xmrig | 2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524

Analysis

max time kernel
93s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
Size

1.7MB
MD5

42d6b0adb975bf59df3eaa8681d4b26c
SHA1

f60b371fac39660d083e506b57b7ee412ce0bbf2
SHA256

2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524
SHA512

d1f998b7429cc88279ad066fb02701f3d062ba63b26d4728219b46a7907dbaedca1a28722b77746525d6c78a95d9a5345722305aa35c5a18ff472d99ddf5e053
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRvzc26JAisD:GemTLkNdfE0pZyF

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023bff-4.dat	xmrig
behavioral2/files/0x0008000000023ca2-9.dat	xmrig
behavioral2/files/0x0007000000023ca8-20.dat	xmrig
behavioral2/files/0x0007000000023ca9-23.dat	xmrig
behavioral2/files/0x0007000000023cab-35.dat	xmrig
behavioral2/files/0x0007000000023cb5-85.dat	xmrig
behavioral2/files/0x0007000000023cbb-120.dat	xmrig
behavioral2/files/0x0007000000023cc5-162.dat	xmrig
behavioral2/files/0x0007000000023cc3-160.dat	xmrig
behavioral2/files/0x0007000000023cc4-157.dat	xmrig
behavioral2/files/0x0007000000023cc2-155.dat	xmrig
behavioral2/files/0x0007000000023cc1-150.dat	xmrig
behavioral2/files/0x0007000000023cc0-145.dat	xmrig
behavioral2/files/0x0007000000023cbf-140.dat	xmrig
behavioral2/files/0x0007000000023cbe-135.dat	xmrig
behavioral2/files/0x0007000000023cbd-130.dat	xmrig
behavioral2/files/0x0007000000023cbc-125.dat	xmrig
behavioral2/files/0x0007000000023cba-112.dat	xmrig
behavioral2/files/0x0007000000023cb9-108.dat	xmrig
behavioral2/files/0x0007000000023cb8-103.dat	xmrig
behavioral2/files/0x0007000000023cb7-98.dat	xmrig
behavioral2/files/0x0007000000023cb6-92.dat	xmrig
behavioral2/files/0x0007000000023cb4-80.dat	xmrig
behavioral2/files/0x0007000000023cb3-75.dat	xmrig
behavioral2/files/0x0007000000023cb2-73.dat	xmrig
behavioral2/files/0x0007000000023cb1-65.dat	xmrig
behavioral2/files/0x0007000000023cb0-60.dat	xmrig
behavioral2/files/0x0007000000023caf-55.dat	xmrig
behavioral2/files/0x0007000000023cae-50.dat	xmrig
behavioral2/files/0x0007000000023cad-45.dat	xmrig
behavioral2/files/0x0007000000023cac-40.dat	xmrig
behavioral2/files/0x0007000000023caa-30.dat	xmrig
behavioral2/files/0x0007000000023ca7-15.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1052	fLFggjO.exe
1092	qlXXpeP.exe
4684	rUuSNVr.exe
4584	nHxlsBx.exe
3688	vrJsHxG.exe
2836	cFAltLZ.exe
3448	RjGNBuQ.exe
4664	TFRhWUj.exe
2440	SCFTDyg.exe
4136	uUdYpQo.exe
4880	TkFlKyh.exe
4596	icwEety.exe
2940	VzOHlFc.exe
2216	DVbZHCZ.exe
2672	qMvowAC.exe
1748	lkcwrIK.exe
2156	uwQmbjx.exe
1816	mUEhGTF.exe
4520	TLZvjER.exe
5068	JuJChIn.exe
4212	BJKFHWe.exe
3140	LZqmWBK.exe
1564	aUgPcjI.exe
4092	iYkTrYE.exe
4044	fHhBmIV.exe
2456	JpyWUYD.exe
4572	OEOZaRS.exe
3768	roYTJIC.exe
4836	YqUAuTm.exe
540	fzfmRMp.exe
2316	ULopqAj.exe
3044	vICSzwH.exe
2284	vxXkFPK.exe
3180	JIAQMfs.exe
2116	RipZQYT.exe
3992	kAaSQiq.exe
2488	FsrRryK.exe
4456	cppXfXs.exe
1152	HGgXPFk.exe
5084	gOdRssC.exe
4988	HloUwJb.exe
3588	PqKJwnG.exe
3108	xmxfTwf.exe
4568	bHsugWA.exe
2812	mSeeUAr.exe
2120	ZFeUKZN.exe
2476	PikpXwc.exe
4644	uSDgaHR.exe
2964	QQTrIdv.exe
1516	sFVUJFD.exe
4724	PYkmyxT.exe
3404	qKZKtsv.exe
2660	vTolMgd.exe
2756	WjAabfr.exe
1864	BHNzQQO.exe
2868	DzgGuIB.exe
5072	AvxOvik.exe
4196	mXyYzbP.exe
972	YmTprjG.exe
556	EkVdIBk.exe
4468	wGbaBvn.exe
4992	OixHdQy.exe
1096	hoOHhuk.exe
3240	FryATLt.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KwKsSLq.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\AZjdqVt.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\onMjbWr.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\fLFggjO.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\OdYWkfF.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\rUuSNVr.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\jBbdBFk.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\njPjWqK.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\KgfTSQv.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\gOdRssC.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\meeOpgK.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\vJrDhKm.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\hZrmISf.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\YwAarze.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\ywgNhKa.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\IEunboL.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\aUgPcjI.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\nNZTbgb.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\PhCXYbS.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\KarDXDd.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\UjzATsF.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\UkXNClw.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\xYgobEZ.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\azJKRWE.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\wcmmCFj.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\DhpSsDY.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\fKeoygZ.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\RNdmtxv.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\OhxIgVe.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\ZiMXYtu.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\baZavTE.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\tZQWZkD.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\FhZlWXl.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\wMiKbyJ.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\RLkrZlK.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\jYWdAxZ.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\Pkmjkyz.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\iQcjoxX.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\hfoVkni.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\nYkNSQS.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\qbyRCRn.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\oMQLkaU.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\htpXKAw.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\UoIlPGM.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\ZrnoLvM.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\VtXDUOF.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\XXMbjzz.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\CQGYSzh.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\btgMEoi.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\dWfpVEu.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\QeAZwiE.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\nJZkAVc.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\uesyiYX.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\xpaypsW.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\tosrmjJ.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\dDRzsuo.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\XIiTOTn.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\YwkGiWK.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\ZzrzIOi.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\CvJdEhU.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\HCtvDht.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\mRrNnNy.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\HozTXCk.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
File created	C:\Windows\System\okUSXJt.exe	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 1052	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	83
PID 216 wrote to memory of 1052	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	83
PID 216 wrote to memory of 1092	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	84
PID 216 wrote to memory of 1092	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	84
PID 216 wrote to memory of 4684	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	85
PID 216 wrote to memory of 4684	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	85
PID 216 wrote to memory of 4584	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	86
PID 216 wrote to memory of 4584	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	86
PID 216 wrote to memory of 3688	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	87
PID 216 wrote to memory of 3688	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	87
PID 216 wrote to memory of 2836	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	88
PID 216 wrote to memory of 2836	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	88
PID 216 wrote to memory of 3448	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	89
PID 216 wrote to memory of 3448	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	89
PID 216 wrote to memory of 4664	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	90
PID 216 wrote to memory of 4664	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	90
PID 216 wrote to memory of 2440	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	91
PID 216 wrote to memory of 2440	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	91
PID 216 wrote to memory of 4136	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	92
PID 216 wrote to memory of 4136	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	92
PID 216 wrote to memory of 4880	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	93
PID 216 wrote to memory of 4880	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	93
PID 216 wrote to memory of 4596	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	94
PID 216 wrote to memory of 4596	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	94
PID 216 wrote to memory of 2940	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	95
PID 216 wrote to memory of 2940	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	95
PID 216 wrote to memory of 2216	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	96
PID 216 wrote to memory of 2216	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	96
PID 216 wrote to memory of 2672	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	97
PID 216 wrote to memory of 2672	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	97
PID 216 wrote to memory of 1748	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	98
PID 216 wrote to memory of 1748	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	98
PID 216 wrote to memory of 2156	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	99
PID 216 wrote to memory of 2156	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	99
PID 216 wrote to memory of 1816	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	100
PID 216 wrote to memory of 1816	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	100
PID 216 wrote to memory of 4520	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	101
PID 216 wrote to memory of 4520	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	101
PID 216 wrote to memory of 5068	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	102
PID 216 wrote to memory of 5068	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	102
PID 216 wrote to memory of 4212	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	103
PID 216 wrote to memory of 4212	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	103
PID 216 wrote to memory of 3140	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	104
PID 216 wrote to memory of 3140	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	104
PID 216 wrote to memory of 1564	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	105
PID 216 wrote to memory of 1564	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	105
PID 216 wrote to memory of 4092	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	106
PID 216 wrote to memory of 4092	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	106
PID 216 wrote to memory of 4044	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	107
PID 216 wrote to memory of 4044	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	107
PID 216 wrote to memory of 2456	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	108
PID 216 wrote to memory of 2456	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	108
PID 216 wrote to memory of 4572	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	109
PID 216 wrote to memory of 4572	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	109
PID 216 wrote to memory of 3768	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	110
PID 216 wrote to memory of 3768	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	110
PID 216 wrote to memory of 4836	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	111
PID 216 wrote to memory of 4836	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	111
PID 216 wrote to memory of 540	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	112
PID 216 wrote to memory of 540	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	112
PID 216 wrote to memory of 2316	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	113
PID 216 wrote to memory of 2316	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	113
PID 216 wrote to memory of 3044	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	114
PID 216 wrote to memory of 3044	216	2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe	114

C:\Users\Admin\AppData\Local\Temp\2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe
"C:\Users\Admin\AppData\Local\Temp\2c8bfe92f09a7659fb4415aa1ab62aa8ad898ba6e43b427d2d3643f82942d524.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\System\fLFggjO.exe
  C:\Windows\System\fLFggjO.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\qlXXpeP.exe
  C:\Windows\System\qlXXpeP.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\rUuSNVr.exe
  C:\Windows\System\rUuSNVr.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\nHxlsBx.exe
  C:\Windows\System\nHxlsBx.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\vrJsHxG.exe
  C:\Windows\System\vrJsHxG.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\cFAltLZ.exe
  C:\Windows\System\cFAltLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\RjGNBuQ.exe
  C:\Windows\System\RjGNBuQ.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\TFRhWUj.exe
  C:\Windows\System\TFRhWUj.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\SCFTDyg.exe
  C:\Windows\System\SCFTDyg.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\uUdYpQo.exe
  C:\Windows\System\uUdYpQo.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\TkFlKyh.exe
  C:\Windows\System\TkFlKyh.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\icwEety.exe
  C:\Windows\System\icwEety.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\VzOHlFc.exe
  C:\Windows\System\VzOHlFc.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\DVbZHCZ.exe
  C:\Windows\System\DVbZHCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\qMvowAC.exe
  C:\Windows\System\qMvowAC.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\lkcwrIK.exe
  C:\Windows\System\lkcwrIK.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\uwQmbjx.exe
  C:\Windows\System\uwQmbjx.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\mUEhGTF.exe
  C:\Windows\System\mUEhGTF.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\TLZvjER.exe
  C:\Windows\System\TLZvjER.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\JuJChIn.exe
  C:\Windows\System\JuJChIn.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\BJKFHWe.exe
  C:\Windows\System\BJKFHWe.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\LZqmWBK.exe
  C:\Windows\System\LZqmWBK.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\aUgPcjI.exe
  C:\Windows\System\aUgPcjI.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\iYkTrYE.exe
  C:\Windows\System\iYkTrYE.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\fHhBmIV.exe
  C:\Windows\System\fHhBmIV.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\JpyWUYD.exe
  C:\Windows\System\JpyWUYD.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\OEOZaRS.exe
  C:\Windows\System\OEOZaRS.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\roYTJIC.exe
  C:\Windows\System\roYTJIC.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\YqUAuTm.exe
  C:\Windows\System\YqUAuTm.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\fzfmRMp.exe
  C:\Windows\System\fzfmRMp.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\ULopqAj.exe
  C:\Windows\System\ULopqAj.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\vICSzwH.exe
  C:\Windows\System\vICSzwH.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\vxXkFPK.exe
  C:\Windows\System\vxXkFPK.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\JIAQMfs.exe
  C:\Windows\System\JIAQMfs.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\RipZQYT.exe
  C:\Windows\System\RipZQYT.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\kAaSQiq.exe
  C:\Windows\System\kAaSQiq.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\FsrRryK.exe
  C:\Windows\System\FsrRryK.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\cppXfXs.exe
  C:\Windows\System\cppXfXs.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\HGgXPFk.exe
  C:\Windows\System\HGgXPFk.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\gOdRssC.exe
  C:\Windows\System\gOdRssC.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\HloUwJb.exe
  C:\Windows\System\HloUwJb.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\PqKJwnG.exe
  C:\Windows\System\PqKJwnG.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\xmxfTwf.exe
  C:\Windows\System\xmxfTwf.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\bHsugWA.exe
  C:\Windows\System\bHsugWA.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\mSeeUAr.exe
  C:\Windows\System\mSeeUAr.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\ZFeUKZN.exe
  C:\Windows\System\ZFeUKZN.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\PikpXwc.exe
  C:\Windows\System\PikpXwc.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\uSDgaHR.exe
  C:\Windows\System\uSDgaHR.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\QQTrIdv.exe
  C:\Windows\System\QQTrIdv.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\sFVUJFD.exe
  C:\Windows\System\sFVUJFD.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\PYkmyxT.exe
  C:\Windows\System\PYkmyxT.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\qKZKtsv.exe
  C:\Windows\System\qKZKtsv.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\vTolMgd.exe
  C:\Windows\System\vTolMgd.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\WjAabfr.exe
  C:\Windows\System\WjAabfr.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\BHNzQQO.exe
  C:\Windows\System\BHNzQQO.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\DzgGuIB.exe
  C:\Windows\System\DzgGuIB.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\AvxOvik.exe
  C:\Windows\System\AvxOvik.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\mXyYzbP.exe
  C:\Windows\System\mXyYzbP.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\YmTprjG.exe
  C:\Windows\System\YmTprjG.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\EkVdIBk.exe
  C:\Windows\System\EkVdIBk.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\wGbaBvn.exe
  C:\Windows\System\wGbaBvn.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\OixHdQy.exe
  C:\Windows\System\OixHdQy.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\hoOHhuk.exe
  C:\Windows\System\hoOHhuk.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\FryATLt.exe
  C:\Windows\System\FryATLt.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\NQUsifo.exe
  C:\Windows\System\NQUsifo.exe
  2⤵
  PID:1800
- C:\Windows\System\nYkvzmB.exe
  C:\Windows\System\nYkvzmB.exe
  2⤵
  PID:4388
- C:\Windows\System\YwkGiWK.exe
  C:\Windows\System\YwkGiWK.exe
  2⤵
  PID:4540
- C:\Windows\System\UjzATsF.exe
  C:\Windows\System\UjzATsF.exe
  2⤵
  PID:2036
- C:\Windows\System\dYKFGtN.exe
  C:\Windows\System\dYKFGtN.exe
  2⤵
  PID:2020
- C:\Windows\System\uaMtZjx.exe
  C:\Windows\System\uaMtZjx.exe
  2⤵
  PID:832
- C:\Windows\System\EzAAlLy.exe
  C:\Windows\System\EzAAlLy.exe
  2⤵
  PID:1372
- C:\Windows\System\uenpCfE.exe
  C:\Windows\System\uenpCfE.exe
  2⤵
  PID:3952
- C:\Windows\System\IXqzxRb.exe
  C:\Windows\System\IXqzxRb.exe
  2⤵
  PID:4104
- C:\Windows\System\NlPtnVl.exe
  C:\Windows\System\NlPtnVl.exe
  2⤵
  PID:3496
- C:\Windows\System\dzIyUwU.exe
  C:\Windows\System\dzIyUwU.exe
  2⤵
  PID:3800
- C:\Windows\System\XrKilmY.exe
  C:\Windows\System\XrKilmY.exe
  2⤵
  PID:4492
- C:\Windows\System\OhxIgVe.exe
  C:\Windows\System\OhxIgVe.exe
  2⤵
  PID:1900
- C:\Windows\System\nQQpxsB.exe
  C:\Windows\System\nQQpxsB.exe
  2⤵
  PID:4820
- C:\Windows\System\ZFKIpur.exe
  C:\Windows\System\ZFKIpur.exe
  2⤵
  PID:1304
- C:\Windows\System\fRTHjuZ.exe
  C:\Windows\System\fRTHjuZ.exe
  2⤵
  PID:1776
- C:\Windows\System\IEunboL.exe
  C:\Windows\System\IEunboL.exe
  2⤵
  PID:664
- C:\Windows\System\PwGkmfj.exe
  C:\Windows\System\PwGkmfj.exe
  2⤵
  PID:2324
- C:\Windows\System\IbVFPDS.exe
  C:\Windows\System\IbVFPDS.exe
  2⤵
  PID:372
- C:\Windows\System\gbBDvqp.exe
  C:\Windows\System\gbBDvqp.exe
  2⤵
  PID:3040
- C:\Windows\System\GKyIChV.exe
  C:\Windows\System\GKyIChV.exe
  2⤵
  PID:2268
- C:\Windows\System\KwKsSLq.exe
  C:\Windows\System\KwKsSLq.exe
  2⤵
  PID:3196
- C:\Windows\System\GYKPhnH.exe
  C:\Windows\System\GYKPhnH.exe
  2⤵
  PID:904
- C:\Windows\System\XHnjhTp.exe
  C:\Windows\System\XHnjhTp.exe
  2⤵
  PID:4452
- C:\Windows\System\qsfPmkq.exe
  C:\Windows\System\qsfPmkq.exe
  2⤵
  PID:4508
- C:\Windows\System\qkJztHm.exe
  C:\Windows\System\qkJztHm.exe
  2⤵
  PID:2168
- C:\Windows\System\KgfTSQv.exe
  C:\Windows\System\KgfTSQv.exe
  2⤵
  PID:4680
- C:\Windows\System\qKqrLsm.exe
  C:\Windows\System\qKqrLsm.exe
  2⤵
  PID:4296
- C:\Windows\System\GlbgmDV.exe
  C:\Windows\System\GlbgmDV.exe
  2⤵
  PID:2196
- C:\Windows\System\MupbpEq.exe
  C:\Windows\System\MupbpEq.exe
  2⤵
  PID:1860
- C:\Windows\System\YTvuznM.exe
  C:\Windows\System\YTvuznM.exe
  2⤵
  PID:956
- C:\Windows\System\VmMUTpC.exe
  C:\Windows\System\VmMUTpC.exe
  2⤵
  PID:1788
- C:\Windows\System\sSzMson.exe
  C:\Windows\System\sSzMson.exe
  2⤵
  PID:5148
- C:\Windows\System\xYgobEZ.exe
  C:\Windows\System\xYgobEZ.exe
  2⤵
  PID:5180
- C:\Windows\System\LzRSKnF.exe
  C:\Windows\System\LzRSKnF.exe
  2⤵
  PID:5204
- C:\Windows\System\YUVZeqk.exe
  C:\Windows\System\YUVZeqk.exe
  2⤵
  PID:5232
- C:\Windows\System\kzYCMiy.exe
  C:\Windows\System\kzYCMiy.exe
  2⤵
  PID:5260
- C:\Windows\System\dpFcbEO.exe
  C:\Windows\System\dpFcbEO.exe
  2⤵
  PID:5288
- C:\Windows\System\jExLpla.exe
  C:\Windows\System\jExLpla.exe
  2⤵
  PID:5320
- C:\Windows\System\zYGmtAO.exe
  C:\Windows\System\zYGmtAO.exe
  2⤵
  PID:5344
- C:\Windows\System\pTcDwaD.exe
  C:\Windows\System\pTcDwaD.exe
  2⤵
  PID:5376
- C:\Windows\System\oqhldAM.exe
  C:\Windows\System\oqhldAM.exe
  2⤵
  PID:5404
- C:\Windows\System\dDRzsuo.exe
  C:\Windows\System\dDRzsuo.exe
  2⤵
  PID:5428
- C:\Windows\System\GPNahhf.exe
  C:\Windows\System\GPNahhf.exe
  2⤵
  PID:5460
- C:\Windows\System\DofNQiB.exe
  C:\Windows\System\DofNQiB.exe
  2⤵
  PID:5488
- C:\Windows\System\GmWyNxK.exe
  C:\Windows\System\GmWyNxK.exe
  2⤵
  PID:5548
- C:\Windows\System\BfEmIPT.exe
  C:\Windows\System\BfEmIPT.exe
  2⤵
  PID:5564
- C:\Windows\System\WCeiING.exe
  C:\Windows\System\WCeiING.exe
  2⤵
  PID:5580
- C:\Windows\System\CzqcIOo.exe
  C:\Windows\System\CzqcIOo.exe
  2⤵
  PID:5604
- C:\Windows\System\tWEoeyN.exe
  C:\Windows\System\tWEoeyN.exe
  2⤵
  PID:5632
- C:\Windows\System\DcuVPNE.exe
  C:\Windows\System\DcuVPNE.exe
  2⤵
  PID:5660
- C:\Windows\System\EDyXTzU.exe
  C:\Windows\System\EDyXTzU.exe
  2⤵
  PID:5680
- C:\Windows\System\malLWqd.exe
  C:\Windows\System\malLWqd.exe
  2⤵
  PID:5708
- C:\Windows\System\fukYDNC.exe
  C:\Windows\System\fukYDNC.exe
  2⤵
  PID:5736
- C:\Windows\System\KgfRfjh.exe
  C:\Windows\System\KgfRfjh.exe
  2⤵
  PID:5764
- C:\Windows\System\nKVjYce.exe
  C:\Windows\System\nKVjYce.exe
  2⤵
  PID:5792
- C:\Windows\System\rFuaRhh.exe
  C:\Windows\System\rFuaRhh.exe
  2⤵
  PID:5820
- C:\Windows\System\VNyomBz.exe
  C:\Windows\System\VNyomBz.exe
  2⤵
  PID:5848
- C:\Windows\System\uFgGnZg.exe
  C:\Windows\System\uFgGnZg.exe
  2⤵
  PID:5876
- C:\Windows\System\kwLPnPg.exe
  C:\Windows\System\kwLPnPg.exe
  2⤵
  PID:5908
- C:\Windows\System\WdoriAR.exe
  C:\Windows\System\WdoriAR.exe
  2⤵
  PID:5932
- C:\Windows\System\FCmTPXM.exe
  C:\Windows\System\FCmTPXM.exe
  2⤵
  PID:5964
- C:\Windows\System\EYqNuxX.exe
  C:\Windows\System\EYqNuxX.exe
  2⤵
  PID:5988
- C:\Windows\System\cLkNCIp.exe
  C:\Windows\System\cLkNCIp.exe
  2⤵
  PID:6016
- C:\Windows\System\GdiwRRU.exe
  C:\Windows\System\GdiwRRU.exe
  2⤵
  PID:6044
- C:\Windows\System\jYWdAxZ.exe
  C:\Windows\System\jYWdAxZ.exe
  2⤵
  PID:6072
- C:\Windows\System\xKGpRqk.exe
  C:\Windows\System\xKGpRqk.exe
  2⤵
  PID:6100
- C:\Windows\System\vinWKkW.exe
  C:\Windows\System\vinWKkW.exe
  2⤵
  PID:6128
- C:\Windows\System\yZosGUi.exe
  C:\Windows\System\yZosGUi.exe
  2⤵
  PID:4376
- C:\Windows\System\eRWycRS.exe
  C:\Windows\System\eRWycRS.exe
  2⤵
  PID:4776
- C:\Windows\System\cewOEOI.exe
  C:\Windows\System\cewOEOI.exe
  2⤵
  PID:428
- C:\Windows\System\yUOssxT.exe
  C:\Windows\System\yUOssxT.exe
  2⤵
  PID:2936
- C:\Windows\System\XyCPPkz.exe
  C:\Windows\System\XyCPPkz.exe
  2⤵
  PID:1360
- C:\Windows\System\EbiNvKU.exe
  C:\Windows\System\EbiNvKU.exe
  2⤵
  PID:5096
- C:\Windows\System\zCNaIKi.exe
  C:\Windows\System\zCNaIKi.exe
  2⤵
  PID:4792
- C:\Windows\System\rQCdsEv.exe
  C:\Windows\System\rQCdsEv.exe
  2⤵
  PID:5164
- C:\Windows\System\HHIvREL.exe
  C:\Windows\System\HHIvREL.exe
  2⤵
  PID:5224
- C:\Windows\System\ViEFWnC.exe
  C:\Windows\System\ViEFWnC.exe
  2⤵
  PID:5280
- C:\Windows\System\jBbdBFk.exe
  C:\Windows\System\jBbdBFk.exe
  2⤵
  PID:5360
- C:\Windows\System\xbqpnjX.exe
  C:\Windows\System\xbqpnjX.exe
  2⤵
  PID:5424
- C:\Windows\System\dPLsGrn.exe
  C:\Windows\System\dPLsGrn.exe
  2⤵
  PID:5496
- C:\Windows\System\QeAZwiE.exe
  C:\Windows\System\QeAZwiE.exe
  2⤵
  PID:5560
- C:\Windows\System\wURZdBj.exe
  C:\Windows\System\wURZdBj.exe
  2⤵
  PID:5624
- C:\Windows\System\GubdcKo.exe
  C:\Windows\System\GubdcKo.exe
  2⤵
  PID:5692
- C:\Windows\System\XDfCPXe.exe
  C:\Windows\System\XDfCPXe.exe
  2⤵
  PID:5752
- C:\Windows\System\aTnOayz.exe
  C:\Windows\System\aTnOayz.exe
  2⤵
  PID:5812
- C:\Windows\System\kXEoewT.exe
  C:\Windows\System\kXEoewT.exe
  2⤵
  PID:5868
- C:\Windows\System\PaWtYZq.exe
  C:\Windows\System\PaWtYZq.exe
  2⤵
  PID:5944
- C:\Windows\System\jvLhaan.exe
  C:\Windows\System\jvLhaan.exe
  2⤵
  PID:6000
- C:\Windows\System\nNZTbgb.exe
  C:\Windows\System\nNZTbgb.exe
  2⤵
  PID:6060
- C:\Windows\System\KCRzQOX.exe
  C:\Windows\System\KCRzQOX.exe
  2⤵
  PID:6140
- C:\Windows\System\rEQnQoq.exe
  C:\Windows\System\rEQnQoq.exe
  2⤵
  PID:3328
- C:\Windows\System\Pkmjkyz.exe
  C:\Windows\System\Pkmjkyz.exe
  2⤵
  PID:4604
- C:\Windows\System\YPFNYZc.exe
  C:\Windows\System\YPFNYZc.exe
  2⤵
  PID:4168
- C:\Windows\System\yyAkdAF.exe
  C:\Windows\System\yyAkdAF.exe
  2⤵
  PID:5200
- C:\Windows\System\LgnEYpz.exe
  C:\Windows\System\LgnEYpz.exe
  2⤵
  PID:5340
- C:\Windows\System\zKuYWmc.exe
  C:\Windows\System\zKuYWmc.exe
  2⤵
  PID:5476
- C:\Windows\System\gsorgxd.exe
  C:\Windows\System\gsorgxd.exe
  2⤵
  PID:5652
- C:\Windows\System\npFKpFi.exe
  C:\Windows\System\npFKpFi.exe
  2⤵
  PID:5780
- C:\Windows\System\SCHjlzL.exe
  C:\Windows\System\SCHjlzL.exe
  2⤵
  PID:5900
- C:\Windows\System\nbWkcgd.exe
  C:\Windows\System\nbWkcgd.exe
  2⤵
  PID:6032
- C:\Windows\System\LcxdqSd.exe
  C:\Windows\System\LcxdqSd.exe
  2⤵
  PID:6152
- C:\Windows\System\QtNsGOI.exe
  C:\Windows\System\QtNsGOI.exe
  2⤵
  PID:6176
- C:\Windows\System\aWraQQx.exe
  C:\Windows\System\aWraQQx.exe
  2⤵
  PID:6208
- C:\Windows\System\VUwpngf.exe
  C:\Windows\System\VUwpngf.exe
  2⤵
  PID:6232
- C:\Windows\System\RSMEPQt.exe
  C:\Windows\System\RSMEPQt.exe
  2⤵
  PID:6264
- C:\Windows\System\MFSmXjf.exe
  C:\Windows\System\MFSmXjf.exe
  2⤵
  PID:6292
- C:\Windows\System\OOtyGuu.exe
  C:\Windows\System\OOtyGuu.exe
  2⤵
  PID:6316
- C:\Windows\System\vLkdpSF.exe
  C:\Windows\System\vLkdpSF.exe
  2⤵
  PID:6344
- C:\Windows\System\ZVGclDD.exe
  C:\Windows\System\ZVGclDD.exe
  2⤵
  PID:6376
- C:\Windows\System\ZzrzIOi.exe
  C:\Windows\System\ZzrzIOi.exe
  2⤵
  PID:6404
- C:\Windows\System\pCCfcpB.exe
  C:\Windows\System\pCCfcpB.exe
  2⤵
  PID:6432
- C:\Windows\System\ZSlRPVW.exe
  C:\Windows\System\ZSlRPVW.exe
  2⤵
  PID:6460
- C:\Windows\System\lwFnwup.exe
  C:\Windows\System\lwFnwup.exe
  2⤵
  PID:6488
- C:\Windows\System\eaVGORL.exe
  C:\Windows\System\eaVGORL.exe
  2⤵
  PID:6512
- C:\Windows\System\gKBpoXh.exe
  C:\Windows\System\gKBpoXh.exe
  2⤵
  PID:6544
- C:\Windows\System\tuWIBfY.exe
  C:\Windows\System\tuWIBfY.exe
  2⤵
  PID:6572
- C:\Windows\System\ukXGjVF.exe
  C:\Windows\System\ukXGjVF.exe
  2⤵
  PID:6600
- C:\Windows\System\hxwYuSF.exe
  C:\Windows\System\hxwYuSF.exe
  2⤵
  PID:6624
- C:\Windows\System\bCWuUoJ.exe
  C:\Windows\System\bCWuUoJ.exe
  2⤵
  PID:6656
- C:\Windows\System\EiebCaz.exe
  C:\Windows\System\EiebCaz.exe
  2⤵
  PID:6684
- C:\Windows\System\gEGXHel.exe
  C:\Windows\System\gEGXHel.exe
  2⤵
  PID:6712
- C:\Windows\System\rNWZszV.exe
  C:\Windows\System\rNWZszV.exe
  2⤵
  PID:6740
- C:\Windows\System\qzghKeE.exe
  C:\Windows\System\qzghKeE.exe
  2⤵
  PID:6768
- C:\Windows\System\LCCfpgL.exe
  C:\Windows\System\LCCfpgL.exe
  2⤵
  PID:6796
- C:\Windows\System\RVOLYLS.exe
  C:\Windows\System\RVOLYLS.exe
  2⤵
  PID:6812
- C:\Windows\System\YCwzTWy.exe
  C:\Windows\System\YCwzTWy.exe
  2⤵
  PID:6884
- C:\Windows\System\MwLgOfw.exe
  C:\Windows\System\MwLgOfw.exe
  2⤵
  PID:6900
- C:\Windows\System\LEiELXQ.exe
  C:\Windows\System\LEiELXQ.exe
  2⤵
  PID:6920
- C:\Windows\System\qtJctzk.exe
  C:\Windows\System\qtJctzk.exe
  2⤵
  PID:6972
- C:\Windows\System\aBgFxiQ.exe
  C:\Windows\System\aBgFxiQ.exe
  2⤵
  PID:7020
- C:\Windows\System\TQyMAqD.exe
  C:\Windows\System\TQyMAqD.exe
  2⤵
  PID:7040
- C:\Windows\System\Ocyulma.exe
  C:\Windows\System\Ocyulma.exe
  2⤵
  PID:7056
- C:\Windows\System\gMvPrQY.exe
  C:\Windows\System\gMvPrQY.exe
  2⤵
  PID:7072
- C:\Windows\System\OhUdTez.exe
  C:\Windows\System\OhUdTez.exe
  2⤵
  PID:7120
- C:\Windows\System\ILmkfXl.exe
  C:\Windows\System\ILmkfXl.exe
  2⤵
  PID:7140
- C:\Windows\System\nJZkAVc.exe
  C:\Windows\System\nJZkAVc.exe
  2⤵
  PID:7160
- C:\Windows\System\PnWyouO.exe
  C:\Windows\System\PnWyouO.exe
  2⤵
  PID:552
- C:\Windows\System\UPBMBKf.exe
  C:\Windows\System\UPBMBKf.exe
  2⤵
  PID:5276
- C:\Windows\System\IdBTrLD.exe
  C:\Windows\System\IdBTrLD.exe
  2⤵
  PID:4908
- C:\Windows\System\DHnhnnb.exe
  C:\Windows\System\DHnhnnb.exe
  2⤵
  PID:5980
- C:\Windows\System\ljDBcLr.exe
  C:\Windows\System\ljDBcLr.exe
  2⤵
  PID:3976
- C:\Windows\System\yVriReq.exe
  C:\Windows\System\yVriReq.exe
  2⤵
  PID:6248
- C:\Windows\System\CDqVWDs.exe
  C:\Windows\System\CDqVWDs.exe
  2⤵
  PID:6308
- C:\Windows\System\XxPBpOv.exe
  C:\Windows\System\XxPBpOv.exe
  2⤵
  PID:6332
- C:\Windows\System\lcjtHow.exe
  C:\Windows\System\lcjtHow.exe
  2⤵
  PID:6388
- C:\Windows\System\raCfRmx.exe
  C:\Windows\System\raCfRmx.exe
  2⤵
  PID:6420
- C:\Windows\System\wdQmlDb.exe
  C:\Windows\System\wdQmlDb.exe
  2⤵
  PID:2152
- C:\Windows\System\IyNuNPK.exe
  C:\Windows\System\IyNuNPK.exe
  2⤵
  PID:6500
- C:\Windows\System\AEkkCWJ.exe
  C:\Windows\System\AEkkCWJ.exe
  2⤵
  PID:6532
- C:\Windows\System\ThAEnCf.exe
  C:\Windows\System\ThAEnCf.exe
  2⤵
  PID:6560
- C:\Windows\System\azJKRWE.exe
  C:\Windows\System\azJKRWE.exe
  2⤵
  PID:6584
- C:\Windows\System\NBjQllZ.exe
  C:\Windows\System\NBjQllZ.exe
  2⤵
  PID:6616
- C:\Windows\System\wDpNOpP.exe
  C:\Windows\System\wDpNOpP.exe
  2⤵
  PID:6704
- C:\Windows\System\JxzGoMZ.exe
  C:\Windows\System\JxzGoMZ.exe
  2⤵
  PID:6728
- C:\Windows\System\NEnUAGT.exe
  C:\Windows\System\NEnUAGT.exe
  2⤵
  PID:6756
- C:\Windows\System\ZFmgAIw.exe
  C:\Windows\System\ZFmgAIw.exe
  2⤵
  PID:5064
- C:\Windows\System\lEMYXTe.exe
  C:\Windows\System\lEMYXTe.exe
  2⤵
  PID:3020
- C:\Windows\System\SQjSmpb.exe
  C:\Windows\System\SQjSmpb.exe
  2⤵
  PID:6808
- C:\Windows\System\oXWaHkT.exe
  C:\Windows\System\oXWaHkT.exe
  2⤵
  PID:6864
- C:\Windows\System\btgMEoi.exe
  C:\Windows\System\btgMEoi.exe
  2⤵
  PID:6912
- C:\Windows\System\wOtMPoz.exe
  C:\Windows\System\wOtMPoz.exe
  2⤵
  PID:6992
- C:\Windows\System\IseoKep.exe
  C:\Windows\System\IseoKep.exe
  2⤵
  PID:7032
- C:\Windows\System\pYvyHdj.exe
  C:\Windows\System\pYvyHdj.exe
  2⤵
  PID:4904
- C:\Windows\System\ZclFNaW.exe
  C:\Windows\System\ZclFNaW.exe
  2⤵
  PID:5508
- C:\Windows\System\QmLeFtR.exe
  C:\Windows\System\QmLeFtR.exe
  2⤵
  PID:6192
- C:\Windows\System\HRkIvtE.exe
  C:\Windows\System\HRkIvtE.exe
  2⤵
  PID:6276
- C:\Windows\System\MmFjsui.exe
  C:\Windows\System\MmFjsui.exe
  2⤵
  PID:3724
- C:\Windows\System\GQCDuvw.exe
  C:\Windows\System\GQCDuvw.exe
  2⤵
  PID:6508
- C:\Windows\System\WEzsfjI.exe
  C:\Windows\System\WEzsfjI.exe
  2⤵
  PID:3740
- C:\Windows\System\fgfrfrx.exe
  C:\Windows\System\fgfrfrx.exe
  2⤵
  PID:3152
- C:\Windows\System\IxLGfMm.exe
  C:\Windows\System\IxLGfMm.exe
  2⤵
  PID:3504
- C:\Windows\System\jXObUuh.exe
  C:\Windows\System\jXObUuh.exe
  2⤵
  PID:6896
- C:\Windows\System\NMLycZw.exe
  C:\Windows\System\NMLycZw.exe
  2⤵
  PID:6968
- C:\Windows\System\DmITsfa.exe
  C:\Windows\System\DmITsfa.exe
  2⤵
  PID:7148
- C:\Windows\System\doySNBj.exe
  C:\Windows\System\doySNBj.exe
  2⤵
  PID:6112
- C:\Windows\System\KMOLiVA.exe
  C:\Windows\System\KMOLiVA.exe
  2⤵
  PID:116
- C:\Windows\System\yOCPwiU.exe
  C:\Windows\System\yOCPwiU.exe
  2⤵
  PID:3764
- C:\Windows\System\qQQdzwV.exe
  C:\Windows\System\qQQdzwV.exe
  2⤵
  PID:6760
- C:\Windows\System\OwLmBsr.exe
  C:\Windows\System\OwLmBsr.exe
  2⤵
  PID:7016
- C:\Windows\System\rQUrXsB.exe
  C:\Windows\System\rQUrXsB.exe
  2⤵
  PID:6472
- C:\Windows\System\vNBQjRl.exe
  C:\Windows\System\vNBQjRl.exe
  2⤵
  PID:2984
- C:\Windows\System\ttTeJPl.exe
  C:\Windows\System\ttTeJPl.exe
  2⤵
  PID:6984
- C:\Windows\System\yzsLOCn.exe
  C:\Windows\System\yzsLOCn.exe
  2⤵
  PID:7196
- C:\Windows\System\vOJDXrZ.exe
  C:\Windows\System\vOJDXrZ.exe
  2⤵
  PID:7236
- C:\Windows\System\jwXMlyC.exe
  C:\Windows\System\jwXMlyC.exe
  2⤵
  PID:7264
- C:\Windows\System\EiMSygl.exe
  C:\Windows\System\EiMSygl.exe
  2⤵
  PID:7292
- C:\Windows\System\VtXDUOF.exe
  C:\Windows\System\VtXDUOF.exe
  2⤵
  PID:7320
- C:\Windows\System\wfslJYK.exe
  C:\Windows\System\wfslJYK.exe
  2⤵
  PID:7352
- C:\Windows\System\rQYLNfF.exe
  C:\Windows\System\rQYLNfF.exe
  2⤵
  PID:7376
- C:\Windows\System\SQlVYcf.exe
  C:\Windows\System\SQlVYcf.exe
  2⤵
  PID:7404
- C:\Windows\System\jajBDCJ.exe
  C:\Windows\System\jajBDCJ.exe
  2⤵
  PID:7436
- C:\Windows\System\TTwJRyw.exe
  C:\Windows\System\TTwJRyw.exe
  2⤵
  PID:7452
- C:\Windows\System\RLkrZlK.exe
  C:\Windows\System\RLkrZlK.exe
  2⤵
  PID:7472
- C:\Windows\System\WwTgrAX.exe
  C:\Windows\System\WwTgrAX.exe
  2⤵
  PID:7492
- C:\Windows\System\GKkvdUJ.exe
  C:\Windows\System\GKkvdUJ.exe
  2⤵
  PID:7508
- C:\Windows\System\jkNxsvx.exe
  C:\Windows\System\jkNxsvx.exe
  2⤵
  PID:7524
- C:\Windows\System\bqKAqTO.exe
  C:\Windows\System\bqKAqTO.exe
  2⤵
  PID:7548
- C:\Windows\System\SyCDxHr.exe
  C:\Windows\System\SyCDxHr.exe
  2⤵
  PID:7572
- C:\Windows\System\XQSTMrq.exe
  C:\Windows\System\XQSTMrq.exe
  2⤵
  PID:7600
- C:\Windows\System\mOyApGB.exe
  C:\Windows\System\mOyApGB.exe
  2⤵
  PID:7620
- C:\Windows\System\lrSurxL.exe
  C:\Windows\System\lrSurxL.exe
  2⤵
  PID:7688
- C:\Windows\System\ZgLDoOC.exe
  C:\Windows\System\ZgLDoOC.exe
  2⤵
  PID:7740
- C:\Windows\System\KNTZlYP.exe
  C:\Windows\System\KNTZlYP.exe
  2⤵
  PID:7780
- C:\Windows\System\nYkNSQS.exe
  C:\Windows\System\nYkNSQS.exe
  2⤵
  PID:7808
- C:\Windows\System\KXcxYIx.exe
  C:\Windows\System\KXcxYIx.exe
  2⤵
  PID:7824
- C:\Windows\System\ycZLFXo.exe
  C:\Windows\System\ycZLFXo.exe
  2⤵
  PID:7852
- C:\Windows\System\knruyrH.exe
  C:\Windows\System\knruyrH.exe
  2⤵
  PID:7880
- C:\Windows\System\vyVmELz.exe
  C:\Windows\System\vyVmELz.exe
  2⤵
  PID:7908
- C:\Windows\System\RPOGYVy.exe
  C:\Windows\System\RPOGYVy.exe
  2⤵
  PID:7936
- C:\Windows\System\ixXYuSL.exe
  C:\Windows\System\ixXYuSL.exe
  2⤵
  PID:7972
- C:\Windows\System\hXjoOIL.exe
  C:\Windows\System\hXjoOIL.exe
  2⤵
  PID:8004
- C:\Windows\System\UrzAafU.exe
  C:\Windows\System\UrzAafU.exe
  2⤵
  PID:8020
- C:\Windows\System\cJLmifH.exe
  C:\Windows\System\cJLmifH.exe
  2⤵
  PID:8036
- C:\Windows\System\srqRbNU.exe
  C:\Windows\System\srqRbNU.exe
  2⤵
  PID:8056
- C:\Windows\System\ekOsvmJ.exe
  C:\Windows\System\ekOsvmJ.exe
  2⤵
  PID:8092
- C:\Windows\System\YLdWERP.exe
  C:\Windows\System\YLdWERP.exe
  2⤵
  PID:8120
- C:\Windows\System\gheRfId.exe
  C:\Windows\System\gheRfId.exe
  2⤵
  PID:8152
- C:\Windows\System\IZVyBgG.exe
  C:\Windows\System\IZVyBgG.exe
  2⤵
  PID:8188
- C:\Windows\System\lcKUhIY.exe
  C:\Windows\System\lcKUhIY.exe
  2⤵
  PID:7108
- C:\Windows\System\uTvHxhj.exe
  C:\Windows\System\uTvHxhj.exe
  2⤵
  PID:7244
- C:\Windows\System\rwiCijl.exe
  C:\Windows\System\rwiCijl.exe
  2⤵
  PID:7316
- C:\Windows\System\bORkGUa.exe
  C:\Windows\System\bORkGUa.exe
  2⤵
  PID:7416
- C:\Windows\System\tESOTSa.exe
  C:\Windows\System\tESOTSa.exe
  2⤵
  PID:7468
- C:\Windows\System\hXYlNgp.exe
  C:\Windows\System\hXYlNgp.exe
  2⤵
  PID:7540
- C:\Windows\System\XIynvHM.exe
  C:\Windows\System\XIynvHM.exe
  2⤵
  PID:7544
- C:\Windows\System\ktEfNaP.exe
  C:\Windows\System\ktEfNaP.exe
  2⤵
  PID:7608
- C:\Windows\System\yhmEUgb.exe
  C:\Windows\System\yhmEUgb.exe
  2⤵
  PID:7672
- C:\Windows\System\XXMbjzz.exe
  C:\Windows\System\XXMbjzz.exe
  2⤵
  PID:7800
- C:\Windows\System\Okwbbea.exe
  C:\Windows\System\Okwbbea.exe
  2⤵
  PID:7836
- C:\Windows\System\jEtdXsU.exe
  C:\Windows\System\jEtdXsU.exe
  2⤵
  PID:7868
- C:\Windows\System\HjAjqIu.exe
  C:\Windows\System\HjAjqIu.exe
  2⤵
  PID:7924
- C:\Windows\System\pLnWtHy.exe
  C:\Windows\System\pLnWtHy.exe
  2⤵
  PID:7980
- C:\Windows\System\OHYPFSG.exe
  C:\Windows\System\OHYPFSG.exe
  2⤵
  PID:8064
- C:\Windows\System\WUleMqa.exe
  C:\Windows\System\WUleMqa.exe
  2⤵
  PID:8108
- C:\Windows\System\XisTrLO.exe
  C:\Windows\System\XisTrLO.exe
  2⤵
  PID:6668
- C:\Windows\System\vMxIVxa.exe
  C:\Windows\System\vMxIVxa.exe
  2⤵
  PID:7328
- C:\Windows\System\zdYZuFS.exe
  C:\Windows\System\zdYZuFS.exe
  2⤵
  PID:7500
- C:\Windows\System\fNMogFD.exe
  C:\Windows\System\fNMogFD.exe
  2⤵
  PID:7584
- C:\Windows\System\bjfHowL.exe
  C:\Windows\System\bjfHowL.exe
  2⤵
  PID:7820
- C:\Windows\System\pxuUcvT.exe
  C:\Windows\System\pxuUcvT.exe
  2⤵
  PID:7892
- C:\Windows\System\eeTCSNm.exe
  C:\Windows\System\eeTCSNm.exe
  2⤵
  PID:8172
- C:\Windows\System\pIDflme.exe
  C:\Windows\System\pIDflme.exe
  2⤵
  PID:7764
- C:\Windows\System\dGTodjp.exe
  C:\Windows\System\dGTodjp.exe
  2⤵
  PID:7900
- C:\Windows\System\tjmNqzN.exe
  C:\Windows\System\tjmNqzN.exe
  2⤵
  PID:7680
- C:\Windows\System\WdGOuTS.exe
  C:\Windows\System\WdGOuTS.exe
  2⤵
  PID:8200
- C:\Windows\System\nXtJvlS.exe
  C:\Windows\System\nXtJvlS.exe
  2⤵
  PID:8228
- C:\Windows\System\tmnrhUQ.exe
  C:\Windows\System\tmnrhUQ.exe
  2⤵
  PID:8244
- C:\Windows\System\shmAwCU.exe
  C:\Windows\System\shmAwCU.exe
  2⤵
  PID:8276
- C:\Windows\System\VSQDNRi.exe
  C:\Windows\System\VSQDNRi.exe
  2⤵
  PID:8292
- C:\Windows\System\tJruuon.exe
  C:\Windows\System\tJruuon.exe
  2⤵
  PID:8308
- C:\Windows\System\uesyiYX.exe
  C:\Windows\System\uesyiYX.exe
  2⤵
  PID:8340
- C:\Windows\System\xCWWvzh.exe
  C:\Windows\System\xCWWvzh.exe
  2⤵
  PID:8372
- C:\Windows\System\mtBsaqs.exe
  C:\Windows\System\mtBsaqs.exe
  2⤵
  PID:8396
- C:\Windows\System\exArxsk.exe
  C:\Windows\System\exArxsk.exe
  2⤵
  PID:8452
- C:\Windows\System\uxDxnkC.exe
  C:\Windows\System\uxDxnkC.exe
  2⤵
  PID:8476
- C:\Windows\System\bUCNCDp.exe
  C:\Windows\System\bUCNCDp.exe
  2⤵
  PID:8504
- C:\Windows\System\AeMHuxa.exe
  C:\Windows\System\AeMHuxa.exe
  2⤵
  PID:8536
- C:\Windows\System\qNjdTuw.exe
  C:\Windows\System\qNjdTuw.exe
  2⤵
  PID:8564
- C:\Windows\System\puUaTUs.exe
  C:\Windows\System\puUaTUs.exe
  2⤵
  PID:8588
- C:\Windows\System\mxRTuAD.exe
  C:\Windows\System\mxRTuAD.exe
  2⤵
  PID:8608
- C:\Windows\System\AXYJooM.exe
  C:\Windows\System\AXYJooM.exe
  2⤵
  PID:8628
- C:\Windows\System\HTKCDdn.exe
  C:\Windows\System\HTKCDdn.exe
  2⤵
  PID:8648
- C:\Windows\System\JJnIPqN.exe
  C:\Windows\System\JJnIPqN.exe
  2⤵
  PID:8696
- C:\Windows\System\qbyRCRn.exe
  C:\Windows\System\qbyRCRn.exe
  2⤵
  PID:8728
- C:\Windows\System\PhCXYbS.exe
  C:\Windows\System\PhCXYbS.exe
  2⤵
  PID:8752
- C:\Windows\System\CvJdEhU.exe
  C:\Windows\System\CvJdEhU.exe
  2⤵
  PID:8776
- C:\Windows\System\WgDsPxs.exe
  C:\Windows\System\WgDsPxs.exe
  2⤵
  PID:8804
- C:\Windows\System\nVNasNb.exe
  C:\Windows\System\nVNasNb.exe
  2⤵
  PID:8852
- C:\Windows\System\NqPFBzU.exe
  C:\Windows\System\NqPFBzU.exe
  2⤵
  PID:8888
- C:\Windows\System\ZtPUUdH.exe
  C:\Windows\System\ZtPUUdH.exe
  2⤵
  PID:8912
- C:\Windows\System\okUSXJt.exe
  C:\Windows\System\okUSXJt.exe
  2⤵
  PID:8952
- C:\Windows\System\EfSsShJ.exe
  C:\Windows\System\EfSsShJ.exe
  2⤵
  PID:8980
- C:\Windows\System\wcmmCFj.exe
  C:\Windows\System\wcmmCFj.exe
  2⤵
  PID:8996
- C:\Windows\System\dBBuFOb.exe
  C:\Windows\System\dBBuFOb.exe
  2⤵
  PID:9036
- C:\Windows\System\PhteWHA.exe
  C:\Windows\System\PhteWHA.exe
  2⤵
  PID:9052
- C:\Windows\System\DQVUzTB.exe
  C:\Windows\System\DQVUzTB.exe
  2⤵
  PID:9080
- C:\Windows\System\ZBJMZVu.exe
  C:\Windows\System\ZBJMZVu.exe
  2⤵
  PID:9112
- C:\Windows\System\rLAiIKt.exe
  C:\Windows\System\rLAiIKt.exe
  2⤵
  PID:9152
- C:\Windows\System\lXvEHtd.exe
  C:\Windows\System\lXvEHtd.exe
  2⤵
  PID:9168
- C:\Windows\System\aHpNuSK.exe
  C:\Windows\System\aHpNuSK.exe
  2⤵
  PID:9208
- C:\Windows\System\oVgDWje.exe
  C:\Windows\System\oVgDWje.exe
  2⤵
  PID:7580
- C:\Windows\System\vStNQEm.exe
  C:\Windows\System\vStNQEm.exe
  2⤵
  PID:8260
- C:\Windows\System\LHvMJEi.exe
  C:\Windows\System\LHvMJEi.exe
  2⤵
  PID:8300
- C:\Windows\System\miIVkJQ.exe
  C:\Windows\System\miIVkJQ.exe
  2⤵
  PID:8388
- C:\Windows\System\rzOYAfx.exe
  C:\Windows\System\rzOYAfx.exe
  2⤵
  PID:8472
- C:\Windows\System\peOqrgh.exe
  C:\Windows\System\peOqrgh.exe
  2⤵
  PID:8496
- C:\Windows\System\miGlpTk.exe
  C:\Windows\System\miGlpTk.exe
  2⤵
  PID:8616
- C:\Windows\System\tIadHdw.exe
  C:\Windows\System\tIadHdw.exe
  2⤵
  PID:8688
- C:\Windows\System\lEshpdw.exe
  C:\Windows\System\lEshpdw.exe
  2⤵
  PID:8768
- C:\Windows\System\MKWVdBQ.exe
  C:\Windows\System\MKWVdBQ.exe
  2⤵
  PID:8748
- C:\Windows\System\EVYfVEA.exe
  C:\Windows\System\EVYfVEA.exe
  2⤵
  PID:8908
- C:\Windows\System\JyYwPSN.exe
  C:\Windows\System\JyYwPSN.exe
  2⤵
  PID:8964
- C:\Windows\System\tlUwdjb.exe
  C:\Windows\System\tlUwdjb.exe
  2⤵
  PID:8992
- C:\Windows\System\lexafhQ.exe
  C:\Windows\System\lexafhQ.exe
  2⤵
  PID:9092
- C:\Windows\System\AZjdqVt.exe
  C:\Windows\System\AZjdqVt.exe
  2⤵
  PID:9148
- C:\Windows\System\CKqJwNE.exe
  C:\Windows\System\CKqJwNE.exe
  2⤵
  PID:7428
- C:\Windows\System\BMJogvf.exe
  C:\Windows\System\BMJogvf.exe
  2⤵
  PID:8364
- C:\Windows\System\IxzfUxp.exe
  C:\Windows\System\IxzfUxp.exe
  2⤵
  PID:8524
- C:\Windows\System\ojoLXff.exe
  C:\Windows\System\ojoLXff.exe
  2⤵
  PID:8644
- C:\Windows\System\XfkPzzv.exe
  C:\Windows\System\XfkPzzv.exe
  2⤵
  PID:8872
- C:\Windows\System\DeHzYiN.exe
  C:\Windows\System\DeHzYiN.exe
  2⤵
  PID:8900
- C:\Windows\System\QuyFrMk.exe
  C:\Windows\System\QuyFrMk.exe
  2⤵
  PID:9144
- C:\Windows\System\CjFuAOn.exe
  C:\Windows\System\CjFuAOn.exe
  2⤵
  PID:7216
- C:\Windows\System\xZsKyRP.exe
  C:\Windows\System\xZsKyRP.exe
  2⤵
  PID:8576
- C:\Windows\System\pfendKK.exe
  C:\Windows\System\pfendKK.exe
  2⤵
  PID:8132
- C:\Windows\System\rwYaFzt.exe
  C:\Windows\System\rwYaFzt.exe
  2⤵
  PID:8712
- C:\Windows\System\ynreNaY.exe
  C:\Windows\System\ynreNaY.exe
  2⤵
  PID:9192
- C:\Windows\System\HelMqmL.exe
  C:\Windows\System\HelMqmL.exe
  2⤵
  PID:8672
- C:\Windows\System\uFBEleL.exe
  C:\Windows\System\uFBEleL.exe
  2⤵
  PID:5108
- C:\Windows\System\jxmUFYo.exe
  C:\Windows\System\jxmUFYo.exe
  2⤵
  PID:9232
- C:\Windows\System\ItukKdv.exe
  C:\Windows\System\ItukKdv.exe
  2⤵
  PID:9260
- C:\Windows\System\ifSZYmv.exe
  C:\Windows\System\ifSZYmv.exe
  2⤵
  PID:9284
- C:\Windows\System\GMWhHTg.exe
  C:\Windows\System\GMWhHTg.exe
  2⤵
  PID:9316
- C:\Windows\System\RsTzQjg.exe
  C:\Windows\System\RsTzQjg.exe
  2⤵
  PID:9332
- C:\Windows\System\AjZIkSV.exe
  C:\Windows\System\AjZIkSV.exe
  2⤵
  PID:9352
- C:\Windows\System\xFyQrMy.exe
  C:\Windows\System\xFyQrMy.exe
  2⤵
  PID:9380
- C:\Windows\System\DWdMCNE.exe
  C:\Windows\System\DWdMCNE.exe
  2⤵
  PID:9404
- C:\Windows\System\MZWxNIl.exe
  C:\Windows\System\MZWxNIl.exe
  2⤵
  PID:9428
- C:\Windows\System\QBXqolI.exe
  C:\Windows\System\QBXqolI.exe
  2⤵
  PID:9464
- C:\Windows\System\yJyJjkT.exe
  C:\Windows\System\yJyJjkT.exe
  2⤵
  PID:9492
- C:\Windows\System\yWcJgIR.exe
  C:\Windows\System\yWcJgIR.exe
  2⤵
  PID:9512
- C:\Windows\System\pzcwkzA.exe
  C:\Windows\System\pzcwkzA.exe
  2⤵
  PID:9540
- C:\Windows\System\LafZDBH.exe
  C:\Windows\System\LafZDBH.exe
  2⤵
  PID:9564
- C:\Windows\System\WLlnlbn.exe
  C:\Windows\System\WLlnlbn.exe
  2⤵
  PID:9600
- C:\Windows\System\ekxWmmM.exe
  C:\Windows\System\ekxWmmM.exe
  2⤵
  PID:9628
- C:\Windows\System\mmFppYA.exe
  C:\Windows\System\mmFppYA.exe
  2⤵
  PID:9656
- C:\Windows\System\SowDfBT.exe
  C:\Windows\System\SowDfBT.exe
  2⤵
  PID:9688
- C:\Windows\System\jzFCiVJ.exe
  C:\Windows\System\jzFCiVJ.exe
  2⤵
  PID:9724
- C:\Windows\System\VMrzqAU.exe
  C:\Windows\System\VMrzqAU.exe
  2⤵
  PID:9768
- C:\Windows\System\WzQeHDR.exe
  C:\Windows\System\WzQeHDR.exe
  2⤵
  PID:9796
- C:\Windows\System\UuOSdsl.exe
  C:\Windows\System\UuOSdsl.exe
  2⤵
  PID:9820
- C:\Windows\System\SkWinQq.exe
  C:\Windows\System\SkWinQq.exe
  2⤵
  PID:9844
- C:\Windows\System\NhaqxKL.exe
  C:\Windows\System\NhaqxKL.exe
  2⤵
  PID:9884
- C:\Windows\System\YSmBndb.exe
  C:\Windows\System\YSmBndb.exe
  2⤵
  PID:9900
- C:\Windows\System\BPWArfF.exe
  C:\Windows\System\BPWArfF.exe
  2⤵
  PID:9940
- C:\Windows\System\zmahEXS.exe
  C:\Windows\System\zmahEXS.exe
  2⤵
  PID:9968
- C:\Windows\System\EpCwqMj.exe
  C:\Windows\System\EpCwqMj.exe
  2⤵
  PID:9996
- C:\Windows\System\zuUrycm.exe
  C:\Windows\System\zuUrycm.exe
  2⤵
  PID:10024
- C:\Windows\System\TBNAqPx.exe
  C:\Windows\System\TBNAqPx.exe
  2⤵
  PID:10044
- C:\Windows\System\HCtvDht.exe
  C:\Windows\System\HCtvDht.exe
  2⤵
  PID:10068
- C:\Windows\System\MQZuowR.exe
  C:\Windows\System\MQZuowR.exe
  2⤵
  PID:10100
- C:\Windows\System\bTDvLfP.exe
  C:\Windows\System\bTDvLfP.exe
  2⤵
  PID:10120
- C:\Windows\System\zTVzpLc.exe
  C:\Windows\System\zTVzpLc.exe
  2⤵
  PID:10148
- C:\Windows\System\kLpoYYG.exe
  C:\Windows\System\kLpoYYG.exe
  2⤵
  PID:10192
- C:\Windows\System\DiTMfhe.exe
  C:\Windows\System\DiTMfhe.exe
  2⤵
  PID:10220
- C:\Windows\System\VQthhGw.exe
  C:\Windows\System\VQthhGw.exe
  2⤵
  PID:9228
- C:\Windows\System\GdyxItF.exe
  C:\Windows\System\GdyxItF.exe
  2⤵
  PID:9300
- C:\Windows\System\CXRwIhp.exe
  C:\Windows\System\CXRwIhp.exe
  2⤵
  PID:9368
- C:\Windows\System\VJVXWJC.exe
  C:\Windows\System\VJVXWJC.exe
  2⤵
  PID:9400
- C:\Windows\System\RKdIPZx.exe
  C:\Windows\System\RKdIPZx.exe
  2⤵
  PID:9476
- C:\Windows\System\mBfVBQI.exe
  C:\Windows\System\mBfVBQI.exe
  2⤵
  PID:9556
- C:\Windows\System\OoAqDXU.exe
  C:\Windows\System\OoAqDXU.exe
  2⤵
  PID:9612
- C:\Windows\System\vFXUsKS.exe
  C:\Windows\System\vFXUsKS.exe
  2⤵
  PID:9668
- C:\Windows\System\DhpSsDY.exe
  C:\Windows\System\DhpSsDY.exe
  2⤵
  PID:9700
- C:\Windows\System\oosOiCR.exe
  C:\Windows\System\oosOiCR.exe
  2⤵
  PID:9788
- C:\Windows\System\yLdPRef.exe
  C:\Windows\System\yLdPRef.exe
  2⤵
  PID:9864
- C:\Windows\System\PdeJLuQ.exe
  C:\Windows\System\PdeJLuQ.exe
  2⤵
  PID:9920
- C:\Windows\System\ZDTHiTl.exe
  C:\Windows\System\ZDTHiTl.exe
  2⤵
  PID:9964
- C:\Windows\System\mRrNnNy.exe
  C:\Windows\System\mRrNnNy.exe
  2⤵
  PID:10088
- C:\Windows\System\QfIbRzP.exe
  C:\Windows\System\QfIbRzP.exe
  2⤵
  PID:10136
- C:\Windows\System\xpaypsW.exe
  C:\Windows\System\xpaypsW.exe
  2⤵
  PID:10188
- C:\Windows\System\eADypmb.exe
  C:\Windows\System\eADypmb.exe
  2⤵
  PID:4800
- C:\Windows\System\fKeoygZ.exe
  C:\Windows\System\fKeoygZ.exe
  2⤵
  PID:9424
- C:\Windows\System\BWEgTka.exe
  C:\Windows\System\BWEgTka.exe
  2⤵
  PID:9592
- C:\Windows\System\cGYaOoB.exe
  C:\Windows\System\cGYaOoB.exe
  2⤵
  PID:9640
- C:\Windows\System\eyTbOgy.exe
  C:\Windows\System\eyTbOgy.exe
  2⤵
  PID:9816
- C:\Windows\System\cMHjioI.exe
  C:\Windows\System\cMHjioI.exe
  2⤵
  PID:9956
- C:\Windows\System\TkRTIIj.exe
  C:\Windows\System\TkRTIIj.exe
  2⤵
  PID:10060
- C:\Windows\System\gCwiCXR.exe
  C:\Windows\System\gCwiCXR.exe
  2⤵
  PID:10172
- C:\Windows\System\RGhEOzn.exe
  C:\Windows\System\RGhEOzn.exe
  2⤵
  PID:9652
- C:\Windows\System\prtARjg.exe
  C:\Windows\System\prtARjg.exe
  2⤵
  PID:10016
- C:\Windows\System\orFxNck.exe
  C:\Windows\System\orFxNck.exe
  2⤵
  PID:10112
- C:\Windows\System\fvreItp.exe
  C:\Windows\System\fvreItp.exe
  2⤵
  PID:10248
- C:\Windows\System\Qvtfmki.exe
  C:\Windows\System\Qvtfmki.exe
  2⤵
  PID:10276
- C:\Windows\System\iaOAENp.exe
  C:\Windows\System\iaOAENp.exe
  2⤵
  PID:10304
- C:\Windows\System\RUVSEaD.exe
  C:\Windows\System\RUVSEaD.exe
  2⤵
  PID:10324
- C:\Windows\System\wgBwitR.exe
  C:\Windows\System\wgBwitR.exe
  2⤵
  PID:10348
- C:\Windows\System\BRPfjSU.exe
  C:\Windows\System\BRPfjSU.exe
  2⤵
  PID:10376
- C:\Windows\System\wGcvVtc.exe
  C:\Windows\System\wGcvVtc.exe
  2⤵
  PID:10400
- C:\Windows\System\pGWIYlV.exe
  C:\Windows\System\pGWIYlV.exe
  2⤵
  PID:10444
- C:\Windows\System\KKfpdBt.exe
  C:\Windows\System\KKfpdBt.exe
  2⤵
  PID:10472
- C:\Windows\System\jFzzIpn.exe
  C:\Windows\System\jFzzIpn.exe
  2⤵
  PID:10488
- C:\Windows\System\mnZGSBi.exe
  C:\Windows\System\mnZGSBi.exe
  2⤵
  PID:10516
- C:\Windows\System\OdYWkfF.exe
  C:\Windows\System\OdYWkfF.exe
  2⤵
  PID:10544
- C:\Windows\System\sYNZRzu.exe
  C:\Windows\System\sYNZRzu.exe
  2⤵
  PID:10576
- C:\Windows\System\AqhKnvv.exe
  C:\Windows\System\AqhKnvv.exe
  2⤵
  PID:10612
- C:\Windows\System\FwAYgnn.exe
  C:\Windows\System\FwAYgnn.exe
  2⤵
  PID:10636
- C:\Windows\System\NSeVNWt.exe
  C:\Windows\System\NSeVNWt.exe
  2⤵
  PID:10664
- C:\Windows\System\SjhorOk.exe
  C:\Windows\System\SjhorOk.exe
  2⤵
  PID:10684
- C:\Windows\System\nJnsvVB.exe
  C:\Windows\System\nJnsvVB.exe
  2⤵
  PID:10700
- C:\Windows\System\rQGERzz.exe
  C:\Windows\System\rQGERzz.exe
  2⤵
  PID:10736
- C:\Windows\System\OeeKaCV.exe
  C:\Windows\System\OeeKaCV.exe
  2⤵
  PID:10760
- C:\Windows\System\iLJdxQB.exe
  C:\Windows\System\iLJdxQB.exe
  2⤵
  PID:10800
- C:\Windows\System\GorcOAU.exe
  C:\Windows\System\GorcOAU.exe
  2⤵
  PID:10824
- C:\Windows\System\rPYZmsL.exe
  C:\Windows\System\rPYZmsL.exe
  2⤵
  PID:10844
- C:\Windows\System\JZAsvbl.exe
  C:\Windows\System\JZAsvbl.exe
  2⤵
  PID:10876
- C:\Windows\System\XaXmArn.exe
  C:\Windows\System\XaXmArn.exe
  2⤵
  PID:10900
- C:\Windows\System\euBuyKP.exe
  C:\Windows\System\euBuyKP.exe
  2⤵
  PID:10928
- C:\Windows\System\wHURwQY.exe
  C:\Windows\System\wHURwQY.exe
  2⤵
  PID:10964
- C:\Windows\System\UJMjFjh.exe
  C:\Windows\System\UJMjFjh.exe
  2⤵
  PID:10992
- C:\Windows\System\LccEYXx.exe
  C:\Windows\System\LccEYXx.exe
  2⤵
  PID:11024
- C:\Windows\System\hZrmISf.exe
  C:\Windows\System\hZrmISf.exe
  2⤵
  PID:11052
- C:\Windows\System\UUciFpH.exe
  C:\Windows\System\UUciFpH.exe
  2⤵
  PID:11080
- C:\Windows\System\OedTQGT.exe
  C:\Windows\System\OedTQGT.exe
  2⤵
  PID:11108
- C:\Windows\System\QCkYKVB.exe
  C:\Windows\System\QCkYKVB.exe
  2⤵
  PID:11132
- C:\Windows\System\hFSsGCG.exe
  C:\Windows\System\hFSsGCG.exe
  2⤵
  PID:11156
- C:\Windows\System\VEPQMpZ.exe
  C:\Windows\System\VEPQMpZ.exe
  2⤵
  PID:11180
- C:\Windows\System\ByKnKUy.exe
  C:\Windows\System\ByKnKUy.exe
  2⤵
  PID:11224
- C:\Windows\System\PMyuBWw.exe
  C:\Windows\System\PMyuBWw.exe
  2⤵
  PID:11248
- C:\Windows\System\qbhgTsF.exe
  C:\Windows\System\qbhgTsF.exe
  2⤵
  PID:10244
- C:\Windows\System\baZavTE.exe
  C:\Windows\System\baZavTE.exe
  2⤵
  PID:10332
- C:\Windows\System\qMAVWXM.exe
  C:\Windows\System\qMAVWXM.exe
  2⤵
  PID:10388
- C:\Windows\System\UXrBUEq.exe
  C:\Windows\System\UXrBUEq.exe
  2⤵
  PID:10464
- C:\Windows\System\nRUWyXt.exe
  C:\Windows\System\nRUWyXt.exe
  2⤵
  PID:10480
- C:\Windows\System\uBscWfz.exe
  C:\Windows\System\uBscWfz.exe
  2⤵
  PID:10604
- C:\Windows\System\ZEQikzp.exe
  C:\Windows\System\ZEQikzp.exe
  2⤵
  PID:10672
- C:\Windows\System\FbSJNDr.exe
  C:\Windows\System\FbSJNDr.exe
  2⤵
  PID:10724
- C:\Windows\System\WIAsbNt.exe
  C:\Windows\System\WIAsbNt.exe
  2⤵
  PID:10796
- C:\Windows\System\SWbZqET.exe
  C:\Windows\System\SWbZqET.exe
  2⤵
  PID:10836
- C:\Windows\System\fhewlEj.exe
  C:\Windows\System\fhewlEj.exe
  2⤵
  PID:10940
- C:\Windows\System\xXiCgKu.exe
  C:\Windows\System\xXiCgKu.exe
  2⤵
  PID:10956
- C:\Windows\System\nMlkSab.exe
  C:\Windows\System\nMlkSab.exe
  2⤵
  PID:11036
- C:\Windows\System\XNjsKBK.exe
  C:\Windows\System\XNjsKBK.exe
  2⤵
  PID:11076
- C:\Windows\System\YwAarze.exe
  C:\Windows\System\YwAarze.exe
  2⤵
  PID:11144
- C:\Windows\System\kXkDHMA.exe
  C:\Windows\System\kXkDHMA.exe
  2⤵
  PID:11244
- C:\Windows\System\cjuLXzw.exe
  C:\Windows\System\cjuLXzw.exe
  2⤵
  PID:9804
- C:\Windows\System\fRnVRvY.exe
  C:\Windows\System\fRnVRvY.exe
  2⤵
  PID:10428
- C:\Windows\System\AfsjYMb.exe
  C:\Windows\System\AfsjYMb.exe
  2⤵
  PID:10620
- C:\Windows\System\rFxccrF.exe
  C:\Windows\System\rFxccrF.exe
  2⤵
  PID:10752
- C:\Windows\System\jqDkIJx.exe
  C:\Windows\System\jqDkIJx.exe
  2⤵
  PID:10948
- C:\Windows\System\OGpyWQh.exe
  C:\Windows\System\OGpyWQh.exe
  2⤵
  PID:11128
- C:\Windows\System\iOFhddw.exe
  C:\Windows\System\iOFhddw.exe
  2⤵
  PID:10292
- C:\Windows\System\HFYPsHK.exe
  C:\Windows\System\HFYPsHK.exe
  2⤵
  PID:10360
- C:\Windows\System\HtCclCU.exe
  C:\Windows\System\HtCclCU.exe
  2⤵
  PID:10896
- C:\Windows\System\NmlWUZo.exe
  C:\Windows\System\NmlWUZo.exe
  2⤵
  PID:10556
- C:\Windows\System\Vdtpsps.exe
  C:\Windows\System\Vdtpsps.exe
  2⤵
  PID:10508
- C:\Windows\System\CFzROOH.exe
  C:\Windows\System\CFzROOH.exe
  2⤵
  PID:11288
- C:\Windows\System\vfjOjth.exe
  C:\Windows\System\vfjOjth.exe
  2⤵
  PID:11304
- C:\Windows\System\MDHWhMx.exe
  C:\Windows\System\MDHWhMx.exe
  2⤵
  PID:11320
- C:\Windows\System\XdufrII.exe
  C:\Windows\System\XdufrII.exe
  2⤵
  PID:11360
- C:\Windows\System\MIQyDGt.exe
  C:\Windows\System\MIQyDGt.exe
  2⤵
  PID:11388
- C:\Windows\System\hfoVkni.exe
  C:\Windows\System\hfoVkni.exe
  2⤵
  PID:11408
- C:\Windows\System\uJFCGiM.exe
  C:\Windows\System\uJFCGiM.exe
  2⤵
  PID:11436
- C:\Windows\System\oAvfWKw.exe
  C:\Windows\System\oAvfWKw.exe
  2⤵
  PID:11476
- C:\Windows\System\ywgNhKa.exe
  C:\Windows\System\ywgNhKa.exe
  2⤵
  PID:11504
- C:\Windows\System\HLjdAcq.exe
  C:\Windows\System\HLjdAcq.exe
  2⤵
  PID:11520
- C:\Windows\System\ElGsmYq.exe
  C:\Windows\System\ElGsmYq.exe
  2⤵
  PID:11548
- C:\Windows\System\wMCbYXw.exe
  C:\Windows\System\wMCbYXw.exe
  2⤵
  PID:11568
- C:\Windows\System\SmPcbhG.exe
  C:\Windows\System\SmPcbhG.exe
  2⤵
  PID:11612
- C:\Windows\System\XLypcGA.exe
  C:\Windows\System\XLypcGA.exe
  2⤵
  PID:11640
- C:\Windows\System\CaYXYab.exe
  C:\Windows\System\CaYXYab.exe
  2⤵
  PID:11660
- C:\Windows\System\EGDZMvz.exe
  C:\Windows\System\EGDZMvz.exe
  2⤵
  PID:11684
- C:\Windows\System\cmPdwik.exe
  C:\Windows\System\cmPdwik.exe
  2⤵
  PID:11704
- C:\Windows\System\FbMPIeD.exe
  C:\Windows\System\FbMPIeD.exe
  2⤵
  PID:11740
- C:\Windows\System\UdNEFzC.exe
  C:\Windows\System\UdNEFzC.exe
  2⤵
  PID:11776
- C:\Windows\System\vMyvNFg.exe
  C:\Windows\System\vMyvNFg.exe
  2⤵
  PID:11804
- C:\Windows\System\PgUdvQw.exe
  C:\Windows\System\PgUdvQw.exe
  2⤵
  PID:11832
- C:\Windows\System\JOHocsi.exe
  C:\Windows\System\JOHocsi.exe
  2⤵
  PID:11864
- C:\Windows\System\MokInxy.exe
  C:\Windows\System\MokInxy.exe
  2⤵
  PID:11892
- C:\Windows\System\zqnsFZt.exe
  C:\Windows\System\zqnsFZt.exe
  2⤵
  PID:11932
- C:\Windows\System\nDGPkRX.exe
  C:\Windows\System\nDGPkRX.exe
  2⤵
  PID:11952
- C:\Windows\System\pRaYEAg.exe
  C:\Windows\System\pRaYEAg.exe
  2⤵
  PID:11980
- C:\Windows\System\AnPDeIi.exe
  C:\Windows\System\AnPDeIi.exe
  2⤵
  PID:12020
- C:\Windows\System\mjdFjhc.exe
  C:\Windows\System\mjdFjhc.exe
  2⤵
  PID:12048
- C:\Windows\System\lgRCncy.exe
  C:\Windows\System\lgRCncy.exe
  2⤵
  PID:12064
- C:\Windows\System\zUbPcLj.exe
  C:\Windows\System\zUbPcLj.exe
  2⤵
  PID:12100
- C:\Windows\System\nLuEkvy.exe
  C:\Windows\System\nLuEkvy.exe
  2⤵
  PID:12128
- C:\Windows\System\ISFSynM.exe
  C:\Windows\System\ISFSynM.exe
  2⤵
  PID:12160
- C:\Windows\System\ismHIqm.exe
  C:\Windows\System\ismHIqm.exe
  2⤵
  PID:12188
- C:\Windows\System\FfnxRup.exe
  C:\Windows\System\FfnxRup.exe
  2⤵
  PID:12216
- C:\Windows\System\zXiztpR.exe
  C:\Windows\System\zXiztpR.exe
  2⤵
  PID:12232
- C:\Windows\System\fgLurgH.exe
  C:\Windows\System\fgLurgH.exe
  2⤵
  PID:12260
- C:\Windows\System\FklPVPd.exe
  C:\Windows\System\FklPVPd.exe
  2⤵
  PID:10716
- C:\Windows\System\AsHxvdc.exe
  C:\Windows\System\AsHxvdc.exe
  2⤵
  PID:11312
- C:\Windows\System\NaxXueM.exe
  C:\Windows\System\NaxXueM.exe
  2⤵
  PID:11344
- C:\Windows\System\ZTDVCRJ.exe
  C:\Windows\System\ZTDVCRJ.exe
  2⤵
  PID:11396
- C:\Windows\System\CzbsRMo.exe
  C:\Windows\System\CzbsRMo.exe
  2⤵
  PID:11464
- C:\Windows\System\vboBROy.exe
  C:\Windows\System\vboBROy.exe
  2⤵
  PID:11580
- C:\Windows\System\ZurVVas.exe
  C:\Windows\System\ZurVVas.exe
  2⤵
  PID:11600
- C:\Windows\System\CjmrQra.exe
  C:\Windows\System\CjmrQra.exe
  2⤵
  PID:11672
- C:\Windows\System\faKREii.exe
  C:\Windows\System\faKREii.exe
  2⤵
  PID:11700
- C:\Windows\System\oJgksee.exe
  C:\Windows\System\oJgksee.exe
  2⤵
  PID:11820
- C:\Windows\System\JEkMGsO.exe
  C:\Windows\System\JEkMGsO.exe
  2⤵
  PID:11848
- C:\Windows\System\rPHHOhl.exe
  C:\Windows\System\rPHHOhl.exe
  2⤵
  PID:11948
- C:\Windows\System\uyCcRut.exe
  C:\Windows\System\uyCcRut.exe
  2⤵
  PID:12044
- C:\Windows\System\GgcxQiO.exe
  C:\Windows\System\GgcxQiO.exe
  2⤵
  PID:12096
- C:\Windows\System\MrUwiPM.exe
  C:\Windows\System\MrUwiPM.exe
  2⤵
  PID:12144
- C:\Windows\System\WMDCocX.exe
  C:\Windows\System\WMDCocX.exe
  2⤵
  PID:12228
- C:\Windows\System\LnzbIzJ.exe
  C:\Windows\System\LnzbIzJ.exe
  2⤵
  PID:11272
- C:\Windows\System\ZQbDczD.exe
  C:\Windows\System\ZQbDczD.exe
  2⤵
  PID:11404
- C:\Windows\System\dHjuIaT.exe
  C:\Windows\System\dHjuIaT.exe
  2⤵
  PID:11512
- C:\Windows\System\mVJIzAz.exe
  C:\Windows\System\mVJIzAz.exe
  2⤵
  PID:11628
- C:\Windows\System\rXQvxLe.exe
  C:\Windows\System\rXQvxLe.exe
  2⤵
  PID:11800
- C:\Windows\System\hBBmWgI.exe
  C:\Windows\System\hBBmWgI.exe
  2⤵
  PID:12012
- C:\Windows\System\XKlbPHc.exe
  C:\Windows\System\XKlbPHc.exe
  2⤵
  PID:12124
- C:\Windows\System\zETnSjl.exe
  C:\Windows\System\zETnSjl.exe
  2⤵
  PID:11356
- C:\Windows\System\BlIaQGC.exe
  C:\Windows\System\BlIaQGC.exe
  2⤵
  PID:11656
- C:\Windows\System\JVsOyNv.exe
  C:\Windows\System\JVsOyNv.exe
  2⤵
  PID:11920
- C:\Windows\System\HQYsXoh.exe
  C:\Windows\System\HQYsXoh.exe
  2⤵
  PID:11448
- C:\Windows\System\VdmXKZC.exe
  C:\Windows\System\VdmXKZC.exe
  2⤵
  PID:11856
- C:\Windows\System\vaWTgZO.exe
  C:\Windows\System\vaWTgZO.exe
  2⤵
  PID:12292
- C:\Windows\System\TSLdgnF.exe
  C:\Windows\System\TSLdgnF.exe
  2⤵
  PID:12312
- C:\Windows\System\Kacimuo.exe
  C:\Windows\System\Kacimuo.exe
  2⤵
  PID:12344
- C:\Windows\System\CQGYSzh.exe
  C:\Windows\System\CQGYSzh.exe
  2⤵
  PID:12372
- C:\Windows\System\tqkZipH.exe
  C:\Windows\System\tqkZipH.exe
  2⤵
  PID:12404
- C:\Windows\System\EupNTAT.exe
  C:\Windows\System\EupNTAT.exe
  2⤵
  PID:12424
- C:\Windows\System\xbJJrgQ.exe
  C:\Windows\System\xbJJrgQ.exe
  2⤵
  PID:12468
- C:\Windows\System\kXsoTpo.exe
  C:\Windows\System\kXsoTpo.exe
  2⤵
  PID:12504
- C:\Windows\System\gasywho.exe
  C:\Windows\System\gasywho.exe
  2⤵
  PID:12520
- C:\Windows\System\mwRcLIh.exe
  C:\Windows\System\mwRcLIh.exe
  2⤵
  PID:12560
- C:\Windows\System\tRZQgih.exe
  C:\Windows\System\tRZQgih.exe
  2⤵
  PID:12588
- C:\Windows\System\znJogoE.exe
  C:\Windows\System\znJogoE.exe
  2⤵
  PID:12616
- C:\Windows\System\vuphaSd.exe
  C:\Windows\System\vuphaSd.exe
  2⤵
  PID:12632
- C:\Windows\System\eQFGqQU.exe
  C:\Windows\System\eQFGqQU.exe
  2⤵
  PID:12656
- C:\Windows\System\EzfKgew.exe
  C:\Windows\System\EzfKgew.exe
  2⤵
  PID:12676
- C:\Windows\System\uwWzPgr.exe
  C:\Windows\System\uwWzPgr.exe
  2⤵
  PID:12728
- C:\Windows\System\bXnXBTu.exe
  C:\Windows\System\bXnXBTu.exe
  2⤵
  PID:12744
- C:\Windows\System\VoLmgRW.exe
  C:\Windows\System\VoLmgRW.exe
  2⤵
  PID:12772
- C:\Windows\System\pfQliHk.exe
  C:\Windows\System\pfQliHk.exe
  2⤵
  PID:12808
- C:\Windows\System\VeExkod.exe
  C:\Windows\System\VeExkod.exe
  2⤵
  PID:12840
- C:\Windows\System\njPjWqK.exe
  C:\Windows\System\njPjWqK.exe
  2⤵
  PID:12864
- C:\Windows\System\oZsbHjS.exe
  C:\Windows\System\oZsbHjS.exe
  2⤵
  PID:12884
- C:\Windows\System\HLbTgrl.exe
  C:\Windows\System\HLbTgrl.exe
  2⤵
  PID:12912
- C:\Windows\System\RsLGpCd.exe
  C:\Windows\System\RsLGpCd.exe
  2⤵
  PID:12940
- C:\Windows\System\UbAoXXA.exe
  C:\Windows\System\UbAoXXA.exe
  2⤵
  PID:12972
- C:\Windows\System\GcJVmLe.exe
  C:\Windows\System\GcJVmLe.exe
  2⤵
  PID:12996
- C:\Windows\System\bRvrGTu.exe
  C:\Windows\System\bRvrGTu.exe
  2⤵
  PID:13024
- C:\Windows\System\CspHbHw.exe
  C:\Windows\System\CspHbHw.exe
  2⤵
  PID:13044
- C:\Windows\System\nVQiUpd.exe
  C:\Windows\System\nVQiUpd.exe
  2⤵
  PID:13072
- C:\Windows\System\cpnuKDt.exe
  C:\Windows\System\cpnuKDt.exe
  2⤵
  PID:13120
- C:\Windows\System\gxvuLid.exe
  C:\Windows\System\gxvuLid.exe
  2⤵
  PID:13140
- C:\Windows\System\HozTXCk.exe
  C:\Windows\System\HozTXCk.exe
  2⤵
  PID:13176
- C:\Windows\System\aYqVtJs.exe
  C:\Windows\System\aYqVtJs.exe
  2⤵
  PID:13192
- C:\Windows\System\OgnKgXh.exe
  C:\Windows\System\OgnKgXh.exe
  2⤵
  PID:13220
- C:\Windows\System\QmFXAxT.exe
  C:\Windows\System\QmFXAxT.exe
  2⤵
  PID:13236
- C:\Windows\System\HVGpkeh.exe
  C:\Windows\System\HVGpkeh.exe
  2⤵
  PID:13272
- C:\Windows\System\kYZVKSU.exe
  C:\Windows\System\kYZVKSU.exe
  2⤵
  PID:13300
- C:\Windows\System\xJMkQFC.exe
  C:\Windows\System\xJMkQFC.exe
  2⤵
  PID:11608
- C:\Windows\System\BiVwYng.exe
  C:\Windows\System\BiVwYng.exe
  2⤵
  PID:12340
- C:\Windows\System\IKaPrWl.exe
  C:\Windows\System\IKaPrWl.exe
  2⤵
  PID:12420
- C:\Windows\System\AjyfmFG.exe
  C:\Windows\System\AjyfmFG.exe
  2⤵
  PID:12452
- C:\Windows\System\oMQLkaU.exe
  C:\Windows\System\oMQLkaU.exe
  2⤵
  PID:12600
- C:\Windows\System\QoJkGIg.exe
  C:\Windows\System\QoJkGIg.exe
  2⤵
  PID:12624
- C:\Windows\System\IQfcPVo.exe
  C:\Windows\System\IQfcPVo.exe
  2⤵
  PID:12720
- C:\Windows\System\QHPXsRc.exe
  C:\Windows\System\QHPXsRc.exe
  2⤵
  PID:12784
- C:\Windows\System\vXRXHdt.exe
  C:\Windows\System\vXRXHdt.exe
  2⤵
  PID:12860
- C:\Windows\System\CoMECoZ.exe
  C:\Windows\System\CoMECoZ.exe
  2⤵
  PID:12876
- C:\Windows\System\EMOgAFD.exe
  C:\Windows\System\EMOgAFD.exe
  2⤵
  PID:12952
- C:\Windows\System\MDACREF.exe
  C:\Windows\System\MDACREF.exe
  2⤵
  PID:12992
- C:\Windows\System\KarDXDd.exe
  C:\Windows\System\KarDXDd.exe
  2⤵
  PID:13092
- C:\Windows\System\sFqHQgR.exe
  C:\Windows\System\sFqHQgR.exe
  2⤵
  PID:13188
- C:\Windows\System\hHZxZOv.exe
  C:\Windows\System\hHZxZOv.exe
  2⤵
  PID:13256
- C:\Windows\System\BYXctdA.exe
  C:\Windows\System\BYXctdA.exe
  2⤵
  PID:12240
- C:\Windows\System\GywglOQ.exe
  C:\Windows\System\GywglOQ.exe
  2⤵
  PID:12476
- C:\Windows\System\EUtXGnK.exe
  C:\Windows\System\EUtXGnK.exe
  2⤵
  PID:12516
- C:\Windows\System\okfHwqC.exe
  C:\Windows\System\okfHwqC.exe
  2⤵
  PID:12644
- C:\Windows\System\RNdmtxv.exe
  C:\Windows\System\RNdmtxv.exe
  2⤵
  PID:12880
- C:\Windows\System\cHWDcfM.exe
  C:\Windows\System\cHWDcfM.exe
  2⤵
  PID:12988
- C:\Windows\System\wKdrCmp.exe
  C:\Windows\System\wKdrCmp.exe
  2⤵
  PID:13136
- C:\Windows\System\mYUNfZv.exe
  C:\Windows\System\mYUNfZv.exe
  2⤵
  PID:13284
- C:\Windows\System\nvBvSRh.exe
  C:\Windows\System\nvBvSRh.exe
  2⤵
  PID:12668
- C:\Windows\System\OLDGgSJ.exe
  C:\Windows\System\OLDGgSJ.exe
  2⤵
  PID:12968
- C:\Windows\System\upGCtcK.exe
  C:\Windows\System\upGCtcK.exe
  2⤵
  PID:12360
- C:\Windows\System\tZQWZkD.exe
  C:\Windows\System\tZQWZkD.exe
  2⤵
  PID:12700
- C:\Windows\System\iyHCVEG.exe
  C:\Windows\System\iyHCVEG.exe
  2⤵
  PID:13328
- C:\Windows\System\NFmJFnJ.exe
  C:\Windows\System\NFmJFnJ.exe
  2⤵
  PID:13368
- C:\Windows\System\PiKUajS.exe
  C:\Windows\System\PiKUajS.exe
  2⤵
  PID:13392
- C:\Windows\System\WnkFRYn.exe
  C:\Windows\System\WnkFRYn.exe
  2⤵
  PID:13416
- C:\Windows\System\htpXKAw.exe
  C:\Windows\System\htpXKAw.exe
  2⤵
  PID:13444
- C:\Windows\System\LyMXDbi.exe
  C:\Windows\System\LyMXDbi.exe
  2⤵
  PID:13472
- C:\Windows\System\WLosfLN.exe
  C:\Windows\System\WLosfLN.exe
  2⤵
  PID:13496
- C:\Windows\System\mTGORHk.exe
  C:\Windows\System\mTGORHk.exe
  2⤵
  PID:13528
- C:\Windows\System\rgWfSJj.exe
  C:\Windows\System\rgWfSJj.exe
  2⤵
  PID:13544
- C:\Windows\System\KRpzxQN.exe
  C:\Windows\System\KRpzxQN.exe
  2⤵
  PID:13572
- C:\Windows\System\ySYSPPS.exe
  C:\Windows\System\ySYSPPS.exe
  2⤵
  PID:13596
- C:\Windows\System\UoIlPGM.exe
  C:\Windows\System\UoIlPGM.exe
  2⤵
  PID:13616
- C:\Windows\System\onMjbWr.exe
  C:\Windows\System\onMjbWr.exe
  2⤵
  PID:13644
- C:\Windows\System\EaUWNVi.exe
  C:\Windows\System\EaUWNVi.exe
  2⤵
  PID:13680
- C:\Windows\System\IjINznW.exe
  C:\Windows\System\IjINznW.exe
  2⤵
  PID:13736
- C:\Windows\System\QScnhoV.exe
  C:\Windows\System\QScnhoV.exe
  2⤵
  PID:13764
- C:\Windows\System\EMjdhSz.exe
  C:\Windows\System\EMjdhSz.exe
  2⤵
  PID:13792
- C:\Windows\System\GVomYgt.exe
  C:\Windows\System\GVomYgt.exe
  2⤵
  PID:13820
- C:\Windows\System\VmkdVWE.exe
  C:\Windows\System\VmkdVWE.exe
  2⤵
  PID:13836
- C:\Windows\System\BKNKzYa.exe
  C:\Windows\System\BKNKzYa.exe
  2⤵
  PID:13856
- C:\Windows\System\zyLwKYa.exe
  C:\Windows\System\zyLwKYa.exe
  2⤵
  PID:13888
- C:\Windows\System\rKJzvid.exe
  C:\Windows\System\rKJzvid.exe
  2⤵
  PID:13904
- C:\Windows\System\vWQCsuJ.exe
  C:\Windows\System\vWQCsuJ.exe
  2⤵
  PID:13940
- C:\Windows\System\ncDzLiv.exe
  C:\Windows\System\ncDzLiv.exe
  2⤵
  PID:13976
- C:\Windows\System\reJJdHS.exe
  C:\Windows\System\reJJdHS.exe
  2⤵
  PID:14004
- C:\Windows\System\MxArsHQ.exe
  C:\Windows\System\MxArsHQ.exe
  2⤵
  PID:14040
- C:\Windows\System\mwzyYZZ.exe
  C:\Windows\System\mwzyYZZ.exe
  2⤵
  PID:14064
- C:\Windows\System\TAThsSw.exe
  C:\Windows\System\TAThsSw.exe
  2⤵
  PID:14088
- C:\Windows\System\drPkbFn.exe
  C:\Windows\System\drPkbFn.exe
  2⤵
  PID:14116
- C:\Windows\System\JnMjxay.exe
  C:\Windows\System\JnMjxay.exe
  2⤵
  PID:14156
- C:\Windows\System\OJSQpvF.exe
  C:\Windows\System\OJSQpvF.exe
  2⤵
  PID:14184
- C:\Windows\System\prlqdZC.exe
  C:\Windows\System\prlqdZC.exe
  2⤵
  PID:14212
- C:\Windows\System\nIVMnNa.exe
  C:\Windows\System\nIVMnNa.exe
  2⤵
  PID:14228
- C:\Windows\System\FEFkWtF.exe
  C:\Windows\System\FEFkWtF.exe
  2⤵
  PID:14248
- C:\Windows\System\BSRboQs.exe
  C:\Windows\System\BSRboQs.exe
  2⤵
  PID:14280
- C:\Windows\System\cVsARZX.exe
  C:\Windows\System\cVsARZX.exe
  2⤵
  PID:14324
- C:\Windows\System\meeOpgK.exe
  C:\Windows\System\meeOpgK.exe
  2⤵
  PID:13324
- C:\Windows\System\JsDNAlL.exe
  C:\Windows\System\JsDNAlL.exe
  2⤵
  PID:13400
- C:\Windows\System\fYztOky.exe
  C:\Windows\System\fYztOky.exe
  2⤵
  PID:13464
- C:\Windows\System\LnKHGFs.exe
  C:\Windows\System\LnKHGFs.exe
  2⤵
  PID:13484
- C:\Windows\System\UhIquLZ.exe
  C:\Windows\System\UhIquLZ.exe
  2⤵
  PID:13564
- C:\Windows\System\TYtSCTi.exe
  C:\Windows\System\TYtSCTi.exe
  2⤵
  PID:13656
- C:\Windows\System\HXZdkhL.exe
  C:\Windows\System\HXZdkhL.exe
  2⤵
  PID:13720
- C:\Windows\System\QJjBfLf.exe
  C:\Windows\System\QJjBfLf.exe
  2⤵
  PID:13748
- C:\Windows\System\okwfSSh.exe
  C:\Windows\System\okwfSSh.exe
  2⤵
  PID:13832
- C:\Windows\System\wOaggkP.exe
  C:\Windows\System\wOaggkP.exe
  2⤵
  PID:13864
- C:\Windows\System\VMzrVax.exe
  C:\Windows\System\VMzrVax.exe
  2⤵
  PID:13988
- C:\Windows\System\HJZcdFb.exe
  C:\Windows\System\HJZcdFb.exe
  2⤵
  PID:14072
- C:\Windows\System\sDYXJct.exe
  C:\Windows\System\sDYXJct.exe
  2⤵
  PID:14108
- C:\Windows\System\gkIcxNo.exe
  C:\Windows\System\gkIcxNo.exe
  2⤵
  PID:14180
- C:\Windows\System\AhIDohp.exe
  C:\Windows\System\AhIDohp.exe
  2⤵
  PID:14224
- C:\Windows\System\yFlsGRF.exe
  C:\Windows\System\yFlsGRF.exe
  2⤵
  PID:14320
- C:\Windows\System\vJrDhKm.exe
  C:\Windows\System\vJrDhKm.exe
  2⤵
  PID:12764
- C:\Windows\System\DdxkREZ.exe
  C:\Windows\System\DdxkREZ.exe
  2⤵
  PID:13560
- C:\Windows\System\ldKUYFv.exe
  C:\Windows\System\ldKUYFv.exe
  2⤵
  PID:13588
- C:\Windows\System\ygBteoY.exe
  C:\Windows\System\ygBteoY.exe
  2⤵
  PID:13896
- C:\Windows\System\FhZlWXl.exe
  C:\Windows\System\FhZlWXl.exe
  2⤵
  PID:13960
- C:\Windows\System\tTqdNId.exe
  C:\Windows\System\tTqdNId.exe
  2⤵
  PID:14152
- C:\Windows\System\tklRXYm.exe
  C:\Windows\System\tklRXYm.exe
  2⤵
  PID:14296
- C:\Windows\System\ykHfTlO.exe
  C:\Windows\System\ykHfTlO.exe
  2⤵
  PID:13592
- C:\Windows\System\JmmGpuC.exe
  C:\Windows\System\JmmGpuC.exe
  2⤵
  PID:13804
- C:\Windows\System\DVjMwLK.exe
  C:\Windows\System\DVjMwLK.exe
  2⤵
  PID:14144
- C:\Windows\System\ndaBPxN.exe
  C:\Windows\System\ndaBPxN.exe
  2⤵
  PID:13508
- C:\Windows\System\pGuAKeK.exe
  C:\Windows\System\pGuAKeK.exe
  2⤵
  PID:13704
- C:\Windows\System\qxolecS.exe
  C:\Windows\System\qxolecS.exe
  2⤵
  PID:14368
- C:\Windows\System\BCcshLG.exe
  C:\Windows\System\BCcshLG.exe
  2⤵
  PID:14384
- C:\Windows\System\QfEInjy.exe
  C:\Windows\System\QfEInjy.exe
  2⤵
  PID:14428
- C:\Windows\System\JplOIll.exe
  C:\Windows\System\JplOIll.exe
  2⤵
  PID:14452
- C:\Windows\System\hJqLkKz.exe
  C:\Windows\System\hJqLkKz.exe
  2⤵
  PID:14480
- C:\Windows\System\ZzufpKY.exe
  C:\Windows\System\ZzufpKY.exe
  2⤵
  PID:14504
- C:\Windows\System\kjSznDi.exe
  C:\Windows\System\kjSznDi.exe
  2⤵
  PID:14532
- C:\Windows\System\RJEHlxW.exe
  C:\Windows\System\RJEHlxW.exe
  2⤵
  PID:14560
- C:\Windows\System\ksXoRVq.exe
  C:\Windows\System\ksXoRVq.exe
  2⤵
  PID:14604
- C:\Windows\System\XFQpLmG.exe
  C:\Windows\System\XFQpLmG.exe
  2⤵
  PID:14624
- C:\Windows\System\jswqMse.exe
  C:\Windows\System\jswqMse.exe
  2⤵
  PID:14648
- C:\Windows\System\fUNaStV.exe
  C:\Windows\System\fUNaStV.exe
  2⤵
  PID:14672
- C:\Windows\System\VdwMeVr.exe
  C:\Windows\System\VdwMeVr.exe
  2⤵
  PID:14704
- C:\Windows\System\FCbkTuv.exe
  C:\Windows\System\FCbkTuv.exe
  2⤵
  PID:14724
- C:\Windows\System\quUNSKU.exe
  C:\Windows\System\quUNSKU.exe
  2⤵
  PID:14752
- C:\Windows\System\GaIqIbW.exe
  C:\Windows\System\GaIqIbW.exe
  2⤵
  PID:14780
- C:\Windows\System\zQcWZGK.exe
  C:\Windows\System\zQcWZGK.exe
  2⤵
  PID:14808
- C:\Windows\System\tIJhINN.exe
  C:\Windows\System\tIJhINN.exe
  2⤵
  PID:14832
- C:\Windows\System\pCZqBMz.exe
  C:\Windows\System\pCZqBMz.exe
  2⤵
  PID:14852
- C:\Windows\System\LmxHxGo.exe
  C:\Windows\System\LmxHxGo.exe
  2⤵
  PID:14884
- C:\Windows\System\zijCtdy.exe
  C:\Windows\System\zijCtdy.exe
  2⤵
  PID:14944
- C:\Windows\System\ZzfuafD.exe
  C:\Windows\System\ZzfuafD.exe
  2⤵
  PID:14972
- C:\Windows\System\lIUtDau.exe
  C:\Windows\System\lIUtDau.exe
  2⤵
  PID:14992
- C:\Windows\System\UkXNClw.exe
  C:\Windows\System\UkXNClw.exe
  2⤵
  PID:15016
- C:\Windows\System\rwFmDMk.exe
  C:\Windows\System\rwFmDMk.exe
  2⤵
  PID:15044
- C:\Windows\System\QSpRdEf.exe
  C:\Windows\System\QSpRdEf.exe
  2⤵
  PID:15060
- C:\Windows\System\klcvbWn.exe
  C:\Windows\System\klcvbWn.exe
  2⤵
  PID:15112
- C:\Windows\System\KXkbkrZ.exe
  C:\Windows\System\KXkbkrZ.exe
  2⤵
  PID:15136
- C:\Windows\System\ynzxjQM.exe
  C:\Windows\System\ynzxjQM.exe
  2⤵
  PID:15156
- C:\Windows\System\ORGGeMu.exe
  C:\Windows\System\ORGGeMu.exe
  2⤵
  PID:15176
- C:\Windows\System\iFfbrZR.exe
  C:\Windows\System\iFfbrZR.exe
  2⤵
  PID:15204
- C:\Windows\System\KXvDYff.exe
  C:\Windows\System\KXvDYff.exe
  2⤵
  PID:15228
- C:\Windows\System\CenLUyE.exe
  C:\Windows\System\CenLUyE.exe
  2⤵
  PID:15264
- C:\Windows\System\RbilMMv.exe
  C:\Windows\System\RbilMMv.exe
  2⤵
  PID:15288
- C:\Windows\System\ageYGOI.exe
  C:\Windows\System\ageYGOI.exe
  2⤵
  PID:15320
- C:\Windows\System\HdospUK.exe
  C:\Windows\System\HdospUK.exe
  2⤵
  PID:15348
- C:\Windows\System\LcUhaCf.exe
  C:\Windows\System\LcUhaCf.exe
  2⤵
  PID:14292
- C:\Windows\System\WkSgkzS.exe
  C:\Windows\System\WkSgkzS.exe
  2⤵
  PID:14380
- C:\Windows\System\eugWgbn.exe
  C:\Windows\System\eugWgbn.exe
  2⤵
  PID:14464
- C:\Windows\System\BNvRSce.exe
  C:\Windows\System\BNvRSce.exe
  2⤵
  PID:14496
- C:\Windows\System\ebMpqzp.exe
  C:\Windows\System\ebMpqzp.exe
  2⤵
  PID:14644
- C:\Windows\System\TXmZcCZ.exe
  C:\Windows\System\TXmZcCZ.exe
  2⤵
  PID:14740
- C:\Windows\System\hgZkopg.exe
  C:\Windows\System\hgZkopg.exe
  2⤵
  PID:14768
- C:\Windows\System\alCKSTG.exe
  C:\Windows\System\alCKSTG.exe
  2⤵
  PID:14816
- C:\Windows\System\FbOgGzY.exe
  C:\Windows\System\FbOgGzY.exe
  2⤵
  PID:14872
- C:\Windows\System\aKcKyGj.exe
  C:\Windows\System\aKcKyGj.exe
  2⤵
  PID:14940
- C:\Windows\System\ZiMXYtu.exe
  C:\Windows\System\ZiMXYtu.exe
  2⤵
  PID:14980
- C:\Windows\System\vzVNbYZ.exe
  C:\Windows\System\vzVNbYZ.exe
  2⤵
  PID:15104
- C:\Windows\System\dWfpVEu.exe
  C:\Windows\System\dWfpVEu.exe
  2⤵
  PID:15152
- C:\Windows\System\cFHSTEd.exe
  C:\Windows\System\cFHSTEd.exe
  2⤵
  PID:15212
- C:\Windows\System\TmDCxdf.exe
  C:\Windows\System\TmDCxdf.exe
  2⤵
  PID:15256
- C:\Windows\System\gWUgmtr.exe
  C:\Windows\System\gWUgmtr.exe
  2⤵
  PID:15336
- C:\Windows\System\EYDFSzm.exe
  C:\Windows\System\EYDFSzm.exe
  2⤵
  PID:14352
- C:\Windows\System\LNQuelQ.exe
  C:\Windows\System\LNQuelQ.exe
  2⤵
  PID:14376
- C:\Windows\System\AcxyiHE.exe
  C:\Windows\System\AcxyiHE.exe
  2⤵
  PID:14516
- C:\Windows\System\XNocmlI.exe
  C:\Windows\System\XNocmlI.exe
  2⤵
  PID:14824
- C:\Windows\System\uZwwqTP.exe
  C:\Windows\System\uZwwqTP.exe
  2⤵
  PID:15000
- C:\Windows\System\kogHCKe.exe
  C:\Windows\System\kogHCKe.exe
  2⤵
  PID:15056
- C:\Windows\System\dPbAtJt.exe
  C:\Windows\System\dPbAtJt.exe
  2⤵
  PID:14572
- C:\Windows\System\sPxJTKV.exe
  C:\Windows\System\sPxJTKV.exe
  2⤵
  PID:14540
- C:\Windows\System\eWIEWzC.exe
  C:\Windows\System\eWIEWzC.exe
  2⤵
  PID:14916
- C:\Windows\System\DUbUKjR.exe
  C:\Windows\System\DUbUKjR.exe
  2⤵
  PID:15304
- C:\Windows\System\ylFDlTL.exe
  C:\Windows\System\ylFDlTL.exe
  2⤵
  PID:14804
- C:\Windows\System\IlJUQoB.exe
  C:\Windows\System\IlJUQoB.exe
  2⤵
  PID:15376
- C:\Windows\System\MTzYTOX.exe
  C:\Windows\System\MTzYTOX.exe
  2⤵
  PID:15408
- C:\Windows\System\mfIggRD.exe
  C:\Windows\System\mfIggRD.exe
  2⤵
  PID:15424
- C:\Windows\System\wtjKRDJ.exe
  C:\Windows\System\wtjKRDJ.exe
  2⤵
  PID:15464
- C:\Windows\System\ZSdsWvN.exe
  C:\Windows\System\ZSdsWvN.exe
  2⤵
  PID:15492
- C:\Windows\System\MrMpnDF.exe
  C:\Windows\System\MrMpnDF.exe
  2⤵
  PID:15516
- C:\Windows\System\nKapRMp.exe
  C:\Windows\System\nKapRMp.exe
  2⤵
  PID:15536
- C:\Windows\System\sjyaeIQ.exe
  C:\Windows\System\sjyaeIQ.exe
  2⤵
  PID:15556
- C:\Windows\System\HXTaSpf.exe
  C:\Windows\System\HXTaSpf.exe
  2⤵
  PID:15584
- C:\Windows\System\HrexCHB.exe
  C:\Windows\System\HrexCHB.exe
  2⤵
  PID:15620
- C:\Windows\System\PMCkBev.exe
  C:\Windows\System\PMCkBev.exe
  2⤵
  PID:15656
- C:\Windows\System\fHcMLkA.exe
  C:\Windows\System\fHcMLkA.exe
  2⤵
  PID:15672
- C:\Windows\System\zIZndFK.exe
  C:\Windows\System\zIZndFK.exe
  2⤵
  PID:15696
- C:\Windows\System\tosrmjJ.exe
  C:\Windows\System\tosrmjJ.exe
  2⤵
  PID:15724
- C:\Windows\System\CvgvaVf.exe
  C:\Windows\System\CvgvaVf.exe
  2⤵
  PID:15748
- C:\Windows\System\VwjMdtD.exe
  C:\Windows\System\VwjMdtD.exe
  2⤵
  PID:15780
- C:\Windows\System\jrwihqq.exe
  C:\Windows\System\jrwihqq.exe
  2⤵
  PID:15800
- C:\Windows\System\zjlshCN.exe
  C:\Windows\System\zjlshCN.exe
  2⤵
  PID:15844
- C:\Windows\System\qHAFQXi.exe
  C:\Windows\System\qHAFQXi.exe
  2⤵
  PID:15868
- C:\Windows\System\wMiKbyJ.exe
  C:\Windows\System\wMiKbyJ.exe
  2⤵
  PID:15888
- C:\Windows\System\iRLVTFG.exe
  C:\Windows\System\iRLVTFG.exe
  2⤵
  PID:15912
- C:\Windows\System\iQcjoxX.exe
  C:\Windows\System\iQcjoxX.exe
  2⤵
  PID:15940
- C:\Windows\System\Deubegn.exe
  C:\Windows\System\Deubegn.exe
  2⤵
  PID:15976
- C:\Windows\System\dlLZvMH.exe
  C:\Windows\System\dlLZvMH.exe
  2⤵
  PID:16012
- C:\Windows\System\dqlWHUr.exe
  C:\Windows\System\dqlWHUr.exe
  2⤵
  PID:16032
- C:\Windows\System\JBrLNXT.exe
  C:\Windows\System\JBrLNXT.exe
  2⤵
  PID:16052
- C:\Windows\System\mZYfhiO.exe
  C:\Windows\System\mZYfhiO.exe
  2⤵
  PID:16108
- C:\Windows\System\PeZiAfn.exe
  C:\Windows\System\PeZiAfn.exe
  2⤵
  PID:16136
- C:\Windows\System\jirZHUT.exe
  C:\Windows\System\jirZHUT.exe
  2⤵
  PID:16156
- C:\Windows\System\nrDntGr.exe
  C:\Windows\System\nrDntGr.exe
  2⤵
  PID:16180
- C:\Windows\System\iOwzoKF.exe
  C:\Windows\System\iOwzoKF.exe
  2⤵
  PID:16204
- C:\Windows\System\TkEexvK.exe
  C:\Windows\System\TkEexvK.exe
  2⤵
  PID:16232
- C:\Windows\System\foKCxcH.exe
  C:\Windows\System\foKCxcH.exe
  2⤵
  PID:16252
- C:\Windows\System\HYrmAUf.exe
  C:\Windows\System\HYrmAUf.exe
  2⤵
  PID:16288
- C:\Windows\System\viKXRgY.exe
  C:\Windows\System\viKXRgY.exe
  2⤵
  PID:16316
- C:\Windows\System\WvXfFfW.exe
  C:\Windows\System\WvXfFfW.exe
  2⤵
  PID:16336
- C:\Windows\System\oXPbFVp.exe
  C:\Windows\System\oXPbFVp.exe
  2⤵
  PID:15144
- C:\Windows\System\NIuWcDC.exe
  C:\Windows\System\NIuWcDC.exe
  2⤵
  PID:15400
- C:\Windows\System\tpWqbhg.exe
  C:\Windows\System\tpWqbhg.exe
  2⤵
  PID:15480
- C:\Windows\System\TyLUJua.exe
  C:\Windows\System\TyLUJua.exe
  2⤵
  PID:15508
- C:\Windows\System\nUFhobq.exe
  C:\Windows\System\nUFhobq.exe
  2⤵
  PID:15596
- C:\Windows\System\aEWtajJ.exe
  C:\Windows\System\aEWtajJ.exe
  2⤵
  PID:15632
- C:\Windows\System\JGhcupF.exe
  C:\Windows\System\JGhcupF.exe
  2⤵
  PID:15708
- C:\Windows\System\TBCqlcs.exe
  C:\Windows\System\TBCqlcs.exe
  2⤵
  PID:15740
- C:\Windows\System\xwLYMEy.exe
  C:\Windows\System\xwLYMEy.exe
  2⤵
  PID:15824
- C:\Windows\System\ZiZFXHu.exe
  C:\Windows\System\ZiZFXHu.exe
  2⤵
  PID:15884
- C:\Windows\System\XIiTOTn.exe
  C:\Windows\System\XIiTOTn.exe
  2⤵
  PID:15904
- C:\Windows\System\bsomqJH.exe
  C:\Windows\System\bsomqJH.exe
  2⤵
  PID:16000
- C:\Windows\System\yOBpyZe.exe
  C:\Windows\System\yOBpyZe.exe
  2⤵
  PID:16020
- C:\Windows\System\odtnVVP.exe
  C:\Windows\System\odtnVVP.exe
  2⤵
  PID:16104
- C:\Windows\System\Oxyfoli.exe
  C:\Windows\System\Oxyfoli.exe
  2⤵
  PID:16188
- C:\Windows\System\PwTLoAs.exe
  C:\Windows\System\PwTLoAs.exe
  2⤵
  PID:16248
- C:\Windows\System\EWuTOmx.exe
  C:\Windows\System\EWuTOmx.exe
  2⤵
  PID:16348
- C:\Windows\System\tcpQtSp.exe
  C:\Windows\System\tcpQtSp.exe
  2⤵
  PID:14420
- C:\Windows\System\DOSmhtm.exe
  C:\Windows\System\DOSmhtm.exe
  2⤵
  PID:15564
- C:\Windows\System\EbfHjvF.exe
  C:\Windows\System\EbfHjvF.exe
  2⤵
  PID:15768
- C:\Windows\System\ADkGYNi.exe
  C:\Windows\System\ADkGYNi.exe
  2⤵
  PID:15908
- C:\Windows\System\JLRUxgH.exe
  C:\Windows\System\JLRUxgH.exe
  2⤵
  PID:16048
- C:\Windows\System\RXplLZL.exe
  C:\Windows\System\RXplLZL.exe
  2⤵
  PID:16100
- C:\Windows\System\NCFKBNG.exe
  C:\Windows\System\NCFKBNG.exe
  2⤵
  PID:16280
- C:\Windows\System\vJOzWZl.exe
  C:\Windows\System\vJOzWZl.exe
  2⤵
  PID:15460
- C:\Windows\System\DrbPpSx.exe
  C:\Windows\System\DrbPpSx.exe
  2⤵
  PID:15856
- C:\Windows\System\nxHbJCe.exe
  C:\Windows\System\nxHbJCe.exe
  2⤵
  PID:16164
- C:\Windows\System\iYruraj.exe
  C:\Windows\System\iYruraj.exe
  2⤵
  PID:15832
- C:\Windows\System\nlEbwwN.exe
  C:\Windows\System\nlEbwwN.exe
  2⤵
  PID:16412
- C:\Windows\System\XRUnToN.exe
  C:\Windows\System\XRUnToN.exe
  2⤵
  PID:16444
- C:\Windows\System\tvfPHcp.exe
  C:\Windows\System\tvfPHcp.exe
  2⤵
  PID:16488
- C:\Windows\System\AEXnWtL.exe
  C:\Windows\System\AEXnWtL.exe
  2⤵
  PID:16516
- C:\Windows\System\aSDVHvg.exe
  C:\Windows\System\aSDVHvg.exe
  2⤵
  PID:16544
- C:\Windows\System\vxqtEAW.exe
  C:\Windows\System\vxqtEAW.exe
  2⤵
  PID:16560
- C:\Windows\System\JhWWiFw.exe
  C:\Windows\System\JhWWiFw.exe
  2⤵
  PID:16576
- C:\Windows\System\SNkmtGv.exe
  C:\Windows\System\SNkmtGv.exe
  2⤵
  PID:16620
- C:\Windows\System\gXzMdFm.exe
  C:\Windows\System\gXzMdFm.exe
  2⤵
  PID:16644
- C:\Windows\System\TawjIWi.exe
  C:\Windows\System\TawjIWi.exe
  2⤵
  PID:16660
- C:\Windows\System\rCnTLOF.exe
  C:\Windows\System\rCnTLOF.exe
  2⤵
  PID:16696
- C:\Windows\System\jPxZfyS.exe
  C:\Windows\System\jPxZfyS.exe
  2⤵
  PID:16720
- C:\Windows\System\ZrnoLvM.exe
  C:\Windows\System\ZrnoLvM.exe
  2⤵
  PID:16764
- C:\Windows\System\IkAgsdi.exe
  C:\Windows\System\IkAgsdi.exe
  2⤵
  PID:16784
- C:\Windows\System\vhklyMa.exe
  C:\Windows\System\vhklyMa.exe
  2⤵
  PID:16808
- C:\Windows\System\laAkzGW.exe
  C:\Windows\System\laAkzGW.exe
  2⤵
  PID:16832
- C:\Windows\System\kNolXnl.exe
  C:\Windows\System\kNolXnl.exe
  2⤵
  PID:16868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BJKFHWe.exe

Filesize
1.7MB

MD5
80a3fa20ae3e4941a79867cdff60ee88

SHA1
18acbb44131da80d38e0aeb97887574dcac5d0ef

SHA256
ae8a2cbe1142d18e14ef604ee7b8585f8db9137b836fa3980762fe107b4bff0a

SHA512
800ef74e4d90c6a146b05984f5f20dabcfdb02cf1f8d5203445bdd680f44f54f4794ea524eaee1b61237fdefc00a4b856268a6f8481b2b390fe08f55549831c0

Download Submit
C:\Windows\System\DVbZHCZ.exe

Filesize
1.7MB

MD5
72ad03e8f1d91211327cb1040a51eb19

SHA1
caae215fcc2e285a3416afd1b1fd02ae3922bfea

SHA256
2b3f40898d8b4cda50ace43a3371475136ce02b16e072df8f8ecba1af3764074

SHA512
91b3a518d581926982b7161dba1187cdcab54431d7da681adb9ddf18512612fddce764b7a309094affa1c729e3fcd1ea04686e0b5c3bfce549af225b066cc84e

Download Submit
C:\Windows\System\JpyWUYD.exe

Filesize
1.7MB

MD5
02e2faeddb6169769d4e1fdce14e46e4

SHA1
baaf9520da6c50f3f95c3e16f6be10413eda6f5d

SHA256
494a107a829379dd838ced6bebae95e1f2b59f6991fe505f1920048754836c37

SHA512
9aa68e192867f7dbe8b197525e55cef2ea0892903ba64639f843aa65b8021d9c33b478ce1cfdf8215513b02cdb60aa02a13dfe35cb53b73f901b0a1a414f4d74

Download Submit
C:\Windows\System\JuJChIn.exe

Filesize
1.7MB

MD5
51c39eada4b2724dd74d6ceeff08feea

SHA1
9393ff185778a712aa0db5e9a3033157d0e83ad0

SHA256
ed3b000c27678fb8340b2b936e57f8d372e6a842a6c5a76d2204e3d9f59ac4ab

SHA512
ef2e3111b02901dc1cb19f75d511d3270b18a04bb4397c55b079109100d738ffd9eddbf07b6a955e2d04549afa08aaf4a205ae4ff0fe63543db964beb5157306

Download Submit
C:\Windows\System\LZqmWBK.exe

Filesize
1.7MB

MD5
d3eb5ce53bcb8a56c26b3bafdc2502df

SHA1
6693b8fbb80cb1da22be23d8ac95f116b132a977

SHA256
c3cd5794099ed94eeced95fd667e1ab2eb6940e4e1cca374229750e24d862945

SHA512
4e64e2ecfb6502940d17f056f03ff49c7b96aaea2d588433237d6166c41b477da3668a937f942321bb3d47d72881d63c964f77f680344140739c31dd6e1795f4

Download Submit
C:\Windows\System\OEOZaRS.exe

Filesize
1.7MB

MD5
4c615a5f014ada7f756df319d0101123

SHA1
e7a4d2c3810b31bdee069644074fbd8ab6b42134

SHA256
e16bb02bcd12ef5a7352389013f21eaf2e1cc1f0e79a401c1e0138104e6c71f2

SHA512
e2ad6457129d5aacb62d707283a37a003b366c43ce1ec5e8873ef9f9ccce1d4cc72fcbdbf693416b3f86eb431e65c7aecff0d5b2e662374952e1c81fc824f675

Download Submit
C:\Windows\System\RjGNBuQ.exe

Filesize
1.7MB

MD5
588b9943109f93a304d1474c978db342

SHA1
6ecb09b59c9105304c6dc6b14d0fcfa57f3b8220

SHA256
3bcbd2d88fcb1f3ae4281b94ead50f831ece0432bc99afb530a9118ebb96194f

SHA512
dc87a0f6884f3d3016f04e1ef25774e08d509c7fe893e3f5b81f388cec99dcedaaf42f7901af9016fa50478476aa0e0a28fc95c8cfa90385b5c94b30e972b96b

Download Submit
C:\Windows\System\SCFTDyg.exe

Filesize
1.7MB

MD5
988c16a660d44a121b104ddc6d718fa5

SHA1
93e328313946bad9fffb04f66b7ae258511ff6a0

SHA256
2d99fe5f23ff0527846f484c8d4b75200da32c9cf2535466e9db989492844bda

SHA512
ad60eed2c8ae44f7080262d4c62f255d07873a4f79864d301d5719cbfa9b762ce15ee08cefef7a885066990e5fe61682d9751647ca841fa72c77596f508510ef

Download Submit
C:\Windows\System\TFRhWUj.exe

Filesize
1.7MB

MD5
6983b62570abc97478cb188d1ed78497

SHA1
066b162637f1b7bc53964a2bc0e6de13a17a2c99

SHA256
01ab24802fa1fa5de0a4361d3fabdbc6542aebc02bf2524acebf4bd089a1d3fe

SHA512
bb6b367e52bae52840ff96a232cb6e24ff2c331cc45684609140d2eab5f002eb53a47b48d7c2378c5a12db0c46865f7c45003634dd255d54bf11bbabb0d7a066

Download Submit
C:\Windows\System\TLZvjER.exe

Filesize
1.7MB

MD5
78ec7328a2db610c5a0140511b723522

SHA1
dee232ed7d575370ec9d14dfd223953688452261

SHA256
3f99f8cf4e442a2a58900f9f38ad244d71dc5b1846d7e67be926ead37b60b740

SHA512
93f3790248ea192cd25783e6b4d62e49d24ac029571f86026d205f3b30087ccf10f4cd2c2cda95b415b40f6f1dbada00d27e3aa33b1d42a8c2c358bce65d4a81

Download Submit
C:\Windows\System\TkFlKyh.exe

Filesize
1.7MB

MD5
ad40dccbfbff29946ff49fe62f6363d6

SHA1
50682eeca03703c4772d1cbc45e42635b972ae5d

SHA256
392a483e6813203211f46e6cd65713bb38f3c42701aa49b6417cb4d7c82cbc0f

SHA512
bcc8c46028ed043036e273db04d18baa02b5c5e975e1f72984cbdb64ec9a3f2b8f2ed1cdd537ca78dfd693d5fe3876e5e94219ac0668cfa441b8869512de49ef

Download Submit
C:\Windows\System\ULopqAj.exe

Filesize
1.7MB

MD5
8c83b294f69ed1c283ce38b907c2868f

SHA1
1632f9669a321c7da04c69f62a1528a468021f9a

SHA256
52f8a150444214f977ff0d53bd1a23068d960bbc93124320c44a903af73b6ccc

SHA512
eda6c5baaaadb8a58ada4f4d658f2a1c9b1f3ba9f51bd2276197b09ad14d3250529b6e3417a9dcbb41202c2250b5cd342a99d9183d3fb6397a9ca6bbdf1e26b4

Download Submit
C:\Windows\System\VzOHlFc.exe

Filesize
1.7MB

MD5
b0b51a25d41bd791cb0faa767f55ce5f

SHA1
26e913e8491fffb3945a2f6a19690bfd5fb75c0d

SHA256
ecdfef076af53ec3003f2d64945cc770c5b2aee5dea26aeb05bcd02763d6550c

SHA512
beff2e20fdbbf67985cc7e1f312b37d20994b5369000a497c854d4e090a58ff29ecceb988179e24864aae7af544f112f5a18205262285394f964fbe110e64a7f

Download Submit
C:\Windows\System\YqUAuTm.exe

Filesize
1.7MB

MD5
744bbf28779358524d1e63830b00e448

SHA1
39723f621cfebe3a4c37cc0a77709e2fceea5dc8

SHA256
b4e4388de8a229669548ab7723e3bc912095a6acd878e2935f72eb19d0d7299a

SHA512
37fa58c39aa1133008ac2571ec7b4bc90b12ceb2c5f45c3db716874b35ffa0a9fb48baaff4db8b594c3bbd9149fa9fd07d1f55645798f3dc24f0de45e53a6fd5

Download Submit
C:\Windows\System\aUgPcjI.exe

Filesize
1.7MB

MD5
456ea67956b3a56fc3ee2078f880ef62

SHA1
0b1bf7fba602d75e57ba156dd9a5ed78e87a1e15

SHA256
e7cb9c146da902099b524626c1d98bed2c07dffcd3d81a0563685fc819beb0c7

SHA512
904214ecefeab9b808bc5bc8b776ffdd004e48dd669beed7217890ac499cde319fb026cc36d51a4f33d919b34e6108be5a7dbe9a559f64afcbf7ce31bc5524cf

Download Submit
C:\Windows\System\cFAltLZ.exe

Filesize
1.7MB

MD5
1e1c64676fff395d55e25fc9460df5b5

SHA1
e922bc9cdaa21cbc0dee42db737cd2cdb34bb6d0

SHA256
4423a6e207c2dcd20249376b1f8a0b854fd0eb79ad52de6d6f5ed9c0189e113f

SHA512
02784abb000fa42106a09dd6f156a48fcdef8cc29b246ffa9df4e22bdbcbbe27a077180a469b94c20e5450c965b9aa4c60375fcb13e431f6f9dc6a2600e670fb

Download Submit
C:\Windows\System\fHhBmIV.exe

Filesize
1.7MB

MD5
78d815ad70cab9b617989a8c74ecef3c

SHA1
3e2c8882554e04cb119b3bc9dd35c3dbd29650db

SHA256
7aa5f780c80d03e07536312e6de775d87143b1d289abf47deff981e62c2ff2ec

SHA512
c221e62387a04fe7f3e8cf18ee9751ee3c9c886335f4e656353157ab00a32ae015a29e2756cfaba4cae4370e4732dbcb250ce751b5673ed780f3a3a2d8e97086

Download Submit
C:\Windows\System\fLFggjO.exe

Filesize
1.7MB

MD5
77a699b213cd075d10363c0a10e0c791

SHA1
8758318090744ee6b5c280d747150b65301e47e5

SHA256
8619ce3d9b423791ac4b63f64a33708bd3a3b3a3781900221e05c4346b712bd6

SHA512
e59e102fbd6cd5fa9119cd1e26156b2cdf0fbd18761adea2c2a1ec0df467c70fbd3c1d991f3b12567d898dc3a3ed739ceade9200771ba75e8ff4bbeefcf12b10

Download Submit
C:\Windows\System\fzfmRMp.exe

Filesize
1.7MB

MD5
0021fa4bc232aafc18048f71dc12826b

SHA1
092b95093e279dc533f0e3564a06fb11330c2fca

SHA256
06de0702ec6b522e294b0058b6d9ad0275ee650bef75fbd25c7864f546e39c62

SHA512
704240972122903fdfeb53c14141bac469208f4748186e175549d63f3fb20f2433bfc076580858082939828df427cda1fb1d0049962306254685a74fa0181569

Download Submit
C:\Windows\System\iYkTrYE.exe

Filesize
1.7MB

MD5
4d79b3140e1e9efd58ac128c8b2c7e49

SHA1
1d256f3fec31e0a5403392922ceb3df4c727a4e5

SHA256
105108158f11ca142ddd4f548ca9fa5ba18e8597c0cb5dc804d17ac64e82178b

SHA512
454d092d99d83604e14f95dfdd80255790485baf4f084d6f9952e295085ed12c127e9f37206a133506574d55d2e8d4302299bc8f13ae40ad5e47d5e4cfba5cd7

Download Submit
C:\Windows\System\icwEety.exe

Filesize
1.7MB

MD5
eddbaa78da4858d4cf07853092f3a4c3

SHA1
661baff7f88279f6ecc88ba095416bddcb443211

SHA256
b109e6b95ac8fa2e62634a090901f2e3b049749b9a9b8eac8644729e2a3842ea

SHA512
882667288cad91bedb9842e278adbcf259206cf39fe074c2e86aae5dc3aeb2c83c067433dcb52c87ab2854300837d02aa6ae8a0a3600ee27a500d04acccce15d

Download Submit
C:\Windows\System\lkcwrIK.exe

Filesize
1.7MB

MD5
f438af2e80dde9605364033c6f855472

SHA1
750d6b802757ba6ad7dcd28df981dc21556cc1ab

SHA256
0a7f96f6d668351f857414c14fdf6efdc03c08ecc45b319e57104df9cbda1fbe

SHA512
2f8856e69a88c222926ae36ae19a8f8b92f3c95afaf098c056463b42465a156100fe30755a5cdd83beb8afd437b36091d51c217d5ed8c5d1b2f70fd6b5177343

Download Submit
C:\Windows\System\mUEhGTF.exe

Filesize
1.7MB

MD5
113a696e71fe9ae8865b201cd366a8e5

SHA1
a796570837df90570b85f96fe8dc92ea099c8602

SHA256
59194098d1dafcf4e338c9a4fb04b388e2f5638fe51e04d0710f0ff15ea6e93e

SHA512
24c4eaf616843a0f5a495875e63ad0e96bc9e90fbb085f6d4c7921c67501aae01a0233ebe0ebde8ffeaebc3ce750147e5141f4febc09a353c8e1c9687fb88b39

Download Submit
C:\Windows\System\nHxlsBx.exe

Filesize
1.7MB

MD5
fca3f383479f6da2bc57b7ef1c0a7878

SHA1
0bcc4c0b3c4e16e870f48df2f043f8146c809eb1

SHA256
a395110c84dda285aaf99c429793094e3bf57c2d7f1c2e4f2fe93dff3b273d7d

SHA512
5a2cd01c982023b387d3d1bf2e335897dae999aba33c1061d6ed8d7b852404862f19e0e5ce6bdfce224baf2cd77cd145433f10fd06170d5ee93b1a08870f8ccb

Download Submit
C:\Windows\System\qMvowAC.exe

Filesize
1.7MB

MD5
40e75b5aa4f8d91db690c92c1dd0e2bd

SHA1
a590d2e6961402761dfc4c170b660dbf057a60de

SHA256
ffc8b2a90409ec39db1b1557ec1aa02b0a33e72b823101900da5d8a260f3a063

SHA512
aa77ea05cd2f70e3fdbf0828eba28e7bc6efc4f0e66e7504a82fa0b1ce98952cf56423213e9bff2239ab5bbc45bce77b2cd73327110679fc78d028fc79ccfd2a

Download Submit
C:\Windows\System\qlXXpeP.exe

Filesize
1.7MB

MD5
be489bfb22f97ede49fca7f30cc6bdd7

SHA1
0cfed2f647e1468918dbd7e8c3b3c666ec0ff081

SHA256
7c57ac9f96f35e824524cbfcd216c8baa1ab6ae4ee8a4d08e2332db19978ca53

SHA512
71a46792dd8cd935172e97e0dfea2167c8a542a262b7ac381426c017e325173aa72cdbf7c2d390a28fd7a16bd15fce9ffe7e02f4551b9eb763d241d400e7dbb2

Download Submit
C:\Windows\System\rUuSNVr.exe

Filesize
1.7MB

MD5
064a3cb90631c78d540dc8699c3ab821

SHA1
31521f8c141c61954c4fc79ab1512f53f3f5e991

SHA256
a366b03a6890f67b4e9eda9c46dc39efa2e6243990998c699c38a516238e3e78

SHA512
9fc512a2c11f44d686ba23530892573cc57588d9a1baf8607806d02b173e77ad8478b312ed75c06e725659303de16fd88d79fc799a0a07a84b49a32d3917e3fb

Download Submit
C:\Windows\System\roYTJIC.exe

Filesize
1.7MB

MD5
88f789b43465830dbe2b175842dba969

SHA1
8813e8180ff7d756e317193179e817963422ad2a

SHA256
8ea9939501508622ad500228c47fa95d082750a30a935c22c889617a8d866f5a

SHA512
0628e941ce0d8026f454880fcba7661417177d63bc0b977e5371d78e20422007fcbccd3dffe7c3dc2f1e06df5bcd46f42e8248759dc768c1d31d25b77131475f

Download Submit
C:\Windows\System\uUdYpQo.exe

Filesize
1.7MB

MD5
8fafaa59cd332b19b336f10ef00a4be3

SHA1
80fab3b57ca3af6f0e46583716f4985e3d599011

SHA256
b535bd6b29e2d64198be57d17399553e3e98cfd7c91e5aeb01dcc9d866942b18

SHA512
71c83b10b1ec065b6d469a7d7165e19e1720d16e5793c5b3d235ec5ec7ba1a963755e33ead8902221fc56abf5bff7992efbbf557e3c493c52bd190a09b02fa14

Download Submit
C:\Windows\System\uwQmbjx.exe

Filesize
1.7MB

MD5
7b70d962f650ab785cad8108a351531c

SHA1
f8d4456216440c2b4f1218f323873335500c3094

SHA256
872d1972c3335eb57402b8b6219310b53a2033856d6baa4ae4f867fce913debb

SHA512
0d0c96f3e87d02441d0f23810425a37340518268d8aab2d39f98d23cc4f37f68bacbf6585ae639d6cbcede34790bffd45211a31e3bc879092fa70bc8456f4593

Download Submit
C:\Windows\System\vICSzwH.exe

Filesize
1.7MB

MD5
e8bb5eb89b838551085b368d394db8cb

SHA1
62f5a5e3982fa1e5aa5a5917d8ffe8c6283cd408

SHA256
1a2e6f37df53a0213c1efd904735f1721712a37b23482a878bc46e4e9af54415

SHA512
b57a565c158a014f99275678046f5ad8e4612c1e210af102c174a5301ba8235f55f2326ec017e019823bca7a19cd1a321baa5905c864e77e0ca25e44ca96ab46

Download Submit
C:\Windows\System\vrJsHxG.exe

Filesize
1.7MB

MD5
dfb60c31eb5677d2e6e07d3637360006

SHA1
a358192a1f8adcaf95763383798beaf4ae382574

SHA256
04618bde8ec3d1fdac9c3cd03be62f2b081cb05ddba04041512c147f8b045e04

SHA512
cbe964c67c393dd26e30c20f4886b72fe50cccb2ee1806abf8d2598e8e1c16cd2af2bce0761dc3f6157b3ec2920629bd4cecae071557c62a3cad92211813edc9

Download Submit
C:\Windows\System\vxXkFPK.exe

Filesize
1.7MB

MD5
ac9ebd5e5f4fbab9f07716a683090913

SHA1
3aeec824074d5bb08cc6492c97f0270e5f51cc66

SHA256
82a0bc8140b014d68c662f601ca5096c740c720897579e8e48668a11235c983a

SHA512
fb2f831b9a0ea0f4a770f5ac3af3371bada596e3017cada40c70e49be6000e4b9d4f5fc49f4265918731c44e68e9f75d15e7d9e261980f988d178e777753ddb4

Download Submit
memory/216-0-0x000002B4B9280000-0x000002B4B9290000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads