xmrig | 2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
Size

1.4MB
MD5

0dcfe67838db333753d4819479894181
SHA1

5081a29e954580efea4a30f06442976c80c37f89
SHA256

2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb
SHA512

6eefc11393088d1f0411573c098406a0a8c5fe7432157c104677424e694f14392da61ba243bb6171b6f32a71dbd3c12acc337f1ae98b5b7b8d67fa7e47fabbce
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p84nesGung:GezaTF8FcNkNdfE0pZ9ozttwIRxA1sS/

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0018000000023c3b-4.dat	xmrig
behavioral2/files/0x0007000000023cb9-8.dat	xmrig
behavioral2/files/0x0009000000023cb5-10.dat	xmrig
behavioral2/files/0x0007000000023cbd-32.dat	xmrig
behavioral2/files/0x0007000000023cbe-39.dat	xmrig
behavioral2/files/0x0007000000023cc1-60.dat	xmrig
behavioral2/files/0x0007000000023cc5-72.dat	xmrig
behavioral2/files/0x0007000000023ccc-107.dat	xmrig
behavioral2/files/0x0007000000023cd1-140.dat	xmrig
behavioral2/files/0x0007000000023cd7-162.dat	xmrig
behavioral2/files/0x0007000000023cd5-160.dat	xmrig
behavioral2/files/0x0007000000023cd6-157.dat	xmrig
behavioral2/files/0x0007000000023cd4-155.dat	xmrig
behavioral2/files/0x0007000000023cd3-150.dat	xmrig
behavioral2/files/0x0007000000023cd2-145.dat	xmrig
behavioral2/files/0x0007000000023cd0-135.dat	xmrig
behavioral2/files/0x0007000000023ccf-130.dat	xmrig
behavioral2/files/0x0007000000023cce-125.dat	xmrig
behavioral2/files/0x0007000000023ccd-120.dat	xmrig
behavioral2/files/0x0007000000023ccb-110.dat	xmrig
behavioral2/files/0x0007000000023cca-105.dat	xmrig
behavioral2/files/0x0007000000023cc9-100.dat	xmrig
behavioral2/files/0x0007000000023cc8-95.dat	xmrig
behavioral2/files/0x0007000000023cc7-90.dat	xmrig
behavioral2/files/0x0007000000023cc6-85.dat	xmrig
behavioral2/files/0x0007000000023cc4-75.dat	xmrig
behavioral2/files/0x0007000000023cc3-70.dat	xmrig
behavioral2/files/0x0007000000023cc2-65.dat	xmrig
behavioral2/files/0x0007000000023cc0-55.dat	xmrig
behavioral2/files/0x0007000000023cbf-47.dat	xmrig
behavioral2/files/0x0007000000023cbc-33.dat	xmrig
behavioral2/files/0x0007000000023cbb-28.dat	xmrig
behavioral2/files/0x0007000000023cba-21.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2132	DcoJabg.exe
4544	RFHEsiE.exe
3648	uOnvOcu.exe
4620	vhwwOrm.exe
4488	YfcNqog.exe
1732	kidSzGG.exe
3312	fwpnZDn.exe
4172	jYZcZeh.exe
1164	vKoiXce.exe
3460	lrjcPsz.exe
2808	KqPZDGG.exe
4120	NTtdOri.exe
3040	TSfguBa.exe
2580	QeBoXTH.exe
4456	bjgKkql.exe
2412	dWNFFOa.exe
3624	ReaDdBf.exe
2336	woxDnoi.exe
1708	GtvRYfy.exe
5092	RByxtbK.exe
1656	NoRSVvB.exe
2024	yAcfwMk.exe
4412	SUeVMvm.exe
4336	NgYRAVl.exe
4236	KbzYGAu.exe
1700	fKeLzBM.exe
848	iyiDTdX.exe
4572	OhwxxDw.exe
4796	fzJWfIT.exe
2760	WzIWLFc.exe
708	PwuMRZu.exe
4360	GqTyyhU.exe
4584	nOVvkEy.exe
3916	uSDhOpi.exe
4724	xfTcgPh.exe
4416	Jrnuzlg.exe
3224	fnKzuSX.exe
2548	GgMYPYY.exe
1400	cYJwoUB.exe
4536	eEwOOHW.exe
1916	qYQDHUv.exe
1048	wTqFYSq.exe
4428	gpCehfW.exe
1792	AZPcrHr.exe
5084	TqdsbsS.exe
2996	qIRxtDN.exe
1688	ppIEYvA.exe
408	EJQIXSF.exe
4508	OCdkReN.exe
884	TpUfSAU.exe
2228	krQRPQh.exe
4764	VzGXKto.exe
1716	wLsqQuN.exe
2016	cVjBBGZ.exe
2520	aPbpdwt.exe
1568	KkzgCrm.exe
1028	ueyvACX.exe
648	VWpZtHn.exe
4320	fHglTOT.exe
3004	dENmRtF.exe
4436	sUatZRz.exe
1972	vsVvGOg.exe
3692	CGJlfvD.exe
4460	WMDqCio.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pKbXIbp.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\ezlRgrQ.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\xgyUslF.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\kSJzAiO.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\ZmEyney.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\FCztSYr.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\RByxtbK.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\LNdrdOI.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\AXDtTtT.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\blqTUWi.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\qKLgBpG.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\tLbobTv.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\ZeBmeJg.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\nYMcMlu.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\yrFhnNO.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\nAaFFkP.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\tXwgPXN.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\hPFhtEA.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\jQiZCDS.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\JccSWlv.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\rMLLdEz.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\tWXEpUv.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\sSRUsUY.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\aNimQzP.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\BCAYOqn.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\geRviKG.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\kYtsMWT.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\FFPgJfQ.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\zKyQLZx.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\dzLAAdV.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\HxczNzO.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\bkURKor.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\mhmERJY.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\lMblwnP.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\qYqflGN.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\REhjFHo.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\CwBMKSk.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\hFOhOPo.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\DuBCBxP.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\vPqPMsK.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\RmoQsBk.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\eHxXtEU.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\SPiizTO.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\WSkSOoM.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\LMCIJby.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\RGoEXWi.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\nickILB.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\Qcovrmu.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\AZPcrHr.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\jUmPgNG.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\JuWknlK.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\lPfdQnQ.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\tCDWPyD.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\yNqwzrk.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\hBjIGFz.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\LNpjuJW.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\fswaRWp.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\ATWZlaq.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\RGCmYwJ.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\kYhNufx.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\KIsYqMS.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\DdPXblV.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\KpKRZoD.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
File created	C:\Windows\System\JuuEiyS.exe	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2132	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	84
PID 1772 wrote to memory of 2132	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	84
PID 1772 wrote to memory of 4544	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	85
PID 1772 wrote to memory of 4544	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	85
PID 1772 wrote to memory of 3648	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	86
PID 1772 wrote to memory of 3648	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	86
PID 1772 wrote to memory of 4620	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	87
PID 1772 wrote to memory of 4620	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	87
PID 1772 wrote to memory of 4488	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	88
PID 1772 wrote to memory of 4488	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	88
PID 1772 wrote to memory of 1732	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	89
PID 1772 wrote to memory of 1732	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	89
PID 1772 wrote to memory of 3312	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	90
PID 1772 wrote to memory of 3312	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	90
PID 1772 wrote to memory of 4172	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	91
PID 1772 wrote to memory of 4172	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	91
PID 1772 wrote to memory of 1164	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	92
PID 1772 wrote to memory of 1164	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	92
PID 1772 wrote to memory of 3460	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	93
PID 1772 wrote to memory of 3460	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	93
PID 1772 wrote to memory of 2808	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	94
PID 1772 wrote to memory of 2808	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	94
PID 1772 wrote to memory of 4120	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	95
PID 1772 wrote to memory of 4120	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	95
PID 1772 wrote to memory of 3040	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	96
PID 1772 wrote to memory of 3040	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	96
PID 1772 wrote to memory of 2580	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	97
PID 1772 wrote to memory of 2580	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	97
PID 1772 wrote to memory of 4456	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	98
PID 1772 wrote to memory of 4456	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	98
PID 1772 wrote to memory of 2412	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	99
PID 1772 wrote to memory of 2412	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	99
PID 1772 wrote to memory of 3624	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	100
PID 1772 wrote to memory of 3624	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	100
PID 1772 wrote to memory of 2336	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	101
PID 1772 wrote to memory of 2336	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	101
PID 1772 wrote to memory of 1708	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	102
PID 1772 wrote to memory of 1708	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	102
PID 1772 wrote to memory of 5092	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	103
PID 1772 wrote to memory of 5092	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	103
PID 1772 wrote to memory of 1656	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	104
PID 1772 wrote to memory of 1656	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	104
PID 1772 wrote to memory of 2024	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	105
PID 1772 wrote to memory of 2024	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	105
PID 1772 wrote to memory of 4412	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	106
PID 1772 wrote to memory of 4412	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	106
PID 1772 wrote to memory of 4336	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	107
PID 1772 wrote to memory of 4336	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	107
PID 1772 wrote to memory of 4236	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	108
PID 1772 wrote to memory of 4236	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	108
PID 1772 wrote to memory of 1700	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	109
PID 1772 wrote to memory of 1700	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	109
PID 1772 wrote to memory of 848	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	110
PID 1772 wrote to memory of 848	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	110
PID 1772 wrote to memory of 4572	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	111
PID 1772 wrote to memory of 4572	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	111
PID 1772 wrote to memory of 4796	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	112
PID 1772 wrote to memory of 4796	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	112
PID 1772 wrote to memory of 2760	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	113
PID 1772 wrote to memory of 2760	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	113
PID 1772 wrote to memory of 708	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	114
PID 1772 wrote to memory of 708	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	114
PID 1772 wrote to memory of 4360	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	115
PID 1772 wrote to memory of 4360	1772	2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe	115

C:\Users\Admin\AppData\Local\Temp\2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe
"C:\Users\Admin\AppData\Local\Temp\2095fd665989ee9e9279e68d84ffc599c66fe5c183c7906ba3e63be6fbd32ddb.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System\DcoJabg.exe
  C:\Windows\System\DcoJabg.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\RFHEsiE.exe
  C:\Windows\System\RFHEsiE.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\uOnvOcu.exe
  C:\Windows\System\uOnvOcu.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\vhwwOrm.exe
  C:\Windows\System\vhwwOrm.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\YfcNqog.exe
  C:\Windows\System\YfcNqog.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\kidSzGG.exe
  C:\Windows\System\kidSzGG.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\fwpnZDn.exe
  C:\Windows\System\fwpnZDn.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\jYZcZeh.exe
  C:\Windows\System\jYZcZeh.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\vKoiXce.exe
  C:\Windows\System\vKoiXce.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\lrjcPsz.exe
  C:\Windows\System\lrjcPsz.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\KqPZDGG.exe
  C:\Windows\System\KqPZDGG.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\NTtdOri.exe
  C:\Windows\System\NTtdOri.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\TSfguBa.exe
  C:\Windows\System\TSfguBa.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\QeBoXTH.exe
  C:\Windows\System\QeBoXTH.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\bjgKkql.exe
  C:\Windows\System\bjgKkql.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\dWNFFOa.exe
  C:\Windows\System\dWNFFOa.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ReaDdBf.exe
  C:\Windows\System\ReaDdBf.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\woxDnoi.exe
  C:\Windows\System\woxDnoi.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\GtvRYfy.exe
  C:\Windows\System\GtvRYfy.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\RByxtbK.exe
  C:\Windows\System\RByxtbK.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\NoRSVvB.exe
  C:\Windows\System\NoRSVvB.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\yAcfwMk.exe
  C:\Windows\System\yAcfwMk.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\SUeVMvm.exe
  C:\Windows\System\SUeVMvm.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\NgYRAVl.exe
  C:\Windows\System\NgYRAVl.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\KbzYGAu.exe
  C:\Windows\System\KbzYGAu.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\fKeLzBM.exe
  C:\Windows\System\fKeLzBM.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\iyiDTdX.exe
  C:\Windows\System\iyiDTdX.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\OhwxxDw.exe
  C:\Windows\System\OhwxxDw.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\fzJWfIT.exe
  C:\Windows\System\fzJWfIT.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\WzIWLFc.exe
  C:\Windows\System\WzIWLFc.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\PwuMRZu.exe
  C:\Windows\System\PwuMRZu.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\GqTyyhU.exe
  C:\Windows\System\GqTyyhU.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\nOVvkEy.exe
  C:\Windows\System\nOVvkEy.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\uSDhOpi.exe
  C:\Windows\System\uSDhOpi.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\xfTcgPh.exe
  C:\Windows\System\xfTcgPh.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\Jrnuzlg.exe
  C:\Windows\System\Jrnuzlg.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\fnKzuSX.exe
  C:\Windows\System\fnKzuSX.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\GgMYPYY.exe
  C:\Windows\System\GgMYPYY.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\cYJwoUB.exe
  C:\Windows\System\cYJwoUB.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\eEwOOHW.exe
  C:\Windows\System\eEwOOHW.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\qYQDHUv.exe
  C:\Windows\System\qYQDHUv.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\wTqFYSq.exe
  C:\Windows\System\wTqFYSq.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\gpCehfW.exe
  C:\Windows\System\gpCehfW.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\AZPcrHr.exe
  C:\Windows\System\AZPcrHr.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\TqdsbsS.exe
  C:\Windows\System\TqdsbsS.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\qIRxtDN.exe
  C:\Windows\System\qIRxtDN.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\ppIEYvA.exe
  C:\Windows\System\ppIEYvA.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\EJQIXSF.exe
  C:\Windows\System\EJQIXSF.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\OCdkReN.exe
  C:\Windows\System\OCdkReN.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\TpUfSAU.exe
  C:\Windows\System\TpUfSAU.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\krQRPQh.exe
  C:\Windows\System\krQRPQh.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\VzGXKto.exe
  C:\Windows\System\VzGXKto.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\wLsqQuN.exe
  C:\Windows\System\wLsqQuN.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\cVjBBGZ.exe
  C:\Windows\System\cVjBBGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\aPbpdwt.exe
  C:\Windows\System\aPbpdwt.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\KkzgCrm.exe
  C:\Windows\System\KkzgCrm.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\ueyvACX.exe
  C:\Windows\System\ueyvACX.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\VWpZtHn.exe
  C:\Windows\System\VWpZtHn.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\fHglTOT.exe
  C:\Windows\System\fHglTOT.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\dENmRtF.exe
  C:\Windows\System\dENmRtF.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\sUatZRz.exe
  C:\Windows\System\sUatZRz.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\vsVvGOg.exe
  C:\Windows\System\vsVvGOg.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\CGJlfvD.exe
  C:\Windows\System\CGJlfvD.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\WMDqCio.exe
  C:\Windows\System\WMDqCio.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\VGRgcWg.exe
  C:\Windows\System\VGRgcWg.exe
  2⤵
  PID:3852
- C:\Windows\System\lJuJuTM.exe
  C:\Windows\System\lJuJuTM.exe
  2⤵
  PID:4928
- C:\Windows\System\ZdXzoGQ.exe
  C:\Windows\System\ZdXzoGQ.exe
  2⤵
  PID:3464
- C:\Windows\System\JplQHsW.exe
  C:\Windows\System\JplQHsW.exe
  2⤵
  PID:2320
- C:\Windows\System\QHOSYch.exe
  C:\Windows\System\QHOSYch.exe
  2⤵
  PID:2752
- C:\Windows\System\OFLOwoy.exe
  C:\Windows\System\OFLOwoy.exe
  2⤵
  PID:3668
- C:\Windows\System\nvaqpBA.exe
  C:\Windows\System\nvaqpBA.exe
  2⤵
  PID:1944
- C:\Windows\System\yblbHtt.exe
  C:\Windows\System\yblbHtt.exe
  2⤵
  PID:1072
- C:\Windows\System\gyDtJjp.exe
  C:\Windows\System\gyDtJjp.exe
  2⤵
  PID:2244
- C:\Windows\System\xiGMABe.exe
  C:\Windows\System\xiGMABe.exe
  2⤵
  PID:2652
- C:\Windows\System\TMbklfF.exe
  C:\Windows\System\TMbklfF.exe
  2⤵
  PID:2384
- C:\Windows\System\XpqtdGG.exe
  C:\Windows\System\XpqtdGG.exe
  2⤵
  PID:1432
- C:\Windows\System\IzZvzLO.exe
  C:\Windows\System\IzZvzLO.exe
  2⤵
  PID:3508
- C:\Windows\System\XlRjHHR.exe
  C:\Windows\System\XlRjHHR.exe
  2⤵
  PID:2184
- C:\Windows\System\iIdTUxX.exe
  C:\Windows\System\iIdTUxX.exe
  2⤵
  PID:4816
- C:\Windows\System\HSQFQbI.exe
  C:\Windows\System\HSQFQbI.exe
  2⤵
  PID:212
- C:\Windows\System\CUSGSTL.exe
  C:\Windows\System\CUSGSTL.exe
  2⤵
  PID:820
- C:\Windows\System\OrYHBCz.exe
  C:\Windows\System\OrYHBCz.exe
  2⤵
  PID:4556
- C:\Windows\System\mlWmILO.exe
  C:\Windows\System\mlWmILO.exe
  2⤵
  PID:116
- C:\Windows\System\YnxDPUY.exe
  C:\Windows\System\YnxDPUY.exe
  2⤵
  PID:4324
- C:\Windows\System\XKjueue.exe
  C:\Windows\System\XKjueue.exe
  2⤵
  PID:1204
- C:\Windows\System\GbaHXAA.exe
  C:\Windows\System\GbaHXAA.exe
  2⤵
  PID:4560
- C:\Windows\System\BfIxhcZ.exe
  C:\Windows\System\BfIxhcZ.exe
  2⤵
  PID:948
- C:\Windows\System\DVxqNBW.exe
  C:\Windows\System\DVxqNBW.exe
  2⤵
  PID:1628
- C:\Windows\System\WsTYkSu.exe
  C:\Windows\System\WsTYkSu.exe
  2⤵
  PID:5128
- C:\Windows\System\vqijVEt.exe
  C:\Windows\System\vqijVEt.exe
  2⤵
  PID:5160
- C:\Windows\System\TzsJmFs.exe
  C:\Windows\System\TzsJmFs.exe
  2⤵
  PID:5192
- C:\Windows\System\fbmuoiO.exe
  C:\Windows\System\fbmuoiO.exe
  2⤵
  PID:5216
- C:\Windows\System\jvYsbot.exe
  C:\Windows\System\jvYsbot.exe
  2⤵
  PID:5240
- C:\Windows\System\VLJzPIj.exe
  C:\Windows\System\VLJzPIj.exe
  2⤵
  PID:5276
- C:\Windows\System\GOnmACs.exe
  C:\Windows\System\GOnmACs.exe
  2⤵
  PID:5304
- C:\Windows\System\rjSzIiW.exe
  C:\Windows\System\rjSzIiW.exe
  2⤵
  PID:5328
- C:\Windows\System\YeQcGeV.exe
  C:\Windows\System\YeQcGeV.exe
  2⤵
  PID:5360
- C:\Windows\System\aalydVV.exe
  C:\Windows\System\aalydVV.exe
  2⤵
  PID:5384
- C:\Windows\System\IumELpS.exe
  C:\Windows\System\IumELpS.exe
  2⤵
  PID:5412
- C:\Windows\System\vBSZZAn.exe
  C:\Windows\System\vBSZZAn.exe
  2⤵
  PID:5436
- C:\Windows\System\uIBSzAN.exe
  C:\Windows\System\uIBSzAN.exe
  2⤵
  PID:5472
- C:\Windows\System\ThBvIFv.exe
  C:\Windows\System\ThBvIFv.exe
  2⤵
  PID:5496
- C:\Windows\System\xfFjAzj.exe
  C:\Windows\System\xfFjAzj.exe
  2⤵
  PID:5528
- C:\Windows\System\FSrIJaK.exe
  C:\Windows\System\FSrIJaK.exe
  2⤵
  PID:5552
- C:\Windows\System\EYbWDcD.exe
  C:\Windows\System\EYbWDcD.exe
  2⤵
  PID:5580
- C:\Windows\System\KcVmolr.exe
  C:\Windows\System\KcVmolr.exe
  2⤵
  PID:5612
- C:\Windows\System\vQnSbyq.exe
  C:\Windows\System\vQnSbyq.exe
  2⤵
  PID:5640
- C:\Windows\System\DmAMEzU.exe
  C:\Windows\System\DmAMEzU.exe
  2⤵
  PID:5664
- C:\Windows\System\geRviKG.exe
  C:\Windows\System\geRviKG.exe
  2⤵
  PID:5692
- C:\Windows\System\mblVfQk.exe
  C:\Windows\System\mblVfQk.exe
  2⤵
  PID:5720
- C:\Windows\System\DdPXblV.exe
  C:\Windows\System\DdPXblV.exe
  2⤵
  PID:5748
- C:\Windows\System\VZQgyVh.exe
  C:\Windows\System\VZQgyVh.exe
  2⤵
  PID:5812
- C:\Windows\System\WSkSOoM.exe
  C:\Windows\System\WSkSOoM.exe
  2⤵
  PID:5828
- C:\Windows\System\qEXDBeE.exe
  C:\Windows\System\qEXDBeE.exe
  2⤵
  PID:5844
- C:\Windows\System\cORONdG.exe
  C:\Windows\System\cORONdG.exe
  2⤵
  PID:5860
- C:\Windows\System\bgucRaJ.exe
  C:\Windows\System\bgucRaJ.exe
  2⤵
  PID:5888
- C:\Windows\System\xqiTAjU.exe
  C:\Windows\System\xqiTAjU.exe
  2⤵
  PID:5912
- C:\Windows\System\kxTstiM.exe
  C:\Windows\System\kxTstiM.exe
  2⤵
  PID:5940
- C:\Windows\System\brgKEiJ.exe
  C:\Windows\System\brgKEiJ.exe
  2⤵
  PID:5972
- C:\Windows\System\lMblwnP.exe
  C:\Windows\System\lMblwnP.exe
  2⤵
  PID:5996
- C:\Windows\System\TXOohek.exe
  C:\Windows\System\TXOohek.exe
  2⤵
  PID:6028
- C:\Windows\System\LOeiyAC.exe
  C:\Windows\System\LOeiyAC.exe
  2⤵
  PID:6056
- C:\Windows\System\uCDVJYx.exe
  C:\Windows\System\uCDVJYx.exe
  2⤵
  PID:6080
- C:\Windows\System\MmDPHJr.exe
  C:\Windows\System\MmDPHJr.exe
  2⤵
  PID:6108
- C:\Windows\System\FfLveUY.exe
  C:\Windows\System\FfLveUY.exe
  2⤵
  PID:6140
- C:\Windows\System\jUycIqs.exe
  C:\Windows\System\jUycIqs.exe
  2⤵
  PID:2256
- C:\Windows\System\PCgBGTs.exe
  C:\Windows\System\PCgBGTs.exe
  2⤵
  PID:4856
- C:\Windows\System\FKGVgFs.exe
  C:\Windows\System\FKGVgFs.exe
  2⤵
  PID:2020
- C:\Windows\System\udFMyIV.exe
  C:\Windows\System\udFMyIV.exe
  2⤵
  PID:1392
- C:\Windows\System\BEHBDQr.exe
  C:\Windows\System\BEHBDQr.exe
  2⤵
  PID:4444
- C:\Windows\System\NTduJgx.exe
  C:\Windows\System\NTduJgx.exe
  2⤵
  PID:2508
- C:\Windows\System\mhttlnr.exe
  C:\Windows\System\mhttlnr.exe
  2⤵
  PID:3632
- C:\Windows\System\NqerIHJ.exe
  C:\Windows\System\NqerIHJ.exe
  2⤵
  PID:552
- C:\Windows\System\aXhIhIE.exe
  C:\Windows\System\aXhIhIE.exe
  2⤵
  PID:5152
- C:\Windows\System\hVKfrtv.exe
  C:\Windows\System\hVKfrtv.exe
  2⤵
  PID:5232
- C:\Windows\System\RlbdLts.exe
  C:\Windows\System\RlbdLts.exe
  2⤵
  PID:5292
- C:\Windows\System\iOCFozh.exe
  C:\Windows\System\iOCFozh.exe
  2⤵
  PID:5348
- C:\Windows\System\moeHcOg.exe
  C:\Windows\System\moeHcOg.exe
  2⤵
  PID:5428
- C:\Windows\System\ZUdBSNn.exe
  C:\Windows\System\ZUdBSNn.exe
  2⤵
  PID:5488
- C:\Windows\System\AujSdcw.exe
  C:\Windows\System\AujSdcw.exe
  2⤵
  PID:5564
- C:\Windows\System\yrFhnNO.exe
  C:\Windows\System\yrFhnNO.exe
  2⤵
  PID:5620
- C:\Windows\System\AJJXHtM.exe
  C:\Windows\System\AJJXHtM.exe
  2⤵
  PID:5680
- C:\Windows\System\guylHpb.exe
  C:\Windows\System\guylHpb.exe
  2⤵
  PID:5740
- C:\Windows\System\rjMzrMb.exe
  C:\Windows\System\rjMzrMb.exe
  2⤵
  PID:5820
- C:\Windows\System\miyvfrN.exe
  C:\Windows\System\miyvfrN.exe
  2⤵
  PID:5876
- C:\Windows\System\qMKeiTw.exe
  C:\Windows\System\qMKeiTw.exe
  2⤵
  PID:5936
- C:\Windows\System\zPaCyIf.exe
  C:\Windows\System\zPaCyIf.exe
  2⤵
  PID:5992
- C:\Windows\System\ihAvezw.exe
  C:\Windows\System\ihAvezw.exe
  2⤵
  PID:6068
- C:\Windows\System\KtOwdZG.exe
  C:\Windows\System\KtOwdZG.exe
  2⤵
  PID:6132
- C:\Windows\System\dNINITC.exe
  C:\Windows\System\dNINITC.exe
  2⤵
  PID:4512
- C:\Windows\System\XyZnrbt.exe
  C:\Windows\System\XyZnrbt.exe
  2⤵
  PID:428
- C:\Windows\System\xxHHdlD.exe
  C:\Windows\System\xxHHdlD.exe
  2⤵
  PID:1812
- C:\Windows\System\JFzGzeQ.exe
  C:\Windows\System\JFzGzeQ.exe
  2⤵
  PID:5204
- C:\Windows\System\MPsqtDN.exe
  C:\Windows\System\MPsqtDN.exe
  2⤵
  PID:5344
- C:\Windows\System\IfPnQgA.exe
  C:\Windows\System\IfPnQgA.exe
  2⤵
  PID:5452
- C:\Windows\System\QJwIMap.exe
  C:\Windows\System\QJwIMap.exe
  2⤵
  PID:6168
- C:\Windows\System\HOXZirK.exe
  C:\Windows\System\HOXZirK.exe
  2⤵
  PID:6196
- C:\Windows\System\qHdQHKc.exe
  C:\Windows\System\qHdQHKc.exe
  2⤵
  PID:6220
- C:\Windows\System\CMMMziE.exe
  C:\Windows\System\CMMMziE.exe
  2⤵
  PID:6252
- C:\Windows\System\xGBIVvB.exe
  C:\Windows\System\xGBIVvB.exe
  2⤵
  PID:6276
- C:\Windows\System\BumbMfB.exe
  C:\Windows\System\BumbMfB.exe
  2⤵
  PID:6308
- C:\Windows\System\TspaTWx.exe
  C:\Windows\System\TspaTWx.exe
  2⤵
  PID:6332
- C:\Windows\System\AqXDRyE.exe
  C:\Windows\System\AqXDRyE.exe
  2⤵
  PID:6360
- C:\Windows\System\bokBfCX.exe
  C:\Windows\System\bokBfCX.exe
  2⤵
  PID:6388
- C:\Windows\System\hnCRDxP.exe
  C:\Windows\System\hnCRDxP.exe
  2⤵
  PID:6420
- C:\Windows\System\TFIbBsM.exe
  C:\Windows\System\TFIbBsM.exe
  2⤵
  PID:6444
- C:\Windows\System\pVxILcm.exe
  C:\Windows\System\pVxILcm.exe
  2⤵
  PID:6472
- C:\Windows\System\VXsdKlJ.exe
  C:\Windows\System\VXsdKlJ.exe
  2⤵
  PID:6500
- C:\Windows\System\wgBXEWs.exe
  C:\Windows\System\wgBXEWs.exe
  2⤵
  PID:6528
- C:\Windows\System\ZjGfXAP.exe
  C:\Windows\System\ZjGfXAP.exe
  2⤵
  PID:6556
- C:\Windows\System\jBaRria.exe
  C:\Windows\System\jBaRria.exe
  2⤵
  PID:6584
- C:\Windows\System\JccSWlv.exe
  C:\Windows\System\JccSWlv.exe
  2⤵
  PID:6612
- C:\Windows\System\CJTtqAG.exe
  C:\Windows\System\CJTtqAG.exe
  2⤵
  PID:6640
- C:\Windows\System\lWcKavw.exe
  C:\Windows\System\lWcKavw.exe
  2⤵
  PID:6668
- C:\Windows\System\RlRkQZv.exe
  C:\Windows\System\RlRkQZv.exe
  2⤵
  PID:6696
- C:\Windows\System\LQdMroF.exe
  C:\Windows\System\LQdMroF.exe
  2⤵
  PID:6728
- C:\Windows\System\leiFQzg.exe
  C:\Windows\System\leiFQzg.exe
  2⤵
  PID:6756
- C:\Windows\System\ecHlDzB.exe
  C:\Windows\System\ecHlDzB.exe
  2⤵
  PID:6784
- C:\Windows\System\ackVsyO.exe
  C:\Windows\System\ackVsyO.exe
  2⤵
  PID:6812
- C:\Windows\System\QwXmMYw.exe
  C:\Windows\System\QwXmMYw.exe
  2⤵
  PID:6844
- C:\Windows\System\SLCPmFm.exe
  C:\Windows\System\SLCPmFm.exe
  2⤵
  PID:6868
- C:\Windows\System\qaCUiTR.exe
  C:\Windows\System\qaCUiTR.exe
  2⤵
  PID:6896
- C:\Windows\System\KGdIAXq.exe
  C:\Windows\System\KGdIAXq.exe
  2⤵
  PID:6920
- C:\Windows\System\IvsaNDv.exe
  C:\Windows\System\IvsaNDv.exe
  2⤵
  PID:6948
- C:\Windows\System\DwJmKTb.exe
  C:\Windows\System\DwJmKTb.exe
  2⤵
  PID:6976
- C:\Windows\System\KAkbVJc.exe
  C:\Windows\System\KAkbVJc.exe
  2⤵
  PID:7004
- C:\Windows\System\qGAMGhr.exe
  C:\Windows\System\qGAMGhr.exe
  2⤵
  PID:7036
- C:\Windows\System\OpZOxbr.exe
  C:\Windows\System\OpZOxbr.exe
  2⤵
  PID:7060
- C:\Windows\System\CEBHXTl.exe
  C:\Windows\System\CEBHXTl.exe
  2⤵
  PID:7092
- C:\Windows\System\VgaerBq.exe
  C:\Windows\System\VgaerBq.exe
  2⤵
  PID:7116
- C:\Windows\System\vGOiOSH.exe
  C:\Windows\System\vGOiOSH.exe
  2⤵
  PID:7144
- C:\Windows\System\lDrHIYE.exe
  C:\Windows\System\lDrHIYE.exe
  2⤵
  PID:5512
- C:\Windows\System\hPFhtEA.exe
  C:\Windows\System\hPFhtEA.exe
  2⤵
  PID:5656
- C:\Windows\System\CtWIrge.exe
  C:\Windows\System\CtWIrge.exe
  2⤵
  PID:5804
- C:\Windows\System\pHgpNNu.exe
  C:\Windows\System\pHgpNNu.exe
  2⤵
  PID:5960
- C:\Windows\System\GJerPne.exe
  C:\Windows\System\GJerPne.exe
  2⤵
  PID:6100
- C:\Windows\System\SignfbV.exe
  C:\Windows\System\SignfbV.exe
  2⤵
  PID:2744
- C:\Windows\System\tCDWPyD.exe
  C:\Windows\System\tCDWPyD.exe
  2⤵
  PID:5124
- C:\Windows\System\RTFwtTM.exe
  C:\Windows\System\RTFwtTM.exe
  2⤵
  PID:5396
- C:\Windows\System\VMapOwg.exe
  C:\Windows\System\VMapOwg.exe
  2⤵
  PID:6188
- C:\Windows\System\ASJGLyP.exe
  C:\Windows\System\ASJGLyP.exe
  2⤵
  PID:6264
- C:\Windows\System\HQbSGHr.exe
  C:\Windows\System\HQbSGHr.exe
  2⤵
  PID:6320
- C:\Windows\System\zCxSqeU.exe
  C:\Windows\System\zCxSqeU.exe
  2⤵
  PID:6380
- C:\Windows\System\rskwhvA.exe
  C:\Windows\System\rskwhvA.exe
  2⤵
  PID:6440
- C:\Windows\System\odyDRLS.exe
  C:\Windows\System\odyDRLS.exe
  2⤵
  PID:6492
- C:\Windows\System\sUARQtB.exe
  C:\Windows\System\sUARQtB.exe
  2⤵
  PID:6548
- C:\Windows\System\xgyUslF.exe
  C:\Windows\System\xgyUslF.exe
  2⤵
  PID:6600
- C:\Windows\System\WDaxTpl.exe
  C:\Windows\System\WDaxTpl.exe
  2⤵
  PID:6660
- C:\Windows\System\MsqMxCt.exe
  C:\Windows\System\MsqMxCt.exe
  2⤵
  PID:6720
- C:\Windows\System\CMpgNxA.exe
  C:\Windows\System\CMpgNxA.exe
  2⤵
  PID:896
- C:\Windows\System\sHQBXdP.exe
  C:\Windows\System\sHQBXdP.exe
  2⤵
  PID:6944
- C:\Windows\System\aIGzhIN.exe
  C:\Windows\System\aIGzhIN.exe
  2⤵
  PID:7028
- C:\Windows\System\WDDuPxy.exe
  C:\Windows\System\WDDuPxy.exe
  2⤵
  PID:7088
- C:\Windows\System\LMCIJby.exe
  C:\Windows\System\LMCIJby.exe
  2⤵
  PID:1852
- C:\Windows\System\DuBCBxP.exe
  C:\Windows\System\DuBCBxP.exe
  2⤵
  PID:5596
- C:\Windows\System\YfbGDNn.exe
  C:\Windows\System\YfbGDNn.exe
  2⤵
  PID:384
- C:\Windows\System\memwCoI.exe
  C:\Windows\System\memwCoI.exe
  2⤵
  PID:6044
- C:\Windows\System\WSLwLyW.exe
  C:\Windows\System\WSLwLyW.exe
  2⤵
  PID:2504
- C:\Windows\System\XpowwIj.exe
  C:\Windows\System\XpowwIj.exe
  2⤵
  PID:5340
- C:\Windows\System\jUmPgNG.exe
  C:\Windows\System\jUmPgNG.exe
  2⤵
  PID:6184
- C:\Windows\System\lORNUaW.exe
  C:\Windows\System\lORNUaW.exe
  2⤵
  PID:2272
- C:\Windows\System\tcFDdBm.exe
  C:\Windows\System\tcFDdBm.exe
  2⤵
  PID:4392
- C:\Windows\System\mWEUWPW.exe
  C:\Windows\System\mWEUWPW.exe
  2⤵
  PID:6436
- C:\Windows\System\rMLLdEz.exe
  C:\Windows\System\rMLLdEz.exe
  2⤵
  PID:6520
- C:\Windows\System\fWXXISb.exe
  C:\Windows\System\fWXXISb.exe
  2⤵
  PID:4576
- C:\Windows\System\UgLZkTc.exe
  C:\Windows\System\UgLZkTc.exe
  2⤵
  PID:1040
- C:\Windows\System\htFhyII.exe
  C:\Windows\System\htFhyII.exe
  2⤵
  PID:4740
- C:\Windows\System\SauWFOl.exe
  C:\Windows\System\SauWFOl.exe
  2⤵
  PID:4396
- C:\Windows\System\VJcaJvN.exe
  C:\Windows\System\VJcaJvN.exe
  2⤵
  PID:368
- C:\Windows\System\RGoEXWi.exe
  C:\Windows\System\RGoEXWi.exe
  2⤵
  PID:2100
- C:\Windows\System\bbAeUvH.exe
  C:\Windows\System\bbAeUvH.exe
  2⤵
  PID:6968
- C:\Windows\System\hhyGSJc.exe
  C:\Windows\System\hhyGSJc.exe
  2⤵
  PID:7076
- C:\Windows\System\nsQxFNv.exe
  C:\Windows\System\nsQxFNv.exe
  2⤵
  PID:7164
- C:\Windows\System\oodDIvH.exe
  C:\Windows\System\oodDIvH.exe
  2⤵
  PID:440
- C:\Windows\System\HwnAyKa.exe
  C:\Windows\System\HwnAyKa.exe
  2⤵
  PID:5032
- C:\Windows\System\eqdsgZL.exe
  C:\Windows\System\eqdsgZL.exe
  2⤵
  PID:2788
- C:\Windows\System\guPeGCC.exe
  C:\Windows\System\guPeGCC.exe
  2⤵
  PID:3124
- C:\Windows\System\qKLgBpG.exe
  C:\Windows\System\qKLgBpG.exe
  2⤵
  PID:4284
- C:\Windows\System\lZPikTn.exe
  C:\Windows\System\lZPikTn.exe
  2⤵
  PID:1116
- C:\Windows\System\xVUsbvd.exe
  C:\Windows\System\xVUsbvd.exe
  2⤵
  PID:2748
- C:\Windows\System\CrrpTUW.exe
  C:\Windows\System\CrrpTUW.exe
  2⤵
  PID:6940
- C:\Windows\System\KLVLzhB.exe
  C:\Windows\System\KLVLzhB.exe
  2⤵
  PID:7204
- C:\Windows\System\jnFUDnx.exe
  C:\Windows\System\jnFUDnx.exe
  2⤵
  PID:7232
- C:\Windows\System\IIrWzcE.exe
  C:\Windows\System\IIrWzcE.exe
  2⤵
  PID:7252
- C:\Windows\System\sSEjzOz.exe
  C:\Windows\System\sSEjzOz.exe
  2⤵
  PID:7284
- C:\Windows\System\nzOtvLP.exe
  C:\Windows\System\nzOtvLP.exe
  2⤵
  PID:7308
- C:\Windows\System\LNdrdOI.exe
  C:\Windows\System\LNdrdOI.exe
  2⤵
  PID:7336
- C:\Windows\System\nAaFFkP.exe
  C:\Windows\System\nAaFFkP.exe
  2⤵
  PID:7364
- C:\Windows\System\dtZczWj.exe
  C:\Windows\System\dtZczWj.exe
  2⤵
  PID:7388
- C:\Windows\System\WVMXLOi.exe
  C:\Windows\System\WVMXLOi.exe
  2⤵
  PID:7428
- C:\Windows\System\aZaaKrt.exe
  C:\Windows\System\aZaaKrt.exe
  2⤵
  PID:7460
- C:\Windows\System\WMeNXip.exe
  C:\Windows\System\WMeNXip.exe
  2⤵
  PID:7476
- C:\Windows\System\EPmbuXF.exe
  C:\Windows\System\EPmbuXF.exe
  2⤵
  PID:7516
- C:\Windows\System\mBKeLah.exe
  C:\Windows\System\mBKeLah.exe
  2⤵
  PID:7544
- C:\Windows\System\aWIMVqA.exe
  C:\Windows\System\aWIMVqA.exe
  2⤵
  PID:7572
- C:\Windows\System\VVVAbok.exe
  C:\Windows\System\VVVAbok.exe
  2⤵
  PID:7608
- C:\Windows\System\bJcrIiZ.exe
  C:\Windows\System\bJcrIiZ.exe
  2⤵
  PID:7660
- C:\Windows\System\joKHxhN.exe
  C:\Windows\System\joKHxhN.exe
  2⤵
  PID:7676
- C:\Windows\System\eZhiLXb.exe
  C:\Windows\System\eZhiLXb.exe
  2⤵
  PID:7712
- C:\Windows\System\sKaXiuL.exe
  C:\Windows\System\sKaXiuL.exe
  2⤵
  PID:7736
- C:\Windows\System\EszeduM.exe
  C:\Windows\System\EszeduM.exe
  2⤵
  PID:7760
- C:\Windows\System\vdUKpmE.exe
  C:\Windows\System\vdUKpmE.exe
  2⤵
  PID:7788
- C:\Windows\System\lFhzsHe.exe
  C:\Windows\System\lFhzsHe.exe
  2⤵
  PID:7828
- C:\Windows\System\WtvSTQf.exe
  C:\Windows\System\WtvSTQf.exe
  2⤵
  PID:7856
- C:\Windows\System\sKzcTXz.exe
  C:\Windows\System\sKzcTXz.exe
  2⤵
  PID:7872
- C:\Windows\System\dSvzXgZ.exe
  C:\Windows\System\dSvzXgZ.exe
  2⤵
  PID:7900
- C:\Windows\System\BzviYAG.exe
  C:\Windows\System\BzviYAG.exe
  2⤵
  PID:7928
- C:\Windows\System\tiQLxcZ.exe
  C:\Windows\System\tiQLxcZ.exe
  2⤵
  PID:7944
- C:\Windows\System\XNEXleR.exe
  C:\Windows\System\XNEXleR.exe
  2⤵
  PID:7988
- C:\Windows\System\fTzPeLA.exe
  C:\Windows\System\fTzPeLA.exe
  2⤵
  PID:8016
- C:\Windows\System\dDGlxqQ.exe
  C:\Windows\System\dDGlxqQ.exe
  2⤵
  PID:8040
- C:\Windows\System\ThChXXf.exe
  C:\Windows\System\ThChXXf.exe
  2⤵
  PID:8064
- C:\Windows\System\kSJzAiO.exe
  C:\Windows\System\kSJzAiO.exe
  2⤵
  PID:8084
- C:\Windows\System\KhmtPTT.exe
  C:\Windows\System\KhmtPTT.exe
  2⤵
  PID:8104
- C:\Windows\System\ieLbnuy.exe
  C:\Windows\System\ieLbnuy.exe
  2⤵
  PID:8124
- C:\Windows\System\hiABlok.exe
  C:\Windows\System\hiABlok.exe
  2⤵
  PID:8144
- C:\Windows\System\eTGSLZB.exe
  C:\Windows\System\eTGSLZB.exe
  2⤵
  PID:8172
- C:\Windows\System\Trrceqv.exe
  C:\Windows\System\Trrceqv.exe
  2⤵
  PID:4948
- C:\Windows\System\qhGKwxO.exe
  C:\Windows\System\qhGKwxO.exe
  2⤵
  PID:6712
- C:\Windows\System\kPZVYOL.exe
  C:\Windows\System\kPZVYOL.exe
  2⤵
  PID:2588
- C:\Windows\System\JjpfOdZ.exe
  C:\Windows\System\JjpfOdZ.exe
  2⤵
  PID:7276
- C:\Windows\System\fswaRWp.exe
  C:\Windows\System\fswaRWp.exe
  2⤵
  PID:7360
- C:\Windows\System\eUjEfjP.exe
  C:\Windows\System\eUjEfjP.exe
  2⤵
  PID:7412
- C:\Windows\System\YrvzByc.exe
  C:\Windows\System\YrvzByc.exe
  2⤵
  PID:7440
- C:\Windows\System\zYwtIxO.exe
  C:\Windows\System\zYwtIxO.exe
  2⤵
  PID:7532
- C:\Windows\System\QkRzLnn.exe
  C:\Windows\System\QkRzLnn.exe
  2⤵
  PID:7508
- C:\Windows\System\EcYEHTJ.exe
  C:\Windows\System\EcYEHTJ.exe
  2⤵
  PID:7632
- C:\Windows\System\lnmVPGo.exe
  C:\Windows\System\lnmVPGo.exe
  2⤵
  PID:7728
- C:\Windows\System\RDIPbTj.exe
  C:\Windows\System\RDIPbTj.exe
  2⤵
  PID:7808
- C:\Windows\System\hKiHggy.exe
  C:\Windows\System\hKiHggy.exe
  2⤵
  PID:7884
- C:\Windows\System\qqVKyyx.exe
  C:\Windows\System\qqVKyyx.exe
  2⤵
  PID:7920
- C:\Windows\System\QRMEoUN.exe
  C:\Windows\System\QRMEoUN.exe
  2⤵
  PID:7980
- C:\Windows\System\tcIDORz.exe
  C:\Windows\System\tcIDORz.exe
  2⤵
  PID:8060
- C:\Windows\System\qjnjetV.exe
  C:\Windows\System\qjnjetV.exe
  2⤵
  PID:8184
- C:\Windows\System\jiXRBIa.exe
  C:\Windows\System\jiXRBIa.exe
  2⤵
  PID:7200
- C:\Windows\System\KpKRZoD.exe
  C:\Windows\System\KpKRZoD.exe
  2⤵
  PID:7384
- C:\Windows\System\wUWHbDT.exe
  C:\Windows\System\wUWHbDT.exe
  2⤵
  PID:7328
- C:\Windows\System\EbtCBPD.exe
  C:\Windows\System\EbtCBPD.exe
  2⤵
  PID:7528
- C:\Windows\System\kKVioFV.exe
  C:\Windows\System\kKVioFV.exe
  2⤵
  PID:7772
- C:\Windows\System\ZbBHfMF.exe
  C:\Windows\System\ZbBHfMF.exe
  2⤵
  PID:7912
- C:\Windows\System\QJZaApt.exe
  C:\Windows\System\QJZaApt.exe
  2⤵
  PID:8116
- C:\Windows\System\SZanVYO.exe
  C:\Windows\System\SZanVYO.exe
  2⤵
  PID:8180
- C:\Windows\System\YpBVKEJ.exe
  C:\Windows\System\YpBVKEJ.exe
  2⤵
  PID:7320
- C:\Windows\System\QwIKCHV.exe
  C:\Windows\System\QwIKCHV.exe
  2⤵
  PID:7372
- C:\Windows\System\ynAGCEW.exe
  C:\Windows\System\ynAGCEW.exe
  2⤵
  PID:7784
- C:\Windows\System\DvckTLs.exe
  C:\Windows\System\DvckTLs.exe
  2⤵
  PID:6432
- C:\Windows\System\GMXmggN.exe
  C:\Windows\System\GMXmggN.exe
  2⤵
  PID:8216
- C:\Windows\System\CBvOAPe.exe
  C:\Windows\System\CBvOAPe.exe
  2⤵
  PID:8232
- C:\Windows\System\TXHhmER.exe
  C:\Windows\System\TXHhmER.exe
  2⤵
  PID:8292
- C:\Windows\System\HTdQNRv.exe
  C:\Windows\System\HTdQNRv.exe
  2⤵
  PID:8308
- C:\Windows\System\EVusKmZ.exe
  C:\Windows\System\EVusKmZ.exe
  2⤵
  PID:8340
- C:\Windows\System\XLPnnwv.exe
  C:\Windows\System\XLPnnwv.exe
  2⤵
  PID:8360
- C:\Windows\System\yLrlKMJ.exe
  C:\Windows\System\yLrlKMJ.exe
  2⤵
  PID:8392
- C:\Windows\System\qkxCMYU.exe
  C:\Windows\System\qkxCMYU.exe
  2⤵
  PID:8416
- C:\Windows\System\YSdUUJO.exe
  C:\Windows\System\YSdUUJO.exe
  2⤵
  PID:8448
- C:\Windows\System\RejCqRY.exe
  C:\Windows\System\RejCqRY.exe
  2⤵
  PID:8468
- C:\Windows\System\aVbiIuh.exe
  C:\Windows\System\aVbiIuh.exe
  2⤵
  PID:8520
- C:\Windows\System\KdKSXxO.exe
  C:\Windows\System\KdKSXxO.exe
  2⤵
  PID:8540
- C:\Windows\System\EueImVa.exe
  C:\Windows\System\EueImVa.exe
  2⤵
  PID:8560
- C:\Windows\System\SKdwMXD.exe
  C:\Windows\System\SKdwMXD.exe
  2⤵
  PID:8584
- C:\Windows\System\QcDzdyz.exe
  C:\Windows\System\QcDzdyz.exe
  2⤵
  PID:8620
- C:\Windows\System\uRMEmWT.exe
  C:\Windows\System\uRMEmWT.exe
  2⤵
  PID:8644
- C:\Windows\System\wRkPctv.exe
  C:\Windows\System\wRkPctv.exe
  2⤵
  PID:8692
- C:\Windows\System\FLlYlDx.exe
  C:\Windows\System\FLlYlDx.exe
  2⤵
  PID:8708
- C:\Windows\System\XBgcZSo.exe
  C:\Windows\System\XBgcZSo.exe
  2⤵
  PID:8724
- C:\Windows\System\vEdrkxy.exe
  C:\Windows\System\vEdrkxy.exe
  2⤵
  PID:8748
- C:\Windows\System\rQkavtt.exe
  C:\Windows\System\rQkavtt.exe
  2⤵
  PID:8772
- C:\Windows\System\ndyBjnl.exe
  C:\Windows\System\ndyBjnl.exe
  2⤵
  PID:8808
- C:\Windows\System\DuArzmg.exe
  C:\Windows\System\DuArzmg.exe
  2⤵
  PID:8860
- C:\Windows\System\fOIoWui.exe
  C:\Windows\System\fOIoWui.exe
  2⤵
  PID:8880
- C:\Windows\System\FtqWlaT.exe
  C:\Windows\System\FtqWlaT.exe
  2⤵
  PID:8900
- C:\Windows\System\qHUHLAM.exe
  C:\Windows\System\qHUHLAM.exe
  2⤵
  PID:8920
- C:\Windows\System\eHxXtEU.exe
  C:\Windows\System\eHxXtEU.exe
  2⤵
  PID:8952
- C:\Windows\System\oTpTwbk.exe
  C:\Windows\System\oTpTwbk.exe
  2⤵
  PID:8976
- C:\Windows\System\jBemHJQ.exe
  C:\Windows\System\jBemHJQ.exe
  2⤵
  PID:9020
- C:\Windows\System\EtLpdMw.exe
  C:\Windows\System\EtLpdMw.exe
  2⤵
  PID:9044
- C:\Windows\System\oBYjzBU.exe
  C:\Windows\System\oBYjzBU.exe
  2⤵
  PID:9084
- C:\Windows\System\kxUCDVX.exe
  C:\Windows\System\kxUCDVX.exe
  2⤵
  PID:9100
- C:\Windows\System\pKcMWDB.exe
  C:\Windows\System\pKcMWDB.exe
  2⤵
  PID:9140
- C:\Windows\System\XxGcaRt.exe
  C:\Windows\System\XxGcaRt.exe
  2⤵
  PID:9156
- C:\Windows\System\LtqCCsd.exe
  C:\Windows\System\LtqCCsd.exe
  2⤵
  PID:9172
- C:\Windows\System\GNgNcbu.exe
  C:\Windows\System\GNgNcbu.exe
  2⤵
  PID:7968
- C:\Windows\System\kUdnQKf.exe
  C:\Windows\System\kUdnQKf.exe
  2⤵
  PID:8200
- C:\Windows\System\FpMrILT.exe
  C:\Windows\System\FpMrILT.exe
  2⤵
  PID:8252
- C:\Windows\System\oUUcDjv.exe
  C:\Windows\System\oUUcDjv.exe
  2⤵
  PID:8300
- C:\Windows\System\iEeWtBp.exe
  C:\Windows\System\iEeWtBp.exe
  2⤵
  PID:8380
- C:\Windows\System\hKYzJry.exe
  C:\Windows\System\hKYzJry.exe
  2⤵
  PID:8436
- C:\Windows\System\oGgFjph.exe
  C:\Windows\System\oGgFjph.exe
  2⤵
  PID:8496
- C:\Windows\System\dpkvzJe.exe
  C:\Windows\System\dpkvzJe.exe
  2⤵
  PID:8532
- C:\Windows\System\tRtIdzI.exe
  C:\Windows\System\tRtIdzI.exe
  2⤵
  PID:8664
- C:\Windows\System\lzbuoZS.exe
  C:\Windows\System\lzbuoZS.exe
  2⤵
  PID:8700
- C:\Windows\System\FhOTjDC.exe
  C:\Windows\System\FhOTjDC.exe
  2⤵
  PID:8744
- C:\Windows\System\BjNOwGY.exe
  C:\Windows\System\BjNOwGY.exe
  2⤵
  PID:8788
- C:\Windows\System\oWmQaZU.exe
  C:\Windows\System\oWmQaZU.exe
  2⤵
  PID:8912
- C:\Windows\System\kBiSAQR.exe
  C:\Windows\System\kBiSAQR.exe
  2⤵
  PID:9040
- C:\Windows\System\wbNXkci.exe
  C:\Windows\System\wbNXkci.exe
  2⤵
  PID:9028
- C:\Windows\System\CaOWKmw.exe
  C:\Windows\System\CaOWKmw.exe
  2⤵
  PID:9076
- C:\Windows\System\toCGpKW.exe
  C:\Windows\System\toCGpKW.exe
  2⤵
  PID:9132
- C:\Windows\System\PQWOfnX.exe
  C:\Windows\System\PQWOfnX.exe
  2⤵
  PID:8284
- C:\Windows\System\kgQUigy.exe
  C:\Windows\System\kgQUigy.exe
  2⤵
  PID:8408
- C:\Windows\System\QtfnuoZ.exe
  C:\Windows\System\QtfnuoZ.exe
  2⤵
  PID:8464
- C:\Windows\System\NkLtTuq.exe
  C:\Windows\System\NkLtTuq.exe
  2⤵
  PID:8676
- C:\Windows\System\OVxqItw.exe
  C:\Windows\System\OVxqItw.exe
  2⤵
  PID:8780
- C:\Windows\System\nZYonwR.exe
  C:\Windows\System\nZYonwR.exe
  2⤵
  PID:9008
- C:\Windows\System\ruQuIjM.exe
  C:\Windows\System\ruQuIjM.exe
  2⤵
  PID:9116
- C:\Windows\System\NNhzypT.exe
  C:\Windows\System\NNhzypT.exe
  2⤵
  PID:7636
- C:\Windows\System\dqDlcix.exe
  C:\Windows\System\dqDlcix.exe
  2⤵
  PID:8432
- C:\Windows\System\zBWjfGI.exe
  C:\Windows\System\zBWjfGI.exe
  2⤵
  PID:8888
- C:\Windows\System\RsRoBmc.exe
  C:\Windows\System\RsRoBmc.exe
  2⤵
  PID:9000
- C:\Windows\System\VGCzUBT.exe
  C:\Windows\System\VGCzUBT.exe
  2⤵
  PID:9056
- C:\Windows\System\JEPjIls.exe
  C:\Windows\System\JEPjIls.exe
  2⤵
  PID:9236
- C:\Windows\System\neasFnt.exe
  C:\Windows\System\neasFnt.exe
  2⤵
  PID:9260
- C:\Windows\System\SywiVSK.exe
  C:\Windows\System\SywiVSK.exe
  2⤵
  PID:9296
- C:\Windows\System\ZczsMdV.exe
  C:\Windows\System\ZczsMdV.exe
  2⤵
  PID:9312
- C:\Windows\System\HMVNIJr.exe
  C:\Windows\System\HMVNIJr.exe
  2⤵
  PID:9364
- C:\Windows\System\McRhUVS.exe
  C:\Windows\System\McRhUVS.exe
  2⤵
  PID:9392
- C:\Windows\System\qQSilfE.exe
  C:\Windows\System\qQSilfE.exe
  2⤵
  PID:9412
- C:\Windows\System\HcxYHNR.exe
  C:\Windows\System\HcxYHNR.exe
  2⤵
  PID:9432
- C:\Windows\System\hdHUFfW.exe
  C:\Windows\System\hdHUFfW.exe
  2⤵
  PID:9464
- C:\Windows\System\jloEaxB.exe
  C:\Windows\System\jloEaxB.exe
  2⤵
  PID:9496
- C:\Windows\System\hdHYAmB.exe
  C:\Windows\System\hdHYAmB.exe
  2⤵
  PID:9516
- C:\Windows\System\gqJcQml.exe
  C:\Windows\System\gqJcQml.exe
  2⤵
  PID:9540
- C:\Windows\System\ULzEfmW.exe
  C:\Windows\System\ULzEfmW.exe
  2⤵
  PID:9564
- C:\Windows\System\QAOngaL.exe
  C:\Windows\System\QAOngaL.exe
  2⤵
  PID:9584
- C:\Windows\System\fmiTJAb.exe
  C:\Windows\System\fmiTJAb.exe
  2⤵
  PID:9600
- C:\Windows\System\MVARZLF.exe
  C:\Windows\System\MVARZLF.exe
  2⤵
  PID:9668
- C:\Windows\System\GDQOrkH.exe
  C:\Windows\System\GDQOrkH.exe
  2⤵
  PID:9688
- C:\Windows\System\hzdqlPV.exe
  C:\Windows\System\hzdqlPV.exe
  2⤵
  PID:9720
- C:\Windows\System\aImpwib.exe
  C:\Windows\System\aImpwib.exe
  2⤵
  PID:9736
- C:\Windows\System\GnJJwlu.exe
  C:\Windows\System\GnJJwlu.exe
  2⤵
  PID:9776
- C:\Windows\System\DuifPif.exe
  C:\Windows\System\DuifPif.exe
  2⤵
  PID:9816
- C:\Windows\System\lLbXCLU.exe
  C:\Windows\System\lLbXCLU.exe
  2⤵
  PID:9832
- C:\Windows\System\YzeQAvT.exe
  C:\Windows\System\YzeQAvT.exe
  2⤵
  PID:9856
- C:\Windows\System\CpKYYjj.exe
  C:\Windows\System\CpKYYjj.exe
  2⤵
  PID:9896
- C:\Windows\System\tWXEpUv.exe
  C:\Windows\System\tWXEpUv.exe
  2⤵
  PID:9916
- C:\Windows\System\hRrsZmY.exe
  C:\Windows\System\hRrsZmY.exe
  2⤵
  PID:9940
- C:\Windows\System\rXyKTDX.exe
  C:\Windows\System\rXyKTDX.exe
  2⤵
  PID:9964
- C:\Windows\System\AXYsrGO.exe
  C:\Windows\System\AXYsrGO.exe
  2⤵
  PID:9992
- C:\Windows\System\vzddBmy.exe
  C:\Windows\System\vzddBmy.exe
  2⤵
  PID:10020
- C:\Windows\System\eoegiNh.exe
  C:\Windows\System\eoegiNh.exe
  2⤵
  PID:10068
- C:\Windows\System\aUfjfSd.exe
  C:\Windows\System\aUfjfSd.exe
  2⤵
  PID:10096
- C:\Windows\System\mfERmgJ.exe
  C:\Windows\System\mfERmgJ.exe
  2⤵
  PID:10112
- C:\Windows\System\ExTpHQg.exe
  C:\Windows\System\ExTpHQg.exe
  2⤵
  PID:10140
- C:\Windows\System\PwDgrdP.exe
  C:\Windows\System\PwDgrdP.exe
  2⤵
  PID:10168
- C:\Windows\System\kRQxbsL.exe
  C:\Windows\System\kRQxbsL.exe
  2⤵
  PID:10184
- C:\Windows\System\Qcovrmu.exe
  C:\Windows\System\Qcovrmu.exe
  2⤵
  PID:10236
- C:\Windows\System\oUdtAiS.exe
  C:\Windows\System\oUdtAiS.exe
  2⤵
  PID:9248
- C:\Windows\System\Stpcebi.exe
  C:\Windows\System\Stpcebi.exe
  2⤵
  PID:9292
- C:\Windows\System\BqmGUQg.exe
  C:\Windows\System\BqmGUQg.exe
  2⤵
  PID:9356
- C:\Windows\System\NGKycQk.exe
  C:\Windows\System\NGKycQk.exe
  2⤵
  PID:9420
- C:\Windows\System\dzaZZjE.exe
  C:\Windows\System\dzaZZjE.exe
  2⤵
  PID:9440
- C:\Windows\System\HxczNzO.exe
  C:\Windows\System\HxczNzO.exe
  2⤵
  PID:9492
- C:\Windows\System\tYXFNJi.exe
  C:\Windows\System\tYXFNJi.exe
  2⤵
  PID:9532
- C:\Windows\System\MagGsdA.exe
  C:\Windows\System\MagGsdA.exe
  2⤵
  PID:9696
- C:\Windows\System\kROhFhp.exe
  C:\Windows\System\kROhFhp.exe
  2⤵
  PID:9704
- C:\Windows\System\gQJAvJi.exe
  C:\Windows\System\gQJAvJi.exe
  2⤵
  PID:9772
- C:\Windows\System\jISJZXW.exe
  C:\Windows\System\jISJZXW.exe
  2⤵
  PID:9844
- C:\Windows\System\TRtsfGe.exe
  C:\Windows\System\TRtsfGe.exe
  2⤵
  PID:9912
- C:\Windows\System\OCNVZXR.exe
  C:\Windows\System\OCNVZXR.exe
  2⤵
  PID:9976
- C:\Windows\System\fCDncGV.exe
  C:\Windows\System\fCDncGV.exe
  2⤵
  PID:10088
- C:\Windows\System\UKFBYIc.exe
  C:\Windows\System\UKFBYIc.exe
  2⤵
  PID:10160
- C:\Windows\System\wZwGNOZ.exe
  C:\Windows\System\wZwGNOZ.exe
  2⤵
  PID:10228
- C:\Windows\System\dzgbhld.exe
  C:\Windows\System\dzgbhld.exe
  2⤵
  PID:7024
- C:\Windows\System\GxDaKYg.exe
  C:\Windows\System\GxDaKYg.exe
  2⤵
  PID:9288
- C:\Windows\System\LRkASCR.exe
  C:\Windows\System\LRkASCR.exe
  2⤵
  PID:9428
- C:\Windows\System\HEGKBRx.exe
  C:\Windows\System\HEGKBRx.exe
  2⤵
  PID:9576
- C:\Windows\System\EbPeTpK.exe
  C:\Windows\System\EbPeTpK.exe
  2⤵
  PID:9732
- C:\Windows\System\LTsWvDO.exe
  C:\Windows\System\LTsWvDO.exe
  2⤵
  PID:9904
- C:\Windows\System\MRoQISu.exe
  C:\Windows\System\MRoQISu.exe
  2⤵
  PID:10124
- C:\Windows\System\KFDlvNG.exe
  C:\Windows\System\KFDlvNG.exe
  2⤵
  PID:10204
- C:\Windows\System\ZmEyney.exe
  C:\Windows\System\ZmEyney.exe
  2⤵
  PID:9404
- C:\Windows\System\PsmEzKP.exe
  C:\Windows\System\PsmEzKP.exe
  2⤵
  PID:9828
- C:\Windows\System\GwZstFP.exe
  C:\Windows\System\GwZstFP.exe
  2⤵
  PID:9728
- C:\Windows\System\HfsvJMu.exe
  C:\Windows\System\HfsvJMu.exe
  2⤵
  PID:10256
- C:\Windows\System\sBFbGSa.exe
  C:\Windows\System\sBFbGSa.exe
  2⤵
  PID:10280
- C:\Windows\System\eTVKeCL.exe
  C:\Windows\System\eTVKeCL.exe
  2⤵
  PID:10300
- C:\Windows\System\ZbXvmES.exe
  C:\Windows\System\ZbXvmES.exe
  2⤵
  PID:10316
- C:\Windows\System\yNqwzrk.exe
  C:\Windows\System\yNqwzrk.exe
  2⤵
  PID:10336
- C:\Windows\System\kswAXeG.exe
  C:\Windows\System\kswAXeG.exe
  2⤵
  PID:10372
- C:\Windows\System\aUAZvOl.exe
  C:\Windows\System\aUAZvOl.exe
  2⤵
  PID:10396
- C:\Windows\System\wxoUwlB.exe
  C:\Windows\System\wxoUwlB.exe
  2⤵
  PID:10416
- C:\Windows\System\JrRNRni.exe
  C:\Windows\System\JrRNRni.exe
  2⤵
  PID:10468
- C:\Windows\System\EyuIQRP.exe
  C:\Windows\System\EyuIQRP.exe
  2⤵
  PID:10488
- C:\Windows\System\rdwjOLI.exe
  C:\Windows\System\rdwjOLI.exe
  2⤵
  PID:10512
- C:\Windows\System\lmkpfaI.exe
  C:\Windows\System\lmkpfaI.exe
  2⤵
  PID:10540
- C:\Windows\System\VLIeqJV.exe
  C:\Windows\System\VLIeqJV.exe
  2⤵
  PID:10592
- C:\Windows\System\ivEuJRs.exe
  C:\Windows\System\ivEuJRs.exe
  2⤵
  PID:10624
- C:\Windows\System\uRJFziF.exe
  C:\Windows\System\uRJFziF.exe
  2⤵
  PID:10640
- C:\Windows\System\xxkdLsZ.exe
  C:\Windows\System\xxkdLsZ.exe
  2⤵
  PID:10656
- C:\Windows\System\UeFpDNz.exe
  C:\Windows\System\UeFpDNz.exe
  2⤵
  PID:10676
- C:\Windows\System\ATWZlaq.exe
  C:\Windows\System\ATWZlaq.exe
  2⤵
  PID:10704
- C:\Windows\System\vwrUiIX.exe
  C:\Windows\System\vwrUiIX.exe
  2⤵
  PID:10736
- C:\Windows\System\CUCONOR.exe
  C:\Windows\System\CUCONOR.exe
  2⤵
  PID:10756
- C:\Windows\System\bmtUAQk.exe
  C:\Windows\System\bmtUAQk.exe
  2⤵
  PID:10788
- C:\Windows\System\DJAZUEt.exe
  C:\Windows\System\DJAZUEt.exe
  2⤵
  PID:10848
- C:\Windows\System\zPdYTnO.exe
  C:\Windows\System\zPdYTnO.exe
  2⤵
  PID:10864
- C:\Windows\System\kbbNaXf.exe
  C:\Windows\System\kbbNaXf.exe
  2⤵
  PID:10880
- C:\Windows\System\qluTZxQ.exe
  C:\Windows\System\qluTZxQ.exe
  2⤵
  PID:10932
- C:\Windows\System\hxJJnOf.exe
  C:\Windows\System\hxJJnOf.exe
  2⤵
  PID:10948
- C:\Windows\System\TQWyThS.exe
  C:\Windows\System\TQWyThS.exe
  2⤵
  PID:10964
- C:\Windows\System\bFeIDiV.exe
  C:\Windows\System\bFeIDiV.exe
  2⤵
  PID:11000
- C:\Windows\System\SPiizTO.exe
  C:\Windows\System\SPiizTO.exe
  2⤵
  PID:11028
- C:\Windows\System\bWgdciq.exe
  C:\Windows\System\bWgdciq.exe
  2⤵
  PID:11052
- C:\Windows\System\EIOyBXx.exe
  C:\Windows\System\EIOyBXx.exe
  2⤵
  PID:11072
- C:\Windows\System\OyldkwH.exe
  C:\Windows\System\OyldkwH.exe
  2⤵
  PID:11096
- C:\Windows\System\Mbmcgac.exe
  C:\Windows\System\Mbmcgac.exe
  2⤵
  PID:11144
- C:\Windows\System\MSTQOSy.exe
  C:\Windows\System\MSTQOSy.exe
  2⤵
  PID:11172
- C:\Windows\System\SnMhJjb.exe
  C:\Windows\System\SnMhJjb.exe
  2⤵
  PID:11196
- C:\Windows\System\KEnPXMu.exe
  C:\Windows\System\KEnPXMu.exe
  2⤵
  PID:11216
- C:\Windows\System\kUMzHTo.exe
  C:\Windows\System\kUMzHTo.exe
  2⤵
  PID:11232
- C:\Windows\System\fUoAZoW.exe
  C:\Windows\System\fUoAZoW.exe
  2⤵
  PID:10156
- C:\Windows\System\jHHMnUg.exe
  C:\Windows\System\jHHMnUg.exe
  2⤵
  PID:10272
- C:\Windows\System\NvAdubq.exe
  C:\Windows\System\NvAdubq.exe
  2⤵
  PID:10356
- C:\Windows\System\FuDFlkn.exe
  C:\Windows\System\FuDFlkn.exe
  2⤵
  PID:10388
- C:\Windows\System\exqOoPi.exe
  C:\Windows\System\exqOoPi.exe
  2⤵
  PID:10428
- C:\Windows\System\VgYnnKq.exe
  C:\Windows\System\VgYnnKq.exe
  2⤵
  PID:10484
- C:\Windows\System\xdbmlZF.exe
  C:\Windows\System\xdbmlZF.exe
  2⤵
  PID:10608
- C:\Windows\System\CiLtUtl.exe
  C:\Windows\System\CiLtUtl.exe
  2⤵
  PID:10696
- C:\Windows\System\ugtRrLB.exe
  C:\Windows\System\ugtRrLB.exe
  2⤵
  PID:10700
- C:\Windows\System\dGJgpKT.exe
  C:\Windows\System\dGJgpKT.exe
  2⤵
  PID:10748
- C:\Windows\System\gNmtzbb.exe
  C:\Windows\System\gNmtzbb.exe
  2⤵
  PID:10824
- C:\Windows\System\vhhjGXM.exe
  C:\Windows\System\vhhjGXM.exe
  2⤵
  PID:10908
- C:\Windows\System\ldCvERs.exe
  C:\Windows\System\ldCvERs.exe
  2⤵
  PID:10920
- C:\Windows\System\ZdLZSPt.exe
  C:\Windows\System\ZdLZSPt.exe
  2⤵
  PID:10996
- C:\Windows\System\qYqflGN.exe
  C:\Windows\System\qYqflGN.exe
  2⤵
  PID:11048
- C:\Windows\System\cGSQmQi.exe
  C:\Windows\System\cGSQmQi.exe
  2⤵
  PID:11124
- C:\Windows\System\RGCmYwJ.exe
  C:\Windows\System\RGCmYwJ.exe
  2⤵
  PID:11192
- C:\Windows\System\RIkrowt.exe
  C:\Windows\System\RIkrowt.exe
  2⤵
  PID:11244
- C:\Windows\System\MylHaSC.exe
  C:\Windows\System\MylHaSC.exe
  2⤵
  PID:10268
- C:\Windows\System\xtDzJBo.exe
  C:\Windows\System\xtDzJBo.exe
  2⤵
  PID:10364
- C:\Windows\System\vDONYxo.exe
  C:\Windows\System\vDONYxo.exe
  2⤵
  PID:10728
- C:\Windows\System\jyXJEYR.exe
  C:\Windows\System\jyXJEYR.exe
  2⤵
  PID:10892
- C:\Windows\System\tLDdNxM.exe
  C:\Windows\System\tLDdNxM.exe
  2⤵
  PID:10448
- C:\Windows\System\OdkDxHC.exe
  C:\Windows\System\OdkDxHC.exe
  2⤵
  PID:11088
- C:\Windows\System\UbZBeVA.exe
  C:\Windows\System\UbZBeVA.exe
  2⤵
  PID:10412
- C:\Windows\System\cOjPKCF.exe
  C:\Windows\System\cOjPKCF.exe
  2⤵
  PID:10560
- C:\Windows\System\yBNsCnE.exe
  C:\Windows\System\yBNsCnE.exe
  2⤵
  PID:10900
- C:\Windows\System\KeRdoCw.exe
  C:\Windows\System\KeRdoCw.exe
  2⤵
  PID:10652
- C:\Windows\System\UxUWzYg.exe
  C:\Windows\System\UxUWzYg.exe
  2⤵
  PID:11276
- C:\Windows\System\FAnWgfh.exe
  C:\Windows\System\FAnWgfh.exe
  2⤵
  PID:11328
- C:\Windows\System\KvHztaC.exe
  C:\Windows\System\KvHztaC.exe
  2⤵
  PID:11376
- C:\Windows\System\FrDivfV.exe
  C:\Windows\System\FrDivfV.exe
  2⤵
  PID:11400
- C:\Windows\System\QcbEGlz.exe
  C:\Windows\System\QcbEGlz.exe
  2⤵
  PID:11424
- C:\Windows\System\IVeJGrc.exe
  C:\Windows\System\IVeJGrc.exe
  2⤵
  PID:11456
- C:\Windows\System\ZDybExQ.exe
  C:\Windows\System\ZDybExQ.exe
  2⤵
  PID:11500
- C:\Windows\System\bkURKor.exe
  C:\Windows\System\bkURKor.exe
  2⤵
  PID:11520
- C:\Windows\System\XSOzWfD.exe
  C:\Windows\System\XSOzWfD.exe
  2⤵
  PID:11552
- C:\Windows\System\xwwPTPo.exe
  C:\Windows\System\xwwPTPo.exe
  2⤵
  PID:11572
- C:\Windows\System\JqTmQJb.exe
  C:\Windows\System\JqTmQJb.exe
  2⤵
  PID:11616
- C:\Windows\System\NMTuceL.exe
  C:\Windows\System\NMTuceL.exe
  2⤵
  PID:11632
- C:\Windows\System\kYtsMWT.exe
  C:\Windows\System\kYtsMWT.exe
  2⤵
  PID:11672
- C:\Windows\System\FgCbcub.exe
  C:\Windows\System\FgCbcub.exe
  2⤵
  PID:11692
- C:\Windows\System\mUycdLI.exe
  C:\Windows\System\mUycdLI.exe
  2⤵
  PID:11712
- C:\Windows\System\gaMUoqs.exe
  C:\Windows\System\gaMUoqs.exe
  2⤵
  PID:11736
- C:\Windows\System\odmPaMJ.exe
  C:\Windows\System\odmPaMJ.exe
  2⤵
  PID:11756
- C:\Windows\System\QBakjDO.exe
  C:\Windows\System\QBakjDO.exe
  2⤵
  PID:11784
- C:\Windows\System\vnkpxGb.exe
  C:\Windows\System\vnkpxGb.exe
  2⤵
  PID:11836
- C:\Windows\System\DxNwFZD.exe
  C:\Windows\System\DxNwFZD.exe
  2⤵
  PID:11860
- C:\Windows\System\IAiANJS.exe
  C:\Windows\System\IAiANJS.exe
  2⤵
  PID:11888
- C:\Windows\System\zMcdHrL.exe
  C:\Windows\System\zMcdHrL.exe
  2⤵
  PID:11936
- C:\Windows\System\bwTsIMO.exe
  C:\Windows\System\bwTsIMO.exe
  2⤵
  PID:11976
- C:\Windows\System\CcIRMCd.exe
  C:\Windows\System\CcIRMCd.exe
  2⤵
  PID:12004
- C:\Windows\System\ylRykcL.exe
  C:\Windows\System\ylRykcL.exe
  2⤵
  PID:12036
- C:\Windows\System\nStaOvu.exe
  C:\Windows\System\nStaOvu.exe
  2⤵
  PID:12052
- C:\Windows\System\FCztSYr.exe
  C:\Windows\System\FCztSYr.exe
  2⤵
  PID:12072
- C:\Windows\System\AXDtTtT.exe
  C:\Windows\System\AXDtTtT.exe
  2⤵
  PID:12100
- C:\Windows\System\hcOuIAk.exe
  C:\Windows\System\hcOuIAk.exe
  2⤵
  PID:12124
- C:\Windows\System\TKgXjdm.exe
  C:\Windows\System\TKgXjdm.exe
  2⤵
  PID:12140
- C:\Windows\System\hlTUdlC.exe
  C:\Windows\System\hlTUdlC.exe
  2⤵
  PID:12168
- C:\Windows\System\zxZZcMa.exe
  C:\Windows\System\zxZZcMa.exe
  2⤵
  PID:12224
- C:\Windows\System\REhjFHo.exe
  C:\Windows\System\REhjFHo.exe
  2⤵
  PID:12244
- C:\Windows\System\nickILB.exe
  C:\Windows\System\nickILB.exe
  2⤵
  PID:12264
- C:\Windows\System\tsoVaZA.exe
  C:\Windows\System\tsoVaZA.exe
  2⤵
  PID:10292
- C:\Windows\System\GrErTfE.exe
  C:\Windows\System\GrErTfE.exe
  2⤵
  PID:11060
- C:\Windows\System\FcDMyNg.exe
  C:\Windows\System\FcDMyNg.exe
  2⤵
  PID:11140
- C:\Windows\System\WMDwnxr.exe
  C:\Windows\System\WMDwnxr.exe
  2⤵
  PID:11416
- C:\Windows\System\fZlxAkN.exe
  C:\Windows\System\fZlxAkN.exe
  2⤵
  PID:11496
- C:\Windows\System\mwvSxQF.exe
  C:\Windows\System\mwvSxQF.exe
  2⤵
  PID:11508
- C:\Windows\System\HxfOlUo.exe
  C:\Windows\System\HxfOlUo.exe
  2⤵
  PID:11592
- C:\Windows\System\tLbobTv.exe
  C:\Windows\System\tLbobTv.exe
  2⤵
  PID:11688
- C:\Windows\System\NcQKcEz.exe
  C:\Windows\System\NcQKcEz.exe
  2⤵
  PID:11772
- C:\Windows\System\bbVlMTI.exe
  C:\Windows\System\bbVlMTI.exe
  2⤵
  PID:11832
- C:\Windows\System\LTAfyHv.exe
  C:\Windows\System\LTAfyHv.exe
  2⤵
  PID:11872
- C:\Windows\System\SaCHdwb.exe
  C:\Windows\System\SaCHdwb.exe
  2⤵
  PID:4800
- C:\Windows\System\EKhKJkJ.exe
  C:\Windows\System\EKhKJkJ.exe
  2⤵
  PID:11984
- C:\Windows\System\jQrOsdx.exe
  C:\Windows\System\jQrOsdx.exe
  2⤵
  PID:12080
- C:\Windows\System\BLUhuAX.exe
  C:\Windows\System\BLUhuAX.exe
  2⤵
  PID:12060
- C:\Windows\System\JAQTTxz.exe
  C:\Windows\System\JAQTTxz.exe
  2⤵
  PID:12212
- C:\Windows\System\NIMEMBV.exe
  C:\Windows\System\NIMEMBV.exe
  2⤵
  PID:10352
- C:\Windows\System\IrfPDfU.exe
  C:\Windows\System\IrfPDfU.exe
  2⤵
  PID:11020
- C:\Windows\System\kpUpASO.exe
  C:\Windows\System\kpUpASO.exe
  2⤵
  PID:11368
- C:\Windows\System\wpCPhwn.exe
  C:\Windows\System\wpCPhwn.exe
  2⤵
  PID:11624
- C:\Windows\System\QqOCGNB.exe
  C:\Windows\System\QqOCGNB.exe
  2⤵
  PID:11664
- C:\Windows\System\bpGifJq.exe
  C:\Windows\System\bpGifJq.exe
  2⤵
  PID:11924
- C:\Windows\System\blqTUWi.exe
  C:\Windows\System\blqTUWi.exe
  2⤵
  PID:12020
- C:\Windows\System\kYhNufx.exe
  C:\Windows\System\kYhNufx.exe
  2⤵
  PID:12260
- C:\Windows\System\bSnqigq.exe
  C:\Windows\System\bSnqigq.exe
  2⤵
  PID:11388
- C:\Windows\System\kBCTAjk.exe
  C:\Windows\System\kBCTAjk.exe
  2⤵
  PID:11568
- C:\Windows\System\lfZAWSV.exe
  C:\Windows\System\lfZAWSV.exe
  2⤵
  PID:12164
- C:\Windows\System\pxeqnRb.exe
  C:\Windows\System\pxeqnRb.exe
  2⤵
  PID:12256
- C:\Windows\System\papCkPi.exe
  C:\Windows\System\papCkPi.exe
  2⤵
  PID:12092
- C:\Windows\System\hPryOdi.exe
  C:\Windows\System\hPryOdi.exe
  2⤵
  PID:12308
- C:\Windows\System\RjQgvNi.exe
  C:\Windows\System\RjQgvNi.exe
  2⤵
  PID:12340
- C:\Windows\System\Ztevfia.exe
  C:\Windows\System\Ztevfia.exe
  2⤵
  PID:12360
- C:\Windows\System\nMxFTQa.exe
  C:\Windows\System\nMxFTQa.exe
  2⤵
  PID:12400
- C:\Windows\System\fwdNrlI.exe
  C:\Windows\System\fwdNrlI.exe
  2⤵
  PID:12428
- C:\Windows\System\jQiZCDS.exe
  C:\Windows\System\jQiZCDS.exe
  2⤵
  PID:12480
- C:\Windows\System\KIsYqMS.exe
  C:\Windows\System\KIsYqMS.exe
  2⤵
  PID:12508
- C:\Windows\System\FFPgJfQ.exe
  C:\Windows\System\FFPgJfQ.exe
  2⤵
  PID:12528
- C:\Windows\System\aEwtFaL.exe
  C:\Windows\System\aEwtFaL.exe
  2⤵
  PID:12548
- C:\Windows\System\fPIVrVa.exe
  C:\Windows\System\fPIVrVa.exe
  2⤵
  PID:12568
- C:\Windows\System\jXXoReK.exe
  C:\Windows\System\jXXoReK.exe
  2⤵
  PID:12608
- C:\Windows\System\agvxpJa.exe
  C:\Windows\System\agvxpJa.exe
  2⤵
  PID:12668
- C:\Windows\System\LNpjuJW.exe
  C:\Windows\System\LNpjuJW.exe
  2⤵
  PID:12688
- C:\Windows\System\kIBwnZP.exe
  C:\Windows\System\kIBwnZP.exe
  2⤵
  PID:12732
- C:\Windows\System\sBEPEuV.exe
  C:\Windows\System\sBEPEuV.exe
  2⤵
  PID:12776
- C:\Windows\System\FnYkHrl.exe
  C:\Windows\System\FnYkHrl.exe
  2⤵
  PID:12796
- C:\Windows\System\UTZyXEp.exe
  C:\Windows\System\UTZyXEp.exe
  2⤵
  PID:12824
- C:\Windows\System\EyTsRzU.exe
  C:\Windows\System\EyTsRzU.exe
  2⤵
  PID:12848
- C:\Windows\System\bqISFpj.exe
  C:\Windows\System\bqISFpj.exe
  2⤵
  PID:12868
- C:\Windows\System\gMzIcSl.exe
  C:\Windows\System\gMzIcSl.exe
  2⤵
  PID:12904
- C:\Windows\System\eAhtncc.exe
  C:\Windows\System\eAhtncc.exe
  2⤵
  PID:12924
- C:\Windows\System\tXMQPAA.exe
  C:\Windows\System\tXMQPAA.exe
  2⤵
  PID:12952
- C:\Windows\System\ylWFRDk.exe
  C:\Windows\System\ylWFRDk.exe
  2⤵
  PID:13000
- C:\Windows\System\AZoEHIh.exe
  C:\Windows\System\AZoEHIh.exe
  2⤵
  PID:13028
- C:\Windows\System\bAUWakB.exe
  C:\Windows\System\bAUWakB.exe
  2⤵
  PID:13044
- C:\Windows\System\kAOWDWP.exe
  C:\Windows\System\kAOWDWP.exe
  2⤵
  PID:13072
- C:\Windows\System\uMreufP.exe
  C:\Windows\System\uMreufP.exe
  2⤵
  PID:13092
- C:\Windows\System\bkKFsDU.exe
  C:\Windows\System\bkKFsDU.exe
  2⤵
  PID:13120
- C:\Windows\System\PzEJkyq.exe
  C:\Windows\System\PzEJkyq.exe
  2⤵
  PID:13160
- C:\Windows\System\Jfgkozz.exe
  C:\Windows\System\Jfgkozz.exe
  2⤵
  PID:13176
- C:\Windows\System\fXcwbTp.exe
  C:\Windows\System\fXcwbTp.exe
  2⤵
  PID:13200
- C:\Windows\System\vQgNzdo.exe
  C:\Windows\System\vQgNzdo.exe
  2⤵
  PID:13236
- C:\Windows\System\vtOmbHk.exe
  C:\Windows\System\vtOmbHk.exe
  2⤵
  PID:13264
- C:\Windows\System\CBlZyBG.exe
  C:\Windows\System\CBlZyBG.exe
  2⤵
  PID:13284
- C:\Windows\System\XRgrzFw.exe
  C:\Windows\System\XRgrzFw.exe
  2⤵
  PID:12296
- C:\Windows\System\ojXBwBR.exe
  C:\Windows\System\ojXBwBR.exe
  2⤵
  PID:12376
- C:\Windows\System\wSDtfgZ.exe
  C:\Windows\System\wSDtfgZ.exe
  2⤵
  PID:12460
- C:\Windows\System\RMxaEPc.exe
  C:\Windows\System\RMxaEPc.exe
  2⤵
  PID:12416
- C:\Windows\System\dHZqZLN.exe
  C:\Windows\System\dHZqZLN.exe
  2⤵
  PID:12476
- C:\Windows\System\sLyKHnG.exe
  C:\Windows\System\sLyKHnG.exe
  2⤵
  PID:12516
- C:\Windows\System\TEzjHQb.exe
  C:\Windows\System\TEzjHQb.exe
  2⤵
  PID:12604
- C:\Windows\System\BsmadMx.exe
  C:\Windows\System\BsmadMx.exe
  2⤵
  PID:12684
- C:\Windows\System\HvfFfDh.exe
  C:\Windows\System\HvfFfDh.exe
  2⤵
  PID:12812
- C:\Windows\System\aJrZGNm.exe
  C:\Windows\System\aJrZGNm.exe
  2⤵
  PID:12884
- C:\Windows\System\HZTPdUQ.exe
  C:\Windows\System\HZTPdUQ.exe
  2⤵
  PID:12920
- C:\Windows\System\aBaRJlr.exe
  C:\Windows\System\aBaRJlr.exe
  2⤵
  PID:13080
- C:\Windows\System\IoRVUqf.exe
  C:\Windows\System\IoRVUqf.exe
  2⤵
  PID:13152
- C:\Windows\System\rftdQso.exe
  C:\Windows\System\rftdQso.exe
  2⤵
  PID:13188
- C:\Windows\System\AUuIlrx.exe
  C:\Windows\System\AUuIlrx.exe
  2⤵
  PID:13272
- C:\Windows\System\leIBHml.exe
  C:\Windows\System\leIBHml.exe
  2⤵
  PID:13280
- C:\Windows\System\HorfNOT.exe
  C:\Windows\System\HorfNOT.exe
  2⤵
  PID:12348
- C:\Windows\System\kWRoebk.exe
  C:\Windows\System\kWRoebk.exe
  2⤵
  PID:12504
- C:\Windows\System\CdtHJtI.exe
  C:\Windows\System\CdtHJtI.exe
  2⤵
  PID:12664
- C:\Windows\System\KwBOUiB.exe
  C:\Windows\System\KwBOUiB.exe
  2⤵
  PID:12912
- C:\Windows\System\FMGmFgI.exe
  C:\Windows\System\FMGmFgI.exe
  2⤵
  PID:12968
- C:\Windows\System\znGiQBa.exe
  C:\Windows\System\znGiQBa.exe
  2⤵
  PID:13168
- C:\Windows\System\GbWFoFE.exe
  C:\Windows\System\GbWFoFE.exe
  2⤵
  PID:12328
- C:\Windows\System\jhRBvCv.exe
  C:\Windows\System\jhRBvCv.exe
  2⤵
  PID:12876
- C:\Windows\System\dSbmEsz.exe
  C:\Windows\System\dSbmEsz.exe
  2⤵
  PID:12320
- C:\Windows\System\JgMyVLn.exe
  C:\Windows\System\JgMyVLn.exe
  2⤵
  PID:13216
- C:\Windows\System\NxTcvwg.exe
  C:\Windows\System\NxTcvwg.exe
  2⤵
  PID:13340
- C:\Windows\System\lUJNCBn.exe
  C:\Windows\System\lUJNCBn.exe
  2⤵
  PID:13356
- C:\Windows\System\HvbkPpp.exe
  C:\Windows\System\HvbkPpp.exe
  2⤵
  PID:13376
- C:\Windows\System\qjwJupm.exe
  C:\Windows\System\qjwJupm.exe
  2⤵
  PID:13396
- C:\Windows\System\xCzCWPY.exe
  C:\Windows\System\xCzCWPY.exe
  2⤵
  PID:13424
- C:\Windows\System\nTzVJHs.exe
  C:\Windows\System\nTzVJHs.exe
  2⤵
  PID:13460
- C:\Windows\System\xOXFXTY.exe
  C:\Windows\System\xOXFXTY.exe
  2⤵
  PID:13484
- C:\Windows\System\QAFnIvK.exe
  C:\Windows\System\QAFnIvK.exe
  2⤵
  PID:13504
- C:\Windows\System\kqCVsOU.exe
  C:\Windows\System\kqCVsOU.exe
  2⤵
  PID:13564
- C:\Windows\System\twwbqei.exe
  C:\Windows\System\twwbqei.exe
  2⤵
  PID:13588
- C:\Windows\System\ZeBmeJg.exe
  C:\Windows\System\ZeBmeJg.exe
  2⤵
  PID:13608
- C:\Windows\System\jPUqrfi.exe
  C:\Windows\System\jPUqrfi.exe
  2⤵
  PID:13628
- C:\Windows\System\VtlTHkW.exe
  C:\Windows\System\VtlTHkW.exe
  2⤵
  PID:13680
- C:\Windows\System\DDcKfwl.exe
  C:\Windows\System\DDcKfwl.exe
  2⤵
  PID:13708
- C:\Windows\System\XzuXPDV.exe
  C:\Windows\System\XzuXPDV.exe
  2⤵
  PID:13728
- C:\Windows\System\ntlwXCo.exe
  C:\Windows\System\ntlwXCo.exe
  2⤵
  PID:13748
- C:\Windows\System\zuTxafg.exe
  C:\Windows\System\zuTxafg.exe
  2⤵
  PID:13768
- C:\Windows\System\iNNtSbO.exe
  C:\Windows\System\iNNtSbO.exe
  2⤵
  PID:13824
- C:\Windows\System\FssruCz.exe
  C:\Windows\System\FssruCz.exe
  2⤵
  PID:13840
- C:\Windows\System\bOttbGb.exe
  C:\Windows\System\bOttbGb.exe
  2⤵
  PID:13880
- C:\Windows\System\mXvDxpq.exe
  C:\Windows\System\mXvDxpq.exe
  2⤵
  PID:13908
- C:\Windows\System\poCYTmT.exe
  C:\Windows\System\poCYTmT.exe
  2⤵
  PID:13924
- C:\Windows\System\VIqYAVh.exe
  C:\Windows\System\VIqYAVh.exe
  2⤵
  PID:13940
- C:\Windows\System\xUslefy.exe
  C:\Windows\System\xUslefy.exe
  2⤵
  PID:13964
- C:\Windows\System\jwIIxsb.exe
  C:\Windows\System\jwIIxsb.exe
  2⤵
  PID:13996
- C:\Windows\System\MyJCqRk.exe
  C:\Windows\System\MyJCqRk.exe
  2⤵
  PID:14012
- C:\Windows\System\zrcTCfZ.exe
  C:\Windows\System\zrcTCfZ.exe
  2⤵
  PID:14040
- C:\Windows\System\smbpnyX.exe
  C:\Windows\System\smbpnyX.exe
  2⤵
  PID:14072
- C:\Windows\System\NTRGCCc.exe
  C:\Windows\System\NTRGCCc.exe
  2⤵
  PID:14108
- C:\Windows\System\btmlFxe.exe
  C:\Windows\System\btmlFxe.exe
  2⤵
  PID:14152
- C:\Windows\System\QrhULOC.exe
  C:\Windows\System\QrhULOC.exe
  2⤵
  PID:14176
- C:\Windows\System\xBSxVvV.exe
  C:\Windows\System\xBSxVvV.exe
  2⤵
  PID:14192
- C:\Windows\System\qvNexJH.exe
  C:\Windows\System\qvNexJH.exe
  2⤵
  PID:14216
- C:\Windows\System\IemvVhM.exe
  C:\Windows\System\IemvVhM.exe
  2⤵
  PID:14236
- C:\Windows\System\PWGrKBx.exe
  C:\Windows\System\PWGrKBx.exe
  2⤵
  PID:14276
- C:\Windows\System\ULpKBKy.exe
  C:\Windows\System\ULpKBKy.exe
  2⤵
  PID:14300
- C:\Windows\System\fHpCFyp.exe
  C:\Windows\System\fHpCFyp.exe
  2⤵
  PID:13224
- C:\Windows\System\QxSCxnb.exe
  C:\Windows\System\QxSCxnb.exe
  2⤵
  PID:13336
- C:\Windows\System\SkskLlZ.exe
  C:\Windows\System\SkskLlZ.exe
  2⤵
  PID:13368
- C:\Windows\System\UAzsIJz.exe
  C:\Windows\System\UAzsIJz.exe
  2⤵
  PID:13480
- C:\Windows\System\YaGvhbU.exe
  C:\Windows\System\YaGvhbU.exe
  2⤵
  PID:13532
- C:\Windows\System\DUrgvTh.exe
  C:\Windows\System\DUrgvTh.exe
  2⤵
  PID:13624
- C:\Windows\System\QPooiAK.exe
  C:\Windows\System\QPooiAK.exe
  2⤵
  PID:13672
- C:\Windows\System\TVLEbEp.exe
  C:\Windows\System\TVLEbEp.exe
  2⤵
  PID:13704
- C:\Windows\System\UiecdXB.exe
  C:\Windows\System\UiecdXB.exe
  2⤵
  PID:13784
- C:\Windows\System\sMzoUBO.exe
  C:\Windows\System\sMzoUBO.exe
  2⤵
  PID:13860
- C:\Windows\System\JuWknlK.exe
  C:\Windows\System\JuWknlK.exe
  2⤵
  PID:13896
- C:\Windows\System\wMUrSZI.exe
  C:\Windows\System\wMUrSZI.exe
  2⤵
  PID:13108
- C:\Windows\System\xylazyu.exe
  C:\Windows\System\xylazyu.exe
  2⤵
  PID:14068
- C:\Windows\System\UEfpRCI.exe
  C:\Windows\System\UEfpRCI.exe
  2⤵
  PID:14132
- C:\Windows\System\CxmCGYC.exe
  C:\Windows\System\CxmCGYC.exe
  2⤵
  PID:14168
- C:\Windows\System\kkkQMKe.exe
  C:\Windows\System\kkkQMKe.exe
  2⤵
  PID:14228
- C:\Windows\System\BnnUQcm.exe
  C:\Windows\System\BnnUQcm.exe
  2⤵
  PID:13328
- C:\Windows\System\agyZuhE.exe
  C:\Windows\System\agyZuhE.exe
  2⤵
  PID:13404
- C:\Windows\System\xfHYEdc.exe
  C:\Windows\System\xfHYEdc.exe
  2⤵
  PID:13528
- C:\Windows\System\kiynjlX.exe
  C:\Windows\System\kiynjlX.exe
  2⤵
  PID:13596
- C:\Windows\System\GKeMfhV.exe
  C:\Windows\System\GKeMfhV.exe
  2⤵
  PID:13832
- C:\Windows\System\fjicVMd.exe
  C:\Windows\System\fjicVMd.exe
  2⤵
  PID:13956
- C:\Windows\System\ZlMpQYA.exe
  C:\Windows\System\ZlMpQYA.exe
  2⤵
  PID:14264
- C:\Windows\System\ocZwmEg.exe
  C:\Windows\System\ocZwmEg.exe
  2⤵
  PID:14332
- C:\Windows\System\qiwLYpi.exe
  C:\Windows\System\qiwLYpi.exe
  2⤵
  PID:13548
- C:\Windows\System\cHVpojc.exe
  C:\Windows\System\cHVpojc.exe
  2⤵
  PID:13812
- C:\Windows\System\Etdcvcj.exe
  C:\Windows\System\Etdcvcj.exe
  2⤵
  PID:13932
- C:\Windows\System\UMflfmM.exe
  C:\Windows\System\UMflfmM.exe
  2⤵
  PID:13472
- C:\Windows\System\RBHZzNt.exe
  C:\Windows\System\RBHZzNt.exe
  2⤵
  PID:13876
- C:\Windows\System\AxorkOS.exe
  C:\Windows\System\AxorkOS.exe
  2⤵
  PID:14368
- C:\Windows\System\WLlhFhe.exe
  C:\Windows\System\WLlhFhe.exe
  2⤵
  PID:14412
- C:\Windows\System\lJnRtms.exe
  C:\Windows\System\lJnRtms.exe
  2⤵
  PID:14440
- C:\Windows\System\ukkOlOJ.exe
  C:\Windows\System\ukkOlOJ.exe
  2⤵
  PID:14460
- C:\Windows\System\tpbyqNZ.exe
  C:\Windows\System\tpbyqNZ.exe
  2⤵
  PID:14480
- C:\Windows\System\XfJEHjf.exe
  C:\Windows\System\XfJEHjf.exe
  2⤵
  PID:14504
- C:\Windows\System\zKyQLZx.exe
  C:\Windows\System\zKyQLZx.exe
  2⤵
  PID:14560
- C:\Windows\System\LnPHqtW.exe
  C:\Windows\System\LnPHqtW.exe
  2⤵
  PID:14588
- C:\Windows\System\lQiyPTU.exe
  C:\Windows\System\lQiyPTU.exe
  2⤵
  PID:14604
- C:\Windows\System\pKbXIbp.exe
  C:\Windows\System\pKbXIbp.exe
  2⤵
  PID:14636
- C:\Windows\System\gRMxRGa.exe
  C:\Windows\System\gRMxRGa.exe
  2⤵
  PID:14660
- C:\Windows\System\dgRxcym.exe
  C:\Windows\System\dgRxcym.exe
  2⤵
  PID:14688
- C:\Windows\System\cQqqFuk.exe
  C:\Windows\System\cQqqFuk.exe
  2⤵
  PID:14724
- C:\Windows\System\paByehL.exe
  C:\Windows\System\paByehL.exe
  2⤵
  PID:14740
- C:\Windows\System\JfBRdOK.exe
  C:\Windows\System\JfBRdOK.exe
  2⤵
  PID:14772
- C:\Windows\System\Dogseym.exe
  C:\Windows\System\Dogseym.exe
  2⤵
  PID:14788
- C:\Windows\System\rqFTfWW.exe
  C:\Windows\System\rqFTfWW.exe
  2⤵
  PID:14820
- C:\Windows\System\pyKWUCM.exe
  C:\Windows\System\pyKWUCM.exe
  2⤵
  PID:14860
- C:\Windows\System\fRpHjjD.exe
  C:\Windows\System\fRpHjjD.exe
  2⤵
  PID:14884
- C:\Windows\System\ftOXiDa.exe
  C:\Windows\System\ftOXiDa.exe
  2⤵
  PID:14900
- C:\Windows\System\WpmcoRx.exe
  C:\Windows\System\WpmcoRx.exe
  2⤵
  PID:14956
- C:\Windows\System\exbbXKe.exe
  C:\Windows\System\exbbXKe.exe
  2⤵
  PID:14972
- C:\Windows\System\wBTOarb.exe
  C:\Windows\System\wBTOarb.exe
  2⤵
  PID:14992
- C:\Windows\System\DvGnwUb.exe
  C:\Windows\System\DvGnwUb.exe
  2⤵
  PID:15012
- C:\Windows\System\GmxoZQd.exe
  C:\Windows\System\GmxoZQd.exe
  2⤵
  PID:15036
- C:\Windows\System\MXRZuEh.exe
  C:\Windows\System\MXRZuEh.exe
  2⤵
  PID:15060
- C:\Windows\System\CrLjnZe.exe
  C:\Windows\System\CrLjnZe.exe
  2⤵
  PID:15076
- C:\Windows\System\bQDOSkQ.exe
  C:\Windows\System\bQDOSkQ.exe
  2⤵
  PID:15100
- C:\Windows\System\aBDnGDJ.exe
  C:\Windows\System\aBDnGDJ.exe
  2⤵
  PID:15120
- C:\Windows\System\cdXXsiG.exe
  C:\Windows\System\cdXXsiG.exe
  2⤵
  PID:15184
- C:\Windows\System\YIEbkSS.exe
  C:\Windows\System\YIEbkSS.exe
  2⤵
  PID:15212
- C:\Windows\System\fvZVMeV.exe
  C:\Windows\System\fvZVMeV.exe
  2⤵
  PID:15236
- C:\Windows\System\KZsQqZi.exe
  C:\Windows\System\KZsQqZi.exe
  2⤵
  PID:15284
- C:\Windows\System\EqtWUHo.exe
  C:\Windows\System\EqtWUHo.exe
  2⤵
  PID:15304
- C:\Windows\System\HHWBMRX.exe
  C:\Windows\System\HHWBMRX.exe
  2⤵
  PID:15324
- C:\Windows\System\cMhVxwG.exe
  C:\Windows\System\cMhVxwG.exe
  2⤵
  PID:14360
- C:\Windows\System\KWhSsdo.exe
  C:\Windows\System\KWhSsdo.exe
  2⤵
  PID:14384
- C:\Windows\System\rIfKbTX.exe
  C:\Windows\System\rIfKbTX.exe
  2⤵
  PID:14476
- C:\Windows\System\sqVrSGP.exe
  C:\Windows\System\sqVrSGP.exe
  2⤵
  PID:14528
- C:\Windows\System\SZdPbhJ.exe
  C:\Windows\System\SZdPbhJ.exe
  2⤵
  PID:14580
- C:\Windows\System\dINgOKU.exe
  C:\Windows\System\dINgOKU.exe
  2⤵
  PID:14628
- C:\Windows\System\ZmZtFJY.exe
  C:\Windows\System\ZmZtFJY.exe
  2⤵
  PID:14704
- C:\Windows\System\VnzTQAJ.exe
  C:\Windows\System\VnzTQAJ.exe
  2⤵
  PID:14760
- C:\Windows\System\vPqPMsK.exe
  C:\Windows\System\vPqPMsK.exe
  2⤵
  PID:14840
- C:\Windows\System\nfBuVhH.exe
  C:\Windows\System\nfBuVhH.exe
  2⤵
  PID:14892
- C:\Windows\System\RmoQsBk.exe
  C:\Windows\System\RmoQsBk.exe
  2⤵
  PID:14944
- C:\Windows\System\yJfEUBV.exe
  C:\Windows\System\yJfEUBV.exe
  2⤵
  PID:15000
- C:\Windows\System\prWBZLd.exe
  C:\Windows\System\prWBZLd.exe
  2⤵
  PID:15056
- C:\Windows\System\EvJhiYH.exe
  C:\Windows\System\EvJhiYH.exe
  2⤵
  PID:15136
- C:\Windows\System\xjUuPKp.exe
  C:\Windows\System\xjUuPKp.exe
  2⤵
  PID:15176
- C:\Windows\System\chiBodt.exe
  C:\Windows\System\chiBodt.exe
  2⤵
  PID:15224
- C:\Windows\System\gcFgOea.exe
  C:\Windows\System\gcFgOea.exe
  2⤵
  PID:15268
- C:\Windows\System\wAhMEop.exe
  C:\Windows\System\wAhMEop.exe
  2⤵
  PID:15264
- C:\Windows\System\peCWUqf.exe
  C:\Windows\System\peCWUqf.exe
  2⤵
  PID:14136
- C:\Windows\System\tcWmikO.exe
  C:\Windows\System\tcWmikO.exe
  2⤵
  PID:14452
- C:\Windows\System\mYWerLg.exe
  C:\Windows\System\mYWerLg.exe
  2⤵
  PID:14496
- C:\Windows\System\OmTvuAg.exe
  C:\Windows\System\OmTvuAg.exe
  2⤵
  PID:14780
- C:\Windows\System\LBXOZpU.exe
  C:\Windows\System\LBXOZpU.exe
  2⤵
  PID:14756
- C:\Windows\System\AtxeUVE.exe
  C:\Windows\System\AtxeUVE.exe
  2⤵
  PID:14920
- C:\Windows\System\zsXoHJT.exe
  C:\Windows\System\zsXoHJT.exe
  2⤵
  PID:15156
- C:\Windows\System\lPfdQnQ.exe
  C:\Windows\System\lPfdQnQ.exe
  2⤵
  PID:15172
- C:\Windows\System\xIOPKdo.exe
  C:\Windows\System\xIOPKdo.exe
  2⤵
  PID:15344
- C:\Windows\System\DusrvuI.exe
  C:\Windows\System\DusrvuI.exe
  2⤵
  PID:15316
- C:\Windows\System\vqTwvzk.exe
  C:\Windows\System\vqTwvzk.exe
  2⤵
  PID:15364
- C:\Windows\System\peEqhRb.exe
  C:\Windows\System\peEqhRb.exe
  2⤵
  PID:15388
- C:\Windows\System\ZlJlvWv.exe
  C:\Windows\System\ZlJlvWv.exe
  2⤵
  PID:15408
- C:\Windows\System\kGdOQAn.exe
  C:\Windows\System\kGdOQAn.exe
  2⤵
  PID:15424
- C:\Windows\System\nPPZmxm.exe
  C:\Windows\System\nPPZmxm.exe
  2⤵
  PID:15448
- C:\Windows\System\gCkqaua.exe
  C:\Windows\System\gCkqaua.exe
  2⤵
  PID:15468
- C:\Windows\System\olOQbUV.exe
  C:\Windows\System\olOQbUV.exe
  2⤵
  PID:15492
- C:\Windows\System\RqdpVAb.exe
  C:\Windows\System\RqdpVAb.exe
  2⤵
  PID:15512
- C:\Windows\System\phnBQZt.exe
  C:\Windows\System\phnBQZt.exe
  2⤵
  PID:15540
- C:\Windows\System\sJHKhvs.exe
  C:\Windows\System\sJHKhvs.exe
  2⤵
  PID:15556
- C:\Windows\System\WoPAVMi.exe
  C:\Windows\System\WoPAVMi.exe
  2⤵
  PID:15572
- C:\Windows\System\fPlcDmb.exe
  C:\Windows\System\fPlcDmb.exe
  2⤵
  PID:15588
- C:\Windows\System\qCaCvkF.exe
  C:\Windows\System\qCaCvkF.exe
  2⤵
  PID:15612
- C:\Windows\System\xwFpNNi.exe
  C:\Windows\System\xwFpNNi.exe
  2⤵
  PID:15632
- C:\Windows\System\HmzDiSR.exe
  C:\Windows\System\HmzDiSR.exe
  2⤵
  PID:15652
- C:\Windows\System\gjqaRqD.exe
  C:\Windows\System\gjqaRqD.exe
  2⤵
  PID:15668
- C:\Windows\System\pVhBWkL.exe
  C:\Windows\System\pVhBWkL.exe
  2⤵
  PID:15692
- C:\Windows\System\DrwOEID.exe
  C:\Windows\System\DrwOEID.exe
  2⤵
  PID:15712
- C:\Windows\System\DRdsXqB.exe
  C:\Windows\System\DRdsXqB.exe
  2⤵
  PID:15744
- C:\Windows\System\edmvfmp.exe
  C:\Windows\System\edmvfmp.exe
  2⤵
  PID:15764
- C:\Windows\System\KpcHFNV.exe
  C:\Windows\System\KpcHFNV.exe
  2⤵
  PID:15796
- C:\Windows\System\UAkaLLC.exe
  C:\Windows\System\UAkaLLC.exe
  2⤵
  PID:15820
- C:\Windows\System\ZvwcPOL.exe
  C:\Windows\System\ZvwcPOL.exe
  2⤵
  PID:15840
- C:\Windows\System\LUDuQEc.exe
  C:\Windows\System\LUDuQEc.exe
  2⤵
  PID:15868
- C:\Windows\System\KnVcTNY.exe
  C:\Windows\System\KnVcTNY.exe
  2⤵
  PID:15888
- C:\Windows\System\mhmERJY.exe
  C:\Windows\System\mhmERJY.exe
  2⤵
  PID:15916
- C:\Windows\System\iCvWkYt.exe
  C:\Windows\System\iCvWkYt.exe
  2⤵
  PID:15940
- C:\Windows\System\nkmOULS.exe
  C:\Windows\System\nkmOULS.exe
  2⤵
  PID:15968
- C:\Windows\System\STMxjWz.exe
  C:\Windows\System\STMxjWz.exe
  2⤵
  PID:15984
- C:\Windows\System\KepIdeT.exe
  C:\Windows\System\KepIdeT.exe
  2⤵
  PID:16008
- C:\Windows\System\vIovVgw.exe
  C:\Windows\System\vIovVgw.exe
  2⤵
  PID:16032
- C:\Windows\System\klYNRNO.exe
  C:\Windows\System\klYNRNO.exe
  2⤵
  PID:16064
- C:\Windows\System\CwBMKSk.exe
  C:\Windows\System\CwBMKSk.exe
  2⤵
  PID:16080
- C:\Windows\System\PEVdsgS.exe
  C:\Windows\System\PEVdsgS.exe
  2⤵
  PID:16096
- C:\Windows\System\NBpHZJT.exe
  C:\Windows\System\NBpHZJT.exe
  2⤵
  PID:16112
- C:\Windows\System\NCuYIXx.exe
  C:\Windows\System\NCuYIXx.exe
  2⤵
  PID:16132
- C:\Windows\System\KCKUgnD.exe
  C:\Windows\System\KCKUgnD.exe
  2⤵
  PID:16148
- C:\Windows\System\htJBkqV.exe
  C:\Windows\System\htJBkqV.exe
  2⤵
  PID:16172
- C:\Windows\System\vXKgMgI.exe
  C:\Windows\System\vXKgMgI.exe
  2⤵
  PID:16196
- C:\Windows\System\ezlRgrQ.exe
  C:\Windows\System\ezlRgrQ.exe
  2⤵
  PID:16220
- C:\Windows\System\UprgNJv.exe
  C:\Windows\System\UprgNJv.exe
  2⤵
  PID:16256
- C:\Windows\System\hFOhOPo.exe
  C:\Windows\System\hFOhOPo.exe
  2⤵
  PID:16272
- C:\Windows\System\tXwgPXN.exe
  C:\Windows\System\tXwgPXN.exe
  2⤵
  PID:16288
- C:\Windows\System\GVrsZBX.exe
  C:\Windows\System\GVrsZBX.exe
  2⤵
  PID:16304
- C:\Windows\System\qtgRrIn.exe
  C:\Windows\System\qtgRrIn.exe
  2⤵
  PID:16332
- C:\Windows\System\TQZPdSz.exe
  C:\Windows\System\TQZPdSz.exe
  2⤵
  PID:16348
- C:\Windows\System\fSCmmrL.exe
  C:\Windows\System\fSCmmrL.exe
  2⤵
  PID:16364
- C:\Windows\System\hBjIGFz.exe
  C:\Windows\System\hBjIGFz.exe
  2⤵
  PID:14800
- C:\Windows\System\xZjWcGu.exe
  C:\Windows\System\xZjWcGu.exe
  2⤵
  PID:14828
- C:\Windows\System\LPOvrJj.exe
  C:\Windows\System\LPOvrJj.exe
  2⤵
  PID:14448
- C:\Windows\System\lQoGKJE.exe
  C:\Windows\System\lQoGKJE.exe
  2⤵
  PID:14672
- C:\Windows\System\qTsvdfR.exe
  C:\Windows\System\qTsvdfR.exe
  2⤵
  PID:15088
- C:\Windows\System\mvmbCkN.exe
  C:\Windows\System\mvmbCkN.exe
  2⤵
  PID:15296
- C:\Windows\System\aNimQzP.exe
  C:\Windows\System\aNimQzP.exe
  2⤵
  PID:15564
- C:\Windows\System\jCNRAZH.exe
  C:\Windows\System\jCNRAZH.exe
  2⤵
  PID:15600
- C:\Windows\System\aZjnUbE.exe
  C:\Windows\System\aZjnUbE.exe
  2⤵
  PID:15144
- C:\Windows\System\YumJCgg.exe
  C:\Windows\System\YumJCgg.exe
  2⤵
  PID:15788
- C:\Windows\System\TubjYys.exe
  C:\Windows\System\TubjYys.exe
  2⤵
  PID:15856
- C:\Windows\System\VSkLEdI.exe
  C:\Windows\System\VSkLEdI.exe
  2⤵
  PID:15376
- C:\Windows\System\GKnyfEx.exe
  C:\Windows\System\GKnyfEx.exe
  2⤵
  PID:15976
- C:\Windows\System\MRggwRI.exe
  C:\Windows\System\MRggwRI.exe
  2⤵
  PID:15664
- C:\Windows\System\bJuLzEw.exe
  C:\Windows\System\bJuLzEw.exe
  2⤵
  PID:15500
- C:\Windows\System\hzDoqEH.exe
  C:\Windows\System\hzDoqEH.exe
  2⤵
  PID:16124
- C:\Windows\System\birkCRg.exe
  C:\Windows\System\birkCRg.exe
  2⤵
  PID:16168
- C:\Windows\System\UuLlATB.exe
  C:\Windows\System\UuLlATB.exe
  2⤵
  PID:15568
- C:\Windows\System\wHyuAyG.exe
  C:\Windows\System\wHyuAyG.exe
  2⤵
  PID:15912
- C:\Windows\System\FZmYOSL.exe
  C:\Windows\System\FZmYOSL.exe
  2⤵
  PID:16244
- C:\Windows\System\JHEgMhY.exe
  C:\Windows\System\JHEgMhY.exe
  2⤵
  PID:16264
- C:\Windows\System\tZTmGEq.exe
  C:\Windows\System\tZTmGEq.exe
  2⤵
  PID:15980
- C:\Windows\System\nYMcMlu.exe
  C:\Windows\System\nYMcMlu.exe
  2⤵
  PID:16388
- C:\Windows\System\rizexPc.exe
  C:\Windows\System\rizexPc.exe
  2⤵
  PID:16404
- C:\Windows\System\lkZEqiS.exe
  C:\Windows\System\lkZEqiS.exe
  2⤵
  PID:16420
- C:\Windows\System\OrvlDMW.exe
  C:\Windows\System\OrvlDMW.exe
  2⤵
  PID:16452
- C:\Windows\System\xtcYbRJ.exe
  C:\Windows\System\xtcYbRJ.exe
  2⤵
  PID:16472
- C:\Windows\System\LUkbsen.exe
  C:\Windows\System\LUkbsen.exe
  2⤵
  PID:16488
- C:\Windows\System\qlECHJq.exe
  C:\Windows\System\qlECHJq.exe
  2⤵
  PID:16512
- C:\Windows\System\PdgSJeg.exe
  C:\Windows\System\PdgSJeg.exe
  2⤵
  PID:16536
- C:\Windows\System\sSRUsUY.exe
  C:\Windows\System\sSRUsUY.exe
  2⤵
  PID:16572
- C:\Windows\System\XaRlChi.exe
  C:\Windows\System\XaRlChi.exe
  2⤵
  PID:16588
- C:\Windows\System\vKNavvQ.exe
  C:\Windows\System\vKNavvQ.exe
  2⤵
  PID:16612
- C:\Windows\System\pfSarsd.exe
  C:\Windows\System\pfSarsd.exe
  2⤵
  PID:16628
- C:\Windows\System\NByvBUK.exe
  C:\Windows\System\NByvBUK.exe
  2⤵
  PID:16644
- C:\Windows\System\pjexWuF.exe
  C:\Windows\System\pjexWuF.exe
  2⤵
  PID:16672
- C:\Windows\System\sYSLEXo.exe
  C:\Windows\System\sYSLEXo.exe
  2⤵
  PID:16688
- C:\Windows\System\BjHxzTR.exe
  C:\Windows\System\BjHxzTR.exe
  2⤵
  PID:16716
- C:\Windows\System\CVocUTD.exe
  C:\Windows\System\CVocUTD.exe
  2⤵
  PID:16732
- C:\Windows\System\LwJiTYn.exe
  C:\Windows\System\LwJiTYn.exe
  2⤵
  PID:17092
- C:\Windows\System\XuxtVYk.exe
  C:\Windows\System\XuxtVYk.exe
  2⤵
  PID:17108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DcoJabg.exe

Filesize
1.4MB

MD5
6a03ae9747cd7596532dc27ea954f78a

SHA1
073aba1fe371a94b3eb8f6e2148932007a6d0cbd

SHA256
e26e0651f65b648232e746bca9895dac628aab75b1cacd0cca790c843991c08d

SHA512
a0242caa947bc8a74eb2c13e8cd27f3fe7f0caafd941b7d5bf82f748bc544820a93f742f9b0b4bbc625905dab24ace6866361a0512ef7a7e31469bdedf90a5b9

Download Submit
C:\Windows\System\GqTyyhU.exe

Filesize
1.4MB

MD5
ebf52080193fd8138cb980d07e2e030f

SHA1
c98fa721dc4d2f6b192ff1b16051bdc35bac8ac1

SHA256
e5b27d2bff07305554f25b762cb19f8ccabf4fba0ea0c41ab8608253993d16ca

SHA512
217ce9667f4041284c0603af5a801acdfe87d34b6d5ab816495221a5b1ebe61c92f18c9802402db9bec14da9548eb3a9f15a0fbdefd339891b416f88b86b1ee9

Download Submit
C:\Windows\System\GtvRYfy.exe

Filesize
1.4MB

MD5
282eee65c934d551e654ff5f14516511

SHA1
6f1dd2cc93a11116482747f2859e94a9beb27782

SHA256
be91901f10f598d62e1b7e68dfe653d1c5ff2586626654b1422898c02151f6c0

SHA512
e7a9cf58122c89bb2bc95612f54120da2708da54e13f17ebd41027b9911796df63633688128e74165a7fe4e6737e46cededec9669cef7d96a9b7daccc7112fa2

Download Submit
C:\Windows\System\KbzYGAu.exe

Filesize
1.4MB

MD5
af7d154c96b2383489a6937b7d094fd7

SHA1
653533066c7db737246b118dbe1cbd1fd9449323

SHA256
88f3f51c31a5a8240b17b7d42c0424aeeccd02e2c9668e6186f0ec581041fc3f

SHA512
543bc04dda7dab99d393b32a28dbb18255dcf436cdbdf23b7bfd73b8e9a3a0b65d0fcf9aa0abb71f0167891faeb2d877e14dc3ed49ff56729ac51a6816cc8524

Download Submit
C:\Windows\System\KqPZDGG.exe

Filesize
1.4MB

MD5
9262d6b2bef1cc43abd497705b63ae83

SHA1
f0b0caa54d2a30e09b2c26f9c762e2f1448c852a

SHA256
714f4b1fec85d28f0e49511cbccb44300abf84c83699314e2e2c8110ae4f26ce

SHA512
3e7956358b0aeccb2cb5cd2c4ea1c1dd4a65c1432b6c281c0eeb8eaf907db1bf758b51e578dc39e4dda0c204b6e015e294677c20511ffe7e2386f5cfeff16fcf

Download Submit
C:\Windows\System\NTtdOri.exe

Filesize
1.4MB

MD5
2b90c06001f40af91902ecedb2b262ea

SHA1
98fce4abf1a406d1d3732bcfe64d91413a69f3d1

SHA256
41803a7573a04c50ad2553439844595df016cec1857a67212386a22fff56ae55

SHA512
6a49f83389689a5fd43b253c189ced7de962e47983811bc3404deea3a28e97378be8f5579838b94bc907daf5e29c336ca38c6be07f85c004e0f30a46189099e5

Download Submit
C:\Windows\System\NgYRAVl.exe

Filesize
1.4MB

MD5
85d737876eda7b225b4583c2e531af8c

SHA1
2d978db01505a20b4c049b18fbdce8b590a57197

SHA256
c285e9dab0b218d7804f2859af0d3e138830f4e4d8d8b590fe23e08c3fbc0ad7

SHA512
5cb39c6e7b6e81844df22b671ac8a3e384a2e0d7df27ea979f39b371bb437ae16bb62c61a7b694903c8fe6373a67c473477de88dbcf00302a48db8bb7811034b

Download Submit
C:\Windows\System\NoRSVvB.exe

Filesize
1.4MB

MD5
dcfcd8c49d06e794ed3199653f54b33d

SHA1
25657cbe67ba865ade50e9a5ff87acc2d8f50511

SHA256
f22ebaaf5158368007e5f8b6edabb1f09e1448d9c7dca15a7e373df531dc3e93

SHA512
0b881a9335cfbeda22dcb60822c177b3f3399a05d3867fa9ebc7e184e5861090939fa688135ac9c6c28c62f3a4f3482a6cbda516db52fe35e732346006d74f08

Download Submit
C:\Windows\System\OhwxxDw.exe

Filesize
1.4MB

MD5
654fd11a336fbbee429615b9663e9666

SHA1
03c7812bf3a27e47210f9cab34b67fcdef690d84

SHA256
a54c41a711cdaced027594de779a76dd96d4f2ed0bd9bc0d892d30eb325ef178

SHA512
98038a540bc397aa70c599f98faeb0f085ac84d584868cae88ad149fac46964ba7d5d1d08ed84230e223137dda6c890252cb9d9760824c99e0aaf6bc339d531d

Download Submit
C:\Windows\System\PwuMRZu.exe

Filesize
1.4MB

MD5
9fa351b8b7c28ada8c9d335b154e11eb

SHA1
a87fbe4ca683a687ecb1657b61c816dc73dbaaa7

SHA256
5039a21f1da66e0d6470560dde34dc8308f8a1ec2f011e44ec67a88620ad30c2

SHA512
8c47fe9976c67925202e0814cc02082909cf2986a25d0b49ef183b8abe348a5e49a920ac8b0a0f9b0a2e750e67fcde1d5b18510e744fa189f4227204fb396b61

Download Submit
C:\Windows\System\QeBoXTH.exe

Filesize
1.4MB

MD5
9d1bce1dbf4a72a3645b9d9f894f7556

SHA1
5bc658ce1ec050cde2fa988f930d733c68f4d10e

SHA256
6376b570ee42f6d08948a0aa8c978d3cac135852fe72189bef005a4f7fef1384

SHA512
7ba043b5369e67ab8cd700e8ebdc0cd3effbc7842db2a33f504f3beb0c6dcb13bc28cc8815fc2de41d9420461e5879a32958573ef624a3c9acea8828ca4ed37f

Download Submit
C:\Windows\System\RByxtbK.exe

Filesize
1.4MB

MD5
af0b0f87156f28237ae3c95cfb4ea87e

SHA1
c4285c2b0b77db9355f49f5a235b5df3e6382ad5

SHA256
dab3fc65eec9d6013f9669b71e6dc83c9411e2cf8604d1f842faa0e80bee6811

SHA512
3043062335ccb043dca6713b75ddb1a23860278e41d707ca633ef902b72672e4799e7627bca1cb682c787bb65f3bd5b2e61d0e155b5cb56d60193ada6c186c33

Download Submit
C:\Windows\System\RFHEsiE.exe

Filesize
1.4MB

MD5
1b07b4ff50adf241dcdbf3e0eb928028

SHA1
fd9f1e586d2912cfa62da40d731da449aaec53fe

SHA256
68bf8ede46703554738be9360878d9d41e1023dc1b4e146644552658628dbcfb

SHA512
190ed28da9f82a6e9bf6a505447c254af49a91200ef595ead7c4b1c54fb4aee63829d3c6d799ce5b506e2cbfd863cd7360f4f49a9b522246baf35b2c7af313cf

Download Submit
C:\Windows\System\ReaDdBf.exe

Filesize
1.4MB

MD5
f7373cc58d57ad220f1adea66c647d95

SHA1
46e1c3bf610f4d48498acebd0fc6fc922f1aa50c

SHA256
57a626e8d13d045a1253e8382e566300efa6f796b82dfe3d03806c1c68cc67fc

SHA512
97ec7bacff7d64c75c6e54c43b0ad7fbd93061dc858205f6866d08e1270205aa42e796b03599630779f9422a544413d0d2d63db8c5c03204b463718c8ab1fb7b

Download Submit
C:\Windows\System\SUeVMvm.exe

Filesize
1.4MB

MD5
3479e9f0b066e35a75663244e4be8764

SHA1
dc63023ebce5a9429772e076f4449c542fdca466

SHA256
d8106a5e3981939f9709d80cab1dde485294e824a15936485ffa04a43d42b384

SHA512
6adf4e94172d1b95f52a8fa775d2285fd3f852c3eb0d4d40239911ea879a5e35c5d67926e3e1f092d9f32b16ff0e06bbe5e2ef17e4391d365cd603bea06a4379

Download Submit
C:\Windows\System\TSfguBa.exe

Filesize
1.4MB

MD5
0205c791624c922f28358290fb3fc6d2

SHA1
088213206de44a0d0fce92dd82fc1ee3a1085342

SHA256
190f55b62009fb24132777c3c2d24a7e54b07cb913c08827aecb415030ec8e42

SHA512
b86142a172c7e8026b00ae7e409f41a8c84b391fe1bd060c561c1fd3e329be96d2458b98659a63d343bba4fc271e1860f7d4b9f5a884953f984f45470c09d3d4

Download Submit
C:\Windows\System\WzIWLFc.exe

Filesize
1.4MB

MD5
18f1437580933db275544c930bdd9e65

SHA1
6ddb2a2cdc9224f1986efaef6a7afde538b346f5

SHA256
6d097eb80b122f0a0fed23aca520b64f15b65109e9300dcc3de9c419c33dc520

SHA512
06b46d647d01beecd1e710241e251f41bd905d2335ba31220bdc191d97b4cb3fcff8aa5e85ef7912e40745e1c66bead560528cbaab801ccb9b6000e65026c28f

Download Submit
C:\Windows\System\YfcNqog.exe

Filesize
1.4MB

MD5
29684efd29495908f2ccc9a36b9a9894

SHA1
d37da0f3ee00a0e8099524d398076f4b5a949a1b

SHA256
5b77355b7552fe20858d25fd570b3a1667a26a2857d9b8f586a4c11289c5a357

SHA512
4244f64d7c4a160e38c0f026119b1dac8eaa69633c86789c2e1856b64515941485953ca418cec3186bc8627aa3987fccaefc96de4eeeeb53542ba0d17ca2159f

Download Submit
C:\Windows\System\bjgKkql.exe

Filesize
1.4MB

MD5
168019f3cfb8af9358b80d5f647426db

SHA1
695b1fd3920b9453fb05ba23ac88099274bc800c

SHA256
dc3ba389a5790e859f13aaef106199e95aaf1849673de1ea54ef4557544e75c4

SHA512
6c530ccdb6c2f6528bbb1b3baa6e52ce377b51c943bc8982ca005b5270067ba0a0b7a83fd4002638771eb065662f145a6233ad2b28c95b79f3b49c34211015b6

Download Submit
C:\Windows\System\dWNFFOa.exe

Filesize
1.4MB

MD5
a2f95e52e77550d663996b02db65ef41

SHA1
a9b5590dce1e3940c0d4bc23f4b215c89bbcdbbd

SHA256
b630fa8f51867bff0988641581aa20a54fff0bac830a2cfbe598e5644f3d7ca7

SHA512
3327838553db369ca209e50881a1d77fa576867a0fecdef1b6e3c99ce990bcb17a2b9c937c0f363285c7b1089f634dbc101d395973fbe5afe033bc56c417d329

Download Submit
C:\Windows\System\fKeLzBM.exe

Filesize
1.4MB

MD5
b5538c881a0cae7beba825725f8789cf

SHA1
33c70bccf31053ba6adf08ef721fc9c4e502289b

SHA256
a04075c1cddc2dec7f90c3bb1cb8551f6f7598be3c7cc6df63c5d2d4c9f64afb

SHA512
dea54ca2c8a973a1f2153257d7bc9f462f9fd393391e4099b63a84bb03ed3268c24d37ccf99c49b23a876a3f396d7db1c050fbd3c3c1bb66f3cbca7d0f369317

Download Submit
C:\Windows\System\fwpnZDn.exe

Filesize
1.4MB

MD5
d0ffd239e49ec2feb3c32319caeb33b6

SHA1
62bf98e6b43ff8d13d96fad1dac305d9fe9216f4

SHA256
d491197b57b938ac18b1d4ba9611052faf4c0dc4b753e063a51e7db05dfd7dbb

SHA512
7270816613ff8b0401f4d29d29b3f3ad7abfd8e1d00e19d85c64b1fb1cf458bbafb5247501a620df60c0c2a15a3ebbe38b1b1259c846abdd0b7f8a920cbf614e

Download Submit
C:\Windows\System\fzJWfIT.exe

Filesize
1.4MB

MD5
f6e33f169b109b41ae336a87e23afb70

SHA1
df9c05e5fa210cd587632bc99331f1e346163ca9

SHA256
c40544e2696921d02c79da962e1b888ca7a48001e3ce743b145defd77c6066b6

SHA512
f3d72b3b8034a4ea267cd0be4082486bf43383f0d2515db74bd40eeda5f3ea092e17fd26ea1b65602447d1436e56eeafd1270ba0facd3c85f815c49f45f7bc29

Download Submit
C:\Windows\System\iyiDTdX.exe

Filesize
1.4MB

MD5
d6bd1d362f8a23f18b2257c7b663c52f

SHA1
a196a4975d6f7cf37118d5384cf5f3f37792a44d

SHA256
bc9bd23417bc317511e9288603f9cc17335424c1a6496110550befbec30e247f

SHA512
ec2a5f09429ff2737e984b918d5b3611249a5953bf71357f6da070ca61adf0bf38fc12845833f3bdc7f99548522e2a22d0d26c5297a80472af3bbe41fa6acad5

Download Submit
C:\Windows\System\jYZcZeh.exe

Filesize
1.4MB

MD5
95fb8091545309735c6600dc7ed05d69

SHA1
0d1d79044e69f86e53ab406cc472d9ee2ec4b468

SHA256
5d4940a3c267438a4dae6f19b2cb7b01f02818457d2d522309e32666b5ad89b5

SHA512
a6b32f48de596866e8e693540190eb2f144a24d0b68cdf9ba3b167a80e8a82b2e17c8bdef75bf3d966a96201cbc07846c2ee2c77e6c55a19ce2b225683647959

Download Submit
C:\Windows\System\kidSzGG.exe

Filesize
1.4MB

MD5
645305af442077aa2bc8ded5f9724814

SHA1
09db6bb6fd916d873e443012b5538a0ddefb55c6

SHA256
499605dacd6e034ac2e556b918607e699ef51216474543dc1e659d746243e7cf

SHA512
f26b7b911f137021094ea091cd80d1011277f41996ae4404a303864ca2b9787c66fd57bdce68de4737f0a101c6da699324f695642eeb35c5114b5ee86e39050c

Download Submit
C:\Windows\System\lrjcPsz.exe

Filesize
1.4MB

MD5
a891ede3dadc4224a2b04eb3618aa892

SHA1
97ee943ccaa4eac01aacfcdb88a4948e7faca610

SHA256
b13d2f91a7c30d137c30bb5d524f8b24aafe1d9059b51c191fff383a3a11fb10

SHA512
35499a0f598442b4f3a503bc3d85fa5d42f2b29db02055171c9c1a8aed9c5afb46bc87c5f95e0161d750276f56c1b10725291ab65a3ab8ad0fd2b4cee0e193d7

Download Submit
C:\Windows\System\nOVvkEy.exe

Filesize
1.4MB

MD5
0d44fb1f7e8c3e4e5b28ee25c448bbdc

SHA1
3adf804e75f323081b9fe15629d590f07a163366

SHA256
4ea3ea64c946505ea50e4aa5edaf6181c028fb5bc2b2dda4dd63939a477da4d8

SHA512
21d231f0f6bea5223170e9552742544bb8206171fa7bd72a80c6fe27ecac8abef436dc47e09e0a1bee52b2b57b5c5c713f088c9351eb75fdbf92f25f08a5b925

Download Submit
C:\Windows\System\uOnvOcu.exe

Filesize
1.4MB

MD5
f1520d5de87c7b8f390c12cfb2d25296

SHA1
5b920a6077cee04bfd55734001d801c79cd549f7

SHA256
dd0bdea4d3ef473cee2e38ba3c61804626ad32c6412f6f83f5ef4fe64984f689

SHA512
1d68373ab0431dea6ba0ee00c8b1a503e20db2a55e206602e1fb46c340bd52cb71cc276083a3eb0c0c0609a1c6a9f47b3ba5a4ec2f8f3a8aaab3358ba475b0e4

Download Submit
C:\Windows\System\vKoiXce.exe

Filesize
1.4MB

MD5
6c58731de1b5042e0faa46b8464716f1

SHA1
d4dfd3a2879dbe8e7d5106b5ac07664277467f80

SHA256
09a747745f984b41fa91a181472662b161969feeb696062fc7dd6c553ae7c3f3

SHA512
b0d4fdc4ed4fcb99301854f546281baab4555abf828b45ad193934c401bf7f0f711e69749cf1850243effbdf6abc7854dddee7a477626d91484f40d7291f4e62

Download Submit
C:\Windows\System\vhwwOrm.exe

Filesize
1.4MB

MD5
67789933ac62474c09481a30919757b8

SHA1
a8cd1d283698344c3ea2fb06935f98e9bc3d51bb

SHA256
af50506740ff91bcec0742a3b13f5ec18fd81d6321893249659140064badd7a8

SHA512
fdf521e65d46bd32eb7564eea1a77910f0d2521e565ff20de5144ad7f61a6ac50bac3925f4833dfaf35be531c2ec04c920fa898496046f2238a01c8ba3d747db

Download Submit
C:\Windows\System\woxDnoi.exe

Filesize
1.4MB

MD5
60ceaf842ad941b5d81766d79aa81b07

SHA1
ec31ffc2862089b856e6bdf8dbf6a2a0fee21215

SHA256
62fce391d86c8a288a89c9c38166c634b4d7edb87b710c732277cd6c196c2790

SHA512
02926cca22ec680780d66fafe99ae2b77f98766c85a499a1abc5602ac34995d65ff4c4a9b1d4ea354d261e29fa4de8f17ae334102a307e9122d856b2d1d1ea7e

Download Submit
C:\Windows\System\yAcfwMk.exe

Filesize
1.4MB

MD5
2da8cbfa6c132b10c95b1d89bb1f63f5

SHA1
0183b1e36e84d77a90039819b4aa4126dc2c02c7

SHA256
fc2ceab3eb590cba2e52f127833f33557c4fc302df2f0377874010089ce61db8

SHA512
ee1c988e3868fb51890f6e7579c292eea1aea8ebec08e85afba7771b14e1184cb851532daf4cb8e9f00c8dc1de7af95e7982334d4b3693cb098fc7f51b137628

Download Submit
memory/1772-0-0x0000020179760000-0x0000020179770000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads