xmrig | 0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
Size

1.2MB
MD5

3ff3df86b1362e67a353b5a60333c350
SHA1

27c7794a4c19daf9fee908b21a12d165d0ddca69
SHA256

0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139
SHA512

94cf613eafc6f718e1196a8b4ed504e2d5d28646119a8252bd912c356743ff4d1ea2be228ceca91656ba978fa21fccce2b621005d557ae5520d2a5eeb78ffb14
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrgdFGAy:GezaTF8FcNkNdfE0pZ9ozttwIRQUu

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023ba4-3.dat	xmrig
behavioral2/files/0x000a000000023ba8-8.dat	xmrig
behavioral2/files/0x000a000000023ba9-7.dat	xmrig
behavioral2/files/0x000a000000023baa-19.dat	xmrig
behavioral2/files/0x000a000000023bad-33.dat	xmrig
behavioral2/files/0x000b000000023baf-49.dat	xmrig
behavioral2/files/0x000b000000023bb0-62.dat	xmrig
behavioral2/files/0x000e000000023bbf-75.dat	xmrig
behavioral2/files/0x000e000000023bd3-85.dat	xmrig
behavioral2/files/0x0009000000023bcf-83.dat	xmrig
behavioral2/files/0x0009000000023bce-81.dat	xmrig
behavioral2/files/0x0009000000023bcd-79.dat	xmrig
behavioral2/files/0x0008000000023bc8-77.dat	xmrig
behavioral2/files/0x000a000000023bb8-67.dat	xmrig
behavioral2/files/0x000b000000023bae-55.dat	xmrig
behavioral2/files/0x0008000000023bda-101.dat	xmrig
behavioral2/files/0x0008000000023c0c-128.dat	xmrig
behavioral2/files/0x0008000000023c0e-135.dat	xmrig
behavioral2/files/0x0008000000023c0d-130.dat	xmrig
behavioral2/files/0x0008000000023c0b-126.dat	xmrig
behavioral2/files/0x0008000000023bdb-119.dat	xmrig
behavioral2/files/0x0008000000023c0a-115.dat	xmrig
behavioral2/files/0x0008000000023bd9-104.dat	xmrig
behavioral2/files/0x000b000000023ba5-97.dat	xmrig
behavioral2/files/0x0008000000023bd5-93.dat	xmrig
behavioral2/files/0x0008000000023c0f-140.dat	xmrig
behavioral2/files/0x0008000000023c15-147.dat	xmrig
behavioral2/files/0x0008000000023c14-148.dat	xmrig
behavioral2/files/0x0008000000023c16-152.dat	xmrig
behavioral2/files/0x0008000000023c2e-163.dat	xmrig
behavioral2/files/0x0008000000023c28-159.dat	xmrig
behavioral2/files/0x000a000000023bac-39.dat	xmrig
behavioral2/files/0x000a000000023bab-29.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4836	RtemheK.exe
2848	DQxhQHN.exe
4848	nSTwgOj.exe
1484	ddZkjwm.exe
3160	IaDXCWl.exe
4480	uwOAmRK.exe
3600	qaErAUZ.exe
1632	bjrxBzf.exe
2468	TVofqAO.exe
872	yRtYxpc.exe
4440	mwEhKju.exe
2276	vDyeMLW.exe
540	MREcvTo.exe
2968	WZURcRK.exe
4908	fXDgjKY.exe
2156	PRDwDBj.exe
2404	TglROag.exe
4400	NqlbNod.exe
3832	lCpeXBu.exe
2980	TkEpZal.exe
3988	IsHbRdY.exe
1636	kldtnHt.exe
1692	alFoiMG.exe
1272	ipQNbeD.exe
980	gSnBqcE.exe
2084	bOHCDUJ.exe
4308	DUdBcug.exe
4652	jhdcxRD.exe
1796	gYutRqv.exe
2680	WpYKLtl.exe
2204	vwBxdad.exe
684	jWGCBuv.exe
368	knMwVim.exe
1260	gNfTjjt.exe
3308	LvNxfzO.exe
4936	WImObXW.exe
1880	YmAPQnk.exe
2528	gZPmwsa.exe
3104	xMdKmXe.exe
3140	kytGYSR.exe
2132	VCFNVZE.exe
4428	maXCmgn.exe
1340	isqXcDF.exe
3364	CDOtwLh.exe
2768	fhtWfpc.exe
1656	hBDVoJm.exe
4080	mmqKdAV.exe
3972	eyFjUOY.exe
2844	FxnjWxk.exe
1084	tPpTgWj.exe
964	bcYgzjB.exe
4780	LdRzwSF.exe
1752	OwjDKGd.exe
3548	bIZLAED.exe
2168	rUOeXpn.exe
3828	jeiAfcX.exe
4324	aSrYjoT.exe
1964	UIvCyYW.exe
232	NDLLGkt.exe
1400	WEIQolD.exe
1776	iwnSeDt.exe
4532	irIovjh.exe
3492	kxDIWfd.exe
4632	QoOtRbd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gzMZAep.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\JSAfvZk.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\maXCmgn.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\yWbiEoL.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\RQzdDnZ.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\ZkPjATI.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\RupViYu.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\DhkuWBq.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\DYIHxLa.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\oQRUlQX.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\SafgFgu.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\BMXptRd.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\GNDoGwD.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\KwuOmKT.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\QDfIPxs.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\XepUXBn.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\BMIFKyv.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\MugTkIB.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\WLCXybK.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\YuHnepk.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\kkyjgll.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\BsFKQIv.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\cYcFxXQ.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\TVofqAO.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\mmqKdAV.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\ounImhg.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\VCFNVZE.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\YQZEskP.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\xhcoxKt.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\KHenwgH.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\uqfGdvU.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\pnfZkmo.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\Mmpvbcx.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\Ugvihdi.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\WLAjBzi.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\octzgFD.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\opCpbEu.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\DQUzMMc.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\LUqvCiW.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\lXkWSVS.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\YTdrWDJ.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\OagWzBA.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\jSxUPKe.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\UkCxRAk.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\cAJyWVh.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\izBsLWV.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\CgQLzed.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\ZvOPBzF.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\DoExxnI.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\gSnBqcE.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\QvJTotm.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\CZhzNFS.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\DniOIBC.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\tNgHAPg.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\jhdcxRD.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\qmOWNvi.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\pOEogOa.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\nMGwcVE.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\WyNOvzk.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\SRhtDpA.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\uzKWDEn.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\ePJMNSV.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\aSrYjoT.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
File created	C:\Windows\System\eGKdKqN.exe	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4836	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	84
PID 5064 wrote to memory of 4836	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	84
PID 5064 wrote to memory of 2848	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	85
PID 5064 wrote to memory of 2848	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	85
PID 5064 wrote to memory of 4848	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	86
PID 5064 wrote to memory of 4848	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	86
PID 5064 wrote to memory of 1484	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	87
PID 5064 wrote to memory of 1484	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	87
PID 5064 wrote to memory of 3160	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	88
PID 5064 wrote to memory of 3160	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	88
PID 5064 wrote to memory of 4480	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	89
PID 5064 wrote to memory of 4480	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	89
PID 5064 wrote to memory of 3600	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	90
PID 5064 wrote to memory of 3600	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	90
PID 5064 wrote to memory of 1632	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	91
PID 5064 wrote to memory of 1632	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	91
PID 5064 wrote to memory of 2468	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	92
PID 5064 wrote to memory of 2468	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	92
PID 5064 wrote to memory of 4440	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	93
PID 5064 wrote to memory of 4440	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	93
PID 5064 wrote to memory of 872	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	94
PID 5064 wrote to memory of 872	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	94
PID 5064 wrote to memory of 2276	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	95
PID 5064 wrote to memory of 2276	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	95
PID 5064 wrote to memory of 540	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	96
PID 5064 wrote to memory of 540	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	96
PID 5064 wrote to memory of 2968	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	97
PID 5064 wrote to memory of 2968	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	97
PID 5064 wrote to memory of 4908	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	98
PID 5064 wrote to memory of 4908	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	98
PID 5064 wrote to memory of 2156	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	99
PID 5064 wrote to memory of 2156	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	99
PID 5064 wrote to memory of 2404	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	100
PID 5064 wrote to memory of 2404	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	100
PID 5064 wrote to memory of 4400	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	101
PID 5064 wrote to memory of 4400	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	101
PID 5064 wrote to memory of 3832	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	102
PID 5064 wrote to memory of 3832	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	102
PID 5064 wrote to memory of 2980	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	103
PID 5064 wrote to memory of 2980	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	103
PID 5064 wrote to memory of 3988	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	104
PID 5064 wrote to memory of 3988	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	104
PID 5064 wrote to memory of 1636	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	105
PID 5064 wrote to memory of 1636	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	105
PID 5064 wrote to memory of 1692	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	106
PID 5064 wrote to memory of 1692	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	106
PID 5064 wrote to memory of 1272	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	107
PID 5064 wrote to memory of 1272	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	107
PID 5064 wrote to memory of 980	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	108
PID 5064 wrote to memory of 980	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	108
PID 5064 wrote to memory of 2084	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	109
PID 5064 wrote to memory of 2084	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	109
PID 5064 wrote to memory of 4308	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	110
PID 5064 wrote to memory of 4308	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	110
PID 5064 wrote to memory of 4652	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	111
PID 5064 wrote to memory of 4652	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	111
PID 5064 wrote to memory of 1796	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	112
PID 5064 wrote to memory of 1796	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	112
PID 5064 wrote to memory of 2680	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	113
PID 5064 wrote to memory of 2680	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	113
PID 5064 wrote to memory of 2204	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	114
PID 5064 wrote to memory of 2204	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	114
PID 5064 wrote to memory of 684	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	115
PID 5064 wrote to memory of 684	5064	0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe	115

C:\Users\Admin\AppData\Local\Temp\0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe
"C:\Users\Admin\AppData\Local\Temp\0b41f626eee9a500a51aa73ad16b9d1d7a6cf8e774b47d8d77eee1a5a2b35139.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\System\RtemheK.exe
  C:\Windows\System\RtemheK.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\DQxhQHN.exe
  C:\Windows\System\DQxhQHN.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\nSTwgOj.exe
  C:\Windows\System\nSTwgOj.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\ddZkjwm.exe
  C:\Windows\System\ddZkjwm.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\IaDXCWl.exe
  C:\Windows\System\IaDXCWl.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\uwOAmRK.exe
  C:\Windows\System\uwOAmRK.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\qaErAUZ.exe
  C:\Windows\System\qaErAUZ.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\bjrxBzf.exe
  C:\Windows\System\bjrxBzf.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\TVofqAO.exe
  C:\Windows\System\TVofqAO.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\mwEhKju.exe
  C:\Windows\System\mwEhKju.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\yRtYxpc.exe
  C:\Windows\System\yRtYxpc.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\vDyeMLW.exe
  C:\Windows\System\vDyeMLW.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\MREcvTo.exe
  C:\Windows\System\MREcvTo.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\WZURcRK.exe
  C:\Windows\System\WZURcRK.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\fXDgjKY.exe
  C:\Windows\System\fXDgjKY.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\PRDwDBj.exe
  C:\Windows\System\PRDwDBj.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\TglROag.exe
  C:\Windows\System\TglROag.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\NqlbNod.exe
  C:\Windows\System\NqlbNod.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\lCpeXBu.exe
  C:\Windows\System\lCpeXBu.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\TkEpZal.exe
  C:\Windows\System\TkEpZal.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\IsHbRdY.exe
  C:\Windows\System\IsHbRdY.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\kldtnHt.exe
  C:\Windows\System\kldtnHt.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\alFoiMG.exe
  C:\Windows\System\alFoiMG.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\ipQNbeD.exe
  C:\Windows\System\ipQNbeD.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\gSnBqcE.exe
  C:\Windows\System\gSnBqcE.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\bOHCDUJ.exe
  C:\Windows\System\bOHCDUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\DUdBcug.exe
  C:\Windows\System\DUdBcug.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\jhdcxRD.exe
  C:\Windows\System\jhdcxRD.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\gYutRqv.exe
  C:\Windows\System\gYutRqv.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\WpYKLtl.exe
  C:\Windows\System\WpYKLtl.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\vwBxdad.exe
  C:\Windows\System\vwBxdad.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\jWGCBuv.exe
  C:\Windows\System\jWGCBuv.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\knMwVim.exe
  C:\Windows\System\knMwVim.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\gNfTjjt.exe
  C:\Windows\System\gNfTjjt.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\WImObXW.exe
  C:\Windows\System\WImObXW.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\LvNxfzO.exe
  C:\Windows\System\LvNxfzO.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\YmAPQnk.exe
  C:\Windows\System\YmAPQnk.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\gZPmwsa.exe
  C:\Windows\System\gZPmwsa.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\xMdKmXe.exe
  C:\Windows\System\xMdKmXe.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\kytGYSR.exe
  C:\Windows\System\kytGYSR.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\VCFNVZE.exe
  C:\Windows\System\VCFNVZE.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\maXCmgn.exe
  C:\Windows\System\maXCmgn.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\isqXcDF.exe
  C:\Windows\System\isqXcDF.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\CDOtwLh.exe
  C:\Windows\System\CDOtwLh.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\fhtWfpc.exe
  C:\Windows\System\fhtWfpc.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\hBDVoJm.exe
  C:\Windows\System\hBDVoJm.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\mmqKdAV.exe
  C:\Windows\System\mmqKdAV.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\eyFjUOY.exe
  C:\Windows\System\eyFjUOY.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\FxnjWxk.exe
  C:\Windows\System\FxnjWxk.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\tPpTgWj.exe
  C:\Windows\System\tPpTgWj.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\bcYgzjB.exe
  C:\Windows\System\bcYgzjB.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\LdRzwSF.exe
  C:\Windows\System\LdRzwSF.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\OwjDKGd.exe
  C:\Windows\System\OwjDKGd.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\bIZLAED.exe
  C:\Windows\System\bIZLAED.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\rUOeXpn.exe
  C:\Windows\System\rUOeXpn.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\jeiAfcX.exe
  C:\Windows\System\jeiAfcX.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\aSrYjoT.exe
  C:\Windows\System\aSrYjoT.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\UIvCyYW.exe
  C:\Windows\System\UIvCyYW.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\NDLLGkt.exe
  C:\Windows\System\NDLLGkt.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\WEIQolD.exe
  C:\Windows\System\WEIQolD.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\iwnSeDt.exe
  C:\Windows\System\iwnSeDt.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\irIovjh.exe
  C:\Windows\System\irIovjh.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\kxDIWfd.exe
  C:\Windows\System\kxDIWfd.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\QoOtRbd.exe
  C:\Windows\System\QoOtRbd.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\lguIBdG.exe
  C:\Windows\System\lguIBdG.exe
  2⤵
  PID:2100
- C:\Windows\System\ohAqUhq.exe
  C:\Windows\System\ohAqUhq.exe
  2⤵
  PID:624
- C:\Windows\System\YOLxkvW.exe
  C:\Windows\System\YOLxkvW.exe
  2⤵
  PID:740
- C:\Windows\System\FiqLxKC.exe
  C:\Windows\System\FiqLxKC.exe
  2⤵
  PID:1224
- C:\Windows\System\JUbwqFN.exe
  C:\Windows\System\JUbwqFN.exe
  2⤵
  PID:3440
- C:\Windows\System\CTABtUJ.exe
  C:\Windows\System\CTABtUJ.exe
  2⤵
  PID:720
- C:\Windows\System\EPFbJci.exe
  C:\Windows\System\EPFbJci.exe
  2⤵
  PID:436
- C:\Windows\System\DalKkvL.exe
  C:\Windows\System\DalKkvL.exe
  2⤵
  PID:4084
- C:\Windows\System\QvJTotm.exe
  C:\Windows\System\QvJTotm.exe
  2⤵
  PID:2808
- C:\Windows\System\FQXfJIP.exe
  C:\Windows\System\FQXfJIP.exe
  2⤵
  PID:2268
- C:\Windows\System\YNZroHj.exe
  C:\Windows\System\YNZroHj.exe
  2⤵
  PID:2948
- C:\Windows\System\fMLlDep.exe
  C:\Windows\System\fMLlDep.exe
  2⤵
  PID:4156
- C:\Windows\System\themMNa.exe
  C:\Windows\System\themMNa.exe
  2⤵
  PID:5100
- C:\Windows\System\lOJoFqf.exe
  C:\Windows\System\lOJoFqf.exe
  2⤵
  PID:2012
- C:\Windows\System\zVzYvXP.exe
  C:\Windows\System\zVzYvXP.exe
  2⤵
  PID:4488
- C:\Windows\System\GzPlrEo.exe
  C:\Windows\System\GzPlrEo.exe
  2⤵
  PID:3184
- C:\Windows\System\ZWHVeRI.exe
  C:\Windows\System\ZWHVeRI.exe
  2⤵
  PID:2004
- C:\Windows\System\CgQLzed.exe
  C:\Windows\System\CgQLzed.exe
  2⤵
  PID:3748
- C:\Windows\System\fAkhgZv.exe
  C:\Windows\System\fAkhgZv.exe
  2⤵
  PID:4784
- C:\Windows\System\bPMgdbv.exe
  C:\Windows\System\bPMgdbv.exe
  2⤵
  PID:4248
- C:\Windows\System\jobqeoW.exe
  C:\Windows\System\jobqeoW.exe
  2⤵
  PID:3200
- C:\Windows\System\BMIFKyv.exe
  C:\Windows\System\BMIFKyv.exe
  2⤵
  PID:1684
- C:\Windows\System\KnVHcZE.exe
  C:\Windows\System\KnVHcZE.exe
  2⤵
  PID:2900
- C:\Windows\System\KzbBEGy.exe
  C:\Windows\System\KzbBEGy.exe
  2⤵
  PID:3944
- C:\Windows\System\fvnUlql.exe
  C:\Windows\System\fvnUlql.exe
  2⤵
  PID:4320
- C:\Windows\System\LEGDlLl.exe
  C:\Windows\System\LEGDlLl.exe
  2⤵
  PID:3544
- C:\Windows\System\iFGwmSC.exe
  C:\Windows\System\iFGwmSC.exe
  2⤵
  PID:116
- C:\Windows\System\eGxqmcz.exe
  C:\Windows\System\eGxqmcz.exe
  2⤵
  PID:2016
- C:\Windows\System\VxxHVRE.exe
  C:\Windows\System\VxxHVRE.exe
  2⤵
  PID:3696
- C:\Windows\System\XqsEQnY.exe
  C:\Windows\System\XqsEQnY.exe
  2⤵
  PID:812
- C:\Windows\System\JxGkebh.exe
  C:\Windows\System\JxGkebh.exe
  2⤵
  PID:3376
- C:\Windows\System\IyxamzJ.exe
  C:\Windows\System\IyxamzJ.exe
  2⤵
  PID:3064
- C:\Windows\System\dLOxvvA.exe
  C:\Windows\System\dLOxvvA.exe
  2⤵
  PID:736
- C:\Windows\System\rVEAmMO.exe
  C:\Windows\System\rVEAmMO.exe
  2⤵
  PID:4112
- C:\Windows\System\xiJPCzl.exe
  C:\Windows\System\xiJPCzl.exe
  2⤵
  PID:4224
- C:\Windows\System\gwcPzMs.exe
  C:\Windows\System\gwcPzMs.exe
  2⤵
  PID:2440
- C:\Windows\System\MrdXNiz.exe
  C:\Windows\System\MrdXNiz.exe
  2⤵
  PID:1244
- C:\Windows\System\MFKeOgf.exe
  C:\Windows\System\MFKeOgf.exe
  2⤵
  PID:1412
- C:\Windows\System\uwlLDLw.exe
  C:\Windows\System\uwlLDLw.exe
  2⤵
  PID:4880
- C:\Windows\System\eXXjLRx.exe
  C:\Windows\System\eXXjLRx.exe
  2⤵
  PID:3924
- C:\Windows\System\EaaaXKs.exe
  C:\Windows\System\EaaaXKs.exe
  2⤵
  PID:2640
- C:\Windows\System\NiTWeOd.exe
  C:\Windows\System\NiTWeOd.exe
  2⤵
  PID:4120
- C:\Windows\System\gkiwkWV.exe
  C:\Windows\System\gkiwkWV.exe
  2⤵
  PID:1584
- C:\Windows\System\pnfZkmo.exe
  C:\Windows\System\pnfZkmo.exe
  2⤵
  PID:5060
- C:\Windows\System\FsPFPVt.exe
  C:\Windows\System\FsPFPVt.exe
  2⤵
  PID:2784
- C:\Windows\System\vFMhZew.exe
  C:\Windows\System\vFMhZew.exe
  2⤵
  PID:5016
- C:\Windows\System\TNzhHHH.exe
  C:\Windows\System\TNzhHHH.exe
  2⤵
  PID:1312
- C:\Windows\System\NXSbAie.exe
  C:\Windows\System\NXSbAie.exe
  2⤵
  PID:3272
- C:\Windows\System\zQuPEGK.exe
  C:\Windows\System\zQuPEGK.exe
  2⤵
  PID:5140
- C:\Windows\System\EmfQuIq.exe
  C:\Windows\System\EmfQuIq.exe
  2⤵
  PID:5168
- C:\Windows\System\YMRmndl.exe
  C:\Windows\System\YMRmndl.exe
  2⤵
  PID:5204
- C:\Windows\System\IsDOPgK.exe
  C:\Windows\System\IsDOPgK.exe
  2⤵
  PID:5236
- C:\Windows\System\BMXptRd.exe
  C:\Windows\System\BMXptRd.exe
  2⤵
  PID:5264
- C:\Windows\System\dsKKCxd.exe
  C:\Windows\System\dsKKCxd.exe
  2⤵
  PID:5292
- C:\Windows\System\CZhzNFS.exe
  C:\Windows\System\CZhzNFS.exe
  2⤵
  PID:5320
- C:\Windows\System\gzzBcTC.exe
  C:\Windows\System\gzzBcTC.exe
  2⤵
  PID:5348
- C:\Windows\System\kGPZJjk.exe
  C:\Windows\System\kGPZJjk.exe
  2⤵
  PID:5372
- C:\Windows\System\EFUCVzg.exe
  C:\Windows\System\EFUCVzg.exe
  2⤵
  PID:5404
- C:\Windows\System\wEBJNEB.exe
  C:\Windows\System\wEBJNEB.exe
  2⤵
  PID:5428
- C:\Windows\System\QcbTsUP.exe
  C:\Windows\System\QcbTsUP.exe
  2⤵
  PID:5456
- C:\Windows\System\lPNINAK.exe
  C:\Windows\System\lPNINAK.exe
  2⤵
  PID:5480
- C:\Windows\System\LTQAYwk.exe
  C:\Windows\System\LTQAYwk.exe
  2⤵
  PID:5512
- C:\Windows\System\DPSuJZf.exe
  C:\Windows\System\DPSuJZf.exe
  2⤵
  PID:5540
- C:\Windows\System\qzGTHOl.exe
  C:\Windows\System\qzGTHOl.exe
  2⤵
  PID:5564
- C:\Windows\System\TEGoBIC.exe
  C:\Windows\System\TEGoBIC.exe
  2⤵
  PID:5596
- C:\Windows\System\VjsIWpf.exe
  C:\Windows\System\VjsIWpf.exe
  2⤵
  PID:5624
- C:\Windows\System\hOZPSCG.exe
  C:\Windows\System\hOZPSCG.exe
  2⤵
  PID:5652
- C:\Windows\System\zlKBwJW.exe
  C:\Windows\System\zlKBwJW.exe
  2⤵
  PID:5684
- C:\Windows\System\RltaEhp.exe
  C:\Windows\System\RltaEhp.exe
  2⤵
  PID:5712
- C:\Windows\System\DoExxnI.exe
  C:\Windows\System\DoExxnI.exe
  2⤵
  PID:5740
- C:\Windows\System\QCFxCUI.exe
  C:\Windows\System\QCFxCUI.exe
  2⤵
  PID:5768
- C:\Windows\System\qgdkZFO.exe
  C:\Windows\System\qgdkZFO.exe
  2⤵
  PID:5796
- C:\Windows\System\KJBBRnr.exe
  C:\Windows\System\KJBBRnr.exe
  2⤵
  PID:5824
- C:\Windows\System\xYvFeXG.exe
  C:\Windows\System\xYvFeXG.exe
  2⤵
  PID:5852
- C:\Windows\System\GhePlXl.exe
  C:\Windows\System\GhePlXl.exe
  2⤵
  PID:5880
- C:\Windows\System\SzDCDsx.exe
  C:\Windows\System\SzDCDsx.exe
  2⤵
  PID:5920
- C:\Windows\System\JpCxgZr.exe
  C:\Windows\System\JpCxgZr.exe
  2⤵
  PID:5936
- C:\Windows\System\OoJpZuG.exe
  C:\Windows\System\OoJpZuG.exe
  2⤵
  PID:5964
- C:\Windows\System\eguGwjs.exe
  C:\Windows\System\eguGwjs.exe
  2⤵
  PID:5992
- C:\Windows\System\tfMrhQH.exe
  C:\Windows\System\tfMrhQH.exe
  2⤵
  PID:6020
- C:\Windows\System\kWAESoe.exe
  C:\Windows\System\kWAESoe.exe
  2⤵
  PID:6048
- C:\Windows\System\zpgAICc.exe
  C:\Windows\System\zpgAICc.exe
  2⤵
  PID:6076
- C:\Windows\System\GREMLbD.exe
  C:\Windows\System\GREMLbD.exe
  2⤵
  PID:6096
- C:\Windows\System\AHAzVHe.exe
  C:\Windows\System\AHAzVHe.exe
  2⤵
  PID:6120
- C:\Windows\System\fccHCfX.exe
  C:\Windows\System\fccHCfX.exe
  2⤵
  PID:5132
- C:\Windows\System\QALjWMb.exe
  C:\Windows\System\QALjWMb.exe
  2⤵
  PID:5184
- C:\Windows\System\kyvJGRc.exe
  C:\Windows\System\kyvJGRc.exe
  2⤵
  PID:5256
- C:\Windows\System\yWbiEoL.exe
  C:\Windows\System\yWbiEoL.exe
  2⤵
  PID:5316
- C:\Windows\System\ESaOoZj.exe
  C:\Windows\System\ESaOoZj.exe
  2⤵
  PID:5364
- C:\Windows\System\rwMeefw.exe
  C:\Windows\System\rwMeefw.exe
  2⤵
  PID:5424
- C:\Windows\System\GisQfzv.exe
  C:\Windows\System\GisQfzv.exe
  2⤵
  PID:5464
- C:\Windows\System\XJErHQQ.exe
  C:\Windows\System\XJErHQQ.exe
  2⤵
  PID:5548
- C:\Windows\System\SRhtDpA.exe
  C:\Windows\System\SRhtDpA.exe
  2⤵
  PID:5604
- C:\Windows\System\GNDoGwD.exe
  C:\Windows\System\GNDoGwD.exe
  2⤵
  PID:5636
- C:\Windows\System\RQzdDnZ.exe
  C:\Windows\System\RQzdDnZ.exe
  2⤵
  PID:5696
- C:\Windows\System\qmOWNvi.exe
  C:\Windows\System\qmOWNvi.exe
  2⤵
  PID:5780
- C:\Windows\System\VUzFZQE.exe
  C:\Windows\System\VUzFZQE.exe
  2⤵
  PID:5844
- C:\Windows\System\bsLiPea.exe
  C:\Windows\System\bsLiPea.exe
  2⤵
  PID:5904
- C:\Windows\System\UoluAlk.exe
  C:\Windows\System\UoluAlk.exe
  2⤵
  PID:5952
- C:\Windows\System\PExInIr.exe
  C:\Windows\System\PExInIr.exe
  2⤵
  PID:6040
- C:\Windows\System\ZkPjATI.exe
  C:\Windows\System\ZkPjATI.exe
  2⤵
  PID:6104
- C:\Windows\System\vjYmXpR.exe
  C:\Windows\System\vjYmXpR.exe
  2⤵
  PID:5152
- C:\Windows\System\ZdpbsWb.exe
  C:\Windows\System\ZdpbsWb.exe
  2⤵
  PID:5280
- C:\Windows\System\InNmjqD.exe
  C:\Windows\System\InNmjqD.exe
  2⤵
  PID:5288
- C:\Windows\System\SUOOQvR.exe
  C:\Windows\System\SUOOQvR.exe
  2⤵
  PID:5532
- C:\Windows\System\gyXnARy.exe
  C:\Windows\System\gyXnARy.exe
  2⤵
  PID:5572
- C:\Windows\System\moHiGmd.exe
  C:\Windows\System\moHiGmd.exe
  2⤵
  PID:5808
- C:\Windows\System\qcGEUdo.exe
  C:\Windows\System\qcGEUdo.exe
  2⤵
  PID:5820
- C:\Windows\System\ISxMmwa.exe
  C:\Windows\System\ISxMmwa.exe
  2⤵
  PID:6140
- C:\Windows\System\neoDhqv.exe
  C:\Windows\System\neoDhqv.exe
  2⤵
  PID:6132
- C:\Windows\System\LFjDOcl.exe
  C:\Windows\System\LFjDOcl.exe
  2⤵
  PID:5980
- C:\Windows\System\UUHfjqz.exe
  C:\Windows\System\UUHfjqz.exe
  2⤵
  PID:6060
- C:\Windows\System\MEltySG.exe
  C:\Windows\System\MEltySG.exe
  2⤵
  PID:5752
- C:\Windows\System\MxKtJTh.exe
  C:\Windows\System\MxKtJTh.exe
  2⤵
  PID:6152
- C:\Windows\System\lTjStmc.exe
  C:\Windows\System\lTjStmc.exe
  2⤵
  PID:6176
- C:\Windows\System\XRkXpWr.exe
  C:\Windows\System\XRkXpWr.exe
  2⤵
  PID:6200
- C:\Windows\System\hsIcRqs.exe
  C:\Windows\System\hsIcRqs.exe
  2⤵
  PID:6228
- C:\Windows\System\llOIztj.exe
  C:\Windows\System\llOIztj.exe
  2⤵
  PID:6256
- C:\Windows\System\srfSzhS.exe
  C:\Windows\System\srfSzhS.exe
  2⤵
  PID:6284
- C:\Windows\System\uzKWDEn.exe
  C:\Windows\System\uzKWDEn.exe
  2⤵
  PID:6312
- C:\Windows\System\YQZEskP.exe
  C:\Windows\System\YQZEskP.exe
  2⤵
  PID:6332
- C:\Windows\System\Mmpvbcx.exe
  C:\Windows\System\Mmpvbcx.exe
  2⤵
  PID:6360
- C:\Windows\System\nwoLbas.exe
  C:\Windows\System\nwoLbas.exe
  2⤵
  PID:6384
- C:\Windows\System\suqyBgB.exe
  C:\Windows\System\suqyBgB.exe
  2⤵
  PID:6408
- C:\Windows\System\UMPKuzR.exe
  C:\Windows\System\UMPKuzR.exe
  2⤵
  PID:6436
- C:\Windows\System\ixmuOdR.exe
  C:\Windows\System\ixmuOdR.exe
  2⤵
  PID:6468
- C:\Windows\System\AHIakfa.exe
  C:\Windows\System\AHIakfa.exe
  2⤵
  PID:6492
- C:\Windows\System\AnPWcWc.exe
  C:\Windows\System\AnPWcWc.exe
  2⤵
  PID:6520
- C:\Windows\System\XGULtqF.exe
  C:\Windows\System\XGULtqF.exe
  2⤵
  PID:6552
- C:\Windows\System\bfFDqOW.exe
  C:\Windows\System\bfFDqOW.exe
  2⤵
  PID:6576
- C:\Windows\System\qlMWPfs.exe
  C:\Windows\System\qlMWPfs.exe
  2⤵
  PID:6600
- C:\Windows\System\kdpJyjc.exe
  C:\Windows\System\kdpJyjc.exe
  2⤵
  PID:6624
- C:\Windows\System\apvJErf.exe
  C:\Windows\System\apvJErf.exe
  2⤵
  PID:6652
- C:\Windows\System\XPIAtNF.exe
  C:\Windows\System\XPIAtNF.exe
  2⤵
  PID:6676
- C:\Windows\System\WuUuwrM.exe
  C:\Windows\System\WuUuwrM.exe
  2⤵
  PID:6708
- C:\Windows\System\mHyzRcg.exe
  C:\Windows\System\mHyzRcg.exe
  2⤵
  PID:6736
- C:\Windows\System\nukGbjx.exe
  C:\Windows\System\nukGbjx.exe
  2⤵
  PID:6768
- C:\Windows\System\wfIkRnp.exe
  C:\Windows\System\wfIkRnp.exe
  2⤵
  PID:6792
- C:\Windows\System\EtczgEi.exe
  C:\Windows\System\EtczgEi.exe
  2⤵
  PID:6816
- C:\Windows\System\ybiKGbS.exe
  C:\Windows\System\ybiKGbS.exe
  2⤵
  PID:6848
- C:\Windows\System\aprpBKf.exe
  C:\Windows\System\aprpBKf.exe
  2⤵
  PID:6880
- C:\Windows\System\RYgcySd.exe
  C:\Windows\System\RYgcySd.exe
  2⤵
  PID:6912
- C:\Windows\System\qhjrtXp.exe
  C:\Windows\System\qhjrtXp.exe
  2⤵
  PID:6936
- C:\Windows\System\Ugvihdi.exe
  C:\Windows\System\Ugvihdi.exe
  2⤵
  PID:6964
- C:\Windows\System\uHRpaCA.exe
  C:\Windows\System\uHRpaCA.exe
  2⤵
  PID:6992
- C:\Windows\System\tKFCmYu.exe
  C:\Windows\System\tKFCmYu.exe
  2⤵
  PID:7020
- C:\Windows\System\pOEogOa.exe
  C:\Windows\System\pOEogOa.exe
  2⤵
  PID:7048
- C:\Windows\System\ksrkCTh.exe
  C:\Windows\System\ksrkCTh.exe
  2⤵
  PID:7076
- C:\Windows\System\rkFkMZc.exe
  C:\Windows\System\rkFkMZc.exe
  2⤵
  PID:7092
- C:\Windows\System\hGMhKHE.exe
  C:\Windows\System\hGMhKHE.exe
  2⤵
  PID:7116
- C:\Windows\System\VfhesZh.exe
  C:\Windows\System\VfhesZh.exe
  2⤵
  PID:7144
- C:\Windows\System\RgMcOkc.exe
  C:\Windows\System\RgMcOkc.exe
  2⤵
  PID:6164
- C:\Windows\System\PLwCvmO.exe
  C:\Windows\System\PLwCvmO.exe
  2⤵
  PID:5336
- C:\Windows\System\YZmBEUC.exe
  C:\Windows\System\YZmBEUC.exe
  2⤵
  PID:6244
- C:\Windows\System\FHXdZho.exe
  C:\Windows\System\FHXdZho.exe
  2⤵
  PID:6348
- C:\Windows\System\iqOPfTm.exe
  C:\Windows\System\iqOPfTm.exe
  2⤵
  PID:6356
- C:\Windows\System\vZbUgDL.exe
  C:\Windows\System\vZbUgDL.exe
  2⤵
  PID:6476
- C:\Windows\System\QpJsPxQ.exe
  C:\Windows\System\QpJsPxQ.exe
  2⤵
  PID:6500
- C:\Windows\System\XoeVAvP.exe
  C:\Windows\System\XoeVAvP.exe
  2⤵
  PID:6536
- C:\Windows\System\MRrenwv.exe
  C:\Windows\System\MRrenwv.exe
  2⤵
  PID:6620
- C:\Windows\System\mzPDzvd.exe
  C:\Windows\System\mzPDzvd.exe
  2⤵
  PID:6648
- C:\Windows\System\eGKdKqN.exe
  C:\Windows\System\eGKdKqN.exe
  2⤵
  PID:6760
- C:\Windows\System\bZaJTYd.exe
  C:\Windows\System\bZaJTYd.exe
  2⤵
  PID:6720
- C:\Windows\System\NtqkYkr.exe
  C:\Windows\System\NtqkYkr.exe
  2⤵
  PID:6776
- C:\Windows\System\xcqIRiY.exe
  C:\Windows\System\xcqIRiY.exe
  2⤵
  PID:6976
- C:\Windows\System\bqhktlo.exe
  C:\Windows\System\bqhktlo.exe
  2⤵
  PID:6924
- C:\Windows\System\GAsyFFr.exe
  C:\Windows\System\GAsyFFr.exe
  2⤵
  PID:7072
- C:\Windows\System\ZzpxeHJ.exe
  C:\Windows\System\ZzpxeHJ.exe
  2⤵
  PID:7140
- C:\Windows\System\aTgUGUk.exe
  C:\Windows\System\aTgUGUk.exe
  2⤵
  PID:6196
- C:\Windows\System\ctEoQuq.exe
  C:\Windows\System\ctEoQuq.exe
  2⤵
  PID:7108
- C:\Windows\System\ZzStCIb.exe
  C:\Windows\System\ZzStCIb.exe
  2⤵
  PID:6664
- C:\Windows\System\OHZFDru.exe
  C:\Windows\System\OHZFDru.exe
  2⤵
  PID:6488
- C:\Windows\System\fAZQrAe.exe
  C:\Windows\System\fAZQrAe.exe
  2⤵
  PID:6528
- C:\Windows\System\RhvsKWg.exe
  C:\Windows\System\RhvsKWg.exe
  2⤵
  PID:6892
- C:\Windows\System\UuCHBiJ.exe
  C:\Windows\System\UuCHBiJ.exe
  2⤵
  PID:6960
- C:\Windows\System\nMGwcVE.exe
  C:\Windows\System\nMGwcVE.exe
  2⤵
  PID:7064
- C:\Windows\System\LjHxgin.exe
  C:\Windows\System\LjHxgin.exe
  2⤵
  PID:6484
- C:\Windows\System\zviDLXj.exe
  C:\Windows\System\zviDLXj.exe
  2⤵
  PID:7196
- C:\Windows\System\TiHOKcj.exe
  C:\Windows\System\TiHOKcj.exe
  2⤵
  PID:7220
- C:\Windows\System\YAxQMoF.exe
  C:\Windows\System\YAxQMoF.exe
  2⤵
  PID:7244
- C:\Windows\System\gvTfIUy.exe
  C:\Windows\System\gvTfIUy.exe
  2⤵
  PID:7272
- C:\Windows\System\gQRxVtX.exe
  C:\Windows\System\gQRxVtX.exe
  2⤵
  PID:7300
- C:\Windows\System\EqZMFJP.exe
  C:\Windows\System\EqZMFJP.exe
  2⤵
  PID:7324
- C:\Windows\System\AHmQkDP.exe
  C:\Windows\System\AHmQkDP.exe
  2⤵
  PID:7352
- C:\Windows\System\aUKSHiD.exe
  C:\Windows\System\aUKSHiD.exe
  2⤵
  PID:7380
- C:\Windows\System\FuQQizN.exe
  C:\Windows\System\FuQQizN.exe
  2⤵
  PID:7408
- C:\Windows\System\nFzCSVK.exe
  C:\Windows\System\nFzCSVK.exe
  2⤵
  PID:7432
- C:\Windows\System\etrKqqc.exe
  C:\Windows\System\etrKqqc.exe
  2⤵
  PID:7464
- C:\Windows\System\rejRNcQ.exe
  C:\Windows\System\rejRNcQ.exe
  2⤵
  PID:7492
- C:\Windows\System\mccSLKS.exe
  C:\Windows\System\mccSLKS.exe
  2⤵
  PID:7520
- C:\Windows\System\zAdinpm.exe
  C:\Windows\System\zAdinpm.exe
  2⤵
  PID:7548
- C:\Windows\System\WCCJiwW.exe
  C:\Windows\System\WCCJiwW.exe
  2⤵
  PID:7580
- C:\Windows\System\lOOolMs.exe
  C:\Windows\System\lOOolMs.exe
  2⤵
  PID:7604
- C:\Windows\System\VYLCMBR.exe
  C:\Windows\System\VYLCMBR.exe
  2⤵
  PID:7628
- C:\Windows\System\zMDtypd.exe
  C:\Windows\System\zMDtypd.exe
  2⤵
  PID:7656
- C:\Windows\System\uvzoVoy.exe
  C:\Windows\System\uvzoVoy.exe
  2⤵
  PID:7680
- C:\Windows\System\javknnJ.exe
  C:\Windows\System\javknnJ.exe
  2⤵
  PID:7704
- C:\Windows\System\hfjtpHr.exe
  C:\Windows\System\hfjtpHr.exe
  2⤵
  PID:7724
- C:\Windows\System\GEDWphk.exe
  C:\Windows\System\GEDWphk.exe
  2⤵
  PID:7756
- C:\Windows\System\uUgWStV.exe
  C:\Windows\System\uUgWStV.exe
  2⤵
  PID:7784
- C:\Windows\System\eYmRhAI.exe
  C:\Windows\System\eYmRhAI.exe
  2⤵
  PID:7808
- C:\Windows\System\vDuDGZv.exe
  C:\Windows\System\vDuDGZv.exe
  2⤵
  PID:7836
- C:\Windows\System\rUrYNbG.exe
  C:\Windows\System\rUrYNbG.exe
  2⤵
  PID:7864
- C:\Windows\System\pJwZWcI.exe
  C:\Windows\System\pJwZWcI.exe
  2⤵
  PID:7892
- C:\Windows\System\rZhdRlH.exe
  C:\Windows\System\rZhdRlH.exe
  2⤵
  PID:7924
- C:\Windows\System\aSLXqiG.exe
  C:\Windows\System\aSLXqiG.exe
  2⤵
  PID:7948
- C:\Windows\System\BAgDGyH.exe
  C:\Windows\System\BAgDGyH.exe
  2⤵
  PID:7976
- C:\Windows\System\DkapTJE.exe
  C:\Windows\System\DkapTJE.exe
  2⤵
  PID:7992
- C:\Windows\System\eSgBvnn.exe
  C:\Windows\System\eSgBvnn.exe
  2⤵
  PID:8016
- C:\Windows\System\vWnAvor.exe
  C:\Windows\System\vWnAvor.exe
  2⤵
  PID:8044
- C:\Windows\System\ZPPgbbg.exe
  C:\Windows\System\ZPPgbbg.exe
  2⤵
  PID:8076
- C:\Windows\System\KzRTjqa.exe
  C:\Windows\System\KzRTjqa.exe
  2⤵
  PID:8104
- C:\Windows\System\WPEdbMv.exe
  C:\Windows\System\WPEdbMv.exe
  2⤵
  PID:8132
- C:\Windows\System\RupViYu.exe
  C:\Windows\System\RupViYu.exe
  2⤵
  PID:8156
- C:\Windows\System\ctCFCxe.exe
  C:\Windows\System\ctCFCxe.exe
  2⤵
  PID:8180
- C:\Windows\System\leiryZw.exe
  C:\Windows\System\leiryZw.exe
  2⤵
  PID:6448
- C:\Windows\System\lexiyMa.exe
  C:\Windows\System\lexiyMa.exe
  2⤵
  PID:6116
- C:\Windows\System\oFhsVEk.exe
  C:\Windows\System\oFhsVEk.exe
  2⤵
  PID:6568
- C:\Windows\System\ovsGGWU.exe
  C:\Windows\System\ovsGGWU.exe
  2⤵
  PID:6692
- C:\Windows\System\TUDhMCK.exe
  C:\Windows\System\TUDhMCK.exe
  2⤵
  PID:7388
- C:\Windows\System\sIVDWut.exe
  C:\Windows\System\sIVDWut.exe
  2⤵
  PID:7420
- C:\Windows\System\kIOWZZe.exe
  C:\Windows\System\kIOWZZe.exe
  2⤵
  PID:7452
- C:\Windows\System\riVQpGh.exe
  C:\Windows\System\riVQpGh.exe
  2⤵
  PID:7504
- C:\Windows\System\nUioqOO.exe
  C:\Windows\System\nUioqOO.exe
  2⤵
  PID:7336
- C:\Windows\System\lDybeLK.exe
  C:\Windows\System\lDybeLK.exe
  2⤵
  PID:7592
- C:\Windows\System\yUzFAML.exe
  C:\Windows\System\yUzFAML.exe
  2⤵
  PID:7648
- C:\Windows\System\WuwkZae.exe
  C:\Windows\System\WuwkZae.exe
  2⤵
  PID:7572
- C:\Windows\System\cjBCBLp.exe
  C:\Windows\System\cjBCBLp.exe
  2⤵
  PID:7800
- C:\Windows\System\WpaeReD.exe
  C:\Windows\System\WpaeReD.exe
  2⤵
  PID:7692
- C:\Windows\System\SXVwXpw.exe
  C:\Windows\System\SXVwXpw.exe
  2⤵
  PID:7740
- C:\Windows\System\eppfSgo.exe
  C:\Windows\System\eppfSgo.exe
  2⤵
  PID:7968
- C:\Windows\System\LHxEOvC.exe
  C:\Windows\System\LHxEOvC.exe
  2⤵
  PID:8060
- C:\Windows\System\gEydkgo.exe
  C:\Windows\System\gEydkgo.exe
  2⤵
  PID:7904
- C:\Windows\System\zEryHNi.exe
  C:\Windows\System\zEryHNi.exe
  2⤵
  PID:8124
- C:\Windows\System\PSmBQIR.exe
  C:\Windows\System\PSmBQIR.exe
  2⤵
  PID:6636
- C:\Windows\System\DorRzMI.exe
  C:\Windows\System\DorRzMI.exe
  2⤵
  PID:7940
- C:\Windows\System\eFFsSCJ.exe
  C:\Windows\System\eFFsSCJ.exe
  2⤵
  PID:6956
- C:\Windows\System\lWZIHxd.exe
  C:\Windows\System\lWZIHxd.exe
  2⤵
  PID:6744
- C:\Windows\System\oytTUja.exe
  C:\Windows\System\oytTUja.exe
  2⤵
  PID:6508
- C:\Windows\System\joyBzlr.exe
  C:\Windows\System\joyBzlr.exe
  2⤵
  PID:8140
- C:\Windows\System\cLYdKGV.exe
  C:\Windows\System\cLYdKGV.exe
  2⤵
  PID:7368
- C:\Windows\System\ruDevBU.exe
  C:\Windows\System\ruDevBU.exe
  2⤵
  PID:7772
- C:\Windows\System\YlrncHA.exe
  C:\Windows\System\YlrncHA.exe
  2⤵
  PID:8096
- C:\Windows\System\LMgbqhx.exe
  C:\Windows\System\LMgbqhx.exe
  2⤵
  PID:8172
- C:\Windows\System\IKuLBYL.exe
  C:\Windows\System\IKuLBYL.exe
  2⤵
  PID:8216
- C:\Windows\System\UQPonxH.exe
  C:\Windows\System\UQPonxH.exe
  2⤵
  PID:8248
- C:\Windows\System\lctZfZK.exe
  C:\Windows\System\lctZfZK.exe
  2⤵
  PID:8272
- C:\Windows\System\CDqrrzf.exe
  C:\Windows\System\CDqrrzf.exe
  2⤵
  PID:8292
- C:\Windows\System\nBLGOHU.exe
  C:\Windows\System\nBLGOHU.exe
  2⤵
  PID:8324
- C:\Windows\System\ZSQaMTw.exe
  C:\Windows\System\ZSQaMTw.exe
  2⤵
  PID:8348
- C:\Windows\System\CQYRcaw.exe
  C:\Windows\System\CQYRcaw.exe
  2⤵
  PID:8368
- C:\Windows\System\OagWzBA.exe
  C:\Windows\System\OagWzBA.exe
  2⤵
  PID:8400
- C:\Windows\System\qnwRWKu.exe
  C:\Windows\System\qnwRWKu.exe
  2⤵
  PID:8440
- C:\Windows\System\pdEGFOV.exe
  C:\Windows\System\pdEGFOV.exe
  2⤵
  PID:8464
- C:\Windows\System\YXFbSen.exe
  C:\Windows\System\YXFbSen.exe
  2⤵
  PID:8492
- C:\Windows\System\RVpcrrz.exe
  C:\Windows\System\RVpcrrz.exe
  2⤵
  PID:8516
- C:\Windows\System\CPfsRhE.exe
  C:\Windows\System\CPfsRhE.exe
  2⤵
  PID:8544
- C:\Windows\System\CsmStmK.exe
  C:\Windows\System\CsmStmK.exe
  2⤵
  PID:8564
- C:\Windows\System\JKQxaNB.exe
  C:\Windows\System\JKQxaNB.exe
  2⤵
  PID:8588
- C:\Windows\System\vaRaIya.exe
  C:\Windows\System\vaRaIya.exe
  2⤵
  PID:8620
- C:\Windows\System\jBkUHga.exe
  C:\Windows\System\jBkUHga.exe
  2⤵
  PID:8644
- C:\Windows\System\sNlZNFC.exe
  C:\Windows\System\sNlZNFC.exe
  2⤵
  PID:8664
- C:\Windows\System\EgQAWYm.exe
  C:\Windows\System\EgQAWYm.exe
  2⤵
  PID:8692
- C:\Windows\System\mWriSrS.exe
  C:\Windows\System\mWriSrS.exe
  2⤵
  PID:8712
- C:\Windows\System\DQUzMMc.exe
  C:\Windows\System\DQUzMMc.exe
  2⤵
  PID:8740
- C:\Windows\System\TdtXadn.exe
  C:\Windows\System\TdtXadn.exe
  2⤵
  PID:8768
- C:\Windows\System\VfveUrl.exe
  C:\Windows\System\VfveUrl.exe
  2⤵
  PID:8792
- C:\Windows\System\KwuOmKT.exe
  C:\Windows\System\KwuOmKT.exe
  2⤵
  PID:8816
- C:\Windows\System\AIcaLyx.exe
  C:\Windows\System\AIcaLyx.exe
  2⤵
  PID:8836
- C:\Windows\System\iNoYDVc.exe
  C:\Windows\System\iNoYDVc.exe
  2⤵
  PID:8856
- C:\Windows\System\mMcWnZv.exe
  C:\Windows\System\mMcWnZv.exe
  2⤵
  PID:8876
- C:\Windows\System\yrvNrJx.exe
  C:\Windows\System\yrvNrJx.exe
  2⤵
  PID:8896
- C:\Windows\System\QDfIPxs.exe
  C:\Windows\System\QDfIPxs.exe
  2⤵
  PID:8916
- C:\Windows\System\YuHnepk.exe
  C:\Windows\System\YuHnepk.exe
  2⤵
  PID:8932
- C:\Windows\System\YIWJEph.exe
  C:\Windows\System\YIWJEph.exe
  2⤵
  PID:8952
- C:\Windows\System\TEyaHxE.exe
  C:\Windows\System\TEyaHxE.exe
  2⤵
  PID:8976
- C:\Windows\System\CSpvRcW.exe
  C:\Windows\System\CSpvRcW.exe
  2⤵
  PID:9000
- C:\Windows\System\STQjuGO.exe
  C:\Windows\System\STQjuGO.exe
  2⤵
  PID:9020
- C:\Windows\System\EtCINwZ.exe
  C:\Windows\System\EtCINwZ.exe
  2⤵
  PID:9044
- C:\Windows\System\BDOaZwf.exe
  C:\Windows\System\BDOaZwf.exe
  2⤵
  PID:9064
- C:\Windows\System\cCJLVFU.exe
  C:\Windows\System\cCJLVFU.exe
  2⤵
  PID:9088
- C:\Windows\System\hxJkgtd.exe
  C:\Windows\System\hxJkgtd.exe
  2⤵
  PID:9116
- C:\Windows\System\geZoZYD.exe
  C:\Windows\System\geZoZYD.exe
  2⤵
  PID:9140
- C:\Windows\System\ijXKJAu.exe
  C:\Windows\System\ijXKJAu.exe
  2⤵
  PID:9160
- C:\Windows\System\JPlTaLS.exe
  C:\Windows\System\JPlTaLS.exe
  2⤵
  PID:9184
- C:\Windows\System\ubDuHxV.exe
  C:\Windows\System\ubDuHxV.exe
  2⤵
  PID:9204
- C:\Windows\System\amDxSph.exe
  C:\Windows\System\amDxSph.exe
  2⤵
  PID:8068
- C:\Windows\System\hzSyYTZ.exe
  C:\Windows\System\hzSyYTZ.exe
  2⤵
  PID:7296
- C:\Windows\System\fNYjwCZ.exe
  C:\Windows\System\fNYjwCZ.exe
  2⤵
  PID:7852
- C:\Windows\System\aKBhPvs.exe
  C:\Windows\System\aKBhPvs.exe
  2⤵
  PID:8236
- C:\Windows\System\SafgFgu.exe
  C:\Windows\System\SafgFgu.exe
  2⤵
  PID:8260
- C:\Windows\System\urgPpOj.exe
  C:\Windows\System\urgPpOj.exe
  2⤵
  PID:7448
- C:\Windows\System\zUksuIS.exe
  C:\Windows\System\zUksuIS.exe
  2⤵
  PID:7204
- C:\Windows\System\vuNjRca.exe
  C:\Windows\System\vuNjRca.exe
  2⤵
  PID:8416
- C:\Windows\System\HguqUam.exe
  C:\Windows\System\HguqUam.exe
  2⤵
  PID:8120
- C:\Windows\System\FufRJER.exe
  C:\Windows\System\FufRJER.exe
  2⤵
  PID:8528
- C:\Windows\System\UHTczAk.exe
  C:\Windows\System\UHTczAk.exe
  2⤵
  PID:8572
- C:\Windows\System\fLzoThE.exe
  C:\Windows\System\fLzoThE.exe
  2⤵
  PID:8636
- C:\Windows\System\ehHlFdB.exe
  C:\Windows\System\ehHlFdB.exe
  2⤵
  PID:8704
- C:\Windows\System\DugHXdk.exe
  C:\Windows\System\DugHXdk.exe
  2⤵
  PID:8824
- C:\Windows\System\iyXGDJH.exe
  C:\Windows\System\iyXGDJH.exe
  2⤵
  PID:8908
- C:\Windows\System\swqiHoP.exe
  C:\Windows\System\swqiHoP.exe
  2⤵
  PID:8988
- C:\Windows\System\mveMDsI.exe
  C:\Windows\System\mveMDsI.exe
  2⤵
  PID:9084
- C:\Windows\System\WLAjBzi.exe
  C:\Windows\System\WLAjBzi.exe
  2⤵
  PID:8852
- C:\Windows\System\nkgrphw.exe
  C:\Windows\System\nkgrphw.exe
  2⤵
  PID:8928
- C:\Windows\System\brVFBZw.exe
  C:\Windows\System\brVFBZw.exe
  2⤵
  PID:9236
- C:\Windows\System\dDpAExR.exe
  C:\Windows\System\dDpAExR.exe
  2⤵
  PID:9260
- C:\Windows\System\xNjEBqd.exe
  C:\Windows\System\xNjEBqd.exe
  2⤵
  PID:9284
- C:\Windows\System\gprXsZQ.exe
  C:\Windows\System\gprXsZQ.exe
  2⤵
  PID:9312
- C:\Windows\System\eWcqRYV.exe
  C:\Windows\System\eWcqRYV.exe
  2⤵
  PID:9336
- C:\Windows\System\dnBJWsh.exe
  C:\Windows\System\dnBJWsh.exe
  2⤵
  PID:9356
- C:\Windows\System\MugTkIB.exe
  C:\Windows\System\MugTkIB.exe
  2⤵
  PID:9380
- C:\Windows\System\tQXNVcC.exe
  C:\Windows\System\tQXNVcC.exe
  2⤵
  PID:9408
- C:\Windows\System\WplIcVO.exe
  C:\Windows\System\WplIcVO.exe
  2⤵
  PID:9444
- C:\Windows\System\OwKiQxo.exe
  C:\Windows\System\OwKiQxo.exe
  2⤵
  PID:9472
- C:\Windows\System\YIscMnd.exe
  C:\Windows\System\YIscMnd.exe
  2⤵
  PID:9500
- C:\Windows\System\ZAaxeOX.exe
  C:\Windows\System\ZAaxeOX.exe
  2⤵
  PID:9524
- C:\Windows\System\CbEEXOM.exe
  C:\Windows\System\CbEEXOM.exe
  2⤵
  PID:9556
- C:\Windows\System\srxQBry.exe
  C:\Windows\System\srxQBry.exe
  2⤵
  PID:9580
- C:\Windows\System\DPhYSkQ.exe
  C:\Windows\System\DPhYSkQ.exe
  2⤵
  PID:9600
- C:\Windows\System\sKnbmaW.exe
  C:\Windows\System\sKnbmaW.exe
  2⤵
  PID:9616
- C:\Windows\System\koXKPsT.exe
  C:\Windows\System\koXKPsT.exe
  2⤵
  PID:9640
- C:\Windows\System\yZSuJbN.exe
  C:\Windows\System\yZSuJbN.exe
  2⤵
  PID:9660
- C:\Windows\System\ybJSiKP.exe
  C:\Windows\System\ybJSiKP.exe
  2⤵
  PID:9684
- C:\Windows\System\wBuNeXu.exe
  C:\Windows\System\wBuNeXu.exe
  2⤵
  PID:9708
- C:\Windows\System\CxqjJKC.exe
  C:\Windows\System\CxqjJKC.exe
  2⤵
  PID:9736
- C:\Windows\System\Ntklgmo.exe
  C:\Windows\System\Ntklgmo.exe
  2⤵
  PID:9756
- C:\Windows\System\CTQTIjd.exe
  C:\Windows\System\CTQTIjd.exe
  2⤵
  PID:9784
- C:\Windows\System\iZlcWYl.exe
  C:\Windows\System\iZlcWYl.exe
  2⤵
  PID:9812
- C:\Windows\System\nQVUfSn.exe
  C:\Windows\System\nQVUfSn.exe
  2⤵
  PID:9840
- C:\Windows\System\wZIAeJH.exe
  C:\Windows\System\wZIAeJH.exe
  2⤵
  PID:9860
- C:\Windows\System\YJqhvLP.exe
  C:\Windows\System\YJqhvLP.exe
  2⤵
  PID:9888
- C:\Windows\System\unNTLQb.exe
  C:\Windows\System\unNTLQb.exe
  2⤵
  PID:9916
- C:\Windows\System\PShToEX.exe
  C:\Windows\System\PShToEX.exe
  2⤵
  PID:9940
- C:\Windows\System\tePDxMr.exe
  C:\Windows\System\tePDxMr.exe
  2⤵
  PID:9960
- C:\Windows\System\iTBlVkl.exe
  C:\Windows\System\iTBlVkl.exe
  2⤵
  PID:9980
- C:\Windows\System\Ipolwye.exe
  C:\Windows\System\Ipolwye.exe
  2⤵
  PID:9996
- C:\Windows\System\eSArjPH.exe
  C:\Windows\System\eSArjPH.exe
  2⤵
  PID:10020
- C:\Windows\System\kkyjgll.exe
  C:\Windows\System\kkyjgll.exe
  2⤵
  PID:10040
- C:\Windows\System\RPCOEYA.exe
  C:\Windows\System\RPCOEYA.exe
  2⤵
  PID:10060
- C:\Windows\System\GsmWtKs.exe
  C:\Windows\System\GsmWtKs.exe
  2⤵
  PID:10080
- C:\Windows\System\hmzoqvW.exe
  C:\Windows\System\hmzoqvW.exe
  2⤵
  PID:10100
- C:\Windows\System\DbmIDzt.exe
  C:\Windows\System\DbmIDzt.exe
  2⤵
  PID:10128
- C:\Windows\System\ZcmxFcd.exe
  C:\Windows\System\ZcmxFcd.exe
  2⤵
  PID:10144
- C:\Windows\System\iINoElm.exe
  C:\Windows\System\iINoElm.exe
  2⤵
  PID:10172
- C:\Windows\System\JUrdxvI.exe
  C:\Windows\System\JUrdxvI.exe
  2⤵
  PID:10188
- C:\Windows\System\UdUGuTZ.exe
  C:\Windows\System\UdUGuTZ.exe
  2⤵
  PID:10216
- C:\Windows\System\clGRbKo.exe
  C:\Windows\System\clGRbKo.exe
  2⤵
  PID:7752
- C:\Windows\System\SOVoVWb.exe
  C:\Windows\System\SOVoVWb.exe
  2⤵
  PID:8408
- C:\Windows\System\SZKdZtp.exe
  C:\Windows\System\SZKdZtp.exe
  2⤵
  PID:8728
- C:\Windows\System\azowjfK.exe
  C:\Windows\System\azowjfK.exe
  2⤵
  PID:8344
- C:\Windows\System\DZXMAlP.exe
  C:\Windows\System\DZXMAlP.exe
  2⤵
  PID:8892
- C:\Windows\System\SFWxTht.exe
  C:\Windows\System\SFWxTht.exe
  2⤵
  PID:7832
- C:\Windows\System\CUkNkBQ.exe
  C:\Windows\System\CUkNkBQ.exe
  2⤵
  PID:8888
- C:\Windows\System\FGsZPpB.exe
  C:\Windows\System\FGsZPpB.exe
  2⤵
  PID:9252
- C:\Windows\System\CRCjmJy.exe
  C:\Windows\System\CRCjmJy.exe
  2⤵
  PID:9300
- C:\Windows\System\okenSEH.exe
  C:\Windows\System\okenSEH.exe
  2⤵
  PID:9376
- C:\Windows\System\aunxLvV.exe
  C:\Windows\System\aunxLvV.exe
  2⤵
  PID:8612
- C:\Windows\System\KsOVSXV.exe
  C:\Windows\System\KsOVSXV.exe
  2⤵
  PID:8056
- C:\Windows\System\glaZSPA.exe
  C:\Windows\System\glaZSPA.exe
  2⤵
  PID:7400
- C:\Windows\System\mnMipzK.exe
  C:\Windows\System\mnMipzK.exe
  2⤵
  PID:8676
- C:\Windows\System\XhkLWnV.exe
  C:\Windows\System\XhkLWnV.exe
  2⤵
  PID:9624
- C:\Windows\System\lThljkp.exe
  C:\Windows\System\lThljkp.exe
  2⤵
  PID:9220
- C:\Windows\System\laAwkWV.exe
  C:\Windows\System\laAwkWV.exe
  2⤵
  PID:9720
- C:\Windows\System\hiWbWvN.exe
  C:\Windows\System\hiWbWvN.exe
  2⤵
  PID:9344
- C:\Windows\System\csKrAPH.exe
  C:\Windows\System\csKrAPH.exe
  2⤵
  PID:8380
- C:\Windows\System\mtnFHND.exe
  C:\Windows\System\mtnFHND.exe
  2⤵
  PID:9460
- C:\Windows\System\BOWuAWL.exe
  C:\Windows\System\BOWuAWL.exe
  2⤵
  PID:9520
- C:\Windows\System\sLvjTvY.exe
  C:\Windows\System\sLvjTvY.exe
  2⤵
  PID:10076
- C:\Windows\System\rdERprr.exe
  C:\Windows\System\rdERprr.exe
  2⤵
  PID:9608
- C:\Windows\System\TtYOnnp.exe
  C:\Windows\System\TtYOnnp.exe
  2⤵
  PID:10208
- C:\Windows\System\QEZIwnX.exe
  C:\Windows\System\QEZIwnX.exe
  2⤵
  PID:9052
- C:\Windows\System\knJgBEL.exe
  C:\Windows\System\knJgBEL.exe
  2⤵
  PID:9764
- C:\Windows\System\zCpiTfQ.exe
  C:\Windows\System\zCpiTfQ.exe
  2⤵
  PID:9172
- C:\Windows\System\DjAGAmO.exe
  C:\Windows\System\DjAGAmO.exe
  2⤵
  PID:8912
- C:\Windows\System\aJMzTvD.exe
  C:\Windows\System\aJMzTvD.exe
  2⤵
  PID:10264
- C:\Windows\System\CtSLREp.exe
  C:\Windows\System\CtSLREp.exe
  2⤵
  PID:10292
- C:\Windows\System\blrDCkf.exe
  C:\Windows\System\blrDCkf.exe
  2⤵
  PID:10320
- C:\Windows\System\ijmiSxE.exe
  C:\Windows\System\ijmiSxE.exe
  2⤵
  PID:10344
- C:\Windows\System\ZpLhtRn.exe
  C:\Windows\System\ZpLhtRn.exe
  2⤵
  PID:10372
- C:\Windows\System\ssxmgLf.exe
  C:\Windows\System\ssxmgLf.exe
  2⤵
  PID:10388
- C:\Windows\System\lbropaF.exe
  C:\Windows\System\lbropaF.exe
  2⤵
  PID:10416
- C:\Windows\System\JVDDcvl.exe
  C:\Windows\System\JVDDcvl.exe
  2⤵
  PID:10440
- C:\Windows\System\eJXpDbj.exe
  C:\Windows\System\eJXpDbj.exe
  2⤵
  PID:10468
- C:\Windows\System\liOgajs.exe
  C:\Windows\System\liOgajs.exe
  2⤵
  PID:10496
- C:\Windows\System\yTgbHgj.exe
  C:\Windows\System\yTgbHgj.exe
  2⤵
  PID:10520
- C:\Windows\System\gWxbueY.exe
  C:\Windows\System\gWxbueY.exe
  2⤵
  PID:10548
- C:\Windows\System\TiZhVfZ.exe
  C:\Windows\System\TiZhVfZ.exe
  2⤵
  PID:10568
- C:\Windows\System\OQJSGTJ.exe
  C:\Windows\System\OQJSGTJ.exe
  2⤵
  PID:10592
- C:\Windows\System\TCagBTf.exe
  C:\Windows\System\TCagBTf.exe
  2⤵
  PID:10620
- C:\Windows\System\fEMtBno.exe
  C:\Windows\System\fEMtBno.exe
  2⤵
  PID:10652
- C:\Windows\System\GkBoMFQ.exe
  C:\Windows\System\GkBoMFQ.exe
  2⤵
  PID:10680
- C:\Windows\System\XQwvoHo.exe
  C:\Windows\System\XQwvoHo.exe
  2⤵
  PID:10704
- C:\Windows\System\WCKhLRa.exe
  C:\Windows\System\WCKhLRa.exe
  2⤵
  PID:10736
- C:\Windows\System\LPTrJZg.exe
  C:\Windows\System\LPTrJZg.exe
  2⤵
  PID:10756
- C:\Windows\System\tUmgbgR.exe
  C:\Windows\System\tUmgbgR.exe
  2⤵
  PID:10780
- C:\Windows\System\rRKamIo.exe
  C:\Windows\System\rRKamIo.exe
  2⤵
  PID:10800
- C:\Windows\System\LRlJlab.exe
  C:\Windows\System\LRlJlab.exe
  2⤵
  PID:10824
- C:\Windows\System\eNSmiGR.exe
  C:\Windows\System\eNSmiGR.exe
  2⤵
  PID:10844
- C:\Windows\System\BBbyqMw.exe
  C:\Windows\System\BBbyqMw.exe
  2⤵
  PID:10872
- C:\Windows\System\iZdNcOZ.exe
  C:\Windows\System\iZdNcOZ.exe
  2⤵
  PID:10888
- C:\Windows\System\NdRvmzO.exe
  C:\Windows\System\NdRvmzO.exe
  2⤵
  PID:10920
- C:\Windows\System\DzXBJrV.exe
  C:\Windows\System\DzXBJrV.exe
  2⤵
  PID:10936
- C:\Windows\System\inmyRfI.exe
  C:\Windows\System\inmyRfI.exe
  2⤵
  PID:10964
- C:\Windows\System\OecuEit.exe
  C:\Windows\System\OecuEit.exe
  2⤵
  PID:10984
- C:\Windows\System\zWBEeTP.exe
  C:\Windows\System\zWBEeTP.exe
  2⤵
  PID:11012
- C:\Windows\System\MXoTyhm.exe
  C:\Windows\System\MXoTyhm.exe
  2⤵
  PID:11032
- C:\Windows\System\KVciAun.exe
  C:\Windows\System\KVciAun.exe
  2⤵
  PID:11052
- C:\Windows\System\GHnvImO.exe
  C:\Windows\System\GHnvImO.exe
  2⤵
  PID:9256
- C:\Windows\System\KHenwgH.exe
  C:\Windows\System\KHenwgH.exe
  2⤵
  PID:9096
- C:\Windows\System\YIgRNsO.exe
  C:\Windows\System\YIgRNsO.exe
  2⤵
  PID:9976
- C:\Windows\System\vAhHEEm.exe
  C:\Windows\System\vAhHEEm.exe
  2⤵
  PID:9540
- C:\Windows\System\MwzpSCO.exe
  C:\Windows\System\MwzpSCO.exe
  2⤵
  PID:10160
- C:\Windows\System\YMJLnAT.exe
  C:\Windows\System\YMJLnAT.exe
  2⤵
  PID:9704
- C:\Windows\System\pmwjRFI.exe
  C:\Windows\System\pmwjRFI.exe
  2⤵
  PID:8812
- C:\Windows\System\SvVbGoM.exe
  C:\Windows\System\SvVbGoM.exe
  2⤵
  PID:10252
- C:\Windows\System\EGGdpYq.exe
  C:\Windows\System\EGGdpYq.exe
  2⤵
  PID:10312
- C:\Windows\System\CJMnIHI.exe
  C:\Windows\System\CJMnIHI.exe
  2⤵
  PID:10368
- C:\Windows\System\BGCjPTE.exe
  C:\Windows\System\BGCjPTE.exe
  2⤵
  PID:10512
- C:\Windows\System\cdXVoDz.exe
  C:\Windows\System\cdXVoDz.exe
  2⤵
  PID:10232
- C:\Windows\System\dyKrgpc.exe
  C:\Windows\System\dyKrgpc.exe
  2⤵
  PID:10796
- C:\Windows\System\HYlxCFE.exe
  C:\Windows\System\HYlxCFE.exe
  2⤵
  PID:10860
- C:\Windows\System\cequndp.exe
  C:\Windows\System\cequndp.exe
  2⤵
  PID:10932
- C:\Windows\System\SjaTBQW.exe
  C:\Windows\System\SjaTBQW.exe
  2⤵
  PID:10332
- C:\Windows\System\KQHPvDx.exe
  C:\Windows\System\KQHPvDx.exe
  2⤵
  PID:10484
- C:\Windows\System\WLCXybK.exe
  C:\Windows\System\WLCXybK.exe
  2⤵
  PID:11108
- C:\Windows\System\TBsKIMo.exe
  C:\Windows\System\TBsKIMo.exe
  2⤵
  PID:9348
- C:\Windows\System\tzrssbD.exe
  C:\Windows\System\tzrssbD.exe
  2⤵
  PID:10676
- C:\Windows\System\MeCyvpJ.exe
  C:\Windows\System\MeCyvpJ.exe
  2⤵
  PID:10200
- C:\Windows\System\TtteJlb.exe
  C:\Windows\System\TtteJlb.exe
  2⤵
  PID:7188
- C:\Windows\System\ounImhg.exe
  C:\Windows\System\ounImhg.exe
  2⤵
  PID:11008
- C:\Windows\System\hpdJSfQ.exe
  C:\Windows\System\hpdJSfQ.exe
  2⤵
  PID:11048
- C:\Windows\System\LUqvCiW.exe
  C:\Windows\System\LUqvCiW.exe
  2⤵
  PID:9136
- C:\Windows\System\PuApvGl.exe
  C:\Windows\System\PuApvGl.exe
  2⤵
  PID:11292
- C:\Windows\System\QjgRQcY.exe
  C:\Windows\System\QjgRQcY.exe
  2⤵
  PID:11312
- C:\Windows\System\WVNTjPK.exe
  C:\Windows\System\WVNTjPK.exe
  2⤵
  PID:11336
- C:\Windows\System\xFsOZBS.exe
  C:\Windows\System\xFsOZBS.exe
  2⤵
  PID:11360
- C:\Windows\System\uLIJyVU.exe
  C:\Windows\System\uLIJyVU.exe
  2⤵
  PID:11380
- C:\Windows\System\vpizjhX.exe
  C:\Windows\System\vpizjhX.exe
  2⤵
  PID:11404
- C:\Windows\System\orQHNQw.exe
  C:\Windows\System\orQHNQw.exe
  2⤵
  PID:11428
- C:\Windows\System\xTMXANN.exe
  C:\Windows\System\xTMXANN.exe
  2⤵
  PID:11456
- C:\Windows\System\cvKfaxA.exe
  C:\Windows\System\cvKfaxA.exe
  2⤵
  PID:11480
- C:\Windows\System\eGygajS.exe
  C:\Windows\System\eGygajS.exe
  2⤵
  PID:11508
- C:\Windows\System\jSxUPKe.exe
  C:\Windows\System\jSxUPKe.exe
  2⤵
  PID:11532
- C:\Windows\System\EReMjqm.exe
  C:\Windows\System\EReMjqm.exe
  2⤵
  PID:11560
- C:\Windows\System\qxhjnpr.exe
  C:\Windows\System\qxhjnpr.exe
  2⤵
  PID:11588
- C:\Windows\System\hFdgUTu.exe
  C:\Windows\System\hFdgUTu.exe
  2⤵
  PID:11616
- C:\Windows\System\EXFnyfC.exe
  C:\Windows\System\EXFnyfC.exe
  2⤵
  PID:11648
- C:\Windows\System\wgUQTTA.exe
  C:\Windows\System\wgUQTTA.exe
  2⤵
  PID:11680
- C:\Windows\System\tSHNqia.exe
  C:\Windows\System\tSHNqia.exe
  2⤵
  PID:11716
- C:\Windows\System\JoFVajO.exe
  C:\Windows\System\JoFVajO.exe
  2⤵
  PID:11736
- C:\Windows\System\uqfGdvU.exe
  C:\Windows\System\uqfGdvU.exe
  2⤵
  PID:11768
- C:\Windows\System\nXBAptU.exe
  C:\Windows\System\nXBAptU.exe
  2⤵
  PID:11804
- C:\Windows\System\RhVQJzh.exe
  C:\Windows\System\RhVQJzh.exe
  2⤵
  PID:11832
- C:\Windows\System\AZLDDAx.exe
  C:\Windows\System\AZLDDAx.exe
  2⤵
  PID:11856
- C:\Windows\System\XYEqWEV.exe
  C:\Windows\System\XYEqWEV.exe
  2⤵
  PID:11880
- C:\Windows\System\eQjZHGz.exe
  C:\Windows\System\eQjZHGz.exe
  2⤵
  PID:11896
- C:\Windows\System\aPJXElh.exe
  C:\Windows\System\aPJXElh.exe
  2⤵
  PID:11924
- C:\Windows\System\Gtjnbeh.exe
  C:\Windows\System\Gtjnbeh.exe
  2⤵
  PID:12196
- C:\Windows\System\EkhRPwf.exe
  C:\Windows\System\EkhRPwf.exe
  2⤵
  PID:12220
- C:\Windows\System\VPFUOiI.exe
  C:\Windows\System\VPFUOiI.exe
  2⤵
  PID:12244
- C:\Windows\System\VlwaeIQ.exe
  C:\Windows\System\VlwaeIQ.exe
  2⤵
  PID:12276
- C:\Windows\System\VSfBcEY.exe
  C:\Windows\System\VSfBcEY.exe
  2⤵
  PID:10556
- C:\Windows\System\BELAUim.exe
  C:\Windows\System\BELAUim.exe
  2⤵
  PID:10616
- C:\Windows\System\ePJMNSV.exe
  C:\Windows\System\ePJMNSV.exe
  2⤵
  PID:9028
- C:\Windows\System\LIAMfJs.exe
  C:\Windows\System\LIAMfJs.exe
  2⤵
  PID:10480
- C:\Windows\System\zXqQBWD.exe
  C:\Windows\System\zXqQBWD.exe
  2⤵
  PID:10956
- C:\Windows\System\YsIcLhJ.exe
  C:\Windows\System\YsIcLhJ.exe
  2⤵
  PID:10688
- C:\Windows\System\zQAuIIF.exe
  C:\Windows\System\zQAuIIF.exe
  2⤵
  PID:9852
- C:\Windows\System\Lwimfoe.exe
  C:\Windows\System\Lwimfoe.exe
  2⤵
  PID:8604
- C:\Windows\System\UkCxRAk.exe
  C:\Windows\System\UkCxRAk.exe
  2⤵
  PID:11320
- C:\Windows\System\eJDnIOj.exe
  C:\Windows\System\eJDnIOj.exe
  2⤵
  PID:11396
- C:\Windows\System\ngBUrNb.exe
  C:\Windows\System\ngBUrNb.exe
  2⤵
  PID:10836
- C:\Windows\System\nWhFlpZ.exe
  C:\Windows\System\nWhFlpZ.exe
  2⤵
  PID:11668
- C:\Windows\System\UPhtaTK.exe
  C:\Windows\System\UPhtaTK.exe
  2⤵
  PID:11732
- C:\Windows\System\JYTghZO.exe
  C:\Windows\System\JYTghZO.exe
  2⤵
  PID:12192
- C:\Windows\System\FGWDtMZ.exe
  C:\Windows\System\FGWDtMZ.exe
  2⤵
  PID:11972
- C:\Windows\System\QkusFvt.exe
  C:\Windows\System\QkusFvt.exe
  2⤵
  PID:12056
- C:\Windows\System\BybgKbj.exe
  C:\Windows\System\BybgKbj.exe
  2⤵
  PID:12112
- C:\Windows\System\Bcgjqto.exe
  C:\Windows\System\Bcgjqto.exe
  2⤵
  PID:11848
- C:\Windows\System\gpmpUaZ.exe
  C:\Windows\System\gpmpUaZ.exe
  2⤵
  PID:12008
- C:\Windows\System\yOpRKzG.exe
  C:\Windows\System\yOpRKzG.exe
  2⤵
  PID:12092
- C:\Windows\System\dpxlOzZ.exe
  C:\Windows\System\dpxlOzZ.exe
  2⤵
  PID:11044
- C:\Windows\System\sGkaJBl.exe
  C:\Windows\System\sGkaJBl.exe
  2⤵
  PID:11516
- C:\Windows\System\SpeXrwM.exe
  C:\Windows\System\SpeXrwM.exe
  2⤵
  PID:12184
- C:\Windows\System\vMqUMwx.exe
  C:\Windows\System\vMqUMwx.exe
  2⤵
  PID:12236
- C:\Windows\System\oBEdtKT.exe
  C:\Windows\System\oBEdtKT.exe
  2⤵
  PID:12260
- C:\Windows\System\IdDNyKM.exe
  C:\Windows\System\IdDNyKM.exe
  2⤵
  PID:10944
- C:\Windows\System\cAJyWVh.exe
  C:\Windows\System\cAJyWVh.exe
  2⤵
  PID:11356
- C:\Windows\System\WYpXJoC.exe
  C:\Windows\System\WYpXJoC.exe
  2⤵
  PID:12272
- C:\Windows\System\uyYYnTC.exe
  C:\Windows\System\uyYYnTC.exe
  2⤵
  PID:11704
- C:\Windows\System\jGyCsve.exe
  C:\Windows\System\jGyCsve.exe
  2⤵
  PID:8708
- C:\Windows\System\kWThiGV.exe
  C:\Windows\System\kWThiGV.exe
  2⤵
  PID:11824
- C:\Windows\System\EswVDrV.exe
  C:\Windows\System\EswVDrV.exe
  2⤵
  PID:12300
- C:\Windows\System\EDeduoJ.exe
  C:\Windows\System\EDeduoJ.exe
  2⤵
  PID:12328
- C:\Windows\System\FDKhdxo.exe
  C:\Windows\System\FDKhdxo.exe
  2⤵
  PID:12352
- C:\Windows\System\sCPtJgw.exe
  C:\Windows\System\sCPtJgw.exe
  2⤵
  PID:12376
- C:\Windows\System\nHSeLSC.exe
  C:\Windows\System\nHSeLSC.exe
  2⤵
  PID:12404
- C:\Windows\System\CQhEOqO.exe
  C:\Windows\System\CQhEOqO.exe
  2⤵
  PID:12420
- C:\Windows\System\hIyhTbm.exe
  C:\Windows\System\hIyhTbm.exe
  2⤵
  PID:12448
- C:\Windows\System\VrEgyjT.exe
  C:\Windows\System\VrEgyjT.exe
  2⤵
  PID:12476
- C:\Windows\System\zaHzEfR.exe
  C:\Windows\System\zaHzEfR.exe
  2⤵
  PID:12500
- C:\Windows\System\RlXGSaW.exe
  C:\Windows\System\RlXGSaW.exe
  2⤵
  PID:12520
- C:\Windows\System\zlxMpXw.exe
  C:\Windows\System\zlxMpXw.exe
  2⤵
  PID:12540
- C:\Windows\System\uCdSMsv.exe
  C:\Windows\System\uCdSMsv.exe
  2⤵
  PID:12560
- C:\Windows\System\lODcAYT.exe
  C:\Windows\System\lODcAYT.exe
  2⤵
  PID:12588
- C:\Windows\System\usEeFLA.exe
  C:\Windows\System\usEeFLA.exe
  2⤵
  PID:12612
- C:\Windows\System\EWeigfn.exe
  C:\Windows\System\EWeigfn.exe
  2⤵
  PID:12636
- C:\Windows\System\HcPmxXA.exe
  C:\Windows\System\HcPmxXA.exe
  2⤵
  PID:12756
- C:\Windows\System\KlfJJgG.exe
  C:\Windows\System\KlfJJgG.exe
  2⤵
  PID:12792
- C:\Windows\System\nyKxoPf.exe
  C:\Windows\System\nyKxoPf.exe
  2⤵
  PID:12816
- C:\Windows\System\TIZNflT.exe
  C:\Windows\System\TIZNflT.exe
  2⤵
  PID:12860
- C:\Windows\System\BMJDgLt.exe
  C:\Windows\System\BMJDgLt.exe
  2⤵
  PID:12900
- C:\Windows\System\DBDXrtA.exe
  C:\Windows\System\DBDXrtA.exe
  2⤵
  PID:12940
- C:\Windows\System\bdjfziy.exe
  C:\Windows\System\bdjfziy.exe
  2⤵
  PID:12964
- C:\Windows\System\bQZucHB.exe
  C:\Windows\System\bQZucHB.exe
  2⤵
  PID:12992
- C:\Windows\System\olyLStt.exe
  C:\Windows\System\olyLStt.exe
  2⤵
  PID:13036
- C:\Windows\System\tFjeubd.exe
  C:\Windows\System\tFjeubd.exe
  2⤵
  PID:13060
- C:\Windows\System\LHVIRZz.exe
  C:\Windows\System\LHVIRZz.exe
  2⤵
  PID:13088
- C:\Windows\System\PEfYeFy.exe
  C:\Windows\System\PEfYeFy.exe
  2⤵
  PID:13108
- C:\Windows\System\IvtyVZA.exe
  C:\Windows\System\IvtyVZA.exe
  2⤵
  PID:13136
- C:\Windows\System\HlhuYbS.exe
  C:\Windows\System\HlhuYbS.exe
  2⤵
  PID:13160
- C:\Windows\System\FyvjDFA.exe
  C:\Windows\System\FyvjDFA.exe
  2⤵
  PID:13176
- C:\Windows\System\KSTFMgb.exe
  C:\Windows\System\KSTFMgb.exe
  2⤵
  PID:13200
- C:\Windows\System\GgNsEFP.exe
  C:\Windows\System\GgNsEFP.exe
  2⤵
  PID:13224
- C:\Windows\System\dLymvuq.exe
  C:\Windows\System\dLymvuq.exe
  2⤵
  PID:13252
- C:\Windows\System\mxAaRdM.exe
  C:\Windows\System\mxAaRdM.exe
  2⤵
  PID:13280
- C:\Windows\System\dCQiNNU.exe
  C:\Windows\System\dCQiNNU.exe
  2⤵
  PID:13300
- C:\Windows\System\RukFSWu.exe
  C:\Windows\System\RukFSWu.exe
  2⤵
  PID:10532
- C:\Windows\System\dugBOVV.exe
  C:\Windows\System\dugBOVV.exe
  2⤵
  PID:10732
- C:\Windows\System\XqiIbft.exe
  C:\Windows\System\XqiIbft.exe
  2⤵
  PID:9752
- C:\Windows\System\BMKRMWU.exe
  C:\Windows\System\BMKRMWU.exe
  2⤵
  PID:11932
- C:\Windows\System\LVcqeLE.exe
  C:\Windows\System\LVcqeLE.exe
  2⤵
  PID:11308
- C:\Windows\System\dwOjvoW.exe
  C:\Windows\System\dwOjvoW.exe
  2⤵
  PID:11612
- C:\Windows\System\tWyqEFE.exe
  C:\Windows\System\tWyqEFE.exe
  2⤵
  PID:12496
- C:\Windows\System\nlPYPzH.exe
  C:\Windows\System\nlPYPzH.exe
  2⤵
  PID:12572
- C:\Windows\System\TeJpftt.exe
  C:\Windows\System\TeJpftt.exe
  2⤵
  PID:12440
- C:\Windows\System\EgyggNm.exe
  C:\Windows\System\EgyggNm.exe
  2⤵
  PID:12348
- C:\Windows\System\QNfCSfp.exe
  C:\Windows\System\QNfCSfp.exe
  2⤵
  PID:12396
- C:\Windows\System\MPbfnSz.exe
  C:\Windows\System\MPbfnSz.exe
  2⤵
  PID:12804
- C:\Windows\System\bXSCuQv.exe
  C:\Windows\System\bXSCuQv.exe
  2⤵
  PID:12584
- C:\Windows\System\LGHTDKV.exe
  C:\Windows\System\LGHTDKV.exe
  2⤵
  PID:12664
- C:\Windows\System\octzgFD.exe
  C:\Windows\System\octzgFD.exe
  2⤵
  PID:12972
- C:\Windows\System\LlFUowP.exe
  C:\Windows\System\LlFUowP.exe
  2⤵
  PID:12924
- C:\Windows\System\WyNOvzk.exe
  C:\Windows\System\WyNOvzk.exe
  2⤵
  PID:12788
- C:\Windows\System\DWTPaRc.exe
  C:\Windows\System\DWTPaRc.exe
  2⤵
  PID:12876
- C:\Windows\System\ZkAkCIG.exe
  C:\Windows\System\ZkAkCIG.exe
  2⤵
  PID:13080
- C:\Windows\System\KsDdSzs.exe
  C:\Windows\System\KsDdSzs.exe
  2⤵
  PID:13128
- C:\Windows\System\oDQwRtr.exe
  C:\Windows\System\oDQwRtr.exe
  2⤵
  PID:13156
- C:\Windows\System\ktWKTOj.exe
  C:\Windows\System\ktWKTOj.exe
  2⤵
  PID:13096
- C:\Windows\System\VWRbbGK.exe
  C:\Windows\System\VWRbbGK.exe
  2⤵
  PID:13220
- C:\Windows\System\jvdIFZo.exe
  C:\Windows\System\jvdIFZo.exe
  2⤵
  PID:10992
- C:\Windows\System\BpzcNAb.exe
  C:\Windows\System\BpzcNAb.exe
  2⤵
  PID:7576
- C:\Windows\System\PNFwSzd.exe
  C:\Windows\System\PNFwSzd.exe
  2⤵
  PID:12368
- C:\Windows\System\mTBjAGD.exe
  C:\Windows\System\mTBjAGD.exe
  2⤵
  PID:12340
- C:\Windows\System\kvbXdvG.exe
  C:\Windows\System\kvbXdvG.exe
  2⤵
  PID:12512
- C:\Windows\System\MCNQsUP.exe
  C:\Windows\System\MCNQsUP.exe
  2⤵
  PID:12764
- C:\Windows\System\rtBJktA.exe
  C:\Windows\System\rtBJktA.exe
  2⤵
  PID:13072
- C:\Windows\System\WPkOagw.exe
  C:\Windows\System\WPkOagw.exe
  2⤵
  PID:13320
- C:\Windows\System\FlfefpL.exe
  C:\Windows\System\FlfefpL.exe
  2⤵
  PID:13348
- C:\Windows\System\ceUlkpE.exe
  C:\Windows\System\ceUlkpE.exe
  2⤵
  PID:13376
- C:\Windows\System\cHgERZD.exe
  C:\Windows\System\cHgERZD.exe
  2⤵
  PID:13684
- C:\Windows\System\YsvYbiM.exe
  C:\Windows\System\YsvYbiM.exe
  2⤵
  PID:13708
- C:\Windows\System\foZhaKD.exe
  C:\Windows\System\foZhaKD.exe
  2⤵
  PID:13724
- C:\Windows\System\RUprWvU.exe
  C:\Windows\System\RUprWvU.exe
  2⤵
  PID:13748
- C:\Windows\System\CrZXPVQ.exe
  C:\Windows\System\CrZXPVQ.exe
  2⤵
  PID:13776
- C:\Windows\System\qLTYhUS.exe
  C:\Windows\System\qLTYhUS.exe
  2⤵
  PID:13804
- C:\Windows\System\WHcaDHz.exe
  C:\Windows\System\WHcaDHz.exe
  2⤵
  PID:13828
- C:\Windows\System\pkZIUAJ.exe
  C:\Windows\System\pkZIUAJ.exe
  2⤵
  PID:13848
- C:\Windows\System\eQcpNgu.exe
  C:\Windows\System\eQcpNgu.exe
  2⤵
  PID:13868
- C:\Windows\System\eWuxtUJ.exe
  C:\Windows\System\eWuxtUJ.exe
  2⤵
  PID:13892
- C:\Windows\System\vDSnyQg.exe
  C:\Windows\System\vDSnyQg.exe
  2⤵
  PID:13908
- C:\Windows\System\nYOVthi.exe
  C:\Windows\System\nYOVthi.exe
  2⤵
  PID:13936
- C:\Windows\System\nmnNXSW.exe
  C:\Windows\System\nmnNXSW.exe
  2⤵
  PID:13956
- C:\Windows\System\uxaknCa.exe
  C:\Windows\System\uxaknCa.exe
  2⤵
  PID:13984
- C:\Windows\System\CZKYyxY.exe
  C:\Windows\System\CZKYyxY.exe
  2⤵
  PID:14004
- C:\Windows\System\kJuwpTP.exe
  C:\Windows\System\kJuwpTP.exe
  2⤵
  PID:14028
- C:\Windows\System\lXkWSVS.exe
  C:\Windows\System\lXkWSVS.exe
  2⤵
  PID:14060
- C:\Windows\System\hRVaiOz.exe
  C:\Windows\System\hRVaiOz.exe
  2⤵
  PID:14080
- C:\Windows\System\uzuZvaK.exe
  C:\Windows\System\uzuZvaK.exe
  2⤵
  PID:14108
- C:\Windows\System\evJSpmi.exe
  C:\Windows\System\evJSpmi.exe
  2⤵
  PID:14136
- C:\Windows\System\YTdrWDJ.exe
  C:\Windows\System\YTdrWDJ.exe
  2⤵
  PID:14156
- C:\Windows\System\kzCvrCC.exe
  C:\Windows\System\kzCvrCC.exe
  2⤵
  PID:14176
- C:\Windows\System\kLUzcfi.exe
  C:\Windows\System\kLUzcfi.exe
  2⤵
  PID:14200
- C:\Windows\System\zKORYjO.exe
  C:\Windows\System\zKORYjO.exe
  2⤵
  PID:14216
- C:\Windows\System\PqNVCHm.exe
  C:\Windows\System\PqNVCHm.exe
  2⤵
  PID:14236
- C:\Windows\System\wPlsNmz.exe
  C:\Windows\System\wPlsNmz.exe
  2⤵
  PID:14284
- C:\Windows\System\tNgHAPg.exe
  C:\Windows\System\tNgHAPg.exe
  2⤵
  PID:14312
- C:\Windows\System\MalYFGJ.exe
  C:\Windows\System\MalYFGJ.exe
  2⤵
  PID:12696
- C:\Windows\System\PuTgZba.exe
  C:\Windows\System\PuTgZba.exe
  2⤵
  PID:13212
- C:\Windows\System\dhLdfbp.exe
  C:\Windows\System\dhLdfbp.exe
  2⤵
  PID:12868
- C:\Windows\System\VgPlYik.exe
  C:\Windows\System\VgPlYik.exe
  2⤵
  PID:12952
- C:\Windows\System\RTLFvVY.exe
  C:\Windows\System\RTLFvVY.exe
  2⤵
  PID:12676
- C:\Windows\System\coqjkyZ.exe
  C:\Windows\System\coqjkyZ.exe
  2⤵
  PID:13196
- C:\Windows\System\XIaQrSi.exe
  C:\Windows\System\XIaQrSi.exe
  2⤵
  PID:12528
- C:\Windows\System\ItagVTM.exe
  C:\Windows\System\ItagVTM.exe
  2⤵
  PID:11688
- C:\Windows\System\QWyEXrr.exe
  C:\Windows\System\QWyEXrr.exe
  2⤵
  PID:13360
- C:\Windows\System\huSDkPz.exe
  C:\Windows\System\huSDkPz.exe
  2⤵
  PID:13528
- C:\Windows\System\UWKxrvU.exe
  C:\Windows\System\UWKxrvU.exe
  2⤵
  PID:13572
- C:\Windows\System\zQYnEyi.exe
  C:\Windows\System\zQYnEyi.exe
  2⤵
  PID:13660
- C:\Windows\System\SHdQLYs.exe
  C:\Windows\System\SHdQLYs.exe
  2⤵
  PID:13716
- C:\Windows\System\SqUrWya.exe
  C:\Windows\System\SqUrWya.exe
  2⤵
  PID:13744
- C:\Windows\System\UrmbndI.exe
  C:\Windows\System\UrmbndI.exe
  2⤵
  PID:13760
- C:\Windows\System\aHTlBOZ.exe
  C:\Windows\System\aHTlBOZ.exe
  2⤵
  PID:13856
- C:\Windows\System\RlzVhRw.exe
  C:\Windows\System\RlzVhRw.exe
  2⤵
  PID:14056
- C:\Windows\System\rOXJCoa.exe
  C:\Windows\System\rOXJCoa.exe
  2⤵
  PID:14212
- C:\Windows\System\hQXyGux.exe
  C:\Windows\System\hQXyGux.exe
  2⤵
  PID:14292
- C:\Windows\System\SiCFdQG.exe
  C:\Windows\System\SiCFdQG.exe
  2⤵
  PID:11492
- C:\Windows\System\CIzDSlo.exe
  C:\Windows\System\CIzDSlo.exe
  2⤵
  PID:13788
- C:\Windows\System\rSveUVx.exe
  C:\Windows\System\rSveUVx.exe
  2⤵
  PID:12508
- C:\Windows\System\RqqzcLt.exe
  C:\Windows\System\RqqzcLt.exe
  2⤵
  PID:11800
- C:\Windows\System\vRyvzoc.exe
  C:\Windows\System\vRyvzoc.exe
  2⤵
  PID:12932
- C:\Windows\System\ZxPdert.exe
  C:\Windows\System\ZxPdert.exe
  2⤵
  PID:13844
- C:\Windows\System\MkBmhvy.exe
  C:\Windows\System\MkBmhvy.exe
  2⤵
  PID:12148
- C:\Windows\System\VVSMtfJ.exe
  C:\Windows\System\VVSMtfJ.exe
  2⤵
  PID:13500
- C:\Windows\System\eARrDTE.exe
  C:\Windows\System\eARrDTE.exe
  2⤵
  PID:13924
- C:\Windows\System\EXHBHGp.exe
  C:\Windows\System\EXHBHGp.exe
  2⤵
  PID:13820
- C:\Windows\System\fSKtdbP.exe
  C:\Windows\System\fSKtdbP.exe
  2⤵
  PID:14224
- C:\Windows\System\FYIqvcr.exe
  C:\Windows\System\FYIqvcr.exe
  2⤵
  PID:14268
- C:\Windows\System\CloHeiQ.exe
  C:\Windows\System\CloHeiQ.exe
  2⤵
  PID:14344
- C:\Windows\System\TJJtofB.exe
  C:\Windows\System\TJJtofB.exe
  2⤵
  PID:14364
- C:\Windows\System\QPKhlOs.exe
  C:\Windows\System\QPKhlOs.exe
  2⤵
  PID:14384
- C:\Windows\System\zUlwBfH.exe
  C:\Windows\System\zUlwBfH.exe
  2⤵
  PID:14412
- C:\Windows\System\ZzGTjvt.exe
  C:\Windows\System\ZzGTjvt.exe
  2⤵
  PID:14432
- C:\Windows\System\OoUQrvd.exe
  C:\Windows\System\OoUQrvd.exe
  2⤵
  PID:14448
- C:\Windows\System\wvEKCtz.exe
  C:\Windows\System\wvEKCtz.exe
  2⤵
  PID:14468
- C:\Windows\System\yBfoKHA.exe
  C:\Windows\System\yBfoKHA.exe
  2⤵
  PID:14496
- C:\Windows\System\zGXnBth.exe
  C:\Windows\System\zGXnBth.exe
  2⤵
  PID:14512
- C:\Windows\System\qsLvXkE.exe
  C:\Windows\System\qsLvXkE.exe
  2⤵
  PID:14536
- C:\Windows\System\bxNCquv.exe
  C:\Windows\System\bxNCquv.exe
  2⤵
  PID:14560
- C:\Windows\System\AWrxAFb.exe
  C:\Windows\System\AWrxAFb.exe
  2⤵
  PID:14584
- C:\Windows\System\sUjdiVG.exe
  C:\Windows\System\sUjdiVG.exe
  2⤵
  PID:14608
- C:\Windows\System\izBsLWV.exe
  C:\Windows\System\izBsLWV.exe
  2⤵
  PID:14712
- C:\Windows\System\PBjqDew.exe
  C:\Windows\System\PBjqDew.exe
  2⤵
  PID:14732
- C:\Windows\System\WISYErd.exe
  C:\Windows\System\WISYErd.exe
  2⤵
  PID:14768
- C:\Windows\System\seSeHof.exe
  C:\Windows\System\seSeHof.exe
  2⤵
  PID:14784
- C:\Windows\System\XqVQIVa.exe
  C:\Windows\System\XqVQIVa.exe
  2⤵
  PID:14812
- C:\Windows\System\zorISIb.exe
  C:\Windows\System\zorISIb.exe
  2⤵
  PID:14836
- C:\Windows\System\UpRZjVa.exe
  C:\Windows\System\UpRZjVa.exe
  2⤵
  PID:14860
- C:\Windows\System\tNonYas.exe
  C:\Windows\System\tNonYas.exe
  2⤵
  PID:14884
- C:\Windows\System\JcNAuuW.exe
  C:\Windows\System\JcNAuuW.exe
  2⤵
  PID:14900
- C:\Windows\System\opCpbEu.exe
  C:\Windows\System\opCpbEu.exe
  2⤵
  PID:14932
- C:\Windows\System\HehKQcC.exe
  C:\Windows\System\HehKQcC.exe
  2⤵
  PID:14960
- C:\Windows\System\ApWeHpZ.exe
  C:\Windows\System\ApWeHpZ.exe
  2⤵
  PID:14984
- C:\Windows\System\DhkuWBq.exe
  C:\Windows\System\DhkuWBq.exe
  2⤵
  PID:15008
- C:\Windows\System\oLOLrCj.exe
  C:\Windows\System\oLOLrCj.exe
  2⤵
  PID:15028
- C:\Windows\System\HESupqP.exe
  C:\Windows\System\HESupqP.exe
  2⤵
  PID:15056
- C:\Windows\System\ZvOPBzF.exe
  C:\Windows\System\ZvOPBzF.exe
  2⤵
  PID:15096
- C:\Windows\System\dMCDDlp.exe
  C:\Windows\System\dMCDDlp.exe
  2⤵
  PID:15116
- C:\Windows\System\XePxqwG.exe
  C:\Windows\System\XePxqwG.exe
  2⤵
  PID:15144
- C:\Windows\System\sXsJhwJ.exe
  C:\Windows\System\sXsJhwJ.exe
  2⤵
  PID:15168
- C:\Windows\System\mWEchLO.exe
  C:\Windows\System\mWEchLO.exe
  2⤵
  PID:15184
- C:\Windows\System\qjjYUwX.exe
  C:\Windows\System\qjjYUwX.exe
  2⤵
  PID:15208
- C:\Windows\System\vHnEGwW.exe
  C:\Windows\System\vHnEGwW.exe
  2⤵
  PID:15236
- C:\Windows\System\vLyblLf.exe
  C:\Windows\System\vLyblLf.exe
  2⤵
  PID:15264
- C:\Windows\System\tFKoNFg.exe
  C:\Windows\System\tFKoNFg.exe
  2⤵
  PID:15284
- C:\Windows\System\cBgPgZb.exe
  C:\Windows\System\cBgPgZb.exe
  2⤵
  PID:15316
- C:\Windows\System\qeoynpk.exe
  C:\Windows\System\qeoynpk.exe
  2⤵
  PID:15336
- C:\Windows\System\fGoNFui.exe
  C:\Windows\System\fGoNFui.exe
  2⤵
  PID:15356
- C:\Windows\System\xPyaPEt.exe
  C:\Windows\System\xPyaPEt.exe
  2⤵
  PID:14116
- C:\Windows\System\MjNGCCs.exe
  C:\Windows\System\MjNGCCs.exe
  2⤵
  PID:13168
- C:\Windows\System\nRsRYeJ.exe
  C:\Windows\System\nRsRYeJ.exe
  2⤵
  PID:13704
- C:\Windows\System\GkpHGQu.exe
  C:\Windows\System\GkpHGQu.exe
  2⤵
  PID:14392
- C:\Windows\System\wfedTPT.exe
  C:\Windows\System\wfedTPT.exe
  2⤵
  PID:14244
- C:\Windows\System\GBsVqTk.exe
  C:\Windows\System\GBsVqTk.exe
  2⤵
  PID:14444
- C:\Windows\System\LDgfRNO.exe
  C:\Windows\System\LDgfRNO.exe
  2⤵
  PID:14552
- C:\Windows\System\UkqYnht.exe
  C:\Windows\System\UkqYnht.exe
  2⤵
  PID:14576
- C:\Windows\System\OwyCiOF.exe
  C:\Windows\System\OwyCiOF.exe
  2⤵
  PID:14488
- C:\Windows\System\CNpwKTI.exe
  C:\Windows\System\CNpwKTI.exe
  2⤵
  PID:14532
- C:\Windows\System\OgitQOI.exe
  C:\Windows\System\OgitQOI.exe
  2⤵
  PID:14596
- C:\Windows\System\wFHWoqj.exe
  C:\Windows\System\wFHWoqj.exe
  2⤵
  PID:14832
- C:\Windows\System\FeZOjWz.exe
  C:\Windows\System\FeZOjWz.exe
  2⤵
  PID:14896
- C:\Windows\System\EAYeJiG.exe
  C:\Windows\System\EAYeJiG.exe
  2⤵
  PID:14728
- C:\Windows\System\IariQqN.exe
  C:\Windows\System\IariQqN.exe
  2⤵
  PID:15052
- C:\Windows\System\ZwMbVEc.exe
  C:\Windows\System\ZwMbVEc.exe
  2⤵
  PID:15156
- C:\Windows\System\BXDoBxR.exe
  C:\Windows\System\BXDoBxR.exe
  2⤵
  PID:14992
- C:\Windows\System\jPDPMqr.exe
  C:\Windows\System\jPDPMqr.exe
  2⤵
  PID:15256
- C:\Windows\System\JMvpcIX.exe
  C:\Windows\System\JMvpcIX.exe
  2⤵
  PID:15300
- C:\Windows\System\TtOQjTC.exe
  C:\Windows\System\TtOQjTC.exe
  2⤵
  PID:15308
- C:\Windows\System\BldDWqK.exe
  C:\Windows\System\BldDWqK.exe
  2⤵
  PID:15328
- C:\Windows\System\goHQePt.exe
  C:\Windows\System\goHQePt.exe
  2⤵
  PID:12372
- C:\Windows\System\reBrumA.exe
  C:\Windows\System\reBrumA.exe
  2⤵
  PID:15004
- C:\Windows\System\MMrmobn.exe
  C:\Windows\System\MMrmobn.exe
  2⤵
  PID:15020
- C:\Windows\System\iZMZnNO.exe
  C:\Windows\System\iZMZnNO.exe
  2⤵
  PID:14408
- C:\Windows\System\nXpixEq.exe
  C:\Windows\System\nXpixEq.exe
  2⤵
  PID:15080
- C:\Windows\System\XbCbrzF.exe
  C:\Windows\System\XbCbrzF.exe
  2⤵
  PID:15348
- C:\Windows\System\ODmaZtg.exe
  C:\Windows\System\ODmaZtg.exe
  2⤵
  PID:15024
- C:\Windows\System\hMuFdjK.exe
  C:\Windows\System\hMuFdjK.exe
  2⤵
  PID:15364
- C:\Windows\System\RfjWKbn.exe
  C:\Windows\System\RfjWKbn.exe
  2⤵
  PID:15400
- C:\Windows\System\BqlJUOF.exe
  C:\Windows\System\BqlJUOF.exe
  2⤵
  PID:15440
- C:\Windows\System\UlrpnmM.exe
  C:\Windows\System\UlrpnmM.exe
  2⤵
  PID:15460
- C:\Windows\System\hFghREZ.exe
  C:\Windows\System\hFghREZ.exe
  2⤵
  PID:15476
- C:\Windows\System\fJjDbUD.exe
  C:\Windows\System\fJjDbUD.exe
  2⤵
  PID:15508
- C:\Windows\System\OpZsgzL.exe
  C:\Windows\System\OpZsgzL.exe
  2⤵
  PID:15544
- C:\Windows\System\ZilsTid.exe
  C:\Windows\System\ZilsTid.exe
  2⤵
  PID:15568
- C:\Windows\System\XVgwEcv.exe
  C:\Windows\System\XVgwEcv.exe
  2⤵
  PID:15604
- C:\Windows\System\VgzXrBm.exe
  C:\Windows\System\VgzXrBm.exe
  2⤵
  PID:15648
- C:\Windows\System\BTTVwWN.exe
  C:\Windows\System\BTTVwWN.exe
  2⤵
  PID:15668
- C:\Windows\System\LFnwwLk.exe
  C:\Windows\System\LFnwwLk.exe
  2⤵
  PID:15692
- C:\Windows\System\raYoFUv.exe
  C:\Windows\System\raYoFUv.exe
  2⤵
  PID:15708
- C:\Windows\System\vBWdoLa.exe
  C:\Windows\System\vBWdoLa.exe
  2⤵
  PID:15728
- C:\Windows\System\lZxuBWa.exe
  C:\Windows\System\lZxuBWa.exe
  2⤵
  PID:15752
- C:\Windows\System\xzrVTPH.exe
  C:\Windows\System\xzrVTPH.exe
  2⤵
  PID:15776
- C:\Windows\System\IFTvPVH.exe
  C:\Windows\System\IFTvPVH.exe
  2⤵
  PID:15800
- C:\Windows\System\YhEyzsy.exe
  C:\Windows\System\YhEyzsy.exe
  2⤵
  PID:15824
- C:\Windows\System\zqBJOky.exe
  C:\Windows\System\zqBJOky.exe
  2⤵
  PID:15860
- C:\Windows\System\xyKWAvQ.exe
  C:\Windows\System\xyKWAvQ.exe
  2⤵
  PID:15896
- C:\Windows\System\zPtieQk.exe
  C:\Windows\System\zPtieQk.exe
  2⤵
  PID:15912
- C:\Windows\System\JWdyyCI.exe
  C:\Windows\System\JWdyyCI.exe
  2⤵
  PID:15928
- C:\Windows\System\nkRZAxa.exe
  C:\Windows\System\nkRZAxa.exe
  2⤵
  PID:15944
- C:\Windows\System\gvZSHRY.exe
  C:\Windows\System\gvZSHRY.exe
  2⤵
  PID:15964
- C:\Windows\System\idlbLhr.exe
  C:\Windows\System\idlbLhr.exe
  2⤵
  PID:15984
- C:\Windows\System\tLywmGt.exe
  C:\Windows\System\tLywmGt.exe
  2⤵
  PID:16004
- C:\Windows\System\reKpUHJ.exe
  C:\Windows\System\reKpUHJ.exe
  2⤵
  PID:16024
- C:\Windows\System\LrsPfwm.exe
  C:\Windows\System\LrsPfwm.exe
  2⤵
  PID:16048
- C:\Windows\System\SdrzCNd.exe
  C:\Windows\System\SdrzCNd.exe
  2⤵
  PID:16088
- C:\Windows\System\oDTVkof.exe
  C:\Windows\System\oDTVkof.exe
  2⤵
  PID:16108
- C:\Windows\System\FSWgcRU.exe
  C:\Windows\System\FSWgcRU.exe
  2⤵
  PID:16124
- C:\Windows\System\rPsYHIm.exe
  C:\Windows\System\rPsYHIm.exe
  2⤵
  PID:16152
- C:\Windows\System\lOSMMpr.exe
  C:\Windows\System\lOSMMpr.exe
  2⤵
  PID:16176
- C:\Windows\System\FdkcdHI.exe
  C:\Windows\System\FdkcdHI.exe
  2⤵
  PID:16200
- C:\Windows\System\lzvpdBm.exe
  C:\Windows\System\lzvpdBm.exe
  2⤵
  PID:16220
- C:\Windows\System\zoveVoZ.exe
  C:\Windows\System\zoveVoZ.exe
  2⤵
  PID:16236
- C:\Windows\System\oPNbcNO.exe
  C:\Windows\System\oPNbcNO.exe
  2⤵
  PID:16260
- C:\Windows\System\lPBgruB.exe
  C:\Windows\System\lPBgruB.exe
  2⤵
  PID:16288
- C:\Windows\System\HxmSZlE.exe
  C:\Windows\System\HxmSZlE.exe
  2⤵
  PID:16316
- C:\Windows\System\KkHnJEV.exe
  C:\Windows\System\KkHnJEV.exe
  2⤵
  PID:16340
- C:\Windows\System\lqWhUhc.exe
  C:\Windows\System\lqWhUhc.exe
  2⤵
  PID:16364
- C:\Windows\System\EMKFuFK.exe
  C:\Windows\System\EMKFuFK.exe
  2⤵
  PID:16380
- C:\Windows\System\gAUXfhM.exe
  C:\Windows\System\gAUXfhM.exe
  2⤵
  PID:15044
- C:\Windows\System\dhkeMqi.exe
  C:\Windows\System\dhkeMqi.exe
  2⤵
  PID:13480
- C:\Windows\System\gzMZAep.exe
  C:\Windows\System\gzMZAep.exe
  2⤵
  PID:3652
- C:\Windows\System\NatVBsk.exe
  C:\Windows\System\NatVBsk.exe
  2⤵
  PID:15388
- C:\Windows\System\HLwAfYb.exe
  C:\Windows\System\HLwAfYb.exe
  2⤵
  PID:15428
- C:\Windows\System\tIjWujr.exe
  C:\Windows\System\tIjWujr.exe
  2⤵
  PID:15520
- C:\Windows\System\BSAZUWU.exe
  C:\Windows\System\BSAZUWU.exe
  2⤵
  PID:15564
- C:\Windows\System\xhcoxKt.exe
  C:\Windows\System\xhcoxKt.exe
  2⤵
  PID:16100
- C:\Windows\System\AVRiShw.exe
  C:\Windows\System\AVRiShw.exe
  2⤵
  PID:16116
- C:\Windows\System\NKnDICq.exe
  C:\Windows\System\NKnDICq.exe
  2⤵
  PID:16164
- C:\Windows\System\eKMTHVf.exe
  C:\Windows\System\eKMTHVf.exe
  2⤵
  PID:16208
- C:\Windows\System\BsFKQIv.exe
  C:\Windows\System\BsFKQIv.exe
  2⤵
  PID:16232
- C:\Windows\System\JSAfvZk.exe
  C:\Windows\System\JSAfvZk.exe
  2⤵
  PID:16252
- C:\Windows\System\sXwmWuo.exe
  C:\Windows\System\sXwmWuo.exe
  2⤵
  PID:15952
- C:\Windows\System\kqPccmQ.exe
  C:\Windows\System\kqPccmQ.exe
  2⤵
  PID:15972
- C:\Windows\System\rlOSShp.exe
  C:\Windows\System\rlOSShp.exe
  2⤵
  PID:15872
- C:\Windows\System\UWsCBxY.exe
  C:\Windows\System\UWsCBxY.exe
  2⤵
  PID:14380
- C:\Windows\System\kggGbwd.exe
  C:\Windows\System\kggGbwd.exe
  2⤵
  PID:16012
- C:\Windows\System\dSfSLQa.exe
  C:\Windows\System\dSfSLQa.exe
  2⤵
  PID:15452
- C:\Windows\System\nGfPNPq.exe
  C:\Windows\System\nGfPNPq.exe
  2⤵
  PID:16096
- C:\Windows\System\UYJjFXL.exe
  C:\Windows\System\UYJjFXL.exe
  2⤵
  PID:15904
- C:\Windows\System\mbNaFDW.exe
  C:\Windows\System\mbNaFDW.exe
  2⤵
  PID:16400
- C:\Windows\System\xRDTBgX.exe
  C:\Windows\System\xRDTBgX.exe
  2⤵
  PID:16436
- C:\Windows\System\XYNiuQW.exe
  C:\Windows\System\XYNiuQW.exe
  2⤵
  PID:16472
- C:\Windows\System\CBjZpNr.exe
  C:\Windows\System\CBjZpNr.exe
  2⤵
  PID:16504
- C:\Windows\System\nYdjHrS.exe
  C:\Windows\System\nYdjHrS.exe
  2⤵
  PID:16524
- C:\Windows\System\FSZMBWt.exe
  C:\Windows\System\FSZMBWt.exe
  2⤵
  PID:16544
- C:\Windows\System\nBTgxAt.exe
  C:\Windows\System\nBTgxAt.exe
  2⤵
  PID:16576
- C:\Windows\System\LGkAfoR.exe
  C:\Windows\System\LGkAfoR.exe
  2⤵
  PID:16608
- C:\Windows\System\kFvNrWc.exe
  C:\Windows\System\kFvNrWc.exe
  2⤵
  PID:16632
- C:\Windows\System\iWyApZU.exe
  C:\Windows\System\iWyApZU.exe
  2⤵
  PID:16656
- C:\Windows\System\vKNskzI.exe
  C:\Windows\System\vKNskzI.exe
  2⤵
  PID:16688
- C:\Windows\System\aHUzXrR.exe
  C:\Windows\System\aHUzXrR.exe
  2⤵
  PID:16716
- C:\Windows\System\XepUXBn.exe
  C:\Windows\System\XepUXBn.exe
  2⤵
  PID:16740
- C:\Windows\System\cEiITMo.exe
  C:\Windows\System\cEiITMo.exe
  2⤵
  PID:16756
- C:\Windows\System\TDwpWqR.exe
  C:\Windows\System\TDwpWqR.exe
  2⤵
  PID:16788
- C:\Windows\System\tfXKzrt.exe
  C:\Windows\System\tfXKzrt.exe
  2⤵
  PID:16808
- C:\Windows\System\nzYMnZp.exe
  C:\Windows\System\nzYMnZp.exe
  2⤵
  PID:16828
- C:\Windows\System\bxcTtxt.exe
  C:\Windows\System\bxcTtxt.exe
  2⤵
  PID:16856
- C:\Windows\System\CPGzNHX.exe
  C:\Windows\System\CPGzNHX.exe
  2⤵
  PID:16876
- C:\Windows\System\tjVmbBs.exe
  C:\Windows\System\tjVmbBs.exe
  2⤵
  PID:16908
- C:\Windows\System\AhsPWwh.exe
  C:\Windows\System\AhsPWwh.exe
  2⤵
  PID:16928
- C:\Windows\System\VUjRWWV.exe
  C:\Windows\System\VUjRWWV.exe
  2⤵
  PID:16944
- C:\Windows\System\jHjrbwK.exe
  C:\Windows\System\jHjrbwK.exe
  2⤵
  PID:16976
- C:\Windows\System\AHwadLe.exe
  C:\Windows\System\AHwadLe.exe
  2⤵
  PID:16996
- C:\Windows\System\fEXmCRr.exe
  C:\Windows\System\fEXmCRr.exe
  2⤵
  PID:17020
- C:\Windows\System\vINMkVR.exe
  C:\Windows\System\vINMkVR.exe
  2⤵
  PID:17052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DQxhQHN.exe

Filesize
1.2MB

MD5
e659e4e22f82fedaf9cfd118f8a68090

SHA1
8ef79c1abf0b33d77260634d13461d374766967f

SHA256
1728ded9c73a767b14c0b908206ae4d9e09268b689baaaec11142fec6acc29a0

SHA512
ae7992a371d248316c097112fbf949bab3f4e29089758e1fd128e6b02a621f8b6ffe4bf4a0f3d5ccc653b3e9f3a0303b01e83e631d230cb23c60a1e3197a5338

Download Submit
C:\Windows\System\DUdBcug.exe

Filesize
1.2MB

MD5
274606a15122b71927fc3ef0d1c7e9a6

SHA1
36e32682e52c9b60eebf47c489bfe005a8036489

SHA256
757026ffeb8df0cc0670edf1943d091d83667dd041e398e88a18dbbe6ec20d48

SHA512
38e13f016231e3bb8469f35a1af63d8ca01eb8d3b69a13529a0e084fbbbf7c981a3aab1168c2bef3a621bf75b97f7f1eab24132a3e5289cf2e9c16315b4a2724

Download Submit
C:\Windows\System\IaDXCWl.exe

Filesize
1.2MB

MD5
6735ec9767a3f109c07a6c926b3c03ff

SHA1
c9c45ea167b7cbff79f1ebea80ed53bd16b7349a

SHA256
ac8ead6376ef304012e2950994a68891a63d7fc7e159548bec7cb41c22db51b5

SHA512
26bd06e3defb253f9d37d6c41ef01dd05f6515234ad43701801a7b181cb5bc4fcf5a417cd641147c16132fb3e8e64f8a87b2ee6b15174246ccda069a23f84149

Download Submit
C:\Windows\System\IsHbRdY.exe

Filesize
1.2MB

MD5
0f4c66e17b98c16811c14ce00cb37bd2

SHA1
f1c0ebebd1e2659d3a7acce887bcd00a27b1cab9

SHA256
d57d21ba3c687e6888a672c785a64eeda1a5ce3ff53b78936decfc1108638b8c

SHA512
43972c9bcf0eec7a3ec97d0e8877ae5cdf7a9b120dc41f284d2763bededf689cc84941967c84850d30a30a471b6a325af9d51dc219e43b7fe8e3904449b9d3bb

Download Submit
C:\Windows\System\MREcvTo.exe

Filesize
1.2MB

MD5
36d14f511ce8d886174106e65242570e

SHA1
99ab921dcedd46d3a58b2b094d0750d2b724a7a0

SHA256
bdbcd50a95b7b3c2e89052eb82781b073eb2551576b24dd5b6621e835c90ff11

SHA512
dbe0907b5b893100584b69805056fdb59e5e408879e53e1e9a59380bb5096453417d0c81d9902674b2fb63fa78db3794799148c02a83d21c8fbb2e8870e1899e

Download Submit
C:\Windows\System\NqlbNod.exe

Filesize
1.2MB

MD5
820adb0c4da8d2c7df9e46dfaab6f2c8

SHA1
de864f691db61ae9edb356b8b2c57eb8c83370ff

SHA256
85b3c511dc6976d1ab961611939dd406dbe5488da5bada0bb005c50e6edd457e

SHA512
5c100c6e2cfd8001788dca8320258ab47c10b4b5c22627d833f21d1a05cefc1fb19a826761bf3068527836fafcbec5d6991b1007fcd2f9c4094f09db83b1f993

Download Submit
C:\Windows\System\PRDwDBj.exe

Filesize
1.2MB

MD5
2d29e41b753c8619d7f9f4b4dac9d81b

SHA1
80b2415ec47b2eea3435de3f3223a8c6c1070bf8

SHA256
eaf1b3836cde73f38df67482913a72573ec1517b440c05455816f50980af0e81

SHA512
13ba9916f1ac413b628c7cc5f2cf25e10662bc27b1541f5bd399f170012ab92bcaccc3d1a9fb8cd0cfbea9ddb8bc4c6672cd6526d25cda445ed7846a135ecd7b

Download Submit
C:\Windows\System\RtemheK.exe

Filesize
1.2MB

MD5
00ece64ee15984f299b8d921513e6eab

SHA1
6cb1a28d8d364ed0d535aeabe1fc4b13249583cc

SHA256
ba6d7f3b605193a174aa96dbb7d5a2c7afc4b73f354858315e27d6a443bad8ca

SHA512
a640a857cd15a7622b0e9c27270f8a1a9662181d6bb084694f8ee3942bffd20c58fdc6f6246f933bb19b84108a434d626ee965f664d16e840f789fd7872d3276

Download Submit
C:\Windows\System\TVofqAO.exe

Filesize
1.2MB

MD5
8f5653296e665b7ff7660d1ac1ca08e3

SHA1
8927d048588f9f22284824446aa2086e93fe3f27

SHA256
f743ef7601c123d79701088680d839ab81e0d05e4a90ac98bcbf29c1cb0fe653

SHA512
0a2d6501b2e2df0fb2fc5626950f2bd1e6d401b29699542ec62494f9e3ee26990304c6ea9303b1570cb5e722f7266acffa5c56199629825041f152e4b9d80bd5

Download Submit
C:\Windows\System\TglROag.exe

Filesize
1.2MB

MD5
446e14105c1726db8a8b05e0a96a6ccf

SHA1
0f97cc3ab6adeeed3b2a63af52c1bbcf7c38c7d4

SHA256
a3dbb9d618204fa6710704b042ecf5416b476b8c5d6889cb4bbeb3a851212837

SHA512
284cb783e33d4d46313a107a07ea74b73fab0f2d2554d8ab72e574462485891ae982ba75d8ba2a47b77ddef763a5efa79e4cb4dc1cdd324c2ed5a9f509e3bc3b

Download Submit
C:\Windows\System\TkEpZal.exe

Filesize
1.2MB

MD5
d77e04eab42a7721bf8a94a891d82284

SHA1
4dbd9294192144104d649318b1744ff1deb97683

SHA256
ee063207cd9f70fbec77585257e92949d5e3e6885034bd7217bfbab1f8c302eb

SHA512
bae5505730c1e6bb48066c71d11eb0d47ebcaa0251bde032c122b4f1254b24f91ea733e737db9c5dca075de9f5d7e48b4716997602a0799288f25a8236f828e7

Download Submit
C:\Windows\System\WZURcRK.exe

Filesize
1.2MB

MD5
a441c06ecc0d6f09b7933501ab297c86

SHA1
95e8979968443057a23189235aad30ae901ca07f

SHA256
b2ee5e6fd3cc2656a2854adea3c84c8d6ad78f3ac44eb87ae8318e2e6289d675

SHA512
e72c10849076c794cbaad1edde949d47547374c2a4614fabb003cf96f17f1323d8a0cb1385a05a00aaba7d3f7c345b776cf300c6da1bae09d3366614fa44de3c

Download Submit
C:\Windows\System\WpYKLtl.exe

Filesize
1.2MB

MD5
4d72a95eb03479493226ed56989a74fe

SHA1
db21257f640e04d3ace0ef1fd68891ff9fe5027f

SHA256
1d9418c4f62a374cce0beb7e0e6ce5b2f982edda2c248616ce30e9803486f497

SHA512
e48f9adaa57b2acd71cddd198ee97af775895a7a20aa0f577f29a257ffbb420dcf50957184e84f9ca5b02966898f86b3ebab1d9b5b7be19f7908814f8ef5619b

Download Submit
C:\Windows\System\alFoiMG.exe

Filesize
1.2MB

MD5
944c7865666527520cc9703862667465

SHA1
e2efef1c586c8273b2e06512bae889d8c428243f

SHA256
a78d408fcecae3bee9e2275b3649a59c431e6b4687c06321c2b550f37fe8a586

SHA512
f68485986a9a9b0d45869a60e642117dbcda84a0842d1e28753ca58ad791eacdf192ad854defbf005865f1e3ebb7c0ed16ab2d83be416b0adb947009fbeb7a6f

Download Submit
C:\Windows\System\bOHCDUJ.exe

Filesize
1.2MB

MD5
f8b8c5253e5e9d5767f98ecfb2b37333

SHA1
5a847056b51f5f17acb35894876613bfa5a6dc48

SHA256
158b3709ce2a39b55ec5d40b961461fbf93291110a024b9be4fb0b8f6f94ba0c

SHA512
1e321d9837f6c99e81450eb4fd4ef0a4d7db0053b0f78da519dbcf7be3f4a54d6d85608d27abeb54447e609f3e1aa1c960d39d5da72f0a81b8b89f8989bf49fb

Download Submit
C:\Windows\System\bjrxBzf.exe

Filesize
1.2MB

MD5
dedd09bd369176f5425c0617b7d054e2

SHA1
9ae43bbdf9bc9f36ca253380e55a7a0e69566aa8

SHA256
75d6892ff6a09263d34ec7dd4a98a4cb5f90d1ca779ae83854d498bf2f7d4baf

SHA512
088da0c47d1a67cddb758a3046d33be5aec6a4bfc8c4f54389613f42e3ce5b1a45b1aa236c2b63d2c353de80b2d1c1f99f61e113d7a5c18bd614383b2b4c50b7

Download Submit
C:\Windows\System\ddZkjwm.exe

Filesize
1.2MB

MD5
f90682f9ddd0d2bfc31b81d632a37481

SHA1
672c7e05bd37b65b094e4851edf88ecf4f3e1ab9

SHA256
60211026d746824cd78587026c199bdbce6c1756ddebf6e241dd555475b24389

SHA512
5b631124d3d405140fcd86bec79abf0e157993b01cff25680a85a71150ffd85618736f5cd2160f747636e009df108aff089f5df7eab6d8a2954bf9cab2c84b42

Download Submit
C:\Windows\System\fXDgjKY.exe

Filesize
1.2MB

MD5
a2bb33438628c8076a804aa7b790f890

SHA1
82ca1d170daf37e0a6e9d5b21038398a13c3e322

SHA256
ed66aca83d65712600d8f4eb81bfad433a1d3014954545eae18548c349c68e0b

SHA512
6aaadaea84fb6bb2247127709ca9c87cd8e414bcff3843b867281e03bd5f89a6846be178a8648641c885d9c364fd4457db483c556cba8693092f355c6e1f98b7

Download Submit
C:\Windows\System\gSnBqcE.exe

Filesize
1.2MB

MD5
509efd1afff2f90842494000c37eb126

SHA1
995140f60245d636b9fd6e1cc8e7494630411f7b

SHA256
f5f9dfb086f399fb2b844d7ab8ccddb6a5fdecd3b2e27bf37b4a87a6cf1224b1

SHA512
48bed6a9b0bb38a9cce66a1aad11a78a01137ab50b5bf258d80dea75eed6fccae33bfbe7c5d3a9c799021095daf50782a5af58f21e7c823973c7d1a89852490d

Download Submit
C:\Windows\System\gYutRqv.exe

Filesize
1.2MB

MD5
42ca236bdea165da04287bb6cbbe9b3e

SHA1
f106e25cd3469461622f2b80b79adfa67b3de2ed

SHA256
3988dfeba5e10f417e19b455a54298a3175b9d7d8e2af968850a0e230640c3c3

SHA512
335eda0b4b5d2391c895c7e7907ecc7ec41d3ff016cfe6b76f96c315b071104e28ad211afb89037524f7f0f008c8db1f1fae21324ba343f231d2a7eba558c69b

Download Submit
C:\Windows\System\ipQNbeD.exe

Filesize
1.2MB

MD5
ccc69a42ff1c61937269f97cc3d6fb85

SHA1
7de560d81970afdc7e007aef7feeefe3d360be6f

SHA256
33af0fa2f762d560d49d7c821f994b2a0801cdb05ae925ba38e92a8f152542c9

SHA512
d148d13d17523a45ddef3d6c41155ead4da7c2d4fff5cd7e7b4cf907fdf36c5e98a9f0123d2d3b667be0184b9b26c88bf59f850e9fc7bea1829d2c0371025d0d

Download Submit
C:\Windows\System\jWGCBuv.exe

Filesize
1.2MB

MD5
85f5753202e23adc1ed5082ff94d1bec

SHA1
37053c02f54defbdf9ad0c41421fa51b6ac66731

SHA256
9e9d342dd548e8d774f1aa263e96c50175c85753819ddc1918ceca1b84d688ac

SHA512
f59eedb8c497e5c1d425f7ce3f6bf6b98ad1c58c2a1d4e529f4a2bfb6c2fa9f77687521ecdc716a7e9963d7e6ca7d3ce058dabf567c90edcc465db6a674c7eec

Download Submit
C:\Windows\System\jhdcxRD.exe

Filesize
1.2MB

MD5
dc2fd481c7c3205abc04a4c0fb868dda

SHA1
f56cd76a3876cb915f90d83acc5173b91904ad76

SHA256
33a19eabb815dc191a040ff9b8fec27a8a5c71ba404a5eb7019204f78f759ad2

SHA512
d8886bc824fbdd567e81975b6a70decc0863fba2bc4be4ab1ffba7a421630ec2e6df26baafd44cb99073cd84ae8d7f7d9ae648e1d078912bc7ea47cf6d40b146

Download Submit
C:\Windows\System\kldtnHt.exe

Filesize
1.2MB

MD5
045edadec5a7a8ab172ede657a3f9996

SHA1
08c18ac1dcec6eeb90bdb2d8ecbc2f5dc06618db

SHA256
cae38cbd3b776d9e1493b6fefac76e44efe1004f350d4e6f748ce107bfdf82c3

SHA512
04e921f01ce489ff9bbe87e19cc089a9c1c406cb9df155b30e8a839a8bb437bd2f0b941b38fb42f7217e0443e4ac414313d51a902d62f0f23e3b1c925a7da653

Download Submit
C:\Windows\System\knMwVim.exe

Filesize
1.2MB

MD5
d6db8ac5b2c691df8107f6239f2658ab

SHA1
bf1c13bc16a54ba3e9726c6463995f9842eea9f1

SHA256
9b0d9570693bc8316d59ebcf1e3a0d8910b8060664419f08cbb5cbbbb58cd524

SHA512
1d68f5b070a771041e66817d503d95c42483d2e11077b3c2ca6665cec5be25ab0ef5eb6378a8566bf206cbebd661c4ecd86660b3b295d2d37443e4e0a91ec382

Download Submit
C:\Windows\System\lCpeXBu.exe

Filesize
1.2MB

MD5
eb5bb544d8a787b3be96afa5fe66a579

SHA1
bf2bf0c3c36a6059761634795bd87049826eadc9

SHA256
919804e7841909724602b95c74bea2585b521488a1d71a80e99b006ab6284446

SHA512
06a5914615a446fe59c25d9395f46c0cdee773290df672f3cc875908779e9fa9993469451c8afff339379be666bb276d2525f438ffcc9d5086c90dfddf3c4e70

Download Submit
C:\Windows\System\mwEhKju.exe

Filesize
1.2MB

MD5
dd8f8ab3c0d210a222018aecc5738bad

SHA1
5dde4d4e1521f2930736a386c73abbcd7a04d810

SHA256
3c9d0120a745e885f5f03e3ee62ec02407dd927caedc7d0afac2c726835a89a4

SHA512
ab57ac294e7d46dfa9aa87f0b528720bc459abd767ddfd2b8bf690d500a8d4b8a6fddfff9b27522f6442532044bc9a78a0ac3a7c01817bd863af45d34d3b4b60

Download Submit
C:\Windows\System\nSTwgOj.exe

Filesize
1.2MB

MD5
ab0d1510a1eac4455866c9a084f53916

SHA1
ab85920d5ed5fa758041b588cb92181241079a8d

SHA256
d0082dfbb0cfde7d6a4624132f831c1188e557b66d05dd6553661d77df2339f3

SHA512
d256c01a7212f90faa7e8cc45ebca419ae65367f929424b65f865d52a9f42814014bb5ec326e76a73cd17d336e3476f8b5c8344b1d5227961bf98c7d81f83533

Download Submit
C:\Windows\System\qaErAUZ.exe

Filesize
1.2MB

MD5
cddd598639ebc90f0fe908dfbf438fc3

SHA1
165665eabde688a9620fad680fb4672a5d923cc9

SHA256
3346df72fc3e42268eb7f79bb04596990e1f70517c5fae2570f42385b13b3faa

SHA512
2dffbd60b3e023df24ee8a334bfc31626a6d106921307da8d482a1dbea1d6121b4ff0460161f08d2b97b67e7cee4155a3f9f5285a50ea8fa6130a6ece36e6c16

Download Submit
C:\Windows\System\uwOAmRK.exe

Filesize
1.2MB

MD5
931b7998afcbd324c209861ce481a403

SHA1
bf92ec9eca6dc59bba198c8b1ce123af0a2bf0c3

SHA256
0b9ba79b2d599be8e9d1081716c0d7b6f7b0b4c821bd22be06b882196e9846c2

SHA512
07beb55c3e243850d292eb5a5f8ac7fc8667f720a680f53acc42c3c417495025383a7db496a8be2ebac60eade71e4ccfa8e897363cf20f902ffc06352287d735

Download Submit
C:\Windows\System\vDyeMLW.exe

Filesize
1.2MB

MD5
dfa6fd59673109413beb9aaed5130c35

SHA1
83314ef3bfb0c4ab8d2bb3be20ae513955d7e2a2

SHA256
052cf914447912e1abcc5e4df8dec11ccb126a805b772fdba06b2479932a0bba

SHA512
b95ff1cc087d841ed0208e24fa1e923ae96a48fa6de3ba3332108ad7ad9dacfd4b446877bf380b94dae4e0d8c1a6f2488b7ca5607bfae03d9fc2c6d29f840389

Download Submit
C:\Windows\System\vwBxdad.exe

Filesize
1.2MB

MD5
8cdc7c0fed6db83561375e3dad081ce8

SHA1
2416d6b58d24dd8936adf04f9bef29d779b1e2c8

SHA256
90dfed04fffaaace87ff3504e063ef1e38a3704dd7302aa2e41e79b45ad125b9

SHA512
96d71c015eb760b23cd78d689055834175eaf7be6fb67540d622d9d69252d114050175309483f25646d04ff5f7732698009df4a3e2af41c331fd455a68da2cbf

Download Submit
C:\Windows\System\yRtYxpc.exe

Filesize
1.2MB

MD5
9a249be98f786b403c163af607395d07

SHA1
0174701a3c0775a4e8cfd9f78897e4ee19882de7

SHA256
2878ebb1b14e43be2af65f8c764a23332a42f8ecc281f83a54a13949b0e72926

SHA512
4ba9fb264f9a2590dbc3ada663531d06bc8c105e789433889817a786d89ed15cb32fcb459b31fb7400d71992381a0f755071c1820384771f734f38721814e544

Download Submit
memory/5064-0-0x000001F63B650000-0x000001F63B660000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads