- C:\Windows\System\JKIWSGM.exe
  C:\Windows\System\JKIWSGM.exe
  2⤵
  PID:12480
- C:\Windows\System\uYhXgSt.exe
  C:\Windows\System\uYhXgSt.exe
  2⤵
  PID:12504
- C:\Windows\System\mDNrBKB.exe
  C:\Windows\System\mDNrBKB.exe
  2⤵
  PID:12524
- C:\Windows\System\yzMdUzc.exe
  C:\Windows\System\yzMdUzc.exe
  2⤵
  PID:12556
- C:\Windows\System\ACqvzVl.exe
  C:\Windows\System\ACqvzVl.exe
  2⤵
  PID:12592
- C:\Windows\System\BKqPISF.exe
  C:\Windows\System\BKqPISF.exe
  2⤵
  PID:12620
- C:\Windows\System\CYVBRfV.exe
  C:\Windows\System\CYVBRfV.exe
  2⤵
  PID:12652
- C:\Windows\System\yLjWHTz.exe
  C:\Windows\System\yLjWHTz.exe
  2⤵
  PID:12684
- C:\Windows\System\sRAbMYw.exe
  C:\Windows\System\sRAbMYw.exe
  2⤵
  PID:12708
- C:\Windows\System\kWrvuFf.exe
  C:\Windows\System\kWrvuFf.exe
  2⤵
  PID:12736
- C:\Windows\System\LrTLOAD.exe
  C:\Windows\System\LrTLOAD.exe
  2⤵
  PID:12756
- C:\Windows\System\kTQITpn.exe
  C:\Windows\System\kTQITpn.exe
  2⤵
  PID:12784
- C:\Windows\System\UOYYxhs.exe
  C:\Windows\System\UOYYxhs.exe
  2⤵
  PID:12824
- C:\Windows\System\SGyvAVK.exe
  C:\Windows\System\SGyvAVK.exe
  2⤵
  PID:12852
- C:\Windows\System\AcOhoVm.exe
  C:\Windows\System\AcOhoVm.exe
  2⤵
  PID:12880
- C:\Windows\System\nJTZZoJ.exe
  C:\Windows\System\nJTZZoJ.exe
  2⤵
  PID:12896
- C:\Windows\System\NWRzqMy.exe
  C:\Windows\System\NWRzqMy.exe
  2⤵
  PID:12924
- C:\Windows\System\HvzOBvB.exe
  C:\Windows\System\HvzOBvB.exe
  2⤵
  PID:12952
- C:\Windows\System\SbtUbVd.exe
  C:\Windows\System\SbtUbVd.exe
  2⤵
  PID:12980
- C:\Windows\System\fkitQWV.exe
  C:\Windows\System\fkitQWV.exe
  2⤵
  PID:13020
- C:\Windows\System\imIgvCV.exe
  C:\Windows\System\imIgvCV.exe
  2⤵
  PID:13048
- C:\Windows\System\OiccLfY.exe
  C:\Windows\System\OiccLfY.exe
  2⤵
  PID:13072
- C:\Windows\System\FJuSMFn.exe
  C:\Windows\System\FJuSMFn.exe
  2⤵
  PID:13096
- C:\Windows\System\kobIRpY.exe
  C:\Windows\System\kobIRpY.exe
  2⤵
  PID:13124
- C:\Windows\System\mnLOArO.exe
  C:\Windows\System\mnLOArO.exe
  2⤵
  PID:13144
- C:\Windows\System\KfHkbvN.exe
  C:\Windows\System\KfHkbvN.exe
  2⤵
  PID:13168
- C:\Windows\System\QopEkIh.exe
  C:\Windows\System\QopEkIh.exe
  2⤵
  PID:13192
- C:\Windows\System\zTJEUZo.exe
  C:\Windows\System\zTJEUZo.exe
  2⤵
  PID:13220
- C:\Windows\System\bsUiaTM.exe
  C:\Windows\System\bsUiaTM.exe
  2⤵
  PID:13244
- C:\Windows\System\OpczSZq.exe
  C:\Windows\System\OpczSZq.exe
  2⤵
  PID:13272
- C:\Windows\System\zeTIxSF.exe
  C:\Windows\System\zeTIxSF.exe
  2⤵
  PID:13300
- C:\Windows\System\tKnMGnB.exe
  C:\Windows\System\tKnMGnB.exe
  2⤵
  PID:11468
- C:\Windows\System\lsomkEL.exe
  C:\Windows\System\lsomkEL.exe
  2⤵
  PID:12340
- C:\Windows\System\yEfyIQl.exe
  C:\Windows\System\yEfyIQl.exe
  2⤵
  PID:12416
- C:\Windows\System\GZqbRBc.exe
  C:\Windows\System\GZqbRBc.exe
  2⤵
  PID:12544
- C:\Windows\System\hwkiqwR.exe
  C:\Windows\System\hwkiqwR.exe
  2⤵
  PID:12616
- C:\Windows\System\ajQAArc.exe
  C:\Windows\System\ajQAArc.exe
  2⤵
  PID:12668
- C:\Windows\System\AKaSzzQ.exe
  C:\Windows\System\AKaSzzQ.exe
  2⤵
  PID:12752
- C:\Windows\System\cgOOijf.exe
  C:\Windows\System\cgOOijf.exe
  2⤵
  PID:12816
- C:\Windows\System\eGgrSHz.exe
  C:\Windows\System\eGgrSHz.exe
  2⤵
  PID:12892
- C:\Windows\System\HUIlriU.exe
  C:\Windows\System\HUIlriU.exe
  2⤵
  PID:12948
- C:\Windows\System\RDDRDft.exe
  C:\Windows\System\RDDRDft.exe
  2⤵
  PID:12992
- C:\Windows\System\bprSbgH.exe
  C:\Windows\System\bprSbgH.exe
  2⤵
  PID:13092
- C:\Windows\System\pciCWiv.exe
  C:\Windows\System\pciCWiv.exe
  2⤵
  PID:13112
- C:\Windows\System\LlXzfCf.exe
  C:\Windows\System\LlXzfCf.exe
  2⤵
  PID:13208
- C:\Windows\System\LvNoCNy.exe
  C:\Windows\System\LvNoCNy.exe
  2⤵
  PID:13264
- C:\Windows\System\CErxYUs.exe
  C:\Windows\System\CErxYUs.exe
  2⤵
  PID:13284
- C:\Windows\System\HWobJUW.exe
  C:\Windows\System\HWobJUW.exe
  2⤵
  PID:12516
- C:\Windows\System\RsjwWUL.exe
  C:\Windows\System\RsjwWUL.exe
  2⤵
  PID:12720
- C:\Windows\System\CbHAzGr.exe
  C:\Windows\System\CbHAzGr.exe
  2⤵
  PID:12908
- C:\Windows\System\ivvBBnp.exe
  C:\Windows\System\ivvBBnp.exe
  2⤵
  PID:13044
- C:\Windows\System\IByLRwu.exe
  C:\Windows\System\IByLRwu.exe
  2⤵
  PID:13164
- C:\Windows\System\mOzWTpu.exe
  C:\Windows\System\mOzWTpu.exe
  2⤵
  PID:11496
- C:\Windows\System\DIzPDgK.exe
  C:\Windows\System\DIzPDgK.exe
  2⤵
  PID:12968
- C:\Windows\System\xwfekOx.exe
  C:\Windows\System\xwfekOx.exe
  2⤵
  PID:12548
- C:\Windows\System\SlmBMxv.exe
  C:\Windows\System\SlmBMxv.exe
  2⤵
  PID:13324
- C:\Windows\System\NJOLyNZ.exe
  C:\Windows\System\NJOLyNZ.exe
  2⤵
  PID:13352
- C:\Windows\System\qWMLZvk.exe
  C:\Windows\System\qWMLZvk.exe
  2⤵
  PID:13380
- C:\Windows\System\gWGInFa.exe
  C:\Windows\System\gWGInFa.exe
  2⤵
  PID:13408
- C:\Windows\System\gtFGNHi.exe
  C:\Windows\System\gtFGNHi.exe
  2⤵
  PID:13432
- C:\Windows\System\SXYKihw.exe
  C:\Windows\System\SXYKihw.exe
  2⤵
  PID:13452
- C:\Windows\System\SwLfnbb.exe
  C:\Windows\System\SwLfnbb.exe
  2⤵
  PID:13488
- C:\Windows\System\QoSOKcd.exe
  C:\Windows\System\QoSOKcd.exe
  2⤵
  PID:13508
- C:\Windows\System\AnXhTse.exe
  C:\Windows\System\AnXhTse.exe
  2⤵
  PID:13552
- C:\Windows\System\HApAnPc.exe
  C:\Windows\System\HApAnPc.exe
  2⤵
  PID:13568
- C:\Windows\System\qqgbCqp.exe
  C:\Windows\System\qqgbCqp.exe
  2⤵
  PID:13596
- C:\Windows\System\LPRftuw.exe
  C:\Windows\System\LPRftuw.exe
  2⤵
  PID:13620
- C:\Windows\System\wdgaTxL.exe
  C:\Windows\System\wdgaTxL.exe
  2⤵
  PID:13664
- C:\Windows\System\BvPFBTE.exe
  C:\Windows\System\BvPFBTE.exe
  2⤵
  PID:13692
- C:\Windows\System\iAOMaCb.exe
  C:\Windows\System\iAOMaCb.exe
  2⤵
  PID:13720
- C:\Windows\System\QRXwSyV.exe
  C:\Windows\System\QRXwSyV.exe
  2⤵
  PID:13748
- C:\Windows\System\vxwNvzW.exe
  C:\Windows\System\vxwNvzW.exe
  2⤵
  PID:13776
- C:\Windows\System\PWrXdtX.exe
  C:\Windows\System\PWrXdtX.exe
  2⤵
  PID:13804
- C:\Windows\System\KdLNAIZ.exe
  C:\Windows\System\KdLNAIZ.exe
  2⤵
  PID:13832
- C:\Windows\System\WuIrjEX.exe
  C:\Windows\System\WuIrjEX.exe
  2⤵
  PID:13860
- C:\Windows\System\YTGtKXp.exe
  C:\Windows\System\YTGtKXp.exe
  2⤵
  PID:13888
- C:\Windows\System\nwdnvGB.exe
  C:\Windows\System\nwdnvGB.exe
  2⤵
  PID:13916
- C:\Windows\System\mmrCQsK.exe
  C:\Windows\System\mmrCQsK.exe
  2⤵
  PID:13944
- C:\Windows\System\VEbhVAC.exe
  C:\Windows\System\VEbhVAC.exe
  2⤵
  PID:13980
- C:\Windows\System\RNszRcU.exe
  C:\Windows\System\RNszRcU.exe
  2⤵
  PID:14008
- C:\Windows\System\AHAttCh.exe
  C:\Windows\System\AHAttCh.exe
  2⤵
  PID:14060
- C:\Windows\System\IjPfcMS.exe
  C:\Windows\System\IjPfcMS.exe
  2⤵
  PID:14092
- C:\Windows\System\ZwhfilJ.exe
  C:\Windows\System\ZwhfilJ.exe
  2⤵
  PID:14116
- C:\Windows\System\KwgEZxD.exe
  C:\Windows\System\KwgEZxD.exe
  2⤵
  PID:14140
- C:\Windows\System\QYXuqvv.exe
  C:\Windows\System\QYXuqvv.exe
  2⤵
  PID:14180
- C:\Windows\System\ZqLflTW.exe
  C:\Windows\System\ZqLflTW.exe
  2⤵
  PID:14204
- C:\Windows\System\tFydiGm.exe
  C:\Windows\System\tFydiGm.exe
  2⤵
  PID:14236
- C:\Windows\System\LUOJodX.exe
  C:\Windows\System\LUOJodX.exe
  2⤵
  PID:14264
- C:\Windows\System\gcZmkaV.exe
  C:\Windows\System\gcZmkaV.exe
  2⤵
  PID:14288
- C:\Windows\System\vbHXYUj.exe
  C:\Windows\System\vbHXYUj.exe
  2⤵
  PID:14328
- C:\Windows\System\ZoeSwhx.exe
  C:\Windows\System\ZoeSwhx.exe
  2⤵
  PID:13368
- C:\Windows\System\dSehCoF.exe
  C:\Windows\System\dSehCoF.exe
  2⤵
  PID:13444
- C:\Windows\System\gspmzLp.exe
  C:\Windows\System\gspmzLp.exe
  2⤵
  PID:13448
- C:\Windows\System\raMXsXa.exe
  C:\Windows\System\raMXsXa.exe
  2⤵
  PID:13580
- C:\Windows\System\JIimoKz.exe
  C:\Windows\System\JIimoKz.exe
  2⤵
  PID:13640
- C:\Windows\System\jJJpdkF.exe
  C:\Windows\System\jJJpdkF.exe
  2⤵
  PID:13704
- C:\Windows\System\xmwlnyU.exe
  C:\Windows\System\xmwlnyU.exe
  2⤵
  PID:13816
- C:\Windows\System\YTSrJWG.exe
  C:\Windows\System\YTSrJWG.exe
  2⤵
  PID:13844
- C:\Windows\System\PgNjGJm.exe
  C:\Windows\System\PgNjGJm.exe
  2⤵
  PID:13932
- C:\Windows\System\mEGKFWm.exe
  C:\Windows\System\mEGKFWm.exe
  2⤵
  PID:13960
- C:\Windows\System\HzfhDNr.exe
  C:\Windows\System\HzfhDNr.exe
  2⤵
  PID:14104
- C:\Windows\System\XRiJJlX.exe
  C:\Windows\System\XRiJJlX.exe
  2⤵
  PID:12412
- C:\Windows\System\jiPqQbr.exe
  C:\Windows\System\jiPqQbr.exe
  2⤵
  PID:14296
- C:\Windows\System\tBFUptE.exe
  C:\Windows\System\tBFUptE.exe
  2⤵
  PID:13396
- C:\Windows\System\qbEkViJ.exe
  C:\Windows\System\qbEkViJ.exe
  2⤵
  PID:13540
- C:\Windows\System\qptTRdO.exe
  C:\Windows\System\qptTRdO.exe
  2⤵
  PID:13800
- C:\Windows\System\MZdHzKB.exe
  C:\Windows\System\MZdHzKB.exe
  2⤵
  PID:14080
- C:\Windows\System\nItTAli.exe
  C:\Windows\System\nItTAli.exe
  2⤵
  PID:14276
- C:\Windows\System\ZNirFAu.exe
  C:\Windows\System\ZNirFAu.exe
  2⤵
  PID:13764
- C:\Windows\System\EeRbQkS.exe
  C:\Windows\System\EeRbQkS.exe
  2⤵
  PID:13744
- C:\Windows\System\KiegdSn.exe
  C:\Windows\System\KiegdSn.exe
  2⤵
  PID:14356
- C:\Windows\System\CuwZrQB.exe
  C:\Windows\System\CuwZrQB.exe
  2⤵
  PID:14400
- C:\Windows\System\mBiWTDM.exe
  C:\Windows\System\mBiWTDM.exe
  2⤵
  PID:14432
- C:\Windows\System\syGqUQS.exe
  C:\Windows\System\syGqUQS.exe
  2⤵
  PID:14476
- C:\Windows\System\SkKzaYR.exe
  C:\Windows\System\SkKzaYR.exe
  2⤵
  PID:14508
- C:\Windows\System\aLxhijC.exe
  C:\Windows\System\aLxhijC.exe
  2⤵
  PID:14536
- C:\Windows\System\ULRcgGI.exe
  C:\Windows\System\ULRcgGI.exe
  2⤵
  PID:14556
- C:\Windows\System\oALngye.exe
  C:\Windows\System\oALngye.exe
  2⤵
  PID:14588
- C:\Windows\System\uAzJhfV.exe
  C:\Windows\System\uAzJhfV.exe
  2⤵
  PID:14616
- C:\Windows\System\TmfEbLL.exe
  C:\Windows\System\TmfEbLL.exe
  2⤵
  PID:14648
- C:\Windows\System\fYSyuTi.exe
  C:\Windows\System\fYSyuTi.exe
  2⤵
  PID:14668
- C:\Windows\System\FrGNqvR.exe
  C:\Windows\System\FrGNqvR.exe
  2⤵
  PID:14696
- C:\Windows\System\MXXwKQM.exe
  C:\Windows\System\MXXwKQM.exe
  2⤵
  PID:14728
- C:\Windows\System\nUPvpfU.exe
  C:\Windows\System\nUPvpfU.exe
  2⤵
  PID:14752
- C:\Windows\System\xUeYjvu.exe
  C:\Windows\System\xUeYjvu.exe
  2⤵
  PID:14792
- C:\Windows\System\ksafClC.exe
  C:\Windows\System\ksafClC.exe
  2⤵
  PID:14816
- C:\Windows\System\ZxXjZry.exe
  C:\Windows\System\ZxXjZry.exe
  2⤵
  PID:14832
- C:\Windows\System\aFvhAhy.exe
  C:\Windows\System\aFvhAhy.exe
  2⤵
  PID:14860
- C:\Windows\System\LCholhG.exe
  C:\Windows\System\LCholhG.exe
  2⤵
  PID:14888
- C:\Windows\System\SdOBBdi.exe
  C:\Windows\System\SdOBBdi.exe
  2⤵
  PID:14908
- C:\Windows\System\TEWbgeq.exe
  C:\Windows\System\TEWbgeq.exe
  2⤵
  PID:14924
- C:\Windows\System\hgMUTqL.exe
  C:\Windows\System\hgMUTqL.exe
  2⤵
  PID:14948
- C:\Windows\System\WXBdSpE.exe
  C:\Windows\System\WXBdSpE.exe
  2⤵
  PID:14964
- C:\Windows\System\TpnEwyd.exe
  C:\Windows\System\TpnEwyd.exe
  2⤵
  PID:14980
- C:\Windows\System\tbwoibO.exe
  C:\Windows\System\tbwoibO.exe
  2⤵
  PID:14996
- C:\Windows\System\QGOUaHs.exe
  C:\Windows\System\QGOUaHs.exe
  2⤵
  PID:15012
- C:\Windows\System\artBukT.exe
  C:\Windows\System\artBukT.exe
  2⤵
  PID:15028
- C:\Windows\System\edUZuBA.exe
  C:\Windows\System\edUZuBA.exe
  2⤵
  PID:15060
- C:\Windows\System\mWzyfVA.exe
  C:\Windows\System\mWzyfVA.exe
  2⤵
  PID:15076
- C:\Windows\System\DvZXmXl.exe
  C:\Windows\System\DvZXmXl.exe
  2⤵
  PID:15108
- C:\Windows\System\vhFccGu.exe
  C:\Windows\System\vhFccGu.exe
  2⤵
  PID:15140
- C:\Windows\System\bkXhPIu.exe
  C:\Windows\System\bkXhPIu.exe
  2⤵
  PID:15164
- C:\Windows\System\xgciviv.exe
  C:\Windows\System\xgciviv.exe
  2⤵
  PID:15184
- C:\Windows\System\BcPkAIj.exe
  C:\Windows\System\BcPkAIj.exe
  2⤵
  PID:15200
- C:\Windows\System\igzYtyS.exe
  C:\Windows\System\igzYtyS.exe
  2⤵
  PID:15228
- C:\Windows\System\DSGmfOZ.exe
  C:\Windows\System\DSGmfOZ.exe
  2⤵
  PID:15264
- C:\Windows\System\hYWxRyQ.exe
  C:\Windows\System\hYWxRyQ.exe
  2⤵
  PID:15292
- C:\Windows\System\PhNdaKC.exe
  C:\Windows\System\PhNdaKC.exe
  2⤵
  PID:15312
- C:\Windows\System\SkIzIAp.exe
  C:\Windows\System\SkIzIAp.exe
  2⤵
  PID:15328
- C:\Windows\System\tkkRVDU.exe
  C:\Windows\System\tkkRVDU.exe
  2⤵
  PID:15348
- C:\Windows\System\ryyoZlv.exe
  C:\Windows\System\ryyoZlv.exe
  2⤵
  PID:14376
- C:\Windows\System\LyklVqd.exe
  C:\Windows\System\LyklVqd.exe
  2⤵
  PID:14456
- C:\Windows\System\VtHUYgB.exe
  C:\Windows\System\VtHUYgB.exe
  2⤵
  PID:14488
- C:\Windows\System\WefrmvT.exe
  C:\Windows\System\WefrmvT.exe
  2⤵
  PID:14532
- C:\Windows\System\PvQjaFl.exe
  C:\Windows\System\PvQjaFl.exe
  2⤵
  PID:14608
- C:\Windows\System\JBfywxc.exe
  C:\Windows\System\JBfywxc.exe
  2⤵
  PID:14844
- C:\Windows\System\yevxqUN.exe
  C:\Windows\System\yevxqUN.exe
  2⤵
  PID:14976
- C:\Windows\System\hBWqdiJ.exe
  C:\Windows\System\hBWqdiJ.exe
  2⤵
  PID:15104
- C:\Windows\System\ZihuvAy.exe
  C:\Windows\System\ZihuvAy.exe
  2⤵
  PID:15088
- C:\Windows\System\hykhwUt.exe
  C:\Windows\System\hykhwUt.exe
  2⤵
  PID:15020
- C:\Windows\System\iwrKjCu.exe
  C:\Windows\System\iwrKjCu.exe
  2⤵
  PID:15224
- C:\Windows\System\AmwlHWF.exe
  C:\Windows\System\AmwlHWF.exe
  2⤵
  PID:15308
- C:\Windows\System\Igtmetw.exe
  C:\Windows\System\Igtmetw.exe
  2⤵
  PID:4916
- C:\Windows\System\OsbPZRi.exe
  C:\Windows\System\OsbPZRi.exe
  2⤵
  PID:15304
- C:\Windows\System\VCNNVXe.exe
  C:\Windows\System\VCNNVXe.exe
  2⤵
  PID:14352
- C:\Windows\System\jjpDesb.exe
  C:\Windows\System\jjpDesb.exe
  2⤵
  PID:14448
- C:\Windows\System\FfArvyl.exe
  C:\Windows\System\FfArvyl.exe
  2⤵
  PID:15004
- C:\Windows\System\xCIMPbX.exe
  C:\Windows\System\xCIMPbX.exe
  2⤵
  PID:14956
- C:\Windows\System\bfEkiEA.exe
  C:\Windows\System\bfEkiEA.exe
  2⤵
  PID:15132
- C:\Windows\System\WWrtAdk.exe
  C:\Windows\System\WWrtAdk.exe
  2⤵
  PID:15100
- C:\Windows\System\WfIsOtX.exe
  C:\Windows\System\WfIsOtX.exe
  2⤵
  PID:14384
- C:\Windows\System\LgOyKNW.exe
  C:\Windows\System\LgOyKNW.exe
  2⤵
  PID:14580
- C:\Windows\System\XumWZTc.exe
  C:\Windows\System\XumWZTc.exe
  2⤵
  PID:15368
- C:\Windows\System\VIHZsQW.exe
  C:\Windows\System\VIHZsQW.exe
  2⤵
  PID:15404
- C:\Windows\System\GNdrIfP.exe
  C:\Windows\System\GNdrIfP.exe
  2⤵
  PID:15432
- C:\Windows\System\NgJRDUM.exe
  C:\Windows\System\NgJRDUM.exe
  2⤵
  PID:15452
- C:\Windows\System\WuYOacF.exe
  C:\Windows\System\WuYOacF.exe
  2⤵
  PID:15480
- C:\Windows\System\UeCBuDW.exe
  C:\Windows\System\UeCBuDW.exe
  2⤵
  PID:15516
- C:\Windows\System\evSpudo.exe
  C:\Windows\System\evSpudo.exe
  2⤵
  PID:15548
- C:\Windows\System\ilUwLXk.exe
  C:\Windows\System\ilUwLXk.exe
  2⤵
  PID:15576
- C:\Windows\System\ebBsHPe.exe
  C:\Windows\System\ebBsHPe.exe
  2⤵
  PID:15600
- C:\Windows\System\GncbnIV.exe
  C:\Windows\System\GncbnIV.exe
  2⤵
  PID:15616
- C:\Windows\System\mZHBiLP.exe
  C:\Windows\System\mZHBiLP.exe
  2⤵
  PID:15656
- C:\Windows\System\pMRuTtf.exe
  C:\Windows\System\pMRuTtf.exe
  2⤵
  PID:15680
- C:\Windows\System\PAiabIB.exe
  C:\Windows\System\PAiabIB.exe
  2⤵
  PID:15704
- C:\Windows\System\UowYMBY.exe
  C:\Windows\System\UowYMBY.exe
  2⤵
  PID:15728
- C:\Windows\System\UvWOsia.exe
  C:\Windows\System\UvWOsia.exe
  2⤵
  PID:15760
- C:\Windows\System\pbfRaao.exe
  C:\Windows\System\pbfRaao.exe
  2⤵
  PID:15792
- C:\Windows\System\yrJZGBl.exe
  C:\Windows\System\yrJZGBl.exe
  2⤵
  PID:15820
- C:\Windows\System\aqbBUAN.exe
  C:\Windows\System\aqbBUAN.exe
  2⤵
  PID:15848
- C:\Windows\System\pdnpFQs.exe
  C:\Windows\System\pdnpFQs.exe
  2⤵
  PID:15876
- C:\Windows\System\kGFRQaK.exe
  C:\Windows\System\kGFRQaK.exe
  2⤵
  PID:15900
- C:\Windows\System\qMotbSh.exe
  C:\Windows\System\qMotbSh.exe
  2⤵
  PID:15928
- C:\Windows\System\jUMTJGe.exe
  C:\Windows\System\jUMTJGe.exe
  2⤵
  PID:15948
- C:\Windows\System\psduxiw.exe
  C:\Windows\System\psduxiw.exe
  2⤵
  PID:15968
- C:\Windows\System\UyPjslF.exe
  C:\Windows\System\UyPjslF.exe
  2⤵
  PID:16004
- C:\Windows\System\YxpQVjS.exe
  C:\Windows\System\YxpQVjS.exe
  2⤵
  PID:16036
- C:\Windows\System\BrOYcSK.exe
  C:\Windows\System\BrOYcSK.exe
  2⤵
  PID:16064
- C:\Windows\System\wMJKAXF.exe
  C:\Windows\System\wMJKAXF.exe
  2⤵
  PID:16088
- C:\Windows\System\XMtaDfy.exe
  C:\Windows\System\XMtaDfy.exe
  2⤵
  PID:16116
- C:\Windows\System\qlebodU.exe
  C:\Windows\System\qlebodU.exe
  2⤵
  PID:16156
- C:\Windows\System\RsnntcJ.exe
  C:\Windows\System\RsnntcJ.exe
  2⤵
  PID:16188
- C:\Windows\System\eljZJdH.exe
  C:\Windows\System\eljZJdH.exe
  2⤵
  PID:16204
- C:\Windows\System\AbGXbtG.exe
  C:\Windows\System\AbGXbtG.exe
  2⤵
  PID:16228
- C:\Windows\System\fcKdwKW.exe
  C:\Windows\System\fcKdwKW.exe
  2⤵
  PID:16248
- C:\Windows\System\UBQmlMZ.exe
  C:\Windows\System\UBQmlMZ.exe
  2⤵
  PID:16284
- C:\Windows\System\MEsMexS.exe
  C:\Windows\System\MEsMexS.exe
  2⤵
  PID:16308
- C:\Windows\System\UlfEtgt.exe
  C:\Windows\System\UlfEtgt.exe
  2⤵
  PID:16340
- C:\Windows\System\TddQtYV.exe
  C:\Windows\System\TddQtYV.exe
  2⤵
  PID:16372
- C:\Windows\System\MqZBTrm.exe
  C:\Windows\System\MqZBTrm.exe
  2⤵
  PID:15276
- C:\Windows\System\BemjGPL.exe
  C:\Windows\System\BemjGPL.exe
  2⤵
  PID:14632
- C:\Windows\System\TFmqjpa.exe
  C:\Windows\System\TFmqjpa.exe
  2⤵
  PID:15496
- C:\Windows\System\xvyTJSb.exe
  C:\Windows\System\xvyTJSb.exe
  2⤵
  PID:15416
- C:\Windows\System\NELuzMt.exe
  C:\Windows\System\NELuzMt.exe
  2⤵
  PID:15492
- C:\Windows\System\kWqFoCR.exe
  C:\Windows\System\kWqFoCR.exe
  2⤵
  PID:15444
- C:\Windows\System\DVbRNyS.exe
  C:\Windows\System\DVbRNyS.exe
  2⤵
  PID:15648
- C:\Windows\System\AHdqyIf.exe
  C:\Windows\System\AHdqyIf.exe
  2⤵
  PID:15812
- C:\Windows\System\PqbgIdF.exe
  C:\Windows\System\PqbgIdF.exe
  2⤵
  PID:15664
- C:\Windows\System\tvnPPOB.exe
  C:\Windows\System\tvnPPOB.exe
  2⤵
  PID:15936
- C:\Windows\System\EdYYrxk.exe
  C:\Windows\System\EdYYrxk.exe
  2⤵
  PID:16024
- C:\Windows\System\IzQrBcl.exe
  C:\Windows\System\IzQrBcl.exe
  2⤵
  PID:15924
- C:\Windows\System\vqtxIAv.exe
  C:\Windows\System\vqtxIAv.exe
  2⤵
  PID:16084
- C:\Windows\System\cFDeTAU.exe
  C:\Windows\System\cFDeTAU.exe
  2⤵
  PID:16200
- C:\Windows\System\oJUARSA.exe
  C:\Windows\System\oJUARSA.exe
  2⤵
  PID:16048
- C:\Windows\System\neLnwXz.exe
  C:\Windows\System\neLnwXz.exe
  2⤵
  PID:16104
- C:\Windows\System\vEObZQV.exe
  C:\Windows\System\vEObZQV.exe
  2⤵
  PID:16148
- C:\Windows\System\lXuFBVq.exe
  C:\Windows\System\lXuFBVq.exe
  2⤵
  PID:15196
- C:\Windows\System\VtUtSzn.exe
  C:\Windows\System\VtUtSzn.exe
  2⤵
  PID:16108
- C:\Windows\System\nHvENJh.exe
  C:\Windows\System\nHvENJh.exe
  2⤵
  PID:14428
- C:\Windows\System\PGkwJWe.exe
  C:\Windows\System\PGkwJWe.exe
  2⤵
  PID:16360
- C:\Windows\System\ydlRrTV.exe
  C:\Windows\System\ydlRrTV.exe
  2⤵
  PID:15192
- C:\Windows\System\duVwIWj.exe
  C:\Windows\System\duVwIWj.exe
  2⤵
  PID:15804
- C:\Windows\System\jWPVFwA.exe
  C:\Windows\System\jWPVFwA.exe
  2⤵
  PID:15940
- C:\Windows\System\gopJXjg.exe
  C:\Windows\System\gopJXjg.exe
  2⤵
  PID:16388
- C:\Windows\System\hrOYsXs.exe
  C:\Windows\System\hrOYsXs.exe
  2⤵
  PID:16416
- C:\Windows\System\KhImOYE.exe
  C:\Windows\System\KhImOYE.exe
  2⤵
  PID:16432
- C:\Windows\System\tyAowBi.exe
  C:\Windows\System\tyAowBi.exe
  2⤵
  PID:16464
- C:\Windows\System\ePPyTnV.exe
  C:\Windows\System\ePPyTnV.exe
  2⤵
  PID:16500
- C:\Windows\System\XrTQzlh.exe
  C:\Windows\System\XrTQzlh.exe
  2⤵
  PID:16524
- C:\Windows\System\mkkJqEy.exe
  C:\Windows\System\mkkJqEy.exe
  2⤵
  PID:16564
- C:\Windows\System\YjuncfF.exe
  C:\Windows\System\YjuncfF.exe
  2⤵
  PID:16592
- C:\Windows\System\HWYRohv.exe
  C:\Windows\System\HWYRohv.exe
  2⤵
  PID:16616
- C:\Windows\System\ncVuIqr.exe
  C:\Windows\System\ncVuIqr.exe
  2⤵
  PID:16644
- C:\Windows\System\qEroVlr.exe
  C:\Windows\System\qEroVlr.exe
  2⤵
  PID:16672
- C:\Windows\System\KgyUGMQ.exe
  C:\Windows\System\KgyUGMQ.exe
  2⤵
  PID:16688
- C:\Windows\System\FNnulHs.exe
  C:\Windows\System\FNnulHs.exe
  2⤵
  PID:16716
- C:\Windows\System\YuOXkiu.exe
  C:\Windows\System\YuOXkiu.exe
  2⤵
  PID:16744
- C:\Windows\System\cNhjzXf.exe
  C:\Windows\System\cNhjzXf.exe
  2⤵
  PID:16784
- C:\Windows\System\NPVYUja.exe
  C:\Windows\System\NPVYUja.exe
  2⤵
  PID:16804
- C:\Windows\System\heBIDuR.exe
  C:\Windows\System\heBIDuR.exe
  2⤵
  PID:16820
- C:\Windows\System\QInwUFL.exe
  C:\Windows\System\QInwUFL.exe
  2⤵
  PID:16840
- C:\Windows\System\uegYryp.exe
  C:\Windows\System\uegYryp.exe
  2⤵
  PID:16872
- C:\Windows\System\WRzhbUK.exe
  C:\Windows\System\WRzhbUK.exe
  2⤵
  PID:16900
- C:\Windows\System\dGhPpnT.exe
  C:\Windows\System\dGhPpnT.exe
  2⤵
  PID:16928
- C:\Windows\System\bFQMpvI.exe
  C:\Windows\System\bFQMpvI.exe
  2⤵
  PID:16956
- C:\Windows\System\wMosrbt.exe
  C:\Windows\System\wMosrbt.exe
  2⤵
  PID:16988
- C:\Windows\System\UqjMydm.exe
  C:\Windows\System\UqjMydm.exe
  2⤵
  PID:17004
- C:\Windows\System\UnuGOiz.exe
  C:\Windows\System\UnuGOiz.exe
  2⤵
  PID:17032
- C:\Windows\System\OtpcdCe.exe
  C:\Windows\System\OtpcdCe.exe
  2⤵
  PID:17048
- C:\Windows\System\mBRophd.exe
  C:\Windows\System\mBRophd.exe
  2⤵
  PID:17068
- C:\Windows\System\yNDjuVx.exe
  C:\Windows\System\yNDjuVx.exe
  2⤵
  PID:17104
- C:\Windows\System\cMTWnrv.exe
  C:\Windows\System\cMTWnrv.exe
  2⤵
  PID:17140
- C:\Windows\System\mexsuJG.exe
  C:\Windows\System\mexsuJG.exe
  2⤵
  PID:17164
- C:\Windows\System\VIOWjLb.exe
  C:\Windows\System\VIOWjLb.exe
  2⤵
  PID:17192
- C:\Windows\System\iukTDlA.exe
  C:\Windows\System\iukTDlA.exe
  2⤵
  PID:17220
- C:\Windows\System\nMnBtSg.exe
  C:\Windows\System\nMnBtSg.exe
  2⤵
  PID:17244
- C:\Windows\System\mZcouJc.exe
  C:\Windows\System\mZcouJc.exe
  2⤵
  PID:16732
- C:\Windows\System\pLNGXrN.exe
  C:\Windows\System\pLNGXrN.exe
  2⤵
  PID:16776
- C:\Windows\System\UWlFWGr.exe
  C:\Windows\System\UWlFWGr.exe
  2⤵
  PID:16604
- C:\Windows\System\SOHJnzR.exe
  C:\Windows\System\SOHJnzR.exe
  2⤵
  PID:16460
- C:\Windows\System\TIKKsqp.exe
  C:\Windows\System\TIKKsqp.exe
  2⤵
  PID:17040
- C:\Windows\System\qLVwoOF.exe
  C:\Windows\System\qLVwoOF.exe
  2⤵
  PID:16836
- C:\Windows\System\aSuHhiy.exe
  C:\Windows\System\aSuHhiy.exe
  2⤵
  PID:16792
- C:\Windows\System\MYfmkwb.exe
  C:\Windows\System\MYfmkwb.exe
  2⤵
  PID:17284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BIKxyRf.exe

Filesize
1.5MB

MD5
275e4d878c814d0dd91ed5589cf7f217

SHA1
c434d9d5547c104b9d5bcb889c29bd817d2ead97

SHA256
7bce602b13abeed641d5e9e9f99a352af560cddce905718a562dadc3abe56c53

SHA512
84a272d0906dffd3b1109b834f139d80d15368e0345bbe9b820ada55a1582fc891d09ccd392c846df1ea5abea50a328370795d8ec56fee2c4edfab4d0238fe32

Download Submit
C:\Windows\System\BqlrAVQ.exe

Filesize
1.5MB

MD5
99640a0ae2c7c2cf4b1f217d12261d35

SHA1
ce73bbaeb2b024751de9cc3b6267f7fe8806d903

SHA256
72579b0c25bcef199bfa0306cbf3ba7e2da2fbba92e022b47e4b219512ebda0b

SHA512
9b63bd58562c430500e4350c006210055444e5d972e1e91811ae3808adaeb363371e82278d7242b0c681eb6f9ff6d7394449f985b23c232a64427866eaeaad56

Download Submit
C:\Windows\System\CVIDgal.exe

Filesize
1.5MB

MD5
beeea76935ff35f29b86ccfd0ff129b6

SHA1
844a1d3b3c804b260c57e29b7f51ad9506ea9a74

SHA256
c8eacb6491e39abc6dfc39e481530a64f8feeb3ecc6f994942e2e74856465b7f

SHA512
8680927ac0a8750e660a45e74ff91fd8e1e37e24efd086da14fefec7e13428465f38fd73f05b0563ff3ab121730c5208e5cec6b39ca2017d34386835629d8fbd

Download Submit
C:\Windows\System\EOYssWY.exe

Filesize
1.5MB

MD5
56782d876f164ecb25dce78b887fb66d

SHA1
b692b0128ce9a2e9c58ff72b93d8851a66561d95

SHA256
a9b2702b824246f0e931f3af8661b0540b84d203afc5cede457b1a02f35976ca

SHA512
16e78b7f7ba3fccc84da48c454ee0dc64d1fc2fdde0ca857f3f0633fa06b04a590cce20583e830a86ef5b6b867302258508dbea18b9fd29c86d02e0e5a1b3fd7

Download Submit
C:\Windows\System\IEyMKfi.exe

Filesize
1.5MB

MD5
9a00701f6946e926d8e5aef412cb9bde

SHA1
222c49421fe9fa242973d16fd13ecc02ce1633a7

SHA256
aebd54f7954e2f4a635a5bd2e58a0175187ec9267b4454389dd4f7d2d8b76a5f

SHA512
9c522a37f365f9a20988e2808197ae183066ddc99bc6e9fdeb331dab96b4e2a6f5618cc8118138dd57082da1c9a76f162b988c417cfe3c948ff6f3117a804bf3

Download Submit
C:\Windows\System\IFLlANS.exe

Filesize
1.5MB

MD5
c8466d049268f4f041770a87e25e445c

SHA1
fc7e14fa1c0ab4f538ffb19bd073aa2636e6e987

SHA256
b6c52bfc570e451752962ae32f2a4cd02b3288ccf6593d4e0d2c584928e9b513

SHA512
d2dcf4dbdf7a6416950ed6ea7e6381571bde1394da4eab99e0c3ded3d1b75337a181428a08d23128c9dc2642872ab8ffbffad9c0ab64c1c2fef52d1d192b52a5

Download Submit
C:\Windows\System\KDFXwaw.exe

Filesize
1.5MB

MD5
a81dd8a9ac30bf8b26ba1f321f32d344

SHA1
aac038ee25f423db9c1448692352caef225b21aa

SHA256
328e402b9e013f9506b237e48efcce730c46bbbf61b4cd62e7b664411bd9f10f

SHA512
17e2725fdf3593fd6c6290446358fe541cf2d35e0e37dbacb76b7dce0cdb35d435fde4c1672dc4e233fcf285d6fc5378e1b8b142ec6be4a0691f8eeb73d8fce9

Download Submit
C:\Windows\System\KpdCuGL.exe

Filesize
1.5MB

MD5
1b3e9ca5f06edbc23c4c9c89b741c4ab

SHA1
20b8414b6aa15db3b5414203a0e16e12e0507284

SHA256
21ab293c27a265f66686899991ce991d5c409aaf664d00edee9e4dc72dcd3d48

SHA512
a0ad5f223543e973fcf923223f9c9e13e313abf264b280f4a26adbecced5d6e0fb353db2c9621dbe8f509d32fb8e2b8af3481308045764d1d8e4b8be82157512

Download Submit
C:\Windows\System\OMCFprR.exe

Filesize
1.5MB

MD5
5e95fb53d062c6958b5bff58b6a23f5d

SHA1
3601e35bec8eb4fc1570a89e2a760ffc7369e567

SHA256
8f3c641d1613468f6bffdd400ab2454c03b7465216ed56df5427a95b0f25ae58

SHA512
76e5206437216caabbd91250063f8b18eb2633e100d62655e92e22ae3950e18d55540e0a2747eb0395bf3e0c9beea9f095ce6ad76aa78270e415c78b4eeadacc

Download Submit
C:\Windows\System\PpYyetY.exe

Filesize
1.5MB

MD5
26871c80ff09ddb1b17561744f327565

SHA1
f279db9833f45160f2f7419ce5bc0e6edea88614

SHA256
1c851e32282b147f34b4b8fe4211350dde39f8100b5ac8f5183fb1d9e9d94328

SHA512
2f21f52c21c32b79195efde6c4425a1ee7e61bfa0ac58ca24fc5a8339070393b7b664a53d9456d13d3b7b279ec54a00b1fad883b9a6e8df2921a774fdbd1dd25

Download Submit
C:\Windows\System\SFWGWOh.exe

Filesize
1.5MB

MD5
ee8e022cfbfacca7e4f2a5bbb08d9723

SHA1
4e0ace0026b5d6dc18289148c6ae64ccb0071b3a

SHA256
b4365303eec707d7af2d6a5ba5c90c6dd8c915f0fb3353ef7d5000490ba989c4

SHA512
d017b9b3d1d35e7da4b13c2c6fa0dc08a2e6fedac6c659a0100a5db63f774e934a93c68eb7ad3fe37f4518f011f31c6123cdfa4e92f643f9b801924e5a256912

Download Submit
C:\Windows\System\SqnTxaz.exe

Filesize
1.5MB

MD5
fe511f1b9a44e6f1352284f806985b6e

SHA1
4d39f234852c0f55791561499323f54b56474bda

SHA256
3b8a8aa7ed44f0e21f55cd1c1435d5a791f4af3580679f9cd3acf5a71db87752

SHA512
6ab33e17314099c662fc1ca595b062f7dd1a935b4e815dc266ad8edcddb09ebd2dfc846b1a0da78972c1aca390b0cc150d05c48eed9fa9bbd0b3404da4dcc4ff

Download Submit
C:\Windows\System\TYIlhEN.exe

Filesize
1.5MB

MD5
a08b02a4f946eeffc2d8efc4d83e2cc1

SHA1
58b27dffc704a65ce7d97e9830421b00bd5bf6a7

SHA256
d17c2af4e14f89d135397b4fec98c1ccd4ef3a19496fe61c501e77eef60bc275

SHA512
9930dc72af1109fb4d8789e01266c0691b302f27a0ff417fd31474d8a44634756da16a947ab50472346a78d799569d12940cb833e7ff4d851a2e0c325948be37

Download Submit
C:\Windows\System\VrzdaWk.exe

Filesize
1.5MB

MD5
58e3c584242a98a5f59fcac533250ca1

SHA1
62311597cd2185c4774d077a84717469d00208bf

SHA256
a62a23774b880efc20dd02ef10c6cbb9f7c2811e383d3f339ca6fa9be5756415

SHA512
186a0f035a5afdfda2a00dfb05e2127f79f4261606e4672fb26f0f1906c56a0f5fb9d34aecc2a88ddca68f9b7e671daffde20c2b263bd3d2c0b1757c6c56c186

Download Submit
C:\Windows\System\XUdzHCU.exe

Filesize
1.5MB

MD5
10273ddd5a86f7ed47a4cde63c46fd02

SHA1
aac3e6fd93b7b16f8c56907e4d5f5c5b71afe825

SHA256
3243c7bcf5076204bbe05da7dd728705f85cd0cadc3626de7ecafdef27bb133a

SHA512
903bf87f4be1da1a56af0b61103a1e99fcb65d9c36797c019ed39e809d2a3b570b6edd0f4d3e77259b309236563ad2a5aeff9594cd1169c34360e5cc491d7aec

Download Submit
C:\Windows\System\bbUMttj.exe

Filesize
1.5MB

MD5
ab2dda58e38b81374c36f1b4248c378f

SHA1
0f205f102d21f6aa5417b61b0cbaea2f7b6785a0

SHA256
3f227f46498232fdd10b578c9eb489401bca80c14566fa7fd8678881991bfebf

SHA512
af41f2ece992db29b1dc4f0960f171d704b219412727ce20549485ed3062b4b3a5a9601e4bff2b74a23d00b5f2b9a851acdedfe6c2b46656d7b20283d1459f49

Download Submit
C:\Windows\System\dLmKwuz.exe

Filesize
1.5MB

MD5
04d60405a78d8c30aa0bda4582fb3c61

SHA1
654dd5e1264f8657690fa37cdeba6f5e43481b87

SHA256
f9a111f74855792ac490604123faaa5f7b995b942f5fbac48ce261aae66c1c66

SHA512
417e2e6c6d67d83121b4c8605f2fcf008f141b287781770388cc8a3948662f567aa19163b51d8e149d33bd43b318e9927e8b301f9ad930df243ce928436196bd

Download Submit
C:\Windows\System\gqXjmMS.exe

Filesize
1.5MB

MD5
db8feb173e5392dced363d466033ae1b

SHA1
9b01c7f86ea51ed9ccf7314b84200da6054fecb2

SHA256
bcfc5898090d79b7a1b71ffd5bb35216e5c1052f902d98f8496ed48a6b77b86f

SHA512
4aa802731ce043321fa83949ed6605e56d0fe9d4696d9ed68dc4f2bb2ba61a2f5326463d03ddc963d0a9e76b15db0cc1b49c4d3b447b05a12261bae42e5dfcc8

Download Submit
C:\Windows\System\hQrqCjg.exe

Filesize
1.5MB

MD5
f27632b5c704c8a486c12f5a67f55577

SHA1
a24d910102de1c4cc4cf080f505f85886fc63dd1

SHA256
b90af7a4741c4b07ffa9f609e744b81c5b29677a7e1b68cf445380fb792d3fa5

SHA512
61e97bcb69cf93964425e9dbc6a662f1bc4c118e700581fc8a05b8d00de42be48847b184e69ca161ab31b9c0d0f78319947fa41a3b2fa9cf827ffa6db9c6ec19

Download Submit
C:\Windows\System\kFRdSDe.exe

Filesize
1.5MB

MD5
8fad5d448adc8fb2375fe5f6a64d3730

SHA1
0c8aaf659c6a6cd3a754427bc1b962c27b875201

SHA256
81df09e2e9f19dc8c0e99000d19b502d0cb3bb16e2192a03c8597a3a5e39d0aa

SHA512
7c4a4b44b5cce3faf54148b56078b33bc24b9c3f43bcc2f9fea9ba4763658a49c2a705659da53f82d9ae715d37120f332ba49dae34418a5b9b88328574359ba3

Download Submit
C:\Windows\System\kpewNgs.exe

Filesize
1.5MB

MD5
17d3a7dc860b3b185255ac381efea0d8

SHA1
a2373421263ad68cba6a97a7b2f5e987308231df

SHA256
7c3f552fa26bbd426a769fdc0b9c488890dd7c8affa3c17dbb8d4e0f5f211272

SHA512
653fc0a8bbaef046b6a8e175fcb5f0714f0b5d45e4050fe12d870f7b802e823339c20cd344ccc937142253a83ffff79aef43ef75da57c639d0752cab520af54f

Download Submit
C:\Windows\System\ktpeRTM.exe

Filesize
1.5MB

MD5
e91c32efb87d991eae153d256fdeb77d

SHA1
a3ef7b8a6422ead4a495a0a32f2dcbe64a34eeba

SHA256
aeaa72c8c74fc00ef0992172bc80e793aa18217ac5659afee3a59746f411ed49

SHA512
421de72ccef105284acd080fcd2a34a97fe1e7a0fa0379082efb1313e8f16b221737eaf150b0297bb8e4b81454ca1a140cf73ae76d733a81c4862fbaf293605a

Download Submit
C:\Windows\System\mDkndLV.exe

Filesize
1.5MB

MD5
ceabca66fcdaaef7f791e1972e30d7df

SHA1
f9c43f392d435ef3fed1714dbc99ffc3adca5ce6

SHA256
bb27a6613042565940657dbfed2889aafd26525c1f0f9231021df4cc28789667

SHA512
86b604b4df6fbfedfa566429e028263e02be73b008f76a880ff7568dd0297c3f6c7d115a25c5c4f9be3a1da8e087061beb48a4e46fd74a2b9b135f60736f6753

Download Submit
C:\Windows\System\muyIJuD.exe

Filesize
1.5MB

MD5
4f524c1ace96b86a2d23efc0672e4ab4

SHA1
7df199d0e8aff32e380b07acdb4c0d06195e8563

SHA256
7957271bbd9255fef149c8fdb9b14c32b42423132d9b01966f05794dcfd796da

SHA512
d93892e7dc7eefcc458ea7f067cc4158c2c48d9a200af9ba8e3d84ccbe65d549c3fe95bd81dc1684c7c536cc25f53c7c494f82e6188b9a881525a23333b6bcf6

Download Submit
C:\Windows\System\pvRMAWN.exe

Filesize
1.5MB

MD5
883cd77d9f70f3858cf727e155ba64b5

SHA1
b3048f59ae760c30a39c705694082b77f265d310

SHA256
4af88bca0bfb5383403770343ce7fbd9b74dc00760df561ea31199d65f6bcbd8

SHA512
c4e2b4799201a7676a8baf43d8697baeff1cee928a5f9537ea0b5da04d1a0bccb8fb5a224f3941559ca6e0daac9cc5812792116fcba26bc61c89f11f268997b8

Download Submit
C:\Windows\System\pxCVFRf.exe

Filesize
1.5MB

MD5
97c00b1fa30f0f2086720c356a10377c

SHA1
319b65c2e57b122db89133a79c5240468129ccef

SHA256
2d181cb659a40b9a0a544bf67f56c6fa093dbf2ad8ecc589d77fe3ad7fc54d6b

SHA512
7e2326fee277f711c38513f71e6c00f682df89ae4681ed9aa4d6878265c3bb7f8c951a2020feab897683a1c324035750a3f37d52cd13677f81858a31c38b98b3

Download Submit
C:\Windows\System\pzOmmOE.exe

Filesize
1.5MB

MD5
3e1b7103877ac714051a9dc29a72aec8

SHA1
5789991e48f44355d7debe0779ad2b09fd836a07

SHA256
b7feb3442b27b92e12faf4d3efc14c5829db7f76ca42b0f707f80bed58306222

SHA512
815089ddcdc87538e7d6ef632ca5fbcd7eaa6474f60698ce5af4603b469c0ce879929baef07d68edf20f02c996602dad12a1d3ac20e3a0a8b06c91e5bf192772

Download Submit
C:\Windows\System\rYpfRfN.exe

Filesize
1.5MB

MD5
e4c6935779da798e1dc6262db57d75f5

SHA1
ee85265286ebc56d0d32c91e2a0c9c1a9f177492

SHA256
a0bbf8b4de1bf68e0e7a224cb06d7897a5cc5e545fc0c75d368e1878d50c922c

SHA512
0655dfc323fa7d4838046d6b64f1aebfb165aa7ec735c41a73907e8f368462659118474ec74b8129cf7ce57356e12ec709950adbd1378d47a4fe74cd6111e891

Download Submit
C:\Windows\System\rfJTBMr.exe

Filesize
1.5MB

MD5
92e3f85a59ce08496421fe1eb5c89660

SHA1
09782f213c9326af6a7a42dd52e1714d29f03a73

SHA256
de75276cbc5bbd4041bd9d6f517cb37f6dd291941ba07690a7e52491bb835de4

SHA512
70cff2eaebfaa6eecfa37582e92d2df345b8c71f4d8f25c7c95115770ad6be538a45c069774e28e0e9465b4f344c7fd5ec25901f7ce861f3b060976c62c9c18e

Download Submit
C:\Windows\System\uYdbnGy.exe

Filesize
1.5MB

MD5
b6aaa6e784026a1819512e5b06c45586

SHA1
424e5827d94d7f9111558e767db7938187781ddb

SHA256
21ca28b619c25f3da67a6608b0ba668ebe615a8844c976ff79f5555aa3ec12c1

SHA512
43c623f6f50b03a789ed6adee9afbf753ee05e855317ffd588d5c815a7aa3546d7ab959b1447b2c44190d16502802c54226bbb1d4bf8c4125229868c8d6981e0

Download Submit
C:\Windows\System\wMBxgzp.exe

Filesize
1.5MB

MD5
bed86a2fb6218e3cc3732c310690bbaf

SHA1
bbcfa4398ff5644ef4f5fd39a2d50f2cac93f131

SHA256
1196402b9cd55d29c47553b91e4ed0ffe063bbef12c397db54ef5ecc22403a98

SHA512
90f6505229c876ab1d9da1c5e2ee3b3651e294ed86687d6ced6f6004a22abb3b82b8400d959e43a57821776295c8c7b90f0b58915d7d917e8d71df85f0dc5054

Download Submit
C:\Windows\System\weBvNEy.exe

Filesize
1.5MB

MD5
2e52f06a9d7ce91a61f6cd0430974f98

SHA1
54aeebed29a66ed9b0563a9178adba1e754313a2

SHA256
27ad9ea9eb3d51b75e4d1021c2cfd57043fb175ec1798a191e28fb3e02fab6c0

SHA512
d2f07504ff5bb4eb05075287db9d53d3d07a56b5fc75df372a96b1c50c97a1e00a4f48e29f9a2119c859380758f0432a3d0d4aa05d04391c133b7d3038c8aa52

Download Submit
C:\Windows\System\zyYaSER.exe

Filesize
1.5MB

MD5
a33a22a6ef122911d39a1766a88e40e1

SHA1
a787038cc50b9c684d700e44a0d10b7434ac2641

SHA256
57fe89e7a59c65276c05248217320060b1dc9f0ac611320769c61f00a02c5ae9

SHA512
80fd1c17824f30672a5e162ac96e589c344b4c04625010f7ea76a3715a9d059dbd0024979c65660a9b8fb63b044e37bafbe91a9a1c5fe08cd26f21a3961c7413

Download Submit
memory/1116-0-0x000001BFA65C0000-0x000001BFA65D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads