xmrig | a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
Size

1.1MB
MD5

54989340ac72906b41dd8b958422c2db
SHA1

2fded45e1a48dbbfa3e9d33bab0698e7317fdc38
SHA256

a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49
SHA512

636bb9c87d09aaf1034f1d0dde991ae599b88dfac33c7977c314c29f17e3e2fe4e1b6e49407d3c4ec7f4c0034a9fb40c3463b341e5e3a9e5eeb41106148e5888
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5QbddoaE0:GezaTF8FcNkNdfE0pZ9ozttwIRx2BI0

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c01-4.dat	xmrig
behavioral2/files/0x0008000000023c9a-7.dat	xmrig
behavioral2/files/0x0007000000023c9e-15.dat	xmrig
behavioral2/files/0x0007000000023c9f-22.dat	xmrig
behavioral2/files/0x0007000000023ca2-27.dat	xmrig
behavioral2/files/0x0007000000023ca1-26.dat	xmrig
behavioral2/files/0x0007000000023ca3-31.dat	xmrig
behavioral2/files/0x0007000000023ca7-48.dat	xmrig
behavioral2/files/0x0007000000023ca8-57.dat	xmrig
behavioral2/files/0x0007000000023ca9-84.dat	xmrig
behavioral2/files/0x0007000000023cb2-105.dat	xmrig
behavioral2/files/0x0007000000023cad-116.dat	xmrig
behavioral2/files/0x0007000000023cb9-163.dat	xmrig
behavioral2/files/0x0007000000023cb8-161.dat	xmrig
behavioral2/files/0x0007000000023cb7-159.dat	xmrig
behavioral2/files/0x0007000000023cbf-157.dat	xmrig
behavioral2/files/0x0007000000023cbe-156.dat	xmrig
behavioral2/files/0x0007000000023cbd-155.dat	xmrig
behavioral2/files/0x0007000000023cb6-153.dat	xmrig
behavioral2/files/0x0007000000023cbc-152.dat	xmrig
behavioral2/files/0x0007000000023cb3-150.dat	xmrig
behavioral2/files/0x0007000000023cbb-149.dat	xmrig
behavioral2/files/0x0007000000023cb5-147.dat	xmrig
behavioral2/files/0x0007000000023cb4-145.dat	xmrig
behavioral2/files/0x0007000000023cba-144.dat	xmrig
behavioral2/files/0x0007000000023cae-142.dat	xmrig
behavioral2/files/0x0007000000023cb0-127.dat	xmrig
behavioral2/files/0x0007000000023caf-124.dat	xmrig
behavioral2/files/0x0007000000023cab-120.dat	xmrig
behavioral2/files/0x0007000000023cb1-101.dat	xmrig
behavioral2/files/0x0007000000023caa-100.dat	xmrig
behavioral2/files/0x0007000000023cac-97.dat	xmrig
behavioral2/files/0x0007000000023ca5-59.dat	xmrig
behavioral2/files/0x0007000000023ca6-53.dat	xmrig
behavioral2/files/0x0007000000023ca4-43.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4496	NWvfaLI.exe
2920	FBDZftR.exe
2672	sbiExAs.exe
5068	DAvyvhz.exe
4532	LiaJXUu.exe
4416	lKVeekI.exe
4180	VWVXmpx.exe
464	OghlDnl.exe
3848	PWnhbOZ.exe
2584	WkmpEIb.exe
228	mayAWQu.exe
3572	FazWhaO.exe
232	wRHMweY.exe
212	ZovcWnE.exe
3036	zmPvLdT.exe
2276	DkSvBNP.exe
532	sZLnVwP.exe
2988	EMHBfaT.exe
988	TzxISdq.exe
4852	uKngagv.exe
2760	YVuFyJn.exe
3592	YcmUwWk.exe
208	FWppiWf.exe
3356	XoDqcIT.exe
1140	mvLljGf.exe
3936	RcuUOiO.exe
3268	pUlWryv.exe
1136	yEOBBuP.exe
2520	EUXyXEG.exe
3852	PcBDCFj.exe
2392	Ighysqd.exe
4232	EwZgXbI.exe
2044	VYErfKh.exe
2780	ftXsvxf.exe
2284	Mvzzmlg.exe
1772	XPzNkzD.exe
1592	kxQbZrj.exe
4936	gFEsxkj.exe
2300	zYlXtUS.exe
3844	emnpHhh.exe
1780	weiSweT.exe
4884	QvjUIBm.exe
2736	zLkzSyc.exe
4208	QDrxZkv.exe
3812	TRgfyLi.exe
3480	DrTwVQp.exe
4392	cpuWzVN.exe
2764	rHVgETL.exe
4724	ObskPdT.exe
4548	AXDSaxu.exe
3444	FDRLWms.exe
4576	BOwZCyP.exe
5104	jmVlIlT.exe
216	EOPGVUe.exe
4312	OOTwOGU.exe
3388	SVckcXg.exe
4468	aLmyQAi.exe
1272	MGiUpGw.exe
2772	QEDhPwu.exe
4308	uEYNGoQ.exe
1492	EuXvPOC.exe
3612	BgERRBN.exe
4340	LHxbzhi.exe
3888	vKlXWuO.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fbbaRmx.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\PkOsaFa.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\UBEitIe.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\axuWZtU.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\MZCQqEF.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\oMKYILb.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\NOzrVkb.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\zUGXTIc.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\JSNcClv.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\iFBpHuf.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\xplqqJN.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\oCCaUNb.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\PEMJweI.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\NBkbNuO.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\QvjUIBm.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\kXRoToc.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\eGKjFhS.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\jPISVQM.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\RcuUOiO.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\WWmnTBd.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\olvHyyP.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\lUIQBtM.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\weiSweT.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\ivhbLGk.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\ixjiEWh.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\noFfnJM.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\EkSbBti.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\EPxlmZB.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\hpcHqJE.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\NRqpYKm.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\llAhsli.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\jAiOLPf.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\avGhxxV.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\FDglLSZ.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\gjbUUxU.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\PjIzjip.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\SyIGfXD.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\YUoOnbn.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\kGVspiD.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\QUpfGsE.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\WNdXpRC.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\VxScKqO.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\DkSvBNP.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\aOIDDoa.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\wvNTEBl.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\kDFjfzQ.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\OOMOTUe.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\CEFeRzK.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\zZjzKkl.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\vHGLBgL.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\IETcCSg.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\cpuWzVN.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\vgNAvxP.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\RWGTDLH.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\qRXuhqs.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\flwOKrv.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\RatqXKN.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\IedFrhq.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\ZEUCEqV.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\rRQYJQD.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\bxkGDEe.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\uixiSJq.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\lAojVpl.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
File created	C:\Windows\System\FWppiWf.exe	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4496	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	83
PID 3272 wrote to memory of 4496	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	83
PID 3272 wrote to memory of 2920	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	84
PID 3272 wrote to memory of 2920	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	84
PID 3272 wrote to memory of 2672	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	85
PID 3272 wrote to memory of 2672	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	85
PID 3272 wrote to memory of 5068	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	86
PID 3272 wrote to memory of 5068	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	86
PID 3272 wrote to memory of 4532	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	87
PID 3272 wrote to memory of 4532	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	87
PID 3272 wrote to memory of 4416	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	88
PID 3272 wrote to memory of 4416	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	88
PID 3272 wrote to memory of 4180	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	89
PID 3272 wrote to memory of 4180	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	89
PID 3272 wrote to memory of 464	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	90
PID 3272 wrote to memory of 464	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	90
PID 3272 wrote to memory of 3572	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	91
PID 3272 wrote to memory of 3572	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	91
PID 3272 wrote to memory of 3848	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	92
PID 3272 wrote to memory of 3848	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	92
PID 3272 wrote to memory of 2584	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	93
PID 3272 wrote to memory of 2584	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	93
PID 3272 wrote to memory of 228	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	94
PID 3272 wrote to memory of 228	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	94
PID 3272 wrote to memory of 232	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	95
PID 3272 wrote to memory of 232	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	95
PID 3272 wrote to memory of 212	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	96
PID 3272 wrote to memory of 212	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	96
PID 3272 wrote to memory of 3036	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	97
PID 3272 wrote to memory of 3036	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	97
PID 3272 wrote to memory of 2276	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	98
PID 3272 wrote to memory of 2276	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	98
PID 3272 wrote to memory of 532	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	99
PID 3272 wrote to memory of 532	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	99
PID 3272 wrote to memory of 2988	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	100
PID 3272 wrote to memory of 2988	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	100
PID 3272 wrote to memory of 988	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	101
PID 3272 wrote to memory of 988	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	101
PID 3272 wrote to memory of 4852	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	102
PID 3272 wrote to memory of 4852	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	102
PID 3272 wrote to memory of 2760	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	103
PID 3272 wrote to memory of 2760	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	103
PID 3272 wrote to memory of 3592	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	104
PID 3272 wrote to memory of 3592	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	104
PID 3272 wrote to memory of 208	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	105
PID 3272 wrote to memory of 208	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	105
PID 3272 wrote to memory of 3356	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	106
PID 3272 wrote to memory of 3356	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	106
PID 3272 wrote to memory of 1140	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	107
PID 3272 wrote to memory of 1140	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	107
PID 3272 wrote to memory of 3936	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	108
PID 3272 wrote to memory of 3936	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	108
PID 3272 wrote to memory of 3268	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	109
PID 3272 wrote to memory of 3268	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	109
PID 3272 wrote to memory of 1136	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	110
PID 3272 wrote to memory of 1136	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	110
PID 3272 wrote to memory of 2520	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	111
PID 3272 wrote to memory of 2520	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	111
PID 3272 wrote to memory of 3852	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	112
PID 3272 wrote to memory of 3852	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	112
PID 3272 wrote to memory of 2392	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	113
PID 3272 wrote to memory of 2392	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	113
PID 3272 wrote to memory of 4232	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	114
PID 3272 wrote to memory of 4232	3272	a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe	114

C:\Users\Admin\AppData\Local\Temp\a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe
"C:\Users\Admin\AppData\Local\Temp\a39c336307c80bf5fc885c52b9a6da97ddf858fb4626980b0d9539e9c3ee6f49.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\System\NWvfaLI.exe
  C:\Windows\System\NWvfaLI.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\FBDZftR.exe
  C:\Windows\System\FBDZftR.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\sbiExAs.exe
  C:\Windows\System\sbiExAs.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\DAvyvhz.exe
  C:\Windows\System\DAvyvhz.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\LiaJXUu.exe
  C:\Windows\System\LiaJXUu.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\lKVeekI.exe
  C:\Windows\System\lKVeekI.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\VWVXmpx.exe
  C:\Windows\System\VWVXmpx.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\OghlDnl.exe
  C:\Windows\System\OghlDnl.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\FazWhaO.exe
  C:\Windows\System\FazWhaO.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\PWnhbOZ.exe
  C:\Windows\System\PWnhbOZ.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\WkmpEIb.exe
  C:\Windows\System\WkmpEIb.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\mayAWQu.exe
  C:\Windows\System\mayAWQu.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\wRHMweY.exe
  C:\Windows\System\wRHMweY.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\ZovcWnE.exe
  C:\Windows\System\ZovcWnE.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\zmPvLdT.exe
  C:\Windows\System\zmPvLdT.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\DkSvBNP.exe
  C:\Windows\System\DkSvBNP.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\sZLnVwP.exe
  C:\Windows\System\sZLnVwP.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\EMHBfaT.exe
  C:\Windows\System\EMHBfaT.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\TzxISdq.exe
  C:\Windows\System\TzxISdq.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\uKngagv.exe
  C:\Windows\System\uKngagv.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\YVuFyJn.exe
  C:\Windows\System\YVuFyJn.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\YcmUwWk.exe
  C:\Windows\System\YcmUwWk.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\FWppiWf.exe
  C:\Windows\System\FWppiWf.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\XoDqcIT.exe
  C:\Windows\System\XoDqcIT.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\mvLljGf.exe
  C:\Windows\System\mvLljGf.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\RcuUOiO.exe
  C:\Windows\System\RcuUOiO.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\pUlWryv.exe
  C:\Windows\System\pUlWryv.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\yEOBBuP.exe
  C:\Windows\System\yEOBBuP.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\EUXyXEG.exe
  C:\Windows\System\EUXyXEG.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\PcBDCFj.exe
  C:\Windows\System\PcBDCFj.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\Ighysqd.exe
  C:\Windows\System\Ighysqd.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\EwZgXbI.exe
  C:\Windows\System\EwZgXbI.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\VYErfKh.exe
  C:\Windows\System\VYErfKh.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\ftXsvxf.exe
  C:\Windows\System\ftXsvxf.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\Mvzzmlg.exe
  C:\Windows\System\Mvzzmlg.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\XPzNkzD.exe
  C:\Windows\System\XPzNkzD.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\kxQbZrj.exe
  C:\Windows\System\kxQbZrj.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\gFEsxkj.exe
  C:\Windows\System\gFEsxkj.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\emnpHhh.exe
  C:\Windows\System\emnpHhh.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\zYlXtUS.exe
  C:\Windows\System\zYlXtUS.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\weiSweT.exe
  C:\Windows\System\weiSweT.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\QvjUIBm.exe
  C:\Windows\System\QvjUIBm.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\zLkzSyc.exe
  C:\Windows\System\zLkzSyc.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\QDrxZkv.exe
  C:\Windows\System\QDrxZkv.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\TRgfyLi.exe
  C:\Windows\System\TRgfyLi.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\DrTwVQp.exe
  C:\Windows\System\DrTwVQp.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\cpuWzVN.exe
  C:\Windows\System\cpuWzVN.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\rHVgETL.exe
  C:\Windows\System\rHVgETL.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ObskPdT.exe
  C:\Windows\System\ObskPdT.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\AXDSaxu.exe
  C:\Windows\System\AXDSaxu.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\FDRLWms.exe
  C:\Windows\System\FDRLWms.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\BOwZCyP.exe
  C:\Windows\System\BOwZCyP.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\jmVlIlT.exe
  C:\Windows\System\jmVlIlT.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\EOPGVUe.exe
  C:\Windows\System\EOPGVUe.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\OOTwOGU.exe
  C:\Windows\System\OOTwOGU.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\aLmyQAi.exe
  C:\Windows\System\aLmyQAi.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\SVckcXg.exe
  C:\Windows\System\SVckcXg.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\MGiUpGw.exe
  C:\Windows\System\MGiUpGw.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\QEDhPwu.exe
  C:\Windows\System\QEDhPwu.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\uEYNGoQ.exe
  C:\Windows\System\uEYNGoQ.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\EuXvPOC.exe
  C:\Windows\System\EuXvPOC.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\BgERRBN.exe
  C:\Windows\System\BgERRBN.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\LHxbzhi.exe
  C:\Windows\System\LHxbzhi.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\vKlXWuO.exe
  C:\Windows\System\vKlXWuO.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\KGviwOe.exe
  C:\Windows\System\KGviwOe.exe
  2⤵
  PID:1396
- C:\Windows\System\WrLEVXc.exe
  C:\Windows\System\WrLEVXc.exe
  2⤵
  PID:3080
- C:\Windows\System\TGbnQBc.exe
  C:\Windows\System\TGbnQBc.exe
  2⤵
  PID:3016
- C:\Windows\System\bfdLxjq.exe
  C:\Windows\System\bfdLxjq.exe
  2⤵
  PID:5040
- C:\Windows\System\TyhWflb.exe
  C:\Windows\System\TyhWflb.exe
  2⤵
  PID:2968
- C:\Windows\System\WPvYJeu.exe
  C:\Windows\System\WPvYJeu.exe
  2⤵
  PID:1616
- C:\Windows\System\NZQRrMj.exe
  C:\Windows\System\NZQRrMj.exe
  2⤵
  PID:1568
- C:\Windows\System\LFfXmVi.exe
  C:\Windows\System\LFfXmVi.exe
  2⤵
  PID:836
- C:\Windows\System\wniJohw.exe
  C:\Windows\System\wniJohw.exe
  2⤵
  PID:3328
- C:\Windows\System\pHYMjHz.exe
  C:\Windows\System\pHYMjHz.exe
  2⤵
  PID:4944
- C:\Windows\System\kXRoToc.exe
  C:\Windows\System\kXRoToc.exe
  2⤵
  PID:4508
- C:\Windows\System\xUZkXhc.exe
  C:\Windows\System\xUZkXhc.exe
  2⤵
  PID:4060
- C:\Windows\System\TfFkWEJ.exe
  C:\Windows\System\TfFkWEJ.exe
  2⤵
  PID:1204
- C:\Windows\System\WYzoFMq.exe
  C:\Windows\System\WYzoFMq.exe
  2⤵
  PID:3800
- C:\Windows\System\XHSWPZR.exe
  C:\Windows\System\XHSWPZR.exe
  2⤵
  PID:2732
- C:\Windows\System\wmkPNTH.exe
  C:\Windows\System\wmkPNTH.exe
  2⤵
  PID:1936
- C:\Windows\System\fXnSord.exe
  C:\Windows\System\fXnSord.exe
  2⤵
  PID:408
- C:\Windows\System\SyIGfXD.exe
  C:\Windows\System\SyIGfXD.exe
  2⤵
  PID:624
- C:\Windows\System\xYwEWSl.exe
  C:\Windows\System\xYwEWSl.exe
  2⤵
  PID:3264
- C:\Windows\System\CIXvvkJ.exe
  C:\Windows\System\CIXvvkJ.exe
  2⤵
  PID:3056
- C:\Windows\System\kDFjfzQ.exe
  C:\Windows\System\kDFjfzQ.exe
  2⤵
  PID:4636
- C:\Windows\System\mPkFxIP.exe
  C:\Windows\System\mPkFxIP.exe
  2⤵
  PID:3632
- C:\Windows\System\MTJrRGy.exe
  C:\Windows\System\MTJrRGy.exe
  2⤵
  PID:3752
- C:\Windows\System\OZxeFoV.exe
  C:\Windows\System\OZxeFoV.exe
  2⤵
  PID:1540
- C:\Windows\System\CKTEsZP.exe
  C:\Windows\System\CKTEsZP.exe
  2⤵
  PID:796
- C:\Windows\System\SWBXUOu.exe
  C:\Windows\System\SWBXUOu.exe
  2⤵
  PID:3156
- C:\Windows\System\tACFRoW.exe
  C:\Windows\System\tACFRoW.exe
  2⤵
  PID:2228
- C:\Windows\System\LpqhYUu.exe
  C:\Windows\System\LpqhYUu.exe
  2⤵
  PID:4672
- C:\Windows\System\rRJUXUY.exe
  C:\Windows\System\rRJUXUY.exe
  2⤵
  PID:3380
- C:\Windows\System\aXCMjzT.exe
  C:\Windows\System\aXCMjzT.exe
  2⤵
  PID:2548
- C:\Windows\System\BaUyqvP.exe
  C:\Windows\System\BaUyqvP.exe
  2⤵
  PID:224
- C:\Windows\System\qRXuhqs.exe
  C:\Windows\System\qRXuhqs.exe
  2⤵
  PID:4552
- C:\Windows\System\mFuTmCK.exe
  C:\Windows\System\mFuTmCK.exe
  2⤵
  PID:780
- C:\Windows\System\kwTpzeu.exe
  C:\Windows\System\kwTpzeu.exe
  2⤵
  PID:872
- C:\Windows\System\UoqAcVE.exe
  C:\Windows\System\UoqAcVE.exe
  2⤵
  PID:3868
- C:\Windows\System\fOzLHPl.exe
  C:\Windows\System\fOzLHPl.exe
  2⤵
  PID:1948
- C:\Windows\System\HoFkdkC.exe
  C:\Windows\System\HoFkdkC.exe
  2⤵
  PID:924
- C:\Windows\System\kCojxEN.exe
  C:\Windows\System\kCojxEN.exe
  2⤵
  PID:2380
- C:\Windows\System\AnWKOAc.exe
  C:\Windows\System\AnWKOAc.exe
  2⤵
  PID:3692
- C:\Windows\System\lHOzygA.exe
  C:\Windows\System\lHOzygA.exe
  2⤵
  PID:1460
- C:\Windows\System\cSWbqwX.exe
  C:\Windows\System\cSWbqwX.exe
  2⤵
  PID:964
- C:\Windows\System\IsGDDHm.exe
  C:\Windows\System\IsGDDHm.exe
  2⤵
  PID:5116
- C:\Windows\System\UlMOBiH.exe
  C:\Windows\System\UlMOBiH.exe
  2⤵
  PID:4612
- C:\Windows\System\lIhxohe.exe
  C:\Windows\System\lIhxohe.exe
  2⤵
  PID:1792
- C:\Windows\System\SMVGiTj.exe
  C:\Windows\System\SMVGiTj.exe
  2⤵
  PID:5000
- C:\Windows\System\OLfMXQk.exe
  C:\Windows\System\OLfMXQk.exe
  2⤵
  PID:740
- C:\Windows\System\MrTPUzi.exe
  C:\Windows\System\MrTPUzi.exe
  2⤵
  PID:3940
- C:\Windows\System\rFEoMRV.exe
  C:\Windows\System\rFEoMRV.exe
  2⤵
  PID:2016
- C:\Windows\System\MtXwjJg.exe
  C:\Windows\System\MtXwjJg.exe
  2⤵
  PID:2964
- C:\Windows\System\vmjFvsS.exe
  C:\Windows\System\vmjFvsS.exe
  2⤵
  PID:4816
- C:\Windows\System\wOsAMFj.exe
  C:\Windows\System\wOsAMFj.exe
  2⤵
  PID:3608
- C:\Windows\System\YUTJAPw.exe
  C:\Windows\System\YUTJAPw.exe
  2⤵
  PID:3716
- C:\Windows\System\nUmXQTG.exe
  C:\Windows\System\nUmXQTG.exe
  2⤵
  PID:3516
- C:\Windows\System\WNPZOUw.exe
  C:\Windows\System\WNPZOUw.exe
  2⤵
  PID:3304
- C:\Windows\System\iSrGwSp.exe
  C:\Windows\System\iSrGwSp.exe
  2⤵
  PID:5140
- C:\Windows\System\VOEUDyV.exe
  C:\Windows\System\VOEUDyV.exe
  2⤵
  PID:5168
- C:\Windows\System\lThiEmF.exe
  C:\Windows\System\lThiEmF.exe
  2⤵
  PID:5184
- C:\Windows\System\jAiOLPf.exe
  C:\Windows\System\jAiOLPf.exe
  2⤵
  PID:5220
- C:\Windows\System\zbVANfU.exe
  C:\Windows\System\zbVANfU.exe
  2⤵
  PID:5256
- C:\Windows\System\NTMdgFJ.exe
  C:\Windows\System\NTMdgFJ.exe
  2⤵
  PID:5280
- C:\Windows\System\xpxkpZc.exe
  C:\Windows\System\xpxkpZc.exe
  2⤵
  PID:5308
- C:\Windows\System\ixahZHv.exe
  C:\Windows\System\ixahZHv.exe
  2⤵
  PID:5340
- C:\Windows\System\jmSbNXb.exe
  C:\Windows\System\jmSbNXb.exe
  2⤵
  PID:5368
- C:\Windows\System\kyYJnCZ.exe
  C:\Windows\System\kyYJnCZ.exe
  2⤵
  PID:5396
- C:\Windows\System\rolDIhO.exe
  C:\Windows\System\rolDIhO.exe
  2⤵
  PID:5420
- C:\Windows\System\kAuDyij.exe
  C:\Windows\System\kAuDyij.exe
  2⤵
  PID:5448
- C:\Windows\System\AhaTQrU.exe
  C:\Windows\System\AhaTQrU.exe
  2⤵
  PID:5480
- C:\Windows\System\nWYWoBg.exe
  C:\Windows\System\nWYWoBg.exe
  2⤵
  PID:5512
- C:\Windows\System\xBMPGTx.exe
  C:\Windows\System\xBMPGTx.exe
  2⤵
  PID:5536
- C:\Windows\System\XOVNagX.exe
  C:\Windows\System\XOVNagX.exe
  2⤵
  PID:5560
- C:\Windows\System\OwWNxJA.exe
  C:\Windows\System\OwWNxJA.exe
  2⤵
  PID:5596
- C:\Windows\System\NJHWBbE.exe
  C:\Windows\System\NJHWBbE.exe
  2⤵
  PID:5624
- C:\Windows\System\mqWlJry.exe
  C:\Windows\System\mqWlJry.exe
  2⤵
  PID:5648
- C:\Windows\System\FYUwGWW.exe
  C:\Windows\System\FYUwGWW.exe
  2⤵
  PID:5676
- C:\Windows\System\MZCQqEF.exe
  C:\Windows\System\MZCQqEF.exe
  2⤵
  PID:5724
- C:\Windows\System\kcsLZag.exe
  C:\Windows\System\kcsLZag.exe
  2⤵
  PID:5772
- C:\Windows\System\rwxcwzW.exe
  C:\Windows\System\rwxcwzW.exe
  2⤵
  PID:5800
- C:\Windows\System\jCrrbIn.exe
  C:\Windows\System\jCrrbIn.exe
  2⤵
  PID:5828
- C:\Windows\System\HxlckZQ.exe
  C:\Windows\System\HxlckZQ.exe
  2⤵
  PID:5856
- C:\Windows\System\wUtMtGs.exe
  C:\Windows\System\wUtMtGs.exe
  2⤵
  PID:5884
- C:\Windows\System\AulOptx.exe
  C:\Windows\System\AulOptx.exe
  2⤵
  PID:5912
- C:\Windows\System\WnAnWtb.exe
  C:\Windows\System\WnAnWtb.exe
  2⤵
  PID:5940
- C:\Windows\System\lodYJkw.exe
  C:\Windows\System\lodYJkw.exe
  2⤵
  PID:5968
- C:\Windows\System\pXgXqHh.exe
  C:\Windows\System\pXgXqHh.exe
  2⤵
  PID:5996
- C:\Windows\System\XtMhsSO.exe
  C:\Windows\System\XtMhsSO.exe
  2⤵
  PID:6024
- C:\Windows\System\LabRbVQ.exe
  C:\Windows\System\LabRbVQ.exe
  2⤵
  PID:6044
- C:\Windows\System\ClNQFdM.exe
  C:\Windows\System\ClNQFdM.exe
  2⤵
  PID:6080
- C:\Windows\System\FRfuqxQ.exe
  C:\Windows\System\FRfuqxQ.exe
  2⤵
  PID:6108
- C:\Windows\System\GjMZwEu.exe
  C:\Windows\System\GjMZwEu.exe
  2⤵
  PID:6136
- C:\Windows\System\cImhucb.exe
  C:\Windows\System\cImhucb.exe
  2⤵
  PID:5148
- C:\Windows\System\DixAiAG.exe
  C:\Windows\System\DixAiAG.exe
  2⤵
  PID:5196
- C:\Windows\System\fuWMhyg.exe
  C:\Windows\System\fuWMhyg.exe
  2⤵
  PID:5232
- C:\Windows\System\deayKZG.exe
  C:\Windows\System\deayKZG.exe
  2⤵
  PID:5320
- C:\Windows\System\hbvITsl.exe
  C:\Windows\System\hbvITsl.exe
  2⤵
  PID:5408
- C:\Windows\System\xKoLdOX.exe
  C:\Windows\System\xKoLdOX.exe
  2⤵
  PID:5476
- C:\Windows\System\yKAHiyR.exe
  C:\Windows\System\yKAHiyR.exe
  2⤵
  PID:5528
- C:\Windows\System\DjiJeSB.exe
  C:\Windows\System\DjiJeSB.exe
  2⤵
  PID:5604
- C:\Windows\System\PORyqIx.exe
  C:\Windows\System\PORyqIx.exe
  2⤵
  PID:5664
- C:\Windows\System\BoJOxNR.exe
  C:\Windows\System\BoJOxNR.exe
  2⤵
  PID:5764
- C:\Windows\System\HKcQfxK.exe
  C:\Windows\System\HKcQfxK.exe
  2⤵
  PID:5788
- C:\Windows\System\bPxJQCa.exe
  C:\Windows\System\bPxJQCa.exe
  2⤵
  PID:5848
- C:\Windows\System\VlRxSzp.exe
  C:\Windows\System\VlRxSzp.exe
  2⤵
  PID:5952
- C:\Windows\System\GdNlntG.exe
  C:\Windows\System\GdNlntG.exe
  2⤵
  PID:5988
- C:\Windows\System\kVGfjla.exe
  C:\Windows\System\kVGfjla.exe
  2⤵
  PID:6036
- C:\Windows\System\cDqzyGh.exe
  C:\Windows\System\cDqzyGh.exe
  2⤵
  PID:6132
- C:\Windows\System\LQPbiqH.exe
  C:\Windows\System\LQPbiqH.exe
  2⤵
  PID:5180
- C:\Windows\System\fqrmLTn.exe
  C:\Windows\System\fqrmLTn.exe
  2⤵
  PID:5364
- C:\Windows\System\pStSBoU.exe
  C:\Windows\System\pStSBoU.exe
  2⤵
  PID:5508
- C:\Windows\System\fmMUGlZ.exe
  C:\Windows\System\fmMUGlZ.exe
  2⤵
  PID:5632
- C:\Windows\System\UHviDUa.exe
  C:\Windows\System\UHviDUa.exe
  2⤵
  PID:5760
- C:\Windows\System\TyZdzcc.exe
  C:\Windows\System\TyZdzcc.exe
  2⤵
  PID:6068
- C:\Windows\System\BGXtIBs.exe
  C:\Windows\System\BGXtIBs.exe
  2⤵
  PID:5136
- C:\Windows\System\aZPthpU.exe
  C:\Windows\System\aZPthpU.exe
  2⤵
  PID:5556
- C:\Windows\System\LgiEQsb.exe
  C:\Windows\System\LgiEQsb.exe
  2⤵
  PID:5932
- C:\Windows\System\BotKJas.exe
  C:\Windows\System\BotKJas.exe
  2⤵
  PID:5124
- C:\Windows\System\zUGXTIc.exe
  C:\Windows\System\zUGXTIc.exe
  2⤵
  PID:5156
- C:\Windows\System\oxOBZqq.exe
  C:\Windows\System\oxOBZqq.exe
  2⤵
  PID:6148
- C:\Windows\System\jmwalfd.exe
  C:\Windows\System\jmwalfd.exe
  2⤵
  PID:6172
- C:\Windows\System\yeHazkp.exe
  C:\Windows\System\yeHazkp.exe
  2⤵
  PID:6200
- C:\Windows\System\mMNuuFg.exe
  C:\Windows\System\mMNuuFg.exe
  2⤵
  PID:6228
- C:\Windows\System\SaiSaQJ.exe
  C:\Windows\System\SaiSaQJ.exe
  2⤵
  PID:6260
- C:\Windows\System\wpFltxS.exe
  C:\Windows\System\wpFltxS.exe
  2⤵
  PID:6288
- C:\Windows\System\slVfmTO.exe
  C:\Windows\System\slVfmTO.exe
  2⤵
  PID:6308
- C:\Windows\System\DXJzwqN.exe
  C:\Windows\System\DXJzwqN.exe
  2⤵
  PID:6336
- C:\Windows\System\vgNAvxP.exe
  C:\Windows\System\vgNAvxP.exe
  2⤵
  PID:6364
- C:\Windows\System\ucPAQDL.exe
  C:\Windows\System\ucPAQDL.exe
  2⤵
  PID:6388
- C:\Windows\System\jyopJIr.exe
  C:\Windows\System\jyopJIr.exe
  2⤵
  PID:6416
- C:\Windows\System\vqSSMDc.exe
  C:\Windows\System\vqSSMDc.exe
  2⤵
  PID:6444
- C:\Windows\System\DfiOlKI.exe
  C:\Windows\System\DfiOlKI.exe
  2⤵
  PID:6468
- C:\Windows\System\YUoOnbn.exe
  C:\Windows\System\YUoOnbn.exe
  2⤵
  PID:6500
- C:\Windows\System\yKHHvua.exe
  C:\Windows\System\yKHHvua.exe
  2⤵
  PID:6524
- C:\Windows\System\WbfcdNs.exe
  C:\Windows\System\WbfcdNs.exe
  2⤵
  PID:6548
- C:\Windows\System\JSNcClv.exe
  C:\Windows\System\JSNcClv.exe
  2⤵
  PID:6576
- C:\Windows\System\fBEHcgG.exe
  C:\Windows\System\fBEHcgG.exe
  2⤵
  PID:6608
- C:\Windows\System\NBaXtjD.exe
  C:\Windows\System\NBaXtjD.exe
  2⤵
  PID:6632
- C:\Windows\System\pduQofq.exe
  C:\Windows\System\pduQofq.exe
  2⤵
  PID:6648
- C:\Windows\System\YlrAcol.exe
  C:\Windows\System\YlrAcol.exe
  2⤵
  PID:6680
- C:\Windows\System\KjjHcFB.exe
  C:\Windows\System\KjjHcFB.exe
  2⤵
  PID:6704
- C:\Windows\System\NJmoQhr.exe
  C:\Windows\System\NJmoQhr.exe
  2⤵
  PID:6732
- C:\Windows\System\SsczJRv.exe
  C:\Windows\System\SsczJRv.exe
  2⤵
  PID:6752
- C:\Windows\System\QozZRIs.exe
  C:\Windows\System\QozZRIs.exe
  2⤵
  PID:6776
- C:\Windows\System\bVYglUT.exe
  C:\Windows\System\bVYglUT.exe
  2⤵
  PID:6804
- C:\Windows\System\iVurzwi.exe
  C:\Windows\System\iVurzwi.exe
  2⤵
  PID:6836
- C:\Windows\System\FAdgxyl.exe
  C:\Windows\System\FAdgxyl.exe
  2⤵
  PID:6864
- C:\Windows\System\uimBMGF.exe
  C:\Windows\System\uimBMGF.exe
  2⤵
  PID:6892
- C:\Windows\System\LeekhfN.exe
  C:\Windows\System\LeekhfN.exe
  2⤵
  PID:6920
- C:\Windows\System\bYergjd.exe
  C:\Windows\System\bYergjd.exe
  2⤵
  PID:6944
- C:\Windows\System\fXGOHhl.exe
  C:\Windows\System\fXGOHhl.exe
  2⤵
  PID:6972
- C:\Windows\System\zFMjouU.exe
  C:\Windows\System\zFMjouU.exe
  2⤵
  PID:7008
- C:\Windows\System\IjWPCWk.exe
  C:\Windows\System\IjWPCWk.exe
  2⤵
  PID:7036
- C:\Windows\System\LBVvHPN.exe
  C:\Windows\System\LBVvHPN.exe
  2⤵
  PID:7056
- C:\Windows\System\fhWffzQ.exe
  C:\Windows\System\fhWffzQ.exe
  2⤵
  PID:7076
- C:\Windows\System\GkqNJiz.exe
  C:\Windows\System\GkqNJiz.exe
  2⤵
  PID:7096
- C:\Windows\System\gMfgACI.exe
  C:\Windows\System\gMfgACI.exe
  2⤵
  PID:7128
- C:\Windows\System\fkbDslC.exe
  C:\Windows\System\fkbDslC.exe
  2⤵
  PID:7148
- C:\Windows\System\EpvVnmp.exe
  C:\Windows\System\EpvVnmp.exe
  2⤵
  PID:6156
- C:\Windows\System\ziNJGkV.exe
  C:\Windows\System\ziNJGkV.exe
  2⤵
  PID:6224
- C:\Windows\System\jcBhIcf.exe
  C:\Windows\System\jcBhIcf.exe
  2⤵
  PID:6284
- C:\Windows\System\pXYCeMi.exe
  C:\Windows\System\pXYCeMi.exe
  2⤵
  PID:6408
- C:\Windows\System\rNrdjwu.exe
  C:\Windows\System\rNrdjwu.exe
  2⤵
  PID:6492
- C:\Windows\System\wvuiUFX.exe
  C:\Windows\System\wvuiUFX.exe
  2⤵
  PID:6568
- C:\Windows\System\AgWzpPN.exe
  C:\Windows\System\AgWzpPN.exe
  2⤵
  PID:6604
- C:\Windows\System\ofpMGbf.exe
  C:\Windows\System\ofpMGbf.exe
  2⤵
  PID:6692
- C:\Windows\System\KoqSFbC.exe
  C:\Windows\System\KoqSFbC.exe
  2⤵
  PID:6716
- C:\Windows\System\yMUbjtH.exe
  C:\Windows\System\yMUbjtH.exe
  2⤵
  PID:6848
- C:\Windows\System\ctWsWpg.exe
  C:\Windows\System\ctWsWpg.exe
  2⤵
  PID:6772
- C:\Windows\System\QhFCSOL.exe
  C:\Windows\System\QhFCSOL.exe
  2⤵
  PID:6900
- C:\Windows\System\ByocrEU.exe
  C:\Windows\System\ByocrEU.exe
  2⤵
  PID:6940
- C:\Windows\System\sQfxrqu.exe
  C:\Windows\System\sQfxrqu.exe
  2⤵
  PID:6992
- C:\Windows\System\fbbaRmx.exe
  C:\Windows\System\fbbaRmx.exe
  2⤵
  PID:7032
- C:\Windows\System\XLImdBf.exe
  C:\Windows\System\XLImdBf.exe
  2⤵
  PID:7164
- C:\Windows\System\xiBOggd.exe
  C:\Windows\System\xiBOggd.exe
  2⤵
  PID:6236
- C:\Windows\System\BEeGVAr.exe
  C:\Windows\System\BEeGVAr.exe
  2⤵
  PID:6376
- C:\Windows\System\aYoexLT.exe
  C:\Windows\System\aYoexLT.exe
  2⤵
  PID:6560
- C:\Windows\System\OOMOTUe.exe
  C:\Windows\System\OOMOTUe.exe
  2⤵
  PID:6748
- C:\Windows\System\JqAeAhn.exe
  C:\Windows\System\JqAeAhn.exe
  2⤵
  PID:6912
- C:\Windows\System\fibNELH.exe
  C:\Windows\System\fibNELH.exe
  2⤵
  PID:7084
- C:\Windows\System\xNPHdms.exe
  C:\Windows\System\xNPHdms.exe
  2⤵
  PID:7112
- C:\Windows\System\PhQcWYU.exe
  C:\Windows\System\PhQcWYU.exe
  2⤵
  PID:6512
- C:\Windows\System\ZEuLpjn.exe
  C:\Windows\System\ZEuLpjn.exe
  2⤵
  PID:7176
- C:\Windows\System\jdkExzz.exe
  C:\Windows\System\jdkExzz.exe
  2⤵
  PID:7204
- C:\Windows\System\EPxlmZB.exe
  C:\Windows\System\EPxlmZB.exe
  2⤵
  PID:7232
- C:\Windows\System\GwIbFlH.exe
  C:\Windows\System\GwIbFlH.exe
  2⤵
  PID:7248
- C:\Windows\System\QdgIceM.exe
  C:\Windows\System\QdgIceM.exe
  2⤵
  PID:7276
- C:\Windows\System\QGcVmNo.exe
  C:\Windows\System\QGcVmNo.exe
  2⤵
  PID:7300
- C:\Windows\System\zZjzKkl.exe
  C:\Windows\System\zZjzKkl.exe
  2⤵
  PID:7320
- C:\Windows\System\PCJCPRk.exe
  C:\Windows\System\PCJCPRk.exe
  2⤵
  PID:7352
- C:\Windows\System\NZGHtOr.exe
  C:\Windows\System\NZGHtOr.exe
  2⤵
  PID:7372
- C:\Windows\System\rBzssmi.exe
  C:\Windows\System\rBzssmi.exe
  2⤵
  PID:7400
- C:\Windows\System\GcakcbN.exe
  C:\Windows\System\GcakcbN.exe
  2⤵
  PID:7428
- C:\Windows\System\vnnxXoF.exe
  C:\Windows\System\vnnxXoF.exe
  2⤵
  PID:7452
- C:\Windows\System\XtvwNZE.exe
  C:\Windows\System\XtvwNZE.exe
  2⤵
  PID:7480
- C:\Windows\System\wPREkua.exe
  C:\Windows\System\wPREkua.exe
  2⤵
  PID:7512
- C:\Windows\System\tLAtgMo.exe
  C:\Windows\System\tLAtgMo.exe
  2⤵
  PID:7536
- C:\Windows\System\eTzmmec.exe
  C:\Windows\System\eTzmmec.exe
  2⤵
  PID:7564
- C:\Windows\System\uBzfgkz.exe
  C:\Windows\System\uBzfgkz.exe
  2⤵
  PID:7584
- C:\Windows\System\yPxhhVW.exe
  C:\Windows\System\yPxhhVW.exe
  2⤵
  PID:7616
- C:\Windows\System\WKIoYoA.exe
  C:\Windows\System\WKIoYoA.exe
  2⤵
  PID:7640
- C:\Windows\System\dgyTCrN.exe
  C:\Windows\System\dgyTCrN.exe
  2⤵
  PID:7664
- C:\Windows\System\jzYuWMp.exe
  C:\Windows\System\jzYuWMp.exe
  2⤵
  PID:7692
- C:\Windows\System\VBAtQsQ.exe
  C:\Windows\System\VBAtQsQ.exe
  2⤵
  PID:7716
- C:\Windows\System\dyoHful.exe
  C:\Windows\System\dyoHful.exe
  2⤵
  PID:7748
- C:\Windows\System\MZxVegW.exe
  C:\Windows\System\MZxVegW.exe
  2⤵
  PID:7768
- C:\Windows\System\AmYWLYR.exe
  C:\Windows\System\AmYWLYR.exe
  2⤵
  PID:7800
- C:\Windows\System\rjhBmBn.exe
  C:\Windows\System\rjhBmBn.exe
  2⤵
  PID:7828
- C:\Windows\System\XZRPGKt.exe
  C:\Windows\System\XZRPGKt.exe
  2⤵
  PID:7848
- C:\Windows\System\slTVURz.exe
  C:\Windows\System\slTVURz.exe
  2⤵
  PID:7880
- C:\Windows\System\TEzNtPP.exe
  C:\Windows\System\TEzNtPP.exe
  2⤵
  PID:7908
- C:\Windows\System\vnRakab.exe
  C:\Windows\System\vnRakab.exe
  2⤵
  PID:7936
- C:\Windows\System\qZzRUnq.exe
  C:\Windows\System\qZzRUnq.exe
  2⤵
  PID:7964
- C:\Windows\System\aOIDDoa.exe
  C:\Windows\System\aOIDDoa.exe
  2⤵
  PID:7992
- C:\Windows\System\lkQstWK.exe
  C:\Windows\System\lkQstWK.exe
  2⤵
  PID:8012
- C:\Windows\System\EZsSvzT.exe
  C:\Windows\System\EZsSvzT.exe
  2⤵
  PID:8044
- C:\Windows\System\xFmbAdP.exe
  C:\Windows\System\xFmbAdP.exe
  2⤵
  PID:8068
- C:\Windows\System\NxyAXQR.exe
  C:\Windows\System\NxyAXQR.exe
  2⤵
  PID:8100
- C:\Windows\System\ivhbLGk.exe
  C:\Windows\System\ivhbLGk.exe
  2⤵
  PID:8120
- C:\Windows\System\djECPfj.exe
  C:\Windows\System\djECPfj.exe
  2⤵
  PID:8148
- C:\Windows\System\tPejlqG.exe
  C:\Windows\System\tPejlqG.exe
  2⤵
  PID:8168
- C:\Windows\System\YgrCFPX.exe
  C:\Windows\System\YgrCFPX.exe
  2⤵
  PID:6596
- C:\Windows\System\nVIpfVB.exe
  C:\Windows\System\nVIpfVB.exe
  2⤵
  PID:6440
- C:\Windows\System\UVjrtfd.exe
  C:\Windows\System\UVjrtfd.exe
  2⤵
  PID:7092
- C:\Windows\System\EvchrXG.exe
  C:\Windows\System\EvchrXG.exe
  2⤵
  PID:7284
- C:\Windows\System\xQVXIeo.exe
  C:\Windows\System\xQVXIeo.exe
  2⤵
  PID:7336
- C:\Windows\System\SLhzPOo.exe
  C:\Windows\System\SLhzPOo.exe
  2⤵
  PID:7368
- C:\Windows\System\EzPUvHw.exe
  C:\Windows\System\EzPUvHw.exe
  2⤵
  PID:7264
- C:\Windows\System\aBecvzS.exe
  C:\Windows\System\aBecvzS.exe
  2⤵
  PID:7412
- C:\Windows\System\RatqXKN.exe
  C:\Windows\System\RatqXKN.exe
  2⤵
  PID:7492
- C:\Windows\System\BGEPYUx.exe
  C:\Windows\System\BGEPYUx.exe
  2⤵
  PID:7600
- C:\Windows\System\qYJMiOI.exe
  C:\Windows\System\qYJMiOI.exe
  2⤵
  PID:7676
- C:\Windows\System\AfUemmd.exe
  C:\Windows\System\AfUemmd.exe
  2⤵
  PID:7736
- C:\Windows\System\ZKtOaam.exe
  C:\Windows\System\ZKtOaam.exe
  2⤵
  PID:7572
- C:\Windows\System\QKRALHI.exe
  C:\Windows\System\QKRALHI.exe
  2⤵
  PID:7688
- C:\Windows\System\zPtVaWC.exe
  C:\Windows\System\zPtVaWC.exe
  2⤵
  PID:7900
- C:\Windows\System\lNOWLPP.exe
  C:\Windows\System\lNOWLPP.exe
  2⤵
  PID:8008
- C:\Windows\System\keojHow.exe
  C:\Windows\System\keojHow.exe
  2⤵
  PID:8028
- C:\Windows\System\xuFLJWs.exe
  C:\Windows\System\xuFLJWs.exe
  2⤵
  PID:8060
- C:\Windows\System\BFvlEcW.exe
  C:\Windows\System\BFvlEcW.exe
  2⤵
  PID:8112
- C:\Windows\System\AbqEAVv.exe
  C:\Windows\System\AbqEAVv.exe
  2⤵
  PID:8144
- C:\Windows\System\EfjZAgO.exe
  C:\Windows\System\EfjZAgO.exe
  2⤵
  PID:7072
- C:\Windows\System\rJbebnH.exe
  C:\Windows\System\rJbebnH.exe
  2⤵
  PID:6644
- C:\Windows\System\AwYrtRA.exe
  C:\Windows\System\AwYrtRA.exe
  2⤵
  PID:6616
- C:\Windows\System\BmQCVIi.exe
  C:\Windows\System\BmQCVIi.exe
  2⤵
  PID:7312
- C:\Windows\System\YZKynLG.exe
  C:\Windows\System\YZKynLG.exe
  2⤵
  PID:7472
- C:\Windows\System\PWaZvig.exe
  C:\Windows\System\PWaZvig.exe
  2⤵
  PID:7636
- C:\Windows\System\TAwKQlw.exe
  C:\Windows\System\TAwKQlw.exe
  2⤵
  PID:8056
- C:\Windows\System\kdMmsaH.exe
  C:\Windows\System\kdMmsaH.exe
  2⤵
  PID:8200
- C:\Windows\System\BXRLvWA.exe
  C:\Windows\System\BXRLvWA.exe
  2⤵
  PID:8228
- C:\Windows\System\QUpfGsE.exe
  C:\Windows\System\QUpfGsE.exe
  2⤵
  PID:8256
- C:\Windows\System\pTbxEKF.exe
  C:\Windows\System\pTbxEKF.exe
  2⤵
  PID:8280
- C:\Windows\System\vgLCfpa.exe
  C:\Windows\System\vgLCfpa.exe
  2⤵
  PID:8304
- C:\Windows\System\DiWdULz.exe
  C:\Windows\System\DiWdULz.exe
  2⤵
  PID:8340
- C:\Windows\System\rXLdshz.exe
  C:\Windows\System\rXLdshz.exe
  2⤵
  PID:8364
- C:\Windows\System\YpBNYQK.exe
  C:\Windows\System\YpBNYQK.exe
  2⤵
  PID:8388
- C:\Windows\System\WNdXpRC.exe
  C:\Windows\System\WNdXpRC.exe
  2⤵
  PID:8412
- C:\Windows\System\maPEOra.exe
  C:\Windows\System\maPEOra.exe
  2⤵
  PID:8448
- C:\Windows\System\FvSSZMM.exe
  C:\Windows\System\FvSSZMM.exe
  2⤵
  PID:8468
- C:\Windows\System\LwsHciq.exe
  C:\Windows\System\LwsHciq.exe
  2⤵
  PID:8496
- C:\Windows\System\sNXQsfl.exe
  C:\Windows\System\sNXQsfl.exe
  2⤵
  PID:8520
- C:\Windows\System\wDOborW.exe
  C:\Windows\System\wDOborW.exe
  2⤵
  PID:8548
- C:\Windows\System\VYExkzx.exe
  C:\Windows\System\VYExkzx.exe
  2⤵
  PID:8564
- C:\Windows\System\BvnuHOB.exe
  C:\Windows\System\BvnuHOB.exe
  2⤵
  PID:8592
- C:\Windows\System\pQgWpzx.exe
  C:\Windows\System\pQgWpzx.exe
  2⤵
  PID:8612
- C:\Windows\System\sHbuxOl.exe
  C:\Windows\System\sHbuxOl.exe
  2⤵
  PID:8652
- C:\Windows\System\ClMdYWR.exe
  C:\Windows\System\ClMdYWR.exe
  2⤵
  PID:8672
- C:\Windows\System\yrOgGfl.exe
  C:\Windows\System\yrOgGfl.exe
  2⤵
  PID:8700
- C:\Windows\System\CUsHNju.exe
  C:\Windows\System\CUsHNju.exe
  2⤵
  PID:8728
- C:\Windows\System\kcuBMQZ.exe
  C:\Windows\System\kcuBMQZ.exe
  2⤵
  PID:8756
- C:\Windows\System\xplqqJN.exe
  C:\Windows\System\xplqqJN.exe
  2⤵
  PID:8776
- C:\Windows\System\ANZujHa.exe
  C:\Windows\System\ANZujHa.exe
  2⤵
  PID:8800
- C:\Windows\System\eGrcwMe.exe
  C:\Windows\System\eGrcwMe.exe
  2⤵
  PID:8820
- C:\Windows\System\uLgZfuf.exe
  C:\Windows\System\uLgZfuf.exe
  2⤵
  PID:8848
- C:\Windows\System\fjQuomh.exe
  C:\Windows\System\fjQuomh.exe
  2⤵
  PID:8872
- C:\Windows\System\wCMJthD.exe
  C:\Windows\System\wCMJthD.exe
  2⤵
  PID:8892
- C:\Windows\System\qLqSCwl.exe
  C:\Windows\System\qLqSCwl.exe
  2⤵
  PID:8916
- C:\Windows\System\vkmPtiL.exe
  C:\Windows\System\vkmPtiL.exe
  2⤵
  PID:8952
- C:\Windows\System\LWibdvz.exe
  C:\Windows\System\LWibdvz.exe
  2⤵
  PID:8984
- C:\Windows\System\QIqkXhn.exe
  C:\Windows\System\QIqkXhn.exe
  2⤵
  PID:9012
- C:\Windows\System\ZsqBXUk.exe
  C:\Windows\System\ZsqBXUk.exe
  2⤵
  PID:9044
- C:\Windows\System\izIbtgz.exe
  C:\Windows\System\izIbtgz.exe
  2⤵
  PID:9072
- C:\Windows\System\aBuwDaJ.exe
  C:\Windows\System\aBuwDaJ.exe
  2⤵
  PID:9100
- C:\Windows\System\cbjtDjK.exe
  C:\Windows\System\cbjtDjK.exe
  2⤵
  PID:9128
- C:\Windows\System\cSTKqLN.exe
  C:\Windows\System\cSTKqLN.exe
  2⤵
  PID:9152
- C:\Windows\System\fciKFuN.exe
  C:\Windows\System\fciKFuN.exe
  2⤵
  PID:9184
- C:\Windows\System\jaXiRcL.exe
  C:\Windows\System\jaXiRcL.exe
  2⤵
  PID:9212
- C:\Windows\System\WTcGXwp.exe
  C:\Windows\System\WTcGXwp.exe
  2⤵
  PID:7580
- C:\Windows\System\uyzmjKt.exe
  C:\Windows\System\uyzmjKt.exe
  2⤵
  PID:7820
- C:\Windows\System\ETzboTM.exe
  C:\Windows\System\ETzboTM.exe
  2⤵
  PID:8220
- C:\Windows\System\fNCwXyn.exe
  C:\Windows\System\fNCwXyn.exe
  2⤵
  PID:8252
- C:\Windows\System\rRQYJQD.exe
  C:\Windows\System\rRQYJQD.exe
  2⤵
  PID:8292
- C:\Windows\System\OgUBppU.exe
  C:\Windows\System\OgUBppU.exe
  2⤵
  PID:8316
- C:\Windows\System\zLrUvyb.exe
  C:\Windows\System\zLrUvyb.exe
  2⤵
  PID:7764
- C:\Windows\System\MqPiRoC.exe
  C:\Windows\System\MqPiRoC.exe
  2⤵
  PID:8196
- C:\Windows\System\vggVELV.exe
  C:\Windows\System\vggVELV.exe
  2⤵
  PID:8188
- C:\Windows\System\rlnFFzx.exe
  C:\Windows\System\rlnFFzx.exe
  2⤵
  PID:8244
- C:\Windows\System\OfmzcgM.exe
  C:\Windows\System\OfmzcgM.exe
  2⤵
  PID:8560
- C:\Windows\System\ExpxnQM.exe
  C:\Windows\System\ExpxnQM.exe
  2⤵
  PID:8632
- C:\Windows\System\aAneTQE.exe
  C:\Windows\System\aAneTQE.exe
  2⤵
  PID:8444
- C:\Windows\System\MTbqdFK.exe
  C:\Windows\System\MTbqdFK.exe
  2⤵
  PID:8840
- C:\Windows\System\UBnjFYi.exe
  C:\Windows\System\UBnjFYi.exe
  2⤵
  PID:8512
- C:\Windows\System\hLeHbLN.exe
  C:\Windows\System\hLeHbLN.exe
  2⤵
  PID:8540
- C:\Windows\System\PkOsaFa.exe
  C:\Windows\System\PkOsaFa.exe
  2⤵
  PID:8584
- C:\Windows\System\pLJYZmp.exe
  C:\Windows\System\pLJYZmp.exe
  2⤵
  PID:8864
- C:\Windows\System\ixjiEWh.exe
  C:\Windows\System\ixjiEWh.exe
  2⤵
  PID:8936
- C:\Windows\System\qkunaOs.exe
  C:\Windows\System\qkunaOs.exe
  2⤵
  PID:9176
- C:\Windows\System\tPCzUqM.exe
  C:\Windows\System\tPCzUqM.exe
  2⤵
  PID:9052
- C:\Windows\System\yFSVVUV.exe
  C:\Windows\System\yFSVVUV.exe
  2⤵
  PID:8868
- C:\Windows\System\VIrAzLY.exe
  C:\Windows\System\VIrAzLY.exe
  2⤵
  PID:9088
- C:\Windows\System\pFYZQML.exe
  C:\Windows\System\pFYZQML.exe
  2⤵
  PID:9140
- C:\Windows\System\FHwcjgG.exe
  C:\Windows\System\FHwcjgG.exe
  2⤵
  PID:9008
- C:\Windows\System\YpKdoeY.exe
  C:\Windows\System\YpKdoeY.exe
  2⤵
  PID:8580
- C:\Windows\System\obbFXOP.exe
  C:\Windows\System\obbFXOP.exe
  2⤵
  PID:8724
- C:\Windows\System\JEOBQPl.exe
  C:\Windows\System\JEOBQPl.exe
  2⤵
  PID:9244
- C:\Windows\System\WWmnTBd.exe
  C:\Windows\System\WWmnTBd.exe
  2⤵
  PID:9272
- C:\Windows\System\NyWxkWn.exe
  C:\Windows\System\NyWxkWn.exe
  2⤵
  PID:9304
- C:\Windows\System\UWPkMDz.exe
  C:\Windows\System\UWPkMDz.exe
  2⤵
  PID:9324
- C:\Windows\System\ALymwPr.exe
  C:\Windows\System\ALymwPr.exe
  2⤵
  PID:9340
- C:\Windows\System\PZtCVvL.exe
  C:\Windows\System\PZtCVvL.exe
  2⤵
  PID:9368
- C:\Windows\System\BfQYlHK.exe
  C:\Windows\System\BfQYlHK.exe
  2⤵
  PID:9388
- C:\Windows\System\tdOcCpy.exe
  C:\Windows\System\tdOcCpy.exe
  2⤵
  PID:9408
- C:\Windows\System\MFATFUd.exe
  C:\Windows\System\MFATFUd.exe
  2⤵
  PID:9436
- C:\Windows\System\fubkqpU.exe
  C:\Windows\System\fubkqpU.exe
  2⤵
  PID:9460
- C:\Windows\System\drgjkfX.exe
  C:\Windows\System\drgjkfX.exe
  2⤵
  PID:9484
- C:\Windows\System\jeEfSyV.exe
  C:\Windows\System\jeEfSyV.exe
  2⤵
  PID:9504
- C:\Windows\System\TcFpmFG.exe
  C:\Windows\System\TcFpmFG.exe
  2⤵
  PID:9532
- C:\Windows\System\ZKcoRZp.exe
  C:\Windows\System\ZKcoRZp.exe
  2⤵
  PID:9552
- C:\Windows\System\wvNTEBl.exe
  C:\Windows\System\wvNTEBl.exe
  2⤵
  PID:9576
- C:\Windows\System\PDAKCxk.exe
  C:\Windows\System\PDAKCxk.exe
  2⤵
  PID:9596
- C:\Windows\System\bKHMVpN.exe
  C:\Windows\System\bKHMVpN.exe
  2⤵
  PID:9624
- C:\Windows\System\KRkxJNE.exe
  C:\Windows\System\KRkxJNE.exe
  2⤵
  PID:9656
- C:\Windows\System\olvHyyP.exe
  C:\Windows\System\olvHyyP.exe
  2⤵
  PID:9672
- C:\Windows\System\avGhxxV.exe
  C:\Windows\System\avGhxxV.exe
  2⤵
  PID:9696
- C:\Windows\System\vxyNvak.exe
  C:\Windows\System\vxyNvak.exe
  2⤵
  PID:9728
- C:\Windows\System\mezGzrS.exe
  C:\Windows\System\mezGzrS.exe
  2⤵
  PID:9756
- C:\Windows\System\hsWQDUV.exe
  C:\Windows\System\hsWQDUV.exe
  2⤵
  PID:9780
- C:\Windows\System\gueLTvF.exe
  C:\Windows\System\gueLTvF.exe
  2⤵
  PID:9796
- C:\Windows\System\hpcHqJE.exe
  C:\Windows\System\hpcHqJE.exe
  2⤵
  PID:9824
- C:\Windows\System\UBEitIe.exe
  C:\Windows\System\UBEitIe.exe
  2⤵
  PID:9852
- C:\Windows\System\RUkfQHL.exe
  C:\Windows\System\RUkfQHL.exe
  2⤵
  PID:9872
- C:\Windows\System\uNKQjUa.exe
  C:\Windows\System\uNKQjUa.exe
  2⤵
  PID:9896
- C:\Windows\System\MuioWGa.exe
  C:\Windows\System\MuioWGa.exe
  2⤵
  PID:9928
- C:\Windows\System\saePiNH.exe
  C:\Windows\System\saePiNH.exe
  2⤵
  PID:9960
- C:\Windows\System\dIbyrSY.exe
  C:\Windows\System\dIbyrSY.exe
  2⤵
  PID:9984
- C:\Windows\System\etjIcrU.exe
  C:\Windows\System\etjIcrU.exe
  2⤵
  PID:10000
- C:\Windows\System\lJhYiEy.exe
  C:\Windows\System\lJhYiEy.exe
  2⤵
  PID:10028
- C:\Windows\System\KYbHNaT.exe
  C:\Windows\System\KYbHNaT.exe
  2⤵
  PID:10052
- C:\Windows\System\xMbNOBk.exe
  C:\Windows\System\xMbNOBk.exe
  2⤵
  PID:10072
- C:\Windows\System\zvwhhCb.exe
  C:\Windows\System\zvwhhCb.exe
  2⤵
  PID:10100
- C:\Windows\System\etdhYpn.exe
  C:\Windows\System\etdhYpn.exe
  2⤵
  PID:10128
- C:\Windows\System\GErtZOy.exe
  C:\Windows\System\GErtZOy.exe
  2⤵
  PID:10152
- C:\Windows\System\LCDqRDO.exe
  C:\Windows\System\LCDqRDO.exe
  2⤵
  PID:10184
- C:\Windows\System\fQpBdzv.exe
  C:\Windows\System\fQpBdzv.exe
  2⤵
  PID:10212
- C:\Windows\System\VmRyijO.exe
  C:\Windows\System\VmRyijO.exe
  2⤵
  PID:10236
- C:\Windows\System\uAOTjAN.exe
  C:\Windows\System\uAOTjAN.exe
  2⤵
  PID:7260
- C:\Windows\System\sXgmXPu.exe
  C:\Windows\System\sXgmXPu.exe
  2⤵
  PID:8492
- C:\Windows\System\PgkifnL.exe
  C:\Windows\System\PgkifnL.exe
  2⤵
  PID:7296
- C:\Windows\System\OaLLIwx.exe
  C:\Windows\System\OaLLIwx.exe
  2⤵
  PID:9004
- C:\Windows\System\XDPfOio.exe
  C:\Windows\System\XDPfOio.exe
  2⤵
  PID:8716
- C:\Windows\System\moqbNiA.exe
  C:\Windows\System\moqbNiA.exe
  2⤵
  PID:9280
- C:\Windows\System\mWILwfI.exe
  C:\Windows\System\mWILwfI.exe
  2⤵
  PID:8844
- C:\Windows\System\JjHNalk.exe
  C:\Windows\System\JjHNalk.exe
  2⤵
  PID:8792
- C:\Windows\System\AdqTNmJ.exe
  C:\Windows\System\AdqTNmJ.exe
  2⤵
  PID:9432
- C:\Windows\System\VLPiKZZ.exe
  C:\Windows\System\VLPiKZZ.exe
  2⤵
  PID:9496
- C:\Windows\System\pSgwSBk.exe
  C:\Windows\System\pSgwSBk.exe
  2⤵
  PID:8964
- C:\Windows\System\UKUVCHZ.exe
  C:\Windows\System\UKUVCHZ.exe
  2⤵
  PID:9664
- C:\Windows\System\yXEetji.exe
  C:\Windows\System\yXEetji.exe
  2⤵
  PID:9720
- C:\Windows\System\yPgWHOS.exe
  C:\Windows\System\yPgWHOS.exe
  2⤵
  PID:9752
- C:\Windows\System\sgjxtMT.exe
  C:\Windows\System\sgjxtMT.exe
  2⤵
  PID:9808
- C:\Windows\System\OBuQpup.exe
  C:\Windows\System\OBuQpup.exe
  2⤵
  PID:9480
- C:\Windows\System\tHYJcSC.exe
  C:\Windows\System\tHYJcSC.exe
  2⤵
  PID:9892
- C:\Windows\System\lUIQBtM.exe
  C:\Windows\System\lUIQBtM.exe
  2⤵
  PID:9644
- C:\Windows\System\VuTKCJu.exe
  C:\Windows\System\VuTKCJu.exe
  2⤵
  PID:10012
- C:\Windows\System\ClZoWVO.exe
  C:\Windows\System\ClZoWVO.exe
  2⤵
  PID:10092
- C:\Windows\System\lcaPuMh.exe
  C:\Windows\System\lcaPuMh.exe
  2⤵
  PID:10144
- C:\Windows\System\YSmvROj.exe
  C:\Windows\System\YSmvROj.exe
  2⤵
  PID:8480
- C:\Windows\System\qIuqNAV.exe
  C:\Windows\System\qIuqNAV.exe
  2⤵
  PID:9920
- C:\Windows\System\kGVspiD.exe
  C:\Windows\System\kGVspiD.exe
  2⤵
  PID:8744
- C:\Windows\System\KFuUjkQ.exe
  C:\Windows\System\KFuUjkQ.exe
  2⤵
  PID:10248
- C:\Windows\System\gjbUUxU.exe
  C:\Windows\System\gjbUUxU.exe
  2⤵
  PID:10272
- C:\Windows\System\oMKYILb.exe
  C:\Windows\System\oMKYILb.exe
  2⤵
  PID:10296
- C:\Windows\System\dQNkyos.exe
  C:\Windows\System\dQNkyos.exe
  2⤵
  PID:10320
- C:\Windows\System\cTPKFMs.exe
  C:\Windows\System\cTPKFMs.exe
  2⤵
  PID:10344
- C:\Windows\System\siMTVcl.exe
  C:\Windows\System\siMTVcl.exe
  2⤵
  PID:10368
- C:\Windows\System\UGvTdXY.exe
  C:\Windows\System\UGvTdXY.exe
  2⤵
  PID:10396
- C:\Windows\System\llAhsli.exe
  C:\Windows\System\llAhsli.exe
  2⤵
  PID:10420
- C:\Windows\System\iGQsBKV.exe
  C:\Windows\System\iGQsBKV.exe
  2⤵
  PID:10444
- C:\Windows\System\nHMCXoh.exe
  C:\Windows\System\nHMCXoh.exe
  2⤵
  PID:10472
- C:\Windows\System\oQgDspV.exe
  C:\Windows\System\oQgDspV.exe
  2⤵
  PID:10500
- C:\Windows\System\VFPHWCR.exe
  C:\Windows\System\VFPHWCR.exe
  2⤵
  PID:10520
- C:\Windows\System\bxkGDEe.exe
  C:\Windows\System\bxkGDEe.exe
  2⤵
  PID:10552
- C:\Windows\System\DWuaJeH.exe
  C:\Windows\System\DWuaJeH.exe
  2⤵
  PID:10580
- C:\Windows\System\NRqpYKm.exe
  C:\Windows\System\NRqpYKm.exe
  2⤵
  PID:10604
- C:\Windows\System\uixiSJq.exe
  C:\Windows\System\uixiSJq.exe
  2⤵
  PID:10620
- C:\Windows\System\nJTImvu.exe
  C:\Windows\System\nJTImvu.exe
  2⤵
  PID:10640
- C:\Windows\System\QxEHHOk.exe
  C:\Windows\System\QxEHHOk.exe
  2⤵
  PID:10660
- C:\Windows\System\mgdCCPa.exe
  C:\Windows\System\mgdCCPa.exe
  2⤵
  PID:10676
- C:\Windows\System\DqMmROi.exe
  C:\Windows\System\DqMmROi.exe
  2⤵
  PID:10696
- C:\Windows\System\OjlPrYO.exe
  C:\Windows\System\OjlPrYO.exe
  2⤵
  PID:10728
- C:\Windows\System\wIRBQEL.exe
  C:\Windows\System\wIRBQEL.exe
  2⤵
  PID:10748
- C:\Windows\System\CKtIFOK.exe
  C:\Windows\System\CKtIFOK.exe
  2⤵
  PID:10772
- C:\Windows\System\ximQZyQ.exe
  C:\Windows\System\ximQZyQ.exe
  2⤵
  PID:10804
- C:\Windows\System\gWdFGhk.exe
  C:\Windows\System\gWdFGhk.exe
  2⤵
  PID:10828
- C:\Windows\System\QtdUNWL.exe
  C:\Windows\System\QtdUNWL.exe
  2⤵
  PID:10856
- C:\Windows\System\StxkNgZ.exe
  C:\Windows\System\StxkNgZ.exe
  2⤵
  PID:10884
- C:\Windows\System\hyKsZRr.exe
  C:\Windows\System\hyKsZRr.exe
  2⤵
  PID:10904
- C:\Windows\System\vjWtthr.exe
  C:\Windows\System\vjWtthr.exe
  2⤵
  PID:10936
- C:\Windows\System\ElxMZvD.exe
  C:\Windows\System\ElxMZvD.exe
  2⤵
  PID:10956
- C:\Windows\System\PdWnsBn.exe
  C:\Windows\System\PdWnsBn.exe
  2⤵
  PID:10984
- C:\Windows\System\dVbVRic.exe
  C:\Windows\System\dVbVRic.exe
  2⤵
  PID:11004
- C:\Windows\System\NOzrVkb.exe
  C:\Windows\System\NOzrVkb.exe
  2⤵
  PID:11028
- C:\Windows\System\zdOsWFs.exe
  C:\Windows\System\zdOsWFs.exe
  2⤵
  PID:11044
- C:\Windows\System\VdEFdHB.exe
  C:\Windows\System\VdEFdHB.exe
  2⤵
  PID:11072
- C:\Windows\System\FMlfhWS.exe
  C:\Windows\System\FMlfhWS.exe
  2⤵
  PID:11096
- C:\Windows\System\noFfnJM.exe
  C:\Windows\System\noFfnJM.exe
  2⤵
  PID:11120
- C:\Windows\System\vIsoFAO.exe
  C:\Windows\System\vIsoFAO.exe
  2⤵
  PID:11144
- C:\Windows\System\lVEoUeo.exe
  C:\Windows\System\lVEoUeo.exe
  2⤵
  PID:11160
- C:\Windows\System\ZquhSYe.exe
  C:\Windows\System\ZquhSYe.exe
  2⤵
  PID:11192
- C:\Windows\System\JwVsMvB.exe
  C:\Windows\System\JwVsMvB.exe
  2⤵
  PID:11220
- C:\Windows\System\blozQbk.exe
  C:\Windows\System\blozQbk.exe
  2⤵
  PID:11244
- C:\Windows\System\VvPZSBT.exe
  C:\Windows\System\VvPZSBT.exe
  2⤵
  PID:9992
- C:\Windows\System\UorSYmo.exe
  C:\Windows\System\UorSYmo.exe
  2⤵
  PID:9776
- C:\Windows\System\AFMcQyz.exe
  C:\Windows\System\AFMcQyz.exe
  2⤵
  PID:9652
- C:\Windows\System\oVqPSVl.exe
  C:\Windows\System\oVqPSVl.exe
  2⤵
  PID:9740
- C:\Windows\System\aHiBhwv.exe
  C:\Windows\System\aHiBhwv.exe
  2⤵
  PID:8992
- C:\Windows\System\ZVQmRYh.exe
  C:\Windows\System\ZVQmRYh.exe
  2⤵
  PID:9788
- C:\Windows\System\arhZJnU.exe
  C:\Windows\System\arhZJnU.exe
  2⤵
  PID:9916
- C:\Windows\System\gXVWDZt.exe
  C:\Windows\System\gXVWDZt.exe
  2⤵
  PID:9240
- C:\Windows\System\ffQQuor.exe
  C:\Windows\System\ffQQuor.exe
  2⤵
  PID:10316
- C:\Windows\System\OSfZcDA.exe
  C:\Windows\System\OSfZcDA.exe
  2⤵
  PID:9356
- C:\Windows\System\bFJJmmD.exe
  C:\Windows\System\bFJJmmD.exe
  2⤵
  PID:10496
- C:\Windows\System\fhjDvmF.exe
  C:\Windows\System\fhjDvmF.exe
  2⤵
  PID:8924
- C:\Windows\System\alUfDBH.exe
  C:\Windows\System\alUfDBH.exe
  2⤵
  PID:10656
- C:\Windows\System\laKxDLP.exe
  C:\Windows\System\laKxDLP.exe
  2⤵
  PID:9976
- C:\Windows\System\ZIOhiJz.exe
  C:\Windows\System\ZIOhiJz.exe
  2⤵
  PID:10844
- C:\Windows\System\ayMYgvQ.exe
  C:\Windows\System\ayMYgvQ.exe
  2⤵
  PID:9448
- C:\Windows\System\KohtaXt.exe
  C:\Windows\System\KohtaXt.exe
  2⤵
  PID:10380
- C:\Windows\System\bacwOJn.exe
  C:\Windows\System\bacwOJn.exe
  2⤵
  PID:11024
- C:\Windows\System\axuWZtU.exe
  C:\Windows\System\axuWZtU.exe
  2⤵
  PID:9936
- C:\Windows\System\zLqaoEl.exe
  C:\Windows\System\zLqaoEl.exe
  2⤵
  PID:10948
- C:\Windows\System\wbyYJmO.exe
  C:\Windows\System\wbyYJmO.exe
  2⤵
  PID:10588
- C:\Windows\System\xrOzuwF.exe
  C:\Windows\System\xrOzuwF.exe
  2⤵
  PID:11020
- C:\Windows\System\aWnPRah.exe
  C:\Windows\System\aWnPRah.exe
  2⤵
  PID:11188
- C:\Windows\System\lYvTkJu.exe
  C:\Windows\System\lYvTkJu.exe
  2⤵
  PID:11208
- C:\Windows\System\VmvIMZY.exe
  C:\Windows\System\VmvIMZY.exe
  2⤵
  PID:10712
- C:\Windows\System\pOYxqQx.exe
  C:\Windows\System\pOYxqQx.exe
  2⤵
  PID:11280
- C:\Windows\System\CBQPZRa.exe
  C:\Windows\System\CBQPZRa.exe
  2⤵
  PID:11300
- C:\Windows\System\aydAcpC.exe
  C:\Windows\System\aydAcpC.exe
  2⤵
  PID:11324
- C:\Windows\System\igoMBrp.exe
  C:\Windows\System\igoMBrp.exe
  2⤵
  PID:11352
- C:\Windows\System\koHQTQI.exe
  C:\Windows\System\koHQTQI.exe
  2⤵
  PID:11384
- C:\Windows\System\wiVSTLh.exe
  C:\Windows\System\wiVSTLh.exe
  2⤵
  PID:11416
- C:\Windows\System\PzrGKuc.exe
  C:\Windows\System\PzrGKuc.exe
  2⤵
  PID:11436
- C:\Windows\System\uhiHtOR.exe
  C:\Windows\System\uhiHtOR.exe
  2⤵
  PID:11476
- C:\Windows\System\zLSvXGe.exe
  C:\Windows\System\zLSvXGe.exe
  2⤵
  PID:11504
- C:\Windows\System\DOqLIcb.exe
  C:\Windows\System\DOqLIcb.exe
  2⤵
  PID:11528
- C:\Windows\System\dwBHQTj.exe
  C:\Windows\System\dwBHQTj.exe
  2⤵
  PID:11560
- C:\Windows\System\XHwqMvv.exe
  C:\Windows\System\XHwqMvv.exe
  2⤵
  PID:11580
- C:\Windows\System\iFBpHuf.exe
  C:\Windows\System\iFBpHuf.exe
  2⤵
  PID:11604
- C:\Windows\System\zWzRpfT.exe
  C:\Windows\System\zWzRpfT.exe
  2⤵
  PID:11640
- C:\Windows\System\pYvvwzn.exe
  C:\Windows\System\pYvvwzn.exe
  2⤵
  PID:11660
- C:\Windows\System\LsWruSH.exe
  C:\Windows\System\LsWruSH.exe
  2⤵
  PID:11680
- C:\Windows\System\wAzJhRe.exe
  C:\Windows\System\wAzJhRe.exe
  2⤵
  PID:11708
- C:\Windows\System\IucYHBH.exe
  C:\Windows\System\IucYHBH.exe
  2⤵
  PID:11748
- C:\Windows\System\GYdNXzE.exe
  C:\Windows\System\GYdNXzE.exe
  2⤵
  PID:11768
- C:\Windows\System\jbwakwJ.exe
  C:\Windows\System\jbwakwJ.exe
  2⤵
  PID:11800
- C:\Windows\System\yiTtzrU.exe
  C:\Windows\System\yiTtzrU.exe
  2⤵
  PID:11824
- C:\Windows\System\HYSyYWI.exe
  C:\Windows\System\HYSyYWI.exe
  2⤵
  PID:11848
- C:\Windows\System\ucUimez.exe
  C:\Windows\System\ucUimez.exe
  2⤵
  PID:11864
- C:\Windows\System\YAeAmJo.exe
  C:\Windows\System\YAeAmJo.exe
  2⤵
  PID:11888
- C:\Windows\System\SYatdWw.exe
  C:\Windows\System\SYatdWw.exe
  2⤵
  PID:11908
- C:\Windows\System\ffksfnF.exe
  C:\Windows\System\ffksfnF.exe
  2⤵
  PID:11936
- C:\Windows\System\jkvZJrk.exe
  C:\Windows\System\jkvZJrk.exe
  2⤵
  PID:11956
- C:\Windows\System\eWWobXF.exe
  C:\Windows\System\eWWobXF.exe
  2⤵
  PID:11976
- C:\Windows\System\CYEqMun.exe
  C:\Windows\System\CYEqMun.exe
  2⤵
  PID:12000
- C:\Windows\System\mlgAuty.exe
  C:\Windows\System\mlgAuty.exe
  2⤵
  PID:12032
- C:\Windows\System\rZAHGxc.exe
  C:\Windows\System\rZAHGxc.exe
  2⤵
  PID:12056
- C:\Windows\System\VmfQIRV.exe
  C:\Windows\System\VmfQIRV.exe
  2⤵
  PID:12080
- C:\Windows\System\DFJyQGQ.exe
  C:\Windows\System\DFJyQGQ.exe
  2⤵
  PID:12096
- C:\Windows\System\PzxKhpK.exe
  C:\Windows\System\PzxKhpK.exe
  2⤵
  PID:12128
- C:\Windows\System\kLBcObA.exe
  C:\Windows\System\kLBcObA.exe
  2⤵
  PID:12152
- C:\Windows\System\jPISVQM.exe
  C:\Windows\System\jPISVQM.exe
  2⤵
  PID:12176
- C:\Windows\System\GdjPoDm.exe
  C:\Windows\System\GdjPoDm.exe
  2⤵
  PID:12208
- C:\Windows\System\ABwDGOM.exe
  C:\Windows\System\ABwDGOM.exe
  2⤵
  PID:12236
- C:\Windows\System\MnOdxPE.exe
  C:\Windows\System\MnOdxPE.exe
  2⤵
  PID:12260
- C:\Windows\System\UupXFQo.exe
  C:\Windows\System\UupXFQo.exe
  2⤵
  PID:12280
- C:\Windows\System\azkTaIU.exe
  C:\Windows\System\azkTaIU.exe
  2⤵
  PID:10760
- C:\Windows\System\axnSxvS.exe
  C:\Windows\System\axnSxvS.exe
  2⤵
  PID:8772
- C:\Windows\System\KDeNBHJ.exe
  C:\Windows\System\KDeNBHJ.exe
  2⤵
  PID:10224
- C:\Windows\System\mAtRrgh.exe
  C:\Windows\System\mAtRrgh.exe
  2⤵
  PID:10968
- C:\Windows\System\mWwHEMT.exe
  C:\Windows\System\mWwHEMT.exe
  2⤵
  PID:10812
- C:\Windows\System\UbBhuPb.exe
  C:\Windows\System\UbBhuPb.exe
  2⤵
  PID:10332
- C:\Windows\System\wKmnsLC.exe
  C:\Windows\System\wKmnsLC.exe
  2⤵
  PID:9376
- C:\Windows\System\zjnpTsi.exe
  C:\Windows\System\zjnpTsi.exe
  2⤵
  PID:9880
- C:\Windows\System\QSunriW.exe
  C:\Windows\System\QSunriW.exe
  2⤵
  PID:11340
- C:\Windows\System\muUsoqE.exe
  C:\Windows\System\muUsoqE.exe
  2⤵
  PID:9972
- C:\Windows\System\zoAidwL.exe
  C:\Windows\System\zoAidwL.exe
  2⤵
  PID:10720
- C:\Windows\System\GPOSrUJ.exe
  C:\Windows\System\GPOSrUJ.exe
  2⤵
  PID:10512
- C:\Windows\System\AKEvYaS.exe
  C:\Windows\System\AKEvYaS.exe
  2⤵
  PID:11600
- C:\Windows\System\QWScxjD.exe
  C:\Windows\System\QWScxjD.exe
  2⤵
  PID:11668
- C:\Windows\System\wvirTeg.exe
  C:\Windows\System\wvirTeg.exe
  2⤵
  PID:11856
- C:\Windows\System\AQhfpbd.exe
  C:\Windows\System\AQhfpbd.exe
  2⤵
  PID:11876
- C:\Windows\System\vUOjDVG.exe
  C:\Windows\System\vUOjDVG.exe
  2⤵
  PID:11336
- C:\Windows\System\phmwnvb.exe
  C:\Windows\System\phmwnvb.exe
  2⤵
  PID:12024
- C:\Windows\System\yeykRKN.exe
  C:\Windows\System\yeykRKN.exe
  2⤵
  PID:12192
- C:\Windows\System\eKegmzF.exe
  C:\Windows\System\eKegmzF.exe
  2⤵
  PID:11652
- C:\Windows\System\oouqCSc.exe
  C:\Windows\System\oouqCSc.exe
  2⤵
  PID:9068
- C:\Windows\System\OwEsRvJ.exe
  C:\Windows\System\OwEsRvJ.exe
  2⤵
  PID:12296
- C:\Windows\System\cvyTsJt.exe
  C:\Windows\System\cvyTsJt.exe
  2⤵
  PID:12324
- C:\Windows\System\HmoTXsK.exe
  C:\Windows\System\HmoTXsK.exe
  2⤵
  PID:12348
- C:\Windows\System\GpJMDQc.exe
  C:\Windows\System\GpJMDQc.exe
  2⤵
  PID:12368
- C:\Windows\System\aOYsMEh.exe
  C:\Windows\System\aOYsMEh.exe
  2⤵
  PID:12396
- C:\Windows\System\ETfnEMd.exe
  C:\Windows\System\ETfnEMd.exe
  2⤵
  PID:12424
- C:\Windows\System\greTKLo.exe
  C:\Windows\System\greTKLo.exe
  2⤵
  PID:12452
- C:\Windows\System\gXRiKPX.exe
  C:\Windows\System\gXRiKPX.exe
  2⤵
  PID:12472
- C:\Windows\System\bQCexzP.exe
  C:\Windows\System\bQCexzP.exe
  2⤵
  PID:12492
- C:\Windows\System\ZxYthOA.exe
  C:\Windows\System\ZxYthOA.exe
  2⤵
  PID:12512
- C:\Windows\System\amIUSki.exe
  C:\Windows\System\amIUSki.exe
  2⤵
  PID:12544
- C:\Windows\System\YXVhOta.exe
  C:\Windows\System\YXVhOta.exe
  2⤵
  PID:12564
- C:\Windows\System\IjvpFiF.exe
  C:\Windows\System\IjvpFiF.exe
  2⤵
  PID:12592
- C:\Windows\System\Tezikiu.exe
  C:\Windows\System\Tezikiu.exe
  2⤵
  PID:12620
- C:\Windows\System\MbPZaDl.exe
  C:\Windows\System\MbPZaDl.exe
  2⤵
  PID:12640
- C:\Windows\System\MPgwLRR.exe
  C:\Windows\System\MPgwLRR.exe
  2⤵
  PID:12668
- C:\Windows\System\GkLpZPX.exe
  C:\Windows\System\GkLpZPX.exe
  2⤵
  PID:12688
- C:\Windows\System\QDOUldC.exe
  C:\Windows\System\QDOUldC.exe
  2⤵
  PID:12716
- C:\Windows\System\uYabjqB.exe
  C:\Windows\System\uYabjqB.exe
  2⤵
  PID:12744
- C:\Windows\System\QszPPkd.exe
  C:\Windows\System\QszPPkd.exe
  2⤵
  PID:12768
- C:\Windows\System\jprdagB.exe
  C:\Windows\System\jprdagB.exe
  2⤵
  PID:12788
- C:\Windows\System\oCCaUNb.exe
  C:\Windows\System\oCCaUNb.exe
  2⤵
  PID:12812
- C:\Windows\System\wxEXxmn.exe
  C:\Windows\System\wxEXxmn.exe
  2⤵
  PID:12836
- C:\Windows\System\MtmGcqp.exe
  C:\Windows\System\MtmGcqp.exe
  2⤵
  PID:12860
- C:\Windows\System\vjfqZqT.exe
  C:\Windows\System\vjfqZqT.exe
  2⤵
  PID:12876
- C:\Windows\System\lTiYTgU.exe
  C:\Windows\System\lTiYTgU.exe
  2⤵
  PID:12900
- C:\Windows\System\jSuxLfM.exe
  C:\Windows\System\jSuxLfM.exe
  2⤵
  PID:12936
- C:\Windows\System\qXYpoLW.exe
  C:\Windows\System\qXYpoLW.exe
  2⤵
  PID:12960
- C:\Windows\System\BOkrpGr.exe
  C:\Windows\System\BOkrpGr.exe
  2⤵
  PID:12984
- C:\Windows\System\qTCbnak.exe
  C:\Windows\System\qTCbnak.exe
  2⤵
  PID:13004
- C:\Windows\System\uYycvwK.exe
  C:\Windows\System\uYycvwK.exe
  2⤵
  PID:13028
- C:\Windows\System\NuEvOXy.exe
  C:\Windows\System\NuEvOXy.exe
  2⤵
  PID:13056
- C:\Windows\System\QVmUIKn.exe
  C:\Windows\System\QVmUIKn.exe
  2⤵
  PID:13076
- C:\Windows\System\wsoeZiJ.exe
  C:\Windows\System\wsoeZiJ.exe
  2⤵
  PID:13108
- C:\Windows\System\XfFMrhF.exe
  C:\Windows\System\XfFMrhF.exe
  2⤵
  PID:13132
- C:\Windows\System\lmlQIZF.exe
  C:\Windows\System\lmlQIZF.exe
  2⤵
  PID:13160
- C:\Windows\System\fSsuSaR.exe
  C:\Windows\System\fSsuSaR.exe
  2⤵
  PID:13184
- C:\Windows\System\MXbztKN.exe
  C:\Windows\System\MXbztKN.exe
  2⤵
  PID:13224
- C:\Windows\System\NuESQhX.exe
  C:\Windows\System\NuESQhX.exe
  2⤵
  PID:13248
- C:\Windows\System\NrylfwD.exe
  C:\Windows\System\NrylfwD.exe
  2⤵
  PID:13276
- C:\Windows\System\KDcgBPS.exe
  C:\Windows\System\KDcgBPS.exe
  2⤵
  PID:13296
- C:\Windows\System\GbGzqNc.exe
  C:\Windows\System\GbGzqNc.exe
  2⤵
  PID:11788
- C:\Windows\System\NsmKMJB.exe
  C:\Windows\System\NsmKMJB.exe
  2⤵
  PID:11840
- C:\Windows\System\vTFSWws.exe
  C:\Windows\System\vTFSWws.exe
  2⤵
  PID:11784
- C:\Windows\System\KqdoCBm.exe
  C:\Windows\System\KqdoCBm.exe
  2⤵
  PID:11272
- C:\Windows\System\vhMqOMT.exe
  C:\Windows\System\vhMqOMT.exe
  2⤵
  PID:10268
- C:\Windows\System\KyArMHd.exe
  C:\Windows\System\KyArMHd.exe
  2⤵
  PID:11948
- C:\Windows\System\cNawSFV.exe
  C:\Windows\System\cNawSFV.exe
  2⤵
  PID:12052
- C:\Windows\System\dHKYlHL.exe
  C:\Windows\System\dHKYlHL.exe
  2⤵
  PID:11512
- C:\Windows\System\WAqrQiL.exe
  C:\Windows\System\WAqrQiL.exe
  2⤵
  PID:12140
- C:\Windows\System\BmsmWIj.exe
  C:\Windows\System\BmsmWIj.exe
  2⤵
  PID:12168
- C:\Windows\System\CYGcnfy.exe
  C:\Windows\System\CYGcnfy.exe
  2⤵
  PID:11648
- C:\Windows\System\yXqTJUK.exe
  C:\Windows\System\yXqTJUK.exe
  2⤵
  PID:10140
- C:\Windows\System\DtpKUCo.exe
  C:\Windows\System\DtpKUCo.exe
  2⤵
  PID:12292
- C:\Windows\System\PtcMtsD.exe
  C:\Windows\System\PtcMtsD.exe
  2⤵
  PID:12356
- C:\Windows\System\eVNEaJt.exe
  C:\Windows\System\eVNEaJt.exe
  2⤵
  PID:12448
- C:\Windows\System\fSywqNB.exe
  C:\Windows\System\fSywqNB.exe
  2⤵
  PID:12504
- C:\Windows\System\ELAfZim.exe
  C:\Windows\System\ELAfZim.exe
  2⤵
  PID:12608
- C:\Windows\System\tUpCHTG.exe
  C:\Windows\System\tUpCHTG.exe
  2⤵
  PID:12712
- C:\Windows\System\HreYuDI.exe
  C:\Windows\System\HreYuDI.exe
  2⤵
  PID:12092
- C:\Windows\System\iHPjRbg.exe
  C:\Windows\System\iHPjRbg.exe
  2⤵
  PID:12856
- C:\Windows\System\kLErLvx.exe
  C:\Windows\System\kLErLvx.exe
  2⤵
  PID:12924
- C:\Windows\System\vHGLBgL.exe
  C:\Windows\System\vHGLBgL.exe
  2⤵
  PID:13316
- C:\Windows\System\AfFNatY.exe
  C:\Windows\System\AfFNatY.exe
  2⤵
  PID:13340
- C:\Windows\System\RWGTDLH.exe
  C:\Windows\System\RWGTDLH.exe
  2⤵
  PID:13372
- C:\Windows\System\gigqjgp.exe
  C:\Windows\System\gigqjgp.exe
  2⤵
  PID:13400
- C:\Windows\System\vSCTeAM.exe
  C:\Windows\System\vSCTeAM.exe
  2⤵
  PID:13416
- C:\Windows\System\VxScKqO.exe
  C:\Windows\System\VxScKqO.exe
  2⤵
  PID:13448
- C:\Windows\System\TSbOvEc.exe
  C:\Windows\System\TSbOvEc.exe
  2⤵
  PID:13480
- C:\Windows\System\mSdwKuo.exe
  C:\Windows\System\mSdwKuo.exe
  2⤵
  PID:13500
- C:\Windows\System\SzpwBem.exe
  C:\Windows\System\SzpwBem.exe
  2⤵
  PID:13516
- C:\Windows\System\ONdssge.exe
  C:\Windows\System\ONdssge.exe
  2⤵
  PID:13536
- C:\Windows\System\trcsuio.exe
  C:\Windows\System\trcsuio.exe
  2⤵
  PID:13552
- C:\Windows\System\IPcprGE.exe
  C:\Windows\System\IPcprGE.exe
  2⤵
  PID:13580
- C:\Windows\System\AdkxfDI.exe
  C:\Windows\System\AdkxfDI.exe
  2⤵
  PID:13608
- C:\Windows\System\xroOuHl.exe
  C:\Windows\System\xroOuHl.exe
  2⤵
  PID:13628
- C:\Windows\System\LaTbaVL.exe
  C:\Windows\System\LaTbaVL.exe
  2⤵
  PID:13656
- C:\Windows\System\cRXHdxw.exe
  C:\Windows\System\cRXHdxw.exe
  2⤵
  PID:13684
- C:\Windows\System\CIXepOr.exe
  C:\Windows\System\CIXepOr.exe
  2⤵
  PID:13704
- C:\Windows\System\vURjDoc.exe
  C:\Windows\System\vURjDoc.exe
  2⤵
  PID:13728
- C:\Windows\System\hXsWXmF.exe
  C:\Windows\System\hXsWXmF.exe
  2⤵
  PID:13752
- C:\Windows\System\tsjoRct.exe
  C:\Windows\System\tsjoRct.exe
  2⤵
  PID:13780
- C:\Windows\System\PSdkWPT.exe
  C:\Windows\System\PSdkWPT.exe
  2⤵
  PID:13804
- C:\Windows\System\QoPafdq.exe
  C:\Windows\System\QoPafdq.exe
  2⤵
  PID:13820
- C:\Windows\System\IPMThwL.exe
  C:\Windows\System\IPMThwL.exe
  2⤵
  PID:13840
- C:\Windows\System\WNfyOSJ.exe
  C:\Windows\System\WNfyOSJ.exe
  2⤵
  PID:13868
- C:\Windows\System\YQppYSM.exe
  C:\Windows\System\YQppYSM.exe
  2⤵
  PID:13884
- C:\Windows\System\tcowJib.exe
  C:\Windows\System\tcowJib.exe
  2⤵
  PID:13912
- C:\Windows\System\tzqTOxt.exe
  C:\Windows\System\tzqTOxt.exe
  2⤵
  PID:13932
- C:\Windows\System\VIbBbDF.exe
  C:\Windows\System\VIbBbDF.exe
  2⤵
  PID:13952
- C:\Windows\System\kzpaTDJ.exe
  C:\Windows\System\kzpaTDJ.exe
  2⤵
  PID:13980
- C:\Windows\System\mTuXbPU.exe
  C:\Windows\System\mTuXbPU.exe
  2⤵
  PID:13996
- C:\Windows\System\oRzWmSK.exe
  C:\Windows\System\oRzWmSK.exe
  2⤵
  PID:14012
- C:\Windows\System\wkuwaYr.exe
  C:\Windows\System\wkuwaYr.exe
  2⤵
  PID:14028
- C:\Windows\System\NjfeMPt.exe
  C:\Windows\System\NjfeMPt.exe
  2⤵
  PID:14048
- C:\Windows\System\OPygkpq.exe
  C:\Windows\System\OPygkpq.exe
  2⤵
  PID:14076
- C:\Windows\System\pHYmxNG.exe
  C:\Windows\System\pHYmxNG.exe
  2⤵
  PID:14100
- C:\Windows\System\HeqGwFP.exe
  C:\Windows\System\HeqGwFP.exe
  2⤵
  PID:14124
- C:\Windows\System\uedoCGl.exe
  C:\Windows\System\uedoCGl.exe
  2⤵
  PID:14156
- C:\Windows\System\bZuEyDY.exe
  C:\Windows\System\bZuEyDY.exe
  2⤵
  PID:14188
- C:\Windows\System\WTCBTRZ.exe
  C:\Windows\System\WTCBTRZ.exe
  2⤵
  PID:14208
- C:\Windows\System\vEdXCIt.exe
  C:\Windows\System\vEdXCIt.exe
  2⤵
  PID:14236
- C:\Windows\System\aXlwoqY.exe
  C:\Windows\System\aXlwoqY.exe
  2⤵
  PID:14256
- C:\Windows\System\icYYVdN.exe
  C:\Windows\System\icYYVdN.exe
  2⤵
  PID:14276
- C:\Windows\System\rrcTfEy.exe
  C:\Windows\System\rrcTfEy.exe
  2⤵
  PID:14296
- C:\Windows\System\GWqYGkI.exe
  C:\Windows\System\GWqYGkI.exe
  2⤵
  PID:14312
- C:\Windows\System\nBpESmn.exe
  C:\Windows\System\nBpESmn.exe
  2⤵
  PID:11688
- C:\Windows\System\PsrgDsG.exe
  C:\Windows\System\PsrgDsG.exe
  2⤵
  PID:13124
- C:\Windows\System\wlmmOQD.exe
  C:\Windows\System\wlmmOQD.exe
  2⤵
  PID:13172
- C:\Windows\System\llVcNcx.exe
  C:\Windows\System\llVcNcx.exe
  2⤵
  PID:13240
- C:\Windows\System\tOELqyc.exe
  C:\Windows\System\tOELqyc.exe
  2⤵
  PID:12528
- C:\Windows\System\YEeeofc.exe
  C:\Windows\System\YEeeofc.exe
  2⤵
  PID:12616
- C:\Windows\System\KNbIqBb.exe
  C:\Windows\System\KNbIqBb.exe
  2⤵
  PID:12636
- C:\Windows\System\lZAMsax.exe
  C:\Windows\System\lZAMsax.exe
  2⤵
  PID:12676
- C:\Windows\System\IwUPWKH.exe
  C:\Windows\System\IwUPWKH.exe
  2⤵
  PID:11568
- C:\Windows\System\UneepYB.exe
  C:\Windows\System\UneepYB.exe
  2⤵
  PID:12828
- C:\Windows\System\fimbhql.exe
  C:\Windows\System\fimbhql.exe
  2⤵
  PID:11996
- C:\Windows\System\yiipJyv.exe
  C:\Windows\System\yiipJyv.exe
  2⤵
  PID:13044
- C:\Windows\System\TZbnlWr.exe
  C:\Windows\System\TZbnlWr.exe
  2⤵
  PID:13412
- C:\Windows\System\FDglLSZ.exe
  C:\Windows\System\FDglLSZ.exe
  2⤵
  PID:12404
- C:\Windows\System\eGKjFhS.exe
  C:\Windows\System\eGKjFhS.exe
  2⤵
  PID:12440
- C:\Windows\System\FuQbjPf.exe
  C:\Windows\System\FuQbjPf.exe
  2⤵
  PID:13600
- C:\Windows\System\yfDduVb.exe
  C:\Windows\System\yfDduVb.exe
  2⤵
  PID:12460
- C:\Windows\System\jgeTnVp.exe
  C:\Windows\System\jgeTnVp.exe
  2⤵
  PID:13664
- C:\Windows\System\IRASGfd.exe
  C:\Windows\System\IRASGfd.exe
  2⤵
  PID:13748
- C:\Windows\System\asZJjXP.exe
  C:\Windows\System\asZJjXP.exe
  2⤵
  PID:11896
- C:\Windows\System\UtQUdDr.exe
  C:\Windows\System\UtQUdDr.exe
  2⤵
  PID:12732
- C:\Windows\System\xeqNiRA.exe
  C:\Windows\System\xeqNiRA.exe
  2⤵
  PID:13904
- C:\Windows\System\cCcEqeE.exe
  C:\Windows\System\cCcEqeE.exe
  2⤵
  PID:14352
- C:\Windows\System\yMwyaPF.exe
  C:\Windows\System\yMwyaPF.exe
  2⤵
  PID:14380
- C:\Windows\System\lZETQtz.exe
  C:\Windows\System\lZETQtz.exe
  2⤵
  PID:14412
- C:\Windows\System\BGfjDwS.exe
  C:\Windows\System\BGfjDwS.exe
  2⤵
  PID:14432
- C:\Windows\System\OFwnplg.exe
  C:\Windows\System\OFwnplg.exe
  2⤵
  PID:14456
- C:\Windows\System\DRPzdEk.exe
  C:\Windows\System\DRPzdEk.exe
  2⤵
  PID:14480
- C:\Windows\System\fQwDqET.exe
  C:\Windows\System\fQwDqET.exe
  2⤵
  PID:14508
- C:\Windows\System\KSovaOu.exe
  C:\Windows\System\KSovaOu.exe
  2⤵
  PID:14536
- C:\Windows\System\qbvwEdE.exe
  C:\Windows\System\qbvwEdE.exe
  2⤵
  PID:14556
- C:\Windows\System\REHpZst.exe
  C:\Windows\System\REHpZst.exe
  2⤵
  PID:14584
- C:\Windows\System\jwupLXO.exe
  C:\Windows\System\jwupLXO.exe
  2⤵
  PID:14604
- C:\Windows\System\mZNAIYn.exe
  C:\Windows\System\mZNAIYn.exe
  2⤵
  PID:14624
- C:\Windows\System\EVFVWUG.exe
  C:\Windows\System\EVFVWUG.exe
  2⤵
  PID:14660
- C:\Windows\System\dCXnByJ.exe
  C:\Windows\System\dCXnByJ.exe
  2⤵
  PID:14676
- C:\Windows\System\mqQNGIf.exe
  C:\Windows\System\mqQNGIf.exe
  2⤵
  PID:14700
- C:\Windows\System\IBBTfRj.exe
  C:\Windows\System\IBBTfRj.exe
  2⤵
  PID:14740
- C:\Windows\System\UIKGXcK.exe
  C:\Windows\System\UIKGXcK.exe
  2⤵
  PID:14760
- C:\Windows\System\DVaxBhe.exe
  C:\Windows\System\DVaxBhe.exe
  2⤵
  PID:14792
- C:\Windows\System\BISRCGu.exe
  C:\Windows\System\BISRCGu.exe
  2⤵
  PID:14812
- C:\Windows\System\riPcMZu.exe
  C:\Windows\System\riPcMZu.exe
  2⤵
  PID:14836
- C:\Windows\System\LEswDme.exe
  C:\Windows\System\LEswDme.exe
  2⤵
  PID:14860
- C:\Windows\System\nhJYeLO.exe
  C:\Windows\System\nhJYeLO.exe
  2⤵
  PID:14884
- C:\Windows\System\cwuqsGT.exe
  C:\Windows\System\cwuqsGT.exe
  2⤵
  PID:14900
- C:\Windows\System\rWNNmnZ.exe
  C:\Windows\System\rWNNmnZ.exe
  2⤵
  PID:14924
- C:\Windows\System\EYlnSjh.exe
  C:\Windows\System\EYlnSjh.exe
  2⤵
  PID:14956
- C:\Windows\System\sJGjraj.exe
  C:\Windows\System\sJGjraj.exe
  2⤵
  PID:14972
- C:\Windows\System\HcWGjzO.exe
  C:\Windows\System\HcWGjzO.exe
  2⤵
  PID:14988
- C:\Windows\System\KkUXdGE.exe
  C:\Windows\System\KkUXdGE.exe
  2⤵
  PID:15012
- C:\Windows\System\lWpdPHB.exe
  C:\Windows\System\lWpdPHB.exe
  2⤵
  PID:15036
- C:\Windows\System\SuuzWuE.exe
  C:\Windows\System\SuuzWuE.exe
  2⤵
  PID:15068
- C:\Windows\System\wboxvCv.exe
  C:\Windows\System\wboxvCv.exe
  2⤵
  PID:15084
- C:\Windows\System\hLXuBAG.exe
  C:\Windows\System\hLXuBAG.exe
  2⤵
  PID:15100
- C:\Windows\System\FBnfvoh.exe
  C:\Windows\System\FBnfvoh.exe
  2⤵
  PID:15120
- C:\Windows\System\EAnFfFy.exe
  C:\Windows\System\EAnFfFy.exe
  2⤵
  PID:15140
- C:\Windows\System\CZQokbO.exe
  C:\Windows\System\CZQokbO.exe
  2⤵
  PID:15156
- C:\Windows\System\YZESJYh.exe
  C:\Windows\System\YZESJYh.exe
  2⤵
  PID:15172
- C:\Windows\System\VUfsbAt.exe
  C:\Windows\System\VUfsbAt.exe
  2⤵
  PID:15200
- C:\Windows\System\OGwdYtX.exe
  C:\Windows\System\OGwdYtX.exe
  2⤵
  PID:15220
- C:\Windows\System\LxGZJBA.exe
  C:\Windows\System\LxGZJBA.exe
  2⤵
  PID:15240
- C:\Windows\System\AFEGfHT.exe
  C:\Windows\System\AFEGfHT.exe
  2⤵
  PID:15276
- C:\Windows\System\VfNoWcR.exe
  C:\Windows\System\VfNoWcR.exe
  2⤵
  PID:15300
- C:\Windows\System\EFQKuQK.exe
  C:\Windows\System\EFQKuQK.exe
  2⤵
  PID:15328
- C:\Windows\System\nKTbstF.exe
  C:\Windows\System\nKTbstF.exe
  2⤵
  PID:15356
- C:\Windows\System\YiqviLb.exe
  C:\Windows\System\YiqviLb.exe
  2⤵
  PID:12228
- C:\Windows\System\TLmcyJp.exe
  C:\Windows\System\TLmcyJp.exe
  2⤵
  PID:12316
- C:\Windows\System\ZGwYxDc.exe
  C:\Windows\System\ZGwYxDc.exe
  2⤵
  PID:12740
- C:\Windows\System\vehNFIR.exe
  C:\Windows\System\vehNFIR.exe
  2⤵
  PID:12944
- C:\Windows\System\uGaLdSU.exe
  C:\Windows\System\uGaLdSU.exe
  2⤵
  PID:13352
- C:\Windows\System\rUBLoeV.exe
  C:\Windows\System\rUBLoeV.exe
  2⤵
  PID:13428
- C:\Windows\System\KxBofjX.exe
  C:\Windows\System\KxBofjX.exe
  2⤵
  PID:13512
- C:\Windows\System\CCrQBxd.exe
  C:\Windows\System\CCrQBxd.exe
  2⤵
  PID:13200
- C:\Windows\System\hnvvNgW.exe
  C:\Windows\System\hnvvNgW.exe
  2⤵
  PID:11268
- C:\Windows\System\jkBCCOA.exe
  C:\Windows\System\jkBCCOA.exe
  2⤵
  PID:12848
- C:\Windows\System\ZEUCEqV.exe
  C:\Windows\System\ZEUCEqV.exe
  2⤵
  PID:13368
- C:\Windows\System\XOzlCjt.exe
  C:\Windows\System\XOzlCjt.exe
  2⤵
  PID:13408
- C:\Windows\System\WIifzzK.exe
  C:\Windows\System\WIifzzK.exe
  2⤵
  PID:13444
- C:\Windows\System\cckbpxW.exe
  C:\Windows\System\cckbpxW.exe
  2⤵
  PID:10972
- C:\Windows\System\EkSbBti.exe
  C:\Windows\System\EkSbBti.exe
  2⤵
  PID:13564
- C:\Windows\System\SFbjvMo.exe
  C:\Windows\System\SFbjvMo.exe
  2⤵
  PID:11380
- C:\Windows\System\iBvkBNt.exe
  C:\Windows\System\iBvkBNt.exe
  2⤵
  PID:13812
- C:\Windows\System\IfXSjJi.exe
  C:\Windows\System\IfXSjJi.exe
  2⤵
  PID:12144
- C:\Windows\System\kCotQmf.exe
  C:\Windows\System\kCotQmf.exe
  2⤵
  PID:12256
- C:\Windows\System\sEtjPpP.exe
  C:\Windows\System\sEtjPpP.exe
  2⤵
  PID:11744
- C:\Windows\System\UkiUtrl.exe
  C:\Windows\System\UkiUtrl.exe
  2⤵
  PID:12416
- C:\Windows\System\aYLrnIc.exe
  C:\Windows\System\aYLrnIc.exe
  2⤵
  PID:14472
- C:\Windows\System\ZdiRQfh.exe
  C:\Windows\System\ZdiRQfh.exe
  2⤵
  PID:14532
- C:\Windows\System\JskLOYj.exe
  C:\Windows\System\JskLOYj.exe
  2⤵
  PID:14024
- C:\Windows\System\YNdQVNt.exe
  C:\Windows\System\YNdQVNt.exe
  2⤵
  PID:14644
- C:\Windows\System\PXDcbPo.exe
  C:\Windows\System\PXDcbPo.exe
  2⤵
  PID:14720
- C:\Windows\System\cenBKMk.exe
  C:\Windows\System\cenBKMk.exe
  2⤵
  PID:14780
- C:\Windows\System\IGHdJRi.exe
  C:\Windows\System\IGHdJRi.exe
  2⤵
  PID:15364
- C:\Windows\System\npKiPtD.exe
  C:\Windows\System\npKiPtD.exe
  2⤵
  PID:15388
- C:\Windows\System\PIvGUSa.exe
  C:\Windows\System\PIvGUSa.exe
  2⤵
  PID:15420
- C:\Windows\System\ToAhDWe.exe
  C:\Windows\System\ToAhDWe.exe
  2⤵
  PID:15444
- C:\Windows\System\omDuSgJ.exe
  C:\Windows\System\omDuSgJ.exe
  2⤵
  PID:15464
- C:\Windows\System\SYSZcVz.exe
  C:\Windows\System\SYSZcVz.exe
  2⤵
  PID:15484
- C:\Windows\System\KXFbWZS.exe
  C:\Windows\System\KXFbWZS.exe
  2⤵
  PID:15508
- C:\Windows\System\abzYhXg.exe
  C:\Windows\System\abzYhXg.exe
  2⤵
  PID:15532
- C:\Windows\System\vFFnANS.exe
  C:\Windows\System\vFFnANS.exe
  2⤵
  PID:15556
- C:\Windows\System\flwOKrv.exe
  C:\Windows\System\flwOKrv.exe
  2⤵
  PID:15580
- C:\Windows\System\mFgYAJR.exe
  C:\Windows\System\mFgYAJR.exe
  2⤵
  PID:15612
- C:\Windows\System\vZJmIGW.exe
  C:\Windows\System\vZJmIGW.exe
  2⤵
  PID:15636
- C:\Windows\System\RdSnNFa.exe
  C:\Windows\System\RdSnNFa.exe
  2⤵
  PID:15652
- C:\Windows\System\ewBrqlx.exe
  C:\Windows\System\ewBrqlx.exe
  2⤵
  PID:15676
- C:\Windows\System\TYOVFkS.exe
  C:\Windows\System\TYOVFkS.exe
  2⤵
  PID:15692
- C:\Windows\System\kaAcnuN.exe
  C:\Windows\System\kaAcnuN.exe
  2⤵
  PID:15708
- C:\Windows\System\Mykxehh.exe
  C:\Windows\System\Mykxehh.exe
  2⤵
  PID:15736
- C:\Windows\System\WeQHquP.exe
  C:\Windows\System\WeQHquP.exe
  2⤵
  PID:15752
- C:\Windows\System\WKsNnAA.exe
  C:\Windows\System\WKsNnAA.exe
  2⤵
  PID:15768
- C:\Windows\System\HBQNSPq.exe
  C:\Windows\System\HBQNSPq.exe
  2⤵
  PID:15788
- C:\Windows\System\TjWfzgk.exe
  C:\Windows\System\TjWfzgk.exe
  2⤵
  PID:15804
- C:\Windows\System\xCfhEZP.exe
  C:\Windows\System\xCfhEZP.exe
  2⤵
  PID:15832
- C:\Windows\System\cvucEZF.exe
  C:\Windows\System\cvucEZF.exe
  2⤵
  PID:15856
- C:\Windows\System\ERXAVCU.exe
  C:\Windows\System\ERXAVCU.exe
  2⤵
  PID:15884
- C:\Windows\System\yNfrkMb.exe
  C:\Windows\System\yNfrkMb.exe
  2⤵
  PID:15908
- C:\Windows\System\JjmzOkX.exe
  C:\Windows\System\JjmzOkX.exe
  2⤵
  PID:15928
- C:\Windows\System\CNqNaCW.exe
  C:\Windows\System\CNqNaCW.exe
  2⤵
  PID:15948
- C:\Windows\System\yojFVVV.exe
  C:\Windows\System\yojFVVV.exe
  2⤵
  PID:15972
- C:\Windows\System\tSJNyeE.exe
  C:\Windows\System\tSJNyeE.exe
  2⤵
  PID:16004
- C:\Windows\System\xmPGahS.exe
  C:\Windows\System\xmPGahS.exe
  2⤵
  PID:16028
- C:\Windows\System\DoygDlx.exe
  C:\Windows\System\DoygDlx.exe
  2⤵
  PID:16052
- C:\Windows\System\dlkarFk.exe
  C:\Windows\System\dlkarFk.exe
  2⤵
  PID:16080
- C:\Windows\System\sUkvNIr.exe
  C:\Windows\System\sUkvNIr.exe
  2⤵
  PID:16096
- C:\Windows\System\IMXZkDu.exe
  C:\Windows\System\IMXZkDu.exe
  2⤵
  PID:16112
- C:\Windows\System\ulfLKnj.exe
  C:\Windows\System\ulfLKnj.exe
  2⤵
  PID:16132
- C:\Windows\System\fbIYRBj.exe
  C:\Windows\System\fbIYRBj.exe
  2⤵
  PID:16156
- C:\Windows\System\lpsaCFV.exe
  C:\Windows\System\lpsaCFV.exe
  2⤵
  PID:16172
- C:\Windows\System\IedFrhq.exe
  C:\Windows\System\IedFrhq.exe
  2⤵
  PID:16196
- C:\Windows\System\QNcrumv.exe
  C:\Windows\System\QNcrumv.exe
  2⤵
  PID:16224
- C:\Windows\System\uBHrLWr.exe
  C:\Windows\System\uBHrLWr.exe
  2⤵
  PID:16244
- C:\Windows\System\SwLqjEy.exe
  C:\Windows\System\SwLqjEy.exe
  2⤵
  PID:16268
- C:\Windows\System\qMMIGng.exe
  C:\Windows\System\qMMIGng.exe
  2⤵
  PID:16300
- C:\Windows\System\LYAckPi.exe
  C:\Windows\System\LYAckPi.exe
  2⤵
  PID:16324
- C:\Windows\System\lExhGRr.exe
  C:\Windows\System\lExhGRr.exe
  2⤵
  PID:16344
- C:\Windows\System\gqolMqv.exe
  C:\Windows\System\gqolMqv.exe
  2⤵
  PID:16380
- C:\Windows\System\axRdrQa.exe
  C:\Windows\System\axRdrQa.exe
  2⤵
  PID:14912
- C:\Windows\System\oineZjA.exe
  C:\Windows\System\oineZjA.exe
  2⤵
  PID:14980
- C:\Windows\System\YMPpMhx.exe
  C:\Windows\System\YMPpMhx.exe
  2⤵
  PID:13676
- C:\Windows\System\fALNEfj.exe
  C:\Windows\System\fALNEfj.exe
  2⤵
  PID:15032
- C:\Windows\System\IIuhUuL.exe
  C:\Windows\System\IIuhUuL.exe
  2⤵
  PID:12684
- C:\Windows\System\CTGCrEY.exe
  C:\Windows\System\CTGCrEY.exe
  2⤵
  PID:13208
- C:\Windows\System\tyLHKRV.exe
  C:\Windows\System\tyLHKRV.exe
  2⤵
  PID:15252
- C:\Windows\System\femmdIP.exe
  C:\Windows\System\femmdIP.exe
  2⤵
  PID:13292
- C:\Windows\System\BcgbptD.exe
  C:\Windows\System\BcgbptD.exe
  2⤵
  PID:12800
- C:\Windows\System\ZfFBjzg.exe
  C:\Windows\System\ZfFBjzg.exe
  2⤵
  PID:12892
- C:\Windows\System\NarvLQy.exe
  C:\Windows\System\NarvLQy.exe
  2⤵
  PID:14404
- C:\Windows\System\RokPPvI.exe
  C:\Windows\System\RokPPvI.exe
  2⤵
  PID:14496
- C:\Windows\System\VVRYgey.exe
  C:\Windows\System\VVRYgey.exe
  2⤵
  PID:14040
- C:\Windows\System\kenkFpy.exe
  C:\Windows\System\kenkFpy.exe
  2⤵
  PID:14596
- C:\Windows\System\KVfpWAv.exe
  C:\Windows\System\KVfpWAv.exe
  2⤵
  PID:11320
- C:\Windows\System\qpDEsfT.exe
  C:\Windows\System\qpDEsfT.exe
  2⤵
  PID:14112
- C:\Windows\System\qMQwldz.exe
  C:\Windows\System\qMQwldz.exe
  2⤵
  PID:14392
- C:\Windows\System\xFCmlSB.exe
  C:\Windows\System\xFCmlSB.exe
  2⤵
  PID:12488
- C:\Windows\System\JgnFgYS.exe
  C:\Windows\System\JgnFgYS.exe
  2⤵
  PID:12048
- C:\Windows\System\QVkQVFI.exe
  C:\Windows\System\QVkQVFI.exe
  2⤵
  PID:14268
- C:\Windows\System\GpaoRNY.exe
  C:\Windows\System\GpaoRNY.exe
  2⤵
  PID:14304
- C:\Windows\System\MufLJnb.exe
  C:\Windows\System\MufLJnb.exe
  2⤵
  PID:16400
- C:\Windows\System\PEMJweI.exe
  C:\Windows\System\PEMJweI.exe
  2⤵
  PID:16416
- C:\Windows\System\PrbXaGQ.exe
  C:\Windows\System\PrbXaGQ.exe
  2⤵
  PID:16444
- C:\Windows\System\CMPvZIe.exe
  C:\Windows\System\CMPvZIe.exe
  2⤵
  PID:16472
- C:\Windows\System\CEFeRzK.exe
  C:\Windows\System\CEFeRzK.exe
  2⤵
  PID:16504
- C:\Windows\System\iyREcnK.exe
  C:\Windows\System\iyREcnK.exe
  2⤵
  PID:16532
- C:\Windows\System\zWOOsxI.exe
  C:\Windows\System\zWOOsxI.exe
  2⤵
  PID:16556
- C:\Windows\System\XvhWdSY.exe
  C:\Windows\System\XvhWdSY.exe
  2⤵
  PID:16580
- C:\Windows\System\AYbPiNH.exe
  C:\Windows\System\AYbPiNH.exe
  2⤵
  PID:16600
- C:\Windows\System\lbmerBI.exe
  C:\Windows\System\lbmerBI.exe
  2⤵
  PID:16620
- C:\Windows\System\jpAAvuO.exe
  C:\Windows\System\jpAAvuO.exe
  2⤵
  PID:16644
- C:\Windows\System\EQnRrgW.exe
  C:\Windows\System\EQnRrgW.exe
  2⤵
  PID:16672
- C:\Windows\System\lzDnLPG.exe
  C:\Windows\System\lzDnLPG.exe
  2⤵
  PID:16692
- C:\Windows\System\gQraiFT.exe
  C:\Windows\System\gQraiFT.exe
  2⤵
  PID:16716
- C:\Windows\System\XZfKxHi.exe
  C:\Windows\System\XZfKxHi.exe
  2⤵
  PID:16732
- C:\Windows\System\QSSFTFP.exe
  C:\Windows\System\QSSFTFP.exe
  2⤵
  PID:16752
- C:\Windows\System\MqoxOom.exe
  C:\Windows\System\MqoxOom.exe
  2⤵
  PID:16772
- C:\Windows\System\lAojVpl.exe
  C:\Windows\System\lAojVpl.exe
  2⤵
  PID:16808
- C:\Windows\System\VywQWnj.exe
  C:\Windows\System\VywQWnj.exe
  2⤵
  PID:16828
- C:\Windows\System\rdnJlSw.exe
  C:\Windows\System\rdnJlSw.exe
  2⤵
  PID:16860
- C:\Windows\System\UXpkBwl.exe
  C:\Windows\System\UXpkBwl.exe
  2⤵
  PID:16880
- C:\Windows\System\NBkbNuO.exe
  C:\Windows\System\NBkbNuO.exe
  2⤵
  PID:16900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DAvyvhz.exe

Filesize
1.1MB

MD5
f249f5062417075af522f238de9a5033

SHA1
4232f0e9c20c8422b53598ce3f015b4c1d8be8d2

SHA256
3b966124239491f9bf68661caea5497352f06000e18cd75275f2863b89e2e812

SHA512
08dddd1568b0bcee9dcb9cec47c1b2893f3b491217e229a2898e2a94b36a3699fc88cbc212d9a60966b0168c1b25d062184c12be0e0441c5b90a5c6be272b692

Download Submit
C:\Windows\System\DkSvBNP.exe

Filesize
1.1MB

MD5
1f8ae25144766263ebd4dc3c920bfb30

SHA1
15e209756887c9bd66d27df4d3162f57f495215f

SHA256
6d8b7906043477321653a0479c697449ce0fc800b31de8493d7dafe4be5c2c09

SHA512
23308932c342fa7523e0d494c87052fdeeb81610092f9fb409e127b5353721f348f3b23d12ba6cbf85d0a7155c9a32059e46af3ee2575f38637844e6900f8e47

Download Submit
C:\Windows\System\EMHBfaT.exe

Filesize
1.1MB

MD5
97ef6d0249bbf2f1d8b1271dc8716f26

SHA1
f0b9c88e87300b2ac0692ee04674c4f85144c78e

SHA256
5de7e3efc8d248cd78079c317cdf50fc4fb4e66b6d2ce88ccd4e64358ff4fc37

SHA512
2602f0503cc8d5818fa82d78a6c82aab700148392cbd35b5142348e2aed4ee3cca5dbbe108261e4a3a39329c85351db9f21b5485bd710e280c17b4f83f84462c

Download Submit
C:\Windows\System\EUXyXEG.exe

Filesize
1.1MB

MD5
877a094ba9121adc40b6fb0a8b5f7ff7

SHA1
b68a1fa8e50cf6003520254f59d2a4dc0104c67b

SHA256
32ff86dd2da1a1bdcb9d0266e0ddb53fe595011f33ebe956ed9335a6d4347bf4

SHA512
4e4e4eeae7feec726b9cdc7013d368e9261a60c0f2105c18df0edd9d607e89f6056660d965ee80a056d5bc6d148e9ee059a4eb8580b0441ff98a559fdcf6d351

Download Submit
C:\Windows\System\EwZgXbI.exe

Filesize
1.1MB

MD5
bfa9a248c374e54ee42c76c2a3eb9692

SHA1
8042371bc9d5483373bbc3ecdc64bf8ef1b21bcd

SHA256
22c0e6178a895c57c9e2167fa0d8f5013b41862a19f3c7a7a32ba9d691835b63

SHA512
602238718190c23de1d54e0492c3660d86d653205741abbea55000063808bc48cc9480c4328c2d2c2823fd810e619fe9dafec6240440076584b1fad4c933e891

Download Submit
C:\Windows\System\FBDZftR.exe

Filesize
1.1MB

MD5
07b73f81da329ed8621adfecf7650bbf

SHA1
a588f2468e9123058b6b0b4f45815bef59a1bbf1

SHA256
26b8077a5472e603c9c701cf5e2023ec879e2cd3cec071813296d95ed0b22452

SHA512
d71797a78ce7d2268f6639f80daa44c9a76b631c13e141ac227447eca74c417f27299431f16e017685cf324e3faeee51e7a0260bfc69e209b9900a56b361afe7

Download Submit
C:\Windows\System\FWppiWf.exe

Filesize
1.1MB

MD5
46dae20c21315cfdab1fe146697aa1db

SHA1
ace4d7cadd13db846122ac41596a5afea484e32e

SHA256
ae1ea4c79df813c4bf8aa754914d8379aa605a328105258641bdd3073bec4ce5

SHA512
9e98519da355412501504044fc9b8152dd91f2d281cad4ee658fd010bc9096fa4850ad9f5dcb709d3cb1fac43044615b1ad0f8345cca1b66d48735381edc868f

Download Submit
C:\Windows\System\FazWhaO.exe

Filesize
1.1MB

MD5
a5bfc6007bd3289297aa1015c9084b78

SHA1
62b9c87a546916af1b926c913d0b5489d45f51bd

SHA256
a5c9e4622ac6c8625ee51b22383bfbe30213237b9242ac5d53ee10af09ee6d17

SHA512
78ad1a0e7027f8a03a38373d6f352d5be22f9c60544b468bb90c45c2f4a834c8eb973305bf7eb67dc1293574ae9e3056da376aa533b34c7dfe3637f9683a6b96

Download Submit
C:\Windows\System\Ighysqd.exe

Filesize
1.1MB

MD5
1b3c324d3c947f8a4d8d2b8c41505a64

SHA1
d58da4291e922111dd75e1103f26cea80e48a7e3

SHA256
a4c94c5b6dcec3468924913ec7b6a88673302b8d194b1b5befcd00912e58ffa5

SHA512
68f5135cce584efb082447c6c48231b573977a6d7c934ce91900bbff606f593f0569315c1b182c4224952bb04960b823f7d2b0ff12e3f59af2e3b5e11345288b

Download Submit
C:\Windows\System\LiaJXUu.exe

Filesize
1.1MB

MD5
4b0d833b9ab14e6d3b6f28c57fcb64ab

SHA1
8db6979a396e9486630dcfa5d99e88ea482b3c93

SHA256
f23083450db8fdc69379a8b160659372c4cfad20a594faf8873dd690d2685128

SHA512
cf337a1f37e8a9db6a949fd9befd6511dd87556757195d73349e6a113e0d7d7d02e7f7d0e1886aae1893f15d67624648535bd905da7cfa6809897a6c4a3a6ad7

Download Submit
C:\Windows\System\Mvzzmlg.exe

Filesize
1.1MB

MD5
edc74790d3d2de51ed676e40aab351b0

SHA1
b79c6c6825a860d67f5747bb8f64bc6cb4c973e4

SHA256
16aa43ee5d08987883aa43badf6243087dc37402483a9329e31dbc8b08f6e536

SHA512
7b9de5ec8e23bd3173559c87df5a3d8e4ef53193738074ea821d528a5bb311352469490a2be8ce20b8a0e2ffcaf57fa9c370bcd2545cc2e47a00b6c42bd7f824

Download Submit
C:\Windows\System\NWvfaLI.exe

Filesize
1.1MB

MD5
21785974075dd383f8061f86710d9458

SHA1
a86596c87443ddd7c414f4675c5c944072d61e69

SHA256
21b5d602d9d718c53888b6871c9162cf26b886f5c23afeec6d0aa12e8793b82f

SHA512
48cc824d573262a81fda50dc6970280de65f5b04b94b850bc5452ccc259187fc4988024ad596a7f34e61c11615bb5cc94d6199633e83c701886e635eda11d903

Download Submit
C:\Windows\System\OghlDnl.exe

Filesize
1.1MB

MD5
941c7d9850db896d2d58078eeb832036

SHA1
1f09a2d89096ac94aaa660703e1d2347c0839c1b

SHA256
00cc757e36cfae2341199bcfffc04ae606a591d4eecb7d53486da38b3dab4d1b

SHA512
3943430df0c6f87c84fd955df3dec02c57365bd8115140a5e87fe47a7a49f6f82c360182590e97888ec4c141295af87dfbc766c0cd541afb7a8a0dca4c72e474

Download Submit
C:\Windows\System\PWnhbOZ.exe

Filesize
1.1MB

MD5
cc8a5b0d940197c982662f3204cf2299

SHA1
29150a19c06841f2bb94e0e423c365d449a4ef84

SHA256
fc1e72b7c42080721fa83d7310612eb566d705c681d04afbb8318d1a63839fd7

SHA512
5227373ffd4603d19ed6067f5ba54be7196e3858b604f3869d0fe98c60988b534fce1adf3b663ccab4e5f26b219106e11bd56e461995fab82fcfa8bb68f72c05

Download Submit
C:\Windows\System\PcBDCFj.exe

Filesize
1.1MB

MD5
8eef77055a353b9af68663d267769913

SHA1
bbfbdeb626c2a1f8c130221b5201c1740e5d0a3a

SHA256
746095450b77e3b1a5fab2e5b9c64e2d59cf7c73ec7ae1e58a2396cb8eb0821c

SHA512
2c5df2e910bc9128d14858592c7b04004d1ead70c21b4c2cddfc0b3e96d726a731701dc1a0f95097616fa1e247df2849ea3270d544bf9f3e70f8ae79fdbac6f2

Download Submit
C:\Windows\System\RcuUOiO.exe

Filesize
1.1MB

MD5
3617b7b0f0ddef64ebd93f91a9236ab5

SHA1
579846fc5167410ab14801739718d6bf21e0b5a5

SHA256
24f0c73e2f42a1af2c6d3355789ef78b1d01ecd82f2325311255bf01fb7d6357

SHA512
c60fdb83590be4c11079f2e284b300bf591c15db7269af307c522519d28bbe3acefcd6c7b8e0788df02eb59c4fb27ce117e4128b58129cc567e6e2d1562d6c49

Download Submit
C:\Windows\System\TzxISdq.exe

Filesize
1.1MB

MD5
14a82ae0519aa9fec3767def548b3067

SHA1
e336bf1e4634bc8a9c88ad47bd9e72a2a7e16c31

SHA256
f6fd2a227fe612f25f0dcef304f48db23f20a5379acb8950ca898cd0d2bb20e1

SHA512
ccee46ea8a9cb1bb4a89afa246670fcf725ca97465206cf688e25dac5e48fa5e59cc0985aead2309060c49264d26e5c71186cdfb539382be710c2a69a4c0fc99

Download Submit
C:\Windows\System\VWVXmpx.exe

Filesize
1.1MB

MD5
9f6431639c363829faf88fdca4d6a8ec

SHA1
8259257be5c1f11a6f1afe929b0031ee4c0291a6

SHA256
ab70f92fa7ef85dc3216fb9c9c9dd5bee4218860eb67df6d2a74de69a3b11bdb

SHA512
8ed4dbf1ad29af560cf0af8bc00cae3ae96f8b214f141b4d6df1a2f0a4c01650e3b6c712cb04496e751852e3af2e65d62535745130e93399a4abc70dec9979f6

Download Submit
C:\Windows\System\VYErfKh.exe

Filesize
1.1MB

MD5
e03f2e3da226266a0e03017a8c8f0b83

SHA1
bc7734690934d0eabb0422f8933ccab660463887

SHA256
aa0b3d63044b2297baa6a65304e9d05ac4782f27347a9218ba86021de53fcf54

SHA512
38fdfd3ced9116513b367f10b95b38204acebd6f0e76baae62eb5179f922dd09965e498d3192b42f3be685fc55a3fd0c1bceb649d2ab27c8352a6cc2d6640f30

Download Submit
C:\Windows\System\WkmpEIb.exe

Filesize
1.1MB

MD5
f1aa3a62ed7a9a18d62500efcc3ef0b2

SHA1
02a011073dce423b0ed5f87d2ba944624a36db61

SHA256
38cba83a2efd0d7f78aede0ce3c09cd88bb7c242ed948643cc4d61eb1c4791c9

SHA512
0bb65de641ed504aeb88a4bd80c58bc8f35bbabc0135f4bb543329bb9d8ba4f55f8cd331d2218ac959143812b75eded7e61b8e6cb5a011d315b3ea8701161386

Download Submit
C:\Windows\System\XoDqcIT.exe

Filesize
1.1MB

MD5
ba1914773472e2d4582c473653dc7b99

SHA1
77d57ee8b7eb2b29558b704cbf1b812b4ec99cbe

SHA256
31ecf3ca83d807899461a963bc9fe5e93ef15325b6c8ef063f1f51b4f8371459

SHA512
3a9e1050624c2143cb1f183df19c0098ad33882f784342d324eec9cc76aa7f2570c468c7f3c9afd896198b4f8d8adacc93985fa611eb422b9df85496fd3c16ce

Download Submit
C:\Windows\System\YVuFyJn.exe

Filesize
1.1MB

MD5
f6efeb4f31177d117c4fcb4d5850c910

SHA1
ab2409b54ab88eb8bc6f43ea92cc47fc3e52f1f2

SHA256
414da4e1aa80f696ed54474d86919200d7ebf41818c0f5dc7f94e040de0e94f1

SHA512
4eb43c5db834ef14704ef084cb42a80762a0753ce7ca0b4e1de6a25cc44305dc90f8e8bdf4edc64fb2eb3e94b7a6d603de807177e44bd87759ed4d9a84da4ca5

Download Submit
C:\Windows\System\YcmUwWk.exe

Filesize
1.1MB

MD5
007579480b319616899b48ae22cf503c

SHA1
9beedb3bffab4582f1ebf2f6084707616dd9975c

SHA256
951064fcbe8c22ffc78cf4e1635893acbc2d8b9415a06b5a8b011df229674ca9

SHA512
2573a750096cd25834e622387c52441004bf5c551cc9f73ce9b207ad88b9f0ac8fab2ce5338f8ba920f7d201910642989fab71ec188d4fc9f60769c43f26cc13

Download Submit
C:\Windows\System\ZovcWnE.exe

Filesize
1.1MB

MD5
76a31708e1479ae51ab9bf10846b9452

SHA1
a0f9f9efbbff8b1f8c33c736f75fa10ac700c701

SHA256
c4d8d1d5f0ebdfa1cd2c29eeef57287a1227504fc092d7384d525245e7b7449b

SHA512
049be0a38b291b1b21acf30de9f8a3f7632a6d6b634904496d11d3671bc773de5f485da77c0fc6bd12fd41ca1acbddf1d0e742e6d052133f271be9ca75622460

Download Submit
C:\Windows\System\ftXsvxf.exe

Filesize
1.1MB

MD5
81934115b22b5d40c5224fbd56603cca

SHA1
d915a0c1ba56ccae1482157aae6a44c175ed9667

SHA256
1d7b7b0babfe6fe0a167c3817b9e414a087ba5253b15f306edd2dbbd7e379630

SHA512
35cf0a185df1c3e0a17e7fbb324742cd3727a4ef71103cf34296cd48a35690f64c35540766d5e6f4994b4d8bb05abb1436677d462322e7245ce5cdbb16518c1a

Download Submit
C:\Windows\System\lKVeekI.exe

Filesize
1.1MB

MD5
18f8c47eed35c3185e7f964e82ade56f

SHA1
2ce753dd5cb95bacdd4c3ab2182e8a954fe571a8

SHA256
36d8f293c2d259c9d7d7f753d9767c4130e4c987eb2627df0d0b8b08333d1446

SHA512
4e7802ee205cbb74f51645d32ec57bc7edebc0d3f0230a96fe4f246e2c2b2f1fc7f889de7f91e9b162600424880c38c1d07b522c05f048ec589d4105f62aae21

Download Submit
C:\Windows\System\mayAWQu.exe

Filesize
1.1MB

MD5
1513ad238612ed3a4cd5e302c44d9f9c

SHA1
10d79a910dbf88c7964b64bb47b4883353c79039

SHA256
173dd272a0020a3811520ba0a7814cbd355712fe3dbb74f6e51e57ec58fa00fe

SHA512
5a5a06d25155954c7a8c5f29402a8d4e723169de30fe20673e3113a900b63d5fee5aebeaa528e4caacbd4f7abed8267f8a89a2dbba4c788903b4ae465c7c740a

Download Submit
C:\Windows\System\mvLljGf.exe

Filesize
1.1MB

MD5
b2655bea4e56151240ac50f6b4bf3465

SHA1
d4a96d6c3ba348351c606f67670b30cdec6ed6e5

SHA256
2036abfe23e9d7819f2c6446090bcd200ee285ed303c87edef4e17b7da3c6dbd

SHA512
dc3ad34cbb67350285679949b5710e5bd9c8a24b26a62e36471521305e8cdcb1f36320f7e7d7cccc2cc2e04c0b97d89eb36d1f2e7487e262504d856c3a7a869c

Download Submit
C:\Windows\System\pUlWryv.exe

Filesize
1.1MB

MD5
4e3b28e68b11c416b225529d15fd4b32

SHA1
1e41fb18fdeb7869ba40c2432f8d91c2ec4d9ef4

SHA256
0074ccabe9615b6c709afff3f751b853e18f9e577dc1ea5d724dff6d158c8e03

SHA512
be07806729c184dce715ef86fc2ff3b149f24da1b55000577b92f741636f9b6a02191dbb6db027c7147b343180bc1dd125bbf3bc3c021fd93f0a9ebe3eaf639e

Download Submit
C:\Windows\System\sZLnVwP.exe

Filesize
1.1MB

MD5
883073d0e1f1bce970728a181201265f

SHA1
9a85a102169f3ba9614e1574285cd99926f6f8dc

SHA256
abeed1bf938fe7845cbd188182bfd835076fd162e73b26210267115827e55975

SHA512
8b98aa4b3c1cdf0d62feb8807e36ef3ee99e7d0ddba132def33d75283bb6cb057e1bf09dd701942723fdd73a97f9ebc71cf38a9042c96f53f937da2fed70601e

Download Submit
C:\Windows\System\sbiExAs.exe

Filesize
1.1MB

MD5
af73a81b93d41c2e457183045d4b0599

SHA1
8ed658da5e97cb9f69347c9a42c0f2490e3e0cb7

SHA256
31882b8c7e9c05c61a1d8f4bfaaacfb83d8e6ab3e348a394bf36eabb2631f723

SHA512
4a2ba49cc61de95e2670f3ac5d76a390252eb95e4a136f7c913d8e131225a78e84187a9cfcf7c99804d1b2bf3f3fb3d6b0b438d50ca2623f11e8d7c0374a15f5

Download Submit
C:\Windows\System\uKngagv.exe

Filesize
1.1MB

MD5
2e899e3dd66cf3bff8365ada59f75ab3

SHA1
caf97037ad6c1b29b3c1f64999ce7d011cdfa6b7

SHA256
4c389ef51f94d7c38b1fd29c0547d8a22fb7fd092843c1d42d3defb17a2adbe5

SHA512
307891f18319f538eb991a1e93bd0528058e373b385161decc4d00202374b87eb84a43b10b0556bb0579f8469d376050281c6d795e0178e3083c83170013f399

Download Submit
C:\Windows\System\wRHMweY.exe

Filesize
1.1MB

MD5
f38b4b4fc55b4540ca21869326abbedb

SHA1
125075f3e6e6ef40dfa9ed8cdc02bd4830692937

SHA256
ba7be91809c3e755ec0b5ac4df8e68f14963d858a46647c3e6c84c8dff3604f4

SHA512
803f6927574b46abe69f18a7b987a08ca4d674bdfc5b5744f78fabd73ad98efb6a9ffcf3ac1fc9829d9cecb42b4eaf996759f1b2f4524e65eabebcc46cd17bfb

Download Submit
C:\Windows\System\yEOBBuP.exe

Filesize
1.1MB

MD5
dbeab642a643f34a3300e51311a0f38a

SHA1
98ce45329bbb0364fa9dbb5b610d9d082de213ac

SHA256
5758aaf9cb7953f5aab2d3319628b7332f9c751d4da6868d1b159b9bab58ad16

SHA512
8eb375225b6a00e5cacf6a70726e32e886ff73fba2a04e13bb5de1648182c86ca102669fb60efd85a95d2529bbee20754c2bbf915c07dd09ea224cc84557bf5d

Download Submit
C:\Windows\System\zmPvLdT.exe

Filesize
1.1MB

MD5
4b457f4e12c46efd7166bd55c04d6fd2

SHA1
edf23643f8569e5d107333853b9db269a9592012

SHA256
c290a9b5291529e7308ef564931a9f49f207a13fe5e985f1eab1bd142896b5f8

SHA512
523e7aa03115db78ff2e249e369200ce87f5889a33e6bf76b96130059facd67a99da05f462c76a2a25be1c59154c18222c41c3af8b85841271cb2381d52a15ae

Download Submit
memory/3272-0-0x00000245EDE10000-0x00000245EDE20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads