xmrig | 9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
Size

1.5MB
MD5

e5264eb5d2bd7be8f10b28798ab98c0b
SHA1

b376cc547303258e634752c3016f99574ee1ffdd
SHA256

9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4
SHA512

28d8153af4dcf37420513d6151cb57b072086c1e85a87ba1e7edca1b7e515bd1e4c3eac73cdb09e0c1d1fa724527a8d58439a17eaff1d96d2d522b231bc3a581
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc9:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5/

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b60-3.dat	xmrig
behavioral2/files/0x000a000000023b68-6.dat	xmrig
behavioral2/files/0x000b000000023b64-11.dat	xmrig
behavioral2/files/0x000a000000023b6e-39.dat	xmrig
behavioral2/files/0x000a000000023b73-66.dat	xmrig
behavioral2/files/0x000a000000023b75-77.dat	xmrig
behavioral2/files/0x000a000000023b79-128.dat	xmrig
behavioral2/files/0x000a000000023b82-144.dat	xmrig
behavioral2/files/0x000a000000023b81-142.dat	xmrig
behavioral2/files/0x000a000000023b80-140.dat	xmrig
behavioral2/files/0x000a000000023b7f-138.dat	xmrig
behavioral2/files/0x000a000000023b7b-136.dat	xmrig
behavioral2/files/0x000a000000023b7e-134.dat	xmrig
behavioral2/files/0x000a000000023b7c-132.dat	xmrig
behavioral2/files/0x000a000000023b7a-130.dat	xmrig
behavioral2/files/0x000a000000023b7d-126.dat	xmrig
behavioral2/files/0x000a000000023b78-122.dat	xmrig
behavioral2/files/0x000a000000023b77-115.dat	xmrig
behavioral2/files/0x000a000000023b76-113.dat	xmrig
behavioral2/files/0x0031000000023b72-109.dat	xmrig
behavioral2/files/0x0031000000023b71-108.dat	xmrig
behavioral2/files/0x000a000000023b74-96.dat	xmrig
behavioral2/files/0x0031000000023b70-61.dat	xmrig
behavioral2/files/0x000a000000023b6f-57.dat	xmrig
behavioral2/files/0x000a000000023b6c-49.dat	xmrig
behavioral2/files/0x000a000000023b6d-46.dat	xmrig
behavioral2/files/0x000a000000023b69-44.dat	xmrig
behavioral2/files/0x000a000000023b6b-41.dat	xmrig
behavioral2/files/0x000a000000023b6a-34.dat	xmrig
behavioral2/files/0x000a000000023b83-149.dat	xmrig
behavioral2/files/0x000b000000023b65-154.dat	xmrig
behavioral2/files/0x000a000000023b86-158.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
980	ITesSWq.exe
1516	DZRWHeO.exe
1520	lfaLqZF.exe
60	kZQAEpW.exe
3888	HeACxKT.exe
1156	bytVnAv.exe
1860	arbLrtJ.exe
4932	JfGKcFi.exe
4364	XuthNms.exe
2880	rByhmBo.exe
2932	FJgAsDO.exe
4660	NjxRBTu.exe
4504	BXMSOqn.exe
3752	egdPqGq.exe
1676	pycGUfr.exe
2728	oaZxTvz.exe
3944	AfyuGSl.exe
4296	zlHNHhh.exe
5032	DGXibEp.exe
5100	pMhUgtg.exe
1836	OzpOInB.exe
1964	PJGzuyW.exe
2008	uOJwWlp.exe
4804	mOVwPfb.exe
3012	brBGjBz.exe
2388	ebjVpUw.exe
4228	OJzgHDe.exe
3476	zXRXCLT.exe
1548	cJEdHHI.exe
3000	vYrZIEB.exe
3688	DBvoUMq.exe
2324	LLBoCFG.exe
1284	NbROOXl.exe
1688	FqegPka.exe
4036	mRZEAxt.exe
2032	ZSgMvoI.exe
392	CAfMNfJ.exe
1996	NEgFMGr.exe
1424	lgLkOjW.exe
3108	DQyUMKF.exe
2192	bIQkYDE.exe
3456	YnbfzzO.exe
920	jpDOVeU.exe
648	UjhIQIn.exe
2244	ByXNzzk.exe
4156	kqxFHLI.exe
3512	WdHyeSR.exe
228	vbVARVM.exe
1524	jlGRLty.exe
4912	utRwKew.exe
4180	uPdIKsI.exe
3792	mqrkAaf.exe
1796	uMSpdge.exe
4536	jyCTRdc.exe
1480	mnGFAzf.exe
3052	QNKeRuF.exe
3636	dESWXtQ.exe
5024	gBiSVYt.exe
4916	ZKXIjIG.exe
4736	dCKlGFG.exe
1960	okkMVbr.exe
4924	XErCsku.exe
2360	CizcBur.exe
1172	kFoXZuq.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CizcBur.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\yQmEvDi.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\cnijaEV.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\ETYOGVN.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\djXidKc.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\opaOFnU.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\rByhmBo.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\uuYpPsi.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\fvmjGwd.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\yGoACkh.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\mOFYFke.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\PQBKNhp.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\bXULYZW.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\QPAAyqu.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\UwOXySp.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\tSkDSYI.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\IlEYuCM.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\qlMpvGz.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\hEcfwfM.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\MtZnuuz.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\yWyBVkT.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\eyihcWb.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\CZbyXhm.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\ZwtneJc.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\ZkQSZig.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\zTzZKwd.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\RYbBzAX.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\DyepWNE.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\ENRWXvC.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\TxUbeNH.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\mpeVJyG.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\KQAwILn.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\wmsmbse.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\DPvgVpO.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\dQlsMSK.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\lfaLqZF.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\QYGYbYd.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\sbORfTq.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\saInBDg.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\YRWxyab.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\leitIvd.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\FWblSJB.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\PuHdgkd.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\mzqhhuz.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\ULhtezU.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\arbLrtJ.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\NjxRBTu.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\HjYTdjy.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\tjTMfaH.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\AcJmWlo.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\DMptzrj.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\ltCYSxY.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\ZPzWgaR.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\YGONIJg.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\BVXcPNv.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\aghYhme.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\QcVAKVc.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\zQjlvEc.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\VZmMHCt.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\AwKMVbj.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\jpXjLzc.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\kKcrZJS.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\oanXkIG.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
File created	C:\Windows\System\rXetcUN.exe	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 980	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	84
PID 4864 wrote to memory of 980	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	84
PID 4864 wrote to memory of 1516	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	85
PID 4864 wrote to memory of 1516	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	85
PID 4864 wrote to memory of 1520	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	86
PID 4864 wrote to memory of 1520	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	86
PID 4864 wrote to memory of 3888	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	87
PID 4864 wrote to memory of 3888	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	87
PID 4864 wrote to memory of 60	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	88
PID 4864 wrote to memory of 60	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	88
PID 4864 wrote to memory of 1156	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	89
PID 4864 wrote to memory of 1156	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	89
PID 4864 wrote to memory of 1860	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	90
PID 4864 wrote to memory of 1860	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	90
PID 4864 wrote to memory of 4932	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	91
PID 4864 wrote to memory of 4932	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	91
PID 4864 wrote to memory of 4364	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	92
PID 4864 wrote to memory of 4364	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	92
PID 4864 wrote to memory of 2880	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	93
PID 4864 wrote to memory of 2880	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	93
PID 4864 wrote to memory of 2932	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	94
PID 4864 wrote to memory of 2932	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	94
PID 4864 wrote to memory of 4660	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	95
PID 4864 wrote to memory of 4660	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	95
PID 4864 wrote to memory of 1676	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	96
PID 4864 wrote to memory of 1676	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	96
PID 4864 wrote to memory of 4504	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	97
PID 4864 wrote to memory of 4504	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	97
PID 4864 wrote to memory of 3752	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	98
PID 4864 wrote to memory of 3752	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	98
PID 4864 wrote to memory of 2728	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	99
PID 4864 wrote to memory of 2728	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	99
PID 4864 wrote to memory of 3944	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	100
PID 4864 wrote to memory of 3944	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	100
PID 4864 wrote to memory of 4296	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	101
PID 4864 wrote to memory of 4296	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	101
PID 4864 wrote to memory of 5032	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	102
PID 4864 wrote to memory of 5032	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	102
PID 4864 wrote to memory of 5100	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	103
PID 4864 wrote to memory of 5100	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	103
PID 4864 wrote to memory of 1836	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	104
PID 4864 wrote to memory of 1836	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	104
PID 4864 wrote to memory of 3012	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	105
PID 4864 wrote to memory of 3012	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	105
PID 4864 wrote to memory of 1964	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	106
PID 4864 wrote to memory of 1964	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	106
PID 4864 wrote to memory of 2008	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	107
PID 4864 wrote to memory of 2008	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	107
PID 4864 wrote to memory of 4804	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	108
PID 4864 wrote to memory of 4804	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	108
PID 4864 wrote to memory of 2388	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	109
PID 4864 wrote to memory of 2388	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	109
PID 4864 wrote to memory of 4228	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	110
PID 4864 wrote to memory of 4228	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	110
PID 4864 wrote to memory of 3476	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	111
PID 4864 wrote to memory of 3476	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	111
PID 4864 wrote to memory of 1548	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	112
PID 4864 wrote to memory of 1548	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	112
PID 4864 wrote to memory of 3000	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	113
PID 4864 wrote to memory of 3000	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	113
PID 4864 wrote to memory of 3688	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	114
PID 4864 wrote to memory of 3688	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	114
PID 4864 wrote to memory of 2324	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	116
PID 4864 wrote to memory of 2324	4864	9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe	116

C:\Users\Admin\AppData\Local\Temp\9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe
"C:\Users\Admin\AppData\Local\Temp\9909fc26b13684caa05757c51bec37b176340c6a001a7fbd604e6ae5046fcbd4.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\System\ITesSWq.exe
  C:\Windows\System\ITesSWq.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\DZRWHeO.exe
  C:\Windows\System\DZRWHeO.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\lfaLqZF.exe
  C:\Windows\System\lfaLqZF.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\HeACxKT.exe
  C:\Windows\System\HeACxKT.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\kZQAEpW.exe
  C:\Windows\System\kZQAEpW.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\bytVnAv.exe
  C:\Windows\System\bytVnAv.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\arbLrtJ.exe
  C:\Windows\System\arbLrtJ.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\JfGKcFi.exe
  C:\Windows\System\JfGKcFi.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\XuthNms.exe
  C:\Windows\System\XuthNms.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\rByhmBo.exe
  C:\Windows\System\rByhmBo.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\FJgAsDO.exe
  C:\Windows\System\FJgAsDO.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\NjxRBTu.exe
  C:\Windows\System\NjxRBTu.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\pycGUfr.exe
  C:\Windows\System\pycGUfr.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\BXMSOqn.exe
  C:\Windows\System\BXMSOqn.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\egdPqGq.exe
  C:\Windows\System\egdPqGq.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\oaZxTvz.exe
  C:\Windows\System\oaZxTvz.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\AfyuGSl.exe
  C:\Windows\System\AfyuGSl.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\zlHNHhh.exe
  C:\Windows\System\zlHNHhh.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\DGXibEp.exe
  C:\Windows\System\DGXibEp.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\pMhUgtg.exe
  C:\Windows\System\pMhUgtg.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\OzpOInB.exe
  C:\Windows\System\OzpOInB.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\brBGjBz.exe
  C:\Windows\System\brBGjBz.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\PJGzuyW.exe
  C:\Windows\System\PJGzuyW.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\uOJwWlp.exe
  C:\Windows\System\uOJwWlp.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\mOVwPfb.exe
  C:\Windows\System\mOVwPfb.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\ebjVpUw.exe
  C:\Windows\System\ebjVpUw.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\OJzgHDe.exe
  C:\Windows\System\OJzgHDe.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\zXRXCLT.exe
  C:\Windows\System\zXRXCLT.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\cJEdHHI.exe
  C:\Windows\System\cJEdHHI.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\vYrZIEB.exe
  C:\Windows\System\vYrZIEB.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\DBvoUMq.exe
  C:\Windows\System\DBvoUMq.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\LLBoCFG.exe
  C:\Windows\System\LLBoCFG.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\NbROOXl.exe
  C:\Windows\System\NbROOXl.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\FqegPka.exe
  C:\Windows\System\FqegPka.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\mRZEAxt.exe
  C:\Windows\System\mRZEAxt.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\ZSgMvoI.exe
  C:\Windows\System\ZSgMvoI.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\CAfMNfJ.exe
  C:\Windows\System\CAfMNfJ.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\NEgFMGr.exe
  C:\Windows\System\NEgFMGr.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\lgLkOjW.exe
  C:\Windows\System\lgLkOjW.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\DQyUMKF.exe
  C:\Windows\System\DQyUMKF.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\bIQkYDE.exe
  C:\Windows\System\bIQkYDE.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\YnbfzzO.exe
  C:\Windows\System\YnbfzzO.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\jpDOVeU.exe
  C:\Windows\System\jpDOVeU.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\UjhIQIn.exe
  C:\Windows\System\UjhIQIn.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\ByXNzzk.exe
  C:\Windows\System\ByXNzzk.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\kqxFHLI.exe
  C:\Windows\System\kqxFHLI.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\WdHyeSR.exe
  C:\Windows\System\WdHyeSR.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\vbVARVM.exe
  C:\Windows\System\vbVARVM.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\jlGRLty.exe
  C:\Windows\System\jlGRLty.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\utRwKew.exe
  C:\Windows\System\utRwKew.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\uPdIKsI.exe
  C:\Windows\System\uPdIKsI.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\mqrkAaf.exe
  C:\Windows\System\mqrkAaf.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\uMSpdge.exe
  C:\Windows\System\uMSpdge.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\jyCTRdc.exe
  C:\Windows\System\jyCTRdc.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\mnGFAzf.exe
  C:\Windows\System\mnGFAzf.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\QNKeRuF.exe
  C:\Windows\System\QNKeRuF.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\dESWXtQ.exe
  C:\Windows\System\dESWXtQ.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\gBiSVYt.exe
  C:\Windows\System\gBiSVYt.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\ZKXIjIG.exe
  C:\Windows\System\ZKXIjIG.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\dCKlGFG.exe
  C:\Windows\System\dCKlGFG.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\okkMVbr.exe
  C:\Windows\System\okkMVbr.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\XErCsku.exe
  C:\Windows\System\XErCsku.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\CizcBur.exe
  C:\Windows\System\CizcBur.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\kFoXZuq.exe
  C:\Windows\System\kFoXZuq.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\nvXQxtk.exe
  C:\Windows\System\nvXQxtk.exe
  2⤵
  PID:4664
- C:\Windows\System\BVXcPNv.exe
  C:\Windows\System\BVXcPNv.exe
  2⤵
  PID:1152
- C:\Windows\System\hTkWKJl.exe
  C:\Windows\System\hTkWKJl.exe
  2⤵
  PID:1420
- C:\Windows\System\FYYJkTt.exe
  C:\Windows\System\FYYJkTt.exe
  2⤵
  PID:1852
- C:\Windows\System\KQIAUFe.exe
  C:\Windows\System\KQIAUFe.exe
  2⤵
  PID:4484
- C:\Windows\System\dgzTLBW.exe
  C:\Windows\System\dgzTLBW.exe
  2⤵
  PID:1672
- C:\Windows\System\MriTHNO.exe
  C:\Windows\System\MriTHNO.exe
  2⤵
  PID:2128
- C:\Windows\System\ZUGtxdB.exe
  C:\Windows\System\ZUGtxdB.exe
  2⤵
  PID:232
- C:\Windows\System\CCfHSCL.exe
  C:\Windows\System\CCfHSCL.exe
  2⤵
  PID:1120
- C:\Windows\System\YmIsrOO.exe
  C:\Windows\System\YmIsrOO.exe
  2⤵
  PID:1608
- C:\Windows\System\pGNYLsF.exe
  C:\Windows\System\pGNYLsF.exe
  2⤵
  PID:4900
- C:\Windows\System\UFbmshu.exe
  C:\Windows\System\UFbmshu.exe
  2⤵
  PID:4004
- C:\Windows\System\SRpJBfB.exe
  C:\Windows\System\SRpJBfB.exe
  2⤵
  PID:3948
- C:\Windows\System\eAGZvfW.exe
  C:\Windows\System\eAGZvfW.exe
  2⤵
  PID:1228
- C:\Windows\System\SCmriey.exe
  C:\Windows\System\SCmriey.exe
  2⤵
  PID:4084
- C:\Windows\System\lnheggS.exe
  C:\Windows\System\lnheggS.exe
  2⤵
  PID:4676
- C:\Windows\System\STnGwbv.exe
  C:\Windows\System\STnGwbv.exe
  2⤵
  PID:4280
- C:\Windows\System\NLFCHtE.exe
  C:\Windows\System\NLFCHtE.exe
  2⤵
  PID:5068
- C:\Windows\System\gjbWZqM.exe
  C:\Windows\System\gjbWZqM.exe
  2⤵
  PID:3360
- C:\Windows\System\boHOMTM.exe
  C:\Windows\System\boHOMTM.exe
  2⤵
  PID:2856
- C:\Windows\System\ScwjzLx.exe
  C:\Windows\System\ScwjzLx.exe
  2⤵
  PID:4992
- C:\Windows\System\DiHByZG.exe
  C:\Windows\System\DiHByZG.exe
  2⤵
  PID:4060
- C:\Windows\System\USuPyLk.exe
  C:\Windows\System\USuPyLk.exe
  2⤵
  PID:1668
- C:\Windows\System\UGGaLzJ.exe
  C:\Windows\System\UGGaLzJ.exe
  2⤵
  PID:660
- C:\Windows\System\ALITUDP.exe
  C:\Windows\System\ALITUDP.exe
  2⤵
  PID:3596
- C:\Windows\System\DHITHXw.exe
  C:\Windows\System\DHITHXw.exe
  2⤵
  PID:4588
- C:\Windows\System\eZMYuOn.exe
  C:\Windows\System\eZMYuOn.exe
  2⤵
  PID:2060
- C:\Windows\System\OBgFGVl.exe
  C:\Windows\System\OBgFGVl.exe
  2⤵
  PID:4240
- C:\Windows\System\wDyPMMT.exe
  C:\Windows\System\wDyPMMT.exe
  2⤵
  PID:548
- C:\Windows\System\gWNlNgJ.exe
  C:\Windows\System\gWNlNgJ.exe
  2⤵
  PID:1948
- C:\Windows\System\mqJgQOD.exe
  C:\Windows\System\mqJgQOD.exe
  2⤵
  PID:1008
- C:\Windows\System\OlNzdpx.exe
  C:\Windows\System\OlNzdpx.exe
  2⤵
  PID:2524
- C:\Windows\System\zakQyZW.exe
  C:\Windows\System\zakQyZW.exe
  2⤵
  PID:388
- C:\Windows\System\QBfGxzE.exe
  C:\Windows\System\QBfGxzE.exe
  2⤵
  PID:5088
- C:\Windows\System\KAaOWQB.exe
  C:\Windows\System\KAaOWQB.exe
  2⤵
  PID:4516
- C:\Windows\System\KBGOfMx.exe
  C:\Windows\System\KBGOfMx.exe
  2⤵
  PID:3840
- C:\Windows\System\mxkVJtm.exe
  C:\Windows\System\mxkVJtm.exe
  2⤵
  PID:968
- C:\Windows\System\WoIlcis.exe
  C:\Windows\System\WoIlcis.exe
  2⤵
  PID:1760
- C:\Windows\System\DwectsU.exe
  C:\Windows\System\DwectsU.exe
  2⤵
  PID:1488
- C:\Windows\System\nhFeuPM.exe
  C:\Windows\System\nhFeuPM.exe
  2⤵
  PID:2804
- C:\Windows\System\bUaakIX.exe
  C:\Windows\System\bUaakIX.exe
  2⤵
  PID:1532
- C:\Windows\System\jJPsrSn.exe
  C:\Windows\System\jJPsrSn.exe
  2⤵
  PID:2920
- C:\Windows\System\ZjsvOBt.exe
  C:\Windows\System\ZjsvOBt.exe
  2⤵
  PID:468
- C:\Windows\System\FErKVPA.exe
  C:\Windows\System\FErKVPA.exe
  2⤵
  PID:5144
- C:\Windows\System\dcLXCgB.exe
  C:\Windows\System\dcLXCgB.exe
  2⤵
  PID:5184
- C:\Windows\System\WrGZOyj.exe
  C:\Windows\System\WrGZOyj.exe
  2⤵
  PID:5204
- C:\Windows\System\hMmcyFM.exe
  C:\Windows\System\hMmcyFM.exe
  2⤵
  PID:5240
- C:\Windows\System\axWfmMe.exe
  C:\Windows\System\axWfmMe.exe
  2⤵
  PID:5268
- C:\Windows\System\AnxMZRT.exe
  C:\Windows\System\AnxMZRT.exe
  2⤵
  PID:5300
- C:\Windows\System\kOiYkGW.exe
  C:\Windows\System\kOiYkGW.exe
  2⤵
  PID:5324
- C:\Windows\System\faYEpXn.exe
  C:\Windows\System\faYEpXn.exe
  2⤵
  PID:5352
- C:\Windows\System\QULAxfa.exe
  C:\Windows\System\QULAxfa.exe
  2⤵
  PID:5380
- C:\Windows\System\YWjkbCg.exe
  C:\Windows\System\YWjkbCg.exe
  2⤵
  PID:5408
- C:\Windows\System\XjtMIEx.exe
  C:\Windows\System\XjtMIEx.exe
  2⤵
  PID:5436
- C:\Windows\System\xoCGvoO.exe
  C:\Windows\System\xoCGvoO.exe
  2⤵
  PID:5452
- C:\Windows\System\PFtPbMt.exe
  C:\Windows\System\PFtPbMt.exe
  2⤵
  PID:5476
- C:\Windows\System\oJNendJ.exe
  C:\Windows\System\oJNendJ.exe
  2⤵
  PID:5508
- C:\Windows\System\HaTyWtP.exe
  C:\Windows\System\HaTyWtP.exe
  2⤵
  PID:5536
- C:\Windows\System\DziCRtI.exe
  C:\Windows\System\DziCRtI.exe
  2⤵
  PID:5568
- C:\Windows\System\KohUUHw.exe
  C:\Windows\System\KohUUHw.exe
  2⤵
  PID:5596
- C:\Windows\System\UBNtPAt.exe
  C:\Windows\System\UBNtPAt.exe
  2⤵
  PID:5632
- C:\Windows\System\puVLcla.exe
  C:\Windows\System\puVLcla.exe
  2⤵
  PID:5660
- C:\Windows\System\rSaqpku.exe
  C:\Windows\System\rSaqpku.exe
  2⤵
  PID:5688
- C:\Windows\System\dMZgoMb.exe
  C:\Windows\System\dMZgoMb.exe
  2⤵
  PID:5720
- C:\Windows\System\UcooFmY.exe
  C:\Windows\System\UcooFmY.exe
  2⤵
  PID:5744
- C:\Windows\System\cTutWUM.exe
  C:\Windows\System\cTutWUM.exe
  2⤵
  PID:5760
- C:\Windows\System\pSnVpgF.exe
  C:\Windows\System\pSnVpgF.exe
  2⤵
  PID:5796
- C:\Windows\System\Vurhoiw.exe
  C:\Windows\System\Vurhoiw.exe
  2⤵
  PID:5816
- C:\Windows\System\cSSKLQJ.exe
  C:\Windows\System\cSSKLQJ.exe
  2⤵
  PID:5832
- C:\Windows\System\FXUXHEm.exe
  C:\Windows\System\FXUXHEm.exe
  2⤵
  PID:5852
- C:\Windows\System\YXMffIo.exe
  C:\Windows\System\YXMffIo.exe
  2⤵
  PID:5888
- C:\Windows\System\xIMDJqQ.exe
  C:\Windows\System\xIMDJqQ.exe
  2⤵
  PID:5916
- C:\Windows\System\fqluAMo.exe
  C:\Windows\System\fqluAMo.exe
  2⤵
  PID:5952
- C:\Windows\System\WZlOyTE.exe
  C:\Windows\System\WZlOyTE.exe
  2⤵
  PID:5984
- C:\Windows\System\SNOLQRj.exe
  C:\Windows\System\SNOLQRj.exe
  2⤵
  PID:6008
- C:\Windows\System\WSlwMdE.exe
  C:\Windows\System\WSlwMdE.exe
  2⤵
  PID:6040
- C:\Windows\System\fuRrFYy.exe
  C:\Windows\System\fuRrFYy.exe
  2⤵
  PID:6068
- C:\Windows\System\xaXNQKG.exe
  C:\Windows\System\xaXNQKG.exe
  2⤵
  PID:6096
- C:\Windows\System\cIYHrsH.exe
  C:\Windows\System\cIYHrsH.exe
  2⤵
  PID:6124
- C:\Windows\System\PtAPXhy.exe
  C:\Windows\System\PtAPXhy.exe
  2⤵
  PID:4848
- C:\Windows\System\KMsbTfH.exe
  C:\Windows\System\KMsbTfH.exe
  2⤵
  PID:5164
- C:\Windows\System\PQBKNhp.exe
  C:\Windows\System\PQBKNhp.exe
  2⤵
  PID:5216
- C:\Windows\System\OWdNuVr.exe
  C:\Windows\System\OWdNuVr.exe
  2⤵
  PID:5256
- C:\Windows\System\UssYeeO.exe
  C:\Windows\System\UssYeeO.exe
  2⤵
  PID:5392
- C:\Windows\System\azeHEus.exe
  C:\Windows\System\azeHEus.exe
  2⤵
  PID:5464
- C:\Windows\System\aghYhme.exe
  C:\Windows\System\aghYhme.exe
  2⤵
  PID:5524
- C:\Windows\System\sDRRTFE.exe
  C:\Windows\System\sDRRTFE.exe
  2⤵
  PID:5552
- C:\Windows\System\vRQWuhJ.exe
  C:\Windows\System\vRQWuhJ.exe
  2⤵
  PID:5672
- C:\Windows\System\tpPjfgh.exe
  C:\Windows\System\tpPjfgh.exe
  2⤵
  PID:5704
- C:\Windows\System\dGGhTiN.exe
  C:\Windows\System\dGGhTiN.exe
  2⤵
  PID:5788
- C:\Windows\System\TYorkFv.exe
  C:\Windows\System\TYorkFv.exe
  2⤵
  PID:5844
- C:\Windows\System\IgzEGsA.exe
  C:\Windows\System\IgzEGsA.exe
  2⤵
  PID:5928
- C:\Windows\System\keGIjyV.exe
  C:\Windows\System\keGIjyV.exe
  2⤵
  PID:6004
- C:\Windows\System\fNTmzPy.exe
  C:\Windows\System\fNTmzPy.exe
  2⤵
  PID:6052
- C:\Windows\System\jsiVEis.exe
  C:\Windows\System\jsiVEis.exe
  2⤵
  PID:6080
- C:\Windows\System\SEDOgqY.exe
  C:\Windows\System\SEDOgqY.exe
  2⤵
  PID:5220
- C:\Windows\System\DMjkeBU.exe
  C:\Windows\System\DMjkeBU.exe
  2⤵
  PID:5320
- C:\Windows\System\PCVeBWQ.exe
  C:\Windows\System\PCVeBWQ.exe
  2⤵
  PID:5560
- C:\Windows\System\HpIdusB.exe
  C:\Windows\System\HpIdusB.exe
  2⤵
  PID:5656
- C:\Windows\System\qlMpvGz.exe
  C:\Windows\System\qlMpvGz.exe
  2⤵
  PID:5828
- C:\Windows\System\rfHJrPz.exe
  C:\Windows\System\rfHJrPz.exe
  2⤵
  PID:5968
- C:\Windows\System\ixHrckb.exe
  C:\Windows\System\ixHrckb.exe
  2⤵
  PID:3800
- C:\Windows\System\FkBdzwL.exe
  C:\Windows\System\FkBdzwL.exe
  2⤵
  PID:6120
- C:\Windows\System\LwVsjQG.exe
  C:\Windows\System\LwVsjQG.exe
  2⤵
  PID:5500
- C:\Windows\System\mREecPo.exe
  C:\Windows\System\mREecPo.exe
  2⤵
  PID:6024
- C:\Windows\System\TxUbeNH.exe
  C:\Windows\System\TxUbeNH.exe
  2⤵
  PID:6148
- C:\Windows\System\kDjULsx.exe
  C:\Windows\System\kDjULsx.exe
  2⤵
  PID:6172
- C:\Windows\System\kdIsfcO.exe
  C:\Windows\System\kdIsfcO.exe
  2⤵
  PID:6196
- C:\Windows\System\TZOZncO.exe
  C:\Windows\System\TZOZncO.exe
  2⤵
  PID:6216
- C:\Windows\System\rBzlVeY.exe
  C:\Windows\System\rBzlVeY.exe
  2⤵
  PID:6240
- C:\Windows\System\PAyYAGk.exe
  C:\Windows\System\PAyYAGk.exe
  2⤵
  PID:6268
- C:\Windows\System\icapZPz.exe
  C:\Windows\System\icapZPz.exe
  2⤵
  PID:6288
- C:\Windows\System\vmIrpIh.exe
  C:\Windows\System\vmIrpIh.exe
  2⤵
  PID:6312
- C:\Windows\System\bydTMKr.exe
  C:\Windows\System\bydTMKr.exe
  2⤵
  PID:6344
- C:\Windows\System\pgMCfJR.exe
  C:\Windows\System\pgMCfJR.exe
  2⤵
  PID:6376
- C:\Windows\System\cqjWfir.exe
  C:\Windows\System\cqjWfir.exe
  2⤵
  PID:6400
- C:\Windows\System\XyJJIId.exe
  C:\Windows\System\XyJJIId.exe
  2⤵
  PID:6432
- C:\Windows\System\FLpSHMs.exe
  C:\Windows\System\FLpSHMs.exe
  2⤵
  PID:6460
- C:\Windows\System\mNFVKUG.exe
  C:\Windows\System\mNFVKUG.exe
  2⤵
  PID:6484
- C:\Windows\System\minQwWg.exe
  C:\Windows\System\minQwWg.exe
  2⤵
  PID:6508
- C:\Windows\System\HKreEcA.exe
  C:\Windows\System\HKreEcA.exe
  2⤵
  PID:6540
- C:\Windows\System\rqWlhOl.exe
  C:\Windows\System\rqWlhOl.exe
  2⤵
  PID:6564
- C:\Windows\System\inWWOuz.exe
  C:\Windows\System\inWWOuz.exe
  2⤵
  PID:6596
- C:\Windows\System\dbQMGoY.exe
  C:\Windows\System\dbQMGoY.exe
  2⤵
  PID:6616
- C:\Windows\System\EjYOgeH.exe
  C:\Windows\System\EjYOgeH.exe
  2⤵
  PID:6640
- C:\Windows\System\RVnVodw.exe
  C:\Windows\System\RVnVodw.exe
  2⤵
  PID:6660
- C:\Windows\System\cSRSNTi.exe
  C:\Windows\System\cSRSNTi.exe
  2⤵
  PID:6684
- C:\Windows\System\sZPsJbY.exe
  C:\Windows\System\sZPsJbY.exe
  2⤵
  PID:6708
- C:\Windows\System\QgNKVRh.exe
  C:\Windows\System\QgNKVRh.exe
  2⤵
  PID:6740
- C:\Windows\System\EDftzvp.exe
  C:\Windows\System\EDftzvp.exe
  2⤵
  PID:6776
- C:\Windows\System\HCoazQp.exe
  C:\Windows\System\HCoazQp.exe
  2⤵
  PID:6804
- C:\Windows\System\pwnvpUt.exe
  C:\Windows\System\pwnvpUt.exe
  2⤵
  PID:6828
- C:\Windows\System\XdGstkQ.exe
  C:\Windows\System\XdGstkQ.exe
  2⤵
  PID:6856
- C:\Windows\System\cWxTHCD.exe
  C:\Windows\System\cWxTHCD.exe
  2⤵
  PID:6884
- C:\Windows\System\bXDFFhs.exe
  C:\Windows\System\bXDFFhs.exe
  2⤵
  PID:6916
- C:\Windows\System\NOQUHLm.exe
  C:\Windows\System\NOQUHLm.exe
  2⤵
  PID:6952
- C:\Windows\System\vDrGnAK.exe
  C:\Windows\System\vDrGnAK.exe
  2⤵
  PID:6976
- C:\Windows\System\oanXkIG.exe
  C:\Windows\System\oanXkIG.exe
  2⤵
  PID:7008
- C:\Windows\System\LmKZrra.exe
  C:\Windows\System\LmKZrra.exe
  2⤵
  PID:7036
- C:\Windows\System\nLuvsTj.exe
  C:\Windows\System\nLuvsTj.exe
  2⤵
  PID:7072
- C:\Windows\System\ZlWsAhr.exe
  C:\Windows\System\ZlWsAhr.exe
  2⤵
  PID:7096
- C:\Windows\System\nMAuGQf.exe
  C:\Windows\System\nMAuGQf.exe
  2⤵
  PID:7120
- C:\Windows\System\FKhlUTm.exe
  C:\Windows\System\FKhlUTm.exe
  2⤵
  PID:7148
- C:\Windows\System\tSErJhB.exe
  C:\Windows\System\tSErJhB.exe
  2⤵
  PID:5400
- C:\Windows\System\EEdVXFF.exe
  C:\Windows\System\EEdVXFF.exe
  2⤵
  PID:6192
- C:\Windows\System\SPncqtv.exe
  C:\Windows\System\SPncqtv.exe
  2⤵
  PID:6236
- C:\Windows\System\BHZAlUW.exe
  C:\Windows\System\BHZAlUW.exe
  2⤵
  PID:6260
- C:\Windows\System\QYGYbYd.exe
  C:\Windows\System\QYGYbYd.exe
  2⤵
  PID:6396
- C:\Windows\System\XMNvsOX.exe
  C:\Windows\System\XMNvsOX.exe
  2⤵
  PID:6428
- C:\Windows\System\bvqdhCI.exe
  C:\Windows\System\bvqdhCI.exe
  2⤵
  PID:6480
- C:\Windows\System\DkBgctt.exe
  C:\Windows\System\DkBgctt.exe
  2⤵
  PID:6576
- C:\Windows\System\LFoCIDs.exe
  C:\Windows\System\LFoCIDs.exe
  2⤵
  PID:6536
- C:\Windows\System\ZCFQSod.exe
  C:\Windows\System\ZCFQSod.exe
  2⤵
  PID:6612
- C:\Windows\System\vvRuRpc.exe
  C:\Windows\System\vvRuRpc.exe
  2⤵
  PID:6648
- C:\Windows\System\IIYxIhz.exe
  C:\Windows\System\IIYxIhz.exe
  2⤵
  PID:6748
- C:\Windows\System\EChgqWh.exe
  C:\Windows\System\EChgqWh.exe
  2⤵
  PID:6904
- C:\Windows\System\BkHgiPH.exe
  C:\Windows\System\BkHgiPH.exe
  2⤵
  PID:6868
- C:\Windows\System\MTtdVYh.exe
  C:\Windows\System\MTtdVYh.exe
  2⤵
  PID:7048
- C:\Windows\System\WKLSNVo.exe
  C:\Windows\System\WKLSNVo.exe
  2⤵
  PID:7092
- C:\Windows\System\anuLdjD.exe
  C:\Windows\System\anuLdjD.exe
  2⤵
  PID:7112
- C:\Windows\System\PfegfDs.exe
  C:\Windows\System\PfegfDs.exe
  2⤵
  PID:6252
- C:\Windows\System\rdpKoBV.exe
  C:\Windows\System\rdpKoBV.exe
  2⤵
  PID:7164
- C:\Windows\System\pNEylwd.exe
  C:\Windows\System\pNEylwd.exe
  2⤵
  PID:6556
- C:\Windows\System\NyBVgPf.exe
  C:\Windows\System\NyBVgPf.exe
  2⤵
  PID:6520
- C:\Windows\System\MYHAUtM.exe
  C:\Windows\System\MYHAUtM.exe
  2⤵
  PID:6788
- C:\Windows\System\gKGCdhr.exe
  C:\Windows\System\gKGCdhr.exe
  2⤵
  PID:6760
- C:\Windows\System\pAvPjuU.exe
  C:\Windows\System\pAvPjuU.exe
  2⤵
  PID:6164
- C:\Windows\System\URHEzpg.exe
  C:\Windows\System\URHEzpg.exe
  2⤵
  PID:6336
- C:\Windows\System\DRlKhYT.exe
  C:\Windows\System\DRlKhYT.exe
  2⤵
  PID:7200
- C:\Windows\System\cTXiPYK.exe
  C:\Windows\System\cTXiPYK.exe
  2⤵
  PID:7224
- C:\Windows\System\jBHcKcp.exe
  C:\Windows\System\jBHcKcp.exe
  2⤵
  PID:7244
- C:\Windows\System\mzuoqXf.exe
  C:\Windows\System\mzuoqXf.exe
  2⤵
  PID:7268
- C:\Windows\System\JDFmjFv.exe
  C:\Windows\System\JDFmjFv.exe
  2⤵
  PID:7296
- C:\Windows\System\CiUXice.exe
  C:\Windows\System\CiUXice.exe
  2⤵
  PID:7324
- C:\Windows\System\fckYxlK.exe
  C:\Windows\System\fckYxlK.exe
  2⤵
  PID:7344
- C:\Windows\System\LqefOJg.exe
  C:\Windows\System\LqefOJg.exe
  2⤵
  PID:7372
- C:\Windows\System\BQjElNK.exe
  C:\Windows\System\BQjElNK.exe
  2⤵
  PID:7396
- C:\Windows\System\ODhZSGd.exe
  C:\Windows\System\ODhZSGd.exe
  2⤵
  PID:7424
- C:\Windows\System\wJKossU.exe
  C:\Windows\System\wJKossU.exe
  2⤵
  PID:7448
- C:\Windows\System\fcWkBbF.exe
  C:\Windows\System\fcWkBbF.exe
  2⤵
  PID:7472
- C:\Windows\System\rglakyK.exe
  C:\Windows\System\rglakyK.exe
  2⤵
  PID:7500
- C:\Windows\System\WcLFDTF.exe
  C:\Windows\System\WcLFDTF.exe
  2⤵
  PID:7536
- C:\Windows\System\SHEMhJw.exe
  C:\Windows\System\SHEMhJw.exe
  2⤵
  PID:7560
- C:\Windows\System\OOtLjsf.exe
  C:\Windows\System\OOtLjsf.exe
  2⤵
  PID:7588
- C:\Windows\System\wYFkVNw.exe
  C:\Windows\System\wYFkVNw.exe
  2⤵
  PID:7616
- C:\Windows\System\YYCYvfe.exe
  C:\Windows\System\YYCYvfe.exe
  2⤵
  PID:7636
- C:\Windows\System\mYHKyIV.exe
  C:\Windows\System\mYHKyIV.exe
  2⤵
  PID:7660
- C:\Windows\System\mpeVJyG.exe
  C:\Windows\System\mpeVJyG.exe
  2⤵
  PID:7688
- C:\Windows\System\usIZAbo.exe
  C:\Windows\System\usIZAbo.exe
  2⤵
  PID:7720
- C:\Windows\System\QEpscLU.exe
  C:\Windows\System\QEpscLU.exe
  2⤵
  PID:7744
- C:\Windows\System\WmsiSwQ.exe
  C:\Windows\System\WmsiSwQ.exe
  2⤵
  PID:7768
- C:\Windows\System\SEzPOKp.exe
  C:\Windows\System\SEzPOKp.exe
  2⤵
  PID:7792
- C:\Windows\System\jZqiqeH.exe
  C:\Windows\System\jZqiqeH.exe
  2⤵
  PID:7828
- C:\Windows\System\VZmMHCt.exe
  C:\Windows\System\VZmMHCt.exe
  2⤵
  PID:7856
- C:\Windows\System\VZTjjcg.exe
  C:\Windows\System\VZTjjcg.exe
  2⤵
  PID:7884
- C:\Windows\System\KmuOaEs.exe
  C:\Windows\System\KmuOaEs.exe
  2⤵
  PID:7900
- C:\Windows\System\XfbFRsj.exe
  C:\Windows\System\XfbFRsj.exe
  2⤵
  PID:7924
- C:\Windows\System\JxawxxL.exe
  C:\Windows\System\JxawxxL.exe
  2⤵
  PID:7952
- C:\Windows\System\ggUQDYi.exe
  C:\Windows\System\ggUQDYi.exe
  2⤵
  PID:7976
- C:\Windows\System\SzpwrRA.exe
  C:\Windows\System\SzpwrRA.exe
  2⤵
  PID:8000
- C:\Windows\System\ubITnad.exe
  C:\Windows\System\ubITnad.exe
  2⤵
  PID:8032
- C:\Windows\System\zaTPxmb.exe
  C:\Windows\System\zaTPxmb.exe
  2⤵
  PID:8060
- C:\Windows\System\BBvLqMU.exe
  C:\Windows\System\BBvLqMU.exe
  2⤵
  PID:8088
- C:\Windows\System\eVbblfI.exe
  C:\Windows\System\eVbblfI.exe
  2⤵
  PID:8116
- C:\Windows\System\PmJNBtb.exe
  C:\Windows\System\PmJNBtb.exe
  2⤵
  PID:8140
- C:\Windows\System\UJAwJri.exe
  C:\Windows\System\UJAwJri.exe
  2⤵
  PID:8156
- C:\Windows\System\IYRATpX.exe
  C:\Windows\System\IYRATpX.exe
  2⤵
  PID:8180
- C:\Windows\System\gwRWCCn.exe
  C:\Windows\System\gwRWCCn.exe
  2⤵
  PID:6680
- C:\Windows\System\uNtdDQA.exe
  C:\Windows\System\uNtdDQA.exe
  2⤵
  PID:5736
- C:\Windows\System\afGqOxk.exe
  C:\Windows\System\afGqOxk.exe
  2⤵
  PID:7188
- C:\Windows\System\ASaJPOo.exe
  C:\Windows\System\ASaJPOo.exe
  2⤵
  PID:7292
- C:\Windows\System\LUmZida.exe
  C:\Windows\System\LUmZida.exe
  2⤵
  PID:7336
- C:\Windows\System\FnpNTWp.exe
  C:\Windows\System\FnpNTWp.exe
  2⤵
  PID:7416
- C:\Windows\System\MWGSicE.exe
  C:\Windows\System\MWGSicE.exe
  2⤵
  PID:7492
- C:\Windows\System\gRXcWAA.exe
  C:\Windows\System\gRXcWAA.exe
  2⤵
  PID:7624
- C:\Windows\System\fsGxMtX.exe
  C:\Windows\System\fsGxMtX.exe
  2⤵
  PID:7512
- C:\Windows\System\fAfflOq.exe
  C:\Windows\System\fAfflOq.exe
  2⤵
  PID:7584
- C:\Windows\System\yFauXwr.exe
  C:\Windows\System\yFauXwr.exe
  2⤵
  PID:7576
- C:\Windows\System\arLWPcb.exe
  C:\Windows\System\arLWPcb.exe
  2⤵
  PID:7732
- C:\Windows\System\XczZQVw.exe
  C:\Windows\System\XczZQVw.exe
  2⤵
  PID:7876
- C:\Windows\System\norTbNA.exe
  C:\Windows\System\norTbNA.exe
  2⤵
  PID:7756
- C:\Windows\System\hGuoQLW.exe
  C:\Windows\System\hGuoQLW.exe
  2⤵
  PID:8016
- C:\Windows\System\okceiJJ.exe
  C:\Windows\System\okceiJJ.exe
  2⤵
  PID:8096
- C:\Windows\System\EfbkYwG.exe
  C:\Windows\System\EfbkYwG.exe
  2⤵
  PID:7996
- C:\Windows\System\dKECcvO.exe
  C:\Windows\System\dKECcvO.exe
  2⤵
  PID:7212
- C:\Windows\System\cDHYlMF.exe
  C:\Windows\System\cDHYlMF.exe
  2⤵
  PID:7388
- C:\Windows\System\XbNWvcw.exe
  C:\Windows\System\XbNWvcw.exe
  2⤵
  PID:6844
- C:\Windows\System\WSNWaiY.exe
  C:\Windows\System\WSNWaiY.exe
  2⤵
  PID:7180
- C:\Windows\System\iTNeLXV.exe
  C:\Windows\System\iTNeLXV.exe
  2⤵
  PID:7568
- C:\Windows\System\NrpOzLp.exe
  C:\Windows\System\NrpOzLp.exe
  2⤵
  PID:7940
- C:\Windows\System\gtwXrye.exe
  C:\Windows\System\gtwXrye.exe
  2⤵
  PID:6532
- C:\Windows\System\BIjIlye.exe
  C:\Windows\System\BIjIlye.exe
  2⤵
  PID:8196
- C:\Windows\System\vlqkDPE.exe
  C:\Windows\System\vlqkDPE.exe
  2⤵
  PID:8220
- C:\Windows\System\tbrMDoJ.exe
  C:\Windows\System\tbrMDoJ.exe
  2⤵
  PID:8248
- C:\Windows\System\HNpDfHR.exe
  C:\Windows\System\HNpDfHR.exe
  2⤵
  PID:8276
- C:\Windows\System\fAPQOIJ.exe
  C:\Windows\System\fAPQOIJ.exe
  2⤵
  PID:8304
- C:\Windows\System\kHfiCeb.exe
  C:\Windows\System\kHfiCeb.exe
  2⤵
  PID:8328
- C:\Windows\System\AsQyHdi.exe
  C:\Windows\System\AsQyHdi.exe
  2⤵
  PID:8352
- C:\Windows\System\KEDJMuB.exe
  C:\Windows\System\KEDJMuB.exe
  2⤵
  PID:8380
- C:\Windows\System\UZtDScE.exe
  C:\Windows\System\UZtDScE.exe
  2⤵
  PID:8404
- C:\Windows\System\ezNytIM.exe
  C:\Windows\System\ezNytIM.exe
  2⤵
  PID:8440
- C:\Windows\System\KbvfzSR.exe
  C:\Windows\System\KbvfzSR.exe
  2⤵
  PID:8468
- C:\Windows\System\sbORfTq.exe
  C:\Windows\System\sbORfTq.exe
  2⤵
  PID:8492
- C:\Windows\System\ZiwgDWl.exe
  C:\Windows\System\ZiwgDWl.exe
  2⤵
  PID:8516
- C:\Windows\System\nJGLmsq.exe
  C:\Windows\System\nJGLmsq.exe
  2⤵
  PID:8544
- C:\Windows\System\hRCJIws.exe
  C:\Windows\System\hRCJIws.exe
  2⤵
  PID:8576
- C:\Windows\System\QIHVytA.exe
  C:\Windows\System\QIHVytA.exe
  2⤵
  PID:8604
- C:\Windows\System\fMpepGa.exe
  C:\Windows\System\fMpepGa.exe
  2⤵
  PID:8628
- C:\Windows\System\MhnPfMq.exe
  C:\Windows\System\MhnPfMq.exe
  2⤵
  PID:8648
- C:\Windows\System\xXUtYVE.exe
  C:\Windows\System\xXUtYVE.exe
  2⤵
  PID:8680
- C:\Windows\System\CwPlUhy.exe
  C:\Windows\System\CwPlUhy.exe
  2⤵
  PID:8704
- C:\Windows\System\jEMXJzF.exe
  C:\Windows\System\jEMXJzF.exe
  2⤵
  PID:8744
- C:\Windows\System\AbSkONN.exe
  C:\Windows\System\AbSkONN.exe
  2⤵
  PID:8768
- C:\Windows\System\eWOUhTN.exe
  C:\Windows\System\eWOUhTN.exe
  2⤵
  PID:8796
- C:\Windows\System\QeuAQYY.exe
  C:\Windows\System\QeuAQYY.exe
  2⤵
  PID:8820
- C:\Windows\System\mqhRIdO.exe
  C:\Windows\System\mqhRIdO.exe
  2⤵
  PID:8840
- C:\Windows\System\gamCsaI.exe
  C:\Windows\System\gamCsaI.exe
  2⤵
  PID:8860
- C:\Windows\System\OyDSKRt.exe
  C:\Windows\System\OyDSKRt.exe
  2⤵
  PID:8896
- C:\Windows\System\DqnbykT.exe
  C:\Windows\System\DqnbykT.exe
  2⤵
  PID:8920
- C:\Windows\System\zNoCQdM.exe
  C:\Windows\System\zNoCQdM.exe
  2⤵
  PID:8948
- C:\Windows\System\rXetcUN.exe
  C:\Windows\System\rXetcUN.exe
  2⤵
  PID:8968
- C:\Windows\System\yoWvzHD.exe
  C:\Windows\System\yoWvzHD.exe
  2⤵
  PID:8992
- C:\Windows\System\oomAdpt.exe
  C:\Windows\System\oomAdpt.exe
  2⤵
  PID:9016
- C:\Windows\System\URzsrSW.exe
  C:\Windows\System\URzsrSW.exe
  2⤵
  PID:9036
- C:\Windows\System\DMptzrj.exe
  C:\Windows\System\DMptzrj.exe
  2⤵
  PID:9068
- C:\Windows\System\qPUXojc.exe
  C:\Windows\System\qPUXojc.exe
  2⤵
  PID:9088
- C:\Windows\System\LWVbfqR.exe
  C:\Windows\System\LWVbfqR.exe
  2⤵
  PID:9108
- C:\Windows\System\oqwoPJr.exe
  C:\Windows\System\oqwoPJr.exe
  2⤵
  PID:9140
- C:\Windows\System\mKRgJKz.exe
  C:\Windows\System\mKRgJKz.exe
  2⤵
  PID:9176
- C:\Windows\System\HHoEoNL.exe
  C:\Windows\System\HHoEoNL.exe
  2⤵
  PID:9204
- C:\Windows\System\TapMZSJ.exe
  C:\Windows\System\TapMZSJ.exe
  2⤵
  PID:8068
- C:\Windows\System\cxEkOMC.exe
  C:\Windows\System\cxEkOMC.exe
  2⤵
  PID:7920
- C:\Windows\System\KatNsSR.exe
  C:\Windows\System\KatNsSR.exe
  2⤵
  PID:7404
- C:\Windows\System\iKjHhVx.exe
  C:\Windows\System\iKjHhVx.exe
  2⤵
  PID:8232
- C:\Windows\System\cDUWgVV.exe
  C:\Windows\System\cDUWgVV.exe
  2⤵
  PID:8272
- C:\Windows\System\gJjzxzt.exe
  C:\Windows\System\gJjzxzt.exe
  2⤵
  PID:8208
- C:\Windows\System\MRcfVqU.exe
  C:\Windows\System\MRcfVqU.exe
  2⤵
  PID:8372
- C:\Windows\System\OxOlfEp.exe
  C:\Windows\System\OxOlfEp.exe
  2⤵
  PID:8416
- C:\Windows\System\fzCORQZ.exe
  C:\Windows\System\fzCORQZ.exe
  2⤵
  PID:8528
- C:\Windows\System\gppQXzh.exe
  C:\Windows\System\gppQXzh.exe
  2⤵
  PID:8452
- C:\Windows\System\IltiNGt.exe
  C:\Windows\System\IltiNGt.exe
  2⤵
  PID:8364
- C:\Windows\System\NGVpLwi.exe
  C:\Windows\System\NGVpLwi.exe
  2⤵
  PID:8672
- C:\Windows\System\xYXOFMP.exe
  C:\Windows\System\xYXOFMP.exe
  2⤵
  PID:8792
- C:\Windows\System\JjJgxTc.exe
  C:\Windows\System\JjJgxTc.exe
  2⤵
  PID:8728
- C:\Windows\System\pWLtujh.exe
  C:\Windows\System\pWLtujh.exe
  2⤵
  PID:8596
- C:\Windows\System\AlrRokk.exe
  C:\Windows\System\AlrRokk.exe
  2⤵
  PID:8764
- C:\Windows\System\FKsmkEP.exe
  C:\Windows\System\FKsmkEP.exe
  2⤵
  PID:8828
- C:\Windows\System\ltCYSxY.exe
  C:\Windows\System\ltCYSxY.exe
  2⤵
  PID:9044
- C:\Windows\System\dlGtqyZ.exe
  C:\Windows\System\dlGtqyZ.exe
  2⤵
  PID:9008
- C:\Windows\System\lymahrE.exe
  C:\Windows\System\lymahrE.exe
  2⤵
  PID:8956
- C:\Windows\System\uuYpPsi.exe
  C:\Windows\System\uuYpPsi.exe
  2⤵
  PID:7628
- C:\Windows\System\JGisUer.exe
  C:\Windows\System\JGisUer.exe
  2⤵
  PID:9152
- C:\Windows\System\RoRUGdd.exe
  C:\Windows\System\RoRUGdd.exe
  2⤵
  PID:9012
- C:\Windows\System\oMrnRYx.exe
  C:\Windows\System\oMrnRYx.exe
  2⤵
  PID:7264
- C:\Windows\System\FpSzIEi.exe
  C:\Windows\System\FpSzIEi.exe
  2⤵
  PID:8488
- C:\Windows\System\HdlbKMX.exe
  C:\Windows\System\HdlbKMX.exe
  2⤵
  PID:8836
- C:\Windows\System\iWrKZZG.exe
  C:\Windows\System\iWrKZZG.exe
  2⤵
  PID:8480
- C:\Windows\System\mSuByDk.exe
  C:\Windows\System\mSuByDk.exe
  2⤵
  PID:9060
- C:\Windows\System\QYEdQLM.exe
  C:\Windows\System\QYEdQLM.exe
  2⤵
  PID:9240
- C:\Windows\System\WSLyano.exe
  C:\Windows\System\WSLyano.exe
  2⤵
  PID:9264
- C:\Windows\System\XmCJffr.exe
  C:\Windows\System\XmCJffr.exe
  2⤵
  PID:9292
- C:\Windows\System\EaAawjQ.exe
  C:\Windows\System\EaAawjQ.exe
  2⤵
  PID:9316
- C:\Windows\System\PgxAPtS.exe
  C:\Windows\System\PgxAPtS.exe
  2⤵
  PID:9340
- C:\Windows\System\ivFfRkY.exe
  C:\Windows\System\ivFfRkY.exe
  2⤵
  PID:9372
- C:\Windows\System\FyfFSZf.exe
  C:\Windows\System\FyfFSZf.exe
  2⤵
  PID:9396
- C:\Windows\System\KVrALrO.exe
  C:\Windows\System\KVrALrO.exe
  2⤵
  PID:9416
- C:\Windows\System\krYChyf.exe
  C:\Windows\System\krYChyf.exe
  2⤵
  PID:9452
- C:\Windows\System\yQmEvDi.exe
  C:\Windows\System\yQmEvDi.exe
  2⤵
  PID:9480
- C:\Windows\System\HnCuniy.exe
  C:\Windows\System\HnCuniy.exe
  2⤵
  PID:9508
- C:\Windows\System\DyUWezg.exe
  C:\Windows\System\DyUWezg.exe
  2⤵
  PID:9536
- C:\Windows\System\dJlPXeq.exe
  C:\Windows\System\dJlPXeq.exe
  2⤵
  PID:9560
- C:\Windows\System\UTTTJtA.exe
  C:\Windows\System\UTTTJtA.exe
  2⤵
  PID:9584
- C:\Windows\System\Ovlfdxe.exe
  C:\Windows\System\Ovlfdxe.exe
  2⤵
  PID:9608
- C:\Windows\System\fFUuzKY.exe
  C:\Windows\System\fFUuzKY.exe
  2⤵
  PID:9628
- C:\Windows\System\nuffVDc.exe
  C:\Windows\System\nuffVDc.exe
  2⤵
  PID:9644
- C:\Windows\System\CeFaVSu.exe
  C:\Windows\System\CeFaVSu.exe
  2⤵
  PID:9668
- C:\Windows\System\KkSazva.exe
  C:\Windows\System\KkSazva.exe
  2⤵
  PID:9696
- C:\Windows\System\SlrBnpR.exe
  C:\Windows\System\SlrBnpR.exe
  2⤵
  PID:9724
- C:\Windows\System\QCkLumy.exe
  C:\Windows\System\QCkLumy.exe
  2⤵
  PID:9748
- C:\Windows\System\etRrCEF.exe
  C:\Windows\System\etRrCEF.exe
  2⤵
  PID:9780
- C:\Windows\System\oblHCzS.exe
  C:\Windows\System\oblHCzS.exe
  2⤵
  PID:9808
- C:\Windows\System\rEdAzpo.exe
  C:\Windows\System\rEdAzpo.exe
  2⤵
  PID:9832
- C:\Windows\System\XhpenAt.exe
  C:\Windows\System\XhpenAt.exe
  2⤵
  PID:9852
- C:\Windows\System\uPuLuNq.exe
  C:\Windows\System\uPuLuNq.exe
  2⤵
  PID:9872
- C:\Windows\System\wxyAxMv.exe
  C:\Windows\System\wxyAxMv.exe
  2⤵
  PID:9896
- C:\Windows\System\kDeOpOO.exe
  C:\Windows\System\kDeOpOO.exe
  2⤵
  PID:9924
- C:\Windows\System\vILlwsa.exe
  C:\Windows\System\vILlwsa.exe
  2⤵
  PID:9956
- C:\Windows\System\CNQSJTX.exe
  C:\Windows\System\CNQSJTX.exe
  2⤵
  PID:9980
- C:\Windows\System\PYBkLFC.exe
  C:\Windows\System\PYBkLFC.exe
  2⤵
  PID:10012
- C:\Windows\System\CTXNGdl.exe
  C:\Windows\System\CTXNGdl.exe
  2⤵
  PID:10036
- C:\Windows\System\ySajmwm.exe
  C:\Windows\System\ySajmwm.exe
  2⤵
  PID:10064
- C:\Windows\System\ZkQSZig.exe
  C:\Windows\System\ZkQSZig.exe
  2⤵
  PID:10096
- C:\Windows\System\ujfjrvf.exe
  C:\Windows\System\ujfjrvf.exe
  2⤵
  PID:10124
- C:\Windows\System\NlMYYcW.exe
  C:\Windows\System\NlMYYcW.exe
  2⤵
  PID:10156
- C:\Windows\System\TUphRER.exe
  C:\Windows\System\TUphRER.exe
  2⤵
  PID:10184
- C:\Windows\System\kAVlsdI.exe
  C:\Windows\System\kAVlsdI.exe
  2⤵
  PID:10208
- C:\Windows\System\gbJjJKv.exe
  C:\Windows\System\gbJjJKv.exe
  2⤵
  PID:10236
- C:\Windows\System\vXxrmOZ.exe
  C:\Windows\System\vXxrmOZ.exe
  2⤵
  PID:8320
- C:\Windows\System\YXMlLEz.exe
  C:\Windows\System\YXMlLEz.exe
  2⤵
  PID:7988
- C:\Windows\System\LNbfVPp.exe
  C:\Windows\System\LNbfVPp.exe
  2⤵
  PID:9248
- C:\Windows\System\SUEoZLR.exe
  C:\Windows\System\SUEoZLR.exe
  2⤵
  PID:8396
- C:\Windows\System\YhexBeE.exe
  C:\Windows\System\YhexBeE.exe
  2⤵
  PID:8784
- C:\Windows\System\KQAwILn.exe
  C:\Windows\System\KQAwILn.exe
  2⤵
  PID:9052
- C:\Windows\System\acBlZun.exe
  C:\Windows\System\acBlZun.exe
  2⤵
  PID:9520
- C:\Windows\System\cnijaEV.exe
  C:\Windows\System\cnijaEV.exe
  2⤵
  PID:9328
- C:\Windows\System\KRdHBgt.exe
  C:\Windows\System\KRdHBgt.exe
  2⤵
  PID:9464
- C:\Windows\System\kCBulIa.exe
  C:\Windows\System\kCBulIa.exe
  2⤵
  PID:9260
- C:\Windows\System\VaCgEfl.exe
  C:\Windows\System\VaCgEfl.exe
  2⤵
  PID:9312
- C:\Windows\System\geCTwFF.exe
  C:\Windows\System\geCTwFF.exe
  2⤵
  PID:9432
- C:\Windows\System\hEcfwfM.exe
  C:\Windows\System\hEcfwfM.exe
  2⤵
  PID:9920
- C:\Windows\System\lQjrvxD.exe
  C:\Windows\System\lQjrvxD.exe
  2⤵
  PID:9736
- C:\Windows\System\cJGnnqm.exe
  C:\Windows\System\cJGnnqm.exe
  2⤵
  PID:9824
- C:\Windows\System\AwQlNSu.exe
  C:\Windows\System\AwQlNSu.exe
  2⤵
  PID:9848
- C:\Windows\System\zMrXYuA.exe
  C:\Windows\System\zMrXYuA.exe
  2⤵
  PID:10176
- C:\Windows\System\NQxYuQw.exe
  C:\Windows\System\NQxYuQw.exe
  2⤵
  PID:8664
- C:\Windows\System\UfmkrlA.exe
  C:\Windows\System\UfmkrlA.exe
  2⤵
  PID:9804
- C:\Windows\System\QLaYSnx.exe
  C:\Windows\System\QLaYSnx.exe
  2⤵
  PID:10140
- C:\Windows\System\qRZZsCG.exe
  C:\Windows\System\qRZZsCG.exe
  2⤵
  PID:8892
- C:\Windows\System\VuTVNFQ.exe
  C:\Windows\System\VuTVNFQ.exe
  2⤵
  PID:9552
- C:\Windows\System\yNklphk.exe
  C:\Windows\System\yNklphk.exe
  2⤵
  PID:9968
- C:\Windows\System\fnnugYy.exe
  C:\Windows\System\fnnugYy.exe
  2⤵
  PID:8928
- C:\Windows\System\tixZfLH.exe
  C:\Windows\System\tixZfLH.exe
  2⤵
  PID:9288
- C:\Windows\System\dENaaXX.exe
  C:\Windows\System\dENaaXX.exe
  2⤵
  PID:10248
- C:\Windows\System\UMfhiNN.exe
  C:\Windows\System\UMfhiNN.exe
  2⤵
  PID:10280
- C:\Windows\System\LiLXLsC.exe
  C:\Windows\System\LiLXLsC.exe
  2⤵
  PID:10308
- C:\Windows\System\UgXPvcH.exe
  C:\Windows\System\UgXPvcH.exe
  2⤵
  PID:10336
- C:\Windows\System\fJOXvOJ.exe
  C:\Windows\System\fJOXvOJ.exe
  2⤵
  PID:10356
- C:\Windows\System\tLaWCnI.exe
  C:\Windows\System\tLaWCnI.exe
  2⤵
  PID:10388
- C:\Windows\System\XdMaswJ.exe
  C:\Windows\System\XdMaswJ.exe
  2⤵
  PID:10420
- C:\Windows\System\ENgbxfy.exe
  C:\Windows\System\ENgbxfy.exe
  2⤵
  PID:10520
- C:\Windows\System\QeLVdRs.exe
  C:\Windows\System\QeLVdRs.exe
  2⤵
  PID:10556
- C:\Windows\System\FfMWbLN.exe
  C:\Windows\System\FfMWbLN.exe
  2⤵
  PID:10588
- C:\Windows\System\hISEGwK.exe
  C:\Windows\System\hISEGwK.exe
  2⤵
  PID:10616
- C:\Windows\System\oEOBcZx.exe
  C:\Windows\System\oEOBcZx.exe
  2⤵
  PID:10648
- C:\Windows\System\ZPzWgaR.exe
  C:\Windows\System\ZPzWgaR.exe
  2⤵
  PID:10676
- C:\Windows\System\GlvAYje.exe
  C:\Windows\System\GlvAYje.exe
  2⤵
  PID:10704
- C:\Windows\System\PhOcwQr.exe
  C:\Windows\System\PhOcwQr.exe
  2⤵
  PID:10744
- C:\Windows\System\BCRilYZ.exe
  C:\Windows\System\BCRilYZ.exe
  2⤵
  PID:10772
- C:\Windows\System\AuOzQtA.exe
  C:\Windows\System\AuOzQtA.exe
  2⤵
  PID:10808
- C:\Windows\System\rpCyWrR.exe
  C:\Windows\System\rpCyWrR.exe
  2⤵
  PID:10836
- C:\Windows\System\hvnvulm.exe
  C:\Windows\System\hvnvulm.exe
  2⤵
  PID:10864
- C:\Windows\System\JUDTRGx.exe
  C:\Windows\System\JUDTRGx.exe
  2⤵
  PID:10896
- C:\Windows\System\LiafJlx.exe
  C:\Windows\System\LiafJlx.exe
  2⤵
  PID:10924
- C:\Windows\System\fvmjGwd.exe
  C:\Windows\System\fvmjGwd.exe
  2⤵
  PID:10964
- C:\Windows\System\KoJelXZ.exe
  C:\Windows\System\KoJelXZ.exe
  2⤵
  PID:10996
- C:\Windows\System\WNkATkj.exe
  C:\Windows\System\WNkATkj.exe
  2⤵
  PID:11016
- C:\Windows\System\OKcwjQn.exe
  C:\Windows\System\OKcwjQn.exe
  2⤵
  PID:11112
- C:\Windows\System\HSMFGzm.exe
  C:\Windows\System\HSMFGzm.exe
  2⤵
  PID:11140
- C:\Windows\System\pxQOdVl.exe
  C:\Windows\System\pxQOdVl.exe
  2⤵
  PID:11168
- C:\Windows\System\aaCfdYe.exe
  C:\Windows\System\aaCfdYe.exe
  2⤵
  PID:11192
- C:\Windows\System\kVAzMdw.exe
  C:\Windows\System\kVAzMdw.exe
  2⤵
  PID:11216
- C:\Windows\System\VsiASZI.exe
  C:\Windows\System\VsiASZI.exe
  2⤵
  PID:11256
- C:\Windows\System\mhVxdOC.exe
  C:\Windows\System\mhVxdOC.exe
  2⤵
  PID:10076
- C:\Windows\System\jocHfLx.exe
  C:\Windows\System\jocHfLx.exe
  2⤵
  PID:9884
- C:\Windows\System\mrAugtn.exe
  C:\Windows\System\mrAugtn.exe
  2⤵
  PID:9548
- C:\Windows\System\IiYyMQV.exe
  C:\Windows\System\IiYyMQV.exe
  2⤵
  PID:8700
- C:\Windows\System\CHidZAS.exe
  C:\Windows\System\CHidZAS.exe
  2⤵
  PID:10120
- C:\Windows\System\lnjuUqK.exe
  C:\Windows\System\lnjuUqK.exe
  2⤵
  PID:9964
- C:\Windows\System\jepThYi.exe
  C:\Windows\System\jepThYi.exe
  2⤵
  PID:10416
- C:\Windows\System\tFcpRGd.exe
  C:\Windows\System\tFcpRGd.exe
  2⤵
  PID:9720
- C:\Windows\System\VMwqvwX.exe
  C:\Windows\System\VMwqvwX.exe
  2⤵
  PID:10228
- C:\Windows\System\sKJHdGN.exe
  C:\Windows\System\sKJHdGN.exe
  2⤵
  PID:9516
- C:\Windows\System\ZEKYFUk.exe
  C:\Windows\System\ZEKYFUk.exe
  2⤵
  PID:10276
- C:\Windows\System\aKHvxar.exe
  C:\Windows\System\aKHvxar.exe
  2⤵
  PID:10428
- C:\Windows\System\uOZszvP.exe
  C:\Windows\System\uOZszvP.exe
  2⤵
  PID:10548
- C:\Windows\System\Qceabrk.exe
  C:\Windows\System\Qceabrk.exe
  2⤵
  PID:10512
- C:\Windows\System\XONYYIr.exe
  C:\Windows\System\XONYYIr.exe
  2⤵
  PID:10684
- C:\Windows\System\cBMtdAF.exe
  C:\Windows\System\cBMtdAF.exe
  2⤵
  PID:10904
- C:\Windows\System\mtHYokb.exe
  C:\Windows\System\mtHYokb.exe
  2⤵
  PID:10740
- C:\Windows\System\OeHtHPb.exe
  C:\Windows\System\OeHtHPb.exe
  2⤵
  PID:11072
- C:\Windows\System\sMMAswo.exe
  C:\Windows\System\sMMAswo.exe
  2⤵
  PID:11108
- C:\Windows\System\AVjEbBF.exe
  C:\Windows\System\AVjEbBF.exe
  2⤵
  PID:11160
- C:\Windows\System\nAOzJvh.exe
  C:\Windows\System\nAOzJvh.exe
  2⤵
  PID:11024
- C:\Windows\System\NLMGkAF.exe
  C:\Windows\System\NLMGkAF.exe
  2⤵
  PID:8084
- C:\Windows\System\zTzZKwd.exe
  C:\Windows\System\zTzZKwd.exe
  2⤵
  PID:10396
- C:\Windows\System\rQQtmoL.exe
  C:\Windows\System\rQQtmoL.exe
  2⤵
  PID:10332
- C:\Windows\System\uvRCQRM.exe
  C:\Windows\System\uvRCQRM.exe
  2⤵
  PID:6472
- C:\Windows\System\SvdPNGD.exe
  C:\Windows\System\SvdPNGD.exe
  2⤵
  PID:10480
- C:\Windows\System\BsPSDIi.exe
  C:\Windows\System\BsPSDIi.exe
  2⤵
  PID:10272
- C:\Windows\System\JrxFOWy.exe
  C:\Windows\System\JrxFOWy.exe
  2⤵
  PID:10936
- C:\Windows\System\QcVAKVc.exe
  C:\Windows\System\QcVAKVc.exe
  2⤵
  PID:10604
- C:\Windows\System\XHOQDXt.exe
  C:\Windows\System\XHOQDXt.exe
  2⤵
  PID:10696
- C:\Windows\System\EWngbjT.exe
  C:\Windows\System\EWngbjT.exe
  2⤵
  PID:10920
- C:\Windows\System\NCxuvzd.exe
  C:\Windows\System\NCxuvzd.exe
  2⤵
  PID:11012
- C:\Windows\System\nQHfoan.exe
  C:\Windows\System\nQHfoan.exe
  2⤵
  PID:11148
- C:\Windows\System\YZvYvDR.exe
  C:\Windows\System\YZvYvDR.exe
  2⤵
  PID:11004
- C:\Windows\System\zXYGgzK.exe
  C:\Windows\System\zXYGgzK.exe
  2⤵
  PID:11204
- C:\Windows\System\NSvhwcI.exe
  C:\Windows\System\NSvhwcI.exe
  2⤵
  PID:8736
- C:\Windows\System\IZBMFZZ.exe
  C:\Windows\System\IZBMFZZ.exe
  2⤵
  PID:11288
- C:\Windows\System\FCmBaHg.exe
  C:\Windows\System\FCmBaHg.exe
  2⤵
  PID:11312
- C:\Windows\System\apccTOh.exe
  C:\Windows\System\apccTOh.exe
  2⤵
  PID:11340
- C:\Windows\System\MtZnuuz.exe
  C:\Windows\System\MtZnuuz.exe
  2⤵
  PID:11368
- C:\Windows\System\DAhHDZr.exe
  C:\Windows\System\DAhHDZr.exe
  2⤵
  PID:11416
- C:\Windows\System\dvvGGUS.exe
  C:\Windows\System\dvvGGUS.exe
  2⤵
  PID:11448
- C:\Windows\System\OabsZgN.exe
  C:\Windows\System\OabsZgN.exe
  2⤵
  PID:11476
- C:\Windows\System\OKuxHcO.exe
  C:\Windows\System\OKuxHcO.exe
  2⤵
  PID:11500
- C:\Windows\System\DSBGYvJ.exe
  C:\Windows\System\DSBGYvJ.exe
  2⤵
  PID:11528
- C:\Windows\System\fxLlmcd.exe
  C:\Windows\System\fxLlmcd.exe
  2⤵
  PID:11552
- C:\Windows\System\jUoaasl.exe
  C:\Windows\System\jUoaasl.exe
  2⤵
  PID:11572
- C:\Windows\System\wGAYRKk.exe
  C:\Windows\System\wGAYRKk.exe
  2⤵
  PID:11612
- C:\Windows\System\ezHCMZO.exe
  C:\Windows\System\ezHCMZO.exe
  2⤵
  PID:11636
- C:\Windows\System\VYclmiV.exe
  C:\Windows\System\VYclmiV.exe
  2⤵
  PID:11656
- C:\Windows\System\GgCATrF.exe
  C:\Windows\System\GgCATrF.exe
  2⤵
  PID:11680
- C:\Windows\System\LQbTXGp.exe
  C:\Windows\System\LQbTXGp.exe
  2⤵
  PID:11712
- C:\Windows\System\lsyTRTS.exe
  C:\Windows\System\lsyTRTS.exe
  2⤵
  PID:11744
- C:\Windows\System\GPPLwAf.exe
  C:\Windows\System\GPPLwAf.exe
  2⤵
  PID:11776
- C:\Windows\System\cTbohbd.exe
  C:\Windows\System\cTbohbd.exe
  2⤵
  PID:11804
- C:\Windows\System\saInBDg.exe
  C:\Windows\System\saInBDg.exe
  2⤵
  PID:11832
- C:\Windows\System\HpcpBhD.exe
  C:\Windows\System\HpcpBhD.exe
  2⤵
  PID:11868
- C:\Windows\System\ZrCESkO.exe
  C:\Windows\System\ZrCESkO.exe
  2⤵
  PID:11896
- C:\Windows\System\PdBBagd.exe
  C:\Windows\System\PdBBagd.exe
  2⤵
  PID:11924
- C:\Windows\System\AwKMVbj.exe
  C:\Windows\System\AwKMVbj.exe
  2⤵
  PID:11952
- C:\Windows\System\bXULYZW.exe
  C:\Windows\System\bXULYZW.exe
  2⤵
  PID:11980
- C:\Windows\System\mCBRYYQ.exe
  C:\Windows\System\mCBRYYQ.exe
  2⤵
  PID:12016
- C:\Windows\System\waMjgxA.exe
  C:\Windows\System\waMjgxA.exe
  2⤵
  PID:12036
- C:\Windows\System\xkJslfY.exe
  C:\Windows\System\xkJslfY.exe
  2⤵
  PID:12060
- C:\Windows\System\jKBSSBY.exe
  C:\Windows\System\jKBSSBY.exe
  2⤵
  PID:12088
- C:\Windows\System\QQyMygx.exe
  C:\Windows\System\QQyMygx.exe
  2⤵
  PID:12116
- C:\Windows\System\aLTIRsP.exe
  C:\Windows\System\aLTIRsP.exe
  2⤵
  PID:12144
- C:\Windows\System\mwsqUVN.exe
  C:\Windows\System\mwsqUVN.exe
  2⤵
  PID:12168
- C:\Windows\System\LAsyEZN.exe
  C:\Windows\System\LAsyEZN.exe
  2⤵
  PID:12196
- C:\Windows\System\YRWxyab.exe
  C:\Windows\System\YRWxyab.exe
  2⤵
  PID:12224
- C:\Windows\System\ppkOiDV.exe
  C:\Windows\System\ppkOiDV.exe
  2⤵
  PID:12244
- C:\Windows\System\ucIkwAS.exe
  C:\Windows\System\ucIkwAS.exe
  2⤵
  PID:12280
- C:\Windows\System\pJLqCFN.exe
  C:\Windows\System\pJLqCFN.exe
  2⤵
  PID:9096
- C:\Windows\System\OQvpAnh.exe
  C:\Windows\System\OQvpAnh.exe
  2⤵
  PID:11324
- C:\Windows\System\PwaWpbk.exe
  C:\Windows\System\PwaWpbk.exe
  2⤵
  PID:9972
- C:\Windows\System\mPeNKim.exe
  C:\Windows\System\mPeNKim.exe
  2⤵
  PID:11408
- C:\Windows\System\WGIjNLg.exe
  C:\Windows\System\WGIjNLg.exe
  2⤵
  PID:11456
- C:\Windows\System\HnNASZq.exe
  C:\Windows\System\HnNASZq.exe
  2⤵
  PID:11304
- C:\Windows\System\KHvwAPk.exe
  C:\Windows\System\KHvwAPk.exe
  2⤵
  PID:11512
- C:\Windows\System\PQMNQzm.exe
  C:\Windows\System\PQMNQzm.exe
  2⤵
  PID:11428
- C:\Windows\System\fnUDSej.exe
  C:\Windows\System\fnUDSej.exe
  2⤵
  PID:11692
- C:\Windows\System\oKTNXnZ.exe
  C:\Windows\System\oKTNXnZ.exe
  2⤵
  PID:11708
- C:\Windows\System\gnZiJIL.exe
  C:\Windows\System\gnZiJIL.exe
  2⤵
  PID:11792
- C:\Windows\System\eAraLxa.exe
  C:\Windows\System\eAraLxa.exe
  2⤵
  PID:11948
- C:\Windows\System\fIDrVpN.exe
  C:\Windows\System\fIDrVpN.exe
  2⤵
  PID:11852
- C:\Windows\System\cyQuyUM.exe
  C:\Windows\System\cyQuyUM.exe
  2⤵
  PID:11732
- C:\Windows\System\vJGJOpl.exe
  C:\Windows\System\vJGJOpl.exe
  2⤵
  PID:11932
- C:\Windows\System\WlLKotI.exe
  C:\Windows\System\WlLKotI.exe
  2⤵
  PID:11936
- C:\Windows\System\GyeYguM.exe
  C:\Windows\System\GyeYguM.exe
  2⤵
  PID:11880
- C:\Windows\System\FBBqhCl.exe
  C:\Windows\System\FBBqhCl.exe
  2⤵
  PID:12004
- C:\Windows\System\SLnXjgs.exe
  C:\Windows\System\SLnXjgs.exe
  2⤵
  PID:10956
- C:\Windows\System\QsZuDuq.exe
  C:\Windows\System\QsZuDuq.exe
  2⤵
  PID:12108
- C:\Windows\System\sfGLsob.exe
  C:\Windows\System\sfGLsob.exe
  2⤵
  PID:8696
- C:\Windows\System\qYHtYGW.exe
  C:\Windows\System\qYHtYGW.exe
  2⤵
  PID:11580
- C:\Windows\System\xHnsefE.exe
  C:\Windows\System\xHnsefE.exe
  2⤵
  PID:12256
- C:\Windows\System\JyTejZd.exe
  C:\Windows\System\JyTejZd.exe
  2⤵
  PID:9160
- C:\Windows\System\JxXBUue.exe
  C:\Windows\System\JxXBUue.exe
  2⤵
  PID:12316
- C:\Windows\System\vyqCJvi.exe
  C:\Windows\System\vyqCJvi.exe
  2⤵
  PID:12332
- C:\Windows\System\inhikHM.exe
  C:\Windows\System\inhikHM.exe
  2⤵
  PID:12360
- C:\Windows\System\EQPeKaM.exe
  C:\Windows\System\EQPeKaM.exe
  2⤵
  PID:12384
- C:\Windows\System\hutVKaY.exe
  C:\Windows\System\hutVKaY.exe
  2⤵
  PID:12408
- C:\Windows\System\eUVJdUn.exe
  C:\Windows\System\eUVJdUn.exe
  2⤵
  PID:12432
- C:\Windows\System\jqZmYDX.exe
  C:\Windows\System\jqZmYDX.exe
  2⤵
  PID:12452
- C:\Windows\System\clCEhyq.exe
  C:\Windows\System\clCEhyq.exe
  2⤵
  PID:12476
- C:\Windows\System\WPqKOcE.exe
  C:\Windows\System\WPqKOcE.exe
  2⤵
  PID:12504
- C:\Windows\System\QsgMKQd.exe
  C:\Windows\System\QsgMKQd.exe
  2⤵
  PID:12528
- C:\Windows\System\ctepaQd.exe
  C:\Windows\System\ctepaQd.exe
  2⤵
  PID:12556
- C:\Windows\System\KkjNtcY.exe
  C:\Windows\System\KkjNtcY.exe
  2⤵
  PID:12576
- C:\Windows\System\xblaVpU.exe
  C:\Windows\System\xblaVpU.exe
  2⤵
  PID:12592
- C:\Windows\System\ZrElGui.exe
  C:\Windows\System\ZrElGui.exe
  2⤵
  PID:12616
- C:\Windows\System\cSNzRMs.exe
  C:\Windows\System\cSNzRMs.exe
  2⤵
  PID:12636
- C:\Windows\System\TwnjKVl.exe
  C:\Windows\System\TwnjKVl.exe
  2⤵
  PID:12660
- C:\Windows\System\YlTuIcy.exe
  C:\Windows\System\YlTuIcy.exe
  2⤵
  PID:12684
- C:\Windows\System\AgJHFcg.exe
  C:\Windows\System\AgJHFcg.exe
  2⤵
  PID:12708
- C:\Windows\System\xEorbBV.exe
  C:\Windows\System\xEorbBV.exe
  2⤵
  PID:12736
- C:\Windows\System\yXsORjn.exe
  C:\Windows\System\yXsORjn.exe
  2⤵
  PID:12768
- C:\Windows\System\JEKOpyi.exe
  C:\Windows\System\JEKOpyi.exe
  2⤵
  PID:12800
- C:\Windows\System\WrrvsUT.exe
  C:\Windows\System\WrrvsUT.exe
  2⤵
  PID:12820
- C:\Windows\System\EfkiJLL.exe
  C:\Windows\System\EfkiJLL.exe
  2⤵
  PID:12848
- C:\Windows\System\qQoimbf.exe
  C:\Windows\System\qQoimbf.exe
  2⤵
  PID:12864
- C:\Windows\System\fiSGJEm.exe
  C:\Windows\System\fiSGJEm.exe
  2⤵
  PID:12888
- C:\Windows\System\kkArXAY.exe
  C:\Windows\System\kkArXAY.exe
  2⤵
  PID:12912
- C:\Windows\System\wmsmbse.exe
  C:\Windows\System\wmsmbse.exe
  2⤵
  PID:12932
- C:\Windows\System\XrbgmdW.exe
  C:\Windows\System\XrbgmdW.exe
  2⤵
  PID:12952
- C:\Windows\System\ykOXFqf.exe
  C:\Windows\System\ykOXFqf.exe
  2⤵
  PID:12984
- C:\Windows\System\QhwElyn.exe
  C:\Windows\System\QhwElyn.exe
  2⤵
  PID:13016
- C:\Windows\System\HjYTdjy.exe
  C:\Windows\System\HjYTdjy.exe
  2⤵
  PID:13052
- C:\Windows\System\RfnYbgM.exe
  C:\Windows\System\RfnYbgM.exe
  2⤵
  PID:13072
- C:\Windows\System\bTQdJGQ.exe
  C:\Windows\System\bTQdJGQ.exe
  2⤵
  PID:13096
- C:\Windows\System\yiyckWt.exe
  C:\Windows\System\yiyckWt.exe
  2⤵
  PID:13120
- C:\Windows\System\zJAJNWL.exe
  C:\Windows\System\zJAJNWL.exe
  2⤵
  PID:13152
- C:\Windows\System\eajYoUq.exe
  C:\Windows\System\eajYoUq.exe
  2⤵
  PID:13168
- C:\Windows\System\RoeuLLD.exe
  C:\Windows\System\RoeuLLD.exe
  2⤵
  PID:13184
- C:\Windows\System\SMoRron.exe
  C:\Windows\System\SMoRron.exe
  2⤵
  PID:13204
- C:\Windows\System\tTyHrvu.exe
  C:\Windows\System\tTyHrvu.exe
  2⤵
  PID:13228
- C:\Windows\System\QBNXqxn.exe
  C:\Windows\System\QBNXqxn.exe
  2⤵
  PID:13248
- C:\Windows\System\njyTtXY.exe
  C:\Windows\System\njyTtXY.exe
  2⤵
  PID:13264
- C:\Windows\System\hTuzNME.exe
  C:\Windows\System\hTuzNME.exe
  2⤵
  PID:13284
- C:\Windows\System\dSzEcKM.exe
  C:\Windows\System\dSzEcKM.exe
  2⤵
  PID:12304
- C:\Windows\System\CXhfsxA.exe
  C:\Windows\System\CXhfsxA.exe
  2⤵
  PID:12372
- C:\Windows\System\rEhlVQl.exe
  C:\Windows\System\rEhlVQl.exe
  2⤵
  PID:12440
- C:\Windows\System\QPAAyqu.exe
  C:\Windows\System\QPAAyqu.exe
  2⤵
  PID:12472
- C:\Windows\System\MpkuRAT.exe
  C:\Windows\System\MpkuRAT.exe
  2⤵
  PID:12492
- C:\Windows\System\GdRDeyn.exe
  C:\Windows\System\GdRDeyn.exe
  2⤵
  PID:12612
- C:\Windows\System\mdYzIzk.exe
  C:\Windows\System\mdYzIzk.exe
  2⤵
  PID:12628
- C:\Windows\System\mnUBJDK.exe
  C:\Windows\System\mnUBJDK.exe
  2⤵
  PID:12648
- C:\Windows\System\pAnTVUg.exe
  C:\Windows\System\pAnTVUg.exe
  2⤵
  PID:12696
- C:\Windows\System\CjERLQI.exe
  C:\Windows\System\CjERLQI.exe
  2⤵
  PID:12776
- C:\Windows\System\gbCuvAx.exe
  C:\Windows\System\gbCuvAx.exe
  2⤵
  PID:12884
- C:\Windows\System\lNzbYOx.exe
  C:\Windows\System\lNzbYOx.exe
  2⤵
  PID:12908
- C:\Windows\System\fcsOeAO.exe
  C:\Windows\System\fcsOeAO.exe
  2⤵
  PID:13040
- C:\Windows\System\eAIuVnF.exe
  C:\Windows\System\eAIuVnF.exe
  2⤵
  PID:13108
- C:\Windows\System\ZZSHFxe.exe
  C:\Windows\System\ZZSHFxe.exe
  2⤵
  PID:13068
- C:\Windows\System\FVnxENL.exe
  C:\Windows\System\FVnxENL.exe
  2⤵
  PID:13224
- C:\Windows\System\ETYOGVN.exe
  C:\Windows\System\ETYOGVN.exe
  2⤵
  PID:13164
- C:\Windows\System\mVsZLXI.exe
  C:\Windows\System\mVsZLXI.exe
  2⤵
  PID:13308
- C:\Windows\System\txAxYDa.exe
  C:\Windows\System\txAxYDa.exe
  2⤵
  PID:12516
- C:\Windows\System\AOQusfI.exe
  C:\Windows\System\AOQusfI.exe
  2⤵
  PID:12608
- C:\Windows\System\NwHZhCj.exe
  C:\Windows\System\NwHZhCj.exe
  2⤵
  PID:12344
- C:\Windows\System\FMbarWd.exe
  C:\Windows\System\FMbarWd.exe
  2⤵
  PID:12860
- C:\Windows\System\yWyBVkT.exe
  C:\Windows\System\yWyBVkT.exe
  2⤵
  PID:12920
- C:\Windows\System\zBSkCbA.exe
  C:\Windows\System\zBSkCbA.exe
  2⤵
  PID:13012
- C:\Windows\System\RWfMrPi.exe
  C:\Windows\System\RWfMrPi.exe
  2⤵
  PID:13300
- C:\Windows\System\eyihcWb.exe
  C:\Windows\System\eyihcWb.exe
  2⤵
  PID:13332
- C:\Windows\System\XxnlSXe.exe
  C:\Windows\System\XxnlSXe.exe
  2⤵
  PID:13356
- C:\Windows\System\JHUBVDr.exe
  C:\Windows\System\JHUBVDr.exe
  2⤵
  PID:13388
- C:\Windows\System\nKNpuXO.exe
  C:\Windows\System\nKNpuXO.exe
  2⤵
  PID:13412
- C:\Windows\System\ooBoypd.exe
  C:\Windows\System\ooBoypd.exe
  2⤵
  PID:13444
- C:\Windows\System\oDOJNOW.exe
  C:\Windows\System\oDOJNOW.exe
  2⤵
  PID:13472
- C:\Windows\System\faulwdc.exe
  C:\Windows\System\faulwdc.exe
  2⤵
  PID:13504
- C:\Windows\System\SKuGHHJ.exe
  C:\Windows\System\SKuGHHJ.exe
  2⤵
  PID:13520
- C:\Windows\System\trkKDWk.exe
  C:\Windows\System\trkKDWk.exe
  2⤵
  PID:13540
- C:\Windows\System\gyWyYsW.exe
  C:\Windows\System\gyWyYsW.exe
  2⤵
  PID:13564
- C:\Windows\System\OgMPSFY.exe
  C:\Windows\System\OgMPSFY.exe
  2⤵
  PID:13584
- C:\Windows\System\EkyRFyk.exe
  C:\Windows\System\EkyRFyk.exe
  2⤵
  PID:13608
- C:\Windows\System\DAbZZnt.exe
  C:\Windows\System\DAbZZnt.exe
  2⤵
  PID:13636
- C:\Windows\System\djXidKc.exe
  C:\Windows\System\djXidKc.exe
  2⤵
  PID:13660
- C:\Windows\System\tjTMfaH.exe
  C:\Windows\System\tjTMfaH.exe
  2⤵
  PID:13680
- C:\Windows\System\RnDRLAh.exe
  C:\Windows\System\RnDRLAh.exe
  2⤵
  PID:13708
- C:\Windows\System\IyjlUnK.exe
  C:\Windows\System\IyjlUnK.exe
  2⤵
  PID:13740
- C:\Windows\System\axgNFAh.exe
  C:\Windows\System\axgNFAh.exe
  2⤵
  PID:13760
- C:\Windows\System\leitIvd.exe
  C:\Windows\System\leitIvd.exe
  2⤵
  PID:13796
- C:\Windows\System\LEwZyqv.exe
  C:\Windows\System\LEwZyqv.exe
  2⤵
  PID:13820
- C:\Windows\System\YYiviyy.exe
  C:\Windows\System\YYiviyy.exe
  2⤵
  PID:13848
- C:\Windows\System\dgRAOqm.exe
  C:\Windows\System\dgRAOqm.exe
  2⤵
  PID:13872
- C:\Windows\System\EHBNDzy.exe
  C:\Windows\System\EHBNDzy.exe
  2⤵
  PID:13900
- C:\Windows\System\udcNLZD.exe
  C:\Windows\System\udcNLZD.exe
  2⤵
  PID:13924
- C:\Windows\System\gyTizuG.exe
  C:\Windows\System\gyTizuG.exe
  2⤵
  PID:13948
- C:\Windows\System\papDpCv.exe
  C:\Windows\System\papDpCv.exe
  2⤵
  PID:13980
- C:\Windows\System\SRSoCKM.exe
  C:\Windows\System\SRSoCKM.exe
  2⤵
  PID:14004
- C:\Windows\System\grstviC.exe
  C:\Windows\System\grstviC.exe
  2⤵
  PID:14036
- C:\Windows\System\qsxPLCg.exe
  C:\Windows\System\qsxPLCg.exe
  2⤵
  PID:14060
- C:\Windows\System\JIHZgFq.exe
  C:\Windows\System\JIHZgFq.exe
  2⤵
  PID:14084
- C:\Windows\System\gqzPEVU.exe
  C:\Windows\System\gqzPEVU.exe
  2⤵
  PID:14108
- C:\Windows\System\RYbBzAX.exe
  C:\Windows\System\RYbBzAX.exe
  2⤵
  PID:14136
- C:\Windows\System\OYuHlBd.exe
  C:\Windows\System\OYuHlBd.exe
  2⤵
  PID:14160
- C:\Windows\System\PuHdgkd.exe
  C:\Windows\System\PuHdgkd.exe
  2⤵
  PID:14188
- C:\Windows\System\yWveOks.exe
  C:\Windows\System\yWveOks.exe
  2⤵
  PID:14212
- C:\Windows\System\JipsViI.exe
  C:\Windows\System\JipsViI.exe
  2⤵
  PID:14236
- C:\Windows\System\XlRxzvf.exe
  C:\Windows\System\XlRxzvf.exe
  2⤵
  PID:14268
- C:\Windows\System\YwARZUh.exe
  C:\Windows\System\YwARZUh.exe
  2⤵
  PID:14292
- C:\Windows\System\MJbTIFH.exe
  C:\Windows\System\MJbTIFH.exe
  2⤵
  PID:14316
- C:\Windows\System\cKeguGQ.exe
  C:\Windows\System\cKeguGQ.exe
  2⤵
  PID:13256
- C:\Windows\System\gsIPWqy.exe
  C:\Windows\System\gsIPWqy.exe
  2⤵
  PID:12488
- C:\Windows\System\hAcqrJN.exe
  C:\Windows\System\hAcqrJN.exe
  2⤵
  PID:13008
- C:\Windows\System\IjSAWUM.exe
  C:\Windows\System\IjSAWUM.exe
  2⤵
  PID:13396
- C:\Windows\System\NPcBDnc.exe
  C:\Windows\System\NPcBDnc.exe
  2⤵
  PID:13136
- C:\Windows\System\aVBhexk.exe
  C:\Windows\System\aVBhexk.exe
  2⤵
  PID:13352
- C:\Windows\System\NjMEgRz.exe
  C:\Windows\System\NjMEgRz.exe
  2⤵
  PID:13420
- C:\Windows\System\ETXMGvb.exe
  C:\Windows\System\ETXMGvb.exe
  2⤵
  PID:13328
- C:\Windows\System\HbIvgQW.exe
  C:\Windows\System\HbIvgQW.exe
  2⤵
  PID:13776
- C:\Windows\System\YevdoYt.exe
  C:\Windows\System\YevdoYt.exe
  2⤵
  PID:13556
- C:\Windows\System\hbfoTWQ.exe
  C:\Windows\System\hbfoTWQ.exe
  2⤵
  PID:13576
- C:\Windows\System\pFKhuBz.exe
  C:\Windows\System\pFKhuBz.exe
  2⤵
  PID:13596
- C:\Windows\System\sDzHbVc.exe
  C:\Windows\System\sDzHbVc.exe
  2⤵
  PID:13656
- C:\Windows\System\ngblkRV.exe
  C:\Windows\System\ngblkRV.exe
  2⤵
  PID:13748
- C:\Windows\System\TRiUOCB.exe
  C:\Windows\System\TRiUOCB.exe
  2⤵
  PID:13992
- C:\Windows\System\KjiCBVV.exe
  C:\Windows\System\KjiCBVV.exe
  2⤵
  PID:14104
- C:\Windows\System\CZbyXhm.exe
  C:\Windows\System\CZbyXhm.exe
  2⤵
  PID:13244
- C:\Windows\System\HaqdJyz.exe
  C:\Windows\System\HaqdJyz.exe
  2⤵
  PID:13316
- C:\Windows\System\booqoJU.exe
  C:\Windows\System\booqoJU.exe
  2⤵
  PID:14148
- C:\Windows\System\BrkZOjQ.exe
  C:\Windows\System\BrkZOjQ.exe
  2⤵
  PID:14256
- C:\Windows\System\jVbjtjj.exe
  C:\Windows\System\jVbjtjj.exe
  2⤵
  PID:14152
- C:\Windows\System\zUpskgd.exe
  C:\Windows\System\zUpskgd.exe
  2⤵
  PID:14224
- C:\Windows\System\SzEFSwx.exe
  C:\Windows\System\SzEFSwx.exe
  2⤵
  PID:14308
- C:\Windows\System\wmZUqzx.exe
  C:\Windows\System\wmZUqzx.exe
  2⤵
  PID:14368
- C:\Windows\System\xzWmoMf.exe
  C:\Windows\System\xzWmoMf.exe
  2⤵
  PID:14396
- C:\Windows\System\OgoEbIa.exe
  C:\Windows\System\OgoEbIa.exe
  2⤵
  PID:14420
- C:\Windows\System\BKaTMJE.exe
  C:\Windows\System\BKaTMJE.exe
  2⤵
  PID:14448
- C:\Windows\System\CpuTWIl.exe
  C:\Windows\System\CpuTWIl.exe
  2⤵
  PID:14488
- C:\Windows\System\WLZhMlk.exe
  C:\Windows\System\WLZhMlk.exe
  2⤵
  PID:14516
- C:\Windows\System\RsZAmFj.exe
  C:\Windows\System\RsZAmFj.exe
  2⤵
  PID:14540
- C:\Windows\System\YGiqGdO.exe
  C:\Windows\System\YGiqGdO.exe
  2⤵
  PID:14560
- C:\Windows\System\mzqhhuz.exe
  C:\Windows\System\mzqhhuz.exe
  2⤵
  PID:14604
- C:\Windows\System\FJnCiLd.exe
  C:\Windows\System\FJnCiLd.exe
  2⤵
  PID:14628
- C:\Windows\System\LukplaS.exe
  C:\Windows\System\LukplaS.exe
  2⤵
  PID:14644
- C:\Windows\System\ULhtezU.exe
  C:\Windows\System\ULhtezU.exe
  2⤵
  PID:14660
- C:\Windows\System\VaNWCrM.exe
  C:\Windows\System\VaNWCrM.exe
  2⤵
  PID:14680
- C:\Windows\System\SKexlPp.exe
  C:\Windows\System\SKexlPp.exe
  2⤵
  PID:14708
- C:\Windows\System\PfBbKOC.exe
  C:\Windows\System\PfBbKOC.exe
  2⤵
  PID:14732
- C:\Windows\System\xpLsDJs.exe
  C:\Windows\System\xpLsDJs.exe
  2⤵
  PID:14756
- C:\Windows\System\qPisPMK.exe
  C:\Windows\System\qPisPMK.exe
  2⤵
  PID:14780
- C:\Windows\System\xbYTpmE.exe
  C:\Windows\System\xbYTpmE.exe
  2⤵
  PID:14800
- C:\Windows\System\IWryMgb.exe
  C:\Windows\System\IWryMgb.exe
  2⤵
  PID:14836
- C:\Windows\System\wlUKbfU.exe
  C:\Windows\System\wlUKbfU.exe
  2⤵
  PID:14860
- C:\Windows\System\SOxEBMo.exe
  C:\Windows\System\SOxEBMo.exe
  2⤵
  PID:14880
- C:\Windows\System\ElAFfat.exe
  C:\Windows\System\ElAFfat.exe
  2⤵
  PID:14900
- C:\Windows\System\DeuAkGo.exe
  C:\Windows\System\DeuAkGo.exe
  2⤵
  PID:14920
- C:\Windows\System\aNmXjDU.exe
  C:\Windows\System\aNmXjDU.exe
  2⤵
  PID:14936
- C:\Windows\System\ZgDKujE.exe
  C:\Windows\System\ZgDKujE.exe
  2⤵
  PID:14952
- C:\Windows\System\QzeUuKQ.exe
  C:\Windows\System\QzeUuKQ.exe
  2⤵
  PID:14972
- C:\Windows\System\QhIAlko.exe
  C:\Windows\System\QhIAlko.exe
  2⤵
  PID:14996
- C:\Windows\System\xHhagbb.exe
  C:\Windows\System\xHhagbb.exe
  2⤵
  PID:15016
- C:\Windows\System\WBcFIEv.exe
  C:\Windows\System\WBcFIEv.exe
  2⤵
  PID:15036
- C:\Windows\System\oJfENwX.exe
  C:\Windows\System\oJfENwX.exe
  2⤵
  PID:15052
- C:\Windows\System\sDmlaYn.exe
  C:\Windows\System\sDmlaYn.exe
  2⤵
  PID:15072
- C:\Windows\System\iamWkGt.exe
  C:\Windows\System\iamWkGt.exe
  2⤵
  PID:15088
- C:\Windows\System\PEPxYnb.exe
  C:\Windows\System\PEPxYnb.exe
  2⤵
  PID:15116
- C:\Windows\System\vKkAniK.exe
  C:\Windows\System\vKkAniK.exe
  2⤵
  PID:15140
- C:\Windows\System\vyFDzYq.exe
  C:\Windows\System\vyFDzYq.exe
  2⤵
  PID:15156
- C:\Windows\System\iTljXiH.exe
  C:\Windows\System\iTljXiH.exe
  2⤵
  PID:15184
- C:\Windows\System\BBospLq.exe
  C:\Windows\System\BBospLq.exe
  2⤵
  PID:15208
- C:\Windows\System\jpXjLzc.exe
  C:\Windows\System\jpXjLzc.exe
  2⤵
  PID:15240
- C:\Windows\System\mOydSRn.exe
  C:\Windows\System\mOydSRn.exe
  2⤵
  PID:15268
- C:\Windows\System\kOJUyac.exe
  C:\Windows\System\kOJUyac.exe
  2⤵
  PID:15292
- C:\Windows\System\UwOXySp.exe
  C:\Windows\System\UwOXySp.exe
  2⤵
  PID:15312
- C:\Windows\System\fQqHCCk.exe
  C:\Windows\System\fQqHCCk.exe
  2⤵
  PID:15332
- C:\Windows\System\RVaIxFn.exe
  C:\Windows\System\RVaIxFn.exe
  2⤵
  PID:13192
- C:\Windows\System\XuAGBql.exe
  C:\Windows\System\XuAGBql.exe
  2⤵
  PID:13688
- C:\Windows\System\OqctXNb.exe
  C:\Windows\System\OqctXNb.exe
  2⤵
  PID:13372
- C:\Windows\System\dFohFBn.exe
  C:\Windows\System\dFohFBn.exe
  2⤵
  PID:13368
- C:\Windows\System\POKKNEs.exe
  C:\Windows\System\POKKNEs.exe
  2⤵
  PID:14344
- C:\Windows\System\JVbWMeH.exe
  C:\Windows\System\JVbWMeH.exe
  2⤵
  PID:14384
- C:\Windows\System\wMwSusw.exe
  C:\Windows\System\wMwSusw.exe
  2⤵
  PID:14436
- C:\Windows\System\NZhehxH.exe
  C:\Windows\System\NZhehxH.exe
  2⤵
  PID:14044
- C:\Windows\System\mxrTmbm.exe
  C:\Windows\System\mxrTmbm.exe
  2⤵
  PID:14028
- C:\Windows\System\DCyJfRO.exe
  C:\Windows\System\DCyJfRO.exe
  2⤵
  PID:14652
- C:\Windows\System\MYJZlHr.exe
  C:\Windows\System\MYJZlHr.exe
  2⤵
  PID:14764
- C:\Windows\System\ZOUqdEZ.exe
  C:\Windows\System\ZOUqdEZ.exe
  2⤵
  PID:13512
- C:\Windows\System\FYTcGLl.exe
  C:\Windows\System\FYTcGLl.exe
  2⤵
  PID:14832
- C:\Windows\System\XUuKzpe.exe
  C:\Windows\System\XUuKzpe.exe
  2⤵
  PID:14896
- C:\Windows\System\LXPjxNa.exe
  C:\Windows\System\LXPjxNa.exe
  2⤵
  PID:14696
- C:\Windows\System\UaogDqe.exe
  C:\Windows\System\UaogDqe.exe
  2⤵
  PID:14500
- C:\Windows\System\DPcjfUk.exe
  C:\Windows\System\DPcjfUk.exe
  2⤵
  PID:15108
- C:\Windows\System\RidihEe.exe
  C:\Windows\System\RidihEe.exe
  2⤵
  PID:14872
- C:\Windows\System\QtEZMwh.exe
  C:\Windows\System\QtEZMwh.exe
  2⤵
  PID:14636
- C:\Windows\System\tGSfCWB.exe
  C:\Windows\System\tGSfCWB.exe
  2⤵
  PID:15300
- C:\Windows\System\EqYShbQ.exe
  C:\Windows\System\EqYShbQ.exe
  2⤵
  PID:15356
- C:\Windows\System\ZNnipaJ.exe
  C:\Windows\System\ZNnipaJ.exe
  2⤵
  PID:14984
- C:\Windows\System\aRdUZbR.exe
  C:\Windows\System\aRdUZbR.exe
  2⤵
  PID:13440
- C:\Windows\System\qmbDgwQ.exe
  C:\Windows\System\qmbDgwQ.exe
  2⤵
  PID:15112
- C:\Windows\System\ZqbprkP.exe
  C:\Windows\System\ZqbprkP.exe
  2⤵
  PID:15372
- C:\Windows\System\wtvtZDa.exe
  C:\Windows\System\wtvtZDa.exe
  2⤵
  PID:15396
- C:\Windows\System\zQjlvEc.exe
  C:\Windows\System\zQjlvEc.exe
  2⤵
  PID:15420
- C:\Windows\System\HYByDFK.exe
  C:\Windows\System\HYByDFK.exe
  2⤵
  PID:15440
- C:\Windows\System\zbDqddl.exe
  C:\Windows\System\zbDqddl.exe
  2⤵
  PID:15460
- C:\Windows\System\LOWguHD.exe
  C:\Windows\System\LOWguHD.exe
  2⤵
  PID:15496
- C:\Windows\System\LpvpgTZ.exe
  C:\Windows\System\LpvpgTZ.exe
  2⤵
  PID:15528
- C:\Windows\System\BOOBTKE.exe
  C:\Windows\System\BOOBTKE.exe
  2⤵
  PID:15548
- C:\Windows\System\jWkIQsJ.exe
  C:\Windows\System\jWkIQsJ.exe
  2⤵
  PID:15568
- C:\Windows\System\hHqnDyq.exe
  C:\Windows\System\hHqnDyq.exe
  2⤵
  PID:15588
- C:\Windows\System\XAQynXu.exe
  C:\Windows\System\XAQynXu.exe
  2⤵
  PID:15612
- C:\Windows\System\SAqClFk.exe
  C:\Windows\System\SAqClFk.exe
  2⤵
  PID:15636
- C:\Windows\System\gDdPuqS.exe
  C:\Windows\System\gDdPuqS.exe
  2⤵
  PID:15664
- C:\Windows\System\HgmDVDV.exe
  C:\Windows\System\HgmDVDV.exe
  2⤵
  PID:15692
- C:\Windows\System\reUEamR.exe
  C:\Windows\System\reUEamR.exe
  2⤵
  PID:15716
- C:\Windows\System\ZiHbiEz.exe
  C:\Windows\System\ZiHbiEz.exe
  2⤵
  PID:15744
- C:\Windows\System\rNuwgUS.exe
  C:\Windows\System\rNuwgUS.exe
  2⤵
  PID:15760
- C:\Windows\System\ieFfDRi.exe
  C:\Windows\System\ieFfDRi.exe
  2⤵
  PID:15788
- C:\Windows\System\alTITnZ.exe
  C:\Windows\System\alTITnZ.exe
  2⤵
  PID:15808
- C:\Windows\System\EGUjpco.exe
  C:\Windows\System\EGUjpco.exe
  2⤵
  PID:15828
- C:\Windows\System\DaHIuaN.exe
  C:\Windows\System\DaHIuaN.exe
  2⤵
  PID:15856
- C:\Windows\System\argXuFc.exe
  C:\Windows\System\argXuFc.exe
  2⤵
  PID:15884
- C:\Windows\System\nMLWrvR.exe
  C:\Windows\System\nMLWrvR.exe
  2⤵
  PID:15908
- C:\Windows\System\fXaibSE.exe
  C:\Windows\System\fXaibSE.exe
  2⤵
  PID:15936
- C:\Windows\System\XowwvRA.exe
  C:\Windows\System\XowwvRA.exe
  2⤵
  PID:15956
- C:\Windows\System\WiHbZoD.exe
  C:\Windows\System\WiHbZoD.exe
  2⤵
  PID:15976
- C:\Windows\System\gJygyRf.exe
  C:\Windows\System\gJygyRf.exe
  2⤵
  PID:16004
- C:\Windows\System\mKWkIYF.exe
  C:\Windows\System\mKWkIYF.exe
  2⤵
  PID:16028
- C:\Windows\System\eMILoLe.exe
  C:\Windows\System\eMILoLe.exe
  2⤵
  PID:16044
- C:\Windows\System\qLUkotZ.exe
  C:\Windows\System\qLUkotZ.exe
  2⤵
  PID:16076
- C:\Windows\System\jwjipJh.exe
  C:\Windows\System\jwjipJh.exe
  2⤵
  PID:16092
- C:\Windows\System\WPyGvdV.exe
  C:\Windows\System\WPyGvdV.exe
  2⤵
  PID:16120
- C:\Windows\System\kZjsZZM.exe
  C:\Windows\System\kZjsZZM.exe
  2⤵
  PID:16136
- C:\Windows\System\xZtJGXY.exe
  C:\Windows\System\xZtJGXY.exe
  2⤵
  PID:16160
- C:\Windows\System\jDGXBHa.exe
  C:\Windows\System\jDGXBHa.exe
  2⤵
  PID:16192
- C:\Windows\System\HAMOTGS.exe
  C:\Windows\System\HAMOTGS.exe
  2⤵
  PID:16212
- C:\Windows\System\eOcpUrj.exe
  C:\Windows\System\eOcpUrj.exe
  2⤵
  PID:16228
- C:\Windows\System\SnzprvQ.exe
  C:\Windows\System\SnzprvQ.exe
  2⤵
  PID:16248
- C:\Windows\System\NKSqvXX.exe
  C:\Windows\System\NKSqvXX.exe
  2⤵
  PID:16264
- C:\Windows\System\rQQyxdD.exe
  C:\Windows\System\rQQyxdD.exe
  2⤵
  PID:16288
- C:\Windows\System\QjQKQOh.exe
  C:\Windows\System\QjQKQOh.exe
  2⤵
  PID:16304
- C:\Windows\System\WOxCEDk.exe
  C:\Windows\System\WOxCEDk.exe
  2⤵
  PID:16324
- C:\Windows\System\zmyMUov.exe
  C:\Windows\System\zmyMUov.exe
  2⤵
  PID:16352
- C:\Windows\System\rwsSwIb.exe
  C:\Windows\System\rwsSwIb.exe
  2⤵
  PID:16372
- C:\Windows\System\kSUWOLM.exe
  C:\Windows\System\kSUWOLM.exe
  2⤵
  PID:14856
- C:\Windows\System\Vkylslt.exe
  C:\Windows\System\Vkylslt.exe
  2⤵
  PID:14020
- C:\Windows\System\sMCDEIY.exe
  C:\Windows\System\sMCDEIY.exe
  2⤵
  PID:15304
- C:\Windows\System\oRBEFlc.exe
  C:\Windows\System\oRBEFlc.exe
  2⤵
  PID:14964
- C:\Windows\System\ihydMjC.exe
  C:\Windows\System\ihydMjC.exe
  2⤵
  PID:15004
- C:\Windows\System\abylJgE.exe
  C:\Windows\System\abylJgE.exe
  2⤵
  PID:14672
- C:\Windows\System\BITdJXh.exe
  C:\Windows\System\BITdJXh.exe
  2⤵
  PID:15080
- C:\Windows\System\AVWefqD.exe
  C:\Windows\System\AVWefqD.exe
  2⤵
  PID:15060
- C:\Windows\System\jpdOjtR.exe
  C:\Windows\System\jpdOjtR.exe
  2⤵
  PID:15432
- C:\Windows\System\mUhcOux.exe
  C:\Windows\System\mUhcOux.exe
  2⤵
  PID:15484
- C:\Windows\System\lxGOzSL.exe
  C:\Windows\System\lxGOzSL.exe
  2⤵
  PID:13828
- C:\Windows\System\UJHpura.exe
  C:\Windows\System\UJHpura.exe
  2⤵
  PID:15200
- C:\Windows\System\xgeBZUC.exe
  C:\Windows\System\xgeBZUC.exe
  2⤵
  PID:15780
- C:\Windows\System\Makxmbn.exe
  C:\Windows\System\Makxmbn.exe
  2⤵
  PID:15840
- C:\Windows\System\efDuXnM.exe
  C:\Windows\System\efDuXnM.exe
  2⤵
  PID:3676
- C:\Windows\System\gfMzPfg.exe
  C:\Windows\System\gfMzPfg.exe
  2⤵
  PID:16036
- C:\Windows\System\retfgdm.exe
  C:\Windows\System\retfgdm.exe
  2⤵
  PID:16128
- C:\Windows\System\aWNFrHS.exe
  C:\Windows\System\aWNFrHS.exe
  2⤵
  PID:14700
- C:\Windows\System\YyCPSIi.exe
  C:\Windows\System\YyCPSIi.exe
  2⤵
  PID:16280
- C:\Windows\System\jHarjNZ.exe
  C:\Windows\System\jHarjNZ.exe
  2⤵
  PID:16400
- C:\Windows\System\zVdmEeu.exe
  C:\Windows\System\zVdmEeu.exe
  2⤵
  PID:16416
- C:\Windows\System\EmumVQb.exe
  C:\Windows\System\EmumVQb.exe
  2⤵
  PID:16440
- C:\Windows\System\GXkhpll.exe
  C:\Windows\System\GXkhpll.exe
  2⤵
  PID:16464
- C:\Windows\System\HxAoirL.exe
  C:\Windows\System\HxAoirL.exe
  2⤵
  PID:16484
- C:\Windows\System\tYOLedK.exe
  C:\Windows\System\tYOLedK.exe
  2⤵
  PID:16508
- C:\Windows\System\JuhHgna.exe
  C:\Windows\System\JuhHgna.exe
  2⤵
  PID:16536
- C:\Windows\System\saGHCkn.exe
  C:\Windows\System\saGHCkn.exe
  2⤵
  PID:16564
- C:\Windows\System\JNXLzOn.exe
  C:\Windows\System\JNXLzOn.exe
  2⤵
  PID:16596
- C:\Windows\System\qdMBIYC.exe
  C:\Windows\System\qdMBIYC.exe
  2⤵
  PID:16804
- C:\Windows\System\ycRkudL.exe
  C:\Windows\System\ycRkudL.exe
  2⤵
  PID:16820
- C:\Windows\System\kKcrZJS.exe
  C:\Windows\System\kKcrZJS.exe
  2⤵
  PID:16840
- C:\Windows\System\CbuXvex.exe
  C:\Windows\System\CbuXvex.exe
  2⤵
  PID:16856
- C:\Windows\System\GaWHBJN.exe
  C:\Windows\System\GaWHBJN.exe
  2⤵
  PID:16876
- C:\Windows\System\zWpXsHk.exe
  C:\Windows\System\zWpXsHk.exe
  2⤵
  PID:16892
- C:\Windows\System\hHvLARf.exe
  C:\Windows\System\hHvLARf.exe
  2⤵
  PID:16908
- C:\Windows\System\aaPHdHa.exe
  C:\Windows\System\aaPHdHa.exe
  2⤵
  PID:16924
- C:\Windows\System\QJNjEtG.exe
  C:\Windows\System\QJNjEtG.exe
  2⤵
  PID:16956
- C:\Windows\System\tSkDSYI.exe
  C:\Windows\System\tSkDSYI.exe
  2⤵
  PID:16972
- C:\Windows\System\NNxdtwj.exe
  C:\Windows\System\NNxdtwj.exe
  2⤵
  PID:17000
- C:\Windows\System\CzzhQFt.exe
  C:\Windows\System\CzzhQFt.exe
  2⤵
  PID:17020
- C:\Windows\System\gUGctiX.exe
  C:\Windows\System\gUGctiX.exe
  2⤵
  PID:17056
- C:\Windows\System\gpZsklV.exe
  C:\Windows\System\gpZsklV.exe
  2⤵
  PID:17084
- C:\Windows\System\FRQFHgm.exe
  C:\Windows\System\FRQFHgm.exe
  2⤵
  PID:17112
- C:\Windows\System\WYPuzHc.exe
  C:\Windows\System\WYPuzHc.exe
  2⤵
  PID:17132
- C:\Windows\System\McjpuId.exe
  C:\Windows\System\McjpuId.exe
  2⤵
  PID:17160
- C:\Windows\System\DPvgVpO.exe
  C:\Windows\System\DPvgVpO.exe
  2⤵
  PID:17200
- C:\Windows\System\FZTXtXB.exe
  C:\Windows\System\FZTXtXB.exe
  2⤵
  PID:17224
- C:\Windows\System\fbkdfCF.exe
  C:\Windows\System\fbkdfCF.exe
  2⤵
  PID:17256
- C:\Windows\System\wjwjZlJ.exe
  C:\Windows\System\wjwjZlJ.exe
  2⤵
  PID:17304
- C:\Windows\System\ExGfpLM.exe
  C:\Windows\System\ExGfpLM.exe
  2⤵
  PID:17364
- C:\Windows\System\XXyaOsP.exe
  C:\Windows\System\XXyaOsP.exe
  2⤵
  PID:17392
- C:\Windows\System\nJjNudn.exe
  C:\Windows\System\nJjNudn.exe
  2⤵
  PID:15472
- C:\Windows\System\HfJKNhL.exe
  C:\Windows\System\HfJKNhL.exe
  2⤵
  PID:16916
- C:\Windows\System\piiPmEO.exe
  C:\Windows\System\piiPmEO.exe
  2⤵
  PID:16788
- C:\Windows\System\xUpfabn.exe
  C:\Windows\System\xUpfabn.exe
  2⤵
  PID:16852
- C:\Windows\System\lkMaTFE.exe
  C:\Windows\System\lkMaTFE.exe
  2⤵
  PID:16888
- C:\Windows\System\ojYCjFN.exe
  C:\Windows\System\ojYCjFN.exe
  2⤵
  PID:16988
- C:\Windows\System\ECtoCeW.exe
  C:\Windows\System\ECtoCeW.exe
  2⤵
  PID:17068
- C:\Windows\System\SzpSQLR.exe
  C:\Windows\System\SzpSQLR.exe
  2⤵
  PID:17120
- C:\Windows\System\iEfQHqf.exe
  C:\Windows\System\iEfQHqf.exe
  2⤵
  PID:17184
- C:\Windows\System\IMyUZkn.exe
  C:\Windows\System\IMyUZkn.exe
  2⤵
  PID:17220
- C:\Windows\System\YnACWlk.exe
  C:\Windows\System\YnACWlk.exe
  2⤵
  PID:17296
- C:\Windows\System\GPVLLsg.exe
  C:\Windows\System\GPVLLsg.exe
  2⤵
  PID:16104
- C:\Windows\System\bDxqYTc.exe
  C:\Windows\System\bDxqYTc.exe
  2⤵
  PID:16188
- C:\Windows\System\EurjCmD.exe
  C:\Windows\System\EurjCmD.exe
  2⤵
  PID:14524
- C:\Windows\System\IQPuVSL.exe
  C:\Windows\System\IQPuVSL.exe
  2⤵
  PID:16664
- C:\Windows\System\TyEREtj.exe
  C:\Windows\System\TyEREtj.exe
  2⤵
  PID:16772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AfyuGSl.exe

Filesize
1.5MB

MD5
e4a2eed85ab6d75b7a25ff0e2fbb8c7b

SHA1
e9e5345f60d4ffcb089578eeb48061e85047ce3e

SHA256
e2bdfcb56a22522acf9084c334ca47eecb3ae2c6d619f9716b49fa8be193826f

SHA512
92b3933d23ee136a010a55be7f61d8d4a4d3cf3abe9cdded406086c29e89aed7c108cae3b32a643c8f946ca4c3cd02967afa3edb4cb92a4c3a9aad10c9e23c27

Download Submit
C:\Windows\System\BXMSOqn.exe

Filesize
1.5MB

MD5
f308d7cb9d26b7859ef69552cb09e561

SHA1
6551cecf1c3cea1aa194867a4ede5cc531656897

SHA256
53667d9fb3016a0cf48d841890c4083f0a135c05064ff0bad45689cb6ddeb23f

SHA512
3a5615edf2b9e976830a202482cbd00e2718e06fae79ebcd286b0eec38704006e86c9a6d74b6355aebdfcced0819fbd2cbc077521c6739f1de89362e6c9b4d35

Download Submit
C:\Windows\System\DBvoUMq.exe

Filesize
1.5MB

MD5
d6a978273f5518c89431547b49afe61c

SHA1
15c6009eb154ac639e38296cd6bee55b337a990e

SHA256
163d25fa9400a1bfb0d234c5d9be7da2303c804ee13859997f433a62b553013d

SHA512
b2af441e973bc29195668ad590fd5d6be8793a44ba1d5441c9a39c2a51eec3fde8c7d0f1fdedcb781cde1eab960bbc236e5b25260d2116d657ebadacafe96a7d

Download Submit
C:\Windows\System\DGXibEp.exe

Filesize
1.5MB

MD5
7d2686d044857926f869009243c220dd

SHA1
8dbf396dbd78dff37133f7f2d9a012a6c83028bc

SHA256
7f14bebd214f2e9c68273e22c2e56c80a4245b99214472b95a01d978736183e9

SHA512
50ec48df7de2d2086e15e0341593968867fbe03287695644eb3c11e370af12dcdf91016cdee9918af1a0fead48e011c6f08de6c4ad1290755f8c5e6135f2763e

Download Submit
C:\Windows\System\DZRWHeO.exe

Filesize
1.5MB

MD5
3d5265477aad41aa64bb36d6fd5d7280

SHA1
03fd66768ee1edd80ddafeab86762a8b47b60ea5

SHA256
cc84fdd6b2acccbd6937f85fb29a5e11e55dffff762095e93a76c89c7ee10967

SHA512
3a81e8fcfc14e73e158c5b67e1d4c00691fd48eaa8f10214c040f2fa80bb059b50453e4540c63115cbcd50dca812976f3be4e830dac0fa12070709447a9a9b46

Download Submit
C:\Windows\System\FJgAsDO.exe

Filesize
1.5MB

MD5
2f32d8f322b9ebee83366526ea2b6226

SHA1
7abbbe22e36606fc5b6732598c901db89fad1c78

SHA256
1d712745c1671c6d462113863e5b4573a3a5936e7b70ce610fcf064e73e32388

SHA512
ba0efd3aada792a592bb90ec11aaf0e472526ef42e7f9fcb91f930e91074bcd18c1605a4d22b7d87035b2cd70cba3edeca3b6d7cc5affce769a4cfb027e8b48c

Download Submit
C:\Windows\System\HeACxKT.exe

Filesize
1.5MB

MD5
1455737b3cb4fed0572bf2d7976dfaf5

SHA1
392061c558de56cfd2c0c36205a40210a9e3cc77

SHA256
73e5e98884c50ea1693eef75c962580596e89cea9d38b9a70a7bde0a6cd53a53

SHA512
c0f9c4b3b8a1498efa8b02c53b0bb693d7efee5f4ce2d4728b3417326f399156d6ab6501fed4ded2cf08f77417402041dc20855a0ba3046f4b0c784202718d54

Download Submit
C:\Windows\System\ITesSWq.exe

Filesize
1.5MB

MD5
89fa17e874d1e130f7056147d91e81fd

SHA1
e36b815686e1cba7ae78e9b195e095b8db2fe29f

SHA256
d52a95f52d9f5366861073e429dc11c995f19da46694948b0f83405aeabcdafc

SHA512
4f14dfff491801fddf22aae8727312fc4f26231c30e58833d9324b78da358ff1a1b6f99a156b2525d7923a5e71f6335568bb8c8bdaec72e8e7c78ce576e491a7

Download Submit
C:\Windows\System\JfGKcFi.exe

Filesize
1.5MB

MD5
d0eefa0ce9c077318312af28753a6fc5

SHA1
3eb61dbcb249b9dd13a34cf539e8f7fc74d53317

SHA256
70555507f37a4676c029c97d1a8a79e902f7c18845ce5bc1346f2854642c83cd

SHA512
4d1f693eb01b20aeabdf36672d097b84a062d588f1f0d749bf149bdd1819fe4ffd2fa62bc9f432d63db7eb6efadff2ba434a1ef8c2b8436351a7bf60bfd17a7a

Download Submit
C:\Windows\System\LLBoCFG.exe

Filesize
1.5MB

MD5
4494acf74f3c279c199752ffacdb5ca5

SHA1
884be249e77d46a414ebabfa20cbb2118f8821e4

SHA256
eb5244184dbb3a7c71e94b16049fbc6f7808f1e0ac83eb4ed521e366cc125519

SHA512
20eb4f41df88e173b048099710dc109cf0cc18983ef0fb0f87ff4e9e4786d9b5c002f733c04b7b8f07a0f85a936c8ea76330fe2f4d5077d809c2aad4719eca7b

Download Submit
C:\Windows\System\NjxRBTu.exe

Filesize
1.5MB

MD5
63d5f6990cb31772b7ff77df6cdba06e

SHA1
fcb3f95fb59832e35089d4ddbba02b6e6a26be43

SHA256
d07e238b59520e50a48f7ae4110716ab23cd4e4b68bb097525458b3bf7694fb5

SHA512
70bba107029b027f7bbabb125dbbe1bb0a506a351240f10312b4f9ac697acd6c6ded554cd87729785e61f1d0da553c40001144901ada3b91d44bf0efb7503c96

Download Submit
C:\Windows\System\OJzgHDe.exe

Filesize
1.5MB

MD5
185864c165b5d228c3c3b3728374b173

SHA1
016c8925e688ab67fd52d0e6fd5addf4ae6a2ff2

SHA256
ec062d64f95d56c1aae596a8a685fc27593e550035dcf30eb808abcef1c23340

SHA512
bdeeb5b2f864d287d221d2362c64499a6a0ebbea18043da6475a79161fe3e6a94ab61ae2ae3429d9896798237e422c3b2786f3f3a55488c7ba41c090d283dc57

Download Submit
C:\Windows\System\OzpOInB.exe

Filesize
1.5MB

MD5
6154ae6f87951e56081c3c4b2403e1e1

SHA1
f6a9131149d5370e3f127f121d874bc1c2036c40

SHA256
520a565b5bb70ff8793773bed68760cb15c4658642fe6c9475b1fa93ded0d2d0

SHA512
1a736842c0406cc0aa158a6fa761a45514523d51a233fa722e19965d0adb9b95d102d70e599f72c7c089b7c9a244df09e49d682c1b47646d9d820ee02ffd6d45

Download Submit
C:\Windows\System\PJGzuyW.exe

Filesize
1.5MB

MD5
1b49aa82894cf971bee36b45992f1b6f

SHA1
7b964684d084c08e1bc388bc1567734b158a2f59

SHA256
5204d1ec7589238d6d5878a57873efe9d116c2a3341fdb75fc20fe8c0be9b20a

SHA512
a986ae45062e2f24e808627aac15e7f07d8289a32ccae2d586d8c5fdce623855946ff992ee67a94847c4c1dbd919ff48e0894f105335872d4006240b6e4a868c

Download Submit
C:\Windows\System\XuthNms.exe

Filesize
1.5MB

MD5
ef16f4fb7e06681c49f272bc040ed24b

SHA1
5fae20ccddb36706c51e28a7e020064b67a64684

SHA256
8f87cc2db7d4776dcada9b2454ef5d4869a957ee58d14222f8fc24b97790c71e

SHA512
90336708c4bdebbaa6e8451982c9f74d6007ce747343c558437f010d30decca5edcce52f579a6b20759f954f6e0ef683dbaf48ccdf6b74a9f4bb6fb57c667a63

Download Submit
C:\Windows\System\arbLrtJ.exe

Filesize
1.5MB

MD5
37feec6e3d98035c0888c15b6f3b5a2c

SHA1
115f1694220e048768bfa2bc323bd2e196cc9e9b

SHA256
48f7f9a23624567916577dd12a88cc06bec0560a292833e5aa7bab64ad646f6d

SHA512
466014d20ad22e97853ebaed4292b6d4a97a544b9c9921c67d6aeaf4caa02b83d8d5a667b74a332dec7deb800fb33d4660a3c5b5101e81480821076940b4d7da

Download Submit
C:\Windows\System\brBGjBz.exe

Filesize
1.5MB

MD5
59626f6367cee02fb07bbabb65f906d9

SHA1
2697c465ef4bdaf963b5e3365f84db49f36391a4

SHA256
fe91072543d52dd5154142097e4d016b52c1a2e6e10d3d95ca49ac7a4fadbd0f

SHA512
ac596de48ba3fde178ab5217be93ae2593618f41271a7a4e80b99daff37b2ee03f2389dce410f08c4283374224ea523305b2efc7803d0e4f6243d49fd8c1ef34

Download Submit
C:\Windows\System\bytVnAv.exe

Filesize
1.5MB

MD5
abf87a495213d34e7433eb3a055dfa13

SHA1
0021b249ba93addeb8903a3a01f244ae6a70aeb4

SHA256
6048f18f1db57808ff0565d99a36bf0edd00514d1b16d1005be7519855691e8f

SHA512
e18f8e52aa681f8b342f7cbdad1f50dc1b388ffa186fe4ff3933f6c039772782b45b2e0a399e4c3e2462858dc4d0103b8b38827e318fd3cd61ff148d5d78616e

Download Submit
C:\Windows\System\cJEdHHI.exe

Filesize
1.5MB

MD5
dca09d2de0399983c4213a07907fc97b

SHA1
0823fbbeebe8b98390df50f2a43991e0118d343c

SHA256
1306286d2862af6e6ad7e64bc792e0794e68e82bfda877ff2f48e69d6320144d

SHA512
efab2d116dd27312259b4eb3fb37fe37b173f96e97c154855aa725fe358ba4466a911226e410c24f2b3b5a8c060a2a3f6d2b2fbfd326493948baf1ead1f4b187

Download Submit
C:\Windows\System\ebjVpUw.exe

Filesize
1.5MB

MD5
57ae6e7288e33cee1ed212f3611ea3dc

SHA1
0babd383a08a890e338ecca45214fc57ece588d0

SHA256
c0f2f93d4368c5e69791d1951f5f9e64f2a92f52146d391363ea5be660ce2c7f

SHA512
fb3bcde699448b9121f52f88f64d27fe3bffe1ea64bcc5bbaf2b06da96f9c58c09c306ced371c27bdd2b327a9a870cebc505bf971b55e80a77e4d87e2e8a7822

Download Submit
C:\Windows\System\egdPqGq.exe

Filesize
1.5MB

MD5
ca9dbcd99a4fe7a6a083e253d258a059

SHA1
c0b86a0548befcb86ea0aca9e4db0ee00aa0ef49

SHA256
fae13adaaf10433f60a34a4735399673c997d2ee0819ce1f39ad78261d0657a3

SHA512
87838c3dcd7601b75f2113a1dde73980c95f70a8668e9d763f90dc5ed00a4a7d1ffc5841caaa167ee087a7051898062f6457cb3c9508f9e30a9119878316060f

Download Submit
C:\Windows\System\kZQAEpW.exe

Filesize
1.5MB

MD5
b81fce3673ccc8b90a0f15769de74ee9

SHA1
3d725e45e91b391f23dd8c76328fd916d37c87d4

SHA256
e9960f30b5336710bc69d9556f97c6ddeafb259c06e22d77fd98ec3251930970

SHA512
b5505cc1c6193b0605b8aa2d6900fd41392132e7f06d136443fec6945c5bc2fbbc18aa8fba90be8a45bd6d06240554d68dcbf30ed623149bd9682e06c26a2378

Download Submit
C:\Windows\System\lfaLqZF.exe

Filesize
1.5MB

MD5
767e9b2863e9195af32389d78c729314

SHA1
8bba1d092dec970bed52105b75578ad1e259d3ca

SHA256
e6bb11dbaca8f48a7dea6fb00ea8d7fcb8c6053cbffd330f88c38e85469fbc21

SHA512
910f53a7e1c41a05d58b79da665062d051f8f160719ce82c85206f28e1f8a40475e99808e599111e34d3e94cd9b89c2b9b95b10efd91eef041cfbcd4f910e314

Download Submit
C:\Windows\System\mOVwPfb.exe

Filesize
1.5MB

MD5
efb0f9fb4a79e7bfef17abffe4448ed7

SHA1
20df020e1ccb52094685fad9a4746851b4c35925

SHA256
84b2127dab952ab00bb23306e037c55185d76f4143857f0d2a0c7e3c897a4461

SHA512
7cc9fc45ad0be2ea6b753945ed8c81d1e0cf8753a86d1382359d5e49be20dd61517e0154ff31aa273d2c3f909f612031fb74e50ebd1940effc59c14c5c3164ca

Download Submit
C:\Windows\System\oaZxTvz.exe

Filesize
1.5MB

MD5
24f7e343e04ffc9ffc81672d458f219f

SHA1
89baf59dc51098be79add8d19998085d8984ccea

SHA256
20d19c2fa22290bd95f83d6684eb3b5ddee5682f45f28e9c0b3e7821719729d6

SHA512
52329e0ca333ee7f3ac73a551803b845305e8b7bfe2a0537bd5b25e41084597652510afc3bccd67a1b8dbf74cf69727209d525788124069610b6bb19ddff4358

Download Submit
C:\Windows\System\pMhUgtg.exe

Filesize
1.5MB

MD5
c6dbfb320df857ac4a21724a0b02398e

SHA1
bd14520657a3133c88dcf28b26a3d1e871f0cea7

SHA256
0bc69a0471dac2547413ec3962c600e05924d23f16a5c066b3031693090c06fe

SHA512
3e75bd881b8f6eb8907ffe61e44cdf8169140cff7394ccfc10ba12346d88ca761fb0c64f030865e6bde41601cc285b868bc31b6db1062ff0b98cc297a5af3fd6

Download Submit
C:\Windows\System\pycGUfr.exe

Filesize
1.5MB

MD5
d0ac04c81c310295c7531ccac1b0ab22

SHA1
9efa694a007b405f482a3fd21ee842d28c21866c

SHA256
aca78c76d7ca89002813f6cfd6453e37cb20043a1fe87dbbed7090549244380d

SHA512
906e47aedd80c4cd7876041656919e48de2591e86b40290f7a4f6a37f08a54020701ed0c96b546570a42fd73745d2c7d45bb80c75ac57976df72ab63079fc678

Download Submit
C:\Windows\System\rByhmBo.exe

Filesize
1.5MB

MD5
d50333e2636343433128fa4d237fbe17

SHA1
069d82f966ba2e857d73d3d69ff04d5b4c557360

SHA256
a589905870f78859a6c003c11c532e9d4ba09adbd691f775d8f05312a0563b3e

SHA512
a3a7c9c94e39440316172757de51b2d26947ff35ac51d7acb2efc3b7a34f274a2399ce9bfe8832eb9605d7ab94b9d2e03423d7e054df14fe1aeb59936c4944da

Download Submit
C:\Windows\System\uOJwWlp.exe

Filesize
1.5MB

MD5
35211903a45868bbc4b90655ab6f84d4

SHA1
44b71dab2c989bcd7f572af01dfc97779064f593

SHA256
8c529521fe4482564bf2f88b82a5223c86389dde59fdd2f3a40a9809b7adfd32

SHA512
d3d20e970ac96e9be86e567c9b71f881efed023795853362ab7978906cdebd1f42241abad626fcc31705b54c3fdc36229d375572add568ff4e692a45214898a0

Download Submit
C:\Windows\System\vYrZIEB.exe

Filesize
1.5MB

MD5
9765987373d3c7201c866aa961b2d192

SHA1
ce0850b963ffcfbcf0878a3e936df7c116ad53c8

SHA256
1d3b58b48ea6690652825fe6c6aadc3a406f2804a0b286067c8957f6e78edfe2

SHA512
4a730d11d479f639a83466a600acbc2074f0fc912cbb87a3c138aed0c3c0fadb4707da314d4e59cd4338ab676e9bd8c4725e638ec90e998f55266a84436733c6

Download Submit
C:\Windows\System\zXRXCLT.exe

Filesize
1.5MB

MD5
ef134a80ce76173cc911ea5aa55a817b

SHA1
293707c82dc64d01934a3f8a0686ab40ac42ff00

SHA256
cee8ae2aa7680dafbd1c45bbb57ab939c61a92216de1b535320db50ee4097b8a

SHA512
22378a6f0b0ea1dbdf8b0a3ecd1597c03e13419b17503856a38b515ff8aad0729c28694727462bac98d6aa24e076f9c21f3e2ec840a617663c707ac3f1c8117f

Download Submit
C:\Windows\System\zlHNHhh.exe

Filesize
1.5MB

MD5
2a90abd2fafdb40a66627a6953257e87

SHA1
f710f6c2fb2e0832bd485b20c497dccec5271a0c

SHA256
88b103d1d0080dcdce0935fbc4ea012dfdbba10068ec81e8d31f97ac79cc3733

SHA512
b60f04feae75803cabd02de945f6014db391cb51f15e33a86ce9871bc3e1669df0a2746983f3e4ea25228769a41323b172f98f502584ec71d8ab12a95f5c8e0b

Download Submit
memory/4864-0-0x0000013F9AD30000-0x0000013F9AD40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads