xmrig | 6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
Size

1.3MB
MD5

9d9939107f051559ebdeff2aac37e061
SHA1

273ee2959e274b24683ac2b47602c052f617b2ee
SHA256

6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c
SHA512

a94e197ff33138e2308255b065f1a334342571b65ae92143e9fe14089d695b72e32c26d3afe6389911dd2386d78e968270091d05f4b3f3096cda73ffa6891382
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwyMRX:GezaTF8FcNkNdfE0pZ9ozttwIRx2VQd

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023ca7-5.dat	xmrig
behavioral2/files/0x0007000000023ca6-7.dat	xmrig
behavioral2/files/0x0007000000023ca8-23.dat	xmrig
behavioral2/files/0x0007000000023caa-29.dat	xmrig
behavioral2/files/0x0007000000023cae-49.dat	xmrig
behavioral2/files/0x0007000000023caf-55.dat	xmrig
behavioral2/files/0x0007000000023cad-53.dat	xmrig
behavioral2/files/0x0007000000023cac-51.dat	xmrig
behavioral2/files/0x0007000000023cab-47.dat	xmrig
behavioral2/files/0x0007000000023ca9-43.dat	xmrig
behavioral2/files/0x0008000000023ca2-15.dat	xmrig
behavioral2/files/0x0007000000023cb0-59.dat	xmrig
behavioral2/files/0x0007000000023cb2-64.dat	xmrig
behavioral2/files/0x0007000000023cb3-71.dat	xmrig
behavioral2/files/0x0007000000023cb5-78.dat	xmrig
behavioral2/files/0x0008000000023ca3-88.dat	xmrig
behavioral2/files/0x0007000000023cb6-90.dat	xmrig
behavioral2/files/0x0007000000023cb4-76.dat	xmrig
behavioral2/files/0x0007000000023cb7-96.dat	xmrig
behavioral2/files/0x0007000000023cb9-107.dat	xmrig
behavioral2/files/0x0007000000023cba-111.dat	xmrig
behavioral2/files/0x0007000000023cbc-117.dat	xmrig
behavioral2/files/0x0007000000023cbb-118.dat	xmrig
behavioral2/files/0x0007000000023cbd-124.dat	xmrig
behavioral2/files/0x0007000000023cb8-109.dat	xmrig
behavioral2/files/0x0007000000023cbf-162.dat	xmrig
behavioral2/files/0x0007000000023cc2-160.dat	xmrig
behavioral2/files/0x0007000000023cc1-158.dat	xmrig
behavioral2/files/0x0007000000023cc0-156.dat	xmrig
behavioral2/files/0x0007000000023cc6-155.dat	xmrig
behavioral2/files/0x0007000000023cc5-154.dat	xmrig
behavioral2/files/0x0007000000023cc4-153.dat	xmrig
behavioral2/files/0x0007000000023cc3-152.dat	xmrig
behavioral2/files/0x0007000000023cbe-150.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4340	eJsfBkd.exe
4688	eGifRHn.exe
4996	fTXOnxZ.exe
684	ydbGZBj.exe
2632	TfgvNoP.exe
516	UWtPGoW.exe
4988	dWDRqCM.exe
4460	KSboMxh.exe
3040	kIqRwNm.exe
3880	QIaxzjx.exe
4472	ZMALUSM.exe
2504	EcHExrJ.exe
4616	JYyBgGU.exe
3820	PXTFpGt.exe
2960	sCCgjuF.exe
2000	iIVFchC.exe
1260	MsrswOz.exe
4372	KKQLCCA.exe
2056	IYsrELW.exe
4636	hUhZEdo.exe
4252	hexywTD.exe
4332	NGgcCqI.exe
3208	aRBHlui.exe
4448	xYqfXKw.exe
2784	cExcspL.exe
940	rXXHebL.exe
2088	nCTnhuK.exe
4336	mTNlooc.exe
60	CVKQYqY.exe
1668	swZutPY.exe
4148	NzBJAYC.exe
1628	JXaZPxL.exe
1972	NXRmvTx.exe
736	TyyCque.exe
4828	NFcVrPj.exe
1240	ZorTBAD.exe
2640	EtktEiJ.exe
1732	kIytCZf.exe
4568	cpZZhQi.exe
1760	MnEuZyj.exe
2112	tOGzoXw.exe
4512	jbdDqed.exe
4844	zTsOUyu.exe
4748	QehONYA.exe
1920	RqBBYRE.exe
4564	HDinHVo.exe
4896	vBWTQho.exe
2232	TjIjqac.exe
860	rRTmldK.exe
3668	yPfNjev.exe
1996	ugRJZMs.exe
1664	aqkCoSY.exe
1964	RsMLfWw.exe
2944	SfZDTpw.exe
3608	QEtjKpO.exe
1820	SaTsKgF.exe
3060	mEAIkWh.exe
4488	MNFKGdH.exe
2532	pChyurD.exe
3424	cpgvROd.exe
3832	dRPnAUv.exe
4980	lzCntzI.exe
4752	trFtUTg.exe
3684	YzIydaz.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZorTBAD.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\pMTsLBb.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\ALiYSvV.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\uAvhmgn.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\IUiTfCi.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\FAGnGpq.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\GIYQeVK.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\LJQKycz.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\PFKPQfh.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\XxRvroT.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\IyEVTKq.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\IGxuDos.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\cGxliJa.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\XIyWSUa.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\uWKsCPO.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\vlAvXMY.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\SGTtriB.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\RmNexjj.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\hTopIQY.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\yPpSyEp.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\YHYaYgX.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\CrPOlRU.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\FbiFZse.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\pitcBGA.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\JPBfkLY.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\zRJyxwf.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\RZlrsXU.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\oQjLtvY.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\UzESOhn.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\eijAiGk.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\WuTVxme.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\TvTQiuG.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\YzIydaz.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\HtKsphv.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\RsMTWvU.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\lQBODgA.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\eJmMTXE.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\ATGJqEl.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\cXxhIhd.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\LsHnbTW.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\cdiUsJf.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\rXXHebL.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\TUPpCjI.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\XPuEXzg.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\MpfqxSU.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\MuRxSqs.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\NdUMCyU.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\LLCCmtc.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\FglVEBj.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\HsyHwbS.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\DWppuno.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\TgcvDYT.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\mqQDNXa.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\jfMPkmd.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\bvFfqMC.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\izYocOB.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\xUfKDQW.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\eJsfBkd.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\CVKQYqY.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\FCtWvNO.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\DpGXNPM.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\yTlHpVy.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\ZMALUSM.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
File created	C:\Windows\System\VGxNZvB.exe	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 4340	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	84
PID 4732 wrote to memory of 4340	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	84
PID 4732 wrote to memory of 4688	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	85
PID 4732 wrote to memory of 4688	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	85
PID 4732 wrote to memory of 4996	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	86
PID 4732 wrote to memory of 4996	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	86
PID 4732 wrote to memory of 684	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	87
PID 4732 wrote to memory of 684	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	87
PID 4732 wrote to memory of 2632	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	88
PID 4732 wrote to memory of 2632	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	88
PID 4732 wrote to memory of 516	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	89
PID 4732 wrote to memory of 516	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	89
PID 4732 wrote to memory of 4988	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	90
PID 4732 wrote to memory of 4988	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	90
PID 4732 wrote to memory of 4460	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	91
PID 4732 wrote to memory of 4460	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	91
PID 4732 wrote to memory of 3040	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	92
PID 4732 wrote to memory of 3040	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	92
PID 4732 wrote to memory of 3880	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	93
PID 4732 wrote to memory of 3880	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	93
PID 4732 wrote to memory of 4472	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	94
PID 4732 wrote to memory of 4472	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	94
PID 4732 wrote to memory of 2504	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	95
PID 4732 wrote to memory of 2504	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	95
PID 4732 wrote to memory of 4616	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	96
PID 4732 wrote to memory of 4616	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	96
PID 4732 wrote to memory of 2000	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	97
PID 4732 wrote to memory of 2000	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	97
PID 4732 wrote to memory of 3820	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	98
PID 4732 wrote to memory of 3820	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	98
PID 4732 wrote to memory of 2960	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	99
PID 4732 wrote to memory of 2960	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	99
PID 4732 wrote to memory of 1260	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	100
PID 4732 wrote to memory of 1260	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	100
PID 4732 wrote to memory of 4372	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	101
PID 4732 wrote to memory of 4372	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	101
PID 4732 wrote to memory of 2056	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	104
PID 4732 wrote to memory of 2056	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	104
PID 4732 wrote to memory of 4636	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	105
PID 4732 wrote to memory of 4636	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	105
PID 4732 wrote to memory of 4332	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	106
PID 4732 wrote to memory of 4332	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	106
PID 4732 wrote to memory of 4252	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	107
PID 4732 wrote to memory of 4252	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	107
PID 4732 wrote to memory of 3208	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	108
PID 4732 wrote to memory of 3208	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	108
PID 4732 wrote to memory of 4448	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	109
PID 4732 wrote to memory of 4448	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	109
PID 4732 wrote to memory of 2784	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	110
PID 4732 wrote to memory of 2784	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	110
PID 4732 wrote to memory of 940	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	111
PID 4732 wrote to memory of 940	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	111
PID 4732 wrote to memory of 1668	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	112
PID 4732 wrote to memory of 1668	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	112
PID 4732 wrote to memory of 2088	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	113
PID 4732 wrote to memory of 2088	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	113
PID 4732 wrote to memory of 4336	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	114
PID 4732 wrote to memory of 4336	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	114
PID 4732 wrote to memory of 60	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	115
PID 4732 wrote to memory of 60	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	115
PID 4732 wrote to memory of 4148	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	116
PID 4732 wrote to memory of 4148	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	116
PID 4732 wrote to memory of 1628	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	117
PID 4732 wrote to memory of 1628	4732	6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe	117

C:\Users\Admin\AppData\Local\Temp\6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe
"C:\Users\Admin\AppData\Local\Temp\6eeeb5f9b4abc9db8c07465b976cdc32298e02700a8cb11185a9e05ee802ca9c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\System\eJsfBkd.exe
  C:\Windows\System\eJsfBkd.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\eGifRHn.exe
  C:\Windows\System\eGifRHn.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\fTXOnxZ.exe
  C:\Windows\System\fTXOnxZ.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\ydbGZBj.exe
  C:\Windows\System\ydbGZBj.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\TfgvNoP.exe
  C:\Windows\System\TfgvNoP.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\UWtPGoW.exe
  C:\Windows\System\UWtPGoW.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\dWDRqCM.exe
  C:\Windows\System\dWDRqCM.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\KSboMxh.exe
  C:\Windows\System\KSboMxh.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\kIqRwNm.exe
  C:\Windows\System\kIqRwNm.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\QIaxzjx.exe
  C:\Windows\System\QIaxzjx.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\ZMALUSM.exe
  C:\Windows\System\ZMALUSM.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\EcHExrJ.exe
  C:\Windows\System\EcHExrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\JYyBgGU.exe
  C:\Windows\System\JYyBgGU.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\iIVFchC.exe
  C:\Windows\System\iIVFchC.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\PXTFpGt.exe
  C:\Windows\System\PXTFpGt.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\sCCgjuF.exe
  C:\Windows\System\sCCgjuF.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\MsrswOz.exe
  C:\Windows\System\MsrswOz.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\KKQLCCA.exe
  C:\Windows\System\KKQLCCA.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\IYsrELW.exe
  C:\Windows\System\IYsrELW.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\hUhZEdo.exe
  C:\Windows\System\hUhZEdo.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\NGgcCqI.exe
  C:\Windows\System\NGgcCqI.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\hexywTD.exe
  C:\Windows\System\hexywTD.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\aRBHlui.exe
  C:\Windows\System\aRBHlui.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\xYqfXKw.exe
  C:\Windows\System\xYqfXKw.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\cExcspL.exe
  C:\Windows\System\cExcspL.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\rXXHebL.exe
  C:\Windows\System\rXXHebL.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\swZutPY.exe
  C:\Windows\System\swZutPY.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\nCTnhuK.exe
  C:\Windows\System\nCTnhuK.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\mTNlooc.exe
  C:\Windows\System\mTNlooc.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\CVKQYqY.exe
  C:\Windows\System\CVKQYqY.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\NzBJAYC.exe
  C:\Windows\System\NzBJAYC.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\JXaZPxL.exe
  C:\Windows\System\JXaZPxL.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\NXRmvTx.exe
  C:\Windows\System\NXRmvTx.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\TyyCque.exe
  C:\Windows\System\TyyCque.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\NFcVrPj.exe
  C:\Windows\System\NFcVrPj.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\ZorTBAD.exe
  C:\Windows\System\ZorTBAD.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\EtktEiJ.exe
  C:\Windows\System\EtktEiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\kIytCZf.exe
  C:\Windows\System\kIytCZf.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\cpZZhQi.exe
  C:\Windows\System\cpZZhQi.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\MnEuZyj.exe
  C:\Windows\System\MnEuZyj.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\tOGzoXw.exe
  C:\Windows\System\tOGzoXw.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\jbdDqed.exe
  C:\Windows\System\jbdDqed.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\zTsOUyu.exe
  C:\Windows\System\zTsOUyu.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\QehONYA.exe
  C:\Windows\System\QehONYA.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\RqBBYRE.exe
  C:\Windows\System\RqBBYRE.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\HDinHVo.exe
  C:\Windows\System\HDinHVo.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\vBWTQho.exe
  C:\Windows\System\vBWTQho.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\TjIjqac.exe
  C:\Windows\System\TjIjqac.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\rRTmldK.exe
  C:\Windows\System\rRTmldK.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\yPfNjev.exe
  C:\Windows\System\yPfNjev.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\ugRJZMs.exe
  C:\Windows\System\ugRJZMs.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\aqkCoSY.exe
  C:\Windows\System\aqkCoSY.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\RsMLfWw.exe
  C:\Windows\System\RsMLfWw.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\SfZDTpw.exe
  C:\Windows\System\SfZDTpw.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\QEtjKpO.exe
  C:\Windows\System\QEtjKpO.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\SaTsKgF.exe
  C:\Windows\System\SaTsKgF.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\mEAIkWh.exe
  C:\Windows\System\mEAIkWh.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\MNFKGdH.exe
  C:\Windows\System\MNFKGdH.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\pChyurD.exe
  C:\Windows\System\pChyurD.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\cpgvROd.exe
  C:\Windows\System\cpgvROd.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\dRPnAUv.exe
  C:\Windows\System\dRPnAUv.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\trFtUTg.exe
  C:\Windows\System\trFtUTg.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\lzCntzI.exe
  C:\Windows\System\lzCntzI.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\YzIydaz.exe
  C:\Windows\System\YzIydaz.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\lTUAgUI.exe
  C:\Windows\System\lTUAgUI.exe
  2⤵
  PID:1936
- C:\Windows\System\KURnhOu.exe
  C:\Windows\System\KURnhOu.exe
  2⤵
  PID:2544
- C:\Windows\System\dgYyFBY.exe
  C:\Windows\System\dgYyFBY.exe
  2⤵
  PID:3644
- C:\Windows\System\bdpsMNP.exe
  C:\Windows\System\bdpsMNP.exe
  2⤵
  PID:5088
- C:\Windows\System\pDKLkPL.exe
  C:\Windows\System\pDKLkPL.exe
  2⤵
  PID:1640
- C:\Windows\System\uCuHDws.exe
  C:\Windows\System\uCuHDws.exe
  2⤵
  PID:3604
- C:\Windows\System\DqosGOf.exe
  C:\Windows\System\DqosGOf.exe
  2⤵
  PID:2192
- C:\Windows\System\XVwgsgS.exe
  C:\Windows\System\XVwgsgS.exe
  2⤵
  PID:1656
- C:\Windows\System\lQBODgA.exe
  C:\Windows\System\lQBODgA.exe
  2⤵
  PID:3412
- C:\Windows\System\JVPBFan.exe
  C:\Windows\System\JVPBFan.exe
  2⤵
  PID:4124
- C:\Windows\System\pAyuNOD.exe
  C:\Windows\System\pAyuNOD.exe
  2⤵
  PID:3708
- C:\Windows\System\hNdxaeW.exe
  C:\Windows\System\hNdxaeW.exe
  2⤵
  PID:2548
- C:\Windows\System\TuXnmoU.exe
  C:\Windows\System\TuXnmoU.exe
  2⤵
  PID:5080
- C:\Windows\System\yBAUEPC.exe
  C:\Windows\System\yBAUEPC.exe
  2⤵
  PID:1844
- C:\Windows\System\eLqezcp.exe
  C:\Windows\System\eLqezcp.exe
  2⤵
  PID:1396
- C:\Windows\System\BKGxRSE.exe
  C:\Windows\System\BKGxRSE.exe
  2⤵
  PID:4956
- C:\Windows\System\WPXaOMC.exe
  C:\Windows\System\WPXaOMC.exe
  2⤵
  PID:4936
- C:\Windows\System\CrPOlRU.exe
  C:\Windows\System\CrPOlRU.exe
  2⤵
  PID:2300
- C:\Windows\System\wnTgTOY.exe
  C:\Windows\System\wnTgTOY.exe
  2⤵
  PID:4016
- C:\Windows\System\SVMJoeq.exe
  C:\Windows\System\SVMJoeq.exe
  2⤵
  PID:2972
- C:\Windows\System\gspKsao.exe
  C:\Windows\System\gspKsao.exe
  2⤵
  PID:1840
- C:\Windows\System\GCmStGq.exe
  C:\Windows\System\GCmStGq.exe
  2⤵
  PID:3360
- C:\Windows\System\JSIPFyS.exe
  C:\Windows\System\JSIPFyS.exe
  2⤵
  PID:3528
- C:\Windows\System\CxzeDWC.exe
  C:\Windows\System\CxzeDWC.exe
  2⤵
  PID:3784
- C:\Windows\System\lBwessW.exe
  C:\Windows\System\lBwessW.exe
  2⤵
  PID:676
- C:\Windows\System\HsyHwbS.exe
  C:\Windows\System\HsyHwbS.exe
  2⤵
  PID:2400
- C:\Windows\System\prNdzty.exe
  C:\Windows\System\prNdzty.exe
  2⤵
  PID:2040
- C:\Windows\System\EwOyDcM.exe
  C:\Windows\System\EwOyDcM.exe
  2⤵
  PID:4492
- C:\Windows\System\PDCVVTA.exe
  C:\Windows\System\PDCVVTA.exe
  2⤵
  PID:4028
- C:\Windows\System\VfugRMG.exe
  C:\Windows\System\VfugRMG.exe
  2⤵
  PID:2868
- C:\Windows\System\uPTDJcO.exe
  C:\Windows\System\uPTDJcO.exe
  2⤵
  PID:2268
- C:\Windows\System\lMtoUuH.exe
  C:\Windows\System\lMtoUuH.exe
  2⤵
  PID:5132
- C:\Windows\System\jXGmCCj.exe
  C:\Windows\System\jXGmCCj.exe
  2⤵
  PID:5160
- C:\Windows\System\QnXqSFd.exe
  C:\Windows\System\QnXqSFd.exe
  2⤵
  PID:5188
- C:\Windows\System\vOAdqDu.exe
  C:\Windows\System\vOAdqDu.exe
  2⤵
  PID:5220
- C:\Windows\System\OijYOkj.exe
  C:\Windows\System\OijYOkj.exe
  2⤵
  PID:5244
- C:\Windows\System\nGSWKoH.exe
  C:\Windows\System\nGSWKoH.exe
  2⤵
  PID:5272
- C:\Windows\System\yiJcLMx.exe
  C:\Windows\System\yiJcLMx.exe
  2⤵
  PID:5312
- C:\Windows\System\gdKVAZC.exe
  C:\Windows\System\gdKVAZC.exe
  2⤵
  PID:5332
- C:\Windows\System\WZoOjBr.exe
  C:\Windows\System\WZoOjBr.exe
  2⤵
  PID:5348
- C:\Windows\System\oOEdlrP.exe
  C:\Windows\System\oOEdlrP.exe
  2⤵
  PID:5376
- C:\Windows\System\SGTtriB.exe
  C:\Windows\System\SGTtriB.exe
  2⤵
  PID:5404
- C:\Windows\System\ZJaOEYo.exe
  C:\Windows\System\ZJaOEYo.exe
  2⤵
  PID:5436
- C:\Windows\System\azLAtke.exe
  C:\Windows\System\azLAtke.exe
  2⤵
  PID:5460
- C:\Windows\System\HbxeLHM.exe
  C:\Windows\System\HbxeLHM.exe
  2⤵
  PID:5492
- C:\Windows\System\sfJCabl.exe
  C:\Windows\System\sfJCabl.exe
  2⤵
  PID:5524
- C:\Windows\System\RfGzPlS.exe
  C:\Windows\System\RfGzPlS.exe
  2⤵
  PID:5540
- C:\Windows\System\vDIqEci.exe
  C:\Windows\System\vDIqEci.exe
  2⤵
  PID:5564
- C:\Windows\System\sxcCjjs.exe
  C:\Windows\System\sxcCjjs.exe
  2⤵
  PID:5596
- C:\Windows\System\WDMEDOP.exe
  C:\Windows\System\WDMEDOP.exe
  2⤵
  PID:5632
- C:\Windows\System\ShXiODm.exe
  C:\Windows\System\ShXiODm.exe
  2⤵
  PID:5660
- C:\Windows\System\jiKtlay.exe
  C:\Windows\System\jiKtlay.exe
  2⤵
  PID:5688
- C:\Windows\System\TbiXQvF.exe
  C:\Windows\System\TbiXQvF.exe
  2⤵
  PID:5724
- C:\Windows\System\umImvKm.exe
  C:\Windows\System\umImvKm.exe
  2⤵
  PID:5748
- C:\Windows\System\sFXMUBW.exe
  C:\Windows\System\sFXMUBW.exe
  2⤵
  PID:5772
- C:\Windows\System\DyTezEX.exe
  C:\Windows\System\DyTezEX.exe
  2⤵
  PID:5804
- C:\Windows\System\IBvPtaN.exe
  C:\Windows\System\IBvPtaN.exe
  2⤵
  PID:5832
- C:\Windows\System\wfhQkQZ.exe
  C:\Windows\System\wfhQkQZ.exe
  2⤵
  PID:5860
- C:\Windows\System\zDVCkDC.exe
  C:\Windows\System\zDVCkDC.exe
  2⤵
  PID:5896
- C:\Windows\System\WHXONlo.exe
  C:\Windows\System\WHXONlo.exe
  2⤵
  PID:5912
- C:\Windows\System\ClDfbcL.exe
  C:\Windows\System\ClDfbcL.exe
  2⤵
  PID:5940
- C:\Windows\System\ORtBnhD.exe
  C:\Windows\System\ORtBnhD.exe
  2⤵
  PID:5968
- C:\Windows\System\xFPzXiH.exe
  C:\Windows\System\xFPzXiH.exe
  2⤵
  PID:6004
- C:\Windows\System\etcvRYV.exe
  C:\Windows\System\etcvRYV.exe
  2⤵
  PID:6040
- C:\Windows\System\nGnDziJ.exe
  C:\Windows\System\nGnDziJ.exe
  2⤵
  PID:6064
- C:\Windows\System\rNFzios.exe
  C:\Windows\System\rNFzios.exe
  2⤵
  PID:6084
- C:\Windows\System\wsjqpJD.exe
  C:\Windows\System\wsjqpJD.exe
  2⤵
  PID:6116
- C:\Windows\System\PNDvFsG.exe
  C:\Windows\System\PNDvFsG.exe
  2⤵
  PID:3468
- C:\Windows\System\jNBiibz.exe
  C:\Windows\System\jNBiibz.exe
  2⤵
  PID:5148
- C:\Windows\System\LqrYNit.exe
  C:\Windows\System\LqrYNit.exe
  2⤵
  PID:5232
- C:\Windows\System\FPKBLUH.exe
  C:\Windows\System\FPKBLUH.exe
  2⤵
  PID:5292
- C:\Windows\System\htGsHrr.exe
  C:\Windows\System\htGsHrr.exe
  2⤵
  PID:5368
- C:\Windows\System\pMTsLBb.exe
  C:\Windows\System\pMTsLBb.exe
  2⤵
  PID:5552
- C:\Windows\System\ehWcNMc.exe
  C:\Windows\System\ehWcNMc.exe
  2⤵
  PID:5588
- C:\Windows\System\OiFotRD.exe
  C:\Windows\System\OiFotRD.exe
  2⤵
  PID:5616
- C:\Windows\System\YTvEIfk.exe
  C:\Windows\System\YTvEIfk.exe
  2⤵
  PID:5668
- C:\Windows\System\WeerPDf.exe
  C:\Windows\System\WeerPDf.exe
  2⤵
  PID:5716
- C:\Windows\System\YKqEurB.exe
  C:\Windows\System\YKqEurB.exe
  2⤵
  PID:5760
- C:\Windows\System\zsIRSvS.exe
  C:\Windows\System\zsIRSvS.exe
  2⤵
  PID:5828
- C:\Windows\System\rHvRKLk.exe
  C:\Windows\System\rHvRKLk.exe
  2⤵
  PID:5872
- C:\Windows\System\HtKsphv.exe
  C:\Windows\System\HtKsphv.exe
  2⤵
  PID:5936
- C:\Windows\System\CyjBGkb.exe
  C:\Windows\System\CyjBGkb.exe
  2⤵
  PID:6032
- C:\Windows\System\oTtwRFy.exe
  C:\Windows\System\oTtwRFy.exe
  2⤵
  PID:6096
- C:\Windows\System\zfYCqVn.exe
  C:\Windows\System\zfYCqVn.exe
  2⤵
  PID:5128
- C:\Windows\System\oYfCwWb.exe
  C:\Windows\System\oYfCwWb.exe
  2⤵
  PID:5328
- C:\Windows\System\mmLEWCr.exe
  C:\Windows\System\mmLEWCr.exe
  2⤵
  PID:5420
- C:\Windows\System\qIKJynr.exe
  C:\Windows\System\qIKJynr.exe
  2⤵
  PID:5844
- C:\Windows\System\TtWwyyr.exe
  C:\Windows\System\TtWwyyr.exe
  2⤵
  PID:5964
- C:\Windows\System\tqLegIH.exe
  C:\Windows\System\tqLegIH.exe
  2⤵
  PID:6024
- C:\Windows\System\FbiFZse.exe
  C:\Windows\System\FbiFZse.exe
  2⤵
  PID:5124
- C:\Windows\System\OxJSIeD.exe
  C:\Windows\System\OxJSIeD.exe
  2⤵
  PID:5624
- C:\Windows\System\fGYeVxM.exe
  C:\Windows\System\fGYeVxM.exe
  2⤵
  PID:6164
- C:\Windows\System\puhBKqA.exe
  C:\Windows\System\puhBKqA.exe
  2⤵
  PID:6192
- C:\Windows\System\jVuBmHe.exe
  C:\Windows\System\jVuBmHe.exe
  2⤵
  PID:6216
- C:\Windows\System\WDFGoND.exe
  C:\Windows\System\WDFGoND.exe
  2⤵
  PID:6252
- C:\Windows\System\JTxegaq.exe
  C:\Windows\System\JTxegaq.exe
  2⤵
  PID:6292
- C:\Windows\System\VbYvibu.exe
  C:\Windows\System\VbYvibu.exe
  2⤵
  PID:6312
- C:\Windows\System\NnSidbT.exe
  C:\Windows\System\NnSidbT.exe
  2⤵
  PID:6340
- C:\Windows\System\eJmMTXE.exe
  C:\Windows\System\eJmMTXE.exe
  2⤵
  PID:6376
- C:\Windows\System\JUSFyBo.exe
  C:\Windows\System\JUSFyBo.exe
  2⤵
  PID:6396
- C:\Windows\System\cNOKfNZ.exe
  C:\Windows\System\cNOKfNZ.exe
  2⤵
  PID:6420
- C:\Windows\System\yVYoeZc.exe
  C:\Windows\System\yVYoeZc.exe
  2⤵
  PID:6440
- C:\Windows\System\aCHfTMz.exe
  C:\Windows\System\aCHfTMz.exe
  2⤵
  PID:6460
- C:\Windows\System\tpWxrUk.exe
  C:\Windows\System\tpWxrUk.exe
  2⤵
  PID:6488
- C:\Windows\System\hSSwPRs.exe
  C:\Windows\System\hSSwPRs.exe
  2⤵
  PID:6512
- C:\Windows\System\WKGBHns.exe
  C:\Windows\System\WKGBHns.exe
  2⤵
  PID:6540
- C:\Windows\System\AoLegmJ.exe
  C:\Windows\System\AoLegmJ.exe
  2⤵
  PID:6568
- C:\Windows\System\HopbdWN.exe
  C:\Windows\System\HopbdWN.exe
  2⤵
  PID:6600
- C:\Windows\System\KamiZez.exe
  C:\Windows\System\KamiZez.exe
  2⤵
  PID:6632
- C:\Windows\System\XdLfRYc.exe
  C:\Windows\System\XdLfRYc.exe
  2⤵
  PID:6656
- C:\Windows\System\ipisKYq.exe
  C:\Windows\System\ipisKYq.exe
  2⤵
  PID:6680
- C:\Windows\System\DGWHMnD.exe
  C:\Windows\System\DGWHMnD.exe
  2⤵
  PID:6712
- C:\Windows\System\EuRzGak.exe
  C:\Windows\System\EuRzGak.exe
  2⤵
  PID:6732
- C:\Windows\System\eJHieRd.exe
  C:\Windows\System\eJHieRd.exe
  2⤵
  PID:6756
- C:\Windows\System\GsMmBqT.exe
  C:\Windows\System\GsMmBqT.exe
  2⤵
  PID:6784
- C:\Windows\System\jqvdTEy.exe
  C:\Windows\System\jqvdTEy.exe
  2⤵
  PID:6820
- C:\Windows\System\FglVEBj.exe
  C:\Windows\System\FglVEBj.exe
  2⤵
  PID:6852
- C:\Windows\System\xUKyVFV.exe
  C:\Windows\System\xUKyVFV.exe
  2⤵
  PID:6888
- C:\Windows\System\ezRzzQV.exe
  C:\Windows\System\ezRzzQV.exe
  2⤵
  PID:6924
- C:\Windows\System\RdtsLog.exe
  C:\Windows\System\RdtsLog.exe
  2⤵
  PID:6948
- C:\Windows\System\ZCabQvL.exe
  C:\Windows\System\ZCabQvL.exe
  2⤵
  PID:6968
- C:\Windows\System\DLqEgPu.exe
  C:\Windows\System\DLqEgPu.exe
  2⤵
  PID:6992
- C:\Windows\System\nCKqMnZ.exe
  C:\Windows\System\nCKqMnZ.exe
  2⤵
  PID:7016
- C:\Windows\System\WBOeNHp.exe
  C:\Windows\System\WBOeNHp.exe
  2⤵
  PID:7036
- C:\Windows\System\RmNexjj.exe
  C:\Windows\System\RmNexjj.exe
  2⤵
  PID:7068
- C:\Windows\System\hzUXDpk.exe
  C:\Windows\System\hzUXDpk.exe
  2⤵
  PID:7088
- C:\Windows\System\pciQCvj.exe
  C:\Windows\System\pciQCvj.exe
  2⤵
  PID:7112
- C:\Windows\System\xdJywHi.exe
  C:\Windows\System\xdJywHi.exe
  2⤵
  PID:7152
- C:\Windows\System\oEmGjaT.exe
  C:\Windows\System\oEmGjaT.exe
  2⤵
  PID:5988
- C:\Windows\System\ZTWSHuW.exe
  C:\Windows\System\ZTWSHuW.exe
  2⤵
  PID:6148
- C:\Windows\System\LWMIsdN.exe
  C:\Windows\System\LWMIsdN.exe
  2⤵
  PID:6224
- C:\Windows\System\VNcnyEh.exe
  C:\Windows\System\VNcnyEh.exe
  2⤵
  PID:6356
- C:\Windows\System\uWKsCPO.exe
  C:\Windows\System\uWKsCPO.exe
  2⤵
  PID:6416
- C:\Windows\System\vGjGECb.exe
  C:\Windows\System\vGjGECb.exe
  2⤵
  PID:6468
- C:\Windows\System\xrffYVl.exe
  C:\Windows\System\xrffYVl.exe
  2⤵
  PID:6508
- C:\Windows\System\YpHbkKP.exe
  C:\Windows\System\YpHbkKP.exe
  2⤵
  PID:6692
- C:\Windows\System\oENwzAF.exe
  C:\Windows\System\oENwzAF.exe
  2⤵
  PID:6596
- C:\Windows\System\ASXuMDh.exe
  C:\Windows\System\ASXuMDh.exe
  2⤵
  PID:6744
- C:\Windows\System\PnaxAlm.exe
  C:\Windows\System\PnaxAlm.exe
  2⤵
  PID:6728
- C:\Windows\System\OYsHTal.exe
  C:\Windows\System\OYsHTal.exe
  2⤵
  PID:6808
- C:\Windows\System\FAGnGpq.exe
  C:\Windows\System\FAGnGpq.exe
  2⤵
  PID:7024
- C:\Windows\System\hTopIQY.exe
  C:\Windows\System\hTopIQY.exe
  2⤵
  PID:6912
- C:\Windows\System\PsRUSgg.exe
  C:\Windows\System\PsRUSgg.exe
  2⤵
  PID:7028
- C:\Windows\System\SXyQGEi.exe
  C:\Windows\System\SXyQGEi.exe
  2⤵
  PID:6988
- C:\Windows\System\ysZsQzS.exe
  C:\Windows\System\ysZsQzS.exe
  2⤵
  PID:7048
- C:\Windows\System\bvFfqMC.exe
  C:\Windows\System\bvFfqMC.exe
  2⤵
  PID:6336
- C:\Windows\System\oFIfCoj.exe
  C:\Windows\System\oFIfCoj.exe
  2⤵
  PID:6528
- C:\Windows\System\SartAKR.exe
  C:\Windows\System\SartAKR.exe
  2⤵
  PID:6248
- C:\Windows\System\NeDmPlz.exe
  C:\Windows\System\NeDmPlz.exe
  2⤵
  PID:6328
- C:\Windows\System\gfrykYZ.exe
  C:\Windows\System\gfrykYZ.exe
  2⤵
  PID:6452
- C:\Windows\System\ZBMYIXG.exe
  C:\Windows\System\ZBMYIXG.exe
  2⤵
  PID:6776
- C:\Windows\System\dKjWjao.exe
  C:\Windows\System\dKjWjao.exe
  2⤵
  PID:7100
- C:\Windows\System\DkqGALW.exe
  C:\Windows\System\DkqGALW.exe
  2⤵
  PID:6720
- C:\Windows\System\nckvJdZ.exe
  C:\Windows\System\nckvJdZ.exe
  2⤵
  PID:7176
- C:\Windows\System\vlAvXMY.exe
  C:\Windows\System\vlAvXMY.exe
  2⤵
  PID:7204
- C:\Windows\System\BhHTcXC.exe
  C:\Windows\System\BhHTcXC.exe
  2⤵
  PID:7240
- C:\Windows\System\kGiTNKk.exe
  C:\Windows\System\kGiTNKk.exe
  2⤵
  PID:7276
- C:\Windows\System\sbhUcYb.exe
  C:\Windows\System\sbhUcYb.exe
  2⤵
  PID:7296
- C:\Windows\System\NjfKydi.exe
  C:\Windows\System\NjfKydi.exe
  2⤵
  PID:7324
- C:\Windows\System\SsvvCHs.exe
  C:\Windows\System\SsvvCHs.exe
  2⤵
  PID:7348
- C:\Windows\System\NQIpvbv.exe
  C:\Windows\System\NQIpvbv.exe
  2⤵
  PID:7376
- C:\Windows\System\LNiBLaE.exe
  C:\Windows\System\LNiBLaE.exe
  2⤵
  PID:7404
- C:\Windows\System\GKdSnTm.exe
  C:\Windows\System\GKdSnTm.exe
  2⤵
  PID:7428
- C:\Windows\System\XaBYrln.exe
  C:\Windows\System\XaBYrln.exe
  2⤵
  PID:7464
- C:\Windows\System\RjsuPLi.exe
  C:\Windows\System\RjsuPLi.exe
  2⤵
  PID:7492
- C:\Windows\System\VLqNkIl.exe
  C:\Windows\System\VLqNkIl.exe
  2⤵
  PID:7520
- C:\Windows\System\ofUJOaR.exe
  C:\Windows\System\ofUJOaR.exe
  2⤵
  PID:7540
- C:\Windows\System\ovpQKTo.exe
  C:\Windows\System\ovpQKTo.exe
  2⤵
  PID:7572
- C:\Windows\System\ZuPkaVm.exe
  C:\Windows\System\ZuPkaVm.exe
  2⤵
  PID:7596
- C:\Windows\System\ONcRZYn.exe
  C:\Windows\System\ONcRZYn.exe
  2⤵
  PID:7624
- C:\Windows\System\IGZZOEt.exe
  C:\Windows\System\IGZZOEt.exe
  2⤵
  PID:7652
- C:\Windows\System\SqCnmmj.exe
  C:\Windows\System\SqCnmmj.exe
  2⤵
  PID:7672
- C:\Windows\System\WHxteYy.exe
  C:\Windows\System\WHxteYy.exe
  2⤵
  PID:7696
- C:\Windows\System\VGxNZvB.exe
  C:\Windows\System\VGxNZvB.exe
  2⤵
  PID:7720
- C:\Windows\System\FgxSaEY.exe
  C:\Windows\System\FgxSaEY.exe
  2⤵
  PID:7748
- C:\Windows\System\EKyIjCn.exe
  C:\Windows\System\EKyIjCn.exe
  2⤵
  PID:7764
- C:\Windows\System\LiSauQh.exe
  C:\Windows\System\LiSauQh.exe
  2⤵
  PID:7788
- C:\Windows\System\LFoszxc.exe
  C:\Windows\System\LFoszxc.exe
  2⤵
  PID:7812
- C:\Windows\System\zKNZnxs.exe
  C:\Windows\System\zKNZnxs.exe
  2⤵
  PID:7836
- C:\Windows\System\VOcKtMf.exe
  C:\Windows\System\VOcKtMf.exe
  2⤵
  PID:7860
- C:\Windows\System\grOyOzw.exe
  C:\Windows\System\grOyOzw.exe
  2⤵
  PID:7880
- C:\Windows\System\PeEcHLG.exe
  C:\Windows\System\PeEcHLG.exe
  2⤵
  PID:7904
- C:\Windows\System\HAjOPNg.exe
  C:\Windows\System\HAjOPNg.exe
  2⤵
  PID:7932
- C:\Windows\System\fZEJtMd.exe
  C:\Windows\System\fZEJtMd.exe
  2⤵
  PID:7956
- C:\Windows\System\dLscLnD.exe
  C:\Windows\System\dLscLnD.exe
  2⤵
  PID:7984
- C:\Windows\System\saUsbeK.exe
  C:\Windows\System\saUsbeK.exe
  2⤵
  PID:8012
- C:\Windows\System\XPuEXzg.exe
  C:\Windows\System\XPuEXzg.exe
  2⤵
  PID:8028
- C:\Windows\System\xcEjGKE.exe
  C:\Windows\System\xcEjGKE.exe
  2⤵
  PID:8044
- C:\Windows\System\cilIRvf.exe
  C:\Windows\System\cilIRvf.exe
  2⤵
  PID:8060
- C:\Windows\System\bJvmPMC.exe
  C:\Windows\System\bJvmPMC.exe
  2⤵
  PID:8088
- C:\Windows\System\vuWXVZx.exe
  C:\Windows\System\vuWXVZx.exe
  2⤵
  PID:8108
- C:\Windows\System\ovMVFem.exe
  C:\Windows\System\ovMVFem.exe
  2⤵
  PID:8136
- C:\Windows\System\rvxPIYv.exe
  C:\Windows\System\rvxPIYv.exe
  2⤵
  PID:8156
- C:\Windows\System\rEllNBX.exe
  C:\Windows\System\rEllNBX.exe
  2⤵
  PID:8180
- C:\Windows\System\rCKyVpr.exe
  C:\Windows\System\rCKyVpr.exe
  2⤵
  PID:6560
- C:\Windows\System\ietcrvj.exe
  C:\Windows\System\ietcrvj.exe
  2⤵
  PID:7172
- C:\Windows\System\FNUJtDZ.exe
  C:\Windows\System\FNUJtDZ.exe
  2⤵
  PID:6020
- C:\Windows\System\dffGTEC.exe
  C:\Windows\System\dffGTEC.exe
  2⤵
  PID:7216
- C:\Windows\System\TUPpCjI.exe
  C:\Windows\System\TUPpCjI.exe
  2⤵
  PID:7064
- C:\Windows\System\MGggkeH.exe
  C:\Windows\System\MGggkeH.exe
  2⤵
  PID:7084
- C:\Windows\System\pwWAoRH.exe
  C:\Windows\System\pwWAoRH.exe
  2⤵
  PID:7292
- C:\Windows\System\HWRnJCW.exe
  C:\Windows\System\HWRnJCW.exe
  2⤵
  PID:7396
- C:\Windows\System\NVtBGBM.exe
  C:\Windows\System\NVtBGBM.exe
  2⤵
  PID:7200
- C:\Windows\System\TyNsvzz.exe
  C:\Windows\System\TyNsvzz.exe
  2⤵
  PID:7568
- C:\Windows\System\JQsWcsp.exe
  C:\Windows\System\JQsWcsp.exe
  2⤵
  PID:7632
- C:\Windows\System\YYWAWMK.exe
  C:\Windows\System\YYWAWMK.exe
  2⤵
  PID:7320
- C:\Windows\System\SQHRqns.exe
  C:\Windows\System\SQHRqns.exe
  2⤵
  PID:7584
- C:\Windows\System\dROLYFV.exe
  C:\Windows\System\dROLYFV.exe
  2⤵
  PID:7852
- C:\Windows\System\YakNcEy.exe
  C:\Windows\System\YakNcEy.exe
  2⤵
  PID:7716
- C:\Windows\System\EmMcRYA.exe
  C:\Windows\System\EmMcRYA.exe
  2⤵
  PID:8036
- C:\Windows\System\uKMmVkI.exe
  C:\Windows\System\uKMmVkI.exe
  2⤵
  PID:7644
- C:\Windows\System\AcZwjRt.exe
  C:\Windows\System\AcZwjRt.exe
  2⤵
  PID:7872
- C:\Windows\System\nmJxRdF.exe
  C:\Windows\System\nmJxRdF.exe
  2⤵
  PID:8168
- C:\Windows\System\BTvyiFt.exe
  C:\Windows\System\BTvyiFt.exe
  2⤵
  PID:7924
- C:\Windows\System\cbpgexr.exe
  C:\Windows\System\cbpgexr.exe
  2⤵
  PID:6536
- C:\Windows\System\gOtmGeN.exe
  C:\Windows\System\gOtmGeN.exe
  2⤵
  PID:8020
- C:\Windows\System\gFwACUW.exe
  C:\Windows\System\gFwACUW.exe
  2⤵
  PID:7332
- C:\Windows\System\SbPYvuX.exe
  C:\Windows\System\SbPYvuX.exe
  2⤵
  PID:7832
- C:\Windows\System\lbAspCY.exe
  C:\Windows\System\lbAspCY.exe
  2⤵
  PID:8200
- C:\Windows\System\tDNwAUt.exe
  C:\Windows\System\tDNwAUt.exe
  2⤵
  PID:8228
- C:\Windows\System\rNINOuk.exe
  C:\Windows\System\rNINOuk.exe
  2⤵
  PID:8252
- C:\Windows\System\jRrDTca.exe
  C:\Windows\System\jRrDTca.exe
  2⤵
  PID:8272
- C:\Windows\System\iEMPanH.exe
  C:\Windows\System\iEMPanH.exe
  2⤵
  PID:8296
- C:\Windows\System\TTLEPEr.exe
  C:\Windows\System\TTLEPEr.exe
  2⤵
  PID:8324
- C:\Windows\System\bVBQEoW.exe
  C:\Windows\System\bVBQEoW.exe
  2⤵
  PID:8348
- C:\Windows\System\tdICfZm.exe
  C:\Windows\System\tdICfZm.exe
  2⤵
  PID:8372
- C:\Windows\System\fJyTejw.exe
  C:\Windows\System\fJyTejw.exe
  2⤵
  PID:8396
- C:\Windows\System\LAnkVDn.exe
  C:\Windows\System\LAnkVDn.exe
  2⤵
  PID:8416
- C:\Windows\System\OvvVFtm.exe
  C:\Windows\System\OvvVFtm.exe
  2⤵
  PID:8436
- C:\Windows\System\LiEzkFn.exe
  C:\Windows\System\LiEzkFn.exe
  2⤵
  PID:8460
- C:\Windows\System\cPIQjNx.exe
  C:\Windows\System\cPIQjNx.exe
  2⤵
  PID:8488
- C:\Windows\System\IoGFTyv.exe
  C:\Windows\System\IoGFTyv.exe
  2⤵
  PID:8512
- C:\Windows\System\ojFhajt.exe
  C:\Windows\System\ojFhajt.exe
  2⤵
  PID:8540
- C:\Windows\System\biaYClp.exe
  C:\Windows\System\biaYClp.exe
  2⤵
  PID:8572
- C:\Windows\System\EdYvjOe.exe
  C:\Windows\System\EdYvjOe.exe
  2⤵
  PID:8596
- C:\Windows\System\YPvQcoF.exe
  C:\Windows\System\YPvQcoF.exe
  2⤵
  PID:8624
- C:\Windows\System\OjuolLc.exe
  C:\Windows\System\OjuolLc.exe
  2⤵
  PID:8644
- C:\Windows\System\ynTjGob.exe
  C:\Windows\System\ynTjGob.exe
  2⤵
  PID:8660
- C:\Windows\System\zCptHSX.exe
  C:\Windows\System\zCptHSX.exe
  2⤵
  PID:8680
- C:\Windows\System\CdnsZxD.exe
  C:\Windows\System\CdnsZxD.exe
  2⤵
  PID:8708
- C:\Windows\System\ATGJqEl.exe
  C:\Windows\System\ATGJqEl.exe
  2⤵
  PID:8732
- C:\Windows\System\ZvmsfAS.exe
  C:\Windows\System\ZvmsfAS.exe
  2⤵
  PID:8760
- C:\Windows\System\sKVHzEJ.exe
  C:\Windows\System\sKVHzEJ.exe
  2⤵
  PID:8780
- C:\Windows\System\izYocOB.exe
  C:\Windows\System\izYocOB.exe
  2⤵
  PID:8808
- C:\Windows\System\gIpbzdw.exe
  C:\Windows\System\gIpbzdw.exe
  2⤵
  PID:8840
- C:\Windows\System\XNOuxCt.exe
  C:\Windows\System\XNOuxCt.exe
  2⤵
  PID:8872
- C:\Windows\System\LGoTksy.exe
  C:\Windows\System\LGoTksy.exe
  2⤵
  PID:8892
- C:\Windows\System\ekFVqIh.exe
  C:\Windows\System\ekFVqIh.exe
  2⤵
  PID:8932
- C:\Windows\System\UxueyVs.exe
  C:\Windows\System\UxueyVs.exe
  2⤵
  PID:8952
- C:\Windows\System\FmZeYJr.exe
  C:\Windows\System\FmZeYJr.exe
  2⤵
  PID:8972
- C:\Windows\System\PqTqwzO.exe
  C:\Windows\System\PqTqwzO.exe
  2⤵
  PID:8996
- C:\Windows\System\zydGocY.exe
  C:\Windows\System\zydGocY.exe
  2⤵
  PID:9016
- C:\Windows\System\LsedAXe.exe
  C:\Windows\System\LsedAXe.exe
  2⤵
  PID:9048
- C:\Windows\System\LIJrcsh.exe
  C:\Windows\System\LIJrcsh.exe
  2⤵
  PID:9068
- C:\Windows\System\LVxipWo.exe
  C:\Windows\System\LVxipWo.exe
  2⤵
  PID:9084
- C:\Windows\System\AohvJJG.exe
  C:\Windows\System\AohvJJG.exe
  2⤵
  PID:9112
- C:\Windows\System\RGnpClA.exe
  C:\Windows\System\RGnpClA.exe
  2⤵
  PID:9140
- C:\Windows\System\CrymnAE.exe
  C:\Windows\System\CrymnAE.exe
  2⤵
  PID:9168
- C:\Windows\System\QteDtSR.exe
  C:\Windows\System\QteDtSR.exe
  2⤵
  PID:9196
- C:\Windows\System\OqtzWYS.exe
  C:\Windows\System\OqtzWYS.exe
  2⤵
  PID:7888
- C:\Windows\System\FyYZLbD.exe
  C:\Windows\System\FyYZLbD.exe
  2⤵
  PID:7800
- C:\Windows\System\WUPmvoj.exe
  C:\Windows\System\WUPmvoj.exe
  2⤵
  PID:7780
- C:\Windows\System\MtPZJAB.exe
  C:\Windows\System\MtPZJAB.exe
  2⤵
  PID:8152
- C:\Windows\System\ElwFTFa.exe
  C:\Windows\System\ElwFTFa.exe
  2⤵
  PID:7484
- C:\Windows\System\phDiyUc.exe
  C:\Windows\System\phDiyUc.exe
  2⤵
  PID:7312
- C:\Windows\System\GIYQeVK.exe
  C:\Windows\System\GIYQeVK.exe
  2⤵
  PID:8284
- C:\Windows\System\cGxliJa.exe
  C:\Windows\System\cGxliJa.exe
  2⤵
  PID:6240
- C:\Windows\System\CfeCray.exe
  C:\Windows\System\CfeCray.exe
  2⤵
  PID:8360
- C:\Windows\System\iGIsBXv.exe
  C:\Windows\System\iGIsBXv.exe
  2⤵
  PID:7692
- C:\Windows\System\OyTvpzV.exe
  C:\Windows\System\OyTvpzV.exe
  2⤵
  PID:7828
- C:\Windows\System\XlXjTZG.exe
  C:\Windows\System\XlXjTZG.exe
  2⤵
  PID:8584
- C:\Windows\System\BIsFtOP.exe
  C:\Windows\System\BIsFtOP.exe
  2⤵
  PID:7640
- C:\Windows\System\AFGbhzg.exe
  C:\Windows\System\AFGbhzg.exe
  2⤵
  PID:8316
- C:\Windows\System\mcNguTu.exe
  C:\Windows\System\mcNguTu.exe
  2⤵
  PID:8860
- C:\Windows\System\ARbXuHk.exe
  C:\Windows\System\ARbXuHk.exe
  2⤵
  PID:7268
- C:\Windows\System\EOYBOHn.exe
  C:\Windows\System\EOYBOHn.exe
  2⤵
  PID:8564
- C:\Windows\System\txVrhxw.exe
  C:\Windows\System\txVrhxw.exe
  2⤵
  PID:9036
- C:\Windows\System\xwCrlbL.exe
  C:\Windows\System\xwCrlbL.exe
  2⤵
  PID:9236
- C:\Windows\System\AlieNJp.exe
  C:\Windows\System\AlieNJp.exe
  2⤵
  PID:9256
- C:\Windows\System\vYZSRuh.exe
  C:\Windows\System\vYZSRuh.exe
  2⤵
  PID:9276
- C:\Windows\System\kHubgas.exe
  C:\Windows\System\kHubgas.exe
  2⤵
  PID:9292
- C:\Windows\System\ZBsNQrN.exe
  C:\Windows\System\ZBsNQrN.exe
  2⤵
  PID:9316
- C:\Windows\System\IoujGcZ.exe
  C:\Windows\System\IoujGcZ.exe
  2⤵
  PID:9336
- C:\Windows\System\YGuwUzS.exe
  C:\Windows\System\YGuwUzS.exe
  2⤵
  PID:9364
- C:\Windows\System\fWkSTin.exe
  C:\Windows\System\fWkSTin.exe
  2⤵
  PID:9392
- C:\Windows\System\IgpcWdv.exe
  C:\Windows\System\IgpcWdv.exe
  2⤵
  PID:9412
- C:\Windows\System\ukMdWbd.exe
  C:\Windows\System\ukMdWbd.exe
  2⤵
  PID:9440
- C:\Windows\System\ZpgXSRN.exe
  C:\Windows\System\ZpgXSRN.exe
  2⤵
  PID:9464
- C:\Windows\System\ByJkyzq.exe
  C:\Windows\System\ByJkyzq.exe
  2⤵
  PID:9488
- C:\Windows\System\EPLbKjL.exe
  C:\Windows\System\EPLbKjL.exe
  2⤵
  PID:9508
- C:\Windows\System\UWRIYEh.exe
  C:\Windows\System\UWRIYEh.exe
  2⤵
  PID:9532
- C:\Windows\System\qHJhAfp.exe
  C:\Windows\System\qHJhAfp.exe
  2⤵
  PID:9556
- C:\Windows\System\EJQPGrH.exe
  C:\Windows\System\EJQPGrH.exe
  2⤵
  PID:9588
- C:\Windows\System\TQxusUb.exe
  C:\Windows\System\TQxusUb.exe
  2⤵
  PID:9612
- C:\Windows\System\SQcFovL.exe
  C:\Windows\System\SQcFovL.exe
  2⤵
  PID:9632
- C:\Windows\System\IyEVTKq.exe
  C:\Windows\System\IyEVTKq.exe
  2⤵
  PID:9656
- C:\Windows\System\VvlDCAf.exe
  C:\Windows\System\VvlDCAf.exe
  2⤵
  PID:9688
- C:\Windows\System\MpfqxSU.exe
  C:\Windows\System\MpfqxSU.exe
  2⤵
  PID:9708
- C:\Windows\System\FbNYzcu.exe
  C:\Windows\System\FbNYzcu.exe
  2⤵
  PID:9740
- C:\Windows\System\NxHiOJq.exe
  C:\Windows\System\NxHiOJq.exe
  2⤵
  PID:9760
- C:\Windows\System\zYshzSy.exe
  C:\Windows\System\zYshzSy.exe
  2⤵
  PID:9780
- C:\Windows\System\pgYLQbr.exe
  C:\Windows\System\pgYLQbr.exe
  2⤵
  PID:9808
- C:\Windows\System\wBnWEHX.exe
  C:\Windows\System\wBnWEHX.exe
  2⤵
  PID:9828
- C:\Windows\System\EWOjpMv.exe
  C:\Windows\System\EWOjpMv.exe
  2⤵
  PID:9860
- C:\Windows\System\EMuabmd.exe
  C:\Windows\System\EMuabmd.exe
  2⤵
  PID:9896
- C:\Windows\System\TsuIlgQ.exe
  C:\Windows\System\TsuIlgQ.exe
  2⤵
  PID:9916
- C:\Windows\System\TbWUmQp.exe
  C:\Windows\System\TbWUmQp.exe
  2⤵
  PID:9940
- C:\Windows\System\GvIDQLR.exe
  C:\Windows\System\GvIDQLR.exe
  2⤵
  PID:9960
- C:\Windows\System\gYlearU.exe
  C:\Windows\System\gYlearU.exe
  2⤵
  PID:9976
- C:\Windows\System\CIDVREh.exe
  C:\Windows\System\CIDVREh.exe
  2⤵
  PID:10004
- C:\Windows\System\FMhVZZt.exe
  C:\Windows\System\FMhVZZt.exe
  2⤵
  PID:10032
- C:\Windows\System\Kpghapd.exe
  C:\Windows\System\Kpghapd.exe
  2⤵
  PID:10056
- C:\Windows\System\UzESOhn.exe
  C:\Windows\System\UzESOhn.exe
  2⤵
  PID:10084
- C:\Windows\System\ikjEpwX.exe
  C:\Windows\System\ikjEpwX.exe
  2⤵
  PID:10104
- C:\Windows\System\ccxXonE.exe
  C:\Windows\System\ccxXonE.exe
  2⤵
  PID:10124
- C:\Windows\System\zVTefAB.exe
  C:\Windows\System\zVTefAB.exe
  2⤵
  PID:10144
- C:\Windows\System\PLYqiCt.exe
  C:\Windows\System\PLYqiCt.exe
  2⤵
  PID:10168
- C:\Windows\System\qCPEyrv.exe
  C:\Windows\System\qCPEyrv.exe
  2⤵
  PID:10192
- C:\Windows\System\PHPfJyJ.exe
  C:\Windows\System\PHPfJyJ.exe
  2⤵
  PID:10220
- C:\Windows\System\gqPUstu.exe
  C:\Windows\System\gqPUstu.exe
  2⤵
  PID:9128
- C:\Windows\System\GsFjEPo.exe
  C:\Windows\System\GsFjEPo.exe
  2⤵
  PID:8768
- C:\Windows\System\ZsMKjzJ.exe
  C:\Windows\System\ZsMKjzJ.exe
  2⤵
  PID:7108
- C:\Windows\System\etPzweS.exe
  C:\Windows\System\etPzweS.exe
  2⤵
  PID:7708
- C:\Windows\System\gjNCQTL.exe
  C:\Windows\System\gjNCQTL.exe
  2⤵
  PID:8456
- C:\Windows\System\JweRHbR.exe
  C:\Windows\System\JweRHbR.exe
  2⤵
  PID:8940
- C:\Windows\System\asmoTuS.exe
  C:\Windows\System\asmoTuS.exe
  2⤵
  PID:8264
- C:\Windows\System\IOfakar.exe
  C:\Windows\System\IOfakar.exe
  2⤵
  PID:8620
- C:\Windows\System\cXxhIhd.exe
  C:\Windows\System\cXxhIhd.exe
  2⤵
  PID:8688
- C:\Windows\System\kNsEUKS.exe
  C:\Windows\System\kNsEUKS.exe
  2⤵
  PID:9192
- C:\Windows\System\aQurMsu.exe
  C:\Windows\System\aQurMsu.exe
  2⤵
  PID:9344
- C:\Windows\System\vhPThds.exe
  C:\Windows\System\vhPThds.exe
  2⤵
  PID:8800
- C:\Windows\System\MRGxrIH.exe
  C:\Windows\System\MRGxrIH.exe
  2⤵
  PID:9404
- C:\Windows\System\nHtpwNl.exe
  C:\Windows\System\nHtpwNl.exe
  2⤵
  PID:8852
- C:\Windows\System\nbkwpne.exe
  C:\Windows\System\nbkwpne.exe
  2⤵
  PID:8404
- C:\Windows\System\zmguNZK.exe
  C:\Windows\System\zmguNZK.exe
  2⤵
  PID:8964
- C:\Windows\System\qKopQoZ.exe
  C:\Windows\System\qKopQoZ.exe
  2⤵
  PID:8216
- C:\Windows\System\gogOKQc.exe
  C:\Windows\System\gogOKQc.exe
  2⤵
  PID:9044
- C:\Windows\System\prczmPg.exe
  C:\Windows\System\prczmPg.exe
  2⤵
  PID:9080
- C:\Windows\System\eKrwPyU.exe
  C:\Windows\System\eKrwPyU.exe
  2⤵
  PID:9156
- C:\Windows\System\btxXCau.exe
  C:\Windows\System\btxXCau.exe
  2⤵
  PID:9868
- C:\Windows\System\ntiEMWK.exe
  C:\Windows\System\ntiEMWK.exe
  2⤵
  PID:9936
- C:\Windows\System\XZNxUcO.exe
  C:\Windows\System\XZNxUcO.exe
  2⤵
  PID:8248
- C:\Windows\System\gvvMgzJ.exe
  C:\Windows\System\gvvMgzJ.exe
  2⤵
  PID:10096
- C:\Windows\System\LwPFqjx.exe
  C:\Windows\System\LwPFqjx.exe
  2⤵
  PID:10132
- C:\Windows\System\morHizY.exe
  C:\Windows\System\morHizY.exe
  2⤵
  PID:10176
- C:\Windows\System\xlfEzkH.exe
  C:\Windows\System\xlfEzkH.exe
  2⤵
  PID:10260
- C:\Windows\System\DWppuno.exe
  C:\Windows\System\DWppuno.exe
  2⤵
  PID:10288
- C:\Windows\System\FNjwJEB.exe
  C:\Windows\System\FNjwJEB.exe
  2⤵
  PID:10312
- C:\Windows\System\YhyNhlW.exe
  C:\Windows\System\YhyNhlW.exe
  2⤵
  PID:10340
- C:\Windows\System\xSDOaZx.exe
  C:\Windows\System\xSDOaZx.exe
  2⤵
  PID:10364
- C:\Windows\System\NFVEzpd.exe
  C:\Windows\System\NFVEzpd.exe
  2⤵
  PID:10380
- C:\Windows\System\oYjJgDO.exe
  C:\Windows\System\oYjJgDO.exe
  2⤵
  PID:10408
- C:\Windows\System\gehuoZM.exe
  C:\Windows\System\gehuoZM.exe
  2⤵
  PID:10428
- C:\Windows\System\UzRTzST.exe
  C:\Windows\System\UzRTzST.exe
  2⤵
  PID:10452
- C:\Windows\System\mNxnAIG.exe
  C:\Windows\System\mNxnAIG.exe
  2⤵
  PID:10472
- C:\Windows\System\ktfHDZw.exe
  C:\Windows\System\ktfHDZw.exe
  2⤵
  PID:10492
- C:\Windows\System\jliIhKT.exe
  C:\Windows\System\jliIhKT.exe
  2⤵
  PID:10508
- C:\Windows\System\KbOmVFB.exe
  C:\Windows\System\KbOmVFB.exe
  2⤵
  PID:10532
- C:\Windows\System\DRgmJaq.exe
  C:\Windows\System\DRgmJaq.exe
  2⤵
  PID:10560
- C:\Windows\System\dXUdetN.exe
  C:\Windows\System\dXUdetN.exe
  2⤵
  PID:10580
- C:\Windows\System\hwWOSWu.exe
  C:\Windows\System\hwWOSWu.exe
  2⤵
  PID:10608
- C:\Windows\System\KaNzLnF.exe
  C:\Windows\System\KaNzLnF.exe
  2⤵
  PID:10628
- C:\Windows\System\uzAIZOB.exe
  C:\Windows\System\uzAIZOB.exe
  2⤵
  PID:10644
- C:\Windows\System\gbPOtvU.exe
  C:\Windows\System\gbPOtvU.exe
  2⤵
  PID:10664
- C:\Windows\System\hHEubVE.exe
  C:\Windows\System\hHEubVE.exe
  2⤵
  PID:10684
- C:\Windows\System\zGpZatd.exe
  C:\Windows\System\zGpZatd.exe
  2⤵
  PID:10704
- C:\Windows\System\DHanOGa.exe
  C:\Windows\System\DHanOGa.exe
  2⤵
  PID:10732
- C:\Windows\System\vtWuPIL.exe
  C:\Windows\System\vtWuPIL.exe
  2⤵
  PID:10768
- C:\Windows\System\jBGvZis.exe
  C:\Windows\System\jBGvZis.exe
  2⤵
  PID:10784
- C:\Windows\System\SvAvbQG.exe
  C:\Windows\System\SvAvbQG.exe
  2⤵
  PID:10820
- C:\Windows\System\WblEMHt.exe
  C:\Windows\System\WblEMHt.exe
  2⤵
  PID:10844
- C:\Windows\System\QkYLEJz.exe
  C:\Windows\System\QkYLEJz.exe
  2⤵
  PID:10864
- C:\Windows\System\VFXFkNA.exe
  C:\Windows\System\VFXFkNA.exe
  2⤵
  PID:10888
- C:\Windows\System\YHYaYgX.exe
  C:\Windows\System\YHYaYgX.exe
  2⤵
  PID:10912
- C:\Windows\System\SCxjfgu.exe
  C:\Windows\System\SCxjfgu.exe
  2⤵
  PID:10928
- C:\Windows\System\CcozUpR.exe
  C:\Windows\System\CcozUpR.exe
  2⤵
  PID:10956
- C:\Windows\System\ckhCfrX.exe
  C:\Windows\System\ckhCfrX.exe
  2⤵
  PID:10976
- C:\Windows\System\FBuNLPr.exe
  C:\Windows\System\FBuNLPr.exe
  2⤵
  PID:10996
- C:\Windows\System\qTxjXHt.exe
  C:\Windows\System\qTxjXHt.exe
  2⤵
  PID:11020
- C:\Windows\System\WsfGmmd.exe
  C:\Windows\System\WsfGmmd.exe
  2⤵
  PID:11040
- C:\Windows\System\MuRxSqs.exe
  C:\Windows\System\MuRxSqs.exe
  2⤵
  PID:11064
- C:\Windows\System\glBKIku.exe
  C:\Windows\System\glBKIku.exe
  2⤵
  PID:11088
- C:\Windows\System\teVJyrs.exe
  C:\Windows\System\teVJyrs.exe
  2⤵
  PID:11108
- C:\Windows\System\JXncKcy.exe
  C:\Windows\System\JXncKcy.exe
  2⤵
  PID:11128
- C:\Windows\System\hbffqEQ.exe
  C:\Windows\System\hbffqEQ.exe
  2⤵
  PID:11144
- C:\Windows\System\tLUeOeV.exe
  C:\Windows\System\tLUeOeV.exe
  2⤵
  PID:11168
- C:\Windows\System\sHvaNvO.exe
  C:\Windows\System\sHvaNvO.exe
  2⤵
  PID:11200
- C:\Windows\System\dPRfQYJ.exe
  C:\Windows\System\dPRfQYJ.exe
  2⤵
  PID:11232
- C:\Windows\System\CGhTRvT.exe
  C:\Windows\System\CGhTRvT.exe
  2⤵
  PID:11256
- C:\Windows\System\IpJXMuz.exe
  C:\Windows\System\IpJXMuz.exe
  2⤵
  PID:8704
- C:\Windows\System\jjLRUvH.exe
  C:\Windows\System\jjLRUvH.exe
  2⤵
  PID:8944
- C:\Windows\System\OyotcAv.exe
  C:\Windows\System\OyotcAv.exe
  2⤵
  PID:8616
- C:\Windows\System\tKUkbFK.exe
  C:\Windows\System\tKUkbFK.exe
  2⤵
  PID:8480
- C:\Windows\System\GqRWSMq.exe
  C:\Windows\System\GqRWSMq.exe
  2⤵
  PID:9772
- C:\Windows\System\XCbhKuu.exe
  C:\Windows\System\XCbhKuu.exe
  2⤵
  PID:9848
- C:\Windows\System\ZXeFxLe.exe
  C:\Windows\System\ZXeFxLe.exe
  2⤵
  PID:9912
- C:\Windows\System\FhHFKki.exe
  C:\Windows\System\FhHFKki.exe
  2⤵
  PID:9972
- C:\Windows\System\uFBuBBo.exe
  C:\Windows\System\uFBuBBo.exe
  2⤵
  PID:8176
- C:\Windows\System\WeMevGr.exe
  C:\Windows\System\WeMevGr.exe
  2⤵
  PID:9552
- C:\Windows\System\LCpVCdy.exe
  C:\Windows\System\LCpVCdy.exe
  2⤵
  PID:9056
- C:\Windows\System\lPdqIzB.exe
  C:\Windows\System\lPdqIzB.exe
  2⤵
  PID:9136
- C:\Windows\System\MpNaMzJ.exe
  C:\Windows\System\MpNaMzJ.exe
  2⤵
  PID:9600
- C:\Windows\System\NdUMCyU.exe
  C:\Windows\System\NdUMCyU.exe
  2⤵
  PID:10020
- C:\Windows\System\xUfKDQW.exe
  C:\Windows\System\xUfKDQW.exe
  2⤵
  PID:9580
- C:\Windows\System\rERdhyj.exe
  C:\Windows\System\rERdhyj.exe
  2⤵
  PID:10304
- C:\Windows\System\wicQhbz.exe
  C:\Windows\System\wicQhbz.exe
  2⤵
  PID:10372
- C:\Windows\System\GpfzUwj.exe
  C:\Windows\System\GpfzUwj.exe
  2⤵
  PID:10392
- C:\Windows\System\ruazhIJ.exe
  C:\Windows\System\ruazhIJ.exe
  2⤵
  PID:8500
- C:\Windows\System\zGlAVTl.exe
  C:\Windows\System\zGlAVTl.exe
  2⤵
  PID:9776
- C:\Windows\System\aunLdFF.exe
  C:\Windows\System\aunLdFF.exe
  2⤵
  PID:9824
- C:\Windows\System\PjGTspY.exe
  C:\Windows\System\PjGTspY.exe
  2⤵
  PID:9904
- C:\Windows\System\urQxWfl.exe
  C:\Windows\System\urQxWfl.exe
  2⤵
  PID:9928
- C:\Windows\System\dmNUzdE.exe
  C:\Windows\System\dmNUzdE.exe
  2⤵
  PID:9952
- C:\Windows\System\MxZJbvt.exe
  C:\Windows\System\MxZJbvt.exe
  2⤵
  PID:10044
- C:\Windows\System\iCFoECK.exe
  C:\Windows\System\iCFoECK.exe
  2⤵
  PID:10724
- C:\Windows\System\DOobloM.exe
  C:\Windows\System\DOobloM.exe
  2⤵
  PID:10852
- C:\Windows\System\vAQoDwA.exe
  C:\Windows\System\vAQoDwA.exe
  2⤵
  PID:10272
- C:\Windows\System\ZBzePZz.exe
  C:\Windows\System\ZBzePZz.exe
  2⤵
  PID:11284
- C:\Windows\System\cvDiadn.exe
  C:\Windows\System\cvDiadn.exe
  2⤵
  PID:11304
- C:\Windows\System\EsVurFx.exe
  C:\Windows\System\EsVurFx.exe
  2⤵
  PID:11332
- C:\Windows\System\TfuUTMm.exe
  C:\Windows\System\TfuUTMm.exe
  2⤵
  PID:11360
- C:\Windows\System\UanvKFw.exe
  C:\Windows\System\UanvKFw.exe
  2⤵
  PID:11376
- C:\Windows\System\nmzhrEr.exe
  C:\Windows\System\nmzhrEr.exe
  2⤵
  PID:11396
- C:\Windows\System\rhRgflA.exe
  C:\Windows\System\rhRgflA.exe
  2⤵
  PID:11424
- C:\Windows\System\IxqPjLq.exe
  C:\Windows\System\IxqPjLq.exe
  2⤵
  PID:11448
- C:\Windows\System\lxlzsVb.exe
  C:\Windows\System\lxlzsVb.exe
  2⤵
  PID:11468
- C:\Windows\System\gdgLtYh.exe
  C:\Windows\System\gdgLtYh.exe
  2⤵
  PID:11488
- C:\Windows\System\OlnWNYP.exe
  C:\Windows\System\OlnWNYP.exe
  2⤵
  PID:11516
- C:\Windows\System\rxiauYZ.exe
  C:\Windows\System\rxiauYZ.exe
  2⤵
  PID:11556
- C:\Windows\System\MIRbQsQ.exe
  C:\Windows\System\MIRbQsQ.exe
  2⤵
  PID:11584
- C:\Windows\System\tOYKVfO.exe
  C:\Windows\System\tOYKVfO.exe
  2⤵
  PID:11600
- C:\Windows\System\mqQDNXa.exe
  C:\Windows\System\mqQDNXa.exe
  2⤵
  PID:11620
- C:\Windows\System\IGxuDos.exe
  C:\Windows\System\IGxuDos.exe
  2⤵
  PID:11644
- C:\Windows\System\GvnQypD.exe
  C:\Windows\System\GvnQypD.exe
  2⤵
  PID:11668
- C:\Windows\System\RZlrsXU.exe
  C:\Windows\System\RZlrsXU.exe
  2⤵
  PID:11700
- C:\Windows\System\dkfVlmz.exe
  C:\Windows\System\dkfVlmz.exe
  2⤵
  PID:11724
- C:\Windows\System\HxLnpoo.exe
  C:\Windows\System\HxLnpoo.exe
  2⤵
  PID:11748
- C:\Windows\System\kmhPdmz.exe
  C:\Windows\System\kmhPdmz.exe
  2⤵
  PID:11768
- C:\Windows\System\pUlsJeI.exe
  C:\Windows\System\pUlsJeI.exe
  2⤵
  PID:11796
- C:\Windows\System\zdmFByU.exe
  C:\Windows\System\zdmFByU.exe
  2⤵
  PID:11812
- C:\Windows\System\CmqoFPt.exe
  C:\Windows\System\CmqoFPt.exe
  2⤵
  PID:11836
- C:\Windows\System\EUXhNDa.exe
  C:\Windows\System\EUXhNDa.exe
  2⤵
  PID:11860
- C:\Windows\System\QBDucoz.exe
  C:\Windows\System\QBDucoz.exe
  2⤵
  PID:11884
- C:\Windows\System\cDIQSOC.exe
  C:\Windows\System\cDIQSOC.exe
  2⤵
  PID:11904
- C:\Windows\System\mmrsVLa.exe
  C:\Windows\System\mmrsVLa.exe
  2⤵
  PID:11924
- C:\Windows\System\cLqSrjq.exe
  C:\Windows\System\cLqSrjq.exe
  2⤵
  PID:11940
- C:\Windows\System\RFToACg.exe
  C:\Windows\System\RFToACg.exe
  2⤵
  PID:11960
- C:\Windows\System\XJkjSHJ.exe
  C:\Windows\System\XJkjSHJ.exe
  2⤵
  PID:11980
- C:\Windows\System\bPogyqL.exe
  C:\Windows\System\bPogyqL.exe
  2⤵
  PID:12004
- C:\Windows\System\WwKdftZ.exe
  C:\Windows\System\WwKdftZ.exe
  2⤵
  PID:12024
- C:\Windows\System\KgHwxPP.exe
  C:\Windows\System\KgHwxPP.exe
  2⤵
  PID:12044
- C:\Windows\System\dwkJQDd.exe
  C:\Windows\System\dwkJQDd.exe
  2⤵
  PID:12076
- C:\Windows\System\YdmdjMM.exe
  C:\Windows\System\YdmdjMM.exe
  2⤵
  PID:12100
- C:\Windows\System\NKYPuZB.exe
  C:\Windows\System\NKYPuZB.exe
  2⤵
  PID:12120
- C:\Windows\System\MIqcEyB.exe
  C:\Windows\System\MIqcEyB.exe
  2⤵
  PID:12140
- C:\Windows\System\UkwXnwa.exe
  C:\Windows\System\UkwXnwa.exe
  2⤵
  PID:12164
- C:\Windows\System\RTQdrPn.exe
  C:\Windows\System\RTQdrPn.exe
  2⤵
  PID:12184
- C:\Windows\System\bDZsuzd.exe
  C:\Windows\System\bDZsuzd.exe
  2⤵
  PID:12220
- C:\Windows\System\vJkaSOP.exe
  C:\Windows\System\vJkaSOP.exe
  2⤵
  PID:12236
- C:\Windows\System\QtdeOpT.exe
  C:\Windows\System\QtdeOpT.exe
  2⤵
  PID:12252
- C:\Windows\System\kKQEGcv.exe
  C:\Windows\System\kKQEGcv.exe
  2⤵
  PID:12280
- C:\Windows\System\EHxEmiQ.exe
  C:\Windows\System\EHxEmiQ.exe
  2⤵
  PID:10324
- C:\Windows\System\rDoTWWq.exe
  C:\Windows\System\rDoTWWq.exe
  2⤵
  PID:11060
- C:\Windows\System\EpQozKr.exe
  C:\Windows\System\EpQozKr.exe
  2⤵
  PID:11116
- C:\Windows\System\yiOPCAU.exe
  C:\Windows\System\yiOPCAU.exe
  2⤵
  PID:11180
- C:\Windows\System\wdHLBMa.exe
  C:\Windows\System\wdHLBMa.exe
  2⤵
  PID:11220
- C:\Windows\System\hmnjPCn.exe
  C:\Windows\System\hmnjPCn.exe
  2⤵
  PID:9228
- C:\Windows\System\tyMWQQx.exe
  C:\Windows\System\tyMWQQx.exe
  2⤵
  PID:10604
- C:\Windows\System\zFxghqF.exe
  C:\Windows\System\zFxghqF.exe
  2⤵
  PID:8820
- C:\Windows\System\XXLoGsx.exe
  C:\Windows\System\XXLoGsx.exe
  2⤵
  PID:10660
- C:\Windows\System\LXDAlWO.exe
  C:\Windows\System\LXDAlWO.exe
  2⤵
  PID:10716
- C:\Windows\System\ACrcAcw.exe
  C:\Windows\System\ACrcAcw.exe
  2⤵
  PID:9676
- C:\Windows\System\qkNGlUQ.exe
  C:\Windows\System\qkNGlUQ.exe
  2⤵
  PID:10216
- C:\Windows\System\fuxwKra.exe
  C:\Windows\System\fuxwKra.exe
  2⤵
  PID:10860
- C:\Windows\System\sNdTQYT.exe
  C:\Windows\System\sNdTQYT.exe
  2⤵
  PID:10400
- C:\Windows\System\sLIQccf.exe
  C:\Windows\System\sLIQccf.exe
  2⤵
  PID:10448
- C:\Windows\System\XlCDXyu.exe
  C:\Windows\System\XlCDXyu.exe
  2⤵
  PID:10568
- C:\Windows\System\pQeZoDm.exe
  C:\Windows\System\pQeZoDm.exe
  2⤵
  PID:9564
- C:\Windows\System\yPpSyEp.exe
  C:\Windows\System\yPpSyEp.exe
  2⤵
  PID:10244
- C:\Windows\System\LGuQois.exe
  C:\Windows\System\LGuQois.exe
  2⤵
  PID:11016
- C:\Windows\System\kpbsiSJ.exe
  C:\Windows\System\kpbsiSJ.exe
  2⤵
  PID:11276
- C:\Windows\System\WNMNyxf.exe
  C:\Windows\System\WNMNyxf.exe
  2⤵
  PID:11352
- C:\Windows\System\nWbsXSf.exe
  C:\Windows\System\nWbsXSf.exe
  2⤵
  PID:11476
- C:\Windows\System\TLSXTHk.exe
  C:\Windows\System\TLSXTHk.exe
  2⤵
  PID:9628
- C:\Windows\System\jfMPkmd.exe
  C:\Windows\System\jfMPkmd.exe
  2⤵
  PID:11592
- C:\Windows\System\MJXGAuF.exe
  C:\Windows\System\MJXGAuF.exe
  2⤵
  PID:10624
- C:\Windows\System\NbexKYi.exe
  C:\Windows\System\NbexKYi.exe
  2⤵
  PID:12300
- C:\Windows\System\FCtWvNO.exe
  C:\Windows\System\FCtWvNO.exe
  2⤵
  PID:12324
- C:\Windows\System\pitcBGA.exe
  C:\Windows\System\pitcBGA.exe
  2⤵
  PID:12360
- C:\Windows\System\VnGLrmo.exe
  C:\Windows\System\VnGLrmo.exe
  2⤵
  PID:12384
- C:\Windows\System\rtqVZXY.exe
  C:\Windows\System\rtqVZXY.exe
  2⤵
  PID:12412
- C:\Windows\System\vrOYxTo.exe
  C:\Windows\System\vrOYxTo.exe
  2⤵
  PID:12440
- C:\Windows\System\GhNlAva.exe
  C:\Windows\System\GhNlAva.exe
  2⤵
  PID:12464
- C:\Windows\System\HmZeoyt.exe
  C:\Windows\System\HmZeoyt.exe
  2⤵
  PID:12480
- C:\Windows\System\JhpyMKH.exe
  C:\Windows\System\JhpyMKH.exe
  2⤵
  PID:12508
- C:\Windows\System\euoQpnp.exe
  C:\Windows\System\euoQpnp.exe
  2⤵
  PID:12528
- C:\Windows\System\kbYOhYV.exe
  C:\Windows\System\kbYOhYV.exe
  2⤵
  PID:12552
- C:\Windows\System\aqQuFZT.exe
  C:\Windows\System\aqQuFZT.exe
  2⤵
  PID:12576
- C:\Windows\System\VabyHLM.exe
  C:\Windows\System\VabyHLM.exe
  2⤵
  PID:12596
- C:\Windows\System\RlSovBk.exe
  C:\Windows\System\RlSovBk.exe
  2⤵
  PID:12628
- C:\Windows\System\ZLssEiX.exe
  C:\Windows\System\ZLssEiX.exe
  2⤵
  PID:12652
- C:\Windows\System\yNVyiao.exe
  C:\Windows\System\yNVyiao.exe
  2⤵
  PID:12676
- C:\Windows\System\rmZxAdE.exe
  C:\Windows\System\rmZxAdE.exe
  2⤵
  PID:12692
- C:\Windows\System\EBepRjb.exe
  C:\Windows\System\EBepRjb.exe
  2⤵
  PID:12724
- C:\Windows\System\XAffzNp.exe
  C:\Windows\System\XAffzNp.exe
  2⤵
  PID:12740
- C:\Windows\System\HJyYtWN.exe
  C:\Windows\System\HJyYtWN.exe
  2⤵
  PID:12764
- C:\Windows\System\jAvUMUD.exe
  C:\Windows\System\jAvUMUD.exe
  2⤵
  PID:12784
- C:\Windows\System\ceoLmos.exe
  C:\Windows\System\ceoLmos.exe
  2⤵
  PID:12808
- C:\Windows\System\scaNiHs.exe
  C:\Windows\System\scaNiHs.exe
  2⤵
  PID:12836
- C:\Windows\System\PKPzWoY.exe
  C:\Windows\System\PKPzWoY.exe
  2⤵
  PID:12868
- C:\Windows\System\sExECYC.exe
  C:\Windows\System\sExECYC.exe
  2⤵
  PID:12884
- C:\Windows\System\tOfZQPT.exe
  C:\Windows\System\tOfZQPT.exe
  2⤵
  PID:12904
- C:\Windows\System\bmtLZTb.exe
  C:\Windows\System\bmtLZTb.exe
  2⤵
  PID:12932
- C:\Windows\System\rAZuYEx.exe
  C:\Windows\System\rAZuYEx.exe
  2⤵
  PID:12952
- C:\Windows\System\OzWxcEX.exe
  C:\Windows\System\OzWxcEX.exe
  2⤵
  PID:12972
- C:\Windows\System\vJfQBAv.exe
  C:\Windows\System\vJfQBAv.exe
  2⤵
  PID:13000
- C:\Windows\System\LCwmnkp.exe
  C:\Windows\System\LCwmnkp.exe
  2⤵
  PID:13016
- C:\Windows\System\UvqIotM.exe
  C:\Windows\System\UvqIotM.exe
  2⤵
  PID:13048
- C:\Windows\System\ElEcNzt.exe
  C:\Windows\System\ElEcNzt.exe
  2⤵
  PID:13068
- C:\Windows\System\mAOkkwA.exe
  C:\Windows\System\mAOkkwA.exe
  2⤵
  PID:13088
- C:\Windows\System\LsHnbTW.exe
  C:\Windows\System\LsHnbTW.exe
  2⤵
  PID:13112
- C:\Windows\System\xBHNUvA.exe
  C:\Windows\System\xBHNUvA.exe
  2⤵
  PID:13140
- C:\Windows\System\EePSxDz.exe
  C:\Windows\System\EePSxDz.exe
  2⤵
  PID:13172
- C:\Windows\System\enkohth.exe
  C:\Windows\System\enkohth.exe
  2⤵
  PID:13196
- C:\Windows\System\DpGXNPM.exe
  C:\Windows\System\DpGXNPM.exe
  2⤵
  PID:13212
- C:\Windows\System\RpxAMci.exe
  C:\Windows\System\RpxAMci.exe
  2⤵
  PID:13228
- C:\Windows\System\TkLpykW.exe
  C:\Windows\System\TkLpykW.exe
  2⤵
  PID:13252
- C:\Windows\System\LJQKycz.exe
  C:\Windows\System\LJQKycz.exe
  2⤵
  PID:13276
- C:\Windows\System\dRvCFYc.exe
  C:\Windows\System\dRvCFYc.exe
  2⤵
  PID:13300
- C:\Windows\System\kvSIJkP.exe
  C:\Windows\System\kvSIJkP.exe
  2⤵
  PID:11824
- C:\Windows\System\tFsdcuS.exe
  C:\Windows\System\tFsdcuS.exe
  2⤵
  PID:9528
- C:\Windows\System\sVVPqZp.exe
  C:\Windows\System\sVVPqZp.exe
  2⤵
  PID:11932
- C:\Windows\System\Tzbzcbx.exe
  C:\Windows\System\Tzbzcbx.exe
  2⤵
  PID:10780
- C:\Windows\System\VMpGHjh.exe
  C:\Windows\System\VMpGHjh.exe
  2⤵
  PID:12064
- C:\Windows\System\SRLOGzT.exe
  C:\Windows\System\SRLOGzT.exe
  2⤵
  PID:10460
- C:\Windows\System\qpxglxe.exe
  C:\Windows\System\qpxglxe.exe
  2⤵
  PID:10920
- C:\Windows\System\FWialDY.exe
  C:\Windows\System\FWialDY.exe
  2⤵
  PID:8776
- C:\Windows\System\dodVJML.exe
  C:\Windows\System\dodVJML.exe
  2⤵
  PID:10204
- C:\Windows\System\NORLoqN.exe
  C:\Windows\System\NORLoqN.exe
  2⤵
  PID:10620
- C:\Windows\System\uOkHTLG.exe
  C:\Windows\System\uOkHTLG.exe
  2⤵
  PID:11440
- C:\Windows\System\dOUQiaP.exe
  C:\Windows\System\dOUQiaP.exe
  2⤵
  PID:10832
- C:\Windows\System\dfnuCRR.exe
  C:\Windows\System\dfnuCRR.exe
  2⤵
  PID:11576
- C:\Windows\System\oUUpxBy.exe
  C:\Windows\System\oUUpxBy.exe
  2⤵
  PID:7968
- C:\Windows\System\ALiYSvV.exe
  C:\Windows\System\ALiYSvV.exe
  2⤵
  PID:11636
- C:\Windows\System\ISNtDqU.exe
  C:\Windows\System\ISNtDqU.exe
  2⤵
  PID:11680
- C:\Windows\System\XAOOsYb.exe
  C:\Windows\System\XAOOsYb.exe
  2⤵
  PID:11716
- C:\Windows\System\GkUdzDD.exe
  C:\Windows\System\GkUdzDD.exe
  2⤵
  PID:11744
- C:\Windows\System\VGeIcjk.exe
  C:\Windows\System\VGeIcjk.exe
  2⤵
  PID:10540
- C:\Windows\System\jhLyvBg.exe
  C:\Windows\System\jhLyvBg.exe
  2⤵
  PID:12316
- C:\Windows\System\ysvZrOn.exe
  C:\Windows\System\ysvZrOn.exe
  2⤵
  PID:9008
- C:\Windows\System\TtdqKOS.exe
  C:\Windows\System\TtdqKOS.exe
  2⤵
  PID:13316
- C:\Windows\System\QplDmJX.exe
  C:\Windows\System\QplDmJX.exe
  2⤵
  PID:13340
- C:\Windows\System\JPBfkLY.exe
  C:\Windows\System\JPBfkLY.exe
  2⤵
  PID:13368
- C:\Windows\System\lylVdsE.exe
  C:\Windows\System\lylVdsE.exe
  2⤵
  PID:13392
- C:\Windows\System\TsKvriy.exe
  C:\Windows\System\TsKvriy.exe
  2⤵
  PID:13412
- C:\Windows\System\qFdDywn.exe
  C:\Windows\System\qFdDywn.exe
  2⤵
  PID:13444
- C:\Windows\System\ejCDJTK.exe
  C:\Windows\System\ejCDJTK.exe
  2⤵
  PID:13464
- C:\Windows\System\NUpjYJT.exe
  C:\Windows\System\NUpjYJT.exe
  2⤵
  PID:13484
- C:\Windows\System\IsqnAHq.exe
  C:\Windows\System\IsqnAHq.exe
  2⤵
  PID:13504
- C:\Windows\System\XzhfDiT.exe
  C:\Windows\System\XzhfDiT.exe
  2⤵
  PID:13528
- C:\Windows\System\WgPTNvR.exe
  C:\Windows\System\WgPTNvR.exe
  2⤵
  PID:13556
- C:\Windows\System\LLCCmtc.exe
  C:\Windows\System\LLCCmtc.exe
  2⤵
  PID:13572
- C:\Windows\System\yoXABDa.exe
  C:\Windows\System\yoXABDa.exe
  2⤵
  PID:13600
- C:\Windows\System\TqdrxOn.exe
  C:\Windows\System\TqdrxOn.exe
  2⤵
  PID:13620
- C:\Windows\System\MziwmVp.exe
  C:\Windows\System\MziwmVp.exe
  2⤵
  PID:13644
- C:\Windows\System\YIZGowT.exe
  C:\Windows\System\YIZGowT.exe
  2⤵
  PID:13672
- C:\Windows\System\QUpTwja.exe
  C:\Windows\System\QUpTwja.exe
  2⤵
  PID:13696
- C:\Windows\System\qaDVfcG.exe
  C:\Windows\System\qaDVfcG.exe
  2⤵
  PID:13732
- C:\Windows\System\niHXZue.exe
  C:\Windows\System\niHXZue.exe
  2⤵
  PID:13764
- C:\Windows\System\TcWibqP.exe
  C:\Windows\System\TcWibqP.exe
  2⤵
  PID:13780
- C:\Windows\System\LqsJHdI.exe
  C:\Windows\System\LqsJHdI.exe
  2⤵
  PID:13804
- C:\Windows\System\fBovHZh.exe
  C:\Windows\System\fBovHZh.exe
  2⤵
  PID:13820
- C:\Windows\System\uocmSnh.exe
  C:\Windows\System\uocmSnh.exe
  2⤵
  PID:13848
- C:\Windows\System\YRoAirE.exe
  C:\Windows\System\YRoAirE.exe
  2⤵
  PID:13872
- C:\Windows\System\izWNxbS.exe
  C:\Windows\System\izWNxbS.exe
  2⤵
  PID:13888
- C:\Windows\System\spgHRXB.exe
  C:\Windows\System\spgHRXB.exe
  2⤵
  PID:13912
- C:\Windows\System\SBRyCCV.exe
  C:\Windows\System\SBRyCCV.exe
  2⤵
  PID:13944
- C:\Windows\System\tBeTWws.exe
  C:\Windows\System\tBeTWws.exe
  2⤵
  PID:13960
- C:\Windows\System\pvKSptC.exe
  C:\Windows\System\pvKSptC.exe
  2⤵
  PID:13976
- C:\Windows\System\kipUWQO.exe
  C:\Windows\System\kipUWQO.exe
  2⤵
  PID:13992
- C:\Windows\System\iZVKBBC.exe
  C:\Windows\System\iZVKBBC.exe
  2⤵
  PID:14008
- C:\Windows\System\elXSrky.exe
  C:\Windows\System\elXSrky.exe
  2⤵
  PID:14032
- C:\Windows\System\amXmPaW.exe
  C:\Windows\System\amXmPaW.exe
  2⤵
  PID:14068
- C:\Windows\System\pOylUUp.exe
  C:\Windows\System\pOylUUp.exe
  2⤵
  PID:14088
- C:\Windows\System\tFyDARr.exe
  C:\Windows\System\tFyDARr.exe
  2⤵
  PID:14120
- C:\Windows\System\vezJeKe.exe
  C:\Windows\System\vezJeKe.exe
  2⤵
  PID:14136
- C:\Windows\System\WtMxqQM.exe
  C:\Windows\System\WtMxqQM.exe
  2⤵
  PID:14152
- C:\Windows\System\CdTQEDw.exe
  C:\Windows\System\CdTQEDw.exe
  2⤵
  PID:14180
- C:\Windows\System\HiyYjeA.exe
  C:\Windows\System\HiyYjeA.exe
  2⤵
  PID:14196
- C:\Windows\System\kzQdmhN.exe
  C:\Windows\System\kzQdmhN.exe
  2⤵
  PID:14216
- C:\Windows\System\hBudWtQ.exe
  C:\Windows\System\hBudWtQ.exe
  2⤵
  PID:14240
- C:\Windows\System\SrqTsyk.exe
  C:\Windows\System\SrqTsyk.exe
  2⤵
  PID:14268
- C:\Windows\System\vBrmxBW.exe
  C:\Windows\System\vBrmxBW.exe
  2⤵
  PID:14288
- C:\Windows\System\GvbXPwH.exe
  C:\Windows\System\GvbXPwH.exe
  2⤵
  PID:14312
- C:\Windows\System\zCDyeug.exe
  C:\Windows\System\zCDyeug.exe
  2⤵
  PID:12520
- C:\Windows\System\BUdZBBy.exe
  C:\Windows\System\BUdZBBy.exe
  2⤵
  PID:12548
- C:\Windows\System\kQaVlYe.exe
  C:\Windows\System\kQaVlYe.exe
  2⤵
  PID:12616
- C:\Windows\System\GpGoNRj.exe
  C:\Windows\System\GpGoNRj.exe
  2⤵
  PID:12648
- C:\Windows\System\EQSdopZ.exe
  C:\Windows\System\EQSdopZ.exe
  2⤵
  PID:12644
- C:\Windows\System\UJhQcGF.exe
  C:\Windows\System\UJhQcGF.exe
  2⤵
  PID:10548
- C:\Windows\System\pkGGudi.exe
  C:\Windows\System\pkGGudi.exe
  2⤵
  PID:12800
- C:\Windows\System\jgutbSr.exe
  C:\Windows\System\jgutbSr.exe
  2⤵
  PID:10700
- C:\Windows\System\DpHKKNz.exe
  C:\Windows\System\DpHKKNz.exe
  2⤵
  PID:10500
- C:\Windows\System\iRUYCZb.exe
  C:\Windows\System\iRUYCZb.exe
  2⤵
  PID:11356
- C:\Windows\System\MqUQPax.exe
  C:\Windows\System\MqUQPax.exe
  2⤵
  PID:13080
- C:\Windows\System\AKTdYue.exe
  C:\Windows\System\AKTdYue.exe
  2⤵
  PID:11388
- C:\Windows\System\ylTEEgJ.exe
  C:\Windows\System\ylTEEgJ.exe
  2⤵
  PID:9604
- C:\Windows\System\tzkbDNd.exe
  C:\Windows\System\tzkbDNd.exe
  2⤵
  PID:11456
- C:\Windows\System\urgGrYh.exe
  C:\Windows\System\urgGrYh.exe
  2⤵
  PID:9816
- C:\Windows\System\yAFigsG.exe
  C:\Windows\System\yAFigsG.exe
  2⤵
  PID:10188
- C:\Windows\System\PkTVGUe.exe
  C:\Windows\System\PkTVGUe.exe
  2⤵
  PID:12204
- C:\Windows\System\JVrXSWW.exe
  C:\Windows\System\JVrXSWW.exe
  2⤵
  PID:10984
- C:\Windows\System\JasTJMG.exe
  C:\Windows\System\JasTJMG.exe
  2⤵
  PID:11412
- C:\Windows\System\wELSGcX.exe
  C:\Windows\System\wELSGcX.exe
  2⤵
  PID:9728
- C:\Windows\System\eijAiGk.exe
  C:\Windows\System\eijAiGk.exe
  2⤵
  PID:14344
- C:\Windows\System\LSgDzlt.exe
  C:\Windows\System\LSgDzlt.exe
  2⤵
  PID:14372
- C:\Windows\System\nUsXzye.exe
  C:\Windows\System\nUsXzye.exe
  2⤵
  PID:14388
- C:\Windows\System\hsSnuyh.exe
  C:\Windows\System\hsSnuyh.exe
  2⤵
  PID:14404
- C:\Windows\System\XQXwfQo.exe
  C:\Windows\System\XQXwfQo.exe
  2⤵
  PID:14420
- C:\Windows\System\fIHTQbk.exe
  C:\Windows\System\fIHTQbk.exe
  2⤵
  PID:14436
- C:\Windows\System\qjIgMCG.exe
  C:\Windows\System\qjIgMCG.exe
  2⤵
  PID:14464
- C:\Windows\System\uCIwwnP.exe
  C:\Windows\System\uCIwwnP.exe
  2⤵
  PID:14480
- C:\Windows\System\SoTNQSb.exe
  C:\Windows\System\SoTNQSb.exe
  2⤵
  PID:14504
- C:\Windows\System\cWMCAil.exe
  C:\Windows\System\cWMCAil.exe
  2⤵
  PID:14532
- C:\Windows\System\HOdBBPC.exe
  C:\Windows\System\HOdBBPC.exe
  2⤵
  PID:14548
- C:\Windows\System\waOBVuI.exe
  C:\Windows\System\waOBVuI.exe
  2⤵
  PID:14572
- C:\Windows\System\zIUIdDJ.exe
  C:\Windows\System\zIUIdDJ.exe
  2⤵
  PID:14592
- C:\Windows\System\MPvooRP.exe
  C:\Windows\System\MPvooRP.exe
  2⤵
  PID:14612
- C:\Windows\System\cpPAjzM.exe
  C:\Windows\System\cpPAjzM.exe
  2⤵
  PID:14632
- C:\Windows\System\grlzikI.exe
  C:\Windows\System\grlzikI.exe
  2⤵
  PID:14656
- C:\Windows\System\znAyMnh.exe
  C:\Windows\System\znAyMnh.exe
  2⤵
  PID:14680
- C:\Windows\System\ZuKYspU.exe
  C:\Windows\System\ZuKYspU.exe
  2⤵
  PID:14704
- C:\Windows\System\NoDwRop.exe
  C:\Windows\System\NoDwRop.exe
  2⤵
  PID:14724
- C:\Windows\System\IxYwxJq.exe
  C:\Windows\System\IxYwxJq.exe
  2⤵
  PID:14976
- C:\Windows\System\rCuhwaY.exe
  C:\Windows\System\rCuhwaY.exe
  2⤵
  PID:14992
- C:\Windows\System\cxrBxDa.exe
  C:\Windows\System\cxrBxDa.exe
  2⤵
  PID:15012
- C:\Windows\System\uLSmFUy.exe
  C:\Windows\System\uLSmFUy.exe
  2⤵
  PID:15028
- C:\Windows\System\FAkbjFy.exe
  C:\Windows\System\FAkbjFy.exe
  2⤵
  PID:15044
- C:\Windows\System\DSnfJlD.exe
  C:\Windows\System\DSnfJlD.exe
  2⤵
  PID:15064
- C:\Windows\System\fiGjdLn.exe
  C:\Windows\System\fiGjdLn.exe
  2⤵
  PID:15080
- C:\Windows\System\chBKbbk.exe
  C:\Windows\System\chBKbbk.exe
  2⤵
  PID:15096
- C:\Windows\System\ghATgTv.exe
  C:\Windows\System\ghATgTv.exe
  2⤵
  PID:15112
- C:\Windows\System\WuTVxme.exe
  C:\Windows\System\WuTVxme.exe
  2⤵
  PID:15128
- C:\Windows\System\XTnZcRH.exe
  C:\Windows\System\XTnZcRH.exe
  2⤵
  PID:15144
- C:\Windows\System\JbGhnFG.exe
  C:\Windows\System\JbGhnFG.exe
  2⤵
  PID:15160
- C:\Windows\System\PuZaTZg.exe
  C:\Windows\System\PuZaTZg.exe
  2⤵
  PID:15176
- C:\Windows\System\XQNFano.exe
  C:\Windows\System\XQNFano.exe
  2⤵
  PID:15196
- C:\Windows\System\RWfxaUa.exe
  C:\Windows\System\RWfxaUa.exe
  2⤵
  PID:15212
- C:\Windows\System\YTFDppx.exe
  C:\Windows\System\YTFDppx.exe
  2⤵
  PID:15228
- C:\Windows\System\KYBMyGs.exe
  C:\Windows\System\KYBMyGs.exe
  2⤵
  PID:15244
- C:\Windows\System\cbaXSwY.exe
  C:\Windows\System\cbaXSwY.exe
  2⤵
  PID:15268
- C:\Windows\System\JApEALJ.exe
  C:\Windows\System\JApEALJ.exe
  2⤵
  PID:15292
- C:\Windows\System\nhbNrag.exe
  C:\Windows\System\nhbNrag.exe
  2⤵
  PID:15312
- C:\Windows\System\eRUINgG.exe
  C:\Windows\System\eRUINgG.exe
  2⤵
  PID:15344
- C:\Windows\System\ajphjbY.exe
  C:\Windows\System\ajphjbY.exe
  2⤵
  PID:12320
- C:\Windows\System\REWgNAD.exe
  C:\Windows\System\REWgNAD.exe
  2⤵
  PID:11872
- C:\Windows\System\zAbSdRC.exe
  C:\Windows\System\zAbSdRC.exe
  2⤵
  PID:11848
- C:\Windows\System\rFSCIVX.exe
  C:\Windows\System\rFSCIVX.exe
  2⤵
  PID:8344
- C:\Windows\System\MerjYSf.exe
  C:\Windows\System\MerjYSf.exe
  2⤵
  PID:12452
- C:\Windows\System\BrBlsXS.exe
  C:\Windows\System\BrBlsXS.exe
  2⤵
  PID:13332
- C:\Windows\System\uAkuVkG.exe
  C:\Windows\System\uAkuVkG.exe
  2⤵
  PID:12504
- C:\Windows\System\FOoYgkS.exe
  C:\Windows\System\FOoYgkS.exe
  2⤵
  PID:12516
- C:\Windows\System\dephfqJ.exe
  C:\Windows\System\dephfqJ.exe
  2⤵
  PID:13440
- C:\Windows\System\XQLeGkX.exe
  C:\Windows\System\XQLeGkX.exe
  2⤵
  PID:12056
- C:\Windows\System\VrdcIMe.exe
  C:\Windows\System\VrdcIMe.exe
  2⤵
  PID:13520
- C:\Windows\System\yGtEUsT.exe
  C:\Windows\System\yGtEUsT.exe
  2⤵
  PID:12172
- C:\Windows\System\iyeYmYJ.exe
  C:\Windows\System\iyeYmYJ.exe
  2⤵
  PID:12264
- C:\Windows\System\pAHyCZe.exe
  C:\Windows\System\pAHyCZe.exe
  2⤵
  PID:12856
- C:\Windows\System\AkCsnXJ.exe
  C:\Windows\System\AkCsnXJ.exe
  2⤵
  PID:13796
- C:\Windows\System\CRjobkM.exe
  C:\Windows\System\CRjobkM.exe
  2⤵
  PID:11160
- C:\Windows\System\pWJJckV.exe
  C:\Windows\System\pWJJckV.exe
  2⤵
  PID:13828
- C:\Windows\System\LJDNKDt.exe
  C:\Windows\System\LJDNKDt.exe
  2⤵
  PID:13868
- C:\Windows\System\zRJyxwf.exe
  C:\Windows\System\zRJyxwf.exe
  2⤵
  PID:13896
- C:\Windows\System\lTTyqXd.exe
  C:\Windows\System\lTTyqXd.exe
  2⤵
  PID:13908
- C:\Windows\System\jCLcrxV.exe
  C:\Windows\System\jCLcrxV.exe
  2⤵
  PID:13036
- C:\Windows\System\YMrbMyC.exe
  C:\Windows\System\YMrbMyC.exe
  2⤵
  PID:13940
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13940 -s 248
    3⤵
    PID:9604
- C:\Windows\System\jZfgeio.exe
  C:\Windows\System\jZfgeio.exe
  2⤵
  PID:14044
- C:\Windows\System\svWoOMV.exe
  C:\Windows\System\svWoOMV.exe
  2⤵
  PID:13124
- C:\Windows\System\VkMnTlv.exe
  C:\Windows\System\VkMnTlv.exe
  2⤵
  PID:14104
- C:\Windows\System\rdECzxa.exe
  C:\Windows\System\rdECzxa.exe
  2⤵
  PID:10764
- C:\Windows\System\odanHPx.exe
  C:\Windows\System\odanHPx.exe
  2⤵
  PID:14252
- C:\Windows\System\aMwotfJ.exe
  C:\Windows\System\aMwotfJ.exe
  2⤵
  PID:14300
- C:\Windows\System\fqmbaru.exe
  C:\Windows\System\fqmbaru.exe
  2⤵
  PID:14328
- C:\Windows\System\MepMuIG.exe
  C:\Windows\System\MepMuIG.exe
  2⤵
  PID:12020
- C:\Windows\System\jFlwNWq.exe
  C:\Windows\System\jFlwNWq.exe
  2⤵
  PID:10436
- C:\Windows\System\NAHbxHZ.exe
  C:\Windows\System\NAHbxHZ.exe
  2⤵
  PID:10092
- C:\Windows\System\CvgoVHa.exe
  C:\Windows\System\CvgoVHa.exe
  2⤵
  PID:11032
- C:\Windows\System\SsQIMKv.exe
  C:\Windows\System\SsQIMKv.exe
  2⤵
  PID:12292
- C:\Windows\System\nMixdyM.exe
  C:\Windows\System\nMixdyM.exe
  2⤵
  PID:14432
- C:\Windows\System\CMEfsKT.exe
  C:\Windows\System\CMEfsKT.exe
  2⤵
  PID:11708
- C:\Windows\System\pbLgcXb.exe
  C:\Windows\System\pbLgcXb.exe
  2⤵
  PID:11736
- C:\Windows\System\HNJyHyl.exe
  C:\Windows\System\HNJyHyl.exe
  2⤵
  PID:9312
- C:\Windows\System\UVhWiue.exe
  C:\Windows\System\UVhWiue.exe
  2⤵
  PID:15384
- C:\Windows\System\XvYFBfS.exe
  C:\Windows\System\XvYFBfS.exe
  2⤵
  PID:15408
- C:\Windows\System\luanpgu.exe
  C:\Windows\System\luanpgu.exe
  2⤵
  PID:15428
- C:\Windows\System\APTOzma.exe
  C:\Windows\System\APTOzma.exe
  2⤵
  PID:15448
- C:\Windows\System\dLGqZFd.exe
  C:\Windows\System\dLGqZFd.exe
  2⤵
  PID:15472
- C:\Windows\System\OQggUtH.exe
  C:\Windows\System\OQggUtH.exe
  2⤵
  PID:15520
- C:\Windows\System\cYXVwTA.exe
  C:\Windows\System\cYXVwTA.exe
  2⤵
  PID:15540
- C:\Windows\System\QgSXjgC.exe
  C:\Windows\System\QgSXjgC.exe
  2⤵
  PID:15560
- C:\Windows\System\uAvhmgn.exe
  C:\Windows\System\uAvhmgn.exe
  2⤵
  PID:15584
- C:\Windows\System\HAwTcsB.exe
  C:\Windows\System\HAwTcsB.exe
  2⤵
  PID:15604
- C:\Windows\System\imvTNdG.exe
  C:\Windows\System\imvTNdG.exe
  2⤵
  PID:15620
- C:\Windows\System\PFKPQfh.exe
  C:\Windows\System\PFKPQfh.exe
  2⤵
  PID:15636
- C:\Windows\System\UUJEtyh.exe
  C:\Windows\System\UUJEtyh.exe
  2⤵
  PID:15652
- C:\Windows\System\PLwXADm.exe
  C:\Windows\System\PLwXADm.exe
  2⤵
  PID:15680
- C:\Windows\System\fTXIvLA.exe
  C:\Windows\System\fTXIvLA.exe
  2⤵
  PID:15728
- C:\Windows\System\lMJzHFR.exe
  C:\Windows\System\lMJzHFR.exe
  2⤵
  PID:15780
- C:\Windows\System\FPuTPKG.exe
  C:\Windows\System\FPuTPKG.exe
  2⤵
  PID:15848
- C:\Windows\System\mHyizod.exe
  C:\Windows\System\mHyizod.exe
  2⤵
  PID:15876
- C:\Windows\System\nemgVLd.exe
  C:\Windows\System\nemgVLd.exe
  2⤵
  PID:15908
- C:\Windows\System\ecOPHYP.exe
  C:\Windows\System\ecOPHYP.exe
  2⤵
  PID:15924
- C:\Windows\System\HoTkUPJ.exe
  C:\Windows\System\HoTkUPJ.exe
  2⤵
  PID:15940
- C:\Windows\System\KhomoqO.exe
  C:\Windows\System\KhomoqO.exe
  2⤵
  PID:15968
- C:\Windows\System\XvtMEpv.exe
  C:\Windows\System\XvtMEpv.exe
  2⤵
  PID:15996
- C:\Windows\System\LqXCMpk.exe
  C:\Windows\System\LqXCMpk.exe
  2⤵
  PID:16016
- C:\Windows\System\oyaxWZM.exe
  C:\Windows\System\oyaxWZM.exe
  2⤵
  PID:16032
- C:\Windows\System\CzOXllU.exe
  C:\Windows\System\CzOXllU.exe
  2⤵
  PID:16056
- C:\Windows\System\mofjQjJ.exe
  C:\Windows\System\mofjQjJ.exe
  2⤵
  PID:16084
- C:\Windows\System\GbDPgmH.exe
  C:\Windows\System\GbDPgmH.exe
  2⤵
  PID:16100
- C:\Windows\System\qkXoCuv.exe
  C:\Windows\System\qkXoCuv.exe
  2⤵
  PID:16116
- C:\Windows\System\yKPcMei.exe
  C:\Windows\System\yKPcMei.exe
  2⤵
  PID:16132
- C:\Windows\System\abkiIuU.exe
  C:\Windows\System\abkiIuU.exe
  2⤵
  PID:16172
- C:\Windows\System\QzBhTEG.exe
  C:\Windows\System\QzBhTEG.exe
  2⤵
  PID:16188
- C:\Windows\System\MxHefRi.exe
  C:\Windows\System\MxHefRi.exe
  2⤵
  PID:16204
- C:\Windows\System\LMNcXVj.exe
  C:\Windows\System\LMNcXVj.exe
  2⤵
  PID:16224
- C:\Windows\System\sxsKmZb.exe
  C:\Windows\System\sxsKmZb.exe
  2⤵
  PID:16252
- C:\Windows\System\DUCEHVh.exe
  C:\Windows\System\DUCEHVh.exe
  2⤵
  PID:16280
- C:\Windows\System\HRtPmef.exe
  C:\Windows\System\HRtPmef.exe
  2⤵
  PID:16312
- C:\Windows\System\ePZuXiP.exe
  C:\Windows\System\ePZuXiP.exe
  2⤵
  PID:16332
- C:\Windows\System\VpUNVvD.exe
  C:\Windows\System\VpUNVvD.exe
  2⤵
  PID:16348
- C:\Windows\System\CAuRPeW.exe
  C:\Windows\System\CAuRPeW.exe
  2⤵
  PID:16364
- C:\Windows\System\ofJuaIW.exe
  C:\Windows\System\ofJuaIW.exe
  2⤵
  PID:10516
- C:\Windows\System\SInRDlY.exe
  C:\Windows\System\SInRDlY.exe
  2⤵
  PID:14500
- C:\Windows\System\skIrFTq.exe
  C:\Windows\System\skIrFTq.exe
  2⤵
  PID:14588
- C:\Windows\System\VeYKYdw.exe
  C:\Windows\System\VeYKYdw.exe
  2⤵
  PID:14672
- C:\Windows\System\bHzivSm.exe
  C:\Windows\System\bHzivSm.exe
  2⤵
  PID:14720
- C:\Windows\System\gYCFzjv.exe
  C:\Windows\System\gYCFzjv.exe
  2⤵
  PID:14764
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14764 -s 28
    3⤵
    PID:9728
- C:\Windows\System\xSRKrus.exe
  C:\Windows\System\xSRKrus.exe
  2⤵
  PID:12688
- C:\Windows\System\truXHtL.exe
  C:\Windows\System\truXHtL.exe
  2⤵
  PID:12732
- C:\Windows\System\NBLUtRe.exe
  C:\Windows\System\NBLUtRe.exe
  2⤵
  PID:12820
- C:\Windows\System\nbhrmGs.exe
  C:\Windows\System\nbhrmGs.exe
  2⤵
  PID:13988
- C:\Windows\System\JxOIAFQ.exe
  C:\Windows\System\JxOIAFQ.exe
  2⤵
  PID:13164
- C:\Windows\System\UeeUVFW.exe
  C:\Windows\System\UeeUVFW.exe
  2⤵
  PID:15040
- C:\Windows\System\wbcxTKe.exe
  C:\Windows\System\wbcxTKe.exe
  2⤵
  PID:15076
- C:\Windows\System\IFAcLFc.exe
  C:\Windows\System\IFAcLFc.exe
  2⤵
  PID:15120
- C:\Windows\System\NrXmomv.exe
  C:\Windows\System\NrXmomv.exe
  2⤵
  PID:3388
- C:\Windows\System\vlbKgnF.exe
  C:\Windows\System\vlbKgnF.exe
  2⤵
  PID:372
- C:\Windows\System\UNeYeVd.exe
  C:\Windows\System\UNeYeVd.exe
  2⤵
  PID:15336
- C:\Windows\System\SqirXZM.exe
  C:\Windows\System\SqirXZM.exe
  2⤵
  PID:10160
- C:\Windows\System\BuMwHLq.exe
  C:\Windows\System\BuMwHLq.exe
  2⤵
  PID:10284
- C:\Windows\System\lcHBfOQ.exe
  C:\Windows\System\lcHBfOQ.exe
  2⤵
  PID:12404
- C:\Windows\System\pZUpzrA.exe
  C:\Windows\System\pZUpzrA.exe
  2⤵
  PID:11956
- C:\Windows\System\xTHFNLz.exe
  C:\Windows\System\xTHFNLz.exe
  2⤵
  PID:12096
- C:\Windows\System\oQjLtvY.exe
  C:\Windows\System\oQjLtvY.exe
  2⤵
  PID:16400
- C:\Windows\System\daKFgJp.exe
  C:\Windows\System\daKFgJp.exe
  2⤵
  PID:16416
- C:\Windows\System\cfxMkhb.exe
  C:\Windows\System\cfxMkhb.exe
  2⤵
  PID:16432
- C:\Windows\System\ciGBZvC.exe
  C:\Windows\System\ciGBZvC.exe
  2⤵
  PID:16452
- C:\Windows\System\yEVZmEQ.exe
  C:\Windows\System\yEVZmEQ.exe
  2⤵
  PID:16472
- C:\Windows\System\QnRDRIf.exe
  C:\Windows\System\QnRDRIf.exe
  2⤵
  PID:16496
- C:\Windows\System\FdBddYL.exe
  C:\Windows\System\FdBddYL.exe
  2⤵
  PID:16520
- C:\Windows\System\EmRkPZJ.exe
  C:\Windows\System\EmRkPZJ.exe
  2⤵
  PID:16548
- C:\Windows\System\pYRQygj.exe
  C:\Windows\System\pYRQygj.exe
  2⤵
  PID:16568
- C:\Windows\System\bARzijz.exe
  C:\Windows\System\bARzijz.exe
  2⤵
  PID:16584
- C:\Windows\System\iOVfaJH.exe
  C:\Windows\System\iOVfaJH.exe
  2⤵
  PID:16608
- C:\Windows\System\RzfMeGe.exe
  C:\Windows\System\RzfMeGe.exe
  2⤵
  PID:16624
- C:\Windows\System\PVbPSHe.exe
  C:\Windows\System\PVbPSHe.exe
  2⤵
  PID:16640
- C:\Windows\System\oXcuhDK.exe
  C:\Windows\System\oXcuhDK.exe
  2⤵
  PID:16664
- C:\Windows\System\TgcvDYT.exe
  C:\Windows\System\TgcvDYT.exe
  2⤵
  PID:16680
- C:\Windows\System\TXetSnA.exe
  C:\Windows\System\TXetSnA.exe
  2⤵
  PID:16700
- C:\Windows\System\hfASItz.exe
  C:\Windows\System\hfASItz.exe
  2⤵
  PID:16736
- C:\Windows\System\iyqjWbp.exe
  C:\Windows\System\iyqjWbp.exe
  2⤵
  PID:16760
- C:\Windows\System\WdPZhDx.exe
  C:\Windows\System\WdPZhDx.exe
  2⤵
  PID:16776
- C:\Windows\System\cdiUsJf.exe
  C:\Windows\System\cdiUsJf.exe
  2⤵
  PID:16792
- C:\Windows\System\RLzNkUb.exe
  C:\Windows\System\RLzNkUb.exe
  2⤵
  PID:16808
- C:\Windows\System\vcTZXVD.exe
  C:\Windows\System\vcTZXVD.exe
  2⤵
  PID:16828
- C:\Windows\System\sFBHuPO.exe
  C:\Windows\System\sFBHuPO.exe
  2⤵
  PID:16844
- C:\Windows\System\iIMMdWv.exe
  C:\Windows\System\iIMMdWv.exe
  2⤵
  PID:16864
- C:\Windows\System\fEDVWme.exe
  C:\Windows\System\fEDVWme.exe
  2⤵
  PID:16884
- C:\Windows\System\rNBhyRR.exe
  C:\Windows\System\rNBhyRR.exe
  2⤵
  PID:16912
- C:\Windows\System\yeaYkJr.exe
  C:\Windows\System\yeaYkJr.exe
  2⤵
  PID:16940
- C:\Windows\System\ZJtfpsE.exe
  C:\Windows\System\ZJtfpsE.exe
  2⤵
  PID:16964
- C:\Windows\System\seBGueY.exe
  C:\Windows\System\seBGueY.exe
  2⤵
  PID:16980
- C:\Windows\System\XIyWSUa.exe
  C:\Windows\System\XIyWSUa.exe
  2⤵
  PID:17000
- C:\Windows\System\IUiTfCi.exe
  C:\Windows\System\IUiTfCi.exe
  2⤵
  PID:17016
- C:\Windows\System\BYdhiKl.exe
  C:\Windows\System\BYdhiKl.exe
  2⤵
  PID:17032
- C:\Windows\System\hzcZLOe.exe
  C:\Windows\System\hzcZLOe.exe
  2⤵
  PID:17048
- C:\Windows\System\eWojYGp.exe
  C:\Windows\System\eWojYGp.exe
  2⤵
  PID:17068
- C:\Windows\System\gEbRIGd.exe
  C:\Windows\System\gEbRIGd.exe
  2⤵
  PID:17088
- C:\Windows\System\kWpCfhi.exe
  C:\Windows\System\kWpCfhi.exe
  2⤵
  PID:17108
- C:\Windows\System\yEagiKm.exe
  C:\Windows\System\yEagiKm.exe
  2⤵
  PID:17128
- C:\Windows\System\TvTQiuG.exe
  C:\Windows\System\TvTQiuG.exe
  2⤵
  PID:17148
- C:\Windows\System\vUrvJaS.exe
  C:\Windows\System\vUrvJaS.exe
  2⤵
  PID:17180
- C:\Windows\System\SdkrdMy.exe
  C:\Windows\System\SdkrdMy.exe
  2⤵
  PID:17200
- C:\Windows\System\UmqZDCM.exe
  C:\Windows\System\UmqZDCM.exe
  2⤵
  PID:17228
- C:\Windows\System\SMwNIyo.exe
  C:\Windows\System\SMwNIyo.exe
  2⤵
  PID:17248
- C:\Windows\System\lROEjoi.exe
  C:\Windows\System\lROEjoi.exe
  2⤵
  PID:17268
- C:\Windows\System\AUSWTbB.exe
  C:\Windows\System\AUSWTbB.exe
  2⤵
  PID:17288
- C:\Windows\System\NddmecW.exe
  C:\Windows\System\NddmecW.exe
  2⤵
  PID:17316
- C:\Windows\System\oEeaojT.exe
  C:\Windows\System\oEeaojT.exe
  2⤵
  PID:17340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CVKQYqY.exe

Filesize
1.3MB

MD5
ff1679f55bccb2aa44e8033c1eadd542

SHA1
b472fa3bc3c77f56e07edf5415e58b8863176475

SHA256
3059a13b64a485e99d6d82cf9c9d04ab819b65860e1564a10d12413a86ed1acd

SHA512
f0a45948ff01891238ce6fd2a4ce2450cd2fdb9a73d74e9ceb654675bd0bed70631daa705b325ae9bff081a49bebe268f15f6c728bfd9a2193261f88ba552ccb

Download Submit
C:\Windows\System\EcHExrJ.exe

Filesize
1.3MB

MD5
255b05efecca12de787ed9d7fdf0395a

SHA1
03d304f9068196259d8b664ee318a631b79ca00d

SHA256
68dfb7beaf668f059207bcc1ad1717bab80aa547979b3095df0d9ef0435ae00e

SHA512
95de9a503c202a7e58c39f4519b34c824046fdaba848021cafdb6fd4031d91b3f5a715b9663b6e14b2c1e81cb124cca75428a37b64e2bc2ee6bfad1237cec31d

Download Submit
C:\Windows\System\IYsrELW.exe

Filesize
1.3MB

MD5
b6cbedfb593c7f8458a514d835a00c2a

SHA1
cd39d2bbde9b069afacdd42b299beaa508115871

SHA256
56bba350f5409b5a77eb778df028509c09a239724f5c86a15a0e3b92f92ae676

SHA512
fbb4eed3d374f14a0c4243068e3da8e80306a30737dffb8e0acdb3c5bbd6db410d1ed0f27c7fccb0f21c59c9bab5270bf4eea65566be77e79bc57fcca1bc51ea

Download Submit
C:\Windows\System\JXaZPxL.exe

Filesize
1.3MB

MD5
53233c32da35314793c631613252fd9f

SHA1
c8856af9c4c87958d6393801f240adccd11005cc

SHA256
2c4421e2f63430b8bbbea7f2af2c852967f4cb5db961de47a6b3b743ae859cbc

SHA512
a43d28f41476a9e8fdc68d482447c932b3f6b1790d7415920eea91aad78ac639ded85ab2d2fda40429476f999fbd16d754f52d3be203d5c3488c219d679cdc66

Download Submit
C:\Windows\System\JYyBgGU.exe

Filesize
1.3MB

MD5
b2211641557e6d2b4574942de0d1e79c

SHA1
01b92cfbe8f0d8f345e77a76648db26b9cc84e87

SHA256
eac219217e552964452656a60576eb9486edd1dfc7e68b9724e175bbbf6e3c49

SHA512
669d7428cb1e38061a34ef33dc73881eef93994b64aaf9aeeae8fcff23e23906af12d481ca6201648b9202a966013d833e6f319fa46001a5f568673481be0f70

Download Submit
C:\Windows\System\KKQLCCA.exe

Filesize
1.3MB

MD5
18c11e2fdb5645e5f3870651f54d838d

SHA1
4ae2b56d03cc40602cd65e3f63d4128388abb29d

SHA256
7d26d16196e8224afec71c7fc1fa7175db4c75d77a12a2ba06532a4a17fd247a

SHA512
3ae92e90a01a81c7d73c4c174ada1658570f800d10a3188e70c2fc0f1e96cb496b5a8c61646fc688220015f1e22c88b1c65d24879650e3b816a41d6cc9f7cc6d

Download Submit
C:\Windows\System\KSboMxh.exe

Filesize
1.3MB

MD5
319a797ee887b15c2473328df5323907

SHA1
ce6c1e29e1072eee1dcab6714757e2d5af8d3930

SHA256
0ca61812801bbc184872b52a737b869545084dd2e021c3fa61818c8bec03ce88

SHA512
fecb8c344050b6e586792b2e0eea3759790fbca206bbddcf119bf325f73804c6b2cebf5fee2d1de5bc4475337c8395a6d62d9adeb266e262cfbe81d1ddaaf594

Download Submit
C:\Windows\System\MsrswOz.exe

Filesize
1.3MB

MD5
a59bb66417c85aa4fe6f3b7bc60107d8

SHA1
75e4729a172809290b56b923d4e6c878f5b835a3

SHA256
fe594bd6f22a727011e5e31f677cd8ed645bd1f2d47e031efaf8f41dda4434d2

SHA512
2dfb2fa5b299f26189ab2cbe33469153386858182dc303ca07929ea3a843a98d1c2547c7065a3d061f41ff56b7672dc58a373e13263a06f82a2162892c647aa4

Download Submit
C:\Windows\System\NGgcCqI.exe

Filesize
1.3MB

MD5
aba16d4c9bb0ec8f3018dfaa5ee55b83

SHA1
2d96e552eae69e85ad31d862cd64dbdc43c1454e

SHA256
dfddfdadf8bc342def3bfc3d19670edf5ec97203f80cc0e762fada98e737dd88

SHA512
1460718b57e5073084196513e18bdfbaeeb4471a8817e29d8167724fdd547a7843a62e20a12a9ae5dadc3d28e3ebbcb11fdd5ffab73ade333d0026907b4c02e1

Download Submit
C:\Windows\System\NXRmvTx.exe

Filesize
1.3MB

MD5
393ff96b70a6b4d66c831c412efbc32b

SHA1
dc45128a23abd173c8341ece10f827fbf7954373

SHA256
62edb8a5e632bad19b52a254f1a1c35ea60d99846459c0809254d508332d810c

SHA512
a52e87a0abeaa4528ebcb5abb07de08dc0503a1275adcfd2405c5c7a30f50e51ec2789b5397c2a6ad11e7270a0a3a03fb67ab5adb344d0f2baaf7569af1cca73

Download Submit
C:\Windows\System\NzBJAYC.exe

Filesize
1.3MB

MD5
06e4c19960d73c5e44c9343ed3c4b5af

SHA1
35a8aa5c8c98fe46edaad8b9bbcf3411705a5966

SHA256
7e8e0674521507619d63a28f88a0fdd7ce734f6ad9f62d119a970801650ea85d

SHA512
e4e0e84a723b9a827393fc2ba5f0181cf11936d0bae683d145ca39eaf32aae0193834ce2903b568c2e2f8dee5138b9dc35426ff977d63464487525722f788da7

Download Submit
C:\Windows\System\PXTFpGt.exe

Filesize
1.3MB

MD5
7219510087b526bf2b2e6e481f3a49b4

SHA1
9f73f7f9496d9c981c788e9687389b3a8da2b8d8

SHA256
e167d892893bdcb289fd83c2f6f06a5c1c08ac310ad60fa8035f373649562fbc

SHA512
5769dcd59d28c5d11773101258d06942bbcab89408e42953e9e54c7b73c525931a8ecd4c625753274ef4022339d76be37589068a172ec057a474a749a4433f23

Download Submit
C:\Windows\System\QIaxzjx.exe

Filesize
1.3MB

MD5
bc9fd03e98e7f146fb0493862def774b

SHA1
c38cb9472a9651c6767b2ad334ed2f6badf52f88

SHA256
77ba2bdb24a13e264f470159f26ecd02e28b10aa6e55618df3c02193180ed089

SHA512
27677d5d400e297a6138d22b9708a6d42375be9265050949eb23cbb9da0f036ee328cadb7596bf7f005f2e085f46e5c9f6430bb50c10ff97dfc532fe0cf9c142

Download Submit
C:\Windows\System\TfgvNoP.exe

Filesize
1.3MB

MD5
effa1b1e53be355788e836e91a3a7547

SHA1
3beb62d55cf14531f459f8593b35704afb6a18fe

SHA256
612a33588223343808d9066c66ee353c034396b064f80e39d651e999c07c91a7

SHA512
662ab6f6c8bdad3d57223a86a8431bb2f4e0eb5e65a1494cf7fe115ab516810812e7aecb4788bbebd291b4e47d50888fb6bbf3757c14dde55d0d8b80e8ec318a

Download Submit
C:\Windows\System\TyyCque.exe

Filesize
1.3MB

MD5
fd7cc0a4ae1cb20d8b91f28029aab54a

SHA1
d41cab8452cbbd2c22765c9de79b92a8906aab9e

SHA256
b70363f8c779aad66fc377ffb009fe60a5e6ffa7305a71a6e3ce723f1a91eed0

SHA512
21863e6ba0e4d604ca0b891e57dd11f33ffba825981ac4a889275be5f710c335f9e5059be20f55dc38163bd485c2f04faa061e434ca5dc403f5f3cc2e11cb45b

Download Submit
C:\Windows\System\UWtPGoW.exe

Filesize
1.3MB

MD5
038811bfc8993829b17b762f05b9df96

SHA1
f5162e4dcfdbea2cf673929b539decb99f680caf

SHA256
ae58a7167cbcfb31fa6c6302bf845393216684f3b035375f07a2bcf88ded1306

SHA512
840f21735c26f1131d72b27e8a96c29479fa87883bc9eea4a2007efdb9359955be5a560a1db12ae53aa56a07b0b5f672915bcb6c61ce6e1888b134f23a1e74e7

Download Submit
C:\Windows\System\ZMALUSM.exe

Filesize
1.3MB

MD5
4925ba05d6c90d79bab5335fce4d09fa

SHA1
14205f78134ae78c9d21680a0cd295d417887e9c

SHA256
a30dfa340dff27539d6e3255e82c1e77a1ae81f613bf691ab9ebfe11e6b1d2f5

SHA512
e16a326546c2997293fd754b1f7dbe45c1ba917887ef2af9790e96914a1083358059b82e3e80a7138271cd8306c2da81aa8cdd64ada3b9a285daa46d5da0cba6

Download Submit
C:\Windows\System\aRBHlui.exe

Filesize
1.3MB

MD5
d3fd3955527112c7b19add6bd232dc9a

SHA1
72d7cb2c9fddfeff65526b2d6b67a50fa5fdc470

SHA256
f293db048e37cae54d9c075e7c7f9a2f83326e79627a7546163759a5a3e0885f

SHA512
33f8d512f19f12afb77732cc009485d17257c7007648edc65b4756fd91856d850c834ae75572273cbcaed9558d00391706a85440aa3f948c27d7b1391cec66fc

Download Submit
C:\Windows\System\cExcspL.exe

Filesize
1.3MB

MD5
989db6c288a0319a3f2ec93fdf5160af

SHA1
2c6a397f179c6a188440942e98a987a298a4b244

SHA256
26adafbcadaa4809ca09e66a94c5636785b35a22cc1ac4727cf0211f388f0b40

SHA512
542f2c44124a2dc04a44ed2c721d3adfbdb9636ee2f6b16e7fd5c196fa80eedf4dcc7b2877da2a49b5926f1fb98f2269d1eb013551685bd3bdb42b50b1fb8894

Download Submit
C:\Windows\System\dWDRqCM.exe

Filesize
1.3MB

MD5
54a2d99b360c61f5d22d921d3789730b

SHA1
ff61713f55bc182763472fea243ccff8c4ee5c2b

SHA256
03ad6b3995e6ff645ea4ea674912fb5b54c9d2ffd6e74521357d33f4e77b7849

SHA512
b0eee24760e0ae9ce15feee175a52968e213ca83afc447e6c1b938385157377d67503aee768692952e6dcd486d2a648647f0375190eeeb5342bacc60d8d51b90

Download Submit
C:\Windows\System\eGifRHn.exe

Filesize
1.3MB

MD5
b8299e6415f556fdd38158938b5410cf

SHA1
867b76f1642e63739d3cb1d47bc8590dc4fe7263

SHA256
0ce287977d3e04961dbc768c5be820ad5bfd809954ed2c605d52828fa13d5e2c

SHA512
46b6c78a618a1d6f52c88d667154017a92812564eecbbeee952fb7f0f483f2d0c30e5d7f8e8c228433b24c3a2c9277957b0af49c1ee142b2cb018b8deb78bb06

Download Submit
C:\Windows\System\eJsfBkd.exe

Filesize
1.3MB

MD5
446eae2a8eec46fe08cd027cdcc0a873

SHA1
a8a4f60f6747349010a1e0b4a4439c5689505622

SHA256
17672d43886e3cd6a2afbf097a23932ef55669b911d2449c22ebc2d95ea60fd0

SHA512
b6c16a025c423e48abacc935f38b190b7414c3ccd856e95a0b5a346d7eaa73e6efc122f6d5573f17a4675eb266b2217705009d9c2aba75b0105f397ee7e9882e

Download Submit
C:\Windows\System\fTXOnxZ.exe

Filesize
1.3MB

MD5
f92d5826d5994e407d63bec09ab95fff

SHA1
f6e5a7a7472b985fdb40f82b6b65515827f5ed15

SHA256
abc86a85b96addebe7a01de161c941ca0157dab5c92a716486cbdd4b30cae08f

SHA512
dc4979efb0dfea51cb9f32afc0b61de0330c3ffb081d8d889c539232b14a45def6e2acd7ade5e5fa10b5b70395fd146216e25d1a39f3e5278036932c16bb0991

Download Submit
C:\Windows\System\hUhZEdo.exe

Filesize
1.3MB

MD5
00c3861ae1a456478dff1a4d637b68a0

SHA1
5329ba54872ecf0bef9f6ef1cd0b0b77845658c3

SHA256
273da55868a8b4b06fb5662f12a652a545814f06e4b520e51c42655e2dfe00e4

SHA512
87d85014704795c1ad995af75e5cbcea2bfeb359f2c7ca37169047ad728936a2e0c46e669665325a584b503a463be3e349aca871072a4f4529dc49fa7aa9f4ba

Download Submit
C:\Windows\System\hexywTD.exe

Filesize
1.3MB

MD5
e4e5120145e2883cce9fc10a3df30cda

SHA1
82cbd66eeeb3b3fee75d1dffeb4dee736a434113

SHA256
1b13ca6f432af1a3fe8234df77c16e1fd50a51d11049db3eaede7cd86d046d72

SHA512
de280f93ae7c2de2cee46975feb5bb3208ddc517292289ffb654ab48574a3b9cd1859ca5c949135999405b956289d97c54a78627880043c5f4603adf9850a675

Download Submit
C:\Windows\System\iIVFchC.exe

Filesize
1.3MB

MD5
106e4b0755db64d6e07392200a81ada1

SHA1
ac50996578268a6266fd3eb14bb30fe4fc3fcc7e

SHA256
a9c9c986d66b9ee33446dea9658c4b05b5eb381434a9eb5ec1e345e6a31fd322

SHA512
2c8239556d35ae449200226ec78f2473b1bc7c86e7de9335d485f27d61bf7147671dd3bb566cb770921b224320a81f35265e54acb3ded19e617c35abebb66ab0

Download Submit
C:\Windows\System\kIqRwNm.exe

Filesize
1.3MB

MD5
6a1236f0c59ae9f01aa6d34e66a1a778

SHA1
8502c8d1f70c1f01ba20cca3c28301d0923104ac

SHA256
4ba21fd3c3a4fcab800b4a2d5ffffe40b5e0bfdfd9c2a7a205f84d55481c7164

SHA512
d7425e7fa259dbbf46b9ef9b36b46f95bd282b7641ecd79c82886740ddb54b84527a768fdcebe47f62bd99afd72d03dc9a073ac1eeda1c8f19e433e792cb84d2

Download Submit
C:\Windows\System\mTNlooc.exe

Filesize
1.3MB

MD5
997efbbcd0aefd6697b58bfa89667fb2

SHA1
8e6742033d8a0763040ed51c91cadc4f1bb3ebf3

SHA256
694e5b0cd4d59abedaea47fc005e7733024744db59feb445f294dbd35105e3ce

SHA512
f499a42e8189ade8f32ebe4b4e53bbffb7d5e949c263714ddc45e51bc89db8a1006e5076660accfb229393617d3e631de5e3cb242df2d4174a8956ecc1230a3e

Download Submit
C:\Windows\System\nCTnhuK.exe

Filesize
1.3MB

MD5
9315dc471c2e9ea28c472e97f873873b

SHA1
4d7f6a4ea17ce418b963976460c8d27d0472791e

SHA256
eaf404d343785f8d04a826633c5818ed81285c534261d8c6753635801a0e7a37

SHA512
18a180cd0b3f4107451f03866e8f0226cb3977717eaa3cc5bc84f1e4c47966fdb58f471a4a597782489187029eee4821011e384dc5f550d9a57da3d62af02a83

Download Submit
C:\Windows\System\rXXHebL.exe

Filesize
1.3MB

MD5
3a6c44d171b6f5084c6d63fe200caf8a

SHA1
c2d299a0715b6b7852477d183975debbbd736e6e

SHA256
6289f3124534c80264f8b8fb9990303f47e9471f17afd290c6ba6967fc2b4bf7

SHA512
6c6387a31bad8f2102667f8bc0c2dc9b86ed5ab14f44e15c5f7fc10464918f4bfca20b3d963fdc72f529e93613bad29d84898f25ddbbefb5f86d88db14af19dc

Download Submit
C:\Windows\System\sCCgjuF.exe

Filesize
1.3MB

MD5
79779b3dc8c7cfeb6f93ccc99c60a861

SHA1
57507bc0c00537b317e3b8b2328054e9667f3c13

SHA256
64ccbf5494e3781371cf1853edd08e1868fb5a5c94527263c14b58205d97f9a8

SHA512
3fc4aafd1aa3075ad7f267daccc2df2220d4f71d6c1348293afb97dea52f2e04c9a529e3bc775ffffa713f81e254f2609deb814df7e177f12526b2e5f732481d

Download Submit
C:\Windows\System\swZutPY.exe

Filesize
1.3MB

MD5
d5ea17b7301f4b72d73f11da35a8fdff

SHA1
694461ca230779975ebcca8e1d7851b489ec4036

SHA256
3249e5036b1e4a6e5f777725e9f29fb849470f0881a203cee1754b04fbce8544

SHA512
a2b934f4562fd5a4a11e4b4e12a41a92bfcc0e30f294cd896ad5aaf5cbb6c323bc6c372702134cc3c1423bdcbf8d49e992c37da997848cba442fd35356ff27fc

Download Submit
C:\Windows\System\xYqfXKw.exe

Filesize
1.3MB

MD5
6795a9dd21d0bbdce2b2f945012cbdd1

SHA1
ba827681165d8e45f0042542ad3c64d8ddf50a99

SHA256
11129b61fad8b9561a3f329447088bff4717f28b3691b9b749221f4332cc3583

SHA512
089eabc5098cbb74779800b8a12629fb95ed66978a0f1c4670e7cbed2432ef9373394f8440bc3946713fbb4925bb82e81fa47d1d25fb1cddf0b05e9551c41054

Download Submit
C:\Windows\System\ydbGZBj.exe

Filesize
1.3MB

MD5
380e75289f2d7e4f931c6ed712e1b516

SHA1
dec0d5b332eef113801adbb3528340e327d51c78

SHA256
381246afab125920aa776789bbbd777c963df0f8d68204c941bbfd7a5be68d23

SHA512
db90f6c97f427341d4a8c216f050fc3b0c8c8811e45aa333b3d57a43b6c80ec7b37192999cfe995885fe368100dcc7f8e8ed16a0d71c365de351ed60c0a1dab1

Download Submit
memory/4732-0-0x0000021602F80000-0x0000021602F90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads