xmrig | dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
Size

1.7MB
MD5

29bc5b9010285de07fcc150ae396a100
SHA1

fe1ea3e5433b03a75b97175fd1904628957220e9
SHA256

dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633
SHA512

90cbfe27c44fddd3db69053b3634676c22944c60e4c26ee04548ee8d546d0e786b8bfc1aab9d2ded4b087930cf9f527439879c022c2bc25e4672550308f1ca2f
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLU:GemTLkNdfE0pZyJ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b3e-4.dat	xmrig
behavioral2/files/0x000a000000023b9c-7.dat	xmrig
behavioral2/files/0x000a000000023b9e-18.dat	xmrig
behavioral2/files/0x000b000000023ba3-33.dat	xmrig
behavioral2/files/0x0008000000023bbd-48.dat	xmrig
behavioral2/files/0x0008000000023bcf-76.dat	xmrig
behavioral2/files/0x0008000000023bff-117.dat	xmrig
behavioral2/files/0x0008000000023c09-154.dat	xmrig
behavioral2/files/0x0008000000023c04-152.dat	xmrig
behavioral2/files/0x0008000000023c03-150.dat	xmrig
behavioral2/files/0x0008000000023c02-148.dat	xmrig
behavioral2/files/0x0008000000023c01-146.dat	xmrig
behavioral2/files/0x0008000000023c00-144.dat	xmrig
behavioral2/files/0x0008000000023bd0-140.dat	xmrig
behavioral2/files/0x0008000000023bcd-137.dat	xmrig
behavioral2/files/0x0009000000023bc3-135.dat	xmrig
behavioral2/files/0x000b000000023ba4-123.dat	xmrig
behavioral2/files/0x0008000000023bce-112.dat	xmrig
behavioral2/files/0x000e000000023bc8-111.dat	xmrig
behavioral2/files/0x0008000000023bca-109.dat	xmrig
behavioral2/files/0x0009000000023bc4-106.dat	xmrig
behavioral2/files/0x0009000000023bc2-104.dat	xmrig
behavioral2/files/0x000e000000023bb4-101.dat	xmrig
behavioral2/files/0x000a000000023bad-96.dat	xmrig
behavioral2/files/0x000b000000023ba5-95.dat	xmrig
behavioral2/files/0x000a000000023ba2-94.dat	xmrig
behavioral2/files/0x000a000000023ba1-92.dat	xmrig
behavioral2/files/0x000a000000023ba0-89.dat	xmrig
behavioral2/files/0x000a000000023b9f-87.dat	xmrig
behavioral2/files/0x000a000000023b9d-81.dat	xmrig
behavioral2/files/0x000c000000023b97-9.dat	xmrig
behavioral2/files/0x0008000000023c0a-159.dat	xmrig
behavioral2/files/0x0008000000023c1d-162.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
448	sKOCTGI.exe
1036	noRmZPy.exe
1228	FYwHjeZ.exe
1512	dAwDkxW.exe
1380	WTfSitI.exe
2588	rZExqWM.exe
3452	wAnsosM.exe
2428	WaBiyzu.exe
4776	ceJIyEg.exe
5064	UNJIWLC.exe
536	igprfjG.exe
1764	xPPvwIx.exe
1212	djICpll.exe
3600	woBRxgY.exe
3032	LkwRdhS.exe
4868	SmRyAsw.exe
676	LSxxWqy.exe
2440	medxkFd.exe
3664	rRsGlRl.exe
1424	sDLxTwY.exe
4856	oRPZDUP.exe
2548	ekAVZsz.exe
3672	OchEgDx.exe
2148	ZdAplvB.exe
216	SVHiwVM.exe
3028	RcYnyfI.exe
2044	ZqcaIMS.exe
4308	QGousPt.exe
4652	SyFOvnv.exe
3056	VDMwdpt.exe
2088	sFijiuI.exe
3616	GWvaabZ.exe
3992	dvJnNTt.exe
1204	ZourQeF.exe
4960	gjwjTos.exe
1564	eCSIoHG.exe
5056	IISndSd.exe
4956	IHsjjhu.exe
1276	HyvIuul.exe
3212	ADwOIDF.exe
1244	jcUphHA.exe
2552	uTSnxAK.exe
1224	aSqUnIm.exe
4392	zgLLQZm.exe
5108	cqwCIgE.exe
1440	VvGHcyG.exe
4848	aWKEtTU.exe
2288	lESEnZa.exe
1920	eyXUfJt.exe
840	KToNwFw.exe
3536	CDGekRU.exe
1096	ndZxZhW.exe
4440	tQhVVqd.exe
1436	FSnCcRW.exe
3196	xmijuDO.exe
1784	tVhpRVJ.exe
3732	fhWMxaj.exe
2672	KzywYMI.exe
2920	glXBHZT.exe
2972	MQPyOFs.exe
2340	fffCtTq.exe
3980	KqvAIJD.exe
3036	gFYMEiX.exe
3352	tuzzxQF.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hCoAuIy.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\iFMRfCi.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\AdgKUCf.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\pJGRnGy.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\JRIwaOT.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\YUHGTWl.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\ZDGqfWE.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\gKMVUzw.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\UNJIWLC.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\GWBrOFF.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\llUvmDv.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\ADwOIDF.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\KXhevpC.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\nphkCnw.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\yWWgeQd.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\SWFJSIA.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\wHApRCC.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\mdUUYRl.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\EdJvAKS.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\xPPvwIx.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\SVHiwVM.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\ruCaEyy.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\bBywfGL.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\jcUphHA.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\gYDxJgg.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\OdmkZnM.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\goCcEst.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\nfNrUCx.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\WPbCfYZ.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\vMZFCpt.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\aznewJn.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\xaNpwwb.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\BQRnnPT.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\iLVVNQL.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\BhTXqPg.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\CDGekRU.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\BBacEid.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\nTTOoPG.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\dAwDkxW.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\HyvIuul.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\opoDtws.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\CfVqfLH.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\MDLkCSb.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\FbrlUNj.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\lLrZUvy.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\khMHSMh.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\orEqNDM.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\dkhASFT.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\kdioElW.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\CtCcFgt.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\VnPvKMF.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\xqsIocS.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\WXXVChl.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\CBtuWmI.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\ZOpwyuk.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\yUrBKiy.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\ngvRtpI.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\LQbAnNx.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\lbUJTYk.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\AoeMaQI.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\MKdvemW.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\EzZENvS.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\bIZQQvz.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
File created	C:\Windows\System\scZhiPv.exe	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 448	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	83
PID 1960 wrote to memory of 448	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	83
PID 1960 wrote to memory of 1036	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	84
PID 1960 wrote to memory of 1036	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	84
PID 1960 wrote to memory of 1228	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	85
PID 1960 wrote to memory of 1228	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	85
PID 1960 wrote to memory of 1512	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	86
PID 1960 wrote to memory of 1512	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	86
PID 1960 wrote to memory of 1380	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	87
PID 1960 wrote to memory of 1380	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	87
PID 1960 wrote to memory of 2588	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	88
PID 1960 wrote to memory of 2588	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	88
PID 1960 wrote to memory of 3452	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	89
PID 1960 wrote to memory of 3452	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	89
PID 1960 wrote to memory of 2428	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	90
PID 1960 wrote to memory of 2428	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	90
PID 1960 wrote to memory of 4776	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	91
PID 1960 wrote to memory of 4776	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	91
PID 1960 wrote to memory of 5064	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	92
PID 1960 wrote to memory of 5064	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	92
PID 1960 wrote to memory of 536	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	93
PID 1960 wrote to memory of 536	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	93
PID 1960 wrote to memory of 1764	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	94
PID 1960 wrote to memory of 1764	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	94
PID 1960 wrote to memory of 1212	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	95
PID 1960 wrote to memory of 1212	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	95
PID 1960 wrote to memory of 3600	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	96
PID 1960 wrote to memory of 3600	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	96
PID 1960 wrote to memory of 3032	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	97
PID 1960 wrote to memory of 3032	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	97
PID 1960 wrote to memory of 4868	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	98
PID 1960 wrote to memory of 4868	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	98
PID 1960 wrote to memory of 676	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	99
PID 1960 wrote to memory of 676	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	99
PID 1960 wrote to memory of 2440	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	100
PID 1960 wrote to memory of 2440	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	100
PID 1960 wrote to memory of 3664	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	101
PID 1960 wrote to memory of 3664	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	101
PID 1960 wrote to memory of 1424	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	102
PID 1960 wrote to memory of 1424	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	102
PID 1960 wrote to memory of 4856	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	103
PID 1960 wrote to memory of 4856	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	103
PID 1960 wrote to memory of 2548	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	104
PID 1960 wrote to memory of 2548	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	104
PID 1960 wrote to memory of 3672	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	105
PID 1960 wrote to memory of 3672	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	105
PID 1960 wrote to memory of 2148	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	106
PID 1960 wrote to memory of 2148	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	106
PID 1960 wrote to memory of 216	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	107
PID 1960 wrote to memory of 216	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	107
PID 1960 wrote to memory of 3028	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	108
PID 1960 wrote to memory of 3028	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	108
PID 1960 wrote to memory of 2044	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	109
PID 1960 wrote to memory of 2044	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	109
PID 1960 wrote to memory of 4308	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	110
PID 1960 wrote to memory of 4308	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	110
PID 1960 wrote to memory of 4652	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	111
PID 1960 wrote to memory of 4652	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	111
PID 1960 wrote to memory of 3056	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	112
PID 1960 wrote to memory of 3056	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	112
PID 1960 wrote to memory of 2088	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	113
PID 1960 wrote to memory of 2088	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	113
PID 1960 wrote to memory of 3616	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	114
PID 1960 wrote to memory of 3616	1960	dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe	114

C:\Users\Admin\AppData\Local\Temp\dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe
"C:\Users\Admin\AppData\Local\Temp\dd2e56c20f472bc6d12d3f09433e98ca275c05fd6e2e29abb8e1d5a8da6ae633.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\System\sKOCTGI.exe
  C:\Windows\System\sKOCTGI.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\noRmZPy.exe
  C:\Windows\System\noRmZPy.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\FYwHjeZ.exe
  C:\Windows\System\FYwHjeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\dAwDkxW.exe
  C:\Windows\System\dAwDkxW.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\WTfSitI.exe
  C:\Windows\System\WTfSitI.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\rZExqWM.exe
  C:\Windows\System\rZExqWM.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\wAnsosM.exe
  C:\Windows\System\wAnsosM.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\WaBiyzu.exe
  C:\Windows\System\WaBiyzu.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\ceJIyEg.exe
  C:\Windows\System\ceJIyEg.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\UNJIWLC.exe
  C:\Windows\System\UNJIWLC.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\igprfjG.exe
  C:\Windows\System\igprfjG.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\xPPvwIx.exe
  C:\Windows\System\xPPvwIx.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\djICpll.exe
  C:\Windows\System\djICpll.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\woBRxgY.exe
  C:\Windows\System\woBRxgY.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\LkwRdhS.exe
  C:\Windows\System\LkwRdhS.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\SmRyAsw.exe
  C:\Windows\System\SmRyAsw.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\LSxxWqy.exe
  C:\Windows\System\LSxxWqy.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\medxkFd.exe
  C:\Windows\System\medxkFd.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\rRsGlRl.exe
  C:\Windows\System\rRsGlRl.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\sDLxTwY.exe
  C:\Windows\System\sDLxTwY.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\oRPZDUP.exe
  C:\Windows\System\oRPZDUP.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\ekAVZsz.exe
  C:\Windows\System\ekAVZsz.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\OchEgDx.exe
  C:\Windows\System\OchEgDx.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\ZdAplvB.exe
  C:\Windows\System\ZdAplvB.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\SVHiwVM.exe
  C:\Windows\System\SVHiwVM.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\RcYnyfI.exe
  C:\Windows\System\RcYnyfI.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\ZqcaIMS.exe
  C:\Windows\System\ZqcaIMS.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\QGousPt.exe
  C:\Windows\System\QGousPt.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\SyFOvnv.exe
  C:\Windows\System\SyFOvnv.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\VDMwdpt.exe
  C:\Windows\System\VDMwdpt.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\sFijiuI.exe
  C:\Windows\System\sFijiuI.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\GWvaabZ.exe
  C:\Windows\System\GWvaabZ.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\dvJnNTt.exe
  C:\Windows\System\dvJnNTt.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\ZourQeF.exe
  C:\Windows\System\ZourQeF.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\gjwjTos.exe
  C:\Windows\System\gjwjTos.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\eCSIoHG.exe
  C:\Windows\System\eCSIoHG.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\IISndSd.exe
  C:\Windows\System\IISndSd.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\IHsjjhu.exe
  C:\Windows\System\IHsjjhu.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\HyvIuul.exe
  C:\Windows\System\HyvIuul.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\ADwOIDF.exe
  C:\Windows\System\ADwOIDF.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\jcUphHA.exe
  C:\Windows\System\jcUphHA.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\uTSnxAK.exe
  C:\Windows\System\uTSnxAK.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\aSqUnIm.exe
  C:\Windows\System\aSqUnIm.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\zgLLQZm.exe
  C:\Windows\System\zgLLQZm.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\cqwCIgE.exe
  C:\Windows\System\cqwCIgE.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\VvGHcyG.exe
  C:\Windows\System\VvGHcyG.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\aWKEtTU.exe
  C:\Windows\System\aWKEtTU.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\lESEnZa.exe
  C:\Windows\System\lESEnZa.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\eyXUfJt.exe
  C:\Windows\System\eyXUfJt.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\KToNwFw.exe
  C:\Windows\System\KToNwFw.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\CDGekRU.exe
  C:\Windows\System\CDGekRU.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\ndZxZhW.exe
  C:\Windows\System\ndZxZhW.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\tQhVVqd.exe
  C:\Windows\System\tQhVVqd.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\FSnCcRW.exe
  C:\Windows\System\FSnCcRW.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\xmijuDO.exe
  C:\Windows\System\xmijuDO.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\tVhpRVJ.exe
  C:\Windows\System\tVhpRVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\fhWMxaj.exe
  C:\Windows\System\fhWMxaj.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\KzywYMI.exe
  C:\Windows\System\KzywYMI.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\glXBHZT.exe
  C:\Windows\System\glXBHZT.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\MQPyOFs.exe
  C:\Windows\System\MQPyOFs.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\fffCtTq.exe
  C:\Windows\System\fffCtTq.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\KqvAIJD.exe
  C:\Windows\System\KqvAIJD.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\gFYMEiX.exe
  C:\Windows\System\gFYMEiX.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\tuzzxQF.exe
  C:\Windows\System\tuzzxQF.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\bLglBJn.exe
  C:\Windows\System\bLglBJn.exe
  2⤵
  PID:5000
- C:\Windows\System\YYkHwgl.exe
  C:\Windows\System\YYkHwgl.exe
  2⤵
  PID:1504
- C:\Windows\System\xLwehHj.exe
  C:\Windows\System\xLwehHj.exe
  2⤵
  PID:2432
- C:\Windows\System\aDrWgmK.exe
  C:\Windows\System\aDrWgmK.exe
  2⤵
  PID:2356
- C:\Windows\System\HGpyXut.exe
  C:\Windows\System\HGpyXut.exe
  2⤵
  PID:4536
- C:\Windows\System\BhuXtCw.exe
  C:\Windows\System\BhuXtCw.exe
  2⤵
  PID:3684
- C:\Windows\System\FtWBfPx.exe
  C:\Windows\System\FtWBfPx.exe
  2⤵
  PID:4672
- C:\Windows\System\RxyEGJL.exe
  C:\Windows\System\RxyEGJL.exe
  2⤵
  PID:5068
- C:\Windows\System\sbQkupC.exe
  C:\Windows\System\sbQkupC.exe
  2⤵
  PID:5112
- C:\Windows\System\HrDPKiz.exe
  C:\Windows\System\HrDPKiz.exe
  2⤵
  PID:4820
- C:\Windows\System\lNfjMdy.exe
  C:\Windows\System\lNfjMdy.exe
  2⤵
  PID:4052
- C:\Windows\System\JixfLTq.exe
  C:\Windows\System\JixfLTq.exe
  2⤵
  PID:4004
- C:\Windows\System\MrZPxTj.exe
  C:\Windows\System\MrZPxTj.exe
  2⤵
  PID:3552
- C:\Windows\System\rSTvdJR.exe
  C:\Windows\System\rSTvdJR.exe
  2⤵
  PID:2724
- C:\Windows\System\HzqVbhF.exe
  C:\Windows\System\HzqVbhF.exe
  2⤵
  PID:1528
- C:\Windows\System\iBEHWqn.exe
  C:\Windows\System\iBEHWqn.exe
  2⤵
  PID:3700
- C:\Windows\System\Xnsieje.exe
  C:\Windows\System\Xnsieje.exe
  2⤵
  PID:1996
- C:\Windows\System\twACYHC.exe
  C:\Windows\System\twACYHC.exe
  2⤵
  PID:3624
- C:\Windows\System\DZDHXYy.exe
  C:\Windows\System\DZDHXYy.exe
  2⤵
  PID:4364
- C:\Windows\System\dkhASFT.exe
  C:\Windows\System\dkhASFT.exe
  2⤵
  PID:4768
- C:\Windows\System\lxBBNtw.exe
  C:\Windows\System\lxBBNtw.exe
  2⤵
  PID:1572
- C:\Windows\System\ignaGyH.exe
  C:\Windows\System\ignaGyH.exe
  2⤵
  PID:4692
- C:\Windows\System\yftYadN.exe
  C:\Windows\System\yftYadN.exe
  2⤵
  PID:3244
- C:\Windows\System\WfmgXKx.exe
  C:\Windows\System\WfmgXKx.exe
  2⤵
  PID:2884
- C:\Windows\System\obkRrWk.exe
  C:\Windows\System\obkRrWk.exe
  2⤵
  PID:636
- C:\Windows\System\PevAGgE.exe
  C:\Windows\System\PevAGgE.exe
  2⤵
  PID:3704
- C:\Windows\System\wbvwwXZ.exe
  C:\Windows\System\wbvwwXZ.exe
  2⤵
  PID:4456
- C:\Windows\System\qObUeeQ.exe
  C:\Windows\System\qObUeeQ.exe
  2⤵
  PID:3596
- C:\Windows\System\HgTTZVU.exe
  C:\Windows\System\HgTTZVU.exe
  2⤵
  PID:1888
- C:\Windows\System\aLEVfNJ.exe
  C:\Windows\System\aLEVfNJ.exe
  2⤵
  PID:1616
- C:\Windows\System\iTVdrcb.exe
  C:\Windows\System\iTVdrcb.exe
  2⤵
  PID:2208
- C:\Windows\System\rbyGZtE.exe
  C:\Windows\System\rbyGZtE.exe
  2⤵
  PID:1868
- C:\Windows\System\QGigVwI.exe
  C:\Windows\System\QGigVwI.exe
  2⤵
  PID:4464
- C:\Windows\System\gmZHBWe.exe
  C:\Windows\System\gmZHBWe.exe
  2⤵
  PID:3964
- C:\Windows\System\ntVBHAC.exe
  C:\Windows\System\ntVBHAC.exe
  2⤵
  PID:916
- C:\Windows\System\AHYdJOO.exe
  C:\Windows\System\AHYdJOO.exe
  2⤵
  PID:436
- C:\Windows\System\lkGwLgY.exe
  C:\Windows\System\lkGwLgY.exe
  2⤵
  PID:3180
- C:\Windows\System\vZFEogR.exe
  C:\Windows\System\vZFEogR.exe
  2⤵
  PID:452
- C:\Windows\System\Drjedht.exe
  C:\Windows\System\Drjedht.exe
  2⤵
  PID:3264
- C:\Windows\System\oltHMFI.exe
  C:\Windows\System\oltHMFI.exe
  2⤵
  PID:740
- C:\Windows\System\ipURFZx.exe
  C:\Windows\System\ipURFZx.exe
  2⤵
  PID:4948
- C:\Windows\System\xORfqZO.exe
  C:\Windows\System\xORfqZO.exe
  2⤵
  PID:1852
- C:\Windows\System\BxShpYm.exe
  C:\Windows\System\BxShpYm.exe
  2⤵
  PID:2276
- C:\Windows\System\GWBrOFF.exe
  C:\Windows\System\GWBrOFF.exe
  2⤵
  PID:2696
- C:\Windows\System\wdOeHdb.exe
  C:\Windows\System\wdOeHdb.exe
  2⤵
  PID:1332
- C:\Windows\System\XVxtDkW.exe
  C:\Windows\System\XVxtDkW.exe
  2⤵
  PID:3768
- C:\Windows\System\TCniVmX.exe
  C:\Windows\System\TCniVmX.exe
  2⤵
  PID:3280
- C:\Windows\System\hYEOaNp.exe
  C:\Windows\System\hYEOaNp.exe
  2⤵
  PID:3300
- C:\Windows\System\KFtbYwZ.exe
  C:\Windows\System\KFtbYwZ.exe
  2⤵
  PID:4092
- C:\Windows\System\nkHCYGb.exe
  C:\Windows\System\nkHCYGb.exe
  2⤵
  PID:2388
- C:\Windows\System\AqWyxke.exe
  C:\Windows\System\AqWyxke.exe
  2⤵
  PID:3968
- C:\Windows\System\VYyGqZt.exe
  C:\Windows\System\VYyGqZt.exe
  2⤵
  PID:3164
- C:\Windows\System\uJJuAkZ.exe
  C:\Windows\System\uJJuAkZ.exe
  2⤵
  PID:4208
- C:\Windows\System\yDgczyW.exe
  C:\Windows\System\yDgczyW.exe
  2⤵
  PID:1288
- C:\Windows\System\cbcTcCk.exe
  C:\Windows\System\cbcTcCk.exe
  2⤵
  PID:1808
- C:\Windows\System\slnWXkZ.exe
  C:\Windows\System\slnWXkZ.exe
  2⤵
  PID:5152
- C:\Windows\System\Aqwqkvp.exe
  C:\Windows\System\Aqwqkvp.exe
  2⤵
  PID:5168
- C:\Windows\System\AdgKUCf.exe
  C:\Windows\System\AdgKUCf.exe
  2⤵
  PID:5196
- C:\Windows\System\CLNEMyl.exe
  C:\Windows\System\CLNEMyl.exe
  2⤵
  PID:5236
- C:\Windows\System\mbfdfgR.exe
  C:\Windows\System\mbfdfgR.exe
  2⤵
  PID:5264
- C:\Windows\System\ZxZumlQ.exe
  C:\Windows\System\ZxZumlQ.exe
  2⤵
  PID:5292
- C:\Windows\System\aFoqqat.exe
  C:\Windows\System\aFoqqat.exe
  2⤵
  PID:5320
- C:\Windows\System\nphkCnw.exe
  C:\Windows\System\nphkCnw.exe
  2⤵
  PID:5348
- C:\Windows\System\iLVVNQL.exe
  C:\Windows\System\iLVVNQL.exe
  2⤵
  PID:5376
- C:\Windows\System\XkoEigG.exe
  C:\Windows\System\XkoEigG.exe
  2⤵
  PID:5404
- C:\Windows\System\xpiGgAH.exe
  C:\Windows\System\xpiGgAH.exe
  2⤵
  PID:5432
- C:\Windows\System\VvpvgOP.exe
  C:\Windows\System\VvpvgOP.exe
  2⤵
  PID:5452
- C:\Windows\System\leMWTUm.exe
  C:\Windows\System\leMWTUm.exe
  2⤵
  PID:5480
- C:\Windows\System\PSztCSE.exe
  C:\Windows\System\PSztCSE.exe
  2⤵
  PID:5508
- C:\Windows\System\qAPBzOD.exe
  C:\Windows\System\qAPBzOD.exe
  2⤵
  PID:5532
- C:\Windows\System\IuHGCoD.exe
  C:\Windows\System\IuHGCoD.exe
  2⤵
  PID:5556
- C:\Windows\System\DlnnkTM.exe
  C:\Windows\System\DlnnkTM.exe
  2⤵
  PID:5580
- C:\Windows\System\pTNrdEp.exe
  C:\Windows\System\pTNrdEp.exe
  2⤵
  PID:5608
- C:\Windows\System\hbZQQse.exe
  C:\Windows\System\hbZQQse.exe
  2⤵
  PID:5640
- C:\Windows\System\BwAKiCZ.exe
  C:\Windows\System\BwAKiCZ.exe
  2⤵
  PID:5668
- C:\Windows\System\PspuufD.exe
  C:\Windows\System\PspuufD.exe
  2⤵
  PID:5704
- C:\Windows\System\qRPGWvc.exe
  C:\Windows\System\qRPGWvc.exe
  2⤵
  PID:5732
- C:\Windows\System\cMElYMg.exe
  C:\Windows\System\cMElYMg.exe
  2⤵
  PID:5748
- C:\Windows\System\VCqpeWU.exe
  C:\Windows\System\VCqpeWU.exe
  2⤵
  PID:5768
- C:\Windows\System\tmMqNAc.exe
  C:\Windows\System\tmMqNAc.exe
  2⤵
  PID:5804
- C:\Windows\System\YspTiFm.exe
  C:\Windows\System\YspTiFm.exe
  2⤵
  PID:5828
- C:\Windows\System\UXYyTDS.exe
  C:\Windows\System\UXYyTDS.exe
  2⤵
  PID:5848
- C:\Windows\System\fqUXKqt.exe
  C:\Windows\System\fqUXKqt.exe
  2⤵
  PID:5872
- C:\Windows\System\zYVnSbi.exe
  C:\Windows\System\zYVnSbi.exe
  2⤵
  PID:5900
- C:\Windows\System\uPDvmII.exe
  C:\Windows\System\uPDvmII.exe
  2⤵
  PID:5924
- C:\Windows\System\cjEuqdA.exe
  C:\Windows\System\cjEuqdA.exe
  2⤵
  PID:5952
- C:\Windows\System\LQbAnNx.exe
  C:\Windows\System\LQbAnNx.exe
  2⤵
  PID:5984
- C:\Windows\System\qRYQcxT.exe
  C:\Windows\System\qRYQcxT.exe
  2⤵
  PID:6016
- C:\Windows\System\sEzkFMl.exe
  C:\Windows\System\sEzkFMl.exe
  2⤵
  PID:6048
- C:\Windows\System\ohUzHHq.exe
  C:\Windows\System\ohUzHHq.exe
  2⤵
  PID:6072
- C:\Windows\System\mxzcmKb.exe
  C:\Windows\System\mxzcmKb.exe
  2⤵
  PID:6108
- C:\Windows\System\TUgrzlP.exe
  C:\Windows\System\TUgrzlP.exe
  2⤵
  PID:6136
- C:\Windows\System\HsWTtGa.exe
  C:\Windows\System\HsWTtGa.exe
  2⤵
  PID:5124
- C:\Windows\System\dlWGlfp.exe
  C:\Windows\System\dlWGlfp.exe
  2⤵
  PID:5228
- C:\Windows\System\tFpXTbg.exe
  C:\Windows\System\tFpXTbg.exe
  2⤵
  PID:5312
- C:\Windows\System\ccydeau.exe
  C:\Windows\System\ccydeau.exe
  2⤵
  PID:5372
- C:\Windows\System\ZsCllus.exe
  C:\Windows\System\ZsCllus.exe
  2⤵
  PID:5416
- C:\Windows\System\nmwtAVN.exe
  C:\Windows\System\nmwtAVN.exe
  2⤵
  PID:5448
- C:\Windows\System\MYWFpIw.exe
  C:\Windows\System\MYWFpIw.exe
  2⤵
  PID:5524
- C:\Windows\System\zrAvSLj.exe
  C:\Windows\System\zrAvSLj.exe
  2⤵
  PID:5596
- C:\Windows\System\xxGgWqf.exe
  C:\Windows\System\xxGgWqf.exe
  2⤵
  PID:5664
- C:\Windows\System\sisckTN.exe
  C:\Windows\System\sisckTN.exe
  2⤵
  PID:5740
- C:\Windows\System\EXxnDil.exe
  C:\Windows\System\EXxnDil.exe
  2⤵
  PID:5776
- C:\Windows\System\ZkPOcGy.exe
  C:\Windows\System\ZkPOcGy.exe
  2⤵
  PID:5884
- C:\Windows\System\SxnEkIK.exe
  C:\Windows\System\SxnEkIK.exe
  2⤵
  PID:5932
- C:\Windows\System\LTOyhwB.exe
  C:\Windows\System\LTOyhwB.exe
  2⤵
  PID:5976
- C:\Windows\System\koCBcjY.exe
  C:\Windows\System\koCBcjY.exe
  2⤵
  PID:6032
- C:\Windows\System\PszildE.exe
  C:\Windows\System\PszildE.exe
  2⤵
  PID:6100
- C:\Windows\System\MJcMndi.exe
  C:\Windows\System\MJcMndi.exe
  2⤵
  PID:5208
- C:\Windows\System\iXDXevS.exe
  C:\Windows\System\iXDXevS.exe
  2⤵
  PID:5344
- C:\Windows\System\iGzQNNr.exe
  C:\Windows\System\iGzQNNr.exe
  2⤵
  PID:5468
- C:\Windows\System\wVqbagF.exe
  C:\Windows\System\wVqbagF.exe
  2⤵
  PID:5692
- C:\Windows\System\grGOedG.exe
  C:\Windows\System\grGOedG.exe
  2⤵
  PID:5868
- C:\Windows\System\otUIlOc.exe
  C:\Windows\System\otUIlOc.exe
  2⤵
  PID:5940
- C:\Windows\System\qFfxPuT.exe
  C:\Windows\System\qFfxPuT.exe
  2⤵
  PID:6060
- C:\Windows\System\YeZcnRF.exe
  C:\Windows\System\YeZcnRF.exe
  2⤵
  PID:5136
- C:\Windows\System\fnSpVdw.exe
  C:\Windows\System\fnSpVdw.exe
  2⤵
  PID:5764
- C:\Windows\System\UjBjBLw.exe
  C:\Windows\System\UjBjBLw.exe
  2⤵
  PID:6008
- C:\Windows\System\DQInliX.exe
  C:\Windows\System\DQInliX.exe
  2⤵
  PID:6176
- C:\Windows\System\yOWGumh.exe
  C:\Windows\System\yOWGumh.exe
  2⤵
  PID:6200
- C:\Windows\System\PXplmFt.exe
  C:\Windows\System\PXplmFt.exe
  2⤵
  PID:6220
- C:\Windows\System\xxmuurV.exe
  C:\Windows\System\xxmuurV.exe
  2⤵
  PID:6256
- C:\Windows\System\gZDBfze.exe
  C:\Windows\System\gZDBfze.exe
  2⤵
  PID:6288
- C:\Windows\System\NxekMwj.exe
  C:\Windows\System\NxekMwj.exe
  2⤵
  PID:6320
- C:\Windows\System\LvthQeg.exe
  C:\Windows\System\LvthQeg.exe
  2⤵
  PID:6340
- C:\Windows\System\QjDrQhA.exe
  C:\Windows\System\QjDrQhA.exe
  2⤵
  PID:6368
- C:\Windows\System\MotEdNY.exe
  C:\Windows\System\MotEdNY.exe
  2⤵
  PID:6396
- C:\Windows\System\ievtHbl.exe
  C:\Windows\System\ievtHbl.exe
  2⤵
  PID:6412
- C:\Windows\System\QcjjARG.exe
  C:\Windows\System\QcjjARG.exe
  2⤵
  PID:6436
- C:\Windows\System\qnmENjU.exe
  C:\Windows\System\qnmENjU.exe
  2⤵
  PID:6464
- C:\Windows\System\RtLqkxR.exe
  C:\Windows\System\RtLqkxR.exe
  2⤵
  PID:6500
- C:\Windows\System\qIYxinH.exe
  C:\Windows\System\qIYxinH.exe
  2⤵
  PID:6528
- C:\Windows\System\KXhevpC.exe
  C:\Windows\System\KXhevpC.exe
  2⤵
  PID:6548
- C:\Windows\System\rWOEtgM.exe
  C:\Windows\System\rWOEtgM.exe
  2⤵
  PID:6564
- C:\Windows\System\kdioElW.exe
  C:\Windows\System\kdioElW.exe
  2⤵
  PID:6588
- C:\Windows\System\xaNpwwb.exe
  C:\Windows\System\xaNpwwb.exe
  2⤵
  PID:6604
- C:\Windows\System\EyybUzk.exe
  C:\Windows\System\EyybUzk.exe
  2⤵
  PID:6628
- C:\Windows\System\vQsUHRd.exe
  C:\Windows\System\vQsUHRd.exe
  2⤵
  PID:6656
- C:\Windows\System\fsjPiSD.exe
  C:\Windows\System\fsjPiSD.exe
  2⤵
  PID:6684
- C:\Windows\System\uZnqgsh.exe
  C:\Windows\System\uZnqgsh.exe
  2⤵
  PID:6716
- C:\Windows\System\MHRvhrE.exe
  C:\Windows\System\MHRvhrE.exe
  2⤵
  PID:6752
- C:\Windows\System\mVvriMm.exe
  C:\Windows\System\mVvriMm.exe
  2⤵
  PID:6772
- C:\Windows\System\dLFRMAc.exe
  C:\Windows\System\dLFRMAc.exe
  2⤵
  PID:6800
- C:\Windows\System\VPVUKcU.exe
  C:\Windows\System\VPVUKcU.exe
  2⤵
  PID:6828
- C:\Windows\System\LzlAVYY.exe
  C:\Windows\System\LzlAVYY.exe
  2⤵
  PID:6856
- C:\Windows\System\jjtkTbs.exe
  C:\Windows\System\jjtkTbs.exe
  2⤵
  PID:6888
- C:\Windows\System\HUcdfYv.exe
  C:\Windows\System\HUcdfYv.exe
  2⤵
  PID:6912
- C:\Windows\System\nonbQSC.exe
  C:\Windows\System\nonbQSC.exe
  2⤵
  PID:6944
- C:\Windows\System\bZeArPW.exe
  C:\Windows\System\bZeArPW.exe
  2⤵
  PID:6972
- C:\Windows\System\PNvjWJd.exe
  C:\Windows\System\PNvjWJd.exe
  2⤵
  PID:7004
- C:\Windows\System\tMJhJxS.exe
  C:\Windows\System\tMJhJxS.exe
  2⤵
  PID:7028
- C:\Windows\System\yFHrumz.exe
  C:\Windows\System\yFHrumz.exe
  2⤵
  PID:7056
- C:\Windows\System\BQRnnPT.exe
  C:\Windows\System\BQRnnPT.exe
  2⤵
  PID:7084
- C:\Windows\System\JRIwaOT.exe
  C:\Windows\System\JRIwaOT.exe
  2⤵
  PID:7112
- C:\Windows\System\MEAaikP.exe
  C:\Windows\System\MEAaikP.exe
  2⤵
  PID:7144
- C:\Windows\System\JicGEFP.exe
  C:\Windows\System\JicGEFP.exe
  2⤵
  PID:5980
- C:\Windows\System\nhVpXvg.exe
  C:\Windows\System\nhVpXvg.exe
  2⤵
  PID:6152
- C:\Windows\System\aXrziaG.exe
  C:\Windows\System\aXrziaG.exe
  2⤵
  PID:6240
- C:\Windows\System\qWpdPQB.exe
  C:\Windows\System\qWpdPQB.exe
  2⤵
  PID:6212
- C:\Windows\System\cvLaUmj.exe
  C:\Windows\System\cvLaUmj.exe
  2⤵
  PID:6328
- C:\Windows\System\QOgCoOV.exe
  C:\Windows\System\QOgCoOV.exe
  2⤵
  PID:6312
- C:\Windows\System\pKMWQgn.exe
  C:\Windows\System\pKMWQgn.exe
  2⤵
  PID:6484
- C:\Windows\System\eMcnpKD.exe
  C:\Windows\System\eMcnpKD.exe
  2⤵
  PID:6472
- C:\Windows\System\lbUJTYk.exe
  C:\Windows\System\lbUJTYk.exe
  2⤵
  PID:6480
- C:\Windows\System\MCXiIys.exe
  C:\Windows\System\MCXiIys.exe
  2⤵
  PID:6560
- C:\Windows\System\nlfFQre.exe
  C:\Windows\System\nlfFQre.exe
  2⤵
  PID:6704
- C:\Windows\System\HGmIKMW.exe
  C:\Windows\System\HGmIKMW.exe
  2⤵
  PID:6652
- C:\Windows\System\NTNLHrS.exe
  C:\Windows\System\NTNLHrS.exe
  2⤵
  PID:6812
- C:\Windows\System\wcdUTZI.exe
  C:\Windows\System\wcdUTZI.exe
  2⤵
  PID:6868
- C:\Windows\System\VgXSVjq.exe
  C:\Windows\System\VgXSVjq.exe
  2⤵
  PID:6924
- C:\Windows\System\bpPrpFh.exe
  C:\Windows\System\bpPrpFh.exe
  2⤵
  PID:6992
- C:\Windows\System\VYzOHzA.exe
  C:\Windows\System\VYzOHzA.exe
  2⤵
  PID:7024
- C:\Windows\System\UvCZhUH.exe
  C:\Windows\System\UvCZhUH.exe
  2⤵
  PID:7108
- C:\Windows\System\HXXSAzr.exe
  C:\Windows\System\HXXSAzr.exe
  2⤵
  PID:6168
- C:\Windows\System\zVRKhOT.exe
  C:\Windows\System\zVRKhOT.exe
  2⤵
  PID:6284
- C:\Windows\System\njZRgGV.exe
  C:\Windows\System\njZRgGV.exe
  2⤵
  PID:6244
- C:\Windows\System\YIJZXOX.exe
  C:\Windows\System\YIJZXOX.exe
  2⤵
  PID:6516
- C:\Windows\System\MUMpoSX.exe
  C:\Windows\System\MUMpoSX.exe
  2⤵
  PID:7040
- C:\Windows\System\HhcuHrf.exe
  C:\Windows\System\HhcuHrf.exe
  2⤵
  PID:6848
- C:\Windows\System\lLrZUvy.exe
  C:\Windows\System\lLrZUvy.exe
  2⤵
  PID:6908
- C:\Windows\System\YijyYpu.exe
  C:\Windows\System\YijyYpu.exe
  2⤵
  PID:7096
- C:\Windows\System\UbAdiix.exe
  C:\Windows\System\UbAdiix.exe
  2⤵
  PID:7180
- C:\Windows\System\toegOzW.exe
  C:\Windows\System\toegOzW.exe
  2⤵
  PID:7208
- C:\Windows\System\sEVzPXv.exe
  C:\Windows\System\sEVzPXv.exe
  2⤵
  PID:7232
- C:\Windows\System\DnwQnRs.exe
  C:\Windows\System\DnwQnRs.exe
  2⤵
  PID:7252
- C:\Windows\System\yWWgeQd.exe
  C:\Windows\System\yWWgeQd.exe
  2⤵
  PID:7284
- C:\Windows\System\CpScbjO.exe
  C:\Windows\System\CpScbjO.exe
  2⤵
  PID:7312
- C:\Windows\System\qHLGBRt.exe
  C:\Windows\System\qHLGBRt.exe
  2⤵
  PID:7344
- C:\Windows\System\RvduEWC.exe
  C:\Windows\System\RvduEWC.exe
  2⤵
  PID:7372
- C:\Windows\System\TEBsJYH.exe
  C:\Windows\System\TEBsJYH.exe
  2⤵
  PID:7404
- C:\Windows\System\dfcUGMO.exe
  C:\Windows\System\dfcUGMO.exe
  2⤵
  PID:7432
- C:\Windows\System\WpGTaYR.exe
  C:\Windows\System\WpGTaYR.exe
  2⤵
  PID:7460
- C:\Windows\System\LrladXL.exe
  C:\Windows\System\LrladXL.exe
  2⤵
  PID:7476
- C:\Windows\System\WeezQVz.exe
  C:\Windows\System\WeezQVz.exe
  2⤵
  PID:7508
- C:\Windows\System\gYOYCHK.exe
  C:\Windows\System\gYOYCHK.exe
  2⤵
  PID:7532
- C:\Windows\System\YFPhJLx.exe
  C:\Windows\System\YFPhJLx.exe
  2⤵
  PID:7560
- C:\Windows\System\KaNwdrS.exe
  C:\Windows\System\KaNwdrS.exe
  2⤵
  PID:7580
- C:\Windows\System\PTvLTPt.exe
  C:\Windows\System\PTvLTPt.exe
  2⤵
  PID:7604
- C:\Windows\System\aUFNHbZ.exe
  C:\Windows\System\aUFNHbZ.exe
  2⤵
  PID:7636
- C:\Windows\System\HcTGtcs.exe
  C:\Windows\System\HcTGtcs.exe
  2⤵
  PID:7672
- C:\Windows\System\JdFXXwM.exe
  C:\Windows\System\JdFXXwM.exe
  2⤵
  PID:7700
- C:\Windows\System\lCDpRJN.exe
  C:\Windows\System\lCDpRJN.exe
  2⤵
  PID:7728
- C:\Windows\System\SpeagWL.exe
  C:\Windows\System\SpeagWL.exe
  2⤵
  PID:7756
- C:\Windows\System\ktgWFXT.exe
  C:\Windows\System\ktgWFXT.exe
  2⤵
  PID:7780
- C:\Windows\System\lfgaGJD.exe
  C:\Windows\System\lfgaGJD.exe
  2⤵
  PID:7804
- C:\Windows\System\SBoOkoV.exe
  C:\Windows\System\SBoOkoV.exe
  2⤵
  PID:7828
- C:\Windows\System\GveyWjh.exe
  C:\Windows\System\GveyWjh.exe
  2⤵
  PID:7856
- C:\Windows\System\gOGwVsv.exe
  C:\Windows\System\gOGwVsv.exe
  2⤵
  PID:7880
- C:\Windows\System\AirdIIV.exe
  C:\Windows\System\AirdIIV.exe
  2⤵
  PID:7908
- C:\Windows\System\BBacEid.exe
  C:\Windows\System\BBacEid.exe
  2⤵
  PID:7932
- C:\Windows\System\OTKBekA.exe
  C:\Windows\System\OTKBekA.exe
  2⤵
  PID:7960
- C:\Windows\System\JHcDjfb.exe
  C:\Windows\System\JHcDjfb.exe
  2⤵
  PID:7988
- C:\Windows\System\PxteXtv.exe
  C:\Windows\System\PxteXtv.exe
  2⤵
  PID:8016
- C:\Windows\System\sWyfVSY.exe
  C:\Windows\System\sWyfVSY.exe
  2⤵
  PID:8040
- C:\Windows\System\WUNFSjj.exe
  C:\Windows\System\WUNFSjj.exe
  2⤵
  PID:8068
- C:\Windows\System\GpDDBHL.exe
  C:\Windows\System\GpDDBHL.exe
  2⤵
  PID:8088
- C:\Windows\System\sHNWsfB.exe
  C:\Windows\System\sHNWsfB.exe
  2⤵
  PID:8112
- C:\Windows\System\SSWTHou.exe
  C:\Windows\System\SSWTHou.exe
  2⤵
  PID:8136
- C:\Windows\System\ZdJfXCa.exe
  C:\Windows\System\ZdJfXCa.exe
  2⤵
  PID:8164
- C:\Windows\System\IfnldjM.exe
  C:\Windows\System\IfnldjM.exe
  2⤵
  PID:5564
- C:\Windows\System\qfmIuqg.exe
  C:\Windows\System\qfmIuqg.exe
  2⤵
  PID:6844
- C:\Windows\System\wnuRLqH.exe
  C:\Windows\System\wnuRLqH.exe
  2⤵
  PID:7520
- C:\Windows\System\FOTkPpr.exe
  C:\Windows\System\FOTkPpr.exe
  2⤵
  PID:7656
- C:\Windows\System\QnFiUGG.exe
  C:\Windows\System\QnFiUGG.exe
  2⤵
  PID:7568
- C:\Windows\System\MKdvemW.exe
  C:\Windows\System\MKdvemW.exe
  2⤵
  PID:7720
- C:\Windows\System\DQUoiic.exe
  C:\Windows\System\DQUoiic.exe
  2⤵
  PID:7648
- C:\Windows\System\zhzIaHW.exe
  C:\Windows\System\zhzIaHW.exe
  2⤵
  PID:7752
- C:\Windows\System\slWqTmC.exe
  C:\Windows\System\slWqTmC.exe
  2⤵
  PID:7800
- C:\Windows\System\PFRVnyc.exe
  C:\Windows\System\PFRVnyc.exe
  2⤵
  PID:7848
- C:\Windows\System\rMrOHcP.exe
  C:\Windows\System\rMrOHcP.exe
  2⤵
  PID:7896
- C:\Windows\System\kAiiLTD.exe
  C:\Windows\System\kAiiLTD.exe
  2⤵
  PID:7956
- C:\Windows\System\kcsGfSF.exe
  C:\Windows\System\kcsGfSF.exe
  2⤵
  PID:6408
- C:\Windows\System\vqZQBmK.exe
  C:\Windows\System\vqZQBmK.exe
  2⤵
  PID:8064
- C:\Windows\System\bPsRvpK.exe
  C:\Windows\System\bPsRvpK.exe
  2⤵
  PID:8132
- C:\Windows\System\tOJrAOQ.exe
  C:\Windows\System\tOJrAOQ.exe
  2⤵
  PID:7268
- C:\Windows\System\dQxyYep.exe
  C:\Windows\System\dQxyYep.exe
  2⤵
  PID:7176
- C:\Windows\System\ntqvUeD.exe
  C:\Windows\System\ntqvUeD.exe
  2⤵
  PID:7328
- C:\Windows\System\WeuUyEB.exe
  C:\Windows\System\WeuUyEB.exe
  2⤵
  PID:7744
- C:\Windows\System\ZaRIpMU.exe
  C:\Windows\System\ZaRIpMU.exe
  2⤵
  PID:7576
- C:\Windows\System\CfVqfLH.exe
  C:\Windows\System\CfVqfLH.exe
  2⤵
  PID:7812
- C:\Windows\System\uojRjZi.exe
  C:\Windows\System\uojRjZi.exe
  2⤵
  PID:7872
- C:\Windows\System\goCcEst.exe
  C:\Windows\System\goCcEst.exe
  2⤵
  PID:8036
- C:\Windows\System\MTCZUTx.exe
  C:\Windows\System\MTCZUTx.exe
  2⤵
  PID:8124
- C:\Windows\System\zrojMSf.exe
  C:\Windows\System\zrojMSf.exe
  2⤵
  PID:8084
- C:\Windows\System\wugeAVK.exe
  C:\Windows\System\wugeAVK.exe
  2⤵
  PID:7452
- C:\Windows\System\qRtQENA.exe
  C:\Windows\System\qRtQENA.exe
  2⤵
  PID:8032
- C:\Windows\System\onsMfda.exe
  C:\Windows\System\onsMfda.exe
  2⤵
  PID:8216
- C:\Windows\System\lndfxzP.exe
  C:\Windows\System\lndfxzP.exe
  2⤵
  PID:8248
- C:\Windows\System\xaWDthV.exe
  C:\Windows\System\xaWDthV.exe
  2⤵
  PID:8272
- C:\Windows\System\OrtQzzw.exe
  C:\Windows\System\OrtQzzw.exe
  2⤵
  PID:8296
- C:\Windows\System\nuyKpNQ.exe
  C:\Windows\System\nuyKpNQ.exe
  2⤵
  PID:8324
- C:\Windows\System\wDoOSjY.exe
  C:\Windows\System\wDoOSjY.exe
  2⤵
  PID:8352
- C:\Windows\System\qDhpyZg.exe
  C:\Windows\System\qDhpyZg.exe
  2⤵
  PID:8384
- C:\Windows\System\IQSuGFL.exe
  C:\Windows\System\IQSuGFL.exe
  2⤵
  PID:8404
- C:\Windows\System\JFpAYYg.exe
  C:\Windows\System\JFpAYYg.exe
  2⤵
  PID:8428
- C:\Windows\System\qSCXXVP.exe
  C:\Windows\System\qSCXXVP.exe
  2⤵
  PID:8448
- C:\Windows\System\gBNqxaA.exe
  C:\Windows\System\gBNqxaA.exe
  2⤵
  PID:8468
- C:\Windows\System\dLStBaR.exe
  C:\Windows\System\dLStBaR.exe
  2⤵
  PID:8496
- C:\Windows\System\zgJzWTm.exe
  C:\Windows\System\zgJzWTm.exe
  2⤵
  PID:8520
- C:\Windows\System\wtYNjIz.exe
  C:\Windows\System\wtYNjIz.exe
  2⤵
  PID:8536
- C:\Windows\System\BlIRNkB.exe
  C:\Windows\System\BlIRNkB.exe
  2⤵
  PID:8552
- C:\Windows\System\kQLtkzi.exe
  C:\Windows\System\kQLtkzi.exe
  2⤵
  PID:8572
- C:\Windows\System\Byezkfh.exe
  C:\Windows\System\Byezkfh.exe
  2⤵
  PID:8596
- C:\Windows\System\UkWQUzh.exe
  C:\Windows\System\UkWQUzh.exe
  2⤵
  PID:8632
- C:\Windows\System\bjKLBGB.exe
  C:\Windows\System\bjKLBGB.exe
  2⤵
  PID:8656
- C:\Windows\System\vhThvNV.exe
  C:\Windows\System\vhThvNV.exe
  2⤵
  PID:8688
- C:\Windows\System\kgmTfcC.exe
  C:\Windows\System\kgmTfcC.exe
  2⤵
  PID:8708
- C:\Windows\System\KAwWjSW.exe
  C:\Windows\System\KAwWjSW.exe
  2⤵
  PID:8736
- C:\Windows\System\jUAskzs.exe
  C:\Windows\System\jUAskzs.exe
  2⤵
  PID:8764
- C:\Windows\System\gkRcOGp.exe
  C:\Windows\System\gkRcOGp.exe
  2⤵
  PID:8800
- C:\Windows\System\RfWibMi.exe
  C:\Windows\System\RfWibMi.exe
  2⤵
  PID:8828
- C:\Windows\System\ayApxXM.exe
  C:\Windows\System\ayApxXM.exe
  2⤵
  PID:8848
- C:\Windows\System\awAjWWw.exe
  C:\Windows\System\awAjWWw.exe
  2⤵
  PID:8876
- C:\Windows\System\insenIl.exe
  C:\Windows\System\insenIl.exe
  2⤵
  PID:8904
- C:\Windows\System\VfMjGcg.exe
  C:\Windows\System\VfMjGcg.exe
  2⤵
  PID:8936
- C:\Windows\System\opoDtws.exe
  C:\Windows\System\opoDtws.exe
  2⤵
  PID:8956
- C:\Windows\System\DqRakWb.exe
  C:\Windows\System\DqRakWb.exe
  2⤵
  PID:8988
- C:\Windows\System\iCrkZMa.exe
  C:\Windows\System\iCrkZMa.exe
  2⤵
  PID:9020
- C:\Windows\System\ceHGuSN.exe
  C:\Windows\System\ceHGuSN.exe
  2⤵
  PID:9048
- C:\Windows\System\ZvDiqvR.exe
  C:\Windows\System\ZvDiqvR.exe
  2⤵
  PID:9080
- C:\Windows\System\ValVJYc.exe
  C:\Windows\System\ValVJYc.exe
  2⤵
  PID:9100
- C:\Windows\System\SVIgJhw.exe
  C:\Windows\System\SVIgJhw.exe
  2⤵
  PID:9124
- C:\Windows\System\KqfdJCz.exe
  C:\Windows\System\KqfdJCz.exe
  2⤵
  PID:9156
- C:\Windows\System\RvJMhaJ.exe
  C:\Windows\System\RvJMhaJ.exe
  2⤵
  PID:9176
- C:\Windows\System\JeXeSdP.exe
  C:\Windows\System\JeXeSdP.exe
  2⤵
  PID:7776
- C:\Windows\System\oPAOkjN.exe
  C:\Windows\System\oPAOkjN.exe
  2⤵
  PID:8176
- C:\Windows\System\BuAymUR.exe
  C:\Windows\System\BuAymUR.exe
  2⤵
  PID:7620
- C:\Windows\System\vILjOgo.exe
  C:\Windows\System\vILjOgo.exe
  2⤵
  PID:8256
- C:\Windows\System\lKxJtAb.exe
  C:\Windows\System\lKxJtAb.exe
  2⤵
  PID:8208
- C:\Windows\System\JfVlqSD.exe
  C:\Windows\System\JfVlqSD.exe
  2⤵
  PID:8412
- C:\Windows\System\gvymMEX.exe
  C:\Windows\System\gvymMEX.exe
  2⤵
  PID:8444
- C:\Windows\System\IbOMvyk.exe
  C:\Windows\System\IbOMvyk.exe
  2⤵
  PID:8484
- C:\Windows\System\yqnPndK.exe
  C:\Windows\System\yqnPndK.exe
  2⤵
  PID:8348
- C:\Windows\System\dCDqeDJ.exe
  C:\Windows\System\dCDqeDJ.exe
  2⤵
  PID:8628
- C:\Windows\System\uCMXxzK.exe
  C:\Windows\System\uCMXxzK.exe
  2⤵
  PID:8548
- C:\Windows\System\nGvbAxr.exe
  C:\Windows\System\nGvbAxr.exe
  2⤵
  PID:8652
- C:\Windows\System\NPkAjgB.exe
  C:\Windows\System\NPkAjgB.exe
  2⤵
  PID:8676
- C:\Windows\System\wybJyad.exe
  C:\Windows\System\wybJyad.exe
  2⤵
  PID:8584
- C:\Windows\System\vxfxEGn.exe
  C:\Windows\System\vxfxEGn.exe
  2⤵
  PID:8932
- C:\Windows\System\PjmyJyr.exe
  C:\Windows\System\PjmyJyr.exe
  2⤵
  PID:8824
- C:\Windows\System\CtCcFgt.exe
  C:\Windows\System\CtCcFgt.exe
  2⤵
  PID:9036
- C:\Windows\System\Opwrwab.exe
  C:\Windows\System\Opwrwab.exe
  2⤵
  PID:8900
- C:\Windows\System\ZsRzovO.exe
  C:\Windows\System\ZsRzovO.exe
  2⤵
  PID:9096
- C:\Windows\System\kfNBFXj.exe
  C:\Windows\System\kfNBFXj.exe
  2⤵
  PID:9200
- C:\Windows\System\FUTAENQ.exe
  C:\Windows\System\FUTAENQ.exe
  2⤵
  PID:8244
- C:\Windows\System\nmMZOCW.exe
  C:\Windows\System\nmMZOCW.exe
  2⤵
  PID:8364
- C:\Windows\System\pmcCXCp.exe
  C:\Windows\System\pmcCXCp.exe
  2⤵
  PID:9152
- C:\Windows\System\bfbxISw.exe
  C:\Windows\System\bfbxISw.exe
  2⤵
  PID:8400
- C:\Windows\System\MDLXSPh.exe
  C:\Windows\System\MDLXSPh.exe
  2⤵
  PID:8668
- C:\Windows\System\JntrwSr.exe
  C:\Windows\System\JntrwSr.exe
  2⤵
  PID:9224
- C:\Windows\System\plkJDEG.exe
  C:\Windows\System\plkJDEG.exe
  2⤵
  PID:9256
- C:\Windows\System\GkepNXC.exe
  C:\Windows\System\GkepNXC.exe
  2⤵
  PID:9276
- C:\Windows\System\YoGLKHW.exe
  C:\Windows\System\YoGLKHW.exe
  2⤵
  PID:9300
- C:\Windows\System\byCueiR.exe
  C:\Windows\System\byCueiR.exe
  2⤵
  PID:9336
- C:\Windows\System\AgCGwjV.exe
  C:\Windows\System\AgCGwjV.exe
  2⤵
  PID:9360
- C:\Windows\System\UHOdqrM.exe
  C:\Windows\System\UHOdqrM.exe
  2⤵
  PID:9384
- C:\Windows\System\zhmqKLc.exe
  C:\Windows\System\zhmqKLc.exe
  2⤵
  PID:9404
- C:\Windows\System\fsxfjmf.exe
  C:\Windows\System\fsxfjmf.exe
  2⤵
  PID:9436
- C:\Windows\System\OmlBFZL.exe
  C:\Windows\System\OmlBFZL.exe
  2⤵
  PID:9456
- C:\Windows\System\pnLZRlB.exe
  C:\Windows\System\pnLZRlB.exe
  2⤵
  PID:9488
- C:\Windows\System\LCYVRKe.exe
  C:\Windows\System\LCYVRKe.exe
  2⤵
  PID:9516
- C:\Windows\System\RYogTTx.exe
  C:\Windows\System\RYogTTx.exe
  2⤵
  PID:9540
- C:\Windows\System\thAJkXZ.exe
  C:\Windows\System\thAJkXZ.exe
  2⤵
  PID:9568
- C:\Windows\System\xoUphqm.exe
  C:\Windows\System\xoUphqm.exe
  2⤵
  PID:9584
- C:\Windows\System\veJAykO.exe
  C:\Windows\System\veJAykO.exe
  2⤵
  PID:9608
- C:\Windows\System\CPyQNcY.exe
  C:\Windows\System\CPyQNcY.exe
  2⤵
  PID:9636
- C:\Windows\System\XDJkJvR.exe
  C:\Windows\System\XDJkJvR.exe
  2⤵
  PID:9656
- C:\Windows\System\hkeIoxv.exe
  C:\Windows\System\hkeIoxv.exe
  2⤵
  PID:9688
- C:\Windows\System\jjeMjRq.exe
  C:\Windows\System\jjeMjRq.exe
  2⤵
  PID:9724
- C:\Windows\System\gOcGETv.exe
  C:\Windows\System\gOcGETv.exe
  2⤵
  PID:9744
- C:\Windows\System\KjWKcen.exe
  C:\Windows\System\KjWKcen.exe
  2⤵
  PID:9768
- C:\Windows\System\nTTOoPG.exe
  C:\Windows\System\nTTOoPG.exe
  2⤵
  PID:9788
- C:\Windows\System\DyEXkYj.exe
  C:\Windows\System\DyEXkYj.exe
  2⤵
  PID:9820
- C:\Windows\System\fSIPwFe.exe
  C:\Windows\System\fSIPwFe.exe
  2⤵
  PID:9844
- C:\Windows\System\eNFOYlM.exe
  C:\Windows\System\eNFOYlM.exe
  2⤵
  PID:9868
- C:\Windows\System\EXrpfco.exe
  C:\Windows\System\EXrpfco.exe
  2⤵
  PID:9892
- C:\Windows\System\GFUQQQf.exe
  C:\Windows\System\GFUQQQf.exe
  2⤵
  PID:9916
- C:\Windows\System\fDKCIhr.exe
  C:\Windows\System\fDKCIhr.exe
  2⤵
  PID:9944
- C:\Windows\System\rYHrYDS.exe
  C:\Windows\System\rYHrYDS.exe
  2⤵
  PID:9964
- C:\Windows\System\ZynOSKj.exe
  C:\Windows\System\ZynOSKj.exe
  2⤵
  PID:9996
- C:\Windows\System\GYOhDWJ.exe
  C:\Windows\System\GYOhDWJ.exe
  2⤵
  PID:10020
- C:\Windows\System\iVKRXPC.exe
  C:\Windows\System\iVKRXPC.exe
  2⤵
  PID:10044
- C:\Windows\System\DoJnqeA.exe
  C:\Windows\System\DoJnqeA.exe
  2⤵
  PID:10068
- C:\Windows\System\gKUbdGZ.exe
  C:\Windows\System\gKUbdGZ.exe
  2⤵
  PID:10092
- C:\Windows\System\HzqYeen.exe
  C:\Windows\System\HzqYeen.exe
  2⤵
  PID:10124
- C:\Windows\System\mEDrUWR.exe
  C:\Windows\System\mEDrUWR.exe
  2⤵
  PID:10148
- C:\Windows\System\XdCqSNQ.exe
  C:\Windows\System\XdCqSNQ.exe
  2⤵
  PID:10168
- C:\Windows\System\MWRzRKb.exe
  C:\Windows\System\MWRzRKb.exe
  2⤵
  PID:10192
- C:\Windows\System\YDsWAng.exe
  C:\Windows\System\YDsWAng.exe
  2⤵
  PID:10212
- C:\Windows\System\CSZgtCQ.exe
  C:\Windows\System\CSZgtCQ.exe
  2⤵
  PID:10236
- C:\Windows\System\gYDxJgg.exe
  C:\Windows\System\gYDxJgg.exe
  2⤵
  PID:9120
- C:\Windows\System\mHtyViN.exe
  C:\Windows\System\mHtyViN.exe
  2⤵
  PID:9044
- C:\Windows\System\tFzGLmO.exe
  C:\Windows\System\tFzGLmO.exe
  2⤵
  PID:8620
- C:\Windows\System\ybrkXqp.exe
  C:\Windows\System\ybrkXqp.exe
  2⤵
  PID:8312
- C:\Windows\System\cXOfNfX.exe
  C:\Windows\System\cXOfNfX.exe
  2⤵
  PID:8968
- C:\Windows\System\zIdmvbI.exe
  C:\Windows\System\zIdmvbI.exe
  2⤵
  PID:9068
- C:\Windows\System\tTOshXD.exe
  C:\Windows\System\tTOshXD.exe
  2⤵
  PID:9468
- C:\Windows\System\UXZLsTM.exe
  C:\Windows\System\UXZLsTM.exe
  2⤵
  PID:9320
- C:\Windows\System\SWFJSIA.exe
  C:\Windows\System\SWFJSIA.exe
  2⤵
  PID:9564
- C:\Windows\System\iezHYnL.exe
  C:\Windows\System\iezHYnL.exe
  2⤵
  PID:9652
- C:\Windows\System\LMRFVYF.exe
  C:\Windows\System\LMRFVYF.exe
  2⤵
  PID:9236
- C:\Windows\System\RrGEvyq.exe
  C:\Windows\System\RrGEvyq.exe
  2⤵
  PID:9508
- C:\Windows\System\UtZdCxz.exe
  C:\Windows\System\UtZdCxz.exe
  2⤵
  PID:9368
- C:\Windows\System\ydKXyLh.exe
  C:\Windows\System\ydKXyLh.exe
  2⤵
  PID:9524
- C:\Windows\System\NtSaYAO.exe
  C:\Windows\System\NtSaYAO.exe
  2⤵
  PID:9912
- C:\Windows\System\wHApRCC.exe
  C:\Windows\System\wHApRCC.exe
  2⤵
  PID:9960
- C:\Windows\System\OwTxbjI.exe
  C:\Windows\System\OwTxbjI.exe
  2⤵
  PID:9720
- C:\Windows\System\OVGuPHX.exe
  C:\Windows\System\OVGuPHX.exe
  2⤵
  PID:9812
- C:\Windows\System\JiikrqU.exe
  C:\Windows\System\JiikrqU.exe
  2⤵
  PID:10088
- C:\Windows\System\yUrBKiy.exe
  C:\Windows\System\yUrBKiy.exe
  2⤵
  PID:9628
- C:\Windows\System\dlktgpd.exe
  C:\Windows\System\dlktgpd.exe
  2⤵
  PID:10136
- C:\Windows\System\pppjofn.exe
  C:\Windows\System\pppjofn.exe
  2⤵
  PID:10164
- C:\Windows\System\vmyXOZr.exe
  C:\Windows\System\vmyXOZr.exe
  2⤵
  PID:9984
- C:\Windows\System\KQsyNcf.exe
  C:\Windows\System\KQsyNcf.exe
  2⤵
  PID:10036
- C:\Windows\System\XfqKvtj.exe
  C:\Windows\System\XfqKvtj.exe
  2⤵
  PID:8392
- C:\Windows\System\nRDxPRo.exe
  C:\Windows\System\nRDxPRo.exe
  2⤵
  PID:10144
- C:\Windows\System\CBtuWmI.exe
  C:\Windows\System\CBtuWmI.exe
  2⤵
  PID:10252
- C:\Windows\System\WPbCfYZ.exe
  C:\Windows\System\WPbCfYZ.exe
  2⤵
  PID:10268
- C:\Windows\System\ETPflEE.exe
  C:\Windows\System\ETPflEE.exe
  2⤵
  PID:10288
- C:\Windows\System\KtQUdfg.exe
  C:\Windows\System\KtQUdfg.exe
  2⤵
  PID:10312
- C:\Windows\System\QosxXkn.exe
  C:\Windows\System\QosxXkn.exe
  2⤵
  PID:10336
- C:\Windows\System\rWjpLdo.exe
  C:\Windows\System\rWjpLdo.exe
  2⤵
  PID:10360
- C:\Windows\System\pxQWWIi.exe
  C:\Windows\System\pxQWWIi.exe
  2⤵
  PID:10376
- C:\Windows\System\IacCBBh.exe
  C:\Windows\System\IacCBBh.exe
  2⤵
  PID:10404
- C:\Windows\System\DSqFVEZ.exe
  C:\Windows\System\DSqFVEZ.exe
  2⤵
  PID:10432
- C:\Windows\System\AnaCfuF.exe
  C:\Windows\System\AnaCfuF.exe
  2⤵
  PID:10460
- C:\Windows\System\rTsVHbi.exe
  C:\Windows\System\rTsVHbi.exe
  2⤵
  PID:10480
- C:\Windows\System\MquJeVZ.exe
  C:\Windows\System\MquJeVZ.exe
  2⤵
  PID:10512
- C:\Windows\System\mImRJoD.exe
  C:\Windows\System\mImRJoD.exe
  2⤵
  PID:10536
- C:\Windows\System\XCAnVOz.exe
  C:\Windows\System\XCAnVOz.exe
  2⤵
  PID:10556
- C:\Windows\System\BLwCyZr.exe
  C:\Windows\System\BLwCyZr.exe
  2⤵
  PID:10580
- C:\Windows\System\myezKCR.exe
  C:\Windows\System\myezKCR.exe
  2⤵
  PID:10604
- C:\Windows\System\dbtoYRY.exe
  C:\Windows\System\dbtoYRY.exe
  2⤵
  PID:10624
- C:\Windows\System\kDRGCZA.exe
  C:\Windows\System\kDRGCZA.exe
  2⤵
  PID:10652
- C:\Windows\System\XfEnLHH.exe
  C:\Windows\System\XfEnLHH.exe
  2⤵
  PID:10680
- C:\Windows\System\hYMrQEK.exe
  C:\Windows\System\hYMrQEK.exe
  2⤵
  PID:10712
- C:\Windows\System\ENRNBIS.exe
  C:\Windows\System\ENRNBIS.exe
  2⤵
  PID:10728
- C:\Windows\System\LbdyBVX.exe
  C:\Windows\System\LbdyBVX.exe
  2⤵
  PID:10760
- C:\Windows\System\orWDBUK.exe
  C:\Windows\System\orWDBUK.exe
  2⤵
  PID:10780
- C:\Windows\System\OByrmtH.exe
  C:\Windows\System\OByrmtH.exe
  2⤵
  PID:10812
- C:\Windows\System\zxOiywr.exe
  C:\Windows\System\zxOiywr.exe
  2⤵
  PID:10836
- C:\Windows\System\oAdRDVr.exe
  C:\Windows\System\oAdRDVr.exe
  2⤵
  PID:10852
- C:\Windows\System\hGSVHBS.exe
  C:\Windows\System\hGSVHBS.exe
  2⤵
  PID:10884
- C:\Windows\System\nmcHMyR.exe
  C:\Windows\System\nmcHMyR.exe
  2⤵
  PID:10912
- C:\Windows\System\FXPaXNC.exe
  C:\Windows\System\FXPaXNC.exe
  2⤵
  PID:10932
- C:\Windows\System\QAMOKgW.exe
  C:\Windows\System\QAMOKgW.exe
  2⤵
  PID:10952
- C:\Windows\System\llUvmDv.exe
  C:\Windows\System\llUvmDv.exe
  2⤵
  PID:10968
- C:\Windows\System\jaSieMw.exe
  C:\Windows\System\jaSieMw.exe
  2⤵
  PID:10996
- C:\Windows\System\nUXImyQ.exe
  C:\Windows\System\nUXImyQ.exe
  2⤵
  PID:11024
- C:\Windows\System\GNGoalw.exe
  C:\Windows\System\GNGoalw.exe
  2⤵
  PID:11052
- C:\Windows\System\XsNlcYq.exe
  C:\Windows\System\XsNlcYq.exe
  2⤵
  PID:11068
- C:\Windows\System\hMvPojO.exe
  C:\Windows\System\hMvPojO.exe
  2⤵
  PID:11100
- C:\Windows\System\WkSpwDA.exe
  C:\Windows\System\WkSpwDA.exe
  2⤵
  PID:11120
- C:\Windows\System\ZAMOthL.exe
  C:\Windows\System\ZAMOthL.exe
  2⤵
  PID:11136
- C:\Windows\System\HCBbzhU.exe
  C:\Windows\System\HCBbzhU.exe
  2⤵
  PID:11164
- C:\Windows\System\ZOpwyuk.exe
  C:\Windows\System\ZOpwyuk.exe
  2⤵
  PID:11188
- C:\Windows\System\tGwAoKA.exe
  C:\Windows\System\tGwAoKA.exe
  2⤵
  PID:11220
- C:\Windows\System\vMZFCpt.exe
  C:\Windows\System\vMZFCpt.exe
  2⤵
  PID:11248
- C:\Windows\System\YUHGTWl.exe
  C:\Windows\System\YUHGTWl.exe
  2⤵
  PID:9352
- C:\Windows\System\zkDsihP.exe
  C:\Windows\System\zkDsihP.exe
  2⤵
  PID:9668
- C:\Windows\System\fBpylEO.exe
  C:\Windows\System\fBpylEO.exe
  2⤵
  PID:9072
- C:\Windows\System\FDOsTLn.exe
  C:\Windows\System\FDOsTLn.exe
  2⤵
  PID:9452
- C:\Windows\System\wehjvPw.exe
  C:\Windows\System\wehjvPw.exe
  2⤵
  PID:9876
- C:\Windows\System\xqsIocS.exe
  C:\Windows\System\xqsIocS.exe
  2⤵
  PID:9428
- C:\Windows\System\UjJdGxt.exe
  C:\Windows\System\UjJdGxt.exe
  2⤵
  PID:9376
- C:\Windows\System\iVhNWBS.exe
  C:\Windows\System\iVhNWBS.exe
  2⤵
  PID:8528
- C:\Windows\System\aKhUZfz.exe
  C:\Windows\System\aKhUZfz.exe
  2⤵
  PID:9732
- C:\Windows\System\bqgPDqL.exe
  C:\Windows\System\bqgPDqL.exe
  2⤵
  PID:9624
- C:\Windows\System\rToHQEi.exe
  C:\Windows\System\rToHQEi.exe
  2⤵
  PID:9616
- C:\Windows\System\AIbgavR.exe
  C:\Windows\System\AIbgavR.exe
  2⤵
  PID:10636
- C:\Windows\System\tfnEpEW.exe
  C:\Windows\System\tfnEpEW.exe
  2⤵
  PID:10744
- C:\Windows\System\gnPBEZk.exe
  C:\Windows\System\gnPBEZk.exe
  2⤵
  PID:10828
- C:\Windows\System\IAMXDww.exe
  C:\Windows\System\IAMXDww.exe
  2⤵
  PID:10848
- C:\Windows\System\ZDGqfWE.exe
  C:\Windows\System\ZDGqfWE.exe
  2⤵
  PID:10488
- C:\Windows\System\FenLOun.exe
  C:\Windows\System\FenLOun.exe
  2⤵
  PID:10188
- C:\Windows\System\wHddDhm.exe
  C:\Windows\System\wHddDhm.exe
  2⤵
  PID:10528
- C:\Windows\System\qShFjmX.exe
  C:\Windows\System\qShFjmX.exe
  2⤵
  PID:11016
- C:\Windows\System\EsmVlvD.exe
  C:\Windows\System\EsmVlvD.exe
  2⤵
  PID:10672
- C:\Windows\System\fPrfbLo.exe
  C:\Windows\System\fPrfbLo.exe
  2⤵
  PID:10708
- C:\Windows\System\DERfufJ.exe
  C:\Windows\System\DERfufJ.exe
  2⤵
  PID:10788
- C:\Windows\System\otrtqCW.exe
  C:\Windows\System\otrtqCW.exe
  2⤵
  PID:9248
- C:\Windows\System\aYNxJhw.exe
  C:\Windows\System\aYNxJhw.exe
  2⤵
  PID:11288
- C:\Windows\System\EEcnkAe.exe
  C:\Windows\System\EEcnkAe.exe
  2⤵
  PID:11308
- C:\Windows\System\JjkvJll.exe
  C:\Windows\System\JjkvJll.exe
  2⤵
  PID:11336
- C:\Windows\System\AESSdhE.exe
  C:\Windows\System\AESSdhE.exe
  2⤵
  PID:11356
- C:\Windows\System\JQzfzlG.exe
  C:\Windows\System\JQzfzlG.exe
  2⤵
  PID:11380
- C:\Windows\System\qJRCqvK.exe
  C:\Windows\System\qJRCqvK.exe
  2⤵
  PID:11412
- C:\Windows\System\aqRYrjz.exe
  C:\Windows\System\aqRYrjz.exe
  2⤵
  PID:11444
- C:\Windows\System\wNusoSc.exe
  C:\Windows\System\wNusoSc.exe
  2⤵
  PID:11468
- C:\Windows\System\iGEadVq.exe
  C:\Windows\System\iGEadVq.exe
  2⤵
  PID:11492
- C:\Windows\System\JuZvgNZ.exe
  C:\Windows\System\JuZvgNZ.exe
  2⤵
  PID:11512
- C:\Windows\System\ZszpXma.exe
  C:\Windows\System\ZszpXma.exe
  2⤵
  PID:11540
- C:\Windows\System\zvMVaCJ.exe
  C:\Windows\System\zvMVaCJ.exe
  2⤵
  PID:11564
- C:\Windows\System\lEgKNin.exe
  C:\Windows\System\lEgKNin.exe
  2⤵
  PID:11596
- C:\Windows\System\yOUMzME.exe
  C:\Windows\System\yOUMzME.exe
  2⤵
  PID:11628
- C:\Windows\System\KNLTmbd.exe
  C:\Windows\System\KNLTmbd.exe
  2⤵
  PID:11652
- C:\Windows\System\YWqwtLT.exe
  C:\Windows\System\YWqwtLT.exe
  2⤵
  PID:11672
- C:\Windows\System\JqbQZmn.exe
  C:\Windows\System\JqbQZmn.exe
  2⤵
  PID:11688
- C:\Windows\System\klhjjrG.exe
  C:\Windows\System\klhjjrG.exe
  2⤵
  PID:11720
- C:\Windows\System\EZsLdXD.exe
  C:\Windows\System\EZsLdXD.exe
  2⤵
  PID:11744
- C:\Windows\System\IeXRozT.exe
  C:\Windows\System\IeXRozT.exe
  2⤵
  PID:11768
- C:\Windows\System\GoBxiah.exe
  C:\Windows\System\GoBxiah.exe
  2⤵
  PID:11792
- C:\Windows\System\scuIpMt.exe
  C:\Windows\System\scuIpMt.exe
  2⤵
  PID:11820
- C:\Windows\System\AgqjLCY.exe
  C:\Windows\System\AgqjLCY.exe
  2⤵
  PID:11840
- C:\Windows\System\GoncTsz.exe
  C:\Windows\System\GoncTsz.exe
  2⤵
  PID:11868
- C:\Windows\System\lSFVDRH.exe
  C:\Windows\System\lSFVDRH.exe
  2⤵
  PID:11892
- C:\Windows\System\ruCaEyy.exe
  C:\Windows\System\ruCaEyy.exe
  2⤵
  PID:11916
- C:\Windows\System\zBMvlnM.exe
  C:\Windows\System\zBMvlnM.exe
  2⤵
  PID:11932
- C:\Windows\System\EzZENvS.exe
  C:\Windows\System\EzZENvS.exe
  2⤵
  PID:11952
- C:\Windows\System\nlhbUGy.exe
  C:\Windows\System\nlhbUGy.exe
  2⤵
  PID:11976
- C:\Windows\System\zxrISZn.exe
  C:\Windows\System\zxrISZn.exe
  2⤵
  PID:11992
- C:\Windows\System\FXwrEJG.exe
  C:\Windows\System\FXwrEJG.exe
  2⤵
  PID:12012
- C:\Windows\System\ZASnGXE.exe
  C:\Windows\System\ZASnGXE.exe
  2⤵
  PID:12036
- C:\Windows\System\RfmcFsq.exe
  C:\Windows\System\RfmcFsq.exe
  2⤵
  PID:12056
- C:\Windows\System\HJJWDyw.exe
  C:\Windows\System\HJJWDyw.exe
  2⤵
  PID:12084
- C:\Windows\System\zmxGvVt.exe
  C:\Windows\System\zmxGvVt.exe
  2⤵
  PID:12108
- C:\Windows\System\QbJVSru.exe
  C:\Windows\System\QbJVSru.exe
  2⤵
  PID:12132
- C:\Windows\System\FZmwsJr.exe
  C:\Windows\System\FZmwsJr.exe
  2⤵
  PID:12160
- C:\Windows\System\IuNuWnU.exe
  C:\Windows\System\IuNuWnU.exe
  2⤵
  PID:12196
- C:\Windows\System\HXdnMOi.exe
  C:\Windows\System\HXdnMOi.exe
  2⤵
  PID:12220
- C:\Windows\System\orEqNDM.exe
  C:\Windows\System\orEqNDM.exe
  2⤵
  PID:12244
- C:\Windows\System\rWgYqII.exe
  C:\Windows\System\rWgYqII.exe
  2⤵
  PID:12264
- C:\Windows\System\HdArqEm.exe
  C:\Windows\System\HdArqEm.exe
  2⤵
  PID:9576
- C:\Windows\System\EDIWtwU.exe
  C:\Windows\System\EDIWtwU.exe
  2⤵
  PID:9344
- C:\Windows\System\UdxunsA.exe
  C:\Windows\System\UdxunsA.exe
  2⤵
  PID:9780
- C:\Windows\System\srZyJNX.exe
  C:\Windows\System\srZyJNX.exe
  2⤵
  PID:10552
- C:\Windows\System\vhrJXKU.exe
  C:\Windows\System\vhrJXKU.exe
  2⤵
  PID:10720
- C:\Windows\System\njxIHYj.exe
  C:\Windows\System\njxIHYj.exe
  2⤵
  PID:11116
- C:\Windows\System\iWQuzfO.exe
  C:\Windows\System\iWQuzfO.exe
  2⤵
  PID:11148
- C:\Windows\System\mQZgjPp.exe
  C:\Windows\System\mQZgjPp.exe
  2⤵
  PID:11756
- C:\Windows\System\iEpcGBZ.exe
  C:\Windows\System\iEpcGBZ.exe
  2⤵
  PID:11816
- C:\Windows\System\xGxTfRu.exe
  C:\Windows\System\xGxTfRu.exe
  2⤵
  PID:10388
- C:\Windows\System\luayGng.exe
  C:\Windows\System\luayGng.exe
  2⤵
  PID:12064
- C:\Windows\System\FAhTfhp.exe
  C:\Windows\System\FAhTfhp.exe
  2⤵
  PID:10452
- C:\Windows\System\yZXXLHq.exe
  C:\Windows\System\yZXXLHq.exe
  2⤵
  PID:12124
- C:\Windows\System\lnZSGbJ.exe
  C:\Windows\System\lnZSGbJ.exe
  2⤵
  PID:12156
- C:\Windows\System\khMHSMh.exe
  C:\Windows\System\khMHSMh.exe
  2⤵
  PID:12260
- C:\Windows\System\vsGCulh.exe
  C:\Windows\System\vsGCulh.exe
  2⤵
  PID:10648
- C:\Windows\System\AgwGevH.exe
  C:\Windows\System\AgwGevH.exe
  2⤵
  PID:8368
- C:\Windows\System\RgQbtkd.exe
  C:\Windows\System\RgQbtkd.exe
  2⤵
  PID:9312
- C:\Windows\System\MyWFOee.exe
  C:\Windows\System\MyWFOee.exe
  2⤵
  PID:12068
- C:\Windows\System\ULKodro.exe
  C:\Windows\System\ULKodro.exe
  2⤵
  PID:11552
- C:\Windows\System\hTPwiRb.exe
  C:\Windows\System\hTPwiRb.exe
  2⤵
  PID:11524
- C:\Windows\System\bDnrTgE.exe
  C:\Windows\System\bDnrTgE.exe
  2⤵
  PID:11648
- C:\Windows\System\lgDJizV.exe
  C:\Windows\System\lgDJizV.exe
  2⤵
  PID:11060
- C:\Windows\System\hujVVVB.exe
  C:\Windows\System\hujVVVB.exe
  2⤵
  PID:11716
- C:\Windows\System\AlTZJMP.exe
  C:\Windows\System\AlTZJMP.exe
  2⤵
  PID:11784
- C:\Windows\System\ywvLMTC.exe
  C:\Windows\System\ywvLMTC.exe
  2⤵
  PID:11852
- C:\Windows\System\YdtlKME.exe
  C:\Windows\System\YdtlKME.exe
  2⤵
  PID:12292
- C:\Windows\System\xlXlCqg.exe
  C:\Windows\System\xlXlCqg.exe
  2⤵
  PID:12320
- C:\Windows\System\MfZbKwy.exe
  C:\Windows\System\MfZbKwy.exe
  2⤵
  PID:12352
- C:\Windows\System\UrzlCAQ.exe
  C:\Windows\System\UrzlCAQ.exe
  2⤵
  PID:12384
- C:\Windows\System\cMpAneM.exe
  C:\Windows\System\cMpAneM.exe
  2⤵
  PID:12416
- C:\Windows\System\BnvsAmD.exe
  C:\Windows\System\BnvsAmD.exe
  2⤵
  PID:12440
- C:\Windows\System\HSbjGmL.exe
  C:\Windows\System\HSbjGmL.exe
  2⤵
  PID:12460
- C:\Windows\System\zsPNcrO.exe
  C:\Windows\System\zsPNcrO.exe
  2⤵
  PID:12492
- C:\Windows\System\RXuGAQT.exe
  C:\Windows\System\RXuGAQT.exe
  2⤵
  PID:12520
- C:\Windows\System\olTatuz.exe
  C:\Windows\System\olTatuz.exe
  2⤵
  PID:12952
- C:\Windows\System\EFYaPMv.exe
  C:\Windows\System\EFYaPMv.exe
  2⤵
  PID:13020
- C:\Windows\System\KpRaXis.exe
  C:\Windows\System\KpRaXis.exe
  2⤵
  PID:13064
- C:\Windows\System\FJyBmVq.exe
  C:\Windows\System\FJyBmVq.exe
  2⤵
  PID:13096
- C:\Windows\System\NFlYKFF.exe
  C:\Windows\System\NFlYKFF.exe
  2⤵
  PID:13120
- C:\Windows\System\FMcQpSX.exe
  C:\Windows\System\FMcQpSX.exe
  2⤵
  PID:13152
- C:\Windows\System\CxWsYfF.exe
  C:\Windows\System\CxWsYfF.exe
  2⤵
  PID:13184
- C:\Windows\System\krRPRSO.exe
  C:\Windows\System\krRPRSO.exe
  2⤵
  PID:13208
- C:\Windows\System\CTUYutH.exe
  C:\Windows\System\CTUYutH.exe
  2⤵
  PID:13232
- C:\Windows\System\mwtVlVF.exe
  C:\Windows\System\mwtVlVF.exe
  2⤵
  PID:13260
- C:\Windows\System\ZwayKdI.exe
  C:\Windows\System\ZwayKdI.exe
  2⤵
  PID:13284
- C:\Windows\System\vuuqQKg.exe
  C:\Windows\System\vuuqQKg.exe
  2⤵
  PID:13300
- C:\Windows\System\RFZoozh.exe
  C:\Windows\System\RFZoozh.exe
  2⤵
  PID:11368
- C:\Windows\System\YijYjWI.exe
  C:\Windows\System\YijYjWI.exe
  2⤵
  PID:11592
- C:\Windows\System\dXSHppk.exe
  C:\Windows\System\dXSHppk.exe
  2⤵
  PID:10944
- C:\Windows\System\ngvRtpI.exe
  C:\Windows\System\ngvRtpI.exe
  2⤵
  PID:12096
- C:\Windows\System\YiMoFow.exe
  C:\Windows\System\YiMoFow.exe
  2⤵
  PID:11856
- C:\Windows\System\QscSxkE.exe
  C:\Windows\System\QscSxkE.exe
  2⤵
  PID:11324
- C:\Windows\System\ilSuPGS.exe
  C:\Windows\System\ilSuPGS.exe
  2⤵
  PID:11760
- C:\Windows\System\oXPjCMS.exe
  C:\Windows\System\oXPjCMS.exe
  2⤵
  PID:11860
- C:\Windows\System\UunplZb.exe
  C:\Windows\System\UunplZb.exe
  2⤵
  PID:11392
- C:\Windows\System\eTFVcPk.exe
  C:\Windows\System\eTFVcPk.exe
  2⤵
  PID:11460
- C:\Windows\System\iyJiSso.exe
  C:\Windows\System\iyJiSso.exe
  2⤵
  PID:10964
- C:\Windows\System\yvgDZOo.exe
  C:\Windows\System\yvgDZOo.exe
  2⤵
  PID:12620
- C:\Windows\System\EiWGALY.exe
  C:\Windows\System\EiWGALY.exe
  2⤵
  PID:12316
- C:\Windows\System\rihtTmZ.exe
  C:\Windows\System\rihtTmZ.exe
  2⤵
  PID:12504
- C:\Windows\System\RMpVBZm.exe
  C:\Windows\System\RMpVBZm.exe
  2⤵
  PID:12548
- C:\Windows\System\MPeweFE.exe
  C:\Windows\System\MPeweFE.exe
  2⤵
  PID:10600
- C:\Windows\System\nBnZwNy.exe
  C:\Windows\System\nBnZwNy.exe
  2⤵
  PID:12372
- C:\Windows\System\XEiCzBK.exe
  C:\Windows\System\XEiCzBK.exe
  2⤵
  PID:12424
- C:\Windows\System\vtbdnQp.exe
  C:\Windows\System\vtbdnQp.exe
  2⤵
  PID:12552
- C:\Windows\System\qZyVGLJ.exe
  C:\Windows\System\qZyVGLJ.exe
  2⤵
  PID:12904
- C:\Windows\System\oNrbukX.exe
  C:\Windows\System\oNrbukX.exe
  2⤵
  PID:12844
- C:\Windows\System\AnEXzLx.exe
  C:\Windows\System\AnEXzLx.exe
  2⤵
  PID:12872
- C:\Windows\System\cGjKjzL.exe
  C:\Windows\System\cGjKjzL.exe
  2⤵
  PID:12912
- C:\Windows\System\hbVeLGj.exe
  C:\Windows\System\hbVeLGj.exe
  2⤵
  PID:13040
- C:\Windows\System\KlKtBdK.exe
  C:\Windows\System\KlKtBdK.exe
  2⤵
  PID:13224
- C:\Windows\System\nYFbVqy.exe
  C:\Windows\System\nYFbVqy.exe
  2⤵
  PID:13116
- C:\Windows\System\hRFYuOe.exe
  C:\Windows\System\hRFYuOe.exe
  2⤵
  PID:13272
- C:\Windows\System\rCYHKJt.exe
  C:\Windows\System\rCYHKJt.exe
  2⤵
  PID:12228
- C:\Windows\System\Ajlqfvm.exe
  C:\Windows\System\Ajlqfvm.exe
  2⤵
  PID:11276
- C:\Windows\System\UDEKVOa.exe
  C:\Windows\System\UDEKVOa.exe
  2⤵
  PID:11396
- C:\Windows\System\SAwZBIM.exe
  C:\Windows\System\SAwZBIM.exe
  2⤵
  PID:11888
- C:\Windows\System\lorTVoi.exe
  C:\Windows\System\lorTVoi.exe
  2⤵
  PID:12516
- C:\Windows\System\BhTXqPg.exe
  C:\Windows\System\BhTXqPg.exe
  2⤵
  PID:13464
- C:\Windows\System\bIZQQvz.exe
  C:\Windows\System\bIZQQvz.exe
  2⤵
  PID:13484
- C:\Windows\System\nEiOsJW.exe
  C:\Windows\System\nEiOsJW.exe
  2⤵
  PID:13508
- C:\Windows\System\bwqbnZj.exe
  C:\Windows\System\bwqbnZj.exe
  2⤵
  PID:13528
- C:\Windows\System\KBBUYRh.exe
  C:\Windows\System\KBBUYRh.exe
  2⤵
  PID:13552
- C:\Windows\System\wxSdNJC.exe
  C:\Windows\System\wxSdNJC.exe
  2⤵
  PID:13580
- C:\Windows\System\LEeJBrq.exe
  C:\Windows\System\LEeJBrq.exe
  2⤵
  PID:13600
- C:\Windows\System\LvSdpuF.exe
  C:\Windows\System\LvSdpuF.exe
  2⤵
  PID:13616
- C:\Windows\System\TuGcGot.exe
  C:\Windows\System\TuGcGot.exe
  2⤵
  PID:13644
- C:\Windows\System\XsNhTSO.exe
  C:\Windows\System\XsNhTSO.exe
  2⤵
  PID:13664
- C:\Windows\System\AUcOKXY.exe
  C:\Windows\System\AUcOKXY.exe
  2⤵
  PID:13688
- C:\Windows\System\TjdvoDa.exe
  C:\Windows\System\TjdvoDa.exe
  2⤵
  PID:13724
- C:\Windows\System\ypQLZob.exe
  C:\Windows\System\ypQLZob.exe
  2⤵
  PID:13740
- C:\Windows\System\jMMQieL.exe
  C:\Windows\System\jMMQieL.exe
  2⤵
  PID:13764
- C:\Windows\System\KamknFE.exe
  C:\Windows\System\KamknFE.exe
  2⤵
  PID:13784
- C:\Windows\System\NWTECil.exe
  C:\Windows\System\NWTECil.exe
  2⤵
  PID:13816
- C:\Windows\System\GtTFZju.exe
  C:\Windows\System\GtTFZju.exe
  2⤵
  PID:13844
- C:\Windows\System\coltCzo.exe
  C:\Windows\System\coltCzo.exe
  2⤵
  PID:13860
- C:\Windows\System\LUeNsaM.exe
  C:\Windows\System\LUeNsaM.exe
  2⤵
  PID:13892
- C:\Windows\System\aEBOwNL.exe
  C:\Windows\System\aEBOwNL.exe
  2⤵
  PID:13916
- C:\Windows\System\tVklsMT.exe
  C:\Windows\System\tVklsMT.exe
  2⤵
  PID:13936
- C:\Windows\System\UOmBrdW.exe
  C:\Windows\System\UOmBrdW.exe
  2⤵
  PID:13956
- C:\Windows\System\huPTKlh.exe
  C:\Windows\System\huPTKlh.exe
  2⤵
  PID:13992
- C:\Windows\System\jatqGVW.exe
  C:\Windows\System\jatqGVW.exe
  2⤵
  PID:14008
- C:\Windows\System\EqELtUZ.exe
  C:\Windows\System\EqELtUZ.exe
  2⤵
  PID:14024
- C:\Windows\System\lUOcowf.exe
  C:\Windows\System\lUOcowf.exe
  2⤵
  PID:14040
- C:\Windows\System\YTvsYEP.exe
  C:\Windows\System\YTvsYEP.exe
  2⤵
  PID:14060
- C:\Windows\System\nCgLkrk.exe
  C:\Windows\System\nCgLkrk.exe
  2⤵
  PID:14076
- C:\Windows\System\PiObqAe.exe
  C:\Windows\System\PiObqAe.exe
  2⤵
  PID:14104
- C:\Windows\System\BriCEbl.exe
  C:\Windows\System\BriCEbl.exe
  2⤵
  PID:14120
- C:\Windows\System\luLGOfO.exe
  C:\Windows\System\luLGOfO.exe
  2⤵
  PID:14144
- C:\Windows\System\pQVIUFK.exe
  C:\Windows\System\pQVIUFK.exe
  2⤵
  PID:14160
- C:\Windows\System\JpmBUJN.exe
  C:\Windows\System\JpmBUJN.exe
  2⤵
  PID:14184
- C:\Windows\System\NUwJUJE.exe
  C:\Windows\System\NUwJUJE.exe
  2⤵
  PID:14204
- C:\Windows\System\gxDrBQt.exe
  C:\Windows\System\gxDrBQt.exe
  2⤵
  PID:14220
- C:\Windows\System\ZznEeVR.exe
  C:\Windows\System\ZznEeVR.exe
  2⤵
  PID:14240
- C:\Windows\System\PiGyCQF.exe
  C:\Windows\System\PiGyCQF.exe
  2⤵
  PID:14268
- C:\Windows\System\CmwnDZh.exe
  C:\Windows\System\CmwnDZh.exe
  2⤵
  PID:14304
- C:\Windows\System\YpWQFpB.exe
  C:\Windows\System\YpWQFpB.exe
  2⤵
  PID:14320
- C:\Windows\System\plcCBDg.exe
  C:\Windows\System\plcCBDg.exe
  2⤵
  PID:12528
- C:\Windows\System\rWEVkOO.exe
  C:\Windows\System\rWEVkOO.exe
  2⤵
  PID:13200
- C:\Windows\System\OaaejjS.exe
  C:\Windows\System\OaaejjS.exe
  2⤵
  PID:11108
- C:\Windows\System\oKTdoQF.exe
  C:\Windows\System\oKTdoQF.exe
  2⤵
  PID:12168
- C:\Windows\System\Dzksitz.exe
  C:\Windows\System\Dzksitz.exe
  2⤵
  PID:11904
- C:\Windows\System\UZRQPKp.exe
  C:\Windows\System\UZRQPKp.exe
  2⤵
  PID:13520
- C:\Windows\System\kNSMpzG.exe
  C:\Windows\System\kNSMpzG.exe
  2⤵
  PID:12408
- C:\Windows\System\rvuxSPO.exe
  C:\Windows\System\rvuxSPO.exe
  2⤵
  PID:13572
- C:\Windows\System\CnLuvlR.exe
  C:\Windows\System\CnLuvlR.exe
  2⤵
  PID:13612
- C:\Windows\System\LCHooty.exe
  C:\Windows\System\LCHooty.exe
  2⤵
  PID:13656
- C:\Windows\System\hccvqVM.exe
  C:\Windows\System\hccvqVM.exe
  2⤵
  PID:12468
- C:\Windows\System\IuQDaVj.exe
  C:\Windows\System\IuQDaVj.exe
  2⤵
  PID:13248
- C:\Windows\System\iHTVTFN.exe
  C:\Windows\System\iHTVTFN.exe
  2⤵
  PID:12252
- C:\Windows\System\KvEcfMA.exe
  C:\Windows\System\KvEcfMA.exe
  2⤵
  PID:12860
- C:\Windows\System\DcLaTgm.exe
  C:\Windows\System\DcLaTgm.exe
  2⤵
  PID:12456
- C:\Windows\System\xpFSRpK.exe
  C:\Windows\System\xpFSRpK.exe
  2⤵
  PID:13324
- C:\Windows\System\CYRPDux.exe
  C:\Windows\System\CYRPDux.exe
  2⤵
  PID:13344
- C:\Windows\System\VOABYRC.exe
  C:\Windows\System\VOABYRC.exe
  2⤵
  PID:13364
- C:\Windows\System\DwLMlZR.exe
  C:\Windows\System\DwLMlZR.exe
  2⤵
  PID:13388
- C:\Windows\System\TjnxtvL.exe
  C:\Windows\System\TjnxtvL.exe
  2⤵
  PID:13408
- C:\Windows\System\ADrCvOE.exe
  C:\Windows\System\ADrCvOE.exe
  2⤵
  PID:13424
- C:\Windows\System\IxXyTMU.exe
  C:\Windows\System\IxXyTMU.exe
  2⤵
  PID:13448
- C:\Windows\System\scZhiPv.exe
  C:\Windows\System\scZhiPv.exe
  2⤵
  PID:13808
- C:\Windows\System\XWMXOTK.exe
  C:\Windows\System\XWMXOTK.exe
  2⤵
  PID:13680
- C:\Windows\System\UjwrPlI.exe
  C:\Windows\System\UjwrPlI.exe
  2⤵
  PID:13888
- C:\Windows\System\rYkbYQm.exe
  C:\Windows\System\rYkbYQm.exe
  2⤵
  PID:13952
- C:\Windows\System\qUOofBA.exe
  C:\Windows\System\qUOofBA.exe
  2⤵
  PID:12368
- C:\Windows\System\UDyUWOu.exe
  C:\Windows\System\UDyUWOu.exe
  2⤵
  PID:13140
- C:\Windows\System\APgvVzf.exe
  C:\Windows\System\APgvVzf.exe
  2⤵
  PID:14036
- C:\Windows\System\dDOvTTo.exe
  C:\Windows\System\dDOvTTo.exe
  2⤵
  PID:14156
- C:\Windows\System\lDLjMmN.exe
  C:\Windows\System\lDLjMmN.exe
  2⤵
  PID:13360
- C:\Windows\System\aGyOyji.exe
  C:\Windows\System\aGyOyji.exe
  2⤵
  PID:13404
- C:\Windows\System\mdUUYRl.exe
  C:\Windows\System\mdUUYRl.exe
  2⤵
  PID:13440
- C:\Windows\System\iWBVVWz.exe
  C:\Windows\System\iWBVVWz.exe
  2⤵
  PID:13760
- C:\Windows\System\OTZEWgY.exe
  C:\Windows\System\OTZEWgY.exe
  2⤵
  PID:13032
- C:\Windows\System\AXsmYkP.exe
  C:\Windows\System\AXsmYkP.exe
  2⤵
  PID:12748
- C:\Windows\System\CzxXrkT.exe
  C:\Windows\System\CzxXrkT.exe
  2⤵
  PID:13092
- C:\Windows\System\NklNMAq.exe
  C:\Windows\System\NklNMAq.exe
  2⤵
  PID:12120
- C:\Windows\System\xxFFFxx.exe
  C:\Windows\System\xxFFFxx.exe
  2⤵
  PID:14340
- C:\Windows\System\UhChaNH.exe
  C:\Windows\System\UhChaNH.exe
  2⤵
  PID:14356
- C:\Windows\System\jiHUkcS.exe
  C:\Windows\System\jiHUkcS.exe
  2⤵
  PID:14372
- C:\Windows\System\csbrojD.exe
  C:\Windows\System\csbrojD.exe
  2⤵
  PID:14392
- C:\Windows\System\gKMVUzw.exe
  C:\Windows\System\gKMVUzw.exe
  2⤵
  PID:14412
- C:\Windows\System\VPDiYKq.exe
  C:\Windows\System\VPDiYKq.exe
  2⤵
  PID:14464
- C:\Windows\System\PGRvOZS.exe
  C:\Windows\System\PGRvOZS.exe
  2⤵
  PID:14484
- C:\Windows\System\MMkJHid.exe
  C:\Windows\System\MMkJHid.exe
  2⤵
  PID:14524
- C:\Windows\System\VnPvKMF.exe
  C:\Windows\System\VnPvKMF.exe
  2⤵
  PID:14552
- C:\Windows\System\IYeGrbF.exe
  C:\Windows\System\IYeGrbF.exe
  2⤵
  PID:14568
- C:\Windows\System\TCaPahy.exe
  C:\Windows\System\TCaPahy.exe
  2⤵
  PID:14588
- C:\Windows\System\XIwfyLk.exe
  C:\Windows\System\XIwfyLk.exe
  2⤵
  PID:14612
- C:\Windows\System\VBGSaBK.exe
  C:\Windows\System\VBGSaBK.exe
  2⤵
  PID:14632
- C:\Windows\System\pJGRnGy.exe
  C:\Windows\System\pJGRnGy.exe
  2⤵
  PID:14652
- C:\Windows\System\KhzNrkZ.exe
  C:\Windows\System\KhzNrkZ.exe
  2⤵
  PID:14668
- C:\Windows\System\bUCGKti.exe
  C:\Windows\System\bUCGKti.exe
  2⤵
  PID:14700
- C:\Windows\System\SdSjLaO.exe
  C:\Windows\System\SdSjLaO.exe
  2⤵
  PID:14720
- C:\Windows\System\mBtYUlz.exe
  C:\Windows\System\mBtYUlz.exe
  2⤵
  PID:14740
- C:\Windows\System\xANGYZI.exe
  C:\Windows\System\xANGYZI.exe
  2⤵
  PID:14768
- C:\Windows\System\UuULQeZ.exe
  C:\Windows\System\UuULQeZ.exe
  2⤵
  PID:14784
- C:\Windows\System\qvyweEP.exe
  C:\Windows\System\qvyweEP.exe
  2⤵
  PID:14808
- C:\Windows\System\JGTwhca.exe
  C:\Windows\System\JGTwhca.exe
  2⤵
  PID:14824
- C:\Windows\System\mWaGdBk.exe
  C:\Windows\System\mWaGdBk.exe
  2⤵
  PID:14840
- C:\Windows\System\blHLPRg.exe
  C:\Windows\System\blHLPRg.exe
  2⤵
  PID:14856
- C:\Windows\System\WwCkmei.exe
  C:\Windows\System\WwCkmei.exe
  2⤵
  PID:14884
- C:\Windows\System\RtqnQwn.exe
  C:\Windows\System\RtqnQwn.exe
  2⤵
  PID:14900
- C:\Windows\System\XyuqsPC.exe
  C:\Windows\System\XyuqsPC.exe
  2⤵
  PID:14920
- C:\Windows\System\hfWbMiI.exe
  C:\Windows\System\hfWbMiI.exe
  2⤵
  PID:14936
- C:\Windows\System\ELcmEGk.exe
  C:\Windows\System\ELcmEGk.exe
  2⤵
  PID:14952
- C:\Windows\System\mRptmGK.exe
  C:\Windows\System\mRptmGK.exe
  2⤵
  PID:14988
- C:\Windows\System\EdJvAKS.exe
  C:\Windows\System\EdJvAKS.exe
  2⤵
  PID:15020
- C:\Windows\System\tQDbVWP.exe
  C:\Windows\System\tQDbVWP.exe
  2⤵
  PID:15040
- C:\Windows\System\GLPfmkk.exe
  C:\Windows\System\GLPfmkk.exe
  2⤵
  PID:15076
- C:\Windows\System\sDMHyFn.exe
  C:\Windows\System\sDMHyFn.exe
  2⤵
  PID:15100
- C:\Windows\System\pFCgDZS.exe
  C:\Windows\System\pFCgDZS.exe
  2⤵
  PID:15124
- C:\Windows\System\CHkpBJl.exe
  C:\Windows\System\CHkpBJl.exe
  2⤵
  PID:15148
- C:\Windows\System\QaHTqYd.exe
  C:\Windows\System\QaHTqYd.exe
  2⤵
  PID:15180
- C:\Windows\System\umleDAR.exe
  C:\Windows\System\umleDAR.exe
  2⤵
  PID:15200
- C:\Windows\System\HWJUhjL.exe
  C:\Windows\System\HWJUhjL.exe
  2⤵
  PID:15232
- C:\Windows\System\qwvGouW.exe
  C:\Windows\System\qwvGouW.exe
  2⤵
  PID:15248
- C:\Windows\System\nEJAOjs.exe
  C:\Windows\System\nEJAOjs.exe
  2⤵
  PID:15268
- C:\Windows\System\KClUQLL.exe
  C:\Windows\System\KClUQLL.exe
  2⤵
  PID:15288
- C:\Windows\System\xIMwbPw.exe
  C:\Windows\System\xIMwbPw.exe
  2⤵
  PID:15324
- C:\Windows\System\koOSqBF.exe
  C:\Windows\System\koOSqBF.exe
  2⤵
  PID:15344
- C:\Windows\System\GRVvbgf.exe
  C:\Windows\System\GRVvbgf.exe
  2⤵
  PID:14112
- C:\Windows\System\WlYWIWQ.exe
  C:\Windows\System\WlYWIWQ.exe
  2⤵
  PID:13660
- C:\Windows\System\FFrLamm.exe
  C:\Windows\System\FFrLamm.exe
  2⤵
  PID:13540
- C:\Windows\System\muxBuJl.exe
  C:\Windows\System\muxBuJl.exe
  2⤵
  PID:14128
- C:\Windows\System\uPQkXMo.exe
  C:\Windows\System\uPQkXMo.exe
  2⤵
  PID:11848
- C:\Windows\System\LBLyNbK.exe
  C:\Windows\System\LBLyNbK.exe
  2⤵
  PID:13476
- C:\Windows\System\VGozhkL.exe
  C:\Windows\System\VGozhkL.exe
  2⤵
  PID:14088
- C:\Windows\System\EAqxABi.exe
  C:\Windows\System\EAqxABi.exe
  2⤵
  PID:14496
- C:\Windows\System\MpQFEPJ.exe
  C:\Windows\System\MpQFEPJ.exe
  2⤵
  PID:12616
- C:\Windows\System\VFZHHxo.exe
  C:\Windows\System\VFZHHxo.exe
  2⤵
  PID:13380
- C:\Windows\System\ynOJkMu.exe
  C:\Windows\System\ynOJkMu.exe
  2⤵
  PID:13852
- C:\Windows\System\Obezqne.exe
  C:\Windows\System\Obezqne.exe
  2⤵
  PID:14584
- C:\Windows\System\MQCECAB.exe
  C:\Windows\System\MQCECAB.exe
  2⤵
  PID:14648
- C:\Windows\System\xFeQTFB.exe
  C:\Windows\System\xFeQTFB.exe
  2⤵
  PID:14680
- C:\Windows\System\HlsYPRS.exe
  C:\Windows\System\HlsYPRS.exe
  2⤵
  PID:14328
- C:\Windows\System\AoeMaQI.exe
  C:\Windows\System\AoeMaQI.exe
  2⤵
  PID:14800
- C:\Windows\System\FgNMQUx.exe
  C:\Windows\System\FgNMQUx.exe
  2⤵
  PID:14832
- C:\Windows\System\CeuWyiq.exe
  C:\Windows\System\CeuWyiq.exe
  2⤵
  PID:14876
- C:\Windows\System\pDasYdb.exe
  C:\Windows\System\pDasYdb.exe
  2⤵
  PID:14384
- C:\Windows\System\hCoAuIy.exe
  C:\Windows\System\hCoAuIy.exe
  2⤵
  PID:14972
- C:\Windows\System\QgVGYlo.exe
  C:\Windows\System\QgVGYlo.exe
  2⤵
  PID:15008
- C:\Windows\System\FJOIawk.exe
  C:\Windows\System\FJOIawk.exe
  2⤵
  PID:15368
- C:\Windows\System\sGeIuXL.exe
  C:\Windows\System\sGeIuXL.exe
  2⤵
  PID:15388
- C:\Windows\System\BsYrwmL.exe
  C:\Windows\System\BsYrwmL.exe
  2⤵
  PID:15416
- C:\Windows\System\EWjELhe.exe
  C:\Windows\System\EWjELhe.exe
  2⤵
  PID:15436
- C:\Windows\System\gpOzjTQ.exe
  C:\Windows\System\gpOzjTQ.exe
  2⤵
  PID:15468
- C:\Windows\System\bWBTJUz.exe
  C:\Windows\System\bWBTJUz.exe
  2⤵
  PID:15488
- C:\Windows\System\YWTkKKL.exe
  C:\Windows\System\YWTkKKL.exe
  2⤵
  PID:15512
- C:\Windows\System\seepJLa.exe
  C:\Windows\System\seepJLa.exe
  2⤵
  PID:15528
- C:\Windows\System\PkZnpIY.exe
  C:\Windows\System\PkZnpIY.exe
  2⤵
  PID:15544
- C:\Windows\System\RWawCHr.exe
  C:\Windows\System\RWawCHr.exe
  2⤵
  PID:15572
- C:\Windows\System\SncRscS.exe
  C:\Windows\System\SncRscS.exe
  2⤵
  PID:15592
- C:\Windows\System\ErOCUSj.exe
  C:\Windows\System\ErOCUSj.exe
  2⤵
  PID:15612
- C:\Windows\System\LuFyaqt.exe
  C:\Windows\System\LuFyaqt.exe
  2⤵
  PID:15648
- C:\Windows\System\QajRVEI.exe
  C:\Windows\System\QajRVEI.exe
  2⤵
  PID:15668
- C:\Windows\System\rFBSxnq.exe
  C:\Windows\System\rFBSxnq.exe
  2⤵
  PID:15692
- C:\Windows\System\AfEAWWo.exe
  C:\Windows\System\AfEAWWo.exe
  2⤵
  PID:15708
- C:\Windows\System\yoLRotr.exe
  C:\Windows\System\yoLRotr.exe
  2⤵
  PID:15740
- C:\Windows\System\fApEoSf.exe
  C:\Windows\System\fApEoSf.exe
  2⤵
  PID:15756
- C:\Windows\System\bBywfGL.exe
  C:\Windows\System\bBywfGL.exe
  2⤵
  PID:15784
- C:\Windows\System\inZJVpp.exe
  C:\Windows\System\inZJVpp.exe
  2⤵
  PID:15812
- C:\Windows\System\QFRVhFs.exe
  C:\Windows\System\QFRVhFs.exe
  2⤵
  PID:15828
- C:\Windows\System\rfPpmsK.exe
  C:\Windows\System\rfPpmsK.exe
  2⤵
  PID:15852
- C:\Windows\System\tPSFoXz.exe
  C:\Windows\System\tPSFoXz.exe
  2⤵
  PID:15872
- C:\Windows\System\TQzeQNh.exe
  C:\Windows\System\TQzeQNh.exe
  2⤵
  PID:15892
- C:\Windows\System\xPKNcFj.exe
  C:\Windows\System\xPKNcFj.exe
  2⤵
  PID:15912
- C:\Windows\System\rSUGqsx.exe
  C:\Windows\System\rSUGqsx.exe
  2⤵
  PID:15932
- C:\Windows\System\uacnRZF.exe
  C:\Windows\System\uacnRZF.exe
  2⤵
  PID:15956
- C:\Windows\System\TYjbGYg.exe
  C:\Windows\System\TYjbGYg.exe
  2⤵
  PID:15972
- C:\Windows\System\zzwpsFn.exe
  C:\Windows\System\zzwpsFn.exe
  2⤵
  PID:15992
- C:\Windows\System\gYqsQfH.exe
  C:\Windows\System\gYqsQfH.exe
  2⤵
  PID:16008
- C:\Windows\System\NKHdLrB.exe
  C:\Windows\System\NKHdLrB.exe
  2⤵
  PID:16032
- C:\Windows\System\qEubiDb.exe
  C:\Windows\System\qEubiDb.exe
  2⤵
  PID:16048
- C:\Windows\System\FgznbBY.exe
  C:\Windows\System\FgznbBY.exe
  2⤵
  PID:16072
- C:\Windows\System\COgqGic.exe
  C:\Windows\System\COgqGic.exe
  2⤵
  PID:16088
- C:\Windows\System\ZeZpgTv.exe
  C:\Windows\System\ZeZpgTv.exe
  2⤵
  PID:16124
- C:\Windows\System\WYnoJGs.exe
  C:\Windows\System\WYnoJGs.exe
  2⤵
  PID:16140
- C:\Windows\System\mefxlLU.exe
  C:\Windows\System\mefxlLU.exe
  2⤵
  PID:16172
- C:\Windows\System\HicFxrX.exe
  C:\Windows\System\HicFxrX.exe
  2⤵
  PID:16196
- C:\Windows\System\fvxkIog.exe
  C:\Windows\System\fvxkIog.exe
  2⤵
  PID:16212
- C:\Windows\System\YvafFfe.exe
  C:\Windows\System\YvafFfe.exe
  2⤵
  PID:16228
- C:\Windows\System\rksUJnP.exe
  C:\Windows\System\rksUJnP.exe
  2⤵
  PID:16248
- C:\Windows\System\qflpHVL.exe
  C:\Windows\System\qflpHVL.exe
  2⤵
  PID:16276
- C:\Windows\System\XkEhIwi.exe
  C:\Windows\System\XkEhIwi.exe
  2⤵
  PID:16296
- C:\Windows\System\yEjEuaT.exe
  C:\Windows\System\yEjEuaT.exe
  2⤵
  PID:16320
- C:\Windows\System\TicPviu.exe
  C:\Windows\System\TicPviu.exe
  2⤵
  PID:16340
- C:\Windows\System\dFbSiJz.exe
  C:\Windows\System\dFbSiJz.exe
  2⤵
  PID:16368
- C:\Windows\System\uDtElbs.exe
  C:\Windows\System\uDtElbs.exe
  2⤵
  PID:15096
- C:\Windows\System\tSCzwbi.exe
  C:\Windows\System\tSCzwbi.exe
  2⤵
  PID:13836
- C:\Windows\System\SuIwKdZ.exe
  C:\Windows\System\SuIwKdZ.exe
  2⤵
  PID:14548
- C:\Windows\System\zrvMWse.exe
  C:\Windows\System\zrvMWse.exe
  2⤵
  PID:15256
- C:\Windows\System\plwFhQy.exe
  C:\Windows\System\plwFhQy.exe
  2⤵
  PID:14696
- C:\Windows\System\asHyOpw.exe
  C:\Windows\System\asHyOpw.exe
  2⤵
  PID:13332
- C:\Windows\System\FWLGNFW.exe
  C:\Windows\System\FWLGNFW.exe
  2⤵
  PID:13984
- C:\Windows\System\vVZdmJz.exe
  C:\Windows\System\vVZdmJz.exe
  2⤵
  PID:14368
- C:\Windows\System\VHQLcDS.exe
  C:\Windows\System\VHQLcDS.exe
  2⤵
  PID:13416
- C:\Windows\System\MwhuYQG.exe
  C:\Windows\System\MwhuYQG.exe
  2⤵
  PID:14644
- C:\Windows\System\zdjxrKq.exe
  C:\Windows\System\zdjxrKq.exe
  2⤵
  PID:14692
- C:\Windows\System\GdDsFLc.exe
  C:\Windows\System\GdDsFLc.exe
  2⤵
  PID:14928
- C:\Windows\System\tbutQtQ.exe
  C:\Windows\System\tbutQtQ.exe
  2⤵
  PID:14380
- C:\Windows\System\PypfrAQ.exe
  C:\Windows\System\PypfrAQ.exe
  2⤵
  PID:15032
- C:\Windows\System\NjrqIFW.exe
  C:\Windows\System\NjrqIFW.exe
  2⤵
  PID:15068
- C:\Windows\System\jtscrNl.exe
  C:\Windows\System\jtscrNl.exe
  2⤵
  PID:15424
- C:\Windows\System\jvdCUWz.exe
  C:\Windows\System\jvdCUWz.exe
  2⤵
  PID:15464
- C:\Windows\System\MDLkCSb.exe
  C:\Windows\System\MDLkCSb.exe
  2⤵
  PID:15196
- C:\Windows\System\FbrlUNj.exe
  C:\Windows\System\FbrlUNj.exe
  2⤵
  PID:15564
- C:\Windows\System\FRPdfjS.exe
  C:\Windows\System\FRPdfjS.exe
  2⤵
  PID:16396
- C:\Windows\System\iVOSeoi.exe
  C:\Windows\System\iVOSeoi.exe
  2⤵
  PID:16420
- C:\Windows\System\cHLMUfL.exe
  C:\Windows\System\cHLMUfL.exe
  2⤵
  PID:16444
- C:\Windows\System\tWcDbhs.exe
  C:\Windows\System\tWcDbhs.exe
  2⤵
  PID:16464
- C:\Windows\System\neeFFWL.exe
  C:\Windows\System\neeFFWL.exe
  2⤵
  PID:16488
- C:\Windows\System\asoUgXZ.exe
  C:\Windows\System\asoUgXZ.exe
  2⤵
  PID:16504
- C:\Windows\System\EhsgEIS.exe
  C:\Windows\System\EhsgEIS.exe
  2⤵
  PID:16528
- C:\Windows\System\eQGitQZ.exe
  C:\Windows\System\eQGitQZ.exe
  2⤵
  PID:16548
- C:\Windows\System\YFYdpSd.exe
  C:\Windows\System\YFYdpSd.exe
  2⤵
  PID:16564
- C:\Windows\System\NfxOsQn.exe
  C:\Windows\System\NfxOsQn.exe
  2⤵
  PID:16592
- C:\Windows\System\PuzcRVv.exe
  C:\Windows\System\PuzcRVv.exe
  2⤵
  PID:16612
- C:\Windows\System\nfNrUCx.exe
  C:\Windows\System\nfNrUCx.exe
  2⤵
  PID:16644
- C:\Windows\System\PwQXgKa.exe
  C:\Windows\System\PwQXgKa.exe
  2⤵
  PID:16660
- C:\Windows\System\OROZUaf.exe
  C:\Windows\System\OROZUaf.exe
  2⤵
  PID:16676
- C:\Windows\System\gPhlkQy.exe
  C:\Windows\System\gPhlkQy.exe
  2⤵
  PID:16692
- C:\Windows\System\RdGkxBt.exe
  C:\Windows\System\RdGkxBt.exe
  2⤵
  PID:16716
- C:\Windows\System\aznewJn.exe
  C:\Windows\System\aznewJn.exe
  2⤵
  PID:16732
- C:\Windows\System\mUtsTVn.exe
  C:\Windows\System\mUtsTVn.exe
  2⤵
  PID:16748
- C:\Windows\System\OcQAzqy.exe
  C:\Windows\System\OcQAzqy.exe
  2⤵
  PID:16764
- C:\Windows\System\oUmCALG.exe
  C:\Windows\System\oUmCALG.exe
  2⤵
  PID:16796
- C:\Windows\System\ANUmIqz.exe
  C:\Windows\System\ANUmIqz.exe
  2⤵
  PID:16812
- C:\Windows\System\AIIrknr.exe
  C:\Windows\System\AIIrknr.exe
  2⤵
  PID:16828
- C:\Windows\System\yIbHRJg.exe
  C:\Windows\System\yIbHRJg.exe
  2⤵
  PID:16844
- C:\Windows\System\iFMRfCi.exe
  C:\Windows\System\iFMRfCi.exe
  2⤵
  PID:16860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\FYwHjeZ.exe

Filesize
1.7MB

MD5
dbdee7dca30dd874f18ac4603ab264bb

SHA1
9dd9140f861c45a2fa3550fe33bf24fc4cf45bad

SHA256
4cf9a75d3cc04b3cd4595b2b96850ca9b0290602e70284509083c46f7febe141

SHA512
834632422844b014e3b085307efa6524f0539b9ee9a8ca7ef61a8a926fed5d6ed5690e206f589d0b67f623f35fa6ab840ec7992c6194d8f2ddb80d89f0e05bc1

Download Submit
C:\Windows\System\GWvaabZ.exe

Filesize
1.7MB

MD5
c0a2553184831cc06d8c8a8d418f86ea

SHA1
611eff1e140469547da11ea240550edd78452bc9

SHA256
1bad2f54870cc34e439e0765bb80a54e7390fc1c704b264b9cdb0ce2f92fe48d

SHA512
da91bc1b55fbdb822a5601a4cdad2a7e3fa285ba5c1235937716ce6c34c9d7f885854ae3e3296f0381fb6427a4185ce465f08ce22931a343d4280fe12d94ef68

Download Submit
C:\Windows\System\LSxxWqy.exe

Filesize
1.7MB

MD5
a53ce8efc2ea97e91bfe368ed3e386f2

SHA1
746d5b63881c9a200bef54276fd6deff3322ea63

SHA256
89efc0879b8a3c8e5b38ba35af635118c8c5ba6140ad892aa1bc796f4c95f891

SHA512
1ca71b7f1063f9893dac89165d4e64bc3cee215f2f224eb39899821a286cc04aa2240d5c51e68c4abf0be2b77b38220ef5f173177ceafcc6ed10029b8b71ea6e

Download Submit
C:\Windows\System\LkwRdhS.exe

Filesize
1.7MB

MD5
19abc89390703cd7da19e0a45acb6e91

SHA1
286259f7886bd25ebb0929749b01e6e895e5414d

SHA256
1550af1f9acc3bd3b65cee2789671d33629a294ddab2877d9663b44e823f9563

SHA512
89ef232d6c6d3999bff3f4496aadc3b8cfe77dc57cb124b4a409e67bb5dfbcae700d80515ba917183b4f0f7e7080136e3f8b8409305226d8808226a86f412885

Download Submit
C:\Windows\System\OchEgDx.exe

Filesize
1.7MB

MD5
1e7fc4b903929c258b08c62fb5a76abd

SHA1
fd0bc5a0ed713bfbf24744374aa7db32d0cc31d3

SHA256
c6157256505efbb6f7b13965845f8161af3d03639c87bb307e2113f10943fc4d

SHA512
8dfe7198ee0605910913d8ad4976512fa005c56017417832761e0e9eb54d4fb582c402e24d59f82b96d41e86a1ef5d7be835e7854de24f49253c0308b2c6500f

Download Submit
C:\Windows\System\QGousPt.exe

Filesize
1.7MB

MD5
0d612b277e1228c9b357380bc5f0f5f7

SHA1
20810174923591fb19f51c109445afa6cbf2ea09

SHA256
3396a6c69b2e32f4bc42d7e025f26744affe21e307338f042c6600729f25612c

SHA512
62cd877db3f99c964c8b2088cdb342ff2f0dac5b29294494c1313536e158370eed73aa4a6394192da2ad708c14c5503c83572f4e34aaa2b21b5b5ceeb546257a

Download Submit
C:\Windows\System\RcYnyfI.exe

Filesize
1.7MB

MD5
64d1a729d9f53e3dbe8456c91200de18

SHA1
b3a064c2584be5d71169ca9d3c5d47ced73be99e

SHA256
7f434adc30978758dac73815fa8d9ef7b6a7b89dfdfba35012f139395f9145ea

SHA512
9ba7021e5b6f2a58422290cc7de49ea68b99c6a9ac7c27744e7d47b51325337ddfcb5f84352f6349154f51918d0ab6d941e4eb446c58606b22d9408502b340b8

Download Submit
C:\Windows\System\SVHiwVM.exe

Filesize
1.7MB

MD5
e885d8c97cd395ef6d4b31772fc98d70

SHA1
a14c9031feee5941b11d3f7e288ba9fc7aecd5bd

SHA256
c82693b370c9c8999be0f71cd5d1d5c5d146c05c1629ffcdf3f3e9a51350f798

SHA512
f988fb63d38108de8f8190500f854159065cd1add90b887e6f9c06d49a9a9ab12ad3ae1e53c084d7a1f65cc8e581aa1b500001ae115ab70445471379aadd2690

Download Submit
C:\Windows\System\SmRyAsw.exe

Filesize
1.7MB

MD5
406844f66f9bfbf448128d08fca6e67c

SHA1
44a40de929c85d80f1bc57db35f51e274e89faf2

SHA256
4f016e95b58225c30cc2d10807d8229078f09f00e55e99951c2f2aa5b7c6582e

SHA512
5be0f4306408876b67bdb0c1ee2128d3b55b7b9125596af0ffc7d4288d696a43efa02ded63febd46d8f0de0df372122f8376a1bbf93def67f41699e9d22e5ac0

Download Submit
C:\Windows\System\SyFOvnv.exe

Filesize
1.7MB

MD5
54364bbc290e5288a0dd3d7bf61e4ba0

SHA1
6d9e150210549a8f232e65bbf140763cd6d1d27d

SHA256
233c37c0b6b536961701405e5240f33e2f65b1faff1791f434a7aef091fb613f

SHA512
64361b0469511ac2278f0568b6130a92a2f06f85100f26fc133e1ddb20324ae6e2b5fc62f6c1d3a45d43b800a5d41db19c39d90658a2a94ad0b960a881eb3157

Download Submit
C:\Windows\System\UNJIWLC.exe

Filesize
1.7MB

MD5
f339894e8d3158eca49a619aec1fa811

SHA1
5c13be56c47d0c89fe05fc803ecdefbb512a6375

SHA256
1543b1c6c22ec0dcf34fe1e55f8472d4d211ed7923deca775d99e3c1abf32510

SHA512
118536f211d40e00ab838cf1d15012489edbf0a7447c8deab6b8b7cbd90af9df0096d15c74e11e36b2be31de1eca22172f6611a304578c9a2df6218ae3a4d6c0

Download Submit
C:\Windows\System\VDMwdpt.exe

Filesize
1.7MB

MD5
9c20492fe8b1ee2d42fb5755e886bfaf

SHA1
f2757f846ef6a6c884d50c45b63c3e057e6530d0

SHA256
4440f53ef0a4d4d2f7209cdb91948b779ea3c9da7fd0165906e67cfcc82a19f8

SHA512
93afc9d67c4adf457cf559036a4c8d53b68443fa9ff5fc342c5c7556665779153b8f1816e19ef85f8f06ba33cd3465a31d05cd731e06fc089c46c04c9c677706

Download Submit
C:\Windows\System\WTfSitI.exe

Filesize
1.7MB

MD5
2b51f0f0765fc83b8fb744727a095359

SHA1
f0b3633be0f9191edbb97a09f4b80ebee75d8dbd

SHA256
883e4eb355d19e9b39b3698686fbc9329dc204a2111e9d3786670a190944d214

SHA512
9fe64ebf24ec28eb10465e668cee3935eac0a61e223460ae63a3c017a0cc8415df863610da6a2410cc9ae62f051d49f18fd7b63983c5c9b405ac28e4735f92f9

Download Submit
C:\Windows\System\WaBiyzu.exe

Filesize
1.7MB

MD5
8549023e835d8afa8644d1266b673c5b

SHA1
5a0f8a888f390cf2842c3654c05b54d4f2600145

SHA256
08b750d614222c3236c07cef59528bc11e32450862947f5ffadba75783529e61

SHA512
f62042c11f17b751adc6f90b705e5e4d1872012c0fadfd8e352b5f872eb61608ed56179454206e211f066913a00e10633ed0842c9acd96b058bbafae58b6bf79

Download Submit
C:\Windows\System\ZdAplvB.exe

Filesize
1.7MB

MD5
4547ffddd7bfd1e9f2cac8cc77c81b24

SHA1
a6aaad9e1475ff04cb1b9cba5cad02007cb2fd67

SHA256
d02f096ebac9ffd995ee62a5fcad87e4abc136dabf0310ceb494150d65af4c11

SHA512
d86814836cf0fc4334de5b7e5ab530e4ec1cedd11dff745c22d5d637ff890c627cce3730a8f6058ce33137616c8ae334d650ca83e8879720352efe7ee59ab980

Download Submit
C:\Windows\System\ZqcaIMS.exe

Filesize
1.7MB

MD5
75ad482832845a8be058cfc15243eb3f

SHA1
ab7c5cc30c41a1cca7198802bef4cf158b51e95f

SHA256
14c542907d6b6d436501902275de0e8bf01ebaf2d53e79217df092bc8901350c

SHA512
f48c945c51e1561df919b13d727abcaeb3fcdb97066d032dac4be01ac12ff11e65452956b227fe4525ebeae391a2b6cf6adf4d3f2f119b845df98ef17987dcdf

Download Submit
C:\Windows\System\ceJIyEg.exe

Filesize
1.7MB

MD5
d991a25bf9de0a836ce40a6cac3e5acc

SHA1
99270a34539662e8ca1d7ab330992f45f55db4ea

SHA256
3e0aa08cfc3a44a3feed155724b54466bb922ed36c2057c35d33cad4900b381e

SHA512
81a942ab5f133a89f2708d9c50a925f12a65b649217952e7d25f7f473a2a8404c161a5f24cf8c32da25df183061452be295f0db7da5253f69319d51950f26329

Download Submit
C:\Windows\System\dAwDkxW.exe

Filesize
1.7MB

MD5
6f5d2260756bcc5360d823534245b91b

SHA1
f4c3571d4539cd0d31e13fba17cd57e73e5e8292

SHA256
f7c580c718a9949042ef75f1c0b0e73e06a5e5b29f0f208eeac97b9d3f368362

SHA512
c1e3074d600e8f036a7eefc8f50e8a251804841712dabfe01ac7c6e070ad58b987a6edf69286dc2520ce7f0159d0dd02e8775b312f82be40af1505c6921a2671

Download Submit
C:\Windows\System\djICpll.exe

Filesize
1.7MB

MD5
c16ce75508aa6f70b115e34045192b98

SHA1
edcccec6ba3a2df73af4d7fe92e1e17d955fd6b9

SHA256
42a6e3ce7fefd6ef338bd108211078681305c5566b3a371392d792baaa3ad17e

SHA512
e5b5d655378eb28a438f14d0d6ce7bde538febfad55048bf4f35c6638a5ae21defaa8db2891c40bc9a33cf3999b665e63f6d1b1e0467ac19a698aaeaf021610e

Download Submit
C:\Windows\System\dvJnNTt.exe

Filesize
1.7MB

MD5
e477a0749ca1aa753eae6a3f484be709

SHA1
ddb963bd4b95871761cc09aa9e133d5a69340257

SHA256
a14681858249705ebb18e7e2a2dadcf214d5babc23c21a71345cc23b6821e3ed

SHA512
457c00ec63a77a7fc6817a889165d62e46128d52af4def313811c6e0923019776f08f16ad63792a610e4930ed099dcc215343c0af11095e04b7835eab5680152

Download Submit
C:\Windows\System\ekAVZsz.exe

Filesize
1.7MB

MD5
e160bfa2ce4adac251efaba55de7f968

SHA1
565bf9aef5313c31028e806249339ad6a997394f

SHA256
e2ddfe43db72da8568e79784b7bec6705ddabec52749ce0db7eba184fdffbab4

SHA512
049f3f8f04959d729b48deb6f1ed917a793d72ee0dfae496b4032444468cd48804cfca3ca091101f82d4db854473d620f969046eb7481d15673b991a011d0471

Download Submit
C:\Windows\System\igprfjG.exe

Filesize
1.7MB

MD5
12fbfd7f824b41622f280b3f7c9dec67

SHA1
a8a4ef94f2cef7bd0dd0feaf38e8200f7989b086

SHA256
581eb921be87be856f5588de6b5457f90de59c84868a619aa4112cdd3f090dd1

SHA512
b5a6703e8623f160626faae258cc9373c56c61b7455858991ac82ad67f97cd6cfa478beb2f02cbbb99829a66ee5ad215280cbd3bc04254226f60232bede378f2

Download Submit
C:\Windows\System\medxkFd.exe

Filesize
1.7MB

MD5
95e330a2fba087dcf09543cda9499f52

SHA1
3fb42a78eef9c712162b87f53faaa28df6abd7cc

SHA256
83ef552af15d4364e732da727537c149d7ead8518b31689ba4fd526f6ebf56c0

SHA512
5ebd7551fd2ee498aceaf3467d4580373d5f3c538c7ca4d715a5685abbdc6321785b7c36ac58d3817ef566820363df6ffce77dee5fd922ca361d563cddae0f56

Download Submit
C:\Windows\System\noRmZPy.exe

Filesize
1.7MB

MD5
0b7a3d1442a8632939551267acc333af

SHA1
137913abddb25b15cb8bf193815c3385e1c6afbb

SHA256
097bf86cd6f37dc0a6cf0cd9c517bafd34ce5449f5f1d835d5d68b84efc8e918

SHA512
ea82023609a93db647f5e4967fdf2946e7110a1dade0eac4b8583154a0a1ce914602d0cc701bb6cde90fbe4740a411d4c0399a631f12a96fd9f2f595120f69c8

Download Submit
C:\Windows\System\oRPZDUP.exe

Filesize
1.7MB

MD5
fd5ffb860ce6bcbd2c3e1c7500e297a6

SHA1
1abc62e3c4cddc9d194d71284b6103fbea2da1fc

SHA256
c1b146d9e29a17c34909e915815c3531f8a6504d379765c65d19b285a093d78b

SHA512
e998c38eb7abdaf23888d0b8456d1d5426d1f0129635de5fe0abeb10baa5a2d12eda0c78d27c4479ebbbabb0b74033ce7970fe20e5741932312dfc168736a895

Download Submit
C:\Windows\System\rRsGlRl.exe

Filesize
1.7MB

MD5
26412f5c1e397b91026d051eb81ba102

SHA1
f97d7ec8bfd31cab5140618ce7478c9af813169e

SHA256
ac092053388d54309df117b5c40eff486970402ffa43cd51fcc44188afa5eb69

SHA512
718fb095079dfc158f9e44b3f09ac1a0c8e39e4b98aa5fcbb3c0431d88234051cf72ba19e9c8dadda0c7554cfc408c717fa1c3889b7563d88448d3bbeab613fd

Download Submit
C:\Windows\System\rZExqWM.exe

Filesize
1.7MB

MD5
dd68edcb5f8c037002a6feb34a018ab6

SHA1
52f236bd239268fa5db83e15cbbfac4791733128

SHA256
57efb9437044a4fa10dd93fa786f52df3b3d046a646f134f17cdbc88eb061d64

SHA512
7e3b3623fd6aee413c227bbe48826a6072506a610a0d20e1154fc4b5df8728b1c4dff2f1be2074fa06e533c9191a9865267d0aa042c4f28d4b016b19dd76cbd3

Download Submit
C:\Windows\System\sDLxTwY.exe

Filesize
1.7MB

MD5
10bd511d6a4d39a7128ec4e19de10834

SHA1
ab2fbb5f3382a2f7454cae547dfcf2b81df60e1f

SHA256
32e145a8044a2a472b79de11cb1937355333d34170e721dd1511816ba21d0081

SHA512
a43400896bbb5529cd4b8ffe39144d460f11ff56c091d1b717c825798399b67ac7a50e604ceb2ae0c60bea38a51e1b0a9da301cefc92d71580308a41eabcf4e7

Download Submit
C:\Windows\System\sFijiuI.exe

Filesize
1.7MB

MD5
bbcd1a371b3c840e30ef6b176e21719e

SHA1
f0f41e8406b2cbd9b163e276cc641f8dff1d7a22

SHA256
16c7a7ff7c8f745766c37901f114408f9a0aacd54a75ae6a04f7d5bfa73a2b09

SHA512
39da0c060eb9d93c3f4eb2070e389c5286f643b41ff28e09e614e89e783701602538a2b9a1cea9e4031071365a4de7f2a5ac3c3ca9d23afa4b0c89a5192cde8f

Download Submit
C:\Windows\System\sKOCTGI.exe

Filesize
1.7MB

MD5
1e29c12100ca058d362d5131dfdeb5d0

SHA1
da1e554984dbda9879dd657f33b72c1abe8bbccd

SHA256
1e7c45f6691b029d4b46e84906ed6a855c320037c23e17d390c262836b372936

SHA512
d0d7f16b8e2183649e00edc04a614a16a8a7d6e30e50ef64206fd29eb6a239922faa777ffb9d4697b03bc82f92113c51309649c4fd8186889635e6829f0bdf90

Download Submit
C:\Windows\System\wAnsosM.exe

Filesize
1.7MB

MD5
cb8e2b6cfb7273343ed093f5cd804288

SHA1
20bf40571c5d1fad4024ec71a8163d4be012be53

SHA256
d509a68b03d8bc911adca29f2062d0b6bdbafbba1274d19791c749ebe12dc5cb

SHA512
bd43a3f1e02d9916e0ee6641dcb4262b828c864d60394db4698121c26df028f0d17be5f7b5e5bc54cd63c06087e1b93e20dcd2c0d39f0b09361fec12d2aa8489

Download Submit
C:\Windows\System\woBRxgY.exe

Filesize
1.7MB

MD5
506c71f29ba43d4b267865a51d8abf30

SHA1
7408fc27819ef447609516e72fbbe485bb50da8b

SHA256
1e39f158bce3d682fd1a76f2e42be3ab90c2d349f0ca8c5308f89cb5b67cbcfd

SHA512
096f4f6ec47d4d1042fea51a54b734a22f1fd777ad6b5bb1c108716776aabb992741818094478ebeb601d7b3c821b51c306dee36d38ac82e7a3a33b660d050e0

Download Submit
C:\Windows\System\xPPvwIx.exe

Filesize
1.7MB

MD5
4c12350b779fa8e1773a3c8311da08d5

SHA1
f85834d1af2ccf1554790a292b6ca2915827aabc

SHA256
5c91143ec06800f2766145586926f6b9521a76c0334c4288576cd0ef4a7bea2a

SHA512
b72ee5ecb5f61618d14654e5cd874b56ddd236576d173443c45caa5c71711d3322d3988951e8b4bb486cd1ecaa257876072bc4c3e177ca14358c9648f527a720

Download Submit
memory/1960-0-0x00000274D0C10000-0x00000274D0C20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads