xmrig | 6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
Size

1.3MB
MD5

34dd0c1267b6f55a0d6f7633293ae31a
SHA1

c50dbc30e3fcc87c6fc8d923c85e0dfd512da512
SHA256

6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332
SHA512

f963054fd068b31e12ce0b5f6e32b7c2ce6432283ec7fe3228cfa2397caa24fdf9b231cf5008b808b8bae45cda3bcad653f975f401d4b59241dc0d728799fde5
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6PbWPLRa:GezaTF8FcNkNdfE0pZ9ozttwIRx3Qj5u

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c44-4.dat	xmrig
behavioral2/files/0x0008000000023c9c-7.dat	xmrig
behavioral2/files/0x0007000000023ca1-18.dat	xmrig
behavioral2/files/0x0007000000023ca6-41.dat	xmrig
behavioral2/files/0x0007000000023ca8-59.dat	xmrig
behavioral2/files/0x0007000000023cab-66.dat	xmrig
behavioral2/files/0x0007000000023cae-80.dat	xmrig
behavioral2/files/0x0007000000023cb8-131.dat	xmrig
behavioral2/files/0x0007000000023cbd-156.dat	xmrig
behavioral2/files/0x0007000000023cbe-161.dat	xmrig
behavioral2/files/0x0007000000023cbc-159.dat	xmrig
behavioral2/files/0x0007000000023cbb-154.dat	xmrig
behavioral2/files/0x0007000000023cba-149.dat	xmrig
behavioral2/files/0x0007000000023cb9-144.dat	xmrig
behavioral2/files/0x0007000000023cb7-134.dat	xmrig
behavioral2/files/0x0007000000023cb6-129.dat	xmrig
behavioral2/files/0x0007000000023cb5-124.dat	xmrig
behavioral2/files/0x0007000000023cb4-119.dat	xmrig
behavioral2/files/0x0007000000023cb3-114.dat	xmrig
behavioral2/files/0x0007000000023cb2-109.dat	xmrig
behavioral2/files/0x0007000000023cb1-104.dat	xmrig
behavioral2/files/0x0007000000023cb0-99.dat	xmrig
behavioral2/files/0x0007000000023caf-94.dat	xmrig
behavioral2/files/0x0007000000023cad-84.dat	xmrig
behavioral2/files/0x0007000000023cac-79.dat	xmrig
behavioral2/files/0x0007000000023caa-69.dat	xmrig
behavioral2/files/0x0007000000023ca9-64.dat	xmrig
behavioral2/files/0x0007000000023ca7-54.dat	xmrig
behavioral2/files/0x0007000000023ca5-44.dat	xmrig
behavioral2/files/0x0007000000023ca4-40.dat	xmrig
behavioral2/files/0x0007000000023ca3-38.dat	xmrig
behavioral2/files/0x0007000000023ca2-27.dat	xmrig
behavioral2/files/0x0007000000023ca0-25.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4916	WNvbmXk.exe
4356	cSSRswe.exe
4784	XLRQoHf.exe
1060	nscDXAs.exe
4700	SEWFqRq.exe
1080	tCOaGtv.exe
2120	gvpPpSS.exe
840	ozpHAMt.exe
764	KmUSHSp.exe
1840	BDQXKDF.exe
4412	csNzcNd.exe
5084	tglpHTV.exe
1612	rbLYGbx.exe
3592	jTUaYYv.exe
4168	GasowBq.exe
3068	wuLHaHU.exe
2800	fedjObQ.exe
3036	uyYoVvO.exe
3824	BfNkGZp.exe
4420	ZXZVoLS.exe
4060	YicsLkv.exe
1856	XPdZNCf.exe
872	QxWrpzy.exe
4668	VcAOUyW.exe
212	vxMypWi.exe
2052	MNURLlF.exe
1252	UxpMxSB.exe
380	dbLIeES.exe
4352	kaBbDHW.exe
3064	uZHfqRE.exe
1352	aOleDXn.exe
4972	UhFodkL.exe
216	puMEEVr.exe
3328	fzpUxgo.exe
4948	pjkPaYK.exe
4444	lLCrBmG.exe
1276	lslcqUM.exe
3656	wVLclkx.exe
2680	AdFWbzU.exe
5076	aqkBMRt.exe
1448	kISuPat.exe
2360	ZkADKwy.exe
4228	hvQvesK.exe
2100	PoCVQEj.exe
3892	XnAAeUQ.exe
3364	pAcJByG.exe
724	irKPsRL.exe
1788	CKaIAnz.exe
3208	UnxwYjD.exe
3832	RrjDGHO.exe
4080	xBhLdye.exe
4424	BFPagYx.exe
2804	HpGtyIq.exe
4772	YCMfsGF.exe
3704	xxhUtwV.exe
2528	bpuYlmn.exe
4496	lKzWkjF.exe
4308	QFyJrKS.exe
5088	EyuAmgu.exe
3968	qfyguzv.exe
5064	JLxvuIK.exe
2740	mnDdMTX.exe
984	QaOWjZg.exe
2092	inIOzEo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SzZeQZp.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\dfNkbTS.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\MXMhAHX.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\kMorjpB.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\KnXITlv.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\fxQoLZs.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\eFauCGr.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\DvburfA.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\mxZEMfz.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\vibcyNd.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\fegYkkJ.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\HewksxY.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\AhonZrb.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\IkgdtAe.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\aeuDEOT.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\xehrBjZ.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\zwobBJz.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\jPdWTMC.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\qSkODFL.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\OskMLvX.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\kISuPat.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\kvTHIYW.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\kilkHhK.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\NPmFqxq.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\SfTbClw.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\bqAgCFC.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\YwLicXB.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\DxtZqOH.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\jxidcht.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\uQaOlhL.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\qemVWkO.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\hHvNwzW.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\ZFZGPOc.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\zOoJfgK.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\eeSDYCH.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\EyuAmgu.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\LgnXIfN.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\BkZCNqR.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\VGVcjzy.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\IphATeq.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\SaaaVWs.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\RlWdydK.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\sKWtaLr.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\MpIAuJJ.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\IFRxLZS.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\YfHuMSO.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\nKGasYx.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\zSFMTDW.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\zasLCtf.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\CFmPXGh.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\nzngQzk.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\vVKQbfj.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\oHpFChi.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\mwTtsTO.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\eFlwhXi.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\TYewtgZ.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\UsJkxnf.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\tfqsRsu.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\lHOaPGl.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\TibIRFh.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\GdljGbX.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\wLwxduN.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\RcfjpHB.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
File created	C:\Windows\System\MPiGSIB.exe	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4916	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	84
PID 3304 wrote to memory of 4916	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	84
PID 3304 wrote to memory of 4356	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	85
PID 3304 wrote to memory of 4356	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	85
PID 3304 wrote to memory of 4784	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	86
PID 3304 wrote to memory of 4784	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	86
PID 3304 wrote to memory of 1060	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	87
PID 3304 wrote to memory of 1060	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	87
PID 3304 wrote to memory of 4700	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	88
PID 3304 wrote to memory of 4700	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	88
PID 3304 wrote to memory of 1080	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	89
PID 3304 wrote to memory of 1080	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	89
PID 3304 wrote to memory of 2120	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	90
PID 3304 wrote to memory of 2120	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	90
PID 3304 wrote to memory of 840	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	91
PID 3304 wrote to memory of 840	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	91
PID 3304 wrote to memory of 764	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	92
PID 3304 wrote to memory of 764	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	92
PID 3304 wrote to memory of 1840	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	93
PID 3304 wrote to memory of 1840	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	93
PID 3304 wrote to memory of 4412	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	94
PID 3304 wrote to memory of 4412	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	94
PID 3304 wrote to memory of 5084	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	95
PID 3304 wrote to memory of 5084	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	95
PID 3304 wrote to memory of 1612	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	96
PID 3304 wrote to memory of 1612	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	96
PID 3304 wrote to memory of 3592	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	97
PID 3304 wrote to memory of 3592	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	97
PID 3304 wrote to memory of 4168	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	98
PID 3304 wrote to memory of 4168	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	98
PID 3304 wrote to memory of 3068	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	99
PID 3304 wrote to memory of 3068	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	99
PID 3304 wrote to memory of 2800	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	100
PID 3304 wrote to memory of 2800	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	100
PID 3304 wrote to memory of 3036	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	101
PID 3304 wrote to memory of 3036	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	101
PID 3304 wrote to memory of 3824	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	102
PID 3304 wrote to memory of 3824	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	102
PID 3304 wrote to memory of 4420	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	103
PID 3304 wrote to memory of 4420	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	103
PID 3304 wrote to memory of 4060	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	104
PID 3304 wrote to memory of 4060	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	104
PID 3304 wrote to memory of 1856	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	105
PID 3304 wrote to memory of 1856	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	105
PID 3304 wrote to memory of 872	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	106
PID 3304 wrote to memory of 872	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	106
PID 3304 wrote to memory of 4668	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	107
PID 3304 wrote to memory of 4668	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	107
PID 3304 wrote to memory of 212	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	108
PID 3304 wrote to memory of 212	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	108
PID 3304 wrote to memory of 2052	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	109
PID 3304 wrote to memory of 2052	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	109
PID 3304 wrote to memory of 1252	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	110
PID 3304 wrote to memory of 1252	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	110
PID 3304 wrote to memory of 380	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	111
PID 3304 wrote to memory of 380	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	111
PID 3304 wrote to memory of 4352	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	112
PID 3304 wrote to memory of 4352	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	112
PID 3304 wrote to memory of 3064	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	113
PID 3304 wrote to memory of 3064	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	113
PID 3304 wrote to memory of 1352	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	114
PID 3304 wrote to memory of 1352	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	114
PID 3304 wrote to memory of 4972	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	115
PID 3304 wrote to memory of 4972	3304	6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe	115

C:\Users\Admin\AppData\Local\Temp\6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe
"C:\Users\Admin\AppData\Local\Temp\6b4afdb0dc2a0a6131b5377d2138790c29d7baab7bf9859fd991867f8ed3a332.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\System\WNvbmXk.exe
  C:\Windows\System\WNvbmXk.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\cSSRswe.exe
  C:\Windows\System\cSSRswe.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\XLRQoHf.exe
  C:\Windows\System\XLRQoHf.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\nscDXAs.exe
  C:\Windows\System\nscDXAs.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\SEWFqRq.exe
  C:\Windows\System\SEWFqRq.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\tCOaGtv.exe
  C:\Windows\System\tCOaGtv.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\gvpPpSS.exe
  C:\Windows\System\gvpPpSS.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\ozpHAMt.exe
  C:\Windows\System\ozpHAMt.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\KmUSHSp.exe
  C:\Windows\System\KmUSHSp.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\BDQXKDF.exe
  C:\Windows\System\BDQXKDF.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\csNzcNd.exe
  C:\Windows\System\csNzcNd.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\tglpHTV.exe
  C:\Windows\System\tglpHTV.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\rbLYGbx.exe
  C:\Windows\System\rbLYGbx.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\jTUaYYv.exe
  C:\Windows\System\jTUaYYv.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\GasowBq.exe
  C:\Windows\System\GasowBq.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\wuLHaHU.exe
  C:\Windows\System\wuLHaHU.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\fedjObQ.exe
  C:\Windows\System\fedjObQ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\uyYoVvO.exe
  C:\Windows\System\uyYoVvO.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\BfNkGZp.exe
  C:\Windows\System\BfNkGZp.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\ZXZVoLS.exe
  C:\Windows\System\ZXZVoLS.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\YicsLkv.exe
  C:\Windows\System\YicsLkv.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\XPdZNCf.exe
  C:\Windows\System\XPdZNCf.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\QxWrpzy.exe
  C:\Windows\System\QxWrpzy.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\VcAOUyW.exe
  C:\Windows\System\VcAOUyW.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\vxMypWi.exe
  C:\Windows\System\vxMypWi.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\MNURLlF.exe
  C:\Windows\System\MNURLlF.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\UxpMxSB.exe
  C:\Windows\System\UxpMxSB.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\dbLIeES.exe
  C:\Windows\System\dbLIeES.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\kaBbDHW.exe
  C:\Windows\System\kaBbDHW.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\uZHfqRE.exe
  C:\Windows\System\uZHfqRE.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\aOleDXn.exe
  C:\Windows\System\aOleDXn.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\UhFodkL.exe
  C:\Windows\System\UhFodkL.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\puMEEVr.exe
  C:\Windows\System\puMEEVr.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\fzpUxgo.exe
  C:\Windows\System\fzpUxgo.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\pjkPaYK.exe
  C:\Windows\System\pjkPaYK.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\lLCrBmG.exe
  C:\Windows\System\lLCrBmG.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\lslcqUM.exe
  C:\Windows\System\lslcqUM.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\wVLclkx.exe
  C:\Windows\System\wVLclkx.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\AdFWbzU.exe
  C:\Windows\System\AdFWbzU.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\aqkBMRt.exe
  C:\Windows\System\aqkBMRt.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\kISuPat.exe
  C:\Windows\System\kISuPat.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\ZkADKwy.exe
  C:\Windows\System\ZkADKwy.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\hvQvesK.exe
  C:\Windows\System\hvQvesK.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\PoCVQEj.exe
  C:\Windows\System\PoCVQEj.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\XnAAeUQ.exe
  C:\Windows\System\XnAAeUQ.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\pAcJByG.exe
  C:\Windows\System\pAcJByG.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\irKPsRL.exe
  C:\Windows\System\irKPsRL.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\CKaIAnz.exe
  C:\Windows\System\CKaIAnz.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\UnxwYjD.exe
  C:\Windows\System\UnxwYjD.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\RrjDGHO.exe
  C:\Windows\System\RrjDGHO.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\xBhLdye.exe
  C:\Windows\System\xBhLdye.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\BFPagYx.exe
  C:\Windows\System\BFPagYx.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\HpGtyIq.exe
  C:\Windows\System\HpGtyIq.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\YCMfsGF.exe
  C:\Windows\System\YCMfsGF.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\xxhUtwV.exe
  C:\Windows\System\xxhUtwV.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\bpuYlmn.exe
  C:\Windows\System\bpuYlmn.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\lKzWkjF.exe
  C:\Windows\System\lKzWkjF.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\QFyJrKS.exe
  C:\Windows\System\QFyJrKS.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\EyuAmgu.exe
  C:\Windows\System\EyuAmgu.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\qfyguzv.exe
  C:\Windows\System\qfyguzv.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\JLxvuIK.exe
  C:\Windows\System\JLxvuIK.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\mnDdMTX.exe
  C:\Windows\System\mnDdMTX.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\QaOWjZg.exe
  C:\Windows\System\QaOWjZg.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\inIOzEo.exe
  C:\Windows\System\inIOzEo.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\FnQVgXE.exe
  C:\Windows\System\FnQVgXE.exe
  2⤵
  PID:2164
- C:\Windows\System\guOQPBV.exe
  C:\Windows\System\guOQPBV.exe
  2⤵
  PID:3996
- C:\Windows\System\hjcDkVA.exe
  C:\Windows\System\hjcDkVA.exe
  2⤵
  PID:4928
- C:\Windows\System\MUvsCYe.exe
  C:\Windows\System\MUvsCYe.exe
  2⤵
  PID:776
- C:\Windows\System\lbjvSqQ.exe
  C:\Windows\System\lbjvSqQ.exe
  2⤵
  PID:1284
- C:\Windows\System\wQzHWKx.exe
  C:\Windows\System\wQzHWKx.exe
  2⤵
  PID:1068
- C:\Windows\System\bKnkkeO.exe
  C:\Windows\System\bKnkkeO.exe
  2⤵
  PID:1588
- C:\Windows\System\UAJDLQG.exe
  C:\Windows\System\UAJDLQG.exe
  2⤵
  PID:2692
- C:\Windows\System\jNTEjFj.exe
  C:\Windows\System\jNTEjFj.exe
  2⤵
  PID:4848
- C:\Windows\System\SaaaVWs.exe
  C:\Windows\System\SaaaVWs.exe
  2⤵
  PID:4944
- C:\Windows\System\HFKqtNV.exe
  C:\Windows\System\HFKqtNV.exe
  2⤵
  PID:2840
- C:\Windows\System\XeNQDEh.exe
  C:\Windows\System\XeNQDEh.exe
  2⤵
  PID:4072
- C:\Windows\System\OmNZWlu.exe
  C:\Windows\System\OmNZWlu.exe
  2⤵
  PID:64
- C:\Windows\System\wJAOhkn.exe
  C:\Windows\System\wJAOhkn.exe
  2⤵
  PID:1820
- C:\Windows\System\pkJtjeH.exe
  C:\Windows\System\pkJtjeH.exe
  2⤵
  PID:2204
- C:\Windows\System\IeYGMrL.exe
  C:\Windows\System\IeYGMrL.exe
  2⤵
  PID:1848
- C:\Windows\System\bhePIYK.exe
  C:\Windows\System\bhePIYK.exe
  2⤵
  PID:5116
- C:\Windows\System\piVJydC.exe
  C:\Windows\System\piVJydC.exe
  2⤵
  PID:1220
- C:\Windows\System\hWAOTJs.exe
  C:\Windows\System\hWAOTJs.exe
  2⤵
  PID:864
- C:\Windows\System\sFFuUiY.exe
  C:\Windows\System\sFFuUiY.exe
  2⤵
  PID:4280
- C:\Windows\System\NVujFRd.exe
  C:\Windows\System\NVujFRd.exe
  2⤵
  PID:4240
- C:\Windows\System\QdkMphn.exe
  C:\Windows\System\QdkMphn.exe
  2⤵
  PID:5100
- C:\Windows\System\IhsmBBh.exe
  C:\Windows\System\IhsmBBh.exe
  2⤵
  PID:4844
- C:\Windows\System\VWWwCOw.exe
  C:\Windows\System\VWWwCOw.exe
  2⤵
  PID:1816
- C:\Windows\System\qJneNHk.exe
  C:\Windows\System\qJneNHk.exe
  2⤵
  PID:5148
- C:\Windows\System\eGJiWei.exe
  C:\Windows\System\eGJiWei.exe
  2⤵
  PID:5176
- C:\Windows\System\QUNfRwT.exe
  C:\Windows\System\QUNfRwT.exe
  2⤵
  PID:5204
- C:\Windows\System\ZXLRvuK.exe
  C:\Windows\System\ZXLRvuK.exe
  2⤵
  PID:5232
- C:\Windows\System\ethudLv.exe
  C:\Windows\System\ethudLv.exe
  2⤵
  PID:5256
- C:\Windows\System\pccKXrf.exe
  C:\Windows\System\pccKXrf.exe
  2⤵
  PID:5284
- C:\Windows\System\iJqqehl.exe
  C:\Windows\System\iJqqehl.exe
  2⤵
  PID:5312
- C:\Windows\System\WETokwm.exe
  C:\Windows\System\WETokwm.exe
  2⤵
  PID:5340
- C:\Windows\System\wzrfcIN.exe
  C:\Windows\System\wzrfcIN.exe
  2⤵
  PID:5368
- C:\Windows\System\zyDZqCy.exe
  C:\Windows\System\zyDZqCy.exe
  2⤵
  PID:5400
- C:\Windows\System\kHlPpxy.exe
  C:\Windows\System\kHlPpxy.exe
  2⤵
  PID:5424
- C:\Windows\System\eFauCGr.exe
  C:\Windows\System\eFauCGr.exe
  2⤵
  PID:5452
- C:\Windows\System\XExlDbv.exe
  C:\Windows\System\XExlDbv.exe
  2⤵
  PID:5480
- C:\Windows\System\pqEqmdl.exe
  C:\Windows\System\pqEqmdl.exe
  2⤵
  PID:5508
- C:\Windows\System\ZRbNmww.exe
  C:\Windows\System\ZRbNmww.exe
  2⤵
  PID:5536
- C:\Windows\System\fLGbylZ.exe
  C:\Windows\System\fLGbylZ.exe
  2⤵
  PID:5568
- C:\Windows\System\gDErTmI.exe
  C:\Windows\System\gDErTmI.exe
  2⤵
  PID:5596
- C:\Windows\System\aUmWGZX.exe
  C:\Windows\System\aUmWGZX.exe
  2⤵
  PID:5620
- C:\Windows\System\XllKzWX.exe
  C:\Windows\System\XllKzWX.exe
  2⤵
  PID:5648
- C:\Windows\System\TrNmonv.exe
  C:\Windows\System\TrNmonv.exe
  2⤵
  PID:5676
- C:\Windows\System\owXvATo.exe
  C:\Windows\System\owXvATo.exe
  2⤵
  PID:5708
- C:\Windows\System\IywIdrt.exe
  C:\Windows\System\IywIdrt.exe
  2⤵
  PID:5732
- C:\Windows\System\SzZeQZp.exe
  C:\Windows\System\SzZeQZp.exe
  2⤵
  PID:5764
- C:\Windows\System\RWrPeJL.exe
  C:\Windows\System\RWrPeJL.exe
  2⤵
  PID:5788
- C:\Windows\System\NsHYkHj.exe
  C:\Windows\System\NsHYkHj.exe
  2⤵
  PID:5820
- C:\Windows\System\mnbeWWJ.exe
  C:\Windows\System\mnbeWWJ.exe
  2⤵
  PID:5844
- C:\Windows\System\aUqgQbw.exe
  C:\Windows\System\aUqgQbw.exe
  2⤵
  PID:5872
- C:\Windows\System\euQkWui.exe
  C:\Windows\System\euQkWui.exe
  2⤵
  PID:5900
- C:\Windows\System\klLHhvt.exe
  C:\Windows\System\klLHhvt.exe
  2⤵
  PID:5928
- C:\Windows\System\WnFLagL.exe
  C:\Windows\System\WnFLagL.exe
  2⤵
  PID:5956
- C:\Windows\System\ZuPdlvT.exe
  C:\Windows\System\ZuPdlvT.exe
  2⤵
  PID:5984
- C:\Windows\System\ZWXYFbc.exe
  C:\Windows\System\ZWXYFbc.exe
  2⤵
  PID:6048
- C:\Windows\System\PuBdstr.exe
  C:\Windows\System\PuBdstr.exe
  2⤵
  PID:6064
- C:\Windows\System\pDgzGlE.exe
  C:\Windows\System\pDgzGlE.exe
  2⤵
  PID:6080
- C:\Windows\System\oSynnxB.exe
  C:\Windows\System\oSynnxB.exe
  2⤵
  PID:6108
- C:\Windows\System\dfNkbTS.exe
  C:\Windows\System\dfNkbTS.exe
  2⤵
  PID:6136
- C:\Windows\System\xpvoPAy.exe
  C:\Windows\System\xpvoPAy.exe
  2⤵
  PID:3640
- C:\Windows\System\YfHuMSO.exe
  C:\Windows\System\YfHuMSO.exe
  2⤵
  PID:3448
- C:\Windows\System\RzkaUiM.exe
  C:\Windows\System\RzkaUiM.exe
  2⤵
  PID:4344
- C:\Windows\System\HYKCiDD.exe
  C:\Windows\System\HYKCiDD.exe
  2⤵
  PID:4788
- C:\Windows\System\oekZWKg.exe
  C:\Windows\System\oekZWKg.exe
  2⤵
  PID:1460
- C:\Windows\System\GdljGbX.exe
  C:\Windows\System\GdljGbX.exe
  2⤵
  PID:1824
- C:\Windows\System\mjHZyuT.exe
  C:\Windows\System\mjHZyuT.exe
  2⤵
  PID:2608
- C:\Windows\System\hRXPIzc.exe
  C:\Windows\System\hRXPIzc.exe
  2⤵
  PID:1556
- C:\Windows\System\LgnXIfN.exe
  C:\Windows\System\LgnXIfN.exe
  2⤵
  PID:4184
- C:\Windows\System\dLVeFnj.exe
  C:\Windows\System\dLVeFnj.exe
  2⤵
  PID:5184
- C:\Windows\System\uefqbZi.exe
  C:\Windows\System\uefqbZi.exe
  2⤵
  PID:5240
- C:\Windows\System\nXWqkoW.exe
  C:\Windows\System\nXWqkoW.exe
  2⤵
  PID:5300
- C:\Windows\System\RJsLCHO.exe
  C:\Windows\System\RJsLCHO.exe
  2⤵
  PID:5380
- C:\Windows\System\qrlESxu.exe
  C:\Windows\System\qrlESxu.exe
  2⤵
  PID:5440
- C:\Windows\System\NBLuPSv.exe
  C:\Windows\System\NBLuPSv.exe
  2⤵
  PID:5496
- C:\Windows\System\PJTwrcG.exe
  C:\Windows\System\PJTwrcG.exe
  2⤵
  PID:5576
- C:\Windows\System\IXvCEwB.exe
  C:\Windows\System\IXvCEwB.exe
  2⤵
  PID:5636
- C:\Windows\System\SMnXovq.exe
  C:\Windows\System\SMnXovq.exe
  2⤵
  PID:5692
- C:\Windows\System\lfBxyWn.exe
  C:\Windows\System\lfBxyWn.exe
  2⤵
  PID:5752
- C:\Windows\System\acNFvEo.exe
  C:\Windows\System\acNFvEo.exe
  2⤵
  PID:5808
- C:\Windows\System\MIRIdfk.exe
  C:\Windows\System\MIRIdfk.exe
  2⤵
  PID:5888
- C:\Windows\System\XmvSQQZ.exe
  C:\Windows\System\XmvSQQZ.exe
  2⤵
  PID:5948
- C:\Windows\System\cwvsFyx.exe
  C:\Windows\System\cwvsFyx.exe
  2⤵
  PID:6016
- C:\Windows\System\poLdUka.exe
  C:\Windows\System\poLdUka.exe
  2⤵
  PID:6072
- C:\Windows\System\SufQMWl.exe
  C:\Windows\System\SufQMWl.exe
  2⤵
  PID:4000
- C:\Windows\System\WZqoTeq.exe
  C:\Windows\System\WZqoTeq.exe
  2⤵
  PID:1428
- C:\Windows\System\muFSlWQ.exe
  C:\Windows\System\muFSlWQ.exe
  2⤵
  PID:2380
- C:\Windows\System\EClBJfE.exe
  C:\Windows\System\EClBJfE.exe
  2⤵
  PID:1140
- C:\Windows\System\TqJsdrS.exe
  C:\Windows\System\TqJsdrS.exe
  2⤵
  PID:5136
- C:\Windows\System\XeCfygd.exe
  C:\Windows\System\XeCfygd.exe
  2⤵
  PID:5276
- C:\Windows\System\jaxRGrz.exe
  C:\Windows\System\jaxRGrz.exe
  2⤵
  PID:5416
- C:\Windows\System\DPiTnAV.exe
  C:\Windows\System\DPiTnAV.exe
  2⤵
  PID:5604
- C:\Windows\System\EGxpozn.exe
  C:\Windows\System\EGxpozn.exe
  2⤵
  PID:5744
- C:\Windows\System\yoXJXbd.exe
  C:\Windows\System\yoXJXbd.exe
  2⤵
  PID:6164
- C:\Windows\System\DoBekGM.exe
  C:\Windows\System\DoBekGM.exe
  2⤵
  PID:6200
- C:\Windows\System\byJcAFP.exe
  C:\Windows\System\byJcAFP.exe
  2⤵
  PID:6232
- C:\Windows\System\NsvXKGw.exe
  C:\Windows\System\NsvXKGw.exe
  2⤵
  PID:6260
- C:\Windows\System\vUZpMQD.exe
  C:\Windows\System\vUZpMQD.exe
  2⤵
  PID:6280
- C:\Windows\System\naiopIr.exe
  C:\Windows\System\naiopIr.exe
  2⤵
  PID:6308
- C:\Windows\System\xUEWpwL.exe
  C:\Windows\System\xUEWpwL.exe
  2⤵
  PID:6332
- C:\Windows\System\gXCmNqp.exe
  C:\Windows\System\gXCmNqp.exe
  2⤵
  PID:6360
- C:\Windows\System\GTkqvZl.exe
  C:\Windows\System\GTkqvZl.exe
  2⤵
  PID:6388
- C:\Windows\System\bCKONIY.exe
  C:\Windows\System\bCKONIY.exe
  2⤵
  PID:6416
- C:\Windows\System\sylAtFc.exe
  C:\Windows\System\sylAtFc.exe
  2⤵
  PID:6444
- C:\Windows\System\wPghhVb.exe
  C:\Windows\System\wPghhVb.exe
  2⤵
  PID:6472
- C:\Windows\System\pDRIADm.exe
  C:\Windows\System\pDRIADm.exe
  2⤵
  PID:6500
- C:\Windows\System\BXiyeJK.exe
  C:\Windows\System\BXiyeJK.exe
  2⤵
  PID:6528
- C:\Windows\System\haihrgE.exe
  C:\Windows\System\haihrgE.exe
  2⤵
  PID:6560
- C:\Windows\System\TVHykae.exe
  C:\Windows\System\TVHykae.exe
  2⤵
  PID:6588
- C:\Windows\System\tFOckXp.exe
  C:\Windows\System\tFOckXp.exe
  2⤵
  PID:6612
- C:\Windows\System\WYaKslw.exe
  C:\Windows\System\WYaKslw.exe
  2⤵
  PID:6644
- C:\Windows\System\rqYuFci.exe
  C:\Windows\System\rqYuFci.exe
  2⤵
  PID:6672
- C:\Windows\System\GlLmGib.exe
  C:\Windows\System\GlLmGib.exe
  2⤵
  PID:6700
- C:\Windows\System\WKbMytW.exe
  C:\Windows\System\WKbMytW.exe
  2⤵
  PID:6724
- C:\Windows\System\qpHotkg.exe
  C:\Windows\System\qpHotkg.exe
  2⤵
  PID:6752
- C:\Windows\System\bnngnTG.exe
  C:\Windows\System\bnngnTG.exe
  2⤵
  PID:6780
- C:\Windows\System\sTpcAbe.exe
  C:\Windows\System\sTpcAbe.exe
  2⤵
  PID:6808
- C:\Windows\System\IskUOtF.exe
  C:\Windows\System\IskUOtF.exe
  2⤵
  PID:6836
- C:\Windows\System\ZnHwote.exe
  C:\Windows\System\ZnHwote.exe
  2⤵
  PID:6864
- C:\Windows\System\OOAbmsA.exe
  C:\Windows\System\OOAbmsA.exe
  2⤵
  PID:6896
- C:\Windows\System\WYaqjGl.exe
  C:\Windows\System\WYaqjGl.exe
  2⤵
  PID:6924
- C:\Windows\System\arNMbRg.exe
  C:\Windows\System\arNMbRg.exe
  2⤵
  PID:6952
- C:\Windows\System\ixGFwmi.exe
  C:\Windows\System\ixGFwmi.exe
  2⤵
  PID:6984
- C:\Windows\System\ewGFudC.exe
  C:\Windows\System\ewGFudC.exe
  2⤵
  PID:7008
- C:\Windows\System\MeBldxl.exe
  C:\Windows\System\MeBldxl.exe
  2⤵
  PID:7036
- C:\Windows\System\zwFwYXJ.exe
  C:\Windows\System\zwFwYXJ.exe
  2⤵
  PID:7064
- C:\Windows\System\KsUbDWF.exe
  C:\Windows\System\KsUbDWF.exe
  2⤵
  PID:7092
- C:\Windows\System\wPoyzCV.exe
  C:\Windows\System\wPoyzCV.exe
  2⤵
  PID:7120
- C:\Windows\System\dtBuKTM.exe
  C:\Windows\System\dtBuKTM.exe
  2⤵
  PID:7148
- C:\Windows\System\vWNpLaC.exe
  C:\Windows\System\vWNpLaC.exe
  2⤵
  PID:5836
- C:\Windows\System\CEpztFr.exe
  C:\Windows\System\CEpztFr.exe
  2⤵
  PID:5996
- C:\Windows\System\QXyEuFX.exe
  C:\Windows\System\QXyEuFX.exe
  2⤵
  PID:4440
- C:\Windows\System\AUMQrBw.exe
  C:\Windows\System\AUMQrBw.exe
  2⤵
  PID:464
- C:\Windows\System\zXdyfaF.exe
  C:\Windows\System\zXdyfaF.exe
  2⤵
  PID:4156
- C:\Windows\System\LDitQji.exe
  C:\Windows\System\LDitQji.exe
  2⤵
  PID:5420
- C:\Windows\System\GtHtqgo.exe
  C:\Windows\System\GtHtqgo.exe
  2⤵
  PID:6152
- C:\Windows\System\NyXEggJ.exe
  C:\Windows\System\NyXEggJ.exe
  2⤵
  PID:6276
- C:\Windows\System\lYbyIRC.exe
  C:\Windows\System\lYbyIRC.exe
  2⤵
  PID:6324
- C:\Windows\System\nLUhKEI.exe
  C:\Windows\System\nLUhKEI.exe
  2⤵
  PID:2296
- C:\Windows\System\vFrBJeO.exe
  C:\Windows\System\vFrBJeO.exe
  2⤵
  PID:6408
- C:\Windows\System\tihfaQq.exe
  C:\Windows\System\tihfaQq.exe
  2⤵
  PID:6460
- C:\Windows\System\hvYGTEi.exe
  C:\Windows\System\hvYGTEi.exe
  2⤵
  PID:6516
- C:\Windows\System\SznyTRg.exe
  C:\Windows\System\SznyTRg.exe
  2⤵
  PID:6572
- C:\Windows\System\wZmobRA.exe
  C:\Windows\System\wZmobRA.exe
  2⤵
  PID:6604
- C:\Windows\System\vwyrFZe.exe
  C:\Windows\System\vwyrFZe.exe
  2⤵
  PID:6632
- C:\Windows\System\tAdeAcl.exe
  C:\Windows\System\tAdeAcl.exe
  2⤵
  PID:6684
- C:\Windows\System\WcqSUsp.exe
  C:\Windows\System\WcqSUsp.exe
  2⤵
  PID:2816
- C:\Windows\System\zEkVXoN.exe
  C:\Windows\System\zEkVXoN.exe
  2⤵
  PID:6776
- C:\Windows\System\OhtecIQ.exe
  C:\Windows\System\OhtecIQ.exe
  2⤵
  PID:2340
- C:\Windows\System\lFSKtSy.exe
  C:\Windows\System\lFSKtSy.exe
  2⤵
  PID:1380
- C:\Windows\System\pUUsfBX.exe
  C:\Windows\System\pUUsfBX.exe
  2⤵
  PID:6912
- C:\Windows\System\OZwSZBT.exe
  C:\Windows\System\OZwSZBT.exe
  2⤵
  PID:6944
- C:\Windows\System\pYpjPtY.exe
  C:\Windows\System\pYpjPtY.exe
  2⤵
  PID:6996
- C:\Windows\System\uMkAzue.exe
  C:\Windows\System\uMkAzue.exe
  2⤵
  PID:7028
- C:\Windows\System\xehrBjZ.exe
  C:\Windows\System\xehrBjZ.exe
  2⤵
  PID:7084
- C:\Windows\System\qgqwOgd.exe
  C:\Windows\System\qgqwOgd.exe
  2⤵
  PID:7144
- C:\Windows\System\BPBQBQN.exe
  C:\Windows\System\BPBQBQN.exe
  2⤵
  PID:2776
- C:\Windows\System\nxJLzGA.exe
  C:\Windows\System\nxJLzGA.exe
  2⤵
  PID:6104
- C:\Windows\System\KEStxxD.exe
  C:\Windows\System\KEStxxD.exe
  2⤵
  PID:5040
- C:\Windows\System\TXfTyqq.exe
  C:\Windows\System\TXfTyqq.exe
  2⤵
  PID:4044
- C:\Windows\System\qiuywLi.exe
  C:\Windows\System\qiuywLi.exe
  2⤵
  PID:5272
- C:\Windows\System\mwTtsTO.exe
  C:\Windows\System\mwTtsTO.exe
  2⤵
  PID:5408
- C:\Windows\System\oXOLebj.exe
  C:\Windows\System\oXOLebj.exe
  2⤵
  PID:4244
- C:\Windows\System\MIMrQpg.exe
  C:\Windows\System\MIMrQpg.exe
  2⤵
  PID:4952
- C:\Windows\System\ZQWSRaJ.exe
  C:\Windows\System\ZQWSRaJ.exe
  2⤵
  PID:5016
- C:\Windows\System\pKBHSDV.exe
  C:\Windows\System\pKBHSDV.exe
  2⤵
  PID:2532
- C:\Windows\System\qHLsObs.exe
  C:\Windows\System\qHLsObs.exe
  2⤵
  PID:6272
- C:\Windows\System\wLwxduN.exe
  C:\Windows\System\wLwxduN.exe
  2⤵
  PID:6348
- C:\Windows\System\qcCFzTG.exe
  C:\Windows\System\qcCFzTG.exe
  2⤵
  PID:6468
- C:\Windows\System\IxUlSNL.exe
  C:\Windows\System\IxUlSNL.exe
  2⤵
  PID:6552
- C:\Windows\System\qGrBddo.exe
  C:\Windows\System\qGrBddo.exe
  2⤵
  PID:6768
- C:\Windows\System\cuhlNjJ.exe
  C:\Windows\System\cuhlNjJ.exe
  2⤵
  PID:6692
- C:\Windows\System\WvjxZyq.exe
  C:\Windows\System\WvjxZyq.exe
  2⤵
  PID:6972
- C:\Windows\System\TdmeSSF.exe
  C:\Windows\System\TdmeSSF.exe
  2⤵
  PID:7056
- C:\Windows\System\cWYoPnP.exe
  C:\Windows\System\cWYoPnP.exe
  2⤵
  PID:7164
- C:\Windows\System\cAhkeMm.exe
  C:\Windows\System\cAhkeMm.exe
  2⤵
  PID:6916
- C:\Windows\System\lPByIHI.exe
  C:\Windows\System\lPByIHI.exe
  2⤵
  PID:2988
- C:\Windows\System\EvayEBt.exe
  C:\Windows\System\EvayEBt.exe
  2⤵
  PID:4224
- C:\Windows\System\ONsMaiT.exe
  C:\Windows\System\ONsMaiT.exe
  2⤵
  PID:2892
- C:\Windows\System\mxZEMfz.exe
  C:\Windows\System\mxZEMfz.exe
  2⤵
  PID:1688
- C:\Windows\System\jAnxZDJ.exe
  C:\Windows\System\jAnxZDJ.exe
  2⤵
  PID:7180
- C:\Windows\System\oiJrFUj.exe
  C:\Windows\System\oiJrFUj.exe
  2⤵
  PID:7204
- C:\Windows\System\iWJxyBR.exe
  C:\Windows\System\iWJxyBR.exe
  2⤵
  PID:7232
- C:\Windows\System\BkZCNqR.exe
  C:\Windows\System\BkZCNqR.exe
  2⤵
  PID:7256
- C:\Windows\System\yeRsyGH.exe
  C:\Windows\System\yeRsyGH.exe
  2⤵
  PID:7284
- C:\Windows\System\dKDgstP.exe
  C:\Windows\System\dKDgstP.exe
  2⤵
  PID:7312
- C:\Windows\System\QTWzHUA.exe
  C:\Windows\System\QTWzHUA.exe
  2⤵
  PID:7340
- C:\Windows\System\zhSUtWK.exe
  C:\Windows\System\zhSUtWK.exe
  2⤵
  PID:7368
- C:\Windows\System\StTGIiS.exe
  C:\Windows\System\StTGIiS.exe
  2⤵
  PID:7400
- C:\Windows\System\vVKQbfj.exe
  C:\Windows\System\vVKQbfj.exe
  2⤵
  PID:7424
- C:\Windows\System\FanvqYe.exe
  C:\Windows\System\FanvqYe.exe
  2⤵
  PID:7456
- C:\Windows\System\wxmltqd.exe
  C:\Windows\System\wxmltqd.exe
  2⤵
  PID:7480
- C:\Windows\System\sqFpVzw.exe
  C:\Windows\System\sqFpVzw.exe
  2⤵
  PID:7512
- C:\Windows\System\MylPSlY.exe
  C:\Windows\System\MylPSlY.exe
  2⤵
  PID:7540
- C:\Windows\System\FdUlEwe.exe
  C:\Windows\System\FdUlEwe.exe
  2⤵
  PID:7568
- C:\Windows\System\UVHGqZW.exe
  C:\Windows\System\UVHGqZW.exe
  2⤵
  PID:7600
- C:\Windows\System\AOJoXDg.exe
  C:\Windows\System\AOJoXDg.exe
  2⤵
  PID:7624
- C:\Windows\System\CnAsJMv.exe
  C:\Windows\System\CnAsJMv.exe
  2⤵
  PID:7652
- C:\Windows\System\kMeqZra.exe
  C:\Windows\System\kMeqZra.exe
  2⤵
  PID:7688
- C:\Windows\System\HewksxY.exe
  C:\Windows\System\HewksxY.exe
  2⤵
  PID:7708
- C:\Windows\System\ZblKhTE.exe
  C:\Windows\System\ZblKhTE.exe
  2⤵
  PID:7736
- C:\Windows\System\nPmbDuw.exe
  C:\Windows\System\nPmbDuw.exe
  2⤵
  PID:7760
- C:\Windows\System\TgesSyG.exe
  C:\Windows\System\TgesSyG.exe
  2⤵
  PID:7784
- C:\Windows\System\VSBJWbL.exe
  C:\Windows\System\VSBJWbL.exe
  2⤵
  PID:7800
- C:\Windows\System\lQnvFAe.exe
  C:\Windows\System\lQnvFAe.exe
  2⤵
  PID:7828
- C:\Windows\System\abvbZYK.exe
  C:\Windows\System\abvbZYK.exe
  2⤵
  PID:7848
- C:\Windows\System\YbPZzSt.exe
  C:\Windows\System\YbPZzSt.exe
  2⤵
  PID:7884
- C:\Windows\System\YwLicXB.exe
  C:\Windows\System\YwLicXB.exe
  2⤵
  PID:7904
- C:\Windows\System\usdbUOc.exe
  C:\Windows\System\usdbUOc.exe
  2⤵
  PID:7928
- C:\Windows\System\VAXqohn.exe
  C:\Windows\System\VAXqohn.exe
  2⤵
  PID:7948
- C:\Windows\System\TMlYIyK.exe
  C:\Windows\System\TMlYIyK.exe
  2⤵
  PID:7988
- C:\Windows\System\OMmzWzY.exe
  C:\Windows\System\OMmzWzY.exe
  2⤵
  PID:8008
- C:\Windows\System\AMHzJLw.exe
  C:\Windows\System\AMHzJLw.exe
  2⤵
  PID:8040
- C:\Windows\System\lVspGgn.exe
  C:\Windows\System\lVspGgn.exe
  2⤵
  PID:8064
- C:\Windows\System\VfJshfm.exe
  C:\Windows\System\VfJshfm.exe
  2⤵
  PID:8088
- C:\Windows\System\PCGzeXn.exe
  C:\Windows\System\PCGzeXn.exe
  2⤵
  PID:8116
- C:\Windows\System\rCrkdGq.exe
  C:\Windows\System\rCrkdGq.exe
  2⤵
  PID:8140
- C:\Windows\System\VcuhKQO.exe
  C:\Windows\System\VcuhKQO.exe
  2⤵
  PID:8164
- C:\Windows\System\zwdVcfh.exe
  C:\Windows\System\zwdVcfh.exe
  2⤵
  PID:8184
- C:\Windows\System\quNxYuN.exe
  C:\Windows\System\quNxYuN.exe
  2⤵
  PID:100
- C:\Windows\System\ZFZGPOc.exe
  C:\Windows\System\ZFZGPOc.exe
  2⤵
  PID:4732
- C:\Windows\System\KSUmaYH.exe
  C:\Windows\System\KSUmaYH.exe
  2⤵
  PID:6664
- C:\Windows\System\tAeFZzB.exe
  C:\Windows\System\tAeFZzB.exe
  2⤵
  PID:7172
- C:\Windows\System\vKtKoQL.exe
  C:\Windows\System\vKtKoQL.exe
  2⤵
  PID:6628
- C:\Windows\System\tJDJFbo.exe
  C:\Windows\System\tJDJFbo.exe
  2⤵
  PID:5976
- C:\Windows\System\MXMhAHX.exe
  C:\Windows\System\MXMhAHX.exe
  2⤵
  PID:7176
- C:\Windows\System\ZbjzoaF.exe
  C:\Windows\System\ZbjzoaF.exe
  2⤵
  PID:7576
- C:\Windows\System\QxmCyxo.exe
  C:\Windows\System\QxmCyxo.exe
  2⤵
  PID:7304
- C:\Windows\System\oIHGxTL.exe
  C:\Windows\System\oIHGxTL.exe
  2⤵
  PID:7772
- C:\Windows\System\YsBeFEN.exe
  C:\Windows\System\YsBeFEN.exe
  2⤵
  PID:7796
- C:\Windows\System\icDYqNI.exe
  C:\Windows\System\icDYqNI.exe
  2⤵
  PID:7392
- C:\Windows\System\rDTGvPU.exe
  C:\Windows\System\rDTGvPU.exe
  2⤵
  PID:7464
- C:\Windows\System\VpvqHwB.exe
  C:\Windows\System\VpvqHwB.exe
  2⤵
  PID:7752
- C:\Windows\System\CFinOIF.exe
  C:\Windows\System\CFinOIF.exe
  2⤵
  PID:7612
- C:\Windows\System\SVojmBL.exe
  C:\Windows\System\SVojmBL.exe
  2⤵
  PID:7684
- C:\Windows\System\NDCjSdi.exe
  C:\Windows\System\NDCjSdi.exe
  2⤵
  PID:7724
- C:\Windows\System\bBLnPXl.exe
  C:\Windows\System\bBLnPXl.exe
  2⤵
  PID:7776
- C:\Windows\System\mqABgrN.exe
  C:\Windows\System\mqABgrN.exe
  2⤵
  PID:7868
- C:\Windows\System\eFlwhXi.exe
  C:\Windows\System\eFlwhXi.exe
  2⤵
  PID:8132
- C:\Windows\System\cxWackF.exe
  C:\Windows\System\cxWackF.exe
  2⤵
  PID:8180
- C:\Windows\System\VimDhHU.exe
  C:\Windows\System\VimDhHU.exe
  2⤵
  PID:7360
- C:\Windows\System\ybSAPyr.exe
  C:\Windows\System\ybSAPyr.exe
  2⤵
  PID:8084
- C:\Windows\System\pAtrJNH.exe
  C:\Windows\System\pAtrJNH.exe
  2⤵
  PID:7496
- C:\Windows\System\dcRLgtn.exe
  C:\Windows\System\dcRLgtn.exe
  2⤵
  PID:7240
- C:\Windows\System\dshGrsX.exe
  C:\Windows\System\dshGrsX.exe
  2⤵
  PID:7140
- C:\Windows\System\pBwDUup.exe
  C:\Windows\System\pBwDUup.exe
  2⤵
  PID:7528
- C:\Windows\System\ZoZwbll.exe
  C:\Windows\System\ZoZwbll.exe
  2⤵
  PID:8216
- C:\Windows\System\sFpxotZ.exe
  C:\Windows\System\sFpxotZ.exe
  2⤵
  PID:8244
- C:\Windows\System\EcCfXkx.exe
  C:\Windows\System\EcCfXkx.exe
  2⤵
  PID:8276
- C:\Windows\System\wYZJjKb.exe
  C:\Windows\System\wYZJjKb.exe
  2⤵
  PID:8304
- C:\Windows\System\RXGNHHW.exe
  C:\Windows\System\RXGNHHW.exe
  2⤵
  PID:8336
- C:\Windows\System\GPfQXyS.exe
  C:\Windows\System\GPfQXyS.exe
  2⤵
  PID:8364
- C:\Windows\System\sbVSswF.exe
  C:\Windows\System\sbVSswF.exe
  2⤵
  PID:8384
- C:\Windows\System\QKsSCam.exe
  C:\Windows\System\QKsSCam.exe
  2⤵
  PID:8416
- C:\Windows\System\hVTYTGO.exe
  C:\Windows\System\hVTYTGO.exe
  2⤵
  PID:8440
- C:\Windows\System\XFMQYGn.exe
  C:\Windows\System\XFMQYGn.exe
  2⤵
  PID:8464
- C:\Windows\System\jPPGkSZ.exe
  C:\Windows\System\jPPGkSZ.exe
  2⤵
  PID:8492
- C:\Windows\System\LxdwNpI.exe
  C:\Windows\System\LxdwNpI.exe
  2⤵
  PID:8520
- C:\Windows\System\QsUWtcM.exe
  C:\Windows\System\QsUWtcM.exe
  2⤵
  PID:8540
- C:\Windows\System\twXKVYs.exe
  C:\Windows\System\twXKVYs.exe
  2⤵
  PID:8576
- C:\Windows\System\LoyYgyr.exe
  C:\Windows\System\LoyYgyr.exe
  2⤵
  PID:8600
- C:\Windows\System\mIYgJgB.exe
  C:\Windows\System\mIYgJgB.exe
  2⤵
  PID:8624
- C:\Windows\System\vqZFtNG.exe
  C:\Windows\System\vqZFtNG.exe
  2⤵
  PID:8648
- C:\Windows\System\gWxTwja.exe
  C:\Windows\System\gWxTwja.exe
  2⤵
  PID:8676
- C:\Windows\System\zwobBJz.exe
  C:\Windows\System\zwobBJz.exe
  2⤵
  PID:8700
- C:\Windows\System\AMVUzHs.exe
  C:\Windows\System\AMVUzHs.exe
  2⤵
  PID:8728
- C:\Windows\System\vAniDUj.exe
  C:\Windows\System\vAniDUj.exe
  2⤵
  PID:8760
- C:\Windows\System\AjdiTGw.exe
  C:\Windows\System\AjdiTGw.exe
  2⤵
  PID:8784
- C:\Windows\System\oRVTCNP.exe
  C:\Windows\System\oRVTCNP.exe
  2⤵
  PID:8816
- C:\Windows\System\DIcFame.exe
  C:\Windows\System\DIcFame.exe
  2⤵
  PID:8836
- C:\Windows\System\zAhJvaK.exe
  C:\Windows\System\zAhJvaK.exe
  2⤵
  PID:8864
- C:\Windows\System\ESUEyaZ.exe
  C:\Windows\System\ESUEyaZ.exe
  2⤵
  PID:8884
- C:\Windows\System\uRztDeL.exe
  C:\Windows\System\uRztDeL.exe
  2⤵
  PID:8912
- C:\Windows\System\AfpByiM.exe
  C:\Windows\System\AfpByiM.exe
  2⤵
  PID:8944
- C:\Windows\System\HVEpNRS.exe
  C:\Windows\System\HVEpNRS.exe
  2⤵
  PID:8972
- C:\Windows\System\uRnKbdG.exe
  C:\Windows\System\uRnKbdG.exe
  2⤵
  PID:8992
- C:\Windows\System\yEdMDza.exe
  C:\Windows\System\yEdMDza.exe
  2⤵
  PID:9020
- C:\Windows\System\zasLCtf.exe
  C:\Windows\System\zasLCtf.exe
  2⤵
  PID:9048
- C:\Windows\System\WugJRjV.exe
  C:\Windows\System\WugJRjV.exe
  2⤵
  PID:9076
- C:\Windows\System\kfxYceO.exe
  C:\Windows\System\kfxYceO.exe
  2⤵
  PID:9096
- C:\Windows\System\fpfeido.exe
  C:\Windows\System\fpfeido.exe
  2⤵
  PID:9116
- C:\Windows\System\AzDJxkP.exe
  C:\Windows\System\AzDJxkP.exe
  2⤵
  PID:9144
- C:\Windows\System\zmWGtMj.exe
  C:\Windows\System\zmWGtMj.exe
  2⤵
  PID:9168
- C:\Windows\System\HcytSzV.exe
  C:\Windows\System\HcytSzV.exe
  2⤵
  PID:9200
- C:\Windows\System\QDFotoq.exe
  C:\Windows\System\QDFotoq.exe
  2⤵
  PID:3444
- C:\Windows\System\mwiCDEW.exe
  C:\Windows\System\mwiCDEW.exe
  2⤵
  PID:7412
- C:\Windows\System\KVPDZQs.exe
  C:\Windows\System\KVPDZQs.exe
  2⤵
  PID:7940
- C:\Windows\System\hHvNwzW.exe
  C:\Windows\System\hHvNwzW.exe
  2⤵
  PID:7856
- C:\Windows\System\RQSTNtb.exe
  C:\Windows\System\RQSTNtb.exe
  2⤵
  PID:2904
- C:\Windows\System\dJLgGvm.exe
  C:\Windows\System\dJLgGvm.exe
  2⤵
  PID:7552
- C:\Windows\System\hNlmMmt.exe
  C:\Windows\System\hNlmMmt.exe
  2⤵
  PID:7672
- C:\Windows\System\aCmDXfV.exe
  C:\Windows\System\aCmDXfV.exe
  2⤵
  PID:8100
- C:\Windows\System\vGQmDND.exe
  C:\Windows\System\vGQmDND.exe
  2⤵
  PID:8488
- C:\Windows\System\hPWXvIx.exe
  C:\Windows\System\hPWXvIx.exe
  2⤵
  PID:8228
- C:\Windows\System\rfUmeBs.exe
  C:\Windows\System\rfUmeBs.exe
  2⤵
  PID:8696
- C:\Windows\System\xyKnRhC.exe
  C:\Windows\System\xyKnRhC.exe
  2⤵
  PID:8436
- C:\Windows\System\WbNBTrg.exe
  C:\Windows\System\WbNBTrg.exe
  2⤵
  PID:8832
- C:\Windows\System\yQtUSTf.exe
  C:\Windows\System\yQtUSTf.exe
  2⤵
  PID:8568
- C:\Windows\System\tmqZgmp.exe
  C:\Windows\System\tmqZgmp.exe
  2⤵
  PID:8296
- C:\Windows\System\mtxnmuv.exe
  C:\Windows\System\mtxnmuv.exe
  2⤵
  PID:8644
- C:\Windows\System\MFwFiAZ.exe
  C:\Windows\System\MFwFiAZ.exe
  2⤵
  PID:9040
- C:\Windows\System\irIqAfx.exe
  C:\Windows\System\irIqAfx.exe
  2⤵
  PID:8804
- C:\Windows\System\yYNNSOR.exe
  C:\Windows\System\yYNNSOR.exe
  2⤵
  PID:8608
- C:\Windows\System\kMorjpB.exe
  C:\Windows\System\kMorjpB.exe
  2⤵
  PID:8672
- C:\Windows\System\uZkKxCZ.exe
  C:\Windows\System\uZkKxCZ.exe
  2⤵
  PID:8716
- C:\Windows\System\bhypjvS.exe
  C:\Windows\System\bhypjvS.exe
  2⤵
  PID:8060
- C:\Windows\System\StuypYW.exe
  C:\Windows\System\StuypYW.exe
  2⤵
  PID:9092
- C:\Windows\System\evqfLaw.exe
  C:\Windows\System\evqfLaw.exe
  2⤵
  PID:9232
- C:\Windows\System\PCLbOmq.exe
  C:\Windows\System\PCLbOmq.exe
  2⤵
  PID:9248
- C:\Windows\System\DxtZqOH.exe
  C:\Windows\System\DxtZqOH.exe
  2⤵
  PID:9284
- C:\Windows\System\lkrsHqo.exe
  C:\Windows\System\lkrsHqo.exe
  2⤵
  PID:9304
- C:\Windows\System\egnTFUb.exe
  C:\Windows\System\egnTFUb.exe
  2⤵
  PID:9332
- C:\Windows\System\erFlgZT.exe
  C:\Windows\System\erFlgZT.exe
  2⤵
  PID:9352
- C:\Windows\System\RxewnAW.exe
  C:\Windows\System\RxewnAW.exe
  2⤵
  PID:9380
- C:\Windows\System\dZLKMKB.exe
  C:\Windows\System\dZLKMKB.exe
  2⤵
  PID:9404
- C:\Windows\System\peregZO.exe
  C:\Windows\System\peregZO.exe
  2⤵
  PID:9424
- C:\Windows\System\IoEuqSC.exe
  C:\Windows\System\IoEuqSC.exe
  2⤵
  PID:9448
- C:\Windows\System\vJxRLgZ.exe
  C:\Windows\System\vJxRLgZ.exe
  2⤵
  PID:9476
- C:\Windows\System\moWeotc.exe
  C:\Windows\System\moWeotc.exe
  2⤵
  PID:9504
- C:\Windows\System\tUGCMbg.exe
  C:\Windows\System\tUGCMbg.exe
  2⤵
  PID:9532
- C:\Windows\System\rcTQSLd.exe
  C:\Windows\System\rcTQSLd.exe
  2⤵
  PID:9552
- C:\Windows\System\uiFJZRH.exe
  C:\Windows\System\uiFJZRH.exe
  2⤵
  PID:9580
- C:\Windows\System\OGbrzcj.exe
  C:\Windows\System\OGbrzcj.exe
  2⤵
  PID:9596
- C:\Windows\System\vPEsQiD.exe
  C:\Windows\System\vPEsQiD.exe
  2⤵
  PID:9624
- C:\Windows\System\VkTXGSU.exe
  C:\Windows\System\VkTXGSU.exe
  2⤵
  PID:9652
- C:\Windows\System\kGPyQQn.exe
  C:\Windows\System\kGPyQQn.exe
  2⤵
  PID:9672
- C:\Windows\System\bNxSwLa.exe
  C:\Windows\System\bNxSwLa.exe
  2⤵
  PID:9700
- C:\Windows\System\EgSFtpu.exe
  C:\Windows\System\EgSFtpu.exe
  2⤵
  PID:9724
- C:\Windows\System\ivCQJpP.exe
  C:\Windows\System\ivCQJpP.exe
  2⤵
  PID:9756
- C:\Windows\System\xEMhwpu.exe
  C:\Windows\System\xEMhwpu.exe
  2⤵
  PID:9796
- C:\Windows\System\tqEktPO.exe
  C:\Windows\System\tqEktPO.exe
  2⤵
  PID:9816
- C:\Windows\System\glzQzRJ.exe
  C:\Windows\System\glzQzRJ.exe
  2⤵
  PID:9844
- C:\Windows\System\Ddvjbrr.exe
  C:\Windows\System\Ddvjbrr.exe
  2⤵
  PID:9864
- C:\Windows\System\OODxGIS.exe
  C:\Windows\System\OODxGIS.exe
  2⤵
  PID:9888
- C:\Windows\System\npRfyIL.exe
  C:\Windows\System\npRfyIL.exe
  2⤵
  PID:9920
- C:\Windows\System\rvNRqNb.exe
  C:\Windows\System\rvNRqNb.exe
  2⤵
  PID:9944
- C:\Windows\System\QDqVcAp.exe
  C:\Windows\System\QDqVcAp.exe
  2⤵
  PID:9972
- C:\Windows\System\rBXsMbL.exe
  C:\Windows\System\rBXsMbL.exe
  2⤵
  PID:9992
- C:\Windows\System\OWjuDZk.exe
  C:\Windows\System\OWjuDZk.exe
  2⤵
  PID:10024
- C:\Windows\System\UTSvXRZ.exe
  C:\Windows\System\UTSvXRZ.exe
  2⤵
  PID:10048
- C:\Windows\System\zUrATeb.exe
  C:\Windows\System\zUrATeb.exe
  2⤵
  PID:10072
- C:\Windows\System\ZEatWJj.exe
  C:\Windows\System\ZEatWJj.exe
  2⤵
  PID:10104
- C:\Windows\System\cehAdCg.exe
  C:\Windows\System\cehAdCg.exe
  2⤵
  PID:10128
- C:\Windows\System\fBRwjyn.exe
  C:\Windows\System\fBRwjyn.exe
  2⤵
  PID:10152
- C:\Windows\System\AcdeLzq.exe
  C:\Windows\System\AcdeLzq.exe
  2⤵
  PID:10180
- C:\Windows\System\tBhweYj.exe
  C:\Windows\System\tBhweYj.exe
  2⤵
  PID:10208
- C:\Windows\System\vqCzGVr.exe
  C:\Windows\System\vqCzGVr.exe
  2⤵
  PID:10232
- C:\Windows\System\BjIOebR.exe
  C:\Windows\System\BjIOebR.exe
  2⤵
  PID:9108
- C:\Windows\System\WHZmtjv.exe
  C:\Windows\System\WHZmtjv.exe
  2⤵
  PID:8880
- C:\Windows\System\HTNYwrt.exe
  C:\Windows\System\HTNYwrt.exe
  2⤵
  PID:8224
- C:\Windows\System\DvburfA.exe
  C:\Windows\System\DvburfA.exe
  2⤵
  PID:7444
- C:\Windows\System\LoSDhyM.exe
  C:\Windows\System\LoSDhyM.exe
  2⤵
  PID:9056
- C:\Windows\System\OPfapxB.exe
  C:\Windows\System\OPfapxB.exe
  2⤵
  PID:3336
- C:\Windows\System\OqVXhYn.exe
  C:\Windows\System\OqVXhYn.exe
  2⤵
  PID:6748
- C:\Windows\System\UuuYILM.exe
  C:\Windows\System\UuuYILM.exe
  2⤵
  PID:9188
- C:\Windows\System\YgIWAoG.exe
  C:\Windows\System\YgIWAoG.exe
  2⤵
  PID:8004
- C:\Windows\System\tPxZubB.exe
  C:\Windows\System\tPxZubB.exe
  2⤵
  PID:7300
- C:\Windows\System\njqJkDO.exe
  C:\Windows\System\njqJkDO.exe
  2⤵
  PID:7524
- C:\Windows\System\OCYVIgY.exe
  C:\Windows\System\OCYVIgY.exe
  2⤵
  PID:8124
- C:\Windows\System\HEdLVYF.exe
  C:\Windows\System\HEdLVYF.exe
  2⤵
  PID:9712
- C:\Windows\System\jaiFmQr.exe
  C:\Windows\System\jaiFmQr.exe
  2⤵
  PID:8764
- C:\Windows\System\SacMQba.exe
  C:\Windows\System\SacMQba.exe
  2⤵
  PID:9376
- C:\Windows\System\AlbXnAB.exe
  C:\Windows\System\AlbXnAB.exe
  2⤵
  PID:8392
- C:\Windows\System\JPDddCc.exe
  C:\Windows\System\JPDddCc.exe
  2⤵
  PID:9468
- C:\Windows\System\AwwaCqo.exe
  C:\Windows\System\AwwaCqo.exe
  2⤵
  PID:8692
- C:\Windows\System\jxidcht.exe
  C:\Windows\System\jxidcht.exe
  2⤵
  PID:9564
- C:\Windows\System\LYGLSok.exe
  C:\Windows\System\LYGLSok.exe
  2⤵
  PID:10016
- C:\Windows\System\mONFvvc.exe
  C:\Windows\System\mONFvvc.exe
  2⤵
  PID:9260
- C:\Windows\System\UhxmQHx.exe
  C:\Windows\System\UhxmQHx.exe
  2⤵
  PID:9320
- C:\Windows\System\fWHWcpU.exe
  C:\Windows\System\fWHWcpU.exe
  2⤵
  PID:9364
- C:\Windows\System\jovgRsz.exe
  C:\Windows\System\jovgRsz.exe
  2⤵
  PID:9416
- C:\Windows\System\ATqxhVB.exe
  C:\Windows\System\ATqxhVB.exe
  2⤵
  PID:10244
- C:\Windows\System\DXdjGwo.exe
  C:\Windows\System\DXdjGwo.exe
  2⤵
  PID:10260
- C:\Windows\System\uxIYbNS.exe
  C:\Windows\System\uxIYbNS.exe
  2⤵
  PID:10280
- C:\Windows\System\dwLtrTb.exe
  C:\Windows\System\dwLtrTb.exe
  2⤵
  PID:10300
- C:\Windows\System\zOoJfgK.exe
  C:\Windows\System\zOoJfgK.exe
  2⤵
  PID:10328
- C:\Windows\System\CLusvwG.exe
  C:\Windows\System\CLusvwG.exe
  2⤵
  PID:10352
- C:\Windows\System\iEowEiT.exe
  C:\Windows\System\iEowEiT.exe
  2⤵
  PID:10372
- C:\Windows\System\MbrSrxe.exe
  C:\Windows\System\MbrSrxe.exe
  2⤵
  PID:10400
- C:\Windows\System\SZVuECi.exe
  C:\Windows\System\SZVuECi.exe
  2⤵
  PID:10428
- C:\Windows\System\EnilYRx.exe
  C:\Windows\System\EnilYRx.exe
  2⤵
  PID:10452
- C:\Windows\System\azseXYp.exe
  C:\Windows\System\azseXYp.exe
  2⤵
  PID:10476
- C:\Windows\System\ggnakgV.exe
  C:\Windows\System\ggnakgV.exe
  2⤵
  PID:10500
- C:\Windows\System\viFkBxe.exe
  C:\Windows\System\viFkBxe.exe
  2⤵
  PID:10520
- C:\Windows\System\VGVcjzy.exe
  C:\Windows\System\VGVcjzy.exe
  2⤵
  PID:10536
- C:\Windows\System\gdlqXiP.exe
  C:\Windows\System\gdlqXiP.exe
  2⤵
  PID:10556
- C:\Windows\System\aimzGxY.exe
  C:\Windows\System\aimzGxY.exe
  2⤵
  PID:10580
- C:\Windows\System\CzjXiyq.exe
  C:\Windows\System\CzjXiyq.exe
  2⤵
  PID:10600
- C:\Windows\System\GqYiOLQ.exe
  C:\Windows\System\GqYiOLQ.exe
  2⤵
  PID:10632
- C:\Windows\System\aAAonha.exe
  C:\Windows\System\aAAonha.exe
  2⤵
  PID:10664
- C:\Windows\System\swkIyzD.exe
  C:\Windows\System\swkIyzD.exe
  2⤵
  PID:10688
- C:\Windows\System\zxXXocB.exe
  C:\Windows\System\zxXXocB.exe
  2⤵
  PID:10712
- C:\Windows\System\xOaQjgy.exe
  C:\Windows\System\xOaQjgy.exe
  2⤵
  PID:10736
- C:\Windows\System\wnDdPLm.exe
  C:\Windows\System\wnDdPLm.exe
  2⤵
  PID:10752
- C:\Windows\System\jTiilvr.exe
  C:\Windows\System\jTiilvr.exe
  2⤵
  PID:10780
- C:\Windows\System\ZzPcmhz.exe
  C:\Windows\System\ZzPcmhz.exe
  2⤵
  PID:10804
- C:\Windows\System\QLOiedQ.exe
  C:\Windows\System\QLOiedQ.exe
  2⤵
  PID:10828
- C:\Windows\System\CYdiZve.exe
  C:\Windows\System\CYdiZve.exe
  2⤵
  PID:10860
- C:\Windows\System\RLPqztc.exe
  C:\Windows\System\RLPqztc.exe
  2⤵
  PID:10880
- C:\Windows\System\tGTamVP.exe
  C:\Windows\System\tGTamVP.exe
  2⤵
  PID:10908
- C:\Windows\System\bRgitwo.exe
  C:\Windows\System\bRgitwo.exe
  2⤵
  PID:10928
- C:\Windows\System\NZdGkJv.exe
  C:\Windows\System\NZdGkJv.exe
  2⤵
  PID:10948
- C:\Windows\System\JVeSbVX.exe
  C:\Windows\System\JVeSbVX.exe
  2⤵
  PID:10972
- C:\Windows\System\yZLyXIw.exe
  C:\Windows\System\yZLyXIw.exe
  2⤵
  PID:11000
- C:\Windows\System\zSFMTDW.exe
  C:\Windows\System\zSFMTDW.exe
  2⤵
  PID:11020
- C:\Windows\System\tmzqYjs.exe
  C:\Windows\System\tmzqYjs.exe
  2⤵
  PID:11052
- C:\Windows\System\EeRQgoU.exe
  C:\Windows\System\EeRQgoU.exe
  2⤵
  PID:11072
- C:\Windows\System\ercbEau.exe
  C:\Windows\System\ercbEau.exe
  2⤵
  PID:11096
- C:\Windows\System\SIBIaAJ.exe
  C:\Windows\System\SIBIaAJ.exe
  2⤵
  PID:11124
- C:\Windows\System\haHfnMB.exe
  C:\Windows\System\haHfnMB.exe
  2⤵
  PID:11156
- C:\Windows\System\dQDwlXO.exe
  C:\Windows\System\dQDwlXO.exe
  2⤵
  PID:11184
- C:\Windows\System\MTtQuVx.exe
  C:\Windows\System\MTtQuVx.exe
  2⤵
  PID:11208
- C:\Windows\System\LWOXuah.exe
  C:\Windows\System\LWOXuah.exe
  2⤵
  PID:11232
- C:\Windows\System\ROTIwgk.exe
  C:\Windows\System\ROTIwgk.exe
  2⤵
  PID:11256
- C:\Windows\System\KJRDhZn.exe
  C:\Windows\System\KJRDhZn.exe
  2⤵
  PID:9908
- C:\Windows\System\AvwpuWD.exe
  C:\Windows\System\AvwpuWD.exe
  2⤵
  PID:9612
- C:\Windows\System\IIuHnVM.exe
  C:\Windows\System\IIuHnVM.exe
  2⤵
  PID:10008
- C:\Windows\System\NNzaVxe.exe
  C:\Windows\System\NNzaVxe.exe
  2⤵
  PID:10096
- C:\Windows\System\XqrfKUk.exe
  C:\Windows\System\XqrfKUk.exe
  2⤵
  PID:9268
- C:\Windows\System\EWVKHgX.exe
  C:\Windows\System\EWVKHgX.exe
  2⤵
  PID:9752
- C:\Windows\System\mnukKqp.exe
  C:\Windows\System\mnukKqp.exe
  2⤵
  PID:9776
- C:\Windows\System\CEkpsoi.exe
  C:\Windows\System\CEkpsoi.exe
  2⤵
  PID:8592
- C:\Windows\System\StuiKdd.exe
  C:\Windows\System\StuiKdd.exe
  2⤵
  PID:9768
- C:\Windows\System\PYgaOHC.exe
  C:\Windows\System\PYgaOHC.exe
  2⤵
  PID:9184
- C:\Windows\System\dhlDApv.exe
  C:\Windows\System\dhlDApv.exe
  2⤵
  PID:8200
- C:\Windows\System\SyztLEn.exe
  C:\Windows\System\SyztLEn.exe
  2⤵
  PID:10344
- C:\Windows\System\VcBpvav.exe
  C:\Windows\System\VcBpvav.exe
  2⤵
  PID:10396
- C:\Windows\System\MpyEAkZ.exe
  C:\Windows\System\MpyEAkZ.exe
  2⤵
  PID:10060
- C:\Windows\System\LZMXHlZ.exe
  C:\Windows\System\LZMXHlZ.exe
  2⤵
  PID:10508
- C:\Windows\System\GbLBTCR.exe
  C:\Windows\System\GbLBTCR.exe
  2⤵
  PID:10228
- C:\Windows\System\ZExAlNz.exe
  C:\Windows\System\ZExAlNz.exe
  2⤵
  PID:9276
- C:\Windows\System\UfrlMZh.exe
  C:\Windows\System\UfrlMZh.exe
  2⤵
  PID:9420
- C:\Windows\System\IWkEyfu.exe
  C:\Windows\System\IWkEyfu.exe
  2⤵
  PID:10252
- C:\Windows\System\XKDKfMY.exe
  C:\Windows\System\XKDKfMY.exe
  2⤵
  PID:10324
- C:\Windows\System\jPdWTMC.exe
  C:\Windows\System\jPdWTMC.exe
  2⤵
  PID:10940
- C:\Windows\System\TMMhuIu.exe
  C:\Windows\System\TMMhuIu.exe
  2⤵
  PID:10936
- C:\Windows\System\TyPPXnw.exe
  C:\Windows\System\TyPPXnw.exe
  2⤵
  PID:11036
- C:\Windows\System\mJaOyXk.exe
  C:\Windows\System\mJaOyXk.exe
  2⤵
  PID:9444
- C:\Windows\System\PBultGb.exe
  C:\Windows\System\PBultGb.exe
  2⤵
  PID:10552
- C:\Windows\System\gHhzKAA.exe
  C:\Windows\System\gHhzKAA.exe
  2⤵
  PID:11276
- C:\Windows\System\GvlciGE.exe
  C:\Windows\System\GvlciGE.exe
  2⤵
  PID:11296
- C:\Windows\System\ymnDLtm.exe
  C:\Windows\System\ymnDLtm.exe
  2⤵
  PID:11316
- C:\Windows\System\WDgLOCK.exe
  C:\Windows\System\WDgLOCK.exe
  2⤵
  PID:11344
- C:\Windows\System\IphATeq.exe
  C:\Windows\System\IphATeq.exe
  2⤵
  PID:11360
- C:\Windows\System\DZoocNe.exe
  C:\Windows\System\DZoocNe.exe
  2⤵
  PID:11376
- C:\Windows\System\XLJxnTM.exe
  C:\Windows\System\XLJxnTM.exe
  2⤵
  PID:11396
- C:\Windows\System\AJyoYlG.exe
  C:\Windows\System\AJyoYlG.exe
  2⤵
  PID:11416
- C:\Windows\System\PmsiQPf.exe
  C:\Windows\System\PmsiQPf.exe
  2⤵
  PID:11440
- C:\Windows\System\rtumymv.exe
  C:\Windows\System\rtumymv.exe
  2⤵
  PID:11472
- C:\Windows\System\lkaaVEl.exe
  C:\Windows\System\lkaaVEl.exe
  2⤵
  PID:11496
- C:\Windows\System\mxmHjvQ.exe
  C:\Windows\System\mxmHjvQ.exe
  2⤵
  PID:11520
- C:\Windows\System\GEBgvxV.exe
  C:\Windows\System\GEBgvxV.exe
  2⤵
  PID:11544
- C:\Windows\System\HntNqEd.exe
  C:\Windows\System\HntNqEd.exe
  2⤵
  PID:11564
- C:\Windows\System\ePTZNxg.exe
  C:\Windows\System\ePTZNxg.exe
  2⤵
  PID:11596
- C:\Windows\System\SIxkLir.exe
  C:\Windows\System\SIxkLir.exe
  2⤵
  PID:11632
- C:\Windows\System\dUEsHst.exe
  C:\Windows\System\dUEsHst.exe
  2⤵
  PID:11652
- C:\Windows\System\iZLdZay.exe
  C:\Windows\System\iZLdZay.exe
  2⤵
  PID:11676
- C:\Windows\System\jdSNGGp.exe
  C:\Windows\System\jdSNGGp.exe
  2⤵
  PID:11696
- C:\Windows\System\wzcHKIW.exe
  C:\Windows\System\wzcHKIW.exe
  2⤵
  PID:11728
- C:\Windows\System\Lmeqgpo.exe
  C:\Windows\System\Lmeqgpo.exe
  2⤵
  PID:11748
- C:\Windows\System\lLIpyII.exe
  C:\Windows\System\lLIpyII.exe
  2⤵
  PID:11784
- C:\Windows\System\fmodwqe.exe
  C:\Windows\System\fmodwqe.exe
  2⤵
  PID:11808
- C:\Windows\System\IqkMYld.exe
  C:\Windows\System\IqkMYld.exe
  2⤵
  PID:11828
- C:\Windows\System\WoUrwih.exe
  C:\Windows\System\WoUrwih.exe
  2⤵
  PID:11856
- C:\Windows\System\XgsFQvL.exe
  C:\Windows\System\XgsFQvL.exe
  2⤵
  PID:11876
- C:\Windows\System\ZUgRpUC.exe
  C:\Windows\System\ZUgRpUC.exe
  2⤵
  PID:11904
- C:\Windows\System\fqiOfSB.exe
  C:\Windows\System\fqiOfSB.exe
  2⤵
  PID:11936
- C:\Windows\System\uQaOlhL.exe
  C:\Windows\System\uQaOlhL.exe
  2⤵
  PID:11952
- C:\Windows\System\jnvMxgb.exe
  C:\Windows\System\jnvMxgb.exe
  2⤵
  PID:11976
- C:\Windows\System\mRhQmoc.exe
  C:\Windows\System\mRhQmoc.exe
  2⤵
  PID:11996
- C:\Windows\System\ovayqQE.exe
  C:\Windows\System\ovayqQE.exe
  2⤵
  PID:12028
- C:\Windows\System\QzLvlDL.exe
  C:\Windows\System\QzLvlDL.exe
  2⤵
  PID:12044
- C:\Windows\System\OFPPAzH.exe
  C:\Windows\System\OFPPAzH.exe
  2⤵
  PID:12060
- C:\Windows\System\JdWKuRN.exe
  C:\Windows\System\JdWKuRN.exe
  2⤵
  PID:12076
- C:\Windows\System\TiDgNCG.exe
  C:\Windows\System\TiDgNCG.exe
  2⤵
  PID:12100
- C:\Windows\System\dnkkpKG.exe
  C:\Windows\System\dnkkpKG.exe
  2⤵
  PID:12120
- C:\Windows\System\ITeAdml.exe
  C:\Windows\System\ITeAdml.exe
  2⤵
  PID:12148
- C:\Windows\System\AaLGwIk.exe
  C:\Windows\System\AaLGwIk.exe
  2⤵
  PID:12172
- C:\Windows\System\GkZuVZi.exe
  C:\Windows\System\GkZuVZi.exe
  2⤵
  PID:12192
- C:\Windows\System\YoXfhPV.exe
  C:\Windows\System\YoXfhPV.exe
  2⤵
  PID:12220
- C:\Windows\System\vlgZdaP.exe
  C:\Windows\System\vlgZdaP.exe
  2⤵
  PID:12248
- C:\Windows\System\suOwajQ.exe
  C:\Windows\System\suOwajQ.exe
  2⤵
  PID:12280
- C:\Windows\System\kwBoJyP.exe
  C:\Windows\System\kwBoJyP.exe
  2⤵
  PID:10648
- C:\Windows\System\ltDbpWc.exe
  C:\Windows\System\ltDbpWc.exe
  2⤵
  PID:10676
- C:\Windows\System\qSkODFL.exe
  C:\Windows\System\qSkODFL.exe
  2⤵
  PID:8272
- C:\Windows\System\etcWMnr.exe
  C:\Windows\System\etcWMnr.exe
  2⤵
  PID:10256
- C:\Windows\System\mlaxLZV.exe
  C:\Windows\System\mlaxLZV.exe
  2⤵
  PID:10292
- C:\Windows\System\PuEpHzi.exe
  C:\Windows\System\PuEpHzi.exe
  2⤵
  PID:10812
- C:\Windows\System\xpqDpMW.exe
  C:\Windows\System\xpqDpMW.exe
  2⤵
  PID:10856
- C:\Windows\System\wYakrRH.exe
  C:\Windows\System\wYakrRH.exe
  2⤵
  PID:10896
- C:\Windows\System\ZpTaoVn.exe
  C:\Windows\System\ZpTaoVn.exe
  2⤵
  PID:9964
- C:\Windows\System\xRccCcv.exe
  C:\Windows\System\xRccCcv.exe
  2⤵
  PID:10448
- C:\Windows\System\tBdMyoM.exe
  C:\Windows\System\tBdMyoM.exe
  2⤵
  PID:10588
- C:\Windows\System\duJTVya.exe
  C:\Windows\System\duJTVya.exe
  2⤵
  PID:10732
- C:\Windows\System\MpneIwS.exe
  C:\Windows\System\MpneIwS.exe
  2⤵
  PID:10460
- C:\Windows\System\xSguGjY.exe
  C:\Windows\System\xSguGjY.exe
  2⤵
  PID:11176
- C:\Windows\System\MfhEARj.exe
  C:\Windows\System\MfhEARj.exe
  2⤵
  PID:11312
- C:\Windows\System\pEguuHW.exe
  C:\Windows\System\pEguuHW.exe
  2⤵
  PID:8352
- C:\Windows\System\iQOMjCz.exe
  C:\Windows\System\iQOMjCz.exe
  2⤵
  PID:10084
- C:\Windows\System\XxwWGEn.exe
  C:\Windows\System\XxwWGEn.exe
  2⤵
  PID:11504
- C:\Windows\System\WERCeTW.exe
  C:\Windows\System\WERCeTW.exe
  2⤵
  PID:11528
- C:\Windows\System\kfpoyTn.exe
  C:\Windows\System\kfpoyTn.exe
  2⤵
  PID:11604
- C:\Windows\System\CGeKTvi.exe
  C:\Windows\System\CGeKTvi.exe
  2⤵
  PID:11672
- C:\Windows\System\vibcyNd.exe
  C:\Windows\System\vibcyNd.exe
  2⤵
  PID:11768
- C:\Windows\System\UorGAfb.exe
  C:\Windows\System\UorGAfb.exe
  2⤵
  PID:10220
- C:\Windows\System\RuZuKlr.exe
  C:\Windows\System\RuZuKlr.exe
  2⤵
  PID:11028
- C:\Windows\System\zxRznTT.exe
  C:\Windows\System\zxRznTT.exe
  2⤵
  PID:11868
- C:\Windows\System\TVvvCoz.exe
  C:\Windows\System\TVvvCoz.exe
  2⤵
  PID:11012
- C:\Windows\System\lSfPpWm.exe
  C:\Windows\System\lSfPpWm.exe
  2⤵
  PID:11896
- C:\Windows\System\ZjwVWUX.exe
  C:\Windows\System\ZjwVWUX.exe
  2⤵
  PID:11944
- C:\Windows\System\sOjIytj.exe
  C:\Windows\System\sOjIytj.exe
  2⤵
  PID:12012
- C:\Windows\System\CFmPXGh.exe
  C:\Windows\System\CFmPXGh.exe
  2⤵
  PID:12304
- C:\Windows\System\nEsxOns.exe
  C:\Windows\System\nEsxOns.exe
  2⤵
  PID:12328
- C:\Windows\System\ZRWKluq.exe
  C:\Windows\System\ZRWKluq.exe
  2⤵
  PID:12352
- C:\Windows\System\NjJvUVR.exe
  C:\Windows\System\NjJvUVR.exe
  2⤵
  PID:12372
- C:\Windows\System\kxUTvGI.exe
  C:\Windows\System\kxUTvGI.exe
  2⤵
  PID:12392
- C:\Windows\System\aLLLYds.exe
  C:\Windows\System\aLLLYds.exe
  2⤵
  PID:12412
- C:\Windows\System\eKAzmYX.exe
  C:\Windows\System\eKAzmYX.exe
  2⤵
  PID:12440
- C:\Windows\System\GJQVwvA.exe
  C:\Windows\System\GJQVwvA.exe
  2⤵
  PID:12464
- C:\Windows\System\OSGhnsk.exe
  C:\Windows\System\OSGhnsk.exe
  2⤵
  PID:12480
- C:\Windows\System\MJDjJOF.exe
  C:\Windows\System\MJDjJOF.exe
  2⤵
  PID:12512
- C:\Windows\System\JFddnmZ.exe
  C:\Windows\System\JFddnmZ.exe
  2⤵
  PID:12536
- C:\Windows\System\QpGcjxf.exe
  C:\Windows\System\QpGcjxf.exe
  2⤵
  PID:12564
- C:\Windows\System\WNHWZnO.exe
  C:\Windows\System\WNHWZnO.exe
  2⤵
  PID:12584
- C:\Windows\System\VWfsTMK.exe
  C:\Windows\System\VWfsTMK.exe
  2⤵
  PID:12612
- C:\Windows\System\xmOORLD.exe
  C:\Windows\System\xmOORLD.exe
  2⤵
  PID:12636
- C:\Windows\System\rVSuIEb.exe
  C:\Windows\System\rVSuIEb.exe
  2⤵
  PID:12664
- C:\Windows\System\LturPXd.exe
  C:\Windows\System\LturPXd.exe
  2⤵
  PID:12684
- C:\Windows\System\QjCuvFO.exe
  C:\Windows\System\QjCuvFO.exe
  2⤵
  PID:12712
- C:\Windows\System\laSiLwn.exe
  C:\Windows\System\laSiLwn.exe
  2⤵
  PID:12732
- C:\Windows\System\LblpBzq.exe
  C:\Windows\System\LblpBzq.exe
  2⤵
  PID:12752
- C:\Windows\System\KnXITlv.exe
  C:\Windows\System\KnXITlv.exe
  2⤵
  PID:12772
- C:\Windows\System\puybUuG.exe
  C:\Windows\System\puybUuG.exe
  2⤵
  PID:12800
- C:\Windows\System\YJyLaAV.exe
  C:\Windows\System\YJyLaAV.exe
  2⤵
  PID:12820
- C:\Windows\System\mZeaTnH.exe
  C:\Windows\System\mZeaTnH.exe
  2⤵
  PID:12836
- C:\Windows\System\lljOcIW.exe
  C:\Windows\System\lljOcIW.exe
  2⤵
  PID:12864
- C:\Windows\System\SWMMepi.exe
  C:\Windows\System\SWMMepi.exe
  2⤵
  PID:12888
- C:\Windows\System\zDgFeLf.exe
  C:\Windows\System\zDgFeLf.exe
  2⤵
  PID:12912
- C:\Windows\System\MpIAuJJ.exe
  C:\Windows\System\MpIAuJJ.exe
  2⤵
  PID:12940
- C:\Windows\System\ebiujee.exe
  C:\Windows\System\ebiujee.exe
  2⤵
  PID:13256
- C:\Windows\System\nzngQzk.exe
  C:\Windows\System\nzngQzk.exe
  2⤵
  PID:13272
- C:\Windows\System\sKWtaLr.exe
  C:\Windows\System\sKWtaLr.exe
  2⤵
  PID:13296
- C:\Windows\System\HrjCBoa.exe
  C:\Windows\System\HrjCBoa.exe
  2⤵
  PID:10544
- C:\Windows\System\TduUlIc.exe
  C:\Windows\System\TduUlIc.exe
  2⤵
  PID:11172
- C:\Windows\System\rXTlxji.exe
  C:\Windows\System\rXTlxji.exe
  2⤵
  PID:12116
- C:\Windows\System\mrYqBif.exe
  C:\Windows\System\mrYqBif.exe
  2⤵
  PID:12160
- C:\Windows\System\RZbGpxH.exe
  C:\Windows\System\RZbGpxH.exe
  2⤵
  PID:11384
- C:\Windows\System\LIsHvOq.exe
  C:\Windows\System\LIsHvOq.exe
  2⤵
  PID:12216
- C:\Windows\System\dfJopxA.exe
  C:\Windows\System\dfJopxA.exe
  2⤵
  PID:10620
- C:\Windows\System\bHaNiBs.exe
  C:\Windows\System\bHaNiBs.exe
  2⤵
  PID:10040
- C:\Windows\System\oGcVPfC.exe
  C:\Windows\System\oGcVPfC.exe
  2⤵
  PID:11640
- C:\Windows\System\ekvsCsU.exe
  C:\Windows\System\ekvsCsU.exe
  2⤵
  PID:10192
- C:\Windows\System\tiNtlhi.exe
  C:\Windows\System\tiNtlhi.exe
  2⤵
  PID:11720
- C:\Windows\System\RSCQsnA.exe
  C:\Windows\System\RSCQsnA.exe
  2⤵
  PID:11576
- C:\Windows\System\tIdbDUZ.exe
  C:\Windows\System\tIdbDUZ.exe
  2⤵
  PID:11692
- C:\Windows\System\bpDuaEk.exe
  C:\Windows\System\bpDuaEk.exe
  2⤵
  PID:10964
- C:\Windows\System\TYewtgZ.exe
  C:\Windows\System\TYewtgZ.exe
  2⤵
  PID:9608
- C:\Windows\System\yGuCeQu.exe
  C:\Windows\System\yGuCeQu.exe
  2⤵
  PID:11924
- C:\Windows\System\NPmFqxq.exe
  C:\Windows\System\NPmFqxq.exe
  2⤵
  PID:12096
- C:\Windows\System\xUOSNvm.exe
  C:\Windows\System\xUOSNvm.exe
  2⤵
  PID:11332
- C:\Windows\System\mNkdQnw.exe
  C:\Windows\System\mNkdQnw.exe
  2⤵
  PID:12236
- C:\Windows\System\bFgSvzm.exe
  C:\Windows\System\bFgSvzm.exe
  2⤵
  PID:9244
- C:\Windows\System\RnQibfy.exe
  C:\Windows\System\RnQibfy.exe
  2⤵
  PID:12796
- C:\Windows\System\QDjAZMh.exe
  C:\Windows\System\QDjAZMh.exe
  2⤵
  PID:11620
- C:\Windows\System\MhAVFzW.exe
  C:\Windows\System\MhAVFzW.exe
  2⤵
  PID:12952
- C:\Windows\System\OtTxsSW.exe
  C:\Windows\System\OtTxsSW.exe
  2⤵
  PID:11228
- C:\Windows\System\johAELO.exe
  C:\Windows\System\johAELO.exe
  2⤵
  PID:13336
- C:\Windows\System\OskMLvX.exe
  C:\Windows\System\OskMLvX.exe
  2⤵
  PID:13372
- C:\Windows\System\vaumxSK.exe
  C:\Windows\System\vaumxSK.exe
  2⤵
  PID:13396
- C:\Windows\System\XdfAKdG.exe
  C:\Windows\System\XdfAKdG.exe
  2⤵
  PID:13448
- C:\Windows\System\YmSaEsr.exe
  C:\Windows\System\YmSaEsr.exe
  2⤵
  PID:13484
- C:\Windows\System\LWMPPZX.exe
  C:\Windows\System\LWMPPZX.exe
  2⤵
  PID:13520
- C:\Windows\System\uxWpOij.exe
  C:\Windows\System\uxWpOij.exe
  2⤵
  PID:13576
- C:\Windows\System\bQZrwAH.exe
  C:\Windows\System\bQZrwAH.exe
  2⤵
  PID:13592
- C:\Windows\System\akOtzzh.exe
  C:\Windows\System\akOtzzh.exe
  2⤵
  PID:13612
- C:\Windows\System\hLJgYqS.exe
  C:\Windows\System\hLJgYqS.exe
  2⤵
  PID:13644
- C:\Windows\System\gUJuULB.exe
  C:\Windows\System\gUJuULB.exe
  2⤵
  PID:13688
- C:\Windows\System\BQbGWxc.exe
  C:\Windows\System\BQbGWxc.exe
  2⤵
  PID:13720
- C:\Windows\System\LzNaHIB.exe
  C:\Windows\System\LzNaHIB.exe
  2⤵
  PID:13740
- C:\Windows\System\yzWnqqM.exe
  C:\Windows\System\yzWnqqM.exe
  2⤵
  PID:13780
- C:\Windows\System\tNMlrkm.exe
  C:\Windows\System\tNMlrkm.exe
  2⤵
  PID:13804
- C:\Windows\System\MuPLOSq.exe
  C:\Windows\System\MuPLOSq.exe
  2⤵
  PID:13828
- C:\Windows\System\SqpQnjV.exe
  C:\Windows\System\SqpQnjV.exe
  2⤵
  PID:13848
- C:\Windows\System\uXLWBFB.exe
  C:\Windows\System\uXLWBFB.exe
  2⤵
  PID:13864
- C:\Windows\System\keiLNVJ.exe
  C:\Windows\System\keiLNVJ.exe
  2⤵
  PID:13888
- C:\Windows\System\mcFMUyY.exe
  C:\Windows\System\mcFMUyY.exe
  2⤵
  PID:13904
- C:\Windows\System\UycJenS.exe
  C:\Windows\System\UycJenS.exe
  2⤵
  PID:13928
- C:\Windows\System\fuefRXv.exe
  C:\Windows\System\fuefRXv.exe
  2⤵
  PID:13952
- C:\Windows\System\TUyudEi.exe
  C:\Windows\System\TUyudEi.exe
  2⤵
  PID:13976
- C:\Windows\System\EGdoGeM.exe
  C:\Windows\System\EGdoGeM.exe
  2⤵
  PID:14016
- C:\Windows\System\IFLnQls.exe
  C:\Windows\System\IFLnQls.exe
  2⤵
  PID:14044
- C:\Windows\System\OMEbyEn.exe
  C:\Windows\System\OMEbyEn.exe
  2⤵
  PID:14072
- C:\Windows\System\uvKMZit.exe
  C:\Windows\System\uvKMZit.exe
  2⤵
  PID:14092
- C:\Windows\System\guJoKEa.exe
  C:\Windows\System\guJoKEa.exe
  2⤵
  PID:14108
- C:\Windows\System\nSxJcdE.exe
  C:\Windows\System\nSxJcdE.exe
  2⤵
  PID:14136
- C:\Windows\System\kvTHIYW.exe
  C:\Windows\System\kvTHIYW.exe
  2⤵
  PID:14152
- C:\Windows\System\nAoiMlL.exe
  C:\Windows\System\nAoiMlL.exe
  2⤵
  PID:14168
- C:\Windows\System\XZFdyOq.exe
  C:\Windows\System\XZFdyOq.exe
  2⤵
  PID:14192
- C:\Windows\System\JzfgcFX.exe
  C:\Windows\System\JzfgcFX.exe
  2⤵
  PID:14216
- C:\Windows\System\pbuswun.exe
  C:\Windows\System\pbuswun.exe
  2⤵
  PID:14240
- C:\Windows\System\gEHfSFl.exe
  C:\Windows\System\gEHfSFl.exe
  2⤵
  PID:14268
- C:\Windows\System\lziHben.exe
  C:\Windows\System\lziHben.exe
  2⤵
  PID:14292
- C:\Windows\System\QAlPtVS.exe
  C:\Windows\System\QAlPtVS.exe
  2⤵
  PID:14312
- C:\Windows\System\xZJawkD.exe
  C:\Windows\System\xZJawkD.exe
  2⤵
  PID:14332
- C:\Windows\System\ChoIgQE.exe
  C:\Windows\System\ChoIgQE.exe
  2⤵
  PID:13056
- C:\Windows\System\KnOdfQj.exe
  C:\Windows\System\KnOdfQj.exe
  2⤵
  PID:11992
- C:\Windows\System\Bnfkgud.exe
  C:\Windows\System\Bnfkgud.exe
  2⤵
  PID:12296
- C:\Windows\System\JbtFvuy.exe
  C:\Windows\System\JbtFvuy.exe
  2⤵
  PID:12360
- C:\Windows\System\dVtbtGR.exe
  C:\Windows\System\dVtbtGR.exe
  2⤵
  PID:12476
- C:\Windows\System\qirPYJZ.exe
  C:\Windows\System\qirPYJZ.exe
  2⤵
  PID:12528
- C:\Windows\System\QNkPaIK.exe
  C:\Windows\System\QNkPaIK.exe
  2⤵
  PID:12208
- C:\Windows\System\iZDDkeT.exe
  C:\Windows\System\iZDDkeT.exe
  2⤵
  PID:12608
- C:\Windows\System\rOXWYGj.exe
  C:\Windows\System\rOXWYGj.exe
  2⤵
  PID:9648
- C:\Windows\System\tFqqECZ.exe
  C:\Windows\System\tFqqECZ.exe
  2⤵
  PID:12108
- C:\Windows\System\vcgvmNr.exe
  C:\Windows\System\vcgvmNr.exe
  2⤵
  PID:11336
- C:\Windows\System\rwbnCxU.exe
  C:\Windows\System\rwbnCxU.exe
  2⤵
  PID:8176
- C:\Windows\System\njOMVym.exe
  C:\Windows\System\njOMVym.exe
  2⤵
  PID:11824
- C:\Windows\System\CmxrrCM.exe
  C:\Windows\System\CmxrrCM.exe
  2⤵
  PID:12896
- C:\Windows\System\cqXTaAJ.exe
  C:\Windows\System\cqXTaAJ.exe
  2⤵
  PID:11328
- C:\Windows\System\qthqOKC.exe
  C:\Windows\System\qthqOKC.exe
  2⤵
  PID:12232
- C:\Windows\System\bxzwuEs.exe
  C:\Windows\System\bxzwuEs.exe
  2⤵
  PID:12264
- C:\Windows\System\kSZTGhz.exe
  C:\Windows\System\kSZTGhz.exe
  2⤵
  PID:12924
- C:\Windows\System\mtsfiGO.exe
  C:\Windows\System\mtsfiGO.exe
  2⤵
  PID:13356
- C:\Windows\System\kNwhyvF.exe
  C:\Windows\System\kNwhyvF.exe
  2⤵
  PID:13072
- C:\Windows\System\cnVokuB.exe
  C:\Windows\System\cnVokuB.exe
  2⤵
  PID:13088
- C:\Windows\System\HxtRgTs.exe
  C:\Windows\System\HxtRgTs.exe
  2⤵
  PID:11120
- C:\Windows\System\eeSDYCH.exe
  C:\Windows\System\eeSDYCH.exe
  2⤵
  PID:13104
- C:\Windows\System\vhrxkCO.exe
  C:\Windows\System\vhrxkCO.exe
  2⤵
  PID:12344
- C:\Windows\System\dsvQCMw.exe
  C:\Windows\System\dsvQCMw.exe
  2⤵
  PID:12364
- C:\Windows\System\uDDjBfJ.exe
  C:\Windows\System\uDDjBfJ.exe
  2⤵
  PID:12404
- C:\Windows\System\MGVcjeu.exe
  C:\Windows\System\MGVcjeu.exe
  2⤵
  PID:13192
- C:\Windows\System\zxSZKFj.exe
  C:\Windows\System\zxSZKFj.exe
  2⤵
  PID:12672
- C:\Windows\System\LkInhMY.exe
  C:\Windows\System\LkInhMY.exe
  2⤵
  PID:14368
- C:\Windows\System\APCqoaT.exe
  C:\Windows\System\APCqoaT.exe
  2⤵
  PID:14404
- C:\Windows\System\fybuLzt.exe
  C:\Windows\System\fybuLzt.exe
  2⤵
  PID:14424
- C:\Windows\System\MkyOcRQ.exe
  C:\Windows\System\MkyOcRQ.exe
  2⤵
  PID:14452
- C:\Windows\System\azxHZED.exe
  C:\Windows\System\azxHZED.exe
  2⤵
  PID:14472
- C:\Windows\System\AhonZrb.exe
  C:\Windows\System\AhonZrb.exe
  2⤵
  PID:14504
- C:\Windows\System\ByrjEoD.exe
  C:\Windows\System\ByrjEoD.exe
  2⤵
  PID:14524
- C:\Windows\System\XXcxuqd.exe
  C:\Windows\System\XXcxuqd.exe
  2⤵
  PID:14544
- C:\Windows\System\mBvEBdW.exe
  C:\Windows\System\mBvEBdW.exe
  2⤵
  PID:14580
- C:\Windows\System\DbUBYVF.exe
  C:\Windows\System\DbUBYVF.exe
  2⤵
  PID:14600
- C:\Windows\System\IetNeAX.exe
  C:\Windows\System\IetNeAX.exe
  2⤵
  PID:14624
- C:\Windows\System\iiGtYRn.exe
  C:\Windows\System\iiGtYRn.exe
  2⤵
  PID:14644
- C:\Windows\System\HaGzWHu.exe
  C:\Windows\System\HaGzWHu.exe
  2⤵
  PID:14660
- C:\Windows\System\zHgptSh.exe
  C:\Windows\System\zHgptSh.exe
  2⤵
  PID:14680
- C:\Windows\System\oHpFChi.exe
  C:\Windows\System\oHpFChi.exe
  2⤵
  PID:14712
- C:\Windows\System\eqFmTbw.exe
  C:\Windows\System\eqFmTbw.exe
  2⤵
  PID:14736
- C:\Windows\System\YEilIrd.exe
  C:\Windows\System\YEilIrd.exe
  2⤵
  PID:14760
- C:\Windows\System\WJIzXDJ.exe
  C:\Windows\System\WJIzXDJ.exe
  2⤵
  PID:14776
- C:\Windows\System\uRqNSJz.exe
  C:\Windows\System\uRqNSJz.exe
  2⤵
  PID:14796
- C:\Windows\System\QTmFlTh.exe
  C:\Windows\System\QTmFlTh.exe
  2⤵
  PID:14816
- C:\Windows\System\hBxYoFN.exe
  C:\Windows\System\hBxYoFN.exe
  2⤵
  PID:14836
- C:\Windows\System\YKHcqtM.exe
  C:\Windows\System\YKHcqtM.exe
  2⤵
  PID:14852
- C:\Windows\System\qemVWkO.exe
  C:\Windows\System\qemVWkO.exe
  2⤵
  PID:14868
- C:\Windows\System\JaCSnjw.exe
  C:\Windows\System\JaCSnjw.exe
  2⤵
  PID:14892
- C:\Windows\System\FAUDmRk.exe
  C:\Windows\System\FAUDmRk.exe
  2⤵
  PID:14920
- C:\Windows\System\PZgdKRE.exe
  C:\Windows\System\PZgdKRE.exe
  2⤵
  PID:14944
- C:\Windows\System\izNEYAY.exe
  C:\Windows\System\izNEYAY.exe
  2⤵
  PID:14964
- C:\Windows\System\HoIQAVt.exe
  C:\Windows\System\HoIQAVt.exe
  2⤵
  PID:14984
- C:\Windows\System\rJfQZYq.exe
  C:\Windows\System\rJfQZYq.exe
  2⤵
  PID:15008
- C:\Windows\System\jeWzBPr.exe
  C:\Windows\System\jeWzBPr.exe
  2⤵
  PID:15024
- C:\Windows\System\ECfbrFb.exe
  C:\Windows\System\ECfbrFb.exe
  2⤵
  PID:15056
- C:\Windows\System\ITKihVP.exe
  C:\Windows\System\ITKihVP.exe
  2⤵
  PID:15076
- C:\Windows\System\SfTbClw.exe
  C:\Windows\System\SfTbClw.exe
  2⤵
  PID:15100
- C:\Windows\System\amRNVtd.exe
  C:\Windows\System\amRNVtd.exe
  2⤵
  PID:15120
- C:\Windows\System\zpvyMNI.exe
  C:\Windows\System\zpvyMNI.exe
  2⤵
  PID:15136
- C:\Windows\System\pLavgBA.exe
  C:\Windows\System\pLavgBA.exe
  2⤵
  PID:15160
- C:\Windows\System\TrhgKyz.exe
  C:\Windows\System\TrhgKyz.exe
  2⤵
  PID:15176
- C:\Windows\System\YZQYIgr.exe
  C:\Windows\System\YZQYIgr.exe
  2⤵
  PID:15196
- C:\Windows\System\cUubyid.exe
  C:\Windows\System\cUubyid.exe
  2⤵
  PID:15220
- C:\Windows\System\apcNlBS.exe
  C:\Windows\System\apcNlBS.exe
  2⤵
  PID:15244
- C:\Windows\System\vkFyEsg.exe
  C:\Windows\System\vkFyEsg.exe
  2⤵
  PID:15260
- C:\Windows\System\ePKIdpl.exe
  C:\Windows\System\ePKIdpl.exe
  2⤵
  PID:15276
- C:\Windows\System\fzWwYQT.exe
  C:\Windows\System\fzWwYQT.exe
  2⤵
  PID:15300
- C:\Windows\System\WqgaosI.exe
  C:\Windows\System\WqgaosI.exe
  2⤵
  PID:15320
- C:\Windows\System\UsJkxnf.exe
  C:\Windows\System\UsJkxnf.exe
  2⤵
  PID:15352
- C:\Windows\System\FUVEwuG.exe
  C:\Windows\System\FUVEwuG.exe
  2⤵
  PID:13844
- C:\Windows\System\DKvWkQc.exe
  C:\Windows\System\DKvWkQc.exe
  2⤵
  PID:12744
- C:\Windows\System\cinlsvy.exe
  C:\Windows\System\cinlsvy.exe
  2⤵
  PID:12788
- C:\Windows\System\iQlArwW.exe
  C:\Windows\System\iQlArwW.exe
  2⤵
  PID:14120
- C:\Windows\System\BoxKKRq.exe
  C:\Windows\System\BoxKKRq.exe
  2⤵
  PID:12848
- C:\Windows\System\CfhrHpE.exe
  C:\Windows\System\CfhrHpE.exe
  2⤵
  PID:14188
- C:\Windows\System\umlItiM.exe
  C:\Windows\System\umlItiM.exe
  2⤵
  PID:14256
- C:\Windows\System\HtAooNZ.exe
  C:\Windows\System\HtAooNZ.exe
  2⤵
  PID:14300
- C:\Windows\System\ObJKBdM.exe
  C:\Windows\System\ObJKBdM.exe
  2⤵
  PID:12964
- C:\Windows\System\NwweicJ.exe
  C:\Windows\System\NwweicJ.exe
  2⤵
  PID:11972
- C:\Windows\System\OUmBfsz.exe
  C:\Windows\System\OUmBfsz.exe
  2⤵
  PID:12504
- C:\Windows\System\IyctCFG.exe
  C:\Windows\System\IyctCFG.exe
  2⤵
  PID:13424
- C:\Windows\System\PXicHYB.exe
  C:\Windows\System\PXicHYB.exe
  2⤵
  PID:12632
- C:\Windows\System\vawvflH.exe
  C:\Windows\System\vawvflH.exe
  2⤵
  PID:12720
- C:\Windows\System\ismrdWU.exe
  C:\Windows\System\ismrdWU.exe
  2⤵
  PID:9956
- C:\Windows\System\VSJirFo.exe
  C:\Windows\System\VSJirFo.exe
  2⤵
  PID:11268
- C:\Windows\System\HexXaQc.exe
  C:\Windows\System\HexXaQc.exe
  2⤵
  PID:11512
- C:\Windows\System\SGsCCIm.exe
  C:\Windows\System\SGsCCIm.exe
  2⤵
  PID:13728
- C:\Windows\System\IkgdtAe.exe
  C:\Windows\System\IkgdtAe.exe
  2⤵
  PID:15372
- C:\Windows\System\MzIjhQT.exe
  C:\Windows\System\MzIjhQT.exe
  2⤵
  PID:15400
- C:\Windows\System\pnkoHPi.exe
  C:\Windows\System\pnkoHPi.exe
  2⤵
  PID:15424
- C:\Windows\System\utcwDBF.exe
  C:\Windows\System\utcwDBF.exe
  2⤵
  PID:15448
- C:\Windows\System\rCiqkfV.exe
  C:\Windows\System\rCiqkfV.exe
  2⤵
  PID:15464
- C:\Windows\System\qIYgZel.exe
  C:\Windows\System\qIYgZel.exe
  2⤵
  PID:15480
- C:\Windows\System\tfqsRsu.exe
  C:\Windows\System\tfqsRsu.exe
  2⤵
  PID:15500
- C:\Windows\System\QtzMLjM.exe
  C:\Windows\System\QtzMLjM.exe
  2⤵
  PID:15528
- C:\Windows\System\wCnlVPO.exe
  C:\Windows\System\wCnlVPO.exe
  2⤵
  PID:15556
- C:\Windows\System\NKoQCuH.exe
  C:\Windows\System\NKoQCuH.exe
  2⤵
  PID:15584
- C:\Windows\System\pfxIbxM.exe
  C:\Windows\System\pfxIbxM.exe
  2⤵
  PID:15600
- C:\Windows\System\lHhwTYb.exe
  C:\Windows\System\lHhwTYb.exe
  2⤵
  PID:15628
- C:\Windows\System\bNwcWmX.exe
  C:\Windows\System\bNwcWmX.exe
  2⤵
  PID:15652
- C:\Windows\System\QyHwfqU.exe
  C:\Windows\System\QyHwfqU.exe
  2⤵
  PID:15684
- C:\Windows\System\fxQoLZs.exe
  C:\Windows\System\fxQoLZs.exe
  2⤵
  PID:15700
- C:\Windows\System\aeuDEOT.exe
  C:\Windows\System\aeuDEOT.exe
  2⤵
  PID:15724
- C:\Windows\System\MIPGDVp.exe
  C:\Windows\System\MIPGDVp.exe
  2⤵
  PID:15752
- C:\Windows\System\WacRKft.exe
  C:\Windows\System\WacRKft.exe
  2⤵
  PID:15768
- C:\Windows\System\tBgWvwY.exe
  C:\Windows\System\tBgWvwY.exe
  2⤵
  PID:15788
- C:\Windows\System\jnspcsH.exe
  C:\Windows\System\jnspcsH.exe
  2⤵
  PID:15808
- C:\Windows\System\voOGHAv.exe
  C:\Windows\System\voOGHAv.exe
  2⤵
  PID:15824
- C:\Windows\System\fQgVhSl.exe
  C:\Windows\System\fQgVhSl.exe
  2⤵
  PID:15856
- C:\Windows\System\CbrOVJN.exe
  C:\Windows\System\CbrOVJN.exe
  2⤵
  PID:15880
- C:\Windows\System\RvXxTiA.exe
  C:\Windows\System\RvXxTiA.exe
  2⤵
  PID:15896
- C:\Windows\System\aGIFSWO.exe
  C:\Windows\System\aGIFSWO.exe
  2⤵
  PID:15912
- C:\Windows\System\dqpNTTb.exe
  C:\Windows\System\dqpNTTb.exe
  2⤵
  PID:15936
- C:\Windows\System\QnjCEyj.exe
  C:\Windows\System\QnjCEyj.exe
  2⤵
  PID:15964
- C:\Windows\System\MPdWRjf.exe
  C:\Windows\System\MPdWRjf.exe
  2⤵
  PID:15988
- C:\Windows\System\HBcPjdd.exe
  C:\Windows\System\HBcPjdd.exe
  2⤵
  PID:16004
- C:\Windows\System\XciycDf.exe
  C:\Windows\System\XciycDf.exe
  2⤵
  PID:16028
- C:\Windows\System\hclMvaE.exe
  C:\Windows\System\hclMvaE.exe
  2⤵
  PID:16048
- C:\Windows\System\hJNnmoz.exe
  C:\Windows\System\hJNnmoz.exe
  2⤵
  PID:16076
- C:\Windows\System\SpWkLUM.exe
  C:\Windows\System\SpWkLUM.exe
  2⤵
  PID:16100
- C:\Windows\System\eGGVZCz.exe
  C:\Windows\System\eGGVZCz.exe
  2⤵
  PID:16128
- C:\Windows\System\uzQGcga.exe
  C:\Windows\System\uzQGcga.exe
  2⤵
  PID:16144
- C:\Windows\System\RNsNIzK.exe
  C:\Windows\System\RNsNIzK.exe
  2⤵
  PID:16168
- C:\Windows\System\mGWSrRo.exe
  C:\Windows\System\mGWSrRo.exe
  2⤵
  PID:16192
- C:\Windows\System\gqSXoxo.exe
  C:\Windows\System\gqSXoxo.exe
  2⤵
  PID:16216
- C:\Windows\System\wIBMrim.exe
  C:\Windows\System\wIBMrim.exe
  2⤵
  PID:16232
- C:\Windows\System\NBaMzRd.exe
  C:\Windows\System\NBaMzRd.exe
  2⤵
  PID:16256
- C:\Windows\System\LxnlYAs.exe
  C:\Windows\System\LxnlYAs.exe
  2⤵
  PID:16292
- C:\Windows\System\bzOjCAn.exe
  C:\Windows\System\bzOjCAn.exe
  2⤵
  PID:16308
- C:\Windows\System\CTVMuRn.exe
  C:\Windows\System\CTVMuRn.exe
  2⤵
  PID:16324
- C:\Windows\System\hIAcLoC.exe
  C:\Windows\System\hIAcLoC.exe
  2⤵
  PID:16340
- C:\Windows\System\fvremMu.exe
  C:\Windows\System\fvremMu.exe
  2⤵
  PID:16360
- C:\Windows\System\RlWdydK.exe
  C:\Windows\System\RlWdydK.exe
  2⤵
  PID:14380
- C:\Windows\System\GMVQoIX.exe
  C:\Windows\System\GMVQoIX.exe
  2⤵
  PID:14412
- C:\Windows\System\RcfjpHB.exe
  C:\Windows\System\RcfjpHB.exe
  2⤵
  PID:13840
- C:\Windows\System\hDreCtG.exe
  C:\Windows\System\hDreCtG.exe
  2⤵
  PID:14540
- C:\Windows\System\arbXhGu.exe
  C:\Windows\System\arbXhGu.exe
  2⤵
  PID:14576
- C:\Windows\System\kilkHhK.exe
  C:\Windows\System\kilkHhK.exe
  2⤵
  PID:14620
- C:\Windows\System\rKnWhGY.exe
  C:\Windows\System\rKnWhGY.exe
  2⤵
  PID:12204
- C:\Windows\System\HULbrJy.exe
  C:\Windows\System\HULbrJy.exe
  2⤵
  PID:14004
- C:\Windows\System\lPJfbvc.exe
  C:\Windows\System\lPJfbvc.exe
  2⤵
  PID:15748
- C:\Windows\System\CIpignB.exe
  C:\Windows\System\CIpignB.exe
  2⤵
  PID:13972
- C:\Windows\System\gfSuted.exe
  C:\Windows\System\gfSuted.exe
  2⤵
  PID:14792
- C:\Windows\System\bqAgCFC.exe
  C:\Windows\System\bqAgCFC.exe
  2⤵
  PID:14828
- C:\Windows\System\RKCrkiQ.exe
  C:\Windows\System\RKCrkiQ.exe
  2⤵
  PID:16092
- C:\Windows\System\OQjWDWP.exe
  C:\Windows\System\OQjWDWP.exe
  2⤵
  PID:16116
- C:\Windows\System\OuiQuUA.exe
  C:\Windows\System\OuiQuUA.exe
  2⤵
  PID:14900
- C:\Windows\System\TkuGqSd.exe
  C:\Windows\System\TkuGqSd.exe
  2⤵
  PID:14236
- C:\Windows\System\cqIACHj.exe
  C:\Windows\System\cqIACHj.exe
  2⤵
  PID:14980
- C:\Windows\System\BCZAlKf.exe
  C:\Windows\System\BCZAlKf.exe
  2⤵
  PID:15044
- C:\Windows\System\elFChIO.exe
  C:\Windows\System\elFChIO.exe
  2⤵
  PID:15068
- C:\Windows\System\oGCgCAG.exe
  C:\Windows\System\oGCgCAG.exe
  2⤵
  PID:15092
- C:\Windows\System\vXivnDH.exe
  C:\Windows\System\vXivnDH.exe
  2⤵
  PID:16356
- C:\Windows\System\oaXFetk.exe
  C:\Windows\System\oaXFetk.exe
  2⤵
  PID:12340
- C:\Windows\System\kaJPIhP.exe
  C:\Windows\System\kaJPIhP.exe
  2⤵
  PID:15192
- C:\Windows\System\KFFnzca.exe
  C:\Windows\System\KFFnzca.exe
  2⤵
  PID:15236
- C:\Windows\System\MDTtXtF.exe
  C:\Windows\System\MDTtXtF.exe
  2⤵
  PID:14616
- C:\Windows\System\zWNTIkO.exe
  C:\Windows\System\zWNTIkO.exe
  2⤵
  PID:15292
- C:\Windows\System\xhMNOOm.exe
  C:\Windows\System\xhMNOOm.exe
  2⤵
  PID:14052
- C:\Windows\System\QHmJxgp.exe
  C:\Windows\System\QHmJxgp.exe
  2⤵
  PID:14308
- C:\Windows\System\ZoLepmt.exe
  C:\Windows\System\ZoLepmt.exe
  2⤵
  PID:13420
- C:\Windows\System\lHOaPGl.exe
  C:\Windows\System\lHOaPGl.exe
  2⤵
  PID:11572
- C:\Windows\System\AUFqhxF.exe
  C:\Windows\System\AUFqhxF.exe
  2⤵
  PID:15472
- C:\Windows\System\wUUZSyX.exe
  C:\Windows\System\wUUZSyX.exe
  2⤵
  PID:15572
- C:\Windows\System\YkhNluY.exe
  C:\Windows\System\YkhNluY.exe
  2⤵
  PID:15668
- C:\Windows\System\ICJIESH.exe
  C:\Windows\System\ICJIESH.exe
  2⤵
  PID:15776
- C:\Windows\System\KJWXpGM.exe
  C:\Windows\System\KJWXpGM.exe
  2⤵
  PID:15928
- C:\Windows\System\OMtOEYc.exe
  C:\Windows\System\OMtOEYc.exe
  2⤵
  PID:15976
- C:\Windows\System\kAdScOR.exe
  C:\Windows\System\kAdScOR.exe
  2⤵
  PID:16160
- C:\Windows\System\LDgwwLd.exe
  C:\Windows\System\LDgwwLd.exe
  2⤵
  PID:16276
- C:\Windows\System\QoWkqws.exe
  C:\Windows\System\QoWkqws.exe
  2⤵
  PID:14400
- C:\Windows\System\TibIRFh.exe
  C:\Windows\System\TibIRFh.exe
  2⤵
  PID:15872
- C:\Windows\System\TGbCKIX.exe
  C:\Windows\System\TGbCKIX.exe
  2⤵
  PID:15904
- C:\Windows\System\IFRxLZS.exe
  C:\Windows\System\IFRxLZS.exe
  2⤵
  PID:13856
- C:\Windows\System\BhmaYja.exe
  C:\Windows\System\BhmaYja.exe
  2⤵
  PID:12812
- C:\Windows\System\jpCsRZb.exe
  C:\Windows\System\jpCsRZb.exe
  2⤵
  PID:16396
- C:\Windows\System\vozYCHv.exe
  C:\Windows\System\vozYCHv.exe
  2⤵
  PID:16412
- C:\Windows\System\MPiGSIB.exe
  C:\Windows\System\MPiGSIB.exe
  2⤵
  PID:16428
- C:\Windows\System\tqVoTbr.exe
  C:\Windows\System\tqVoTbr.exe
  2⤵
  PID:16444
- C:\Windows\System\YXNwaMV.exe
  C:\Windows\System\YXNwaMV.exe
  2⤵
  PID:16460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BDQXKDF.exe

Filesize
1.3MB

MD5
5f417cdfa18f383ecfdcf761625a97db

SHA1
7b3189e7af88f52b9de10ae83b6645080add3b5b

SHA256
55414f6442f42770dc2319947f21233fce2b41a284a905f517ea8487e6868f4f

SHA512
0d05e99a4eed24f30848be9b1ea02cc6edb8209465dc5dabba926559375ee656c369225ba6a106d586f8dd7509dfd8bcf931eea7eb016627736e625a1a9ec00a

Download Submit
C:\Windows\System\BfNkGZp.exe

Filesize
1.3MB

MD5
516c5fb9273d26752929f374d9472333

SHA1
37834e4a5c4b95f2a1afbfbb67fd91fe911a8c4a

SHA256
f3d65e46f06bebbb2529a2d9f74afdb0ca218f661e1cc14859c83e827a10dd91

SHA512
2d15d6ef355d57ad55a711eee4d0d31a11b49086d1ef94d578f09e7cf394a142c32c3dd7b554aca3dcfe073f0773ecba627a5c445af9b26e4d6c46ecb20324cd

Download Submit
C:\Windows\System\GasowBq.exe

Filesize
1.3MB

MD5
f0087e45c2fb681c589856308d434efb

SHA1
f3dca86d2df7dc854a7f61c419ff4f104dc6e480

SHA256
16a180bd11f8355a47ce295032b51e9de1b0068cc4913a56d3ced8ab50ec4f4b

SHA512
509deefd634e449e904d2985280316a332674a9e7cd4024d568258a1025b4f4a63dedc3f715a00d924d8d5b85ef14a34020c05ba59edba15147058b225b072c6

Download Submit
C:\Windows\System\KmUSHSp.exe

Filesize
1.3MB

MD5
fb99cc80cbf3028788c233a512319572

SHA1
77e0df87597333680b51b4687314eaeaa7eeada3

SHA256
4222c5bd63b29050847bdf69c570974a3de2b5a522af9edc0bd177e0882a0300

SHA512
f19c21fc2799eab6bbab8fbe2d9043d5a32fe0f7f68d153f7a8a597dcdc11d87b6e617f9b2ea1d571db9fdc0f646c1d8b0493fff44c944c4f7c65dc8c03d76fc

Download Submit
C:\Windows\System\MNURLlF.exe

Filesize
1.3MB

MD5
824ff2128e37f698c7ae0c82576f6d30

SHA1
aa9c19e2151bf7f91ed28529988d802239463ab8

SHA256
4a5fd56ae5d8105c8d18b6c1c0519baf05e056e3ad912a6fce689bb8cf5ab86e

SHA512
f4fc16f90738a4ae91c291f60f96517da18cda5dcc8e8916d942808c5841f9af647fdd3cb03ceebce3324a40f649a0d8b3d11e40b68a835d8fde4bb2c3bb341b

Download Submit
C:\Windows\System\QxWrpzy.exe

Filesize
1.3MB

MD5
7fc5ad33e3bf9fb0ec8ca1a61e4a8580

SHA1
6555e3a1f5a09d2f953db0e1ccfbed3497793602

SHA256
bcc9eacde6cc05c35246e56c0b5afebf027aa178a749dedacbc3535801800a09

SHA512
e6523ba40663cd09df5fab5480387667e8aa56df990c0b5bf6ec221e05ad94ee30b9af8b85996c469844733836907ceb450db22230ddd0c343c307904c91667f

Download Submit
C:\Windows\System\SEWFqRq.exe

Filesize
1.3MB

MD5
b53387e19353deea144efc948b28c610

SHA1
8c4b52b518217f1180f1ad615a4e5590db639a49

SHA256
812999e6a3335eec47adad3c268c7bf38a34c39eeb0b3e2955033e788b0489a5

SHA512
9070e12fc6abae1bfbce5d2eb70468592dca4b218389820dbd0e6646e02d11d4463c7a8717a38be5ddcdf948064080b36646047b2776387936a2d7a72b624319

Download Submit
C:\Windows\System\UhFodkL.exe

Filesize
1.3MB

MD5
c00bde6eb8a9ff5fa29fec8bdd07d7d9

SHA1
ab50e737c798e9ad1ef0fa18291fa761b4e13567

SHA256
9758e65b901557ca3e043e746c597948266ea3c15b4763ffbbd693ac452c0824

SHA512
29a2cad5ffc436839d532bd8d897f7502dd92e3f57f84c337de375e9fad6d32fd0fbfbab1aff076c05f9de3256eedda0a2e7550329b10185bc4cae9f5bb352f0

Download Submit
C:\Windows\System\UxpMxSB.exe

Filesize
1.3MB

MD5
a212f4dc07fbc24f255cb1ff68d8f67f

SHA1
29c31cbfee4dfee38d20ff3ef15bf2ae0747bf2e

SHA256
3341ed605f3304f619bea787793dd6cad236e56b6710fdbe9ae4dad5cf155da7

SHA512
bdffab29ef2b380389896e6f4c8871549489c748457f01e6deb063a5487452e96bc0142133a9cf2914b8692107073f30a1d5d4042979c470f35bce81152499e6

Download Submit
C:\Windows\System\VcAOUyW.exe

Filesize
1.3MB

MD5
853712b81664f1be5e61c1d7bf90b56e

SHA1
2655ab9527bad8f20fdfd67a50ffa13f850a566c

SHA256
0f8da71ff36c5be14d11f8da99df3bcdf634763ae83341b23e75f23775002472

SHA512
61ca673edb3080ba355848ab031ebc019e435f5ffee38f0c435ee92f5d7fdffd07c25214f6300470bdf5490c3e4ef2b872c8f2228741741643cf245f6ad30d18

Download Submit
C:\Windows\System\WNvbmXk.exe

Filesize
1.3MB

MD5
f25f68cec8f48d10130b8b4d3c2d922d

SHA1
ed263d395fab896295dae88ac878e115a7d7ddf4

SHA256
c4681af289ffb6747e24ebe9e9afb64bfeae164d9e5c7a69b1d2c9ef83a91e1c

SHA512
7288ec4eebe30f2f6ba6f1c61ced19e7bd43546e6cecb484ff3424af1f340675d3a0c525f44e5485025f95c3e5cd643960925e2b7230a8b5c6cce60fd927f99a

Download Submit
C:\Windows\System\XLRQoHf.exe

Filesize
1.3MB

MD5
5afbe4c1a35157b629c9b32e8fdc9c30

SHA1
e6adda1fd2623d3c6f31c7db72bb47514ffab823

SHA256
b5c7a2484814a038ead12ca177986b78f3e213707b914bcf09ae5192bde55de5

SHA512
402d0883c17beb030f6a964cdd264be58fbe971e28da419f9ff08ef7577c555ead423189a42ca64b6ab2446aee46eb9419ca558e6c63c85159f72c2a25727ebb

Download Submit
C:\Windows\System\XPdZNCf.exe

Filesize
1.3MB

MD5
f4b984b98bbd5dbef51dae64e5988336

SHA1
f7dd7a6e97373c5f2ecca91c0023812e0c7533b9

SHA256
5bcee726d20784ad629ae0e4cf8c879b60a70383231d92fc6158390706f7db0d

SHA512
ae507ebefee9f67c3c4b18c139f32a58c9c33a3853ea46181133274ece9931dca1a3f8a7a614f88e89bd9cef751bcd9cb30640e88483411d19b17af2e968fb6a

Download Submit
C:\Windows\System\YicsLkv.exe

Filesize
1.3MB

MD5
90f6d7c4487b4811e2d6484e9966fd76

SHA1
0d1036ead1ca7556ea5c88ab7219ced19327a9dd

SHA256
29f67180adc9bef6bb11c0c1429f3090cce4e637d0f117ae8697cbd5e743836f

SHA512
0886eb4c3570d31e686007c13b7cdbcbe07ad640b298f5afdde0b30b63ea920c47be51627127323f772dfd8c7fa97d85df6d8341092a185ef57d77e0c6e76a07

Download Submit
C:\Windows\System\ZXZVoLS.exe

Filesize
1.3MB

MD5
0ce2704b3cd191912eef13617e266de8

SHA1
6625e02fc8484d48d0db1f387a2ae63be4b143dc

SHA256
3855cd47fc2949946489e1b8eabd35f4c5c78dabe3f57e6c18d6e757d01141fb

SHA512
97218cb3859b341667128d2fb3466f43bede8c2fa6a924efb0df9d61adff5fffc764989ad7cfc2e449761dbb4fdb399b381c8d91e61cb4ee1f7a8b128eb71f70

Download Submit
C:\Windows\System\aOleDXn.exe

Filesize
1.3MB

MD5
e3bd312333843f01e71f5323dc7eb41a

SHA1
492f5f86dd32a219617d75b0d6e58d8ce1511ebb

SHA256
709ecde4bed11c53bc633800b01623e504014e3287c5c1aea6dc9bb4ca530b0e

SHA512
add5740ce3c76bfa61edc0e4a472075eeeb04527f434e4fc2e4f935e8cc3bfa7d70cb8fa63babb285da5b995ce185143d9a086bca5ea3ed3a0e88380a5c08805

Download Submit
C:\Windows\System\cSSRswe.exe

Filesize
1.3MB

MD5
c3ea89cb094c2f8769cf1f0c982922ac

SHA1
1d100673d9f2e4dd72c8af04cc1b71b9a887c8ac

SHA256
b816a8b92854fb084d21179f686d7a64f73f5e152c103b3d5fee2ceac48a9557

SHA512
e5557a220c18b85a448aec1e7de170d061cfd2f25dbee068462ab223221eea482419d7171b4529d3787bb4519f9409bd361189e381f89687426ca8d0384eebb3

Download Submit
C:\Windows\System\csNzcNd.exe

Filesize
1.3MB

MD5
dbd2e1bc12314ba5eaf9b622d7c6d4f8

SHA1
fff1d6d4ad0914bf9d062307818904f48c21a735

SHA256
ebbd450e881cdf495e872e6f329923ede286116aa699f3cf871425d34baa7203

SHA512
cf1854e37bce65fab571eb3c91671890c4eebfe360515c988069eea4671fe7b8862564ae8aea8425368d03a8a1544147359d9f7eb3c1d3cf36a411ea28369391

Download Submit
C:\Windows\System\dbLIeES.exe

Filesize
1.3MB

MD5
d6f5a44eb334fcc10da03357d557e1a1

SHA1
7c17adc551849574bb590b2279e6b9780c4ed749

SHA256
031868992b13c6eedd60c027e44a624a787dd128c1154e3bba47fe9133cd4f3c

SHA512
d8cc0b1bbca05548ab9bf1cc1b90641f9dc049ba04c651ba22f1ad11706a836f523313cf1cf5f72ce41d052a3c2934e1beaefbb12e2ee132ef96269866ba1cb4

Download Submit
C:\Windows\System\fedjObQ.exe

Filesize
1.3MB

MD5
38a90d8414c7f725338ed059741232f2

SHA1
aa1f76acee49dae1fdaf357dc7b622f4c72d3414

SHA256
80109f7120150d623c9bf5b43093f579a8606521768688e2614194c7175512ac

SHA512
6f267a1bbb95bc896309bd3c7044d2a505ef4ec29d00906f481bb7b9c811cec47d108fe1d58faa6f6f5cc909fe712bf3aa0eb2ec0c47ef3901e3859d2dc513c3

Download Submit
C:\Windows\System\gvpPpSS.exe

Filesize
1.3MB

MD5
10c170bbb7dbe19e7f75c0694b45cbed

SHA1
1dac6ca8f55cd2aa631a3b9e041e75a1112dc1e6

SHA256
ff2cd9f74d00b79e15ec801e6eb0de7815a8a23be7636801f0a3e85555aa176f

SHA512
c9b88fb53c194505d866f66573a2be74f8053af7c16d31b5dc029b656d5f669d221801342daa61f6e469bf745a6dbdd96a09a803f281d3cd1c62911e571a7d02

Download Submit
C:\Windows\System\jTUaYYv.exe

Filesize
1.3MB

MD5
52e1e76bcd8f59483838f257bb23fc8b

SHA1
0bc93f62ce83654fba8b070823aac26d2627d273

SHA256
1187c031c658edb1b282c7d0daec09f19f5509fea46b1345c32bf6973f1cc0d9

SHA512
c9dcf169ccda2bac22682c449634a74257acc3342fedb1c9d4f90bba23db8ee5184c7ef186c2f1b098d327bcfbe02eb587ac6136bb42ce555f39cf5c59717051

Download Submit
C:\Windows\System\kaBbDHW.exe

Filesize
1.3MB

MD5
91fba9d9fd67b7a421591446450cd140

SHA1
11c7633dee3be8d992bb19714635ae411312b577

SHA256
9c4183c98aa128f4853d062af3d5381e6b6afdf2b6e5b4962fc4f039690505ee

SHA512
00cdf4cb8d0dd2c0176075aeb3fc21d9fc0a889bb4216d4f5c9503b6f559a40e7492c6704d83bee2360804ca15b5a86c3c6795e61eee0851314f650a74056f96

Download Submit
C:\Windows\System\nscDXAs.exe

Filesize
1.3MB

MD5
8fe1b7fcaabef85db65368ecc1cf9081

SHA1
d93a7543d19095c86b78ab2de140755c6369ea1f

SHA256
2ce828da2c9c63a2eef9bf29f3936aaf9053d8cc97fdfcc72acd1bf5ef6e2f0d

SHA512
ce121c377fe0df03467535489b6d5c7520729a963532ddf32d6666597605a6f52b5db2a284e2939cab581b34b2ceb539c73c0b84272773ccf8a810d195f1c578

Download Submit
C:\Windows\System\ozpHAMt.exe

Filesize
1.3MB

MD5
d6627d11f47717dcc22a6471d3ef3cd4

SHA1
e71c00540da7c3779c3d6895ffe1494f1550f1a9

SHA256
07484371228db5bc36514fddb1848be725ba6af02141475c351bbf2894c79840

SHA512
e67066a625b2fdb87b13809ccf43a3fff96b2a4896a1d75e729545f5fd7ad85fbee7be21da52ec69846c08589ef6d6a724817b325445befd9156c33dfbfc1d11

Download Submit
C:\Windows\System\puMEEVr.exe

Filesize
1.3MB

MD5
2de7b2a4acf38288df94012551ae89ea

SHA1
ab93c8b6fd4eed00a4e33ca837bc4c36c8b38ff5

SHA256
0112644caea75d291b323c5c3aa5982832f5d795bac1bba08ac156312399188e

SHA512
e8032a7b5890c378ad1d2159192df002e7ba795da456bcaf610b7dc8a2ff2fde69cd35c412c6809157416b34ee378829aa0f8f45599d029f2e9e7ce5e1757993

Download Submit
C:\Windows\System\rbLYGbx.exe

Filesize
1.3MB

MD5
bf49ddb032680059a5cf964520b6d37a

SHA1
6e051caa28414f3787a77fa3a403f6bca2465889

SHA256
9af29c5f031329cff3834b2137323a67218008fd9f8e0f416e765cd91fa555ca

SHA512
e46dc30385d695244a58f39adee4fbf2900e98733495ae09eb9f3f2940ef03216937929a88ae548d5210759ac8c7c7a6a820aba7cb3afcf61fff680e2836e8a1

Download Submit
C:\Windows\System\tCOaGtv.exe

Filesize
1.3MB

MD5
17dd9f2910527b1b79cdea696739775a

SHA1
416d1881ccb7dd69be8a36ba8efb314d6a412dc8

SHA256
b294a421eec4ca770424fe6feea0be95df382403dd2f8aec8b30e5097d76e55c

SHA512
1467115292114fd79c796037404aa73deeb2002979838be456bdf70c6d7d310c6f3481c700a96435be619d21b463d3724865678e1773dfc129312e1e69dd29df

Download Submit
C:\Windows\System\tglpHTV.exe

Filesize
1.3MB

MD5
9fa3d9757c27984c40a0c4276356d682

SHA1
aeda0046e218bd983aed7636c62e6bdd55cc5521

SHA256
0cbfd7fdcbb04f99bb62c8a1445365b78bcb1eef19fce0e0c1da31bf8d033c3f

SHA512
5454f355456fcb876c02553758dfe181fe0ab4e7c5cdfced2beb74d85a08b322f7a247192d067475dcb1d3f3c102c458d03fdc6ba50baba958b9cc4f865d772c

Download Submit
C:\Windows\System\uZHfqRE.exe

Filesize
1.3MB

MD5
65b1c2a7bbf206bf86cb625804edc171

SHA1
ee04d97ff2948cdc9c41f7f07af27e9fa1cd1b95

SHA256
55c965932a91c66c90cc4d9bde4dc0f946bb1b3bb1b094a6022a7db3746c3cd4

SHA512
c9e9295ecf844c70be09358f59e480a26281e67d9b592d0fb2bd03bf1ce7b999348e373c5edb38e81ef208bf6fcaa695565647a2ee6546377f410b2bd1151c31

Download Submit
C:\Windows\System\uyYoVvO.exe

Filesize
1.3MB

MD5
5a1d9ab4d687297bbc5c8eaeabeb75bb

SHA1
85cf83a7f8ebdc3ee007f11e308e3e0e902c301e

SHA256
81b1996cca52498b63e757a8e2dc91bc4a82b1d197c6ac0d4a4050636b6d7fc3

SHA512
3b66fee8e4473580c4180815e7dc39123d3158021a69e4f55e11d085d42bdd0b9b6ad509cddd862b556285391ba2c69073c197c9437cd4f27cac3282b2065ff7

Download Submit
C:\Windows\System\vxMypWi.exe

Filesize
1.3MB

MD5
b8e0a0131e17f95d77ccec5db23a4a66

SHA1
39c1f9781a819955d3c030d01cfd3fbc198f2ef4

SHA256
20b741744a41f702b52a7c28174cc5d9309cf1f921b30ba5dc758ae321886a8e

SHA512
61321d0a8db3c5e3f5bdc0a9e161b11b560f20c9cc8afb9a68af30569343f736388f170fe8fa33b2d020a22f3a0775e11dd0ee41672f340153d5c73cec87e624

Download Submit
C:\Windows\System\wuLHaHU.exe

Filesize
1.3MB

MD5
bf822f05c9e018a1406ba33a1c0b8185

SHA1
7fb6254b5119bf4f46f5398e4076b16ad9521ff6

SHA256
c4a98b22473583e7d2de65dd82987bcb705600dd6ae253d185db8bace16d1163

SHA512
463ef174a21606377d2b99686b89ba9dfa162e6e7df00c2187eeec40aaedb802a5e2180fd9a281445dd71424b3f2dcb82d7aa8cfc0bff1f066d59366b4204079

Download Submit
memory/3304-0-0x0000014E8F310000-0x0000014E8F320000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads