xmrig | a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358

Analysis

max time kernel
92s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
Size

1.1MB
MD5

31730666ce7c8eff5dbd24e98ac288d8
SHA1

2862a193271e34325d6c0fadb7ec26f6fae7094e
SHA256

a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358
SHA512

8457545b6502f74db1da6ce5c3b28cb720d2dad4078cee72d828c0eddec57f1d3514d4a40d774fdd8a6f50de6a9fbd4351dd98196a9cd8632531a3892dce3f4f
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensz8Zs0YrTmElbL:GezaTF8FcNkNdfE0pZ9ozttwIRbfmG

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b2e-4.dat	xmrig
behavioral2/files/0x000d000000023b7f-8.dat	xmrig
behavioral2/files/0x000a000000023b8b-16.dat	xmrig
behavioral2/files/0x000a000000023b8c-24.dat	xmrig
behavioral2/files/0x000a000000023b8d-28.dat	xmrig
behavioral2/files/0x000a000000023b98-76.dat	xmrig
behavioral2/files/0x000a000000023b9e-100.dat	xmrig
behavioral2/files/0x000a000000023b9b-125.dat	xmrig
behavioral2/files/0x000b000000023ba1-123.dat	xmrig
behavioral2/files/0x000b000000023ba0-121.dat	xmrig
behavioral2/files/0x000a000000023b9c-119.dat	xmrig
behavioral2/files/0x000a000000023b8f-117.dat	xmrig
behavioral2/files/0x000b000000023b9f-115.dat	xmrig
behavioral2/files/0x000a000000023b9d-111.dat	xmrig
behavioral2/files/0x000a000000023b99-109.dat	xmrig
behavioral2/files/0x000a000000023b9a-104.dat	xmrig
behavioral2/files/0x000a000000023b95-98.dat	xmrig
behavioral2/files/0x000a000000023b96-95.dat	xmrig
behavioral2/files/0x000a000000023b94-92.dat	xmrig
behavioral2/files/0x000e000000023bb0-137.dat	xmrig
behavioral2/files/0x000b000000023b88-142.dat	xmrig
behavioral2/files/0x0008000000023bb9-138.dat	xmrig
behavioral2/files/0x000a000000023ba9-133.dat	xmrig
behavioral2/files/0x000a000000023b97-79.dat	xmrig
behavioral2/files/0x000a000000023b93-64.dat	xmrig
behavioral2/files/0x000a000000023b91-62.dat	xmrig
behavioral2/files/0x000a000000023b90-57.dat	xmrig
behavioral2/files/0x000a000000023b92-68.dat	xmrig
behavioral2/files/0x000a000000023b8e-38.dat	xmrig
behavioral2/files/0x0009000000023bbe-149.dat	xmrig
behavioral2/files/0x0009000000023bbf-158.dat	xmrig
behavioral2/files/0x0009000000023bc0-163.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2640	BtFsnei.exe
2840	rVGewae.exe
1608	ZPWKIxd.exe
4952	bSvLDGG.exe
1140	xemeYKK.exe
1984	NwUQjSP.exe
4032	SaXpTFi.exe
2084	ZfIJLTK.exe
4528	MxvwklR.exe
3524	OUvlsCc.exe
2332	xWQyNZB.exe
2752	uCfzZnC.exe
3204	PNBIcCM.exe
3220	WkJcDCW.exe
2504	VYUPdMM.exe
3692	LqjHCHK.exe
3092	oUJxwei.exe
2008	CNhFHlM.exe
2780	rcYGyJN.exe
1484	gAkmKQl.exe
1988	zpZHWne.exe
5076	MwyYHnw.exe
2396	JjUnBCF.exe
4052	XVyhhdh.exe
2472	nSnRuEQ.exe
1708	JipiYBO.exe
4872	rpCpTTQ.exe
3084	JyviGdW.exe
632	CDnowny.exe
2672	KRFthnV.exe
4204	hzIZMuA.exe
3616	fSWxgCD.exe
4312	irXXQHv.exe
4532	AdNJMJn.exe
2636	VdTAKjc.exe
4468	KAtPqkM.exe
3496	CjBpRYg.exe
4704	EgjGiAF.exe
1404	uekHabV.exe
4104	iGBlFUH.exe
1328	zJLafQh.exe
2380	JuzMpTx.exe
4264	lLPXdKf.exe
4124	RqHLtFG.exe
4996	DJluBUL.exe
3004	CtnlLJH.exe
1884	tzmuoeE.exe
1752	EFSeXwd.exe
1824	zNhnItv.exe
4876	WDliOqw.exe
4812	rYJFEBv.exe
3740	uqtLBfa.exe
3272	ajhigfQ.exe
4252	lAfFcLq.exe
2644	vBJTvEr.exe
4348	CxlSCYk.exe
4584	BGGQuYs.exe
4392	eMOzTLb.exe
4744	gCGDEQs.exe
3968	oQxIKaN.exe
4260	LTxvkpB.exe
3876	ZRSJMoF.exe
4700	kTaTptY.exe
2316	SEGPgim.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SPDvkmr.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\DrjPIDE.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\gYWdMjy.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\jFcyRFn.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\ZfIJLTK.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\tzmuoeE.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\uAKSyYn.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\WkJBGcc.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\yfpTrcK.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\LJwsliI.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\dmckuXf.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\ZYDYzNe.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\bSvLDGG.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\uzaqsYF.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\VICcMzC.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\uUZYJmL.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\ajWjtEa.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\atbYlTz.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\FhdBmAG.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\iRfELbP.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\LxUipJN.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\cUxXqTQ.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\ToHzLDN.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\FQjUDuU.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\tQqIBpO.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\FHZYQoq.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\eLuXCvl.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\nEjmCqH.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\slboyma.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\xWQyNZB.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\wGbkrov.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\rsJHHjw.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\hJudCNd.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\OLmmPia.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\RzmHYoK.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\HGCIheb.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\lqsmOFc.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\VqNLJRE.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\ygQScVu.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\PcFolMF.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\IYRiPfB.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\xXcjkSG.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\TcfarQJ.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\bQvyZaA.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\gwoSIpS.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\djCKFyr.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\VpRDgNN.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\iCCAUcr.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\oTUXOlp.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\UNfhJjK.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\JRfaJrC.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\zzmidGX.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\DhrRFxB.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\GOddVyz.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\SaXpTFi.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\TOecPqC.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\zNdRcGU.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\DpHKqgZ.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\DbDrDMg.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\EcrLyFP.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\IHmnjhI.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\UUycTyg.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\zEmpTOQ.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
File created	C:\Windows\System\pFvdzKq.exe	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 2640	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	84
PID 3080 wrote to memory of 2640	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	84
PID 3080 wrote to memory of 2840	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	85
PID 3080 wrote to memory of 2840	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	85
PID 3080 wrote to memory of 1608	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	86
PID 3080 wrote to memory of 1608	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	86
PID 3080 wrote to memory of 4952	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	87
PID 3080 wrote to memory of 4952	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	87
PID 3080 wrote to memory of 1140	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	88
PID 3080 wrote to memory of 1140	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	88
PID 3080 wrote to memory of 1984	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	89
PID 3080 wrote to memory of 1984	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	89
PID 3080 wrote to memory of 4528	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	90
PID 3080 wrote to memory of 4528	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	90
PID 3080 wrote to memory of 4032	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	91
PID 3080 wrote to memory of 4032	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	91
PID 3080 wrote to memory of 2084	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	92
PID 3080 wrote to memory of 2084	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	92
PID 3080 wrote to memory of 3524	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	93
PID 3080 wrote to memory of 3524	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	93
PID 3080 wrote to memory of 2332	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	94
PID 3080 wrote to memory of 2332	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	94
PID 3080 wrote to memory of 2752	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	95
PID 3080 wrote to memory of 2752	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	95
PID 3080 wrote to memory of 3204	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	96
PID 3080 wrote to memory of 3204	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	96
PID 3080 wrote to memory of 3220	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	97
PID 3080 wrote to memory of 3220	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	97
PID 3080 wrote to memory of 2504	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	98
PID 3080 wrote to memory of 2504	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	98
PID 3080 wrote to memory of 3692	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	99
PID 3080 wrote to memory of 3692	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	99
PID 3080 wrote to memory of 3092	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	100
PID 3080 wrote to memory of 3092	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	100
PID 3080 wrote to memory of 2008	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	101
PID 3080 wrote to memory of 2008	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	101
PID 3080 wrote to memory of 2472	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	102
PID 3080 wrote to memory of 2472	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	102
PID 3080 wrote to memory of 2780	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	103
PID 3080 wrote to memory of 2780	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	103
PID 3080 wrote to memory of 1484	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	104
PID 3080 wrote to memory of 1484	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	104
PID 3080 wrote to memory of 1988	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	105
PID 3080 wrote to memory of 1988	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	105
PID 3080 wrote to memory of 5076	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	106
PID 3080 wrote to memory of 5076	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	106
PID 3080 wrote to memory of 2396	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	107
PID 3080 wrote to memory of 2396	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	107
PID 3080 wrote to memory of 4052	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	108
PID 3080 wrote to memory of 4052	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	108
PID 3080 wrote to memory of 1708	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	109
PID 3080 wrote to memory of 1708	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	109
PID 3080 wrote to memory of 4872	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	110
PID 3080 wrote to memory of 4872	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	110
PID 3080 wrote to memory of 3084	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	111
PID 3080 wrote to memory of 3084	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	111
PID 3080 wrote to memory of 632	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	112
PID 3080 wrote to memory of 632	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	112
PID 3080 wrote to memory of 2672	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	113
PID 3080 wrote to memory of 2672	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	113
PID 3080 wrote to memory of 4204	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	114
PID 3080 wrote to memory of 4204	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	114
PID 3080 wrote to memory of 3616	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	115
PID 3080 wrote to memory of 3616	3080	a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe	115

C:\Users\Admin\AppData\Local\Temp\a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe
"C:\Users\Admin\AppData\Local\Temp\a71b4d49056ae3609752b6256a2ce373ba9c9c0f639bf98dbb72b93d3bfb6358.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\System\BtFsnei.exe
  C:\Windows\System\BtFsnei.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\rVGewae.exe
  C:\Windows\System\rVGewae.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\ZPWKIxd.exe
  C:\Windows\System\ZPWKIxd.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\bSvLDGG.exe
  C:\Windows\System\bSvLDGG.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\xemeYKK.exe
  C:\Windows\System\xemeYKK.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\NwUQjSP.exe
  C:\Windows\System\NwUQjSP.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\MxvwklR.exe
  C:\Windows\System\MxvwklR.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\SaXpTFi.exe
  C:\Windows\System\SaXpTFi.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\ZfIJLTK.exe
  C:\Windows\System\ZfIJLTK.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\OUvlsCc.exe
  C:\Windows\System\OUvlsCc.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\xWQyNZB.exe
  C:\Windows\System\xWQyNZB.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\uCfzZnC.exe
  C:\Windows\System\uCfzZnC.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\PNBIcCM.exe
  C:\Windows\System\PNBIcCM.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\WkJcDCW.exe
  C:\Windows\System\WkJcDCW.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\VYUPdMM.exe
  C:\Windows\System\VYUPdMM.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\LqjHCHK.exe
  C:\Windows\System\LqjHCHK.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\oUJxwei.exe
  C:\Windows\System\oUJxwei.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\CNhFHlM.exe
  C:\Windows\System\CNhFHlM.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\nSnRuEQ.exe
  C:\Windows\System\nSnRuEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\rcYGyJN.exe
  C:\Windows\System\rcYGyJN.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\gAkmKQl.exe
  C:\Windows\System\gAkmKQl.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\zpZHWne.exe
  C:\Windows\System\zpZHWne.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\MwyYHnw.exe
  C:\Windows\System\MwyYHnw.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\JjUnBCF.exe
  C:\Windows\System\JjUnBCF.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\XVyhhdh.exe
  C:\Windows\System\XVyhhdh.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\JipiYBO.exe
  C:\Windows\System\JipiYBO.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\rpCpTTQ.exe
  C:\Windows\System\rpCpTTQ.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\JyviGdW.exe
  C:\Windows\System\JyviGdW.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\CDnowny.exe
  C:\Windows\System\CDnowny.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\KRFthnV.exe
  C:\Windows\System\KRFthnV.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\hzIZMuA.exe
  C:\Windows\System\hzIZMuA.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\fSWxgCD.exe
  C:\Windows\System\fSWxgCD.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\irXXQHv.exe
  C:\Windows\System\irXXQHv.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\AdNJMJn.exe
  C:\Windows\System\AdNJMJn.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\VdTAKjc.exe
  C:\Windows\System\VdTAKjc.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\KAtPqkM.exe
  C:\Windows\System\KAtPqkM.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\CjBpRYg.exe
  C:\Windows\System\CjBpRYg.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\EgjGiAF.exe
  C:\Windows\System\EgjGiAF.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\uekHabV.exe
  C:\Windows\System\uekHabV.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\RqHLtFG.exe
  C:\Windows\System\RqHLtFG.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\iGBlFUH.exe
  C:\Windows\System\iGBlFUH.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\zJLafQh.exe
  C:\Windows\System\zJLafQh.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\JuzMpTx.exe
  C:\Windows\System\JuzMpTx.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\lLPXdKf.exe
  C:\Windows\System\lLPXdKf.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\tzmuoeE.exe
  C:\Windows\System\tzmuoeE.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\DJluBUL.exe
  C:\Windows\System\DJluBUL.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\CtnlLJH.exe
  C:\Windows\System\CtnlLJH.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\EFSeXwd.exe
  C:\Windows\System\EFSeXwd.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\zNhnItv.exe
  C:\Windows\System\zNhnItv.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\WDliOqw.exe
  C:\Windows\System\WDliOqw.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\rYJFEBv.exe
  C:\Windows\System\rYJFEBv.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\uqtLBfa.exe
  C:\Windows\System\uqtLBfa.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\ajhigfQ.exe
  C:\Windows\System\ajhigfQ.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\lAfFcLq.exe
  C:\Windows\System\lAfFcLq.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\vBJTvEr.exe
  C:\Windows\System\vBJTvEr.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\CxlSCYk.exe
  C:\Windows\System\CxlSCYk.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\BGGQuYs.exe
  C:\Windows\System\BGGQuYs.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\eMOzTLb.exe
  C:\Windows\System\eMOzTLb.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\gCGDEQs.exe
  C:\Windows\System\gCGDEQs.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\oQxIKaN.exe
  C:\Windows\System\oQxIKaN.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\LTxvkpB.exe
  C:\Windows\System\LTxvkpB.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\ZRSJMoF.exe
  C:\Windows\System\ZRSJMoF.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\kTaTptY.exe
  C:\Windows\System\kTaTptY.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\MfghGgK.exe
  C:\Windows\System\MfghGgK.exe
  2⤵
  PID:4476
- C:\Windows\System\SEGPgim.exe
  C:\Windows\System\SEGPgim.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\grfsHxg.exe
  C:\Windows\System\grfsHxg.exe
  2⤵
  PID:2096
- C:\Windows\System\IWCuPqO.exe
  C:\Windows\System\IWCuPqO.exe
  2⤵
  PID:1076
- C:\Windows\System\gtlgFUi.exe
  C:\Windows\System\gtlgFUi.exe
  2⤵
  PID:4148
- C:\Windows\System\VqNLJRE.exe
  C:\Windows\System\VqNLJRE.exe
  2⤵
  PID:4400
- C:\Windows\System\efUWobD.exe
  C:\Windows\System\efUWobD.exe
  2⤵
  PID:2976
- C:\Windows\System\qhrywhu.exe
  C:\Windows\System\qhrywhu.exe
  2⤵
  PID:1716
- C:\Windows\System\libfQAP.exe
  C:\Windows\System\libfQAP.exe
  2⤵
  PID:3840
- C:\Windows\System\wuhzMVo.exe
  C:\Windows\System\wuhzMVo.exe
  2⤵
  PID:2296
- C:\Windows\System\VRSjmvT.exe
  C:\Windows\System\VRSjmvT.exe
  2⤵
  PID:640
- C:\Windows\System\AUcKIno.exe
  C:\Windows\System\AUcKIno.exe
  2⤵
  PID:1620
- C:\Windows\System\TBHvAba.exe
  C:\Windows\System\TBHvAba.exe
  2⤵
  PID:848
- C:\Windows\System\SPDvkmr.exe
  C:\Windows\System\SPDvkmr.exe
  2⤵
  PID:208
- C:\Windows\System\RWpbGdY.exe
  C:\Windows\System\RWpbGdY.exe
  2⤵
  PID:4384
- C:\Windows\System\TfjiSlS.exe
  C:\Windows\System\TfjiSlS.exe
  2⤵
  PID:2676
- C:\Windows\System\IPiHFyI.exe
  C:\Windows\System\IPiHFyI.exe
  2⤵
  PID:4456
- C:\Windows\System\AIpmGsF.exe
  C:\Windows\System\AIpmGsF.exe
  2⤵
  PID:2492
- C:\Windows\System\fVpkrBO.exe
  C:\Windows\System\fVpkrBO.exe
  2⤵
  PID:4060
- C:\Windows\System\kaMgwAn.exe
  C:\Windows\System\kaMgwAn.exe
  2⤵
  PID:1624
- C:\Windows\System\WKPYacz.exe
  C:\Windows\System\WKPYacz.exe
  2⤵
  PID:3784
- C:\Windows\System\oBRTWju.exe
  C:\Windows\System\oBRTWju.exe
  2⤵
  PID:3448
- C:\Windows\System\owlXbmO.exe
  C:\Windows\System\owlXbmO.exe
  2⤵
  PID:2012
- C:\Windows\System\qevlEAG.exe
  C:\Windows\System\qevlEAG.exe
  2⤵
  PID:392
- C:\Windows\System\fCxGCua.exe
  C:\Windows\System\fCxGCua.exe
  2⤵
  PID:3364
- C:\Windows\System\DBHPDIU.exe
  C:\Windows\System\DBHPDIU.exe
  2⤵
  PID:4368
- C:\Windows\System\yPxjsBW.exe
  C:\Windows\System\yPxjsBW.exe
  2⤵
  PID:2348
- C:\Windows\System\YybLBrR.exe
  C:\Windows\System\YybLBrR.exe
  2⤵
  PID:2224
- C:\Windows\System\fmPdeNo.exe
  C:\Windows\System\fmPdeNo.exe
  2⤵
  PID:396
- C:\Windows\System\yHgEdsy.exe
  C:\Windows\System\yHgEdsy.exe
  2⤵
  PID:1876
- C:\Windows\System\uUZYJmL.exe
  C:\Windows\System\uUZYJmL.exe
  2⤵
  PID:2604
- C:\Windows\System\OmqrJGu.exe
  C:\Windows\System\OmqrJGu.exe
  2⤵
  PID:3064
- C:\Windows\System\HdDMfZL.exe
  C:\Windows\System\HdDMfZL.exe
  2⤵
  PID:4840
- C:\Windows\System\wZLxAuo.exe
  C:\Windows\System\wZLxAuo.exe
  2⤵
  PID:2300
- C:\Windows\System\fTXvKMw.exe
  C:\Windows\System\fTXvKMw.exe
  2⤵
  PID:5004
- C:\Windows\System\bcBYIQX.exe
  C:\Windows\System\bcBYIQX.exe
  2⤵
  PID:888
- C:\Windows\System\NKPfTFu.exe
  C:\Windows\System\NKPfTFu.exe
  2⤵
  PID:3672
- C:\Windows\System\bpDQwtb.exe
  C:\Windows\System\bpDQwtb.exe
  2⤵
  PID:988
- C:\Windows\System\btgfOMr.exe
  C:\Windows\System\btgfOMr.exe
  2⤵
  PID:1784
- C:\Windows\System\THbyrJS.exe
  C:\Windows\System\THbyrJS.exe
  2⤵
  PID:1340
- C:\Windows\System\WSRZFlV.exe
  C:\Windows\System\WSRZFlV.exe
  2⤵
  PID:1080
- C:\Windows\System\pKgkSNd.exe
  C:\Windows\System\pKgkSNd.exe
  2⤵
  PID:4364
- C:\Windows\System\cvxSbEQ.exe
  C:\Windows\System\cvxSbEQ.exe
  2⤵
  PID:2944
- C:\Windows\System\VeLiOog.exe
  C:\Windows\System\VeLiOog.exe
  2⤵
  PID:4804
- C:\Windows\System\nmtvpMf.exe
  C:\Windows\System\nmtvpMf.exe
  2⤵
  PID:3148
- C:\Windows\System\DoJNMqe.exe
  C:\Windows\System\DoJNMqe.exe
  2⤵
  PID:1932
- C:\Windows\System\uzLfVQU.exe
  C:\Windows\System\uzLfVQU.exe
  2⤵
  PID:856
- C:\Windows\System\VOHXmiy.exe
  C:\Windows\System\VOHXmiy.exe
  2⤵
  PID:628
- C:\Windows\System\NrckEBT.exe
  C:\Windows\System\NrckEBT.exe
  2⤵
  PID:2972
- C:\Windows\System\aDxkdDM.exe
  C:\Windows\System\aDxkdDM.exe
  2⤵
  PID:2804
- C:\Windows\System\uDqBtGl.exe
  C:\Windows\System\uDqBtGl.exe
  2⤵
  PID:1064
- C:\Windows\System\LIABamg.exe
  C:\Windows\System\LIABamg.exe
  2⤵
  PID:2196
- C:\Windows\System\rXhIUZp.exe
  C:\Windows\System\rXhIUZp.exe
  2⤵
  PID:5140
- C:\Windows\System\eqJJWVt.exe
  C:\Windows\System\eqJJWVt.exe
  2⤵
  PID:5176
- C:\Windows\System\wyPggxL.exe
  C:\Windows\System\wyPggxL.exe
  2⤵
  PID:5200
- C:\Windows\System\NfgaBSw.exe
  C:\Windows\System\NfgaBSw.exe
  2⤵
  PID:5224
- C:\Windows\System\IQrlnlP.exe
  C:\Windows\System\IQrlnlP.exe
  2⤵
  PID:5260
- C:\Windows\System\IDlmhIu.exe
  C:\Windows\System\IDlmhIu.exe
  2⤵
  PID:5284
- C:\Windows\System\UCZeBNz.exe
  C:\Windows\System\UCZeBNz.exe
  2⤵
  PID:5308
- C:\Windows\System\FJODDEB.exe
  C:\Windows\System\FJODDEB.exe
  2⤵
  PID:5324
- C:\Windows\System\aBohmgK.exe
  C:\Windows\System\aBohmgK.exe
  2⤵
  PID:5356
- C:\Windows\System\yHQUtaY.exe
  C:\Windows\System\yHQUtaY.exe
  2⤵
  PID:5396
- C:\Windows\System\lNZJJUb.exe
  C:\Windows\System\lNZJJUb.exe
  2⤵
  PID:5424
- C:\Windows\System\QUcctZb.exe
  C:\Windows\System\QUcctZb.exe
  2⤵
  PID:5460
- C:\Windows\System\BbEnLmT.exe
  C:\Windows\System\BbEnLmT.exe
  2⤵
  PID:5488
- C:\Windows\System\OZjMUgh.exe
  C:\Windows\System\OZjMUgh.exe
  2⤵
  PID:5528
- C:\Windows\System\uAKSyYn.exe
  C:\Windows\System\uAKSyYn.exe
  2⤵
  PID:5548
- C:\Windows\System\ZZZetbv.exe
  C:\Windows\System\ZZZetbv.exe
  2⤵
  PID:5576
- C:\Windows\System\NaYbsBh.exe
  C:\Windows\System\NaYbsBh.exe
  2⤵
  PID:5596
- C:\Windows\System\fhigZZz.exe
  C:\Windows\System\fhigZZz.exe
  2⤵
  PID:5628
- C:\Windows\System\PLmxnWC.exe
  C:\Windows\System\PLmxnWC.exe
  2⤵
  PID:5656
- C:\Windows\System\DXJSpVa.exe
  C:\Windows\System\DXJSpVa.exe
  2⤵
  PID:5688
- C:\Windows\System\peHlAYF.exe
  C:\Windows\System\peHlAYF.exe
  2⤵
  PID:5708
- C:\Windows\System\jCyzWba.exe
  C:\Windows\System\jCyzWba.exe
  2⤵
  PID:5740
- C:\Windows\System\ygQScVu.exe
  C:\Windows\System\ygQScVu.exe
  2⤵
  PID:5772
- C:\Windows\System\llXhHXz.exe
  C:\Windows\System\llXhHXz.exe
  2⤵
  PID:5796
- C:\Windows\System\gmUdAml.exe
  C:\Windows\System\gmUdAml.exe
  2⤵
  PID:5828
- C:\Windows\System\sjHXEfw.exe
  C:\Windows\System\sjHXEfw.exe
  2⤵
  PID:5844
- C:\Windows\System\IZBVnjI.exe
  C:\Windows\System\IZBVnjI.exe
  2⤵
  PID:5880
- C:\Windows\System\pumLIiD.exe
  C:\Windows\System\pumLIiD.exe
  2⤵
  PID:5908
- C:\Windows\System\bvvGgBa.exe
  C:\Windows\System\bvvGgBa.exe
  2⤵
  PID:5940
- C:\Windows\System\QMJCmao.exe
  C:\Windows\System\QMJCmao.exe
  2⤵
  PID:5968
- C:\Windows\System\WdgwSWF.exe
  C:\Windows\System\WdgwSWF.exe
  2⤵
  PID:6004
- C:\Windows\System\vCZXxhe.exe
  C:\Windows\System\vCZXxhe.exe
  2⤵
  PID:6024
- C:\Windows\System\QtDoQdg.exe
  C:\Windows\System\QtDoQdg.exe
  2⤵
  PID:6040
- C:\Windows\System\BuFkWQF.exe
  C:\Windows\System\BuFkWQF.exe
  2⤵
  PID:6068
- C:\Windows\System\VAFRCYF.exe
  C:\Windows\System\VAFRCYF.exe
  2⤵
  PID:6092
- C:\Windows\System\EtptLfv.exe
  C:\Windows\System\EtptLfv.exe
  2⤵
  PID:6124
- C:\Windows\System\IooxrTE.exe
  C:\Windows\System\IooxrTE.exe
  2⤵
  PID:2432
- C:\Windows\System\brFeOtC.exe
  C:\Windows\System\brFeOtC.exe
  2⤵
  PID:5188
- C:\Windows\System\VGLrgpj.exe
  C:\Windows\System\VGLrgpj.exe
  2⤵
  PID:5300
- C:\Windows\System\TXixixN.exe
  C:\Windows\System\TXixixN.exe
  2⤵
  PID:5332
- C:\Windows\System\hcEnTxf.exe
  C:\Windows\System\hcEnTxf.exe
  2⤵
  PID:5372
- C:\Windows\System\UTEdiGa.exe
  C:\Windows\System\UTEdiGa.exe
  2⤵
  PID:5440
- C:\Windows\System\isqBnHs.exe
  C:\Windows\System\isqBnHs.exe
  2⤵
  PID:5516
- C:\Windows\System\sWBzMmm.exe
  C:\Windows\System\sWBzMmm.exe
  2⤵
  PID:5616
- C:\Windows\System\NDzYSJg.exe
  C:\Windows\System\NDzYSJg.exe
  2⤵
  PID:5644
- C:\Windows\System\WkJBGcc.exe
  C:\Windows\System\WkJBGcc.exe
  2⤵
  PID:5724
- C:\Windows\System\wfXeVoh.exe
  C:\Windows\System\wfXeVoh.exe
  2⤵
  PID:5768
- C:\Windows\System\frFQCvS.exe
  C:\Windows\System\frFQCvS.exe
  2⤵
  PID:5816
- C:\Windows\System\LufBJKj.exe
  C:\Windows\System\LufBJKj.exe
  2⤵
  PID:5868
- C:\Windows\System\VJrDasm.exe
  C:\Windows\System\VJrDasm.exe
  2⤵
  PID:5928
- C:\Windows\System\KYCKPLr.exe
  C:\Windows\System\KYCKPLr.exe
  2⤵
  PID:5964
- C:\Windows\System\EhzLiat.exe
  C:\Windows\System\EhzLiat.exe
  2⤵
  PID:6036
- C:\Windows\System\VpRDgNN.exe
  C:\Windows\System\VpRDgNN.exe
  2⤵
  PID:6060
- C:\Windows\System\IPYFqEC.exe
  C:\Windows\System\IPYFqEC.exe
  2⤵
  PID:6108
- C:\Windows\System\mFSjaEw.exe
  C:\Windows\System\mFSjaEw.exe
  2⤵
  PID:5156
- C:\Windows\System\TZdEXyk.exe
  C:\Windows\System\TZdEXyk.exe
  2⤵
  PID:5320
- C:\Windows\System\krEqyNd.exe
  C:\Windows\System\krEqyNd.exe
  2⤵
  PID:5416
- C:\Windows\System\PUfBsDh.exe
  C:\Windows\System\PUfBsDh.exe
  2⤵
  PID:5536
- C:\Windows\System\hDetisY.exe
  C:\Windows\System\hDetisY.exe
  2⤵
  PID:5636
- C:\Windows\System\ZMbfsmQ.exe
  C:\Windows\System\ZMbfsmQ.exe
  2⤵
  PID:5860
- C:\Windows\System\lptiInR.exe
  C:\Windows\System\lptiInR.exe
  2⤵
  PID:5988
- C:\Windows\System\nrxPAgs.exe
  C:\Windows\System\nrxPAgs.exe
  2⤵
  PID:5152
- C:\Windows\System\TymIFkW.exe
  C:\Windows\System\TymIFkW.exe
  2⤵
  PID:5436
- C:\Windows\System\hPyEGnx.exe
  C:\Windows\System\hPyEGnx.exe
  2⤵
  PID:5476
- C:\Windows\System\fEpPVKT.exe
  C:\Windows\System\fEpPVKT.exe
  2⤵
  PID:6176
- C:\Windows\System\YNRUgUw.exe
  C:\Windows\System\YNRUgUw.exe
  2⤵
  PID:6208
- C:\Windows\System\rQIZGvf.exe
  C:\Windows\System\rQIZGvf.exe
  2⤵
  PID:6224
- C:\Windows\System\HrMDxbY.exe
  C:\Windows\System\HrMDxbY.exe
  2⤵
  PID:6256
- C:\Windows\System\DWjsrqI.exe
  C:\Windows\System\DWjsrqI.exe
  2⤵
  PID:6284
- C:\Windows\System\IBpnqTY.exe
  C:\Windows\System\IBpnqTY.exe
  2⤵
  PID:6368
- C:\Windows\System\wXXEqsI.exe
  C:\Windows\System\wXXEqsI.exe
  2⤵
  PID:6392
- C:\Windows\System\poBzNse.exe
  C:\Windows\System\poBzNse.exe
  2⤵
  PID:6420
- C:\Windows\System\wXDnUkV.exe
  C:\Windows\System\wXDnUkV.exe
  2⤵
  PID:6440
- C:\Windows\System\buBoZtu.exe
  C:\Windows\System\buBoZtu.exe
  2⤵
  PID:6460
- C:\Windows\System\BSYHUHo.exe
  C:\Windows\System\BSYHUHo.exe
  2⤵
  PID:6488
- C:\Windows\System\DbDrDMg.exe
  C:\Windows\System\DbDrDMg.exe
  2⤵
  PID:6520
- C:\Windows\System\MXkIPkU.exe
  C:\Windows\System\MXkIPkU.exe
  2⤵
  PID:6540
- C:\Windows\System\OGJjReS.exe
  C:\Windows\System\OGJjReS.exe
  2⤵
  PID:6564
- C:\Windows\System\qEzdsRq.exe
  C:\Windows\System\qEzdsRq.exe
  2⤵
  PID:6592
- C:\Windows\System\LGLmLet.exe
  C:\Windows\System\LGLmLet.exe
  2⤵
  PID:6612
- C:\Windows\System\VIzlRJH.exe
  C:\Windows\System\VIzlRJH.exe
  2⤵
  PID:6628
- C:\Windows\System\ODqJRKv.exe
  C:\Windows\System\ODqJRKv.exe
  2⤵
  PID:6648
- C:\Windows\System\EAkbDRo.exe
  C:\Windows\System\EAkbDRo.exe
  2⤵
  PID:6664
- C:\Windows\System\fefdpnl.exe
  C:\Windows\System\fefdpnl.exe
  2⤵
  PID:6688
- C:\Windows\System\uoQDXBz.exe
  C:\Windows\System\uoQDXBz.exe
  2⤵
  PID:6712
- C:\Windows\System\hgQlOQG.exe
  C:\Windows\System\hgQlOQG.exe
  2⤵
  PID:6732
- C:\Windows\System\tsotWcy.exe
  C:\Windows\System\tsotWcy.exe
  2⤵
  PID:6760
- C:\Windows\System\oVVxukP.exe
  C:\Windows\System\oVVxukP.exe
  2⤵
  PID:6776
- C:\Windows\System\FPFBqJz.exe
  C:\Windows\System\FPFBqJz.exe
  2⤵
  PID:6792
- C:\Windows\System\uzaqsYF.exe
  C:\Windows\System\uzaqsYF.exe
  2⤵
  PID:6816
- C:\Windows\System\atbYlTz.exe
  C:\Windows\System\atbYlTz.exe
  2⤵
  PID:6840
- C:\Windows\System\CLrHdaK.exe
  C:\Windows\System\CLrHdaK.exe
  2⤵
  PID:6864
- C:\Windows\System\PiDSyKF.exe
  C:\Windows\System\PiDSyKF.exe
  2⤵
  PID:6888
- C:\Windows\System\vyOvjyl.exe
  C:\Windows\System\vyOvjyl.exe
  2⤵
  PID:6912
- C:\Windows\System\qUtbtgc.exe
  C:\Windows\System\qUtbtgc.exe
  2⤵
  PID:6936
- C:\Windows\System\UwIiCfy.exe
  C:\Windows\System\UwIiCfy.exe
  2⤵
  PID:6960
- C:\Windows\System\vhDyQuT.exe
  C:\Windows\System\vhDyQuT.exe
  2⤵
  PID:6988
- C:\Windows\System\gucVOFT.exe
  C:\Windows\System\gucVOFT.exe
  2⤵
  PID:7008
- C:\Windows\System\KmGRvaW.exe
  C:\Windows\System\KmGRvaW.exe
  2⤵
  PID:7032
- C:\Windows\System\BNDTgFy.exe
  C:\Windows\System\BNDTgFy.exe
  2⤵
  PID:7060
- C:\Windows\System\yxBknqm.exe
  C:\Windows\System\yxBknqm.exe
  2⤵
  PID:7084
- C:\Windows\System\aybUoaH.exe
  C:\Windows\System\aybUoaH.exe
  2⤵
  PID:7104
- C:\Windows\System\tVoYDms.exe
  C:\Windows\System\tVoYDms.exe
  2⤵
  PID:7132
- C:\Windows\System\rvATWcv.exe
  C:\Windows\System\rvATWcv.exe
  2⤵
  PID:7152
- C:\Windows\System\TfxKaTm.exe
  C:\Windows\System\TfxKaTm.exe
  2⤵
  PID:5992
- C:\Windows\System\PyzynpU.exe
  C:\Windows\System\PyzynpU.exe
  2⤵
  PID:6132
- C:\Windows\System\CyHlXgo.exe
  C:\Windows\System\CyHlXgo.exe
  2⤵
  PID:6236
- C:\Windows\System\ZLQRFgx.exe
  C:\Windows\System\ZLQRFgx.exe
  2⤵
  PID:6272
- C:\Windows\System\VICcMzC.exe
  C:\Windows\System\VICcMzC.exe
  2⤵
  PID:6312
- C:\Windows\System\EcrLyFP.exe
  C:\Windows\System\EcrLyFP.exe
  2⤵
  PID:6388
- C:\Windows\System\TOecPqC.exe
  C:\Windows\System\TOecPqC.exe
  2⤵
  PID:6436
- C:\Windows\System\EwzMwyq.exe
  C:\Windows\System\EwzMwyq.exe
  2⤵
  PID:6552
- C:\Windows\System\eiWmpJC.exe
  C:\Windows\System\eiWmpJC.exe
  2⤵
  PID:6560
- C:\Windows\System\pFSivTC.exe
  C:\Windows\System\pFSivTC.exe
  2⤵
  PID:6576
- C:\Windows\System\hEMaWNG.exe
  C:\Windows\System\hEMaWNG.exe
  2⤵
  PID:6624
- C:\Windows\System\sdUHGWn.exe
  C:\Windows\System\sdUHGWn.exe
  2⤵
  PID:6748
- C:\Windows\System\xHIVATO.exe
  C:\Windows\System\xHIVATO.exe
  2⤵
  PID:6640
- C:\Windows\System\aVwQiSR.exe
  C:\Windows\System\aVwQiSR.exe
  2⤵
  PID:6876
- C:\Windows\System\plFvGCN.exe
  C:\Windows\System\plFvGCN.exe
  2⤵
  PID:6944
- C:\Windows\System\LmiOThJ.exe
  C:\Windows\System\LmiOThJ.exe
  2⤵
  PID:6996
- C:\Windows\System\ktLTIdb.exe
  C:\Windows\System\ktLTIdb.exe
  2⤵
  PID:7072
- C:\Windows\System\FQjUDuU.exe
  C:\Windows\System\FQjUDuU.exe
  2⤵
  PID:7124
- C:\Windows\System\zzmidGX.exe
  C:\Windows\System\zzmidGX.exe
  2⤵
  PID:5364
- C:\Windows\System\gfjCPFJ.exe
  C:\Windows\System\gfjCPFJ.exe
  2⤵
  PID:7092
- C:\Windows\System\mKQXIXE.exe
  C:\Windows\System\mKQXIXE.exe
  2⤵
  PID:7028
- C:\Windows\System\RzmHYoK.exe
  C:\Windows\System\RzmHYoK.exe
  2⤵
  PID:6504
- C:\Windows\System\eJZokPX.exe
  C:\Windows\System\eJZokPX.exe
  2⤵
  PID:6380
- C:\Windows\System\IliDrSY.exe
  C:\Windows\System\IliDrSY.exe
  2⤵
  PID:5368
- C:\Windows\System\jzGoPyc.exe
  C:\Windows\System\jzGoPyc.exe
  2⤵
  PID:6280
- C:\Windows\System\kSyLhnr.exe
  C:\Windows\System\kSyLhnr.exe
  2⤵
  PID:6408
- C:\Windows\System\GoJNBsS.exe
  C:\Windows\System\GoJNBsS.exe
  2⤵
  PID:7184
- C:\Windows\System\QTxGPXz.exe
  C:\Windows\System\QTxGPXz.exe
  2⤵
  PID:7212
- C:\Windows\System\IHmnjhI.exe
  C:\Windows\System\IHmnjhI.exe
  2⤵
  PID:7240
- C:\Windows\System\vFiSYJM.exe
  C:\Windows\System\vFiSYJM.exe
  2⤵
  PID:7264
- C:\Windows\System\RQXzXEy.exe
  C:\Windows\System\RQXzXEy.exe
  2⤵
  PID:7288
- C:\Windows\System\WyfbMCk.exe
  C:\Windows\System\WyfbMCk.exe
  2⤵
  PID:7316
- C:\Windows\System\iCCAUcr.exe
  C:\Windows\System\iCCAUcr.exe
  2⤵
  PID:7340
- C:\Windows\System\FhdBmAG.exe
  C:\Windows\System\FhdBmAG.exe
  2⤵
  PID:7368
- C:\Windows\System\AwAjwpb.exe
  C:\Windows\System\AwAjwpb.exe
  2⤵
  PID:7396
- C:\Windows\System\yurQOyo.exe
  C:\Windows\System\yurQOyo.exe
  2⤵
  PID:7424
- C:\Windows\System\YByWzIG.exe
  C:\Windows\System\YByWzIG.exe
  2⤵
  PID:7448
- C:\Windows\System\BZPNzDu.exe
  C:\Windows\System\BZPNzDu.exe
  2⤵
  PID:7472
- C:\Windows\System\znwjezG.exe
  C:\Windows\System\znwjezG.exe
  2⤵
  PID:7500
- C:\Windows\System\vXjOleT.exe
  C:\Windows\System\vXjOleT.exe
  2⤵
  PID:7528
- C:\Windows\System\JHHkoAj.exe
  C:\Windows\System\JHHkoAj.exe
  2⤵
  PID:7556
- C:\Windows\System\bsMmFQT.exe
  C:\Windows\System\bsMmFQT.exe
  2⤵
  PID:7576
- C:\Windows\System\RjqzhLk.exe
  C:\Windows\System\RjqzhLk.exe
  2⤵
  PID:7600
- C:\Windows\System\LuBdKxG.exe
  C:\Windows\System\LuBdKxG.exe
  2⤵
  PID:7628
- C:\Windows\System\aulxKLy.exe
  C:\Windows\System\aulxKLy.exe
  2⤵
  PID:7648
- C:\Windows\System\HiftXMc.exe
  C:\Windows\System\HiftXMc.exe
  2⤵
  PID:7672
- C:\Windows\System\aefTHBP.exe
  C:\Windows\System\aefTHBP.exe
  2⤵
  PID:7696
- C:\Windows\System\YFRJIaQ.exe
  C:\Windows\System\YFRJIaQ.exe
  2⤵
  PID:7724
- C:\Windows\System\ZKbfVPg.exe
  C:\Windows\System\ZKbfVPg.exe
  2⤵
  PID:7748
- C:\Windows\System\HyYePza.exe
  C:\Windows\System\HyYePza.exe
  2⤵
  PID:7772
- C:\Windows\System\AmgmRHt.exe
  C:\Windows\System\AmgmRHt.exe
  2⤵
  PID:7800
- C:\Windows\System\jVMELhc.exe
  C:\Windows\System\jVMELhc.exe
  2⤵
  PID:7824
- C:\Windows\System\xIZWAUI.exe
  C:\Windows\System\xIZWAUI.exe
  2⤵
  PID:7844
- C:\Windows\System\fpPTaWZ.exe
  C:\Windows\System\fpPTaWZ.exe
  2⤵
  PID:7872
- C:\Windows\System\kppXAPQ.exe
  C:\Windows\System\kppXAPQ.exe
  2⤵
  PID:7896
- C:\Windows\System\uuSGKDX.exe
  C:\Windows\System\uuSGKDX.exe
  2⤵
  PID:7920
- C:\Windows\System\dnEmNaF.exe
  C:\Windows\System\dnEmNaF.exe
  2⤵
  PID:7940
- C:\Windows\System\UxVKRDD.exe
  C:\Windows\System\UxVKRDD.exe
  2⤵
  PID:7976
- C:\Windows\System\qMosdyW.exe
  C:\Windows\System\qMosdyW.exe
  2⤵
  PID:7992
- C:\Windows\System\KiWvCLE.exe
  C:\Windows\System\KiWvCLE.exe
  2⤵
  PID:8024
- C:\Windows\System\qKhLLVO.exe
  C:\Windows\System\qKhLLVO.exe
  2⤵
  PID:8052
- C:\Windows\System\ZeyYTGK.exe
  C:\Windows\System\ZeyYTGK.exe
  2⤵
  PID:8080
- C:\Windows\System\HXDpOha.exe
  C:\Windows\System\HXDpOha.exe
  2⤵
  PID:8108
- C:\Windows\System\pzFBWdt.exe
  C:\Windows\System\pzFBWdt.exe
  2⤵
  PID:8136
- C:\Windows\System\wGbkrov.exe
  C:\Windows\System\wGbkrov.exe
  2⤵
  PID:8152
- C:\Windows\System\ILUuzmJ.exe
  C:\Windows\System\ILUuzmJ.exe
  2⤵
  PID:8176
- C:\Windows\System\dopKgDT.exe
  C:\Windows\System\dopKgDT.exe
  2⤵
  PID:6900
- C:\Windows\System\CdshXCq.exe
  C:\Windows\System\CdshXCq.exe
  2⤵
  PID:6968
- C:\Windows\System\igzMpZp.exe
  C:\Windows\System\igzMpZp.exe
  2⤵
  PID:6700
- C:\Windows\System\ZZKcguk.exe
  C:\Windows\System\ZZKcguk.exe
  2⤵
  PID:6860
- C:\Windows\System\DhcPlcA.exe
  C:\Windows\System\DhcPlcA.exe
  2⤵
  PID:7260
- C:\Windows\System\mgxdJXD.exe
  C:\Windows\System\mgxdJXD.exe
  2⤵
  PID:7308
- C:\Windows\System\IQOYXAg.exe
  C:\Windows\System\IQOYXAg.exe
  2⤵
  PID:6192
- C:\Windows\System\nsklhoe.exe
  C:\Windows\System\nsklhoe.exe
  2⤵
  PID:7404
- C:\Windows\System\TVjZLug.exe
  C:\Windows\System\TVjZLug.exe
  2⤵
  PID:7228
- C:\Windows\System\MFxQkRH.exe
  C:\Windows\System\MFxQkRH.exe
  2⤵
  PID:7592
- C:\Windows\System\XgmPjFX.exe
  C:\Windows\System\XgmPjFX.exe
  2⤵
  PID:7708
- C:\Windows\System\sstxNEb.exe
  C:\Windows\System\sstxNEb.exe
  2⤵
  PID:7300
- C:\Windows\System\CJUkhRu.exe
  C:\Windows\System\CJUkhRu.exe
  2⤵
  PID:7860
- C:\Windows\System\kMloLiO.exe
  C:\Windows\System\kMloLiO.exe
  2⤵
  PID:7892
- C:\Windows\System\gwoSIpS.exe
  C:\Windows\System\gwoSIpS.exe
  2⤵
  PID:7760
- C:\Windows\System\AWaQSFU.exe
  C:\Windows\System\AWaQSFU.exe
  2⤵
  PID:7544
- C:\Windows\System\ZZiVefY.exe
  C:\Windows\System\ZZiVefY.exe
  2⤵
  PID:8096
- C:\Windows\System\TURqcEw.exe
  C:\Windows\System\TURqcEw.exe
  2⤵
  PID:8160
- C:\Windows\System\wZWhsPg.exe
  C:\Windows\System\wZWhsPg.exe
  2⤵
  PID:7024
- C:\Windows\System\edkqqnD.exe
  C:\Windows\System\edkqqnD.exe
  2⤵
  PID:7736
- C:\Windows\System\rOuIeCa.exe
  C:\Windows\System\rOuIeCa.exe
  2⤵
  PID:7792
- C:\Windows\System\NiWKvez.exe
  C:\Windows\System\NiWKvez.exe
  2⤵
  PID:7180
- C:\Windows\System\fLbrDdb.exe
  C:\Windows\System\fLbrDdb.exe
  2⤵
  PID:8076
- C:\Windows\System\pfnyrQr.exe
  C:\Windows\System\pfnyrQr.exe
  2⤵
  PID:7784
- C:\Windows\System\wifiDID.exe
  C:\Windows\System\wifiDID.exe
  2⤵
  PID:7388
- C:\Windows\System\NVmPyyY.exe
  C:\Windows\System\NVmPyyY.exe
  2⤵
  PID:7680
- C:\Windows\System\fLzeHhS.exe
  C:\Windows\System\fLzeHhS.exe
  2⤵
  PID:7868
- C:\Windows\System\uZTvwDm.exe
  C:\Windows\System\uZTvwDm.exe
  2⤵
  PID:8012
- C:\Windows\System\TrqicNk.exe
  C:\Windows\System\TrqicNk.exe
  2⤵
  PID:6956
- C:\Windows\System\UPbLOlW.exe
  C:\Windows\System\UPbLOlW.exe
  2⤵
  PID:8196
- C:\Windows\System\jzPWmTb.exe
  C:\Windows\System\jzPWmTb.exe
  2⤵
  PID:8220
- C:\Windows\System\dGfemhy.exe
  C:\Windows\System\dGfemhy.exe
  2⤵
  PID:8252
- C:\Windows\System\PHcemel.exe
  C:\Windows\System\PHcemel.exe
  2⤵
  PID:8284
- C:\Windows\System\VXsXrIn.exe
  C:\Windows\System\VXsXrIn.exe
  2⤵
  PID:8312
- C:\Windows\System\yfiUTlB.exe
  C:\Windows\System\yfiUTlB.exe
  2⤵
  PID:8340
- C:\Windows\System\oZKoXrR.exe
  C:\Windows\System\oZKoXrR.exe
  2⤵
  PID:8372
- C:\Windows\System\OFLqXmi.exe
  C:\Windows\System\OFLqXmi.exe
  2⤵
  PID:8396
- C:\Windows\System\tTBnKvi.exe
  C:\Windows\System\tTBnKvi.exe
  2⤵
  PID:8428
- C:\Windows\System\BMkGxaW.exe
  C:\Windows\System\BMkGxaW.exe
  2⤵
  PID:8452
- C:\Windows\System\edujYLI.exe
  C:\Windows\System\edujYLI.exe
  2⤵
  PID:8484
- C:\Windows\System\VmVNwTv.exe
  C:\Windows\System\VmVNwTv.exe
  2⤵
  PID:8512
- C:\Windows\System\bjtgIay.exe
  C:\Windows\System\bjtgIay.exe
  2⤵
  PID:8544
- C:\Windows\System\LPAPJyu.exe
  C:\Windows\System\LPAPJyu.exe
  2⤵
  PID:8564
- C:\Windows\System\tGekSPK.exe
  C:\Windows\System\tGekSPK.exe
  2⤵
  PID:8588
- C:\Windows\System\wjgiTOc.exe
  C:\Windows\System\wjgiTOc.exe
  2⤵
  PID:8616
- C:\Windows\System\mTzCqFi.exe
  C:\Windows\System\mTzCqFi.exe
  2⤵
  PID:8644
- C:\Windows\System\RVZDCUb.exe
  C:\Windows\System\RVZDCUb.exe
  2⤵
  PID:8664
- C:\Windows\System\BsUaacU.exe
  C:\Windows\System\BsUaacU.exe
  2⤵
  PID:8692
- C:\Windows\System\OcjWTWq.exe
  C:\Windows\System\OcjWTWq.exe
  2⤵
  PID:8720
- C:\Windows\System\vgBkqXg.exe
  C:\Windows\System\vgBkqXg.exe
  2⤵
  PID:8748
- C:\Windows\System\UOfydYg.exe
  C:\Windows\System\UOfydYg.exe
  2⤵
  PID:8776
- C:\Windows\System\BdGRnBn.exe
  C:\Windows\System\BdGRnBn.exe
  2⤵
  PID:8796
- C:\Windows\System\oWAKWLp.exe
  C:\Windows\System\oWAKWLp.exe
  2⤵
  PID:8828
- C:\Windows\System\GqOFKTk.exe
  C:\Windows\System\GqOFKTk.exe
  2⤵
  PID:8848
- C:\Windows\System\OxSsIVi.exe
  C:\Windows\System\OxSsIVi.exe
  2⤵
  PID:8872
- C:\Windows\System\KMtPIzj.exe
  C:\Windows\System\KMtPIzj.exe
  2⤵
  PID:8896
- C:\Windows\System\WAKApKA.exe
  C:\Windows\System\WAKApKA.exe
  2⤵
  PID:8920
- C:\Windows\System\PYBlqEo.exe
  C:\Windows\System\PYBlqEo.exe
  2⤵
  PID:8948
- C:\Windows\System\XOciTCZ.exe
  C:\Windows\System\XOciTCZ.exe
  2⤵
  PID:8980
- C:\Windows\System\YjeSzJE.exe
  C:\Windows\System\YjeSzJE.exe
  2⤵
  PID:9004
- C:\Windows\System\OUOCNYJ.exe
  C:\Windows\System\OUOCNYJ.exe
  2⤵
  PID:9036
- C:\Windows\System\EFADKWf.exe
  C:\Windows\System\EFADKWf.exe
  2⤵
  PID:9064
- C:\Windows\System\tLdnVpr.exe
  C:\Windows\System\tLdnVpr.exe
  2⤵
  PID:9088
- C:\Windows\System\ScgzibQ.exe
  C:\Windows\System\ScgzibQ.exe
  2⤵
  PID:9112
- C:\Windows\System\vAceDmo.exe
  C:\Windows\System\vAceDmo.exe
  2⤵
  PID:9144
- C:\Windows\System\KcBLbTC.exe
  C:\Windows\System\KcBLbTC.exe
  2⤵
  PID:9168
- C:\Windows\System\dPfIbEM.exe
  C:\Windows\System\dPfIbEM.exe
  2⤵
  PID:9192
- C:\Windows\System\RQVKjtY.exe
  C:\Windows\System\RQVKjtY.exe
  2⤵
  PID:7332
- C:\Windows\System\NPQFqor.exe
  C:\Windows\System\NPQFqor.exe
  2⤵
  PID:7612
- C:\Windows\System\fMBdegB.exe
  C:\Windows\System\fMBdegB.exe
  2⤵
  PID:7276
- C:\Windows\System\BzvVOug.exe
  C:\Windows\System\BzvVOug.exe
  2⤵
  PID:7380
- C:\Windows\System\HaZcmuw.exe
  C:\Windows\System\HaZcmuw.exe
  2⤵
  PID:8212
- C:\Windows\System\ZPSSZCA.exe
  C:\Windows\System\ZPSSZCA.exe
  2⤵
  PID:7364
- C:\Windows\System\wbSoLEi.exe
  C:\Windows\System\wbSoLEi.exe
  2⤵
  PID:8380
- C:\Windows\System\DhrRFxB.exe
  C:\Windows\System\DhrRFxB.exe
  2⤵
  PID:8188
- C:\Windows\System\dIfVtlQ.exe
  C:\Windows\System\dIfVtlQ.exe
  2⤵
  PID:8448
- C:\Windows\System\dMUhHFX.exe
  C:\Windows\System\dMUhHFX.exe
  2⤵
  PID:8508
- C:\Windows\System\LATGLfc.exe
  C:\Windows\System\LATGLfc.exe
  2⤵
  PID:8556
- C:\Windows\System\UFYAiDt.exe
  C:\Windows\System\UFYAiDt.exe
  2⤵
  PID:8636
- C:\Windows\System\BgEIpyA.exe
  C:\Windows\System\BgEIpyA.exe
  2⤵
  PID:8704
- C:\Windows\System\jMjOsMT.exe
  C:\Windows\System\jMjOsMT.exe
  2⤵
  PID:8408
- C:\Windows\System\hJudCNd.exe
  C:\Windows\System\hJudCNd.exe
  2⤵
  PID:6880
- C:\Windows\System\MYzvnxI.exe
  C:\Windows\System\MYzvnxI.exe
  2⤵
  PID:8552
- C:\Windows\System\WjHXxaD.exe
  C:\Windows\System\WjHXxaD.exe
  2⤵
  PID:9084
- C:\Windows\System\SXyvETx.exe
  C:\Windows\System\SXyvETx.exe
  2⤵
  PID:9236
- C:\Windows\System\AuLKXfC.exe
  C:\Windows\System\AuLKXfC.exe
  2⤵
  PID:9256
- C:\Windows\System\PcFolMF.exe
  C:\Windows\System\PcFolMF.exe
  2⤵
  PID:9292
- C:\Windows\System\EjiFTqD.exe
  C:\Windows\System\EjiFTqD.exe
  2⤵
  PID:9316
- C:\Windows\System\qsOuVDH.exe
  C:\Windows\System\qsOuVDH.exe
  2⤵
  PID:9340
- C:\Windows\System\lEDOPcs.exe
  C:\Windows\System\lEDOPcs.exe
  2⤵
  PID:9372
- C:\Windows\System\LKrSTTk.exe
  C:\Windows\System\LKrSTTk.exe
  2⤵
  PID:9396
- C:\Windows\System\YzReJfH.exe
  C:\Windows\System\YzReJfH.exe
  2⤵
  PID:9424
- C:\Windows\System\DijhRbz.exe
  C:\Windows\System\DijhRbz.exe
  2⤵
  PID:9440
- C:\Windows\System\IqKcnkZ.exe
  C:\Windows\System\IqKcnkZ.exe
  2⤵
  PID:9468
- C:\Windows\System\LMgLNpK.exe
  C:\Windows\System\LMgLNpK.exe
  2⤵
  PID:9488
- C:\Windows\System\uuVDFfy.exe
  C:\Windows\System\uuVDFfy.exe
  2⤵
  PID:9512
- C:\Windows\System\JLpKenl.exe
  C:\Windows\System\JLpKenl.exe
  2⤵
  PID:9544
- C:\Windows\System\LxdECUM.exe
  C:\Windows\System\LxdECUM.exe
  2⤵
  PID:9568
- C:\Windows\System\OcxWijU.exe
  C:\Windows\System\OcxWijU.exe
  2⤵
  PID:9592
- C:\Windows\System\qWSutOW.exe
  C:\Windows\System\qWSutOW.exe
  2⤵
  PID:9628
- C:\Windows\System\zeQpEiP.exe
  C:\Windows\System\zeQpEiP.exe
  2⤵
  PID:9652
- C:\Windows\System\gefTDqq.exe
  C:\Windows\System\gefTDqq.exe
  2⤵
  PID:9676
- C:\Windows\System\odVujjU.exe
  C:\Windows\System\odVujjU.exe
  2⤵
  PID:9704
- C:\Windows\System\WEtMOfd.exe
  C:\Windows\System\WEtMOfd.exe
  2⤵
  PID:9728
- C:\Windows\System\krdxeXk.exe
  C:\Windows\System\krdxeXk.exe
  2⤵
  PID:9744
- C:\Windows\System\zNdRcGU.exe
  C:\Windows\System\zNdRcGU.exe
  2⤵
  PID:9772
- C:\Windows\System\dHWNjza.exe
  C:\Windows\System\dHWNjza.exe
  2⤵
  PID:9804
- C:\Windows\System\unqkfht.exe
  C:\Windows\System\unqkfht.exe
  2⤵
  PID:9824
- C:\Windows\System\LAUxwpO.exe
  C:\Windows\System\LAUxwpO.exe
  2⤵
  PID:9840
- C:\Windows\System\CxJKzpY.exe
  C:\Windows\System\CxJKzpY.exe
  2⤵
  PID:9868
- C:\Windows\System\VyIVAvw.exe
  C:\Windows\System\VyIVAvw.exe
  2⤵
  PID:9888
- C:\Windows\System\FGTiUtT.exe
  C:\Windows\System\FGTiUtT.exe
  2⤵
  PID:9912
- C:\Windows\System\XUesyQl.exe
  C:\Windows\System\XUesyQl.exe
  2⤵
  PID:9952
- C:\Windows\System\koEGfgn.exe
  C:\Windows\System\koEGfgn.exe
  2⤵
  PID:9976
- C:\Windows\System\VGqWOAI.exe
  C:\Windows\System\VGqWOAI.exe
  2⤵
  PID:9996
- C:\Windows\System\oPkhBWk.exe
  C:\Windows\System\oPkhBWk.exe
  2⤵
  PID:10028
- C:\Windows\System\FrVawlS.exe
  C:\Windows\System\FrVawlS.exe
  2⤵
  PID:10056
- C:\Windows\System\kuJlmZG.exe
  C:\Windows\System\kuJlmZG.exe
  2⤵
  PID:10084
- C:\Windows\System\oRFAUPZ.exe
  C:\Windows\System\oRFAUPZ.exe
  2⤵
  PID:10108
- C:\Windows\System\iRfELbP.exe
  C:\Windows\System\iRfELbP.exe
  2⤵
  PID:10128
- C:\Windows\System\WxFzvpC.exe
  C:\Windows\System\WxFzvpC.exe
  2⤵
  PID:10156
- C:\Windows\System\rExWkHj.exe
  C:\Windows\System\rExWkHj.exe
  2⤵
  PID:10180
- C:\Windows\System\OQlmafq.exe
  C:\Windows\System\OQlmafq.exe
  2⤵
  PID:10208
- C:\Windows\System\qFqiNPE.exe
  C:\Windows\System\qFqiNPE.exe
  2⤵
  PID:9160
- C:\Windows\System\nRavnxc.exe
  C:\Windows\System\nRavnxc.exe
  2⤵
  PID:8808
- C:\Windows\System\prGFhQW.exe
  C:\Windows\System\prGFhQW.exe
  2⤵
  PID:6448
- C:\Windows\System\ViJJdZB.exe
  C:\Windows\System\ViJJdZB.exe
  2⤵
  PID:8888
- C:\Windows\System\rgqceKH.exe
  C:\Windows\System\rgqceKH.exe
  2⤵
  PID:8324
- C:\Windows\System\JpTzUIw.exe
  C:\Windows\System\JpTzUIw.exe
  2⤵
  PID:8632
- C:\Windows\System\aUHfBnZ.exe
  C:\Windows\System\aUHfBnZ.exe
  2⤵
  PID:7988
- C:\Windows\System\hFdgkNP.exe
  C:\Windows\System\hFdgkNP.exe
  2⤵
  PID:8764
- C:\Windows\System\uPVDHwD.exe
  C:\Windows\System\uPVDHwD.exe
  2⤵
  PID:9264
- C:\Windows\System\hknwPYD.exe
  C:\Windows\System\hknwPYD.exe
  2⤵
  PID:9328
- C:\Windows\System\defKbTn.exe
  C:\Windows\System\defKbTn.exe
  2⤵
  PID:8836
- C:\Windows\System\qPNIHfX.exe
  C:\Windows\System\qPNIHfX.exe
  2⤵
  PID:9432
- C:\Windows\System\oTUXOlp.exe
  C:\Windows\System\oTUXOlp.exe
  2⤵
  PID:8364
- C:\Windows\System\SSuFRun.exe
  C:\Windows\System\SSuFRun.exe
  2⤵
  PID:8412
- C:\Windows\System\HSsmshI.exe
  C:\Windows\System\HSsmshI.exe
  2⤵
  PID:8964
- C:\Windows\System\UUycTyg.exe
  C:\Windows\System\UUycTyg.exe
  2⤵
  PID:9528
- C:\Windows\System\GadyeMj.exe
  C:\Windows\System\GadyeMj.exe
  2⤵
  PID:9044
- C:\Windows\System\KKIOpSO.exe
  C:\Windows\System\KKIOpSO.exe
  2⤵
  PID:8936
- C:\Windows\System\bTURKqS.exe
  C:\Windows\System\bTURKqS.exe
  2⤵
  PID:9688
- C:\Windows\System\POmnBtm.exe
  C:\Windows\System\POmnBtm.exe
  2⤵
  PID:9756
- C:\Windows\System\oZUcvIV.exe
  C:\Windows\System\oZUcvIV.exe
  2⤵
  PID:9796
- C:\Windows\System\oUoJsEK.exe
  C:\Windows\System\oUoJsEK.exe
  2⤵
  PID:9436
- C:\Windows\System\bgpyGuu.exe
  C:\Windows\System\bgpyGuu.exe
  2⤵
  PID:9520
- C:\Windows\System\KXGiGIZ.exe
  C:\Windows\System\KXGiGIZ.exe
  2⤵
  PID:10068
- C:\Windows\System\eLuXCvl.exe
  C:\Windows\System\eLuXCvl.exe
  2⤵
  PID:9220
- C:\Windows\System\dKNHOZA.exe
  C:\Windows\System\dKNHOZA.exe
  2⤵
  PID:10188
- C:\Windows\System\UODmvhK.exe
  C:\Windows\System\UODmvhK.exe
  2⤵
  PID:9736
- C:\Windows\System\SnkUAmG.exe
  C:\Windows\System\SnkUAmG.exe
  2⤵
  PID:9812
- C:\Windows\System\QeogMmU.exe
  C:\Windows\System\QeogMmU.exe
  2⤵
  PID:8652
- C:\Windows\System\fHFXimB.exe
  C:\Windows\System\fHFXimB.exe
  2⤵
  PID:10264
- C:\Windows\System\tQqIBpO.exe
  C:\Windows\System\tQqIBpO.exe
  2⤵
  PID:10288
- C:\Windows\System\YUulqxz.exe
  C:\Windows\System\YUulqxz.exe
  2⤵
  PID:10312
- C:\Windows\System\CZvHIfL.exe
  C:\Windows\System\CZvHIfL.exe
  2⤵
  PID:10340
- C:\Windows\System\toDwNrO.exe
  C:\Windows\System\toDwNrO.exe
  2⤵
  PID:10360
- C:\Windows\System\ylTEstE.exe
  C:\Windows\System\ylTEstE.exe
  2⤵
  PID:10388
- C:\Windows\System\wbZOSXA.exe
  C:\Windows\System\wbZOSXA.exe
  2⤵
  PID:10420
- C:\Windows\System\lWcgoGw.exe
  C:\Windows\System\lWcgoGw.exe
  2⤵
  PID:10452
- C:\Windows\System\zEmpTOQ.exe
  C:\Windows\System\zEmpTOQ.exe
  2⤵
  PID:10476
- C:\Windows\System\FEzYaDI.exe
  C:\Windows\System\FEzYaDI.exe
  2⤵
  PID:10504
- C:\Windows\System\bsDNlix.exe
  C:\Windows\System\bsDNlix.exe
  2⤵
  PID:10528
- C:\Windows\System\IoapFsu.exe
  C:\Windows\System\IoapFsu.exe
  2⤵
  PID:10556
- C:\Windows\System\ivAoRrl.exe
  C:\Windows\System\ivAoRrl.exe
  2⤵
  PID:10584
- C:\Windows\System\ZYDYzNe.exe
  C:\Windows\System\ZYDYzNe.exe
  2⤵
  PID:10604
- C:\Windows\System\rgbgaMQ.exe
  C:\Windows\System\rgbgaMQ.exe
  2⤵
  PID:10624
- C:\Windows\System\EroiJdr.exe
  C:\Windows\System\EroiJdr.exe
  2⤵
  PID:10656
- C:\Windows\System\IUWnkTA.exe
  C:\Windows\System\IUWnkTA.exe
  2⤵
  PID:10676
- C:\Windows\System\CkZASVh.exe
  C:\Windows\System\CkZASVh.exe
  2⤵
  PID:10696
- C:\Windows\System\FiWINkP.exe
  C:\Windows\System\FiWINkP.exe
  2⤵
  PID:10724
- C:\Windows\System\bZHjJWg.exe
  C:\Windows\System\bZHjJWg.exe
  2⤵
  PID:10752
- C:\Windows\System\JHfhAwl.exe
  C:\Windows\System\JHfhAwl.exe
  2⤵
  PID:10768
- C:\Windows\System\zuRrMeS.exe
  C:\Windows\System\zuRrMeS.exe
  2⤵
  PID:10796
- C:\Windows\System\UkkygnV.exe
  C:\Windows\System\UkkygnV.exe
  2⤵
  PID:10812
- C:\Windows\System\uyAiivv.exe
  C:\Windows\System\uyAiivv.exe
  2⤵
  PID:10840
- C:\Windows\System\sgiJPKX.exe
  C:\Windows\System\sgiJPKX.exe
  2⤵
  PID:10864
- C:\Windows\System\DpHKqgZ.exe
  C:\Windows\System\DpHKqgZ.exe
  2⤵
  PID:10892
- C:\Windows\System\rOBOnlS.exe
  C:\Windows\System\rOBOnlS.exe
  2⤵
  PID:10912
- C:\Windows\System\epcDZjn.exe
  C:\Windows\System\epcDZjn.exe
  2⤵
  PID:10944
- C:\Windows\System\EKhiCPw.exe
  C:\Windows\System\EKhiCPw.exe
  2⤵
  PID:10972
- C:\Windows\System\zFrldbM.exe
  C:\Windows\System\zFrldbM.exe
  2⤵
  PID:11000
- C:\Windows\System\VSQTeIT.exe
  C:\Windows\System\VSQTeIT.exe
  2⤵
  PID:11024
- C:\Windows\System\LxUipJN.exe
  C:\Windows\System\LxUipJN.exe
  2⤵
  PID:11044
- C:\Windows\System\hPZsSrN.exe
  C:\Windows\System\hPZsSrN.exe
  2⤵
  PID:11060
- C:\Windows\System\DYSczat.exe
  C:\Windows\System\DYSczat.exe
  2⤵
  PID:11088
- C:\Windows\System\GOddVyz.exe
  C:\Windows\System\GOddVyz.exe
  2⤵
  PID:11116
- C:\Windows\System\QUmgBwH.exe
  C:\Windows\System\QUmgBwH.exe
  2⤵
  PID:11144
- C:\Windows\System\aIqkhzb.exe
  C:\Windows\System\aIqkhzb.exe
  2⤵
  PID:11160
- C:\Windows\System\YDbgQQi.exe
  C:\Windows\System\YDbgQQi.exe
  2⤵
  PID:11184
- C:\Windows\System\mZtBPIG.exe
  C:\Windows\System\mZtBPIG.exe
  2⤵
  PID:11212
- C:\Windows\System\UjDuxtq.exe
  C:\Windows\System\UjDuxtq.exe
  2⤵
  PID:11232
- C:\Windows\System\fWDfaZG.exe
  C:\Windows\System\fWDfaZG.exe
  2⤵
  PID:9884
- C:\Windows\System\SiFekKK.exe
  C:\Windows\System\SiFekKK.exe
  2⤵
  PID:9944
- C:\Windows\System\LXGMULI.exe
  C:\Windows\System\LXGMULI.exe
  2⤵
  PID:9988
- C:\Windows\System\mwxRlCE.exe
  C:\Windows\System\mwxRlCE.exe
  2⤵
  PID:9584
- C:\Windows\System\OEFHzKT.exe
  C:\Windows\System\OEFHzKT.exe
  2⤵
  PID:10040
- C:\Windows\System\IYRiPfB.exe
  C:\Windows\System\IYRiPfB.exe
  2⤵
  PID:9640
- C:\Windows\System\TMrNxew.exe
  C:\Windows\System\TMrNxew.exe
  2⤵
  PID:9648
- C:\Windows\System\zMpXqhc.exe
  C:\Windows\System\zMpXqhc.exe
  2⤵
  PID:9664
- C:\Windows\System\EabPHdM.exe
  C:\Windows\System\EabPHdM.exe
  2⤵
  PID:9692
- C:\Windows\System\WmHyHaE.exe
  C:\Windows\System\WmHyHaE.exe
  2⤵
  PID:6812
- C:\Windows\System\vzjStIT.exe
  C:\Windows\System\vzjStIT.exe
  2⤵
  PID:8600
- C:\Windows\System\zcseJTg.exe
  C:\Windows\System\zcseJTg.exe
  2⤵
  PID:9880
- C:\Windows\System\AXmYTQo.exe
  C:\Windows\System\AXmYTQo.exe
  2⤵
  PID:9924
- C:\Windows\System\BRTrFqx.exe
  C:\Windows\System\BRTrFqx.exe
  2⤵
  PID:10376
- C:\Windows\System\CMEVuJh.exe
  C:\Windows\System\CMEVuJh.exe
  2⤵
  PID:10432
- C:\Windows\System\sBbMFXX.exe
  C:\Windows\System\sBbMFXX.exe
  2⤵
  PID:10484
- C:\Windows\System\lVOvlqH.exe
  C:\Windows\System\lVOvlqH.exe
  2⤵
  PID:10524
- C:\Windows\System\xMQdDKt.exe
  C:\Windows\System\xMQdDKt.exe
  2⤵
  PID:10196
- C:\Windows\System\ZsTEVEe.exe
  C:\Windows\System\ZsTEVEe.exe
  2⤵
  PID:7688
- C:\Windows\System\eAmgNou.exe
  C:\Windows\System\eAmgNou.exe
  2⤵
  PID:9620
- C:\Windows\System\PJGLscx.exe
  C:\Windows\System\PJGLscx.exe
  2⤵
  PID:10784
- C:\Windows\System\SAGVCoT.exe
  C:\Windows\System\SAGVCoT.exe
  2⤵
  PID:10836
- C:\Windows\System\QePZdiV.exe
  C:\Windows\System\QePZdiV.exe
  2⤵
  PID:9024
- C:\Windows\System\XUksUil.exe
  C:\Windows\System\XUksUil.exe
  2⤵
  PID:10300
- C:\Windows\System\sEhXsPi.exe
  C:\Windows\System\sEhXsPi.exe
  2⤵
  PID:11016
- C:\Windows\System\JRVjJiL.exe
  C:\Windows\System\JRVjJiL.exe
  2⤵
  PID:11112
- C:\Windows\System\gKXdcwi.exe
  C:\Windows\System\gKXdcwi.exe
  2⤵
  PID:10536
- C:\Windows\System\vReWhJl.exe
  C:\Windows\System\vReWhJl.exe
  2⤵
  PID:9252
- C:\Windows\System\RdybMnn.exe
  C:\Windows\System\RdybMnn.exe
  2⤵
  PID:11260
- C:\Windows\System\qkPpZIQ.exe
  C:\Windows\System\qkPpZIQ.exe
  2⤵
  PID:11284
- C:\Windows\System\DrjPIDE.exe
  C:\Windows\System\DrjPIDE.exe
  2⤵
  PID:11308
- C:\Windows\System\pFvdzKq.exe
  C:\Windows\System\pFvdzKq.exe
  2⤵
  PID:11336
- C:\Windows\System\lXhqeJu.exe
  C:\Windows\System\lXhqeJu.exe
  2⤵
  PID:11684
- C:\Windows\System\GkFRMWf.exe
  C:\Windows\System\GkFRMWf.exe
  2⤵
  PID:11716
- C:\Windows\System\mfTvbbV.exe
  C:\Windows\System\mfTvbbV.exe
  2⤵
  PID:11748
- C:\Windows\System\KrDrSZU.exe
  C:\Windows\System\KrDrSZU.exe
  2⤵
  PID:11772
- C:\Windows\System\WOnvyGg.exe
  C:\Windows\System\WOnvyGg.exe
  2⤵
  PID:11796
- C:\Windows\System\LidZfWn.exe
  C:\Windows\System\LidZfWn.exe
  2⤵
  PID:11836
- C:\Windows\System\iLlMMrP.exe
  C:\Windows\System\iLlMMrP.exe
  2⤵
  PID:11864
- C:\Windows\System\QxpzfXK.exe
  C:\Windows\System\QxpzfXK.exe
  2⤵
  PID:11888
- C:\Windows\System\yjnUhhj.exe
  C:\Windows\System\yjnUhhj.exe
  2⤵
  PID:11904
- C:\Windows\System\AFyldsl.exe
  C:\Windows\System\AFyldsl.exe
  2⤵
  PID:11936
- C:\Windows\System\rsJHHjw.exe
  C:\Windows\System\rsJHHjw.exe
  2⤵
  PID:11956
- C:\Windows\System\XoUIZLt.exe
  C:\Windows\System\XoUIZLt.exe
  2⤵
  PID:11996
- C:\Windows\System\sWRsLhw.exe
  C:\Windows\System\sWRsLhw.exe
  2⤵
  PID:12020
- C:\Windows\System\mqLbltK.exe
  C:\Windows\System\mqLbltK.exe
  2⤵
  PID:12068
- C:\Windows\System\zPAcyBw.exe
  C:\Windows\System\zPAcyBw.exe
  2⤵
  PID:12096
- C:\Windows\System\NVsXQHL.exe
  C:\Windows\System\NVsXQHL.exe
  2⤵
  PID:12128
- C:\Windows\System\ZyafRCf.exe
  C:\Windows\System\ZyafRCf.exe
  2⤵
  PID:12156
- C:\Windows\System\zLuciwx.exe
  C:\Windows\System\zLuciwx.exe
  2⤵
  PID:12188
- C:\Windows\System\kBezboD.exe
  C:\Windows\System\kBezboD.exe
  2⤵
  PID:12204
- C:\Windows\System\QxUkSYJ.exe
  C:\Windows\System\QxUkSYJ.exe
  2⤵
  PID:12220
- C:\Windows\System\QIHOnvv.exe
  C:\Windows\System\QIHOnvv.exe
  2⤵
  PID:12248
- C:\Windows\System\QLHowLP.exe
  C:\Windows\System\QLHowLP.exe
  2⤵
  PID:12284
- C:\Windows\System\ZoHPKUc.exe
  C:\Windows\System\ZoHPKUc.exe
  2⤵
  PID:8844
- C:\Windows\System\OlkLrQb.exe
  C:\Windows\System\OlkLrQb.exe
  2⤵
  PID:10760
- C:\Windows\System\QedLzsM.exe
  C:\Windows\System\QedLzsM.exe
  2⤵
  PID:9500
- C:\Windows\System\LGHZsMp.exe
  C:\Windows\System\LGHZsMp.exe
  2⤵
  PID:8960
- C:\Windows\System\trsVIms.exe
  C:\Windows\System\trsVIms.exe
  2⤵
  PID:10720
- C:\Windows\System\FUQkSUB.exe
  C:\Windows\System\FUQkSUB.exe
  2⤵
  PID:11128
- C:\Windows\System\iuAeKek.exe
  C:\Windows\System\iuAeKek.exe
  2⤵
  PID:11136
- C:\Windows\System\cPGyjBX.exe
  C:\Windows\System\cPGyjBX.exe
  2⤵
  PID:9020
- C:\Windows\System\pRZvaVO.exe
  C:\Windows\System\pRZvaVO.exe
  2⤵
  PID:10632
- C:\Windows\System\EOzPPGa.exe
  C:\Windows\System\EOzPPGa.exe
  2⤵
  PID:10228
- C:\Windows\System\VlIRlBr.exe
  C:\Windows\System\VlIRlBr.exe
  2⤵
  PID:10092
- C:\Windows\System\FRfeEoS.exe
  C:\Windows\System\FRfeEoS.exe
  2⤵
  PID:10856
- C:\Windows\System\nvmBtOZ.exe
  C:\Windows\System\nvmBtOZ.exe
  2⤵
  PID:10176
- C:\Windows\System\lJfWlfQ.exe
  C:\Windows\System\lJfWlfQ.exe
  2⤵
  PID:9900
- C:\Windows\System\tLBWAlQ.exe
  C:\Windows\System\tLBWAlQ.exe
  2⤵
  PID:11476
- C:\Windows\System\BZEbHgh.exe
  C:\Windows\System\BZEbHgh.exe
  2⤵
  PID:11508
- C:\Windows\System\MyaYRqd.exe
  C:\Windows\System\MyaYRqd.exe
  2⤵
  PID:10324
- C:\Windows\System\jnaiSyr.exe
  C:\Windows\System\jnaiSyr.exe
  2⤵
  PID:11276
- C:\Windows\System\MrkyybF.exe
  C:\Windows\System\MrkyybF.exe
  2⤵
  PID:11392
- C:\Windows\System\lPjgDej.exe
  C:\Windows\System\lPjgDej.exe
  2⤵
  PID:10332
- C:\Windows\System\AJXxzQb.exe
  C:\Windows\System\AJXxzQb.exe
  2⤵
  PID:9076
- C:\Windows\System\TckMixF.exe
  C:\Windows\System\TckMixF.exe
  2⤵
  PID:11640
- C:\Windows\System\Unjtkns.exe
  C:\Windows\System\Unjtkns.exe
  2⤵
  PID:11816
- C:\Windows\System\tzZOQjN.exe
  C:\Windows\System\tzZOQjN.exe
  2⤵
  PID:9416
- C:\Windows\System\tgiMNlg.exe
  C:\Windows\System\tgiMNlg.exe
  2⤵
  PID:11944
- C:\Windows\System\aUoBqbZ.exe
  C:\Windows\System\aUoBqbZ.exe
  2⤵
  PID:11988
- C:\Windows\System\tLVWZYT.exe
  C:\Windows\System\tLVWZYT.exe
  2⤵
  PID:12012
- C:\Windows\System\ilUqvtq.exe
  C:\Windows\System\ilUqvtq.exe
  2⤵
  PID:12384
- C:\Windows\System\yUsefZB.exe
  C:\Windows\System\yUsefZB.exe
  2⤵
  PID:12468
- C:\Windows\System\SmmLZbV.exe
  C:\Windows\System\SmmLZbV.exe
  2⤵
  PID:12500
- C:\Windows\System\ajWjtEa.exe
  C:\Windows\System\ajWjtEa.exe
  2⤵
  PID:12528
- C:\Windows\System\eKolARF.exe
  C:\Windows\System\eKolARF.exe
  2⤵
  PID:12552
- C:\Windows\System\fbbBMaP.exe
  C:\Windows\System\fbbBMaP.exe
  2⤵
  PID:12588
- C:\Windows\System\aNffsns.exe
  C:\Windows\System\aNffsns.exe
  2⤵
  PID:12624
- C:\Windows\System\pahBLcK.exe
  C:\Windows\System\pahBLcK.exe
  2⤵
  PID:12676
- C:\Windows\System\hkEdLyT.exe
  C:\Windows\System\hkEdLyT.exe
  2⤵
  PID:12700
- C:\Windows\System\dmvFzBW.exe
  C:\Windows\System\dmvFzBW.exe
  2⤵
  PID:12732
- C:\Windows\System\pWaLXrv.exe
  C:\Windows\System\pWaLXrv.exe
  2⤵
  PID:12756
- C:\Windows\System\CpDLgRb.exe
  C:\Windows\System\CpDLgRb.exe
  2⤵
  PID:12784
- C:\Windows\System\nputZjN.exe
  C:\Windows\System\nputZjN.exe
  2⤵
  PID:12808
- C:\Windows\System\DcOSkrT.exe
  C:\Windows\System\DcOSkrT.exe
  2⤵
  PID:12832
- C:\Windows\System\cCkDlYQ.exe
  C:\Windows\System\cCkDlYQ.exe
  2⤵
  PID:12860
- C:\Windows\System\SOoFjKe.exe
  C:\Windows\System\SOoFjKe.exe
  2⤵
  PID:12888
- C:\Windows\System\bxgdMgQ.exe
  C:\Windows\System\bxgdMgQ.exe
  2⤵
  PID:12920
- C:\Windows\System\qpmplky.exe
  C:\Windows\System\qpmplky.exe
  2⤵
  PID:12948
- C:\Windows\System\LfdToqG.exe
  C:\Windows\System\LfdToqG.exe
  2⤵
  PID:12992
- C:\Windows\System\jJtWSBT.exe
  C:\Windows\System\jJtWSBT.exe
  2⤵
  PID:13020
- C:\Windows\System\HeaCnLF.exe
  C:\Windows\System\HeaCnLF.exe
  2⤵
  PID:13044
- C:\Windows\System\UkJezul.exe
  C:\Windows\System\UkJezul.exe
  2⤵
  PID:13064
- C:\Windows\System\tiwREDy.exe
  C:\Windows\System\tiwREDy.exe
  2⤵
  PID:13092
- C:\Windows\System\pnUGbqh.exe
  C:\Windows\System\pnUGbqh.exe
  2⤵
  PID:13120
- C:\Windows\System\vHoUWZT.exe
  C:\Windows\System\vHoUWZT.exe
  2⤵
  PID:13148
- C:\Windows\System\uhvZYLi.exe
  C:\Windows\System\uhvZYLi.exe
  2⤵
  PID:13176
- C:\Windows\System\LEaXXqd.exe
  C:\Windows\System\LEaXXqd.exe
  2⤵
  PID:13200
- C:\Windows\System\cUxXqTQ.exe
  C:\Windows\System\cUxXqTQ.exe
  2⤵
  PID:13224
- C:\Windows\System\mlBUhMy.exe
  C:\Windows\System\mlBUhMy.exe
  2⤵
  PID:13252
- C:\Windows\System\pXZZqmp.exe
  C:\Windows\System\pXZZqmp.exe
  2⤵
  PID:13280
- C:\Windows\System\qUHXZXD.exe
  C:\Windows\System\qUHXZXD.exe
  2⤵
  PID:11552
- C:\Windows\System\ZNHoVuW.exe
  C:\Windows\System\ZNHoVuW.exe
  2⤵
  PID:11736
- C:\Windows\System\CnyoEWM.exe
  C:\Windows\System\CnyoEWM.exe
  2⤵
  PID:12140
- C:\Windows\System\yfpTrcK.exe
  C:\Windows\System\yfpTrcK.exe
  2⤵
  PID:9920
- C:\Windows\System\hNgWdPu.exe
  C:\Windows\System\hNgWdPu.exe
  2⤵
  PID:11100
- C:\Windows\System\COFygAK.exe
  C:\Windows\System\COFygAK.exe
  2⤵
  PID:11856
- C:\Windows\System\mluwPQL.exe
  C:\Windows\System\mluwPQL.exe
  2⤵
  PID:11896
- C:\Windows\System\tDTyXkL.exe
  C:\Windows\System\tDTyXkL.exe
  2⤵
  PID:12040
- C:\Windows\System\LIKdVMJ.exe
  C:\Windows\System\LIKdVMJ.exe
  2⤵
  PID:11740
- C:\Windows\System\yyaEFcV.exe
  C:\Windows\System\yyaEFcV.exe
  2⤵
  PID:12172
- C:\Windows\System\SpBzeCM.exe
  C:\Windows\System\SpBzeCM.exe
  2⤵
  PID:12236
- C:\Windows\System\MXtxOPH.exe
  C:\Windows\System\MXtxOPH.exe
  2⤵
  PID:11032
- C:\Windows\System\uSarKre.exe
  C:\Windows\System\uSarKre.exe
  2⤵
  PID:12540
- C:\Windows\System\AohnImx.exe
  C:\Windows\System\AohnImx.exe
  2⤵
  PID:10496
- C:\Windows\System\eKclxeg.exe
  C:\Windows\System\eKclxeg.exe
  2⤵
  PID:10852
- C:\Windows\System\lraorXk.exe
  C:\Windows\System\lraorXk.exe
  2⤵
  PID:12660
- C:\Windows\System\RPlghMP.exe
  C:\Windows\System\RPlghMP.exe
  2⤵
  PID:11468
- C:\Windows\System\SCFhjcD.exe
  C:\Windows\System\SCFhjcD.exe
  2⤵
  PID:11172
- C:\Windows\System\sAnJzNd.exe
  C:\Windows\System\sAnJzNd.exe
  2⤵
  PID:12212
- C:\Windows\System\AnkNoKK.exe
  C:\Windows\System\AnkNoKK.exe
  2⤵
  PID:11712
- C:\Windows\System\FMJxnXW.exe
  C:\Windows\System\FMJxnXW.exe
  2⤵
  PID:12800
- C:\Windows\System\BdnhXJV.exe
  C:\Windows\System\BdnhXJV.exe
  2⤵
  PID:12868
- C:\Windows\System\UJjwCXA.exe
  C:\Windows\System\UJjwCXA.exe
  2⤵
  PID:12916
- C:\Windows\System\sSdBzcf.exe
  C:\Windows\System\sSdBzcf.exe
  2⤵
  PID:11304
- C:\Windows\System\peZyRYe.exe
  C:\Windows\System\peZyRYe.exe
  2⤵
  PID:12424
- C:\Windows\System\FCqYvjD.exe
  C:\Windows\System\FCqYvjD.exe
  2⤵
  PID:12440
- C:\Windows\System\ThHEJxd.exe
  C:\Windows\System\ThHEJxd.exe
  2⤵
  PID:12484
- C:\Windows\System\KJWIIMz.exe
  C:\Windows\System\KJWIIMz.exe
  2⤵
  PID:12512
- C:\Windows\System\LJwsliI.exe
  C:\Windows\System\LJwsliI.exe
  2⤵
  PID:13144
- C:\Windows\System\FnCPdUw.exe
  C:\Windows\System\FnCPdUw.exe
  2⤵
  PID:12696
- C:\Windows\System\OvCBelR.exe
  C:\Windows\System\OvCBelR.exe
  2⤵
  PID:13248
- C:\Windows\System\DBaCRgN.exe
  C:\Windows\System\DBaCRgN.exe
  2⤵
  PID:12116
- C:\Windows\System\FGAJbsk.exe
  C:\Windows\System\FGAJbsk.exe
  2⤵
  PID:10568
- C:\Windows\System\BvYIpap.exe
  C:\Windows\System\BvYIpap.exe
  2⤵
  PID:13008
- C:\Windows\System\XnAlXLe.exe
  C:\Windows\System\XnAlXLe.exe
  2⤵
  PID:12580
- C:\Windows\System\VAjFoDb.exe
  C:\Windows\System\VAjFoDb.exe
  2⤵
  PID:13320
- C:\Windows\System\lpHxDyE.exe
  C:\Windows\System\lpHxDyE.exe
  2⤵
  PID:13464
- C:\Windows\System\HEwsmSn.exe
  C:\Windows\System\HEwsmSn.exe
  2⤵
  PID:13480
- C:\Windows\System\jrstXyP.exe
  C:\Windows\System\jrstXyP.exe
  2⤵
  PID:13500
- C:\Windows\System\hAsTwtb.exe
  C:\Windows\System\hAsTwtb.exe
  2⤵
  PID:13516
- C:\Windows\System\cFlvniW.exe
  C:\Windows\System\cFlvniW.exe
  2⤵
  PID:13532
- C:\Windows\System\hkTltMc.exe
  C:\Windows\System\hkTltMc.exe
  2⤵
  PID:13560
- C:\Windows\System\ULJQqER.exe
  C:\Windows\System\ULJQqER.exe
  2⤵
  PID:13576
- C:\Windows\System\HGCIheb.exe
  C:\Windows\System\HGCIheb.exe
  2⤵
  PID:13600
- C:\Windows\System\JwXDrUW.exe
  C:\Windows\System\JwXDrUW.exe
  2⤵
  PID:13624
- C:\Windows\System\NYDKzvh.exe
  C:\Windows\System\NYDKzvh.exe
  2⤵
  PID:13652
- C:\Windows\System\hRnaqPq.exe
  C:\Windows\System\hRnaqPq.exe
  2⤵
  PID:13684
- C:\Windows\System\iahkCBx.exe
  C:\Windows\System\iahkCBx.exe
  2⤵
  PID:13712
- C:\Windows\System\YjjwruL.exe
  C:\Windows\System\YjjwruL.exe
  2⤵
  PID:13736
- C:\Windows\System\DDnuFPp.exe
  C:\Windows\System\DDnuFPp.exe
  2⤵
  PID:13768
- C:\Windows\System\sfbjZhM.exe
  C:\Windows\System\sfbjZhM.exe
  2⤵
  PID:13788
- C:\Windows\System\sKIkDeg.exe
  C:\Windows\System\sKIkDeg.exe
  2⤵
  PID:13812
- C:\Windows\System\UNzNNFh.exe
  C:\Windows\System\UNzNNFh.exe
  2⤵
  PID:13844
- C:\Windows\System\OfpNpiS.exe
  C:\Windows\System\OfpNpiS.exe
  2⤵
  PID:13864
- C:\Windows\System\tSubuGD.exe
  C:\Windows\System\tSubuGD.exe
  2⤵
  PID:13880
- C:\Windows\System\OmAeHwV.exe
  C:\Windows\System\OmAeHwV.exe
  2⤵
  PID:13908
- C:\Windows\System\IOLWtoi.exe
  C:\Windows\System\IOLWtoi.exe
  2⤵
  PID:13928
- C:\Windows\System\ToHzLDN.exe
  C:\Windows\System\ToHzLDN.exe
  2⤵
  PID:13952
- C:\Windows\System\lxDBptY.exe
  C:\Windows\System\lxDBptY.exe
  2⤵
  PID:13980
- C:\Windows\System\TmLoNUp.exe
  C:\Windows\System\TmLoNUp.exe
  2⤵
  PID:14008
- C:\Windows\System\HBFECpD.exe
  C:\Windows\System\HBFECpD.exe
  2⤵
  PID:14028
- C:\Windows\System\Cpjbhig.exe
  C:\Windows\System\Cpjbhig.exe
  2⤵
  PID:14056
- C:\Windows\System\lbtZtli.exe
  C:\Windows\System\lbtZtli.exe
  2⤵
  PID:14076
- C:\Windows\System\HdTQPex.exe
  C:\Windows\System\HdTQPex.exe
  2⤵
  PID:14092
- C:\Windows\System\suYHGlF.exe
  C:\Windows\System\suYHGlF.exe
  2⤵
  PID:14112
- C:\Windows\System\lFJyvQb.exe
  C:\Windows\System\lFJyvQb.exe
  2⤵
  PID:14128
- C:\Windows\System\AkveIcK.exe
  C:\Windows\System\AkveIcK.exe
  2⤵
  PID:14144
- C:\Windows\System\VksYrQd.exe
  C:\Windows\System\VksYrQd.exe
  2⤵
  PID:14172
- C:\Windows\System\SPiLWlm.exe
  C:\Windows\System\SPiLWlm.exe
  2⤵
  PID:14204
- C:\Windows\System\mKwXZGV.exe
  C:\Windows\System\mKwXZGV.exe
  2⤵
  PID:14228
- C:\Windows\System\eVjJtOL.exe
  C:\Windows\System\eVjJtOL.exe
  2⤵
  PID:14248
- C:\Windows\System\pbwXGWd.exe
  C:\Windows\System\pbwXGWd.exe
  2⤵
  PID:14276
- C:\Windows\System\tWzXKJk.exe
  C:\Windows\System\tWzXKJk.exe
  2⤵
  PID:14300
- C:\Windows\System\sovrlbI.exe
  C:\Windows\System\sovrlbI.exe
  2⤵
  PID:14328
- C:\Windows\System\VdoECCS.exe
  C:\Windows\System\VdoECCS.exe
  2⤵
  PID:12688
- C:\Windows\System\uiBcgOW.exe
  C:\Windows\System\uiBcgOW.exe
  2⤵
  PID:13184
- C:\Windows\System\HhAIKOQ.exe
  C:\Windows\System\HhAIKOQ.exe
  2⤵
  PID:13244
- C:\Windows\System\MtcBgMK.exe
  C:\Windows\System\MtcBgMK.exe
  2⤵
  PID:8596
- C:\Windows\System\lklkXNB.exe
  C:\Windows\System\lklkXNB.exe
  2⤵
  PID:13036
- C:\Windows\System\oNceNrZ.exe
  C:\Windows\System\oNceNrZ.exe
  2⤵
  PID:12280
- C:\Windows\System\EISuHPh.exe
  C:\Windows\System\EISuHPh.exe
  2⤵
  PID:11700
- C:\Windows\System\TfOjSHN.exe
  C:\Windows\System\TfOjSHN.exe
  2⤵
  PID:8104
- C:\Windows\System\zZCWPSi.exe
  C:\Windows\System\zZCWPSi.exe
  2⤵
  PID:11084
- C:\Windows\System\TOxqIrp.exe
  C:\Windows\System\TOxqIrp.exe
  2⤵
  PID:13332
- C:\Windows\System\nEjmCqH.exe
  C:\Windows\System\nEjmCqH.exe
  2⤵
  PID:13360
- C:\Windows\System\zidNHOn.exe
  C:\Windows\System\zidNHOn.exe
  2⤵
  PID:13396
- C:\Windows\System\dwUCpGh.exe
  C:\Windows\System\dwUCpGh.exe
  2⤵
  PID:13424
- C:\Windows\System\bKRFPFJ.exe
  C:\Windows\System\bKRFPFJ.exe
  2⤵
  PID:11324
- C:\Windows\System\tTyKMHP.exe
  C:\Windows\System\tTyKMHP.exe
  2⤵
  PID:11932
- C:\Windows\System\xylXBYh.exe
  C:\Windows\System\xylXBYh.exe
  2⤵
  PID:12900
- C:\Windows\System\AIrPAXh.exe
  C:\Windows\System\AIrPAXh.exe
  2⤵
  PID:11708
- C:\Windows\System\SJArkeE.exe
  C:\Windows\System\SJArkeE.exe
  2⤵
  PID:13752
- C:\Windows\System\ridGxDK.exe
  C:\Windows\System\ridGxDK.exe
  2⤵
  PID:12076
- C:\Windows\System\khEQald.exe
  C:\Windows\System\khEQald.exe
  2⤵
  PID:12356
- C:\Windows\System\FHZYQoq.exe
  C:\Windows\System\FHZYQoq.exe
  2⤵
  PID:12032
- C:\Windows\System\pvpaLWg.exe
  C:\Windows\System\pvpaLWg.exe
  2⤵
  PID:13976
- C:\Windows\System\qjXKAiU.exe
  C:\Windows\System\qjXKAiU.exe
  2⤵
  PID:12640
- C:\Windows\System\xXcjkSG.exe
  C:\Windows\System\xXcjkSG.exe
  2⤵
  PID:13456
- C:\Windows\System\nqNjmsR.exe
  C:\Windows\System\nqNjmsR.exe
  2⤵
  PID:13476
- C:\Windows\System\dmckuXf.exe
  C:\Windows\System\dmckuXf.exe
  2⤵
  PID:14340
- C:\Windows\System\UmxcHUY.exe
  C:\Windows\System\UmxcHUY.exe
  2⤵
  PID:14360
- C:\Windows\System\mgRIKgZ.exe
  C:\Windows\System\mgRIKgZ.exe
  2⤵
  PID:14388
- C:\Windows\System\KPDGtZt.exe
  C:\Windows\System\KPDGtZt.exe
  2⤵
  PID:14408
- C:\Windows\System\OLhHevT.exe
  C:\Windows\System\OLhHevT.exe
  2⤵
  PID:14440
- C:\Windows\System\TZpXSue.exe
  C:\Windows\System\TZpXSue.exe
  2⤵
  PID:14456
- C:\Windows\System\pAMwbCd.exe
  C:\Windows\System\pAMwbCd.exe
  2⤵
  PID:14484
- C:\Windows\System\OLmmPia.exe
  C:\Windows\System\OLmmPia.exe
  2⤵
  PID:14500
- C:\Windows\System\UJzsaBU.exe
  C:\Windows\System\UJzsaBU.exe
  2⤵
  PID:14528
- C:\Windows\System\WHnNcsQ.exe
  C:\Windows\System\WHnNcsQ.exe
  2⤵
  PID:14548
- C:\Windows\System\xGSmJHD.exe
  C:\Windows\System\xGSmJHD.exe
  2⤵
  PID:14568
- C:\Windows\System\ORjTFFo.exe
  C:\Windows\System\ORjTFFo.exe
  2⤵
  PID:14592
- C:\Windows\System\JphDFHJ.exe
  C:\Windows\System\JphDFHJ.exe
  2⤵
  PID:14616
- C:\Windows\System\djCKFyr.exe
  C:\Windows\System\djCKFyr.exe
  2⤵
  PID:14648
- C:\Windows\System\UNfhJjK.exe
  C:\Windows\System\UNfhJjK.exe
  2⤵
  PID:14664
- C:\Windows\System\kPEGsNj.exe
  C:\Windows\System\kPEGsNj.exe
  2⤵
  PID:14688
- C:\Windows\System\MTUjwaP.exe
  C:\Windows\System\MTUjwaP.exe
  2⤵
  PID:14712
- C:\Windows\System\NXhdPAE.exe
  C:\Windows\System\NXhdPAE.exe
  2⤵
  PID:14732
- C:\Windows\System\HobFkHj.exe
  C:\Windows\System\HobFkHj.exe
  2⤵
  PID:14760
- C:\Windows\System\MsxINyq.exe
  C:\Windows\System\MsxINyq.exe
  2⤵
  PID:14780
- C:\Windows\System\LBJxxRb.exe
  C:\Windows\System\LBJxxRb.exe
  2⤵
  PID:14804
- C:\Windows\System\slboyma.exe
  C:\Windows\System\slboyma.exe
  2⤵
  PID:14832
- C:\Windows\System\ZeSacyH.exe
  C:\Windows\System\ZeSacyH.exe
  2⤵
  PID:14856
- C:\Windows\System\OtmZBlY.exe
  C:\Windows\System\OtmZBlY.exe
  2⤵
  PID:14872
- C:\Windows\System\KlOzVSI.exe
  C:\Windows\System\KlOzVSI.exe
  2⤵
  PID:14892
- C:\Windows\System\Cgkvjjo.exe
  C:\Windows\System\Cgkvjjo.exe
  2⤵
  PID:14920
- C:\Windows\System\SVQjweq.exe
  C:\Windows\System\SVQjweq.exe
  2⤵
  PID:14936
- C:\Windows\System\wIvqZjz.exe
  C:\Windows\System\wIvqZjz.exe
  2⤵
  PID:14960
- C:\Windows\System\lzxtpyI.exe
  C:\Windows\System\lzxtpyI.exe
  2⤵
  PID:14988
- C:\Windows\System\wTcsysa.exe
  C:\Windows\System\wTcsysa.exe
  2⤵
  PID:15012
- C:\Windows\System\kWHPiOA.exe
  C:\Windows\System\kWHPiOA.exe
  2⤵
  PID:15040
- C:\Windows\System\LZkvRFu.exe
  C:\Windows\System\LZkvRFu.exe
  2⤵
  PID:15056
- C:\Windows\System\OUFViup.exe
  C:\Windows\System\OUFViup.exe
  2⤵
  PID:15084
- C:\Windows\System\eGYKQrs.exe
  C:\Windows\System\eGYKQrs.exe
  2⤵
  PID:15108
- C:\Windows\System\PGjDdha.exe
  C:\Windows\System\PGjDdha.exe
  2⤵
  PID:15140
- C:\Windows\System\gkjNjxw.exe
  C:\Windows\System\gkjNjxw.exe
  2⤵
  PID:15172
- C:\Windows\System\kQKerkl.exe
  C:\Windows\System\kQKerkl.exe
  2⤵
  PID:15188
- C:\Windows\System\lvSoTzE.exe
  C:\Windows\System\lvSoTzE.exe
  2⤵
  PID:15212
- C:\Windows\System\mepETyj.exe
  C:\Windows\System\mepETyj.exe
  2⤵
  PID:15240
- C:\Windows\System\QqnrEVu.exe
  C:\Windows\System\QqnrEVu.exe
  2⤵
  PID:15268
- C:\Windows\System\BFLYZtB.exe
  C:\Windows\System\BFLYZtB.exe
  2⤵
  PID:15292
- C:\Windows\System\fgQeojm.exe
  C:\Windows\System\fgQeojm.exe
  2⤵
  PID:15320
- C:\Windows\System\FBGStiN.exe
  C:\Windows\System\FBGStiN.exe
  2⤵
  PID:15344
- C:\Windows\System\SVMTMxU.exe
  C:\Windows\System\SVMTMxU.exe
  2⤵
  PID:13568
- C:\Windows\System\OxaWJOY.exe
  C:\Windows\System\OxaWJOY.exe
  2⤵
  PID:14288
- C:\Windows\System\UPyoVXj.exe
  C:\Windows\System\UPyoVXj.exe
  2⤵
  PID:9000
- C:\Windows\System\DdBbLYy.exe
  C:\Windows\System\DdBbLYy.exe
  2⤵
  PID:11252
- C:\Windows\System\FjHxpdy.exe
  C:\Windows\System\FjHxpdy.exe
  2⤵
  PID:13240
- C:\Windows\System\TUdjPFv.exe
  C:\Windows\System\TUdjPFv.exe
  2⤵
  PID:12984
- C:\Windows\System\eVuqjwX.exe
  C:\Windows\System\eVuqjwX.exe
  2⤵
  PID:13308
- C:\Windows\System\TPZAepm.exe
  C:\Windows\System\TPZAepm.exe
  2⤵
  PID:13164
- C:\Windows\System\vCsfkOy.exe
  C:\Windows\System\vCsfkOy.exe
  2⤵
  PID:12876
- C:\Windows\System\TMuCsip.exe
  C:\Windows\System\TMuCsip.exe
  2⤵
  PID:13356
- C:\Windows\System\mgCuPgg.exe
  C:\Windows\System\mgCuPgg.exe
  2⤵
  PID:13440
- C:\Windows\System\cCYBqbc.exe
  C:\Windows\System\cCYBqbc.exe
  2⤵
  PID:12880
- C:\Windows\System\mUBThwM.exe
  C:\Windows\System\mUBThwM.exe
  2⤵
  PID:14140
- C:\Windows\System\wVoiVkC.exe
  C:\Windows\System\wVoiVkC.exe
  2⤵
  PID:14240
- C:\Windows\System\mFCjiSC.exe
  C:\Windows\System\mFCjiSC.exe
  2⤵
  PID:14284
- C:\Windows\System\JrVKqce.exe
  C:\Windows\System\JrVKqce.exe
  2⤵
  PID:14320
- C:\Windows\System\WubXpof.exe
  C:\Windows\System\WubXpof.exe
  2⤵
  PID:13724
- C:\Windows\System\zeSMurq.exe
  C:\Windows\System\zeSMurq.exe
  2⤵
  PID:13040
- C:\Windows\System\pssKZOo.exe
  C:\Windows\System\pssKZOo.exe
  2⤵
  PID:13784
- C:\Windows\System\MdZRkNx.exe
  C:\Windows\System\MdZRkNx.exe
  2⤵
  PID:13828
- C:\Windows\System\DqreOdf.exe
  C:\Windows\System\DqreOdf.exe
  2⤵
  PID:14704
- C:\Windows\System\jElHXzX.exe
  C:\Windows\System\jElHXzX.exe
  2⤵
  PID:14724
- C:\Windows\System\WnHewxA.exe
  C:\Windows\System\WnHewxA.exe
  2⤵
  PID:14820
- C:\Windows\System\CXNUagQ.exe
  C:\Windows\System\CXNUagQ.exe
  2⤵
  PID:14020
- C:\Windows\System\XiYeKgp.exe
  C:\Windows\System\XiYeKgp.exe
  2⤵
  PID:14864
- C:\Windows\System\vPXlBxs.exe
  C:\Windows\System\vPXlBxs.exe
  2⤵
  PID:12420
- C:\Windows\System\fHInUuK.exe
  C:\Windows\System\fHInUuK.exe
  2⤵
  PID:14984
- C:\Windows\System\IZToskl.exe
  C:\Windows\System\IZToskl.exe
  2⤵
  PID:14168
- C:\Windows\System\JRfaJrC.exe
  C:\Windows\System\JRfaJrC.exe
  2⤵
  PID:15388
- C:\Windows\System\eqnVEVC.exe
  C:\Windows\System\eqnVEVC.exe
  2⤵
  PID:15404
- C:\Windows\System\aMBQfLB.exe
  C:\Windows\System\aMBQfLB.exe
  2⤵
  PID:15432
- C:\Windows\System\TcfarQJ.exe
  C:\Windows\System\TcfarQJ.exe
  2⤵
  PID:15456
- C:\Windows\System\IkxEcTn.exe
  C:\Windows\System\IkxEcTn.exe
  2⤵
  PID:15484
- C:\Windows\System\HpmdmsM.exe
  C:\Windows\System\HpmdmsM.exe
  2⤵
  PID:15500
- C:\Windows\System\IzzTyuj.exe
  C:\Windows\System\IzzTyuj.exe
  2⤵
  PID:15520
- C:\Windows\System\sMoafKn.exe
  C:\Windows\System\sMoafKn.exe
  2⤵
  PID:15540
- C:\Windows\System\IjEFkUc.exe
  C:\Windows\System\IjEFkUc.exe
  2⤵
  PID:15564
- C:\Windows\System\puvadrW.exe
  C:\Windows\System\puvadrW.exe
  2⤵
  PID:15584
- C:\Windows\System\NDRASah.exe
  C:\Windows\System\NDRASah.exe
  2⤵
  PID:15608
- C:\Windows\System\GQNoDCs.exe
  C:\Windows\System\GQNoDCs.exe
  2⤵
  PID:15640
- C:\Windows\System\lWKGPHx.exe
  C:\Windows\System\lWKGPHx.exe
  2⤵
  PID:15660
- C:\Windows\System\FNuFVBl.exe
  C:\Windows\System\FNuFVBl.exe
  2⤵
  PID:15680
- C:\Windows\System\qjbObZr.exe
  C:\Windows\System\qjbObZr.exe
  2⤵
  PID:15708
- C:\Windows\System\WqZWLRk.exe
  C:\Windows\System\WqZWLRk.exe
  2⤵
  PID:15728
- C:\Windows\System\PaJaLQu.exe
  C:\Windows\System\PaJaLQu.exe
  2⤵
  PID:15744
- C:\Windows\System\uIfiuBI.exe
  C:\Windows\System\uIfiuBI.exe
  2⤵
  PID:15764
- C:\Windows\System\RHjJekz.exe
  C:\Windows\System\RHjJekz.exe
  2⤵
  PID:15792
- C:\Windows\System\MYwWSfX.exe
  C:\Windows\System\MYwWSfX.exe
  2⤵
  PID:15816
- C:\Windows\System\GZITsBh.exe
  C:\Windows\System\GZITsBh.exe
  2⤵
  PID:15848
- C:\Windows\System\GHMUGly.exe
  C:\Windows\System\GHMUGly.exe
  2⤵
  PID:15872
- C:\Windows\System\Nbvdvcd.exe
  C:\Windows\System\Nbvdvcd.exe
  2⤵
  PID:15892
- C:\Windows\System\IQKqTzy.exe
  C:\Windows\System\IQKqTzy.exe
  2⤵
  PID:15924
- C:\Windows\System\xEmJUxs.exe
  C:\Windows\System\xEmJUxs.exe
  2⤵
  PID:15948
- C:\Windows\System\hTQuFVR.exe
  C:\Windows\System\hTQuFVR.exe
  2⤵
  PID:15972
- C:\Windows\System\DWSeQHc.exe
  C:\Windows\System\DWSeQHc.exe
  2⤵
  PID:15992
- C:\Windows\System\uZYAVtv.exe
  C:\Windows\System\uZYAVtv.exe
  2⤵
  PID:16020
- C:\Windows\System\jnaNwGG.exe
  C:\Windows\System\jnaNwGG.exe
  2⤵
  PID:16048
- C:\Windows\System\vfkPxlY.exe
  C:\Windows\System\vfkPxlY.exe
  2⤵
  PID:16068
- C:\Windows\System\SXJnDnc.exe
  C:\Windows\System\SXJnDnc.exe
  2⤵
  PID:16092
- C:\Windows\System\zqgHuvI.exe
  C:\Windows\System\zqgHuvI.exe
  2⤵
  PID:16112
- C:\Windows\System\qcfQbEV.exe
  C:\Windows\System\qcfQbEV.exe
  2⤵
  PID:16144
- C:\Windows\System\SippSFh.exe
  C:\Windows\System\SippSFh.exe
  2⤵
  PID:16180
- C:\Windows\System\bFIjkoO.exe
  C:\Windows\System\bFIjkoO.exe
  2⤵
  PID:16200
- C:\Windows\System\sMegJes.exe
  C:\Windows\System\sMegJes.exe
  2⤵
  PID:16228
- C:\Windows\System\ZROSJjT.exe
  C:\Windows\System\ZROSJjT.exe
  2⤵
  PID:16244
- C:\Windows\System\ISxtDFq.exe
  C:\Windows\System\ISxtDFq.exe
  2⤵
  PID:16268
- C:\Windows\System\yyUxaQh.exe
  C:\Windows\System\yyUxaQh.exe
  2⤵
  PID:16284
- C:\Windows\System\DNcyNVR.exe
  C:\Windows\System\DNcyNVR.exe
  2⤵
  PID:16316
- C:\Windows\System\PWMOwMI.exe
  C:\Windows\System\PWMOwMI.exe
  2⤵
  PID:16332
- C:\Windows\System\KVLcOkj.exe
  C:\Windows\System\KVLcOkj.exe
  2⤵
  PID:16356
- C:\Windows\System\EEebpCp.exe
  C:\Windows\System\EEebpCp.exe
  2⤵
  PID:16372
- C:\Windows\System\MDfAVAV.exe
  C:\Windows\System\MDfAVAV.exe
  2⤵
  PID:13544
- C:\Windows\System\OkKsuwI.exe
  C:\Windows\System\OkKsuwI.exe
  2⤵
  PID:14348
- C:\Windows\System\eyfmSZA.exe
  C:\Windows\System\eyfmSZA.exe
  2⤵
  PID:14368
- C:\Windows\System\tUletmp.exe
  C:\Windows\System\tUletmp.exe
  2⤵
  PID:15284
- C:\Windows\System\LEEZztj.exe
  C:\Windows\System\LEEZztj.exe
  2⤵
  PID:15316
- C:\Windows\System\zKrCYsy.exe
  C:\Windows\System\zKrCYsy.exe
  2⤵
  PID:15352
- C:\Windows\System\bjvRgww.exe
  C:\Windows\System\bjvRgww.exe
  2⤵
  PID:14588
- C:\Windows\System\tmQtOFl.exe
  C:\Windows\System\tmQtOFl.exe
  2⤵
  PID:14676
- C:\Windows\System\DYEguAs.exe
  C:\Windows\System\DYEguAs.exe
  2⤵
  PID:13896
- C:\Windows\System\EwPOGSJ.exe
  C:\Windows\System\EwPOGSJ.exe
  2⤵
  PID:13596
- C:\Windows\System\UCronDj.exe
  C:\Windows\System\UCronDj.exe
  2⤵
  PID:12016
- C:\Windows\System\pvwbpmR.exe
  C:\Windows\System\pvwbpmR.exe
  2⤵
  PID:13348
- C:\Windows\System\bsSZKvH.exe
  C:\Windows\System\bsSZKvH.exe
  2⤵
  PID:14212
- C:\Windows\System\jjRgocT.exe
  C:\Windows\System\jjRgocT.exe
  2⤵
  PID:14436
- C:\Windows\System\PNPKXRP.exe
  C:\Windows\System\PNPKXRP.exe
  2⤵
  PID:14576
- C:\Windows\System\syKiupK.exe
  C:\Windows\System\syKiupK.exe
  2⤵
  PID:14888
- C:\Windows\System\PWvpykj.exe
  C:\Windows\System\PWvpykj.exe
  2⤵
  PID:14932
- C:\Windows\System\pwYOcpZ.exe
  C:\Windows\System\pwYOcpZ.exe
  2⤵
  PID:13416
- C:\Windows\System\IUFFSpJ.exe
  C:\Windows\System\IUFFSpJ.exe
  2⤵
  PID:11860
- C:\Windows\System\CZJbnEz.exe
  C:\Windows\System\CZJbnEz.exe
  2⤵
  PID:14016
- C:\Windows\System\bTCGmJj.exe
  C:\Windows\System\bTCGmJj.exe
  2⤵
  PID:13472
- C:\Windows\System\ewtQRzI.exe
  C:\Windows\System\ewtQRzI.exe
  2⤵
  PID:15224
- C:\Windows\System\hgxBMGU.exe
  C:\Windows\System\hgxBMGU.exe
  2⤵
  PID:15528
- C:\Windows\System\qRDWMSJ.exe
  C:\Windows\System\qRDWMSJ.exe
  2⤵
  PID:15620
- C:\Windows\System\bQvyZaA.exe
  C:\Windows\System\bQvyZaA.exe
  2⤵
  PID:15668
- C:\Windows\System\nBKlzHS.exe
  C:\Windows\System\nBKlzHS.exe
  2⤵
  PID:15772
- C:\Windows\System\RfLYIQF.exe
  C:\Windows\System\RfLYIQF.exe
  2⤵
  PID:15812
- C:\Windows\System\RNWJzQI.exe
  C:\Windows\System\RNWJzQI.exe
  2⤵
  PID:16400
- C:\Windows\System\IUFmqld.exe
  C:\Windows\System\IUFmqld.exe
  2⤵
  PID:16432
- C:\Windows\System\sRiNves.exe
  C:\Windows\System\sRiNves.exe
  2⤵
  PID:16468
- C:\Windows\System\kJdxNVm.exe
  C:\Windows\System\kJdxNVm.exe
  2⤵
  PID:16496
- C:\Windows\System\dwFIPnA.exe
  C:\Windows\System\dwFIPnA.exe
  2⤵
  PID:16520
- C:\Windows\System\iThoyWR.exe
  C:\Windows\System\iThoyWR.exe
  2⤵
  PID:16536
- C:\Windows\System\zfdjxNa.exe
  C:\Windows\System\zfdjxNa.exe
  2⤵
  PID:16564
- C:\Windows\System\lHToLEl.exe
  C:\Windows\System\lHToLEl.exe
  2⤵
  PID:16584
- C:\Windows\System\qxtNPlZ.exe
  C:\Windows\System\qxtNPlZ.exe
  2⤵
  PID:16604
- C:\Windows\System\jappnbM.exe
  C:\Windows\System\jappnbM.exe
  2⤵
  PID:16620
- C:\Windows\System\gMSOnyD.exe
  C:\Windows\System\gMSOnyD.exe
  2⤵
  PID:16644
- C:\Windows\System\QirStFV.exe
  C:\Windows\System\QirStFV.exe
  2⤵
  PID:16672
- C:\Windows\System\oQMseEm.exe
  C:\Windows\System\oQMseEm.exe
  2⤵
  PID:16700
- C:\Windows\System\LSHikWS.exe
  C:\Windows\System\LSHikWS.exe
  2⤵
  PID:16720
- C:\Windows\System\xsggvyA.exe
  C:\Windows\System\xsggvyA.exe
  2⤵
  PID:16736
- C:\Windows\System\jnHlbCS.exe
  C:\Windows\System\jnHlbCS.exe
  2⤵
  PID:16756
- C:\Windows\System\lqsmOFc.exe
  C:\Windows\System\lqsmOFc.exe
  2⤵
  PID:16788
- C:\Windows\System\eQtjVzc.exe
  C:\Windows\System\eQtjVzc.exe
  2⤵
  PID:16808
- C:\Windows\System\isJWwsu.exe
  C:\Windows\System\isJWwsu.exe
  2⤵
  PID:16824
- C:\Windows\System\hWiXTam.exe
  C:\Windows\System\hWiXTam.exe
  2⤵
  PID:16848
- C:\Windows\System\irFNeXY.exe
  C:\Windows\System\irFNeXY.exe
  2⤵
  PID:16872
- C:\Windows\System\GTrcwiF.exe
  C:\Windows\System\GTrcwiF.exe
  2⤵
  PID:16900
- C:\Windows\System\ctPWJbk.exe
  C:\Windows\System\ctPWJbk.exe
  2⤵
  PID:16920
- C:\Windows\System\SKvGdVe.exe
  C:\Windows\System\SKvGdVe.exe
  2⤵
  PID:16948
- C:\Windows\System\mypFLPl.exe
  C:\Windows\System\mypFLPl.exe
  2⤵
  PID:16964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BtFsnei.exe

Filesize
1.1MB

MD5
3539bfb1a86dead02d54fe4d465e87de

SHA1
ede985c7b797c29c5f623612a58527426780bccf

SHA256
8231a9a70278e1832059ac081fa355271054450c459002b3221aa4367da8ad9a

SHA512
a18f0373a9f4fe99eb1f00884bce3bc5174a4a2854f0efafeec43c688643e7902d36c5ccd2bb840fdfacd008f32e9ed4f9595002ee4ba9a94e3d5eae1118f11f

Download Submit
C:\Windows\System\CDnowny.exe

Filesize
1.1MB

MD5
c114dc2d75e0e163970d0eb66b7290d8

SHA1
4c0ee6b040f181288e203727acfd10a370f690fa

SHA256
7128da6693026bfacd413ab2c3c99af2690215a298f827b8977a9aa16c01b944

SHA512
21ced413d6a7120855b6e6eb042a9b998e73121094ec39c1df3271d6e26d02fdadba708aeaf45c1d6506dcaa428ab18280eef33f040fdc6049e066a1eeeb0e44

Download Submit
C:\Windows\System\CNhFHlM.exe

Filesize
1.1MB

MD5
9f948c13477750fd8682e14002cb68bd

SHA1
a2e7d516caa974d412f06662aae49cacf9f18de0

SHA256
e26a395c918632921fe6a361acf46834bbb0762315c3ae3bdfe30fac99e46b94

SHA512
b06213077ff5278c836c2105511896007f5f6184910b0c0155862f6aa8e1b469602bae290f4abbc81ffcecf04ae49bd25e1028dbd7fed62211ed9ebddf613f48

Download Submit
C:\Windows\System\JipiYBO.exe

Filesize
1.1MB

MD5
2ddf2b147a617e491bd918c941acfaa4

SHA1
98b49bb8e176b04c17c69f0919d841ffa85c912d

SHA256
f64278b9632e0f03e56d9f39adc71c1e0966e5c3233ad3f30d17e27646506b80

SHA512
e101c7b180edb212423a28fcabe8da48be46f784f23219ba475f395db9c77d2f293fe13f8b3bb8b9563824a1c75a193c27ae270ff579c38a42fde5c209e95c4b

Download Submit
C:\Windows\System\JjUnBCF.exe

Filesize
1.1MB

MD5
7922cd99dd8b50364ed74e5c5226c385

SHA1
07f9efec2b619fc50f028431f436f167e75d5e44

SHA256
170d8dec2b35d76243041bf5b81da2c5cd9ee95c4f6f2649adab6a993d8f11d8

SHA512
d7b307fe2aa941462f8f23b7769bdd352acd8f38da008c8809a08596ea09e0be6248859e6c6f5387d153e1040d79e4e0e72bba435ca65952fc3cbb6af1052122

Download Submit
C:\Windows\System\JyviGdW.exe

Filesize
1.1MB

MD5
5aa21fa93e8e13ab45de5408d30a59e1

SHA1
1e66e85205633952b562968afbea93b8ef9ee714

SHA256
cf5709dd886485b2c552491b5f2b34d2e551b2e4d47d54f7134ee4ece0a3c933

SHA512
9a0d4acd74d4131343cad413e79e2ce2786e7d95e55a72ca12b1ea652773b112ae8497d1510544fc0428aacd16ff39b53e9e17ac546f4c4b90ff60864ff6a15e

Download Submit
C:\Windows\System\KRFthnV.exe

Filesize
1.1MB

MD5
dab7dbef06f52b5c93e5a319cdd823c0

SHA1
3ce6f4dfa3e041e4e833786804a285f2d120022c

SHA256
bbe2c2fff82b4f9283dbc6ab5941f873785d771dad6d36073a734fd04becb0b2

SHA512
ddad67a27a575beedb7b602fb952823dea8b890e1d586f9a1eff8a5e922d0922843879d08480f250c7139e31cd5fa3fd90a53b180e4254784b078c225fba53f0

Download Submit
C:\Windows\System\LqjHCHK.exe

Filesize
1.1MB

MD5
84ae9c5e9b367fa060c28829e6b7f690

SHA1
87207f6047d9e22ecfab2d913877a906933856f9

SHA256
70ca1ab7e87f9a5f8af56dc56f4f33effb7a2e4ef3218bd3b9e9a852a3f09b99

SHA512
4211afbd5c2343bce745d86f5b7fdf8ff932a3912a7d6c2693542fe06cc63d1bb539c1493f016d87df6133bd52928168bd145f9c46c234f1e1f81bb89eff369c

Download Submit
C:\Windows\System\MwyYHnw.exe

Filesize
1.1MB

MD5
4e8503b3a66d55c550f256283a43bd1b

SHA1
a42ccf5af69abe503fe802f328991e50ea59f761

SHA256
df66addf027b4fdc34e782ed843c726ddf583ce4129d37489be00dfc2f07b9d8

SHA512
b1e794e28aed9cc6346888e97f008376964423d03c436449f465850ba35bcf16703abe353e5b10f20763dbc43cf9bb51ef683fcbd527b8f7861eb5e99695bdb0

Download Submit
C:\Windows\System\MxvwklR.exe

Filesize
1.1MB

MD5
beccc5143acc20a30a862774588dc913

SHA1
8ab6667f05f52edb0659d2493db8e2c9977fd89d

SHA256
bb6a2e0dd64aa94901b07842ae0f5339f6f4e4383ffd82e19da8b608d337ce64

SHA512
b0236a132ab9b8f31be6f28e32b864c12c7b5dd9cdb801fc373efc5490ab22769e25134a5a8b1318fa432794d46c064df7b0ef129c50b322942902b8534a6649

Download Submit
C:\Windows\System\NwUQjSP.exe

Filesize
1.1MB

MD5
e471de8ab17979eb6adb3f092d59ffbc

SHA1
3eae5c6934383af751a0c0d0685190d0a39fc66e

SHA256
2606c0ed8a90a46545138b7ef5f44c6e71eeee11f851af97d6560a74274a1101

SHA512
8bec0ce2b4085579a4db1f4877f98b1471e833f6ed8c11bc8a31e1c32a889960e52604a92d4d7467229b9b5629b4735b1f49cfbc25b262abf5a5edd7b0b8303c

Download Submit
C:\Windows\System\OUvlsCc.exe

Filesize
1.1MB

MD5
1330fce9a014ae0f7aa852d3c3dc861c

SHA1
68862e6bd080df39501e911ebc87ee85c808a5c4

SHA256
4763ff634aaf170dcb8ad3cc8edafd420788a385ca1d902379444ea891bb2d6c

SHA512
54552233790ea17eea831d46db18996bd10e93b069edf4348a9b18af3d5fbcfe854b3397dc2b84e4ca16dce9af61518b12a3bdae11177a8e604b3c343a805852

Download Submit
C:\Windows\System\PNBIcCM.exe

Filesize
1.1MB

MD5
ecd203f563eaabf8d6f188d983d1b4f6

SHA1
5777663ede02fe363ce54a243ebf73a31334b0a8

SHA256
333ab94aefd5b9b093db893387a1614de1cfca0a5c59a1372056a5f981c5fbfe

SHA512
74fc48d1da025945b0932ad53e0a2f262caec2202b6559e86a38155bcadf902565914018479e4717341fa84cdc104b306069ef301fa270cf3d2eb232ee8a7ab0

Download Submit
C:\Windows\System\SaXpTFi.exe

Filesize
1.1MB

MD5
9dce48f38e7ed3089f1d40ad55125c30

SHA1
c3e26a4ce926cf6d95fc129f56bd213fdf24cc38

SHA256
c252bc636717e4008c54f199ff870eda3258c664cd310d4d39748a9ab8638a1a

SHA512
0c1e89506a988abbb6b214eefbaf2101cf9c52a3926052ea72dae4b94ba1e4a9c9e1941e518a5630aff1ba06d56fbb06f56b548977adfc7f4dfc62bdc6942095

Download Submit
C:\Windows\System\VYUPdMM.exe

Filesize
1.1MB

MD5
572403723575542381dbc14c310e8590

SHA1
04f1b4cc826da9f3c35a7b8c81483288114579f0

SHA256
2993fed5bd42fa31f5d333dba4823de4b725b1a8e8a1e39ac9cc0df68c136ae3

SHA512
95a1ce04b958087ab069882ec48641b2de482d9607e603a1b70993754d8feafa84be22858c565e10a90a43f291604d30c894518e441cf00d82a5b655029fe1e1

Download Submit
C:\Windows\System\WkJcDCW.exe

Filesize
1.1MB

MD5
5ac4b8f31094e59d3cf1ed9cdfa40ba6

SHA1
3ca489c26d72029f155a9529376f7998a444ed17

SHA256
8c360ad2dc01db6c65aa34fd24d10c89208f0ecd15c59ed4990a0e21b18cf4cb

SHA512
3d66a0c410ff783b16b2d62f81b7b1732905a4cf08915b74e05ed4feeee4855c80cc5f8568897ecb8df1a8b7f42e9376d4e56984298313786147ef6aa2e888f5

Download Submit
C:\Windows\System\XVyhhdh.exe

Filesize
1.1MB

MD5
09923b753abf5d919b99f4cc1e9d0654

SHA1
cdf25c6d1e7f1a06556797304ab8001eb380b2c7

SHA256
99e7ed42e09dca23380434dd83de427d1fe03ff51ddcce7751e0055763bfe794

SHA512
5297dc5873359eca07842d9f91aec855bbbc31a9e8412033c1100b08fc57a13c80794f7118f351b6a577eac42a6167b6de347cf13c30f041c6c1b82180948f41

Download Submit
C:\Windows\System\ZPWKIxd.exe

Filesize
1.1MB

MD5
b9b28db5c908ce2fe70ac6414bead5bb

SHA1
8c23fd643cf78eb4bb57b8a02cf8d37282ab9dd4

SHA256
5df32385bc4181da9b33544b3d8e6bf07bcf3ab6662fd42f889472440daf7c27

SHA512
2ca6a01a09b63575faa08ba25157abc6ddada4e485b15dc18781a2094ff283ac731f0288d17359a320ea08668d5ba791d4b6d7f344a2d3fb369e2e75b6daf096

Download Submit
C:\Windows\System\ZfIJLTK.exe

Filesize
1.1MB

MD5
ab2937d83bcbc61fc78b8c95a0632466

SHA1
14eed9bef5db1592122430a43e2aad16c64e293d

SHA256
4c1342d4edfef52df8286d513cf3d6a1b9091504b6f64e213353c7096907eea2

SHA512
7da3be548e8831d0cbdb0ffd0e3bd89ba2beccd8ca9de29fa53fbe1a1ed040f8a9b7a1d9972caf3a401efba797ec9b7148708531fa29e34d89d1a2d9e07fa245

Download Submit
C:\Windows\System\bSvLDGG.exe

Filesize
1.1MB

MD5
8a5856448d102b0ba5285770fc76e90f

SHA1
2c51a39edbdc9629372b4d081dc204ac638006de

SHA256
4aae75431b9f3ef29493a8c8f44cbf4fd1cb6afe240d94edee89624841af36eb

SHA512
4db30a195c223cd5af0a5c6e741972ff5a06fa70a52141fd928408b57d424f2c80fe1fd80c39856b84ccab3c186af2d952dd8fdcbe7904f0cc0e0468a24cc455

Download Submit
C:\Windows\System\fSWxgCD.exe

Filesize
1.1MB

MD5
2fe69bc0a4f33de0bf91208f16048aa6

SHA1
512f9cf5f017e2928d7a7d15333da96d2dc6dd89

SHA256
b54232a61a725c365d0295c903bb0e20d0576b66e0a057357f603c89bd84e0d2

SHA512
f47266d67206b36df4aada9bd469330f0a0e367d9829530e2356c4f25ae6b06e6ad52374eaa76184caa37ac6f82f21d4263aa2265e3fc46c6b926dea7dcb2a3e

Download Submit
C:\Windows\System\gAkmKQl.exe

Filesize
1.1MB

MD5
c323ee1d042dd4f5706c771e2b3efdeb

SHA1
5677297d986fd03bfa0bc8c6fbe5489e543bc581

SHA256
f046dbf8c895205376e8196dffb171df4ce80b051f6759a0c2ffe8a7617fa387

SHA512
1115cabf5a45e3bbebac38fac81cefa8cc1a88d837b26eec8baa3e05fa05bf4e5a084712693a5e1a63d5ad4c42946b2f8cb8aa757999a2a7d49cd7a9ae628ead

Download Submit
C:\Windows\System\hzIZMuA.exe

Filesize
1.1MB

MD5
77e3aeebc7803571d4407e46f23e32d5

SHA1
a0bc371327ede0ffa1b19f4b67663befb6680212

SHA256
d90ec5bcb81f7ae356c5c7c9e0f886046e851f15a329ba439e2a48a2b5c9cc12

SHA512
0c655c6a78044e510fb12548f85c55a02abe051161c00e11e9950ddf222f72a1429bdd2fe9b07ec94ad28ac9b77de229e0e181944394db7db8626bd41c266d51

Download Submit
C:\Windows\System\nSnRuEQ.exe

Filesize
1.1MB

MD5
b4f9a3904b724ba87fe682184a534613

SHA1
6546690956317e2fb7b94c1cca2e0e50836fc47d

SHA256
a9c2cd94f86c4795727f2e7e507700e57d905c1759d87b86ca48aeaa69935aa2

SHA512
d7a6fbff490b3f738ab1a6d43a3e8c8a1c6d9e665d076c69aab06f00040d13daa5091595e9f7becfdb670b289f39965bb2c8cc69ed251b7d1b776bbfc4e9e8ce

Download Submit
C:\Windows\System\oUJxwei.exe

Filesize
1.1MB

MD5
1f540434696b5d3ef64688bfe6c66e66

SHA1
22e1fa80fc17a627ecda38e97b81b44bc0fc833b

SHA256
436f2fb5480c125074783c0b70a55a3994c7e90e63f5e20d96c4e6a02d49ad4b

SHA512
6f245578f882d50e22a36979f19144290ec5d826da86f1740b82fce477c09a82536a2dc518d31bcec88204c2ae17a4c778fd463178794906a26068130b75a73e

Download Submit
C:\Windows\System\rVGewae.exe

Filesize
1.1MB

MD5
d14f9159b61d9be2211b1b9f8786a22f

SHA1
3ac9c4dbb920a2599ec36fd57183e480466df1dc

SHA256
cac7b1b3073ed76c5f36f58eb115ba87d93b8c95b9a904ecc6f281802ca256d4

SHA512
7eb14d07ad60d05ccf5782f470dac46e079abecf2fac1a029a28629aab76b8f47e887ad1cc40d39561b226df4361e65577409a4c2d90976bf94dbf2194826d63

Download Submit
C:\Windows\System\rcYGyJN.exe

Filesize
1.1MB

MD5
64535af9db367ac41206bfdd44a89431

SHA1
f25a175c44c0c7ca83fea7d18e950199e3a85317

SHA256
470f1f2867aa922068561d63326c86fd9be71b714692e70122762f3d9f5f4234

SHA512
a43496992c2d62fae1cfd33beb9f31d7aa953d907836aeeedf6119dce3ec71ae79fb80e484865bb2772487bd1f725a524e9442dbba98796e7fd49d2d623670c6

Download Submit
C:\Windows\System\rpCpTTQ.exe

Filesize
1.1MB

MD5
690f1e13de1ca0fb6cf22acbf63eb95e

SHA1
a17955eec53a86172eba7e6f7eda8f6e7e237465

SHA256
5e47404b01cc86a526f9beab3b41122ad5f13c45757bc6b46bc3eeda0ae4a8fa

SHA512
7f0d0fc4ee9253d84796f0ea0c4dd6bed9f8d3afb96a6d4eef2af61292e640ed7767753c7bcfc6404644b1d7280fd8119634c757fd4322bde4f22fd754a94c41

Download Submit
C:\Windows\System\uCfzZnC.exe

Filesize
1.1MB

MD5
6304cf8159ca94a43ea2921298882bb8

SHA1
c7cba30e3d53f90c1021641cec26ef6a8d5b3e0c

SHA256
fbc188d0af8888aed195677a3d065f9d30fe9f6be25be1511572e57052fe627d

SHA512
6b9dcb79038f4e82527daefb058cb18bdad97565233d8659ca20149666417e6d5bcb5fd2109cb136a26ce9805b252d18166608ff0afabb4e56865751a9a8efc3

Download Submit
C:\Windows\System\xWQyNZB.exe

Filesize
1.1MB

MD5
ccda75cd2f6776273e5cdef9305f6116

SHA1
cbc403313ab4255eff52a181d1ddd4937fdce392

SHA256
66e5f85dcd4af222ccd146d1dc0e5385e674f37e16456203c09c2d2b4e829bbf

SHA512
95f601dbc08384c7220b815aff9b0e3cb3dab5e90bd6487ef70c5169fbf2bbb49d774606883b3f3d231af29085a00757b45371fb3cc26cf133382ddc092b78e8

Download Submit
C:\Windows\System\xemeYKK.exe

Filesize
1.1MB

MD5
cca6868e4c88ab8dcb7e9bc3b9ce555f

SHA1
0a4656caa7e9c64ce12cb0e8ee958e2d6d2d6dfd

SHA256
712ea97170dd4ee7f66a88478097c2e68bb145be927a25fdb1db5792c6f40358

SHA512
5f61053b870e82f1429521c3598b95e0dd3e1177e66933cb45b05705566abd0b54e494256e0860e097d7f5cdb7bb8840ee80c18f7e0e6e6bcc77991145698a01

Download Submit
C:\Windows\System\zpZHWne.exe

Filesize
1.1MB

MD5
5ecc95edfb20dc5b7e75cf193b7a626b

SHA1
899214612332657bfbb457246a78aa81a37d2383

SHA256
a6f79b44ce80c4d813a1fcf106491018a2f86004c1dbf70848111504f9bd8ccb

SHA512
290bcc7b598d40ead6eb37c4a3e590496f851addb3af90ca5e28417206848a44bba0a90c84db1da566baada595415f2a280f33dd0c98d49b8b19b61925cb1ddf

Download Submit
memory/3080-0-0x0000020F70BE0000-0x0000020F70BF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads