xmrig | daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
Size

1.3MB
MD5

628aaf44de6c4ac926ddad27dc968941
SHA1

15658150687f825cfb08f4bbc39131da17f7ec5c
SHA256

daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a
SHA512

05c735af40b2bcb847a2a16a2dba503db9f57d6a1dee95e190a4269fa2c2498f212cc686cadba689faa8b2e489cf170ab8f43260af7bdf9635db484d062dfcbe
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc9:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5f

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b37-4.dat	xmrig
behavioral2/files/0x000a000000023b9a-9.dat	xmrig
behavioral2/files/0x000a000000023b9b-18.dat	xmrig
behavioral2/files/0x000a000000023b9c-20.dat	xmrig
behavioral2/files/0x000a000000023ba1-40.dat	xmrig
behavioral2/files/0x000a000000023ba0-43.dat	xmrig
behavioral2/files/0x000a000000023b9f-41.dat	xmrig
behavioral2/files/0x000b000000023b97-33.dat	xmrig
behavioral2/files/0x000a000000023b9d-30.dat	xmrig
behavioral2/files/0x000a000000023ba2-49.dat	xmrig
behavioral2/files/0x000b000000023ba3-54.dat	xmrig
behavioral2/files/0x000b000000023ba4-60.dat	xmrig
behavioral2/files/0x000b000000023ba5-64.dat	xmrig
behavioral2/files/0x000a000000023bad-71.dat	xmrig
behavioral2/files/0x000e000000023bb4-75.dat	xmrig
behavioral2/files/0x0009000000023bc2-85.dat	xmrig
behavioral2/files/0x0009000000023bc3-86.dat	xmrig
behavioral2/files/0x0009000000023bc4-102.dat	xmrig
behavioral2/files/0x0008000000023c04-151.dat	xmrig
behavioral2/files/0x0008000000023c25-174.dat	xmrig
behavioral2/files/0x0008000000023c24-173.dat	xmrig
behavioral2/files/0x0008000000023c23-172.dat	xmrig
behavioral2/files/0x0008000000023bff-166.dat	xmrig
behavioral2/files/0x0008000000023c1d-165.dat	xmrig
behavioral2/files/0x0008000000023c0b-158.dat	xmrig
behavioral2/files/0x0008000000023c0a-157.dat	xmrig
behavioral2/files/0x0008000000023c09-155.dat	xmrig
behavioral2/files/0x0008000000023bce-149.dat	xmrig
behavioral2/files/0x0008000000023c03-147.dat	xmrig
behavioral2/files/0x0008000000023c02-141.dat	xmrig
behavioral2/files/0x0008000000023c01-140.dat	xmrig
behavioral2/files/0x0008000000023bd0-137.dat	xmrig
behavioral2/files/0x0008000000023bcf-133.dat	xmrig
behavioral2/files/0x0008000000023c00-131.dat	xmrig
behavioral2/files/0x0008000000023bcd-127.dat	xmrig
behavioral2/files/0x000e000000023bc8-118.dat	xmrig
behavioral2/files/0x0008000000023bca-107.dat	xmrig
behavioral2/files/0x0008000000023bbd-80.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2772	rYiDzjk.exe
3620	LsZyMPV.exe
3460	WRheJYE.exe
4428	YqSanHb.exe
4304	oMGKLLU.exe
4540	WOTDQnV.exe
2956	bdIEQQX.exe
1400	dqAbGZn.exe
3944	iquDfVZ.exe
1428	DpIEoRj.exe
3920	nHJQOiB.exe
4056	unagjqx.exe
2368	xDnkmrr.exe
4496	mYlOJTy.exe
3032	JjABdSJ.exe
324	uAwvInV.exe
1944	VYLoUXK.exe
3104	jrOHJIU.exe
4652	vGKhRII.exe
3512	qDGYnAI.exe
4236	QaVgzyC.exe
2760	wkgbAbn.exe
3752	fwlGzAp.exe
4440	cVZpjAX.exe
1208	dkLkkpn.exe
2228	wQdIwxk.exe
3508	ImNRsWy.exe
3708	xNtIwQE.exe
2912	dVhXnlL.exe
4444	cbuPyqD.exe
4224	cCIsYWC.exe
1960	FVLlzsW.exe
4020	AlhWddk.exe
1012	TxYNlpZ.exe
4460	iAcwXEJ.exe
1032	gtTANmV.exe
1604	XgAYCKp.exe
1860	LYvuhMI.exe
860	bXLTikm.exe
1748	sSIYtKR.exe
4848	usHKopj.exe
4956	jhZGNbP.exe
2116	SWVtSFF.exe
4520	vVbaFYY.exe
4812	WrstJmt.exe
4608	SMpOhPF.exe
1620	LtKILws.exe
4884	YLnVnRR.exe
1832	lJRBSXX.exe
4900	FWjZxYz.exe
2364	PEjoYvT.exe
4208	yFIKWPK.exe
1092	PgkdFKK.exe
2152	cjNWbQS.exe
2812	guMvzTv.exe
5088	HmxpATG.exe
3360	uBObUHY.exe
2044	VsfoCSu.exe
1084	JtIkszQ.exe
1200	AZVgDjk.exe
972	JcEBwll.exe
2836	HzvsAoJ.exe
4176	FgvLiKf.exe
4312	LHCgOon.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XbPhjNr.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\niiuAkz.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\piQGyIn.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\xFGStuH.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\FmZYVTp.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\QOVcwie.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\sWbAqIt.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\bbfIctM.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\lYBYXfx.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\oWKIaZr.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\UTtsZzf.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\EWhmiNw.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\jrOHJIU.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\fpRANIo.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\dQAYnJL.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\DrivkBX.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\gUwSABe.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\QncDCci.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\UXoGPWC.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\ZMLzXsu.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\weDdryb.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\yhjbXPW.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\EmBWeCC.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\mpQdbYz.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\ZIWGdqD.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\dFEYsXe.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\rZFpmTB.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\nJfJcvL.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\Itzgwrv.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\FgvLiKf.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\PApZWyV.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\cGUSFoA.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\mvFBlgN.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\TtHMtdl.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\wlJShSU.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\aslAWbB.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\yTaWrMn.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\FWjZxYz.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\stdeQpO.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\SJJIdTY.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\BzfXBwV.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\KoMVgBV.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\RNANrDe.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\YacADVm.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\zySQGCB.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\VEQEAvt.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\CiQmPvd.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\sSIYtKR.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\sBWRXRY.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\NyjqQfO.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\fbHPdCR.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\TfGaCfs.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\cUaEhHw.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\PYJAlFF.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\DpIEoRj.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\DgOuCco.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\GQfDHbw.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\JSSnsFh.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\yFIKWPK.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\HbZMyBu.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\TDaBEWS.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\ougsaLH.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\eiupVJX.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
File created	C:\Windows\System\kvZqVvA.exe	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2772	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	84
PID 1648 wrote to memory of 2772	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	84
PID 1648 wrote to memory of 3620	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	85
PID 1648 wrote to memory of 3620	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	85
PID 1648 wrote to memory of 3460	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	86
PID 1648 wrote to memory of 3460	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	86
PID 1648 wrote to memory of 4428	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	87
PID 1648 wrote to memory of 4428	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	87
PID 1648 wrote to memory of 4304	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	88
PID 1648 wrote to memory of 4304	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	88
PID 1648 wrote to memory of 4540	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	89
PID 1648 wrote to memory of 4540	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	89
PID 1648 wrote to memory of 2956	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	90
PID 1648 wrote to memory of 2956	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	90
PID 1648 wrote to memory of 1400	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	91
PID 1648 wrote to memory of 1400	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	91
PID 1648 wrote to memory of 3944	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	92
PID 1648 wrote to memory of 3944	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	92
PID 1648 wrote to memory of 1428	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	93
PID 1648 wrote to memory of 1428	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	93
PID 1648 wrote to memory of 3920	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	96
PID 1648 wrote to memory of 3920	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	96
PID 1648 wrote to memory of 4056	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	97
PID 1648 wrote to memory of 4056	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	97
PID 1648 wrote to memory of 2368	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	98
PID 1648 wrote to memory of 2368	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	98
PID 1648 wrote to memory of 4496	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	100
PID 1648 wrote to memory of 4496	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	100
PID 1648 wrote to memory of 324	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	101
PID 1648 wrote to memory of 324	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	101
PID 1648 wrote to memory of 3032	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	102
PID 1648 wrote to memory of 3032	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	102
PID 1648 wrote to memory of 1944	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	103
PID 1648 wrote to memory of 1944	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	103
PID 1648 wrote to memory of 3104	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	104
PID 1648 wrote to memory of 3104	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	104
PID 1648 wrote to memory of 4652	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	105
PID 1648 wrote to memory of 4652	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	105
PID 1648 wrote to memory of 3512	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	106
PID 1648 wrote to memory of 3512	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	106
PID 1648 wrote to memory of 4236	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	107
PID 1648 wrote to memory of 4236	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	107
PID 1648 wrote to memory of 2760	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	108
PID 1648 wrote to memory of 2760	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	108
PID 1648 wrote to memory of 3752	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	109
PID 1648 wrote to memory of 3752	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	109
PID 1648 wrote to memory of 4440	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	110
PID 1648 wrote to memory of 4440	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	110
PID 1648 wrote to memory of 1208	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	111
PID 1648 wrote to memory of 1208	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	111
PID 1648 wrote to memory of 2228	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	112
PID 1648 wrote to memory of 2228	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	112
PID 1648 wrote to memory of 3508	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	113
PID 1648 wrote to memory of 3508	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	113
PID 1648 wrote to memory of 3708	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	114
PID 1648 wrote to memory of 3708	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	114
PID 1648 wrote to memory of 2912	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	115
PID 1648 wrote to memory of 2912	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	115
PID 1648 wrote to memory of 4444	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	116
PID 1648 wrote to memory of 4444	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	116
PID 1648 wrote to memory of 4224	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	117
PID 1648 wrote to memory of 4224	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	117
PID 1648 wrote to memory of 1960	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	118
PID 1648 wrote to memory of 1960	1648	daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe	118

C:\Users\Admin\AppData\Local\Temp\daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe
"C:\Users\Admin\AppData\Local\Temp\daf4c4bcfe04f6627661c111582f8646e41cf80ceab1f4e76b86b3f17032b61a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\System\rYiDzjk.exe
  C:\Windows\System\rYiDzjk.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\LsZyMPV.exe
  C:\Windows\System\LsZyMPV.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\WRheJYE.exe
  C:\Windows\System\WRheJYE.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\YqSanHb.exe
  C:\Windows\System\YqSanHb.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\oMGKLLU.exe
  C:\Windows\System\oMGKLLU.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\WOTDQnV.exe
  C:\Windows\System\WOTDQnV.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\bdIEQQX.exe
  C:\Windows\System\bdIEQQX.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\dqAbGZn.exe
  C:\Windows\System\dqAbGZn.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\iquDfVZ.exe
  C:\Windows\System\iquDfVZ.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\DpIEoRj.exe
  C:\Windows\System\DpIEoRj.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\nHJQOiB.exe
  C:\Windows\System\nHJQOiB.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\unagjqx.exe
  C:\Windows\System\unagjqx.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\xDnkmrr.exe
  C:\Windows\System\xDnkmrr.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\mYlOJTy.exe
  C:\Windows\System\mYlOJTy.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\uAwvInV.exe
  C:\Windows\System\uAwvInV.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\JjABdSJ.exe
  C:\Windows\System\JjABdSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\VYLoUXK.exe
  C:\Windows\System\VYLoUXK.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\jrOHJIU.exe
  C:\Windows\System\jrOHJIU.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\vGKhRII.exe
  C:\Windows\System\vGKhRII.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\qDGYnAI.exe
  C:\Windows\System\qDGYnAI.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\QaVgzyC.exe
  C:\Windows\System\QaVgzyC.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\wkgbAbn.exe
  C:\Windows\System\wkgbAbn.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\fwlGzAp.exe
  C:\Windows\System\fwlGzAp.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\cVZpjAX.exe
  C:\Windows\System\cVZpjAX.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\dkLkkpn.exe
  C:\Windows\System\dkLkkpn.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\wQdIwxk.exe
  C:\Windows\System\wQdIwxk.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\ImNRsWy.exe
  C:\Windows\System\ImNRsWy.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\xNtIwQE.exe
  C:\Windows\System\xNtIwQE.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\dVhXnlL.exe
  C:\Windows\System\dVhXnlL.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\cbuPyqD.exe
  C:\Windows\System\cbuPyqD.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\cCIsYWC.exe
  C:\Windows\System\cCIsYWC.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\FVLlzsW.exe
  C:\Windows\System\FVLlzsW.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\AlhWddk.exe
  C:\Windows\System\AlhWddk.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\TxYNlpZ.exe
  C:\Windows\System\TxYNlpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\iAcwXEJ.exe
  C:\Windows\System\iAcwXEJ.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\gtTANmV.exe
  C:\Windows\System\gtTANmV.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\XgAYCKp.exe
  C:\Windows\System\XgAYCKp.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\LYvuhMI.exe
  C:\Windows\System\LYvuhMI.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\bXLTikm.exe
  C:\Windows\System\bXLTikm.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\sSIYtKR.exe
  C:\Windows\System\sSIYtKR.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\usHKopj.exe
  C:\Windows\System\usHKopj.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\jhZGNbP.exe
  C:\Windows\System\jhZGNbP.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\SWVtSFF.exe
  C:\Windows\System\SWVtSFF.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\vVbaFYY.exe
  C:\Windows\System\vVbaFYY.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\WrstJmt.exe
  C:\Windows\System\WrstJmt.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\SMpOhPF.exe
  C:\Windows\System\SMpOhPF.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\LtKILws.exe
  C:\Windows\System\LtKILws.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\lJRBSXX.exe
  C:\Windows\System\lJRBSXX.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\FWjZxYz.exe
  C:\Windows\System\FWjZxYz.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\PEjoYvT.exe
  C:\Windows\System\PEjoYvT.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\yFIKWPK.exe
  C:\Windows\System\yFIKWPK.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\PgkdFKK.exe
  C:\Windows\System\PgkdFKK.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\cjNWbQS.exe
  C:\Windows\System\cjNWbQS.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\guMvzTv.exe
  C:\Windows\System\guMvzTv.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\HmxpATG.exe
  C:\Windows\System\HmxpATG.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\uBObUHY.exe
  C:\Windows\System\uBObUHY.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\YLnVnRR.exe
  C:\Windows\System\YLnVnRR.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\VsfoCSu.exe
  C:\Windows\System\VsfoCSu.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\JtIkszQ.exe
  C:\Windows\System\JtIkszQ.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\AZVgDjk.exe
  C:\Windows\System\AZVgDjk.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\JcEBwll.exe
  C:\Windows\System\JcEBwll.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\HzvsAoJ.exe
  C:\Windows\System\HzvsAoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\FgvLiKf.exe
  C:\Windows\System\FgvLiKf.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\LHCgOon.exe
  C:\Windows\System\LHCgOon.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\tlTGRrp.exe
  C:\Windows\System\tlTGRrp.exe
  2⤵
  PID:4424
- C:\Windows\System\yiAJeiM.exe
  C:\Windows\System\yiAJeiM.exe
  2⤵
  PID:4464
- C:\Windows\System\wfIMKzi.exe
  C:\Windows\System\wfIMKzi.exe
  2⤵
  PID:3560
- C:\Windows\System\pIKmGUB.exe
  C:\Windows\System\pIKmGUB.exe
  2⤵
  PID:2572
- C:\Windows\System\nPjGdkQ.exe
  C:\Windows\System\nPjGdkQ.exe
  2⤵
  PID:816
- C:\Windows\System\jEUOZYL.exe
  C:\Windows\System\jEUOZYL.exe
  2⤵
  PID:4660
- C:\Windows\System\iPDpdfY.exe
  C:\Windows\System\iPDpdfY.exe
  2⤵
  PID:1096
- C:\Windows\System\TtKjadZ.exe
  C:\Windows\System\TtKjadZ.exe
  2⤵
  PID:392
- C:\Windows\System\wSrLZOq.exe
  C:\Windows\System\wSrLZOq.exe
  2⤵
  PID:984
- C:\Windows\System\SVwNxLM.exe
  C:\Windows\System\SVwNxLM.exe
  2⤵
  PID:3260
- C:\Windows\System\koYuePQ.exe
  C:\Windows\System\koYuePQ.exe
  2⤵
  PID:4628
- C:\Windows\System\jxUjdlb.exe
  C:\Windows\System\jxUjdlb.exe
  2⤵
  PID:3756
- C:\Windows\System\VzLSRlD.exe
  C:\Windows\System\VzLSRlD.exe
  2⤵
  PID:3556
- C:\Windows\System\vwhwsMn.exe
  C:\Windows\System\vwhwsMn.exe
  2⤵
  PID:892
- C:\Windows\System\fXpUSqy.exe
  C:\Windows\System\fXpUSqy.exe
  2⤵
  PID:3800
- C:\Windows\System\ETFShBn.exe
  C:\Windows\System\ETFShBn.exe
  2⤵
  PID:4328
- C:\Windows\System\waPFujk.exe
  C:\Windows\System\waPFujk.exe
  2⤵
  PID:2584
- C:\Windows\System\LLnsRkL.exe
  C:\Windows\System\LLnsRkL.exe
  2⤵
  PID:3332
- C:\Windows\System\yaRnLTF.exe
  C:\Windows\System\yaRnLTF.exe
  2⤵
  PID:544
- C:\Windows\System\aOTYMji.exe
  C:\Windows\System\aOTYMji.exe
  2⤵
  PID:212
- C:\Windows\System\JkXVuoO.exe
  C:\Windows\System\JkXVuoO.exe
  2⤵
  PID:3500
- C:\Windows\System\eKhiMkO.exe
  C:\Windows\System\eKhiMkO.exe
  2⤵
  PID:4888
- C:\Windows\System\UDVNlKy.exe
  C:\Windows\System\UDVNlKy.exe
  2⤵
  PID:952
- C:\Windows\System\SpVHSat.exe
  C:\Windows\System\SpVHSat.exe
  2⤵
  PID:1728
- C:\Windows\System\mdQHHHL.exe
  C:\Windows\System\mdQHHHL.exe
  2⤵
  PID:1676
- C:\Windows\System\QOVcwie.exe
  C:\Windows\System\QOVcwie.exe
  2⤵
  PID:3980
- C:\Windows\System\aIGuWZP.exe
  C:\Windows\System\aIGuWZP.exe
  2⤵
  PID:4472
- C:\Windows\System\wMYJuhF.exe
  C:\Windows\System\wMYJuhF.exe
  2⤵
  PID:3640
- C:\Windows\System\CmfnxzY.exe
  C:\Windows\System\CmfnxzY.exe
  2⤵
  PID:4756
- C:\Windows\System\TUSoBRr.exe
  C:\Windows\System\TUSoBRr.exe
  2⤵
  PID:2188
- C:\Windows\System\eREKaZZ.exe
  C:\Windows\System\eREKaZZ.exe
  2⤵
  PID:64
- C:\Windows\System\jAYHhMX.exe
  C:\Windows\System\jAYHhMX.exe
  2⤵
  PID:5164
- C:\Windows\System\qkPLokr.exe
  C:\Windows\System\qkPLokr.exe
  2⤵
  PID:5200
- C:\Windows\System\wjpuVES.exe
  C:\Windows\System\wjpuVES.exe
  2⤵
  PID:5220
- C:\Windows\System\RNANrDe.exe
  C:\Windows\System\RNANrDe.exe
  2⤵
  PID:5236
- C:\Windows\System\uJjdZJl.exe
  C:\Windows\System\uJjdZJl.exe
  2⤵
  PID:5260
- C:\Windows\System\pUZkQaS.exe
  C:\Windows\System\pUZkQaS.exe
  2⤵
  PID:5276
- C:\Windows\System\sgpifcb.exe
  C:\Windows\System\sgpifcb.exe
  2⤵
  PID:5296
- C:\Windows\System\xxdXiNH.exe
  C:\Windows\System\xxdXiNH.exe
  2⤵
  PID:5320
- C:\Windows\System\HZcFjDf.exe
  C:\Windows\System\HZcFjDf.exe
  2⤵
  PID:5344
- C:\Windows\System\DgOuCco.exe
  C:\Windows\System\DgOuCco.exe
  2⤵
  PID:5360
- C:\Windows\System\VSpyLch.exe
  C:\Windows\System\VSpyLch.exe
  2⤵
  PID:5388
- C:\Windows\System\LoMSGEJ.exe
  C:\Windows\System\LoMSGEJ.exe
  2⤵
  PID:5408
- C:\Windows\System\PTAQjFW.exe
  C:\Windows\System\PTAQjFW.exe
  2⤵
  PID:5436
- C:\Windows\System\sWbAqIt.exe
  C:\Windows\System\sWbAqIt.exe
  2⤵
  PID:5468
- C:\Windows\System\pwYILlv.exe
  C:\Windows\System\pwYILlv.exe
  2⤵
  PID:5500
- C:\Windows\System\lyImDqq.exe
  C:\Windows\System\lyImDqq.exe
  2⤵
  PID:5528
- C:\Windows\System\jiudvIC.exe
  C:\Windows\System\jiudvIC.exe
  2⤵
  PID:5556
- C:\Windows\System\tmEbIQQ.exe
  C:\Windows\System\tmEbIQQ.exe
  2⤵
  PID:5588
- C:\Windows\System\sXXrvUh.exe
  C:\Windows\System\sXXrvUh.exe
  2⤵
  PID:5608
- C:\Windows\System\rtNniCl.exe
  C:\Windows\System\rtNniCl.exe
  2⤵
  PID:5648
- C:\Windows\System\YOiNPhx.exe
  C:\Windows\System\YOiNPhx.exe
  2⤵
  PID:5688
- C:\Windows\System\xHTeXMC.exe
  C:\Windows\System\xHTeXMC.exe
  2⤵
  PID:5708
- C:\Windows\System\vTuctLJ.exe
  C:\Windows\System\vTuctLJ.exe
  2⤵
  PID:5744
- C:\Windows\System\GhoTGVD.exe
  C:\Windows\System\GhoTGVD.exe
  2⤵
  PID:5768
- C:\Windows\System\FsgHNBi.exe
  C:\Windows\System\FsgHNBi.exe
  2⤵
  PID:5796
- C:\Windows\System\TtHMtdl.exe
  C:\Windows\System\TtHMtdl.exe
  2⤵
  PID:5824
- C:\Windows\System\QrurbNB.exe
  C:\Windows\System\QrurbNB.exe
  2⤵
  PID:5852
- C:\Windows\System\uIzNzoy.exe
  C:\Windows\System\uIzNzoy.exe
  2⤵
  PID:5880
- C:\Windows\System\mYvMqJB.exe
  C:\Windows\System\mYvMqJB.exe
  2⤵
  PID:5908
- C:\Windows\System\HhZXkvB.exe
  C:\Windows\System\HhZXkvB.exe
  2⤵
  PID:5940
- C:\Windows\System\FoqskIx.exe
  C:\Windows\System\FoqskIx.exe
  2⤵
  PID:5972
- C:\Windows\System\IJESagw.exe
  C:\Windows\System\IJESagw.exe
  2⤵
  PID:5996
- C:\Windows\System\oELuZSN.exe
  C:\Windows\System\oELuZSN.exe
  2⤵
  PID:6024
- C:\Windows\System\YySHCRd.exe
  C:\Windows\System\YySHCRd.exe
  2⤵
  PID:6060
- C:\Windows\System\xsUwGuM.exe
  C:\Windows\System\xsUwGuM.exe
  2⤵
  PID:6084
- C:\Windows\System\MvqSoki.exe
  C:\Windows\System\MvqSoki.exe
  2⤵
  PID:6116
- C:\Windows\System\bmjAwXL.exe
  C:\Windows\System\bmjAwXL.exe
  2⤵
  PID:1740
- C:\Windows\System\pkMtAvS.exe
  C:\Windows\System\pkMtAvS.exe
  2⤵
  PID:1852
- C:\Windows\System\hrkaQXh.exe
  C:\Windows\System\hrkaQXh.exe
  2⤵
  PID:1760
- C:\Windows\System\OWUUhGy.exe
  C:\Windows\System\OWUUhGy.exe
  2⤵
  PID:2012
- C:\Windows\System\knEiAfV.exe
  C:\Windows\System\knEiAfV.exe
  2⤵
  PID:2940
- C:\Windows\System\vOtCmuk.exe
  C:\Windows\System\vOtCmuk.exe
  2⤵
  PID:5252
- C:\Windows\System\UXoGPWC.exe
  C:\Windows\System\UXoGPWC.exe
  2⤵
  PID:3356
- C:\Windows\System\LfrfasF.exe
  C:\Windows\System\LfrfasF.exe
  2⤵
  PID:1824
- C:\Windows\System\qHhgWzV.exe
  C:\Windows\System\qHhgWzV.exe
  2⤵
  PID:2124
- C:\Windows\System\FBbzBXe.exe
  C:\Windows\System\FBbzBXe.exe
  2⤵
  PID:4820
- C:\Windows\System\cRDxiDV.exe
  C:\Windows\System\cRDxiDV.exe
  2⤵
  PID:5232
- C:\Windows\System\NKLKQny.exe
  C:\Windows\System\NKLKQny.exe
  2⤵
  PID:5288
- C:\Windows\System\ftNTzBy.exe
  C:\Windows\System\ftNTzBy.exe
  2⤵
  PID:5376
- C:\Windows\System\kYGvPzf.exe
  C:\Windows\System\kYGvPzf.exe
  2⤵
  PID:5464
- C:\Windows\System\hcBkbNk.exe
  C:\Windows\System\hcBkbNk.exe
  2⤵
  PID:5636
- C:\Windows\System\NCcJNfX.exe
  C:\Windows\System\NCcJNfX.exe
  2⤵
  PID:5820
- C:\Windows\System\cyhxTNs.exe
  C:\Windows\System\cyhxTNs.exe
  2⤵
  PID:5952
- C:\Windows\System\elVByCX.exe
  C:\Windows\System\elVByCX.exe
  2⤵
  PID:6048
- C:\Windows\System\yRkQTwm.exe
  C:\Windows\System\yRkQTwm.exe
  2⤵
  PID:5764
- C:\Windows\System\SPLiKOH.exe
  C:\Windows\System\SPLiKOH.exe
  2⤵
  PID:3520
- C:\Windows\System\vDpAlUO.exe
  C:\Windows\System\vDpAlUO.exe
  2⤵
  PID:5892
- C:\Windows\System\EPfstBo.exe
  C:\Windows\System\EPfstBo.exe
  2⤵
  PID:5984
- C:\Windows\System\fOUPNHC.exe
  C:\Windows\System\fOUPNHC.exe
  2⤵
  PID:6100
- C:\Windows\System\WdxGGMi.exe
  C:\Windows\System\WdxGGMi.exe
  2⤵
  PID:5188
- C:\Windows\System\pMdQohG.exe
  C:\Windows\System\pMdQohG.exe
  2⤵
  PID:1172
- C:\Windows\System\VZtiTqH.exe
  C:\Windows\System\VZtiTqH.exe
  2⤵
  PID:2308
- C:\Windows\System\GugDMSA.exe
  C:\Windows\System\GugDMSA.exe
  2⤵
  PID:5448
- C:\Windows\System\WcjWsjr.exe
  C:\Windows\System\WcjWsjr.exe
  2⤵
  PID:5540
- C:\Windows\System\YKOoEsa.exe
  C:\Windows\System\YKOoEsa.exe
  2⤵
  PID:5576
- C:\Windows\System\agchLix.exe
  C:\Windows\System\agchLix.exe
  2⤵
  PID:5888
- C:\Windows\System\ZMLzXsu.exe
  C:\Windows\System\ZMLzXsu.exe
  2⤵
  PID:5020
- C:\Windows\System\TZNxXEZ.exe
  C:\Windows\System\TZNxXEZ.exe
  2⤵
  PID:5696
- C:\Windows\System\NdpXNkV.exe
  C:\Windows\System\NdpXNkV.exe
  2⤵
  PID:6156
- C:\Windows\System\CrOfYiN.exe
  C:\Windows\System\CrOfYiN.exe
  2⤵
  PID:6188
- C:\Windows\System\rNNqsGj.exe
  C:\Windows\System\rNNqsGj.exe
  2⤵
  PID:6220
- C:\Windows\System\fwZBulR.exe
  C:\Windows\System\fwZBulR.exe
  2⤵
  PID:6244
- C:\Windows\System\uecmLcC.exe
  C:\Windows\System\uecmLcC.exe
  2⤵
  PID:6272
- C:\Windows\System\VFcHGVx.exe
  C:\Windows\System\VFcHGVx.exe
  2⤵
  PID:6308
- C:\Windows\System\jxuHCxg.exe
  C:\Windows\System\jxuHCxg.exe
  2⤵
  PID:6336
- C:\Windows\System\GQfDHbw.exe
  C:\Windows\System\GQfDHbw.exe
  2⤵
  PID:6364
- C:\Windows\System\QqPPMIc.exe
  C:\Windows\System\QqPPMIc.exe
  2⤵
  PID:6396
- C:\Windows\System\xkBDxiT.exe
  C:\Windows\System\xkBDxiT.exe
  2⤵
  PID:6416
- C:\Windows\System\BllTBps.exe
  C:\Windows\System\BllTBps.exe
  2⤵
  PID:6448
- C:\Windows\System\gHgFaTB.exe
  C:\Windows\System\gHgFaTB.exe
  2⤵
  PID:6472
- C:\Windows\System\xFGStuH.exe
  C:\Windows\System\xFGStuH.exe
  2⤵
  PID:6496
- C:\Windows\System\heYmrzd.exe
  C:\Windows\System\heYmrzd.exe
  2⤵
  PID:6516
- C:\Windows\System\kMaprdt.exe
  C:\Windows\System\kMaprdt.exe
  2⤵
  PID:6548
- C:\Windows\System\TIqzrBK.exe
  C:\Windows\System\TIqzrBK.exe
  2⤵
  PID:6568
- C:\Windows\System\GQGfZqt.exe
  C:\Windows\System\GQGfZqt.exe
  2⤵
  PID:6596
- C:\Windows\System\mFhaLBh.exe
  C:\Windows\System\mFhaLBh.exe
  2⤵
  PID:6624
- C:\Windows\System\bwqKGij.exe
  C:\Windows\System\bwqKGij.exe
  2⤵
  PID:6648
- C:\Windows\System\XxBrWTc.exe
  C:\Windows\System\XxBrWTc.exe
  2⤵
  PID:6672
- C:\Windows\System\oGCajLO.exe
  C:\Windows\System\oGCajLO.exe
  2⤵
  PID:6696
- C:\Windows\System\HDxLCvW.exe
  C:\Windows\System\HDxLCvW.exe
  2⤵
  PID:6724
- C:\Windows\System\DgWvJEK.exe
  C:\Windows\System\DgWvJEK.exe
  2⤵
  PID:6748
- C:\Windows\System\SuddbKe.exe
  C:\Windows\System\SuddbKe.exe
  2⤵
  PID:6776
- C:\Windows\System\BgDGXiS.exe
  C:\Windows\System\BgDGXiS.exe
  2⤵
  PID:6796
- C:\Windows\System\UTtsZzf.exe
  C:\Windows\System\UTtsZzf.exe
  2⤵
  PID:6828
- C:\Windows\System\Hefqymy.exe
  C:\Windows\System\Hefqymy.exe
  2⤵
  PID:6856
- C:\Windows\System\wLgqphc.exe
  C:\Windows\System\wLgqphc.exe
  2⤵
  PID:6880
- C:\Windows\System\NXgzANS.exe
  C:\Windows\System\NXgzANS.exe
  2⤵
  PID:6916
- C:\Windows\System\sBraXLG.exe
  C:\Windows\System\sBraXLG.exe
  2⤵
  PID:6948
- C:\Windows\System\jgrSaiL.exe
  C:\Windows\System\jgrSaiL.exe
  2⤵
  PID:6972
- C:\Windows\System\QPhUcUL.exe
  C:\Windows\System\QPhUcUL.exe
  2⤵
  PID:7004
- C:\Windows\System\zIuLFFg.exe
  C:\Windows\System\zIuLFFg.exe
  2⤵
  PID:7028
- C:\Windows\System\yIhkoNC.exe
  C:\Windows\System\yIhkoNC.exe
  2⤵
  PID:7056
- C:\Windows\System\RLlzTtD.exe
  C:\Windows\System\RLlzTtD.exe
  2⤵
  PID:7080
- C:\Windows\System\UNrFIuQ.exe
  C:\Windows\System\UNrFIuQ.exe
  2⤵
  PID:7100
- C:\Windows\System\tbSpKkM.exe
  C:\Windows\System\tbSpKkM.exe
  2⤵
  PID:7124
- C:\Windows\System\kIaOOkl.exe
  C:\Windows\System\kIaOOkl.exe
  2⤵
  PID:7152
- C:\Windows\System\SotSKmr.exe
  C:\Windows\System\SotSKmr.exe
  2⤵
  PID:5248
- C:\Windows\System\SpiQwxF.exe
  C:\Windows\System\SpiQwxF.exe
  2⤵
  PID:4264
- C:\Windows\System\FPzaDzL.exe
  C:\Windows\System\FPzaDzL.exe
  2⤵
  PID:5148
- C:\Windows\System\InwEaRX.exe
  C:\Windows\System\InwEaRX.exe
  2⤵
  PID:6020
- C:\Windows\System\zCeLHtS.exe
  C:\Windows\System\zCeLHtS.exe
  2⤵
  PID:6204
- C:\Windows\System\NKIaVLX.exe
  C:\Windows\System\NKIaVLX.exe
  2⤵
  PID:6228
- C:\Windows\System\caRvSxk.exe
  C:\Windows\System\caRvSxk.exe
  2⤵
  PID:5268
- C:\Windows\System\FmjTTwS.exe
  C:\Windows\System\FmjTTwS.exe
  2⤵
  PID:6484
- C:\Windows\System\jZTRGPU.exe
  C:\Windows\System\jZTRGPU.exe
  2⤵
  PID:6332
- C:\Windows\System\WzrDRbL.exe
  C:\Windows\System\WzrDRbL.exe
  2⤵
  PID:6380
- C:\Windows\System\vzOQCNC.exe
  C:\Windows\System\vzOQCNC.exe
  2⤵
  PID:6440
- C:\Windows\System\xxbNvpf.exe
  C:\Windows\System\xxbNvpf.exe
  2⤵
  PID:6612
- C:\Windows\System\fltLtam.exe
  C:\Windows\System\fltLtam.exe
  2⤵
  PID:6468
- C:\Windows\System\ifupeck.exe
  C:\Windows\System\ifupeck.exe
  2⤵
  PID:6852
- C:\Windows\System\rZFpmTB.exe
  C:\Windows\System\rZFpmTB.exe
  2⤵
  PID:6564
- C:\Windows\System\SxoySdo.exe
  C:\Windows\System\SxoySdo.exe
  2⤵
  PID:6584
- C:\Windows\System\ttbSMNs.exe
  C:\Windows\System\ttbSMNs.exe
  2⤵
  PID:6792
- C:\Windows\System\epPiLcj.exe
  C:\Windows\System\epPiLcj.exe
  2⤵
  PID:6680
- C:\Windows\System\TYEVeLr.exe
  C:\Windows\System\TYEVeLr.exe
  2⤵
  PID:6908
- C:\Windows\System\oLIFXuR.exe
  C:\Windows\System\oLIFXuR.exe
  2⤵
  PID:6940
- C:\Windows\System\XFEYihI.exe
  C:\Windows\System\XFEYihI.exe
  2⤵
  PID:6764
- C:\Windows\System\PkznMMy.exe
  C:\Windows\System\PkznMMy.exe
  2⤵
  PID:4836
- C:\Windows\System\cfLdZIw.exe
  C:\Windows\System\cfLdZIw.exe
  2⤵
  PID:5516
- C:\Windows\System\qNOoVXY.exe
  C:\Windows\System\qNOoVXY.exe
  2⤵
  PID:6428
- C:\Windows\System\UvRHyFA.exe
  C:\Windows\System\UvRHyFA.exe
  2⤵
  PID:7096
- C:\Windows\System\EQaMdFK.exe
  C:\Windows\System\EQaMdFK.exe
  2⤵
  PID:6324
- C:\Windows\System\JSSnsFh.exe
  C:\Windows\System\JSSnsFh.exe
  2⤵
  PID:7044
- C:\Windows\System\TAQpYXm.exe
  C:\Windows\System\TAQpYXm.exe
  2⤵
  PID:7188
- C:\Windows\System\PPvtAzz.exe
  C:\Windows\System\PPvtAzz.exe
  2⤵
  PID:7216
- C:\Windows\System\fHXQhbL.exe
  C:\Windows\System\fHXQhbL.exe
  2⤵
  PID:7248
- C:\Windows\System\sSkrJaH.exe
  C:\Windows\System\sSkrJaH.exe
  2⤵
  PID:7272
- C:\Windows\System\YmsSOsn.exe
  C:\Windows\System\YmsSOsn.exe
  2⤵
  PID:7296
- C:\Windows\System\MImLOnS.exe
  C:\Windows\System\MImLOnS.exe
  2⤵
  PID:7316
- C:\Windows\System\cUaEhHw.exe
  C:\Windows\System\cUaEhHw.exe
  2⤵
  PID:7336
- C:\Windows\System\WJNRcCy.exe
  C:\Windows\System\WJNRcCy.exe
  2⤵
  PID:7364
- C:\Windows\System\axEKRFb.exe
  C:\Windows\System\axEKRFb.exe
  2⤵
  PID:7384
- C:\Windows\System\fHYclpy.exe
  C:\Windows\System\fHYclpy.exe
  2⤵
  PID:7412
- C:\Windows\System\wlJShSU.exe
  C:\Windows\System\wlJShSU.exe
  2⤵
  PID:7436
- C:\Windows\System\mcbOxtu.exe
  C:\Windows\System\mcbOxtu.exe
  2⤵
  PID:7468
- C:\Windows\System\zTCHhky.exe
  C:\Windows\System\zTCHhky.exe
  2⤵
  PID:7488
- C:\Windows\System\TIODUXo.exe
  C:\Windows\System\TIODUXo.exe
  2⤵
  PID:7516
- C:\Windows\System\OlnaNya.exe
  C:\Windows\System\OlnaNya.exe
  2⤵
  PID:7544
- C:\Windows\System\ynYjdGt.exe
  C:\Windows\System\ynYjdGt.exe
  2⤵
  PID:7564
- C:\Windows\System\dFcSZWq.exe
  C:\Windows\System\dFcSZWq.exe
  2⤵
  PID:7588
- C:\Windows\System\YCgeNYp.exe
  C:\Windows\System\YCgeNYp.exe
  2⤵
  PID:7616
- C:\Windows\System\ZFoxOeF.exe
  C:\Windows\System\ZFoxOeF.exe
  2⤵
  PID:7644
- C:\Windows\System\VjtlPyo.exe
  C:\Windows\System\VjtlPyo.exe
  2⤵
  PID:7668
- C:\Windows\System\YWhtndi.exe
  C:\Windows\System\YWhtndi.exe
  2⤵
  PID:7700
- C:\Windows\System\JgtFcYl.exe
  C:\Windows\System\JgtFcYl.exe
  2⤵
  PID:7728
- C:\Windows\System\xfHhJkA.exe
  C:\Windows\System\xfHhJkA.exe
  2⤵
  PID:7744
- C:\Windows\System\RUVCQJv.exe
  C:\Windows\System\RUVCQJv.exe
  2⤵
  PID:7772
- C:\Windows\System\RhORLXg.exe
  C:\Windows\System\RhORLXg.exe
  2⤵
  PID:7800
- C:\Windows\System\rxztErj.exe
  C:\Windows\System\rxztErj.exe
  2⤵
  PID:7824
- C:\Windows\System\ydFZbNx.exe
  C:\Windows\System\ydFZbNx.exe
  2⤵
  PID:7848
- C:\Windows\System\NdSwBAY.exe
  C:\Windows\System\NdSwBAY.exe
  2⤵
  PID:7880
- C:\Windows\System\Fwfayaz.exe
  C:\Windows\System\Fwfayaz.exe
  2⤵
  PID:7896
- C:\Windows\System\wiLUUTk.exe
  C:\Windows\System\wiLUUTk.exe
  2⤵
  PID:7920
- C:\Windows\System\zkodgqs.exe
  C:\Windows\System\zkodgqs.exe
  2⤵
  PID:7944
- C:\Windows\System\gEskddK.exe
  C:\Windows\System\gEskddK.exe
  2⤵
  PID:7972
- C:\Windows\System\yyKutZZ.exe
  C:\Windows\System\yyKutZZ.exe
  2⤵
  PID:8000
- C:\Windows\System\RzEPYtR.exe
  C:\Windows\System\RzEPYtR.exe
  2⤵
  PID:8024
- C:\Windows\System\WkRrniy.exe
  C:\Windows\System\WkRrniy.exe
  2⤵
  PID:8048
- C:\Windows\System\oWtsafA.exe
  C:\Windows\System\oWtsafA.exe
  2⤵
  PID:8080
- C:\Windows\System\tJhcRxr.exe
  C:\Windows\System\tJhcRxr.exe
  2⤵
  PID:8100
- C:\Windows\System\XEhxLue.exe
  C:\Windows\System\XEhxLue.exe
  2⤵
  PID:8128
- C:\Windows\System\YZqJCUO.exe
  C:\Windows\System\YZqJCUO.exe
  2⤵
  PID:8152
- C:\Windows\System\yuQiSyJ.exe
  C:\Windows\System\yuQiSyJ.exe
  2⤵
  PID:8176
- C:\Windows\System\jLwFZxm.exe
  C:\Windows\System\jLwFZxm.exe
  2⤵
  PID:6992
- C:\Windows\System\zMgTzVI.exe
  C:\Windows\System\zMgTzVI.exe
  2⤵
  PID:6556
- C:\Windows\System\eeXYFeo.exe
  C:\Windows\System\eeXYFeo.exe
  2⤵
  PID:6328
- C:\Windows\System\tqerCzw.exe
  C:\Windows\System\tqerCzw.exe
  2⤵
  PID:5960
- C:\Windows\System\sBWRXRY.exe
  C:\Windows\System\sBWRXRY.exe
  2⤵
  PID:7076
- C:\Windows\System\UQtteZN.exe
  C:\Windows\System\UQtteZN.exe
  2⤵
  PID:7328
- C:\Windows\System\DwaYJTW.exe
  C:\Windows\System\DwaYJTW.exe
  2⤵
  PID:6892
- C:\Windows\System\fpRANIo.exe
  C:\Windows\System\fpRANIo.exe
  2⤵
  PID:7476
- C:\Windows\System\wfmshcF.exe
  C:\Windows\System\wfmshcF.exe
  2⤵
  PID:7528
- C:\Windows\System\oZnkbsm.exe
  C:\Windows\System\oZnkbsm.exe
  2⤵
  PID:7584
- C:\Windows\System\mYAGJFt.exe
  C:\Windows\System\mYAGJFt.exe
  2⤵
  PID:7640
- C:\Windows\System\OgRlwSi.exe
  C:\Windows\System\OgRlwSi.exe
  2⤵
  PID:7736
- C:\Windows\System\aUEWKLl.exe
  C:\Windows\System\aUEWKLl.exe
  2⤵
  PID:7228
- C:\Windows\System\OOrFETN.exe
  C:\Windows\System\OOrFETN.exe
  2⤵
  PID:7264
- C:\Windows\System\NLJJFFe.exe
  C:\Windows\System\NLJJFFe.exe
  2⤵
  PID:7552
- C:\Windows\System\uJVsmIB.exe
  C:\Windows\System\uJVsmIB.exe
  2⤵
  PID:7940
- C:\Windows\System\akGQfGM.exe
  C:\Windows\System\akGQfGM.exe
  2⤵
  PID:7396
- C:\Windows\System\GsLGbkR.exe
  C:\Windows\System\GsLGbkR.exe
  2⤵
  PID:7716
- C:\Windows\System\lJSGEfV.exe
  C:\Windows\System\lJSGEfV.exe
  2⤵
  PID:7796
- C:\Windows\System\vCZeGaz.exe
  C:\Windows\System\vCZeGaz.exe
  2⤵
  PID:7560
- C:\Windows\System\kGaZmmj.exe
  C:\Windows\System\kGaZmmj.exe
  2⤵
  PID:7608
- C:\Windows\System\zJDvaKU.exe
  C:\Windows\System\zJDvaKU.exe
  2⤵
  PID:7692
- C:\Windows\System\JxzcMrR.exe
  C:\Windows\System\JxzcMrR.exe
  2⤵
  PID:8216
- C:\Windows\System\rocRqlZ.exe
  C:\Windows\System\rocRqlZ.exe
  2⤵
  PID:8236
- C:\Windows\System\yLhcqZu.exe
  C:\Windows\System\yLhcqZu.exe
  2⤵
  PID:8260
- C:\Windows\System\kJgxzTb.exe
  C:\Windows\System\kJgxzTb.exe
  2⤵
  PID:8288
- C:\Windows\System\YrsNzwy.exe
  C:\Windows\System\YrsNzwy.exe
  2⤵
  PID:8316
- C:\Windows\System\dQAYnJL.exe
  C:\Windows\System\dQAYnJL.exe
  2⤵
  PID:8340
- C:\Windows\System\EZmnMOF.exe
  C:\Windows\System\EZmnMOF.exe
  2⤵
  PID:8368
- C:\Windows\System\NpXCjKu.exe
  C:\Windows\System\NpXCjKu.exe
  2⤵
  PID:8392
- C:\Windows\System\ipxpcgX.exe
  C:\Windows\System\ipxpcgX.exe
  2⤵
  PID:8420
- C:\Windows\System\FFAXTWR.exe
  C:\Windows\System\FFAXTWR.exe
  2⤵
  PID:8440
- C:\Windows\System\mkWJasR.exe
  C:\Windows\System\mkWJasR.exe
  2⤵
  PID:8468
- C:\Windows\System\ZpZfRzQ.exe
  C:\Windows\System\ZpZfRzQ.exe
  2⤵
  PID:8492
- C:\Windows\System\hUWEiwn.exe
  C:\Windows\System\hUWEiwn.exe
  2⤵
  PID:8520
- C:\Windows\System\LJbdetj.exe
  C:\Windows\System\LJbdetj.exe
  2⤵
  PID:8536
- C:\Windows\System\GVqWiwC.exe
  C:\Windows\System\GVqWiwC.exe
  2⤵
  PID:8564
- C:\Windows\System\hOmhiRY.exe
  C:\Windows\System\hOmhiRY.exe
  2⤵
  PID:8588
- C:\Windows\System\gpgtQnE.exe
  C:\Windows\System\gpgtQnE.exe
  2⤵
  PID:8612
- C:\Windows\System\GLYoJYx.exe
  C:\Windows\System\GLYoJYx.exe
  2⤵
  PID:8628
- C:\Windows\System\fhexIgN.exe
  C:\Windows\System\fhexIgN.exe
  2⤵
  PID:8652
- C:\Windows\System\LpowgZH.exe
  C:\Windows\System\LpowgZH.exe
  2⤵
  PID:8680
- C:\Windows\System\wDRAEla.exe
  C:\Windows\System\wDRAEla.exe
  2⤵
  PID:8704
- C:\Windows\System\CmLXzCY.exe
  C:\Windows\System\CmLXzCY.exe
  2⤵
  PID:8728
- C:\Windows\System\TlgIeVz.exe
  C:\Windows\System\TlgIeVz.exe
  2⤵
  PID:8752
- C:\Windows\System\eutMsJX.exe
  C:\Windows\System\eutMsJX.exe
  2⤵
  PID:8776
- C:\Windows\System\orVUIvk.exe
  C:\Windows\System\orVUIvk.exe
  2⤵
  PID:8804
- C:\Windows\System\HNprkrs.exe
  C:\Windows\System\HNprkrs.exe
  2⤵
  PID:8824
- C:\Windows\System\wEuVnom.exe
  C:\Windows\System\wEuVnom.exe
  2⤵
  PID:8844
- C:\Windows\System\AAYacHY.exe
  C:\Windows\System\AAYacHY.exe
  2⤵
  PID:8868
- C:\Windows\System\wsdYIwy.exe
  C:\Windows\System\wsdYIwy.exe
  2⤵
  PID:8892
- C:\Windows\System\IyvAXnp.exe
  C:\Windows\System\IyvAXnp.exe
  2⤵
  PID:8916
- C:\Windows\System\jUkQFJw.exe
  C:\Windows\System\jUkQFJw.exe
  2⤵
  PID:8936
- C:\Windows\System\ADLKulL.exe
  C:\Windows\System\ADLKulL.exe
  2⤵
  PID:8956
- C:\Windows\System\htrvVwe.exe
  C:\Windows\System\htrvVwe.exe
  2⤵
  PID:8976
- C:\Windows\System\mUzPVMR.exe
  C:\Windows\System\mUzPVMR.exe
  2⤵
  PID:8996
- C:\Windows\System\dPoZTZV.exe
  C:\Windows\System\dPoZTZV.exe
  2⤵
  PID:9024
- C:\Windows\System\XTCgpBP.exe
  C:\Windows\System\XTCgpBP.exe
  2⤵
  PID:9048
- C:\Windows\System\BxRyQIF.exe
  C:\Windows\System\BxRyQIF.exe
  2⤵
  PID:9072
- C:\Windows\System\fIHKbCP.exe
  C:\Windows\System\fIHKbCP.exe
  2⤵
  PID:9096
- C:\Windows\System\MkmLrlZ.exe
  C:\Windows\System\MkmLrlZ.exe
  2⤵
  PID:9120
- C:\Windows\System\WKCRYbf.exe
  C:\Windows\System\WKCRYbf.exe
  2⤵
  PID:9140
- C:\Windows\System\CMlVCXq.exe
  C:\Windows\System\CMlVCXq.exe
  2⤵
  PID:9164
- C:\Windows\System\naawFEg.exe
  C:\Windows\System\naawFEg.exe
  2⤵
  PID:9192
- C:\Windows\System\YdJNIYL.exe
  C:\Windows\System\YdJNIYL.exe
  2⤵
  PID:9212
- C:\Windows\System\YacADVm.exe
  C:\Windows\System\YacADVm.exe
  2⤵
  PID:8076
- C:\Windows\System\jHgXkPt.exe
  C:\Windows\System\jHgXkPt.exe
  2⤵
  PID:7836
- C:\Windows\System\MkLejYu.exe
  C:\Windows\System\MkLejYu.exe
  2⤵
  PID:7892
- C:\Windows\System\zZLQhcH.exe
  C:\Windows\System\zZLQhcH.exe
  2⤵
  PID:7684
- C:\Windows\System\caPoKzh.exe
  C:\Windows\System\caPoKzh.exe
  2⤵
  PID:7460
- C:\Windows\System\nrJFzUb.exe
  C:\Windows\System\nrJFzUb.exe
  2⤵
  PID:8016
- C:\Windows\System\QrjKqWC.exe
  C:\Windows\System\QrjKqWC.exe
  2⤵
  PID:8200
- C:\Windows\System\irobBEZ.exe
  C:\Windows\System\irobBEZ.exe
  2⤵
  PID:8012
- C:\Windows\System\rGNurvy.exe
  C:\Windows\System\rGNurvy.exe
  2⤵
  PID:8108
- C:\Windows\System\MlxUgpi.exe
  C:\Windows\System\MlxUgpi.exe
  2⤵
  PID:7688
- C:\Windows\System\ljaZviF.exe
  C:\Windows\System\ljaZviF.exe
  2⤵
  PID:7256
- C:\Windows\System\PYJAlFF.exe
  C:\Windows\System\PYJAlFF.exe
  2⤵
  PID:7632
- C:\Windows\System\TWvrlKX.exe
  C:\Windows\System\TWvrlKX.exe
  2⤵
  PID:6964
- C:\Windows\System\rTIAceX.exe
  C:\Windows\System\rTIAceX.exe
  2⤵
  PID:8720
- C:\Windows\System\mSIEVPK.exe
  C:\Windows\System\mSIEVPK.exe
  2⤵
  PID:8796
- C:\Windows\System\bDJqxzS.exe
  C:\Windows\System\bDJqxzS.exe
  2⤵
  PID:7968
- C:\Windows\System\JnzSrEu.exe
  C:\Windows\System\JnzSrEu.exe
  2⤵
  PID:8944
- C:\Windows\System\kyePDtQ.exe
  C:\Windows\System\kyePDtQ.exe
  2⤵
  PID:9032
- C:\Windows\System\iwSKkot.exe
  C:\Windows\System\iwSKkot.exe
  2⤵
  PID:8252
- C:\Windows\System\voJgXAS.exe
  C:\Windows\System\voJgXAS.exe
  2⤵
  PID:8644
- C:\Windows\System\MZZerUu.exe
  C:\Windows\System\MZZerUu.exe
  2⤵
  PID:8724
- C:\Windows\System\stdeQpO.exe
  C:\Windows\System\stdeQpO.exe
  2⤵
  PID:8388
- C:\Windows\System\hmddPHF.exe
  C:\Windows\System\hmddPHF.exe
  2⤵
  PID:8428
- C:\Windows\System\BSuakPf.exe
  C:\Windows\System\BSuakPf.exe
  2⤵
  PID:8508
- C:\Windows\System\WcWbKqY.exe
  C:\Windows\System\WcWbKqY.exe
  2⤵
  PID:8560
- C:\Windows\System\KQDnAnU.exe
  C:\Windows\System\KQDnAnU.exe
  2⤵
  PID:8624
- C:\Windows\System\ZVtIiQl.exe
  C:\Windows\System\ZVtIiQl.exe
  2⤵
  PID:9228
- C:\Windows\System\xTqZGLS.exe
  C:\Windows\System\xTqZGLS.exe
  2⤵
  PID:9244
- C:\Windows\System\McoNdFE.exe
  C:\Windows\System\McoNdFE.exe
  2⤵
  PID:9260
- C:\Windows\System\jONFBZr.exe
  C:\Windows\System\jONFBZr.exe
  2⤵
  PID:9276
- C:\Windows\System\pSqARZX.exe
  C:\Windows\System\pSqARZX.exe
  2⤵
  PID:9292
- C:\Windows\System\FSBbwsZ.exe
  C:\Windows\System\FSBbwsZ.exe
  2⤵
  PID:9320
- C:\Windows\System\lwIzsfq.exe
  C:\Windows\System\lwIzsfq.exe
  2⤵
  PID:9352
- C:\Windows\System\cIUMXsq.exe
  C:\Windows\System\cIUMXsq.exe
  2⤵
  PID:9388
- C:\Windows\System\ugIpARC.exe
  C:\Windows\System\ugIpARC.exe
  2⤵
  PID:9416
- C:\Windows\System\OjAaWqw.exe
  C:\Windows\System\OjAaWqw.exe
  2⤵
  PID:9444
- C:\Windows\System\zISuegf.exe
  C:\Windows\System\zISuegf.exe
  2⤵
  PID:9480
- C:\Windows\System\mrNUNoL.exe
  C:\Windows\System\mrNUNoL.exe
  2⤵
  PID:9504
- C:\Windows\System\IQSnUCm.exe
  C:\Windows\System\IQSnUCm.exe
  2⤵
  PID:9748
- C:\Windows\System\NrpUcyC.exe
  C:\Windows\System\NrpUcyC.exe
  2⤵
  PID:9784
- C:\Windows\System\CQqPTIJ.exe
  C:\Windows\System\CQqPTIJ.exe
  2⤵
  PID:9812
- C:\Windows\System\ZwshiqY.exe
  C:\Windows\System\ZwshiqY.exe
  2⤵
  PID:9844
- C:\Windows\System\uDGlxHS.exe
  C:\Windows\System\uDGlxHS.exe
  2⤵
  PID:9876
- C:\Windows\System\SJJIdTY.exe
  C:\Windows\System\SJJIdTY.exe
  2⤵
  PID:9908
- C:\Windows\System\WkBOdSW.exe
  C:\Windows\System\WkBOdSW.exe
  2⤵
  PID:9940
- C:\Windows\System\pxUrvWy.exe
  C:\Windows\System\pxUrvWy.exe
  2⤵
  PID:9984
- C:\Windows\System\ufzmfYy.exe
  C:\Windows\System\ufzmfYy.exe
  2⤵
  PID:10016
- C:\Windows\System\XbPhjNr.exe
  C:\Windows\System\XbPhjNr.exe
  2⤵
  PID:10044
- C:\Windows\System\xskdUpd.exe
  C:\Windows\System\xskdUpd.exe
  2⤵
  PID:10072
- C:\Windows\System\IoaKZZP.exe
  C:\Windows\System\IoaKZZP.exe
  2⤵
  PID:10104
- C:\Windows\System\WdVAezI.exe
  C:\Windows\System\WdVAezI.exe
  2⤵
  PID:10128
- C:\Windows\System\bEosrmJ.exe
  C:\Windows\System\bEosrmJ.exe
  2⤵
  PID:10144
- C:\Windows\System\fLfTuvE.exe
  C:\Windows\System\fLfTuvE.exe
  2⤵
  PID:10176
- C:\Windows\System\CYvnsHi.exe
  C:\Windows\System\CYvnsHi.exe
  2⤵
  PID:10228
- C:\Windows\System\ZoRDEyP.exe
  C:\Windows\System\ZoRDEyP.exe
  2⤵
  PID:8672
- C:\Windows\System\HjtSGdo.exe
  C:\Windows\System\HjtSGdo.exe
  2⤵
  PID:9172
- C:\Windows\System\uspCxuB.exe
  C:\Windows\System\uspCxuB.exe
  2⤵
  PID:9200
- C:\Windows\System\GOSAdFv.exe
  C:\Windows\System\GOSAdFv.exe
  2⤵
  PID:7788
- C:\Windows\System\EUeUJRA.exe
  C:\Windows\System\EUeUJRA.exe
  2⤵
  PID:8840
- C:\Windows\System\MjVkVrG.exe
  C:\Windows\System\MjVkVrG.exe
  2⤵
  PID:7000
- C:\Windows\System\hjfYHoy.exe
  C:\Windows\System\hjfYHoy.exe
  2⤵
  PID:8988
- C:\Windows\System\aKttDCY.exe
  C:\Windows\System\aKttDCY.exe
  2⤵
  PID:9104
- C:\Windows\System\CXzbmQe.exe
  C:\Windows\System\CXzbmQe.exe
  2⤵
  PID:9308
- C:\Windows\System\QiepVFi.exe
  C:\Windows\System\QiepVFi.exe
  2⤵
  PID:9364
- C:\Windows\System\qBjvFOU.exe
  C:\Windows\System\qBjvFOU.exe
  2⤵
  PID:9412
- C:\Windows\System\SdQfOnu.exe
  C:\Windows\System\SdQfOnu.exe
  2⤵
  PID:9476
- C:\Windows\System\HZHxyLX.exe
  C:\Windows\System\HZHxyLX.exe
  2⤵
  PID:9148
- C:\Windows\System\oeapPyf.exe
  C:\Windows\System\oeapPyf.exe
  2⤵
  PID:8836
- C:\Windows\System\HvRfFbO.exe
  C:\Windows\System\HvRfFbO.exe
  2⤵
  PID:6772
- C:\Windows\System\qVECmSW.exe
  C:\Windows\System\qVECmSW.exe
  2⤵
  PID:5816
- C:\Windows\System\uKaWWzU.exe
  C:\Windows\System\uKaWWzU.exe
  2⤵
  PID:8452
- C:\Windows\System\nbnyhtz.exe
  C:\Windows\System\nbnyhtz.exe
  2⤵
  PID:8296
- C:\Windows\System\bHsyLqb.exe
  C:\Windows\System\bHsyLqb.exe
  2⤵
  PID:9236
- C:\Windows\System\TrHfxLv.exe
  C:\Windows\System\TrHfxLv.exe
  2⤵
  PID:9776
- C:\Windows\System\qkmVUrn.exe
  C:\Windows\System\qkmVUrn.exe
  2⤵
  PID:9828
- C:\Windows\System\BwlUDVi.exe
  C:\Windows\System\BwlUDVi.exe
  2⤵
  PID:8300
- C:\Windows\System\LkjxWGg.exe
  C:\Windows\System\LkjxWGg.exe
  2⤵
  PID:8608
- C:\Windows\System\ULaTkDG.exe
  C:\Windows\System\ULaTkDG.exe
  2⤵
  PID:9268
- C:\Windows\System\XQdFoJc.exe
  C:\Windows\System\XQdFoJc.exe
  2⤵
  PID:10056
- C:\Windows\System\DtcggJd.exe
  C:\Windows\System\DtcggJd.exe
  2⤵
  PID:10096
- C:\Windows\System\BUqzPkP.exe
  C:\Windows\System\BUqzPkP.exe
  2⤵
  PID:10164
- C:\Windows\System\UIhttBH.exe
  C:\Windows\System\UIhttBH.exe
  2⤵
  PID:9712
- C:\Windows\System\YkkWsmN.exe
  C:\Windows\System\YkkWsmN.exe
  2⤵
  PID:10244
- C:\Windows\System\TbiEesh.exe
  C:\Windows\System\TbiEesh.exe
  2⤵
  PID:10264
- C:\Windows\System\VcHdWCq.exe
  C:\Windows\System\VcHdWCq.exe
  2⤵
  PID:10296
- C:\Windows\System\XraxRkF.exe
  C:\Windows\System\XraxRkF.exe
  2⤵
  PID:10320
- C:\Windows\System\oFYKjgO.exe
  C:\Windows\System\oFYKjgO.exe
  2⤵
  PID:10336
- C:\Windows\System\fXIToqj.exe
  C:\Windows\System\fXIToqj.exe
  2⤵
  PID:10360
- C:\Windows\System\lMPePTw.exe
  C:\Windows\System\lMPePTw.exe
  2⤵
  PID:10384
- C:\Windows\System\xpLfkVe.exe
  C:\Windows\System\xpLfkVe.exe
  2⤵
  PID:10404
- C:\Windows\System\dxhXbgQ.exe
  C:\Windows\System\dxhXbgQ.exe
  2⤵
  PID:10428
- C:\Windows\System\fzgVTLs.exe
  C:\Windows\System\fzgVTLs.exe
  2⤵
  PID:10448
- C:\Windows\System\iycMYlY.exe
  C:\Windows\System\iycMYlY.exe
  2⤵
  PID:10488
- C:\Windows\System\bpQMezO.exe
  C:\Windows\System\bpQMezO.exe
  2⤵
  PID:10508
- C:\Windows\System\jXaqubq.exe
  C:\Windows\System\jXaqubq.exe
  2⤵
  PID:10532
- C:\Windows\System\jvoZrxb.exe
  C:\Windows\System\jvoZrxb.exe
  2⤵
  PID:10548
- C:\Windows\System\tHBBSaQ.exe
  C:\Windows\System\tHBBSaQ.exe
  2⤵
  PID:10572
- C:\Windows\System\bMcVrrR.exe
  C:\Windows\System\bMcVrrR.exe
  2⤵
  PID:10596
- C:\Windows\System\QudnKSj.exe
  C:\Windows\System\QudnKSj.exe
  2⤵
  PID:10620
- C:\Windows\System\cGQklHp.exe
  C:\Windows\System\cGQklHp.exe
  2⤵
  PID:10640
- C:\Windows\System\njWjGYn.exe
  C:\Windows\System\njWjGYn.exe
  2⤵
  PID:10664
- C:\Windows\System\WQzWCzR.exe
  C:\Windows\System\WQzWCzR.exe
  2⤵
  PID:10692
- C:\Windows\System\flWcahm.exe
  C:\Windows\System\flWcahm.exe
  2⤵
  PID:10716
- C:\Windows\System\xLjOldl.exe
  C:\Windows\System\xLjOldl.exe
  2⤵
  PID:10736
- C:\Windows\System\DrivkBX.exe
  C:\Windows\System\DrivkBX.exe
  2⤵
  PID:10760
- C:\Windows\System\mjdrTJh.exe
  C:\Windows\System\mjdrTJh.exe
  2⤵
  PID:10784
- C:\Windows\System\xsUqEoe.exe
  C:\Windows\System\xsUqEoe.exe
  2⤵
  PID:10804
- C:\Windows\System\jZbbHsZ.exe
  C:\Windows\System\jZbbHsZ.exe
  2⤵
  PID:10836
- C:\Windows\System\doVksQg.exe
  C:\Windows\System\doVksQg.exe
  2⤵
  PID:10868
- C:\Windows\System\mtbVIeD.exe
  C:\Windows\System\mtbVIeD.exe
  2⤵
  PID:11044
- C:\Windows\System\dariBLE.exe
  C:\Windows\System\dariBLE.exe
  2⤵
  PID:11096
- C:\Windows\System\dMsZdPV.exe
  C:\Windows\System\dMsZdPV.exe
  2⤵
  PID:11112
- C:\Windows\System\YhatfKG.exe
  C:\Windows\System\YhatfKG.exe
  2⤵
  PID:11132
- C:\Windows\System\FYmZkFN.exe
  C:\Windows\System\FYmZkFN.exe
  2⤵
  PID:11152
- C:\Windows\System\HrfkKgk.exe
  C:\Windows\System\HrfkKgk.exe
  2⤵
  PID:11168
- C:\Windows\System\LheBQSK.exe
  C:\Windows\System\LheBQSK.exe
  2⤵
  PID:11188
- C:\Windows\System\SKsoHCf.exe
  C:\Windows\System\SKsoHCf.exe
  2⤵
  PID:11220
- C:\Windows\System\bKCzwqg.exe
  C:\Windows\System\bKCzwqg.exe
  2⤵
  PID:11236
- C:\Windows\System\BpJZJKh.exe
  C:\Windows\System\BpJZJKh.exe
  2⤵
  PID:11256
- C:\Windows\System\JlTgDfZ.exe
  C:\Windows\System\JlTgDfZ.exe
  2⤵
  PID:8124
- C:\Windows\System\KibqsPA.exe
  C:\Windows\System\KibqsPA.exe
  2⤵
  PID:7656
- C:\Windows\System\bjqjRYS.exe
  C:\Windows\System\bjqjRYS.exe
  2⤵
  PID:9960
- C:\Windows\System\pDkOwRT.exe
  C:\Windows\System\pDkOwRT.exe
  2⤵
  PID:9608
- C:\Windows\System\QDrPhIw.exe
  C:\Windows\System\QDrPhIw.exe
  2⤵
  PID:7756
- C:\Windows\System\XCsOHGf.exe
  C:\Windows\System\XCsOHGf.exe
  2⤵
  PID:7508
- C:\Windows\System\xuYgRCQ.exe
  C:\Windows\System\xuYgRCQ.exe
  2⤵
  PID:8860
- C:\Windows\System\uJaonnV.exe
  C:\Windows\System\uJaonnV.exe
  2⤵
  PID:9720
- C:\Windows\System\weDdryb.exe
  C:\Windows\System\weDdryb.exe
  2⤵
  PID:10124
- C:\Windows\System\tNHEvnq.exe
  C:\Windows\System\tNHEvnq.exe
  2⤵
  PID:8768
- C:\Windows\System\ighKwpL.exe
  C:\Windows\System\ighKwpL.exe
  2⤵
  PID:9888
- C:\Windows\System\FlYAhih.exe
  C:\Windows\System\FlYAhih.exe
  2⤵
  PID:10472
- C:\Windows\System\GLToLuy.exe
  C:\Windows\System\GLToLuy.exe
  2⤵
  PID:10004
- C:\Windows\System\NyjqQfO.exe
  C:\Windows\System\NyjqQfO.exe
  2⤵
  PID:8268
- C:\Windows\System\gtgqChK.exe
  C:\Windows\System\gtgqChK.exe
  2⤵
  PID:8884
- C:\Windows\System\edDQiKT.exe
  C:\Windows\System\edDQiKT.exe
  2⤵
  PID:8908
- C:\Windows\System\ntqQnPs.exe
  C:\Windows\System\ntqQnPs.exe
  2⤵
  PID:10612
- C:\Windows\System\wJtDqbb.exe
  C:\Windows\System\wJtDqbb.exe
  2⤵
  PID:9548
- C:\Windows\System\jCfFlMt.exe
  C:\Windows\System\jCfFlMt.exe
  2⤵
  PID:10608
- C:\Windows\System\vfnERpS.exe
  C:\Windows\System\vfnERpS.exe
  2⤵
  PID:10704
- C:\Windows\System\INTxcbv.exe
  C:\Windows\System\INTxcbv.exe
  2⤵
  PID:10796
- C:\Windows\System\NtTeiKu.exe
  C:\Windows\System\NtTeiKu.exe
  2⤵
  PID:10460
- C:\Windows\System\MMtWOyw.exe
  C:\Windows\System\MMtWOyw.exe
  2⤵
  PID:9284
- C:\Windows\System\xTxZZWN.exe
  C:\Windows\System\xTxZZWN.exe
  2⤵
  PID:10184
- C:\Windows\System\nJfJcvL.exe
  C:\Windows\System\nJfJcvL.exe
  2⤵
  PID:10252
- C:\Windows\System\bIXuhGs.exe
  C:\Windows\System\bIXuhGs.exe
  2⤵
  PID:10444
- C:\Windows\System\uXOZGsH.exe
  C:\Windows\System\uXOZGsH.exe
  2⤵
  PID:10616
- C:\Windows\System\wUqOhlH.exe
  C:\Windows\System\wUqOhlH.exe
  2⤵
  PID:11084
- C:\Windows\System\EicKELA.exe
  C:\Windows\System\EicKELA.exe
  2⤵
  PID:11108
- C:\Windows\System\NqBkhFw.exe
  C:\Windows\System\NqBkhFw.exe
  2⤵
  PID:11148
- C:\Windows\System\xQHvEwr.exe
  C:\Windows\System\xQHvEwr.exe
  2⤵
  PID:10700
- C:\Windows\System\xtNVaUi.exe
  C:\Windows\System\xtNVaUi.exe
  2⤵
  PID:10748
- C:\Windows\System\UqeYFql.exe
  C:\Windows\System\UqeYFql.exe
  2⤵
  PID:11376
- C:\Windows\System\OsCzYec.exe
  C:\Windows\System\OsCzYec.exe
  2⤵
  PID:11392
- C:\Windows\System\ZXKdvWB.exe
  C:\Windows\System\ZXKdvWB.exe
  2⤵
  PID:11640
- C:\Windows\System\THmrBhC.exe
  C:\Windows\System\THmrBhC.exe
  2⤵
  PID:11656
- C:\Windows\System\HPJmflq.exe
  C:\Windows\System\HPJmflq.exe
  2⤵
  PID:11684
- C:\Windows\System\IHhWIFq.exe
  C:\Windows\System\IHhWIFq.exe
  2⤵
  PID:11712
- C:\Windows\System\KmUsJRf.exe
  C:\Windows\System\KmUsJRf.exe
  2⤵
  PID:11740
- C:\Windows\System\tpQGifw.exe
  C:\Windows\System\tpQGifw.exe
  2⤵
  PID:11772
- C:\Windows\System\gSPKUrH.exe
  C:\Windows\System\gSPKUrH.exe
  2⤵
  PID:11800
- C:\Windows\System\DLcIggS.exe
  C:\Windows\System\DLcIggS.exe
  2⤵
  PID:11836
- C:\Windows\System\souFehY.exe
  C:\Windows\System\souFehY.exe
  2⤵
  PID:11872
- C:\Windows\System\eLWyWHj.exe
  C:\Windows\System\eLWyWHj.exe
  2⤵
  PID:11900
- C:\Windows\System\yhjbXPW.exe
  C:\Windows\System\yhjbXPW.exe
  2⤵
  PID:11924
- C:\Windows\System\LybwkEa.exe
  C:\Windows\System\LybwkEa.exe
  2⤵
  PID:11956
- C:\Windows\System\qAMslxh.exe
  C:\Windows\System\qAMslxh.exe
  2⤵
  PID:12008
- C:\Windows\System\HiFuPEX.exe
  C:\Windows\System\HiFuPEX.exe
  2⤵
  PID:12052
- C:\Windows\System\RXqAjlT.exe
  C:\Windows\System\RXqAjlT.exe
  2⤵
  PID:12104
- C:\Windows\System\gEoecWu.exe
  C:\Windows\System\gEoecWu.exe
  2⤵
  PID:12128
- C:\Windows\System\YGponEr.exe
  C:\Windows\System\YGponEr.exe
  2⤵
  PID:12152
- C:\Windows\System\HGnbEVJ.exe
  C:\Windows\System\HGnbEVJ.exe
  2⤵
  PID:12168
- C:\Windows\System\tbUKQAa.exe
  C:\Windows\System\tbUKQAa.exe
  2⤵
  PID:12188
- C:\Windows\System\vKdRgbU.exe
  C:\Windows\System\vKdRgbU.exe
  2⤵
  PID:12224
- C:\Windows\System\aslAWbB.exe
  C:\Windows\System\aslAWbB.exe
  2⤵
  PID:12252
- C:\Windows\System\SpGQqNp.exe
  C:\Windows\System\SpGQqNp.exe
  2⤵
  PID:12268
- C:\Windows\System\KoZEjhK.exe
  C:\Windows\System\KoZEjhK.exe
  2⤵
  PID:9340
- C:\Windows\System\RyeXxRH.exe
  C:\Windows\System\RyeXxRH.exe
  2⤵
  PID:11164
- C:\Windows\System\bRUlbPG.exe
  C:\Windows\System\bRUlbPG.exe
  2⤵
  PID:8552
- C:\Windows\System\XPdnIuH.exe
  C:\Windows\System\XPdnIuH.exe
  2⤵
  PID:8044
- C:\Windows\System\FSWkUsL.exe
  C:\Windows\System\FSWkUsL.exe
  2⤵
  PID:9380
- C:\Windows\System\zvQsxJs.exe
  C:\Windows\System\zvQsxJs.exe
  2⤵
  PID:8064
- C:\Windows\System\eOOLRiR.exe
  C:\Windows\System\eOOLRiR.exe
  2⤵
  PID:9460
- C:\Windows\System\SvvNaNc.exe
  C:\Windows\System\SvvNaNc.exe
  2⤵
  PID:10032
- C:\Windows\System\BmpZcgs.exe
  C:\Windows\System\BmpZcgs.exe
  2⤵
  PID:7260
- C:\Windows\System\Tpvkuau.exe
  C:\Windows\System\Tpvkuau.exe
  2⤵
  PID:9892
- C:\Windows\System\ihsfvyM.exe
  C:\Windows\System\ihsfvyM.exe
  2⤵
  PID:9996
- C:\Windows\System\ZZfPUqA.exe
  C:\Windows\System\ZZfPUqA.exe
  2⤵
  PID:10544
- C:\Windows\System\zverRPa.exe
  C:\Windows\System\zverRPa.exe
  2⤵
  PID:9768
- C:\Windows\System\gVpYUlC.exe
  C:\Windows\System\gVpYUlC.exe
  2⤵
  PID:10564
- C:\Windows\System\YtobJve.exe
  C:\Windows\System\YtobJve.exe
  2⤵
  PID:10312
- C:\Windows\System\LXPbXBk.exe
  C:\Windows\System\LXPbXBk.exe
  2⤵
  PID:11556
- C:\Windows\System\nhEcGsX.exe
  C:\Windows\System\nhEcGsX.exe
  2⤵
  PID:11128
- C:\Windows\System\iCtGkqN.exe
  C:\Windows\System\iCtGkqN.exe
  2⤵
  PID:11424
- C:\Windows\System\IrQugqx.exe
  C:\Windows\System\IrQugqx.exe
  2⤵
  PID:11700
- C:\Windows\System\WnFOGJt.exe
  C:\Windows\System\WnFOGJt.exe
  2⤵
  PID:11728
- C:\Windows\System\FoPgXRB.exe
  C:\Windows\System\FoPgXRB.exe
  2⤵
  PID:11788
- C:\Windows\System\iTpgsvA.exe
  C:\Windows\System\iTpgsvA.exe
  2⤵
  PID:11300
- C:\Windows\System\FwXCbcm.exe
  C:\Windows\System\FwXCbcm.exe
  2⤵
  PID:11500
- C:\Windows\System\uRXGsfR.exe
  C:\Windows\System\uRXGsfR.exe
  2⤵
  PID:11528
- C:\Windows\System\XRlSqNG.exe
  C:\Windows\System\XRlSqNG.exe
  2⤵
  PID:11412
- C:\Windows\System\vggnEqc.exe
  C:\Windows\System\vggnEqc.exe
  2⤵
  PID:11704
- C:\Windows\System\IheshIz.exe
  C:\Windows\System\IheshIz.exe
  2⤵
  PID:11912
- C:\Windows\System\LVMXIzr.exe
  C:\Windows\System\LVMXIzr.exe
  2⤵
  PID:12236
- C:\Windows\System\BzfXBwV.exe
  C:\Windows\System\BzfXBwV.exe
  2⤵
  PID:11276
- C:\Windows\System\vdjjWrv.exe
  C:\Windows\System\vdjjWrv.exe
  2⤵
  PID:12148
- C:\Windows\System\vNYMAhP.exe
  C:\Windows\System\vNYMAhP.exe
  2⤵
  PID:12204
- C:\Windows\System\QmKieZr.exe
  C:\Windows\System\QmKieZr.exe
  2⤵
  PID:10484
- C:\Windows\System\ZIWGdqD.exe
  C:\Windows\System\ZIWGdqD.exe
  2⤵
  PID:10412
- C:\Windows\System\Gamnbvq.exe
  C:\Windows\System\Gamnbvq.exe
  2⤵
  PID:12032
- C:\Windows\System\EmBWeCC.exe
  C:\Windows\System\EmBWeCC.exe
  2⤵
  PID:9820
- C:\Windows\System\ghEhTpL.exe
  C:\Windows\System\ghEhTpL.exe
  2⤵
  PID:9220
- C:\Windows\System\qGdiuxQ.exe
  C:\Windows\System\qGdiuxQ.exe
  2⤵
  PID:10220
- C:\Windows\System\ozgSmpQ.exe
  C:\Windows\System\ozgSmpQ.exe
  2⤵
  PID:11580
- C:\Windows\System\OgdlHkf.exe
  C:\Windows\System\OgdlHkf.exe
  2⤵
  PID:8528
- C:\Windows\System\XJstROv.exe
  C:\Windows\System\XJstROv.exe
  2⤵
  PID:11336
- C:\Windows\System\AYwVjqR.exe
  C:\Windows\System\AYwVjqR.exe
  2⤵
  PID:12300
- C:\Windows\System\TFDmPxN.exe
  C:\Windows\System\TFDmPxN.exe
  2⤵
  PID:12320
- C:\Windows\System\mSDFGdM.exe
  C:\Windows\System\mSDFGdM.exe
  2⤵
  PID:12352
- C:\Windows\System\cMDePyu.exe
  C:\Windows\System\cMDePyu.exe
  2⤵
  PID:12368
- C:\Windows\System\DXjyXad.exe
  C:\Windows\System\DXjyXad.exe
  2⤵
  PID:12396
- C:\Windows\System\FfDEGan.exe
  C:\Windows\System\FfDEGan.exe
  2⤵
  PID:12420
- C:\Windows\System\MqIzNwm.exe
  C:\Windows\System\MqIzNwm.exe
  2⤵
  PID:12440
- C:\Windows\System\NjwbqqH.exe
  C:\Windows\System\NjwbqqH.exe
  2⤵
  PID:12468
- C:\Windows\System\AvKrpVm.exe
  C:\Windows\System\AvKrpVm.exe
  2⤵
  PID:12496
- C:\Windows\System\SYWlAod.exe
  C:\Windows\System\SYWlAod.exe
  2⤵
  PID:12516
- C:\Windows\System\KuTlQhE.exe
  C:\Windows\System\KuTlQhE.exe
  2⤵
  PID:12552
- C:\Windows\System\bbfIctM.exe
  C:\Windows\System\bbfIctM.exe
  2⤵
  PID:12572
- C:\Windows\System\ahfMkhL.exe
  C:\Windows\System\ahfMkhL.exe
  2⤵
  PID:12604
- C:\Windows\System\afbITBb.exe
  C:\Windows\System\afbITBb.exe
  2⤵
  PID:12640
- C:\Windows\System\huWmIpz.exe
  C:\Windows\System\huWmIpz.exe
  2⤵
  PID:12660
- C:\Windows\System\sJBSDFD.exe
  C:\Windows\System\sJBSDFD.exe
  2⤵
  PID:12680
- C:\Windows\System\koteDFu.exe
  C:\Windows\System\koteDFu.exe
  2⤵
  PID:12700
- C:\Windows\System\nptCglg.exe
  C:\Windows\System\nptCglg.exe
  2⤵
  PID:12724
- C:\Windows\System\gtqdyJA.exe
  C:\Windows\System\gtqdyJA.exe
  2⤵
  PID:12748
- C:\Windows\System\BICEdUi.exe
  C:\Windows\System\BICEdUi.exe
  2⤵
  PID:12768
- C:\Windows\System\Itzgwrv.exe
  C:\Windows\System\Itzgwrv.exe
  2⤵
  PID:12792
- C:\Windows\System\FnRigye.exe
  C:\Windows\System\FnRigye.exe
  2⤵
  PID:12812
- C:\Windows\System\dqEtJUm.exe
  C:\Windows\System\dqEtJUm.exe
  2⤵
  PID:12840
- C:\Windows\System\MgSUqhz.exe
  C:\Windows\System\MgSUqhz.exe
  2⤵
  PID:12860
- C:\Windows\System\CKWrXgN.exe
  C:\Windows\System\CKWrXgN.exe
  2⤵
  PID:12884
- C:\Windows\System\SsUySHc.exe
  C:\Windows\System\SsUySHc.exe
  2⤵
  PID:12908
- C:\Windows\System\yasPhEP.exe
  C:\Windows\System\yasPhEP.exe
  2⤵
  PID:12936
- C:\Windows\System\XCvnmYA.exe
  C:\Windows\System\XCvnmYA.exe
  2⤵
  PID:13052
- C:\Windows\System\YgwUnRN.exe
  C:\Windows\System\YgwUnRN.exe
  2⤵
  PID:13068
- C:\Windows\System\EGMBANw.exe
  C:\Windows\System\EGMBANw.exe
  2⤵
  PID:13088
- C:\Windows\System\sFVXzXc.exe
  C:\Windows\System\sFVXzXc.exe
  2⤵
  PID:13104
- C:\Windows\System\AmrmuLn.exe
  C:\Windows\System\AmrmuLn.exe
  2⤵
  PID:13120
- C:\Windows\System\tFbFLPh.exe
  C:\Windows\System\tFbFLPh.exe
  2⤵
  PID:13148
- C:\Windows\System\lYBYXfx.exe
  C:\Windows\System\lYBYXfx.exe
  2⤵
  PID:13168
- C:\Windows\System\GUYVhfX.exe
  C:\Windows\System\GUYVhfX.exe
  2⤵
  PID:13192
- C:\Windows\System\cJaLmUj.exe
  C:\Windows\System\cJaLmUj.exe
  2⤵
  PID:13212
- C:\Windows\System\KoMVgBV.exe
  C:\Windows\System\KoMVgBV.exe
  2⤵
  PID:13228
- C:\Windows\System\pxKyeUQ.exe
  C:\Windows\System\pxKyeUQ.exe
  2⤵
  PID:13248
- C:\Windows\System\BagCthW.exe
  C:\Windows\System\BagCthW.exe
  2⤵
  PID:13268
- C:\Windows\System\yiaPGpX.exe
  C:\Windows\System\yiaPGpX.exe
  2⤵
  PID:13292
- C:\Windows\System\IqNTmik.exe
  C:\Windows\System\IqNTmik.exe
  2⤵
  PID:11552
- C:\Windows\System\niiuAkz.exe
  C:\Windows\System\niiuAkz.exe
  2⤵
  PID:12124
- C:\Windows\System\iSGvEaS.exe
  C:\Windows\System\iSGvEaS.exe
  2⤵
  PID:8148
- C:\Windows\System\TfbokmM.exe
  C:\Windows\System\TfbokmM.exe
  2⤵
  PID:12244
- C:\Windows\System\RjIGiLp.exe
  C:\Windows\System\RjIGiLp.exe
  2⤵
  PID:11540
- C:\Windows\System\isIKVkQ.exe
  C:\Windows\System\isIKVkQ.exe
  2⤵
  PID:11404
- C:\Windows\System\divxtAr.exe
  C:\Windows\System\divxtAr.exe
  2⤵
  PID:12436
- C:\Windows\System\EGkfWkc.exe
  C:\Windows\System\EGkfWkc.exe
  2⤵
  PID:12460
- C:\Windows\System\tgokCTv.exe
  C:\Windows\System\tgokCTv.exe
  2⤵
  PID:12488
- C:\Windows\System\OPazhNo.exe
  C:\Windows\System\OPazhNo.exe
  2⤵
  PID:12528
- C:\Windows\System\GdqsAaw.exe
  C:\Windows\System\GdqsAaw.exe
  2⤵
  PID:12560
- C:\Windows\System\JitmzNz.exe
  C:\Windows\System\JitmzNz.exe
  2⤵
  PID:12668
- C:\Windows\System\eRpoYgK.exe
  C:\Windows\System\eRpoYgK.exe
  2⤵
  PID:12744
- C:\Windows\System\kkfEDge.exe
  C:\Windows\System\kkfEDge.exe
  2⤵
  PID:11620
- C:\Windows\System\aALhcAJ.exe
  C:\Windows\System\aALhcAJ.exe
  2⤵
  PID:12960
- C:\Windows\System\RiiEePt.exe
  C:\Windows\System\RiiEePt.exe
  2⤵
  PID:12588
- C:\Windows\System\nSxbQdF.exe
  C:\Windows\System\nSxbQdF.exe
  2⤵
  PID:12620
- C:\Windows\System\FMTNPSD.exe
  C:\Windows\System\FMTNPSD.exe
  2⤵
  PID:12264
- C:\Windows\System\UWOJKSu.exe
  C:\Windows\System\UWOJKSu.exe
  2⤵
  PID:12784
- C:\Windows\System\zySQGCB.exe
  C:\Windows\System\zySQGCB.exe
  2⤵
  PID:12872
- C:\Windows\System\lGtbfdH.exe
  C:\Windows\System\lGtbfdH.exe
  2⤵
  PID:12360
- C:\Windows\System\SmSEslL.exe
  C:\Windows\System\SmSEslL.exe
  2⤵
  PID:12920
- C:\Windows\System\SCzinNA.exe
  C:\Windows\System\SCzinNA.exe
  2⤵
  PID:13064
- C:\Windows\System\iOhTSfT.exe
  C:\Windows\System\iOhTSfT.exe
  2⤵
  PID:13144
- C:\Windows\System\PhaVfLz.exe
  C:\Windows\System\PhaVfLz.exe
  2⤵
  PID:12708
- C:\Windows\System\aOOSeie.exe
  C:\Windows\System\aOOSeie.exe
  2⤵
  PID:12760
- C:\Windows\System\FtXaDbm.exe
  C:\Windows\System\FtXaDbm.exe
  2⤵
  PID:12832
- C:\Windows\System\Nbsgvwc.exe
  C:\Windows\System\Nbsgvwc.exe
  2⤵
  PID:11880
- C:\Windows\System\ZFQuBRz.exe
  C:\Windows\System\ZFQuBRz.exe
  2⤵
  PID:12880
- C:\Windows\System\cVcSssJ.exe
  C:\Windows\System\cVcSssJ.exe
  2⤵
  PID:13336
- C:\Windows\System\dFYhKcY.exe
  C:\Windows\System\dFYhKcY.exe
  2⤵
  PID:13356
- C:\Windows\System\qXyCRji.exe
  C:\Windows\System\qXyCRji.exe
  2⤵
  PID:13380
- C:\Windows\System\ToxQoja.exe
  C:\Windows\System\ToxQoja.exe
  2⤵
  PID:13412
- C:\Windows\System\mZRccPD.exe
  C:\Windows\System\mZRccPD.exe
  2⤵
  PID:13436
- C:\Windows\System\kEmgVAv.exe
  C:\Windows\System\kEmgVAv.exe
  2⤵
  PID:13464
- C:\Windows\System\epgOGMQ.exe
  C:\Windows\System\epgOGMQ.exe
  2⤵
  PID:13492
- C:\Windows\System\eOmPFCR.exe
  C:\Windows\System\eOmPFCR.exe
  2⤵
  PID:13520
- C:\Windows\System\gigAHia.exe
  C:\Windows\System\gigAHia.exe
  2⤵
  PID:13708
- C:\Windows\System\mXgDBxk.exe
  C:\Windows\System\mXgDBxk.exe
  2⤵
  PID:13732
- C:\Windows\System\GsYfyww.exe
  C:\Windows\System\GsYfyww.exe
  2⤵
  PID:13748
- C:\Windows\System\iporTiM.exe
  C:\Windows\System\iporTiM.exe
  2⤵
  PID:13764
- C:\Windows\System\HiALmuj.exe
  C:\Windows\System\HiALmuj.exe
  2⤵
  PID:13780
- C:\Windows\System\laCxZcm.exe
  C:\Windows\System\laCxZcm.exe
  2⤵
  PID:13796
- C:\Windows\System\RgZlDDs.exe
  C:\Windows\System\RgZlDDs.exe
  2⤵
  PID:13812
- C:\Windows\System\YHsbrEA.exe
  C:\Windows\System\YHsbrEA.exe
  2⤵
  PID:13836
- C:\Windows\System\pntmCSa.exe
  C:\Windows\System\pntmCSa.exe
  2⤵
  PID:13856
- C:\Windows\System\fbHPdCR.exe
  C:\Windows\System\fbHPdCR.exe
  2⤵
  PID:13872
- C:\Windows\System\volZWZp.exe
  C:\Windows\System\volZWZp.exe
  2⤵
  PID:13892
- C:\Windows\System\dAYasoH.exe
  C:\Windows\System\dAYasoH.exe
  2⤵
  PID:13924
- C:\Windows\System\wmMjTYy.exe
  C:\Windows\System\wmMjTYy.exe
  2⤵
  PID:13944
- C:\Windows\System\yESXakd.exe
  C:\Windows\System\yESXakd.exe
  2⤵
  PID:13960
- C:\Windows\System\psOFqDs.exe
  C:\Windows\System\psOFqDs.exe
  2⤵
  PID:13980
- C:\Windows\System\gjwvNVT.exe
  C:\Windows\System\gjwvNVT.exe
  2⤵
  PID:14004
- C:\Windows\System\jhpscCa.exe
  C:\Windows\System\jhpscCa.exe
  2⤵
  PID:14048
- C:\Windows\System\qvNyKck.exe
  C:\Windows\System\qvNyKck.exe
  2⤵
  PID:14080
- C:\Windows\System\sBBdxfV.exe
  C:\Windows\System\sBBdxfV.exe
  2⤵
  PID:14112
- C:\Windows\System\gwhaXOA.exe
  C:\Windows\System\gwhaXOA.exe
  2⤵
  PID:14140
- C:\Windows\System\AMZlAIg.exe
  C:\Windows\System\AMZlAIg.exe
  2⤵
  PID:14180
- C:\Windows\System\LUCNvWe.exe
  C:\Windows\System\LUCNvWe.exe
  2⤵
  PID:14196
- C:\Windows\System\PEJAcmI.exe
  C:\Windows\System\PEJAcmI.exe
  2⤵
  PID:14212
- C:\Windows\System\GSTpqeD.exe
  C:\Windows\System\GSTpqeD.exe
  2⤵
  PID:14228
- C:\Windows\System\QxcAVQb.exe
  C:\Windows\System\QxcAVQb.exe
  2⤵
  PID:14244
- C:\Windows\System\SDIAaDk.exe
  C:\Windows\System\SDIAaDk.exe
  2⤵
  PID:14268
- C:\Windows\System\tZbkpgG.exe
  C:\Windows\System\tZbkpgG.exe
  2⤵
  PID:14292
- C:\Windows\System\ZKvpDFY.exe
  C:\Windows\System\ZKvpDFY.exe
  2⤵
  PID:14312
- C:\Windows\System\yUZbzkB.exe
  C:\Windows\System\yUZbzkB.exe
  2⤵
  PID:14332
- C:\Windows\System\ZeSTuoA.exe
  C:\Windows\System\ZeSTuoA.exe
  2⤵
  PID:12404
- C:\Windows\System\uXYinvp.exe
  C:\Windows\System\uXYinvp.exe
  2⤵
  PID:12392
- C:\Windows\System\mKIOUnk.exe
  C:\Windows\System\mKIOUnk.exe
  2⤵
  PID:13280
- C:\Windows\System\STjggKa.exe
  C:\Windows\System\STjggKa.exe
  2⤵
  PID:13304
- C:\Windows\System\VOXsQgq.exe
  C:\Windows\System\VOXsQgq.exe
  2⤵
  PID:12456
- C:\Windows\System\SDYRXeD.exe
  C:\Windows\System\SDYRXeD.exe
  2⤵
  PID:13100
- C:\Windows\System\bOHlfKq.exe
  C:\Windows\System\bOHlfKq.exe
  2⤵
  PID:13508
- C:\Windows\System\LfGSted.exe
  C:\Windows\System\LfGSted.exe
  2⤵
  PID:12928
- C:\Windows\System\BGRqWXy.exe
  C:\Windows\System\BGRqWXy.exe
  2⤵
  PID:13188
- C:\Windows\System\fOugYkV.exe
  C:\Windows\System\fOugYkV.exe
  2⤵
  PID:13204
- C:\Windows\System\JXxWfij.exe
  C:\Windows\System\JXxWfij.exe
  2⤵
  PID:13720
- C:\Windows\System\wdfkWqX.exe
  C:\Windows\System\wdfkWqX.exe
  2⤵
  PID:13744
- C:\Windows\System\PeOeNlp.exe
  C:\Windows\System\PeOeNlp.exe
  2⤵
  PID:13832
- C:\Windows\System\vrosBLT.exe
  C:\Windows\System\vrosBLT.exe
  2⤵
  PID:13912
- C:\Windows\System\PHxvXdp.exe
  C:\Windows\System\PHxvXdp.exe
  2⤵
  PID:12688
- C:\Windows\System\mvGxTAp.exe
  C:\Windows\System\mvGxTAp.exe
  2⤵
  PID:12764
- C:\Windows\System\oGpmoRZ.exe
  C:\Windows\System\oGpmoRZ.exe
  2⤵
  PID:12896
- C:\Windows\System\VpJamXx.exe
  C:\Windows\System\VpJamXx.exe
  2⤵
  PID:12736
- C:\Windows\System\yTaWrMn.exe
  C:\Windows\System\yTaWrMn.exe
  2⤵
  PID:13344
- C:\Windows\System\nnZqyqg.exe
  C:\Windows\System\nnZqyqg.exe
  2⤵
  PID:13376
- C:\Windows\System\BfFbBTA.exe
  C:\Windows\System\BfFbBTA.exe
  2⤵
  PID:14240
- C:\Windows\System\OncLjjk.exe
  C:\Windows\System\OncLjjk.exe
  2⤵
  PID:14340
- C:\Windows\System\mpQdbYz.exe
  C:\Windows\System\mpQdbYz.exe
  2⤵
  PID:14356
- C:\Windows\System\eobccRu.exe
  C:\Windows\System\eobccRu.exe
  2⤵
  PID:14380
- C:\Windows\System\VEQEAvt.exe
  C:\Windows\System\VEQEAvt.exe
  2⤵
  PID:14396
- C:\Windows\System\FeBKAmV.exe
  C:\Windows\System\FeBKAmV.exe
  2⤵
  PID:14412
- C:\Windows\System\IPyxifx.exe
  C:\Windows\System\IPyxifx.exe
  2⤵
  PID:14436
- C:\Windows\System\jZJHYui.exe
  C:\Windows\System\jZJHYui.exe
  2⤵
  PID:14460
- C:\Windows\System\ZzgDEFP.exe
  C:\Windows\System\ZzgDEFP.exe
  2⤵
  PID:14484
- C:\Windows\System\MqyuSTh.exe
  C:\Windows\System\MqyuSTh.exe
  2⤵
  PID:14504
- C:\Windows\System\iDlULSd.exe
  C:\Windows\System\iDlULSd.exe
  2⤵
  PID:14524
- C:\Windows\System\DPnoKBe.exe
  C:\Windows\System\DPnoKBe.exe
  2⤵
  PID:14540
- C:\Windows\System\kGroVGX.exe
  C:\Windows\System\kGroVGX.exe
  2⤵
  PID:14560
- C:\Windows\System\RmSjJHG.exe
  C:\Windows\System\RmSjJHG.exe
  2⤵
  PID:14576
- C:\Windows\System\ATWTFGr.exe
  C:\Windows\System\ATWTFGr.exe
  2⤵
  PID:14596
- C:\Windows\System\ZhoHsEL.exe
  C:\Windows\System\ZhoHsEL.exe
  2⤵
  PID:14616
- C:\Windows\System\TjhQzuC.exe
  C:\Windows\System\TjhQzuC.exe
  2⤵
  PID:14644
- C:\Windows\System\BPFyIOF.exe
  C:\Windows\System\BPFyIOF.exe
  2⤵
  PID:14680
- C:\Windows\System\DUvUdkI.exe
  C:\Windows\System\DUvUdkI.exe
  2⤵
  PID:14740
- C:\Windows\System\cJYXcvq.exe
  C:\Windows\System\cJYXcvq.exe
  2⤵
  PID:14772
- C:\Windows\System\fWEummw.exe
  C:\Windows\System\fWEummw.exe
  2⤵
  PID:14788
- C:\Windows\System\hbgduKJ.exe
  C:\Windows\System\hbgduKJ.exe
  2⤵
  PID:14804
- C:\Windows\System\tWowlTu.exe
  C:\Windows\System\tWowlTu.exe
  2⤵
  PID:14832
- C:\Windows\System\NpquNqg.exe
  C:\Windows\System\NpquNqg.exe
  2⤵
  PID:14856
- C:\Windows\System\ceukrYG.exe
  C:\Windows\System\ceukrYG.exe
  2⤵
  PID:14876
- C:\Windows\System\LtmEQWX.exe
  C:\Windows\System\LtmEQWX.exe
  2⤵
  PID:14896
- C:\Windows\System\HbZMyBu.exe
  C:\Windows\System\HbZMyBu.exe
  2⤵
  PID:14916
- C:\Windows\System\cJiOqDL.exe
  C:\Windows\System\cJiOqDL.exe
  2⤵
  PID:14936
- C:\Windows\System\bvvFmqL.exe
  C:\Windows\System\bvvFmqL.exe
  2⤵
  PID:14972
- C:\Windows\System\PMMzaWJ.exe
  C:\Windows\System\PMMzaWJ.exe
  2⤵
  PID:14992
- C:\Windows\System\dLuSPnM.exe
  C:\Windows\System\dLuSPnM.exe
  2⤵
  PID:15008
- C:\Windows\System\OtOImPV.exe
  C:\Windows\System\OtOImPV.exe
  2⤵
  PID:15032
- C:\Windows\System\HfdZamD.exe
  C:\Windows\System\HfdZamD.exe
  2⤵
  PID:15056
- C:\Windows\System\UBidjyQ.exe
  C:\Windows\System\UBidjyQ.exe
  2⤵
  PID:15088
- C:\Windows\System\GQTNcyN.exe
  C:\Windows\System\GQTNcyN.exe
  2⤵
  PID:15108
- C:\Windows\System\YIsvbuu.exe
  C:\Windows\System\YIsvbuu.exe
  2⤵
  PID:15124
- C:\Windows\System\tcnfnQF.exe
  C:\Windows\System\tcnfnQF.exe
  2⤵
  PID:15148
- C:\Windows\System\opkIUFv.exe
  C:\Windows\System\opkIUFv.exe
  2⤵
  PID:15164
- C:\Windows\System\foNqLRm.exe
  C:\Windows\System\foNqLRm.exe
  2⤵
  PID:15184
- C:\Windows\System\OHBJRBh.exe
  C:\Windows\System\OHBJRBh.exe
  2⤵
  PID:15212
- C:\Windows\System\atsmBJJ.exe
  C:\Windows\System\atsmBJJ.exe
  2⤵
  PID:15236
- C:\Windows\System\thDYWpV.exe
  C:\Windows\System\thDYWpV.exe
  2⤵
  PID:15256
- C:\Windows\System\pcILVcu.exe
  C:\Windows\System\pcILVcu.exe
  2⤵
  PID:15280
- C:\Windows\System\qilupXY.exe
  C:\Windows\System\qilupXY.exe
  2⤵
  PID:15300
- C:\Windows\System\GjcYsBF.exe
  C:\Windows\System\GjcYsBF.exe
  2⤵
  PID:15324
- C:\Windows\System\oRNTHEI.exe
  C:\Windows\System\oRNTHEI.exe
  2⤵
  PID:15344
- C:\Windows\System\gZunSKY.exe
  C:\Windows\System\gZunSKY.exe
  2⤵
  PID:13844
- C:\Windows\System\oItlEhC.exe
  C:\Windows\System\oItlEhC.exe
  2⤵
  PID:13916
- C:\Windows\System\jlPHRlY.exe
  C:\Windows\System\jlPHRlY.exe
  2⤵
  PID:13940
- C:\Windows\System\qVqxHEO.exe
  C:\Windows\System\qVqxHEO.exe
  2⤵
  PID:14012
- C:\Windows\System\XmyOVqe.exe
  C:\Windows\System\XmyOVqe.exe
  2⤵
  PID:13608
- C:\Windows\System\gUwSABe.exe
  C:\Windows\System\gUwSABe.exe
  2⤵
  PID:12144
- C:\Windows\System\OvaejLk.exe
  C:\Windows\System\OvaejLk.exe
  2⤵
  PID:12160
- C:\Windows\System\ZMjOuoV.exe
  C:\Windows\System\ZMjOuoV.exe
  2⤵
  PID:14168
- C:\Windows\System\QjHJpHh.exe
  C:\Windows\System\QjHJpHh.exe
  2⤵
  PID:14188
- C:\Windows\System\QggENBT.exe
  C:\Windows\System\QggENBT.exe
  2⤵
  PID:13908
- C:\Windows\System\YOhXbxj.exe
  C:\Windows\System\YOhXbxj.exe
  2⤵
  PID:14328
- C:\Windows\System\hUUKXOG.exe
  C:\Windows\System\hUUKXOG.exe
  2⤵
  PID:13352
- C:\Windows\System\ziQzQWA.exe
  C:\Windows\System\ziQzQWA.exe
  2⤵
  PID:13772
- C:\Windows\System\ECPumla.exe
  C:\Windows\System\ECPumla.exe
  2⤵
  PID:13804
- C:\Windows\System\WDPEuPZ.exe
  C:\Windows\System\WDPEuPZ.exe
  2⤵
  PID:13164
- C:\Windows\System\nTDMHlb.exe
  C:\Windows\System\nTDMHlb.exe
  2⤵
  PID:14480
- C:\Windows\System\TlZDKuP.exe
  C:\Windows\System\TlZDKuP.exe
  2⤵
  PID:14536
- C:\Windows\System\QncDCci.exe
  C:\Windows\System\QncDCci.exe
  2⤵
  PID:14632
- C:\Windows\System\bWDPUFq.exe
  C:\Windows\System\bWDPUFq.exe
  2⤵
  PID:12296
- C:\Windows\System\rhiETdp.exe
  C:\Windows\System\rhiETdp.exe
  2⤵
  PID:14728
- C:\Windows\System\TDaBEWS.exe
  C:\Windows\System\TDaBEWS.exe
  2⤵
  PID:14764
- C:\Windows\System\rfjrtvj.exe
  C:\Windows\System\rfjrtvj.exe
  2⤵
  PID:4288
- C:\Windows\System\pdvIQro.exe
  C:\Windows\System\pdvIQro.exe
  2⤵
  PID:14848
- C:\Windows\System\oWKIaZr.exe
  C:\Windows\System\oWKIaZr.exe
  2⤵
  PID:15364
- C:\Windows\System\IVTdbIM.exe
  C:\Windows\System\IVTdbIM.exe
  2⤵
  PID:15380
- C:\Windows\System\RpTQddJ.exe
  C:\Windows\System\RpTQddJ.exe
  2⤵
  PID:15400
- C:\Windows\System\VbUFTSp.exe
  C:\Windows\System\VbUFTSp.exe
  2⤵
  PID:15420
- C:\Windows\System\LLctnCB.exe
  C:\Windows\System\LLctnCB.exe
  2⤵
  PID:15444
- C:\Windows\System\MJoosaG.exe
  C:\Windows\System\MJoosaG.exe
  2⤵
  PID:15460
- C:\Windows\System\qarGgFB.exe
  C:\Windows\System\qarGgFB.exe
  2⤵
  PID:15476
- C:\Windows\System\FdJKQGT.exe
  C:\Windows\System\FdJKQGT.exe
  2⤵
  PID:15492
- C:\Windows\System\LxrUCLO.exe
  C:\Windows\System\LxrUCLO.exe
  2⤵
  PID:15508
- C:\Windows\System\LttlHIl.exe
  C:\Windows\System\LttlHIl.exe
  2⤵
  PID:15528
- C:\Windows\System\lypmHjH.exe
  C:\Windows\System\lypmHjH.exe
  2⤵
  PID:15548
- C:\Windows\System\QdjIOvz.exe
  C:\Windows\System\QdjIOvz.exe
  2⤵
  PID:15568
- C:\Windows\System\SXcXiHe.exe
  C:\Windows\System\SXcXiHe.exe
  2⤵
  PID:15584
- C:\Windows\System\LuLJkKO.exe
  C:\Windows\System\LuLJkKO.exe
  2⤵
  PID:15600
- C:\Windows\System\vcXHZdp.exe
  C:\Windows\System\vcXHZdp.exe
  2⤵
  PID:15624
- C:\Windows\System\eoEgHLC.exe
  C:\Windows\System\eoEgHLC.exe
  2⤵
  PID:15644
- C:\Windows\System\DQjofyQ.exe
  C:\Windows\System\DQjofyQ.exe
  2⤵
  PID:15664
- C:\Windows\System\HOFSyWb.exe
  C:\Windows\System\HOFSyWb.exe
  2⤵
  PID:15688
- C:\Windows\System\oKKStns.exe
  C:\Windows\System\oKKStns.exe
  2⤵
  PID:15704
- C:\Windows\System\IoiBlUB.exe
  C:\Windows\System\IoiBlUB.exe
  2⤵
  PID:15736
- C:\Windows\System\lPVVmLW.exe
  C:\Windows\System\lPVVmLW.exe
  2⤵
  PID:15752
- C:\Windows\System\UJzmpqP.exe
  C:\Windows\System\UJzmpqP.exe
  2⤵
  PID:15768
- C:\Windows\System\gZeqcZV.exe
  C:\Windows\System\gZeqcZV.exe
  2⤵
  PID:15792
- C:\Windows\System\FmZYVTp.exe
  C:\Windows\System\FmZYVTp.exe
  2⤵
  PID:15812
- C:\Windows\System\gXzpMuE.exe
  C:\Windows\System\gXzpMuE.exe
  2⤵
  PID:15828
- C:\Windows\System\PjjILwi.exe
  C:\Windows\System\PjjILwi.exe
  2⤵
  PID:15844
- C:\Windows\System\kZHLcZP.exe
  C:\Windows\System\kZHLcZP.exe
  2⤵
  PID:15868
- C:\Windows\System\nOVzHwI.exe
  C:\Windows\System\nOVzHwI.exe
  2⤵
  PID:15892
- C:\Windows\System\KlQPxYz.exe
  C:\Windows\System\KlQPxYz.exe
  2⤵
  PID:15912
- C:\Windows\System\PApZWyV.exe
  C:\Windows\System\PApZWyV.exe
  2⤵
  PID:15932
- C:\Windows\System\KZgjOUJ.exe
  C:\Windows\System\KZgjOUJ.exe
  2⤵
  PID:15948
- C:\Windows\System\hABGuAU.exe
  C:\Windows\System\hABGuAU.exe
  2⤵
  PID:15972
- C:\Windows\System\YtjbswV.exe
  C:\Windows\System\YtjbswV.exe
  2⤵
  PID:15988
- C:\Windows\System\irBtjXk.exe
  C:\Windows\System\irBtjXk.exe
  2⤵
  PID:16016
- C:\Windows\System\IXTljSV.exe
  C:\Windows\System\IXTljSV.exe
  2⤵
  PID:16044
- C:\Windows\System\ZfoQddn.exe
  C:\Windows\System\ZfoQddn.exe
  2⤵
  PID:16072
- C:\Windows\System\PuAVmxY.exe
  C:\Windows\System\PuAVmxY.exe
  2⤵
  PID:16088
- C:\Windows\System\MlSRdpy.exe
  C:\Windows\System\MlSRdpy.exe
  2⤵
  PID:16104
- C:\Windows\System\bVIrSoD.exe
  C:\Windows\System\bVIrSoD.exe
  2⤵
  PID:16120
- C:\Windows\System\ndoGBJr.exe
  C:\Windows\System\ndoGBJr.exe
  2⤵
  PID:16140
- C:\Windows\System\KubPwaV.exe
  C:\Windows\System\KubPwaV.exe
  2⤵
  PID:16156
- C:\Windows\System\YRBRuUU.exe
  C:\Windows\System\YRBRuUU.exe
  2⤵
  PID:16180
- C:\Windows\System\GoYOREs.exe
  C:\Windows\System\GoYOREs.exe
  2⤵
  PID:16216
- C:\Windows\System\BCTZvnr.exe
  C:\Windows\System\BCTZvnr.exe
  2⤵
  PID:16240
- C:\Windows\System\LLCzGcR.exe
  C:\Windows\System\LLCzGcR.exe
  2⤵
  PID:16256
- C:\Windows\System\jKVSJrB.exe
  C:\Windows\System\jKVSJrB.exe
  2⤵
  PID:16276
- C:\Windows\System\PVPMTvD.exe
  C:\Windows\System\PVPMTvD.exe
  2⤵
  PID:16304
- C:\Windows\System\vpVkPhO.exe
  C:\Windows\System\vpVkPhO.exe
  2⤵
  PID:16320
- C:\Windows\System\dVYsdZX.exe
  C:\Windows\System\dVYsdZX.exe
  2⤵
  PID:16344
- C:\Windows\System\JfUSuXO.exe
  C:\Windows\System\JfUSuXO.exe
  2⤵
  PID:16376
- C:\Windows\System\SLVkSsI.exe
  C:\Windows\System\SLVkSsI.exe
  2⤵
  PID:14932
- C:\Windows\System\ougsaLH.exe
  C:\Windows\System\ougsaLH.exe
  2⤵
  PID:15024
- C:\Windows\System\BqGxEQo.exe
  C:\Windows\System\BqGxEQo.exe
  2⤵
  PID:15096
- C:\Windows\System\evULOHk.exe
  C:\Windows\System\evULOHk.exe
  2⤵
  PID:15208
- C:\Windows\System\PePhkkQ.exe
  C:\Windows\System\PePhkkQ.exe
  2⤵
  PID:15224
- C:\Windows\System\xVOUrPJ.exe
  C:\Windows\System\xVOUrPJ.exe
  2⤵
  PID:15316
- C:\Windows\System\TfGaCfs.exe
  C:\Windows\System\TfGaCfs.exe
  2⤵
  PID:12336
- C:\Windows\System\yfDhAyP.exe
  C:\Windows\System\yfDhAyP.exe
  2⤵
  PID:14128
- C:\Windows\System\LqKYkSr.exe
  C:\Windows\System\LqKYkSr.exe
  2⤵
  PID:14300
- C:\Windows\System\hMBocMW.exe
  C:\Windows\System\hMBocMW.exe
  2⤵
  PID:14472
- C:\Windows\System\lYlvSiy.exe
  C:\Windows\System\lYlvSiy.exe
  2⤵
  PID:13900
- C:\Windows\System\krFYzpK.exe
  C:\Windows\System\krFYzpK.exe
  2⤵
  PID:14752
- C:\Windows\System\xrQQWUF.exe
  C:\Windows\System\xrQQWUF.exe
  2⤵
  PID:14892
- C:\Windows\System\feteOcb.exe
  C:\Windows\System\feteOcb.exe
  2⤵
  PID:16396
- C:\Windows\System\mmQReJc.exe
  C:\Windows\System\mmQReJc.exe
  2⤵
  PID:16412
- C:\Windows\System\FQGuXHS.exe
  C:\Windows\System\FQGuXHS.exe
  2⤵
  PID:16428
- C:\Windows\System\fDpZjIu.exe
  C:\Windows\System\fDpZjIu.exe
  2⤵
  PID:16448
- C:\Windows\System\jhtSDDU.exe
  C:\Windows\System\jhtSDDU.exe
  2⤵
  PID:16480
- C:\Windows\System\zApELfY.exe
  C:\Windows\System\zApELfY.exe
  2⤵
  PID:16500
- C:\Windows\System\kVQPyXx.exe
  C:\Windows\System\kVQPyXx.exe
  2⤵
  PID:16520
- C:\Windows\System\thxGloT.exe
  C:\Windows\System\thxGloT.exe
  2⤵
  PID:16536
- C:\Windows\System\ABPBXpn.exe
  C:\Windows\System\ABPBXpn.exe
  2⤵
  PID:16560
- C:\Windows\System\ZvRVEzU.exe
  C:\Windows\System\ZvRVEzU.exe
  2⤵
  PID:16576
- C:\Windows\System\bTOodVm.exe
  C:\Windows\System\bTOodVm.exe
  2⤵
  PID:16592
- C:\Windows\System\IxOBmCg.exe
  C:\Windows\System\IxOBmCg.exe
  2⤵
  PID:16616
- C:\Windows\System\bpKFiZt.exe
  C:\Windows\System\bpKFiZt.exe
  2⤵
  PID:16636
- C:\Windows\System\HAZdPrH.exe
  C:\Windows\System\HAZdPrH.exe
  2⤵
  PID:16652
- C:\Windows\System\rGmNEVK.exe
  C:\Windows\System\rGmNEVK.exe
  2⤵
  PID:16668
- C:\Windows\System\GTIqpjI.exe
  C:\Windows\System\GTIqpjI.exe
  2⤵
  PID:16684
- C:\Windows\System\OyeBLjh.exe
  C:\Windows\System\OyeBLjh.exe
  2⤵
  PID:16700
- C:\Windows\System\BonsADJ.exe
  C:\Windows\System\BonsADJ.exe
  2⤵
  PID:16716
- C:\Windows\System\CiQmPvd.exe
  C:\Windows\System\CiQmPvd.exe
  2⤵
  PID:16736
- C:\Windows\System\iOPqDtf.exe
  C:\Windows\System\iOPqDtf.exe
  2⤵
  PID:16756
- C:\Windows\System\HcBFdHG.exe
  C:\Windows\System\HcBFdHG.exe
  2⤵
  PID:16772
- C:\Windows\System\nlybDOg.exe
  C:\Windows\System\nlybDOg.exe
  2⤵
  PID:16788
- C:\Windows\System\FekXxbX.exe
  C:\Windows\System\FekXxbX.exe
  2⤵
  PID:16804
- C:\Windows\System\yCRcSKX.exe
  C:\Windows\System\yCRcSKX.exe
  2⤵
  PID:16828
- C:\Windows\System\ZOuRLKS.exe
  C:\Windows\System\ZOuRLKS.exe
  2⤵
  PID:16844
- C:\Windows\System\EFxXHHq.exe
  C:\Windows\System\EFxXHHq.exe
  2⤵
  PID:16880
- C:\Windows\System\aTNbfMQ.exe
  C:\Windows\System\aTNbfMQ.exe
  2⤵
  PID:16900
- C:\Windows\System\RnXxMvn.exe
  C:\Windows\System\RnXxMvn.exe
  2⤵
  PID:16924
- C:\Windows\System\GbZBWns.exe
  C:\Windows\System\GbZBWns.exe
  2⤵
  PID:16944
- C:\Windows\System\RGBLdkK.exe
  C:\Windows\System\RGBLdkK.exe
  2⤵
  PID:16964
- C:\Windows\System\jCkMNPm.exe
  C:\Windows\System\jCkMNPm.exe
  2⤵
  PID:16988
- C:\Windows\System\YrHJIMx.exe
  C:\Windows\System\YrHJIMx.exe
  2⤵
  PID:17004
- C:\Windows\System\JeyGpTj.exe
  C:\Windows\System\JeyGpTj.exe
  2⤵
  PID:17024
- C:\Windows\System\AcfWKEg.exe
  C:\Windows\System\AcfWKEg.exe
  2⤵
  PID:17040
- C:\Windows\System\iWvdKED.exe
  C:\Windows\System\iWvdKED.exe
  2⤵
  PID:17060
- C:\Windows\System\hbcqhsT.exe
  C:\Windows\System\hbcqhsT.exe
  2⤵
  PID:17080
- C:\Windows\System\HfBJStk.exe
  C:\Windows\System\HfBJStk.exe
  2⤵
  PID:17104
- C:\Windows\System\ejUress.exe
  C:\Windows\System\ejUress.exe
  2⤵
  PID:17120
- C:\Windows\System\XwPqppU.exe
  C:\Windows\System\XwPqppU.exe
  2⤵
  PID:17140
- C:\Windows\System\dhxtfhi.exe
  C:\Windows\System\dhxtfhi.exe
  2⤵
  PID:17160
- C:\Windows\System\iDaGxHR.exe
  C:\Windows\System\iDaGxHR.exe
  2⤵
  PID:17176
- C:\Windows\System\fpFcGhs.exe
  C:\Windows\System\fpFcGhs.exe
  2⤵
  PID:17192
- C:\Windows\System\cGUSFoA.exe
  C:\Windows\System\cGUSFoA.exe
  2⤵
  PID:17208
- C:\Windows\System\nXfzPPZ.exe
  C:\Windows\System\nXfzPPZ.exe
  2⤵
  PID:17228
- C:\Windows\System\qurHNdh.exe
  C:\Windows\System\qurHNdh.exe
  2⤵
  PID:17244
- C:\Windows\System\RKoigjw.exe
  C:\Windows\System\RKoigjw.exe
  2⤵
  PID:17264
- C:\Windows\System\yjBGpwO.exe
  C:\Windows\System\yjBGpwO.exe
  2⤵
  PID:17280
- C:\Windows\System\vTCToQY.exe
  C:\Windows\System\vTCToQY.exe
  2⤵
  PID:17316
- C:\Windows\System\GTCTypx.exe
  C:\Windows\System\GTCTypx.exe
  2⤵
  PID:17336
- C:\Windows\System\kcSdRur.exe
  C:\Windows\System\kcSdRur.exe
  2⤵
  PID:17368
- C:\Windows\System\HHeJydw.exe
  C:\Windows\System\HHeJydw.exe
  2⤵
  PID:17388
- C:\Windows\System\cYxDUwY.exe
  C:\Windows\System\cYxDUwY.exe
  2⤵
  PID:14952
- C:\Windows\System\zbQIKxR.exe
  C:\Windows\System\zbQIKxR.exe
  2⤵
  PID:13644
- C:\Windows\System\SAaGBoq.exe
  C:\Windows\System\SAaGBoq.exe
  2⤵
  PID:15484
- C:\Windows\System\gzwCgFn.exe
  C:\Windows\System\gzwCgFn.exe
  2⤵
  PID:15504
- C:\Windows\System\ELIyKiS.exe
  C:\Windows\System\ELIyKiS.exe
  2⤵
  PID:15044
- C:\Windows\System\NTURTiN.exe
  C:\Windows\System\NTURTiN.exe
  2⤵
  PID:15540
- C:\Windows\System\rylntez.exe
  C:\Windows\System\rylntez.exe
  2⤵
  PID:15116
- C:\Windows\System\eiupVJX.exe
  C:\Windows\System\eiupVJX.exe
  2⤵
  PID:15696
- C:\Windows\System\mYqMmtC.exe
  C:\Windows\System\mYqMmtC.exe
  2⤵
  PID:14392
- C:\Windows\System\RBDXlLc.exe
  C:\Windows\System\RBDXlLc.exe
  2⤵
  PID:15728

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv yABUJMsoW025q7G84CYkHA.0.2
1⤵
PID:14616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:16592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AlhWddk.exe

Filesize
1.3MB

MD5
0079989c4d85a49f5fc93bd1c9e978ed

SHA1
dca9159f99967402e714c27f738d195459910065

SHA256
8bf115e441a74a8eb9f777a1997320dcb818ee710d181e2f903f00b0f585c476

SHA512
54271151c3c6282bddeb7b3cc600642ddd6646a8314fb61730fffde36b245a3b94650054095eaebd26983ae7f80f59dbaacfc5fd9c5f0368cbb094a0dec473c7

Download Submit
C:\Windows\System\DpIEoRj.exe

Filesize
1.3MB

MD5
ed988e918b2ce85672aba1a75f755cfa

SHA1
7bc0b0e4d5bc28e0d726d3cdfcc9607e992a291b

SHA256
4ffb1c8da25a2bbe9d66ac8787a4ae81a631edd445eed3b89ed0c24ab1ee3181

SHA512
68be28ec9e2caccf7b774a94a146e8036e2d2311326927565aea750cbdebc976f2ad8b40df998b535c44e9b343a8665e964007976d23196aaba73c4aa82c6e2d

Download Submit
C:\Windows\System\FVLlzsW.exe

Filesize
1.3MB

MD5
6c5f99b065062a17a436e0975499ca1e

SHA1
2efc6b3b7b8e63ffff3a2589bfa7d0e98a0df699

SHA256
79b10f417e1331a2a21883515eca9da8b0490b95fe6356f419b6537fb1adf1be

SHA512
27eebdbcb73a619622915b078f16567c17857233cb8e3cc0de5e501a7a12ba4b1cb7aefe23df606d64c3ba122360bbe55fc5bdd000f19c922aa4a949aec8b2d8

Download Submit
C:\Windows\System\ImNRsWy.exe

Filesize
1.3MB

MD5
7b7afec2b7f7317392e91d228fa5e332

SHA1
9ad364cf41e685f4257f3438934eb6ac23db816f

SHA256
b14351fe0a8ce1c1a174746e6e48cb1164db9a62ed5c4005483537948b3506fc

SHA512
1a8abf949d252903fd111f48751206c65f4ac2233f347dd979171c0f129a1d1b9958f805573561f4580eb950cef462414d5e2d5264a369420528bac700380ccb

Download Submit
C:\Windows\System\JjABdSJ.exe

Filesize
1.3MB

MD5
01dfd451ab6387830f5b50a13d4b2ffe

SHA1
f0d3a00e3feba16e08e29ed71064bb537664c120

SHA256
2f77e01b00d359aa2cb3cbc905891489cf8a8149f0a082a81e0af2a299659c43

SHA512
5714e8e83f3000821d2e5240ce7e65cd577d7955e6138ca20ebda137effad1fbcdc79d3c1cd8576ba2cdc99c39a5e61e86d3a03d10763a16972e593b2c01b4f2

Download Submit
C:\Windows\System\LYvuhMI.exe

Filesize
1.3MB

MD5
885a15560613ba3323ca3f679279b33f

SHA1
9c0984c4506f3122bed8adcf1fd24d72c633fdef

SHA256
7f3ca695d8901e017bb2580a1e903b0a1e01a06bd7b2edd686411ed3058f78cc

SHA512
cc0c421561c65d895a410f0c66519effd9c7fe60790d3d00e14c8bb7146a6475827b8886388eb053f778fa045c1ac6cbc1391c696697600e2ed36e4fa3925358

Download Submit
C:\Windows\System\LsZyMPV.exe

Filesize
1.3MB

MD5
f62c403386fcd4f6ad4cd3d472614aaf

SHA1
31f5642af8dbd4cd849f891a8221a79e9c5b35d6

SHA256
f48053554e60084bc41c5562af83921eafdc80f28c35036002867ab0fceab33d

SHA512
7c9286c7762497467afcae93a2d8e3fa86d6143bfb6f65229568aed830e238c02bd9da7f12c3bb01106202d01625b31e4701ad0fd473f6af0430cc2385202147

Download Submit
C:\Windows\System\QaVgzyC.exe

Filesize
1.3MB

MD5
8e4175922c85ea8fc4372adf5d53b547

SHA1
814510b233dfa8339f35f9567e0c2fa7bb7e3b26

SHA256
1559f36fdb11e4af6ac8b6845934fc86efa34a9cf751394809252b696c88f091

SHA512
abc6f80277fa6a955e33edfacd4ae0636f9317e425fc2a3b2e5031e1dc3cb2e51130709927d488a722e070d0a91b6e0e05150b8c0f1301d9178fdaa3a8b4734d

Download Submit
C:\Windows\System\TxYNlpZ.exe

Filesize
1.3MB

MD5
d2b5314dc0913f4404e51487b0648a38

SHA1
aab0dd21c85eb29cf4957791c4f52e6a1fb2b334

SHA256
d1976f73f0bf7db75f6bba344da9e7d18e555d9eca5b0e1e6d64793911c39903

SHA512
51e23046793651d2c4777d58f153cfa7f3c2495756626629f363ffbdfab24514a5fbbc11de856919ea1d4d6e86b84199693196afb00fa83be39b869abeb2cbd1

Download Submit
C:\Windows\System\VYLoUXK.exe

Filesize
1.3MB

MD5
1fea0e8d8bb5b60f20097e003c65387a

SHA1
165ea3e5497de57bb733033f9c5cb526c5da988f

SHA256
a36b1ff1a91dff795ee6aafd313dbe51f6e6bf27e2a60afdfbbf1d93d400c5e9

SHA512
a9da38894e21598b2992b67d5b26813ade890d127059527e2d9d50887bdf77c2cdda93bf190008cd237805b0d7d04832a6614c8673220527da610fbba22bed25

Download Submit
C:\Windows\System\WOTDQnV.exe

Filesize
1.3MB

MD5
123b097294e3a4da0d68a70bdfc43a11

SHA1
c1632f259a3b3095ffff57d348a5ea757299995c

SHA256
eca42d4c15bb62133ffb44d43134824b4488891e9708dc2eacd1b99056758a67

SHA512
937f412e735fd6862b617f57610f4e01da1d1c3ff30cc0f9f4cd2c00d68c21636b5d1e8bb92ddcdf50ecb99c74febfc633508a217c013c7a4784e48ea2f9472b

Download Submit
C:\Windows\System\WRheJYE.exe

Filesize
1.3MB

MD5
1b9a92fcb39f3714b22f2c18da389bd4

SHA1
36ea411af7e2de39aa6566086a6a4cc84e37dccb

SHA256
cb46c818954cf7c93adbc5101459a244d74211dd2c814c5c227304d74c6ed171

SHA512
2911710e348efeb6032767b1f6d51ad03589ede74cd33e72a063dc78745e64db1f9246a969b4e8b21759731f651d24f09a1b24eedfb73084a8057ca4a3c627cc

Download Submit
C:\Windows\System\XgAYCKp.exe

Filesize
1.3MB

MD5
b1769048deffa27f8c22eec2e954c59b

SHA1
7807ab70a35fee076c38a5c21181886b415cd0fa

SHA256
63e5bc0d845ce95fd1185b3191e5a8fc1d1398fa0af4c205803fa2a9133dc630

SHA512
37a2a7c1a829be510dc097e49bfd405c65ac065d492db904c0bcf76f1ec2ffc9ae821bea9f95a292c58aaffe2955e5ff07ab84cdd9ed4e888cfe2b620407cd7a

Download Submit
C:\Windows\System\YqSanHb.exe

Filesize
1.3MB

MD5
9a487cb395342ff24fc96decaf6e4a75

SHA1
75e3811233a2ed135f83b0d7946642e3043ab8ea

SHA256
b6c65461427fbe8376d456b8a7582412af29167acc768ee935014909c47f693a

SHA512
10bea13d77e9381ed7337239647aad6f83b2a999fa6b2409229ca4b066ab72c74578f103c62a64f426de97944363076b52fc8f78a9d556ba2265298fe26a4b3c

Download Submit
C:\Windows\System\bdIEQQX.exe

Filesize
1.3MB

MD5
44f337365c98c4a7a4ff99d1982af0b0

SHA1
e14c4a6d774008ed4bc077ffdeb797bfc1eb653f

SHA256
848dc72131bd11fc78ada0fb2a2a402312ae7dddb0a2f8c2e5680db60a447d6e

SHA512
14ff043d34f82a899350a096daa7755e015e6c20624e577e7ecc8acf5b1f58f42848fe2d93124b8b35e99c1ab02cb15f18690bf1f46b0f6918716c6127c98894

Download Submit
C:\Windows\System\cCIsYWC.exe

Filesize
1.3MB

MD5
5530664171ffe1517546855a22a923d0

SHA1
6423147b623eb34506ce36f6c750419e3de1f449

SHA256
51af06fc02684f5769620f2be560353681f84a08ec7a5aba8d1c9f2bf4224cb0

SHA512
7c26d1b1264081811e974735c61ffaf43226607e7d4a16588d5cd39a43b449597595d792c3b3c9b6576aa90e0bffed44b9827b8e5fb7a068698b92495b5da063

Download Submit
C:\Windows\System\cVZpjAX.exe

Filesize
1.3MB

MD5
3a85a9f65c1a92b1cf585fbc17d5d355

SHA1
27fc5186689ce2a472a683a0df07b021bf92e5e5

SHA256
d4dd0e6749bc63a31d3edeb014168c24a9337f76ae3f7402f87c203d0bbff0be

SHA512
80a9027d2af21ff58fac64f1d156dbb9d060cb037526c1c62c7104662b500e3c58541d00379ad0c1f44e8b45fe5a9e810fd0d6e89e23aa1d2e6a290d7ca686f1

Download Submit
C:\Windows\System\cbuPyqD.exe

Filesize
1.3MB

MD5
758f55646ecb44057dc35ee053f0e0b1

SHA1
4a9f39574c55f0ddb59362e1857fc1d58717b762

SHA256
40dfaae25ccdf98b7624f436934b7c780c92f0a2294ac3ef7753abe5498313ea

SHA512
6f706762e69677329a24d0d8efb980038d2113a8aba4ee16d7e18678e22d14259522d17181870bb371067180d9b7f6c1a9830b9cd1e788219f584383d09fa943

Download Submit
C:\Windows\System\dVhXnlL.exe

Filesize
1.3MB

MD5
87203a33bfb972931cc95e80c69f3aba

SHA1
f42c85165d8f7d637ec3e0fba798754dfee4ae26

SHA256
18c3725377b03b6eedb764bde1882dd07ec1a98a1023bf6cd7824d1ced40f231

SHA512
07d889227557809e1f961ce8926f79e21e8dacfb74301b0c6f62135b94f6084975f2fef4e1108710748b69826b9376c2e3b586513da79a169965692b1183148f

Download Submit
C:\Windows\System\dkLkkpn.exe

Filesize
1.3MB

MD5
1ba1c62b07cfefeb4ae1344c4b071c66

SHA1
89cdf7c9a469814d47f0c65c11dc0173dc0ee4cf

SHA256
cd750dd69bf1eacb469d638f73f6ae00306bc14869911ecb6626ee99a09357ad

SHA512
4545534e720f718028b07ba78d6125eed1dd89651c20edad7eabdd7a22ffb9e8116e91ee1fc268adc398341118930e9b870e010e716fcd46e4f2d24b0145e450

Download Submit
C:\Windows\System\dqAbGZn.exe

Filesize
1.3MB

MD5
841e681fb64fcb0dc1a6778110e0f057

SHA1
2a849b56e8ab4b47942b0b1ff2d39daddc39db7f

SHA256
60702430dbf07a9ff77afe2e38ce99ded89d34c36fbc6aacd4549d0240d32bb3

SHA512
953acc726173f5cec8c7d594cdd60a0cd4fa06e9456e08ce946680cc4903edbbbea4904808be6eb25274f22473bb9ca3f680368d3e02f9a4c33e6689a2ce29e9

Download Submit
C:\Windows\System\fwlGzAp.exe

Filesize
1.3MB

MD5
66f618970841fbf3126cfb9cc1725069

SHA1
ca654b68e73dd78904816fafb8e691933d8fa5bd

SHA256
1adf32d52457119ec77bfe9341b2d7c33c26b9e539930a4977174a92a0f620f7

SHA512
aa2728103dd47fbcfae95af6c887d2f0514ea378be7e0528e7c29404911ad1c01267ef240a2184e46601a42c3e2a6a1e211529fbf120efd336fdc996a9423927

Download Submit
C:\Windows\System\gtTANmV.exe

Filesize
1.3MB

MD5
db509332cb1cc32fe9c08b596442d538

SHA1
cec3238356ffe35e402c7205da94142bbf71f3bc

SHA256
dd22680c230c570566cbd51fbc54cc9ee3dde8345f05bbfa2d63dde38465a461

SHA512
1ac36c728105c09153fdc4db77a4e35d75781480eb44161a57f389059cd3407ccded0d47abd1eda1bd31cdd85077e76f319bf3d26f515d4a0dfb83c9ad6fde4f

Download Submit
C:\Windows\System\iAcwXEJ.exe

Filesize
1.3MB

MD5
25ecff07aaf278f60ddd95b9ac726b34

SHA1
42867e304c8c55e5996e86ca2b9f3ec271e5bdb1

SHA256
6d0e2427acb6abb143b07414c0cffc263baa3836dcf4ff4f3c719899eb19d951

SHA512
55a37ab84b8d0344b86592f0faba57a0a8f0589e7ae6d5ffd65f2553911abe9d04453a720447b8ec5cd13d05d9e32a8f66bad940c67062650ddd453c98af2560

Download Submit
C:\Windows\System\iquDfVZ.exe

Filesize
1.3MB

MD5
a31d0d227c2c5238e3b82baf2f7ab602

SHA1
d4715f9e542ef60e4676ed1b0dfaacc2952abc93

SHA256
17d0f4f30bd6cf353dd28c3ddb2527d6348cef5e21c5c6e8599beef22d3c5a3e

SHA512
d01b80b250a9896161be452120e7fec71fe94cc500dee1529d5587b0fa7411bf8adfadb191b0cf4a5d2d69ebd39fed99747a2808bbfd984bcfc93e04725387a7

Download Submit
C:\Windows\System\jrOHJIU.exe

Filesize
1.3MB

MD5
e740873c60bc81ac88b2338c412a542b

SHA1
19aab6d2b58b87be81a01950238a3fb3b42b23dc

SHA256
d287893751b7e9b11ed37aeae7721654d2a8cdc433d85aa8a69a131cfcb2e3b6

SHA512
e76a43c07596a0e16e24082f3e49d07ef59c473fdf90866fa77d73e633df9e5fb26e9c6645e138ccece54e9e4e3f511e2a82989abcb525253ba1550497023557

Download Submit
C:\Windows\System\mYlOJTy.exe

Filesize
1.3MB

MD5
b10b79b6b300883508ab7d042030bc1a

SHA1
67748d8a52653a3dd770b630667a87ca6fdcfd2e

SHA256
47e242f63733b7fae085de08b707b1260bef6213d9b690570d05fc71a12e4916

SHA512
4ddcac918ce16f8bc49f28ba2722e0feffe12d97c7e3c42e10f78aa6b4f6184e43363eec376ef4e58dc2b7cfcd54c126145943d3a7663cf7b4cb98429fd1cacb

Download Submit
C:\Windows\System\nHJQOiB.exe

Filesize
1.3MB

MD5
0756460b862522879abbd277bedc511f

SHA1
61f79ab33bb018a011b7e12780a39da230707786

SHA256
502ab9cf30f591197694184a1e9443a834e3d89471013e48ad1715d1baf7b285

SHA512
52f188cff8029e4bfeff3b1cc28685e1180bfea0efc2c756e0b38cab2e78b523872680406044c8b06d1b30cfc19a6533cbb3d6802d71e1e36a627fe45b04258c

Download Submit
C:\Windows\System\oMGKLLU.exe

Filesize
1.3MB

MD5
6201f379acdf0b246e851ff58d9b2927

SHA1
1d2a269b4342c7499824a9f09b68d041a7a659ff

SHA256
30eb67034ff252285e1a5bbc51706e4f07552b8db4457ffc5fcd01155822d431

SHA512
26af2e54f913f95bb80dddd807e4fe0236f585c8dcad1db6943fc2f9143ea7e68664568f8b8d889a0f5146a48f354ba206476ca08d38620629960665abb7acec

Download Submit
C:\Windows\System\qDGYnAI.exe

Filesize
1.3MB

MD5
27108c60cafffce457c9eabd699b6e51

SHA1
ea1c3282855df0fa93bd8bd27660c6599da7cd77

SHA256
f3eb06a44de99fdd7b31fc874a698e33a211d3ef40214013b97d768f6fcd9831

SHA512
3901472b1bd9bc3b7a07bf7355d51459f5b7d30395ad521ceee57b977dea8d3689ee32714b0598522ebb139c4e01f9c0d87ac17d25bfd7147834650c404ea7a8

Download Submit
C:\Windows\System\rYiDzjk.exe

Filesize
1.3MB

MD5
caedec828ba18d7ea18b63e8a677fcf0

SHA1
e8072450f77fcd9564d544b22bcebb4e732214d5

SHA256
19ad5d2ef3746c04a9923f1b7d7b1c713bbb4baf28486fd676a2c3a4d8a05ee9

SHA512
abab369395f7aefa098cc4c59fc9442d3c014275569516d6e473cc3430c43e3a8d043b5d7ce46e077b13e2de405ace1fd463659b019d5611841dade291ec12b3

Download Submit
C:\Windows\System\uAwvInV.exe

Filesize
1.3MB

MD5
072a32025a8525e91b26cafb1c3ed8df

SHA1
148b079cbee04e45eac195914375e8dc8aff0023

SHA256
c36a2c8367c3996b33ed7fb8604c4e843a587a49f8ffa9935d694f101b8f08dc

SHA512
81da1783a05add082ffaae7db1b66f60b67650a746df8f1201908ac1c933ff61aaaa72911f23f92795bd16a37ac9e911ecb68a479fc1ee58e8b8f40b52c1c7d1

Download Submit
C:\Windows\System\unagjqx.exe

Filesize
1.3MB

MD5
8d8e50b44ddd3f9cabda261500f367e1

SHA1
c64c4a8dec122fd979412d02e4751d74d01c08a0

SHA256
75eddcb329579eaf7911db81f79916a9824d4bb25ded83f41fd8b41e467faf9e

SHA512
fb66eeed4efa0e1be086ac7e52c4304d20352da4f31f29b7aeb4cc9e9c874c490917e638a490df349c9a0cdd4945260239dde983b50e7a705b9640e603695a46

Download Submit
C:\Windows\System\vGKhRII.exe

Filesize
1.3MB

MD5
f96aae116e7da55ac202fc1a18c44ce1

SHA1
6478d8708c868f5f73314a1cc00780357b07f985

SHA256
bbcca694a5850c32d75ac53fd3a9f5fc2e80deb83cc935c2183aa6578fad4ce9

SHA512
c8a41c6f2f3faaad2bc756c749c833c7f3636aeb37f1ad50f497b367bf50abca17315db8083b654373854c4664632608281fb5eb8f29e5b42a8bbea867a1f644

Download Submit
C:\Windows\System\wQdIwxk.exe

Filesize
1.3MB

MD5
1e467d398e25eb9e8e95f55b9c09e4ff

SHA1
3f86cf3a72304ed5b93c3980ffeb56495658798f

SHA256
9d68ecb6ce0a5b01a06ccf413ebb762246daab7e3957571d595fb7789942ea7e

SHA512
13fcf7802fb461f8b00066681393ddd24a05395d0611fabd5cec04e6db635fea5866e5d466ffb4598c1f7a819d565603ac2842e4490fe18f0a39e0b2f433b1f3

Download Submit
C:\Windows\System\wkgbAbn.exe

Filesize
1.3MB

MD5
34bd1608f4f19f35eba80f184a2e4e24

SHA1
c4550316a7c9b1b2ab5f8e5d3d7e825b55652ac7

SHA256
6597ca4265da92b087d3ba1d77502e2ea81750822f5eaa892c6953cacc0d538f

SHA512
10acc733696703a34ffa9b91bd1d2ec5d264a65559813c56be3a7bc3922b4b93fbc0eafac7bc86dc1567c2ba92956d152b0d1af3f151f175ad9df39b59ed5793

Download Submit
C:\Windows\System\xDnkmrr.exe

Filesize
1.3MB

MD5
98ccab69beb93972146638d42f3ac17a

SHA1
8c7caf6d7683b4a2980ce5934ae72c4299fdc4b8

SHA256
f5bda1b5973b61236a780d1bd8e4578910d40b6660658861be5bed19e313d031

SHA512
34aff115d13289bb73d62d1f0c671c810db8ea59efbbcd5be57e06dcb738f072f10a97243c4fe66f60f3cb119dfe51739f244d33209198c23fddb3fb6bbe8935

Download Submit
C:\Windows\System\xNtIwQE.exe

Filesize
1.3MB

MD5
bb07548d4cce2c7116bc89cfd435d0e6

SHA1
152637595633b2c527701a3af33035443a235487

SHA256
f649ce8e9f629b6b00300e65b2fd8b606e7f186ef5c0410ab9c707aaacd913f8

SHA512
86be4357b3af8e673c2ccfbaf1d32fdddc3076a4dd46734cc3d739c54412269ace61b6377f683f8a3c6a87627d7efc2f549a3eef1a83bbe7b5b4a3c1eee28d57

Download Submit
memory/1648-0-0x0000023C89B20000-0x0000023C89B30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads