xmrig | 71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
Size

1.4MB
MD5

50d3e9aa0816afe339b3b2aeed663f52
SHA1

721ecb87672edd7eca6633090469fc95200ac290
SHA256

71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071
SHA512

022aa8304758e413a2bc31bd862fabb43e66c11d93985ecce500b99c7a0e83918f973953924abc0a306878c037ab9bf79945737873e59473fb2d46bd4444ddff
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcO:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5g

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b44-4.dat	xmrig
behavioral2/files/0x0009000000023ba9-8.dat	xmrig
behavioral2/files/0x0008000000023bb9-9.dat	xmrig
behavioral2/files/0x0008000000023bba-17.dat	xmrig
behavioral2/files/0x000a000000023baf-29.dat	xmrig
behavioral2/files/0x0008000000023bbb-24.dat	xmrig
behavioral2/files/0x0008000000023bbc-34.dat	xmrig
behavioral2/files/0x0009000000023bbd-40.dat	xmrig
behavioral2/files/0x0008000000023bec-44.dat	xmrig
behavioral2/files/0x0008000000023bed-49.dat	xmrig
behavioral2/files/0x0008000000023bf1-67.dat	xmrig
behavioral2/files/0x0008000000023bf7-85.dat	xmrig
behavioral2/files/0x0008000000023c15-117.dat	xmrig
behavioral2/files/0x0008000000023c31-140.dat	xmrig
behavioral2/files/0x0008000000023c44-157.dat	xmrig
behavioral2/files/0x0008000000023c45-162.dat	xmrig
behavioral2/files/0x0008000000023c43-160.dat	xmrig
behavioral2/files/0x0008000000023c42-155.dat	xmrig
behavioral2/files/0x0008000000023c41-150.dat	xmrig
behavioral2/files/0x0008000000023c35-145.dat	xmrig
behavioral2/files/0x0016000000023c2b-135.dat	xmrig
behavioral2/files/0x000b000000023c2a-130.dat	xmrig
behavioral2/files/0x0008000000023c14-120.dat	xmrig
behavioral2/files/0x0008000000023c13-115.dat	xmrig
behavioral2/files/0x0008000000023c12-110.dat	xmrig
behavioral2/files/0x0008000000023c11-105.dat	xmrig
behavioral2/files/0x0008000000023c10-100.dat	xmrig
behavioral2/files/0x0008000000023c0a-95.dat	xmrig
behavioral2/files/0x0008000000023bf8-90.dat	xmrig
behavioral2/files/0x0008000000023bf6-80.dat	xmrig
behavioral2/files/0x0008000000023bf0-70.dat	xmrig
behavioral2/files/0x0008000000023bef-62.dat	xmrig
behavioral2/files/0x0008000000023bee-58.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4072	cOMEBIT.exe
5032	wLBsZUk.exe
3432	xgfyqgz.exe
1096	Bbbfbaq.exe
4396	knhuUSL.exe
4836	qsenaIZ.exe
1292	RGGiWnD.exe
3152	KCkdFUN.exe
3436	trigapF.exe
1556	FOJTkED.exe
8	YMpHfNw.exe
3460	YaQhTjk.exe
2984	WdNSOqX.exe
1852	OxUdcFv.exe
4948	VxUUDtA.exe
408	bNKMvrm.exe
5000	tETXhpK.exe
2672	GYhlwzT.exe
984	JLKkODb.exe
112	KmrHEdC.exe
2716	SCtzCIj.exe
4844	lQirBDZ.exe
4648	XQcrZTg.exe
3048	kWMLJAu.exe
1592	YZwdowM.exe
3484	NKNPNyq.exe
1784	UAYQjqq.exe
2852	USicRop.exe
2276	sBkjNTI.exe
4016	ZClWXfA.exe
3584	ePZnAMz.exe
2908	RHeAiaG.exe
2644	tRNmxAV.exe
1976	fYjjdLe.exe
888	mwpWbwF.exe
4052	IaKVzKz.exe
1608	oIRUhmE.exe
3400	WyZtqGR.exe
1916	ioLbWcj.exe
1432	gnQXqdC.exe
2720	bQNPqyC.exe
2396	kntGAjx.exe
5096	URvGgBz.exe
4268	QBDbTkF.exe
740	eVOCvcC.exe
4480	BKYAlHb.exe
4160	rnHlWhB.exe
3880	VZXBRKG.exe
4024	ukplmLQ.exe
1648	CqrbFXA.exe
2240	DdBfVYo.exe
872	mYpDOnh.exe
4060	AADDyDY.exe
3964	ZMUJmiq.exe
2484	YEyStan.exe
4332	vxUnfpJ.exe
4852	ISrbplZ.exe
2508	GmznGIE.exe
4056	uxczhac.exe
3164	JZFCKUv.exe
548	ZnmVMSl.exe
1164	YGmWDrP.exe
3188	QzGYPlc.exe
848	qQZIfVt.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YVCDxTq.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\KTmDLWt.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\tRNmxAV.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\QMlsUMQ.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\DYgAeaf.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\uTgooAi.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\piFxygW.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\AqjgKXk.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\FWntKYa.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\wnCmKbK.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\hcekjTH.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\sMrrPVf.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\omPDpWf.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\ckiDoHs.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\qPARAmY.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\gidkHBa.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\FMtFowX.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\zELBdvP.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\ezkFuCO.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\MvgdmBJ.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\vokFUqQ.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\VdvONRJ.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\UHOESOV.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\uRacGuf.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\lFRQgvU.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\zbADAVg.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\qQTRDyH.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\ZKOiGqb.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\RyzOKqk.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\wfjiRnh.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\DzBtFZh.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\HifMbHH.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\IPUdEDk.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\Cloukae.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\JcDGtIs.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\awKfKFl.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\NWaYkuY.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\IZoQwjr.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\EvIeUVD.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\uHzPXaz.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\iMFOAFO.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\ehPawFQ.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\CqnhDiQ.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\dXIKleH.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\ArBDgdP.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\VOyZDBb.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\qZcsRug.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\XNLSgYV.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\ioLbWcj.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\jqAnuJe.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\fAJfndY.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\vWPgApi.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\yvGcaxC.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\UycOWfd.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\OxYJpFP.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\QpkbsPH.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\UckqpIE.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\hYPRDAW.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\IHzZYpH.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\VRNqklm.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\KoYmNGs.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\VqFuqxX.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\ZhwLJNG.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
File created	C:\Windows\System\vxUnfpJ.exe	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4072	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	84
PID 1344 wrote to memory of 4072	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	84
PID 1344 wrote to memory of 5032	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	85
PID 1344 wrote to memory of 5032	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	85
PID 1344 wrote to memory of 3432	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	86
PID 1344 wrote to memory of 3432	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	86
PID 1344 wrote to memory of 1096	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	87
PID 1344 wrote to memory of 1096	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	87
PID 1344 wrote to memory of 4396	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	88
PID 1344 wrote to memory of 4396	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	88
PID 1344 wrote to memory of 4836	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	89
PID 1344 wrote to memory of 4836	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	89
PID 1344 wrote to memory of 1292	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	90
PID 1344 wrote to memory of 1292	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	90
PID 1344 wrote to memory of 3152	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	91
PID 1344 wrote to memory of 3152	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	91
PID 1344 wrote to memory of 3436	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	92
PID 1344 wrote to memory of 3436	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	92
PID 1344 wrote to memory of 1556	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	93
PID 1344 wrote to memory of 1556	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	93
PID 1344 wrote to memory of 8	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	94
PID 1344 wrote to memory of 8	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	94
PID 1344 wrote to memory of 3460	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	95
PID 1344 wrote to memory of 3460	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	95
PID 1344 wrote to memory of 2984	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	96
PID 1344 wrote to memory of 2984	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	96
PID 1344 wrote to memory of 1852	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	97
PID 1344 wrote to memory of 1852	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	97
PID 1344 wrote to memory of 4948	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	98
PID 1344 wrote to memory of 4948	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	98
PID 1344 wrote to memory of 408	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	99
PID 1344 wrote to memory of 408	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	99
PID 1344 wrote to memory of 5000	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	100
PID 1344 wrote to memory of 5000	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	100
PID 1344 wrote to memory of 2672	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	101
PID 1344 wrote to memory of 2672	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	101
PID 1344 wrote to memory of 984	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	102
PID 1344 wrote to memory of 984	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	102
PID 1344 wrote to memory of 112	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	103
PID 1344 wrote to memory of 112	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	103
PID 1344 wrote to memory of 2716	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	104
PID 1344 wrote to memory of 2716	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	104
PID 1344 wrote to memory of 4844	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	105
PID 1344 wrote to memory of 4844	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	105
PID 1344 wrote to memory of 4648	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	106
PID 1344 wrote to memory of 4648	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	106
PID 1344 wrote to memory of 3048	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	107
PID 1344 wrote to memory of 3048	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	107
PID 1344 wrote to memory of 1592	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	108
PID 1344 wrote to memory of 1592	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	108
PID 1344 wrote to memory of 3484	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	109
PID 1344 wrote to memory of 3484	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	109
PID 1344 wrote to memory of 1784	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	110
PID 1344 wrote to memory of 1784	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	110
PID 1344 wrote to memory of 2852	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	111
PID 1344 wrote to memory of 2852	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	111
PID 1344 wrote to memory of 2276	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	112
PID 1344 wrote to memory of 2276	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	112
PID 1344 wrote to memory of 4016	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	113
PID 1344 wrote to memory of 4016	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	113
PID 1344 wrote to memory of 3584	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	114
PID 1344 wrote to memory of 3584	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	114
PID 1344 wrote to memory of 2908	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	115
PID 1344 wrote to memory of 2908	1344	71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe	115

C:\Users\Admin\AppData\Local\Temp\71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe
"C:\Users\Admin\AppData\Local\Temp\71f4d7dd9a4feab007e9045924b939b6bf02e58b0a57a88cf1b010cce9c63071.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\System\cOMEBIT.exe
  C:\Windows\System\cOMEBIT.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\wLBsZUk.exe
  C:\Windows\System\wLBsZUk.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\xgfyqgz.exe
  C:\Windows\System\xgfyqgz.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\Bbbfbaq.exe
  C:\Windows\System\Bbbfbaq.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\knhuUSL.exe
  C:\Windows\System\knhuUSL.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\qsenaIZ.exe
  C:\Windows\System\qsenaIZ.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\RGGiWnD.exe
  C:\Windows\System\RGGiWnD.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\KCkdFUN.exe
  C:\Windows\System\KCkdFUN.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\trigapF.exe
  C:\Windows\System\trigapF.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\FOJTkED.exe
  C:\Windows\System\FOJTkED.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\YMpHfNw.exe
  C:\Windows\System\YMpHfNw.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\YaQhTjk.exe
  C:\Windows\System\YaQhTjk.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\WdNSOqX.exe
  C:\Windows\System\WdNSOqX.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\OxUdcFv.exe
  C:\Windows\System\OxUdcFv.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\VxUUDtA.exe
  C:\Windows\System\VxUUDtA.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\bNKMvrm.exe
  C:\Windows\System\bNKMvrm.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\tETXhpK.exe
  C:\Windows\System\tETXhpK.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\GYhlwzT.exe
  C:\Windows\System\GYhlwzT.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\JLKkODb.exe
  C:\Windows\System\JLKkODb.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\KmrHEdC.exe
  C:\Windows\System\KmrHEdC.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\SCtzCIj.exe
  C:\Windows\System\SCtzCIj.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\lQirBDZ.exe
  C:\Windows\System\lQirBDZ.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\XQcrZTg.exe
  C:\Windows\System\XQcrZTg.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\kWMLJAu.exe
  C:\Windows\System\kWMLJAu.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\YZwdowM.exe
  C:\Windows\System\YZwdowM.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\NKNPNyq.exe
  C:\Windows\System\NKNPNyq.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\UAYQjqq.exe
  C:\Windows\System\UAYQjqq.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\USicRop.exe
  C:\Windows\System\USicRop.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\sBkjNTI.exe
  C:\Windows\System\sBkjNTI.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\ZClWXfA.exe
  C:\Windows\System\ZClWXfA.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\ePZnAMz.exe
  C:\Windows\System\ePZnAMz.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\RHeAiaG.exe
  C:\Windows\System\RHeAiaG.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\tRNmxAV.exe
  C:\Windows\System\tRNmxAV.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\fYjjdLe.exe
  C:\Windows\System\fYjjdLe.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\mwpWbwF.exe
  C:\Windows\System\mwpWbwF.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\IaKVzKz.exe
  C:\Windows\System\IaKVzKz.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\oIRUhmE.exe
  C:\Windows\System\oIRUhmE.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\WyZtqGR.exe
  C:\Windows\System\WyZtqGR.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\ioLbWcj.exe
  C:\Windows\System\ioLbWcj.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\gnQXqdC.exe
  C:\Windows\System\gnQXqdC.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\bQNPqyC.exe
  C:\Windows\System\bQNPqyC.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\kntGAjx.exe
  C:\Windows\System\kntGAjx.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\URvGgBz.exe
  C:\Windows\System\URvGgBz.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\QBDbTkF.exe
  C:\Windows\System\QBDbTkF.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\eVOCvcC.exe
  C:\Windows\System\eVOCvcC.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\BKYAlHb.exe
  C:\Windows\System\BKYAlHb.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\rnHlWhB.exe
  C:\Windows\System\rnHlWhB.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\VZXBRKG.exe
  C:\Windows\System\VZXBRKG.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\ukplmLQ.exe
  C:\Windows\System\ukplmLQ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\CqrbFXA.exe
  C:\Windows\System\CqrbFXA.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\DdBfVYo.exe
  C:\Windows\System\DdBfVYo.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\mYpDOnh.exe
  C:\Windows\System\mYpDOnh.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\AADDyDY.exe
  C:\Windows\System\AADDyDY.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\ZMUJmiq.exe
  C:\Windows\System\ZMUJmiq.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\YEyStan.exe
  C:\Windows\System\YEyStan.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\vxUnfpJ.exe
  C:\Windows\System\vxUnfpJ.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\ISrbplZ.exe
  C:\Windows\System\ISrbplZ.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\GmznGIE.exe
  C:\Windows\System\GmznGIE.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\uxczhac.exe
  C:\Windows\System\uxczhac.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\JZFCKUv.exe
  C:\Windows\System\JZFCKUv.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\ZnmVMSl.exe
  C:\Windows\System\ZnmVMSl.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\YGmWDrP.exe
  C:\Windows\System\YGmWDrP.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\QzGYPlc.exe
  C:\Windows\System\QzGYPlc.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\qQZIfVt.exe
  C:\Windows\System\qQZIfVt.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\UkWmYAa.exe
  C:\Windows\System\UkWmYAa.exe
  2⤵
  PID:2956
- C:\Windows\System\lfGYIfL.exe
  C:\Windows\System\lfGYIfL.exe
  2⤵
  PID:4104
- C:\Windows\System\eXsbnuZ.exe
  C:\Windows\System\eXsbnuZ.exe
  2⤵
  PID:3892
- C:\Windows\System\FuWnGZi.exe
  C:\Windows\System\FuWnGZi.exe
  2⤵
  PID:1064
- C:\Windows\System\hYuPNaH.exe
  C:\Windows\System\hYuPNaH.exe
  2⤵
  PID:4088
- C:\Windows\System\IBOOVAT.exe
  C:\Windows\System\IBOOVAT.exe
  2⤵
  PID:1584
- C:\Windows\System\dVByBYM.exe
  C:\Windows\System\dVByBYM.exe
  2⤵
  PID:4596
- C:\Windows\System\jGshouX.exe
  C:\Windows\System\jGshouX.exe
  2⤵
  PID:2928
- C:\Windows\System\BHIaqve.exe
  C:\Windows\System\BHIaqve.exe
  2⤵
  PID:3540
- C:\Windows\System\LgoLoVG.exe
  C:\Windows\System\LgoLoVG.exe
  2⤵
  PID:1564
- C:\Windows\System\HYWkbfE.exe
  C:\Windows\System\HYWkbfE.exe
  2⤵
  PID:1824
- C:\Windows\System\GIgjoEs.exe
  C:\Windows\System\GIgjoEs.exe
  2⤵
  PID:1220
- C:\Windows\System\NBdjNhb.exe
  C:\Windows\System\NBdjNhb.exe
  2⤵
  PID:1548
- C:\Windows\System\nMvWaWP.exe
  C:\Windows\System\nMvWaWP.exe
  2⤵
  PID:3368
- C:\Windows\System\RUJqsCC.exe
  C:\Windows\System\RUJqsCC.exe
  2⤵
  PID:3776
- C:\Windows\System\cpDKjEA.exe
  C:\Windows\System\cpDKjEA.exe
  2⤵
  PID:1156
- C:\Windows\System\IHzZYpH.exe
  C:\Windows\System\IHzZYpH.exe
  2⤵
  PID:2176
- C:\Windows\System\HVKjDuW.exe
  C:\Windows\System\HVKjDuW.exe
  2⤵
  PID:4348
- C:\Windows\System\vJUpaRS.exe
  C:\Windows\System\vJUpaRS.exe
  2⤵
  PID:1044
- C:\Windows\System\TNGslKU.exe
  C:\Windows\System\TNGslKU.exe
  2⤵
  PID:3640
- C:\Windows\System\KGYmHZR.exe
  C:\Windows\System\KGYmHZR.exe
  2⤵
  PID:4436
- C:\Windows\System\mYNVDHb.exe
  C:\Windows\System\mYNVDHb.exe
  2⤵
  PID:4036
- C:\Windows\System\EdHIZOR.exe
  C:\Windows\System\EdHIZOR.exe
  2⤵
  PID:1460
- C:\Windows\System\pDnhgZH.exe
  C:\Windows\System\pDnhgZH.exe
  2⤵
  PID:2308
- C:\Windows\System\dneMRAh.exe
  C:\Windows\System\dneMRAh.exe
  2⤵
  PID:5124
- C:\Windows\System\IdVXuDL.exe
  C:\Windows\System\IdVXuDL.exe
  2⤵
  PID:5152
- C:\Windows\System\ECSRbsS.exe
  C:\Windows\System\ECSRbsS.exe
  2⤵
  PID:5180
- C:\Windows\System\SGaIbtt.exe
  C:\Windows\System\SGaIbtt.exe
  2⤵
  PID:5212
- C:\Windows\System\yKruZxU.exe
  C:\Windows\System\yKruZxU.exe
  2⤵
  PID:5240
- C:\Windows\System\TpcwiRX.exe
  C:\Windows\System\TpcwiRX.exe
  2⤵
  PID:5268
- C:\Windows\System\gkEQRiw.exe
  C:\Windows\System\gkEQRiw.exe
  2⤵
  PID:5292
- C:\Windows\System\teecdtG.exe
  C:\Windows\System\teecdtG.exe
  2⤵
  PID:5320
- C:\Windows\System\xAumdLs.exe
  C:\Windows\System\xAumdLs.exe
  2⤵
  PID:5348
- C:\Windows\System\ymQSSST.exe
  C:\Windows\System\ymQSSST.exe
  2⤵
  PID:5376
- C:\Windows\System\NNemTZE.exe
  C:\Windows\System\NNemTZE.exe
  2⤵
  PID:5404
- C:\Windows\System\hLAvAnr.exe
  C:\Windows\System\hLAvAnr.exe
  2⤵
  PID:5432
- C:\Windows\System\tqIfsHb.exe
  C:\Windows\System\tqIfsHb.exe
  2⤵
  PID:5464
- C:\Windows\System\RxxVGpQ.exe
  C:\Windows\System\RxxVGpQ.exe
  2⤵
  PID:5488
- C:\Windows\System\OWnTFrO.exe
  C:\Windows\System\OWnTFrO.exe
  2⤵
  PID:5516
- C:\Windows\System\zesKfPx.exe
  C:\Windows\System\zesKfPx.exe
  2⤵
  PID:5548
- C:\Windows\System\KodFlwB.exe
  C:\Windows\System\KodFlwB.exe
  2⤵
  PID:5576
- C:\Windows\System\CeHjYhj.exe
  C:\Windows\System\CeHjYhj.exe
  2⤵
  PID:5600
- C:\Windows\System\vWPgApi.exe
  C:\Windows\System\vWPgApi.exe
  2⤵
  PID:5628
- C:\Windows\System\VDlWsJQ.exe
  C:\Windows\System\VDlWsJQ.exe
  2⤵
  PID:5656
- C:\Windows\System\yBqClvU.exe
  C:\Windows\System\yBqClvU.exe
  2⤵
  PID:5684
- C:\Windows\System\hZVJHUh.exe
  C:\Windows\System\hZVJHUh.exe
  2⤵
  PID:5712
- C:\Windows\System\jQrlUNP.exe
  C:\Windows\System\jQrlUNP.exe
  2⤵
  PID:5744
- C:\Windows\System\SdTAxtX.exe
  C:\Windows\System\SdTAxtX.exe
  2⤵
  PID:5772
- C:\Windows\System\eFNqfdS.exe
  C:\Windows\System\eFNqfdS.exe
  2⤵
  PID:5796
- C:\Windows\System\NFoIXsA.exe
  C:\Windows\System\NFoIXsA.exe
  2⤵
  PID:5824
- C:\Windows\System\oFAvLeY.exe
  C:\Windows\System\oFAvLeY.exe
  2⤵
  PID:5852
- C:\Windows\System\QpkbsPH.exe
  C:\Windows\System\QpkbsPH.exe
  2⤵
  PID:5880
- C:\Windows\System\cIhkIGy.exe
  C:\Windows\System\cIhkIGy.exe
  2⤵
  PID:5908
- C:\Windows\System\YpeCaBj.exe
  C:\Windows\System\YpeCaBj.exe
  2⤵
  PID:5936
- C:\Windows\System\vcynMmf.exe
  C:\Windows\System\vcynMmf.exe
  2⤵
  PID:5964
- C:\Windows\System\qZcsRug.exe
  C:\Windows\System\qZcsRug.exe
  2⤵
  PID:6028
- C:\Windows\System\TZGHuth.exe
  C:\Windows\System\TZGHuth.exe
  2⤵
  PID:6044
- C:\Windows\System\AetsMKT.exe
  C:\Windows\System\AetsMKT.exe
  2⤵
  PID:6060
- C:\Windows\System\CvrdTxk.exe
  C:\Windows\System\CvrdTxk.exe
  2⤵
  PID:6088
- C:\Windows\System\bReegza.exe
  C:\Windows\System\bReegza.exe
  2⤵
  PID:6116
- C:\Windows\System\pfBATfX.exe
  C:\Windows\System\pfBATfX.exe
  2⤵
  PID:6132
- C:\Windows\System\UHOESOV.exe
  C:\Windows\System\UHOESOV.exe
  2⤵
  PID:4044
- C:\Windows\System\jmNIqix.exe
  C:\Windows\System\jmNIqix.exe
  2⤵
  PID:1712
- C:\Windows\System\eXvEqmZ.exe
  C:\Windows\System\eXvEqmZ.exe
  2⤵
  PID:968
- C:\Windows\System\FsLlaNd.exe
  C:\Windows\System\FsLlaNd.exe
  2⤵
  PID:1972
- C:\Windows\System\mMQicGJ.exe
  C:\Windows\System\mMQicGJ.exe
  2⤵
  PID:596
- C:\Windows\System\KzuyqrZ.exe
  C:\Windows\System\KzuyqrZ.exe
  2⤵
  PID:4976
- C:\Windows\System\rJLqoRL.exe
  C:\Windows\System\rJLqoRL.exe
  2⤵
  PID:2748
- C:\Windows\System\OlXvZhV.exe
  C:\Windows\System\OlXvZhV.exe
  2⤵
  PID:2924
- C:\Windows\System\gidkHBa.exe
  C:\Windows\System\gidkHBa.exe
  2⤵
  PID:5168
- C:\Windows\System\wnCmKbK.exe
  C:\Windows\System\wnCmKbK.exe
  2⤵
  PID:5248
- C:\Windows\System\IgZCsAb.exe
  C:\Windows\System\IgZCsAb.exe
  2⤵
  PID:5304
- C:\Windows\System\fOIdluz.exe
  C:\Windows\System\fOIdluz.exe
  2⤵
  PID:5364
- C:\Windows\System\hDxyhdk.exe
  C:\Windows\System\hDxyhdk.exe
  2⤵
  PID:5428
- C:\Windows\System\BCUvsAa.exe
  C:\Windows\System\BCUvsAa.exe
  2⤵
  PID:5484
- C:\Windows\System\VdvONRJ.exe
  C:\Windows\System\VdvONRJ.exe
  2⤵
  PID:5556
- C:\Windows\System\XbdChfP.exe
  C:\Windows\System\XbdChfP.exe
  2⤵
  PID:5616
- C:\Windows\System\iflswTn.exe
  C:\Windows\System\iflswTn.exe
  2⤵
  PID:5672
- C:\Windows\System\pnhEtJw.exe
  C:\Windows\System\pnhEtJw.exe
  2⤵
  PID:5780
- C:\Windows\System\NCaGgVt.exe
  C:\Windows\System\NCaGgVt.exe
  2⤵
  PID:5844
- C:\Windows\System\huOkaLu.exe
  C:\Windows\System\huOkaLu.exe
  2⤵
  PID:5920
- C:\Windows\System\cyrQoTz.exe
  C:\Windows\System\cyrQoTz.exe
  2⤵
  PID:5976
- C:\Windows\System\VTHhfLQ.exe
  C:\Windows\System\VTHhfLQ.exe
  2⤵
  PID:6040
- C:\Windows\System\SPYiFlC.exe
  C:\Windows\System\SPYiFlC.exe
  2⤵
  PID:4068
- C:\Windows\System\yXYQGOS.exe
  C:\Windows\System\yXYQGOS.exe
  2⤵
  PID:4488
- C:\Windows\System\dmTrBYd.exe
  C:\Windows\System\dmTrBYd.exe
  2⤵
  PID:3420
- C:\Windows\System\eKAWnaP.exe
  C:\Windows\System\eKAWnaP.exe
  2⤵
  PID:4128
- C:\Windows\System\KtnBFZz.exe
  C:\Windows\System\KtnBFZz.exe
  2⤵
  PID:3984
- C:\Windows\System\zBqnpcG.exe
  C:\Windows\System\zBqnpcG.exe
  2⤵
  PID:5164
- C:\Windows\System\CNmiNum.exe
  C:\Windows\System\CNmiNum.exe
  2⤵
  PID:5336
- C:\Windows\System\nRUXmRl.exe
  C:\Windows\System\nRUXmRl.exe
  2⤵
  PID:5452
- C:\Windows\System\yOpoAcm.exe
  C:\Windows\System\yOpoAcm.exe
  2⤵
  PID:5592
- C:\Windows\System\cJvMyyn.exe
  C:\Windows\System\cJvMyyn.exe
  2⤵
  PID:5732
- C:\Windows\System\jGiSFQU.exe
  C:\Windows\System\jGiSFQU.exe
  2⤵
  PID:5892
- C:\Windows\System\oQLaJlN.exe
  C:\Windows\System\oQLaJlN.exe
  2⤵
  PID:5984
- C:\Windows\System\pnymSbh.exe
  C:\Windows\System\pnymSbh.exe
  2⤵
  PID:4860
- C:\Windows\System\LuGHarH.exe
  C:\Windows\System\LuGHarH.exe
  2⤵
  PID:6172
- C:\Windows\System\JqyvJMe.exe
  C:\Windows\System\JqyvJMe.exe
  2⤵
  PID:6196
- C:\Windows\System\WgAHkqB.exe
  C:\Windows\System\WgAHkqB.exe
  2⤵
  PID:6228
- C:\Windows\System\vokFUqQ.exe
  C:\Windows\System\vokFUqQ.exe
  2⤵
  PID:6252
- C:\Windows\System\VokEoPx.exe
  C:\Windows\System\VokEoPx.exe
  2⤵
  PID:6284
- C:\Windows\System\pUDuyUv.exe
  C:\Windows\System\pUDuyUv.exe
  2⤵
  PID:6308
- C:\Windows\System\HPSHeyi.exe
  C:\Windows\System\HPSHeyi.exe
  2⤵
  PID:6336
- C:\Windows\System\CKpWboa.exe
  C:\Windows\System\CKpWboa.exe
  2⤵
  PID:6364
- C:\Windows\System\zfzsgYU.exe
  C:\Windows\System\zfzsgYU.exe
  2⤵
  PID:6392
- C:\Windows\System\HJGrOvB.exe
  C:\Windows\System\HJGrOvB.exe
  2⤵
  PID:6420
- C:\Windows\System\pUzUmgk.exe
  C:\Windows\System\pUzUmgk.exe
  2⤵
  PID:6448
- C:\Windows\System\PrhVUkj.exe
  C:\Windows\System\PrhVUkj.exe
  2⤵
  PID:6480
- C:\Windows\System\mBywRJk.exe
  C:\Windows\System\mBywRJk.exe
  2⤵
  PID:6508
- C:\Windows\System\LvQqpvo.exe
  C:\Windows\System\LvQqpvo.exe
  2⤵
  PID:6532
- C:\Windows\System\sYqdPGt.exe
  C:\Windows\System\sYqdPGt.exe
  2⤵
  PID:6564
- C:\Windows\System\rvECDfO.exe
  C:\Windows\System\rvECDfO.exe
  2⤵
  PID:6592
- C:\Windows\System\AFAPPdN.exe
  C:\Windows\System\AFAPPdN.exe
  2⤵
  PID:6620
- C:\Windows\System\MpOjSNj.exe
  C:\Windows\System\MpOjSNj.exe
  2⤵
  PID:6644
- C:\Windows\System\HajdHnk.exe
  C:\Windows\System\HajdHnk.exe
  2⤵
  PID:6672
- C:\Windows\System\IlhqaUV.exe
  C:\Windows\System\IlhqaUV.exe
  2⤵
  PID:6744
- C:\Windows\System\wCHygAC.exe
  C:\Windows\System\wCHygAC.exe
  2⤵
  PID:6764
- C:\Windows\System\nWPqGAK.exe
  C:\Windows\System\nWPqGAK.exe
  2⤵
  PID:6800
- C:\Windows\System\htwArGL.exe
  C:\Windows\System\htwArGL.exe
  2⤵
  PID:6820
- C:\Windows\System\cZMoBCF.exe
  C:\Windows\System\cZMoBCF.exe
  2⤵
  PID:6860
- C:\Windows\System\kKEWuth.exe
  C:\Windows\System\kKEWuth.exe
  2⤵
  PID:6876
- C:\Windows\System\GDfjYLR.exe
  C:\Windows\System\GDfjYLR.exe
  2⤵
  PID:6920
- C:\Windows\System\FWntKYa.exe
  C:\Windows\System\FWntKYa.exe
  2⤵
  PID:6948
- C:\Windows\System\VgOmNmt.exe
  C:\Windows\System\VgOmNmt.exe
  2⤵
  PID:6964
- C:\Windows\System\FUhEbgf.exe
  C:\Windows\System\FUhEbgf.exe
  2⤵
  PID:7004
- C:\Windows\System\KYtKhtg.exe
  C:\Windows\System\KYtKhtg.exe
  2⤵
  PID:7032
- C:\Windows\System\sXWcMHL.exe
  C:\Windows\System\sXWcMHL.exe
  2⤵
  PID:7048
- C:\Windows\System\eAOTMxr.exe
  C:\Windows\System\eAOTMxr.exe
  2⤵
  PID:7072
- C:\Windows\System\IQCgoDM.exe
  C:\Windows\System\IQCgoDM.exe
  2⤵
  PID:7104
- C:\Windows\System\TfzByQx.exe
  C:\Windows\System\TfzByQx.exe
  2⤵
  PID:7132
- C:\Windows\System\CwdemKg.exe
  C:\Windows\System\CwdemKg.exe
  2⤵
  PID:7160
- C:\Windows\System\CbjiCOQ.exe
  C:\Windows\System\CbjiCOQ.exe
  2⤵
  PID:5012
- C:\Windows\System\jIVxlDG.exe
  C:\Windows\System\jIVxlDG.exe
  2⤵
  PID:5276
- C:\Windows\System\VavHpvu.exe
  C:\Windows\System\VavHpvu.exe
  2⤵
  PID:5528
- C:\Windows\System\sXeysjk.exe
  C:\Windows\System\sXeysjk.exe
  2⤵
  PID:5836
- C:\Windows\System\IGCqPxa.exe
  C:\Windows\System\IGCqPxa.exe
  2⤵
  PID:6124
- C:\Windows\System\SJMjXaF.exe
  C:\Windows\System\SJMjXaF.exe
  2⤵
  PID:6212
- C:\Windows\System\CzqfcIF.exe
  C:\Windows\System\CzqfcIF.exe
  2⤵
  PID:6248
- C:\Windows\System\jMTVjpz.exe
  C:\Windows\System\jMTVjpz.exe
  2⤵
  PID:6300
- C:\Windows\System\GxsVpUW.exe
  C:\Windows\System\GxsVpUW.exe
  2⤵
  PID:6332
- C:\Windows\System\pfOYslc.exe
  C:\Windows\System\pfOYslc.exe
  2⤵
  PID:6384
- C:\Windows\System\rMaJqyI.exe
  C:\Windows\System\rMaJqyI.exe
  2⤵
  PID:6460
- C:\Windows\System\owvKNpT.exe
  C:\Windows\System\owvKNpT.exe
  2⤵
  PID:6500
- C:\Windows\System\xchsTgM.exe
  C:\Windows\System\xchsTgM.exe
  2⤵
  PID:6552
- C:\Windows\System\zbADAVg.exe
  C:\Windows\System\zbADAVg.exe
  2⤵
  PID:6604
- C:\Windows\System\YJcGSDP.exe
  C:\Windows\System\YJcGSDP.exe
  2⤵
  PID:6612
- C:\Windows\System\nvrSFfg.exe
  C:\Windows\System\nvrSFfg.exe
  2⤵
  PID:6660
- C:\Windows\System\zVdgRxQ.exe
  C:\Windows\System\zVdgRxQ.exe
  2⤵
  PID:2348
- C:\Windows\System\yFgbmyZ.exe
  C:\Windows\System\yFgbmyZ.exe
  2⤵
  PID:4868
- C:\Windows\System\qkDuzCf.exe
  C:\Windows\System\qkDuzCf.exe
  2⤵
  PID:4676
- C:\Windows\System\ztgfyDm.exe
  C:\Windows\System\ztgfyDm.exe
  2⤵
  PID:6752
- C:\Windows\System\SgLbcVu.exe
  C:\Windows\System\SgLbcVu.exe
  2⤵
  PID:6816
- C:\Windows\System\ffJXkxU.exe
  C:\Windows\System\ffJXkxU.exe
  2⤵
  PID:6868
- C:\Windows\System\UjzOJxr.exe
  C:\Windows\System\UjzOJxr.exe
  2⤵
  PID:6940
- C:\Windows\System\uRacGuf.exe
  C:\Windows\System\uRacGuf.exe
  2⤵
  PID:6996
- C:\Windows\System\oNKYeEL.exe
  C:\Windows\System\oNKYeEL.exe
  2⤵
  PID:7068
- C:\Windows\System\qgXINGQ.exe
  C:\Windows\System\qgXINGQ.exe
  2⤵
  PID:7124
- C:\Windows\System\QWqkzwV.exe
  C:\Windows\System\QWqkzwV.exe
  2⤵
  PID:4516
- C:\Windows\System\ezvRKNX.exe
  C:\Windows\System\ezvRKNX.exe
  2⤵
  PID:5724
- C:\Windows\System\AUXlUQH.exe
  C:\Windows\System\AUXlUQH.exe
  2⤵
  PID:6188
- C:\Windows\System\jPYAyAH.exe
  C:\Windows\System\jPYAyAH.exe
  2⤵
  PID:6276
- C:\Windows\System\DXBGepb.exe
  C:\Windows\System\DXBGepb.exe
  2⤵
  PID:6328
- C:\Windows\System\kYDzjBZ.exe
  C:\Windows\System\kYDzjBZ.exe
  2⤵
  PID:32
- C:\Windows\System\LbQnIuG.exe
  C:\Windows\System\LbQnIuG.exe
  2⤵
  PID:6580
- C:\Windows\System\ujYTVvV.exe
  C:\Windows\System\ujYTVvV.exe
  2⤵
  PID:6664
- C:\Windows\System\jFgjyhv.exe
  C:\Windows\System\jFgjyhv.exe
  2⤵
  PID:3332
- C:\Windows\System\ujnrcXf.exe
  C:\Windows\System\ujnrcXf.exe
  2⤵
  PID:6916
- C:\Windows\System\oYXlkdT.exe
  C:\Windows\System\oYXlkdT.exe
  2⤵
  PID:7088
- C:\Windows\System\ddbjHoB.exe
  C:\Windows\System\ddbjHoB.exe
  2⤵
  PID:7120
- C:\Windows\System\wqFFyrN.exe
  C:\Windows\System\wqFFyrN.exe
  2⤵
  PID:3392
- C:\Windows\System\TLwOaWs.exe
  C:\Windows\System\TLwOaWs.exe
  2⤵
  PID:1540
- C:\Windows\System\bnIIILK.exe
  C:\Windows\System\bnIIILK.exe
  2⤵
  PID:6584
- C:\Windows\System\ybopSGf.exe
  C:\Windows\System\ybopSGf.exe
  2⤵
  PID:6980
- C:\Windows\System\yAqseCv.exe
  C:\Windows\System\yAqseCv.exe
  2⤵
  PID:3156
- C:\Windows\System\nDbdFhI.exe
  C:\Windows\System\nDbdFhI.exe
  2⤵
  PID:6632
- C:\Windows\System\vGphXYd.exe
  C:\Windows\System\vGphXYd.exe
  2⤵
  PID:2472
- C:\Windows\System\TslwrnU.exe
  C:\Windows\System\TslwrnU.exe
  2⤵
  PID:7180
- C:\Windows\System\WSYRTFY.exe
  C:\Windows\System\WSYRTFY.exe
  2⤵
  PID:7204
- C:\Windows\System\nAXelfV.exe
  C:\Windows\System\nAXelfV.exe
  2⤵
  PID:7268
- C:\Windows\System\OklaUWw.exe
  C:\Windows\System\OklaUWw.exe
  2⤵
  PID:7296
- C:\Windows\System\bJFepel.exe
  C:\Windows\System\bJFepel.exe
  2⤵
  PID:7324
- C:\Windows\System\ZBnTFxl.exe
  C:\Windows\System\ZBnTFxl.exe
  2⤵
  PID:7340
- C:\Windows\System\osJeRwY.exe
  C:\Windows\System\osJeRwY.exe
  2⤵
  PID:7368
- C:\Windows\System\CjsdOqJ.exe
  C:\Windows\System\CjsdOqJ.exe
  2⤵
  PID:7392
- C:\Windows\System\njUGtLx.exe
  C:\Windows\System\njUGtLx.exe
  2⤵
  PID:7420
- C:\Windows\System\odvJxzC.exe
  C:\Windows\System\odvJxzC.exe
  2⤵
  PID:7440
- C:\Windows\System\vjcGXyT.exe
  C:\Windows\System\vjcGXyT.exe
  2⤵
  PID:7468
- C:\Windows\System\aPIGeXE.exe
  C:\Windows\System\aPIGeXE.exe
  2⤵
  PID:7520
- C:\Windows\System\EuhDQUu.exe
  C:\Windows\System\EuhDQUu.exe
  2⤵
  PID:7540
- C:\Windows\System\qQTRDyH.exe
  C:\Windows\System\qQTRDyH.exe
  2⤵
  PID:7564
- C:\Windows\System\zoucSKt.exe
  C:\Windows\System\zoucSKt.exe
  2⤵
  PID:7584
- C:\Windows\System\hSasKIM.exe
  C:\Windows\System\hSasKIM.exe
  2⤵
  PID:7620
- C:\Windows\System\FrkbOPl.exe
  C:\Windows\System\FrkbOPl.exe
  2⤵
  PID:7660
- C:\Windows\System\nmGbRFw.exe
  C:\Windows\System\nmGbRFw.exe
  2⤵
  PID:7688
- C:\Windows\System\NzkRotm.exe
  C:\Windows\System\NzkRotm.exe
  2⤵
  PID:7716
- C:\Windows\System\HkmisBa.exe
  C:\Windows\System\HkmisBa.exe
  2⤵
  PID:7732
- C:\Windows\System\TswpgsB.exe
  C:\Windows\System\TswpgsB.exe
  2⤵
  PID:7784
- C:\Windows\System\QZTtyKy.exe
  C:\Windows\System\QZTtyKy.exe
  2⤵
  PID:7800
- C:\Windows\System\hHxDRwP.exe
  C:\Windows\System\hHxDRwP.exe
  2⤵
  PID:7828
- C:\Windows\System\AmkcXJY.exe
  C:\Windows\System\AmkcXJY.exe
  2⤵
  PID:7856
- C:\Windows\System\vWiuavc.exe
  C:\Windows\System\vWiuavc.exe
  2⤵
  PID:7876
- C:\Windows\System\XJDKYCR.exe
  C:\Windows\System\XJDKYCR.exe
  2⤵
  PID:7900
- C:\Windows\System\FQCkHoX.exe
  C:\Windows\System\FQCkHoX.exe
  2⤵
  PID:7920
- C:\Windows\System\VMEBNQc.exe
  C:\Windows\System\VMEBNQc.exe
  2⤵
  PID:7956
- C:\Windows\System\ibwTkuB.exe
  C:\Windows\System\ibwTkuB.exe
  2⤵
  PID:7996
- C:\Windows\System\RJdKrqF.exe
  C:\Windows\System\RJdKrqF.exe
  2⤵
  PID:8012
- C:\Windows\System\ElwcRWW.exe
  C:\Windows\System\ElwcRWW.exe
  2⤵
  PID:8040
- C:\Windows\System\pTBwzDl.exe
  C:\Windows\System\pTBwzDl.exe
  2⤵
  PID:8064
- C:\Windows\System\HsNaCFw.exe
  C:\Windows\System\HsNaCFw.exe
  2⤵
  PID:8100
- C:\Windows\System\cwjbKPW.exe
  C:\Windows\System\cwjbKPW.exe
  2⤵
  PID:8136
- C:\Windows\System\wvjNqjL.exe
  C:\Windows\System\wvjNqjL.exe
  2⤵
  PID:8164
- C:\Windows\System\xycOYlT.exe
  C:\Windows\System\xycOYlT.exe
  2⤵
  PID:5396
- C:\Windows\System\xwxwgow.exe
  C:\Windows\System\xwxwgow.exe
  2⤵
  PID:6244
- C:\Windows\System\IhSlYJe.exe
  C:\Windows\System\IhSlYJe.exe
  2⤵
  PID:7280
- C:\Windows\System\xwSAMlF.exe
  C:\Windows\System\xwSAMlF.exe
  2⤵
  PID:7312
- C:\Windows\System\BsEQQor.exe
  C:\Windows\System\BsEQQor.exe
  2⤵
  PID:7352
- C:\Windows\System\wXDTIgX.exe
  C:\Windows\System\wXDTIgX.exe
  2⤵
  PID:7388
- C:\Windows\System\uCEAPDP.exe
  C:\Windows\System\uCEAPDP.exe
  2⤵
  PID:7460
- C:\Windows\System\suJDYlv.exe
  C:\Windows\System\suJDYlv.exe
  2⤵
  PID:7508
- C:\Windows\System\rztMSaR.exe
  C:\Windows\System\rztMSaR.exe
  2⤵
  PID:7608
- C:\Windows\System\nBEatKV.exe
  C:\Windows\System\nBEatKV.exe
  2⤵
  PID:7700
- C:\Windows\System\SylDFWu.exe
  C:\Windows\System\SylDFWu.exe
  2⤵
  PID:920
- C:\Windows\System\OenbFee.exe
  C:\Windows\System\OenbFee.exe
  2⤵
  PID:7776
- C:\Windows\System\DvVbbtf.exe
  C:\Windows\System\DvVbbtf.exe
  2⤵
  PID:7812
- C:\Windows\System\cwGtddA.exe
  C:\Windows\System\cwGtddA.exe
  2⤵
  PID:7896
- C:\Windows\System\xpRDAqU.exe
  C:\Windows\System\xpRDAqU.exe
  2⤵
  PID:7988
- C:\Windows\System\xxPhEsE.exe
  C:\Windows\System\xxPhEsE.exe
  2⤵
  PID:8028
- C:\Windows\System\pmxNrLN.exe
  C:\Windows\System\pmxNrLN.exe
  2⤵
  PID:8124
- C:\Windows\System\mTVMVmE.exe
  C:\Windows\System\mTVMVmE.exe
  2⤵
  PID:8184
- C:\Windows\System\HOIzlSf.exe
  C:\Windows\System\HOIzlSf.exe
  2⤵
  PID:7244
- C:\Windows\System\qjbcMAF.exe
  C:\Windows\System\qjbcMAF.exe
  2⤵
  PID:7284
- C:\Windows\System\hWJyXkR.exe
  C:\Windows\System\hWJyXkR.exe
  2⤵
  PID:7412
- C:\Windows\System\RybFdWu.exe
  C:\Windows\System\RybFdWu.exe
  2⤵
  PID:7552
- C:\Windows\System\VoJRzLU.exe
  C:\Windows\System\VoJRzLU.exe
  2⤵
  PID:7452
- C:\Windows\System\gHNDfzf.exe
  C:\Windows\System\gHNDfzf.exe
  2⤵
  PID:7724
- C:\Windows\System\BlljUvu.exe
  C:\Windows\System\BlljUvu.exe
  2⤵
  PID:7844
- C:\Windows\System\luqrljd.exe
  C:\Windows\System\luqrljd.exe
  2⤵
  PID:8088
- C:\Windows\System\PEvlPbP.exe
  C:\Windows\System\PEvlPbP.exe
  2⤵
  PID:6796
- C:\Windows\System\YVDBGgg.exe
  C:\Windows\System\YVDBGgg.exe
  2⤵
  PID:7556
- C:\Windows\System\XNLSgYV.exe
  C:\Windows\System\XNLSgYV.exe
  2⤵
  PID:7336
- C:\Windows\System\PDlFmZg.exe
  C:\Windows\System\PDlFmZg.exe
  2⤵
  PID:7384
- C:\Windows\System\MwiEOdc.exe
  C:\Windows\System\MwiEOdc.exe
  2⤵
  PID:7580
- C:\Windows\System\msUsoHy.exe
  C:\Windows\System\msUsoHy.exe
  2⤵
  PID:8224
- C:\Windows\System\dmzmueH.exe
  C:\Windows\System\dmzmueH.exe
  2⤵
  PID:8248
- C:\Windows\System\KsZVDeq.exe
  C:\Windows\System\KsZVDeq.exe
  2⤵
  PID:8280
- C:\Windows\System\kzdQdPs.exe
  C:\Windows\System\kzdQdPs.exe
  2⤵
  PID:8304
- C:\Windows\System\BqRjzzp.exe
  C:\Windows\System\BqRjzzp.exe
  2⤵
  PID:8344
- C:\Windows\System\wVagNYP.exe
  C:\Windows\System\wVagNYP.exe
  2⤵
  PID:8368
- C:\Windows\System\jDnSYLG.exe
  C:\Windows\System\jDnSYLG.exe
  2⤵
  PID:8388
- C:\Windows\System\CkfxvXi.exe
  C:\Windows\System\CkfxvXi.exe
  2⤵
  PID:8408
- C:\Windows\System\NBmuZfL.exe
  C:\Windows\System\NBmuZfL.exe
  2⤵
  PID:8432
- C:\Windows\System\YwVOHBd.exe
  C:\Windows\System\YwVOHBd.exe
  2⤵
  PID:8456
- C:\Windows\System\nNKkzzU.exe
  C:\Windows\System\nNKkzzU.exe
  2⤵
  PID:8500
- C:\Windows\System\ITzDJIb.exe
  C:\Windows\System\ITzDJIb.exe
  2⤵
  PID:8536
- C:\Windows\System\TMRcQOc.exe
  C:\Windows\System\TMRcQOc.exe
  2⤵
  PID:8576
- C:\Windows\System\sJOrfqM.exe
  C:\Windows\System\sJOrfqM.exe
  2⤵
  PID:8612
- C:\Windows\System\zZdmTDO.exe
  C:\Windows\System\zZdmTDO.exe
  2⤵
  PID:8636
- C:\Windows\System\yvGcaxC.exe
  C:\Windows\System\yvGcaxC.exe
  2⤵
  PID:8660
- C:\Windows\System\EmkWDUy.exe
  C:\Windows\System\EmkWDUy.exe
  2⤵
  PID:8680
- C:\Windows\System\VcnaZhV.exe
  C:\Windows\System\VcnaZhV.exe
  2⤵
  PID:8740
- C:\Windows\System\bxkbgAP.exe
  C:\Windows\System\bxkbgAP.exe
  2⤵
  PID:8756
- C:\Windows\System\UjygXKP.exe
  C:\Windows\System\UjygXKP.exe
  2⤵
  PID:8784
- C:\Windows\System\wmuLKrH.exe
  C:\Windows\System\wmuLKrH.exe
  2⤵
  PID:8816
- C:\Windows\System\IDaEsoA.exe
  C:\Windows\System\IDaEsoA.exe
  2⤵
  PID:8852
- C:\Windows\System\ybepsWj.exe
  C:\Windows\System\ybepsWj.exe
  2⤵
  PID:8880
- C:\Windows\System\jfVTKXj.exe
  C:\Windows\System\jfVTKXj.exe
  2⤵
  PID:8908
- C:\Windows\System\SRZSBDR.exe
  C:\Windows\System\SRZSBDR.exe
  2⤵
  PID:8928
- C:\Windows\System\yyTYkBu.exe
  C:\Windows\System\yyTYkBu.exe
  2⤵
  PID:8952
- C:\Windows\System\nMOZBhg.exe
  C:\Windows\System\nMOZBhg.exe
  2⤵
  PID:8972
- C:\Windows\System\ddHEzjH.exe
  C:\Windows\System\ddHEzjH.exe
  2⤵
  PID:8988
- C:\Windows\System\JobnwEq.exe
  C:\Windows\System\JobnwEq.exe
  2⤵
  PID:9012
- C:\Windows\System\lEVvREJ.exe
  C:\Windows\System\lEVvREJ.exe
  2⤵
  PID:9032
- C:\Windows\System\cEwJnao.exe
  C:\Windows\System\cEwJnao.exe
  2⤵
  PID:9096
- C:\Windows\System\oRKRQmn.exe
  C:\Windows\System\oRKRQmn.exe
  2⤵
  PID:9124
- C:\Windows\System\dNoPDOJ.exe
  C:\Windows\System\dNoPDOJ.exe
  2⤵
  PID:9144
- C:\Windows\System\JCmUMvP.exe
  C:\Windows\System\JCmUMvP.exe
  2⤵
  PID:9164
- C:\Windows\System\ktzEPKA.exe
  C:\Windows\System\ktzEPKA.exe
  2⤵
  PID:9184
- C:\Windows\System\YlkIVqK.exe
  C:\Windows\System\YlkIVqK.exe
  2⤵
  PID:9212
- C:\Windows\System\gqbeRdJ.exe
  C:\Windows\System\gqbeRdJ.exe
  2⤵
  PID:7780
- C:\Windows\System\ZKOiGqb.exe
  C:\Windows\System\ZKOiGqb.exe
  2⤵
  PID:8244
- C:\Windows\System\XenLPof.exe
  C:\Windows\System\XenLPof.exe
  2⤵
  PID:8360
- C:\Windows\System\HpaBOPW.exe
  C:\Windows\System\HpaBOPW.exe
  2⤵
  PID:8384
- C:\Windows\System\qEloXEm.exe
  C:\Windows\System\qEloXEm.exe
  2⤵
  PID:8452
- C:\Windows\System\gwAsXYc.exe
  C:\Windows\System\gwAsXYc.exe
  2⤵
  PID:8560
- C:\Windows\System\UepWHMj.exe
  C:\Windows\System\UepWHMj.exe
  2⤵
  PID:8600
- C:\Windows\System\XkrevoI.exe
  C:\Windows\System\XkrevoI.exe
  2⤵
  PID:8676
- C:\Windows\System\DzBtFZh.exe
  C:\Windows\System\DzBtFZh.exe
  2⤵
  PID:8776
- C:\Windows\System\qCgPhAG.exe
  C:\Windows\System\qCgPhAG.exe
  2⤵
  PID:8824
- C:\Windows\System\nvRagdB.exe
  C:\Windows\System\nvRagdB.exe
  2⤵
  PID:8996
- C:\Windows\System\iMFOAFO.exe
  C:\Windows\System\iMFOAFO.exe
  2⤵
  PID:9088
- C:\Windows\System\WnLZWRC.exe
  C:\Windows\System\WnLZWRC.exe
  2⤵
  PID:9076
- C:\Windows\System\gfyvaJQ.exe
  C:\Windows\System\gfyvaJQ.exe
  2⤵
  PID:9180
- C:\Windows\System\SZzDajF.exe
  C:\Windows\System\SZzDajF.exe
  2⤵
  PID:9204
- C:\Windows\System\sSWQItE.exe
  C:\Windows\System\sSWQItE.exe
  2⤵
  PID:8272
- C:\Windows\System\MKGlJfv.exe
  C:\Windows\System\MKGlJfv.exe
  2⤵
  PID:8544
- C:\Windows\System\PaEdrXj.exe
  C:\Windows\System\PaEdrXj.exe
  2⤵
  PID:8672
- C:\Windows\System\WWUAXhf.exe
  C:\Windows\System\WWUAXhf.exe
  2⤵
  PID:8872
- C:\Windows\System\BvxjmtV.exe
  C:\Windows\System\BvxjmtV.exe
  2⤵
  PID:8960
- C:\Windows\System\lZfRVsc.exe
  C:\Windows\System\lZfRVsc.exe
  2⤵
  PID:9132
- C:\Windows\System\MzNvrZj.exe
  C:\Windows\System\MzNvrZj.exe
  2⤵
  PID:9176
- C:\Windows\System\ImckZGG.exe
  C:\Windows\System\ImckZGG.exe
  2⤵
  PID:8216
- C:\Windows\System\WYSHUIf.exe
  C:\Windows\System\WYSHUIf.exe
  2⤵
  PID:8748
- C:\Windows\System\LquREVY.exe
  C:\Windows\System\LquREVY.exe
  2⤵
  PID:9044
- C:\Windows\System\PiKeOcd.exe
  C:\Windows\System\PiKeOcd.exe
  2⤵
  PID:9256
- C:\Windows\System\qcfGpIw.exe
  C:\Windows\System\qcfGpIw.exe
  2⤵
  PID:9276
- C:\Windows\System\pwlyfbC.exe
  C:\Windows\System\pwlyfbC.exe
  2⤵
  PID:9308
- C:\Windows\System\hIdJElt.exe
  C:\Windows\System\hIdJElt.exe
  2⤵
  PID:9328
- C:\Windows\System\xQIWfSP.exe
  C:\Windows\System\xQIWfSP.exe
  2⤵
  PID:9356
- C:\Windows\System\VRNqklm.exe
  C:\Windows\System\VRNqklm.exe
  2⤵
  PID:9384
- C:\Windows\System\AlqNTGV.exe
  C:\Windows\System\AlqNTGV.exe
  2⤵
  PID:9440
- C:\Windows\System\LjLdIfo.exe
  C:\Windows\System\LjLdIfo.exe
  2⤵
  PID:9464
- C:\Windows\System\BdYCKVo.exe
  C:\Windows\System\BdYCKVo.exe
  2⤵
  PID:9496
- C:\Windows\System\dKYqjzU.exe
  C:\Windows\System\dKYqjzU.exe
  2⤵
  PID:9516
- C:\Windows\System\vhLaUFo.exe
  C:\Windows\System\vhLaUFo.exe
  2⤵
  PID:9536
- C:\Windows\System\zbsBRTF.exe
  C:\Windows\System\zbsBRTF.exe
  2⤵
  PID:9556
- C:\Windows\System\bBZLPbq.exe
  C:\Windows\System\bBZLPbq.exe
  2⤵
  PID:9584
- C:\Windows\System\WxIwoVc.exe
  C:\Windows\System\WxIwoVc.exe
  2⤵
  PID:9640
- C:\Windows\System\jZmmjjb.exe
  C:\Windows\System\jZmmjjb.exe
  2⤵
  PID:9656
- C:\Windows\System\BTGxtPo.exe
  C:\Windows\System\BTGxtPo.exe
  2⤵
  PID:9684
- C:\Windows\System\yWHABjm.exe
  C:\Windows\System\yWHABjm.exe
  2⤵
  PID:9700
- C:\Windows\System\GCIRsxT.exe
  C:\Windows\System\GCIRsxT.exe
  2⤵
  PID:9740
- C:\Windows\System\uxSuVca.exe
  C:\Windows\System\uxSuVca.exe
  2⤵
  PID:9760
- C:\Windows\System\LTwdsJA.exe
  C:\Windows\System\LTwdsJA.exe
  2⤵
  PID:9808
- C:\Windows\System\JTXGaRg.exe
  C:\Windows\System\JTXGaRg.exe
  2⤵
  PID:9828
- C:\Windows\System\WbgDqPQ.exe
  C:\Windows\System\WbgDqPQ.exe
  2⤵
  PID:9852
- C:\Windows\System\WFwncLY.exe
  C:\Windows\System\WFwncLY.exe
  2⤵
  PID:9880
- C:\Windows\System\tpeQaif.exe
  C:\Windows\System\tpeQaif.exe
  2⤵
  PID:9896
- C:\Windows\System\rtNWbmH.exe
  C:\Windows\System\rtNWbmH.exe
  2⤵
  PID:9916
- C:\Windows\System\unxwuBT.exe
  C:\Windows\System\unxwuBT.exe
  2⤵
  PID:9952
- C:\Windows\System\XrUqeXk.exe
  C:\Windows\System\XrUqeXk.exe
  2⤵
  PID:9980
- C:\Windows\System\XPWRIFO.exe
  C:\Windows\System\XPWRIFO.exe
  2⤵
  PID:10000
- C:\Windows\System\AowTYHZ.exe
  C:\Windows\System\AowTYHZ.exe
  2⤵
  PID:10024
- C:\Windows\System\wnJggoa.exe
  C:\Windows\System\wnJggoa.exe
  2⤵
  PID:10048
- C:\Windows\System\eIcKkiW.exe
  C:\Windows\System\eIcKkiW.exe
  2⤵
  PID:10080
- C:\Windows\System\EjJpwbP.exe
  C:\Windows\System\EjJpwbP.exe
  2⤵
  PID:10108
- C:\Windows\System\gdyIMBs.exe
  C:\Windows\System\gdyIMBs.exe
  2⤵
  PID:10136
- C:\Windows\System\wjSssAZ.exe
  C:\Windows\System\wjSssAZ.exe
  2⤵
  PID:10160
- C:\Windows\System\nLxKvYD.exe
  C:\Windows\System\nLxKvYD.exe
  2⤵
  PID:10204
- C:\Windows\System\RkuiLQO.exe
  C:\Windows\System\RkuiLQO.exe
  2⤵
  PID:8732
- C:\Windows\System\ydKaOuQ.exe
  C:\Windows\System\ydKaOuQ.exe
  2⤵
  PID:8596
- C:\Windows\System\CmhiIzc.exe
  C:\Windows\System\CmhiIzc.exe
  2⤵
  PID:9284
- C:\Windows\System\lkEPesD.exe
  C:\Windows\System\lkEPesD.exe
  2⤵
  PID:9324
- C:\Windows\System\dfSwHqp.exe
  C:\Windows\System\dfSwHqp.exe
  2⤵
  PID:9428
- C:\Windows\System\MAoXFDV.exe
  C:\Windows\System\MAoXFDV.exe
  2⤵
  PID:9484
- C:\Windows\System\QtWDhYv.exe
  C:\Windows\System\QtWDhYv.exe
  2⤵
  PID:9544
- C:\Windows\System\UitofYr.exe
  C:\Windows\System\UitofYr.exe
  2⤵
  PID:9580
- C:\Windows\System\IbWncFQ.exe
  C:\Windows\System\IbWncFQ.exe
  2⤵
  PID:9648
- C:\Windows\System\OcZRnjD.exe
  C:\Windows\System\OcZRnjD.exe
  2⤵
  PID:9736
- C:\Windows\System\hhzZjeV.exe
  C:\Windows\System\hhzZjeV.exe
  2⤵
  PID:9776
- C:\Windows\System\AijUIgH.exe
  C:\Windows\System\AijUIgH.exe
  2⤵
  PID:9816
- C:\Windows\System\BkOMwkV.exe
  C:\Windows\System\BkOMwkV.exe
  2⤵
  PID:9868
- C:\Windows\System\UnDmgvX.exe
  C:\Windows\System\UnDmgvX.exe
  2⤵
  PID:9964
- C:\Windows\System\IyEXThX.exe
  C:\Windows\System\IyEXThX.exe
  2⤵
  PID:9988
- C:\Windows\System\MAuveMM.exe
  C:\Windows\System\MAuveMM.exe
  2⤵
  PID:10100
- C:\Windows\System\maELKqy.exe
  C:\Windows\System\maELKqy.exe
  2⤵
  PID:10156
- C:\Windows\System\lEdFZdD.exe
  C:\Windows\System\lEdFZdD.exe
  2⤵
  PID:8700
- C:\Windows\System\NUeowcN.exe
  C:\Windows\System\NUeowcN.exe
  2⤵
  PID:9236
- C:\Windows\System\bNjhPFC.exe
  C:\Windows\System\bNjhPFC.exe
  2⤵
  PID:9524
- C:\Windows\System\QnnZRfd.exe
  C:\Windows\System\QnnZRfd.exe
  2⤵
  PID:9692
- C:\Windows\System\wOXGhdH.exe
  C:\Windows\System\wOXGhdH.exe
  2⤵
  PID:9940
- C:\Windows\System\BVNnAJq.exe
  C:\Windows\System\BVNnAJq.exe
  2⤵
  PID:9836
- C:\Windows\System\ZPewKLB.exe
  C:\Windows\System\ZPewKLB.exe
  2⤵
  PID:10068
- C:\Windows\System\SUGiWTB.exe
  C:\Windows\System\SUGiWTB.exe
  2⤵
  PID:10152
- C:\Windows\System\lQQGigZ.exe
  C:\Windows\System\lQQGigZ.exe
  2⤵
  PID:9472
- C:\Windows\System\WXsPjUJ.exe
  C:\Windows\System\WXsPjUJ.exe
  2⤵
  PID:10088
- C:\Windows\System\WmkQofE.exe
  C:\Windows\System\WmkQofE.exe
  2⤵
  PID:9424
- C:\Windows\System\DbDyonl.exe
  C:\Windows\System\DbDyonl.exe
  2⤵
  PID:9972
- C:\Windows\System\eNhsfun.exe
  C:\Windows\System\eNhsfun.exe
  2⤵
  PID:10260
- C:\Windows\System\WIATglx.exe
  C:\Windows\System\WIATglx.exe
  2⤵
  PID:10288
- C:\Windows\System\SoZexEk.exe
  C:\Windows\System\SoZexEk.exe
  2⤵
  PID:10312
- C:\Windows\System\HifMbHH.exe
  C:\Windows\System\HifMbHH.exe
  2⤵
  PID:10340
- C:\Windows\System\YFMfzQo.exe
  C:\Windows\System\YFMfzQo.exe
  2⤵
  PID:10364
- C:\Windows\System\XvxBaYh.exe
  C:\Windows\System\XvxBaYh.exe
  2⤵
  PID:10404
- C:\Windows\System\LKhmaah.exe
  C:\Windows\System\LKhmaah.exe
  2⤵
  PID:10432
- C:\Windows\System\vcILxMq.exe
  C:\Windows\System\vcILxMq.exe
  2⤵
  PID:10460
- C:\Windows\System\meWWAqA.exe
  C:\Windows\System\meWWAqA.exe
  2⤵
  PID:10492
- C:\Windows\System\YwIatcu.exe
  C:\Windows\System\YwIatcu.exe
  2⤵
  PID:10528
- C:\Windows\System\zCJeOTc.exe
  C:\Windows\System\zCJeOTc.exe
  2⤵
  PID:10544
- C:\Windows\System\dLzFvCG.exe
  C:\Windows\System\dLzFvCG.exe
  2⤵
  PID:10564
- C:\Windows\System\JsPXLHz.exe
  C:\Windows\System\JsPXLHz.exe
  2⤵
  PID:10588
- C:\Windows\System\BrWZbyK.exe
  C:\Windows\System\BrWZbyK.exe
  2⤵
  PID:10632
- C:\Windows\System\IPUdEDk.exe
  C:\Windows\System\IPUdEDk.exe
  2⤵
  PID:10652
- C:\Windows\System\MRiRCZA.exe
  C:\Windows\System\MRiRCZA.exe
  2⤵
  PID:10672
- C:\Windows\System\cDsLpoD.exe
  C:\Windows\System\cDsLpoD.exe
  2⤵
  PID:10712
- C:\Windows\System\UzhYtgd.exe
  C:\Windows\System\UzhYtgd.exe
  2⤵
  PID:10732
- C:\Windows\System\UbLeeiE.exe
  C:\Windows\System\UbLeeiE.exe
  2⤵
  PID:10752
- C:\Windows\System\ddFnrdm.exe
  C:\Windows\System\ddFnrdm.exe
  2⤵
  PID:10796
- C:\Windows\System\bCxDzvw.exe
  C:\Windows\System\bCxDzvw.exe
  2⤵
  PID:10824
- C:\Windows\System\dXIKleH.exe
  C:\Windows\System\dXIKleH.exe
  2⤵
  PID:10840
- C:\Windows\System\Cloukae.exe
  C:\Windows\System\Cloukae.exe
  2⤵
  PID:10884
- C:\Windows\System\XqpJSLc.exe
  C:\Windows\System\XqpJSLc.exe
  2⤵
  PID:10908
- C:\Windows\System\GJFeoAE.exe
  C:\Windows\System\GJFeoAE.exe
  2⤵
  PID:10944
- C:\Windows\System\IezfLCP.exe
  C:\Windows\System\IezfLCP.exe
  2⤵
  PID:10964
- C:\Windows\System\zoLMTmL.exe
  C:\Windows\System\zoLMTmL.exe
  2⤵
  PID:10984
- C:\Windows\System\HCnPZuV.exe
  C:\Windows\System\HCnPZuV.exe
  2⤵
  PID:11004
- C:\Windows\System\bcIPSOZ.exe
  C:\Windows\System\bcIPSOZ.exe
  2⤵
  PID:11036
- C:\Windows\System\YGQiFaa.exe
  C:\Windows\System\YGQiFaa.exe
  2⤵
  PID:11072
- C:\Windows\System\ZujPYdh.exe
  C:\Windows\System\ZujPYdh.exe
  2⤵
  PID:11104
- C:\Windows\System\plWMyMc.exe
  C:\Windows\System\plWMyMc.exe
  2⤵
  PID:11132
- C:\Windows\System\TEUmlxS.exe
  C:\Windows\System\TEUmlxS.exe
  2⤵
  PID:11152
- C:\Windows\System\YVCDxTq.exe
  C:\Windows\System\YVCDxTq.exe
  2⤵
  PID:11200
- C:\Windows\System\CyqdchN.exe
  C:\Windows\System\CyqdchN.exe
  2⤵
  PID:11228
- C:\Windows\System\mswEYNN.exe
  C:\Windows\System\mswEYNN.exe
  2⤵
  PID:11252
- C:\Windows\System\BntwdSF.exe
  C:\Windows\System\BntwdSF.exe
  2⤵
  PID:9156
- C:\Windows\System\UBwuTHi.exe
  C:\Windows\System\UBwuTHi.exe
  2⤵
  PID:10280
- C:\Windows\System\RyzOKqk.exe
  C:\Windows\System\RyzOKqk.exe
  2⤵
  PID:10356
- C:\Windows\System\QjlCEHC.exe
  C:\Windows\System\QjlCEHC.exe
  2⤵
  PID:10420
- C:\Windows\System\HIrafHy.exe
  C:\Windows\System\HIrafHy.exe
  2⤵
  PID:10512
- C:\Windows\System\uHzPXaz.exe
  C:\Windows\System\uHzPXaz.exe
  2⤵
  PID:10536
- C:\Windows\System\FAZJqLT.exe
  C:\Windows\System\FAZJqLT.exe
  2⤵
  PID:10572
- C:\Windows\System\eMXlPqE.exe
  C:\Windows\System\eMXlPqE.exe
  2⤵
  PID:10664
- C:\Windows\System\ezMFekr.exe
  C:\Windows\System\ezMFekr.exe
  2⤵
  PID:10740
- C:\Windows\System\FNWZUnB.exe
  C:\Windows\System\FNWZUnB.exe
  2⤵
  PID:10772
- C:\Windows\System\knOXRMz.exe
  C:\Windows\System\knOXRMz.exe
  2⤵
  PID:10812
- C:\Windows\System\FUpyWxt.exe
  C:\Windows\System\FUpyWxt.exe
  2⤵
  PID:10992
- C:\Windows\System\ehPawFQ.exe
  C:\Windows\System\ehPawFQ.exe
  2⤵
  PID:11024
- C:\Windows\System\OYdAdCS.exe
  C:\Windows\System\OYdAdCS.exe
  2⤵
  PID:11100
- C:\Windows\System\Qyvzpqw.exe
  C:\Windows\System\Qyvzpqw.exe
  2⤵
  PID:11172
- C:\Windows\System\yjVIvGY.exe
  C:\Windows\System\yjVIvGY.exe
  2⤵
  PID:11212
- C:\Windows\System\sMrrPVf.exe
  C:\Windows\System\sMrrPVf.exe
  2⤵
  PID:9376
- C:\Windows\System\QMlsUMQ.exe
  C:\Windows\System\QMlsUMQ.exe
  2⤵
  PID:10328
- C:\Windows\System\rLCClyE.exe
  C:\Windows\System\rLCClyE.exe
  2⤵
  PID:10504
- C:\Windows\System\JcDGtIs.exe
  C:\Windows\System\JcDGtIs.exe
  2⤵
  PID:10788
- C:\Windows\System\EIHekGW.exe
  C:\Windows\System\EIHekGW.exe
  2⤵
  PID:10868
- C:\Windows\System\KoYmNGs.exe
  C:\Windows\System\KoYmNGs.exe
  2⤵
  PID:10996
- C:\Windows\System\UckqpIE.exe
  C:\Windows\System\UckqpIE.exe
  2⤵
  PID:11140
- C:\Windows\System\SvxNkCf.exe
  C:\Windows\System\SvxNkCf.exe
  2⤵
  PID:10452
- C:\Windows\System\jYVyNrj.exe
  C:\Windows\System\jYVyNrj.exe
  2⤵
  PID:10708
- C:\Windows\System\sZnUHau.exe
  C:\Windows\System\sZnUHau.exe
  2⤵
  PID:11128
- C:\Windows\System\EYVmgXG.exe
  C:\Windows\System\EYVmgXG.exe
  2⤵
  PID:10660
- C:\Windows\System\omPDpWf.exe
  C:\Windows\System\omPDpWf.exe
  2⤵
  PID:10096
- C:\Windows\System\MAdEtgQ.exe
  C:\Windows\System\MAdEtgQ.exe
  2⤵
  PID:10556
- C:\Windows\System\DYgAeaf.exe
  C:\Windows\System\DYgAeaf.exe
  2⤵
  PID:11328
- C:\Windows\System\fyasUNX.exe
  C:\Windows\System\fyasUNX.exe
  2⤵
  PID:11348
- C:\Windows\System\hcekjTH.exe
  C:\Windows\System\hcekjTH.exe
  2⤵
  PID:11372
- C:\Windows\System\QEiPXqW.exe
  C:\Windows\System\QEiPXqW.exe
  2⤵
  PID:11400
- C:\Windows\System\dSamxKi.exe
  C:\Windows\System\dSamxKi.exe
  2⤵
  PID:11432
- C:\Windows\System\nlHrsYj.exe
  C:\Windows\System\nlHrsYj.exe
  2⤵
  PID:11460
- C:\Windows\System\hosZejC.exe
  C:\Windows\System\hosZejC.exe
  2⤵
  PID:11496
- C:\Windows\System\KYascmu.exe
  C:\Windows\System\KYascmu.exe
  2⤵
  PID:11516
- C:\Windows\System\Nxfibnx.exe
  C:\Windows\System\Nxfibnx.exe
  2⤵
  PID:11556
- C:\Windows\System\QtiAVjQ.exe
  C:\Windows\System\QtiAVjQ.exe
  2⤵
  PID:11596
- C:\Windows\System\awKfKFl.exe
  C:\Windows\System\awKfKFl.exe
  2⤵
  PID:11612
- C:\Windows\System\LnMsmoe.exe
  C:\Windows\System\LnMsmoe.exe
  2⤵
  PID:11644
- C:\Windows\System\nRpBTjY.exe
  C:\Windows\System\nRpBTjY.exe
  2⤵
  PID:11664
- C:\Windows\System\uTgooAi.exe
  C:\Windows\System\uTgooAi.exe
  2⤵
  PID:11688
- C:\Windows\System\VfBeGUJ.exe
  C:\Windows\System\VfBeGUJ.exe
  2⤵
  PID:11728
- C:\Windows\System\OdOJOre.exe
  C:\Windows\System\OdOJOre.exe
  2⤵
  PID:11748
- C:\Windows\System\zKKgpgw.exe
  C:\Windows\System\zKKgpgw.exe
  2⤵
  PID:11772
- C:\Windows\System\DfxFgvW.exe
  C:\Windows\System\DfxFgvW.exe
  2⤵
  PID:11812
- C:\Windows\System\zUzWLxi.exe
  C:\Windows\System\zUzWLxi.exe
  2⤵
  PID:11828
- C:\Windows\System\KTmDLWt.exe
  C:\Windows\System\KTmDLWt.exe
  2⤵
  PID:11872
- C:\Windows\System\QXCqCPp.exe
  C:\Windows\System\QXCqCPp.exe
  2⤵
  PID:11900
- C:\Windows\System\jlPdEGx.exe
  C:\Windows\System\jlPdEGx.exe
  2⤵
  PID:11928
- C:\Windows\System\jGCuqUC.exe
  C:\Windows\System\jGCuqUC.exe
  2⤵
  PID:11948
- C:\Windows\System\sJNVaMY.exe
  C:\Windows\System\sJNVaMY.exe
  2⤵
  PID:11968
- C:\Windows\System\nAEakzF.exe
  C:\Windows\System\nAEakzF.exe
  2⤵
  PID:11988
- C:\Windows\System\OlPnyBp.exe
  C:\Windows\System\OlPnyBp.exe
  2⤵
  PID:12040
- C:\Windows\System\HTszUiD.exe
  C:\Windows\System\HTszUiD.exe
  2⤵
  PID:12056
- C:\Windows\System\lwvLhvZ.exe
  C:\Windows\System\lwvLhvZ.exe
  2⤵
  PID:12080
- C:\Windows\System\YvRGsXV.exe
  C:\Windows\System\YvRGsXV.exe
  2⤵
  PID:12108
- C:\Windows\System\CHltkyZ.exe
  C:\Windows\System\CHltkyZ.exe
  2⤵
  PID:12128
- C:\Windows\System\ISlqpVm.exe
  C:\Windows\System\ISlqpVm.exe
  2⤵
  PID:12180
- C:\Windows\System\aweDsAq.exe
  C:\Windows\System\aweDsAq.exe
  2⤵
  PID:12208
- C:\Windows\System\buxXprk.exe
  C:\Windows\System\buxXprk.exe
  2⤵
  PID:12228
- C:\Windows\System\wbOiyNO.exe
  C:\Windows\System\wbOiyNO.exe
  2⤵
  PID:12248
- C:\Windows\System\VVbUjxm.exe
  C:\Windows\System\VVbUjxm.exe
  2⤵
  PID:11260
- C:\Windows\System\eMXvDUS.exe
  C:\Windows\System\eMXvDUS.exe
  2⤵
  PID:11160
- C:\Windows\System\SEkAMfC.exe
  C:\Windows\System\SEkAMfC.exe
  2⤵
  PID:11364
- C:\Windows\System\pvgxmme.exe
  C:\Windows\System\pvgxmme.exe
  2⤵
  PID:11412
- C:\Windows\System\NWaYkuY.exe
  C:\Windows\System\NWaYkuY.exe
  2⤵
  PID:11468
- C:\Windows\System\hAKjZeW.exe
  C:\Windows\System\hAKjZeW.exe
  2⤵
  PID:11564
- C:\Windows\System\yvcbtFt.exe
  C:\Windows\System\yvcbtFt.exe
  2⤵
  PID:11624
- C:\Windows\System\RXhgvxa.exe
  C:\Windows\System\RXhgvxa.exe
  2⤵
  PID:11720
- C:\Windows\System\OdwQzyy.exe
  C:\Windows\System\OdwQzyy.exe
  2⤵
  PID:11784
- C:\Windows\System\gVHeKJr.exe
  C:\Windows\System\gVHeKJr.exe
  2⤵
  PID:11804
- C:\Windows\System\ZONAbXT.exe
  C:\Windows\System\ZONAbXT.exe
  2⤵
  PID:11868
- C:\Windows\System\hXzSmmX.exe
  C:\Windows\System\hXzSmmX.exe
  2⤵
  PID:11912
- C:\Windows\System\vObVona.exe
  C:\Windows\System\vObVona.exe
  2⤵
  PID:11960
- C:\Windows\System\QQvIGmK.exe
  C:\Windows\System\QQvIGmK.exe
  2⤵
  PID:12052
- C:\Windows\System\KxQejhV.exe
  C:\Windows\System\KxQejhV.exe
  2⤵
  PID:12076
- C:\Windows\System\hwNUqzD.exe
  C:\Windows\System\hwNUqzD.exe
  2⤵
  PID:12196
- C:\Windows\System\OoHuDZS.exe
  C:\Windows\System\OoHuDZS.exe
  2⤵
  PID:11292
- C:\Windows\System\YbfCBbg.exe
  C:\Windows\System\YbfCBbg.exe
  2⤵
  PID:11488
- C:\Windows\System\qVURunN.exe
  C:\Windows\System\qVURunN.exe
  2⤵
  PID:11544
- C:\Windows\System\RwoIesL.exe
  C:\Windows\System\RwoIesL.exe
  2⤵
  PID:11724
- C:\Windows\System\ckiDoHs.exe
  C:\Windows\System\ckiDoHs.exe
  2⤵
  PID:11916
- C:\Windows\System\gnMrtWT.exe
  C:\Windows\System\gnMrtWT.exe
  2⤵
  PID:12004
- C:\Windows\System\kxuCKNY.exe
  C:\Windows\System\kxuCKNY.exe
  2⤵
  PID:12156
- C:\Windows\System\zjWvQkx.exe
  C:\Windows\System\zjWvQkx.exe
  2⤵
  PID:11384
- C:\Windows\System\GsxeLsJ.exe
  C:\Windows\System\GsxeLsJ.exe
  2⤵
  PID:11604
- C:\Windows\System\fDlObUp.exe
  C:\Windows\System\fDlObUp.exe
  2⤵
  PID:12140
- C:\Windows\System\qxgXQLP.exe
  C:\Windows\System\qxgXQLP.exe
  2⤵
  PID:11684
- C:\Windows\System\YsAULwY.exe
  C:\Windows\System\YsAULwY.exe
  2⤵
  PID:12240
- C:\Windows\System\QJqPxyp.exe
  C:\Windows\System\QJqPxyp.exe
  2⤵
  PID:12320
- C:\Windows\System\LcqRIwD.exe
  C:\Windows\System\LcqRIwD.exe
  2⤵
  PID:12340
- C:\Windows\System\nrqqoJF.exe
  C:\Windows\System\nrqqoJF.exe
  2⤵
  PID:12368
- C:\Windows\System\ndXsFVu.exe
  C:\Windows\System\ndXsFVu.exe
  2⤵
  PID:12392
- C:\Windows\System\jIpnMzm.exe
  C:\Windows\System\jIpnMzm.exe
  2⤵
  PID:12412
- C:\Windows\System\NzLwnGU.exe
  C:\Windows\System\NzLwnGU.exe
  2⤵
  PID:12436
- C:\Windows\System\yyUlSDu.exe
  C:\Windows\System\yyUlSDu.exe
  2⤵
  PID:12484
- C:\Windows\System\MMsIBiB.exe
  C:\Windows\System\MMsIBiB.exe
  2⤵
  PID:12508
- C:\Windows\System\waePiWW.exe
  C:\Windows\System\waePiWW.exe
  2⤵
  PID:12536
- C:\Windows\System\CcFoyBf.exe
  C:\Windows\System\CcFoyBf.exe
  2⤵
  PID:12552
- C:\Windows\System\YhRGxWJ.exe
  C:\Windows\System\YhRGxWJ.exe
  2⤵
  PID:12596
- C:\Windows\System\IEFUWTu.exe
  C:\Windows\System\IEFUWTu.exe
  2⤵
  PID:12620
- C:\Windows\System\HneorSj.exe
  C:\Windows\System\HneorSj.exe
  2⤵
  PID:12648
- C:\Windows\System\MlAZVfg.exe
  C:\Windows\System\MlAZVfg.exe
  2⤵
  PID:12672
- C:\Windows\System\slpygyw.exe
  C:\Windows\System\slpygyw.exe
  2⤵
  PID:12692
- C:\Windows\System\CzDLBrR.exe
  C:\Windows\System\CzDLBrR.exe
  2⤵
  PID:12716
- C:\Windows\System\kvWLGBW.exe
  C:\Windows\System\kvWLGBW.exe
  2⤵
  PID:12760
- C:\Windows\System\XRNUtdk.exe
  C:\Windows\System\XRNUtdk.exe
  2⤵
  PID:12776
- C:\Windows\System\UktndRg.exe
  C:\Windows\System\UktndRg.exe
  2⤵
  PID:12804
- C:\Windows\System\hYPRDAW.exe
  C:\Windows\System\hYPRDAW.exe
  2⤵
  PID:12856
- C:\Windows\System\okFMVDQ.exe
  C:\Windows\System\okFMVDQ.exe
  2⤵
  PID:12876
- C:\Windows\System\TMeUviO.exe
  C:\Windows\System\TMeUviO.exe
  2⤵
  PID:12904
- C:\Windows\System\uEQVFAy.exe
  C:\Windows\System\uEQVFAy.exe
  2⤵
  PID:12928
- C:\Windows\System\qPARAmY.exe
  C:\Windows\System\qPARAmY.exe
  2⤵
  PID:12952
- C:\Windows\System\NCqfpfw.exe
  C:\Windows\System\NCqfpfw.exe
  2⤵
  PID:12972
- C:\Windows\System\CHaNaEf.exe
  C:\Windows\System\CHaNaEf.exe
  2⤵
  PID:13000
- C:\Windows\System\EJTZAmi.exe
  C:\Windows\System\EJTZAmi.exe
  2⤵
  PID:13032
- C:\Windows\System\FEABjDF.exe
  C:\Windows\System\FEABjDF.exe
  2⤵
  PID:13052
- C:\Windows\System\DkShZCM.exe
  C:\Windows\System\DkShZCM.exe
  2⤵
  PID:13080
- C:\Windows\System\XjojngO.exe
  C:\Windows\System\XjojngO.exe
  2⤵
  PID:13100
- C:\Windows\System\jlZdUcj.exe
  C:\Windows\System\jlZdUcj.exe
  2⤵
  PID:13124
- C:\Windows\System\JYNHffS.exe
  C:\Windows\System\JYNHffS.exe
  2⤵
  PID:13148
- C:\Windows\System\kSXlnoN.exe
  C:\Windows\System\kSXlnoN.exe
  2⤵
  PID:13172
- C:\Windows\System\YZtuVrQ.exe
  C:\Windows\System\YZtuVrQ.exe
  2⤵
  PID:13204
- C:\Windows\System\vGraoQr.exe
  C:\Windows\System\vGraoQr.exe
  2⤵
  PID:13236
- C:\Windows\System\yswtKMW.exe
  C:\Windows\System\yswtKMW.exe
  2⤵
  PID:13260
- C:\Windows\System\VYPuDhC.exe
  C:\Windows\System\VYPuDhC.exe
  2⤵
  PID:13304
- C:\Windows\System\opvdhal.exe
  C:\Windows\System\opvdhal.exe
  2⤵
  PID:12312
- C:\Windows\System\DVswiBZ.exe
  C:\Windows\System\DVswiBZ.exe
  2⤵
  PID:12376
- C:\Windows\System\cUYUqnw.exe
  C:\Windows\System\cUYUqnw.exe
  2⤵
  PID:12456
- C:\Windows\System\nQliISj.exe
  C:\Windows\System\nQliISj.exe
  2⤵
  PID:12468
- C:\Windows\System\TeLSClA.exe
  C:\Windows\System\TeLSClA.exe
  2⤵
  PID:12520
- C:\Windows\System\kneHveD.exe
  C:\Windows\System\kneHveD.exe
  2⤵
  PID:12576
- C:\Windows\System\xjSZxWv.exe
  C:\Windows\System\xjSZxWv.exe
  2⤵
  PID:12632
- C:\Windows\System\rAfCtRY.exe
  C:\Windows\System\rAfCtRY.exe
  2⤵
  PID:12688
- C:\Windows\System\DHkThMp.exe
  C:\Windows\System\DHkThMp.exe
  2⤵
  PID:12788
- C:\Windows\System\QYBUvmd.exe
  C:\Windows\System\QYBUvmd.exe
  2⤵
  PID:12828
- C:\Windows\System\YerFahM.exe
  C:\Windows\System\YerFahM.exe
  2⤵
  PID:12948
- C:\Windows\System\LcfAyeA.exe
  C:\Windows\System\LcfAyeA.exe
  2⤵
  PID:13092
- C:\Windows\System\pEMVmuo.exe
  C:\Windows\System\pEMVmuo.exe
  2⤵
  PID:13136
- C:\Windows\System\oxLIxgx.exe
  C:\Windows\System\oxLIxgx.exe
  2⤵
  PID:13164
- C:\Windows\System\VAsEMHQ.exe
  C:\Windows\System\VAsEMHQ.exe
  2⤵
  PID:12292
- C:\Windows\System\lnSLTLC.exe
  C:\Windows\System\lnSLTLC.exe
  2⤵
  PID:13256
- C:\Windows\System\WtulPhG.exe
  C:\Windows\System\WtulPhG.exe
  2⤵
  PID:12460
- C:\Windows\System\MvgdmBJ.exe
  C:\Windows\System\MvgdmBJ.exe
  2⤵
  PID:12740
- C:\Windows\System\FMtFowX.exe
  C:\Windows\System\FMtFowX.exe
  2⤵
  PID:12644
- C:\Windows\System\MrrpnOB.exe
  C:\Windows\System\MrrpnOB.exe
  2⤵
  PID:12996
- C:\Windows\System\ArBDgdP.exe
  C:\Windows\System\ArBDgdP.exe
  2⤵
  PID:13192
- C:\Windows\System\kqaRuQQ.exe
  C:\Windows\System\kqaRuQQ.exe
  2⤵
  PID:13252
- C:\Windows\System\euxlWcR.exe
  C:\Windows\System\euxlWcR.exe
  2⤵
  PID:12332
- C:\Windows\System\hSVhoAt.exe
  C:\Windows\System\hSVhoAt.exe
  2⤵
  PID:12892
- C:\Windows\System\JmsahqR.exe
  C:\Windows\System\JmsahqR.exe
  2⤵
  PID:13276
- C:\Windows\System\MpdorDO.exe
  C:\Windows\System\MpdorDO.exe
  2⤵
  PID:13120
- C:\Windows\System\Jwiaufb.exe
  C:\Windows\System\Jwiaufb.exe
  2⤵
  PID:13316
- C:\Windows\System\EzHQZvE.exe
  C:\Windows\System\EzHQZvE.exe
  2⤵
  PID:13332
- C:\Windows\System\JtPmeAx.exe
  C:\Windows\System\JtPmeAx.exe
  2⤵
  PID:13396
- C:\Windows\System\IZnoqhs.exe
  C:\Windows\System\IZnoqhs.exe
  2⤵
  PID:13412
- C:\Windows\System\LptWYQj.exe
  C:\Windows\System\LptWYQj.exe
  2⤵
  PID:13452
- C:\Windows\System\IZttLCI.exe
  C:\Windows\System\IZttLCI.exe
  2⤵
  PID:13484
- C:\Windows\System\YZzETXG.exe
  C:\Windows\System\YZzETXG.exe
  2⤵
  PID:13512
- C:\Windows\System\bMzCpPw.exe
  C:\Windows\System\bMzCpPw.exe
  2⤵
  PID:13532
- C:\Windows\System\rasNTuY.exe
  C:\Windows\System\rasNTuY.exe
  2⤵
  PID:13556
- C:\Windows\System\loXFGDL.exe
  C:\Windows\System\loXFGDL.exe
  2⤵
  PID:13572
- C:\Windows\System\KQyqVnj.exe
  C:\Windows\System\KQyqVnj.exe
  2⤵
  PID:13596
- C:\Windows\System\tlBzaHh.exe
  C:\Windows\System\tlBzaHh.exe
  2⤵
  PID:13620
- C:\Windows\System\DdUatSO.exe
  C:\Windows\System\DdUatSO.exe
  2⤵
  PID:13640
- C:\Windows\System\jqvyaDY.exe
  C:\Windows\System\jqvyaDY.exe
  2⤵
  PID:13664
- C:\Windows\System\qmmuUCE.exe
  C:\Windows\System\qmmuUCE.exe
  2⤵
  PID:13684
- C:\Windows\System\hdpyUxW.exe
  C:\Windows\System\hdpyUxW.exe
  2⤵
  PID:13724
- C:\Windows\System\EhMuBGI.exe
  C:\Windows\System\EhMuBGI.exe
  2⤵
  PID:13760
- C:\Windows\System\Ybakmis.exe
  C:\Windows\System\Ybakmis.exe
  2⤵
  PID:13796
- C:\Windows\System\UycOWfd.exe
  C:\Windows\System\UycOWfd.exe
  2⤵
  PID:13848
- C:\Windows\System\WGebYzg.exe
  C:\Windows\System\WGebYzg.exe
  2⤵
  PID:13864
- C:\Windows\System\bzacpHd.exe
  C:\Windows\System\bzacpHd.exe
  2⤵
  PID:13904
- C:\Windows\System\ZhwLJNG.exe
  C:\Windows\System\ZhwLJNG.exe
  2⤵
  PID:13932
- C:\Windows\System\eAAQWEI.exe
  C:\Windows\System\eAAQWEI.exe
  2⤵
  PID:13948
- C:\Windows\System\QzeeJId.exe
  C:\Windows\System\QzeeJId.exe
  2⤵
  PID:13964
- C:\Windows\System\vNcwPUI.exe
  C:\Windows\System\vNcwPUI.exe
  2⤵
  PID:13984
- C:\Windows\System\IZoQwjr.exe
  C:\Windows\System\IZoQwjr.exe
  2⤵
  PID:14012
- C:\Windows\System\QFIsgKk.exe
  C:\Windows\System\QFIsgKk.exe
  2⤵
  PID:14068
- C:\Windows\System\fpIpwyp.exe
  C:\Windows\System\fpIpwyp.exe
  2⤵
  PID:14096
- C:\Windows\System\zwxpBzd.exe
  C:\Windows\System\zwxpBzd.exe
  2⤵
  PID:14116
- C:\Windows\System\GvJhzAD.exe
  C:\Windows\System\GvJhzAD.exe
  2⤵
  PID:14156
- C:\Windows\System\UFETcPM.exe
  C:\Windows\System\UFETcPM.exe
  2⤵
  PID:14176
- C:\Windows\System\zELBdvP.exe
  C:\Windows\System\zELBdvP.exe
  2⤵
  PID:14200
- C:\Windows\System\RHASGqD.exe
  C:\Windows\System\RHASGqD.exe
  2⤵
  PID:14216
- C:\Windows\System\GOfQUQc.exe
  C:\Windows\System\GOfQUQc.exe
  2⤵
  PID:14244
- C:\Windows\System\unwPnUy.exe
  C:\Windows\System\unwPnUy.exe
  2⤵
  PID:14272
- C:\Windows\System\JmnWQPm.exe
  C:\Windows\System\JmnWQPm.exe
  2⤵
  PID:14288
- C:\Windows\System\siGCMTI.exe
  C:\Windows\System\siGCMTI.exe
  2⤵
  PID:14304
- C:\Windows\System\wfjiRnh.exe
  C:\Windows\System\wfjiRnh.exe
  2⤵
  PID:14320
- C:\Windows\System\gseACao.exe
  C:\Windows\System\gseACao.exe
  2⤵
  PID:13324
- C:\Windows\System\gLcmlvX.exe
  C:\Windows\System\gLcmlvX.exe
  2⤵
  PID:13368
- C:\Windows\System\ojfMtan.exe
  C:\Windows\System\ojfMtan.exe
  2⤵
  PID:13480
- C:\Windows\System\uaboIYu.exe
  C:\Windows\System\uaboIYu.exe
  2⤵
  PID:13568
- C:\Windows\System\URLDoul.exe
  C:\Windows\System\URLDoul.exe
  2⤵
  PID:13616
- C:\Windows\System\nCIgYjt.exe
  C:\Windows\System\nCIgYjt.exe
  2⤵
  PID:13720
- C:\Windows\System\AVfwMjX.exe
  C:\Windows\System\AVfwMjX.exe
  2⤵
  PID:13776
- C:\Windows\System\zsWZofs.exe
  C:\Windows\System\zsWZofs.exe
  2⤵
  PID:13860
- C:\Windows\System\QsLcDMW.exe
  C:\Windows\System\QsLcDMW.exe
  2⤵
  PID:13876
- C:\Windows\System\nkiDdQZ.exe
  C:\Windows\System\nkiDdQZ.exe
  2⤵
  PID:13928
- C:\Windows\System\sUmwapF.exe
  C:\Windows\System\sUmwapF.exe
  2⤵
  PID:14000
- C:\Windows\System\gaijkei.exe
  C:\Windows\System\gaijkei.exe
  2⤵
  PID:14044
- C:\Windows\System\leiQwlI.exe
  C:\Windows\System\leiQwlI.exe
  2⤵
  PID:14104
- C:\Windows\System\rUsxexx.exe
  C:\Windows\System\rUsxexx.exe
  2⤵
  PID:14152
- C:\Windows\System\gRfewCE.exe
  C:\Windows\System\gRfewCE.exe
  2⤵
  PID:14228
- C:\Windows\System\IDxhKZc.exe
  C:\Windows\System\IDxhKZc.exe
  2⤵
  PID:14252
- C:\Windows\System\pnAXoNM.exe
  C:\Windows\System\pnAXoNM.exe
  2⤵
  PID:14300
- C:\Windows\System\qihzjvj.exe
  C:\Windows\System\qihzjvj.exe
  2⤵
  PID:12732
- C:\Windows\System\bfMyNAX.exe
  C:\Windows\System\bfMyNAX.exe
  2⤵
  PID:13360
- C:\Windows\System\yKSaiaO.exe
  C:\Windows\System\yKSaiaO.exe
  2⤵
  PID:13528
- C:\Windows\System\ccjAVbi.exe
  C:\Windows\System\ccjAVbi.exe
  2⤵
  PID:13584
- C:\Windows\System\OCpwipB.exe
  C:\Windows\System\OCpwipB.exe
  2⤵
  PID:13656
- C:\Windows\System\MzxWFOQ.exe
  C:\Windows\System\MzxWFOQ.exe
  2⤵
  PID:13900
- C:\Windows\System\lZeKTQb.exe
  C:\Windows\System\lZeKTQb.exe
  2⤵
  PID:13856
- C:\Windows\System\gfVCOCd.exe
  C:\Windows\System\gfVCOCd.exe
  2⤵
  PID:14048
- C:\Windows\System\xzjjDaX.exe
  C:\Windows\System\xzjjDaX.exe
  2⤵
  PID:14080
- C:\Windows\System\kzWlZGm.exe
  C:\Windows\System\kzWlZGm.exe
  2⤵
  PID:14196
- C:\Windows\System\nondgmI.exe
  C:\Windows\System\nondgmI.exe
  2⤵
  PID:14140
- C:\Windows\System\aIgsoTW.exe
  C:\Windows\System\aIgsoTW.exe
  2⤵
  PID:14340
- C:\Windows\System\CqnhDiQ.exe
  C:\Windows\System\CqnhDiQ.exe
  2⤵
  PID:14360
- C:\Windows\System\mizWBGC.exe
  C:\Windows\System\mizWBGC.exe
  2⤵
  PID:14376
- C:\Windows\System\hnNEIUo.exe
  C:\Windows\System\hnNEIUo.exe
  2⤵
  PID:14400
- C:\Windows\System\ZyZZyld.exe
  C:\Windows\System\ZyZZyld.exe
  2⤵
  PID:14416
- C:\Windows\System\MqahauG.exe
  C:\Windows\System\MqahauG.exe
  2⤵
  PID:14448
- C:\Windows\System\kLSbYnj.exe
  C:\Windows\System\kLSbYnj.exe
  2⤵
  PID:14472
- C:\Windows\System\TZenelM.exe
  C:\Windows\System\TZenelM.exe
  2⤵
  PID:14488
- C:\Windows\System\lxfWiIR.exe
  C:\Windows\System\lxfWiIR.exe
  2⤵
  PID:14512
- C:\Windows\System\uMjfzdm.exe
  C:\Windows\System\uMjfzdm.exe
  2⤵
  PID:14536
- C:\Windows\System\aLgnKkR.exe
  C:\Windows\System\aLgnKkR.exe
  2⤵
  PID:14568
- C:\Windows\System\HywDibb.exe
  C:\Windows\System\HywDibb.exe
  2⤵
  PID:14584
- C:\Windows\System\qrfHyzg.exe
  C:\Windows\System\qrfHyzg.exe
  2⤵
  PID:14600
- C:\Windows\System\GjOskDU.exe
  C:\Windows\System\GjOskDU.exe
  2⤵
  PID:14624
- C:\Windows\System\rDYVcrL.exe
  C:\Windows\System\rDYVcrL.exe
  2⤵
  PID:14652
- C:\Windows\System\OxYJpFP.exe
  C:\Windows\System\OxYJpFP.exe
  2⤵
  PID:14672
- C:\Windows\System\RcQuwAA.exe
  C:\Windows\System\RcQuwAA.exe
  2⤵
  PID:14692
- C:\Windows\System\aPvzDil.exe
  C:\Windows\System\aPvzDil.exe
  2⤵
  PID:14708
- C:\Windows\System\suKVQqG.exe
  C:\Windows\System\suKVQqG.exe
  2⤵
  PID:14740
- C:\Windows\System\ezkFuCO.exe
  C:\Windows\System\ezkFuCO.exe
  2⤵
  PID:14756
- C:\Windows\System\eSNxxGy.exe
  C:\Windows\System\eSNxxGy.exe
  2⤵
  PID:14780
- C:\Windows\System\eTmYbiv.exe
  C:\Windows\System\eTmYbiv.exe
  2⤵
  PID:14812
- C:\Windows\System\hWzMqTo.exe
  C:\Windows\System\hWzMqTo.exe
  2⤵
  PID:14832
- C:\Windows\System\piFxygW.exe
  C:\Windows\System\piFxygW.exe
  2⤵
  PID:14860
- C:\Windows\System\VRmdbws.exe
  C:\Windows\System\VRmdbws.exe
  2⤵
  PID:14888
- C:\Windows\System\gsxMYEQ.exe
  C:\Windows\System\gsxMYEQ.exe
  2⤵
  PID:14904
- C:\Windows\System\duTWtbK.exe
  C:\Windows\System\duTWtbK.exe
  2⤵
  PID:14924
- C:\Windows\System\hmwACxN.exe
  C:\Windows\System\hmwACxN.exe
  2⤵
  PID:14948
- C:\Windows\System\SSuLeLC.exe
  C:\Windows\System\SSuLeLC.exe
  2⤵
  PID:14964
- C:\Windows\System\tQdDBiC.exe
  C:\Windows\System\tQdDBiC.exe
  2⤵
  PID:14984
- C:\Windows\System\GiWoYyF.exe
  C:\Windows\System\GiWoYyF.exe
  2⤵
  PID:15004
- C:\Windows\System\poWrhJL.exe
  C:\Windows\System\poWrhJL.exe
  2⤵
  PID:15024
- C:\Windows\System\jqAnuJe.exe
  C:\Windows\System\jqAnuJe.exe
  2⤵
  PID:15048
- C:\Windows\System\gsOObau.exe
  C:\Windows\System\gsOObau.exe
  2⤵
  PID:15072
- C:\Windows\System\FmFSvIN.exe
  C:\Windows\System\FmFSvIN.exe
  2⤵
  PID:15108
- C:\Windows\System\ykjRNJj.exe
  C:\Windows\System\ykjRNJj.exe
  2⤵
  PID:15124
- C:\Windows\System\KvMDnen.exe
  C:\Windows\System\KvMDnen.exe
  2⤵
  PID:15140
- C:\Windows\System\UaiLzfo.exe
  C:\Windows\System\UaiLzfo.exe
  2⤵
  PID:15156
- C:\Windows\System\deIXMBH.exe
  C:\Windows\System\deIXMBH.exe
  2⤵
  PID:15172
- C:\Windows\System\wCwSDWV.exe
  C:\Windows\System\wCwSDWV.exe
  2⤵
  PID:15204
- C:\Windows\System\FVBSrHU.exe
  C:\Windows\System\FVBSrHU.exe
  2⤵
  PID:15224
- C:\Windows\System\wBUAItw.exe
  C:\Windows\System\wBUAItw.exe
  2⤵
  PID:15244
- C:\Windows\System\TDdOOvF.exe
  C:\Windows\System\TDdOOvF.exe
  2⤵
  PID:15268
- C:\Windows\System\PZFfpJm.exe
  C:\Windows\System\PZFfpJm.exe
  2⤵
  PID:15288
- C:\Windows\System\PTZNJxN.exe
  C:\Windows\System\PTZNJxN.exe
  2⤵
  PID:15308
- C:\Windows\System\GcPExxz.exe
  C:\Windows\System\GcPExxz.exe
  2⤵
  PID:15332
- C:\Windows\System\GSLoBSX.exe
  C:\Windows\System\GSLoBSX.exe
  2⤵
  PID:15356
- C:\Windows\System\XCsiprl.exe
  C:\Windows\System\XCsiprl.exe
  2⤵
  PID:13956
- C:\Windows\System\egUMrrm.exe
  C:\Windows\System\egUMrrm.exe
  2⤵
  PID:14312
- C:\Windows\System\Pijjnzi.exe
  C:\Windows\System\Pijjnzi.exe
  2⤵
  PID:14368
- C:\Windows\System\nuHeaIe.exe
  C:\Windows\System\nuHeaIe.exe
  2⤵
  PID:13960
- C:\Windows\System\LUlmORR.exe
  C:\Windows\System\LUlmORR.exe
  2⤵
  PID:14464
- C:\Windows\System\KXkylqv.exe
  C:\Windows\System\KXkylqv.exe
  2⤵
  PID:14500
- C:\Windows\System\waDvxzE.exe
  C:\Windows\System\waDvxzE.exe
  2⤵
  PID:14596
- C:\Windows\System\iqmsuCU.exe
  C:\Windows\System\iqmsuCU.exe
  2⤵
  PID:14640
- C:\Windows\System\GzxzkMw.exe
  C:\Windows\System\GzxzkMw.exe
  2⤵
  PID:14704
- C:\Windows\System\fzGsPFj.exe
  C:\Windows\System\fzGsPFj.exe
  2⤵
  PID:14508
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14508 -s 248
    3⤵
    PID:16652
- C:\Windows\System\RhjMaHC.exe
  C:\Windows\System\RhjMaHC.exe
  2⤵
  PID:14776
- C:\Windows\System\ypdhibF.exe
  C:\Windows\System\ypdhibF.exe
  2⤵
  PID:14856
- C:\Windows\System\zaYhYvt.exe
  C:\Windows\System\zaYhYvt.exe
  2⤵
  PID:14900
- C:\Windows\System\dQpabON.exe
  C:\Windows\System\dQpabON.exe
  2⤵
  PID:14664
- C:\Windows\System\xRdReET.exe
  C:\Windows\System\xRdReET.exe
  2⤵
  PID:15000
- C:\Windows\System\gqRHzyC.exe
  C:\Windows\System\gqRHzyC.exe
  2⤵
  PID:14724
- C:\Windows\System\fAJfndY.exe
  C:\Windows\System\fAJfndY.exe
  2⤵
  PID:14792
- C:\Windows\System\swTghtR.exe
  C:\Windows\System\swTghtR.exe
  2⤵
  PID:15148
- C:\Windows\System\umlHwcY.exe
  C:\Windows\System\umlHwcY.exe
  2⤵
  PID:15200
- C:\Windows\System\tkCZzbU.exe
  C:\Windows\System\tkCZzbU.exe
  2⤵
  PID:15296
- C:\Windows\System\VOyZDBb.exe
  C:\Windows\System\VOyZDBb.exe
  2⤵
  PID:15364
- C:\Windows\System\DqeGZtF.exe
  C:\Windows\System\DqeGZtF.exe
  2⤵
  PID:15380
- C:\Windows\System\kSVXQgR.exe
  C:\Windows\System\kSVXQgR.exe
  2⤵
  PID:15400
- C:\Windows\System\HMOdYYH.exe
  C:\Windows\System\HMOdYYH.exe
  2⤵
  PID:15424
- C:\Windows\System\jVwShjy.exe
  C:\Windows\System\jVwShjy.exe
  2⤵
  PID:15448
- C:\Windows\System\QkJoEIe.exe
  C:\Windows\System\QkJoEIe.exe
  2⤵
  PID:15468
- C:\Windows\System\GdxwkwY.exe
  C:\Windows\System\GdxwkwY.exe
  2⤵
  PID:15496
- C:\Windows\System\ViURoef.exe
  C:\Windows\System\ViURoef.exe
  2⤵
  PID:15520
- C:\Windows\System\XQOKktB.exe
  C:\Windows\System\XQOKktB.exe
  2⤵
  PID:15536
- C:\Windows\System\vaiYMkN.exe
  C:\Windows\System\vaiYMkN.exe
  2⤵
  PID:15556
- C:\Windows\System\DSMEXUT.exe
  C:\Windows\System\DSMEXUT.exe
  2⤵
  PID:15580
- C:\Windows\System\IkjdkQM.exe
  C:\Windows\System\IkjdkQM.exe
  2⤵
  PID:15608
- C:\Windows\System\aDiKAUS.exe
  C:\Windows\System\aDiKAUS.exe
  2⤵
  PID:15632
- C:\Windows\System\RLNgIcO.exe
  C:\Windows\System\RLNgIcO.exe
  2⤵
  PID:15664
- C:\Windows\System\LbhvOWq.exe
  C:\Windows\System\LbhvOWq.exe
  2⤵
  PID:15684
- C:\Windows\System\tyGwgAO.exe
  C:\Windows\System\tyGwgAO.exe
  2⤵
  PID:15716
- C:\Windows\System\yTAlBSs.exe
  C:\Windows\System\yTAlBSs.exe
  2⤵
  PID:15736
- C:\Windows\System\cUgegVx.exe
  C:\Windows\System\cUgegVx.exe
  2⤵
  PID:15756
- C:\Windows\System\fcFdKsr.exe
  C:\Windows\System\fcFdKsr.exe
  2⤵
  PID:15780
- C:\Windows\System\ZignMnB.exe
  C:\Windows\System\ZignMnB.exe
  2⤵
  PID:15804
- C:\Windows\System\sPtzUKC.exe
  C:\Windows\System\sPtzUKC.exe
  2⤵
  PID:15820
- C:\Windows\System\WGBYcZu.exe
  C:\Windows\System\WGBYcZu.exe
  2⤵
  PID:15856
- C:\Windows\System\avEoIWw.exe
  C:\Windows\System\avEoIWw.exe
  2⤵
  PID:15872
- C:\Windows\System\TQuiPWH.exe
  C:\Windows\System\TQuiPWH.exe
  2⤵
  PID:15888
- C:\Windows\System\IzUAoii.exe
  C:\Windows\System\IzUAoii.exe
  2⤵
  PID:15904
- C:\Windows\System\eCwLOLt.exe
  C:\Windows\System\eCwLOLt.exe
  2⤵
  PID:15924
- C:\Windows\System\AqjgKXk.exe
  C:\Windows\System\AqjgKXk.exe
  2⤵
  PID:15940
- C:\Windows\System\tnLGWXX.exe
  C:\Windows\System\tnLGWXX.exe
  2⤵
  PID:15964
- C:\Windows\System\GeYPuHg.exe
  C:\Windows\System\GeYPuHg.exe
  2⤵
  PID:15980
- C:\Windows\System\MKVAskk.exe
  C:\Windows\System\MKVAskk.exe
  2⤵
  PID:16004
- C:\Windows\System\dKjaVXe.exe
  C:\Windows\System\dKjaVXe.exe
  2⤵
  PID:16028
- C:\Windows\System\OTEbEJd.exe
  C:\Windows\System\OTEbEJd.exe
  2⤵
  PID:16044
- C:\Windows\System\hGxlKWH.exe
  C:\Windows\System\hGxlKWH.exe
  2⤵
  PID:16068
- C:\Windows\System\NNoSYUD.exe
  C:\Windows\System\NNoSYUD.exe
  2⤵
  PID:16088
- C:\Windows\System\wSUxFfL.exe
  C:\Windows\System\wSUxFfL.exe
  2⤵
  PID:16108
- C:\Windows\System\IAoHKlD.exe
  C:\Windows\System\IAoHKlD.exe
  2⤵
  PID:16128
- C:\Windows\System\nCDJexh.exe
  C:\Windows\System\nCDJexh.exe
  2⤵
  PID:16156
- C:\Windows\System\KyLINTH.exe
  C:\Windows\System\KyLINTH.exe
  2⤵
  PID:16172
- C:\Windows\System\aeCRthQ.exe
  C:\Windows\System\aeCRthQ.exe
  2⤵
  PID:16188
- C:\Windows\System\SjgVAJP.exe
  C:\Windows\System\SjgVAJP.exe
  2⤵
  PID:16216
- C:\Windows\System\DbtngRI.exe
  C:\Windows\System\DbtngRI.exe
  2⤵
  PID:16236
- C:\Windows\System\zWWeDnY.exe
  C:\Windows\System\zWWeDnY.exe
  2⤵
  PID:16260
- C:\Windows\System\gWhbqKQ.exe
  C:\Windows\System\gWhbqKQ.exe
  2⤵
  PID:16288
- C:\Windows\System\qeDPohl.exe
  C:\Windows\System\qeDPohl.exe
  2⤵
  PID:16308
- C:\Windows\System\zNZpqlZ.exe
  C:\Windows\System\zNZpqlZ.exe
  2⤵
  PID:16336
- C:\Windows\System\acXPMFY.exe
  C:\Windows\System\acXPMFY.exe
  2⤵
  PID:16356
- C:\Windows\System\akpNAas.exe
  C:\Windows\System\akpNAas.exe
  2⤵
  PID:14996
- C:\Windows\System\ahLUaCM.exe
  C:\Windows\System\ahLUaCM.exe
  2⤵
  PID:14088
- C:\Windows\System\tpNhXVF.exe
  C:\Windows\System\tpNhXVF.exe
  2⤵
  PID:15096
- C:\Windows\System\RXTddgC.exe
  C:\Windows\System\RXTddgC.exe
  2⤵
  PID:14564
- C:\Windows\System\NMdZqjg.exe
  C:\Windows\System\NMdZqjg.exe
  2⤵
  PID:14896
- C:\Windows\System\OwjWaoR.exe
  C:\Windows\System\OwjWaoR.exe
  2⤵
  PID:15264
- C:\Windows\System\TDKVmze.exe
  C:\Windows\System\TDKVmze.exe
  2⤵
  PID:15376
- C:\Windows\System\VqFuqxX.exe
  C:\Windows\System\VqFuqxX.exe
  2⤵
  PID:15444
- C:\Windows\System\CrTkhhg.exe
  C:\Windows\System\CrTkhhg.exe
  2⤵
  PID:15464
- C:\Windows\System\csSGokp.exe
  C:\Windows\System\csSGokp.exe
  2⤵
  PID:15492
- C:\Windows\System\GLOLeCs.exe
  C:\Windows\System\GLOLeCs.exe
  2⤵
  PID:15088
- C:\Windows\System\AjbycXy.exe
  C:\Windows\System\AjbycXy.exe
  2⤵
  PID:15552
- C:\Windows\System\thMkBFW.exe
  C:\Windows\System\thMkBFW.exe
  2⤵
  PID:14688
- C:\Windows\System\GPHCNgn.exe
  C:\Windows\System\GPHCNgn.exe
  2⤵
  PID:15616
- C:\Windows\System\xTvQiaM.exe
  C:\Windows\System\xTvQiaM.exe
  2⤵
  PID:15704
- C:\Windows\System\ZhmLfOn.exe
  C:\Windows\System\ZhmLfOn.exe
  2⤵
  PID:15788
- C:\Windows\System\URuVAnV.exe
  C:\Windows\System\URuVAnV.exe
  2⤵
  PID:15136
- C:\Windows\System\gHGJfXx.exe
  C:\Windows\System\gHGJfXx.exe
  2⤵
  PID:15920
- C:\Windows\System\BSQxzmY.exe
  C:\Windows\System\BSQxzmY.exe
  2⤵
  PID:16020
- C:\Windows\System\kWmTTpW.exe
  C:\Windows\System\kWmTTpW.exe
  2⤵
  PID:16404
- C:\Windows\System\kLOuMRk.exe
  C:\Windows\System\kLOuMRk.exe
  2⤵
  PID:16420
- C:\Windows\System\jjdScfv.exe
  C:\Windows\System\jjdScfv.exe
  2⤵
  PID:16436
- C:\Windows\System\lFRQgvU.exe
  C:\Windows\System\lFRQgvU.exe
  2⤵
  PID:16452
- C:\Windows\System\zcrJEzW.exe
  C:\Windows\System\zcrJEzW.exe
  2⤵
  PID:16472
- C:\Windows\System\XiUJAgi.exe
  C:\Windows\System\XiUJAgi.exe
  2⤵
  PID:16492
- C:\Windows\System\MOZWgKo.exe
  C:\Windows\System\MOZWgKo.exe
  2⤵
  PID:16508
- C:\Windows\System\efMHoTG.exe
  C:\Windows\System\efMHoTG.exe
  2⤵
  PID:16540
- C:\Windows\System\mYIRynO.exe
  C:\Windows\System\mYIRynO.exe
  2⤵
  PID:16568
- C:\Windows\System\TKCSXwe.exe
  C:\Windows\System\TKCSXwe.exe
  2⤵
  PID:16592
- C:\Windows\System\CIYkLXM.exe
  C:\Windows\System\CIYkLXM.exe
  2⤵
  PID:16608
- C:\Windows\System\LQxcuxm.exe
  C:\Windows\System\LQxcuxm.exe
  2⤵
  PID:16628
- C:\Windows\System\FDOMtzr.exe
  C:\Windows\System\FDOMtzr.exe
  2⤵
  PID:16656
- C:\Windows\System\WiPTkMQ.exe
  C:\Windows\System\WiPTkMQ.exe
  2⤵
  PID:16676
- C:\Windows\System\movNaxY.exe
  C:\Windows\System\movNaxY.exe
  2⤵
  PID:16692
- C:\Windows\System\yPRTpZp.exe
  C:\Windows\System\yPRTpZp.exe
  2⤵
  PID:16708
- C:\Windows\System\IZOzaGB.exe
  C:\Windows\System\IZOzaGB.exe
  2⤵
  PID:16724
- C:\Windows\System\AmCtDiW.exe
  C:\Windows\System\AmCtDiW.exe
  2⤵
  PID:16744
- C:\Windows\System\GOcPWZL.exe
  C:\Windows\System\GOcPWZL.exe
  2⤵
  PID:16764
- C:\Windows\System\MLLdaBD.exe
  C:\Windows\System\MLLdaBD.exe
  2⤵
  PID:16784
- C:\Windows\System\KsZpOBj.exe
  C:\Windows\System\KsZpOBj.exe
  2⤵
  PID:16804
- C:\Windows\System\JZhEDVE.exe
  C:\Windows\System\JZhEDVE.exe
  2⤵
  PID:16828
- C:\Windows\System\cXFROQe.exe
  C:\Windows\System\cXFROQe.exe
  2⤵
  PID:16856
- C:\Windows\System\KRtOHOp.exe
  C:\Windows\System\KRtOHOp.exe
  2⤵
  PID:16880
- C:\Windows\System\jtbrrZB.exe
  C:\Windows\System\jtbrrZB.exe
  2⤵
  PID:16896
- C:\Windows\System\iUfmQEM.exe
  C:\Windows\System\iUfmQEM.exe
  2⤵
  PID:16920
- C:\Windows\System\ukZhgxe.exe
  C:\Windows\System\ukZhgxe.exe
  2⤵
  PID:16948
- C:\Windows\System\QWpaDGR.exe
  C:\Windows\System\QWpaDGR.exe
  2⤵
  PID:16972
- C:\Windows\System\VzGcTXO.exe
  C:\Windows\System\VzGcTXO.exe
  2⤵
  PID:16988
- C:\Windows\System\EvIeUVD.exe
  C:\Windows\System\EvIeUVD.exe
  2⤵
  PID:17016
- C:\Windows\System\PNITHtL.exe
  C:\Windows\System\PNITHtL.exe
  2⤵
  PID:17040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\Bbbfbaq.exe

Filesize
1.4MB

MD5
efa0fa7f4e15e1c30f55363a8ed2fc1c

SHA1
cf761a60fa29359e922dfdc0a1c167307bd7135c

SHA256
5bebec2932940a74c3a4b6effc8080d36e6a422b2b57b2c192881f8d526d1962

SHA512
2aee4a66ff365eed74e74944993198a25ef063fcb2833161ce73b0727687b4a7c1dffa9fadfeae79f297ea12f3ce60dede237433598888d3627122b6cf7f64cc

Download Submit
C:\Windows\System\FOJTkED.exe

Filesize
1.4MB

MD5
95575582bb49a83e5d86beb91f4d1f70

SHA1
05ecc842d078a566ed850cb19920e658d3a224a9

SHA256
22f992a89869a4e0df1eddb1b40eaf80f71cd3bc76fee34422188f6540a337da

SHA512
659f2edfeb0cbcb7ce168a873083c02d699561ba5dcea7b1e2275e4fafccc2f6a077c72cdbc39cb1355603a84b53825f67ef65ec61fb8e7d218909fec1e73335

Download Submit
C:\Windows\System\GYhlwzT.exe

Filesize
1.4MB

MD5
e3015f8f29d3c4c249a47b8f4d66c25d

SHA1
6a0f5a1b0f775c10f03d14442a3e1f535dabf93f

SHA256
947ba615ad7003bd7108c16b2b0e000395b84416a123640b0ab9083fc6cb58e1

SHA512
01d5f508ab525a359c483be425a0f6b49cff2e122e29b36349e6a078ec0aeb8b7e1188e6884c02cd0eef706234518ecb063c61958ddc98256b1fc0fa09af9acd

Download Submit
C:\Windows\System\JLKkODb.exe

Filesize
1.4MB

MD5
9a3b4d240cc285d2b3c448989651ce1f

SHA1
2a0183d20cbfca84c2671302bd95b2ac1135b488

SHA256
7bfb505b381a2a98d73722fcd67e4b68e616bb85481706f4454e56b4c1356047

SHA512
4de418fe861410b83124091297dbb7434075310390aa1c8efd3d81cc9405f6d5cdb042e0aa104aec27388c541a09ab15dd6890de2b99dfaf8ac091d723f1decc

Download Submit
C:\Windows\System\KCkdFUN.exe

Filesize
1.4MB

MD5
cbafe8b672198f8754d12e0f2b462598

SHA1
5012f308c92a3c889d9e353d62fc1105287e6950

SHA256
3e4d059f3d6613697cfaca8173a1cb54a8026c21f553a814c2cd6585414db246

SHA512
ef94f0df1fde49fbf445f7d62decaa9bc7afeb4ba9dbf45efb10f2b2126ad3002d9921346b361c6baed334c1c3953919f3cad32cd060b8ed105ac133cf1afa2f

Download Submit
C:\Windows\System\KmrHEdC.exe

Filesize
1.4MB

MD5
5cc9e37047803f8241cca1b4f0763cc4

SHA1
0e7edf83cb215d04ce5812e2f59a3c58d2e23f40

SHA256
e8886b8aa25baf79d381f203eee3ec30a145bcbdd5b07d3c1f076f58b783d3df

SHA512
250f46b2d9f30e1147a75279beb2b03f1a5953b407bcda91fff94be072e468dfdc6209a97b370bef2efcab8d9581a8e4a9a3e94638ae2314ffe8dbe0f18b670e

Download Submit
C:\Windows\System\NKNPNyq.exe

Filesize
1.4MB

MD5
7d0c27c62e2dcedccd602ae01bd3427a

SHA1
9294fe3769dcf66ce4084a17365f93179b4f352b

SHA256
d0603f7633a68711cb32abe187723f93c66bba6e6fd4e5e84094f7965494b55d

SHA512
83d58c19af0af0f4416da5904eaed2728edb649d73e5f0726b1f730aeaa48d8f169b3bd18906a38b39a2d89d5289a41e6b40df0ee1700a27e76bf78214ec49c4

Download Submit
C:\Windows\System\OxUdcFv.exe

Filesize
1.4MB

MD5
023bbe841939516f8d6935fe05d170fe

SHA1
52bfd55943a33fc26878fc0a1bb942aa052bc9c8

SHA256
2d804c5d844d0195d9b5f4e612c48aa0ff6ca4bf0e3d682943e4d2c4f55a9f1b

SHA512
8e06b86809672ed77990ef54abba7b2093f72898517ff2eebf1f7263211bb0d7ffa6318c0b7c8278ab624de66ad52efa14703bb61b161cfa06c48828599c553d

Download Submit
C:\Windows\System\RGGiWnD.exe

Filesize
1.4MB

MD5
d450ca87da7ab6b3ff5b6f68a70ddb01

SHA1
585ccf7c9b013de17e73880ff7bcee06839cb4f2

SHA256
1b6f3c84aa49ba72ff045a82ef87169bdda284761695eb438248748d5685b745

SHA512
b28b6f3dd4ae87528e131c233683164257f06cb3296234634f80b66222928d755b65cc167ae1fa89e9aa7cbc7e7ad2c4474307f9af293efa9f1ca4a944e79906

Download Submit
C:\Windows\System\RHeAiaG.exe

Filesize
1.4MB

MD5
58a8e02e9ed6de870c9d52bb94bb96a1

SHA1
83d115075b32a688861ab74b9af0bfc18c3ff7cb

SHA256
2f61dfff67d62c627837f1e50205f9e07cd6b21fefe1e1a945d4999896901163

SHA512
168c057624e41489803a50d02fc6f888822c4ac95c4fec6ff9b25a2330d8b117c878c60e06244882d78ab9801ca21a8f037d14118e0597f97c7e2d487d788b21

Download Submit
C:\Windows\System\SCtzCIj.exe

Filesize
1.4MB

MD5
36ed3c04080235ab51c56ac362c2e7e1

SHA1
c627c074755e5a2806862a1386b87fa52a62f90d

SHA256
7df22f8b5099d8ee873124e1e1dabca1e7f320b5f5ba3b62c114d051ac30b9fd

SHA512
71f6248f7d79e81b1729c99d1c3341e9d58851de45872f2ff80e953ad1542bb52752669d488f1bcfebc7214171f53c588e41287bbea91baa14e7c1877e1c507b

Download Submit
C:\Windows\System\UAYQjqq.exe

Filesize
1.4MB

MD5
984f0924c6f1bb94150a4336bf00b586

SHA1
766fc43a6b642b713e23a68c0db08a692883578c

SHA256
2907cd5a9e85769b0aad26a091f1e3784b4581b49e6ff210880615ec9ec86866

SHA512
948bb44ab728d8d421e7afa1e4cde63d79111a9206db57fc8ff3314670d5adf3fc66d64a130f08cfa822a07c38c24ca1286d42de9f4a16088545b9e02c047e75

Download Submit
C:\Windows\System\USicRop.exe

Filesize
1.4MB

MD5
2c9fb65bea6e7cae8e5d1f5693191e8a

SHA1
b1938915fda7c1bc3a95f4344862297e59d9d7bd

SHA256
c4d84881131a63c00593f283867baacb752d1a219067bb18b283fe04f6cf995b

SHA512
87b446cf945e3b0cb35f80e876e580ec2840c8a1f95f6165b15ab94ca44569f78921755eb3626a840e5f2fd399ed41850d8dca07b143b151e9c9f8607b26306e

Download Submit
C:\Windows\System\VxUUDtA.exe

Filesize
1.4MB

MD5
82d1a27e8ee42505a3bd33c5a49f1f51

SHA1
f7a6f770c3ea253ffba43a86e137207a2e87995f

SHA256
60862475174cf4ac14848eeb021d3d070d8ac0c9bf4a146a76445003978c51ef

SHA512
7d715c15e4c0b0a7baf3ae5a1ff2cead96d6cd7d7131ddfcb64fadb8db846c0423b6012f2daa362a7356a42a1660e152fbcc896ccfb93ac087a1ba10545b5003

Download Submit
C:\Windows\System\WdNSOqX.exe

Filesize
1.4MB

MD5
2f4695f94613fc0167a6fa0d46a37f39

SHA1
b1deca5ab715738401091820359d73b82fa13347

SHA256
b0a9d15e29d9a522ab46547eaa29401571b348be558a016a2627ceced0e633ad

SHA512
c6f531e0bb4d1a1d9e0f422b134a69e12edd92119048c148795dc1cd528d3b9319b84aa317ed035524a14b04c37b7e47e0eb4cae0e08a5ec485579e8f45cac9b

Download Submit
C:\Windows\System\XQcrZTg.exe

Filesize
1.4MB

MD5
7b0732ecf0867f5bc6e66f2eb3a5eac8

SHA1
c482c1d3093998dc3945c7826801e6bfd305b4a9

SHA256
ad7e9350a5c75d3ba81a130e1cba443d598bb259ec0d8f48f3fccfa0209f4c50

SHA512
e7cfeea98bdc1bab3c4bc7b6e7e1e52e4376fea19c9cfd9d79e96490b86d09f304b610e46107d63b38e1061fcd4faafa02693d286988020dcf4b183f9e80dbc8

Download Submit
C:\Windows\System\YMpHfNw.exe

Filesize
1.4MB

MD5
4b5a583ea680a406dc518cbd23904483

SHA1
b85e2dba31799f15a2507146269f6d5a3c627729

SHA256
c34d76b0910eb690841a00362988d26741797ef8cdc8d2f9221adcf28dd3b989

SHA512
5664981cadaaedd29cad4e61babbe3ab763438b9cf94b273f3d55267f3d552875d62f28a69157d861893a449bfcc20528781bc93d3339078255d3e354faa8f6e

Download Submit
C:\Windows\System\YZwdowM.exe

Filesize
1.4MB

MD5
6f5ca28a88e912aa9c51f1e2150fb9a4

SHA1
9732bba6b9f238d0240046956c5154759da685dd

SHA256
cafb5ef7347de986e63f9e3f5e7859ee981f3693802d858d61804697ddcd3c69

SHA512
38694badad70465d6b468d28fb570f3a76fe86653d26b162126208fba11e261d3479685899a9d3c4fadfb05a28424644ea10dad198c32c788d43e357a102c61a

Download Submit
C:\Windows\System\YaQhTjk.exe

Filesize
1.4MB

MD5
221a1fb556220d8ff36788dc5cb4c1be

SHA1
ec99133b6891e58ff3c36265e24e4bd92a3a146e

SHA256
e64523c08bbfec3c975be18dcc6907bc7504dc9f28db9a97fb1f4de8c4b53f8a

SHA512
bd9958137579972a18cae9d5c565f9740cc997049aa5900f587d0ce313a53f346b45a25b2adba3a36ab5680328c2ea0f6b928eb3467e4eeea1f2c8ccf7b28d57

Download Submit
C:\Windows\System\ZClWXfA.exe

Filesize
1.4MB

MD5
09a00f39465d00e00f42663cb8e01574

SHA1
6ff5a360d1944c82cad89e45832188b0a4b96bdb

SHA256
65607c47d2ea94c3d0d2017286249a9f43410e396fecbe499f01d0e27adef112

SHA512
6ee1513e3f589bfccfcf06b05a862a106410eb0f50e4831a5c02731be08c7c8c6488ac29dd256ba82bb34837cf916c7547cac9dc262971658b76b3b06efeee26

Download Submit
C:\Windows\System\bNKMvrm.exe

Filesize
1.4MB

MD5
667b442dd4a980146367240180bfa162

SHA1
7cff935e1f30a7a1b0fe3c593450c21cf5e35a5c

SHA256
668bd564e2747246ba0aecd537837f376e96396357aee04ad9ed13715e1a71ae

SHA512
03111f8996ca75cb2ea18b5ecebc675c371ff0594a66a5e008923db91b1348bebb7627f52fbfece243e3248575ae9e2b95415b8ae56bf7f5b41bb0c1f30ddbce

Download Submit
C:\Windows\System\cOMEBIT.exe

Filesize
1.4MB

MD5
3b6e5fa3e0408812d353576927fae6b9

SHA1
a24c067da5f438add5682d7a9b514dac6127f461

SHA256
442b4ff18f57371cbecc6e958014ce67dafcb1616e350121f41b7dc2c87caae2

SHA512
766337e4fcf09cc9f9433bf4ebea8aa9249dbc8ec7e1232bfd3b87c81bd0c89754563e19f4a2b73559cea29ef0021ee3baff41028cf3d258e4826e1ecd67c9af

Download Submit
C:\Windows\System\ePZnAMz.exe

Filesize
1.4MB

MD5
f199e2f42b2540ada81887ba63954303

SHA1
9c681934d2afd526aec5395a8d918e681f87e6d3

SHA256
e4986e32f30504813a5519a5dca7fa40173188c8ca90b43c96bbe182a0416b4a

SHA512
9ea304a438bd93eb6e8f7b2d303e42a4c48c194ff93de8ae3d3a64fc89768b0f36ed2b28d7105c35118c28688efb585253668961e8fd0b9d7d698b1ae4791f5d

Download Submit
C:\Windows\System\kWMLJAu.exe

Filesize
1.4MB

MD5
2b13510fe7ad461917fd02970846291f

SHA1
3b1b9a36794ff694f38aa8e56f704000e2a6aa7e

SHA256
8ebda10e698d6619dddbb973bac295d4715860a193e307f5f2318c3f4f59a240

SHA512
ddc33916aef213a3d48611ccb36608676ad4d8ffa39574b79d77d945ea6b330706cb61bb993d2982c7993048e01114fb3105f56e1bd522e5e8c73e726e8e5dee

Download Submit
C:\Windows\System\knhuUSL.exe

Filesize
1.4MB

MD5
b07c6b65c393d1fe68e47957eb97c70a

SHA1
3aef1167547b9b5a7053a55a4e4ed9ae7b4bee55

SHA256
59bb6e5cc331bba1cd441259521dab8b5d78988ad0764aa66f3b5f64074d9693

SHA512
4b3322d17b5fa999b6b58cbac6bea1dc4cf4157910a667240cfea56ee7517e37fb20dd40ff60318d1d2acf8350f1dda5c6473a2ba7558c8bb271e7230e42f414

Download Submit
C:\Windows\System\lQirBDZ.exe

Filesize
1.4MB

MD5
326ea65577ffc21828b78fcbf61421fc

SHA1
e6c671c205b8dc40df8ea8a5b85759516c43e7c6

SHA256
8cf592eef1af84f108a13717697d390b985754f21750f65d50ac87d1e6c76ebe

SHA512
928f944c9d9ba2f3d4bda16897ff423ceaa174008bd4e595d67e3c03ad44ecba93fa34f8a8c641231bf908a26a86f94888a7e52ba7916d58154b5fda06edae10

Download Submit
C:\Windows\System\qsenaIZ.exe

Filesize
1.4MB

MD5
e4d8a8f8653e40584a5f0bcc0fe6f8e2

SHA1
1d426f6c387bf7870c048dcf1ca82a5e772be439

SHA256
fc1a29f12e4df283856721b77a495c8c5973c1c3fe2fe211c2871f8d330466e9

SHA512
463ecca1443e8b0b4405a2da2e12ec572139cde84e13d7d860137aab6fa526d9321f97d5010af430e1b25461f808aff0acd0f3af5b77ccecf430fad25baad795

Download Submit
C:\Windows\System\sBkjNTI.exe

Filesize
1.4MB

MD5
9903195f0c65fd26911758568444b3de

SHA1
ff754fd5ace0295130782945b8fbf89dbedb864e

SHA256
9ee8efc8c8d840c0d7bd8774003011cc873581c47a5aaa831749e89d86b3a822

SHA512
7c7125bcb1bb22d9cd3ddb6961dfb9eefb65aa038a9ac0aec9599cdb623739fab4bf8c4104ad76772eebb8da5af85471155885354b022b190fe5cd1647e04e40

Download Submit
C:\Windows\System\tETXhpK.exe

Filesize
1.4MB

MD5
a30c26b856831632baf30f9f13456e99

SHA1
ffebf7e46663ed2d11d15c2865dc8af5febbab5e

SHA256
a0e34fafe8aa6d9833ed747a972273dacf5c44fcd55e204c538bdfef7604116d

SHA512
591c9841ad69311bfb8c70b897b1fbc5331fb07f3983579f4a53625f5b662c171b422e2a42c6152d68b74f97c06942bc2f0d58230c5bef5d8711db8b1a4930ec

Download Submit
C:\Windows\System\tRNmxAV.exe

Filesize
1.4MB

MD5
494180025dff33e99ba3ff4c7a5c10b4

SHA1
5cdf2d6be4b6fc39e4748d69c352ccd58b9fd48d

SHA256
20c03ee70495ecdb47bfab5fc65e807fd5d9787ab94ae4cbe21c7195d65cb699

SHA512
4398a7717cd3a898b572e9229fc61b7dea1ea173cd86bc32e71c9861a47a5fe2ce78ec6344041912dee4d3b77d8abf0b0e7e07e4425e6b7372a971fe2e7f3a97

Download Submit
C:\Windows\System\trigapF.exe

Filesize
1.4MB

MD5
f6a130fd1ffbeb97034e3c1515cbc72e

SHA1
958758005ac01a43b119b118ff139343662feae7

SHA256
aaefa993df1c5a8ac417e7d6c439a685891d86bda4deb0432dabf8a90c0988bd

SHA512
804c7cb06d11c0cf2c1960302e6b2ec9d8af28b6b00e31fe54874b888ac2f47f4699a7e787fa2ec71040d309f2b3b51b096d0825e022e6e77e11d968b1d7bde9

Download Submit
C:\Windows\System\wLBsZUk.exe

Filesize
1.4MB

MD5
4a3018f74c4557076ef9eb6a5e0d95b0

SHA1
04ac081a0c351904052c189286bf72ea42b65aac

SHA256
1b022dbac7036c630114260f0ea8e8af7314f6bc66e9b2f1e6f193edc29e3221

SHA512
c9c949bfdd88e2d352656c609a6c80a8dd06e063250cc43633cea8426fca0e6d4494ebaa23e9574e915500956514ba4355de33975e216fd2c5aaaa0c4dc93623

Download Submit
C:\Windows\System\xgfyqgz.exe

Filesize
1.4MB

MD5
638dca6f2c5fda6bd311d621392d5ee9

SHA1
c38bff7ebdf927fe6a3a586027e4fcc487d695b0

SHA256
9cc68e50f3aa46ad0c4ca15f359573afb78ee2957ba7cce240d85729ccda509c

SHA512
b060cd1a0fa610d8b12756a384e3992c8c459e597043be3f695a18f1277d5d4c4570fbcec19fa35dd05b3949e1c7ebbdc600205eabc213820b512ff2d1991b8c

Download Submit
memory/1344-0-0x00000138F9360000-0x00000138F9370000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads