xmrig | 9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
Size

1.5MB
MD5

22d87e82081dabe02b6b38151f7f7a0a
SHA1

d265cf376f34411e868ae1370471865008e7ac5a
SHA256

9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751
SHA512

d45d87067dab00a77181ced683e11fd1e953cbebff04d2e7eaac7ab4331d526fb983721241fce8a4a0bc3807b708904f7bcb78ca46623efe65eccea40829ef49
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcu:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5s

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c24-4.dat	xmrig
behavioral2/files/0x0007000000023cb0-7.dat	xmrig
behavioral2/files/0x0007000000023cb1-17.dat	xmrig
behavioral2/files/0x0007000000023cb2-22.dat	xmrig
behavioral2/files/0x0007000000023cb3-24.dat	xmrig
behavioral2/files/0x0007000000023cb7-42.dat	xmrig
behavioral2/files/0x0007000000023cb8-55.dat	xmrig
behavioral2/files/0x0007000000023cba-65.dat	xmrig
behavioral2/files/0x0007000000023cbe-79.dat	xmrig
behavioral2/files/0x0007000000023cc6-117.dat	xmrig
behavioral2/files/0x0007000000023ccb-142.dat	xmrig
behavioral2/files/0x0007000000023ccf-162.dat	xmrig
behavioral2/files/0x0007000000023ccd-160.dat	xmrig
behavioral2/files/0x0007000000023cce-157.dat	xmrig
behavioral2/files/0x0007000000023ccc-155.dat	xmrig
behavioral2/files/0x0007000000023cca-145.dat	xmrig
behavioral2/files/0x0007000000023cc9-140.dat	xmrig
behavioral2/files/0x0007000000023cc8-135.dat	xmrig
behavioral2/files/0x0007000000023cc7-130.dat	xmrig
behavioral2/files/0x0007000000023cc5-120.dat	xmrig
behavioral2/files/0x0007000000023cc4-115.dat	xmrig
behavioral2/files/0x0007000000023cc3-110.dat	xmrig
behavioral2/files/0x0007000000023cc2-103.dat	xmrig
behavioral2/files/0x0007000000023cc1-97.dat	xmrig
behavioral2/files/0x0007000000023cc0-93.dat	xmrig
behavioral2/files/0x0007000000023cbf-87.dat	xmrig
behavioral2/files/0x0007000000023cbd-75.dat	xmrig
behavioral2/files/0x0007000000023cbc-73.dat	xmrig
behavioral2/files/0x0007000000023cbb-70.dat	xmrig
behavioral2/files/0x0007000000023cb9-60.dat	xmrig
behavioral2/files/0x0007000000023cb6-45.dat	xmrig
behavioral2/files/0x0007000000023cb5-40.dat	xmrig
behavioral2/files/0x0007000000023cb4-32.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2832	DGJenng.exe
2252	PhofpTQ.exe
2916	ICrugtq.exe
528	RUwuowF.exe
3148	vdYSUdi.exe
3296	ksUcewo.exe
2376	bwLbMxv.exe
1524	tQEcpiY.exe
540	drLxbtv.exe
4940	yXXgeti.exe
1680	SFrznTn.exe
2352	INZvmeC.exe
3988	kGqXBfY.exe
3232	YpksUAG.exe
652	DbSppjU.exe
2496	gumqcAe.exe
4508	yXsAmOu.exe
3740	xPUHQFq.exe
1368	FyVhhtT.exe
316	HnwowzF.exe
3300	AyQjQAX.exe
4800	ztdSGpn.exe
2812	HmLCKOL.exe
4656	CUzotMC.exe
3940	eKvZMaO.exe
1196	yvIcsSe.exe
5096	OQMhVdK.exe
1164	bGmnZgd.exe
2980	vXDnydS.exe
32	CVOhkBO.exe
2240	IAPZBvb.exe
3600	kRtyhJm.exe
2996	YqFeyJR.exe
1720	BdFREKy.exe
4016	HJeSuDR.exe
3788	fsDpNMY.exe
3520	uAjttXe.exe
1812	rLCAPYl.exe
1248	NZIHkCw.exe
4896	EOfhesx.exe
456	nfJYejP.exe
2144	kmcqbCC.exe
876	EVkWmEK.exe
2464	eXFNngr.exe
1604	swyIErR.exe
4036	EfDEyYU.exe
3496	qSImDuz.exe
4496	gBcsHqR.exe
4348	EoZlrgS.exe
1440	tLgUtkF.exe
1080	ePMBMwk.exe
4920	ziRKEtr.exe
3484	GNbBrxF.exe
2780	KFQscGG.exe
2104	oYXMKAR.exe
4768	KHRkfyx.exe
2840	BiGVdne.exe
3648	KBEtPZZ.exe
2132	WHoOCwX.exe
1268	CTjmMIp.exe
4300	bpPAWAT.exe
2992	xlkbeOZ.exe
2772	pRapUjV.exe
4612	LljCouM.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QLldlev.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\LDqqqpn.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\qaIFjFg.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\KFQscGG.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\tiawgBy.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\exIHIKf.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\HRNmapb.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\HmgytzU.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\YpksUAG.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\eEUnmfK.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\yGFBkrN.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\PwbFGmL.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\ZhXbKpk.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\qSImDuz.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\mXosgCJ.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\ZbRBexg.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\bVESkeE.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\KOFEZjn.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\cUbimMn.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\QgRVdhd.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\JnnFitv.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\hcjNhOa.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\PRbrJkx.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\wMcbAuG.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\qncFMEb.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\zqUhVDL.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\xakCRct.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\hiHQojY.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\SVZYbKI.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\StHLphy.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\naJQbNc.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\YNhSfcM.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\WDnsTci.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\jrXfjgw.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\sRmiGqE.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\DgucwKo.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\VJpDHPA.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\tnWhrLj.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\dPJcpLl.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\fWbnNii.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\NLTHeIp.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\SqNATyo.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\IRLfjQn.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\tJROyVN.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\KANLkyt.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\bwLbMxv.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\mLxNOxu.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\YaOnSeA.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\dCMiVcT.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\WRMOtFf.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\sCBcWKw.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\usEGwOc.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\hrafCVg.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\VdTSFRJ.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\SLIbcCT.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\fhEPzVK.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\HWBROET.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\lNixweQ.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\TDyOrmx.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\zKJNTkG.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\ACtrKtn.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\gWgrMKQ.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\kGqXBfY.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
File created	C:\Windows\System\YUvDuNO.exe	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2832	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	84
PID 2592 wrote to memory of 2832	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	84
PID 2592 wrote to memory of 2252	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	85
PID 2592 wrote to memory of 2252	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	85
PID 2592 wrote to memory of 2916	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	86
PID 2592 wrote to memory of 2916	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	86
PID 2592 wrote to memory of 528	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	87
PID 2592 wrote to memory of 528	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	87
PID 2592 wrote to memory of 3148	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	88
PID 2592 wrote to memory of 3148	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	88
PID 2592 wrote to memory of 3296	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	89
PID 2592 wrote to memory of 3296	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	89
PID 2592 wrote to memory of 2376	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	90
PID 2592 wrote to memory of 2376	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	90
PID 2592 wrote to memory of 1524	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	91
PID 2592 wrote to memory of 1524	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	91
PID 2592 wrote to memory of 540	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	92
PID 2592 wrote to memory of 540	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	92
PID 2592 wrote to memory of 4940	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	93
PID 2592 wrote to memory of 4940	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	93
PID 2592 wrote to memory of 1680	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	94
PID 2592 wrote to memory of 1680	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	94
PID 2592 wrote to memory of 2352	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	95
PID 2592 wrote to memory of 2352	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	95
PID 2592 wrote to memory of 3988	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	96
PID 2592 wrote to memory of 3988	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	96
PID 2592 wrote to memory of 3232	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	97
PID 2592 wrote to memory of 3232	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	97
PID 2592 wrote to memory of 652	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	98
PID 2592 wrote to memory of 652	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	98
PID 2592 wrote to memory of 2496	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	99
PID 2592 wrote to memory of 2496	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	99
PID 2592 wrote to memory of 4508	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	100
PID 2592 wrote to memory of 4508	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	100
PID 2592 wrote to memory of 3740	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	101
PID 2592 wrote to memory of 3740	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	101
PID 2592 wrote to memory of 1368	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	102
PID 2592 wrote to memory of 1368	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	102
PID 2592 wrote to memory of 316	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	103
PID 2592 wrote to memory of 316	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	103
PID 2592 wrote to memory of 3300	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	104
PID 2592 wrote to memory of 3300	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	104
PID 2592 wrote to memory of 4800	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	105
PID 2592 wrote to memory of 4800	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	105
PID 2592 wrote to memory of 2812	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	106
PID 2592 wrote to memory of 2812	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	106
PID 2592 wrote to memory of 4656	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	107
PID 2592 wrote to memory of 4656	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	107
PID 2592 wrote to memory of 3940	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	108
PID 2592 wrote to memory of 3940	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	108
PID 2592 wrote to memory of 1196	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	109
PID 2592 wrote to memory of 1196	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	109
PID 2592 wrote to memory of 5096	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	110
PID 2592 wrote to memory of 5096	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	110
PID 2592 wrote to memory of 1164	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	111
PID 2592 wrote to memory of 1164	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	111
PID 2592 wrote to memory of 2980	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	112
PID 2592 wrote to memory of 2980	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	112
PID 2592 wrote to memory of 32	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	113
PID 2592 wrote to memory of 32	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	113
PID 2592 wrote to memory of 2240	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	114
PID 2592 wrote to memory of 2240	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	114
PID 2592 wrote to memory of 3600	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	115
PID 2592 wrote to memory of 3600	2592	9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe	115

C:\Users\Admin\AppData\Local\Temp\9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe
"C:\Users\Admin\AppData\Local\Temp\9422ffa482f7e53bb1d9e69dccbfc8c4437d070197ca45867806a1ff44272751.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\System\DGJenng.exe
  C:\Windows\System\DGJenng.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\PhofpTQ.exe
  C:\Windows\System\PhofpTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\ICrugtq.exe
  C:\Windows\System\ICrugtq.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\RUwuowF.exe
  C:\Windows\System\RUwuowF.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\vdYSUdi.exe
  C:\Windows\System\vdYSUdi.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ksUcewo.exe
  C:\Windows\System\ksUcewo.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\bwLbMxv.exe
  C:\Windows\System\bwLbMxv.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\tQEcpiY.exe
  C:\Windows\System\tQEcpiY.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\drLxbtv.exe
  C:\Windows\System\drLxbtv.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\yXXgeti.exe
  C:\Windows\System\yXXgeti.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\SFrznTn.exe
  C:\Windows\System\SFrznTn.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\INZvmeC.exe
  C:\Windows\System\INZvmeC.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\kGqXBfY.exe
  C:\Windows\System\kGqXBfY.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\YpksUAG.exe
  C:\Windows\System\YpksUAG.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\DbSppjU.exe
  C:\Windows\System\DbSppjU.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\gumqcAe.exe
  C:\Windows\System\gumqcAe.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\yXsAmOu.exe
  C:\Windows\System\yXsAmOu.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\xPUHQFq.exe
  C:\Windows\System\xPUHQFq.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\FyVhhtT.exe
  C:\Windows\System\FyVhhtT.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\HnwowzF.exe
  C:\Windows\System\HnwowzF.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\AyQjQAX.exe
  C:\Windows\System\AyQjQAX.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\ztdSGpn.exe
  C:\Windows\System\ztdSGpn.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\HmLCKOL.exe
  C:\Windows\System\HmLCKOL.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\CUzotMC.exe
  C:\Windows\System\CUzotMC.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\eKvZMaO.exe
  C:\Windows\System\eKvZMaO.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\yvIcsSe.exe
  C:\Windows\System\yvIcsSe.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\OQMhVdK.exe
  C:\Windows\System\OQMhVdK.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\bGmnZgd.exe
  C:\Windows\System\bGmnZgd.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\vXDnydS.exe
  C:\Windows\System\vXDnydS.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\CVOhkBO.exe
  C:\Windows\System\CVOhkBO.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\IAPZBvb.exe
  C:\Windows\System\IAPZBvb.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\kRtyhJm.exe
  C:\Windows\System\kRtyhJm.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\YqFeyJR.exe
  C:\Windows\System\YqFeyJR.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\BdFREKy.exe
  C:\Windows\System\BdFREKy.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\HJeSuDR.exe
  C:\Windows\System\HJeSuDR.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\fsDpNMY.exe
  C:\Windows\System\fsDpNMY.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\uAjttXe.exe
  C:\Windows\System\uAjttXe.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\rLCAPYl.exe
  C:\Windows\System\rLCAPYl.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\NZIHkCw.exe
  C:\Windows\System\NZIHkCw.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\EOfhesx.exe
  C:\Windows\System\EOfhesx.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\nfJYejP.exe
  C:\Windows\System\nfJYejP.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\kmcqbCC.exe
  C:\Windows\System\kmcqbCC.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\EVkWmEK.exe
  C:\Windows\System\EVkWmEK.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\eXFNngr.exe
  C:\Windows\System\eXFNngr.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\swyIErR.exe
  C:\Windows\System\swyIErR.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\EfDEyYU.exe
  C:\Windows\System\EfDEyYU.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\qSImDuz.exe
  C:\Windows\System\qSImDuz.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\gBcsHqR.exe
  C:\Windows\System\gBcsHqR.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\EoZlrgS.exe
  C:\Windows\System\EoZlrgS.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\tLgUtkF.exe
  C:\Windows\System\tLgUtkF.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\ePMBMwk.exe
  C:\Windows\System\ePMBMwk.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\ziRKEtr.exe
  C:\Windows\System\ziRKEtr.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\GNbBrxF.exe
  C:\Windows\System\GNbBrxF.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\KFQscGG.exe
  C:\Windows\System\KFQscGG.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\oYXMKAR.exe
  C:\Windows\System\oYXMKAR.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\KHRkfyx.exe
  C:\Windows\System\KHRkfyx.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\BiGVdne.exe
  C:\Windows\System\BiGVdne.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\KBEtPZZ.exe
  C:\Windows\System\KBEtPZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\WHoOCwX.exe
  C:\Windows\System\WHoOCwX.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\CTjmMIp.exe
  C:\Windows\System\CTjmMIp.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\bpPAWAT.exe
  C:\Windows\System\bpPAWAT.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\xlkbeOZ.exe
  C:\Windows\System\xlkbeOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\pRapUjV.exe
  C:\Windows\System\pRapUjV.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\LljCouM.exe
  C:\Windows\System\LljCouM.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\RxizJtY.exe
  C:\Windows\System\RxizJtY.exe
  2⤵
  PID:4952
- C:\Windows\System\vqsPgGD.exe
  C:\Windows\System\vqsPgGD.exe
  2⤵
  PID:1944
- C:\Windows\System\sqMFXWS.exe
  C:\Windows\System\sqMFXWS.exe
  2⤵
  PID:4268
- C:\Windows\System\ZgVGlrB.exe
  C:\Windows\System\ZgVGlrB.exe
  2⤵
  PID:1764
- C:\Windows\System\LwjHUtY.exe
  C:\Windows\System\LwjHUtY.exe
  2⤵
  PID:2984
- C:\Windows\System\cVHWiLE.exe
  C:\Windows\System\cVHWiLE.exe
  2⤵
  PID:1520
- C:\Windows\System\IRLfjQn.exe
  C:\Windows\System\IRLfjQn.exe
  2⤵
  PID:4744
- C:\Windows\System\BkWcAtY.exe
  C:\Windows\System\BkWcAtY.exe
  2⤵
  PID:2696
- C:\Windows\System\cUbimMn.exe
  C:\Windows\System\cUbimMn.exe
  2⤵
  PID:4820
- C:\Windows\System\esYFeQj.exe
  C:\Windows\System\esYFeQj.exe
  2⤵
  PID:2576
- C:\Windows\System\wqyEIwb.exe
  C:\Windows\System\wqyEIwb.exe
  2⤵
  PID:3368
- C:\Windows\System\SzSTSSJ.exe
  C:\Windows\System\SzSTSSJ.exe
  2⤵
  PID:3016
- C:\Windows\System\qMFtTTV.exe
  C:\Windows\System\qMFtTTV.exe
  2⤵
  PID:1856
- C:\Windows\System\HiNmgzO.exe
  C:\Windows\System\HiNmgzO.exe
  2⤵
  PID:4384
- C:\Windows\System\ffiYbGn.exe
  C:\Windows\System\ffiYbGn.exe
  2⤵
  PID:1732
- C:\Windows\System\YYxybVY.exe
  C:\Windows\System\YYxybVY.exe
  2⤵
  PID:3992
- C:\Windows\System\ECZuFDi.exe
  C:\Windows\System\ECZuFDi.exe
  2⤵
  PID:3852
- C:\Windows\System\OCMbAtR.exe
  C:\Windows\System\OCMbAtR.exe
  2⤵
  PID:5136
- C:\Windows\System\sfDOmFt.exe
  C:\Windows\System\sfDOmFt.exe
  2⤵
  PID:5160
- C:\Windows\System\pKukger.exe
  C:\Windows\System\pKukger.exe
  2⤵
  PID:5192
- C:\Windows\System\wamEwwD.exe
  C:\Windows\System\wamEwwD.exe
  2⤵
  PID:5224
- C:\Windows\System\aSjGDai.exe
  C:\Windows\System\aSjGDai.exe
  2⤵
  PID:5248
- C:\Windows\System\xYHlWBL.exe
  C:\Windows\System\xYHlWBL.exe
  2⤵
  PID:5276
- C:\Windows\System\eLChpRm.exe
  C:\Windows\System\eLChpRm.exe
  2⤵
  PID:5300
- C:\Windows\System\OATGIRT.exe
  C:\Windows\System\OATGIRT.exe
  2⤵
  PID:5332
- C:\Windows\System\McpoSDJ.exe
  C:\Windows\System\McpoSDJ.exe
  2⤵
  PID:5360
- C:\Windows\System\ahbngoY.exe
  C:\Windows\System\ahbngoY.exe
  2⤵
  PID:5388
- C:\Windows\System\WJTDTId.exe
  C:\Windows\System\WJTDTId.exe
  2⤵
  PID:5416
- C:\Windows\System\NQjGIBC.exe
  C:\Windows\System\NQjGIBC.exe
  2⤵
  PID:5444
- C:\Windows\System\ycjqCgO.exe
  C:\Windows\System\ycjqCgO.exe
  2⤵
  PID:5476
- C:\Windows\System\EZDjrZd.exe
  C:\Windows\System\EZDjrZd.exe
  2⤵
  PID:5504
- C:\Windows\System\kJmtlKo.exe
  C:\Windows\System\kJmtlKo.exe
  2⤵
  PID:5528
- C:\Windows\System\EUexvDC.exe
  C:\Windows\System\EUexvDC.exe
  2⤵
  PID:5556
- C:\Windows\System\IpyVjVX.exe
  C:\Windows\System\IpyVjVX.exe
  2⤵
  PID:5588
- C:\Windows\System\BZEUIRX.exe
  C:\Windows\System\BZEUIRX.exe
  2⤵
  PID:5612
- C:\Windows\System\dPJcpLl.exe
  C:\Windows\System\dPJcpLl.exe
  2⤵
  PID:5640
- C:\Windows\System\Xcoknes.exe
  C:\Windows\System\Xcoknes.exe
  2⤵
  PID:5668
- C:\Windows\System\YLixyTG.exe
  C:\Windows\System\YLixyTG.exe
  2⤵
  PID:5696
- C:\Windows\System\ujvgsTv.exe
  C:\Windows\System\ujvgsTv.exe
  2⤵
  PID:5724
- C:\Windows\System\HdfZUIE.exe
  C:\Windows\System\HdfZUIE.exe
  2⤵
  PID:5748
- C:\Windows\System\posuSkj.exe
  C:\Windows\System\posuSkj.exe
  2⤵
  PID:5780
- C:\Windows\System\VJEWKrk.exe
  C:\Windows\System\VJEWKrk.exe
  2⤵
  PID:5808
- C:\Windows\System\HMqgNPu.exe
  C:\Windows\System\HMqgNPu.exe
  2⤵
  PID:5836
- C:\Windows\System\oZJGwlt.exe
  C:\Windows\System\oZJGwlt.exe
  2⤵
  PID:5864
- C:\Windows\System\EiHmeLw.exe
  C:\Windows\System\EiHmeLw.exe
  2⤵
  PID:5892
- C:\Windows\System\jJKiPBj.exe
  C:\Windows\System\jJKiPBj.exe
  2⤵
  PID:5920
- C:\Windows\System\EyZQslz.exe
  C:\Windows\System\EyZQslz.exe
  2⤵
  PID:5948
- C:\Windows\System\lNixweQ.exe
  C:\Windows\System\lNixweQ.exe
  2⤵
  PID:5976
- C:\Windows\System\AmBvstH.exe
  C:\Windows\System\AmBvstH.exe
  2⤵
  PID:6004
- C:\Windows\System\MFVslMa.exe
  C:\Windows\System\MFVslMa.exe
  2⤵
  PID:6032
- C:\Windows\System\fMwaiZQ.exe
  C:\Windows\System\fMwaiZQ.exe
  2⤵
  PID:6060
- C:\Windows\System\LzPaeQP.exe
  C:\Windows\System\LzPaeQP.exe
  2⤵
  PID:6088
- C:\Windows\System\ivoQZde.exe
  C:\Windows\System\ivoQZde.exe
  2⤵
  PID:6112
- C:\Windows\System\zpLUzzv.exe
  C:\Windows\System\zpLUzzv.exe
  2⤵
  PID:1112
- C:\Windows\System\GPKZzhB.exe
  C:\Windows\System\GPKZzhB.exe
  2⤵
  PID:1272
- C:\Windows\System\KhJxabL.exe
  C:\Windows\System\KhJxabL.exe
  2⤵
  PID:4812
- C:\Windows\System\QpofyAa.exe
  C:\Windows\System\QpofyAa.exe
  2⤵
  PID:3684
- C:\Windows\System\FgxzvAb.exe
  C:\Windows\System\FgxzvAb.exe
  2⤵
  PID:4084
- C:\Windows\System\uObGviZ.exe
  C:\Windows\System\uObGviZ.exe
  2⤵
  PID:3416
- C:\Windows\System\hrafCVg.exe
  C:\Windows\System\hrafCVg.exe
  2⤵
  PID:2360
- C:\Windows\System\UuXCcxS.exe
  C:\Windows\System\UuXCcxS.exe
  2⤵
  PID:1008
- C:\Windows\System\tpvtImd.exe
  C:\Windows\System\tpvtImd.exe
  2⤵
  PID:5208
- C:\Windows\System\GoKSBAc.exe
  C:\Windows\System\GoKSBAc.exe
  2⤵
  PID:5244
- C:\Windows\System\fWbnNii.exe
  C:\Windows\System\fWbnNii.exe
  2⤵
  PID:5288
- C:\Windows\System\eBNZlOv.exe
  C:\Windows\System\eBNZlOv.exe
  2⤵
  PID:5344
- C:\Windows\System\wRbfzFC.exe
  C:\Windows\System\wRbfzFC.exe
  2⤵
  PID:5404
- C:\Windows\System\aiXwRUj.exe
  C:\Windows\System\aiXwRUj.exe
  2⤵
  PID:5460
- C:\Windows\System\MlfAJts.exe
  C:\Windows\System\MlfAJts.exe
  2⤵
  PID:5512
- C:\Windows\System\yJwAcfi.exe
  C:\Windows\System\yJwAcfi.exe
  2⤵
  PID:5572
- C:\Windows\System\nPHdQhT.exe
  C:\Windows\System\nPHdQhT.exe
  2⤵
  PID:5628
- C:\Windows\System\RXklXzh.exe
  C:\Windows\System\RXklXzh.exe
  2⤵
  PID:5708
- C:\Windows\System\SrvEaVJ.exe
  C:\Windows\System\SrvEaVJ.exe
  2⤵
  PID:5764
- C:\Windows\System\yWTtmuX.exe
  C:\Windows\System\yWTtmuX.exe
  2⤵
  PID:5828
- C:\Windows\System\JpnLyLZ.exe
  C:\Windows\System\JpnLyLZ.exe
  2⤵
  PID:5884
- C:\Windows\System\BLDslqI.exe
  C:\Windows\System\BLDslqI.exe
  2⤵
  PID:5960
- C:\Windows\System\LxwaExO.exe
  C:\Windows\System\LxwaExO.exe
  2⤵
  PID:6028
- C:\Windows\System\uuMuwrG.exe
  C:\Windows\System\uuMuwrG.exe
  2⤵
  PID:6080
- C:\Windows\System\GpaqWyA.exe
  C:\Windows\System\GpaqWyA.exe
  2⤵
  PID:1316
- C:\Windows\System\ilXBywA.exe
  C:\Windows\System\ilXBywA.exe
  2⤵
  PID:2348
- C:\Windows\System\Spalabr.exe
  C:\Windows\System\Spalabr.exe
  2⤵
  PID:4584
- C:\Windows\System\lziPFfQ.exe
  C:\Windows\System\lziPFfQ.exe
  2⤵
  PID:2000
- C:\Windows\System\fdqMbRo.exe
  C:\Windows\System\fdqMbRo.exe
  2⤵
  PID:5240
- C:\Windows\System\EIEIHuI.exe
  C:\Windows\System\EIEIHuI.exe
  2⤵
  PID:6160
- C:\Windows\System\SVFPyJc.exe
  C:\Windows\System\SVFPyJc.exe
  2⤵
  PID:6188
- C:\Windows\System\uKNVzOI.exe
  C:\Windows\System\uKNVzOI.exe
  2⤵
  PID:6220
- C:\Windows\System\NAnpdQN.exe
  C:\Windows\System\NAnpdQN.exe
  2⤵
  PID:6248
- C:\Windows\System\nzoDgDW.exe
  C:\Windows\System\nzoDgDW.exe
  2⤵
  PID:6276
- C:\Windows\System\cwqyEGf.exe
  C:\Windows\System\cwqyEGf.exe
  2⤵
  PID:6300
- C:\Windows\System\prPNOcH.exe
  C:\Windows\System\prPNOcH.exe
  2⤵
  PID:6328
- C:\Windows\System\YtNkMpo.exe
  C:\Windows\System\YtNkMpo.exe
  2⤵
  PID:6360
- C:\Windows\System\DNVCbgK.exe
  C:\Windows\System\DNVCbgK.exe
  2⤵
  PID:6376
- C:\Windows\System\gVMeWWK.exe
  C:\Windows\System\gVMeWWK.exe
  2⤵
  PID:6404
- C:\Windows\System\ZwhVOLA.exe
  C:\Windows\System\ZwhVOLA.exe
  2⤵
  PID:6440
- C:\Windows\System\KYEJJeV.exe
  C:\Windows\System\KYEJJeV.exe
  2⤵
  PID:6468
- C:\Windows\System\wfDmPVG.exe
  C:\Windows\System\wfDmPVG.exe
  2⤵
  PID:6496
- C:\Windows\System\ZMycoJS.exe
  C:\Windows\System\ZMycoJS.exe
  2⤵
  PID:6524
- C:\Windows\System\TSpKujC.exe
  C:\Windows\System\TSpKujC.exe
  2⤵
  PID:6556
- C:\Windows\System\sseIiBo.exe
  C:\Windows\System\sseIiBo.exe
  2⤵
  PID:6584
- C:\Windows\System\GotLmfe.exe
  C:\Windows\System\GotLmfe.exe
  2⤵
  PID:6612
- C:\Windows\System\GLnmHJe.exe
  C:\Windows\System\GLnmHJe.exe
  2⤵
  PID:6640
- C:\Windows\System\qndbMee.exe
  C:\Windows\System\qndbMee.exe
  2⤵
  PID:6668
- C:\Windows\System\lzWIWRK.exe
  C:\Windows\System\lzWIWRK.exe
  2⤵
  PID:6692
- C:\Windows\System\PNyPNcF.exe
  C:\Windows\System\PNyPNcF.exe
  2⤵
  PID:6720
- C:\Windows\System\DopgWAn.exe
  C:\Windows\System\DopgWAn.exe
  2⤵
  PID:6748
- C:\Windows\System\bzKTvQm.exe
  C:\Windows\System\bzKTvQm.exe
  2⤵
  PID:6776
- C:\Windows\System\YgyCbdX.exe
  C:\Windows\System\YgyCbdX.exe
  2⤵
  PID:6804
- C:\Windows\System\gCqjccQ.exe
  C:\Windows\System\gCqjccQ.exe
  2⤵
  PID:6836
- C:\Windows\System\pEFOaJu.exe
  C:\Windows\System\pEFOaJu.exe
  2⤵
  PID:6860
- C:\Windows\System\jrXfjgw.exe
  C:\Windows\System\jrXfjgw.exe
  2⤵
  PID:6888
- C:\Windows\System\RhiLFlh.exe
  C:\Windows\System\RhiLFlh.exe
  2⤵
  PID:6916
- C:\Windows\System\lmCkaqB.exe
  C:\Windows\System\lmCkaqB.exe
  2⤵
  PID:6944
- C:\Windows\System\YUDSBKD.exe
  C:\Windows\System\YUDSBKD.exe
  2⤵
  PID:6972
- C:\Windows\System\DNbPDIS.exe
  C:\Windows\System\DNbPDIS.exe
  2⤵
  PID:7004
- C:\Windows\System\YHFZUds.exe
  C:\Windows\System\YHFZUds.exe
  2⤵
  PID:7028
- C:\Windows\System\akSIbmZ.exe
  C:\Windows\System\akSIbmZ.exe
  2⤵
  PID:7060
- C:\Windows\System\ihzITyp.exe
  C:\Windows\System\ihzITyp.exe
  2⤵
  PID:7088
- C:\Windows\System\ZEDrmlP.exe
  C:\Windows\System\ZEDrmlP.exe
  2⤵
  PID:7116
- C:\Windows\System\MJitsgj.exe
  C:\Windows\System\MJitsgj.exe
  2⤵
  PID:7144
- C:\Windows\System\knJrmFT.exe
  C:\Windows\System\knJrmFT.exe
  2⤵
  PID:5316
- C:\Windows\System\yWTuxlL.exe
  C:\Windows\System\yWTuxlL.exe
  2⤵
  PID:5436
- C:\Windows\System\PRbrJkx.exe
  C:\Windows\System\PRbrJkx.exe
  2⤵
  PID:5604
- C:\Windows\System\JqQIztX.exe
  C:\Windows\System\JqQIztX.exe
  2⤵
  PID:5744
- C:\Windows\System\hQkzkkT.exe
  C:\Windows\System\hQkzkkT.exe
  2⤵
  PID:5880
- C:\Windows\System\PnemyBp.exe
  C:\Windows\System\PnemyBp.exe
  2⤵
  PID:6020
- C:\Windows\System\vKOJifm.exe
  C:\Windows\System\vKOJifm.exe
  2⤵
  PID:4804
- C:\Windows\System\teviMez.exe
  C:\Windows\System\teviMez.exe
  2⤵
  PID:4956
- C:\Windows\System\opfEowi.exe
  C:\Windows\System\opfEowi.exe
  2⤵
  PID:6152
- C:\Windows\System\yrzZWnh.exe
  C:\Windows\System\yrzZWnh.exe
  2⤵
  PID:6208
- C:\Windows\System\PqPRqOU.exe
  C:\Windows\System\PqPRqOU.exe
  2⤵
  PID:6268
- C:\Windows\System\bwQSRqm.exe
  C:\Windows\System\bwQSRqm.exe
  2⤵
  PID:6344
- C:\Windows\System\VJpDHPA.exe
  C:\Windows\System\VJpDHPA.exe
  2⤵
  PID:6392
- C:\Windows\System\rMRFpyi.exe
  C:\Windows\System\rMRFpyi.exe
  2⤵
  PID:6464
- C:\Windows\System\qaIFjFg.exe
  C:\Windows\System\qaIFjFg.exe
  2⤵
  PID:6520
- C:\Windows\System\GuTfcvM.exe
  C:\Windows\System\GuTfcvM.exe
  2⤵
  PID:6600
- C:\Windows\System\uSFRZFC.exe
  C:\Windows\System\uSFRZFC.exe
  2⤵
  PID:6656
- C:\Windows\System\aMTfoKq.exe
  C:\Windows\System\aMTfoKq.exe
  2⤵
  PID:4236
- C:\Windows\System\EVEDBcA.exe
  C:\Windows\System\EVEDBcA.exe
  2⤵
  PID:6772
- C:\Windows\System\wthJtQE.exe
  C:\Windows\System\wthJtQE.exe
  2⤵
  PID:6848
- C:\Windows\System\amDlFVy.exe
  C:\Windows\System\amDlFVy.exe
  2⤵
  PID:6908
- C:\Windows\System\NVqHDeK.exe
  C:\Windows\System\NVqHDeK.exe
  2⤵
  PID:6960
- C:\Windows\System\PuIopAg.exe
  C:\Windows\System\PuIopAg.exe
  2⤵
  PID:7020
- C:\Windows\System\VJAsZDJ.exe
  C:\Windows\System\VJAsZDJ.exe
  2⤵
  PID:7076
- C:\Windows\System\VMBYEVn.exe
  C:\Windows\System\VMBYEVn.exe
  2⤵
  PID:7156
- C:\Windows\System\SmKthLX.exe
  C:\Windows\System\SmKthLX.exe
  2⤵
  PID:2344
- C:\Windows\System\OwwSyGN.exe
  C:\Windows\System\OwwSyGN.exe
  2⤵
  PID:5736
- C:\Windows\System\XeDMLLA.exe
  C:\Windows\System\XeDMLLA.exe
  2⤵
  PID:6108
- C:\Windows\System\RTceohE.exe
  C:\Windows\System\RTceohE.exe
  2⤵
  PID:5184
- C:\Windows\System\LOkUJjP.exe
  C:\Windows\System\LOkUJjP.exe
  2⤵
  PID:348
- C:\Windows\System\RZkaqVm.exe
  C:\Windows\System\RZkaqVm.exe
  2⤵
  PID:6320
- C:\Windows\System\YAmRxYF.exe
  C:\Windows\System\YAmRxYF.exe
  2⤵
  PID:2284
- C:\Windows\System\IfSKYZo.exe
  C:\Windows\System\IfSKYZo.exe
  2⤵
  PID:6632
- C:\Windows\System\QZyCnZZ.exe
  C:\Windows\System\QZyCnZZ.exe
  2⤵
  PID:6712
- C:\Windows\System\jEkGCdV.exe
  C:\Windows\System\jEkGCdV.exe
  2⤵
  PID:6820
- C:\Windows\System\RBIQxIk.exe
  C:\Windows\System\RBIQxIk.exe
  2⤵
  PID:3504
- C:\Windows\System\qhWRFOt.exe
  C:\Windows\System\qhWRFOt.exe
  2⤵
  PID:220
- C:\Windows\System\mGDKiQj.exe
  C:\Windows\System\mGDKiQj.exe
  2⤵
  PID:5380
- C:\Windows\System\rzBcUCC.exe
  C:\Windows\System\rzBcUCC.exe
  2⤵
  PID:4924
- C:\Windows\System\aVyTdjT.exe
  C:\Windows\System\aVyTdjT.exe
  2⤵
  PID:1588
- C:\Windows\System\PKwwBJR.exe
  C:\Windows\System\PKwwBJR.exe
  2⤵
  PID:6264
- C:\Windows\System\gCBwaQJ.exe
  C:\Windows\System\gCBwaQJ.exe
  2⤵
  PID:2932
- C:\Windows\System\eCkqufd.exe
  C:\Windows\System\eCkqufd.exe
  2⤵
  PID:1700
- C:\Windows\System\qyFkoGe.exe
  C:\Windows\System\qyFkoGe.exe
  2⤵
  PID:1256
- C:\Windows\System\UTAGMLi.exe
  C:\Windows\System\UTAGMLi.exe
  2⤵
  PID:2880
- C:\Windows\System\PIiVzxJ.exe
  C:\Windows\System\PIiVzxJ.exe
  2⤵
  PID:6180
- C:\Windows\System\HKwGBXp.exe
  C:\Windows\System\HKwGBXp.exe
  2⤵
  PID:6184
- C:\Windows\System\adnxgWI.exe
  C:\Windows\System\adnxgWI.exe
  2⤵
  PID:1784
- C:\Windows\System\vlyEAHt.exe
  C:\Windows\System\vlyEAHt.exe
  2⤵
  PID:6988
- C:\Windows\System\ldKUAOC.exe
  C:\Windows\System\ldKUAOC.exe
  2⤵
  PID:2620
- C:\Windows\System\tnWhrLj.exe
  C:\Windows\System\tnWhrLj.exe
  2⤵
  PID:4220
- C:\Windows\System\VdTSFRJ.exe
  C:\Windows\System\VdTSFRJ.exe
  2⤵
  PID:636
- C:\Windows\System\DfiOalG.exe
  C:\Windows\System\DfiOalG.exe
  2⤵
  PID:1712
- C:\Windows\System\qNVQWld.exe
  C:\Windows\System\qNVQWld.exe
  2⤵
  PID:4004
- C:\Windows\System\LnpJwOs.exe
  C:\Windows\System\LnpJwOs.exe
  2⤵
  PID:4564
- C:\Windows\System\sJmzNsJ.exe
  C:\Windows\System\sJmzNsJ.exe
  2⤵
  PID:7208
- C:\Windows\System\eEUnmfK.exe
  C:\Windows\System\eEUnmfK.exe
  2⤵
  PID:7232
- C:\Windows\System\gaagaIj.exe
  C:\Windows\System\gaagaIj.exe
  2⤵
  PID:7248
- C:\Windows\System\OBJlDHJ.exe
  C:\Windows\System\OBJlDHJ.exe
  2⤵
  PID:7276
- C:\Windows\System\WFHCbjq.exe
  C:\Windows\System\WFHCbjq.exe
  2⤵
  PID:7312
- C:\Windows\System\izbSbdD.exe
  C:\Windows\System\izbSbdD.exe
  2⤵
  PID:7360
- C:\Windows\System\pgyDJki.exe
  C:\Windows\System\pgyDJki.exe
  2⤵
  PID:7388
- C:\Windows\System\JotSPzR.exe
  C:\Windows\System\JotSPzR.exe
  2⤵
  PID:7404
- C:\Windows\System\BfKtLUR.exe
  C:\Windows\System\BfKtLUR.exe
  2⤵
  PID:7420
- C:\Windows\System\BMNwyYc.exe
  C:\Windows\System\BMNwyYc.exe
  2⤵
  PID:7444
- C:\Windows\System\lCILwNm.exe
  C:\Windows\System\lCILwNm.exe
  2⤵
  PID:7472
- C:\Windows\System\KmHZVHf.exe
  C:\Windows\System\KmHZVHf.exe
  2⤵
  PID:7492
- C:\Windows\System\fsyXCbX.exe
  C:\Windows\System\fsyXCbX.exe
  2⤵
  PID:7524
- C:\Windows\System\wBkPgUa.exe
  C:\Windows\System\wBkPgUa.exe
  2⤵
  PID:7552
- C:\Windows\System\ZVzwndp.exe
  C:\Windows\System\ZVzwndp.exe
  2⤵
  PID:7580
- C:\Windows\System\sVYIsvK.exe
  C:\Windows\System\sVYIsvK.exe
  2⤵
  PID:7596
- C:\Windows\System\gTXFNdQ.exe
  C:\Windows\System\gTXFNdQ.exe
  2⤵
  PID:7616
- C:\Windows\System\RSUZQXb.exe
  C:\Windows\System\RSUZQXb.exe
  2⤵
  PID:7688
- C:\Windows\System\GzRmaZg.exe
  C:\Windows\System\GzRmaZg.exe
  2⤵
  PID:7716
- C:\Windows\System\oJHUZiU.exe
  C:\Windows\System\oJHUZiU.exe
  2⤵
  PID:7736
- C:\Windows\System\gaQmLDW.exe
  C:\Windows\System\gaQmLDW.exe
  2⤵
  PID:7764
- C:\Windows\System\yTVuwLW.exe
  C:\Windows\System\yTVuwLW.exe
  2⤵
  PID:7788
- C:\Windows\System\SLIbcCT.exe
  C:\Windows\System\SLIbcCT.exe
  2⤵
  PID:7816
- C:\Windows\System\TyeOetH.exe
  C:\Windows\System\TyeOetH.exe
  2⤵
  PID:7868
- C:\Windows\System\VCJkRzc.exe
  C:\Windows\System\VCJkRzc.exe
  2⤵
  PID:7884
- C:\Windows\System\CezHBmS.exe
  C:\Windows\System\CezHBmS.exe
  2⤵
  PID:7912
- C:\Windows\System\yFCXmpo.exe
  C:\Windows\System\yFCXmpo.exe
  2⤵
  PID:7928
- C:\Windows\System\RpuWBBd.exe
  C:\Windows\System\RpuWBBd.exe
  2⤵
  PID:7956
- C:\Windows\System\eExbVuf.exe
  C:\Windows\System\eExbVuf.exe
  2⤵
  PID:8008
- C:\Windows\System\lNeqpBk.exe
  C:\Windows\System\lNeqpBk.exe
  2⤵
  PID:8024
- C:\Windows\System\yGFBkrN.exe
  C:\Windows\System\yGFBkrN.exe
  2⤵
  PID:8064
- C:\Windows\System\uKgCqzr.exe
  C:\Windows\System\uKgCqzr.exe
  2⤵
  PID:8084
- C:\Windows\System\jOaAqEo.exe
  C:\Windows\System\jOaAqEo.exe
  2⤵
  PID:8108
- C:\Windows\System\IkzBqRe.exe
  C:\Windows\System\IkzBqRe.exe
  2⤵
  PID:8148
- C:\Windows\System\TlptLDP.exe
  C:\Windows\System\TlptLDP.exe
  2⤵
  PID:8176
- C:\Windows\System\jHjXeQt.exe
  C:\Windows\System\jHjXeQt.exe
  2⤵
  PID:1956
- C:\Windows\System\AXjlyyB.exe
  C:\Windows\System\AXjlyyB.exe
  2⤵
  PID:7244
- C:\Windows\System\VeaQIUs.exe
  C:\Windows\System\VeaQIUs.exe
  2⤵
  PID:7260
- C:\Windows\System\AwRXWsR.exe
  C:\Windows\System\AwRXWsR.exe
  2⤵
  PID:7352
- C:\Windows\System\SvBLtRY.exe
  C:\Windows\System\SvBLtRY.exe
  2⤵
  PID:7412
- C:\Windows\System\agesmrh.exe
  C:\Windows\System\agesmrh.exe
  2⤵
  PID:7464
- C:\Windows\System\pgIkhiY.exe
  C:\Windows\System\pgIkhiY.exe
  2⤵
  PID:7516
- C:\Windows\System\pBYfVZv.exe
  C:\Windows\System\pBYfVZv.exe
  2⤵
  PID:7660
- C:\Windows\System\uxOdfNn.exe
  C:\Windows\System\uxOdfNn.exe
  2⤵
  PID:7564
- C:\Windows\System\YHxguIg.exe
  C:\Windows\System\YHxguIg.exe
  2⤵
  PID:7636
- C:\Windows\System\bHpTAso.exe
  C:\Windows\System\bHpTAso.exe
  2⤵
  PID:7772
- C:\Windows\System\gAGQhgC.exe
  C:\Windows\System\gAGQhgC.exe
  2⤵
  PID:7748
- C:\Windows\System\OyIneqs.exe
  C:\Windows\System\OyIneqs.exe
  2⤵
  PID:7876
- C:\Windows\System\xwtTcIf.exe
  C:\Windows\System\xwtTcIf.exe
  2⤵
  PID:7920
- C:\Windows\System\pmecYkP.exe
  C:\Windows\System\pmecYkP.exe
  2⤵
  PID:8056
- C:\Windows\System\xcmQBVB.exe
  C:\Windows\System\xcmQBVB.exe
  2⤵
  PID:8128
- C:\Windows\System\JHQXoCG.exe
  C:\Windows\System\JHQXoCG.exe
  2⤵
  PID:8184
- C:\Windows\System\RoqMmQJ.exe
  C:\Windows\System\RoqMmQJ.exe
  2⤵
  PID:7296
- C:\Windows\System\fouBBsm.exe
  C:\Windows\System\fouBBsm.exe
  2⤵
  PID:7460
- C:\Windows\System\watGgNz.exe
  C:\Windows\System\watGgNz.exe
  2⤵
  PID:7484
- C:\Windows\System\lXaWaOs.exe
  C:\Windows\System\lXaWaOs.exe
  2⤵
  PID:7572
- C:\Windows\System\mXosgCJ.exe
  C:\Windows\System\mXosgCJ.exe
  2⤵
  PID:7656
- C:\Windows\System\LhCHRVQ.exe
  C:\Windows\System\LhCHRVQ.exe
  2⤵
  PID:7896
- C:\Windows\System\dCGMSRv.exe
  C:\Windows\System\dCGMSRv.exe
  2⤵
  PID:7852
- C:\Windows\System\yISmzFD.exe
  C:\Windows\System\yISmzFD.exe
  2⤵
  PID:8172
- C:\Windows\System\riXKaFB.exe
  C:\Windows\System\riXKaFB.exe
  2⤵
  PID:7304
- C:\Windows\System\DbwcIIc.exe
  C:\Windows\System\DbwcIIc.exe
  2⤵
  PID:7744
- C:\Windows\System\LGeQsLj.exe
  C:\Windows\System\LGeQsLj.exe
  2⤵
  PID:7604
- C:\Windows\System\haKrQhR.exe
  C:\Windows\System\haKrQhR.exe
  2⤵
  PID:8208
- C:\Windows\System\GjSAXLz.exe
  C:\Windows\System\GjSAXLz.exe
  2⤵
  PID:8244
- C:\Windows\System\zGrDgSa.exe
  C:\Windows\System\zGrDgSa.exe
  2⤵
  PID:8292
- C:\Windows\System\nPYGKbM.exe
  C:\Windows\System\nPYGKbM.exe
  2⤵
  PID:8312
- C:\Windows\System\AWspuFa.exe
  C:\Windows\System\AWspuFa.exe
  2⤵
  PID:8336
- C:\Windows\System\uhkTiPV.exe
  C:\Windows\System\uhkTiPV.exe
  2⤵
  PID:8364
- C:\Windows\System\gVWETpN.exe
  C:\Windows\System\gVWETpN.exe
  2⤵
  PID:8396
- C:\Windows\System\rYfNARh.exe
  C:\Windows\System\rYfNARh.exe
  2⤵
  PID:8420
- C:\Windows\System\zgtZsFk.exe
  C:\Windows\System\zgtZsFk.exe
  2⤵
  PID:8444
- C:\Windows\System\dSHXrSW.exe
  C:\Windows\System\dSHXrSW.exe
  2⤵
  PID:8504
- C:\Windows\System\SeuTEmY.exe
  C:\Windows\System\SeuTEmY.exe
  2⤵
  PID:8528
- C:\Windows\System\lxXEDNX.exe
  C:\Windows\System\lxXEDNX.exe
  2⤵
  PID:8556
- C:\Windows\System\YQzJQRg.exe
  C:\Windows\System\YQzJQRg.exe
  2⤵
  PID:8600
- C:\Windows\System\fASNBiI.exe
  C:\Windows\System\fASNBiI.exe
  2⤵
  PID:8616
- C:\Windows\System\ulOccxO.exe
  C:\Windows\System\ulOccxO.exe
  2⤵
  PID:8656
- C:\Windows\System\nTwPWjb.exe
  C:\Windows\System\nTwPWjb.exe
  2⤵
  PID:8684
- C:\Windows\System\GnFvZDH.exe
  C:\Windows\System\GnFvZDH.exe
  2⤵
  PID:8712
- C:\Windows\System\zqUhVDL.exe
  C:\Windows\System\zqUhVDL.exe
  2⤵
  PID:8740
- C:\Windows\System\NFKIuWi.exe
  C:\Windows\System\NFKIuWi.exe
  2⤵
  PID:8768
- C:\Windows\System\vSpEKQI.exe
  C:\Windows\System\vSpEKQI.exe
  2⤵
  PID:8788
- C:\Windows\System\EovsqVz.exe
  C:\Windows\System\EovsqVz.exe
  2⤵
  PID:8804
- C:\Windows\System\KTuSoWf.exe
  C:\Windows\System\KTuSoWf.exe
  2⤵
  PID:8828
- C:\Windows\System\QgRVdhd.exe
  C:\Windows\System\QgRVdhd.exe
  2⤵
  PID:8860
- C:\Windows\System\wMcbAuG.exe
  C:\Windows\System\wMcbAuG.exe
  2⤵
  PID:8884
- C:\Windows\System\ydvEtOL.exe
  C:\Windows\System\ydvEtOL.exe
  2⤵
  PID:8908
- C:\Windows\System\LoSCbje.exe
  C:\Windows\System\LoSCbje.exe
  2⤵
  PID:8952
- C:\Windows\System\KHiwzWU.exe
  C:\Windows\System\KHiwzWU.exe
  2⤵
  PID:8972
- C:\Windows\System\JajDPgL.exe
  C:\Windows\System\JajDPgL.exe
  2⤵
  PID:9024
- C:\Windows\System\mukIGUo.exe
  C:\Windows\System\mukIGUo.exe
  2⤵
  PID:9056
- C:\Windows\System\RqAVjOn.exe
  C:\Windows\System\RqAVjOn.exe
  2⤵
  PID:9076
- C:\Windows\System\eqTGRyT.exe
  C:\Windows\System\eqTGRyT.exe
  2⤵
  PID:9104
- C:\Windows\System\WIJvKgu.exe
  C:\Windows\System\WIJvKgu.exe
  2⤵
  PID:9124
- C:\Windows\System\jZKEqXa.exe
  C:\Windows\System\jZKEqXa.exe
  2⤵
  PID:9144
- C:\Windows\System\xkWaFoK.exe
  C:\Windows\System\xkWaFoK.exe
  2⤵
  PID:9172
- C:\Windows\System\nVTArEm.exe
  C:\Windows\System\nVTArEm.exe
  2⤵
  PID:9200
- C:\Windows\System\GAGAJhg.exe
  C:\Windows\System\GAGAJhg.exe
  2⤵
  PID:8256
- C:\Windows\System\DPCufWX.exe
  C:\Windows\System\DPCufWX.exe
  2⤵
  PID:8220
- C:\Windows\System\erdWwmS.exe
  C:\Windows\System\erdWwmS.exe
  2⤵
  PID:8300
- C:\Windows\System\ZYLWMBA.exe
  C:\Windows\System\ZYLWMBA.exe
  2⤵
  PID:8356
- C:\Windows\System\Indscha.exe
  C:\Windows\System\Indscha.exe
  2⤵
  PID:8480
- C:\Windows\System\AXhMEOH.exe
  C:\Windows\System\AXhMEOH.exe
  2⤵
  PID:8496
- C:\Windows\System\IiHNxKz.exe
  C:\Windows\System\IiHNxKz.exe
  2⤵
  PID:8584
- C:\Windows\System\yXPYMmj.exe
  C:\Windows\System\yXPYMmj.exe
  2⤵
  PID:8628
- C:\Windows\System\AQlQchS.exe
  C:\Windows\System\AQlQchS.exe
  2⤵
  PID:8680
- C:\Windows\System\csZiKhe.exe
  C:\Windows\System\csZiKhe.exe
  2⤵
  PID:8708
- C:\Windows\System\cJNULSd.exe
  C:\Windows\System\cJNULSd.exe
  2⤵
  PID:8784
- C:\Windows\System\BtPqlXE.exe
  C:\Windows\System\BtPqlXE.exe
  2⤵
  PID:8900
- C:\Windows\System\yDmNFoU.exe
  C:\Windows\System\yDmNFoU.exe
  2⤵
  PID:8944
- C:\Windows\System\zTmarPk.exe
  C:\Windows\System\zTmarPk.exe
  2⤵
  PID:9036
- C:\Windows\System\zrwNEbp.exe
  C:\Windows\System\zrwNEbp.exe
  2⤵
  PID:9084
- C:\Windows\System\wcIupKP.exe
  C:\Windows\System\wcIupKP.exe
  2⤵
  PID:9180
- C:\Windows\System\XECAnSJ.exe
  C:\Windows\System\XECAnSJ.exe
  2⤵
  PID:9212
- C:\Windows\System\fhEPzVK.exe
  C:\Windows\System\fhEPzVK.exe
  2⤵
  PID:8236
- C:\Windows\System\yMeoXYk.exe
  C:\Windows\System\yMeoXYk.exe
  2⤵
  PID:8376
- C:\Windows\System\RFyQWef.exe
  C:\Windows\System\RFyQWef.exe
  2⤵
  PID:8540
- C:\Windows\System\oJtibEn.exe
  C:\Windows\System\oJtibEn.exe
  2⤵
  PID:8756
- C:\Windows\System\hoqtqdU.exe
  C:\Windows\System\hoqtqdU.exe
  2⤵
  PID:8868
- C:\Windows\System\eXWFKlt.exe
  C:\Windows\System\eXWFKlt.exe
  2⤵
  PID:8996
- C:\Windows\System\aHrZrva.exe
  C:\Windows\System\aHrZrva.exe
  2⤵
  PID:9116
- C:\Windows\System\SVZYbKI.exe
  C:\Windows\System\SVZYbKI.exe
  2⤵
  PID:8412
- C:\Windows\System\LeWEWKV.exe
  C:\Windows\System\LeWEWKV.exe
  2⤵
  PID:8544
- C:\Windows\System\HtJWGDl.exe
  C:\Windows\System\HtJWGDl.exe
  2⤵
  PID:9000
- C:\Windows\System\sjErNcj.exe
  C:\Windows\System\sjErNcj.exe
  2⤵
  PID:9220
- C:\Windows\System\fNMWfpr.exe
  C:\Windows\System\fNMWfpr.exe
  2⤵
  PID:9256
- C:\Windows\System\IdRpAFG.exe
  C:\Windows\System\IdRpAFG.exe
  2⤵
  PID:9272
- C:\Windows\System\vqczSst.exe
  C:\Windows\System\vqczSst.exe
  2⤵
  PID:9296
- C:\Windows\System\fueFbNc.exe
  C:\Windows\System\fueFbNc.exe
  2⤵
  PID:9316
- C:\Windows\System\SAIUyHd.exe
  C:\Windows\System\SAIUyHd.exe
  2⤵
  PID:9340
- C:\Windows\System\akbTeSd.exe
  C:\Windows\System\akbTeSd.exe
  2⤵
  PID:9364
- C:\Windows\System\UInAUAJ.exe
  C:\Windows\System\UInAUAJ.exe
  2⤵
  PID:9408
- C:\Windows\System\ovEiXLQ.exe
  C:\Windows\System\ovEiXLQ.exe
  2⤵
  PID:9436
- C:\Windows\System\dCMiVcT.exe
  C:\Windows\System\dCMiVcT.exe
  2⤵
  PID:9456
- C:\Windows\System\OWIschD.exe
  C:\Windows\System\OWIschD.exe
  2⤵
  PID:9492
- C:\Windows\System\xakCRct.exe
  C:\Windows\System\xakCRct.exe
  2⤵
  PID:9508
- C:\Windows\System\upfUQoq.exe
  C:\Windows\System\upfUQoq.exe
  2⤵
  PID:9532
- C:\Windows\System\LUFBNGw.exe
  C:\Windows\System\LUFBNGw.exe
  2⤵
  PID:9556
- C:\Windows\System\GDYPzGH.exe
  C:\Windows\System\GDYPzGH.exe
  2⤵
  PID:9584
- C:\Windows\System\QPxbgSR.exe
  C:\Windows\System\QPxbgSR.exe
  2⤵
  PID:9624
- C:\Windows\System\pMkhrfu.exe
  C:\Windows\System\pMkhrfu.exe
  2⤵
  PID:9656
- C:\Windows\System\YfOZTEc.exe
  C:\Windows\System\YfOZTEc.exe
  2⤵
  PID:9700
- C:\Windows\System\GEgCWtB.exe
  C:\Windows\System\GEgCWtB.exe
  2⤵
  PID:9732
- C:\Windows\System\ZyZYhwp.exe
  C:\Windows\System\ZyZYhwp.exe
  2⤵
  PID:9760
- C:\Windows\System\tpUhenc.exe
  C:\Windows\System\tpUhenc.exe
  2⤵
  PID:9788
- C:\Windows\System\akYeiEI.exe
  C:\Windows\System\akYeiEI.exe
  2⤵
  PID:9824
- C:\Windows\System\ApTPUyU.exe
  C:\Windows\System\ApTPUyU.exe
  2⤵
  PID:9844
- C:\Windows\System\BDsGOKN.exe
  C:\Windows\System\BDsGOKN.exe
  2⤵
  PID:9864
- C:\Windows\System\kUKUqDY.exe
  C:\Windows\System\kUKUqDY.exe
  2⤵
  PID:9896
- C:\Windows\System\WRMOtFf.exe
  C:\Windows\System\WRMOtFf.exe
  2⤵
  PID:9920
- C:\Windows\System\zEjBDYD.exe
  C:\Windows\System\zEjBDYD.exe
  2⤵
  PID:9940
- C:\Windows\System\AiNeren.exe
  C:\Windows\System\AiNeren.exe
  2⤵
  PID:9980
- C:\Windows\System\tJROyVN.exe
  C:\Windows\System\tJROyVN.exe
  2⤵
  PID:10000
- C:\Windows\System\NlrgQNq.exe
  C:\Windows\System\NlrgQNq.exe
  2⤵
  PID:10024
- C:\Windows\System\bdbPFLi.exe
  C:\Windows\System\bdbPFLi.exe
  2⤵
  PID:10060
- C:\Windows\System\mbaIiiU.exe
  C:\Windows\System\mbaIiiU.exe
  2⤵
  PID:10084
- C:\Windows\System\pDnXlJG.exe
  C:\Windows\System\pDnXlJG.exe
  2⤵
  PID:10108
- C:\Windows\System\yHtSmzK.exe
  C:\Windows\System\yHtSmzK.exe
  2⤵
  PID:10132
- C:\Windows\System\NLTHeIp.exe
  C:\Windows\System\NLTHeIp.exe
  2⤵
  PID:10156
- C:\Windows\System\ezRPlbf.exe
  C:\Windows\System\ezRPlbf.exe
  2⤵
  PID:10180
- C:\Windows\System\JsmmFKa.exe
  C:\Windows\System\JsmmFKa.exe
  2⤵
  PID:8988
- C:\Windows\System\XCWofLa.exe
  C:\Windows\System\XCWofLa.exe
  2⤵
  PID:9248
- C:\Windows\System\zPBYqiY.exe
  C:\Windows\System\zPBYqiY.exe
  2⤵
  PID:9336
- C:\Windows\System\yhaXuLk.exe
  C:\Windows\System\yhaXuLk.exe
  2⤵
  PID:9348
- C:\Windows\System\ENGZETi.exe
  C:\Windows\System\ENGZETi.exe
  2⤵
  PID:9420
- C:\Windows\System\ofzngYx.exe
  C:\Windows\System\ofzngYx.exe
  2⤵
  PID:9448
- C:\Windows\System\IMXGGFD.exe
  C:\Windows\System\IMXGGFD.exe
  2⤵
  PID:9472
- C:\Windows\System\iItkOXM.exe
  C:\Windows\System\iItkOXM.exe
  2⤵
  PID:9568
- C:\Windows\System\iHWigdx.exe
  C:\Windows\System\iHWigdx.exe
  2⤵
  PID:9672
- C:\Windows\System\xKYCRnF.exe
  C:\Windows\System\xKYCRnF.exe
  2⤵
  PID:9816
- C:\Windows\System\ZsExfcV.exe
  C:\Windows\System\ZsExfcV.exe
  2⤵
  PID:9840
- C:\Windows\System\DmTdzZD.exe
  C:\Windows\System\DmTdzZD.exe
  2⤵
  PID:9928
- C:\Windows\System\xFItusp.exe
  C:\Windows\System\xFItusp.exe
  2⤵
  PID:10016
- C:\Windows\System\LAycKfU.exe
  C:\Windows\System\LAycKfU.exe
  2⤵
  PID:10072
- C:\Windows\System\ecqlspc.exe
  C:\Windows\System\ecqlspc.exe
  2⤵
  PID:10092
- C:\Windows\System\OgExRaH.exe
  C:\Windows\System\OgExRaH.exe
  2⤵
  PID:10148
- C:\Windows\System\yyXCzbG.exe
  C:\Windows\System\yyXCzbG.exe
  2⤵
  PID:10212
- C:\Windows\System\fYtQMRK.exe
  C:\Windows\System\fYtQMRK.exe
  2⤵
  PID:9280
- C:\Windows\System\xENlIuM.exe
  C:\Windows\System\xENlIuM.exe
  2⤵
  PID:9324
- C:\Windows\System\kgkYQEB.exe
  C:\Windows\System\kgkYQEB.exe
  2⤵
  PID:9500
- C:\Windows\System\IhZMils.exe
  C:\Windows\System\IhZMils.exe
  2⤵
  PID:9596
- C:\Windows\System\Hdecvru.exe
  C:\Windows\System\Hdecvru.exe
  2⤵
  PID:9832
- C:\Windows\System\rgFFeyl.exe
  C:\Windows\System\rgFFeyl.exe
  2⤵
  PID:9936
- C:\Windows\System\isdJxYU.exe
  C:\Windows\System\isdJxYU.exe
  2⤵
  PID:9476
- C:\Windows\System\yeBIPYK.exe
  C:\Windows\System\yeBIPYK.exe
  2⤵
  PID:9652
- C:\Windows\System\ZICxMXJ.exe
  C:\Windows\System\ZICxMXJ.exe
  2⤵
  PID:9888
- C:\Windows\System\zxfNqvK.exe
  C:\Windows\System\zxfNqvK.exe
  2⤵
  PID:9756
- C:\Windows\System\JYGzWyu.exe
  C:\Windows\System\JYGzWyu.exe
  2⤵
  PID:4628
- C:\Windows\System\wNfDbhn.exe
  C:\Windows\System\wNfDbhn.exe
  2⤵
  PID:3252
- C:\Windows\System\HYPmoSO.exe
  C:\Windows\System\HYPmoSO.exe
  2⤵
  PID:10144
- C:\Windows\System\hiHQojY.exe
  C:\Windows\System\hiHQojY.exe
  2⤵
  PID:10280
- C:\Windows\System\dJCpTJR.exe
  C:\Windows\System\dJCpTJR.exe
  2⤵
  PID:10316
- C:\Windows\System\PHqWUTJ.exe
  C:\Windows\System\PHqWUTJ.exe
  2⤵
  PID:10332
- C:\Windows\System\grjSNwD.exe
  C:\Windows\System\grjSNwD.exe
  2⤵
  PID:10372
- C:\Windows\System\wEzfvCL.exe
  C:\Windows\System\wEzfvCL.exe
  2⤵
  PID:10400
- C:\Windows\System\TfRVqxh.exe
  C:\Windows\System\TfRVqxh.exe
  2⤵
  PID:10416
- C:\Windows\System\ZbRBexg.exe
  C:\Windows\System\ZbRBexg.exe
  2⤵
  PID:10460
- C:\Windows\System\HlyoIvM.exe
  C:\Windows\System\HlyoIvM.exe
  2⤵
  PID:10480
- C:\Windows\System\vcKMseT.exe
  C:\Windows\System\vcKMseT.exe
  2⤵
  PID:10516
- C:\Windows\System\EYmUYyD.exe
  C:\Windows\System\EYmUYyD.exe
  2⤵
  PID:10544
- C:\Windows\System\ChtvtAL.exe
  C:\Windows\System\ChtvtAL.exe
  2⤵
  PID:10572
- C:\Windows\System\Whqeulu.exe
  C:\Windows\System\Whqeulu.exe
  2⤵
  PID:10596
- C:\Windows\System\jHdstKF.exe
  C:\Windows\System\jHdstKF.exe
  2⤵
  PID:10620
- C:\Windows\System\TqvKODv.exe
  C:\Windows\System\TqvKODv.exe
  2⤵
  PID:10640
- C:\Windows\System\earGTaP.exe
  C:\Windows\System\earGTaP.exe
  2⤵
  PID:10660
- C:\Windows\System\hsBZhJc.exe
  C:\Windows\System\hsBZhJc.exe
  2⤵
  PID:10688
- C:\Windows\System\jAuarUz.exe
  C:\Windows\System\jAuarUz.exe
  2⤵
  PID:10716
- C:\Windows\System\sbHpIJu.exe
  C:\Windows\System\sbHpIJu.exe
  2⤵
  PID:10736
- C:\Windows\System\haYsfwc.exe
  C:\Windows\System\haYsfwc.exe
  2⤵
  PID:10756
- C:\Windows\System\jBiYRWp.exe
  C:\Windows\System\jBiYRWp.exe
  2⤵
  PID:10784
- C:\Windows\System\sXoYMTY.exe
  C:\Windows\System\sXoYMTY.exe
  2⤵
  PID:10812
- C:\Windows\System\jiLWabL.exe
  C:\Windows\System\jiLWabL.exe
  2⤵
  PID:10844
- C:\Windows\System\GADHSng.exe
  C:\Windows\System\GADHSng.exe
  2⤵
  PID:10872
- C:\Windows\System\YQtjNWY.exe
  C:\Windows\System\YQtjNWY.exe
  2⤵
  PID:10888
- C:\Windows\System\pRxrsbw.exe
  C:\Windows\System\pRxrsbw.exe
  2⤵
  PID:10904
- C:\Windows\System\GpEZpEb.exe
  C:\Windows\System\GpEZpEb.exe
  2⤵
  PID:10988
- C:\Windows\System\sZBvmHo.exe
  C:\Windows\System\sZBvmHo.exe
  2⤵
  PID:11004
- C:\Windows\System\bTJERrq.exe
  C:\Windows\System\bTJERrq.exe
  2⤵
  PID:11028
- C:\Windows\System\XFLlWli.exe
  C:\Windows\System\XFLlWli.exe
  2⤵
  PID:11056
- C:\Windows\System\kcGakHt.exe
  C:\Windows\System\kcGakHt.exe
  2⤵
  PID:11072
- C:\Windows\System\NjJdQUq.exe
  C:\Windows\System\NjJdQUq.exe
  2⤵
  PID:11112
- C:\Windows\System\ejSnIlU.exe
  C:\Windows\System\ejSnIlU.exe
  2⤵
  PID:11140
- C:\Windows\System\Nwqxmaq.exe
  C:\Windows\System\Nwqxmaq.exe
  2⤵
  PID:11172
- C:\Windows\System\HcSZTlC.exe
  C:\Windows\System\HcSZTlC.exe
  2⤵
  PID:11192
- C:\Windows\System\rXjNhks.exe
  C:\Windows\System\rXjNhks.exe
  2⤵
  PID:11220
- C:\Windows\System\ZnJIITo.exe
  C:\Windows\System\ZnJIITo.exe
  2⤵
  PID:11248
- C:\Windows\System\aWmzqGT.exe
  C:\Windows\System\aWmzqGT.exe
  2⤵
  PID:2740
- C:\Windows\System\ATlBcuX.exe
  C:\Windows\System\ATlBcuX.exe
  2⤵
  PID:10300
- C:\Windows\System\UFIXPRA.exe
  C:\Windows\System\UFIXPRA.exe
  2⤵
  PID:10304
- C:\Windows\System\vsxkOzz.exe
  C:\Windows\System\vsxkOzz.exe
  2⤵
  PID:10392
- C:\Windows\System\aLgDTUD.exe
  C:\Windows\System\aLgDTUD.exe
  2⤵
  PID:10476
- C:\Windows\System\fkPdEAL.exe
  C:\Windows\System\fkPdEAL.exe
  2⤵
  PID:10528
- C:\Windows\System\KbiyuLN.exe
  C:\Windows\System\KbiyuLN.exe
  2⤵
  PID:10592
- C:\Windows\System\vPuHTbV.exe
  C:\Windows\System\vPuHTbV.exe
  2⤵
  PID:10652
- C:\Windows\System\StHLphy.exe
  C:\Windows\System\StHLphy.exe
  2⤵
  PID:10712
- C:\Windows\System\SiYZDkp.exe
  C:\Windows\System\SiYZDkp.exe
  2⤵
  PID:10880
- C:\Windows\System\TdzxfCK.exe
  C:\Windows\System\TdzxfCK.exe
  2⤵
  PID:10852
- C:\Windows\System\jJDARCn.exe
  C:\Windows\System\jJDARCn.exe
  2⤵
  PID:10944
- C:\Windows\System\qUCcMoM.exe
  C:\Windows\System\qUCcMoM.exe
  2⤵
  PID:11036
- C:\Windows\System\MlgPRkr.exe
  C:\Windows\System\MlgPRkr.exe
  2⤵
  PID:11088
- C:\Windows\System\LOWgDjg.exe
  C:\Windows\System\LOWgDjg.exe
  2⤵
  PID:11128
- C:\Windows\System\ZnCUJdP.exe
  C:\Windows\System\ZnCUJdP.exe
  2⤵
  PID:11260
- C:\Windows\System\OJutret.exe
  C:\Windows\System\OJutret.exe
  2⤵
  PID:10384
- C:\Windows\System\hrlZpiV.exe
  C:\Windows\System\hrlZpiV.exe
  2⤵
  PID:10508
- C:\Windows\System\YUvDuNO.exe
  C:\Windows\System\YUvDuNO.exe
  2⤵
  PID:10700
- C:\Windows\System\vPDLdsw.exe
  C:\Windows\System\vPDLdsw.exe
  2⤵
  PID:10808
- C:\Windows\System\OLzUWIK.exe
  C:\Windows\System\OLzUWIK.exe
  2⤵
  PID:10924
- C:\Windows\System\NCwuRtR.exe
  C:\Windows\System\NCwuRtR.exe
  2⤵
  PID:10996
- C:\Windows\System\cGLSIEh.exe
  C:\Windows\System\cGLSIEh.exe
  2⤵
  PID:11232
- C:\Windows\System\SqxxoFw.exe
  C:\Windows\System\SqxxoFw.exe
  2⤵
  PID:10328
- C:\Windows\System\XJxULHm.exe
  C:\Windows\System\XJxULHm.exe
  2⤵
  PID:10636
- C:\Windows\System\YaOnSeA.exe
  C:\Windows\System\YaOnSeA.exe
  2⤵
  PID:9752
- C:\Windows\System\RfhGbvc.exe
  C:\Windows\System\RfhGbvc.exe
  2⤵
  PID:11164
- C:\Windows\System\TROESqc.exe
  C:\Windows\System\TROESqc.exe
  2⤵
  PID:10752
- C:\Windows\System\ozEObNf.exe
  C:\Windows\System\ozEObNf.exe
  2⤵
  PID:11276
- C:\Windows\System\ZesACIr.exe
  C:\Windows\System\ZesACIr.exe
  2⤵
  PID:11296
- C:\Windows\System\npXEHgk.exe
  C:\Windows\System\npXEHgk.exe
  2⤵
  PID:11324
- C:\Windows\System\zmZUsfq.exe
  C:\Windows\System\zmZUsfq.exe
  2⤵
  PID:11344
- C:\Windows\System\xYsCmJI.exe
  C:\Windows\System\xYsCmJI.exe
  2⤵
  PID:11368
- C:\Windows\System\DoGKEkK.exe
  C:\Windows\System\DoGKEkK.exe
  2⤵
  PID:11392
- C:\Windows\System\cXcDVAE.exe
  C:\Windows\System\cXcDVAE.exe
  2⤵
  PID:11408
- C:\Windows\System\EAwcVxD.exe
  C:\Windows\System\EAwcVxD.exe
  2⤵
  PID:11424
- C:\Windows\System\CQGgAYv.exe
  C:\Windows\System\CQGgAYv.exe
  2⤵
  PID:11452
- C:\Windows\System\XuYllKg.exe
  C:\Windows\System\XuYllKg.exe
  2⤵
  PID:11476
- C:\Windows\System\mufcsUL.exe
  C:\Windows\System\mufcsUL.exe
  2⤵
  PID:11500
- C:\Windows\System\naJQbNc.exe
  C:\Windows\System\naJQbNc.exe
  2⤵
  PID:11516
- C:\Windows\System\YdnukNd.exe
  C:\Windows\System\YdnukNd.exe
  2⤵
  PID:11604
- C:\Windows\System\oQbwThu.exe
  C:\Windows\System\oQbwThu.exe
  2⤵
  PID:11644
- C:\Windows\System\ErSklbN.exe
  C:\Windows\System\ErSklbN.exe
  2⤵
  PID:11668
- C:\Windows\System\dOgeVJj.exe
  C:\Windows\System\dOgeVJj.exe
  2⤵
  PID:11688
- C:\Windows\System\qLqVfDW.exe
  C:\Windows\System\qLqVfDW.exe
  2⤵
  PID:11716
- C:\Windows\System\NRqNgEx.exe
  C:\Windows\System\NRqNgEx.exe
  2⤵
  PID:11740
- C:\Windows\System\cFfFeQr.exe
  C:\Windows\System\cFfFeQr.exe
  2⤵
  PID:11756
- C:\Windows\System\hFvyIkD.exe
  C:\Windows\System\hFvyIkD.exe
  2⤵
  PID:11776
- C:\Windows\System\zeSvlfC.exe
  C:\Windows\System\zeSvlfC.exe
  2⤵
  PID:11796
- C:\Windows\System\mhirXha.exe
  C:\Windows\System\mhirXha.exe
  2⤵
  PID:11816
- C:\Windows\System\JqWTiHg.exe
  C:\Windows\System\JqWTiHg.exe
  2⤵
  PID:11840
- C:\Windows\System\pUPWmDP.exe
  C:\Windows\System\pUPWmDP.exe
  2⤵
  PID:11868
- C:\Windows\System\FqmdyHi.exe
  C:\Windows\System\FqmdyHi.exe
  2⤵
  PID:11888
- C:\Windows\System\zOzyxlp.exe
  C:\Windows\System\zOzyxlp.exe
  2⤵
  PID:11916
- C:\Windows\System\LqiJxpm.exe
  C:\Windows\System\LqiJxpm.exe
  2⤵
  PID:11936
- C:\Windows\System\mRKIhmj.exe
  C:\Windows\System\mRKIhmj.exe
  2⤵
  PID:11956
- C:\Windows\System\bJDJhrV.exe
  C:\Windows\System\bJDJhrV.exe
  2⤵
  PID:11980
- C:\Windows\System\QLldlev.exe
  C:\Windows\System\QLldlev.exe
  2⤵
  PID:12000
- C:\Windows\System\LDqqqpn.exe
  C:\Windows\System\LDqqqpn.exe
  2⤵
  PID:12024
- C:\Windows\System\RVLWTvR.exe
  C:\Windows\System\RVLWTvR.exe
  2⤵
  PID:12052
- C:\Windows\System\CEQvhFf.exe
  C:\Windows\System\CEQvhFf.exe
  2⤵
  PID:12076
- C:\Windows\System\sRmiGqE.exe
  C:\Windows\System\sRmiGqE.exe
  2⤵
  PID:12100
- C:\Windows\System\konbOsl.exe
  C:\Windows\System\konbOsl.exe
  2⤵
  PID:12124
- C:\Windows\System\JPaRtwP.exe
  C:\Windows\System\JPaRtwP.exe
  2⤵
  PID:12148
- C:\Windows\System\xdvcIld.exe
  C:\Windows\System\xdvcIld.exe
  2⤵
  PID:12172
- C:\Windows\System\gdrOZJq.exe
  C:\Windows\System\gdrOZJq.exe
  2⤵
  PID:12188
- C:\Windows\System\OBpiyVG.exe
  C:\Windows\System\OBpiyVG.exe
  2⤵
  PID:12208
- C:\Windows\System\emYUJYs.exe
  C:\Windows\System\emYUJYs.exe
  2⤵
  PID:12232
- C:\Windows\System\qRkhJBw.exe
  C:\Windows\System\qRkhJBw.exe
  2⤵
  PID:12256
- C:\Windows\System\wFugEUJ.exe
  C:\Windows\System\wFugEUJ.exe
  2⤵
  PID:11068
- C:\Windows\System\WhTYGYU.exe
  C:\Windows\System\WhTYGYU.exe
  2⤵
  PID:11292
- C:\Windows\System\yrjAQvK.exe
  C:\Windows\System\yrjAQvK.exe
  2⤵
  PID:10456
- C:\Windows\System\vjEyZSy.exe
  C:\Windows\System\vjEyZSy.exe
  2⤵
  PID:11332
- C:\Windows\System\oakubNI.exe
  C:\Windows\System\oakubNI.exe
  2⤵
  PID:11340
- C:\Windows\System\ugcIIVA.exe
  C:\Windows\System\ugcIIVA.exe
  2⤵
  PID:11316
- C:\Windows\System\wQkvmfx.exe
  C:\Windows\System\wQkvmfx.exe
  2⤵
  PID:11420
- C:\Windows\System\ETLogxt.exe
  C:\Windows\System\ETLogxt.exe
  2⤵
  PID:11540
- C:\Windows\System\JMJjdVt.exe
  C:\Windows\System\JMJjdVt.exe
  2⤵
  PID:11560
- C:\Windows\System\dPXoBHd.exe
  C:\Windows\System\dPXoBHd.exe
  2⤵
  PID:11632
- C:\Windows\System\IVxMWnZ.exe
  C:\Windows\System\IVxMWnZ.exe
  2⤵
  PID:11656
- C:\Windows\System\fOkbDOp.exe
  C:\Windows\System\fOkbDOp.exe
  2⤵
  PID:11928
- C:\Windows\System\DlZJVZO.exe
  C:\Windows\System\DlZJVZO.exe
  2⤵
  PID:11828
- C:\Windows\System\eOjHuOJ.exe
  C:\Windows\System\eOjHuOJ.exe
  2⤵
  PID:11784
- C:\Windows\System\qVBhFsk.exe
  C:\Windows\System\qVBhFsk.exe
  2⤵
  PID:11912
- C:\Windows\System\rNXElWw.exe
  C:\Windows\System\rNXElWw.exe
  2⤵
  PID:12184
- C:\Windows\System\bVESkeE.exe
  C:\Windows\System\bVESkeE.exe
  2⤵
  PID:12068
- C:\Windows\System\PfaSMjq.exe
  C:\Windows\System\PfaSMjq.exe
  2⤵
  PID:12088
- C:\Windows\System\wbYCYZb.exe
  C:\Windows\System\wbYCYZb.exe
  2⤵
  PID:12284
- C:\Windows\System\PKQBjFM.exe
  C:\Windows\System\PKQBjFM.exe
  2⤵
  PID:11988
- C:\Windows\System\drAsCfa.exe
  C:\Windows\System\drAsCfa.exe
  2⤵
  PID:11320
- C:\Windows\System\vrZlkCx.exe
  C:\Windows\System\vrZlkCx.exe
  2⤵
  PID:12196
- C:\Windows\System\CDdNbxY.exe
  C:\Windows\System\CDdNbxY.exe
  2⤵
  PID:11968
- C:\Windows\System\QzjZalG.exe
  C:\Windows\System\QzjZalG.exe
  2⤵
  PID:12292
- C:\Windows\System\KEQGeHZ.exe
  C:\Windows\System\KEQGeHZ.exe
  2⤵
  PID:12328
- C:\Windows\System\aUYdrci.exe
  C:\Windows\System\aUYdrci.exe
  2⤵
  PID:12352
- C:\Windows\System\TDyOrmx.exe
  C:\Windows\System\TDyOrmx.exe
  2⤵
  PID:12372
- C:\Windows\System\aqZrfgs.exe
  C:\Windows\System\aqZrfgs.exe
  2⤵
  PID:12392
- C:\Windows\System\pFpINID.exe
  C:\Windows\System\pFpINID.exe
  2⤵
  PID:12424
- C:\Windows\System\RueCoBp.exe
  C:\Windows\System\RueCoBp.exe
  2⤵
  PID:12444
- C:\Windows\System\RJzLjnB.exe
  C:\Windows\System\RJzLjnB.exe
  2⤵
  PID:12472
- C:\Windows\System\OEtXvHc.exe
  C:\Windows\System\OEtXvHc.exe
  2⤵
  PID:12504
- C:\Windows\System\GhXXcJX.exe
  C:\Windows\System\GhXXcJX.exe
  2⤵
  PID:12596
- C:\Windows\System\lpOjRHN.exe
  C:\Windows\System\lpOjRHN.exe
  2⤵
  PID:12612
- C:\Windows\System\ZGjNQNL.exe
  C:\Windows\System\ZGjNQNL.exe
  2⤵
  PID:12628
- C:\Windows\System\xjafgsM.exe
  C:\Windows\System\xjafgsM.exe
  2⤵
  PID:12652
- C:\Windows\System\GpifNYB.exe
  C:\Windows\System\GpifNYB.exe
  2⤵
  PID:12684
- C:\Windows\System\EMzZgcr.exe
  C:\Windows\System\EMzZgcr.exe
  2⤵
  PID:12708
- C:\Windows\System\KaAaLQT.exe
  C:\Windows\System\KaAaLQT.exe
  2⤵
  PID:12740
- C:\Windows\System\zKJNTkG.exe
  C:\Windows\System\zKJNTkG.exe
  2⤵
  PID:12776
- C:\Windows\System\HVuyBfj.exe
  C:\Windows\System\HVuyBfj.exe
  2⤵
  PID:12796
- C:\Windows\System\XMsMfnp.exe
  C:\Windows\System\XMsMfnp.exe
  2⤵
  PID:12820
- C:\Windows\System\phOtTMd.exe
  C:\Windows\System\phOtTMd.exe
  2⤵
  PID:12840
- C:\Windows\System\KOFEZjn.exe
  C:\Windows\System\KOFEZjn.exe
  2⤵
  PID:12872
- C:\Windows\System\ninfnYq.exe
  C:\Windows\System\ninfnYq.exe
  2⤵
  PID:12892
- C:\Windows\System\uobHyNp.exe
  C:\Windows\System\uobHyNp.exe
  2⤵
  PID:12912
- C:\Windows\System\qBBXIHY.exe
  C:\Windows\System\qBBXIHY.exe
  2⤵
  PID:12944
- C:\Windows\System\DBmeHdw.exe
  C:\Windows\System\DBmeHdw.exe
  2⤵
  PID:12964
- C:\Windows\System\XoLMahe.exe
  C:\Windows\System\XoLMahe.exe
  2⤵
  PID:12992
- C:\Windows\System\BrDOlNr.exe
  C:\Windows\System\BrDOlNr.exe
  2⤵
  PID:13016
- C:\Windows\System\zJCBJyE.exe
  C:\Windows\System\zJCBJyE.exe
  2⤵
  PID:13040
- C:\Windows\System\HbAbhnz.exe
  C:\Windows\System\HbAbhnz.exe
  2⤵
  PID:13064
- C:\Windows\System\SajsHit.exe
  C:\Windows\System\SajsHit.exe
  2⤵
  PID:13084
- C:\Windows\System\epivQmI.exe
  C:\Windows\System\epivQmI.exe
  2⤵
  PID:13116
- C:\Windows\System\kXVgArB.exe
  C:\Windows\System\kXVgArB.exe
  2⤵
  PID:13140
- C:\Windows\System\JfZSbBs.exe
  C:\Windows\System\JfZSbBs.exe
  2⤵
  PID:13172
- C:\Windows\System\EkYlTyp.exe
  C:\Windows\System\EkYlTyp.exe
  2⤵
  PID:13200
- C:\Windows\System\BJFTlYE.exe
  C:\Windows\System\BJFTlYE.exe
  2⤵
  PID:13220
- C:\Windows\System\WehxuOj.exe
  C:\Windows\System\WehxuOj.exe
  2⤵
  PID:13240
- C:\Windows\System\AhMkvDm.exe
  C:\Windows\System\AhMkvDm.exe
  2⤵
  PID:13260
- C:\Windows\System\ZdQMGiJ.exe
  C:\Windows\System\ZdQMGiJ.exe
  2⤵
  PID:13280
- C:\Windows\System\xDgUUzh.exe
  C:\Windows\System\xDgUUzh.exe
  2⤵
  PID:13308
- C:\Windows\System\hhHtuFf.exe
  C:\Windows\System\hhHtuFf.exe
  2⤵
  PID:11464
- C:\Windows\System\jyeDyOV.exe
  C:\Windows\System\jyeDyOV.exe
  2⤵
  PID:11592
- C:\Windows\System\MbtRZva.exe
  C:\Windows\System\MbtRZva.exe
  2⤵
  PID:11880
- C:\Windows\System\REQRMkJ.exe
  C:\Windows\System\REQRMkJ.exe
  2⤵
  PID:12336
- C:\Windows\System\EXempYf.exe
  C:\Windows\System\EXempYf.exe
  2⤵
  PID:12364
- C:\Windows\System\sCBcWKw.exe
  C:\Windows\System\sCBcWKw.exe
  2⤵
  PID:12180
- C:\Windows\System\TkCnuTU.exe
  C:\Windows\System\TkCnuTU.exe
  2⤵
  PID:12564
- C:\Windows\System\fOZrodm.exe
  C:\Windows\System\fOZrodm.exe
  2⤵
  PID:12580
- C:\Windows\System\jguEcTd.exe
  C:\Windows\System\jguEcTd.exe
  2⤵
  PID:12460
- C:\Windows\System\LxfbUun.exe
  C:\Windows\System\LxfbUun.exe
  2⤵
  PID:12492
- C:\Windows\System\OkfBwtS.exe
  C:\Windows\System\OkfBwtS.exe
  2⤵
  PID:12680
- C:\Windows\System\xJPuUhQ.exe
  C:\Windows\System\xJPuUhQ.exe
  2⤵
  PID:12904
- C:\Windows\System\RKMcepw.exe
  C:\Windows\System\RKMcepw.exe
  2⤵
  PID:12700
- C:\Windows\System\gpjrJlM.exe
  C:\Windows\System\gpjrJlM.exe
  2⤵
  PID:13100
- C:\Windows\System\WyTaBpg.exe
  C:\Windows\System\WyTaBpg.exe
  2⤵
  PID:12812
- C:\Windows\System\mvWDZUA.exe
  C:\Windows\System\mvWDZUA.exe
  2⤵
  PID:13164
- C:\Windows\System\gVHNegr.exe
  C:\Windows\System\gVHNegr.exe
  2⤵
  PID:12960
- C:\Windows\System\hyeYACv.exe
  C:\Windows\System\hyeYACv.exe
  2⤵
  PID:13004
- C:\Windows\System\aqZIXyW.exe
  C:\Windows\System\aqZIXyW.exe
  2⤵
  PID:11512
- C:\Windows\System\tiawgBy.exe
  C:\Windows\System\tiawgBy.exe
  2⤵
  PID:12928
- C:\Windows\System\bLRKMWa.exe
  C:\Windows\System\bLRKMWa.exe
  2⤵
  PID:13232
- C:\Windows\System\ehTAHnh.exe
  C:\Windows\System\ehTAHnh.exe
  2⤵
  PID:11404
- C:\Windows\System\bHlxVVl.exe
  C:\Windows\System\bHlxVVl.exe
  2⤵
  PID:12440
- C:\Windows\System\wTIlIGm.exe
  C:\Windows\System\wTIlIGm.exe
  2⤵
  PID:1768
- C:\Windows\System\ZCifQLL.exe
  C:\Windows\System\ZCifQLL.exe
  2⤵
  PID:12760
- C:\Windows\System\uRJjdye.exe
  C:\Windows\System\uRJjdye.exe
  2⤵
  PID:12164
- C:\Windows\System\aMwiwVk.exe
  C:\Windows\System\aMwiwVk.exe
  2⤵
  PID:13336
- C:\Windows\System\FYaUwIT.exe
  C:\Windows\System\FYaUwIT.exe
  2⤵
  PID:13360
- C:\Windows\System\BsRxtvB.exe
  C:\Windows\System\BsRxtvB.exe
  2⤵
  PID:13392
- C:\Windows\System\vBfBFJu.exe
  C:\Windows\System\vBfBFJu.exe
  2⤵
  PID:13424
- C:\Windows\System\ZhvxRpZ.exe
  C:\Windows\System\ZhvxRpZ.exe
  2⤵
  PID:13456
- C:\Windows\System\PwbFGmL.exe
  C:\Windows\System\PwbFGmL.exe
  2⤵
  PID:13476
- C:\Windows\System\KPvLDjO.exe
  C:\Windows\System\KPvLDjO.exe
  2⤵
  PID:13500
- C:\Windows\System\kDSnerS.exe
  C:\Windows\System\kDSnerS.exe
  2⤵
  PID:13528
- C:\Windows\System\MSfnwIJ.exe
  C:\Windows\System\MSfnwIJ.exe
  2⤵
  PID:13544
- C:\Windows\System\EQidnhV.exe
  C:\Windows\System\EQidnhV.exe
  2⤵
  PID:13568
- C:\Windows\System\qNszdjD.exe
  C:\Windows\System\qNszdjD.exe
  2⤵
  PID:13588
- C:\Windows\System\JjtdTCq.exe
  C:\Windows\System\JjtdTCq.exe
  2⤵
  PID:13616
- C:\Windows\System\GZPaylZ.exe
  C:\Windows\System\GZPaylZ.exe
  2⤵
  PID:13784
- C:\Windows\System\OfCriLi.exe
  C:\Windows\System\OfCriLi.exe
  2⤵
  PID:13800
- C:\Windows\System\xqUVGiX.exe
  C:\Windows\System\xqUVGiX.exe
  2⤵
  PID:13828
- C:\Windows\System\NPzIiXK.exe
  C:\Windows\System\NPzIiXK.exe
  2⤵
  PID:13864
- C:\Windows\System\UZihhwL.exe
  C:\Windows\System\UZihhwL.exe
  2⤵
  PID:13884
- C:\Windows\System\idFSFxN.exe
  C:\Windows\System\idFSFxN.exe
  2⤵
  PID:13904
- C:\Windows\System\zLLvRNM.exe
  C:\Windows\System\zLLvRNM.exe
  2⤵
  PID:13936
- C:\Windows\System\wvILhxL.exe
  C:\Windows\System\wvILhxL.exe
  2⤵
  PID:13972
- C:\Windows\System\tHOELJi.exe
  C:\Windows\System\tHOELJi.exe
  2⤵
  PID:14000
- C:\Windows\System\lsEelIX.exe
  C:\Windows\System\lsEelIX.exe
  2⤵
  PID:14020
- C:\Windows\System\usEGwOc.exe
  C:\Windows\System\usEGwOc.exe
  2⤵
  PID:14052
- C:\Windows\System\WQAssHr.exe
  C:\Windows\System\WQAssHr.exe
  2⤵
  PID:14072
- C:\Windows\System\rPQRtAq.exe
  C:\Windows\System\rPQRtAq.exe
  2⤵
  PID:14092
- C:\Windows\System\nGBRShL.exe
  C:\Windows\System\nGBRShL.exe
  2⤵
  PID:14120
- C:\Windows\System\pZECkXV.exe
  C:\Windows\System\pZECkXV.exe
  2⤵
  PID:14144
- C:\Windows\System\KqFMDyD.exe
  C:\Windows\System\KqFMDyD.exe
  2⤵
  PID:14176
- C:\Windows\System\BUTTEWk.exe
  C:\Windows\System\BUTTEWk.exe
  2⤵
  PID:14208
- C:\Windows\System\PusBSBC.exe
  C:\Windows\System\PusBSBC.exe
  2⤵
  PID:14228
- C:\Windows\System\rzQPnHv.exe
  C:\Windows\System\rzQPnHv.exe
  2⤵
  PID:14256
- C:\Windows\System\qqIRefX.exe
  C:\Windows\System\qqIRefX.exe
  2⤵
  PID:14276
- C:\Windows\System\wMSGCyc.exe
  C:\Windows\System\wMSGCyc.exe
  2⤵
  PID:14296
- C:\Windows\System\RkzRpfe.exe
  C:\Windows\System\RkzRpfe.exe
  2⤵
  PID:14316
- C:\Windows\System\hJctyxL.exe
  C:\Windows\System\hJctyxL.exe
  2⤵
  PID:14332
- C:\Windows\System\eOXmUMW.exe
  C:\Windows\System\eOXmUMW.exe
  2⤵
  PID:11400
- C:\Windows\System\vsnRDTi.exe
  C:\Windows\System\vsnRDTi.exe
  2⤵
  PID:12116
- C:\Windows\System\ysqDKNh.exe
  C:\Windows\System\ysqDKNh.exe
  2⤵
  PID:12920
- C:\Windows\System\zaPtlRx.exe
  C:\Windows\System\zaPtlRx.exe
  2⤵
  PID:12848
- C:\Windows\System\JnnFitv.exe
  C:\Windows\System\JnnFitv.exe
  2⤵
  PID:13516
- C:\Windows\System\luVFNBp.exe
  C:\Windows\System\luVFNBp.exe
  2⤵
  PID:13032
- C:\Windows\System\Qpubjod.exe
  C:\Windows\System\Qpubjod.exe
  2⤵
  PID:13612
- C:\Windows\System\LREsxTR.exe
  C:\Windows\System\LREsxTR.exe
  2⤵
  PID:13368
- C:\Windows\System\EWGIpWB.exe
  C:\Windows\System\EWGIpWB.exe
  2⤵
  PID:13000
- C:\Windows\System\zWTkhSk.exe
  C:\Windows\System\zWTkhSk.exe
  2⤵
  PID:12880
- C:\Windows\System\RrEXQqO.exe
  C:\Windows\System\RrEXQqO.exe
  2⤵
  PID:13272
- C:\Windows\System\XJFPQHk.exe
  C:\Windows\System\XJFPQHk.exe
  2⤵
  PID:13556
- C:\Windows\System\FOizvtB.exe
  C:\Windows\System\FOizvtB.exe
  2⤵
  PID:13332
- C:\Windows\System\jxZSwQO.exe
  C:\Windows\System\jxZSwQO.exe
  2⤵
  PID:13452
- C:\Windows\System\WURvtXR.exe
  C:\Windows\System\WURvtXR.exe
  2⤵
  PID:13744
- C:\Windows\System\HWBROET.exe
  C:\Windows\System\HWBROET.exe
  2⤵
  PID:13712
- C:\Windows\System\MoPNBjZ.exe
  C:\Windows\System\MoPNBjZ.exe
  2⤵
  PID:13696
- C:\Windows\System\faMGsar.exe
  C:\Windows\System\faMGsar.exe
  2⤵
  PID:13824
- C:\Windows\System\nPQuYYo.exe
  C:\Windows\System\nPQuYYo.exe
  2⤵
  PID:14040
- C:\Windows\System\vCKAVax.exe
  C:\Windows\System\vCKAVax.exe
  2⤵
  PID:14060
- C:\Windows\System\pvHMOzq.exe
  C:\Windows\System\pvHMOzq.exe
  2⤵
  PID:13892
- C:\Windows\System\QTSQpUX.exe
  C:\Windows\System\QTSQpUX.exe
  2⤵
  PID:14196
- C:\Windows\System\PZGAbix.exe
  C:\Windows\System\PZGAbix.exe
  2⤵
  PID:13980
- C:\Windows\System\pDcrPDi.exe
  C:\Windows\System\pDcrPDi.exe
  2⤵
  PID:14328
- C:\Windows\System\xwnWekx.exe
  C:\Windows\System\xwnWekx.exe
  2⤵
  PID:13880
- C:\Windows\System\DTpaHZo.exe
  C:\Windows\System\DTpaHZo.exe
  2⤵
  PID:14068
- C:\Windows\System\liaMQoV.exe
  C:\Windows\System\liaMQoV.exe
  2⤵
  PID:12636
- C:\Windows\System\LizEEwl.exe
  C:\Windows\System\LizEEwl.exe
  2⤵
  PID:11640
- C:\Windows\System\ljuizUK.exe
  C:\Windows\System\ljuizUK.exe
  2⤵
  PID:14304
- C:\Windows\System\msIcYSX.exe
  C:\Windows\System\msIcYSX.exe
  2⤵
  PID:12976
- C:\Windows\System\fJExEmm.exe
  C:\Windows\System\fJExEmm.exe
  2⤵
  PID:14344
- C:\Windows\System\ZoCzbMx.exe
  C:\Windows\System\ZoCzbMx.exe
  2⤵
  PID:14472
- C:\Windows\System\PlKiNOi.exe
  C:\Windows\System\PlKiNOi.exe
  2⤵
  PID:14492
- C:\Windows\System\PMAzyAU.exe
  C:\Windows\System\PMAzyAU.exe
  2⤵
  PID:14512
- C:\Windows\System\rtmUsdV.exe
  C:\Windows\System\rtmUsdV.exe
  2⤵
  PID:14528
- C:\Windows\System\KWXikit.exe
  C:\Windows\System\KWXikit.exe
  2⤵
  PID:14544
- C:\Windows\System\bFPTsFo.exe
  C:\Windows\System\bFPTsFo.exe
  2⤵
  PID:14604
- C:\Windows\System\WgXeKqW.exe
  C:\Windows\System\WgXeKqW.exe
  2⤵
  PID:14636
- C:\Windows\System\HJeYLCB.exe
  C:\Windows\System\HJeYLCB.exe
  2⤵
  PID:14664
- C:\Windows\System\nfnNJCH.exe
  C:\Windows\System\nfnNJCH.exe
  2⤵
  PID:14684
- C:\Windows\System\Vgdibae.exe
  C:\Windows\System\Vgdibae.exe
  2⤵
  PID:14700
- C:\Windows\System\vQQVarW.exe
  C:\Windows\System\vQQVarW.exe
  2⤵
  PID:14728
- C:\Windows\System\pmBoDKB.exe
  C:\Windows\System\pmBoDKB.exe
  2⤵
  PID:14748
- C:\Windows\System\JLJZXzV.exe
  C:\Windows\System\JLJZXzV.exe
  2⤵
  PID:14772
- C:\Windows\System\lsPQCCC.exe
  C:\Windows\System\lsPQCCC.exe
  2⤵
  PID:14792
- C:\Windows\System\MbuvGhH.exe
  C:\Windows\System\MbuvGhH.exe
  2⤵
  PID:14812
- C:\Windows\System\ciSBlSI.exe
  C:\Windows\System\ciSBlSI.exe
  2⤵
  PID:14844
- C:\Windows\System\KFYuTnY.exe
  C:\Windows\System\KFYuTnY.exe
  2⤵
  PID:14880
- C:\Windows\System\mlPhoWx.exe
  C:\Windows\System\mlPhoWx.exe
  2⤵
  PID:14916
- C:\Windows\System\JTVRKOn.exe
  C:\Windows\System\JTVRKOn.exe
  2⤵
  PID:14932
- C:\Windows\System\BwGCIYl.exe
  C:\Windows\System\BwGCIYl.exe
  2⤵
  PID:14972
- C:\Windows\System\aXLDaAL.exe
  C:\Windows\System\aXLDaAL.exe
  2⤵
  PID:15108
- C:\Windows\System\rudWQbT.exe
  C:\Windows\System\rudWQbT.exe
  2⤵
  PID:15132
- C:\Windows\System\jPaEpnQ.exe
  C:\Windows\System\jPaEpnQ.exe
  2⤵
  PID:15152
- C:\Windows\System\QyDeKgd.exe
  C:\Windows\System\QyDeKgd.exe
  2⤵
  PID:15172
- C:\Windows\System\CsVuvmQ.exe
  C:\Windows\System\CsVuvmQ.exe
  2⤵
  PID:15192
- C:\Windows\System\leDaedS.exe
  C:\Windows\System\leDaedS.exe
  2⤵
  PID:15216
- C:\Windows\System\KlCGMEg.exe
  C:\Windows\System\KlCGMEg.exe
  2⤵
  PID:15236
- C:\Windows\System\inFfkhp.exe
  C:\Windows\System\inFfkhp.exe
  2⤵
  PID:15252
- C:\Windows\System\pYXVrOw.exe
  C:\Windows\System\pYXVrOw.exe
  2⤵
  PID:15288
- C:\Windows\System\wXOPMtF.exe
  C:\Windows\System\wXOPMtF.exe
  2⤵
  PID:15308
- C:\Windows\System\PJRVKIy.exe
  C:\Windows\System\PJRVKIy.exe
  2⤵
  PID:15324
- C:\Windows\System\mgaRwhn.exe
  C:\Windows\System\mgaRwhn.exe
  2⤵
  PID:15340
- C:\Windows\System\iyJqJBn.exe
  C:\Windows\System\iyJqJBn.exe
  2⤵
  PID:15356
- C:\Windows\System\YNhSfcM.exe
  C:\Windows\System\YNhSfcM.exe
  2⤵
  PID:14064
- C:\Windows\System\QHZjLiz.exe
  C:\Windows\System\QHZjLiz.exe
  2⤵
  PID:14172
- C:\Windows\System\NVjmcsO.exe
  C:\Windows\System\NVjmcsO.exe
  2⤵
  PID:13724
- C:\Windows\System\pUPHpkt.exe
  C:\Windows\System\pUPHpkt.exe
  2⤵
  PID:13216
- C:\Windows\System\BTmjSxq.exe
  C:\Windows\System\BTmjSxq.exe
  2⤵
  PID:14152
- C:\Windows\System\wqOGlan.exe
  C:\Windows\System\wqOGlan.exe
  2⤵
  PID:4892
- C:\Windows\System\SqNATyo.exe
  C:\Windows\System\SqNATyo.exe
  2⤵
  PID:13948
- C:\Windows\System\vbdyJaI.exe
  C:\Windows\System\vbdyJaI.exe
  2⤵
  PID:14376
- C:\Windows\System\TgsyOUk.exe
  C:\Windows\System\TgsyOUk.exe
  2⤵
  PID:14268
- C:\Windows\System\eCKZXWR.exe
  C:\Windows\System\eCKZXWR.exe
  2⤵
  PID:14384
- C:\Windows\System\ZUpLbcx.exe
  C:\Windows\System\ZUpLbcx.exe
  2⤵
  PID:14356
- C:\Windows\System\mLxNOxu.exe
  C:\Windows\System\mLxNOxu.exe
  2⤵
  PID:14696
- C:\Windows\System\PykHCRg.exe
  C:\Windows\System\PykHCRg.exe
  2⤵
  PID:15100
- C:\Windows\System\UzMQyXx.exe
  C:\Windows\System\UzMQyXx.exe
  2⤵
  PID:14828
- C:\Windows\System\asmqADJ.exe
  C:\Windows\System\asmqADJ.exe
  2⤵
  PID:14840
- C:\Windows\System\nlkyuNX.exe
  C:\Windows\System\nlkyuNX.exe
  2⤵
  PID:14864
- C:\Windows\System\oZXiigk.exe
  C:\Windows\System\oZXiigk.exe
  2⤵
  PID:14908
- C:\Windows\System\SJALngO.exe
  C:\Windows\System\SJALngO.exe
  2⤵
  PID:15264
- C:\Windows\System\mbYKTtp.exe
  C:\Windows\System\mbYKTtp.exe
  2⤵
  PID:15336
- C:\Windows\System\AgacmYF.exe
  C:\Windows\System\AgacmYF.exe
  2⤵
  PID:15116
- C:\Windows\System\LqHckSm.exe
  C:\Windows\System\LqHckSm.exe
  2⤵
  PID:15148
- C:\Windows\System\amQKcuP.exe
  C:\Windows\System\amQKcuP.exe
  2⤵
  PID:15348
- C:\Windows\System\oKSWDHa.exe
  C:\Windows\System\oKSWDHa.exe
  2⤵
  PID:15248
- C:\Windows\System\opyYKif.exe
  C:\Windows\System\opyYKif.exe
  2⤵
  PID:12032
- C:\Windows\System\MlvxekH.exe
  C:\Windows\System\MlvxekH.exe
  2⤵
  PID:13508
- C:\Windows\System\ZhXbKpk.exe
  C:\Windows\System\ZhXbKpk.exe
  2⤵
  PID:15316
- C:\Windows\System\NASMziU.exe
  C:\Windows\System\NASMziU.exe
  2⤵
  PID:13632
- C:\Windows\System\RcQfxlt.exe
  C:\Windows\System\RcQfxlt.exe
  2⤵
  PID:14832
- C:\Windows\System\TUptFfg.exe
  C:\Windows\System\TUptFfg.exe
  2⤵
  PID:13684
- C:\Windows\System\lNxMhuk.exe
  C:\Windows\System\lNxMhuk.exe
  2⤵
  PID:15388
- C:\Windows\System\NIAklvE.exe
  C:\Windows\System\NIAklvE.exe
  2⤵
  PID:15408
- C:\Windows\System\nTrCVHC.exe
  C:\Windows\System\nTrCVHC.exe
  2⤵
  PID:15436
- C:\Windows\System\XKdZvmV.exe
  C:\Windows\System\XKdZvmV.exe
  2⤵
  PID:15496
- C:\Windows\System\iuPdyrb.exe
  C:\Windows\System\iuPdyrb.exe
  2⤵
  PID:15512
- C:\Windows\System\wxYLOBk.exe
  C:\Windows\System\wxYLOBk.exe
  2⤵
  PID:15552
- C:\Windows\System\eaIzPpv.exe
  C:\Windows\System\eaIzPpv.exe
  2⤵
  PID:15572
- C:\Windows\System\YzRYKrb.exe
  C:\Windows\System\YzRYKrb.exe
  2⤵
  PID:15588
- C:\Windows\System\AzQySGR.exe
  C:\Windows\System\AzQySGR.exe
  2⤵
  PID:15616
- C:\Windows\System\hzrWAiz.exe
  C:\Windows\System\hzrWAiz.exe
  2⤵
  PID:15632
- C:\Windows\System\PgdHVjE.exe
  C:\Windows\System\PgdHVjE.exe
  2⤵
  PID:15668
- C:\Windows\System\YKxJkuZ.exe
  C:\Windows\System\YKxJkuZ.exe
  2⤵
  PID:15688
- C:\Windows\System\COSMrlj.exe
  C:\Windows\System\COSMrlj.exe
  2⤵
  PID:15724
- C:\Windows\System\aYSWIfV.exe
  C:\Windows\System\aYSWIfV.exe
  2⤵
  PID:15832
- C:\Windows\System\wujDtDa.exe
  C:\Windows\System\wujDtDa.exe
  2⤵
  PID:15848
- C:\Windows\System\DgucwKo.exe
  C:\Windows\System\DgucwKo.exe
  2⤵
  PID:15864
- C:\Windows\System\ZuguklU.exe
  C:\Windows\System\ZuguklU.exe
  2⤵
  PID:15884
- C:\Windows\System\yhFrCuB.exe
  C:\Windows\System\yhFrCuB.exe
  2⤵
  PID:15908
- C:\Windows\System\LeDUgqg.exe
  C:\Windows\System\LeDUgqg.exe
  2⤵
  PID:15924
- C:\Windows\System\cgYUYLS.exe
  C:\Windows\System\cgYUYLS.exe
  2⤵
  PID:15940
- C:\Windows\System\qRWFJVQ.exe
  C:\Windows\System\qRWFJVQ.exe
  2⤵
  PID:15956
- C:\Windows\System\PnoGqRg.exe
  C:\Windows\System\PnoGqRg.exe
  2⤵
  PID:15972
- C:\Windows\System\SPTSJax.exe
  C:\Windows\System\SPTSJax.exe
  2⤵
  PID:15992
- C:\Windows\System\qncFMEb.exe
  C:\Windows\System\qncFMEb.exe
  2⤵
  PID:16020
- C:\Windows\System\rcAWjwl.exe
  C:\Windows\System\rcAWjwl.exe
  2⤵
  PID:16040
- C:\Windows\System\tjjqKCB.exe
  C:\Windows\System\tjjqKCB.exe
  2⤵
  PID:16096
- C:\Windows\System\ACtrKtn.exe
  C:\Windows\System\ACtrKtn.exe
  2⤵
  PID:16116
- C:\Windows\System\LEerHqQ.exe
  C:\Windows\System\LEerHqQ.exe
  2⤵
  PID:16132
- C:\Windows\System\MFntQHk.exe
  C:\Windows\System\MFntQHk.exe
  2⤵
  PID:16148
- C:\Windows\System\uONUtWo.exe
  C:\Windows\System\uONUtWo.exe
  2⤵
  PID:16164
- C:\Windows\System\TWzptUP.exe
  C:\Windows\System\TWzptUP.exe
  2⤵
  PID:16180
- C:\Windows\System\gcXepdB.exe
  C:\Windows\System\gcXepdB.exe
  2⤵
  PID:16196
- C:\Windows\System\zvoiYyW.exe
  C:\Windows\System\zvoiYyW.exe
  2⤵
  PID:16232
- C:\Windows\System\NdRTXWK.exe
  C:\Windows\System\NdRTXWK.exe
  2⤵
  PID:16248
- C:\Windows\System\YLEPFDN.exe
  C:\Windows\System\YLEPFDN.exe
  2⤵
  PID:16264
- C:\Windows\System\atZcgfo.exe
  C:\Windows\System\atZcgfo.exe
  2⤵
  PID:16292
- C:\Windows\System\yoiZnCE.exe
  C:\Windows\System\yoiZnCE.exe
  2⤵
  PID:16308
- C:\Windows\System\JpSNBZX.exe
  C:\Windows\System\JpSNBZX.exe
  2⤵
  PID:16332
- C:\Windows\System\DClKbSk.exe
  C:\Windows\System\DClKbSk.exe
  2⤵
  PID:16356
- C:\Windows\System\vxotmed.exe
  C:\Windows\System\vxotmed.exe
  2⤵
  PID:16376
- C:\Windows\System\wAnekWb.exe
  C:\Windows\System\wAnekWb.exe
  2⤵
  PID:14488
- C:\Windows\System\ckgThYd.exe
  C:\Windows\System\ckgThYd.exe
  2⤵
  PID:15004
- C:\Windows\System\qvUIdvb.exe
  C:\Windows\System\qvUIdvb.exe
  2⤵
  PID:14876
- C:\Windows\System\feXCxtf.exe
  C:\Windows\System\feXCxtf.exe
  2⤵
  PID:14612
- C:\Windows\System\ySUSZID.exe
  C:\Windows\System\ySUSZID.exe
  2⤵
  PID:14836
- C:\Windows\System\XTqaGjC.exe
  C:\Windows\System\XTqaGjC.exe
  2⤵
  PID:15104
- C:\Windows\System\ZipUtPy.exe
  C:\Windows\System\ZipUtPy.exe
  2⤵
  PID:15384
- C:\Windows\System\gWgrMKQ.exe
  C:\Windows\System\gWgrMKQ.exe
  2⤵
  PID:15580
- C:\Windows\System\EWYlNkS.exe
  C:\Windows\System\EWYlNkS.exe
  2⤵
  PID:13432
- C:\Windows\System\mxdGITk.exe
  C:\Windows\System\mxdGITk.exe
  2⤵
  PID:15372
- C:\Windows\System\FwLypiI.exe
  C:\Windows\System\FwLypiI.exe
  2⤵
  PID:15404
- C:\Windows\System\nbDQlAy.exe
  C:\Windows\System\nbDQlAy.exe
  2⤵
  PID:15428
- C:\Windows\System\uACEqHS.exe
  C:\Windows\System\uACEqHS.exe
  2⤵
  PID:15656
- C:\Windows\System\TZLyZKm.exe
  C:\Windows\System\TZLyZKm.exe
  2⤵
  PID:15680
- C:\Windows\System\OPOyUNr.exe
  C:\Windows\System\OPOyUNr.exe
  2⤵
  PID:15820
- C:\Windows\System\WVywKFG.exe
  C:\Windows\System\WVywKFG.exe
  2⤵
  PID:15540
- C:\Windows\System\vxyOtwJ.exe
  C:\Windows\System\vxyOtwJ.exe
  2⤵
  PID:15600
- C:\Windows\System\tfQeMmK.exe
  C:\Windows\System\tfQeMmK.exe
  2⤵
  PID:15948
- C:\Windows\System\BzLRoSc.exe
  C:\Windows\System\BzLRoSc.exe
  2⤵
  PID:15844
- C:\Windows\System\aHEjkLc.exe
  C:\Windows\System\aHEjkLc.exe
  2⤵
  PID:16016
- C:\Windows\System\gjoEwnQ.exe
  C:\Windows\System\gjoEwnQ.exe
  2⤵
  PID:16160
- C:\Windows\System\upVgOCz.exe
  C:\Windows\System\upVgOCz.exe
  2⤵
  PID:16076
- C:\Windows\System\HCCgzcE.exe
  C:\Windows\System\HCCgzcE.exe
  2⤵
  PID:16276
- C:\Windows\System\Zpzgqzh.exe
  C:\Windows\System\Zpzgqzh.exe
  2⤵
  PID:16300
- C:\Windows\System\IEfWcBM.exe
  C:\Windows\System\IEfWcBM.exe
  2⤵
  PID:16324
- C:\Windows\System\PHXaPoI.exe
  C:\Windows\System\PHXaPoI.exe
  2⤵
  PID:13484
- C:\Windows\System\OBmVyfI.exe
  C:\Windows\System\OBmVyfI.exe
  2⤵
  PID:14644
- C:\Windows\System\GMZKihH.exe
  C:\Windows\System\GMZKihH.exe
  2⤵
  PID:16172
- C:\Windows\System\fDtPiwz.exe
  C:\Windows\System\fDtPiwz.exe
  2⤵
  PID:1672
- C:\Windows\System\bkgqXWT.exe
  C:\Windows\System\bkgqXWT.exe
  2⤵
  PID:16396
- C:\Windows\System\hQWiEjD.exe
  C:\Windows\System\hQWiEjD.exe
  2⤵
  PID:16424
- C:\Windows\System\jjHkUnH.exe
  C:\Windows\System\jjHkUnH.exe
  2⤵
  PID:16444
- C:\Windows\System\pjmhDWa.exe
  C:\Windows\System\pjmhDWa.exe
  2⤵
  PID:16476
- C:\Windows\System\nSFSfNH.exe
  C:\Windows\System\nSFSfNH.exe
  2⤵
  PID:16492
- C:\Windows\System\wtGdoEB.exe
  C:\Windows\System\wtGdoEB.exe
  2⤵
  PID:16520
- C:\Windows\System\LZiyXdO.exe
  C:\Windows\System\LZiyXdO.exe
  2⤵
  PID:16540
- C:\Windows\System\bnkTnRM.exe
  C:\Windows\System\bnkTnRM.exe
  2⤵
  PID:16560
- C:\Windows\System\NBtgJRO.exe
  C:\Windows\System\NBtgJRO.exe
  2⤵
  PID:16576
- C:\Windows\System\GaBwhqK.exe
  C:\Windows\System\GaBwhqK.exe
  2⤵
  PID:16604
- C:\Windows\System\WDnsTci.exe
  C:\Windows\System\WDnsTci.exe
  2⤵
  PID:16624
- C:\Windows\System\lWmYoYF.exe
  C:\Windows\System\lWmYoYF.exe
  2⤵
  PID:16652
- C:\Windows\System\QBIPxaq.exe
  C:\Windows\System\QBIPxaq.exe
  2⤵
  PID:16672
- C:\Windows\System\OUBoBip.exe
  C:\Windows\System\OUBoBip.exe
  2⤵
  PID:17316
- C:\Windows\System\UUTjTAQ.exe
  C:\Windows\System\UUTjTAQ.exe
  2⤵
  PID:17344
- C:\Windows\System\cbDrKbY.exe
  C:\Windows\System\cbDrKbY.exe
  2⤵
  PID:17372
- C:\Windows\System\FsFgUms.exe
  C:\Windows\System\FsFgUms.exe
  2⤵
  PID:15712
- C:\Windows\System\vcXPhzm.exe
  C:\Windows\System\vcXPhzm.exe
  2⤵
  PID:16344

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:16196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AyQjQAX.exe

Filesize
1.5MB

MD5
26439d25415b0c263cded7daec9b537b

SHA1
a4443fe8bd3640ff0c3228d8feee35443723862b

SHA256
a715e1298573dda008c656062b93759c362d848a24f6f7080c5158cb28205ae1

SHA512
415a7097424e1f21c02f40e66cd2c36503a29ec13bdd8572c011bbd25746e2c34cbc0973bebb8e5bf0588c6d4b848a827cb6102c216b17dfae61e7aa8509ee83

Download Submit
C:\Windows\System\CUzotMC.exe

Filesize
1.5MB

MD5
9fe14721cd78ddea828d16ef44c1dcf9

SHA1
fcb6018815404e2802506f21af354eaef71ce451

SHA256
9e6514732da7f131313e7c5da1930d41822707404df7ae2bcc908611699b3df3

SHA512
69b79eaf4ca1ec2f38dd0412d759cdb17c84c452e67e2525b6a34754dbc96ca08d6e2312713e7f640fdb06f2286367b2e2bde7817eff318aa1bb49227ece983f

Download Submit
C:\Windows\System\CVOhkBO.exe

Filesize
1.5MB

MD5
0713960175a5ad0bed0e74a16bd48b8e

SHA1
3dfad0a6d3d9acbca288c9c9c89f82186618372c

SHA256
2327b1d2ca78e77950a64b2b34d6cb6889eda8c5fac60ed01a440affafcb3db5

SHA512
966714cc599f37584f47ffc13bf42823f48829296d487304e02d6c564f4df611981f104020fb0d93369bf7c8f2a37542ddb6f8bbb9b3e29daa869e0957eee1bf

Download Submit
C:\Windows\System\DGJenng.exe

Filesize
1.5MB

MD5
bc9a25c2013a8fddb31a9c7fc1c6e519

SHA1
8377ba1a74dd212a742f50474379c40a94d92660

SHA256
b7b03404e30766ab8c1818a939fd8d4dfd17dff759d9a27c9efb43e0c6d10b1d

SHA512
fc697cc655f2296ae4d219ab242462a588a484612e23f4b7a6b9ce3a1fe4f4e92af205bd6cdc40c3b53f049c1a2963a9981a89d3619a61eacb622d4c2ad93fe3

Download Submit
C:\Windows\System\DbSppjU.exe

Filesize
1.5MB

MD5
acdc46d545cdaaf36632181026a8fe9f

SHA1
a18b7b808482ffee17ec5da446d7d8ea40f79d8f

SHA256
8b34fbc775b0edacf49921fe9e9f8ba96680306aaf7bf1820267fd700a2f7561

SHA512
1f70afde14575f8cb9612fcbf6e4cd0238a63adac2a7d72fda14769862a006889bf317005d841eac1a79e3e40f0e45041a6ee044a45269a2ed38fafad66dd17d

Download Submit
C:\Windows\System\FyVhhtT.exe

Filesize
1.5MB

MD5
525908d9de7389f6118faf510553d913

SHA1
4c85c1afb7dd3650909e134641de00425a46155b

SHA256
d3244f7c426e91c2c66f12027bafed3820fbc289bdfe41296a3c77f81f6822c7

SHA512
5334c2b642aa72f1d2909b071880ea3b0f973282f05674de35463f81875c6b819f33f4d813c70d3dca2d634ddaa76395cfd3503823865271efa61fdb778ec774

Download Submit
C:\Windows\System\HmLCKOL.exe

Filesize
1.5MB

MD5
221a781353e325cc87bc23708956c36c

SHA1
4ede1cdf8ed222065fef356ce94b518111083401

SHA256
386adf27df9873473261b3570b983926a540d4cb90c0978d25cde7d1fd47dd34

SHA512
f90c9cf95c82e9b8dde10797ad6c69a5b8ac9d9f9220cafd377e6a642d89d51ef3cd14de43d90dd61db31dc2eca9adb8b3334e5d5c0b4afb718a519313d41f89

Download Submit
C:\Windows\System\HnwowzF.exe

Filesize
1.5MB

MD5
5eb22a9a6beaec8143d1cfdf87df4454

SHA1
3c9e3df11ca608ba17adae638f04cf66f3dc737a

SHA256
e0df17d1ec616a4e216c3289f01e6890955c3f15ff99117283cb9f0406df1341

SHA512
e1cdd2eadab869fcfd940cac529138cb6df46123dd73b020f126a2a8b07c1dd2c7f2e502a6b463772134b38b4fe452486dcfaacca846a54801f17d13f06670a9

Download Submit
C:\Windows\System\IAPZBvb.exe

Filesize
1.5MB

MD5
7ae326f4c2dc83c8171d0152f6717c03

SHA1
4874ad0525769ace041bc93b080b03f9c85e1e86

SHA256
c4255e8bb503d901e78caab02cfb011d41d529d80662ba51128f53c9cc9d8237

SHA512
878eba8fec53ecac728ee987174c08ed45a6460c557cc1ec9d994cc13852717c428711c80445cdb5ccffba79e69c7ba747a9ca2fe9d7eb118383182c308c8bc7

Download Submit
C:\Windows\System\ICrugtq.exe

Filesize
1.5MB

MD5
1dbd87808b55f4d5051c98d73b1109bc

SHA1
e14d99637204ee31263061e2972d143b9f54cd8a

SHA256
7be7a71fcc17100caab8dac350f2f7525b7e6c7d2072d17af67f5a319e86a154

SHA512
e5301c6e277cd0d7c720e7d10ad82626720f892259789309b41a10c266434e2abb8b2bda854354acc067d9fdac5850c6d3a175cae256d0446d7ba862213bb0ba

Download Submit
C:\Windows\System\INZvmeC.exe

Filesize
1.5MB

MD5
7720d35b399e3af00a0ec26d8bb2966d

SHA1
de88e8f7e3cb1469fa13230ba5c79dbf26197cc3

SHA256
4d7299582b780e61af41497b2439afb1c72cf23e277d282a54e90b9e1914a9c6

SHA512
11b90fe60caa346dc686ae47c165f4e29da56672fbd94f5f965c78b4fe451fe01b565c730337c0f21b301d05b3b4196edd7572954eea4e1f6e40145ba7bf95f9

Download Submit
C:\Windows\System\OQMhVdK.exe

Filesize
1.5MB

MD5
0b22a8e50ef9965934fa0c92e346da83

SHA1
3e42fcd44c82e2439ceabbb06769dfc8fcabc8ea

SHA256
df8a7f178192ed755035c44c2ff255cccc0588139e5c985428c25d85bbe5bd3e

SHA512
7102dd4e56d724494effabea10e7ca8137a139d30f02caa2916e1f03bfe42acd9ba262e670ef8946e2a5e1b3fef6e15566ac2db5c259a992c263e23c8574ebc7

Download Submit
C:\Windows\System\PhofpTQ.exe

Filesize
1.5MB

MD5
e469f78d6fea29ed21e4cc0d33b110c6

SHA1
951d395a95fa9cb5984ad30c882c2cbf1d4402d7

SHA256
94bb82b971ff7dfb47b6cd0f8dbe9269c7090121a582299f0208bac596b7f9a2

SHA512
4331b4b7098d9bd662238bfec413f56d778c520497981ac946d7a66135e9ad4f47529a3ad5a3106578f9a7140fd49b7879d65862465a156d83f2da8c4fcc965d

Download Submit
C:\Windows\System\RUwuowF.exe

Filesize
1.5MB

MD5
cc1ab1b422bc151b0c513a9ce6e53195

SHA1
44dcd9a1b44ea45978c7266aed5a4707bd720316

SHA256
7c8e64959033bf9302a3916ef78c938f40dbf33c986e195bd6f898f076819b99

SHA512
0a4a11d9369c50ff1b190e7bd11435e34f2d9d0c4f08474462ac9673f0cc81163bd240c830d2d2a7bb8372632ad6b95189421e556b32637926fcf6b38ff243a0

Download Submit
C:\Windows\System\SFrznTn.exe

Filesize
1.5MB

MD5
f603ea1571fea34e3f6ca88729ec22af

SHA1
16f45ce164b7c2b2533005dc1b9c507c64768846

SHA256
0ab5ecb553b9edaf60becfc25a2d99a6907ee3752f0de959129abeb8c894a681

SHA512
7abe4c8d0605277b5d94a7c909a7debbae47f5ba1739d602411ce5b4b6280d593cea19110aa9b90195e8a120b291abd10593922221d1e300e31a344ef2172a96

Download Submit
C:\Windows\System\YpksUAG.exe

Filesize
1.5MB

MD5
69fcb90ffb0baafe2d720074e2d43874

SHA1
eb7909c4b6461b45dc1d30002b89432c1986f548

SHA256
3de86404125b4d57838423353b95f204e96e2f8aea5e314b1167f72a44bcd2af

SHA512
e2d647cd0d40965fd4b51b4390ba559b1dfd3bfd7ef23a802dffadee0299e4afb865802d0009bfd5f931e672d1c52a23260869a046c7626979ef2dbdbe6f7b57

Download Submit
C:\Windows\System\YqFeyJR.exe

Filesize
1.5MB

MD5
1ad9c90e75880dd9026400706993ea25

SHA1
8fcd4d744ff7991ae8458258424594c05f99a88d

SHA256
6d9792a7923fbed0e6bca54b3cd4024b81e85137a1738fbd3f43fdc76313e343

SHA512
ca6c2d51c6104bec1628b1f12fb014520d831cd749f9fefd0dc2476610c9e610522c51d9df52c6a1679d49d92a95d6f5b175c6023dc7cfef66130da47c8d4bb7

Download Submit
C:\Windows\System\bGmnZgd.exe

Filesize
1.5MB

MD5
00db6b0e09c639e05e9108f66831f3d7

SHA1
537e5cb302f0035a09ce3b35f481d09645a35d7e

SHA256
5d0569e1a91a62a270a1ce0475fb1dfc5eb9c3a2f38069fdbddd8482c80ae60b

SHA512
03cb71152145841190b1894e840081597857dc1794c4101ae23b9636dfbf82907975bb37bd2acc9940158c19ad155c2d7dc03b9262fc9afc9c372353681beac0

Download Submit
C:\Windows\System\bwLbMxv.exe

Filesize
1.5MB

MD5
d9dc5cb2985c0da8b646b806baa6bc9c

SHA1
8794bd6889a2706e48ba22f1b3e42332b7661181

SHA256
9f792bbe57f502f6d8681a57788d9d79fda678a7f80c77e2f9f66ba470360d5b

SHA512
25593c697f0c659e7082f88d2dd515f5e7ddcc300b541cbd4ad1a9e2a536deb56b017af926469a96999b46df73316b2a327b69950a5fad6ba8054c85fbe0b294

Download Submit
C:\Windows\System\drLxbtv.exe

Filesize
1.5MB

MD5
f9af7fe92ed2616ad500b7bf11410bac

SHA1
e05374de75c98a3a8d447ab0736b376d796fe48d

SHA256
ee2b21a4ab79adf6aacb731ed9b5416718c07409e52424cf65c87d9e12d402e5

SHA512
88551a51de4cf43d24bff91b6d3e6923b2fca7d8ee42aa7e7628e3eac4ee4ef78bd00cff4af8e14631c063ac048867abe4e0a246eda378413e530d48fd5db501

Download Submit
C:\Windows\System\eKvZMaO.exe

Filesize
1.5MB

MD5
f27dd7eeb5974e436dd4d88f15fa2350

SHA1
2af966e135cb50ac6a98b008cc164a38bb1919fc

SHA256
a706008cb47065c332d795f25a535deafa66c5148f8540c4468e51ba8cd3541b

SHA512
fae7748dd7a4b184c733a8bcbce097dc6901dfaa7aa77b18c1e1680416d3030f12b221ee4eb84e928d290e1edf7986499d4fc075ce3e41ca0bc81329f18041bd

Download Submit
C:\Windows\System\gumqcAe.exe

Filesize
1.5MB

MD5
b846ff568ddfee758a91fb246d2c40e7

SHA1
2d9099bd743e78aa63e6d549918abb682854ed6c

SHA256
6b7b8723804be34c617f593787434329d58471837bb53cf1b7f32e42e2e325fb

SHA512
67e718a7ba7bf6a765232978deb73b12082e4c2bb9f82971d405e84ef3a5ebfd869f158106942b4390445c42d5b875c87d004dbf869dc3d8753ab1c90b48e5e0

Download Submit
C:\Windows\System\kGqXBfY.exe

Filesize
1.5MB

MD5
7c1e69371af23c666cecfe5e0af8ee75

SHA1
0c9a0751f490813e561c2d8ec6b539ca9a51eafe

SHA256
0ce9f9c2a891564f1a5c0cb33573f990043300ead5c4be90fd7b1bf2596eec00

SHA512
7f2a37b55e68e137987dc432578f12980e6adc2157d6ef26abb9bd03caa124fd88425d1573bb888a6803682117c6adb39e23d25fb6eb3544b62ee79988ee4337

Download Submit
C:\Windows\System\kRtyhJm.exe

Filesize
1.5MB

MD5
2eaf18b1f41f8529ac66ecd475eb6769

SHA1
2d2cdaf38e142eb48a651bcf02f234690dc7b955

SHA256
b8cab856ace12acb03d8abb13b94fca4c69817d538c19319880c1d6e005528d9

SHA512
4ca23004f9400c4e4e48fe180ef18285aa54b5adf28605139103be6d6512c3202fb79f64a72a0f722c9deadbf404ded8a47d286ba36ee9f1abafc8b5de80f6c8

Download Submit
C:\Windows\System\ksUcewo.exe

Filesize
1.5MB

MD5
8e649971fe2514f57962d24cf3feb413

SHA1
509d0766d35af734d6f7bd2843813fefc3df3b7d

SHA256
66004101cf963abe6d3f0e497904d4fe0865d01786c1b04f305aac37106cbdd0

SHA512
2b3bff1a0d00df17d83b818bbd68f4297a6d9c67e95e2a3a1818c3037bbc96bd9a79c5332eddf4058051dc2a0ee301c32dc55e5ee2ca8f03d337d66d12e8d449

Download Submit
C:\Windows\System\tQEcpiY.exe

Filesize
1.5MB

MD5
982e60e163b6ced37a4aef925fc1a9fe

SHA1
a9f130332ef3fa2ab9e6388251551cd2e61e5fc3

SHA256
13c8def776158149a9eaa3ac31b44ef8513e90571113f46e4ac987dc463c7043

SHA512
3c767c0557da3bc080a4fba2fc8f4d8512824f7fa9d82155a641df3aa42ac5bab4d91ea993579a340c0d9fd01a32d7ccb618e45b455c955977990461780aefa8

Download Submit
C:\Windows\System\vXDnydS.exe

Filesize
1.5MB

MD5
78ffe6769581bfc838953ac59f3d25e2

SHA1
a82533c0f7863d561541ccf55dbbdaac5545c1ce

SHA256
5a6835489ffb8739d1f9ea01420bb906e2d562540a89274e26f261c569bb0ea5

SHA512
2c7bdfd4daf392cd8ffcb0e21f353b9d108b921622143b770361c21f8086afd1664c7b05e5a7d7ba0274c21c18b01dda83b563f31ad91c352f7bce821478d5c1

Download Submit
C:\Windows\System\vdYSUdi.exe

Filesize
1.5MB

MD5
ccc160574695088bbc77f57a579956f4

SHA1
c4af8cac7028a75e807c25e85eddf5d743ce9144

SHA256
dc5e0aaa49e99ccd29788f3ab542d935496250f012461e40808a8a2aee56718a

SHA512
6cdd28b0673c157328bce5fd365819e0093b904c74662ea134e4edbd98f6a1fc588b910ba7104f28f69566740a7df23b105c4190915f36efd33937fbc6fdf267

Download Submit
C:\Windows\System\xPUHQFq.exe

Filesize
1.5MB

MD5
a9ea7009b1007ca287a6c60b1e3f4b02

SHA1
40e5440ea6d04a9a4542e436c42d135fc16d736f

SHA256
a8d89145938004dd28b42e62081269d099e9c6430ced31226d66a40c28559740

SHA512
b2362ede37d0720f5b683d89de727280d02745d975e7fc290a7506fdb28b0203154c541924fecbf9611d0f40ad53901b11ac8376ed2a5a35aa7fd3208df488e3

Download Submit
C:\Windows\System\yXXgeti.exe

Filesize
1.5MB

MD5
64670d077cc4828e076064e7d4b0dfc1

SHA1
87db36ab0e3f093272d571322e4af5e3859e7acb

SHA256
1ab455fc5037308c7c19337517e408feae38ae8df60bd50fd4f322fb4ce27755

SHA512
69dde9c8ea13bfeb11c449ebcf5f82e8b0df0bac383cf4300ac39d03819733f70dd7ae20a37c19ded853238cc806c89e91ea6826a3cc7823c9615ef1affada57

Download Submit
C:\Windows\System\yXsAmOu.exe

Filesize
1.5MB

MD5
28ea748c711053a1fbe8d19b88c33132

SHA1
0b72664804924879d36ec4f848426533f53f2945

SHA256
6f11b833c8d9f461d149f0c322c877c25ec95c0b5721de1205b63981ad827ce3

SHA512
611c154d1a02473b065b3bc99bb2fcac304dd2e3c5b8983993fa519f9d2b149f05504480b564b02c954f0c480dd84aaf610dbb6858588508e82aad87684f14df

Download Submit
C:\Windows\System\yvIcsSe.exe

Filesize
1.5MB

MD5
e8e879404c35cc6d7ed7efa87bb852eb

SHA1
3437bdd147142b9133628369a5ac7973dc4d20a9

SHA256
03b3fcf8eecdb30d46c7309540c1bd02ed0c5c0b5cc976e42f535a10d57d4eb4

SHA512
6f3e92d0ee420e1f49125f406e507984962d9728f0d790be40bfdd5a6078d31fe1ff1bf4f7aa798b65a2b49c005325d38c864b5dee1553efb0ee6048a01a66b5

Download Submit
C:\Windows\System\ztdSGpn.exe

Filesize
1.5MB

MD5
e91cd4297cb76be1c4e04a49552df023

SHA1
5eb9820d818e5907e7d40d10d6dceefc3bb7d0f3

SHA256
d434eccda315b6d0424a324a5620f3fd1cb38fbf84725d6d54d9c11416e17534

SHA512
11f64d07a4bf60db7777536f4ebf27f973f936abeff61d4d7f609fb12b13977b6d683b8b187ac024d578c94855cc85135b92c162bd4a323fdb1b95af2791dd1a

Download Submit
memory/2592-0-0x0000014BD57E0000-0x0000014BD57F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads