xmrig | 69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
Size

1.8MB
MD5

4398eaef4ebb13b512b1c8d318730f8a
SHA1

05d5b4db7f917f33e32620c9abdff67f827d2e0b
SHA256

69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba
SHA512

58583bf0493b3fcf5cf48114f94183cd5b22389788c22303b74763950be80c09a236ff61d25517fe1aadf8b30a2112ac73a7b47b27494989ab635c2f03e06317
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ7eqTVl:GemTLkNdfE0pZye

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023b3f-3.dat	xmrig
behavioral2/files/0x000a000000023b88-9.dat	xmrig
behavioral2/files/0x000a000000023b8a-17.dat	xmrig
behavioral2/files/0x000a000000023b8d-34.dat	xmrig
behavioral2/files/0x000a000000023b8f-45.dat	xmrig
behavioral2/files/0x000a000000023b8e-38.dat	xmrig
behavioral2/files/0x000a000000023b8c-30.dat	xmrig
behavioral2/files/0x000a000000023b8b-28.dat	xmrig
behavioral2/files/0x000a000000023b89-18.dat	xmrig
behavioral2/files/0x000a000000023b90-48.dat	xmrig
behavioral2/files/0x000a000000023b91-62.dat	xmrig
behavioral2/files/0x000b000000023b92-68.dat	xmrig
behavioral2/files/0x000b000000023b93-75.dat	xmrig
behavioral2/files/0x000e000000023ba3-82.dat	xmrig
behavioral2/files/0x0008000000023bac-89.dat	xmrig
behavioral2/files/0x000a000000023b9c-85.dat	xmrig
behavioral2/files/0x000b000000023b94-83.dat	xmrig
behavioral2/files/0x0008000000023bbc-106.dat	xmrig
behavioral2/files/0x0008000000023bb9-113.dat	xmrig
behavioral2/files/0x000e000000023bb7-111.dat	xmrig
behavioral2/files/0x0009000000023bb3-109.dat	xmrig
behavioral2/files/0x0009000000023bb1-107.dat	xmrig
behavioral2/files/0x000b000000023b85-61.dat	xmrig
behavioral2/files/0x0008000000023bbf-125.dat	xmrig
behavioral2/files/0x0008000000023bbd-121.dat	xmrig
behavioral2/files/0x0008000000023bbe-132.dat	xmrig
behavioral2/files/0x0008000000023bef-138.dat	xmrig
behavioral2/files/0x0008000000023bf0-147.dat	xmrig
behavioral2/files/0x0008000000023bf8-159.dat	xmrig
behavioral2/files/0x0008000000023bf2-160.dat	xmrig
behavioral2/files/0x0008000000023bf3-158.dat	xmrig
behavioral2/files/0x0008000000023bf1-153.dat	xmrig
behavioral2/files/0x0008000000023bee-140.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3044	AiADSvX.exe
4740	jbZzqgJ.exe
3672	KBbswCv.exe
4776	PFoSUrB.exe
1660	JvFOEdv.exe
1912	lgUzBpA.exe
728	pBIIUjJ.exe
2056	cIPRywm.exe
3228	tyJbqMo.exe
524	hrnQVah.exe
1096	xDwnHBf.exe
2028	cHUktqk.exe
3508	KQhutdi.exe
4516	ORoTavW.exe
3956	PXhFwQl.exe
1272	WSumhvi.exe
2976	bBLbPxH.exe
116	IJiGRGx.exe
3608	kNTvQhD.exe
4600	AQbGdbj.exe
3752	Ynfygwn.exe
3868	BWpmpUq.exe
4868	MrHkYGy.exe
1540	CptIvru.exe
760	byupJEV.exe
4900	AfmCdoo.exe
1492	UQIsydk.exe
5116	twAkbmd.exe
4564	NQoETcG.exe
2128	wBvwfXm.exe
1432	bKZdINd.exe
4680	YpoYvza.exe
4736	LggywPv.exe
4936	pnEYVWe.exe
1752	ssfeDoE.exe
1948	dyxItiE.exe
4524	dPWvvMq.exe
1496	ciumJqb.exe
1256	NQPvShz.exe
4112	KeZyOTU.exe
1868	kyyoJwi.exe
5020	QfoKfcU.exe
2312	ROfhXAj.exe
4732	qyaKUkN.exe
4416	dYcvGRm.exe
4816	gaeGqei.exe
3184	tPCxQdE.exe
1416	ZNAbpzV.exe
2664	VpFalQU.exe
2560	KzOsRiG.exe
2952	OkZgqul.exe
684	KgKKgVI.exe
3976	UDsCJDN.exe
1860	epkQdAt.exe
4672	PAwyTqq.exe
912	kZsaNcc.exe
3080	UFrivgz.exe
5056	qyjGTFx.exe
2748	oTyPEbR.exe
5084	YOKfwQq.exe
4920	APXLNHa.exe
1176	ugStFjn.exe
2180	VMZxtBw.exe
4828	bMLlIkI.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sOQUzRv.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\OLqHbcj.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\UBdGAmy.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\iwzYTfF.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\XCoZbus.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\tEDDyQW.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\mHJirai.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\BWpmpUq.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\JjvNvwJ.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\FDypvKL.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\ZZogmeZ.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\xDWJiul.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\LkyBWJD.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\epWGIpK.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\tyJbqMo.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\EgknaId.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\eOpqfpP.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\BwMVGwN.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\YZkzwFM.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\dEUquRE.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\OMTduyM.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\iVAhDRm.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\qyjGTFx.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\cjBpjke.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\FBxKHXd.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\aDjDtWg.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\YsnUmcU.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\bEBCLld.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\NmzsPqW.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\mLXVQNt.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\fUayNqw.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\pFHzPGo.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\DQpwMyq.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\OAetTFF.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\tJsdtpy.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\PeooaGr.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\chEniQw.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\IgnwiVa.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\bRVVMyO.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\lgUzBpA.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\IRwmVln.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\ylZNvwZ.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\LjvMxCy.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\ssfeDoE.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\BvIackI.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\rkrxiCu.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\yFOkFYx.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\mdtSsaK.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\fimIajy.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\wSBldJS.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\jbZzqgJ.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\bBLbPxH.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\wBgBHlq.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\rOdlXgi.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\FJFfJAq.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\AfFFWlW.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\XcKqsSH.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\xinVKdu.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\MCMZPuR.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\nMjenLA.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\FMvZFuy.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\eJOVokS.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\JRTRibR.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
File created	C:\Windows\System\DASefdC.exe	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 3044	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	84
PID 4052 wrote to memory of 3044	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	84
PID 4052 wrote to memory of 4740	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	85
PID 4052 wrote to memory of 4740	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	85
PID 4052 wrote to memory of 3672	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	86
PID 4052 wrote to memory of 3672	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	86
PID 4052 wrote to memory of 4776	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	87
PID 4052 wrote to memory of 4776	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	87
PID 4052 wrote to memory of 1660	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	88
PID 4052 wrote to memory of 1660	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	88
PID 4052 wrote to memory of 1912	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	89
PID 4052 wrote to memory of 1912	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	89
PID 4052 wrote to memory of 728	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	90
PID 4052 wrote to memory of 728	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	90
PID 4052 wrote to memory of 2056	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	91
PID 4052 wrote to memory of 2056	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	91
PID 4052 wrote to memory of 3228	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	92
PID 4052 wrote to memory of 3228	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	92
PID 4052 wrote to memory of 524	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	93
PID 4052 wrote to memory of 524	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	93
PID 4052 wrote to memory of 2028	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	94
PID 4052 wrote to memory of 2028	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	94
PID 4052 wrote to memory of 1096	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	95
PID 4052 wrote to memory of 1096	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	95
PID 4052 wrote to memory of 3508	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	96
PID 4052 wrote to memory of 3508	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	96
PID 4052 wrote to memory of 4516	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	97
PID 4052 wrote to memory of 4516	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	97
PID 4052 wrote to memory of 3956	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	98
PID 4052 wrote to memory of 3956	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	98
PID 4052 wrote to memory of 1272	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	99
PID 4052 wrote to memory of 1272	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	99
PID 4052 wrote to memory of 2976	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	100
PID 4052 wrote to memory of 2976	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	100
PID 4052 wrote to memory of 116	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	101
PID 4052 wrote to memory of 116	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	101
PID 4052 wrote to memory of 3608	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	102
PID 4052 wrote to memory of 3608	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	102
PID 4052 wrote to memory of 4600	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	103
PID 4052 wrote to memory of 4600	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	103
PID 4052 wrote to memory of 3752	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	104
PID 4052 wrote to memory of 3752	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	104
PID 4052 wrote to memory of 3868	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	105
PID 4052 wrote to memory of 3868	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	105
PID 4052 wrote to memory of 4868	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	106
PID 4052 wrote to memory of 4868	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	106
PID 4052 wrote to memory of 1540	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	107
PID 4052 wrote to memory of 1540	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	107
PID 4052 wrote to memory of 760	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	108
PID 4052 wrote to memory of 760	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	108
PID 4052 wrote to memory of 4900	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	109
PID 4052 wrote to memory of 4900	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	109
PID 4052 wrote to memory of 1492	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	110
PID 4052 wrote to memory of 1492	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	110
PID 4052 wrote to memory of 5116	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	111
PID 4052 wrote to memory of 5116	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	111
PID 4052 wrote to memory of 4564	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	112
PID 4052 wrote to memory of 4564	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	112
PID 4052 wrote to memory of 2128	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	113
PID 4052 wrote to memory of 2128	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	113
PID 4052 wrote to memory of 1432	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	114
PID 4052 wrote to memory of 1432	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	114
PID 4052 wrote to memory of 4680	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	115
PID 4052 wrote to memory of 4680	4052	69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe	115

C:\Users\Admin\AppData\Local\Temp\69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe
"C:\Users\Admin\AppData\Local\Temp\69d5cb68493fcb36c7bd14e4c067c006d7cb4c3492b1a81a1ee73c69addcc8ba.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\System\AiADSvX.exe
  C:\Windows\System\AiADSvX.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\jbZzqgJ.exe
  C:\Windows\System\jbZzqgJ.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\KBbswCv.exe
  C:\Windows\System\KBbswCv.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\PFoSUrB.exe
  C:\Windows\System\PFoSUrB.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\JvFOEdv.exe
  C:\Windows\System\JvFOEdv.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\lgUzBpA.exe
  C:\Windows\System\lgUzBpA.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\pBIIUjJ.exe
  C:\Windows\System\pBIIUjJ.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\cIPRywm.exe
  C:\Windows\System\cIPRywm.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\tyJbqMo.exe
  C:\Windows\System\tyJbqMo.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\hrnQVah.exe
  C:\Windows\System\hrnQVah.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\cHUktqk.exe
  C:\Windows\System\cHUktqk.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\xDwnHBf.exe
  C:\Windows\System\xDwnHBf.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\KQhutdi.exe
  C:\Windows\System\KQhutdi.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\ORoTavW.exe
  C:\Windows\System\ORoTavW.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\PXhFwQl.exe
  C:\Windows\System\PXhFwQl.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\WSumhvi.exe
  C:\Windows\System\WSumhvi.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\bBLbPxH.exe
  C:\Windows\System\bBLbPxH.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\IJiGRGx.exe
  C:\Windows\System\IJiGRGx.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\kNTvQhD.exe
  C:\Windows\System\kNTvQhD.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\AQbGdbj.exe
  C:\Windows\System\AQbGdbj.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\Ynfygwn.exe
  C:\Windows\System\Ynfygwn.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\BWpmpUq.exe
  C:\Windows\System\BWpmpUq.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\MrHkYGy.exe
  C:\Windows\System\MrHkYGy.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\CptIvru.exe
  C:\Windows\System\CptIvru.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\byupJEV.exe
  C:\Windows\System\byupJEV.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\AfmCdoo.exe
  C:\Windows\System\AfmCdoo.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\UQIsydk.exe
  C:\Windows\System\UQIsydk.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\twAkbmd.exe
  C:\Windows\System\twAkbmd.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\NQoETcG.exe
  C:\Windows\System\NQoETcG.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\wBvwfXm.exe
  C:\Windows\System\wBvwfXm.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\bKZdINd.exe
  C:\Windows\System\bKZdINd.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\YpoYvza.exe
  C:\Windows\System\YpoYvza.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\LggywPv.exe
  C:\Windows\System\LggywPv.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\pnEYVWe.exe
  C:\Windows\System\pnEYVWe.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\ssfeDoE.exe
  C:\Windows\System\ssfeDoE.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\dyxItiE.exe
  C:\Windows\System\dyxItiE.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\dPWvvMq.exe
  C:\Windows\System\dPWvvMq.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\ciumJqb.exe
  C:\Windows\System\ciumJqb.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\NQPvShz.exe
  C:\Windows\System\NQPvShz.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\KeZyOTU.exe
  C:\Windows\System\KeZyOTU.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\kyyoJwi.exe
  C:\Windows\System\kyyoJwi.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\QfoKfcU.exe
  C:\Windows\System\QfoKfcU.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\ROfhXAj.exe
  C:\Windows\System\ROfhXAj.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\qyaKUkN.exe
  C:\Windows\System\qyaKUkN.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\dYcvGRm.exe
  C:\Windows\System\dYcvGRm.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\gaeGqei.exe
  C:\Windows\System\gaeGqei.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\tPCxQdE.exe
  C:\Windows\System\tPCxQdE.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\ZNAbpzV.exe
  C:\Windows\System\ZNAbpzV.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\VpFalQU.exe
  C:\Windows\System\VpFalQU.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\KzOsRiG.exe
  C:\Windows\System\KzOsRiG.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\OkZgqul.exe
  C:\Windows\System\OkZgqul.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\KgKKgVI.exe
  C:\Windows\System\KgKKgVI.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\UDsCJDN.exe
  C:\Windows\System\UDsCJDN.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\epkQdAt.exe
  C:\Windows\System\epkQdAt.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\PAwyTqq.exe
  C:\Windows\System\PAwyTqq.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\kZsaNcc.exe
  C:\Windows\System\kZsaNcc.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\UFrivgz.exe
  C:\Windows\System\UFrivgz.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\qyjGTFx.exe
  C:\Windows\System\qyjGTFx.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\oTyPEbR.exe
  C:\Windows\System\oTyPEbR.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\YOKfwQq.exe
  C:\Windows\System\YOKfwQq.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\APXLNHa.exe
  C:\Windows\System\APXLNHa.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\ugStFjn.exe
  C:\Windows\System\ugStFjn.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\VMZxtBw.exe
  C:\Windows\System\VMZxtBw.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\bMLlIkI.exe
  C:\Windows\System\bMLlIkI.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\lHgeEBR.exe
  C:\Windows\System\lHgeEBR.exe
  2⤵
  PID:2884
- C:\Windows\System\dgSpfWA.exe
  C:\Windows\System\dgSpfWA.exe
  2⤵
  PID:2668
- C:\Windows\System\rOdlXgi.exe
  C:\Windows\System\rOdlXgi.exe
  2⤵
  PID:5064
- C:\Windows\System\DQpwMyq.exe
  C:\Windows\System\DQpwMyq.exe
  2⤵
  PID:2212
- C:\Windows\System\TYYEilg.exe
  C:\Windows\System\TYYEilg.exe
  2⤵
  PID:892
- C:\Windows\System\ShPhSdD.exe
  C:\Windows\System\ShPhSdD.exe
  2⤵
  PID:2248
- C:\Windows\System\cUpjUBb.exe
  C:\Windows\System\cUpjUBb.exe
  2⤵
  PID:1216
- C:\Windows\System\UTgVlym.exe
  C:\Windows\System\UTgVlym.exe
  2⤵
  PID:3920
- C:\Windows\System\ggwLjoU.exe
  C:\Windows\System\ggwLjoU.exe
  2⤵
  PID:4980
- C:\Windows\System\maxqWyk.exe
  C:\Windows\System\maxqWyk.exe
  2⤵
  PID:4860
- C:\Windows\System\zHrWsEq.exe
  C:\Windows\System\zHrWsEq.exe
  2⤵
  PID:4268
- C:\Windows\System\ymThuwg.exe
  C:\Windows\System\ymThuwg.exe
  2⤵
  PID:4280
- C:\Windows\System\ibYhzQe.exe
  C:\Windows\System\ibYhzQe.exe
  2⤵
  PID:3888
- C:\Windows\System\fuEaald.exe
  C:\Windows\System\fuEaald.exe
  2⤵
  PID:1120
- C:\Windows\System\hyCzVST.exe
  C:\Windows\System\hyCzVST.exe
  2⤵
  PID:1824
- C:\Windows\System\eHCaSrJ.exe
  C:\Windows\System\eHCaSrJ.exe
  2⤵
  PID:4180
- C:\Windows\System\IcsLQSR.exe
  C:\Windows\System\IcsLQSR.exe
  2⤵
  PID:1260
- C:\Windows\System\dxzmwfF.exe
  C:\Windows\System\dxzmwfF.exe
  2⤵
  PID:1484
- C:\Windows\System\ZPzkagJ.exe
  C:\Windows\System\ZPzkagJ.exe
  2⤵
  PID:2980
- C:\Windows\System\iwzYTfF.exe
  C:\Windows\System\iwzYTfF.exe
  2⤵
  PID:4596
- C:\Windows\System\MCMZPuR.exe
  C:\Windows\System\MCMZPuR.exe
  2⤵
  PID:1200
- C:\Windows\System\BYFpOPk.exe
  C:\Windows\System\BYFpOPk.exe
  2⤵
  PID:3680
- C:\Windows\System\DmqJEkd.exe
  C:\Windows\System\DmqJEkd.exe
  2⤵
  PID:3120
- C:\Windows\System\JbSeLdn.exe
  C:\Windows\System\JbSeLdn.exe
  2⤵
  PID:1136
- C:\Windows\System\wUqjpMh.exe
  C:\Windows\System\wUqjpMh.exe
  2⤵
  PID:3668
- C:\Windows\System\FJFfJAq.exe
  C:\Windows\System\FJFfJAq.exe
  2⤵
  PID:4696
- C:\Windows\System\IZAxjAJ.exe
  C:\Windows\System\IZAxjAJ.exe
  2⤵
  PID:3944
- C:\Windows\System\sOQUzRv.exe
  C:\Windows\System\sOQUzRv.exe
  2⤵
  PID:1392
- C:\Windows\System\DuSFOaB.exe
  C:\Windows\System\DuSFOaB.exe
  2⤵
  PID:224
- C:\Windows\System\jmcJLsR.exe
  C:\Windows\System\jmcJLsR.exe
  2⤵
  PID:1372
- C:\Windows\System\agwRxPC.exe
  C:\Windows\System\agwRxPC.exe
  2⤵
  PID:5040
- C:\Windows\System\qvPZwSd.exe
  C:\Windows\System\qvPZwSd.exe
  2⤵
  PID:744
- C:\Windows\System\jDXmSBi.exe
  C:\Windows\System\jDXmSBi.exe
  2⤵
  PID:4384
- C:\Windows\System\mzOUfoj.exe
  C:\Windows\System\mzOUfoj.exe
  2⤵
  PID:1616
- C:\Windows\System\kRVlvfk.exe
  C:\Windows\System\kRVlvfk.exe
  2⤵
  PID:4700
- C:\Windows\System\UQOAipa.exe
  C:\Windows\System\UQOAipa.exe
  2⤵
  PID:1488
- C:\Windows\System\BxzBJrv.exe
  C:\Windows\System\BxzBJrv.exe
  2⤵
  PID:60
- C:\Windows\System\rJsdKCO.exe
  C:\Windows\System\rJsdKCO.exe
  2⤵
  PID:3084
- C:\Windows\System\MxiSoRc.exe
  C:\Windows\System\MxiSoRc.exe
  2⤵
  PID:1400
- C:\Windows\System\pxgkGCW.exe
  C:\Windows\System\pxgkGCW.exe
  2⤵
  PID:4892
- C:\Windows\System\cZynMaQ.exe
  C:\Windows\System\cZynMaQ.exe
  2⤵
  PID:1996
- C:\Windows\System\vTNYkTD.exe
  C:\Windows\System\vTNYkTD.exe
  2⤵
  PID:3856
- C:\Windows\System\CJcjtVV.exe
  C:\Windows\System\CJcjtVV.exe
  2⤵
  PID:4608
- C:\Windows\System\saerxlp.exe
  C:\Windows\System\saerxlp.exe
  2⤵
  PID:4848
- C:\Windows\System\QzngwVk.exe
  C:\Windows\System\QzngwVk.exe
  2⤵
  PID:1056
- C:\Windows\System\DMvEcqj.exe
  C:\Windows\System\DMvEcqj.exe
  2⤵
  PID:1248
- C:\Windows\System\qtPdiDy.exe
  C:\Windows\System\qtPdiDy.exe
  2⤵
  PID:3172
- C:\Windows\System\vsDTonG.exe
  C:\Windows\System\vsDTonG.exe
  2⤵
  PID:4192
- C:\Windows\System\tylvKxS.exe
  C:\Windows\System\tylvKxS.exe
  2⤵
  PID:1336
- C:\Windows\System\HeHzBcA.exe
  C:\Windows\System\HeHzBcA.exe
  2⤵
  PID:5128
- C:\Windows\System\oqhPxnV.exe
  C:\Windows\System\oqhPxnV.exe
  2⤵
  PID:5156
- C:\Windows\System\fPxxqxr.exe
  C:\Windows\System\fPxxqxr.exe
  2⤵
  PID:5184
- C:\Windows\System\CjnqrEz.exe
  C:\Windows\System\CjnqrEz.exe
  2⤵
  PID:5208
- C:\Windows\System\ujjteWQ.exe
  C:\Windows\System\ujjteWQ.exe
  2⤵
  PID:5232
- C:\Windows\System\AQxTZSr.exe
  C:\Windows\System\AQxTZSr.exe
  2⤵
  PID:5260
- C:\Windows\System\XPeTmbb.exe
  C:\Windows\System\XPeTmbb.exe
  2⤵
  PID:5300
- C:\Windows\System\aPoIhqd.exe
  C:\Windows\System\aPoIhqd.exe
  2⤵
  PID:5324
- C:\Windows\System\BGAYmcD.exe
  C:\Windows\System\BGAYmcD.exe
  2⤵
  PID:5360
- C:\Windows\System\WZoMYga.exe
  C:\Windows\System\WZoMYga.exe
  2⤵
  PID:5392
- C:\Windows\System\QRcPFZv.exe
  C:\Windows\System\QRcPFZv.exe
  2⤵
  PID:5408
- C:\Windows\System\bdBiVZG.exe
  C:\Windows\System\bdBiVZG.exe
  2⤵
  PID:5448
- C:\Windows\System\ehhxLmF.exe
  C:\Windows\System\ehhxLmF.exe
  2⤵
  PID:5476
- C:\Windows\System\bFKaiiG.exe
  C:\Windows\System\bFKaiiG.exe
  2⤵
  PID:5492
- C:\Windows\System\vsNeUlW.exe
  C:\Windows\System\vsNeUlW.exe
  2⤵
  PID:5520
- C:\Windows\System\QYXzJDh.exe
  C:\Windows\System\QYXzJDh.exe
  2⤵
  PID:5548
- C:\Windows\System\WQgwbNy.exe
  C:\Windows\System\WQgwbNy.exe
  2⤵
  PID:5576
- C:\Windows\System\AqUeAkX.exe
  C:\Windows\System\AqUeAkX.exe
  2⤵
  PID:5604
- C:\Windows\System\gxGdFNs.exe
  C:\Windows\System\gxGdFNs.exe
  2⤵
  PID:5632
- C:\Windows\System\pksbHqV.exe
  C:\Windows\System\pksbHqV.exe
  2⤵
  PID:5660
- C:\Windows\System\ELsugNj.exe
  C:\Windows\System\ELsugNj.exe
  2⤵
  PID:5700
- C:\Windows\System\sKVchmy.exe
  C:\Windows\System\sKVchmy.exe
  2⤵
  PID:5728
- C:\Windows\System\vazShjF.exe
  C:\Windows\System\vazShjF.exe
  2⤵
  PID:5752
- C:\Windows\System\tYJBHEA.exe
  C:\Windows\System\tYJBHEA.exe
  2⤵
  PID:5772
- C:\Windows\System\rYtMivr.exe
  C:\Windows\System\rYtMivr.exe
  2⤵
  PID:5812
- C:\Windows\System\SDXRNfY.exe
  C:\Windows\System\SDXRNfY.exe
  2⤵
  PID:5828
- C:\Windows\System\ZKxFKDD.exe
  C:\Windows\System\ZKxFKDD.exe
  2⤵
  PID:5852
- C:\Windows\System\NywwKgi.exe
  C:\Windows\System\NywwKgi.exe
  2⤵
  PID:5884
- C:\Windows\System\Hlbviip.exe
  C:\Windows\System\Hlbviip.exe
  2⤵
  PID:5912
- C:\Windows\System\RoiAzQa.exe
  C:\Windows\System\RoiAzQa.exe
  2⤵
  PID:5940
- C:\Windows\System\rcIWota.exe
  C:\Windows\System\rcIWota.exe
  2⤵
  PID:5972
- C:\Windows\System\HUAWcLn.exe
  C:\Windows\System\HUAWcLn.exe
  2⤵
  PID:5996
- C:\Windows\System\NwsLNSx.exe
  C:\Windows\System\NwsLNSx.exe
  2⤵
  PID:6024
- C:\Windows\System\DUjJPBP.exe
  C:\Windows\System\DUjJPBP.exe
  2⤵
  PID:6048
- C:\Windows\System\eJWBwvM.exe
  C:\Windows\System\eJWBwvM.exe
  2⤵
  PID:6072
- C:\Windows\System\IkOBMWT.exe
  C:\Windows\System\IkOBMWT.exe
  2⤵
  PID:6096
- C:\Windows\System\IpjgfmL.exe
  C:\Windows\System\IpjgfmL.exe
  2⤵
  PID:6124
- C:\Windows\System\tbcNRWo.exe
  C:\Windows\System\tbcNRWo.exe
  2⤵
  PID:1124
- C:\Windows\System\vBEJpQY.exe
  C:\Windows\System\vBEJpQY.exe
  2⤵
  PID:5200
- C:\Windows\System\mvBxCkG.exe
  C:\Windows\System\mvBxCkG.exe
  2⤵
  PID:5244
- C:\Windows\System\qolIXSo.exe
  C:\Windows\System\qolIXSo.exe
  2⤵
  PID:5280
- C:\Windows\System\rBwuuMN.exe
  C:\Windows\System\rBwuuMN.exe
  2⤵
  PID:5384
- C:\Windows\System\QKELWEC.exe
  C:\Windows\System\QKELWEC.exe
  2⤵
  PID:5432
- C:\Windows\System\uzRCbVn.exe
  C:\Windows\System\uzRCbVn.exe
  2⤵
  PID:5516
- C:\Windows\System\oYdNDtW.exe
  C:\Windows\System\oYdNDtW.exe
  2⤵
  PID:5572
- C:\Windows\System\DQdQJHk.exe
  C:\Windows\System\DQdQJHk.exe
  2⤵
  PID:5620
- C:\Windows\System\oKjbnCv.exe
  C:\Windows\System\oKjbnCv.exe
  2⤵
  PID:5724
- C:\Windows\System\ZLKMzvy.exe
  C:\Windows\System\ZLKMzvy.exe
  2⤵
  PID:5784
- C:\Windows\System\cjBpjke.exe
  C:\Windows\System\cjBpjke.exe
  2⤵
  PID:5864
- C:\Windows\System\RZZsZcr.exe
  C:\Windows\System\RZZsZcr.exe
  2⤵
  PID:5924
- C:\Windows\System\UgZWzAA.exe
  C:\Windows\System\UgZWzAA.exe
  2⤵
  PID:5964
- C:\Windows\System\yjJAkrH.exe
  C:\Windows\System\yjJAkrH.exe
  2⤵
  PID:6068
- C:\Windows\System\dOdrcuv.exe
  C:\Windows\System\dOdrcuv.exe
  2⤵
  PID:6136
- C:\Windows\System\mzDKyVq.exe
  C:\Windows\System\mzDKyVq.exe
  2⤵
  PID:5148
- C:\Windows\System\FfTkTzv.exe
  C:\Windows\System\FfTkTzv.exe
  2⤵
  PID:5320
- C:\Windows\System\ipVlWYk.exe
  C:\Windows\System\ipVlWYk.exe
  2⤵
  PID:5488
- C:\Windows\System\SsYvbvJ.exe
  C:\Windows\System\SsYvbvJ.exe
  2⤵
  PID:5688
- C:\Windows\System\gznmZjO.exe
  C:\Windows\System\gznmZjO.exe
  2⤵
  PID:5792
- C:\Windows\System\AvqyDWW.exe
  C:\Windows\System\AvqyDWW.exe
  2⤵
  PID:5904
- C:\Windows\System\wePtJuS.exe
  C:\Windows\System\wePtJuS.exe
  2⤵
  PID:4592
- C:\Windows\System\IgnwiVa.exe
  C:\Windows\System\IgnwiVa.exe
  2⤵
  PID:5192
- C:\Windows\System\atnLDNZ.exe
  C:\Windows\System\atnLDNZ.exe
  2⤵
  PID:5540
- C:\Windows\System\ViYPibf.exe
  C:\Windows\System\ViYPibf.exe
  2⤵
  PID:5952
- C:\Windows\System\HtpfbNN.exe
  C:\Windows\System\HtpfbNN.exe
  2⤵
  PID:3896
- C:\Windows\System\oRVWXUp.exe
  C:\Windows\System\oRVWXUp.exe
  2⤵
  PID:6008
- C:\Windows\System\OLqHbcj.exe
  C:\Windows\System\OLqHbcj.exe
  2⤵
  PID:6156
- C:\Windows\System\uDYnHtO.exe
  C:\Windows\System\uDYnHtO.exe
  2⤵
  PID:6172
- C:\Windows\System\srAWbPR.exe
  C:\Windows\System\srAWbPR.exe
  2⤵
  PID:6204
- C:\Windows\System\oCNdbNv.exe
  C:\Windows\System\oCNdbNv.exe
  2⤵
  PID:6232
- C:\Windows\System\HJIyzpl.exe
  C:\Windows\System\HJIyzpl.exe
  2⤵
  PID:6260
- C:\Windows\System\udVVlXq.exe
  C:\Windows\System\udVVlXq.exe
  2⤵
  PID:6288
- C:\Windows\System\lfphMjl.exe
  C:\Windows\System\lfphMjl.exe
  2⤵
  PID:6316
- C:\Windows\System\gziaopE.exe
  C:\Windows\System\gziaopE.exe
  2⤵
  PID:6352
- C:\Windows\System\bjzinfO.exe
  C:\Windows\System\bjzinfO.exe
  2⤵
  PID:6384
- C:\Windows\System\BGJZzaw.exe
  C:\Windows\System\BGJZzaw.exe
  2⤵
  PID:6412
- C:\Windows\System\yaphTiy.exe
  C:\Windows\System\yaphTiy.exe
  2⤵
  PID:6436
- C:\Windows\System\gYYsJhw.exe
  C:\Windows\System\gYYsJhw.exe
  2⤵
  PID:6460
- C:\Windows\System\nMjenLA.exe
  C:\Windows\System\nMjenLA.exe
  2⤵
  PID:6484
- C:\Windows\System\jdrIiJI.exe
  C:\Windows\System\jdrIiJI.exe
  2⤵
  PID:6516
- C:\Windows\System\dQdKXMN.exe
  C:\Windows\System\dQdKXMN.exe
  2⤵
  PID:6544
- C:\Windows\System\cMDvsyX.exe
  C:\Windows\System\cMDvsyX.exe
  2⤵
  PID:6568
- C:\Windows\System\ciMwTNT.exe
  C:\Windows\System\ciMwTNT.exe
  2⤵
  PID:6600
- C:\Windows\System\IAhkOAn.exe
  C:\Windows\System\IAhkOAn.exe
  2⤵
  PID:6628
- C:\Windows\System\LshOFpN.exe
  C:\Windows\System\LshOFpN.exe
  2⤵
  PID:6656
- C:\Windows\System\ZehxWAU.exe
  C:\Windows\System\ZehxWAU.exe
  2⤵
  PID:6692
- C:\Windows\System\CZdkRYv.exe
  C:\Windows\System\CZdkRYv.exe
  2⤵
  PID:6708
- C:\Windows\System\vlLYIIz.exe
  C:\Windows\System\vlLYIIz.exe
  2⤵
  PID:6740
- C:\Windows\System\UBtewnS.exe
  C:\Windows\System\UBtewnS.exe
  2⤵
  PID:6776
- C:\Windows\System\oaOfcvx.exe
  C:\Windows\System\oaOfcvx.exe
  2⤵
  PID:6792
- C:\Windows\System\ebMsUFU.exe
  C:\Windows\System\ebMsUFU.exe
  2⤵
  PID:6820
- C:\Windows\System\CkaPlxj.exe
  C:\Windows\System\CkaPlxj.exe
  2⤵
  PID:6852
- C:\Windows\System\VYxrkea.exe
  C:\Windows\System\VYxrkea.exe
  2⤵
  PID:6888
- C:\Windows\System\ZNtTSun.exe
  C:\Windows\System\ZNtTSun.exe
  2⤵
  PID:6908
- C:\Windows\System\AnGQIBF.exe
  C:\Windows\System\AnGQIBF.exe
  2⤵
  PID:6932
- C:\Windows\System\jYLrJpO.exe
  C:\Windows\System\jYLrJpO.exe
  2⤵
  PID:6968
- C:\Windows\System\JSrHlLj.exe
  C:\Windows\System\JSrHlLj.exe
  2⤵
  PID:7000
- C:\Windows\System\iPjYQus.exe
  C:\Windows\System\iPjYQus.exe
  2⤵
  PID:7016
- C:\Windows\System\RZVPZYj.exe
  C:\Windows\System\RZVPZYj.exe
  2⤵
  PID:7040
- C:\Windows\System\EBYEiHN.exe
  C:\Windows\System\EBYEiHN.exe
  2⤵
  PID:7068
- C:\Windows\System\QlxtDzM.exe
  C:\Windows\System\QlxtDzM.exe
  2⤵
  PID:7088
- C:\Windows\System\SnxMQkg.exe
  C:\Windows\System\SnxMQkg.exe
  2⤵
  PID:7116
- C:\Windows\System\peZsRLh.exe
  C:\Windows\System\peZsRLh.exe
  2⤵
  PID:7152
- C:\Windows\System\eqPtpJY.exe
  C:\Windows\System\eqPtpJY.exe
  2⤵
  PID:5908
- C:\Windows\System\bvvgDPl.exe
  C:\Windows\System\bvvgDPl.exe
  2⤵
  PID:6188
- C:\Windows\System\XCmncKY.exe
  C:\Windows\System\XCmncKY.exe
  2⤵
  PID:6276
- C:\Windows\System\rkJRoqx.exe
  C:\Windows\System\rkJRoqx.exe
  2⤵
  PID:6312
- C:\Windows\System\XovYuKu.exe
  C:\Windows\System\XovYuKu.exe
  2⤵
  PID:6336
- C:\Windows\System\ZttQaXc.exe
  C:\Windows\System\ZttQaXc.exe
  2⤵
  PID:6428
- C:\Windows\System\rAhvwuw.exe
  C:\Windows\System\rAhvwuw.exe
  2⤵
  PID:6500
- C:\Windows\System\SZJZCEb.exe
  C:\Windows\System\SZJZCEb.exe
  2⤵
  PID:6556
- C:\Windows\System\LEoZAcU.exe
  C:\Windows\System\LEoZAcU.exe
  2⤵
  PID:6664
- C:\Windows\System\hOAhFcX.exe
  C:\Windows\System\hOAhFcX.exe
  2⤵
  PID:6748
- C:\Windows\System\iPBLSCd.exe
  C:\Windows\System\iPBLSCd.exe
  2⤵
  PID:6760
- C:\Windows\System\qNasZOF.exe
  C:\Windows\System\qNasZOF.exe
  2⤵
  PID:6844
- C:\Windows\System\regbQbM.exe
  C:\Windows\System\regbQbM.exe
  2⤵
  PID:6944
- C:\Windows\System\mFBQOZL.exe
  C:\Windows\System\mFBQOZL.exe
  2⤵
  PID:7012
- C:\Windows\System\FMpUGZw.exe
  C:\Windows\System\FMpUGZw.exe
  2⤵
  PID:7032
- C:\Windows\System\xLlytkN.exe
  C:\Windows\System\xLlytkN.exe
  2⤵
  PID:7108
- C:\Windows\System\lCzgjmz.exe
  C:\Windows\System\lCzgjmz.exe
  2⤵
  PID:6192
- C:\Windows\System\OMTduyM.exe
  C:\Windows\System\OMTduyM.exe
  2⤵
  PID:6348
- C:\Windows\System\hwrWIZG.exe
  C:\Windows\System\hwrWIZG.exe
  2⤵
  PID:6420
- C:\Windows\System\xseirHH.exe
  C:\Windows\System\xseirHH.exe
  2⤵
  PID:6764
- C:\Windows\System\PCAwNCt.exe
  C:\Windows\System\PCAwNCt.exe
  2⤵
  PID:6676
- C:\Windows\System\wEZvLwC.exe
  C:\Windows\System\wEZvLwC.exe
  2⤵
  PID:6896
- C:\Windows\System\OZbrVXi.exe
  C:\Windows\System\OZbrVXi.exe
  2⤵
  PID:6184
- C:\Windows\System\bPXslGq.exe
  C:\Windows\System\bPXslGq.exe
  2⤵
  PID:6652
- C:\Windows\System\okhNZqr.exe
  C:\Windows\System\okhNZqr.exe
  2⤵
  PID:6952
- C:\Windows\System\YGwqjdR.exe
  C:\Windows\System\YGwqjdR.exe
  2⤵
  PID:6768
- C:\Windows\System\dklGHVu.exe
  C:\Windows\System\dklGHVu.exe
  2⤵
  PID:7172
- C:\Windows\System\EgknaId.exe
  C:\Windows\System\EgknaId.exe
  2⤵
  PID:7200
- C:\Windows\System\DtmrxJb.exe
  C:\Windows\System\DtmrxJb.exe
  2⤵
  PID:7228
- C:\Windows\System\LPOXdvZ.exe
  C:\Windows\System\LPOXdvZ.exe
  2⤵
  PID:7256
- C:\Windows\System\tbSnUXE.exe
  C:\Windows\System\tbSnUXE.exe
  2⤵
  PID:7276
- C:\Windows\System\YsnUmcU.exe
  C:\Windows\System\YsnUmcU.exe
  2⤵
  PID:7300
- C:\Windows\System\QGoveZg.exe
  C:\Windows\System\QGoveZg.exe
  2⤵
  PID:7316
- C:\Windows\System\nQNYDEC.exe
  C:\Windows\System\nQNYDEC.exe
  2⤵
  PID:7332
- C:\Windows\System\nzSIUco.exe
  C:\Windows\System\nzSIUco.exe
  2⤵
  PID:7356
- C:\Windows\System\FNLxHgF.exe
  C:\Windows\System\FNLxHgF.exe
  2⤵
  PID:7384
- C:\Windows\System\VoVVMqv.exe
  C:\Windows\System\VoVVMqv.exe
  2⤵
  PID:7416
- C:\Windows\System\NbGlPss.exe
  C:\Windows\System\NbGlPss.exe
  2⤵
  PID:7444
- C:\Windows\System\FBxKHXd.exe
  C:\Windows\System\FBxKHXd.exe
  2⤵
  PID:7476
- C:\Windows\System\NYnpDLg.exe
  C:\Windows\System\NYnpDLg.exe
  2⤵
  PID:7500
- C:\Windows\System\QIzWmZV.exe
  C:\Windows\System\QIzWmZV.exe
  2⤵
  PID:7528
- C:\Windows\System\kBfEdFH.exe
  C:\Windows\System\kBfEdFH.exe
  2⤵
  PID:7556
- C:\Windows\System\WYIjYEL.exe
  C:\Windows\System\WYIjYEL.exe
  2⤵
  PID:7584
- C:\Windows\System\xKuuUkP.exe
  C:\Windows\System\xKuuUkP.exe
  2⤵
  PID:7604
- C:\Windows\System\VdraDLH.exe
  C:\Windows\System\VdraDLH.exe
  2⤵
  PID:7628
- C:\Windows\System\ODPeiSU.exe
  C:\Windows\System\ODPeiSU.exe
  2⤵
  PID:7656
- C:\Windows\System\YXprozC.exe
  C:\Windows\System\YXprozC.exe
  2⤵
  PID:7696
- C:\Windows\System\HdTHipY.exe
  C:\Windows\System\HdTHipY.exe
  2⤵
  PID:7732
- C:\Windows\System\rHMWZol.exe
  C:\Windows\System\rHMWZol.exe
  2⤵
  PID:7772
- C:\Windows\System\tUFGqPF.exe
  C:\Windows\System\tUFGqPF.exe
  2⤵
  PID:7804
- C:\Windows\System\dwAnFrS.exe
  C:\Windows\System\dwAnFrS.exe
  2⤵
  PID:7836
- C:\Windows\System\CKGgdAE.exe
  C:\Windows\System\CKGgdAE.exe
  2⤵
  PID:7868
- C:\Windows\System\FIKVlkE.exe
  C:\Windows\System\FIKVlkE.exe
  2⤵
  PID:7892
- C:\Windows\System\huTIflg.exe
  C:\Windows\System\huTIflg.exe
  2⤵
  PID:7924
- C:\Windows\System\QcqlKzZ.exe
  C:\Windows\System\QcqlKzZ.exe
  2⤵
  PID:7952
- C:\Windows\System\EzhGWTy.exe
  C:\Windows\System\EzhGWTy.exe
  2⤵
  PID:7976
- C:\Windows\System\ssHUYCC.exe
  C:\Windows\System\ssHUYCC.exe
  2⤵
  PID:7992
- C:\Windows\System\JVuzqPY.exe
  C:\Windows\System\JVuzqPY.exe
  2⤵
  PID:8020
- C:\Windows\System\XpbWhUC.exe
  C:\Windows\System\XpbWhUC.exe
  2⤵
  PID:8048
- C:\Windows\System\rOvSGYe.exe
  C:\Windows\System\rOvSGYe.exe
  2⤵
  PID:8076
- C:\Windows\System\UBdGAmy.exe
  C:\Windows\System\UBdGAmy.exe
  2⤵
  PID:8108
- C:\Windows\System\IzOKoGU.exe
  C:\Windows\System\IzOKoGU.exe
  2⤵
  PID:8132
- C:\Windows\System\deBUJeF.exe
  C:\Windows\System\deBUJeF.exe
  2⤵
  PID:8160
- C:\Windows\System\UyOFyUH.exe
  C:\Windows\System\UyOFyUH.exe
  2⤵
  PID:7100
- C:\Windows\System\BvIackI.exe
  C:\Windows\System\BvIackI.exe
  2⤵
  PID:7212
- C:\Windows\System\VKBnZeE.exe
  C:\Windows\System\VKBnZeE.exe
  2⤵
  PID:7308
- C:\Windows\System\gAMCDrk.exe
  C:\Windows\System\gAMCDrk.exe
  2⤵
  PID:6196
- C:\Windows\System\OkMjwBf.exe
  C:\Windows\System\OkMjwBf.exe
  2⤵
  PID:7436
- C:\Windows\System\QXxUmkv.exe
  C:\Windows\System\QXxUmkv.exe
  2⤵
  PID:7492
- C:\Windows\System\hSvGPBU.exe
  C:\Windows\System\hSvGPBU.exe
  2⤵
  PID:7580
- C:\Windows\System\MygYomn.exe
  C:\Windows\System\MygYomn.exe
  2⤵
  PID:7572
- C:\Windows\System\LEdhDYj.exe
  C:\Windows\System\LEdhDYj.exe
  2⤵
  PID:7688
- C:\Windows\System\iqnHPIp.exe
  C:\Windows\System\iqnHPIp.exe
  2⤵
  PID:7724
- C:\Windows\System\DNVdbpB.exe
  C:\Windows\System\DNVdbpB.exe
  2⤵
  PID:7740
- C:\Windows\System\srKdbFC.exe
  C:\Windows\System\srKdbFC.exe
  2⤵
  PID:7852
- C:\Windows\System\btIBQlS.exe
  C:\Windows\System\btIBQlS.exe
  2⤵
  PID:7960
- C:\Windows\System\Ihmydpg.exe
  C:\Windows\System\Ihmydpg.exe
  2⤵
  PID:7988
- C:\Windows\System\aWyQiol.exe
  C:\Windows\System\aWyQiol.exe
  2⤵
  PID:8060
- C:\Windows\System\uUhjtcb.exe
  C:\Windows\System\uUhjtcb.exe
  2⤵
  PID:8124
- C:\Windows\System\LEVsfnN.exe
  C:\Windows\System\LEVsfnN.exe
  2⤵
  PID:8176
- C:\Windows\System\wkFstae.exe
  C:\Windows\System\wkFstae.exe
  2⤵
  PID:7264
- C:\Windows\System\cXoUlqm.exe
  C:\Windows\System\cXoUlqm.exe
  2⤵
  PID:7368
- C:\Windows\System\okvqPlP.exe
  C:\Windows\System\okvqPlP.exe
  2⤵
  PID:7612
- C:\Windows\System\LmzafdC.exe
  C:\Windows\System\LmzafdC.exe
  2⤵
  PID:7764
- C:\Windows\System\fPKJqap.exe
  C:\Windows\System\fPKJqap.exe
  2⤵
  PID:7916
- C:\Windows\System\VqbmAZa.exe
  C:\Windows\System\VqbmAZa.exe
  2⤵
  PID:8172
- C:\Windows\System\DQVBnFg.exe
  C:\Windows\System\DQVBnFg.exe
  2⤵
  PID:7524
- C:\Windows\System\nPRbzbj.exe
  C:\Windows\System\nPRbzbj.exe
  2⤵
  PID:7540
- C:\Windows\System\fGsiTqm.exe
  C:\Windows\System\fGsiTqm.exe
  2⤵
  PID:7888
- C:\Windows\System\zEBTQNz.exe
  C:\Windows\System\zEBTQNz.exe
  2⤵
  PID:7544
- C:\Windows\System\WLlaWHB.exe
  C:\Windows\System\WLlaWHB.exe
  2⤵
  PID:8196
- C:\Windows\System\asToUpG.exe
  C:\Windows\System\asToUpG.exe
  2⤵
  PID:8228
- C:\Windows\System\ntyLzMV.exe
  C:\Windows\System\ntyLzMV.exe
  2⤵
  PID:8256
- C:\Windows\System\FeBINIQ.exe
  C:\Windows\System\FeBINIQ.exe
  2⤵
  PID:8280
- C:\Windows\System\zNSouNK.exe
  C:\Windows\System\zNSouNK.exe
  2⤵
  PID:8296
- C:\Windows\System\XVpJUfx.exe
  C:\Windows\System\XVpJUfx.exe
  2⤵
  PID:8324
- C:\Windows\System\fzVmVVg.exe
  C:\Windows\System\fzVmVVg.exe
  2⤵
  PID:8356
- C:\Windows\System\ikjaPNA.exe
  C:\Windows\System\ikjaPNA.exe
  2⤵
  PID:8372
- C:\Windows\System\SqPLmcj.exe
  C:\Windows\System\SqPLmcj.exe
  2⤵
  PID:8396
- C:\Windows\System\PeooaGr.exe
  C:\Windows\System\PeooaGr.exe
  2⤵
  PID:8428
- C:\Windows\System\HUdkSuD.exe
  C:\Windows\System\HUdkSuD.exe
  2⤵
  PID:8452
- C:\Windows\System\sggSZwW.exe
  C:\Windows\System\sggSZwW.exe
  2⤵
  PID:8476
- C:\Windows\System\nfFSGZq.exe
  C:\Windows\System\nfFSGZq.exe
  2⤵
  PID:8500
- C:\Windows\System\VqeCgXN.exe
  C:\Windows\System\VqeCgXN.exe
  2⤵
  PID:8524
- C:\Windows\System\kQwhwQZ.exe
  C:\Windows\System\kQwhwQZ.exe
  2⤵
  PID:8548
- C:\Windows\System\JrfBziu.exe
  C:\Windows\System\JrfBziu.exe
  2⤵
  PID:8584
- C:\Windows\System\MHWgWQX.exe
  C:\Windows\System\MHWgWQX.exe
  2⤵
  PID:8616
- C:\Windows\System\iVAhDRm.exe
  C:\Windows\System\iVAhDRm.exe
  2⤵
  PID:8644
- C:\Windows\System\NLBvYpY.exe
  C:\Windows\System\NLBvYpY.exe
  2⤵
  PID:8668
- C:\Windows\System\caufNYq.exe
  C:\Windows\System\caufNYq.exe
  2⤵
  PID:8704
- C:\Windows\System\JmYfDCy.exe
  C:\Windows\System\JmYfDCy.exe
  2⤵
  PID:8732
- C:\Windows\System\CEBQmZr.exe
  C:\Windows\System\CEBQmZr.exe
  2⤵
  PID:8760
- C:\Windows\System\OAetTFF.exe
  C:\Windows\System\OAetTFF.exe
  2⤵
  PID:8788
- C:\Windows\System\wBgBHlq.exe
  C:\Windows\System\wBgBHlq.exe
  2⤵
  PID:8812
- C:\Windows\System\aavcbqu.exe
  C:\Windows\System\aavcbqu.exe
  2⤵
  PID:8848
- C:\Windows\System\demoscb.exe
  C:\Windows\System\demoscb.exe
  2⤵
  PID:8868
- C:\Windows\System\vOVQtBu.exe
  C:\Windows\System\vOVQtBu.exe
  2⤵
  PID:8892
- C:\Windows\System\CsqlNCJ.exe
  C:\Windows\System\CsqlNCJ.exe
  2⤵
  PID:8920
- C:\Windows\System\KbKebXV.exe
  C:\Windows\System\KbKebXV.exe
  2⤵
  PID:8960
- C:\Windows\System\HVXPEzI.exe
  C:\Windows\System\HVXPEzI.exe
  2⤵
  PID:8988
- C:\Windows\System\ALQvcRx.exe
  C:\Windows\System\ALQvcRx.exe
  2⤵
  PID:9016
- C:\Windows\System\TyrCTna.exe
  C:\Windows\System\TyrCTna.exe
  2⤵
  PID:9048
- C:\Windows\System\YYINdLr.exe
  C:\Windows\System\YYINdLr.exe
  2⤵
  PID:9080
- C:\Windows\System\VanNxSF.exe
  C:\Windows\System\VanNxSF.exe
  2⤵
  PID:9108
- C:\Windows\System\bEBCLld.exe
  C:\Windows\System\bEBCLld.exe
  2⤵
  PID:9136
- C:\Windows\System\ZgAMbKD.exe
  C:\Windows\System\ZgAMbKD.exe
  2⤵
  PID:9164
- C:\Windows\System\ibdiKwk.exe
  C:\Windows\System\ibdiKwk.exe
  2⤵
  PID:9192
- C:\Windows\System\AfFFWlW.exe
  C:\Windows\System\AfFFWlW.exe
  2⤵
  PID:9212
- C:\Windows\System\EgNXAAq.exe
  C:\Windows\System\EgNXAAq.exe
  2⤵
  PID:8216
- C:\Windows\System\yKlIyRh.exe
  C:\Windows\System\yKlIyRh.exe
  2⤵
  PID:8308
- C:\Windows\System\FlPlwSK.exe
  C:\Windows\System\FlPlwSK.exe
  2⤵
  PID:8392
- C:\Windows\System\iXvPWyl.exe
  C:\Windows\System\iXvPWyl.exe
  2⤵
  PID:8416
- C:\Windows\System\CUaCyuu.exe
  C:\Windows\System\CUaCyuu.exe
  2⤵
  PID:8440
- C:\Windows\System\MPVZqWb.exe
  C:\Windows\System\MPVZqWb.exe
  2⤵
  PID:8496
- C:\Windows\System\cpOcRqX.exe
  C:\Windows\System\cpOcRqX.exe
  2⤵
  PID:8608
- C:\Windows\System\fBMPIMo.exe
  C:\Windows\System\fBMPIMo.exe
  2⤵
  PID:8628
- C:\Windows\System\oDOLphY.exe
  C:\Windows\System\oDOLphY.exe
  2⤵
  PID:8632
- C:\Windows\System\fPNDZVR.exe
  C:\Windows\System\fPNDZVR.exe
  2⤵
  PID:8768
- C:\Windows\System\CmAEiWf.exe
  C:\Windows\System\CmAEiWf.exe
  2⤵
  PID:8752
- C:\Windows\System\QEvSUXj.exe
  C:\Windows\System\QEvSUXj.exe
  2⤵
  PID:8860
- C:\Windows\System\eWLpmra.exe
  C:\Windows\System\eWLpmra.exe
  2⤵
  PID:8944
- C:\Windows\System\TDAdXlD.exe
  C:\Windows\System\TDAdXlD.exe
  2⤵
  PID:8984
- C:\Windows\System\ymfwnSH.exe
  C:\Windows\System\ymfwnSH.exe
  2⤵
  PID:9036
- C:\Windows\System\jLEIWxC.exe
  C:\Windows\System\jLEIWxC.exe
  2⤵
  PID:9120
- C:\Windows\System\MhQBFgA.exe
  C:\Windows\System\MhQBFgA.exe
  2⤵
  PID:8240
- C:\Windows\System\VdUKsXp.exe
  C:\Windows\System\VdUKsXp.exe
  2⤵
  PID:8344
- C:\Windows\System\Ufprwua.exe
  C:\Windows\System\Ufprwua.exe
  2⤵
  PID:8560
- C:\Windows\System\xeFrhog.exe
  C:\Windows\System\xeFrhog.exe
  2⤵
  PID:8696
- C:\Windows\System\pdvgAyV.exe
  C:\Windows\System\pdvgAyV.exe
  2⤵
  PID:8680
- C:\Windows\System\dUfBfXJ.exe
  C:\Windows\System\dUfBfXJ.exe
  2⤵
  PID:8956
- C:\Windows\System\SxnZCPi.exe
  C:\Windows\System\SxnZCPi.exe
  2⤵
  PID:9124
- C:\Windows\System\tUCCpAi.exe
  C:\Windows\System\tUCCpAi.exe
  2⤵
  PID:8364
- C:\Windows\System\JjvNvwJ.exe
  C:\Windows\System\JjvNvwJ.exe
  2⤵
  PID:8712
- C:\Windows\System\oImPVcO.exe
  C:\Windows\System\oImPVcO.exe
  2⤵
  PID:9204
- C:\Windows\System\nBjLeMM.exe
  C:\Windows\System\nBjLeMM.exe
  2⤵
  PID:9224
- C:\Windows\System\oQfigIy.exe
  C:\Windows\System\oQfigIy.exe
  2⤵
  PID:9256
- C:\Windows\System\QeekyrF.exe
  C:\Windows\System\QeekyrF.exe
  2⤵
  PID:9284
- C:\Windows\System\gphufwH.exe
  C:\Windows\System\gphufwH.exe
  2⤵
  PID:9316
- C:\Windows\System\bVyLnuW.exe
  C:\Windows\System\bVyLnuW.exe
  2⤵
  PID:9336
- C:\Windows\System\xgSgfBC.exe
  C:\Windows\System\xgSgfBC.exe
  2⤵
  PID:9364
- C:\Windows\System\ODXhHOY.exe
  C:\Windows\System\ODXhHOY.exe
  2⤵
  PID:9400
- C:\Windows\System\AwCKGaL.exe
  C:\Windows\System\AwCKGaL.exe
  2⤵
  PID:9444
- C:\Windows\System\aFhPhZB.exe
  C:\Windows\System\aFhPhZB.exe
  2⤵
  PID:9472
- C:\Windows\System\tiCMHhJ.exe
  C:\Windows\System\tiCMHhJ.exe
  2⤵
  PID:9504
- C:\Windows\System\benKAFE.exe
  C:\Windows\System\benKAFE.exe
  2⤵
  PID:9520
- C:\Windows\System\kpbkaJu.exe
  C:\Windows\System\kpbkaJu.exe
  2⤵
  PID:9536
- C:\Windows\System\HHdZJTh.exe
  C:\Windows\System\HHdZJTh.exe
  2⤵
  PID:9564
- C:\Windows\System\AFpidWq.exe
  C:\Windows\System\AFpidWq.exe
  2⤵
  PID:9592
- C:\Windows\System\BXSFlcQ.exe
  C:\Windows\System\BXSFlcQ.exe
  2⤵
  PID:9628
- C:\Windows\System\FMvZFuy.exe
  C:\Windows\System\FMvZFuy.exe
  2⤵
  PID:9652
- C:\Windows\System\GKghaeZ.exe
  C:\Windows\System\GKghaeZ.exe
  2⤵
  PID:9680
- C:\Windows\System\wEIldDw.exe
  C:\Windows\System\wEIldDw.exe
  2⤵
  PID:9712
- C:\Windows\System\Xiaziiv.exe
  C:\Windows\System\Xiaziiv.exe
  2⤵
  PID:9740
- C:\Windows\System\jxXQafg.exe
  C:\Windows\System\jxXQafg.exe
  2⤵
  PID:9768
- C:\Windows\System\YbeiBBe.exe
  C:\Windows\System\YbeiBBe.exe
  2⤵
  PID:9800
- C:\Windows\System\TYeEbCv.exe
  C:\Windows\System\TYeEbCv.exe
  2⤵
  PID:9824
- C:\Windows\System\OGCdEjZ.exe
  C:\Windows\System\OGCdEjZ.exe
  2⤵
  PID:9848
- C:\Windows\System\qXKOUIr.exe
  C:\Windows\System\qXKOUIr.exe
  2⤵
  PID:9884
- C:\Windows\System\UnPJvWR.exe
  C:\Windows\System\UnPJvWR.exe
  2⤵
  PID:9916
- C:\Windows\System\ZsCpaSp.exe
  C:\Windows\System\ZsCpaSp.exe
  2⤵
  PID:9948
- C:\Windows\System\etHzxjW.exe
  C:\Windows\System\etHzxjW.exe
  2⤵
  PID:9972
- C:\Windows\System\ayyuJlW.exe
  C:\Windows\System\ayyuJlW.exe
  2⤵
  PID:10004
- C:\Windows\System\mdtSsaK.exe
  C:\Windows\System\mdtSsaK.exe
  2⤵
  PID:10040
- C:\Windows\System\chEniQw.exe
  C:\Windows\System\chEniQw.exe
  2⤵
  PID:10068
- C:\Windows\System\VWaxbuK.exe
  C:\Windows\System\VWaxbuK.exe
  2⤵
  PID:10092
- C:\Windows\System\KpbTMGV.exe
  C:\Windows\System\KpbTMGV.exe
  2⤵
  PID:10120
- C:\Windows\System\ZBOsqUL.exe
  C:\Windows\System\ZBOsqUL.exe
  2⤵
  PID:10148
- C:\Windows\System\vCQtmaT.exe
  C:\Windows\System\vCQtmaT.exe
  2⤵
  PID:10176
- C:\Windows\System\LcJxlgV.exe
  C:\Windows\System\LcJxlgV.exe
  2⤵
  PID:10220
- C:\Windows\System\WkGehMV.exe
  C:\Windows\System\WkGehMV.exe
  2⤵
  PID:8876
- C:\Windows\System\WaIPMhU.exe
  C:\Windows\System\WaIPMhU.exe
  2⤵
  PID:9244
- C:\Windows\System\iXEcTZe.exe
  C:\Windows\System\iXEcTZe.exe
  2⤵
  PID:9280
- C:\Windows\System\nsoICGk.exe
  C:\Windows\System\nsoICGk.exe
  2⤵
  PID:9348
- C:\Windows\System\BXFYXru.exe
  C:\Windows\System\BXFYXru.exe
  2⤵
  PID:9388
- C:\Windows\System\XCoZbus.exe
  C:\Windows\System\XCoZbus.exe
  2⤵
  PID:9468
- C:\Windows\System\mpYfSYe.exe
  C:\Windows\System\mpYfSYe.exe
  2⤵
  PID:9528
- C:\Windows\System\fimIajy.exe
  C:\Windows\System\fimIajy.exe
  2⤵
  PID:9640
- C:\Windows\System\XHJNIAh.exe
  C:\Windows\System\XHJNIAh.exe
  2⤵
  PID:9584
- C:\Windows\System\JGDqJhA.exe
  C:\Windows\System\JGDqJhA.exe
  2⤵
  PID:9736
- C:\Windows\System\wnBUhfn.exe
  C:\Windows\System\wnBUhfn.exe
  2⤵
  PID:9788
- C:\Windows\System\jcavEMD.exe
  C:\Windows\System\jcavEMD.exe
  2⤵
  PID:9876
- C:\Windows\System\mSwUbRp.exe
  C:\Windows\System\mSwUbRp.exe
  2⤵
  PID:9944
- C:\Windows\System\xNrbPJf.exe
  C:\Windows\System\xNrbPJf.exe
  2⤵
  PID:10024
- C:\Windows\System\ZzvcKuq.exe
  C:\Windows\System\ZzvcKuq.exe
  2⤵
  PID:10080
- C:\Windows\System\HQYNDkR.exe
  C:\Windows\System\HQYNDkR.exe
  2⤵
  PID:10132
- C:\Windows\System\zkPTHvk.exe
  C:\Windows\System\zkPTHvk.exe
  2⤵
  PID:10232
- C:\Windows\System\VdtRBRM.exe
  C:\Windows\System\VdtRBRM.exe
  2⤵
  PID:10216
- C:\Windows\System\Noardrp.exe
  C:\Windows\System\Noardrp.exe
  2⤵
  PID:9432
- C:\Windows\System\pyEPDLB.exe
  C:\Windows\System\pyEPDLB.exe
  2⤵
  PID:9612
- C:\Windows\System\jAsjHzd.exe
  C:\Windows\System\jAsjHzd.exe
  2⤵
  PID:9836
- C:\Windows\System\TmMwkhx.exe
  C:\Windows\System\TmMwkhx.exe
  2⤵
  PID:10032
- C:\Windows\System\vLgsWde.exe
  C:\Windows\System\vLgsWde.exe
  2⤵
  PID:10140
- C:\Windows\System\KtjaHpP.exe
  C:\Windows\System\KtjaHpP.exe
  2⤵
  PID:9304
- C:\Windows\System\RtgJgSD.exe
  C:\Windows\System\RtgJgSD.exe
  2⤵
  PID:9696
- C:\Windows\System\jTsQQAB.exe
  C:\Windows\System\jTsQQAB.exe
  2⤵
  PID:9968
- C:\Windows\System\ZebeHwy.exe
  C:\Windows\System\ZebeHwy.exe
  2⤵
  PID:10108
- C:\Windows\System\sIMEBrm.exe
  C:\Windows\System\sIMEBrm.exe
  2⤵
  PID:9808
- C:\Windows\System\ThSJPXx.exe
  C:\Windows\System\ThSJPXx.exe
  2⤵
  PID:10260
- C:\Windows\System\wSBldJS.exe
  C:\Windows\System\wSBldJS.exe
  2⤵
  PID:10276
- C:\Windows\System\yAxkeAq.exe
  C:\Windows\System\yAxkeAq.exe
  2⤵
  PID:10312
- C:\Windows\System\EFhxYxF.exe
  C:\Windows\System\EFhxYxF.exe
  2⤵
  PID:10340
- C:\Windows\System\WLPlgJw.exe
  C:\Windows\System\WLPlgJw.exe
  2⤵
  PID:10372
- C:\Windows\System\GrsVYoC.exe
  C:\Windows\System\GrsVYoC.exe
  2⤵
  PID:10400
- C:\Windows\System\ccHyqbl.exe
  C:\Windows\System\ccHyqbl.exe
  2⤵
  PID:10428
- C:\Windows\System\ZzHFihz.exe
  C:\Windows\System\ZzHFihz.exe
  2⤵
  PID:10456
- C:\Windows\System\cLrBlqH.exe
  C:\Windows\System\cLrBlqH.exe
  2⤵
  PID:10480
- C:\Windows\System\lEckvlX.exe
  C:\Windows\System\lEckvlX.exe
  2⤵
  PID:10500
- C:\Windows\System\fXOdSjd.exe
  C:\Windows\System\fXOdSjd.exe
  2⤵
  PID:10528
- C:\Windows\System\xRJnaUC.exe
  C:\Windows\System\xRJnaUC.exe
  2⤵
  PID:10572
- C:\Windows\System\vpHyYMe.exe
  C:\Windows\System\vpHyYMe.exe
  2⤵
  PID:10600
- C:\Windows\System\ahDzvEE.exe
  C:\Windows\System\ahDzvEE.exe
  2⤵
  PID:10620
- C:\Windows\System\AuekSqW.exe
  C:\Windows\System\AuekSqW.exe
  2⤵
  PID:10652
- C:\Windows\System\miBxDee.exe
  C:\Windows\System\miBxDee.exe
  2⤵
  PID:10688
- C:\Windows\System\eKGDDCH.exe
  C:\Windows\System\eKGDDCH.exe
  2⤵
  PID:10712
- C:\Windows\System\thcjUVP.exe
  C:\Windows\System\thcjUVP.exe
  2⤵
  PID:10740
- C:\Windows\System\xDxNYnl.exe
  C:\Windows\System\xDxNYnl.exe
  2⤵
  PID:10768
- C:\Windows\System\jXVNHUe.exe
  C:\Windows\System\jXVNHUe.exe
  2⤵
  PID:10792
- C:\Windows\System\pHIyBdQ.exe
  C:\Windows\System\pHIyBdQ.exe
  2⤵
  PID:10824
- C:\Windows\System\NtMwkms.exe
  C:\Windows\System\NtMwkms.exe
  2⤵
  PID:10852
- C:\Windows\System\GBGuoVg.exe
  C:\Windows\System\GBGuoVg.exe
  2⤵
  PID:10888
- C:\Windows\System\HzyBLvU.exe
  C:\Windows\System\HzyBLvU.exe
  2⤵
  PID:10904
- C:\Windows\System\xDWJiul.exe
  C:\Windows\System\xDWJiul.exe
  2⤵
  PID:10932
- C:\Windows\System\NgoSqwH.exe
  C:\Windows\System\NgoSqwH.exe
  2⤵
  PID:10968
- C:\Windows\System\VaQrBSa.exe
  C:\Windows\System\VaQrBSa.exe
  2⤵
  PID:11000
- C:\Windows\System\UdhohsG.exe
  C:\Windows\System\UdhohsG.exe
  2⤵
  PID:11024
- C:\Windows\System\HnIYTZJ.exe
  C:\Windows\System\HnIYTZJ.exe
  2⤵
  PID:11056
- C:\Windows\System\xAnYwlI.exe
  C:\Windows\System\xAnYwlI.exe
  2⤵
  PID:11084
- C:\Windows\System\fPsBwsE.exe
  C:\Windows\System\fPsBwsE.exe
  2⤵
  PID:11108
- C:\Windows\System\OZxNksH.exe
  C:\Windows\System\OZxNksH.exe
  2⤵
  PID:11140
- C:\Windows\System\FJLjhYW.exe
  C:\Windows\System\FJLjhYW.exe
  2⤵
  PID:11168
- C:\Windows\System\HDNEajP.exe
  C:\Windows\System\HDNEajP.exe
  2⤵
  PID:11192
- C:\Windows\System\xCKytDD.exe
  C:\Windows\System\xCKytDD.exe
  2⤵
  PID:11224
- C:\Windows\System\atHrXCh.exe
  C:\Windows\System\atHrXCh.exe
  2⤵
  PID:11240
- C:\Windows\System\eJOVokS.exe
  C:\Windows\System\eJOVokS.exe
  2⤵
  PID:8544
- C:\Windows\System\YfSuJOw.exe
  C:\Windows\System\YfSuJOw.exe
  2⤵
  PID:10252
- C:\Windows\System\LLKJgBj.exe
  C:\Windows\System\LLKJgBj.exe
  2⤵
  PID:10360
- C:\Windows\System\WcAzTqo.exe
  C:\Windows\System\WcAzTqo.exe
  2⤵
  PID:10412
- C:\Windows\System\yvDOJhF.exe
  C:\Windows\System\yvDOJhF.exe
  2⤵
  PID:10424
- C:\Windows\System\RDZeMdt.exe
  C:\Windows\System\RDZeMdt.exe
  2⤵
  PID:10524
- C:\Windows\System\mviYkZW.exe
  C:\Windows\System\mviYkZW.exe
  2⤵
  PID:10544
- C:\Windows\System\juZrCke.exe
  C:\Windows\System\juZrCke.exe
  2⤵
  PID:10680
- C:\Windows\System\DjlZvYa.exe
  C:\Windows\System\DjlZvYa.exe
  2⤵
  PID:10748
- C:\Windows\System\tEDDyQW.exe
  C:\Windows\System\tEDDyQW.exe
  2⤵
  PID:10784
- C:\Windows\System\MLOASaG.exe
  C:\Windows\System\MLOASaG.exe
  2⤵
  PID:10816
- C:\Windows\System\mtczCZh.exe
  C:\Windows\System\mtczCZh.exe
  2⤵
  PID:10916
- C:\Windows\System\yzzbdFv.exe
  C:\Windows\System\yzzbdFv.exe
  2⤵
  PID:10980
- C:\Windows\System\bzwsylb.exe
  C:\Windows\System\bzwsylb.exe
  2⤵
  PID:11072
- C:\Windows\System\jlcXbXh.exe
  C:\Windows\System\jlcXbXh.exe
  2⤵
  PID:11160
- C:\Windows\System\LMTJFBx.exe
  C:\Windows\System\LMTJFBx.exe
  2⤵
  PID:11204
- C:\Windows\System\YgTlCXs.exe
  C:\Windows\System\YgTlCXs.exe
  2⤵
  PID:9184
- C:\Windows\System\NWewgGS.exe
  C:\Windows\System\NWewgGS.exe
  2⤵
  PID:10296
- C:\Windows\System\lCMlAhg.exe
  C:\Windows\System\lCMlAhg.exe
  2⤵
  PID:10516
- C:\Windows\System\ljtCvMa.exe
  C:\Windows\System\ljtCvMa.exe
  2⤵
  PID:10588
- C:\Windows\System\QhemTnS.exe
  C:\Windows\System\QhemTnS.exe
  2⤵
  PID:10612
- C:\Windows\System\PMoWCST.exe
  C:\Windows\System\PMoWCST.exe
  2⤵
  PID:10836
- C:\Windows\System\lPgatgH.exe
  C:\Windows\System\lPgatgH.exe
  2⤵
  PID:10896
- C:\Windows\System\YmCiFMa.exe
  C:\Windows\System\YmCiFMa.exe
  2⤵
  PID:11104
- C:\Windows\System\iaeJzDI.exe
  C:\Windows\System\iaeJzDI.exe
  2⤵
  PID:10364
- C:\Windows\System\qHQSDlq.exe
  C:\Windows\System\qHQSDlq.exe
  2⤵
  PID:10552
- C:\Windows\System\fOzKdkf.exe
  C:\Windows\System\fOzKdkf.exe
  2⤵
  PID:10584
- C:\Windows\System\vNKYJkr.exe
  C:\Windows\System\vNKYJkr.exe
  2⤵
  PID:11188
- C:\Windows\System\kchqYGG.exe
  C:\Windows\System\kchqYGG.exe
  2⤵
  PID:11296
- C:\Windows\System\yLpPVZr.exe
  C:\Windows\System\yLpPVZr.exe
  2⤵
  PID:11320
- C:\Windows\System\xrDvaeQ.exe
  C:\Windows\System\xrDvaeQ.exe
  2⤵
  PID:11348
- C:\Windows\System\NdLcDzy.exe
  C:\Windows\System\NdLcDzy.exe
  2⤵
  PID:11372
- C:\Windows\System\ZtBUzbt.exe
  C:\Windows\System\ZtBUzbt.exe
  2⤵
  PID:11396
- C:\Windows\System\faqGWEz.exe
  C:\Windows\System\faqGWEz.exe
  2⤵
  PID:11420
- C:\Windows\System\KiyadBN.exe
  C:\Windows\System\KiyadBN.exe
  2⤵
  PID:11448
- C:\Windows\System\ZHfpgJi.exe
  C:\Windows\System\ZHfpgJi.exe
  2⤵
  PID:11480
- C:\Windows\System\aDjDtWg.exe
  C:\Windows\System\aDjDtWg.exe
  2⤵
  PID:11504
- C:\Windows\System\tDEJImn.exe
  C:\Windows\System\tDEJImn.exe
  2⤵
  PID:11528
- C:\Windows\System\BDeiDWR.exe
  C:\Windows\System\BDeiDWR.exe
  2⤵
  PID:11556
- C:\Windows\System\dCiaNva.exe
  C:\Windows\System\dCiaNva.exe
  2⤵
  PID:11588
- C:\Windows\System\zdcExsl.exe
  C:\Windows\System\zdcExsl.exe
  2⤵
  PID:11608
- C:\Windows\System\fMRbKNV.exe
  C:\Windows\System\fMRbKNV.exe
  2⤵
  PID:11644
- C:\Windows\System\zlKlnYW.exe
  C:\Windows\System\zlKlnYW.exe
  2⤵
  PID:11676
- C:\Windows\System\roJWQVL.exe
  C:\Windows\System\roJWQVL.exe
  2⤵
  PID:11708
- C:\Windows\System\WhccWdV.exe
  C:\Windows\System\WhccWdV.exe
  2⤵
  PID:11728
- C:\Windows\System\bDlJgmz.exe
  C:\Windows\System\bDlJgmz.exe
  2⤵
  PID:11768
- C:\Windows\System\epqaKQF.exe
  C:\Windows\System\epqaKQF.exe
  2⤵
  PID:11792
- C:\Windows\System\GCotMhr.exe
  C:\Windows\System\GCotMhr.exe
  2⤵
  PID:11824
- C:\Windows\System\MpXAiMk.exe
  C:\Windows\System\MpXAiMk.exe
  2⤵
  PID:11856
- C:\Windows\System\skwgeYP.exe
  C:\Windows\System\skwgeYP.exe
  2⤵
  PID:11892
- C:\Windows\System\boJAJFS.exe
  C:\Windows\System\boJAJFS.exe
  2⤵
  PID:11932
- C:\Windows\System\rocSdhq.exe
  C:\Windows\System\rocSdhq.exe
  2⤵
  PID:11960
- C:\Windows\System\fRjMTPN.exe
  C:\Windows\System\fRjMTPN.exe
  2⤵
  PID:11976
- C:\Windows\System\jQmYTzA.exe
  C:\Windows\System\jQmYTzA.exe
  2⤵
  PID:11992
- C:\Windows\System\OYOlXjb.exe
  C:\Windows\System\OYOlXjb.exe
  2⤵
  PID:12032
- C:\Windows\System\IkdsFII.exe
  C:\Windows\System\IkdsFII.exe
  2⤵
  PID:12060
- C:\Windows\System\bXefTXU.exe
  C:\Windows\System\bXefTXU.exe
  2⤵
  PID:12088
- C:\Windows\System\JsZJFIf.exe
  C:\Windows\System\JsZJFIf.exe
  2⤵
  PID:12124
- C:\Windows\System\IGDuKAh.exe
  C:\Windows\System\IGDuKAh.exe
  2⤵
  PID:12144
- C:\Windows\System\rHyBscT.exe
  C:\Windows\System\rHyBscT.exe
  2⤵
  PID:12172
- C:\Windows\System\JjOFXHH.exe
  C:\Windows\System\JjOFXHH.exe
  2⤵
  PID:12196
- C:\Windows\System\YsVdrvh.exe
  C:\Windows\System\YsVdrvh.exe
  2⤵
  PID:12228
- C:\Windows\System\gtNLuqH.exe
  C:\Windows\System\gtNLuqH.exe
  2⤵
  PID:12256
- C:\Windows\System\zFpTWIT.exe
  C:\Windows\System\zFpTWIT.exe
  2⤵
  PID:9928
- C:\Windows\System\rkrxiCu.exe
  C:\Windows\System\rkrxiCu.exe
  2⤵
  PID:11312
- C:\Windows\System\PdbkTWG.exe
  C:\Windows\System\PdbkTWG.exe
  2⤵
  PID:11392
- C:\Windows\System\tefdNgN.exe
  C:\Windows\System\tefdNgN.exe
  2⤵
  PID:11468
- C:\Windows\System\pUhNqzA.exe
  C:\Windows\System\pUhNqzA.exe
  2⤵
  PID:11516
- C:\Windows\System\RAtHWbR.exe
  C:\Windows\System\RAtHWbR.exe
  2⤵
  PID:11520
- C:\Windows\System\mHMcbkl.exe
  C:\Windows\System\mHMcbkl.exe
  2⤵
  PID:11580
- C:\Windows\System\LRRtYqB.exe
  C:\Windows\System\LRRtYqB.exe
  2⤵
  PID:11696
- C:\Windows\System\AUneSxg.exe
  C:\Windows\System\AUneSxg.exe
  2⤵
  PID:11716
- C:\Windows\System\CGbqlpr.exe
  C:\Windows\System\CGbqlpr.exe
  2⤵
  PID:11808
- C:\Windows\System\HsGbDDS.exe
  C:\Windows\System\HsGbDDS.exe
  2⤵
  PID:11864
- C:\Windows\System\VkWfLVP.exe
  C:\Windows\System\VkWfLVP.exe
  2⤵
  PID:11948
- C:\Windows\System\JRTRibR.exe
  C:\Windows\System\JRTRibR.exe
  2⤵
  PID:12028
- C:\Windows\System\hNgRQEp.exe
  C:\Windows\System\hNgRQEp.exe
  2⤵
  PID:12048
- C:\Windows\System\xtlgjmJ.exe
  C:\Windows\System\xtlgjmJ.exe
  2⤵
  PID:12140
- C:\Windows\System\gjfWeNS.exe
  C:\Windows\System\gjfWeNS.exe
  2⤵
  PID:12192
- C:\Windows\System\QqBfeyb.exe
  C:\Windows\System\QqBfeyb.exe
  2⤵
  PID:12240
- C:\Windows\System\BfUjWVj.exe
  C:\Windows\System\BfUjWVj.exe
  2⤵
  PID:11252
- C:\Windows\System\TYatrQl.exe
  C:\Windows\System\TYatrQl.exe
  2⤵
  PID:11336
- C:\Windows\System\DKpufWJ.exe
  C:\Windows\System\DKpufWJ.exe
  2⤵
  PID:11552
- C:\Windows\System\BojttnB.exe
  C:\Windows\System\BojttnB.exe
  2⤵
  PID:11600
- C:\Windows\System\abMjvzQ.exe
  C:\Windows\System\abMjvzQ.exe
  2⤵
  PID:11788
- C:\Windows\System\bDxhZwU.exe
  C:\Windows\System\bDxhZwU.exe
  2⤵
  PID:12056
- C:\Windows\System\fXGsJEL.exe
  C:\Windows\System\fXGsJEL.exe
  2⤵
  PID:12252
- C:\Windows\System\FFUpvOW.exe
  C:\Windows\System\FFUpvOW.exe
  2⤵
  PID:11292
- C:\Windows\System\PyxCQmI.exe
  C:\Windows\System\PyxCQmI.exe
  2⤵
  PID:11488
- C:\Windows\System\oETCWWz.exe
  C:\Windows\System\oETCWWz.exe
  2⤵
  PID:11724
- C:\Windows\System\DAFwHbB.exe
  C:\Windows\System\DAFwHbB.exe
  2⤵
  PID:11364
- C:\Windows\System\aZtUIHu.exe
  C:\Windows\System\aZtUIHu.exe
  2⤵
  PID:12312
- C:\Windows\System\XFgWFIU.exe
  C:\Windows\System\XFgWFIU.exe
  2⤵
  PID:12340
- C:\Windows\System\XcKqsSH.exe
  C:\Windows\System\XcKqsSH.exe
  2⤵
  PID:12364
- C:\Windows\System\riPWVqq.exe
  C:\Windows\System\riPWVqq.exe
  2⤵
  PID:12400
- C:\Windows\System\JjNtJBN.exe
  C:\Windows\System\JjNtJBN.exe
  2⤵
  PID:12424
- C:\Windows\System\QjsMbDZ.exe
  C:\Windows\System\QjsMbDZ.exe
  2⤵
  PID:12464
- C:\Windows\System\qHWlsZK.exe
  C:\Windows\System\qHWlsZK.exe
  2⤵
  PID:12488
- C:\Windows\System\OdIJomd.exe
  C:\Windows\System\OdIJomd.exe
  2⤵
  PID:12520
- C:\Windows\System\gSozgMr.exe
  C:\Windows\System\gSozgMr.exe
  2⤵
  PID:12548
- C:\Windows\System\LtqjNFH.exe
  C:\Windows\System\LtqjNFH.exe
  2⤵
  PID:12572
- C:\Windows\System\dNlnmcT.exe
  C:\Windows\System\dNlnmcT.exe
  2⤵
  PID:12604
- C:\Windows\System\jysfiKr.exe
  C:\Windows\System\jysfiKr.exe
  2⤵
  PID:12624
- C:\Windows\System\fRuDvaK.exe
  C:\Windows\System\fRuDvaK.exe
  2⤵
  PID:12652
- C:\Windows\System\KQfLYWP.exe
  C:\Windows\System\KQfLYWP.exe
  2⤵
  PID:12680
- C:\Windows\System\WVmKVmf.exe
  C:\Windows\System\WVmKVmf.exe
  2⤵
  PID:12712
- C:\Windows\System\jNKpZLz.exe
  C:\Windows\System\jNKpZLz.exe
  2⤵
  PID:12748
- C:\Windows\System\YLeQPmn.exe
  C:\Windows\System\YLeQPmn.exe
  2⤵
  PID:12772
- C:\Windows\System\YSZPkYM.exe
  C:\Windows\System\YSZPkYM.exe
  2⤵
  PID:12800
- C:\Windows\System\iRLEbpH.exe
  C:\Windows\System\iRLEbpH.exe
  2⤵
  PID:12832
- C:\Windows\System\IztYyPs.exe
  C:\Windows\System\IztYyPs.exe
  2⤵
  PID:12864
- C:\Windows\System\WfetmtZ.exe
  C:\Windows\System\WfetmtZ.exe
  2⤵
  PID:12884
- C:\Windows\System\zfTXBIO.exe
  C:\Windows\System\zfTXBIO.exe
  2⤵
  PID:12912
- C:\Windows\System\GaUbhlW.exe
  C:\Windows\System\GaUbhlW.exe
  2⤵
  PID:12940
- C:\Windows\System\KBfjOwN.exe
  C:\Windows\System\KBfjOwN.exe
  2⤵
  PID:12956
- C:\Windows\System\TYyHsZr.exe
  C:\Windows\System\TYyHsZr.exe
  2⤵
  PID:12988
- C:\Windows\System\XwSQJZq.exe
  C:\Windows\System\XwSQJZq.exe
  2⤵
  PID:13016
- C:\Windows\System\ZQynlAR.exe
  C:\Windows\System\ZQynlAR.exe
  2⤵
  PID:13044
- C:\Windows\System\OuqQLyS.exe
  C:\Windows\System\OuqQLyS.exe
  2⤵
  PID:13072
- C:\Windows\System\hftKChS.exe
  C:\Windows\System\hftKChS.exe
  2⤵
  PID:13100
- C:\Windows\System\oMequzu.exe
  C:\Windows\System\oMequzu.exe
  2⤵
  PID:13124
- C:\Windows\System\bbWYCvf.exe
  C:\Windows\System\bbWYCvf.exe
  2⤵
  PID:13156
- C:\Windows\System\POptBjM.exe
  C:\Windows\System\POptBjM.exe
  2⤵
  PID:13180
- C:\Windows\System\IRwmVln.exe
  C:\Windows\System\IRwmVln.exe
  2⤵
  PID:13204
- C:\Windows\System\TLvGEFS.exe
  C:\Windows\System\TLvGEFS.exe
  2⤵
  PID:13240
- C:\Windows\System\SxnGjBH.exe
  C:\Windows\System\SxnGjBH.exe
  2⤵
  PID:13272
- C:\Windows\System\yzBoyvu.exe
  C:\Windows\System\yzBoyvu.exe
  2⤵
  PID:13300
- C:\Windows\System\JlOKNpO.exe
  C:\Windows\System\JlOKNpO.exe
  2⤵
  PID:11460
- C:\Windows\System\YsVFyhi.exe
  C:\Windows\System\YsVFyhi.exe
  2⤵
  PID:12156
- C:\Windows\System\BJckRbS.exe
  C:\Windows\System\BJckRbS.exe
  2⤵
  PID:12412
- C:\Windows\System\GyfPKzJ.exe
  C:\Windows\System\GyfPKzJ.exe
  2⤵
  PID:12448
- C:\Windows\System\FDypvKL.exe
  C:\Windows\System\FDypvKL.exe
  2⤵
  PID:12512
- C:\Windows\System\DOGWYEi.exe
  C:\Windows\System\DOGWYEi.exe
  2⤵
  PID:12584
- C:\Windows\System\QLQWcWV.exe
  C:\Windows\System\QLQWcWV.exe
  2⤵
  PID:12636
- C:\Windows\System\zDBjGGj.exe
  C:\Windows\System\zDBjGGj.exe
  2⤵
  PID:12676
- C:\Windows\System\zbNzHpT.exe
  C:\Windows\System\zbNzHpT.exe
  2⤵
  PID:12664
- C:\Windows\System\mCOoJom.exe
  C:\Windows\System\mCOoJom.exe
  2⤵
  PID:12760
- C:\Windows\System\XWphUxy.exe
  C:\Windows\System\XWphUxy.exe
  2⤵
  PID:12852
- C:\Windows\System\xbNMlLd.exe
  C:\Windows\System\xbNMlLd.exe
  2⤵
  PID:12928
- C:\Windows\System\oJvXETV.exe
  C:\Windows\System\oJvXETV.exe
  2⤵
  PID:12976
- C:\Windows\System\GJFmuDh.exe
  C:\Windows\System\GJFmuDh.exe
  2⤵
  PID:13036
- C:\Windows\System\sKwamay.exe
  C:\Windows\System\sKwamay.exe
  2⤵
  PID:13120
- C:\Windows\System\CVKKLVv.exe
  C:\Windows\System\CVKKLVv.exe
  2⤵
  PID:13224
- C:\Windows\System\TVLDEml.exe
  C:\Windows\System\TVLDEml.exe
  2⤵
  PID:4260
- C:\Windows\System\mPmDYhx.exe
  C:\Windows\System\mPmDYhx.exe
  2⤵
  PID:12336
- C:\Windows\System\QEdiBVS.exe
  C:\Windows\System\QEdiBVS.exe
  2⤵
  PID:12476
- C:\Windows\System\TEYdGPb.exe
  C:\Windows\System\TEYdGPb.exe
  2⤵
  PID:12536
- C:\Windows\System\WkyMZHA.exe
  C:\Windows\System\WkyMZHA.exe
  2⤵
  PID:12700
- C:\Windows\System\DfoDTGP.exe
  C:\Windows\System\DfoDTGP.exe
  2⤵
  PID:12816
- C:\Windows\System\KsLsPgs.exe
  C:\Windows\System\KsLsPgs.exe
  2⤵
  PID:12856
- C:\Windows\System\GCMkoai.exe
  C:\Windows\System\GCMkoai.exe
  2⤵
  PID:12972
- C:\Windows\System\IOpjKok.exe
  C:\Windows\System\IOpjKok.exe
  2⤵
  PID:13268
- C:\Windows\System\rndAEGE.exe
  C:\Windows\System\rndAEGE.exe
  2⤵
  PID:12352
- C:\Windows\System\LgdxZGW.exe
  C:\Windows\System\LgdxZGW.exe
  2⤵
  PID:12732
- C:\Windows\System\ZAvpKis.exe
  C:\Windows\System\ZAvpKis.exe
  2⤵
  PID:12900
- C:\Windows\System\aJpFEDJ.exe
  C:\Windows\System\aJpFEDJ.exe
  2⤵
  PID:13356
- C:\Windows\System\pwVkfZb.exe
  C:\Windows\System\pwVkfZb.exe
  2⤵
  PID:13372
- C:\Windows\System\tJsdtpy.exe
  C:\Windows\System\tJsdtpy.exe
  2⤵
  PID:13392
- C:\Windows\System\qFoOdfe.exe
  C:\Windows\System\qFoOdfe.exe
  2⤵
  PID:13424
- C:\Windows\System\fjhaECQ.exe
  C:\Windows\System\fjhaECQ.exe
  2⤵
  PID:13444
- C:\Windows\System\TkdZqtg.exe
  C:\Windows\System\TkdZqtg.exe
  2⤵
  PID:13472
- C:\Windows\System\DWqzCsK.exe
  C:\Windows\System\DWqzCsK.exe
  2⤵
  PID:13500
- C:\Windows\System\Pmajfff.exe
  C:\Windows\System\Pmajfff.exe
  2⤵
  PID:13528
- C:\Windows\System\gZTNOTb.exe
  C:\Windows\System\gZTNOTb.exe
  2⤵
  PID:13552
- C:\Windows\System\BoduxkS.exe
  C:\Windows\System\BoduxkS.exe
  2⤵
  PID:13580
- C:\Windows\System\xinVKdu.exe
  C:\Windows\System\xinVKdu.exe
  2⤵
  PID:13600
- C:\Windows\System\uKqCsxt.exe
  C:\Windows\System\uKqCsxt.exe
  2⤵
  PID:13620
- C:\Windows\System\EZlcCEE.exe
  C:\Windows\System\EZlcCEE.exe
  2⤵
  PID:13648
- C:\Windows\System\eDKndiU.exe
  C:\Windows\System\eDKndiU.exe
  2⤵
  PID:13684
- C:\Windows\System\DsesQSi.exe
  C:\Windows\System\DsesQSi.exe
  2⤵
  PID:13708
- C:\Windows\System\eXJXeZN.exe
  C:\Windows\System\eXJXeZN.exe
  2⤵
  PID:13744
- C:\Windows\System\ZcZWsZb.exe
  C:\Windows\System\ZcZWsZb.exe
  2⤵
  PID:13760
- C:\Windows\System\gJxBHHZ.exe
  C:\Windows\System\gJxBHHZ.exe
  2⤵
  PID:13776
- C:\Windows\System\werkjty.exe
  C:\Windows\System\werkjty.exe
  2⤵
  PID:13800
- C:\Windows\System\GxJCgQX.exe
  C:\Windows\System\GxJCgQX.exe
  2⤵
  PID:13820
- C:\Windows\System\YZkzwFM.exe
  C:\Windows\System\YZkzwFM.exe
  2⤵
  PID:13836
- C:\Windows\System\CUIbzTU.exe
  C:\Windows\System\CUIbzTU.exe
  2⤵
  PID:13864
- C:\Windows\System\FtCdAuX.exe
  C:\Windows\System\FtCdAuX.exe
  2⤵
  PID:13888
- C:\Windows\System\PPtCjDJ.exe
  C:\Windows\System\PPtCjDJ.exe
  2⤵
  PID:13912
- C:\Windows\System\QAOFFmf.exe
  C:\Windows\System\QAOFFmf.exe
  2⤵
  PID:13936
- C:\Windows\System\lUgALuI.exe
  C:\Windows\System\lUgALuI.exe
  2⤵
  PID:13968
- C:\Windows\System\zsDHqbU.exe
  C:\Windows\System\zsDHqbU.exe
  2⤵
  PID:14004
- C:\Windows\System\OTPfxTZ.exe
  C:\Windows\System\OTPfxTZ.exe
  2⤵
  PID:14032
- C:\Windows\System\ddwXWpm.exe
  C:\Windows\System\ddwXWpm.exe
  2⤵
  PID:14064
- C:\Windows\System\BLLuyoP.exe
  C:\Windows\System\BLLuyoP.exe
  2⤵
  PID:14096
- C:\Windows\System\sbNWrlV.exe
  C:\Windows\System\sbNWrlV.exe
  2⤵
  PID:14124
- C:\Windows\System\pFHzPGo.exe
  C:\Windows\System\pFHzPGo.exe
  2⤵
  PID:14152
- C:\Windows\System\CPaTVYJ.exe
  C:\Windows\System\CPaTVYJ.exe
  2⤵
  PID:14184
- C:\Windows\System\bEESeWh.exe
  C:\Windows\System\bEESeWh.exe
  2⤵
  PID:14204
- C:\Windows\System\YZxoJVH.exe
  C:\Windows\System\YZxoJVH.exe
  2⤵
  PID:14236
- C:\Windows\System\dKzbbpR.exe
  C:\Windows\System\dKzbbpR.exe
  2⤵
  PID:14264
- C:\Windows\System\eUywvWX.exe
  C:\Windows\System\eUywvWX.exe
  2⤵
  PID:14292
- C:\Windows\System\JDEuMlY.exe
  C:\Windows\System\JDEuMlY.exe
  2⤵
  PID:14332
- C:\Windows\System\NmzsPqW.exe
  C:\Windows\System\NmzsPqW.exe
  2⤵
  PID:13348
- C:\Windows\System\psWQQOt.exe
  C:\Windows\System\psWQQOt.exe
  2⤵
  PID:13412
- C:\Windows\System\cCOtuPB.exe
  C:\Windows\System\cCOtuPB.exe
  2⤵
  PID:13436
- C:\Windows\System\iyWJetA.exe
  C:\Windows\System\iyWJetA.exe
  2⤵
  PID:13512
- C:\Windows\System\qbFQUxf.exe
  C:\Windows\System\qbFQUxf.exe
  2⤵
  PID:13588
- C:\Windows\System\bYTmXfx.exe
  C:\Windows\System\bYTmXfx.exe
  2⤵
  PID:13644
- C:\Windows\System\FoZejtj.exe
  C:\Windows\System\FoZejtj.exe
  2⤵
  PID:13736
- C:\Windows\System\yMyuXJF.exe
  C:\Windows\System\yMyuXJF.exe
  2⤵
  PID:13808
- C:\Windows\System\xxaiVnc.exe
  C:\Windows\System\xxaiVnc.exe
  2⤵
  PID:13832
- C:\Windows\System\HIYDqVM.exe
  C:\Windows\System\HIYDqVM.exe
  2⤵
  PID:13896
- C:\Windows\System\YoApAok.exe
  C:\Windows\System\YoApAok.exe
  2⤵
  PID:14000
- C:\Windows\System\VfRJtlW.exe
  C:\Windows\System\VfRJtlW.exe
  2⤵
  PID:14176
- C:\Windows\System\Pgwowjb.exe
  C:\Windows\System\Pgwowjb.exe
  2⤵
  PID:14088
- C:\Windows\System\YGDrOmX.exe
  C:\Windows\System\YGDrOmX.exe
  2⤵
  PID:14160
- C:\Windows\System\xWkWuOd.exe
  C:\Windows\System\xWkWuOd.exe
  2⤵
  PID:14200
- C:\Windows\System\TSGrByb.exe
  C:\Windows\System\TSGrByb.exe
  2⤵
  PID:13320
- C:\Windows\System\iqHMIRb.exe
  C:\Windows\System\iqHMIRb.exe
  2⤵
  PID:13420
- C:\Windows\System\ebfjBrB.exe
  C:\Windows\System\ebfjBrB.exe
  2⤵
  PID:13728
- C:\Windows\System\mLXVQNt.exe
  C:\Windows\System\mLXVQNt.exe
  2⤵
  PID:13636
- C:\Windows\System\SUcWyQX.exe
  C:\Windows\System\SUcWyQX.exe
  2⤵
  PID:14020
- C:\Windows\System\zOewXVr.exe
  C:\Windows\System\zOewXVr.exe
  2⤵
  PID:14232
- C:\Windows\System\wNwXhBs.exe
  C:\Windows\System\wNwXhBs.exe
  2⤵
  PID:14280
- C:\Windows\System\poRvoiS.exe
  C:\Windows\System\poRvoiS.exe
  2⤵
  PID:14312
- C:\Windows\System\oGnaVIG.exe
  C:\Windows\System\oGnaVIG.exe
  2⤵
  PID:13696
- C:\Windows\System\pMXiRie.exe
  C:\Windows\System\pMXiRie.exe
  2⤵
  PID:14136
- C:\Windows\System\KZkUFtI.exe
  C:\Windows\System\KZkUFtI.exe
  2⤵
  PID:14144
- C:\Windows\System\lgPDHlr.exe
  C:\Windows\System\lgPDHlr.exe
  2⤵
  PID:14340
- C:\Windows\System\MACZpjk.exe
  C:\Windows\System\MACZpjk.exe
  2⤵
  PID:14364
- C:\Windows\System\XlnWotM.exe
  C:\Windows\System\XlnWotM.exe
  2⤵
  PID:14392
- C:\Windows\System\wbCPQWu.exe
  C:\Windows\System\wbCPQWu.exe
  2⤵
  PID:14420
- C:\Windows\System\TsBUvnF.exe
  C:\Windows\System\TsBUvnF.exe
  2⤵
  PID:14444
- C:\Windows\System\vBzCLZi.exe
  C:\Windows\System\vBzCLZi.exe
  2⤵
  PID:14472
- C:\Windows\System\yuhPkIq.exe
  C:\Windows\System\yuhPkIq.exe
  2⤵
  PID:14488
- C:\Windows\System\nYLELbv.exe
  C:\Windows\System\nYLELbv.exe
  2⤵
  PID:14524
- C:\Windows\System\LAPPmVH.exe
  C:\Windows\System\LAPPmVH.exe
  2⤵
  PID:14552
- C:\Windows\System\qhrbBfP.exe
  C:\Windows\System\qhrbBfP.exe
  2⤵
  PID:14584
- C:\Windows\System\dMHYtfY.exe
  C:\Windows\System\dMHYtfY.exe
  2⤵
  PID:14616
- C:\Windows\System\EtOtXge.exe
  C:\Windows\System\EtOtXge.exe
  2⤵
  PID:14652
- C:\Windows\System\WvbPAxK.exe
  C:\Windows\System\WvbPAxK.exe
  2⤵
  PID:14684
- C:\Windows\System\yivgYkl.exe
  C:\Windows\System\yivgYkl.exe
  2⤵
  PID:14704
- C:\Windows\System\WcJEoGK.exe
  C:\Windows\System\WcJEoGK.exe
  2⤵
  PID:14720
- C:\Windows\System\DjHIkmB.exe
  C:\Windows\System\DjHIkmB.exe
  2⤵
  PID:14740
- C:\Windows\System\nOAZbVC.exe
  C:\Windows\System\nOAZbVC.exe
  2⤵
  PID:14768
- C:\Windows\System\GhwuVBG.exe
  C:\Windows\System\GhwuVBG.exe
  2⤵
  PID:14796
- C:\Windows\System\bbDQuTY.exe
  C:\Windows\System\bbDQuTY.exe
  2⤵
  PID:14820
- C:\Windows\System\LuDpQns.exe
  C:\Windows\System\LuDpQns.exe
  2⤵
  PID:14852
- C:\Windows\System\ZRYXeBo.exe
  C:\Windows\System\ZRYXeBo.exe
  2⤵
  PID:14888
- C:\Windows\System\FFezSqV.exe
  C:\Windows\System\FFezSqV.exe
  2⤵
  PID:14920
- C:\Windows\System\XdcBLLp.exe
  C:\Windows\System\XdcBLLp.exe
  2⤵
  PID:14944
- C:\Windows\System\DfVvVJv.exe
  C:\Windows\System\DfVvVJv.exe
  2⤵
  PID:14968
- C:\Windows\System\hHbgFhm.exe
  C:\Windows\System\hHbgFhm.exe
  2⤵
  PID:14988
- C:\Windows\System\FLhGNCL.exe
  C:\Windows\System\FLhGNCL.exe
  2⤵
  PID:15008
- C:\Windows\System\xvUjWXL.exe
  C:\Windows\System\xvUjWXL.exe
  2⤵
  PID:15044
- C:\Windows\System\PwpAtJD.exe
  C:\Windows\System\PwpAtJD.exe
  2⤵
  PID:15064
- C:\Windows\System\UkabbwH.exe
  C:\Windows\System\UkabbwH.exe
  2⤵
  PID:15096
- C:\Windows\System\CTJHRHH.exe
  C:\Windows\System\CTJHRHH.exe
  2⤵
  PID:15124
- C:\Windows\System\yEIDpiT.exe
  C:\Windows\System\yEIDpiT.exe
  2⤵
  PID:15156
- C:\Windows\System\YlgoaMY.exe
  C:\Windows\System\YlgoaMY.exe
  2⤵
  PID:15208
- C:\Windows\System\LkyBWJD.exe
  C:\Windows\System\LkyBWJD.exe
  2⤵
  PID:15232
- C:\Windows\System\ezBIEfK.exe
  C:\Windows\System\ezBIEfK.exe
  2⤵
  PID:15260
- C:\Windows\System\FVRSpSX.exe
  C:\Windows\System\FVRSpSX.exe
  2⤵
  PID:15284
- C:\Windows\System\koNOLQK.exe
  C:\Windows\System\koNOLQK.exe
  2⤵
  PID:15312
- C:\Windows\System\OUtgmjE.exe
  C:\Windows\System\OUtgmjE.exe
  2⤵
  PID:15344
- C:\Windows\System\ryBAsPa.exe
  C:\Windows\System\ryBAsPa.exe
  2⤵
  PID:14192
- C:\Windows\System\sBaGlWD.exe
  C:\Windows\System\sBaGlWD.exe
  2⤵
  PID:14404
- C:\Windows\System\GLAMNIz.exe
  C:\Windows\System\GLAMNIz.exe
  2⤵
  PID:14436
- C:\Windows\System\UgqCHFG.exe
  C:\Windows\System\UgqCHFG.exe
  2⤵
  PID:14536
- C:\Windows\System\gcepcxH.exe
  C:\Windows\System\gcepcxH.exe
  2⤵
  PID:14628
- C:\Windows\System\YSzIxuh.exe
  C:\Windows\System\YSzIxuh.exe
  2⤵
  PID:14696
- C:\Windows\System\QMhdhud.exe
  C:\Windows\System\QMhdhud.exe
  2⤵
  PID:14716
- C:\Windows\System\knBhMQE.exe
  C:\Windows\System\knBhMQE.exe
  2⤵
  PID:14760
- C:\Windows\System\uDkZzDn.exe
  C:\Windows\System\uDkZzDn.exe
  2⤵
  PID:14876
- C:\Windows\System\tyvlzNe.exe
  C:\Windows\System\tyvlzNe.exe
  2⤵
  PID:14896
- C:\Windows\System\vXVCYOU.exe
  C:\Windows\System\vXVCYOU.exe
  2⤵
  PID:15032
- C:\Windows\System\HAGkqHr.exe
  C:\Windows\System\HAGkqHr.exe
  2⤵
  PID:15072
- C:\Windows\System\eWLLUfI.exe
  C:\Windows\System\eWLLUfI.exe
  2⤵
  PID:15152
- C:\Windows\System\iNJmQlq.exe
  C:\Windows\System\iNJmQlq.exe
  2⤵
  PID:15224
- C:\Windows\System\BDxkDZK.exe
  C:\Windows\System\BDxkDZK.exe
  2⤵
  PID:15328
- C:\Windows\System\hIwAUWd.exe
  C:\Windows\System\hIwAUWd.exe
  2⤵
  PID:15356
- C:\Windows\System\lIXTvIP.exe
  C:\Windows\System\lIXTvIP.exe
  2⤵
  PID:14512
- C:\Windows\System\DCVGbSC.exe
  C:\Windows\System\DCVGbSC.exe
  2⤵
  PID:14576
- C:\Windows\System\qUNfJIV.exe
  C:\Windows\System\qUNfJIV.exe
  2⤵
  PID:14736
- C:\Windows\System\bfEeddu.exe
  C:\Windows\System\bfEeddu.exe
  2⤵
  PID:14908
- C:\Windows\System\LXbYuzR.exe
  C:\Windows\System\LXbYuzR.exe
  2⤵
  PID:15020
- C:\Windows\System\fHWsVsx.exe
  C:\Windows\System\fHWsVsx.exe
  2⤵
  PID:15172
- C:\Windows\System\bYYEEvd.exe
  C:\Windows\System\bYYEEvd.exe
  2⤵
  PID:15308
- C:\Windows\System\EsFezbK.exe
  C:\Windows\System\EsFezbK.exe
  2⤵
  PID:13568
- C:\Windows\System\duBVhEI.exe
  C:\Windows\System\duBVhEI.exe
  2⤵
  PID:14912
- C:\Windows\System\pDfWolL.exe
  C:\Windows\System\pDfWolL.exe
  2⤵
  PID:15332
- C:\Windows\System\scdeLLJ.exe
  C:\Windows\System\scdeLLJ.exe
  2⤵
  PID:15372
- C:\Windows\System\snlVfoo.exe
  C:\Windows\System\snlVfoo.exe
  2⤵
  PID:15400
- C:\Windows\System\ylZNvwZ.exe
  C:\Windows\System\ylZNvwZ.exe
  2⤵
  PID:15432
- C:\Windows\System\cdXuJXN.exe
  C:\Windows\System\cdXuJXN.exe
  2⤵
  PID:15456
- C:\Windows\System\PVdsADp.exe
  C:\Windows\System\PVdsADp.exe
  2⤵
  PID:15488
- C:\Windows\System\NDrmeLH.exe
  C:\Windows\System\NDrmeLH.exe
  2⤵
  PID:15512
- C:\Windows\System\apeLGKY.exe
  C:\Windows\System\apeLGKY.exe
  2⤵
  PID:15528
- C:\Windows\System\ngnqujU.exe
  C:\Windows\System\ngnqujU.exe
  2⤵
  PID:15556
- C:\Windows\System\RxSvSHP.exe
  C:\Windows\System\RxSvSHP.exe
  2⤵
  PID:15596
- C:\Windows\System\rqvSQra.exe
  C:\Windows\System\rqvSQra.exe
  2⤵
  PID:15620
- C:\Windows\System\okDTFlZ.exe
  C:\Windows\System\okDTFlZ.exe
  2⤵
  PID:15652
- C:\Windows\System\ZZogmeZ.exe
  C:\Windows\System\ZZogmeZ.exe
  2⤵
  PID:15668
- C:\Windows\System\LjvMxCy.exe
  C:\Windows\System\LjvMxCy.exe
  2⤵
  PID:15692
- C:\Windows\System\rasAvyK.exe
  C:\Windows\System\rasAvyK.exe
  2⤵
  PID:15712
- C:\Windows\System\acZNVrk.exe
  C:\Windows\System\acZNVrk.exe
  2⤵
  PID:15740
- C:\Windows\System\bBPWXlQ.exe
  C:\Windows\System\bBPWXlQ.exe
  2⤵
  PID:15776
- C:\Windows\System\CsPIaYK.exe
  C:\Windows\System\CsPIaYK.exe
  2⤵
  PID:15800
- C:\Windows\System\EONEIfg.exe
  C:\Windows\System\EONEIfg.exe
  2⤵
  PID:15824
- C:\Windows\System\eLHJIXB.exe
  C:\Windows\System\eLHJIXB.exe
  2⤵
  PID:15848
- C:\Windows\System\KQZVaOp.exe
  C:\Windows\System\KQZVaOp.exe
  2⤵
  PID:15884
- C:\Windows\System\Bytwiut.exe
  C:\Windows\System\Bytwiut.exe
  2⤵
  PID:15912
- C:\Windows\System\YefSMNh.exe
  C:\Windows\System\YefSMNh.exe
  2⤵
  PID:15940
- C:\Windows\System\JZlAAYZ.exe
  C:\Windows\System\JZlAAYZ.exe
  2⤵
  PID:15968
- C:\Windows\System\qfpsSXN.exe
  C:\Windows\System\qfpsSXN.exe
  2⤵
  PID:15992
- C:\Windows\System\NhZbyzR.exe
  C:\Windows\System\NhZbyzR.exe
  2⤵
  PID:16024
- C:\Windows\System\dWVHjdF.exe
  C:\Windows\System\dWVHjdF.exe
  2⤵
  PID:16048
- C:\Windows\System\LbObjKf.exe
  C:\Windows\System\LbObjKf.exe
  2⤵
  PID:16084
- C:\Windows\System\HmDITJB.exe
  C:\Windows\System\HmDITJB.exe
  2⤵
  PID:16108
- C:\Windows\System\oARITFf.exe
  C:\Windows\System\oARITFf.exe
  2⤵
  PID:16144
- C:\Windows\System\otrxIbN.exe
  C:\Windows\System\otrxIbN.exe
  2⤵
  PID:16180
- C:\Windows\System\rWUwtTm.exe
  C:\Windows\System\rWUwtTm.exe
  2⤵
  PID:16204
- C:\Windows\System\jfOruEr.exe
  C:\Windows\System\jfOruEr.exe
  2⤵
  PID:16228
- C:\Windows\System\eOLLRjm.exe
  C:\Windows\System\eOLLRjm.exe
  2⤵
  PID:16248
- C:\Windows\System\ZlrYKzr.exe
  C:\Windows\System\ZlrYKzr.exe
  2⤵
  PID:16280
- C:\Windows\System\DzIpNYY.exe
  C:\Windows\System\DzIpNYY.exe
  2⤵
  PID:16304
- C:\Windows\System\DASefdC.exe
  C:\Windows\System\DASefdC.exe
  2⤵
  PID:16328
- C:\Windows\System\bRVVMyO.exe
  C:\Windows\System\bRVVMyO.exe
  2⤵
  PID:16356
- C:\Windows\System\byLHVLO.exe
  C:\Windows\System\byLHVLO.exe
  2⤵
  PID:14860
- C:\Windows\System\MYWSKbP.exe
  C:\Windows\System\MYWSKbP.exe
  2⤵
  PID:15388
- C:\Windows\System\AuHyPZu.exe
  C:\Windows\System\AuHyPZu.exe
  2⤵
  PID:15444
- C:\Windows\System\tcCraSe.exe
  C:\Windows\System\tcCraSe.exe
  2⤵
  PID:15524
- C:\Windows\System\kCbDuVi.exe
  C:\Windows\System\kCbDuVi.exe
  2⤵
  PID:15572
- C:\Windows\System\frkpSpj.exe
  C:\Windows\System\frkpSpj.exe
  2⤵
  PID:15680
- C:\Windows\System\yFOkFYx.exe
  C:\Windows\System\yFOkFYx.exe
  2⤵
  PID:15736
- C:\Windows\System\lRFdWKB.exe
  C:\Windows\System\lRFdWKB.exe
  2⤵
  PID:15816
- C:\Windows\System\qrMOFbX.exe
  C:\Windows\System\qrMOFbX.exe
  2⤵
  PID:15836
- C:\Windows\System\CFmcpPw.exe
  C:\Windows\System\CFmcpPw.exe
  2⤵
  PID:15860
- C:\Windows\System\HJvfICe.exe
  C:\Windows\System\HJvfICe.exe
  2⤵
  PID:15960
- C:\Windows\System\JbOyezF.exe
  C:\Windows\System\JbOyezF.exe
  2⤵
  PID:16044
- C:\Windows\System\HypkScg.exe
  C:\Windows\System\HypkScg.exe
  2⤵
  PID:16076
- C:\Windows\System\RHdTbZU.exe
  C:\Windows\System\RHdTbZU.exe
  2⤵
  PID:16156
- C:\Windows\System\hlbeNaV.exe
  C:\Windows\System\hlbeNaV.exe
  2⤵
  PID:16172
- C:\Windows\System\DIQtaCx.exe
  C:\Windows\System\DIQtaCx.exe
  2⤵
  PID:16296
- C:\Windows\System\qZbNmBH.exe
  C:\Windows\System\qZbNmBH.exe
  2⤵
  PID:16340
- C:\Windows\System\SDcRAlj.exe
  C:\Windows\System\SDcRAlj.exe
  2⤵
  PID:15040
- C:\Windows\System\mHJirai.exe
  C:\Windows\System\mHJirai.exe
  2⤵
  PID:15544
- C:\Windows\System\ZCTSgbq.exe
  C:\Windows\System\ZCTSgbq.exe
  2⤵
  PID:15764
- C:\Windows\System\QaXnPaS.exe
  C:\Windows\System\QaXnPaS.exe
  2⤵
  PID:15812
- C:\Windows\System\LUegLBg.exe
  C:\Windows\System\LUegLBg.exe
  2⤵
  PID:15876
- C:\Windows\System\zYcZipK.exe
  C:\Windows\System\zYcZipK.exe
  2⤵
  PID:16120
- C:\Windows\System\aiCtupx.exe
  C:\Windows\System\aiCtupx.exe
  2⤵
  PID:16260
- C:\Windows\System\makUSEi.exe
  C:\Windows\System\makUSEi.exe
  2⤵
  PID:16316
- C:\Windows\System\LVdNvlx.exe
  C:\Windows\System\LVdNvlx.exe
  2⤵
  PID:15688
- C:\Windows\System\CHTdTBl.exe
  C:\Windows\System\CHTdTBl.exe
  2⤵
  PID:15984
- C:\Windows\System\dEUquRE.exe
  C:\Windows\System\dEUquRE.exe
  2⤵
  PID:15496
- C:\Windows\System\gyUMSVA.exe
  C:\Windows\System\gyUMSVA.exe
  2⤵
  PID:16388
- C:\Windows\System\JsQnQBE.exe
  C:\Windows\System\JsQnQBE.exe
  2⤵
  PID:16420
- C:\Windows\System\SQksQPC.exe
  C:\Windows\System\SQksQPC.exe
  2⤵
  PID:16448
- C:\Windows\System\eOpqfpP.exe
  C:\Windows\System\eOpqfpP.exe
  2⤵
  PID:16472
- C:\Windows\System\yclWxgC.exe
  C:\Windows\System\yclWxgC.exe
  2⤵
  PID:16496
- C:\Windows\System\pKuWoIo.exe
  C:\Windows\System\pKuWoIo.exe
  2⤵
  PID:16512
- C:\Windows\System\iHZwUKb.exe
  C:\Windows\System\iHZwUKb.exe
  2⤵
  PID:16536
- C:\Windows\System\mPFgavE.exe
  C:\Windows\System\mPFgavE.exe
  2⤵
  PID:16564
- C:\Windows\System\LAtKIUT.exe
  C:\Windows\System\LAtKIUT.exe
  2⤵
  PID:16584
- C:\Windows\System\ZUfKVDg.exe
  C:\Windows\System\ZUfKVDg.exe
  2⤵
  PID:16612
- C:\Windows\System\dRhckLd.exe
  C:\Windows\System\dRhckLd.exe
  2⤵
  PID:16652
- C:\Windows\System\SppxFth.exe
  C:\Windows\System\SppxFth.exe
  2⤵
  PID:16672
- C:\Windows\System\eXxtOTb.exe
  C:\Windows\System\eXxtOTb.exe
  2⤵
  PID:16712
- C:\Windows\System\mqQDYrT.exe
  C:\Windows\System\mqQDYrT.exe
  2⤵
  PID:16740
- C:\Windows\System\mJREykC.exe
  C:\Windows\System\mJREykC.exe
  2⤵
  PID:16764
- C:\Windows\System\QvouchH.exe
  C:\Windows\System\QvouchH.exe
  2⤵
  PID:16796
- C:\Windows\System\mzLUHvA.exe
  C:\Windows\System\mzLUHvA.exe
  2⤵
  PID:16820
- C:\Windows\System\MLkzvht.exe
  C:\Windows\System\MLkzvht.exe
  2⤵
  PID:16840
- C:\Windows\System\tAbrNbe.exe
  C:\Windows\System\tAbrNbe.exe
  2⤵
  PID:16876
- C:\Windows\System\vHtEmsN.exe
  C:\Windows\System\vHtEmsN.exe
  2⤵
  PID:16904
- C:\Windows\System\AhSsqEb.exe
  C:\Windows\System\AhSsqEb.exe
  2⤵
  PID:16928
- C:\Windows\System\YplqoDl.exe
  C:\Windows\System\YplqoDl.exe
  2⤵
  PID:16960
- C:\Windows\System\gPBtlqJ.exe
  C:\Windows\System\gPBtlqJ.exe
  2⤵
  PID:16988
- C:\Windows\System\QgXFABl.exe
  C:\Windows\System\QgXFABl.exe
  2⤵
  PID:17012
- C:\Windows\System\idcjzbG.exe
  C:\Windows\System\idcjzbG.exe
  2⤵
  PID:17036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AQbGdbj.exe

Filesize
1.8MB

MD5
c41f8536967316a720ed4178c307c396

SHA1
3681f8adfd04387cfcb4192fa88978b65b41d165

SHA256
e7053a7fc12856214fb4a120a67cbae07cfb88065bb39f0a0991ce64625ef020

SHA512
b66e4d9aec0e72f9210466b0d1155a462d39860ec052a679da4610bf5587f4fb30e1b0fbc1284a35939d8643f6bbf4a9a3ca6f2a0173416057917135f97e3fab

Download Submit
C:\Windows\System\AfmCdoo.exe

Filesize
1.8MB

MD5
f2cec4001c72a261c539d7b4e42e3bb4

SHA1
143d82f6c050c6254f363e74ee9171f158eb325f

SHA256
ce046b868306bd3f007c6c56ff0f53109dd0489fcfa012121cf36414ef7dfb04

SHA512
99617c41c36b3a729875165f8635b9945246866bfd81e2d684b554c0181a55611208b91459f84add9b5a48d1aab2570b5b57f2b6deb31d3b110fa421061ee993

Download Submit
C:\Windows\System\AiADSvX.exe

Filesize
1.8MB

MD5
119ebc582bbc9af1396152ab06531b0e

SHA1
9c9c2dde70f46ef23b72745eb585c312450a9b26

SHA256
e8b552875716ec1c94f30c029026a66b9831a1b5239b5a13fc2eb9f3aa97206d

SHA512
671639931ea43b37edb5308ca48bf5746a38a23f95719051cd7f4bbf5e9a28bf9329418c91bf2d2a8d654ed012dd6b7a477919bae387ee875a0ffb85ad92d77a

Download Submit
C:\Windows\System\BWpmpUq.exe

Filesize
1.8MB

MD5
19a8e7473818da57c0622504e7bb8b60

SHA1
18ad75e0c044c1cc08dcda9049c68153382176a1

SHA256
bb545ddc0b79cb7024c1f76e04036eb2eac2efa2efcf1c6b2c50692498b67be3

SHA512
3c3b0c68916dfb57fe3f1743ee8b8f4b1ec1db37c5c1881a5667a3744e80bf33534efa29a8750a65b24ad6f89b20eff933a27fe7b23d51e0dfa4a2b4e062f4e2

Download Submit
C:\Windows\System\CptIvru.exe

Filesize
1.8MB

MD5
d572acf6b825744b83276b90e75f85d9

SHA1
f28a3c5d3cbeaceb984b58450ce75edbe39363f9

SHA256
7b9606abbb62caa06a5fc4b7b09921127f59391d3cc14d34947d075317d2a4f8

SHA512
ea478d1215b6359a4e4b4559badec39b4ff799b1751b366783dc3a33aa6bfeff4edf0e2eb7e64d61349abb37af87dafe282295e06263f09d732e3b1205e6ed26

Download Submit
C:\Windows\System\IJiGRGx.exe

Filesize
1.8MB

MD5
3b81f0d67479beed3e4b66d5ec2e6356

SHA1
d5621a65e3e11702f6bfed52508b39c973fe4f10

SHA256
e7cdfe3fb68e7125facd76237cfaa7fe3c8346f23e4b4f5362d9cd84bd209328

SHA512
ef3c629e8474ef1b051195bf8acce0ee6c95de3afdf606aabe3b7a50f436d572f6579b6397204a7d24428f5d6eaf0e10b8463e0842f1ef9fca1dad9d4f0d948f

Download Submit
C:\Windows\System\JvFOEdv.exe

Filesize
1.8MB

MD5
e7fa8978c76e8de4989773dd00de3d6b

SHA1
a31041742acaf655025b8c9242c5733d9d5fb7cf

SHA256
0b941459ddc7dc5fd642841a3fd89a03ffefc8cc89851ff6fdaf6840937f2203

SHA512
f5862f9271ebd599b9f11db53d13ad9d7be30303241027fadf866089da54d0907b1c968031aa847866d14b66116c7e1465e815c8b02372537660bbeef7556e97

Download Submit
C:\Windows\System\KBbswCv.exe

Filesize
1.8MB

MD5
7acba38b81b9904199b2038029a38f00

SHA1
607d6511266af24e1f07fccfe3e65a7f2e6e76fb

SHA256
8c45dd2207e55334c4e8c78e14d35647574e68925342370e19b6c4e24f01ecff

SHA512
e1da32b04a1e1423bf9ade78a6c99430558db16967a3c4dfd9bc7b57c7caa0113c9451918b922c18b39afc92490ccfb1a4bc0c0105fe5be92ed375ace5c4dd8e

Download Submit
C:\Windows\System\KQhutdi.exe

Filesize
1.8MB

MD5
9fff2b6e444b360b702d9bd177e1ddca

SHA1
8fc6f68a3a0ac5816a508f9526ee2a3eb06776fc

SHA256
856187401c28c55f669e4176db39e790c7078b7f8cb1d555fb8862bb2107e33c

SHA512
951f20a1cbb16be970bdbcdce0fea78ee065463a9d876f3ca362142ec966a3638d0c2e70028f82a884fc0c7891f63a3c226b5e9643dde529c3ddd059ddcc991f

Download Submit
C:\Windows\System\LggywPv.exe

Filesize
1.8MB

MD5
8bb94fe95073653c5f92adb8cfa3e77b

SHA1
7d2192748f41af91eacf7b193f5a3d97abf3d968

SHA256
bfa76105de5b4058019b0e99ab0b635bb44f7c2fdf8b1db8b425fdd5cb1aeb5d

SHA512
70149ca9578d8455cfea1a3bb7d140293d679785268206683d4680a78eaf07c111711f8a49061fcc6522148feba09eba2ead2096679a10234e63f9516950afe5

Download Submit
C:\Windows\System\MrHkYGy.exe

Filesize
1.8MB

MD5
44ff16bb5b9c9d560cf27cdc60b98a20

SHA1
6b0d6fee076356f17f613a52597fef94994b69bf

SHA256
3aa211612d7098b096585fb035f78fd1aa90ec5cc8e3a5b8d96a8196ed689e92

SHA512
34644b653206926ecb8729997cf7e06fffb47fa8e8df093daa53eae6b004251eee29e906476e7cfb4fded421c6502bfbe764db7cd2e8aa46d18166e06513cb33

Download Submit
C:\Windows\System\NQoETcG.exe

Filesize
1.8MB

MD5
40a5addbaba7341c86cd95002466dfee

SHA1
8fbcd4401d22f3bea5035794cbde916043700f51

SHA256
64020ca60251b0508e46ad449e5174e617fb1eb6a52de933c5762656f71094b6

SHA512
301d53802923f741956897b8259b4986190412f02bc8866c237e179efa9b150455a9b643ad72fc5f3e03daf07eebe0e6462a59b8cbd43682d11b6f8b4d54d0b9

Download Submit
C:\Windows\System\ORoTavW.exe

Filesize
1.8MB

MD5
b533d40feb26e9c01729da3853c45da1

SHA1
82cb6dd11e057ef1d3693650b4982a04077cdff9

SHA256
5b452d22a63d91dc71f1a8d5c1165cd340a09bf6527f9c89b815f17b726e4d12

SHA512
23f7752b5757e066cfaffdfcb0a3696e70f6a89a648185775d1c0ea950d6eaac604ce19b70fc8c47cf38c29b80cba22e319b5e447838def2978ecbbd161a9d98

Download Submit
C:\Windows\System\PFoSUrB.exe

Filesize
1.8MB

MD5
81b665f03193c99cd2d48f876c08245d

SHA1
74cb646be630215f23a15df6facb7cd98be5ce07

SHA256
a1062e321d30ec2a6ccfe3030878942d0d3dc1bd04e83230bc248ef925e30c8d

SHA512
512caa5a054b27f04c8c82d87c8f75218ce6e81af4ef3b8998e72562f6dddaae5d9d213f224f64961698250a9ee071156d36581f47b90259a90ea87b239f04cd

Download Submit
C:\Windows\System\PXhFwQl.exe

Filesize
1.8MB

MD5
c63d06891277f9aa4da3fd771182b247

SHA1
00496a259f5c87f0d7db7f385c1cd819fd35dee9

SHA256
790f1be3cf235367ce602698208b6a5f9056400fbefb4982183abf8c14835f72

SHA512
494fbb1b5b90e50ebf4965f0fb290a13ba11913d08fc5f408cde86fa495d72cda6351362bded30b6e777aadda69d2d3dc04df4f6a24c32daca09d34f1bb40ca9

Download Submit
C:\Windows\System\UQIsydk.exe

Filesize
1.8MB

MD5
2e3c0105b72724afc99d9b5c8f581530

SHA1
10e7e314de3a9a7401800bb3f488ebcd758a339e

SHA256
b071663cbe689b5527a216abaf087620d31bb0758433b0fd5e590c2e2d959bcb

SHA512
f45ed3a2cfe63a5d4258021f9a7bb5619c319e2c9c3641ab9343d1e0711dc9519f5d95e1312217b4f0ad5592b8b8e93f4f798a2c871eb7720bb018c5e1571e51

Download Submit
C:\Windows\System\WSumhvi.exe

Filesize
1.8MB

MD5
9a6cf8710f2a8d6dca231d76b9493d01

SHA1
ac1544325ad99bdfa0585a97dc5462e87058378d

SHA256
888194a742226c1af425a2c23ecf9a36e506804c560ffd61dee70c5884917eb4

SHA512
48dd235642821f9305c00ebe4937204daf0694445513e731d4a058e03391600e4e22b493a4091f63b62a99d2319afc752025e2a6d16f8e09611d33079b2a894c

Download Submit
C:\Windows\System\Ynfygwn.exe

Filesize
1.8MB

MD5
70730f1fe7847f3f8a4dfb0b3a023341

SHA1
dd86a510078291503e1bd7e4b51c197f0f6cc4db

SHA256
384870a2e00740b13f55c1c6d2f83a2ed7c97936b43d42949bdd01a6b1cbfd94

SHA512
8d059015ba19725760af8cde5d182a31a87b95d82443bd8f7b580914950a3a50d74c5500b5a8daebb9e3279d8c63021e2958b6aa9ed1ad93a0246e0830dc2972

Download Submit
C:\Windows\System\YpoYvza.exe

Filesize
1.8MB

MD5
b802d7888df8f3c00d7cd83ad7e4f2a6

SHA1
fe2e9f19846eeae32fa3b6af34aac240529e107c

SHA256
04284b0fde412479e93ed33e4904bc2dc921120dd24de008a30c02d36ff7fc72

SHA512
466469fa6d92ac7d0bcc61d3b0c5410688a65f1af6e2c493208952faf31c0e3d5cd2fe99fa437beb0cf4a447f42bd98756f6f32a282a93ac0f29a048507b0417

Download Submit
C:\Windows\System\bBLbPxH.exe

Filesize
1.8MB

MD5
2396410c6ec0e301a2c027684eaeaf1a

SHA1
a2603e6b82864ef368a3a9c38d595f2a6a0dcfe4

SHA256
3e5533b9c3486cbbfb836653bbed7b16d8b616e040186f4e8fffa04ed0140c6e

SHA512
b099e64d61d96419ab7cd128125d2e1f07eef92f60953af83916e0f4b2964462ed4a9d89b3b6ac82821ad60c72a843b692dc81431ba43123477d82b9fc43ebf5

Download Submit
C:\Windows\System\bKZdINd.exe

Filesize
1.8MB

MD5
b7d6cb8e441d30bf059dadb3b388da43

SHA1
ba1ce2326aab2faf8079b37ecc21aa01378c6984

SHA256
89454bc8b2af82696a6e694325b7b8e7bd643df01f345e58affc24a95c949a67

SHA512
f2d0d38adfef7079be07bdbd02e272008e03d82c8cd32fec06b9f19430a1f0c5eea1f90f7638d90c3ba71d05613631dbc230cfb6e4c781fb00a5bbe606f3e953

Download Submit
C:\Windows\System\byupJEV.exe

Filesize
1.8MB

MD5
c89983673558fd41735e1d941447fbf6

SHA1
56c083d6b970f6a1254fca0ec87a4b3c4d66bdf0

SHA256
78fec64ddf623b631b153980bfa3c83430ebc9efc45cea8760058032c300d5d8

SHA512
9379b43239b7345e41a313ba1b7227747500708d129e8b783d40e125171014f35d31c44c7c7ee75e6ac3826ecffe584d09076f6574751fb94b5e1b6df5fe2456

Download Submit
C:\Windows\System\cHUktqk.exe

Filesize
1.8MB

MD5
f6ea5cbf3418a7f0e6c41f71fe92cd0e

SHA1
99797e45b0e3a92b6c1bad9e7762a06c42e93929

SHA256
1ced6f8b25ecd5de651f1e936bbcea2a82c5e2bd1853ad666ce3db23dccbb60c

SHA512
4cc7fcf3bab248d4397301e99a553ca3fee30c810ef94c3780583bfc6ac5fe404ea64eb51fdb450a1f7909fb461c1e5a902f7d4a9dcd7ab918fe4b0c02dad20d

Download Submit
C:\Windows\System\cIPRywm.exe

Filesize
1.8MB

MD5
5411e77725eac6313118b3feb0949239

SHA1
f65edc45416ee819a27913efcc2b7c83a920a677

SHA256
ddf0142e27efd6fef637bc4c4a0b4be5daa9950ad19ad0c5de73c177b8aaaf29

SHA512
d1c173175b0a3a7ceaa32c782fddd04f9b7173412073093d0e03d765ff57b1e23419080b9a955a878f74162c42987e2b6253b0f615629d2365cc9134069272b0

Download Submit
C:\Windows\System\hrnQVah.exe

Filesize
1.8MB

MD5
43be689c30b0790c684cc77c0bcb3690

SHA1
b5bc64206234655d3d6f00228b6b302d4ba98b2e

SHA256
3a894a4d91e7ee5653641207eb47404fe207e3f49300e231c618940e61408328

SHA512
125a398c46c291f07b34b0c0b062179b7ab7512049d9f1c2734fa6e27e1b98acda900980da597382209b27ecee8e5556a12385a41842f059f12ad8429a77515f

Download Submit
C:\Windows\System\jbZzqgJ.exe

Filesize
1.8MB

MD5
e97bd4dd919863a4232d3229618f4723

SHA1
0b2a3cadcd076a0061f97336a2bb6abb2b854ab1

SHA256
e60603949712df385b19795a0a057147422be69290b9ec0a04243fad6fe1a57c

SHA512
b6b474809a11241490cfda72c5afa0fbcd0b781d72927c41295ff40f50ae958dc9fb9cc9a66a9498d282bdea5b298cab6ac183137247c74ff3906451e9eb3b83

Download Submit
C:\Windows\System\kNTvQhD.exe

Filesize
1.8MB

MD5
0ab1f925bf0332d705bef210e4cad9d3

SHA1
2100f3e80983ceb17eb9ff931ff054de6cf0ac77

SHA256
0f984d738555dce31ff906b61df88440961cdd4a49414bd6f17636a137ebcea2

SHA512
f982ca7714e7d8a8ca5b490a33bac923f0eacddf7048b48b60679c3f22e8d7be5d6ab153fbdcd57f480029417e4947153d4945247d023e3af9ff51b6119ef8f2

Download Submit
C:\Windows\System\lgUzBpA.exe

Filesize
1.8MB

MD5
bdbaefaa55f196360ea8ab4e77880272

SHA1
4f01dc57340256d6e10afad3d8bd6ac33cf68a6f

SHA256
7e68afc5b8e68f7c72cb0b6f8d52a58a00914dbdf82c30b280d7428fa3f5b23a

SHA512
90d4f573c3919864929b2264cc729374dea5e94806ad31de4efbaa3b4e247e894772569d6bd3fae37d47ed3bac31dc9c39d1d02e10325ddc7d229eeb16a475cd

Download Submit
C:\Windows\System\pBIIUjJ.exe

Filesize
1.8MB

MD5
8df8bac99bfc10e2cf2b21bcfb00732e

SHA1
a726da5f2790b99598fafd7fa3ba6e198bbc1832

SHA256
1a0f412c9a05337801cb1d3332dce45c31d1d5d8944fb4d79c72ada02a21efd6

SHA512
991141677d9e207497dc391e77fd5b39f378e35223f4d426bb14b0f4514117049134cbf62d0c02a5695a7d18bf1d55100c43040f05f90d6d3660492341c8d91c

Download Submit
C:\Windows\System\twAkbmd.exe

Filesize
1.8MB

MD5
356b97bedcb2a71e865e2e09f625f8e1

SHA1
301056938f452e70356cb7ce394b514cf24664fd

SHA256
7e3e75f03d2320da9c53f6c78b3e0c12171d1bb15c917f5e71d33fac971e5771

SHA512
eb3aa74d051efdafbae83f6a32dcf607682d6fd1c7f20adc223bdc044e407b69a558d7d51f837973be277dad26c040fc922c9a7f083f00cc551de5bd799a2ea8

Download Submit
C:\Windows\System\tyJbqMo.exe

Filesize
1.8MB

MD5
cbba5c2352c712b5eca64cd4daf4015b

SHA1
d95b6f534d0204f6efec2882eb37b2398a354bd4

SHA256
09499eec6435ad388b2fe0ac6aeed20afa2724e84d5faa189a96ee55fc322468

SHA512
b1e22408834abecbb41a40f846eeb3262b6a504a07bc9678c7c8b4efda9b5359012084cbf234db73bf9d741659cbe13bbf8e52164dd23f3bdd86cf43fdf4c81f

Download Submit
C:\Windows\System\wBvwfXm.exe

Filesize
1.8MB

MD5
40c1b8d7fdc550cc93c6a8fe71e44a26

SHA1
800a5c9ea0cfa9d39204642d9ec6eb64af868db1

SHA256
4914fd6236ad855ef6975a83fe92996527c58b05851258859e83562e5bded7fa

SHA512
527674f0330baeedb5e1d33018d1841f4d9f362b45ae370f9c8557c846b5bb59fc37ee80977a7df5662974297adbf7e15ab6717adc56c42933a1af9846520078

Download Submit
C:\Windows\System\xDwnHBf.exe

Filesize
1.8MB

MD5
d609efac346f13cbc845ef07c4c6b096

SHA1
5a0827d96f1e46e926f817f3483326652b215a17

SHA256
e9e82f5a54df9f8cf6fbfccac7b6282665c621cad8cd4ccd995afdb7c8ac72b6

SHA512
ce89815303f31eaf59ab2905c5f4cfa13d4b74437a5e960041a424a007a938bb8d4dba28f0ff4bf8f324e6f43a72ba951027f70609681184043dda05b5cab786

Download Submit
memory/4052-0-0x000001D884EA0000-0x000001D884EB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads