xmrig | 20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
Size

1.4MB
MD5

5ba0f100bc93f2c5d53fe76e2f8a17aa
SHA1

54fc83d2ad11dd717b011bb68cb92f2db4cc0802
SHA256

20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a
SHA512

771f193182d6719ef356140234ae8eaa717099f8d6a8c3f93ff7d69eecd74a3368907cf65278228e2e92306a90f3de98dd0e12f78cdc350f2ad367e901c492e4
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6Pb8eRKj:GezaTF8FcNkNdfE0pZ9ozttwIRx3rEuC

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c8f-4.dat	xmrig
behavioral2/files/0x0008000000023c93-8.dat	xmrig
behavioral2/files/0x0007000000023c98-17.dat	xmrig
behavioral2/files/0x0007000000023c99-28.dat	xmrig
behavioral2/files/0x0007000000023c9a-30.dat	xmrig
behavioral2/files/0x0007000000023c9b-35.dat	xmrig
behavioral2/files/0x0007000000023c9d-41.dat	xmrig
behavioral2/files/0x0008000000023c9f-50.dat	xmrig
behavioral2/files/0x0007000000023c9e-48.dat	xmrig
behavioral2/files/0x0007000000023c97-21.dat	xmrig
behavioral2/files/0x0007000000023ca0-54.dat	xmrig
behavioral2/files/0x0008000000023c94-60.dat	xmrig
behavioral2/files/0x0007000000023ca2-65.dat	xmrig
behavioral2/files/0x0007000000023ca4-81.dat	xmrig
behavioral2/files/0x0007000000023ca6-85.dat	xmrig
behavioral2/files/0x0007000000023ca5-83.dat	xmrig
behavioral2/files/0x0007000000023ca3-76.dat	xmrig
behavioral2/files/0x0007000000023ca7-89.dat	xmrig
behavioral2/files/0x0007000000023ca8-93.dat	xmrig
behavioral2/files/0x0007000000023ca9-100.dat	xmrig
behavioral2/files/0x0007000000023cab-107.dat	xmrig
behavioral2/files/0x0007000000023caa-108.dat	xmrig
behavioral2/files/0x0007000000023cac-118.dat	xmrig
behavioral2/files/0x0007000000023cad-120.dat	xmrig
behavioral2/files/0x0007000000023cae-123.dat	xmrig
behavioral2/files/0x0007000000023cb0-128.dat	xmrig
behavioral2/files/0x0007000000023cb2-135.dat	xmrig
behavioral2/files/0x0007000000023cb1-147.dat	xmrig
behavioral2/files/0x0007000000023cb5-154.dat	xmrig
behavioral2/files/0x0007000000023cb4-152.dat	xmrig
behavioral2/files/0x0007000000023cb3-142.dat	xmrig
behavioral2/files/0x0007000000023cb7-162.dat	xmrig
behavioral2/files/0x0007000000023cb6-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2108	cTSZnHf.exe
4004	lrYYVqd.exe
1632	xyjkcMg.exe
3556	EMiuEHw.exe
4436	iohQYmR.exe
2704	ocCJZNf.exe
3356	OtYOnGJ.exe
1512	IENPnKw.exe
3280	XPyonyX.exe
4884	tOxXwrd.exe
2932	bAKeXQn.exe
1228	TXAvDpm.exe
3476	OnkrCnS.exe
3660	gmOQsyN.exe
3108	ZitsHpm.exe
1688	nfyPBjk.exe
4048	nGfNkoS.exe
4072	LPSgHyU.exe
4008	KnvDjLC.exe
2664	CUPVSsR.exe
532	CzNFAAs.exe
984	kpduOfT.exe
1312	wvRHBUB.exe
3132	paoHnSh.exe
4600	ekzXMNg.exe
4520	TMywlyK.exe
1480	ZJcgwCQ.exe
3292	yMmJbBA.exe
3928	eKkUQZs.exe
1940	qsvtIOC.exe
2164	fcBkSvx.exe
748	NhBNQOh.exe
3936	MyNcXgw.exe
4672	rIFmbuS.exe
4716	xAgmNXV.exe
1160	gUBCMiG.exe
512	wiMnbBJ.exe
4088	OGvhGdb.exe
1404	erdieul.exe
1556	WXwOwAm.exe
4176	KtiVNco.exe
2396	YoUpDHL.exe
4012	IRoKXHG.exe
3884	biuwBQZ.exe
3408	DtPfgXI.exe
1752	JOduOJE.exe
1932	tNwOKAK.exe
1468	OAKeOxm.exe
1296	PZjztgV.exe
3128	EabxBve.exe
4340	bEJkWqU.exe
2680	SKzHWlH.exe
2352	uUPXNFD.exe
2160	lSxgsgn.exe
3048	fgkBcUz.exe
4016	waMhByW.exe
1828	YVtlQlx.exe
3688	hdhorln.exe
1948	vUwbMYH.exe
4860	UgLzJsw.exe
3696	sZKKSbb.exe
5088	umCAAvf.exe
4636	UzGCZdE.exe
3096	BRWkbAF.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HifWiTF.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\WNeBjKc.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\VAtbGog.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\AvcSwEt.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\IShBXbN.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\CdVxQLf.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\GkRrrus.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\eseNJlE.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\DbacnfD.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\SbPFadq.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\wtKDFOi.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\FRiAjSt.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\UQomDjg.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\VCsoZYf.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\yZlNuPS.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\OoBdOGz.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\hllfrOL.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\kLdBsVt.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\CQFgkfy.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\jkMWGYF.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\BWmcuId.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\ZJcgwCQ.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\ZTIByDv.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\xXJWLIs.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\tADLGDH.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\OJxgjMs.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\LvNkcDI.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\kYyMQpi.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\nhIxWdd.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\JJUrTer.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\UPmOmyb.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\fArXDZV.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\tUBIrNw.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\parUwgf.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\QTIAjuX.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\SLnzNoe.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\OAKeOxm.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\juaguYT.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\fzDZjzA.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\guMTIgZ.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\KXOerzL.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\NqUfwOz.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\YQQiEfk.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\DcrPZpj.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\PPuStFe.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\YoUpDHL.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\BRWkbAF.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\pbWfMhB.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\RyXEOAd.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\psHAeAD.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\mgZTfWH.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\MOweyPb.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\LTRgdfk.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\XQYomzE.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\nuinkgG.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\gEjSfcF.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\aIBPoOo.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\ZNnMnmh.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\TJRaOSY.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\SGXxlwr.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\vKLGtzr.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\FztpCsN.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\SHxvwES.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
File created	C:\Windows\System\jVgrErl.exe	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2108	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	86
PID 3024 wrote to memory of 2108	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	86
PID 3024 wrote to memory of 4004	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	87
PID 3024 wrote to memory of 4004	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	87
PID 3024 wrote to memory of 1632	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	88
PID 3024 wrote to memory of 1632	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	88
PID 3024 wrote to memory of 3556	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	89
PID 3024 wrote to memory of 3556	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	89
PID 3024 wrote to memory of 4436	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	90
PID 3024 wrote to memory of 4436	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	90
PID 3024 wrote to memory of 2704	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	91
PID 3024 wrote to memory of 2704	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	91
PID 3024 wrote to memory of 3356	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	92
PID 3024 wrote to memory of 3356	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	92
PID 3024 wrote to memory of 1512	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	93
PID 3024 wrote to memory of 1512	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	93
PID 3024 wrote to memory of 3280	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	94
PID 3024 wrote to memory of 3280	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	94
PID 3024 wrote to memory of 4884	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	95
PID 3024 wrote to memory of 4884	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	95
PID 3024 wrote to memory of 2932	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	96
PID 3024 wrote to memory of 2932	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	96
PID 3024 wrote to memory of 1228	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	97
PID 3024 wrote to memory of 1228	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	97
PID 3024 wrote to memory of 3476	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	98
PID 3024 wrote to memory of 3476	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	98
PID 3024 wrote to memory of 3660	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	99
PID 3024 wrote to memory of 3660	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	99
PID 3024 wrote to memory of 3108	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	100
PID 3024 wrote to memory of 3108	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	100
PID 3024 wrote to memory of 1688	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	101
PID 3024 wrote to memory of 1688	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	101
PID 3024 wrote to memory of 4048	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	102
PID 3024 wrote to memory of 4048	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	102
PID 3024 wrote to memory of 4072	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	103
PID 3024 wrote to memory of 4072	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	103
PID 3024 wrote to memory of 4008	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	104
PID 3024 wrote to memory of 4008	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	104
PID 3024 wrote to memory of 2664	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	105
PID 3024 wrote to memory of 2664	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	105
PID 3024 wrote to memory of 532	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	106
PID 3024 wrote to memory of 532	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	106
PID 3024 wrote to memory of 984	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	107
PID 3024 wrote to memory of 984	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	107
PID 3024 wrote to memory of 1312	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	108
PID 3024 wrote to memory of 1312	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	108
PID 3024 wrote to memory of 3132	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	109
PID 3024 wrote to memory of 3132	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	109
PID 3024 wrote to memory of 4600	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	110
PID 3024 wrote to memory of 4600	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	110
PID 3024 wrote to memory of 4520	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	111
PID 3024 wrote to memory of 4520	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	111
PID 3024 wrote to memory of 1480	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	112
PID 3024 wrote to memory of 1480	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	112
PID 3024 wrote to memory of 3292	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	113
PID 3024 wrote to memory of 3292	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	113
PID 3024 wrote to memory of 3928	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	114
PID 3024 wrote to memory of 3928	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	114
PID 3024 wrote to memory of 1940	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	115
PID 3024 wrote to memory of 1940	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	115
PID 3024 wrote to memory of 2164	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	116
PID 3024 wrote to memory of 2164	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	116
PID 3024 wrote to memory of 748	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	117
PID 3024 wrote to memory of 748	3024	20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe	117

C:\Users\Admin\AppData\Local\Temp\20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe
"C:\Users\Admin\AppData\Local\Temp\20dd9da6c86a21aeb7a6f776dbee08aa4d40cbb658455a2d03a11bee61bc4a8a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System\cTSZnHf.exe
  C:\Windows\System\cTSZnHf.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\lrYYVqd.exe
  C:\Windows\System\lrYYVqd.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\xyjkcMg.exe
  C:\Windows\System\xyjkcMg.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\EMiuEHw.exe
  C:\Windows\System\EMiuEHw.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\iohQYmR.exe
  C:\Windows\System\iohQYmR.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\ocCJZNf.exe
  C:\Windows\System\ocCJZNf.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\OtYOnGJ.exe
  C:\Windows\System\OtYOnGJ.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\IENPnKw.exe
  C:\Windows\System\IENPnKw.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\XPyonyX.exe
  C:\Windows\System\XPyonyX.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\tOxXwrd.exe
  C:\Windows\System\tOxXwrd.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\bAKeXQn.exe
  C:\Windows\System\bAKeXQn.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\TXAvDpm.exe
  C:\Windows\System\TXAvDpm.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\OnkrCnS.exe
  C:\Windows\System\OnkrCnS.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\gmOQsyN.exe
  C:\Windows\System\gmOQsyN.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\ZitsHpm.exe
  C:\Windows\System\ZitsHpm.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\nfyPBjk.exe
  C:\Windows\System\nfyPBjk.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\nGfNkoS.exe
  C:\Windows\System\nGfNkoS.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\LPSgHyU.exe
  C:\Windows\System\LPSgHyU.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\KnvDjLC.exe
  C:\Windows\System\KnvDjLC.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\CUPVSsR.exe
  C:\Windows\System\CUPVSsR.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\CzNFAAs.exe
  C:\Windows\System\CzNFAAs.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\kpduOfT.exe
  C:\Windows\System\kpduOfT.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\wvRHBUB.exe
  C:\Windows\System\wvRHBUB.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\paoHnSh.exe
  C:\Windows\System\paoHnSh.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\ekzXMNg.exe
  C:\Windows\System\ekzXMNg.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\TMywlyK.exe
  C:\Windows\System\TMywlyK.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\ZJcgwCQ.exe
  C:\Windows\System\ZJcgwCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\yMmJbBA.exe
  C:\Windows\System\yMmJbBA.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\eKkUQZs.exe
  C:\Windows\System\eKkUQZs.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\qsvtIOC.exe
  C:\Windows\System\qsvtIOC.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\fcBkSvx.exe
  C:\Windows\System\fcBkSvx.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\NhBNQOh.exe
  C:\Windows\System\NhBNQOh.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\MyNcXgw.exe
  C:\Windows\System\MyNcXgw.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\rIFmbuS.exe
  C:\Windows\System\rIFmbuS.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\wiMnbBJ.exe
  C:\Windows\System\wiMnbBJ.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\xAgmNXV.exe
  C:\Windows\System\xAgmNXV.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\gUBCMiG.exe
  C:\Windows\System\gUBCMiG.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\OGvhGdb.exe
  C:\Windows\System\OGvhGdb.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\erdieul.exe
  C:\Windows\System\erdieul.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\KtiVNco.exe
  C:\Windows\System\KtiVNco.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\WXwOwAm.exe
  C:\Windows\System\WXwOwAm.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\YoUpDHL.exe
  C:\Windows\System\YoUpDHL.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\IRoKXHG.exe
  C:\Windows\System\IRoKXHG.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\JOduOJE.exe
  C:\Windows\System\JOduOJE.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\biuwBQZ.exe
  C:\Windows\System\biuwBQZ.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\DtPfgXI.exe
  C:\Windows\System\DtPfgXI.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\EabxBve.exe
  C:\Windows\System\EabxBve.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\tNwOKAK.exe
  C:\Windows\System\tNwOKAK.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\OAKeOxm.exe
  C:\Windows\System\OAKeOxm.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\PZjztgV.exe
  C:\Windows\System\PZjztgV.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\bEJkWqU.exe
  C:\Windows\System\bEJkWqU.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\uUPXNFD.exe
  C:\Windows\System\uUPXNFD.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\SKzHWlH.exe
  C:\Windows\System\SKzHWlH.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\lSxgsgn.exe
  C:\Windows\System\lSxgsgn.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\fgkBcUz.exe
  C:\Windows\System\fgkBcUz.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\waMhByW.exe
  C:\Windows\System\waMhByW.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\hdhorln.exe
  C:\Windows\System\hdhorln.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\YVtlQlx.exe
  C:\Windows\System\YVtlQlx.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\UgLzJsw.exe
  C:\Windows\System\UgLzJsw.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\vUwbMYH.exe
  C:\Windows\System\vUwbMYH.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\sZKKSbb.exe
  C:\Windows\System\sZKKSbb.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\umCAAvf.exe
  C:\Windows\System\umCAAvf.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\UzGCZdE.exe
  C:\Windows\System\UzGCZdE.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\BRWkbAF.exe
  C:\Windows\System\BRWkbAF.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\HQgPrvu.exe
  C:\Windows\System\HQgPrvu.exe
  2⤵
  PID:796
- C:\Windows\System\JSveeqE.exe
  C:\Windows\System\JSveeqE.exe
  2⤵
  PID:1460
- C:\Windows\System\SkRgilk.exe
  C:\Windows\System\SkRgilk.exe
  2⤵
  PID:4928
- C:\Windows\System\gPjRRpX.exe
  C:\Windows\System\gPjRRpX.exe
  2⤵
  PID:2188
- C:\Windows\System\tAWEEcw.exe
  C:\Windows\System\tAWEEcw.exe
  2⤵
  PID:3988
- C:\Windows\System\GkQdDiA.exe
  C:\Windows\System\GkQdDiA.exe
  2⤵
  PID:2572
- C:\Windows\System\JnFNfyI.exe
  C:\Windows\System\JnFNfyI.exe
  2⤵
  PID:3176
- C:\Windows\System\VAtbGog.exe
  C:\Windows\System\VAtbGog.exe
  2⤵
  PID:4812
- C:\Windows\System\yKosuJS.exe
  C:\Windows\System\yKosuJS.exe
  2⤵
  PID:4592
- C:\Windows\System\UQomDjg.exe
  C:\Windows\System\UQomDjg.exe
  2⤵
  PID:2924
- C:\Windows\System\QxWjHlZ.exe
  C:\Windows\System\QxWjHlZ.exe
  2⤵
  PID:1776
- C:\Windows\System\WXmbAdu.exe
  C:\Windows\System\WXmbAdu.exe
  2⤵
  PID:4184
- C:\Windows\System\QthXAge.exe
  C:\Windows\System\QthXAge.exe
  2⤵
  PID:1848
- C:\Windows\System\njGhEuY.exe
  C:\Windows\System\njGhEuY.exe
  2⤵
  PID:4452
- C:\Windows\System\ILzLcJY.exe
  C:\Windows\System\ILzLcJY.exe
  2⤵
  PID:2308
- C:\Windows\System\LoBkxCU.exe
  C:\Windows\System\LoBkxCU.exe
  2⤵
  PID:2852
- C:\Windows\System\WDrvBOu.exe
  C:\Windows\System\WDrvBOu.exe
  2⤵
  PID:4136
- C:\Windows\System\AxTlxih.exe
  C:\Windows\System\AxTlxih.exe
  2⤵
  PID:4036
- C:\Windows\System\ZZiwLSL.exe
  C:\Windows\System\ZZiwLSL.exe
  2⤵
  PID:1840
- C:\Windows\System\IIQqpCf.exe
  C:\Windows\System\IIQqpCf.exe
  2⤵
  PID:2876
- C:\Windows\System\YAbTRSV.exe
  C:\Windows\System\YAbTRSV.exe
  2⤵
  PID:2320
- C:\Windows\System\XxXScbl.exe
  C:\Windows\System\XxXScbl.exe
  2⤵
  PID:1780
- C:\Windows\System\JJUrTer.exe
  C:\Windows\System\JJUrTer.exe
  2⤵
  PID:1936
- C:\Windows\System\CkWQXEY.exe
  C:\Windows\System\CkWQXEY.exe
  2⤵
  PID:1544
- C:\Windows\System\uDfrJat.exe
  C:\Windows\System\uDfrJat.exe
  2⤵
  PID:4780
- C:\Windows\System\HifWiTF.exe
  C:\Windows\System\HifWiTF.exe
  2⤵
  PID:1064
- C:\Windows\System\IlrsjTO.exe
  C:\Windows\System\IlrsjTO.exe
  2⤵
  PID:800
- C:\Windows\System\tgvmNBX.exe
  C:\Windows\System\tgvmNBX.exe
  2⤵
  PID:1928
- C:\Windows\System\xOrCvHu.exe
  C:\Windows\System\xOrCvHu.exe
  2⤵
  PID:1548
- C:\Windows\System\NqRCShc.exe
  C:\Windows\System\NqRCShc.exe
  2⤵
  PID:5004
- C:\Windows\System\hVgqcJY.exe
  C:\Windows\System\hVgqcJY.exe
  2⤵
  PID:5060
- C:\Windows\System\MiuMIAy.exe
  C:\Windows\System\MiuMIAy.exe
  2⤵
  PID:4844
- C:\Windows\System\VFkkjqN.exe
  C:\Windows\System\VFkkjqN.exe
  2⤵
  PID:3492
- C:\Windows\System\OdugpJM.exe
  C:\Windows\System\OdugpJM.exe
  2⤵
  PID:4648
- C:\Windows\System\AvcSwEt.exe
  C:\Windows\System\AvcSwEt.exe
  2⤵
  PID:2448
- C:\Windows\System\jQfSwgW.exe
  C:\Windows\System\jQfSwgW.exe
  2⤵
  PID:1964
- C:\Windows\System\MNKnThq.exe
  C:\Windows\System\MNKnThq.exe
  2⤵
  PID:4836
- C:\Windows\System\egpboVt.exe
  C:\Windows\System\egpboVt.exe
  2⤵
  PID:4512
- C:\Windows\System\uEMhoqE.exe
  C:\Windows\System\uEMhoqE.exe
  2⤵
  PID:3632
- C:\Windows\System\STEXBdw.exe
  C:\Windows\System\STEXBdw.exe
  2⤵
  PID:5144
- C:\Windows\System\WJdWJTs.exe
  C:\Windows\System\WJdWJTs.exe
  2⤵
  PID:5172
- C:\Windows\System\kyiKUrf.exe
  C:\Windows\System\kyiKUrf.exe
  2⤵
  PID:5204
- C:\Windows\System\yaggmEl.exe
  C:\Windows\System\yaggmEl.exe
  2⤵
  PID:5236
- C:\Windows\System\MtnuhWc.exe
  C:\Windows\System\MtnuhWc.exe
  2⤵
  PID:5260
- C:\Windows\System\FlpHcwA.exe
  C:\Windows\System\FlpHcwA.exe
  2⤵
  PID:5296
- C:\Windows\System\OpGzFDb.exe
  C:\Windows\System\OpGzFDb.exe
  2⤵
  PID:5320
- C:\Windows\System\kJZqdGB.exe
  C:\Windows\System\kJZqdGB.exe
  2⤵
  PID:5352
- C:\Windows\System\SGXxlwr.exe
  C:\Windows\System\SGXxlwr.exe
  2⤵
  PID:5384
- C:\Windows\System\zOKZald.exe
  C:\Windows\System\zOKZald.exe
  2⤵
  PID:5412
- C:\Windows\System\jsCyEjt.exe
  C:\Windows\System\jsCyEjt.exe
  2⤵
  PID:5440
- C:\Windows\System\epqTnYo.exe
  C:\Windows\System\epqTnYo.exe
  2⤵
  PID:5472
- C:\Windows\System\zdcpDlX.exe
  C:\Windows\System\zdcpDlX.exe
  2⤵
  PID:5492
- C:\Windows\System\WoBelYV.exe
  C:\Windows\System\WoBelYV.exe
  2⤵
  PID:5524
- C:\Windows\System\mTMFOCv.exe
  C:\Windows\System\mTMFOCv.exe
  2⤵
  PID:5552
- C:\Windows\System\IShBXbN.exe
  C:\Windows\System\IShBXbN.exe
  2⤵
  PID:5584
- C:\Windows\System\ZTIByDv.exe
  C:\Windows\System\ZTIByDv.exe
  2⤵
  PID:5608
- C:\Windows\System\KjkklPE.exe
  C:\Windows\System\KjkklPE.exe
  2⤵
  PID:5636
- C:\Windows\System\qXGkDIs.exe
  C:\Windows\System\qXGkDIs.exe
  2⤵
  PID:5664
- C:\Windows\System\ZMBEqPS.exe
  C:\Windows\System\ZMBEqPS.exe
  2⤵
  PID:5688
- C:\Windows\System\jQnMAsx.exe
  C:\Windows\System\jQnMAsx.exe
  2⤵
  PID:5716
- C:\Windows\System\GOLCicE.exe
  C:\Windows\System\GOLCicE.exe
  2⤵
  PID:5744
- C:\Windows\System\CWzVPKx.exe
  C:\Windows\System\CWzVPKx.exe
  2⤵
  PID:5780
- C:\Windows\System\tRWyLKZ.exe
  C:\Windows\System\tRWyLKZ.exe
  2⤵
  PID:5804
- C:\Windows\System\evSgNbz.exe
  C:\Windows\System\evSgNbz.exe
  2⤵
  PID:5824
- C:\Windows\System\CUQkmnh.exe
  C:\Windows\System\CUQkmnh.exe
  2⤵
  PID:5856
- C:\Windows\System\jaKuIAZ.exe
  C:\Windows\System\jaKuIAZ.exe
  2⤵
  PID:5876
- C:\Windows\System\RLIarYn.exe
  C:\Windows\System\RLIarYn.exe
  2⤵
  PID:5904
- C:\Windows\System\Nknzcvd.exe
  C:\Windows\System\Nknzcvd.exe
  2⤵
  PID:5932
- C:\Windows\System\yJHmBhZ.exe
  C:\Windows\System\yJHmBhZ.exe
  2⤵
  PID:5948
- C:\Windows\System\pmCswsH.exe
  C:\Windows\System\pmCswsH.exe
  2⤵
  PID:5972
- C:\Windows\System\JbzsCSL.exe
  C:\Windows\System\JbzsCSL.exe
  2⤵
  PID:6000
- C:\Windows\System\JBxfuUS.exe
  C:\Windows\System\JBxfuUS.exe
  2⤵
  PID:6020
- C:\Windows\System\mnbPUXA.exe
  C:\Windows\System\mnbPUXA.exe
  2⤵
  PID:6048
- C:\Windows\System\tfejCEA.exe
  C:\Windows\System\tfejCEA.exe
  2⤵
  PID:6084
- C:\Windows\System\kSRZwvJ.exe
  C:\Windows\System\kSRZwvJ.exe
  2⤵
  PID:6112
- C:\Windows\System\pIyjgqy.exe
  C:\Windows\System\pIyjgqy.exe
  2⤵
  PID:6140
- C:\Windows\System\xjWIbAP.exe
  C:\Windows\System\xjWIbAP.exe
  2⤵
  PID:4640
- C:\Windows\System\yKvYLNr.exe
  C:\Windows\System\yKvYLNr.exe
  2⤵
  PID:5164
- C:\Windows\System\aXepQGw.exe
  C:\Windows\System\aXepQGw.exe
  2⤵
  PID:5252
- C:\Windows\System\tlkjOXh.exe
  C:\Windows\System\tlkjOXh.exe
  2⤵
  PID:5312
- C:\Windows\System\VCsoZYf.exe
  C:\Windows\System\VCsoZYf.exe
  2⤵
  PID:5380
- C:\Windows\System\DboDkYQ.exe
  C:\Windows\System\DboDkYQ.exe
  2⤵
  PID:5436
- C:\Windows\System\DYkuszl.exe
  C:\Windows\System\DYkuszl.exe
  2⤵
  PID:5504
- C:\Windows\System\znvOnkW.exe
  C:\Windows\System\znvOnkW.exe
  2⤵
  PID:5576
- C:\Windows\System\diFaySD.exe
  C:\Windows\System\diFaySD.exe
  2⤵
  PID:5644
- C:\Windows\System\iSkdpXv.exe
  C:\Windows\System\iSkdpXv.exe
  2⤵
  PID:5712
- C:\Windows\System\GecjIJl.exe
  C:\Windows\System\GecjIJl.exe
  2⤵
  PID:5776
- C:\Windows\System\HzrnAhA.exe
  C:\Windows\System\HzrnAhA.exe
  2⤵
  PID:5848
- C:\Windows\System\PhMfsoq.exe
  C:\Windows\System\PhMfsoq.exe
  2⤵
  PID:5912
- C:\Windows\System\PTRuvGx.exe
  C:\Windows\System\PTRuvGx.exe
  2⤵
  PID:6032
- C:\Windows\System\eVxGmXt.exe
  C:\Windows\System\eVxGmXt.exe
  2⤵
  PID:6016
- C:\Windows\System\efZSLoi.exe
  C:\Windows\System\efZSLoi.exe
  2⤵
  PID:6124
- C:\Windows\System\WyGuMGp.exe
  C:\Windows\System\WyGuMGp.exe
  2⤵
  PID:3244
- C:\Windows\System\dNcOyrm.exe
  C:\Windows\System\dNcOyrm.exe
  2⤵
  PID:5276
- C:\Windows\System\EkREFUb.exe
  C:\Windows\System\EkREFUb.exe
  2⤵
  PID:5372
- C:\Windows\System\eYpIFxJ.exe
  C:\Windows\System\eYpIFxJ.exe
  2⤵
  PID:5560
- C:\Windows\System\KBJnRYx.exe
  C:\Windows\System\KBJnRYx.exe
  2⤵
  PID:5940
- C:\Windows\System\wLKyDaP.exe
  C:\Windows\System\wLKyDaP.exe
  2⤵
  PID:5996
- C:\Windows\System\uQYOvWu.exe
  C:\Windows\System\uQYOvWu.exe
  2⤵
  PID:6092
- C:\Windows\System\iuXersy.exe
  C:\Windows\System\iuXersy.exe
  2⤵
  PID:5340
- C:\Windows\System\vBjJrzE.exe
  C:\Windows\System\vBjJrzE.exe
  2⤵
  PID:5888
- C:\Windows\System\ozgLUVX.exe
  C:\Windows\System\ozgLUVX.exe
  2⤵
  PID:2344
- C:\Windows\System\OvpnAGj.exe
  C:\Windows\System\OvpnAGj.exe
  2⤵
  PID:6168
- C:\Windows\System\pOFOhIt.exe
  C:\Windows\System\pOFOhIt.exe
  2⤵
  PID:6200
- C:\Windows\System\WtfwgCa.exe
  C:\Windows\System\WtfwgCa.exe
  2⤵
  PID:6224
- C:\Windows\System\zNwHViQ.exe
  C:\Windows\System\zNwHViQ.exe
  2⤵
  PID:6252
- C:\Windows\System\oXbyBkh.exe
  C:\Windows\System\oXbyBkh.exe
  2⤵
  PID:6272
- C:\Windows\System\wyBJGyf.exe
  C:\Windows\System\wyBJGyf.exe
  2⤵
  PID:6304
- C:\Windows\System\BNQKLCw.exe
  C:\Windows\System\BNQKLCw.exe
  2⤵
  PID:6324
- C:\Windows\System\hqmiFuh.exe
  C:\Windows\System\hqmiFuh.exe
  2⤵
  PID:6356
- C:\Windows\System\imSdwNf.exe
  C:\Windows\System\imSdwNf.exe
  2⤵
  PID:6384
- C:\Windows\System\lbuAQLu.exe
  C:\Windows\System\lbuAQLu.exe
  2⤵
  PID:6420
- C:\Windows\System\QmIIlxP.exe
  C:\Windows\System\QmIIlxP.exe
  2⤵
  PID:6444
- C:\Windows\System\hYAzXMj.exe
  C:\Windows\System\hYAzXMj.exe
  2⤵
  PID:6468
- C:\Windows\System\nuinkgG.exe
  C:\Windows\System\nuinkgG.exe
  2⤵
  PID:6504
- C:\Windows\System\IhETAKj.exe
  C:\Windows\System\IhETAKj.exe
  2⤵
  PID:6528
- C:\Windows\System\ImbRARQ.exe
  C:\Windows\System\ImbRARQ.exe
  2⤵
  PID:6548
- C:\Windows\System\HWpNbQX.exe
  C:\Windows\System\HWpNbQX.exe
  2⤵
  PID:6576
- C:\Windows\System\RVQEFOj.exe
  C:\Windows\System\RVQEFOj.exe
  2⤵
  PID:6604
- C:\Windows\System\IYvPfGj.exe
  C:\Windows\System\IYvPfGj.exe
  2⤵
  PID:6640
- C:\Windows\System\fUwrWNl.exe
  C:\Windows\System\fUwrWNl.exe
  2⤵
  PID:6664
- C:\Windows\System\ucXdnkh.exe
  C:\Windows\System\ucXdnkh.exe
  2⤵
  PID:6700
- C:\Windows\System\rIDOnMm.exe
  C:\Windows\System\rIDOnMm.exe
  2⤵
  PID:6724
- C:\Windows\System\wpYDijE.exe
  C:\Windows\System\wpYDijE.exe
  2⤵
  PID:6752
- C:\Windows\System\TgoUDaK.exe
  C:\Windows\System\TgoUDaK.exe
  2⤵
  PID:6780
- C:\Windows\System\iJJlhxi.exe
  C:\Windows\System\iJJlhxi.exe
  2⤵
  PID:6812
- C:\Windows\System\eGwtXOl.exe
  C:\Windows\System\eGwtXOl.exe
  2⤵
  PID:6836
- C:\Windows\System\RxlplNb.exe
  C:\Windows\System\RxlplNb.exe
  2⤵
  PID:6856
- C:\Windows\System\NeBgzDf.exe
  C:\Windows\System\NeBgzDf.exe
  2⤵
  PID:6876
- C:\Windows\System\JxsvDvv.exe
  C:\Windows\System\JxsvDvv.exe
  2⤵
  PID:6900
- C:\Windows\System\juaguYT.exe
  C:\Windows\System\juaguYT.exe
  2⤵
  PID:6928
- C:\Windows\System\DTTwOCz.exe
  C:\Windows\System\DTTwOCz.exe
  2⤵
  PID:6952
- C:\Windows\System\SyntfwP.exe
  C:\Windows\System\SyntfwP.exe
  2⤵
  PID:6984
- C:\Windows\System\pqHqnGP.exe
  C:\Windows\System\pqHqnGP.exe
  2⤵
  PID:7004
- C:\Windows\System\GpKxsea.exe
  C:\Windows\System\GpKxsea.exe
  2⤵
  PID:7028
- C:\Windows\System\jegFuRa.exe
  C:\Windows\System\jegFuRa.exe
  2⤵
  PID:7048
- C:\Windows\System\SeUhFWC.exe
  C:\Windows\System\SeUhFWC.exe
  2⤵
  PID:7072
- C:\Windows\System\WdAxKou.exe
  C:\Windows\System\WdAxKou.exe
  2⤵
  PID:7100
- C:\Windows\System\OzMURPq.exe
  C:\Windows\System\OzMURPq.exe
  2⤵
  PID:7128
- C:\Windows\System\hMMxmrB.exe
  C:\Windows\System\hMMxmrB.exe
  2⤵
  PID:7152
- C:\Windows\System\tpbWbRW.exe
  C:\Windows\System\tpbWbRW.exe
  2⤵
  PID:5244
- C:\Windows\System\pbWfMhB.exe
  C:\Windows\System\pbWfMhB.exe
  2⤵
  PID:6192
- C:\Windows\System\KtbSvat.exe
  C:\Windows\System\KtbSvat.exe
  2⤵
  PID:6216
- C:\Windows\System\WmSTfjY.exe
  C:\Windows\System\WmSTfjY.exe
  2⤵
  PID:6296
- C:\Windows\System\hLDYnOP.exe
  C:\Windows\System\hLDYnOP.exe
  2⤵
  PID:6336
- C:\Windows\System\NYUawxB.exe
  C:\Windows\System\NYUawxB.exe
  2⤵
  PID:6404
- C:\Windows\System\AjyRWbO.exe
  C:\Windows\System\AjyRWbO.exe
  2⤵
  PID:6436
- C:\Windows\System\fzDZjzA.exe
  C:\Windows\System\fzDZjzA.exe
  2⤵
  PID:6492
- C:\Windows\System\sDuWUxn.exe
  C:\Windows\System\sDuWUxn.exe
  2⤵
  PID:6572
- C:\Windows\System\eKCLFjF.exe
  C:\Windows\System\eKCLFjF.exe
  2⤵
  PID:6612
- C:\Windows\System\IByNvQX.exe
  C:\Windows\System\IByNvQX.exe
  2⤵
  PID:6648
- C:\Windows\System\xWoHify.exe
  C:\Windows\System\xWoHify.exe
  2⤵
  PID:6764
- C:\Windows\System\tdAhzeL.exe
  C:\Windows\System\tdAhzeL.exe
  2⤵
  PID:6776
- C:\Windows\System\lFpgNQq.exe
  C:\Windows\System\lFpgNQq.exe
  2⤵
  PID:6888
- C:\Windows\System\mRPUdVK.exe
  C:\Windows\System\mRPUdVK.exe
  2⤵
  PID:6964
- C:\Windows\System\nfxRmkI.exe
  C:\Windows\System\nfxRmkI.exe
  2⤵
  PID:6992
- C:\Windows\System\eiZiwEb.exe
  C:\Windows\System\eiZiwEb.exe
  2⤵
  PID:7112
- C:\Windows\System\yqSeFeb.exe
  C:\Windows\System\yqSeFeb.exe
  2⤵
  PID:5180
- C:\Windows\System\MFnRoyd.exe
  C:\Windows\System\MFnRoyd.exe
  2⤵
  PID:7084
- C:\Windows\System\PGVKPAB.exe
  C:\Windows\System\PGVKPAB.exe
  2⤵
  PID:6376
- C:\Windows\System\EATduXF.exe
  C:\Windows\System\EATduXF.exe
  2⤵
  PID:6484
- C:\Windows\System\plupGFM.exe
  C:\Windows\System\plupGFM.exe
  2⤵
  PID:6460
- C:\Windows\System\HZAwuux.exe
  C:\Windows\System\HZAwuux.exe
  2⤵
  PID:6924
- C:\Windows\System\GCcFsIa.exe
  C:\Windows\System\GCcFsIa.exe
  2⤵
  PID:6736
- C:\Windows\System\ISUFjrb.exe
  C:\Windows\System\ISUFjrb.exe
  2⤵
  PID:6676
- C:\Windows\System\aMSnWZw.exe
  C:\Windows\System\aMSnWZw.exe
  2⤵
  PID:7176
- C:\Windows\System\nNHFXSt.exe
  C:\Windows\System\nNHFXSt.exe
  2⤵
  PID:7196
- C:\Windows\System\jBuriVL.exe
  C:\Windows\System\jBuriVL.exe
  2⤵
  PID:7224
- C:\Windows\System\efymOJr.exe
  C:\Windows\System\efymOJr.exe
  2⤵
  PID:7252
- C:\Windows\System\VDKZLjz.exe
  C:\Windows\System\VDKZLjz.exe
  2⤵
  PID:7276
- C:\Windows\System\PcuSFVT.exe
  C:\Windows\System\PcuSFVT.exe
  2⤵
  PID:7300
- C:\Windows\System\AhuTtbC.exe
  C:\Windows\System\AhuTtbC.exe
  2⤵
  PID:7324
- C:\Windows\System\glLHDnl.exe
  C:\Windows\System\glLHDnl.exe
  2⤵
  PID:7356
- C:\Windows\System\JGUcQSH.exe
  C:\Windows\System\JGUcQSH.exe
  2⤵
  PID:7380
- C:\Windows\System\wVcoKjt.exe
  C:\Windows\System\wVcoKjt.exe
  2⤵
  PID:7404
- C:\Windows\System\HsAFDXy.exe
  C:\Windows\System\HsAFDXy.exe
  2⤵
  PID:7428
- C:\Windows\System\KxgOGtN.exe
  C:\Windows\System\KxgOGtN.exe
  2⤵
  PID:7460
- C:\Windows\System\zIaJbHa.exe
  C:\Windows\System\zIaJbHa.exe
  2⤵
  PID:7476
- C:\Windows\System\nXNdOzJ.exe
  C:\Windows\System\nXNdOzJ.exe
  2⤵
  PID:7504
- C:\Windows\System\aylwYPv.exe
  C:\Windows\System\aylwYPv.exe
  2⤵
  PID:7524
- C:\Windows\System\pXgyFFw.exe
  C:\Windows\System\pXgyFFw.exe
  2⤵
  PID:7556
- C:\Windows\System\OTsJqaS.exe
  C:\Windows\System\OTsJqaS.exe
  2⤵
  PID:7588
- C:\Windows\System\XrByCZN.exe
  C:\Windows\System\XrByCZN.exe
  2⤵
  PID:7616
- C:\Windows\System\alOJtMY.exe
  C:\Windows\System\alOJtMY.exe
  2⤵
  PID:7644
- C:\Windows\System\dfaOyzh.exe
  C:\Windows\System\dfaOyzh.exe
  2⤵
  PID:7668
- C:\Windows\System\auMzLar.exe
  C:\Windows\System\auMzLar.exe
  2⤵
  PID:7696
- C:\Windows\System\pIFENTY.exe
  C:\Windows\System\pIFENTY.exe
  2⤵
  PID:7716
- C:\Windows\System\VpXSvve.exe
  C:\Windows\System\VpXSvve.exe
  2⤵
  PID:7740
- C:\Windows\System\TGFjMjK.exe
  C:\Windows\System\TGFjMjK.exe
  2⤵
  PID:7768
- C:\Windows\System\HBxUpUH.exe
  C:\Windows\System\HBxUpUH.exe
  2⤵
  PID:7792
- C:\Windows\System\EcPMBDi.exe
  C:\Windows\System\EcPMBDi.exe
  2⤵
  PID:7816
- C:\Windows\System\znMPEFg.exe
  C:\Windows\System\znMPEFg.exe
  2⤵
  PID:7844
- C:\Windows\System\GhYkgTw.exe
  C:\Windows\System\GhYkgTw.exe
  2⤵
  PID:7876
- C:\Windows\System\ddCtKFf.exe
  C:\Windows\System\ddCtKFf.exe
  2⤵
  PID:7900
- C:\Windows\System\zlTAVvY.exe
  C:\Windows\System\zlTAVvY.exe
  2⤵
  PID:7924
- C:\Windows\System\lkyoKgJ.exe
  C:\Windows\System\lkyoKgJ.exe
  2⤵
  PID:7956
- C:\Windows\System\FeYtiMf.exe
  C:\Windows\System\FeYtiMf.exe
  2⤵
  PID:7984
- C:\Windows\System\uRxThsG.exe
  C:\Windows\System\uRxThsG.exe
  2⤵
  PID:8012
- C:\Windows\System\nGcOUut.exe
  C:\Windows\System\nGcOUut.exe
  2⤵
  PID:8032
- C:\Windows\System\UPbIbyY.exe
  C:\Windows\System\UPbIbyY.exe
  2⤵
  PID:8064
- C:\Windows\System\fMuGAJj.exe
  C:\Windows\System\fMuGAJj.exe
  2⤵
  PID:8084
- C:\Windows\System\NIdMCSS.exe
  C:\Windows\System\NIdMCSS.exe
  2⤵
  PID:8112
- C:\Windows\System\HsLQnOR.exe
  C:\Windows\System\HsLQnOR.exe
  2⤵
  PID:8140
- C:\Windows\System\hSnyrkc.exe
  C:\Windows\System\hSnyrkc.exe
  2⤵
  PID:8168
- C:\Windows\System\XTzacgS.exe
  C:\Windows\System\XTzacgS.exe
  2⤵
  PID:6940
- C:\Windows\System\VuDpcpf.exe
  C:\Windows\System\VuDpcpf.exe
  2⤵
  PID:6240
- C:\Windows\System\KFSbcbZ.exe
  C:\Windows\System\KFSbcbZ.exe
  2⤵
  PID:6692
- C:\Windows\System\VjsNhsh.exe
  C:\Windows\System\VjsNhsh.exe
  2⤵
  PID:6896
- C:\Windows\System\BTjgkUm.exe
  C:\Windows\System\BTjgkUm.exe
  2⤵
  PID:7296
- C:\Windows\System\Wmfjtjj.exe
  C:\Windows\System\Wmfjtjj.exe
  2⤵
  PID:7244
- C:\Windows\System\nyYlMgI.exe
  C:\Windows\System\nyYlMgI.exe
  2⤵
  PID:7192
- C:\Windows\System\niZHixp.exe
  C:\Windows\System\niZHixp.exe
  2⤵
  PID:7448
- C:\Windows\System\vlzgztA.exe
  C:\Windows\System\vlzgztA.exe
  2⤵
  PID:7248
- C:\Windows\System\CQFgkfy.exe
  C:\Windows\System\CQFgkfy.exe
  2⤵
  PID:7536
- C:\Windows\System\nOOrlrE.exe
  C:\Windows\System\nOOrlrE.exe
  2⤵
  PID:7568
- C:\Windows\System\rxhwIku.exe
  C:\Windows\System\rxhwIku.exe
  2⤵
  PID:7392
- C:\Windows\System\DKQnDkD.exe
  C:\Windows\System\DKQnDkD.exe
  2⤵
  PID:7652
- C:\Windows\System\lXGWoHd.exe
  C:\Windows\System\lXGWoHd.exe
  2⤵
  PID:7684
- C:\Windows\System\MtJfhRg.exe
  C:\Windows\System\MtJfhRg.exe
  2⤵
  PID:7708
- C:\Windows\System\suPjtEu.exe
  C:\Windows\System\suPjtEu.exe
  2⤵
  PID:7656
- C:\Windows\System\RyXEOAd.exe
  C:\Windows\System\RyXEOAd.exe
  2⤵
  PID:8000
- C:\Windows\System\XCJlDNE.exe
  C:\Windows\System\XCJlDNE.exe
  2⤵
  PID:8080
- C:\Windows\System\AlsWuxH.exe
  C:\Windows\System\AlsWuxH.exe
  2⤵
  PID:7968
- C:\Windows\System\SlQAVFg.exe
  C:\Windows\System\SlQAVFg.exe
  2⤵
  PID:8008
- C:\Windows\System\aJzatth.exe
  C:\Windows\System\aJzatth.exe
  2⤵
  PID:8060
- C:\Windows\System\UPmOmyb.exe
  C:\Windows\System\UPmOmyb.exe
  2⤵
  PID:8132
- C:\Windows\System\XiPWhMx.exe
  C:\Windows\System\XiPWhMx.exe
  2⤵
  PID:8024
- C:\Windows\System\fArXDZV.exe
  C:\Windows\System\fArXDZV.exe
  2⤵
  PID:7488
- C:\Windows\System\ILcRchc.exe
  C:\Windows\System\ILcRchc.exe
  2⤵
  PID:7704
- C:\Windows\System\oYdWHpd.exe
  C:\Windows\System\oYdWHpd.exe
  2⤵
  PID:8204
- C:\Windows\System\dcvZAmI.exe
  C:\Windows\System\dcvZAmI.exe
  2⤵
  PID:8228
- C:\Windows\System\DETYHUn.exe
  C:\Windows\System\DETYHUn.exe
  2⤵
  PID:8344
- C:\Windows\System\gEjSfcF.exe
  C:\Windows\System\gEjSfcF.exe
  2⤵
  PID:8368
- C:\Windows\System\tSbBeeA.exe
  C:\Windows\System\tSbBeeA.exe
  2⤵
  PID:8392
- C:\Windows\System\SpYaFBX.exe
  C:\Windows\System\SpYaFBX.exe
  2⤵
  PID:8420
- C:\Windows\System\BKAELkB.exe
  C:\Windows\System\BKAELkB.exe
  2⤵
  PID:8472
- C:\Windows\System\uNVlwVt.exe
  C:\Windows\System\uNVlwVt.exe
  2⤵
  PID:8504
- C:\Windows\System\iUzmJmR.exe
  C:\Windows\System\iUzmJmR.exe
  2⤵
  PID:8540
- C:\Windows\System\uireDSD.exe
  C:\Windows\System\uireDSD.exe
  2⤵
  PID:8568
- C:\Windows\System\ElezYGb.exe
  C:\Windows\System\ElezYGb.exe
  2⤵
  PID:8596
- C:\Windows\System\BRZTiqG.exe
  C:\Windows\System\BRZTiqG.exe
  2⤵
  PID:8628
- C:\Windows\System\yMgMUBX.exe
  C:\Windows\System\yMgMUBX.exe
  2⤵
  PID:8656
- C:\Windows\System\NcZQZjq.exe
  C:\Windows\System\NcZQZjq.exe
  2⤵
  PID:8672
- C:\Windows\System\FuTvCbC.exe
  C:\Windows\System\FuTvCbC.exe
  2⤵
  PID:8700
- C:\Windows\System\dJhwOaG.exe
  C:\Windows\System\dJhwOaG.exe
  2⤵
  PID:8720
- C:\Windows\System\guMTIgZ.exe
  C:\Windows\System\guMTIgZ.exe
  2⤵
  PID:8744
- C:\Windows\System\OjEvNsq.exe
  C:\Windows\System\OjEvNsq.exe
  2⤵
  PID:8768
- C:\Windows\System\fBhlwPm.exe
  C:\Windows\System\fBhlwPm.exe
  2⤵
  PID:8784
- C:\Windows\System\MsSXIJt.exe
  C:\Windows\System\MsSXIJt.exe
  2⤵
  PID:8808
- C:\Windows\System\vDgZgLn.exe
  C:\Windows\System\vDgZgLn.exe
  2⤵
  PID:8832
- C:\Windows\System\hErQHcj.exe
  C:\Windows\System\hErQHcj.exe
  2⤵
  PID:8852
- C:\Windows\System\rOQEfbv.exe
  C:\Windows\System\rOQEfbv.exe
  2⤵
  PID:8876
- C:\Windows\System\ZctAqOc.exe
  C:\Windows\System\ZctAqOc.exe
  2⤵
  PID:8904
- C:\Windows\System\FovToeE.exe
  C:\Windows\System\FovToeE.exe
  2⤵
  PID:8928
- C:\Windows\System\jkMWGYF.exe
  C:\Windows\System\jkMWGYF.exe
  2⤵
  PID:8952
- C:\Windows\System\vKLGtzr.exe
  C:\Windows\System\vKLGtzr.exe
  2⤵
  PID:8968
- C:\Windows\System\aHtauwC.exe
  C:\Windows\System\aHtauwC.exe
  2⤵
  PID:9004
- C:\Windows\System\HhHMCVk.exe
  C:\Windows\System\HhHMCVk.exe
  2⤵
  PID:9032
- C:\Windows\System\DAkdlcT.exe
  C:\Windows\System\DAkdlcT.exe
  2⤵
  PID:9056
- C:\Windows\System\oXqshne.exe
  C:\Windows\System\oXqshne.exe
  2⤵
  PID:9096
- C:\Windows\System\SzjudLR.exe
  C:\Windows\System\SzjudLR.exe
  2⤵
  PID:9124
- C:\Windows\System\vBRDFGl.exe
  C:\Windows\System\vBRDFGl.exe
  2⤵
  PID:9144
- C:\Windows\System\hcmaPCz.exe
  C:\Windows\System\hcmaPCz.exe
  2⤵
  PID:9168
- C:\Windows\System\IgesVwa.exe
  C:\Windows\System\IgesVwa.exe
  2⤵
  PID:9200
- C:\Windows\System\lzyqCZQ.exe
  C:\Windows\System\lzyqCZQ.exe
  2⤵
  PID:7344
- C:\Windows\System\GXvAnGb.exe
  C:\Windows\System\GXvAnGb.exe
  2⤵
  PID:7640
- C:\Windows\System\nqyVeOe.exe
  C:\Windows\System\nqyVeOe.exe
  2⤵
  PID:7576
- C:\Windows\System\mzILala.exe
  C:\Windows\System\mzILala.exe
  2⤵
  PID:7312
- C:\Windows\System\AtDiNCo.exe
  C:\Windows\System\AtDiNCo.exe
  2⤵
  PID:8256
- C:\Windows\System\KndmjJx.exe
  C:\Windows\System\KndmjJx.exe
  2⤵
  PID:7948
- C:\Windows\System\rXuqUcR.exe
  C:\Windows\System\rXuqUcR.exe
  2⤵
  PID:7936
- C:\Windows\System\XkCzogo.exe
  C:\Windows\System\XkCzogo.exe
  2⤵
  PID:8052
- C:\Windows\System\qYRqDHV.exe
  C:\Windows\System\qYRqDHV.exe
  2⤵
  PID:8160
- C:\Windows\System\psHAeAD.exe
  C:\Windows\System\psHAeAD.exe
  2⤵
  PID:8400
- C:\Windows\System\xxZKHof.exe
  C:\Windows\System\xxZKHof.exe
  2⤵
  PID:8440
- C:\Windows\System\Amwowor.exe
  C:\Windows\System\Amwowor.exe
  2⤵
  PID:8524
- C:\Windows\System\IfUiGvr.exe
  C:\Windows\System\IfUiGvr.exe
  2⤵
  PID:5820
- C:\Windows\System\PESEJrT.exe
  C:\Windows\System\PESEJrT.exe
  2⤵
  PID:8356
- C:\Windows\System\WRXnxiN.exe
  C:\Windows\System\WRXnxiN.exe
  2⤵
  PID:8760
- C:\Windows\System\fQqSTKo.exe
  C:\Windows\System\fQqSTKo.exe
  2⤵
  PID:8496
- C:\Windows\System\eWvcXif.exe
  C:\Windows\System\eWvcXif.exe
  2⤵
  PID:8816
- C:\Windows\System\wIiNvZG.exe
  C:\Windows\System\wIiNvZG.exe
  2⤵
  PID:8868
- C:\Windows\System\yNakGHE.exe
  C:\Windows\System\yNakGHE.exe
  2⤵
  PID:8776
- C:\Windows\System\LuCNmQH.exe
  C:\Windows\System\LuCNmQH.exe
  2⤵
  PID:9044
- C:\Windows\System\PitPACy.exe
  C:\Windows\System\PitPACy.exe
  2⤵
  PID:8664
- C:\Windows\System\xXJWLIs.exe
  C:\Windows\System\xXJWLIs.exe
  2⤵
  PID:8892
- C:\Windows\System\FztpCsN.exe
  C:\Windows\System\FztpCsN.exe
  2⤵
  PID:8940
- C:\Windows\System\cPuoUQY.exe
  C:\Windows\System\cPuoUQY.exe
  2⤵
  PID:7440
- C:\Windows\System\WowGbHs.exe
  C:\Windows\System\WowGbHs.exe
  2⤵
  PID:7212
- C:\Windows\System\ORNISNj.exe
  C:\Windows\System\ORNISNj.exe
  2⤵
  PID:9076
- C:\Windows\System\abuxREH.exe
  C:\Windows\System\abuxREH.exe
  2⤵
  PID:9188
- C:\Windows\System\MgYYmSQ.exe
  C:\Windows\System\MgYYmSQ.exe
  2⤵
  PID:8964
- C:\Windows\System\KgzjNdS.exe
  C:\Windows\System\KgzjNdS.exe
  2⤵
  PID:7972
- C:\Windows\System\sFlsrJW.exe
  C:\Windows\System\sFlsrJW.exe
  2⤵
  PID:7436
- C:\Windows\System\ziBwcWN.exe
  C:\Windows\System\ziBwcWN.exe
  2⤵
  PID:9224
- C:\Windows\System\WnnydJd.exe
  C:\Windows\System\WnnydJd.exe
  2⤵
  PID:9248
- C:\Windows\System\yCeeKHt.exe
  C:\Windows\System\yCeeKHt.exe
  2⤵
  PID:9272
- C:\Windows\System\YpoSOvG.exe
  C:\Windows\System\YpoSOvG.exe
  2⤵
  PID:9296
- C:\Windows\System\TTjQKCl.exe
  C:\Windows\System\TTjQKCl.exe
  2⤵
  PID:9324
- C:\Windows\System\aNooEtL.exe
  C:\Windows\System\aNooEtL.exe
  2⤵
  PID:9348
- C:\Windows\System\KSXYlyN.exe
  C:\Windows\System\KSXYlyN.exe
  2⤵
  PID:9368
- C:\Windows\System\fkQuNCj.exe
  C:\Windows\System\fkQuNCj.exe
  2⤵
  PID:9404
- C:\Windows\System\VJkfyVd.exe
  C:\Windows\System\VJkfyVd.exe
  2⤵
  PID:9428
- C:\Windows\System\PSApZSz.exe
  C:\Windows\System\PSApZSz.exe
  2⤵
  PID:9460
- C:\Windows\System\AIgyRir.exe
  C:\Windows\System\AIgyRir.exe
  2⤵
  PID:9484
- C:\Windows\System\VAxEFQK.exe
  C:\Windows\System\VAxEFQK.exe
  2⤵
  PID:9508
- C:\Windows\System\alknICw.exe
  C:\Windows\System\alknICw.exe
  2⤵
  PID:9536
- C:\Windows\System\gYjyvMK.exe
  C:\Windows\System\gYjyvMK.exe
  2⤵
  PID:9564
- C:\Windows\System\nzZncau.exe
  C:\Windows\System\nzZncau.exe
  2⤵
  PID:9588
- C:\Windows\System\sfSNQuD.exe
  C:\Windows\System\sfSNQuD.exe
  2⤵
  PID:9620
- C:\Windows\System\imgfzrC.exe
  C:\Windows\System\imgfzrC.exe
  2⤵
  PID:9652
- C:\Windows\System\vDrpXVK.exe
  C:\Windows\System\vDrpXVK.exe
  2⤵
  PID:9668
- C:\Windows\System\LnnIJMJ.exe
  C:\Windows\System\LnnIJMJ.exe
  2⤵
  PID:9696
- C:\Windows\System\YJktKdZ.exe
  C:\Windows\System\YJktKdZ.exe
  2⤵
  PID:9720
- C:\Windows\System\DZkOKDQ.exe
  C:\Windows\System\DZkOKDQ.exe
  2⤵
  PID:9744
- C:\Windows\System\meKxaHF.exe
  C:\Windows\System\meKxaHF.exe
  2⤵
  PID:9760
- C:\Windows\System\yrFBUDX.exe
  C:\Windows\System\yrFBUDX.exe
  2⤵
  PID:9788
- C:\Windows\System\vMTclec.exe
  C:\Windows\System\vMTclec.exe
  2⤵
  PID:9816
- C:\Windows\System\mXPrGRx.exe
  C:\Windows\System\mXPrGRx.exe
  2⤵
  PID:9844
- C:\Windows\System\mMiuesc.exe
  C:\Windows\System\mMiuesc.exe
  2⤵
  PID:9876
- C:\Windows\System\cbbcgMz.exe
  C:\Windows\System\cbbcgMz.exe
  2⤵
  PID:9892
- C:\Windows\System\UqAlSPr.exe
  C:\Windows\System\UqAlSPr.exe
  2⤵
  PID:9916
- C:\Windows\System\AjRDNIs.exe
  C:\Windows\System\AjRDNIs.exe
  2⤵
  PID:9940
- C:\Windows\System\jkvDSuP.exe
  C:\Windows\System\jkvDSuP.exe
  2⤵
  PID:9968
- C:\Windows\System\qMjApsY.exe
  C:\Windows\System\qMjApsY.exe
  2⤵
  PID:9992
- C:\Windows\System\YMafgxA.exe
  C:\Windows\System\YMafgxA.exe
  2⤵
  PID:10016
- C:\Windows\System\ctXxgKc.exe
  C:\Windows\System\ctXxgKc.exe
  2⤵
  PID:10044
- C:\Windows\System\SVQRUMr.exe
  C:\Windows\System\SVQRUMr.exe
  2⤵
  PID:10064
- C:\Windows\System\LFEqqEN.exe
  C:\Windows\System\LFEqqEN.exe
  2⤵
  PID:10084
- C:\Windows\System\rGDdtQL.exe
  C:\Windows\System\rGDdtQL.exe
  2⤵
  PID:10104
- C:\Windows\System\lPcMtRI.exe
  C:\Windows\System\lPcMtRI.exe
  2⤵
  PID:10124
- C:\Windows\System\UhPHkSQ.exe
  C:\Windows\System\UhPHkSQ.exe
  2⤵
  PID:10152
- C:\Windows\System\rPPAydk.exe
  C:\Windows\System\rPPAydk.exe
  2⤵
  PID:10188
- C:\Windows\System\PalqkBG.exe
  C:\Windows\System\PalqkBG.exe
  2⤵
  PID:10204
- C:\Windows\System\oPcxapg.exe
  C:\Windows\System\oPcxapg.exe
  2⤵
  PID:10224
- C:\Windows\System\UarCPOU.exe
  C:\Windows\System\UarCPOU.exe
  2⤵
  PID:8468
- C:\Windows\System\sQtUhJA.exe
  C:\Windows\System\sQtUhJA.exe
  2⤵
  PID:9208
- C:\Windows\System\DTuLPyw.exe
  C:\Windows\System\DTuLPyw.exe
  2⤵
  PID:8352
- C:\Windows\System\tUBIrNw.exe
  C:\Windows\System\tUBIrNw.exe
  2⤵
  PID:8492
- C:\Windows\System\CdVxQLf.exe
  C:\Windows\System\CdVxQLf.exe
  2⤵
  PID:9220
- C:\Windows\System\ndweGcU.exe
  C:\Windows\System\ndweGcU.exe
  2⤵
  PID:9020
- C:\Windows\System\trNjhcb.exe
  C:\Windows\System\trNjhcb.exe
  2⤵
  PID:9376
- C:\Windows\System\SOivMee.exe
  C:\Windows\System\SOivMee.exe
  2⤵
  PID:8436
- C:\Windows\System\KXOerzL.exe
  C:\Windows\System\KXOerzL.exe
  2⤵
  PID:7864
- C:\Windows\System\xZzRlxn.exe
  C:\Windows\System\xZzRlxn.exe
  2⤵
  PID:9240
- C:\Windows\System\SStefgt.exe
  C:\Windows\System\SStefgt.exe
  2⤵
  PID:9280
- C:\Windows\System\CqfKQUi.exe
  C:\Windows\System\CqfKQUi.exe
  2⤵
  PID:9304
- C:\Windows\System\tVjBqUY.exe
  C:\Windows\System\tVjBqUY.exe
  2⤵
  PID:9356
- C:\Windows\System\HSvzPKc.exe
  C:\Windows\System\HSvzPKc.exe
  2⤵
  PID:9756
- C:\Windows\System\QbrPWXA.exe
  C:\Windows\System\QbrPWXA.exe
  2⤵
  PID:7220
- C:\Windows\System\PuRLGXe.exe
  C:\Windows\System\PuRLGXe.exe
  2⤵
  PID:9572
- C:\Windows\System\YZtkrGd.exe
  C:\Windows\System\YZtkrGd.exe
  2⤵
  PID:9308
- C:\Windows\System\JhLhAWO.exe
  C:\Windows\System\JhLhAWO.exe
  2⤵
  PID:9752
- C:\Windows\System\ybEDfOJ.exe
  C:\Windows\System\ybEDfOJ.exe
  2⤵
  PID:9476
- C:\Windows\System\TwxeWbH.exe
  C:\Windows\System\TwxeWbH.exe
  2⤵
  PID:9888
- C:\Windows\System\RjzErjT.exe
  C:\Windows\System\RjzErjT.exe
  2⤵
  PID:9924
- C:\Windows\System\ktuiUfy.exe
  C:\Windows\System\ktuiUfy.exe
  2⤵
  PID:9268
- C:\Windows\System\sBzpFWm.exe
  C:\Windows\System\sBzpFWm.exe
  2⤵
  PID:10136
- C:\Windows\System\qionzer.exe
  C:\Windows\System\qionzer.exe
  2⤵
  PID:9868
- C:\Windows\System\vKPmYUR.exe
  C:\Windows\System\vKPmYUR.exe
  2⤵
  PID:10244
- C:\Windows\System\UbfhHPa.exe
  C:\Windows\System\UbfhHPa.exe
  2⤵
  PID:10272
- C:\Windows\System\qolPmGe.exe
  C:\Windows\System\qolPmGe.exe
  2⤵
  PID:10300
- C:\Windows\System\GkRrrus.exe
  C:\Windows\System\GkRrrus.exe
  2⤵
  PID:10324
- C:\Windows\System\YipYkSd.exe
  C:\Windows\System\YipYkSd.exe
  2⤵
  PID:10344
- C:\Windows\System\IyAInQI.exe
  C:\Windows\System\IyAInQI.exe
  2⤵
  PID:10372
- C:\Windows\System\gjzmTaQ.exe
  C:\Windows\System\gjzmTaQ.exe
  2⤵
  PID:10408
- C:\Windows\System\lSfYYUe.exe
  C:\Windows\System\lSfYYUe.exe
  2⤵
  PID:10432
- C:\Windows\System\RcxhaZb.exe
  C:\Windows\System\RcxhaZb.exe
  2⤵
  PID:10448
- C:\Windows\System\YcsSyPs.exe
  C:\Windows\System\YcsSyPs.exe
  2⤵
  PID:10472
- C:\Windows\System\WclJfWC.exe
  C:\Windows\System\WclJfWC.exe
  2⤵
  PID:10500
- C:\Windows\System\uPeoIzE.exe
  C:\Windows\System\uPeoIzE.exe
  2⤵
  PID:10524
- C:\Windows\System\EjZMzFA.exe
  C:\Windows\System\EjZMzFA.exe
  2⤵
  PID:10552
- C:\Windows\System\oZdnGLk.exe
  C:\Windows\System\oZdnGLk.exe
  2⤵
  PID:10572
- C:\Windows\System\AyWOzNG.exe
  C:\Windows\System\AyWOzNG.exe
  2⤵
  PID:10596
- C:\Windows\System\KyhvDmL.exe
  C:\Windows\System\KyhvDmL.exe
  2⤵
  PID:10616
- C:\Windows\System\FUBrjRM.exe
  C:\Windows\System\FUBrjRM.exe
  2⤵
  PID:10648
- C:\Windows\System\GcubwqQ.exe
  C:\Windows\System\GcubwqQ.exe
  2⤵
  PID:10672
- C:\Windows\System\ffPWoGI.exe
  C:\Windows\System\ffPWoGI.exe
  2⤵
  PID:10700
- C:\Windows\System\VhNgitK.exe
  C:\Windows\System\VhNgitK.exe
  2⤵
  PID:10724
- C:\Windows\System\NcapDPa.exe
  C:\Windows\System\NcapDPa.exe
  2⤵
  PID:10752
- C:\Windows\System\NNMbkGI.exe
  C:\Windows\System\NNMbkGI.exe
  2⤵
  PID:10780
- C:\Windows\System\mbYgZJo.exe
  C:\Windows\System\mbYgZJo.exe
  2⤵
  PID:10804
- C:\Windows\System\OYbfJKs.exe
  C:\Windows\System\OYbfJKs.exe
  2⤵
  PID:10832
- C:\Windows\System\oegPgGK.exe
  C:\Windows\System\oegPgGK.exe
  2⤵
  PID:10856
- C:\Windows\System\mSfxIxv.exe
  C:\Windows\System\mSfxIxv.exe
  2⤵
  PID:10876
- C:\Windows\System\oGlSPcA.exe
  C:\Windows\System\oGlSPcA.exe
  2⤵
  PID:10900
- C:\Windows\System\RjCKCNv.exe
  C:\Windows\System\RjCKCNv.exe
  2⤵
  PID:10924
- C:\Windows\System\vESUGpc.exe
  C:\Windows\System\vESUGpc.exe
  2⤵
  PID:10952
- C:\Windows\System\cVabZIB.exe
  C:\Windows\System\cVabZIB.exe
  2⤵
  PID:10976
- C:\Windows\System\yZlNuPS.exe
  C:\Windows\System\yZlNuPS.exe
  2⤵
  PID:11008
- C:\Windows\System\bYFLcnx.exe
  C:\Windows\System\bYFLcnx.exe
  2⤵
  PID:11032
- C:\Windows\System\eGGLHuJ.exe
  C:\Windows\System\eGGLHuJ.exe
  2⤵
  PID:11056
- C:\Windows\System\OcvslXR.exe
  C:\Windows\System\OcvslXR.exe
  2⤵
  PID:11076
- C:\Windows\System\NBMQoRD.exe
  C:\Windows\System\NBMQoRD.exe
  2⤵
  PID:11096
- C:\Windows\System\aFhztio.exe
  C:\Windows\System\aFhztio.exe
  2⤵
  PID:11124
- C:\Windows\System\GRLepne.exe
  C:\Windows\System\GRLepne.exe
  2⤵
  PID:11144
- C:\Windows\System\BiiaALl.exe
  C:\Windows\System\BiiaALl.exe
  2⤵
  PID:11160
- C:\Windows\System\SjyJIdT.exe
  C:\Windows\System\SjyJIdT.exe
  2⤵
  PID:11188
- C:\Windows\System\blcfnPX.exe
  C:\Windows\System\blcfnPX.exe
  2⤵
  PID:11212
- C:\Windows\System\DnsjbiJ.exe
  C:\Windows\System\DnsjbiJ.exe
  2⤵
  PID:11232
- C:\Windows\System\OOSgisf.exe
  C:\Windows\System\OOSgisf.exe
  2⤵
  PID:11252
- C:\Windows\System\PVULhrY.exe
  C:\Windows\System\PVULhrY.exe
  2⤵
  PID:10232
- C:\Windows\System\sUyTHZT.exe
  C:\Windows\System\sUyTHZT.exe
  2⤵
  PID:9932
- C:\Windows\System\IqgsrGg.exe
  C:\Windows\System\IqgsrGg.exe
  2⤵
  PID:8564
- C:\Windows\System\FnEGrLW.exe
  C:\Windows\System\FnEGrLW.exe
  2⤵
  PID:9444
- C:\Windows\System\kbxpTUP.exe
  C:\Windows\System\kbxpTUP.exe
  2⤵
  PID:10092
- C:\Windows\System\eteeGNS.exe
  C:\Windows\System\eteeGNS.exe
  2⤵
  PID:9260
- C:\Windows\System\LaRqPWH.exe
  C:\Windows\System\LaRqPWH.exe
  2⤵
  PID:9684
- C:\Windows\System\CtJkana.exe
  C:\Windows\System\CtJkana.exe
  2⤵
  PID:8448
- C:\Windows\System\PcZLQuV.exe
  C:\Windows\System\PcZLQuV.exe
  2⤵
  PID:10320
- C:\Windows\System\QrEoKCp.exe
  C:\Windows\System\QrEoKCp.exe
  2⤵
  PID:10384
- C:\Windows\System\NeadYVx.exe
  C:\Windows\System\NeadYVx.exe
  2⤵
  PID:10424
- C:\Windows\System\NbIAKIE.exe
  C:\Windows\System\NbIAKIE.exe
  2⤵
  PID:9088
- C:\Windows\System\PFzrfSk.exe
  C:\Windows\System\PFzrfSk.exe
  2⤵
  PID:9448
- C:\Windows\System\Ncihrmj.exe
  C:\Windows\System\Ncihrmj.exe
  2⤵
  PID:10028
- C:\Windows\System\jEvyfNw.exe
  C:\Windows\System\jEvyfNw.exe
  2⤵
  PID:10080
- C:\Windows\System\adcgfhl.exe
  C:\Windows\System\adcgfhl.exe
  2⤵
  PID:10212
- C:\Windows\System\VSWzoNE.exe
  C:\Windows\System\VSWzoNE.exe
  2⤵
  PID:10716
- C:\Windows\System\OKrEvTI.exe
  C:\Windows\System\OKrEvTI.exe
  2⤵
  PID:10792
- C:\Windows\System\krPzSce.exe
  C:\Windows\System\krPzSce.exe
  2⤵
  PID:10420
- C:\Windows\System\DSleSnk.exe
  C:\Windows\System\DSleSnk.exe
  2⤵
  PID:10932
- C:\Windows\System\kfjxGqW.exe
  C:\Windows\System\kfjxGqW.exe
  2⤵
  PID:10520
- C:\Windows\System\mAhtkHQ.exe
  C:\Windows\System\mAhtkHQ.exe
  2⤵
  PID:10560
- C:\Windows\System\fVPDDqu.exe
  C:\Windows\System\fVPDDqu.exe
  2⤵
  PID:10636
- C:\Windows\System\IiBPIia.exe
  C:\Windows\System\IiBPIia.exe
  2⤵
  PID:11224
- C:\Windows\System\inlqfkb.exe
  C:\Windows\System\inlqfkb.exe
  2⤵
  PID:10800
- C:\Windows\System\hCyzmcU.exe
  C:\Windows\System\hCyzmcU.exe
  2⤵
  PID:11276
- C:\Windows\System\jSoeecT.exe
  C:\Windows\System\jSoeecT.exe
  2⤵
  PID:11300
- C:\Windows\System\iydCuNM.exe
  C:\Windows\System\iydCuNM.exe
  2⤵
  PID:11328
- C:\Windows\System\zrnlEuM.exe
  C:\Windows\System\zrnlEuM.exe
  2⤵
  PID:11348
- C:\Windows\System\RhjbAcL.exe
  C:\Windows\System\RhjbAcL.exe
  2⤵
  PID:11388
- C:\Windows\System\WlWDsaC.exe
  C:\Windows\System\WlWDsaC.exe
  2⤵
  PID:11408
- C:\Windows\System\VXHsuYs.exe
  C:\Windows\System\VXHsuYs.exe
  2⤵
  PID:11428
- C:\Windows\System\aFqDqmk.exe
  C:\Windows\System\aFqDqmk.exe
  2⤵
  PID:11452
- C:\Windows\System\ocUuAWu.exe
  C:\Windows\System\ocUuAWu.exe
  2⤵
  PID:11468
- C:\Windows\System\piJRpyC.exe
  C:\Windows\System\piJRpyC.exe
  2⤵
  PID:11484
- C:\Windows\System\HoVARPX.exe
  C:\Windows\System\HoVARPX.exe
  2⤵
  PID:11512
- C:\Windows\System\Fcbepzk.exe
  C:\Windows\System\Fcbepzk.exe
  2⤵
  PID:11536
- C:\Windows\System\OoBdOGz.exe
  C:\Windows\System\OoBdOGz.exe
  2⤵
  PID:11556
- C:\Windows\System\epSWDbs.exe
  C:\Windows\System\epSWDbs.exe
  2⤵
  PID:11588
- C:\Windows\System\TbrKSkz.exe
  C:\Windows\System\TbrKSkz.exe
  2⤵
  PID:11612
- C:\Windows\System\JtaVndd.exe
  C:\Windows\System\JtaVndd.exe
  2⤵
  PID:11636
- C:\Windows\System\ZuxPekG.exe
  C:\Windows\System\ZuxPekG.exe
  2⤵
  PID:11660
- C:\Windows\System\JYrAjYu.exe
  C:\Windows\System\JYrAjYu.exe
  2⤵
  PID:11680
- C:\Windows\System\TXDLnEb.exe
  C:\Windows\System\TXDLnEb.exe
  2⤵
  PID:11708
- C:\Windows\System\qcCYUQk.exe
  C:\Windows\System\qcCYUQk.exe
  2⤵
  PID:11740
- C:\Windows\System\brZuSIK.exe
  C:\Windows\System\brZuSIK.exe
  2⤵
  PID:11768
- C:\Windows\System\MpJxGXy.exe
  C:\Windows\System\MpJxGXy.exe
  2⤵
  PID:11788
- C:\Windows\System\FeRtmWT.exe
  C:\Windows\System\FeRtmWT.exe
  2⤵
  PID:11812
- C:\Windows\System\WqxFZSq.exe
  C:\Windows\System\WqxFZSq.exe
  2⤵
  PID:11836
- C:\Windows\System\IaKacdP.exe
  C:\Windows\System\IaKacdP.exe
  2⤵
  PID:11864
- C:\Windows\System\UZfRRgY.exe
  C:\Windows\System\UZfRRgY.exe
  2⤵
  PID:11880
- C:\Windows\System\tHBwCpP.exe
  C:\Windows\System\tHBwCpP.exe
  2⤵
  PID:11908
- C:\Windows\System\lsKbKGM.exe
  C:\Windows\System\lsKbKGM.exe
  2⤵
  PID:11932
- C:\Windows\System\vtBMXnm.exe
  C:\Windows\System\vtBMXnm.exe
  2⤵
  PID:11960
- C:\Windows\System\ufPSWHp.exe
  C:\Windows\System\ufPSWHp.exe
  2⤵
  PID:11984
- C:\Windows\System\CWUuXLZ.exe
  C:\Windows\System\CWUuXLZ.exe
  2⤵
  PID:12008
- C:\Windows\System\nQgHrzB.exe
  C:\Windows\System\nQgHrzB.exe
  2⤵
  PID:12036
- C:\Windows\System\OXXsZBt.exe
  C:\Windows\System\OXXsZBt.exe
  2⤵
  PID:12064
- C:\Windows\System\ZYtAhcQ.exe
  C:\Windows\System\ZYtAhcQ.exe
  2⤵
  PID:12088
- C:\Windows\System\awhGfbg.exe
  C:\Windows\System\awhGfbg.exe
  2⤵
  PID:12112
- C:\Windows\System\YfFgiyf.exe
  C:\Windows\System\YfFgiyf.exe
  2⤵
  PID:12140
- C:\Windows\System\FmxcDsl.exe
  C:\Windows\System\FmxcDsl.exe
  2⤵
  PID:12156
- C:\Windows\System\xJRRTEB.exe
  C:\Windows\System\xJRRTEB.exe
  2⤵
  PID:12184
- C:\Windows\System\lxdkhLh.exe
  C:\Windows\System\lxdkhLh.exe
  2⤵
  PID:12204
- C:\Windows\System\mfGYcOc.exe
  C:\Windows\System\mfGYcOc.exe
  2⤵
  PID:12220
- C:\Windows\System\CfGAgTY.exe
  C:\Windows\System\CfGAgTY.exe
  2⤵
  PID:12244
- C:\Windows\System\rhYnxFI.exe
  C:\Windows\System\rhYnxFI.exe
  2⤵
  PID:12264
- C:\Windows\System\ieosoUu.exe
  C:\Windows\System\ieosoUu.exe
  2⤵
  PID:10848
- C:\Windows\System\PVfrYJv.exe
  C:\Windows\System\PVfrYJv.exe
  2⤵
  PID:8796
- C:\Windows\System\HHVEepC.exe
  C:\Windows\System\HHVEepC.exe
  2⤵
  PID:10512
- C:\Windows\System\TVhooTa.exe
  C:\Windows\System\TVhooTa.exe
  2⤵
  PID:10592
- C:\Windows\System\ebQqJOV.exe
  C:\Windows\System\ebQqJOV.exe
  2⤵
  PID:11116
- C:\Windows\System\unYeJCy.exe
  C:\Windows\System\unYeJCy.exe
  2⤵
  PID:10340
- C:\Windows\System\iDwwYXe.exe
  C:\Windows\System\iDwwYXe.exe
  2⤵
  PID:11204
- C:\Windows\System\BJuUpRt.exe
  C:\Windows\System\BJuUpRt.exe
  2⤵
  PID:10668
- C:\Windows\System\rXdmihZ.exe
  C:\Windows\System\rXdmihZ.exe
  2⤵
  PID:10884
- C:\Windows\System\PlxKXin.exe
  C:\Windows\System\PlxKXin.exe
  2⤵
  PID:11404
- C:\Windows\System\QskmQOv.exe
  C:\Windows\System\QskmQOv.exe
  2⤵
  PID:11444
- C:\Windows\System\VigRoDZ.exe
  C:\Windows\System\VigRoDZ.exe
  2⤵
  PID:10316
- C:\Windows\System\jKyxxnn.exe
  C:\Windows\System\jKyxxnn.exe
  2⤵
  PID:10360
- C:\Windows\System\zMhICPV.exe
  C:\Windows\System\zMhICPV.exe
  2⤵
  PID:10492
- C:\Windows\System\hvNOxaT.exe
  C:\Windows\System\hvNOxaT.exe
  2⤵
  PID:11704
- C:\Windows\System\TmUGEdU.exe
  C:\Windows\System\TmUGEdU.exe
  2⤵
  PID:10280
- C:\Windows\System\aDcramz.exe
  C:\Windows\System\aDcramz.exe
  2⤵
  PID:11832
- C:\Windows\System\FXxAaTG.exe
  C:\Windows\System\FXxAaTG.exe
  2⤵
  PID:10548
- C:\Windows\System\qrwaIss.exe
  C:\Windows\System\qrwaIss.exe
  2⤵
  PID:11976
- C:\Windows\System\WNeBjKc.exe
  C:\Windows\System\WNeBjKc.exe
  2⤵
  PID:10772
- C:\Windows\System\oytIvea.exe
  C:\Windows\System\oytIvea.exe
  2⤵
  PID:12296
- C:\Windows\System\QClqIju.exe
  C:\Windows\System\QClqIju.exe
  2⤵
  PID:12312
- C:\Windows\System\SYPpsYf.exe
  C:\Windows\System\SYPpsYf.exe
  2⤵
  PID:12328
- C:\Windows\System\ebNsmVY.exe
  C:\Windows\System\ebNsmVY.exe
  2⤵
  PID:12360
- C:\Windows\System\KLWUJUa.exe
  C:\Windows\System\KLWUJUa.exe
  2⤵
  PID:12384
- C:\Windows\System\OeFXEDJ.exe
  C:\Windows\System\OeFXEDJ.exe
  2⤵
  PID:12408
- C:\Windows\System\CDFJbzL.exe
  C:\Windows\System\CDFJbzL.exe
  2⤵
  PID:12428
- C:\Windows\System\tTCprVy.exe
  C:\Windows\System\tTCprVy.exe
  2⤵
  PID:12444
- C:\Windows\System\eseNJlE.exe
  C:\Windows\System\eseNJlE.exe
  2⤵
  PID:12464
- C:\Windows\System\YRWrRMQ.exe
  C:\Windows\System\YRWrRMQ.exe
  2⤵
  PID:12492
- C:\Windows\System\FGaBGDV.exe
  C:\Windows\System\FGaBGDV.exe
  2⤵
  PID:12528
- C:\Windows\System\aCCymDE.exe
  C:\Windows\System\aCCymDE.exe
  2⤵
  PID:12548
- C:\Windows\System\BWtiAlL.exe
  C:\Windows\System\BWtiAlL.exe
  2⤵
  PID:12576
- C:\Windows\System\STuFNaJ.exe
  C:\Windows\System\STuFNaJ.exe
  2⤵
  PID:12592
- C:\Windows\System\kpWDYme.exe
  C:\Windows\System\kpWDYme.exe
  2⤵
  PID:12620
- C:\Windows\System\hPMyIvh.exe
  C:\Windows\System\hPMyIvh.exe
  2⤵
  PID:12640
- C:\Windows\System\gpJAHXO.exe
  C:\Windows\System\gpJAHXO.exe
  2⤵
  PID:12668
- C:\Windows\System\RQtsSmc.exe
  C:\Windows\System\RQtsSmc.exe
  2⤵
  PID:12688
- C:\Windows\System\jXtonWg.exe
  C:\Windows\System\jXtonWg.exe
  2⤵
  PID:12724
- C:\Windows\System\FeiXtsO.exe
  C:\Windows\System\FeiXtsO.exe
  2⤵
  PID:12744
- C:\Windows\System\UWpcEjj.exe
  C:\Windows\System\UWpcEjj.exe
  2⤵
  PID:12764
- C:\Windows\System\GHOLRXD.exe
  C:\Windows\System\GHOLRXD.exe
  2⤵
  PID:12792
- C:\Windows\System\AcEYhtd.exe
  C:\Windows\System\AcEYhtd.exe
  2⤵
  PID:12812
- C:\Windows\System\LcDxFFo.exe
  C:\Windows\System\LcDxFFo.exe
  2⤵
  PID:12832
- C:\Windows\System\wYIYTGX.exe
  C:\Windows\System\wYIYTGX.exe
  2⤵
  PID:12856
- C:\Windows\System\bnhZvzq.exe
  C:\Windows\System\bnhZvzq.exe
  2⤵
  PID:12880
- C:\Windows\System\ZCWgOSU.exe
  C:\Windows\System\ZCWgOSU.exe
  2⤵
  PID:12896
- C:\Windows\System\hFylrzg.exe
  C:\Windows\System\hFylrzg.exe
  2⤵
  PID:12920
- C:\Windows\System\pALKMpD.exe
  C:\Windows\System\pALKMpD.exe
  2⤵
  PID:12944
- C:\Windows\System\FRAYZll.exe
  C:\Windows\System\FRAYZll.exe
  2⤵
  PID:12968
- C:\Windows\System\DkadsMz.exe
  C:\Windows\System\DkadsMz.exe
  2⤵
  PID:13000
- C:\Windows\System\YdQaPiv.exe
  C:\Windows\System\YdQaPiv.exe
  2⤵
  PID:13036
- C:\Windows\System\GmzaHTg.exe
  C:\Windows\System\GmzaHTg.exe
  2⤵
  PID:13056
- C:\Windows\System\vDDUeQR.exe
  C:\Windows\System\vDDUeQR.exe
  2⤵
  PID:13076
- C:\Windows\System\IlniSOs.exe
  C:\Windows\System\IlniSOs.exe
  2⤵
  PID:13100
- C:\Windows\System\ZtMxbyt.exe
  C:\Windows\System\ZtMxbyt.exe
  2⤵
  PID:13116
- C:\Windows\System\FrATrBh.exe
  C:\Windows\System\FrATrBh.exe
  2⤵
  PID:13152
- C:\Windows\System\QwOlnCf.exe
  C:\Windows\System\QwOlnCf.exe
  2⤵
  PID:13176
- C:\Windows\System\lIIcpVT.exe
  C:\Windows\System\lIIcpVT.exe
  2⤵
  PID:13200
- C:\Windows\System\SHxvwES.exe
  C:\Windows\System\SHxvwES.exe
  2⤵
  PID:13220
- C:\Windows\System\wfafnOy.exe
  C:\Windows\System\wfafnOy.exe
  2⤵
  PID:13244
- C:\Windows\System\guoqgfn.exe
  C:\Windows\System\guoqgfn.exe
  2⤵
  PID:13260
- C:\Windows\System\WDJWZwW.exe
  C:\Windows\System\WDJWZwW.exe
  2⤵
  PID:13284
- C:\Windows\System\GXOddcY.exe
  C:\Windows\System\GXOddcY.exe
  2⤵
  PID:13308
- C:\Windows\System\tADLGDH.exe
  C:\Windows\System\tADLGDH.exe
  2⤵
  PID:11292
- C:\Windows\System\yOLwnKW.exe
  C:\Windows\System\yOLwnKW.exe
  2⤵
  PID:8820
- C:\Windows\System\pmghtwx.exe
  C:\Windows\System\pmghtwx.exe
  2⤵
  PID:9552
- C:\Windows\System\CBUipSF.exe
  C:\Windows\System\CBUipSF.exe
  2⤵
  PID:12232
- C:\Windows\System\Ushkfcb.exe
  C:\Windows\System\Ushkfcb.exe
  2⤵
  PID:10844
- C:\Windows\System\sFKybgu.exe
  C:\Windows\System\sFKybgu.exe
  2⤵
  PID:11548
- C:\Windows\System\WgoxPBJ.exe
  C:\Windows\System\WgoxPBJ.exe
  2⤵
  PID:11580
- C:\Windows\System\SCouhhF.exe
  C:\Windows\System\SCouhhF.exe
  2⤵
  PID:11624
- C:\Windows\System\GQhBrHA.exe
  C:\Windows\System\GQhBrHA.exe
  2⤵
  PID:11268
- C:\Windows\System\nzEtmJC.exe
  C:\Windows\System\nzEtmJC.exe
  2⤵
  PID:9884
- C:\Windows\System\rSoSPFr.exe
  C:\Windows\System\rSoSPFr.exe
  2⤵
  PID:10296
- C:\Windows\System\NVhppqH.exe
  C:\Windows\System\NVhppqH.exe
  2⤵
  PID:11876
- C:\Windows\System\JJieFWo.exe
  C:\Windows\System\JJieFWo.exe
  2⤵
  PID:11780
- C:\Windows\System\nHmClKM.exe
  C:\Windows\System\nHmClKM.exe
  2⤵
  PID:11972
- C:\Windows\System\KBHeMKr.exe
  C:\Windows\System\KBHeMKr.exe
  2⤵
  PID:12004
- C:\Windows\System\CmYchyN.exe
  C:\Windows\System\CmYchyN.exe
  2⤵
  PID:11980
- C:\Windows\System\jdeduSw.exe
  C:\Windows\System\jdeduSw.exe
  2⤵
  PID:11344
- C:\Windows\System\jVgrErl.exe
  C:\Windows\System\jVgrErl.exe
  2⤵
  PID:12424
- C:\Windows\System\POoCvUp.exe
  C:\Windows\System\POoCvUp.exe
  2⤵
  PID:1436
- C:\Windows\System\TcFoQbx.exe
  C:\Windows\System\TcFoQbx.exe
  2⤵
  PID:11464
- C:\Windows\System\ExCAsVp.exe
  C:\Windows\System\ExCAsVp.exe
  2⤵
  PID:12544
- C:\Windows\System\OegseRz.exe
  C:\Windows\System\OegseRz.exe
  2⤵
  PID:11552
- C:\Windows\System\NqUfwOz.exe
  C:\Windows\System\NqUfwOz.exe
  2⤵
  PID:12732
- C:\Windows\System\WzzUavF.exe
  C:\Windows\System\WzzUavF.exe
  2⤵
  PID:13328
- C:\Windows\System\cMigxZd.exe
  C:\Windows\System\cMigxZd.exe
  2⤵
  PID:13348
- C:\Windows\System\NSAAObM.exe
  C:\Windows\System\NSAAObM.exe
  2⤵
  PID:13372
- C:\Windows\System\czBnZfT.exe
  C:\Windows\System\czBnZfT.exe
  2⤵
  PID:13388
- C:\Windows\System\rFecjno.exe
  C:\Windows\System\rFecjno.exe
  2⤵
  PID:13420
- C:\Windows\System\UbEquiI.exe
  C:\Windows\System\UbEquiI.exe
  2⤵
  PID:13440
- C:\Windows\System\ZWOLhMF.exe
  C:\Windows\System\ZWOLhMF.exe
  2⤵
  PID:13468
- C:\Windows\System\pLbRzuO.exe
  C:\Windows\System\pLbRzuO.exe
  2⤵
  PID:13492
- C:\Windows\System\PYVVpNO.exe
  C:\Windows\System\PYVVpNO.exe
  2⤵
  PID:13512
- C:\Windows\System\GEcSsxm.exe
  C:\Windows\System\GEcSsxm.exe
  2⤵
  PID:13536
- C:\Windows\System\ghWLsBq.exe
  C:\Windows\System\ghWLsBq.exe
  2⤵
  PID:13564
- C:\Windows\System\aPUfEJx.exe
  C:\Windows\System\aPUfEJx.exe
  2⤵
  PID:13588
- C:\Windows\System\PYUoaZM.exe
  C:\Windows\System\PYUoaZM.exe
  2⤵
  PID:13612
- C:\Windows\System\tgxNqaw.exe
  C:\Windows\System\tgxNqaw.exe
  2⤵
  PID:13632
- C:\Windows\System\oKzEqNs.exe
  C:\Windows\System\oKzEqNs.exe
  2⤵
  PID:13648
- C:\Windows\System\kcJlpdQ.exe
  C:\Windows\System\kcJlpdQ.exe
  2⤵
  PID:13676
- C:\Windows\System\euTIipC.exe
  C:\Windows\System\euTIipC.exe
  2⤵
  PID:13708
- C:\Windows\System\vZsCRVx.exe
  C:\Windows\System\vZsCRVx.exe
  2⤵
  PID:13728
- C:\Windows\System\XtshZHq.exe
  C:\Windows\System\XtshZHq.exe
  2⤵
  PID:13748
- C:\Windows\System\yfVWsby.exe
  C:\Windows\System\yfVWsby.exe
  2⤵
  PID:13772
- C:\Windows\System\lvomwWr.exe
  C:\Windows\System\lvomwWr.exe
  2⤵
  PID:13804
- C:\Windows\System\sBVeTHX.exe
  C:\Windows\System\sBVeTHX.exe
  2⤵
  PID:13836
- C:\Windows\System\vDJJWVQ.exe
  C:\Windows\System\vDJJWVQ.exe
  2⤵
  PID:13864
- C:\Windows\System\KVpiVqs.exe
  C:\Windows\System\KVpiVqs.exe
  2⤵
  PID:13884
- C:\Windows\System\DbacnfD.exe
  C:\Windows\System\DbacnfD.exe
  2⤵
  PID:13904
- C:\Windows\System\LidwCal.exe
  C:\Windows\System\LidwCal.exe
  2⤵
  PID:13924
- C:\Windows\System\xwwIDDO.exe
  C:\Windows\System\xwwIDDO.exe
  2⤵
  PID:13948
- C:\Windows\System\shdkkBn.exe
  C:\Windows\System\shdkkBn.exe
  2⤵
  PID:13972
- C:\Windows\System\MyxwTqi.exe
  C:\Windows\System\MyxwTqi.exe
  2⤵
  PID:14000
- C:\Windows\System\uwjSGaP.exe
  C:\Windows\System\uwjSGaP.exe
  2⤵
  PID:14036
- C:\Windows\System\uCbWzCX.exe
  C:\Windows\System\uCbWzCX.exe
  2⤵
  PID:14056
- C:\Windows\System\RvoZUVl.exe
  C:\Windows\System\RvoZUVl.exe
  2⤵
  PID:14084
- C:\Windows\System\dPVdnnJ.exe
  C:\Windows\System\dPVdnnJ.exe
  2⤵
  PID:14100
- C:\Windows\System\buqJjNX.exe
  C:\Windows\System\buqJjNX.exe
  2⤵
  PID:14124
- C:\Windows\System\TUwmXvP.exe
  C:\Windows\System\TUwmXvP.exe
  2⤵
  PID:14144
- C:\Windows\System\MpwbmXB.exe
  C:\Windows\System\MpwbmXB.exe
  2⤵
  PID:14168
- C:\Windows\System\pBtXKaE.exe
  C:\Windows\System\pBtXKaE.exe
  2⤵
  PID:14184
- C:\Windows\System\ITUJHxs.exe
  C:\Windows\System\ITUJHxs.exe
  2⤵
  PID:14216
- C:\Windows\System\cISRQGr.exe
  C:\Windows\System\cISRQGr.exe
  2⤵
  PID:14248
- C:\Windows\System\BvVlPOi.exe
  C:\Windows\System\BvVlPOi.exe
  2⤵
  PID:14264
- C:\Windows\System\GKlSfwf.exe
  C:\Windows\System\GKlSfwf.exe
  2⤵
  PID:14288
- C:\Windows\System\HHafIcC.exe
  C:\Windows\System\HHafIcC.exe
  2⤵
  PID:14328
- C:\Windows\System\GFgbCzF.exe
  C:\Windows\System\GFgbCzF.exe
  2⤵
  PID:11316
- C:\Windows\System\TQiSzkw.exe
  C:\Windows\System\TQiSzkw.exe
  2⤵
  PID:11688
- C:\Windows\System\jpquPYj.exe
  C:\Windows\System\jpquPYj.exe
  2⤵
  PID:12908
- C:\Windows\System\SWwYffB.exe
  C:\Windows\System\SWwYffB.exe
  2⤵
  PID:12988
- C:\Windows\System\ATUbhIL.exe
  C:\Windows\System\ATUbhIL.exe
  2⤵
  PID:9160
- C:\Windows\System\QtrwLCZ.exe
  C:\Windows\System\QtrwLCZ.exe
  2⤵
  PID:13068
- C:\Windows\System\jaPXHCt.exe
  C:\Windows\System\jaPXHCt.exe
  2⤵
  PID:13112
- C:\Windows\System\VNxZMMh.exe
  C:\Windows\System\VNxZMMh.exe
  2⤵
  PID:13208
- C:\Windows\System\EvcWzhN.exe
  C:\Windows\System\EvcWzhN.exe
  2⤵
  PID:13300
- C:\Windows\System\HmmoAVT.exe
  C:\Windows\System\HmmoAVT.exe
  2⤵
  PID:12096
- C:\Windows\System\EwCGjAP.exe
  C:\Windows\System\EwCGjAP.exe
  2⤵
  PID:12148
- C:\Windows\System\fnYWoiu.exe
  C:\Windows\System\fnYWoiu.exe
  2⤵
  PID:12216
- C:\Windows\System\SVwygAd.exe
  C:\Windows\System\SVwygAd.exe
  2⤵
  PID:12172
- C:\Windows\System\tLYonNV.exe
  C:\Windows\System\tLYonNV.exe
  2⤵
  PID:11632
- C:\Windows\System\fRFIcoD.exe
  C:\Windows\System\fRFIcoD.exe
  2⤵
  PID:11720
- C:\Windows\System\SKUsmtu.exe
  C:\Windows\System\SKUsmtu.exe
  2⤵
  PID:9928
- C:\Windows\System\yKkIJAc.exe
  C:\Windows\System\yKkIJAc.exe
  2⤵
  PID:10916
- C:\Windows\System\oCKhERF.exe
  C:\Windows\System\oCKhERF.exe
  2⤵
  PID:11064
- C:\Windows\System\rIwMRfP.exe
  C:\Windows\System\rIwMRfP.exe
  2⤵
  PID:12804
- C:\Windows\System\VbJAYJE.exe
  C:\Windows\System\VbJAYJE.exe
  2⤵
  PID:13400
- C:\Windows\System\ilvWAYN.exe
  C:\Windows\System\ilvWAYN.exe
  2⤵
  PID:11424
- C:\Windows\System\TEoKgTY.exe
  C:\Windows\System\TEoKgTY.exe
  2⤵
  PID:13484
- C:\Windows\System\CprwosW.exe
  C:\Windows\System\CprwosW.exe
  2⤵
  PID:13028
- C:\Windows\System\ltaURcu.exe
  C:\Windows\System\ltaURcu.exe
  2⤵
  PID:13088
- C:\Windows\System\OJxgjMs.exe
  C:\Windows\System\OJxgjMs.exe
  2⤵
  PID:11112
- C:\Windows\System\yAGUZWX.exe
  C:\Windows\System\yAGUZWX.exe
  2⤵
  PID:14348
- C:\Windows\System\MLGRPaT.exe
  C:\Windows\System\MLGRPaT.exe
  2⤵
  PID:14368
- C:\Windows\System\uIbxWTn.exe
  C:\Windows\System\uIbxWTn.exe
  2⤵
  PID:14384
- C:\Windows\System\UiFpZKM.exe
  C:\Windows\System\UiFpZKM.exe
  2⤵
  PID:14408
- C:\Windows\System\nNIbmvV.exe
  C:\Windows\System\nNIbmvV.exe
  2⤵
  PID:14428
- C:\Windows\System\mgZTfWH.exe
  C:\Windows\System\mgZTfWH.exe
  2⤵
  PID:14460
- C:\Windows\System\xDuCJzq.exe
  C:\Windows\System\xDuCJzq.exe
  2⤵
  PID:14492
- C:\Windows\System\aJwQZkb.exe
  C:\Windows\System\aJwQZkb.exe
  2⤵
  PID:14512
- C:\Windows\System\kkgnjlQ.exe
  C:\Windows\System\kkgnjlQ.exe
  2⤵
  PID:14532
- C:\Windows\System\nKtudms.exe
  C:\Windows\System\nKtudms.exe
  2⤵
  PID:14552
- C:\Windows\System\QaapANq.exe
  C:\Windows\System\QaapANq.exe
  2⤵
  PID:14568
- C:\Windows\System\SZViTuC.exe
  C:\Windows\System\SZViTuC.exe
  2⤵
  PID:14592
- C:\Windows\System\EtgUXfV.exe
  C:\Windows\System\EtgUXfV.exe
  2⤵
  PID:14616
- C:\Windows\System\IpBdRJx.exe
  C:\Windows\System\IpBdRJx.exe
  2⤵
  PID:14640
- C:\Windows\System\FoJtmdU.exe
  C:\Windows\System\FoJtmdU.exe
  2⤵
  PID:14668
- C:\Windows\System\YQQiEfk.exe
  C:\Windows\System\YQQiEfk.exe
  2⤵
  PID:14692
- C:\Windows\System\goMOhcs.exe
  C:\Windows\System\goMOhcs.exe
  2⤵
  PID:14716
- C:\Windows\System\VOEbFdk.exe
  C:\Windows\System\VOEbFdk.exe
  2⤵
  PID:14748
- C:\Windows\System\xIPEShK.exe
  C:\Windows\System\xIPEShK.exe
  2⤵
  PID:14764
- C:\Windows\System\NUsjSyj.exe
  C:\Windows\System\NUsjSyj.exe
  2⤵
  PID:14792
- C:\Windows\System\NVouZQB.exe
  C:\Windows\System\NVouZQB.exe
  2⤵
  PID:14808
- C:\Windows\System\pmIrVCG.exe
  C:\Windows\System\pmIrVCG.exe
  2⤵
  PID:14824
- C:\Windows\System\oTykJag.exe
  C:\Windows\System\oTykJag.exe
  2⤵
  PID:14852
- C:\Windows\System\hllfrOL.exe
  C:\Windows\System\hllfrOL.exe
  2⤵
  PID:14880
- C:\Windows\System\CUCrjCO.exe
  C:\Windows\System\CUCrjCO.exe
  2⤵
  PID:14896
- C:\Windows\System\UMNDZBL.exe
  C:\Windows\System\UMNDZBL.exe
  2⤵
  PID:14932
- C:\Windows\System\odddQSC.exe
  C:\Windows\System\odddQSC.exe
  2⤵
  PID:14956
- C:\Windows\System\zqSYLzm.exe
  C:\Windows\System\zqSYLzm.exe
  2⤵
  PID:14972
- C:\Windows\System\gJchvXk.exe
  C:\Windows\System\gJchvXk.exe
  2⤵
  PID:14988
- C:\Windows\System\SgYdXtW.exe
  C:\Windows\System\SgYdXtW.exe
  2⤵
  PID:15008
- C:\Windows\System\UhYhkfv.exe
  C:\Windows\System\UhYhkfv.exe
  2⤵
  PID:15024
- C:\Windows\System\IGESFHG.exe
  C:\Windows\System\IGESFHG.exe
  2⤵
  PID:15040
- C:\Windows\System\lUCBGxX.exe
  C:\Windows\System\lUCBGxX.exe
  2⤵
  PID:15056
- C:\Windows\System\LvNkcDI.exe
  C:\Windows\System\LvNkcDI.exe
  2⤵
  PID:15096
- C:\Windows\System\FiQGeMl.exe
  C:\Windows\System\FiQGeMl.exe
  2⤵
  PID:15116
- C:\Windows\System\fPDhxgQ.exe
  C:\Windows\System\fPDhxgQ.exe
  2⤵
  PID:15136
- C:\Windows\System\TDnIGmv.exe
  C:\Windows\System\TDnIGmv.exe
  2⤵
  PID:15152
- C:\Windows\System\bznmxfm.exe
  C:\Windows\System\bznmxfm.exe
  2⤵
  PID:15176
- C:\Windows\System\UhwIzjn.exe
  C:\Windows\System\UhwIzjn.exe
  2⤵
  PID:15192
- C:\Windows\System\DWbWzgj.exe
  C:\Windows\System\DWbWzgj.exe
  2⤵
  PID:15220
- C:\Windows\System\aIJBrIP.exe
  C:\Windows\System\aIJBrIP.exe
  2⤵
  PID:15240
- C:\Windows\System\XsoLeLy.exe
  C:\Windows\System\XsoLeLy.exe
  2⤵
  PID:15268
- C:\Windows\System\QTIAjuX.exe
  C:\Windows\System\QTIAjuX.exe
  2⤵
  PID:15288
- C:\Windows\System\DiGhUbx.exe
  C:\Windows\System\DiGhUbx.exe
  2⤵
  PID:15316
- C:\Windows\System\lquDgtL.exe
  C:\Windows\System\lquDgtL.exe
  2⤵
  PID:15332
- C:\Windows\System\pTJzoHY.exe
  C:\Windows\System\pTJzoHY.exe
  2⤵
  PID:13780
- C:\Windows\System\GWhHiPD.exe
  C:\Windows\System\GWhHiPD.exe
  2⤵
  PID:13252
- C:\Windows\System\OKvXbhv.exe
  C:\Windows\System\OKvXbhv.exe
  2⤵
  PID:12060
- C:\Windows\System\QhWbRlm.exe
  C:\Windows\System\QhWbRlm.exe
  2⤵
  PID:13920
- C:\Windows\System\NLadxYh.exe
  C:\Windows\System\NLadxYh.exe
  2⤵
  PID:11004
- C:\Windows\System\SbPFadq.exe
  C:\Windows\System\SbPFadq.exe
  2⤵
  PID:14020
- C:\Windows\System\koxqgIr.exe
  C:\Windows\System\koxqgIr.exe
  2⤵
  PID:14048
- C:\Windows\System\XBlyDeB.exe
  C:\Windows\System\XBlyDeB.exe
  2⤵
  PID:14092
- C:\Windows\System\Hevoatj.exe
  C:\Windows\System\Hevoatj.exe
  2⤵
  PID:10396
- C:\Windows\System\dUxlExf.exe
  C:\Windows\System\dUxlExf.exe
  2⤵
  PID:11260
- C:\Windows\System\dMmpRdK.exe
  C:\Windows\System\dMmpRdK.exe
  2⤵
  PID:11324
- C:\Windows\System\aIBPoOo.exe
  C:\Windows\System\aIBPoOo.exe
  2⤵
  PID:12712
- C:\Windows\System\eQGNDNy.exe
  C:\Windows\System\eQGNDNy.exe
  2⤵
  PID:4420
- C:\Windows\System\TqGmjpO.exe
  C:\Windows\System\TqGmjpO.exe
  2⤵
  PID:13020
- C:\Windows\System\ptiRYGl.exe
  C:\Windows\System\ptiRYGl.exe
  2⤵
  PID:13192
- C:\Windows\System\cuMnZxP.exe
  C:\Windows\System\cuMnZxP.exe
  2⤵
  PID:13360
- C:\Windows\System\AFQrQCe.exe
  C:\Windows\System\AFQrQCe.exe
  2⤵
  PID:13384
- C:\Windows\System\daqyWKt.exe
  C:\Windows\System\daqyWKt.exe
  2⤵
  PID:13432
- C:\Windows\System\COEXXBj.exe
  C:\Windows\System\COEXXBj.exe
  2⤵
  PID:13532
- C:\Windows\System\tINkcyC.exe
  C:\Windows\System\tINkcyC.exe
  2⤵
  PID:12776
- C:\Windows\System\zdRqrEQ.exe
  C:\Windows\System\zdRqrEQ.exe
  2⤵
  PID:13604
- C:\Windows\System\FMTowYN.exe
  C:\Windows\System\FMTowYN.exe
  2⤵
  PID:13624
- C:\Windows\System\vzYwCLY.exe
  C:\Windows\System\vzYwCLY.exe
  2⤵
  PID:12976
- C:\Windows\System\oTlRdLx.exe
  C:\Windows\System\oTlRdLx.exe
  2⤵
  PID:13692
- C:\Windows\System\ZrDtoQg.exe
  C:\Windows\System\ZrDtoQg.exe
  2⤵
  PID:15372
- C:\Windows\System\raQUHcv.exe
  C:\Windows\System\raQUHcv.exe
  2⤵
  PID:15396
- C:\Windows\System\uDAVZDL.exe
  C:\Windows\System\uDAVZDL.exe
  2⤵
  PID:15416
- C:\Windows\System\jvaSclf.exe
  C:\Windows\System\jvaSclf.exe
  2⤵
  PID:15440
- C:\Windows\System\zgRSIwC.exe
  C:\Windows\System\zgRSIwC.exe
  2⤵
  PID:15464
- C:\Windows\System\zWhZsAP.exe
  C:\Windows\System\zWhZsAP.exe
  2⤵
  PID:15488
- C:\Windows\System\eLPhgCV.exe
  C:\Windows\System\eLPhgCV.exe
  2⤵
  PID:15508
- C:\Windows\System\DOLEKrL.exe
  C:\Windows\System\DOLEKrL.exe
  2⤵
  PID:15540
- C:\Windows\System\zphdUCY.exe
  C:\Windows\System\zphdUCY.exe
  2⤵
  PID:15572
- C:\Windows\System\RrPFEOF.exe
  C:\Windows\System\RrPFEOF.exe
  2⤵
  PID:15596
- C:\Windows\System\ypZihXu.exe
  C:\Windows\System\ypZihXu.exe
  2⤵
  PID:15616
- C:\Windows\System\vcQegep.exe
  C:\Windows\System\vcQegep.exe
  2⤵
  PID:15632
- C:\Windows\System\UlQClaK.exe
  C:\Windows\System\UlQClaK.exe
  2⤵
  PID:15652
- C:\Windows\System\WVfYLio.exe
  C:\Windows\System\WVfYLio.exe
  2⤵
  PID:15676
- C:\Windows\System\ehKGKFE.exe
  C:\Windows\System\ehKGKFE.exe
  2⤵
  PID:15692
- C:\Windows\System\SxOLBgD.exe
  C:\Windows\System\SxOLBgD.exe
  2⤵
  PID:15720
- C:\Windows\System\ZNnMnmh.exe
  C:\Windows\System\ZNnMnmh.exe
  2⤵
  PID:15744
- C:\Windows\System\YZkhNQp.exe
  C:\Windows\System\YZkhNQp.exe
  2⤵
  PID:15760
- C:\Windows\System\ftIhapP.exe
  C:\Windows\System\ftIhapP.exe
  2⤵
  PID:15780
- C:\Windows\System\hWwVMnS.exe
  C:\Windows\System\hWwVMnS.exe
  2⤵
  PID:13008
- C:\Windows\System\OuNODCJ.exe
  C:\Windows\System\OuNODCJ.exe
  2⤵
  PID:13256
- C:\Windows\System\WTEfoKg.exe
  C:\Windows\System\WTEfoKg.exe
  2⤵
  PID:14032
- C:\Windows\System\TKIsFSL.exe
  C:\Windows\System\TKIsFSL.exe
  2⤵
  PID:12784
- C:\Windows\System\mPMOiOo.exe
  C:\Windows\System\mPMOiOo.exe
  2⤵
  PID:13404
- C:\Windows\System\DfcPgnG.exe
  C:\Windows\System\DfcPgnG.exe
  2⤵
  PID:12892
- C:\Windows\System\zYxZpQY.exe
  C:\Windows\System\zYxZpQY.exe
  2⤵
  PID:13552
- C:\Windows\System\BWmcuId.exe
  C:\Windows\System\BWmcuId.exe
  2⤵
  PID:11196
- C:\Windows\System\uZWLMqE.exe
  C:\Windows\System\uZWLMqE.exe
  2⤵
  PID:13608
- C:\Windows\System\vBAinNW.exe
  C:\Windows\System\vBAinNW.exe
  2⤵
  PID:13128
- C:\Windows\System\mGxGYft.exe
  C:\Windows\System\mGxGYft.exe
  2⤵
  PID:13664
- C:\Windows\System\MOweyPb.exe
  C:\Windows\System\MOweyPb.exe
  2⤵
  PID:15408
- C:\Windows\System\PPuStFe.exe
  C:\Windows\System\PPuStFe.exe
  2⤵
  PID:14344
- C:\Windows\System\gjFhVfV.exe
  C:\Windows\System\gjFhVfV.exe
  2⤵
  PID:14380
- C:\Windows\System\nYqybQm.exe
  C:\Windows\System\nYqybQm.exe
  2⤵
  PID:14404
- C:\Windows\System\ltfkCVO.exe
  C:\Windows\System\ltfkCVO.exe
  2⤵
  PID:15520
- C:\Windows\System\diNsGUV.exe
  C:\Windows\System\diNsGUV.exe
  2⤵
  PID:15548
- C:\Windows\System\mwetBdP.exe
  C:\Windows\System\mwetBdP.exe
  2⤵
  PID:14448
- C:\Windows\System\zGuzcVs.exe
  C:\Windows\System\zGuzcVs.exe
  2⤵
  PID:14484
- C:\Windows\System\URMpoPB.exe
  C:\Windows\System\URMpoPB.exe
  2⤵
  PID:15628
- C:\Windows\System\toBLtKO.exe
  C:\Windows\System\toBLtKO.exe
  2⤵
  PID:15684
- C:\Windows\System\wjPuYID.exe
  C:\Windows\System\wjPuYID.exe
  2⤵
  PID:14584
- C:\Windows\System\eTQWdMn.exe
  C:\Windows\System\eTQWdMn.exe
  2⤵
  PID:15740
- C:\Windows\System\cWTOmZd.exe
  C:\Windows\System\cWTOmZd.exe
  2⤵
  PID:14636
- C:\Windows\System\JJTgPEB.exe
  C:\Windows\System\JJTgPEB.exe
  2⤵
  PID:14648
- C:\Windows\System\NWekxKI.exe
  C:\Windows\System\NWekxKI.exe
  2⤵
  PID:14680
- C:\Windows\System\xNwTfkz.exe
  C:\Windows\System\xNwTfkz.exe
  2⤵
  PID:14704
- C:\Windows\System\cLZscOm.exe
  C:\Windows\System\cLZscOm.exe
  2⤵
  PID:14732
- C:\Windows\System\cnNdblC.exe
  C:\Windows\System\cnNdblC.exe
  2⤵
  PID:14804
- C:\Windows\System\RhfzTXg.exe
  C:\Windows\System\RhfzTXg.exe
  2⤵
  PID:15032
- C:\Windows\System\OKmuVsA.exe
  C:\Windows\System\OKmuVsA.exe
  2⤵
  PID:11676
- C:\Windows\System\csWFbvs.exe
  C:\Windows\System\csWFbvs.exe
  2⤵
  PID:12912
- C:\Windows\System\htGwqTb.exe
  C:\Windows\System\htGwqTb.exe
  2⤵
  PID:15276
- C:\Windows\System\DcrPZpj.exe
  C:\Windows\System\DcrPZpj.exe
  2⤵
  PID:15308
- C:\Windows\System\JnMUJVl.exe
  C:\Windows\System\JnMUJVl.exe
  2⤵
  PID:13800
- C:\Windows\System\aJsOguj.exe
  C:\Windows\System\aJsOguj.exe
  2⤵
  PID:12308
- C:\Windows\System\XsIpuuw.exe
  C:\Windows\System\XsIpuuw.exe
  2⤵
  PID:12400
- C:\Windows\System\BHUxzAp.exe
  C:\Windows\System\BHUxzAp.exe
  2⤵
  PID:12192
- C:\Windows\System\kLdBsVt.exe
  C:\Windows\System\kLdBsVt.exe
  2⤵
  PID:11564
- C:\Windows\System\QNxSVeG.exe
  C:\Windows\System\QNxSVeG.exe
  2⤵
  PID:14300
- C:\Windows\System\VGGDOCZ.exe
  C:\Windows\System\VGGDOCZ.exe
  2⤵
  PID:12848
- C:\Windows\System\xPMBlrH.exe
  C:\Windows\System\xPMBlrH.exe
  2⤵
  PID:12740
- C:\Windows\System\BxhmdtY.exe
  C:\Windows\System\BxhmdtY.exe
  2⤵
  PID:15460
- C:\Windows\System\kYyMQpi.exe
  C:\Windows\System\kYyMQpi.exe
  2⤵
  PID:15436
- C:\Windows\System\PdNNUUa.exe
  C:\Windows\System\PdNNUUa.exe
  2⤵
  PID:15772
- C:\Windows\System\AXOGTZs.exe
  C:\Windows\System\AXOGTZs.exe
  2⤵
  PID:14712
- C:\Windows\System\wtKDFOi.exe
  C:\Windows\System\wtKDFOi.exe
  2⤵
  PID:14780
- C:\Windows\System\BnFwoab.exe
  C:\Windows\System\BnFwoab.exe
  2⤵
  PID:14964
- C:\Windows\System\PMGkoRd.exe
  C:\Windows\System\PMGkoRd.exe
  2⤵
  PID:15020
- C:\Windows\System\heMKjpZ.exe
  C:\Windows\System\heMKjpZ.exe
  2⤵
  PID:15068
- C:\Windows\System\isSrnjB.exe
  C:\Windows\System\isSrnjB.exe
  2⤵
  PID:15108
- C:\Windows\System\tOARivS.exe
  C:\Windows\System\tOARivS.exe
  2⤵
  PID:15164
- C:\Windows\System\sblxRRz.exe
  C:\Windows\System\sblxRRz.exe
  2⤵
  PID:15188
- C:\Windows\System\JsLMJHH.exe
  C:\Windows\System\JsLMJHH.exe
  2⤵
  PID:15252
- C:\Windows\System\EqYuLuw.exe
  C:\Windows\System\EqYuLuw.exe
  2⤵
  PID:15312
- C:\Windows\System\RlYZFbA.exe
  C:\Windows\System\RlYZFbA.exe
  2⤵
  PID:14396
- C:\Windows\System\vtOhCQK.exe
  C:\Windows\System\vtOhCQK.exe
  2⤵
  PID:12648
- C:\Windows\System\hQcSDNq.exe
  C:\Windows\System\hQcSDNq.exe
  2⤵
  PID:12460
- C:\Windows\System\YbZQSnj.exe
  C:\Windows\System\YbZQSnj.exe
  2⤵
  PID:16124
- C:\Windows\System\OuVvruW.exe
  C:\Windows\System\OuVvruW.exe
  2⤵
  PID:14112
- C:\Windows\System\mNRpmmv.exe
  C:\Windows\System\mNRpmmv.exe
  2⤵
  PID:16376
- C:\Windows\System\slIJzpk.exe
  C:\Windows\System\slIJzpk.exe
  2⤵
  PID:12960
- C:\Windows\System\SHEPlsc.exe
  C:\Windows\System\SHEPlsc.exe
  2⤵
  PID:15380
- C:\Windows\System\tblfrpb.exe
  C:\Windows\System\tblfrpb.exe
  2⤵
  PID:15504
- C:\Windows\System\wtwavkd.exe
  C:\Windows\System\wtwavkd.exe
  2⤵
  PID:16156
- C:\Windows\System\qQZXiOZ.exe
  C:\Windows\System\qQZXiOZ.exe
  2⤵
  PID:15660
- C:\Windows\System\JfdZKWm.exe
  C:\Windows\System\JfdZKWm.exe
  2⤵
  PID:16208
- C:\Windows\System\lRaFLrx.exe
  C:\Windows\System\lRaFLrx.exe
  2⤵
  PID:16224
- C:\Windows\System\bRnQhsd.exe
  C:\Windows\System\bRnQhsd.exe
  2⤵
  PID:16260
- C:\Windows\System\GZCRJJB.exe
  C:\Windows\System\GZCRJJB.exe
  2⤵
  PID:16328
- C:\Windows\System\sfmjPOv.exe
  C:\Windows\System\sfmjPOv.exe
  2⤵
  PID:16388
- C:\Windows\System\HclaVhE.exe
  C:\Windows\System\HclaVhE.exe
  2⤵
  PID:16404
- C:\Windows\System\QITLRkE.exe
  C:\Windows\System\QITLRkE.exe
  2⤵
  PID:16420
- C:\Windows\System\fPKiHSe.exe
  C:\Windows\System\fPKiHSe.exe
  2⤵
  PID:16436
- C:\Windows\System\cdImsnN.exe
  C:\Windows\System\cdImsnN.exe
  2⤵
  PID:16452
- C:\Windows\System\EVAVcts.exe
  C:\Windows\System\EVAVcts.exe
  2⤵
  PID:16468
- C:\Windows\System\SPgIhtq.exe
  C:\Windows\System\SPgIhtq.exe
  2⤵
  PID:16484
- C:\Windows\System\eBSbXrb.exe
  C:\Windows\System\eBSbXrb.exe
  2⤵
  PID:16508
- C:\Windows\System\FzwCvAu.exe
  C:\Windows\System\FzwCvAu.exe
  2⤵
  PID:16524
- C:\Windows\System\veOtoKX.exe
  C:\Windows\System\veOtoKX.exe
  2⤵
  PID:16552
- C:\Windows\System\tuQFfMX.exe
  C:\Windows\System\tuQFfMX.exe
  2⤵
  PID:16592
- C:\Windows\System\zAkYBVt.exe
  C:\Windows\System\zAkYBVt.exe
  2⤵
  PID:16612
- C:\Windows\System\rflxRgd.exe
  C:\Windows\System\rflxRgd.exe
  2⤵
  PID:16628
- C:\Windows\System\lDJNQGz.exe
  C:\Windows\System\lDJNQGz.exe
  2⤵
  PID:16644
- C:\Windows\System\rJbNbBv.exe
  C:\Windows\System\rJbNbBv.exe
  2⤵
  PID:16660
- C:\Windows\System\nhIxWdd.exe
  C:\Windows\System\nhIxWdd.exe
  2⤵
  PID:16684
- C:\Windows\System\AwflYPo.exe
  C:\Windows\System\AwflYPo.exe
  2⤵
  PID:16700
- C:\Windows\System\vFYpflX.exe
  C:\Windows\System\vFYpflX.exe
  2⤵
  PID:16728
- C:\Windows\System\boOgFAk.exe
  C:\Windows\System\boOgFAk.exe
  2⤵
  PID:16744
- C:\Windows\System\EWmxwDp.exe
  C:\Windows\System\EWmxwDp.exe
  2⤵
  PID:16760
- C:\Windows\System\VVuciMn.exe
  C:\Windows\System\VVuciMn.exe
  2⤵
  PID:16776
- C:\Windows\System\LSJvyun.exe
  C:\Windows\System\LSJvyun.exe
  2⤵
  PID:16792
- C:\Windows\System\YBlitSN.exe
  C:\Windows\System\YBlitSN.exe
  2⤵
  PID:16808
- C:\Windows\System\TXVVmpk.exe
  C:\Windows\System\TXVVmpk.exe
  2⤵
  PID:16836
- C:\Windows\System\JXrQxpl.exe
  C:\Windows\System\JXrQxpl.exe
  2⤵
  PID:16756
- C:\Windows\System\SyrRUUd.exe
  C:\Windows\System\SyrRUUd.exe
  2⤵
  PID:16948
- C:\Windows\System\actIHBM.exe
  C:\Windows\System\actIHBM.exe
  2⤵
  PID:14116
- C:\Windows\System\XlUGvUI.exe
  C:\Windows\System\XlUGvUI.exe
  2⤵
  PID:17112
- C:\Windows\System\rdWKvGa.exe
  C:\Windows\System\rdWKvGa.exe
  2⤵
  PID:13988
- C:\Windows\System\slcPEoD.exe
  C:\Windows\System\slcPEoD.exe
  2⤵
  PID:17288
- C:\Windows\System\BDGckTh.exe
  C:\Windows\System\BDGckTh.exe
  2⤵
  PID:16120
- C:\Windows\System\suqBjxs.exe
  C:\Windows\System\suqBjxs.exe
  2⤵
  PID:15084
- C:\Windows\System\aCAfhoz.exe
  C:\Windows\System\aCAfhoz.exe
  2⤵
  PID:16244
- C:\Windows\System\yhBrrSf.exe
  C:\Windows\System\yhBrrSf.exe
  2⤵
  PID:17192
- C:\Windows\System\AxhayyX.exe
  C:\Windows\System\AxhayyX.exe
  2⤵
  PID:17316
- C:\Windows\System\ABOTpnl.exe
  C:\Windows\System\ABOTpnl.exe
  2⤵
  PID:16952
- C:\Windows\System\qWRqTaa.exe
  C:\Windows\System\qWRqTaa.exe
  2⤵
  PID:10656
- C:\Windows\System\NCrObzU.exe
  C:\Windows\System\NCrObzU.exe
  2⤵
  PID:12868
- C:\Windows\System\lgvKixA.exe
  C:\Windows\System\lgvKixA.exe
  2⤵
  PID:15356
- C:\Windows\System\wJiUgOO.exe
  C:\Windows\System\wJiUgOO.exe
  2⤵
  PID:16200
- C:\Windows\System\SLnzNoe.exe
  C:\Windows\System\SLnzNoe.exe
  2⤵
  PID:13316
- C:\Windows\System\EMlaKkm.exe
  C:\Windows\System\EMlaKkm.exe
  2⤵
  PID:17428
- C:\Windows\System\ohuHVED.exe
  C:\Windows\System\ohuHVED.exe
  2⤵
  PID:17488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CUPVSsR.exe

Filesize
1.4MB

MD5
f5cca4a01cfb9763e0ac5dbe4cfe4564

SHA1
3d69dede0938a1d8f73f8a4a1f229b50fd39fe79

SHA256
0505b22ab6560595b8b9b1a1bf59740bcfc04ae5599e2fba7db0eeda8dd8f1c8

SHA512
8540e0de32d1ac7603a8bd74947e3ddb27bd95f3c5a35daecad8577efa3e0c673536d0af562e4c99fb4bda4a00744af7d6e3f29a51f52355ffa9c63d5980cd54

Download Submit
C:\Windows\System\CzNFAAs.exe

Filesize
1.4MB

MD5
a2a192d7d291b313647a867957c3edce

SHA1
55243c96fb8cbf15195b5f6a691506dd90c0a8b5

SHA256
40e8f7e288549272f22e524a3651aadc1b89f10b93711299a7fb3b34651a78f4

SHA512
d44d02b38ed660f65cd0c98d23b8aa71128323c65a1fa3754a34dc89101825766358f1b3dea4c8d12966c65f874abc33a4782b69a286ed9a103656fd562ba9dd

Download Submit
C:\Windows\System\EMiuEHw.exe

Filesize
1.4MB

MD5
d784d171d4de22b20e6318dba4394d00

SHA1
9343d94e8cc47c3119cc0bcb2d517fab924db09b

SHA256
05da1d3518da943fcd0b64e2d7451c3c7b1998fc530fd58ea254a8bf3572cb33

SHA512
af6045df3ea2b8c08def6205d1077a0efb0c5e8d13804ba5d0d90a012efe29d1e1f7c8d274b90e87689f1fe76684fcd3f8f6aadbef8cddef0cfdf1398925cb87

Download Submit
C:\Windows\System\IENPnKw.exe

Filesize
1.4MB

MD5
b4e9a45f2cd3e9054e4c06cb106b5ee0

SHA1
7a2821508063d1fbfeb51c8a67aee49066459118

SHA256
b493ab83f4b3e253d411a39501200c6c2ef6265483fbcc596d1e4e515a19b91c

SHA512
5d4b8e970d5083580b47b65e4854e5077f6aadecd26f5540d16b69af9ba856f5496073af75548ee0b929f726837c6230ced0e3de36948d374f31b2321c80dd5f

Download Submit
C:\Windows\System\KnvDjLC.exe

Filesize
1.4MB

MD5
d983058ec32f6495a24f922059dabc70

SHA1
0f3bb3ad7c1181d6f5fbb0bfafc0225c4c97dd07

SHA256
3a7e9bf00cfd85effa5e2c87bdc80b0b9092119025a2f666dc80cbd869fd975a

SHA512
fec6b1d1dd17400ff643f2e428080480f47c8c78d182925b76d63f2bfa045ef7c119a005b9565a85bec4dca1d7c362f38f3eb14e4295baff5c98c0664f7a57df

Download Submit
C:\Windows\System\LPSgHyU.exe

Filesize
1.4MB

MD5
cf61c538ab4d467ff67bef0afd11a5e8

SHA1
f6973ea7a0e5570cd6bc615b94f2d9563a347201

SHA256
cc1dafb827c75a2a1bd6a92c7b8bd2bbe6d6d4a78f13ac65f30e84bbfbb7dd68

SHA512
8a5c11a77419bdc861667c8849f050abe1e1ed075a804d5535fb32a7582109e4dc5d2d2e66778cc8beecdcc4aecfe252f965855731401db56e499b28f2aaca6f

Download Submit
C:\Windows\System\MyNcXgw.exe

Filesize
1.4MB

MD5
5ce6e594f4918658142c41b5c8a1f0cb

SHA1
e4ad3958a0fb734884580a7328e02877f56d20d2

SHA256
1ee432cd1ca31eae220cf784a70bd6b45abdf3e20f6a67267a1133835abdb000

SHA512
8a6eef552f5065e30729196622f9b574d61ce7b5b7d636789f2a42c6e9079a60bfc645fc72c8a8d6e95e24808e95c5745606c1a6bb0916acd0259bad629e3b2e

Download Submit
C:\Windows\System\NhBNQOh.exe

Filesize
1.4MB

MD5
e5304ecf0ba62f1981a70b6da2d10841

SHA1
35442c662f53c967f5231d9e9e51664f3f65cfb0

SHA256
12c1ee46ca7863dc9b5d90a70b603c8aa36d594278af94a0dc5cc0ebb1663795

SHA512
d96cc6d4ce0a12c246a96ac68d2d65accff281fa0c54e9cdb6dfac404af6253123621c18638cc475a903130bc60cd6e8ba1aa7d17f27fcc8ba615abd9d645496

Download Submit
C:\Windows\System\OnkrCnS.exe

Filesize
1.4MB

MD5
f0f9ade75344b0c5e1d2a176ae865c5e

SHA1
e39a7dbafc3170135d2e743b39cb3ba9dc389275

SHA256
eed2b01169b890f412f4067506dd222e7364fbde62a15d134b25a10bb7329ee7

SHA512
9f720dc5c50d2addb18729028429491e7be40c847a2987581cdc2f6e72c8b7b539ef64f0f958bd50ecb7e1ad37359b892dd00a4ea04b467a4cd10556ff4e2ccb

Download Submit
C:\Windows\System\OtYOnGJ.exe

Filesize
1.4MB

MD5
cbaf0815bcd200216d5a94855ae5bbaf

SHA1
271ad21f0940d272805d0b4cae29785fc49f84f5

SHA256
08141e7517ada2f303c4743944be58893260c9bb4c5ad5fed000d61295dc53ae

SHA512
7719638aa09dc544897bc2a204861d6bda1c5f047ad5c72c5b0ea2633eb88d181884ac0355830c6fa21bd452a581d7b7d1052f10a7ecc4573bb7d5e034edc2ff

Download Submit
C:\Windows\System\TMywlyK.exe

Filesize
1.4MB

MD5
c9ec3d9ad53abc96c355fbb00a5cd467

SHA1
6098afd6a0a0cafe85b627c21b574b52ddb827cd

SHA256
3a7a57e98ef5b26490b7eb3433a6f7dcd6ab4a972b772f5d598d3cead3d2cd46

SHA512
20211d9b83c2dd1b8c629395b211e0cca2f7eb0bf8c863b8c445f54214f8037f4deac69bdc55db15b478632d7f980c19b0ac5daaa24b30251b09ea5903045dde

Download Submit
C:\Windows\System\TXAvDpm.exe

Filesize
1.4MB

MD5
56727a028f52d47ac05db57913484433

SHA1
858bc0ac3efc7d0d172c0b52dd7799a073dd4606

SHA256
5bdfe1e2685477f82b5da19826c508730a5088ae55cc27eb3e9b5dae01ac486d

SHA512
638ec307071e1b51670f054211edbaca72a79f024461494f0745143f4dbb5b3b7d680f3ba4d15ebf2593f1b14339e2094e2b59ba14edf9261a17a7d0388ac433

Download Submit
C:\Windows\System\XPyonyX.exe

Filesize
1.4MB

MD5
a233a2549e1e8ba619219fc5a1444385

SHA1
83593c61f1e49927960391ef921322d8bae1cb47

SHA256
151c7871eb6a82ec58baf992a04039c2ae13c61a670a1756dfe8fa648fb09b12

SHA512
eaed2d3dca1a33c2dd7a1a2ed88689eae424414803d76a96d17da7161eac0ca84c37c39eaa2464e365b836e29db1d62d6a8bb287ad7a2fdcfc17d2035b68483f

Download Submit
C:\Windows\System\ZJcgwCQ.exe

Filesize
1.4MB

MD5
dfef2b36225c954546a0dc94e89192da

SHA1
08d4675d2fa6e7ac1b5e34b8ab7cf593c58227a0

SHA256
9bb64744a68c397b368a1c9c1eaf0cfa809e4a5e85637bbca1109cfab2e6ff48

SHA512
8bac8431c77b41460991363c3e1a51f77e5c5983340636e50d8d90deeeff1729e20aa27ec582f5dcf714c576d647a86fa6962dc93cf5d711141ba3545a44ab73

Download Submit
C:\Windows\System\ZitsHpm.exe

Filesize
1.4MB

MD5
a998043d3acfa2be3e6cdeafbd618ed2

SHA1
b2d8747f2a800b24de133af49db3df6550d1bc40

SHA256
c059ff0928487cc2be078193ff8744a331ce192fea228e12a78f1ec46b4f2454

SHA512
920dc5f0f5354c5e43d677b3847fe5933162fc730e95c80b344145d426cb4b82aab6169cd5cd827ac59166c36c39b4224c02c3e8a008de58abd169aa306cae23

Download Submit
C:\Windows\System\bAKeXQn.exe

Filesize
1.4MB

MD5
8acfd6c3bf96f5c2272ed3ebcfc5255c

SHA1
506586c7dfa7c39c4e90c8bfe3a20ededdebe249

SHA256
051397fef388eb5f80486ed589877f960165e47842d7481e0c325a23dbece4b9

SHA512
d80dbf6f151e28a0fc7552e383398f0b3778cfba91a117a0dc09be74639508641563dc7214654189ec8184ab3cb049e4666370e79fee1f6dfdaeff2efa10324b

Download Submit
C:\Windows\System\cTSZnHf.exe

Filesize
1.4MB

MD5
7680c0f18c67d353777e453b6e98067c

SHA1
9f12158172c2185249e0700ea4e163f5cfea22c0

SHA256
d62ad1e7d85c7d797e5e02a65a700d30a06e339b76be11b343c7826964ca855c

SHA512
2c9c68bdf68dce7ef91c17fdc0b5a7205bd5cb4e6686179ec079b1014913f4875c3ada66a83cc0c4e745c08904349e25721f80406e49b32a410cb1e062aeed6f

Download Submit
C:\Windows\System\eKkUQZs.exe

Filesize
1.4MB

MD5
9271d384e598e3667928d209f1fc2588

SHA1
196e685a9cb4d87844786d72f636ef45c03a1d9e

SHA256
48c712f7cf0552909f7bee228f8d02839a45bbb918c769d4b7ec55355386672c

SHA512
49a71047b9bc3503c77d7e364b417bd5b287c3bb6ac8e0b7a65d952afd69f61cba18451e542f433ed7ffcaaa54c8f6fac979572f89b0d5053890200ae3318915

Download Submit
C:\Windows\System\ekzXMNg.exe

Filesize
1.4MB

MD5
20b7ba60c61692e1a20f0782f44b3cac

SHA1
93663490c45b86303bc29b430f58d1b953f5baf8

SHA256
a97f7945ea886cdeeff80f8f9f70d0cc841166f812a9a243b487adb47acc212f

SHA512
b9ab276c1fc455b2e8559fc8be27a34fe40d73749dbc95869b2438a623c77eb6bc11e7f17be744128000c1b7e455fb4a3daa8deac1ffae6bc0939a310483691d

Download Submit
C:\Windows\System\fcBkSvx.exe

Filesize
1.4MB

MD5
aa3b6f31e03917c2475af70bce616c76

SHA1
5c692e19348b8888736182ba362ce1b043f10ee8

SHA256
cf91abc74ffab53b2bbb98c352362d451a9b32ab29eb74d9325942c20412a4e7

SHA512
4fe0f9afd794a7e1ee521e1175d411fb5740830938c53c07c406ad77b78057531ad9276aeb57a2a826a8c69f6506eabcac36d045abcc73775e9f5e8518f0983f

Download Submit
C:\Windows\System\gmOQsyN.exe

Filesize
1.4MB

MD5
2fb8c5d232cfc29a24568632fec42e7b

SHA1
c2754e9ddb63d671a0b404f37c8a688d94fc86f5

SHA256
30d12f9cb25227b08a678fb5c77e6db35e0634c29c05adcb849ec8862ee32845

SHA512
d86a98f5b44bedf8137ac7da738d8337d5f515db92171ada27be58d3c515f567ccb2555d9b781f0bd65629a0f4ca4d97f991cd3d518cb5f86e404db68334ee40

Download Submit
C:\Windows\System\iohQYmR.exe

Filesize
1.4MB

MD5
a99b89aeb19faeeaba98236ead1f4908

SHA1
b3838991b509848d09d112a3aa32fd879f231e16

SHA256
aae870cc66caca2234e91e16385fc6596d32f87b7d5c2f717035c63ac30f57a4

SHA512
073e77064d36e148984c229344c70866e23bd7a2ea93ca35acee757ea2056dd45d6b674a19ee1a480845279870d75d5eea521b16d24bd313a8996bef99221879

Download Submit
C:\Windows\System\kpduOfT.exe

Filesize
1.4MB

MD5
97425f1fba39735660d517bd726c80ac

SHA1
8302dddf244939a04748444b9e53a7710341b68b

SHA256
e48a2a088c989a1b25267285b73f4f7f7857edb67dacd180f25b6cfab5b7c038

SHA512
99eea6fe94cd88dbd4692f1d8db98571b88f509e9b9d9a4e7adf06664375e4247e3c47fbd131fae0543b08f4cc6221a1356a9b16000b6c49268f3e9212ef05cc

Download Submit
C:\Windows\System\lrYYVqd.exe

Filesize
1.4MB

MD5
04aef3b4887203973809f86aa861afd0

SHA1
bf08c5e5c613f14e900e22e17c091dbe3b5fea1f

SHA256
2b948196b577851be6ec8162dec59ada58584e59d97c6cd7a6d3e22f9df19b33

SHA512
12c79339143396a088e9623b50b7da7ca78699a6f9a04f21cdb8582b55d83ca14b96765eea6987010f705101c209bfbb8d818cb5d28f55e9bc95ded35c819133

Download Submit
C:\Windows\System\nGfNkoS.exe

Filesize
1.4MB

MD5
d7c710aa6fcaab511038cd6698271f7b

SHA1
e2c05d4e860ab0abd38ef4b5a0ba7373dc78e91f

SHA256
43da69d65b785e11ab5555e56f69ec46bd5aefd8d911d4a01ac8140b41fa21a8

SHA512
2f240afea7f5ba1387166d4a44f3c863b647e8ec30541d8914e6d4c3921d35d1a67e48658c7fb04bb2162ac10536970dfe6594c2632e9e8778faa58774715f4e

Download Submit
C:\Windows\System\nfyPBjk.exe

Filesize
1.4MB

MD5
03e511e5185d79102efb3dfda32f1325

SHA1
1a1126de447029a8c5b2019804982b7cb1a0a1bb

SHA256
6fdc603838f2b1820e0a11883d3a0b1e9025a4e057fa41c2eda1fbe50958bd6c

SHA512
b89adc7d11f500301138b17840c2bd682dae0a78b601bf6e67a2c1761409242567042a2d7b170b40235489256b113ae63d2f2b43d45466f1ac3c4816f08e3960

Download Submit
C:\Windows\System\ocCJZNf.exe

Filesize
1.4MB

MD5
dfcba9d944af2d3687fc9b9db5bf83c6

SHA1
a3d7a14ddd7dcc4b2dfb06698926c96636d0c5b1

SHA256
67ca920ef30075de8a3c79d4f37d229b6c6ac8ad731cf8196674a0de1545625e

SHA512
a35770167ac72e3f40a3a80efa5d80387cc2c4afd7015805ff6a81d308261db8031e12f98717722f1129ca6f3633d1209ba13831761089f808b6c0109093825e

Download Submit
C:\Windows\System\paoHnSh.exe

Filesize
1.4MB

MD5
3ab2732c7c56d2ea51813d6403e10621

SHA1
a27d5d1f26ca1613d50fc37457f2543fad1bcc37

SHA256
4d2a021f0ca4fc7c5dfb25c17309917c866bb062900948667202d390c4a48f5c

SHA512
0b47f6fcc55152b955214552e788874874f37021f2df9357039211aedf815e702c171b62609b47bed8b7b924e307069986c3d47950c300f349c56cc029e3f6fc

Download Submit
C:\Windows\System\qsvtIOC.exe

Filesize
1.4MB

MD5
6d855d1d6c4803079171bca6a6d692c3

SHA1
9e20da53412d8482dd7885be624268d00e3012c1

SHA256
3f618ef45c08aeb4f4c148ea9148f8106a38eeebfb25b3b4504ffd822d3d2356

SHA512
73edd72be280fc6b548c3a46d52f936fed492c472eeee45397d505047ed794e9d2ec076f7aba0347a80ad3d5d12830cd187d06064aa1892ec41949be78e78f74

Download Submit
C:\Windows\System\tOxXwrd.exe

Filesize
1.4MB

MD5
f62667d7ca8b0e6b28215535c98cd718

SHA1
5534d3016739ebaf4172e9a059ebcc4ecc9f3978

SHA256
1832741abd8d5592956854c66caa424f9cb6ebac7bfffde6abafa049254312c5

SHA512
f259868836fa0962f7022245e01dea8de89139c4cf05ae40250ce6f0955ddce4fee0cfbf63e0e96fdf3551ae86e85661901b189a4d0e9d0fd4bec4d6037194ca

Download Submit
C:\Windows\System\wvRHBUB.exe

Filesize
1.4MB

MD5
b1f11baba117e3fbc6b8ebc046b7471e

SHA1
f97e82a7a4a072ad68b5db496ce75fa37c0d25d4

SHA256
5d5c9f4222eeb1403cd105a9a1b43704491834cd339c2803b46332384851c429

SHA512
817b00a9f704731692fa3acbf922afe6120db83a6132513b87d6de85bc8e48932e64f768d3664e3512984cf4b571ad931935ce4b44821e7dbe1076d581595f62

Download Submit
C:\Windows\System\xyjkcMg.exe

Filesize
1.4MB

MD5
f6126d147aa24849d3d0829aac6fd013

SHA1
20d1d4a47f19c8aaaa3b750532c65ec8efb8a75f

SHA256
b390db6507e5203b5703ec06008738fac7e6f1d675c6e0b4acf397d3abf91716

SHA512
504b08c49923489306acc3b810245ac150fd0b34b6c16e7afa803e668f282fd76d978726476482b75494f5cb64bc37db6542046463eb6d736bce6c8ff3cffef1

Download Submit
C:\Windows\System\yMmJbBA.exe

Filesize
1.4MB

MD5
8030d095d8fb7801f0451558e87bbff2

SHA1
caffb1eb91acbd3a32afb64e3504cc7d66d31dde

SHA256
99721685478a9c3ac3b8d165801a7fb96e643339219b71d0f9ff8438a8111e57

SHA512
c2a19bb5bf59dbf02c8d97a6933c0fca4f79dd67689cff3a21ba27e6968b90daf5f22f7e99f4db1cd6fb188c0f31af9cd079a6a5d26ccee80046724d22db71d3

Download Submit
memory/3024-0-0x0000025A9BDC0000-0x0000025A9BDD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads