xmrig | 60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124

Analysis

max time kernel
92s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
Size

1.4MB
MD5

b859be5dd557feb58b38d70f20523a76
SHA1

c9b451994d717c189847624b84d11295ee749c56
SHA256

60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124
SHA512

8744c14daac236a4aa3b83323a0bd3356ee10365e8687d930e8d3e96723c58d7c62c29ee55d77419dbe00a785becc321a6bf13ec25df3c56ba3f6ae4f101c955
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPqZ650tTovQ8EXc:GezaTF8FcNkNdfE0pZ9ozttwIRRegkv5

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023c9b-6.dat	xmrig
behavioral2/files/0x0008000000023c97-7.dat	xmrig
behavioral2/files/0x0009000000023c94-10.dat	xmrig
behavioral2/files/0x0007000000023c9c-19.dat	xmrig
behavioral2/files/0x0007000000023c9d-24.dat	xmrig
behavioral2/files/0x0007000000023c9e-30.dat	xmrig
behavioral2/files/0x0007000000023c9f-34.dat	xmrig
behavioral2/files/0x0007000000023ca0-40.dat	xmrig
behavioral2/files/0x0007000000023ca1-45.dat	xmrig
behavioral2/files/0x0007000000023ca2-49.dat	xmrig
behavioral2/files/0x0008000000023c98-55.dat	xmrig
behavioral2/files/0x0007000000023ca4-59.dat	xmrig
behavioral2/files/0x0007000000023ca5-64.dat	xmrig
behavioral2/files/0x0007000000023ca7-70.dat	xmrig
behavioral2/files/0x0007000000023ca6-75.dat	xmrig
behavioral2/files/0x0007000000023ca8-78.dat	xmrig
behavioral2/files/0x0007000000023ca9-81.dat	xmrig
behavioral2/files/0x0007000000023caa-87.dat	xmrig
behavioral2/files/0x0007000000023cae-112.dat	xmrig
behavioral2/files/0x0007000000023cb1-121.dat	xmrig
behavioral2/files/0x0007000000023cb3-137.dat	xmrig
behavioral2/files/0x0007000000023cb9-161.dat	xmrig
behavioral2/files/0x0007000000023cb7-159.dat	xmrig
behavioral2/files/0x0007000000023cb8-156.dat	xmrig
behavioral2/files/0x0007000000023cb6-154.dat	xmrig
behavioral2/files/0x0007000000023cb5-149.dat	xmrig
behavioral2/files/0x0007000000023cb4-141.dat	xmrig
behavioral2/files/0x0007000000023cb2-131.dat	xmrig
behavioral2/files/0x0007000000023cb0-122.dat	xmrig
behavioral2/files/0x0007000000023caf-117.dat	xmrig
behavioral2/files/0x0007000000023cad-107.dat	xmrig
behavioral2/files/0x0007000000023cac-101.dat	xmrig
behavioral2/files/0x0007000000023cab-94.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3268	FNTTHpJ.exe
3688	tJfEPUf.exe
980	ZVbtmVL.exe
924	cgDLzcp.exe
1160	GeBURfu.exe
2292	OjexVQR.exe
4324	SnEnJpA.exe
2476	GuCdkMy.exe
1012	rEHGoeF.exe
1564	cgJvDSZ.exe
180	wbWKPPN.exe
4304	YZthmeV.exe
2140	pGHGaat.exe
1600	goJQXNQ.exe
1604	FxMLRFk.exe
2668	fZDuPUA.exe
3360	BYEUCjC.exe
3288	SOGOTEa.exe
2092	ghAePSL.exe
2756	LJRoLPt.exe
2260	gGYWiKe.exe
1476	QgCUjrY.exe
4228	vGMKEbg.exe
1500	rGdTtOv.exe
4948	wXBRGZq.exe
1784	XTfuvOg.exe
4152	IhbDoea.exe
2688	iwhfLTI.exe
1680	cWmAVZf.exe
1984	UCinFtK.exe
3276	pFPvcXC.exe
648	pOpBNFX.exe
3684	TUHYEFx.exe
2672	AyiTKbe.exe
2472	gbjPmfT.exe
2512	kwUbnkl.exe
1504	QTveslt.exe
1180	eKvllfn.exe
2288	assPZGz.exe
408	zYjrXmd.exe
2604	fNufVGq.exe
3412	jrBLive.exe
4660	PwmMrdZ.exe
3256	vULVjaF.exe
2188	eaMIQIj.exe
4696	CnVmfCr.exe
4016	yNEBjdy.exe
2976	dvdhKzl.exe
1824	YGEnLYq.exe
2536	lgpTWHb.exe
520	TCOLTAZ.exe
932	VhzqTmi.exe
4396	RaevMlK.exe
4320	wOrannj.exe
3480	gQcLhzI.exe
4420	bFqDCrg.exe
728	ArKwJHG.exe
3936	MnvksrR.exe
556	BAbAqfz.exe
4200	HHKMFEz.exe
3704	ZjQMFvf.exe
1964	raZCQyW.exe
1076	eYDsNzF.exe
4768	GKTTqQx.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cVgpWiD.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\sFTNTtq.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\iNiVkQN.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\UVoLGHc.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\lBwpmsW.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\CJwIGAe.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\xRDKGsm.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\NNiMxeF.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\cCmnZgu.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\pOpBNFX.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\dYNfLuT.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\DQxucVE.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\FtHKOiu.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\FFBnUdy.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\UwjvSqd.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\uXJfxJK.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\KIuLVjX.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\dEnvKyj.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\KbMwaVm.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\KNmvTRz.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\UuMENXZ.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\xOaCJRa.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\xfyKCCY.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\assPZGz.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\aVSGDdp.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\uDXCvBI.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\yrvFCSp.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\hhUTXWT.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\UCinFtK.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\nuFQmMy.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\vuVsdZU.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\pbxHsah.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\OgeBJbQ.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\AmkmKvI.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\sFIPIGN.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\BApLZFG.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\cAMaMbm.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\DjjhkMa.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\QRRANcL.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\UonCalJ.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\TzufvMB.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\KuOAtJm.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\DpBqBuT.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\DaqDueY.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\oxzVdUJ.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\cbKbgCi.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\JwGBaxR.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\wbWKPPN.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\kwUbnkl.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\EvpGTjX.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\TxfGfEJ.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\EmVpEqC.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\vuDjZZa.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\iwhfLTI.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\XzknKeT.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\TUHYEFx.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\GKTTqQx.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\zLBpqLV.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\UBFwnYP.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\NWsRMjR.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\movgTAa.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\rehoYNy.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\vQIbtcJ.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
File created	C:\Windows\System\IdoEHzZ.exe	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3268	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	83
PID 3000 wrote to memory of 3268	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	83
PID 3000 wrote to memory of 3688	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	84
PID 3000 wrote to memory of 3688	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	84
PID 3000 wrote to memory of 980	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	85
PID 3000 wrote to memory of 980	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	85
PID 3000 wrote to memory of 924	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	86
PID 3000 wrote to memory of 924	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	86
PID 3000 wrote to memory of 1160	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	87
PID 3000 wrote to memory of 1160	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	87
PID 3000 wrote to memory of 2292	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	88
PID 3000 wrote to memory of 2292	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	88
PID 3000 wrote to memory of 4324	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	89
PID 3000 wrote to memory of 4324	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	89
PID 3000 wrote to memory of 2476	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	90
PID 3000 wrote to memory of 2476	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	90
PID 3000 wrote to memory of 1012	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	91
PID 3000 wrote to memory of 1012	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	91
PID 3000 wrote to memory of 1564	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	92
PID 3000 wrote to memory of 1564	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	92
PID 3000 wrote to memory of 180	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	93
PID 3000 wrote to memory of 180	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	93
PID 3000 wrote to memory of 4304	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	94
PID 3000 wrote to memory of 4304	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	94
PID 3000 wrote to memory of 2140	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	95
PID 3000 wrote to memory of 2140	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	95
PID 3000 wrote to memory of 1600	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	96
PID 3000 wrote to memory of 1600	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	96
PID 3000 wrote to memory of 1604	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	97
PID 3000 wrote to memory of 1604	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	97
PID 3000 wrote to memory of 2668	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	98
PID 3000 wrote to memory of 2668	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	98
PID 3000 wrote to memory of 3360	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	99
PID 3000 wrote to memory of 3360	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	99
PID 3000 wrote to memory of 3288	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	100
PID 3000 wrote to memory of 3288	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	100
PID 3000 wrote to memory of 2092	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	101
PID 3000 wrote to memory of 2092	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	101
PID 3000 wrote to memory of 2756	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	102
PID 3000 wrote to memory of 2756	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	102
PID 3000 wrote to memory of 2260	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	103
PID 3000 wrote to memory of 2260	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	103
PID 3000 wrote to memory of 1476	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	104
PID 3000 wrote to memory of 1476	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	104
PID 3000 wrote to memory of 4228	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	105
PID 3000 wrote to memory of 4228	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	105
PID 3000 wrote to memory of 1500	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	106
PID 3000 wrote to memory of 1500	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	106
PID 3000 wrote to memory of 4948	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	107
PID 3000 wrote to memory of 4948	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	107
PID 3000 wrote to memory of 1784	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	108
PID 3000 wrote to memory of 1784	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	108
PID 3000 wrote to memory of 4152	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	109
PID 3000 wrote to memory of 4152	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	109
PID 3000 wrote to memory of 2688	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	110
PID 3000 wrote to memory of 2688	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	110
PID 3000 wrote to memory of 1680	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	111
PID 3000 wrote to memory of 1680	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	111
PID 3000 wrote to memory of 1984	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	112
PID 3000 wrote to memory of 1984	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	112
PID 3000 wrote to memory of 3276	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	113
PID 3000 wrote to memory of 3276	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	113
PID 3000 wrote to memory of 648	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	114
PID 3000 wrote to memory of 648	3000	60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe	114

C:\Users\Admin\AppData\Local\Temp\60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe
"C:\Users\Admin\AppData\Local\Temp\60bdf40def005b2deb8f96aa13947de4cb2890f2c2fe102c7d1d41dbdebe6124.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\System\FNTTHpJ.exe
  C:\Windows\System\FNTTHpJ.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\tJfEPUf.exe
  C:\Windows\System\tJfEPUf.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\ZVbtmVL.exe
  C:\Windows\System\ZVbtmVL.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\cgDLzcp.exe
  C:\Windows\System\cgDLzcp.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\GeBURfu.exe
  C:\Windows\System\GeBURfu.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\OjexVQR.exe
  C:\Windows\System\OjexVQR.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\SnEnJpA.exe
  C:\Windows\System\SnEnJpA.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\GuCdkMy.exe
  C:\Windows\System\GuCdkMy.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\rEHGoeF.exe
  C:\Windows\System\rEHGoeF.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\cgJvDSZ.exe
  C:\Windows\System\cgJvDSZ.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\wbWKPPN.exe
  C:\Windows\System\wbWKPPN.exe
  2⤵
  - Executes dropped EXE
  PID:180
- C:\Windows\System\YZthmeV.exe
  C:\Windows\System\YZthmeV.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\pGHGaat.exe
  C:\Windows\System\pGHGaat.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\goJQXNQ.exe
  C:\Windows\System\goJQXNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\FxMLRFk.exe
  C:\Windows\System\FxMLRFk.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\fZDuPUA.exe
  C:\Windows\System\fZDuPUA.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\BYEUCjC.exe
  C:\Windows\System\BYEUCjC.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\SOGOTEa.exe
  C:\Windows\System\SOGOTEa.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\ghAePSL.exe
  C:\Windows\System\ghAePSL.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\LJRoLPt.exe
  C:\Windows\System\LJRoLPt.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\gGYWiKe.exe
  C:\Windows\System\gGYWiKe.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\QgCUjrY.exe
  C:\Windows\System\QgCUjrY.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\vGMKEbg.exe
  C:\Windows\System\vGMKEbg.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\rGdTtOv.exe
  C:\Windows\System\rGdTtOv.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\wXBRGZq.exe
  C:\Windows\System\wXBRGZq.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\XTfuvOg.exe
  C:\Windows\System\XTfuvOg.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\IhbDoea.exe
  C:\Windows\System\IhbDoea.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\iwhfLTI.exe
  C:\Windows\System\iwhfLTI.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\cWmAVZf.exe
  C:\Windows\System\cWmAVZf.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\UCinFtK.exe
  C:\Windows\System\UCinFtK.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\pFPvcXC.exe
  C:\Windows\System\pFPvcXC.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\pOpBNFX.exe
  C:\Windows\System\pOpBNFX.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\TUHYEFx.exe
  C:\Windows\System\TUHYEFx.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\AyiTKbe.exe
  C:\Windows\System\AyiTKbe.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\gbjPmfT.exe
  C:\Windows\System\gbjPmfT.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\kwUbnkl.exe
  C:\Windows\System\kwUbnkl.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\QTveslt.exe
  C:\Windows\System\QTveslt.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\eKvllfn.exe
  C:\Windows\System\eKvllfn.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\assPZGz.exe
  C:\Windows\System\assPZGz.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\zYjrXmd.exe
  C:\Windows\System\zYjrXmd.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\fNufVGq.exe
  C:\Windows\System\fNufVGq.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\jrBLive.exe
  C:\Windows\System\jrBLive.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\PwmMrdZ.exe
  C:\Windows\System\PwmMrdZ.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\vULVjaF.exe
  C:\Windows\System\vULVjaF.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\eaMIQIj.exe
  C:\Windows\System\eaMIQIj.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\CnVmfCr.exe
  C:\Windows\System\CnVmfCr.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\yNEBjdy.exe
  C:\Windows\System\yNEBjdy.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\dvdhKzl.exe
  C:\Windows\System\dvdhKzl.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\YGEnLYq.exe
  C:\Windows\System\YGEnLYq.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\lgpTWHb.exe
  C:\Windows\System\lgpTWHb.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\TCOLTAZ.exe
  C:\Windows\System\TCOLTAZ.exe
  2⤵
  - Executes dropped EXE
  PID:520
- C:\Windows\System\VhzqTmi.exe
  C:\Windows\System\VhzqTmi.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\RaevMlK.exe
  C:\Windows\System\RaevMlK.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\wOrannj.exe
  C:\Windows\System\wOrannj.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\gQcLhzI.exe
  C:\Windows\System\gQcLhzI.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\bFqDCrg.exe
  C:\Windows\System\bFqDCrg.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\ArKwJHG.exe
  C:\Windows\System\ArKwJHG.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\MnvksrR.exe
  C:\Windows\System\MnvksrR.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\BAbAqfz.exe
  C:\Windows\System\BAbAqfz.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\HHKMFEz.exe
  C:\Windows\System\HHKMFEz.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\ZjQMFvf.exe
  C:\Windows\System\ZjQMFvf.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\raZCQyW.exe
  C:\Windows\System\raZCQyW.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\eYDsNzF.exe
  C:\Windows\System\eYDsNzF.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\GKTTqQx.exe
  C:\Windows\System\GKTTqQx.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\sGDZtvr.exe
  C:\Windows\System\sGDZtvr.exe
  2⤵
  PID:1652
- C:\Windows\System\QPMOBua.exe
  C:\Windows\System\QPMOBua.exe
  2⤵
  PID:4876
- C:\Windows\System\ChOWRoT.exe
  C:\Windows\System\ChOWRoT.exe
  2⤵
  PID:4216
- C:\Windows\System\iHBPDoD.exe
  C:\Windows\System\iHBPDoD.exe
  2⤵
  PID:1208
- C:\Windows\System\paLjVOc.exe
  C:\Windows\System\paLjVOc.exe
  2⤵
  PID:4996
- C:\Windows\System\IARilaN.exe
  C:\Windows\System\IARilaN.exe
  2⤵
  PID:4196
- C:\Windows\System\nCWTpcM.exe
  C:\Windows\System\nCWTpcM.exe
  2⤵
  PID:4220
- C:\Windows\System\KrTrpST.exe
  C:\Windows\System\KrTrpST.exe
  2⤵
  PID:1008
- C:\Windows\System\vCuBvbL.exe
  C:\Windows\System\vCuBvbL.exe
  2⤵
  PID:3708
- C:\Windows\System\LpxIFRc.exe
  C:\Windows\System\LpxIFRc.exe
  2⤵
  PID:976
- C:\Windows\System\hkolNdk.exe
  C:\Windows\System\hkolNdk.exe
  2⤵
  PID:3744
- C:\Windows\System\LCBDSHy.exe
  C:\Windows\System\LCBDSHy.exe
  2⤵
  PID:3516
- C:\Windows\System\XWjLcrO.exe
  C:\Windows\System\XWjLcrO.exe
  2⤵
  PID:4052
- C:\Windows\System\WydyTkG.exe
  C:\Windows\System\WydyTkG.exe
  2⤵
  PID:2524
- C:\Windows\System\aVSGDdp.exe
  C:\Windows\System\aVSGDdp.exe
  2⤵
  PID:1688
- C:\Windows\System\JwlxZzw.exe
  C:\Windows\System\JwlxZzw.exe
  2⤵
  PID:4380
- C:\Windows\System\vpGfiuP.exe
  C:\Windows\System\vpGfiuP.exe
  2⤵
  PID:3396
- C:\Windows\System\KIuLVjX.exe
  C:\Windows\System\KIuLVjX.exe
  2⤵
  PID:1640
- C:\Windows\System\EvpGTjX.exe
  C:\Windows\System\EvpGTjX.exe
  2⤵
  PID:892
- C:\Windows\System\eiyXyCQ.exe
  C:\Windows\System\eiyXyCQ.exe
  2⤵
  PID:4292
- C:\Windows\System\fOFxJdB.exe
  C:\Windows\System\fOFxJdB.exe
  2⤵
  PID:3672
- C:\Windows\System\cpKikwj.exe
  C:\Windows\System\cpKikwj.exe
  2⤵
  PID:844
- C:\Windows\System\IdoEHzZ.exe
  C:\Windows\System\IdoEHzZ.exe
  2⤵
  PID:4716
- C:\Windows\System\YHZrytm.exe
  C:\Windows\System\YHZrytm.exe
  2⤵
  PID:1436
- C:\Windows\System\kdGqwoM.exe
  C:\Windows\System\kdGqwoM.exe
  2⤵
  PID:1488
- C:\Windows\System\UJEhqyH.exe
  C:\Windows\System\UJEhqyH.exe
  2⤵
  PID:2348
- C:\Windows\System\jPKNfVh.exe
  C:\Windows\System\jPKNfVh.exe
  2⤵
  PID:4212
- C:\Windows\System\gOXvJVi.exe
  C:\Windows\System\gOXvJVi.exe
  2⤵
  PID:2132
- C:\Windows\System\IemGCrz.exe
  C:\Windows\System\IemGCrz.exe
  2⤵
  PID:4728
- C:\Windows\System\SfUDeRt.exe
  C:\Windows\System\SfUDeRt.exe
  2⤵
  PID:4632
- C:\Windows\System\cZXgPSL.exe
  C:\Windows\System\cZXgPSL.exe
  2⤵
  PID:552
- C:\Windows\System\roeJKTT.exe
  C:\Windows\System\roeJKTT.exe
  2⤵
  PID:1408
- C:\Windows\System\uDXCvBI.exe
  C:\Windows\System\uDXCvBI.exe
  2⤵
  PID:4312
- C:\Windows\System\fTorTwW.exe
  C:\Windows\System\fTorTwW.exe
  2⤵
  PID:5148
- C:\Windows\System\RCzhKtc.exe
  C:\Windows\System\RCzhKtc.exe
  2⤵
  PID:5188
- C:\Windows\System\ikWDADQ.exe
  C:\Windows\System\ikWDADQ.exe
  2⤵
  PID:5216
- C:\Windows\System\WMRDPWr.exe
  C:\Windows\System\WMRDPWr.exe
  2⤵
  PID:5244
- C:\Windows\System\TBSqiPF.exe
  C:\Windows\System\TBSqiPF.exe
  2⤵
  PID:5276
- C:\Windows\System\NhARsNn.exe
  C:\Windows\System\NhARsNn.exe
  2⤵
  PID:5316
- C:\Windows\System\XrBaNbo.exe
  C:\Windows\System\XrBaNbo.exe
  2⤵
  PID:5344
- C:\Windows\System\NnjQjwr.exe
  C:\Windows\System\NnjQjwr.exe
  2⤵
  PID:5360
- C:\Windows\System\gcoSUbF.exe
  C:\Windows\System\gcoSUbF.exe
  2⤵
  PID:5392
- C:\Windows\System\WZnagop.exe
  C:\Windows\System\WZnagop.exe
  2⤵
  PID:5420
- C:\Windows\System\HhRJZzB.exe
  C:\Windows\System\HhRJZzB.exe
  2⤵
  PID:5452
- C:\Windows\System\xomazxb.exe
  C:\Windows\System\xomazxb.exe
  2⤵
  PID:5472
- C:\Windows\System\VIfmlhx.exe
  C:\Windows\System\VIfmlhx.exe
  2⤵
  PID:5500
- C:\Windows\System\GXWkqTN.exe
  C:\Windows\System\GXWkqTN.exe
  2⤵
  PID:5524
- C:\Windows\System\SOmPAEs.exe
  C:\Windows\System\SOmPAEs.exe
  2⤵
  PID:5560
- C:\Windows\System\tANNwVt.exe
  C:\Windows\System\tANNwVt.exe
  2⤵
  PID:5588
- C:\Windows\System\JpvZiwV.exe
  C:\Windows\System\JpvZiwV.exe
  2⤵
  PID:5616
- C:\Windows\System\UTwzVET.exe
  C:\Windows\System\UTwzVET.exe
  2⤵
  PID:5652
- C:\Windows\System\LnUZYTH.exe
  C:\Windows\System\LnUZYTH.exe
  2⤵
  PID:5680
- C:\Windows\System\PqCFqCh.exe
  C:\Windows\System\PqCFqCh.exe
  2⤵
  PID:5708
- C:\Windows\System\AJLwBaw.exe
  C:\Windows\System\AJLwBaw.exe
  2⤵
  PID:5736
- C:\Windows\System\HuGvqss.exe
  C:\Windows\System\HuGvqss.exe
  2⤵
  PID:5760
- C:\Windows\System\xcXfFqx.exe
  C:\Windows\System\xcXfFqx.exe
  2⤵
  PID:5804
- C:\Windows\System\hJpHBaf.exe
  C:\Windows\System\hJpHBaf.exe
  2⤵
  PID:5824
- C:\Windows\System\LFXuKpo.exe
  C:\Windows\System\LFXuKpo.exe
  2⤵
  PID:5840
- C:\Windows\System\SmkhMHq.exe
  C:\Windows\System\SmkhMHq.exe
  2⤵
  PID:5856
- C:\Windows\System\XsSOueo.exe
  C:\Windows\System\XsSOueo.exe
  2⤵
  PID:5876
- C:\Windows\System\JChXQYt.exe
  C:\Windows\System\JChXQYt.exe
  2⤵
  PID:5908
- C:\Windows\System\pbxHsah.exe
  C:\Windows\System\pbxHsah.exe
  2⤵
  PID:5964
- C:\Windows\System\pBPwNJM.exe
  C:\Windows\System\pBPwNJM.exe
  2⤵
  PID:5988
- C:\Windows\System\TxfGfEJ.exe
  C:\Windows\System\TxfGfEJ.exe
  2⤵
  PID:6020
- C:\Windows\System\GvwbtOv.exe
  C:\Windows\System\GvwbtOv.exe
  2⤵
  PID:6036
- C:\Windows\System\fanfPSY.exe
  C:\Windows\System\fanfPSY.exe
  2⤵
  PID:6064
- C:\Windows\System\kWLsSGD.exe
  C:\Windows\System\kWLsSGD.exe
  2⤵
  PID:6096
- C:\Windows\System\LhnWppg.exe
  C:\Windows\System\LhnWppg.exe
  2⤵
  PID:6132
- C:\Windows\System\GswPXBu.exe
  C:\Windows\System\GswPXBu.exe
  2⤵
  PID:4548
- C:\Windows\System\gYIfPzf.exe
  C:\Windows\System\gYIfPzf.exe
  2⤵
  PID:4572
- C:\Windows\System\YiFHCbz.exe
  C:\Windows\System\YiFHCbz.exe
  2⤵
  PID:5128
- C:\Windows\System\XoDfqPg.exe
  C:\Windows\System\XoDfqPg.exe
  2⤵
  PID:3196
- C:\Windows\System\WjckAhe.exe
  C:\Windows\System\WjckAhe.exe
  2⤵
  PID:4776
- C:\Windows\System\THremCQ.exe
  C:\Windows\System\THremCQ.exe
  2⤵
  PID:4080
- C:\Windows\System\DNcOlVp.exe
  C:\Windows\System\DNcOlVp.exe
  2⤵
  PID:2496
- C:\Windows\System\oeAJYNh.exe
  C:\Windows\System\oeAJYNh.exe
  2⤵
  PID:5172
- C:\Windows\System\XyOdNLE.exe
  C:\Windows\System\XyOdNLE.exe
  2⤵
  PID:3032
- C:\Windows\System\yttusrX.exe
  C:\Windows\System\yttusrX.exe
  2⤵
  PID:4820
- C:\Windows\System\KtZdLJt.exe
  C:\Windows\System\KtZdLJt.exe
  2⤵
  PID:3892
- C:\Windows\System\YYqGHtr.exe
  C:\Windows\System\YYqGHtr.exe
  2⤵
  PID:3944
- C:\Windows\System\ocnJABz.exe
  C:\Windows\System\ocnJABz.exe
  2⤵
  PID:4460
- C:\Windows\System\rTMVXEX.exe
  C:\Windows\System\rTMVXEX.exe
  2⤵
  PID:5332
- C:\Windows\System\ZTsgnHD.exe
  C:\Windows\System\ZTsgnHD.exe
  2⤵
  PID:5352
- C:\Windows\System\ESbljNS.exe
  C:\Windows\System\ESbljNS.exe
  2⤵
  PID:5464
- C:\Windows\System\AmkmKvI.exe
  C:\Windows\System\AmkmKvI.exe
  2⤵
  PID:5488
- C:\Windows\System\DNqMnqR.exe
  C:\Windows\System\DNqMnqR.exe
  2⤵
  PID:5548
- C:\Windows\System\sGBmWAf.exe
  C:\Windows\System\sGBmWAf.exe
  2⤵
  PID:5604
- C:\Windows\System\zcEoyOV.exe
  C:\Windows\System\zcEoyOV.exe
  2⤵
  PID:5648
- C:\Windows\System\DaqDueY.exe
  C:\Windows\System\DaqDueY.exe
  2⤵
  PID:5728
- C:\Windows\System\GATJcOp.exe
  C:\Windows\System\GATJcOp.exe
  2⤵
  PID:1364
- C:\Windows\System\HhvNkzI.exe
  C:\Windows\System\HhvNkzI.exe
  2⤵
  PID:5836
- C:\Windows\System\WSxPFwp.exe
  C:\Windows\System\WSxPFwp.exe
  2⤵
  PID:5872
- C:\Windows\System\YbICrXy.exe
  C:\Windows\System\YbICrXy.exe
  2⤵
  PID:5944
- C:\Windows\System\GcCuZGe.exe
  C:\Windows\System\GcCuZGe.exe
  2⤵
  PID:6008
- C:\Windows\System\rQykcPa.exe
  C:\Windows\System\rQykcPa.exe
  2⤵
  PID:6080
- C:\Windows\System\DfJuOgj.exe
  C:\Windows\System\DfJuOgj.exe
  2⤵
  PID:1448
- C:\Windows\System\sFIPIGN.exe
  C:\Windows\System\sFIPIGN.exe
  2⤵
  PID:1572
- C:\Windows\System\kscMqwf.exe
  C:\Windows\System\kscMqwf.exe
  2⤵
  PID:5124
- C:\Windows\System\XFCgZuu.exe
  C:\Windows\System\XFCgZuu.exe
  2⤵
  PID:3712
- C:\Windows\System\WooamnJ.exe
  C:\Windows\System\WooamnJ.exe
  2⤵
  PID:5184
- C:\Windows\System\JdpPVKp.exe
  C:\Windows\System\JdpPVKp.exe
  2⤵
  PID:1116
- C:\Windows\System\TGpPYbg.exe
  C:\Windows\System\TGpPYbg.exe
  2⤵
  PID:5268
- C:\Windows\System\XJEjfUI.exe
  C:\Windows\System\XJEjfUI.exe
  2⤵
  PID:2004
- C:\Windows\System\xnBynAv.exe
  C:\Windows\System\xnBynAv.exe
  2⤵
  PID:4384
- C:\Windows\System\yrvFCSp.exe
  C:\Windows\System\yrvFCSp.exe
  2⤵
  PID:5356
- C:\Windows\System\SyGjhas.exe
  C:\Windows\System\SyGjhas.exe
  2⤵
  PID:5512
- C:\Windows\System\qbHmUdZ.exe
  C:\Windows\System\qbHmUdZ.exe
  2⤵
  PID:5632
- C:\Windows\System\fYjRxpz.exe
  C:\Windows\System\fYjRxpz.exe
  2⤵
  PID:5796
- C:\Windows\System\tDBtqge.exe
  C:\Windows\System\tDBtqge.exe
  2⤵
  PID:1684
- C:\Windows\System\vbVQAxY.exe
  C:\Windows\System\vbVQAxY.exe
  2⤵
  PID:5952
- C:\Windows\System\FftPGFm.exe
  C:\Windows\System\FftPGFm.exe
  2⤵
  PID:6052
- C:\Windows\System\gudGpeo.exe
  C:\Windows\System\gudGpeo.exe
  2⤵
  PID:2328
- C:\Windows\System\CxHcGCN.exe
  C:\Windows\System\CxHcGCN.exe
  2⤵
  PID:5312
- C:\Windows\System\jarvVZw.exe
  C:\Windows\System\jarvVZw.exe
  2⤵
  PID:5996
- C:\Windows\System\RMQmSkl.exe
  C:\Windows\System\RMQmSkl.exe
  2⤵
  PID:5704
- C:\Windows\System\NEFPhca.exe
  C:\Windows\System\NEFPhca.exe
  2⤵
  PID:6152
- C:\Windows\System\uitBnJI.exe
  C:\Windows\System\uitBnJI.exe
  2⤵
  PID:6220
- C:\Windows\System\eaLlMTi.exe
  C:\Windows\System\eaLlMTi.exe
  2⤵
  PID:6256
- C:\Windows\System\dnsubsq.exe
  C:\Windows\System\dnsubsq.exe
  2⤵
  PID:6292
- C:\Windows\System\FgjRCGe.exe
  C:\Windows\System\FgjRCGe.exe
  2⤵
  PID:6312
- C:\Windows\System\OOPdDFf.exe
  C:\Windows\System\OOPdDFf.exe
  2⤵
  PID:6340
- C:\Windows\System\gkpVQxG.exe
  C:\Windows\System\gkpVQxG.exe
  2⤵
  PID:6360
- C:\Windows\System\JRUTVmB.exe
  C:\Windows\System\JRUTVmB.exe
  2⤵
  PID:6388
- C:\Windows\System\foBwRJa.exe
  C:\Windows\System\foBwRJa.exe
  2⤵
  PID:6416
- C:\Windows\System\GZoXLce.exe
  C:\Windows\System\GZoXLce.exe
  2⤵
  PID:6444
- C:\Windows\System\bfSfSDh.exe
  C:\Windows\System\bfSfSDh.exe
  2⤵
  PID:6480
- C:\Windows\System\zSujjwI.exe
  C:\Windows\System\zSujjwI.exe
  2⤵
  PID:6500
- C:\Windows\System\xkAmSjS.exe
  C:\Windows\System\xkAmSjS.exe
  2⤵
  PID:6528
- C:\Windows\System\rBooSaN.exe
  C:\Windows\System\rBooSaN.exe
  2⤵
  PID:6556
- C:\Windows\System\slwhghn.exe
  C:\Windows\System\slwhghn.exe
  2⤵
  PID:6584
- C:\Windows\System\jcLIPWz.exe
  C:\Windows\System\jcLIPWz.exe
  2⤵
  PID:6620
- C:\Windows\System\bVBRDXK.exe
  C:\Windows\System\bVBRDXK.exe
  2⤵
  PID:6660
- C:\Windows\System\LFvuVBE.exe
  C:\Windows\System\LFvuVBE.exe
  2⤵
  PID:6692
- C:\Windows\System\APLHFCX.exe
  C:\Windows\System\APLHFCX.exe
  2⤵
  PID:6720
- C:\Windows\System\HCjiwwv.exe
  C:\Windows\System\HCjiwwv.exe
  2⤵
  PID:6740
- C:\Windows\System\KrAUtGd.exe
  C:\Windows\System\KrAUtGd.exe
  2⤵
  PID:6756
- C:\Windows\System\cCzOpHU.exe
  C:\Windows\System\cCzOpHU.exe
  2⤵
  PID:6772
- C:\Windows\System\UNIdzSD.exe
  C:\Windows\System\UNIdzSD.exe
  2⤵
  PID:6808
- C:\Windows\System\NbvBdAJ.exe
  C:\Windows\System\NbvBdAJ.exe
  2⤵
  PID:6848
- C:\Windows\System\FQIrmHb.exe
  C:\Windows\System\FQIrmHb.exe
  2⤵
  PID:6888
- C:\Windows\System\DMrVhJR.exe
  C:\Windows\System\DMrVhJR.exe
  2⤵
  PID:6908
- C:\Windows\System\ukGHREu.exe
  C:\Windows\System\ukGHREu.exe
  2⤵
  PID:6936
- C:\Windows\System\AfzIPaz.exe
  C:\Windows\System\AfzIPaz.exe
  2⤵
  PID:6968
- C:\Windows\System\dUcwLJO.exe
  C:\Windows\System\dUcwLJO.exe
  2⤵
  PID:6992
- C:\Windows\System\ofYAugh.exe
  C:\Windows\System\ofYAugh.exe
  2⤵
  PID:7020
- C:\Windows\System\xbhkXDs.exe
  C:\Windows\System\xbhkXDs.exe
  2⤵
  PID:7044
- C:\Windows\System\Lmxndmu.exe
  C:\Windows\System\Lmxndmu.exe
  2⤵
  PID:7068
- C:\Windows\System\BApLZFG.exe
  C:\Windows\System\BApLZFG.exe
  2⤵
  PID:7116
- C:\Windows\System\izFhvvL.exe
  C:\Windows\System\izFhvvL.exe
  2⤵
  PID:7156
- C:\Windows\System\ifOVzNp.exe
  C:\Windows\System\ifOVzNp.exe
  2⤵
  PID:1372
- C:\Windows\System\oqpvGtg.exe
  C:\Windows\System\oqpvGtg.exe
  2⤵
  PID:5400
- C:\Windows\System\vvBHxmw.exe
  C:\Windows\System\vvBHxmw.exe
  2⤵
  PID:6240
- C:\Windows\System\ymHnyCr.exe
  C:\Windows\System\ymHnyCr.exe
  2⤵
  PID:6208
- C:\Windows\System\dXwoBTH.exe
  C:\Windows\System\dXwoBTH.exe
  2⤵
  PID:6372
- C:\Windows\System\MMyOtjQ.exe
  C:\Windows\System\MMyOtjQ.exe
  2⤵
  PID:6368
- C:\Windows\System\GSPqqPD.exe
  C:\Windows\System\GSPqqPD.exe
  2⤵
  PID:6492
- C:\Windows\System\KssLrKF.exe
  C:\Windows\System\KssLrKF.exe
  2⤵
  PID:6516
- C:\Windows\System\yrAMxPN.exe
  C:\Windows\System\yrAMxPN.exe
  2⤵
  PID:6652
- C:\Windows\System\oWaPKUA.exe
  C:\Windows\System\oWaPKUA.exe
  2⤵
  PID:6612
- C:\Windows\System\LbSFVYs.exe
  C:\Windows\System\LbSFVYs.exe
  2⤵
  PID:6704
- C:\Windows\System\wZcglIY.exe
  C:\Windows\System\wZcglIY.exe
  2⤵
  PID:6792
- C:\Windows\System\hKSDwyk.exe
  C:\Windows\System\hKSDwyk.exe
  2⤵
  PID:6856
- C:\Windows\System\zJqIwmI.exe
  C:\Windows\System\zJqIwmI.exe
  2⤵
  PID:6952
- C:\Windows\System\mpyJlDx.exe
  C:\Windows\System\mpyJlDx.exe
  2⤵
  PID:7008
- C:\Windows\System\JsekbMr.exe
  C:\Windows\System\JsekbMr.exe
  2⤵
  PID:7004
- C:\Windows\System\iDITXch.exe
  C:\Windows\System\iDITXch.exe
  2⤵
  PID:7092
- C:\Windows\System\ccxAAZb.exe
  C:\Windows\System\ccxAAZb.exe
  2⤵
  PID:7144
- C:\Windows\System\AHMhsOb.exe
  C:\Windows\System\AHMhsOb.exe
  2⤵
  PID:6148
- C:\Windows\System\mJspSky.exe
  C:\Windows\System\mJspSky.exe
  2⤵
  PID:6400
- C:\Windows\System\OgeBJbQ.exe
  C:\Windows\System\OgeBJbQ.exe
  2⤵
  PID:6412
- C:\Windows\System\opoMYNN.exe
  C:\Windows\System\opoMYNN.exe
  2⤵
  PID:6576
- C:\Windows\System\JOZMiLU.exe
  C:\Windows\System\JOZMiLU.exe
  2⤵
  PID:6632
- C:\Windows\System\SbjuTCV.exe
  C:\Windows\System\SbjuTCV.exe
  2⤵
  PID:6764
- C:\Windows\System\IMLPkii.exe
  C:\Windows\System\IMLPkii.exe
  2⤵
  PID:7084
- C:\Windows\System\ILkOPcl.exe
  C:\Windows\System\ILkOPcl.exe
  2⤵
  PID:6684
- C:\Windows\System\LLXzFcX.exe
  C:\Windows\System\LLXzFcX.exe
  2⤵
  PID:6960
- C:\Windows\System\BtwJYwM.exe
  C:\Windows\System\BtwJYwM.exe
  2⤵
  PID:6356
- C:\Windows\System\hEQUTkP.exe
  C:\Windows\System\hEQUTkP.exe
  2⤵
  PID:6572
- C:\Windows\System\wuCyKmv.exe
  C:\Windows\System\wuCyKmv.exe
  2⤵
  PID:7184
- C:\Windows\System\mQuhfWP.exe
  C:\Windows\System\mQuhfWP.exe
  2⤵
  PID:7224
- C:\Windows\System\XQJqPjg.exe
  C:\Windows\System\XQJqPjg.exe
  2⤵
  PID:7240
- C:\Windows\System\wpTqcwz.exe
  C:\Windows\System\wpTqcwz.exe
  2⤵
  PID:7268
- C:\Windows\System\aWPBCSO.exe
  C:\Windows\System\aWPBCSO.exe
  2⤵
  PID:7304
- C:\Windows\System\tcNdPqr.exe
  C:\Windows\System\tcNdPqr.exe
  2⤵
  PID:7324
- C:\Windows\System\qdOXpdU.exe
  C:\Windows\System\qdOXpdU.exe
  2⤵
  PID:7344
- C:\Windows\System\KEZqdkN.exe
  C:\Windows\System\KEZqdkN.exe
  2⤵
  PID:7372
- C:\Windows\System\sUjvdgI.exe
  C:\Windows\System\sUjvdgI.exe
  2⤵
  PID:7400
- C:\Windows\System\xDiesBH.exe
  C:\Windows\System\xDiesBH.exe
  2⤵
  PID:7428
- C:\Windows\System\UZxqIGQ.exe
  C:\Windows\System\UZxqIGQ.exe
  2⤵
  PID:7452
- C:\Windows\System\UNWMolP.exe
  C:\Windows\System\UNWMolP.exe
  2⤵
  PID:7468
- C:\Windows\System\EdWftTi.exe
  C:\Windows\System\EdWftTi.exe
  2⤵
  PID:7496
- C:\Windows\System\cIUXNcq.exe
  C:\Windows\System\cIUXNcq.exe
  2⤵
  PID:7528
- C:\Windows\System\EmVpEqC.exe
  C:\Windows\System\EmVpEqC.exe
  2⤵
  PID:7568
- C:\Windows\System\ilXFwzK.exe
  C:\Windows\System\ilXFwzK.exe
  2⤵
  PID:7592
- C:\Windows\System\PWkxHlX.exe
  C:\Windows\System\PWkxHlX.exe
  2⤵
  PID:7644
- C:\Windows\System\TUUULxG.exe
  C:\Windows\System\TUUULxG.exe
  2⤵
  PID:7660
- C:\Windows\System\CcYJGxy.exe
  C:\Windows\System\CcYJGxy.exe
  2⤵
  PID:7688
- C:\Windows\System\upCLxly.exe
  C:\Windows\System\upCLxly.exe
  2⤵
  PID:7716
- C:\Windows\System\eMBlngp.exe
  C:\Windows\System\eMBlngp.exe
  2⤵
  PID:7740
- C:\Windows\System\ZNkzMoD.exe
  C:\Windows\System\ZNkzMoD.exe
  2⤵
  PID:7772
- C:\Windows\System\WAqgMms.exe
  C:\Windows\System\WAqgMms.exe
  2⤵
  PID:7812
- C:\Windows\System\igjHSNP.exe
  C:\Windows\System\igjHSNP.exe
  2⤵
  PID:7840
- C:\Windows\System\xSAeIZd.exe
  C:\Windows\System\xSAeIZd.exe
  2⤵
  PID:7868
- C:\Windows\System\qFwkmBO.exe
  C:\Windows\System\qFwkmBO.exe
  2⤵
  PID:7896
- C:\Windows\System\BByXoqz.exe
  C:\Windows\System\BByXoqz.exe
  2⤵
  PID:7924
- C:\Windows\System\FBqTYEr.exe
  C:\Windows\System\FBqTYEr.exe
  2⤵
  PID:7940
- C:\Windows\System\WTOaZMz.exe
  C:\Windows\System\WTOaZMz.exe
  2⤵
  PID:7968
- C:\Windows\System\eFZETfi.exe
  C:\Windows\System\eFZETfi.exe
  2⤵
  PID:7992
- C:\Windows\System\nEylVcJ.exe
  C:\Windows\System\nEylVcJ.exe
  2⤵
  PID:8012
- C:\Windows\System\EfIaryV.exe
  C:\Windows\System\EfIaryV.exe
  2⤵
  PID:8048
- C:\Windows\System\PXAgLYP.exe
  C:\Windows\System\PXAgLYP.exe
  2⤵
  PID:8068
- C:\Windows\System\CMyoEts.exe
  C:\Windows\System\CMyoEts.exe
  2⤵
  PID:8096
- C:\Windows\System\JRZxTry.exe
  C:\Windows\System\JRZxTry.exe
  2⤵
  PID:8128
- C:\Windows\System\nImOLwT.exe
  C:\Windows\System\nImOLwT.exe
  2⤵
  PID:8176
- C:\Windows\System\ztSEcDD.exe
  C:\Windows\System\ztSEcDD.exe
  2⤵
  PID:6540
- C:\Windows\System\TxcXftn.exe
  C:\Windows\System\TxcXftn.exe
  2⤵
  PID:7236
- C:\Windows\System\rFQrLqL.exe
  C:\Windows\System\rFQrLqL.exe
  2⤵
  PID:7312
- C:\Windows\System\azLLejS.exe
  C:\Windows\System\azLLejS.exe
  2⤵
  PID:7320
- C:\Windows\System\aUjVVuX.exe
  C:\Windows\System\aUjVVuX.exe
  2⤵
  PID:7396
- C:\Windows\System\GblmcvX.exe
  C:\Windows\System\GblmcvX.exe
  2⤵
  PID:7460
- C:\Windows\System\pmLXmUF.exe
  C:\Windows\System\pmLXmUF.exe
  2⤵
  PID:7560
- C:\Windows\System\MtLyvdb.exe
  C:\Windows\System\MtLyvdb.exe
  2⤵
  PID:7624
- C:\Windows\System\tOuONuz.exe
  C:\Windows\System\tOuONuz.exe
  2⤵
  PID:7700
- C:\Windows\System\RzBBvuA.exe
  C:\Windows\System\RzBBvuA.exe
  2⤵
  PID:7784
- C:\Windows\System\QLJJcSi.exe
  C:\Windows\System\QLJJcSi.exe
  2⤵
  PID:7808
- C:\Windows\System\jYnMKjZ.exe
  C:\Windows\System\jYnMKjZ.exe
  2⤵
  PID:7880
- C:\Windows\System\zeFnBIK.exe
  C:\Windows\System\zeFnBIK.exe
  2⤵
  PID:7932
- C:\Windows\System\pqtvNDi.exe
  C:\Windows\System\pqtvNDi.exe
  2⤵
  PID:8040
- C:\Windows\System\avSKrku.exe
  C:\Windows\System\avSKrku.exe
  2⤵
  PID:8088
- C:\Windows\System\EdfHDRR.exe
  C:\Windows\System\EdfHDRR.exe
  2⤵
  PID:8168
- C:\Windows\System\JBNlOeV.exe
  C:\Windows\System\JBNlOeV.exe
  2⤵
  PID:7216
- C:\Windows\System\VIIsEgO.exe
  C:\Windows\System\VIIsEgO.exe
  2⤵
  PID:7420
- C:\Windows\System\BippPfd.exe
  C:\Windows\System\BippPfd.exe
  2⤵
  PID:7588
- C:\Windows\System\PojusXL.exe
  C:\Windows\System\PojusXL.exe
  2⤵
  PID:7724
- C:\Windows\System\OEUbHsN.exe
  C:\Windows\System\OEUbHsN.exe
  2⤵
  PID:7936
- C:\Windows\System\bKDfFui.exe
  C:\Windows\System\bKDfFui.exe
  2⤵
  PID:7884
- C:\Windows\System\YbjRwCh.exe
  C:\Windows\System\YbjRwCh.exe
  2⤵
  PID:8184
- C:\Windows\System\dZWdiLy.exe
  C:\Windows\System\dZWdiLy.exe
  2⤵
  PID:7424
- C:\Windows\System\hwnUpEu.exe
  C:\Windows\System\hwnUpEu.exe
  2⤵
  PID:7672
- C:\Windows\System\nkmewAb.exe
  C:\Windows\System\nkmewAb.exe
  2⤵
  PID:7912
- C:\Windows\System\oPSbMux.exe
  C:\Windows\System\oPSbMux.exe
  2⤵
  PID:7280
- C:\Windows\System\FzgCQVi.exe
  C:\Windows\System\FzgCQVi.exe
  2⤵
  PID:8216
- C:\Windows\System\MxbsdrB.exe
  C:\Windows\System\MxbsdrB.exe
  2⤵
  PID:8268
- C:\Windows\System\BmgGbRG.exe
  C:\Windows\System\BmgGbRG.exe
  2⤵
  PID:8284
- C:\Windows\System\ISkqCPP.exe
  C:\Windows\System\ISkqCPP.exe
  2⤵
  PID:8320
- C:\Windows\System\JUojFVK.exe
  C:\Windows\System\JUojFVK.exe
  2⤵
  PID:8340
- C:\Windows\System\aURcvUk.exe
  C:\Windows\System\aURcvUk.exe
  2⤵
  PID:8368
- C:\Windows\System\WxZeroA.exe
  C:\Windows\System\WxZeroA.exe
  2⤵
  PID:8396
- C:\Windows\System\djtdMZb.exe
  C:\Windows\System\djtdMZb.exe
  2⤵
  PID:8416
- C:\Windows\System\FQDMtGf.exe
  C:\Windows\System\FQDMtGf.exe
  2⤵
  PID:8440
- C:\Windows\System\hALhhZg.exe
  C:\Windows\System\hALhhZg.exe
  2⤵
  PID:8472
- C:\Windows\System\nQybwlr.exe
  C:\Windows\System\nQybwlr.exe
  2⤵
  PID:8504
- C:\Windows\System\IlZSBvl.exe
  C:\Windows\System\IlZSBvl.exe
  2⤵
  PID:8520
- C:\Windows\System\VGqgkfI.exe
  C:\Windows\System\VGqgkfI.exe
  2⤵
  PID:8552
- C:\Windows\System\wmSilrX.exe
  C:\Windows\System\wmSilrX.exe
  2⤵
  PID:8568
- C:\Windows\System\JUqqHvj.exe
  C:\Windows\System\JUqqHvj.exe
  2⤵
  PID:8600
- C:\Windows\System\nehxAuE.exe
  C:\Windows\System\nehxAuE.exe
  2⤵
  PID:8660
- C:\Windows\System\VWtfTnZ.exe
  C:\Windows\System\VWtfTnZ.exe
  2⤵
  PID:8676
- C:\Windows\System\cVgpWiD.exe
  C:\Windows\System\cVgpWiD.exe
  2⤵
  PID:8708
- C:\Windows\System\miOCMwl.exe
  C:\Windows\System\miOCMwl.exe
  2⤵
  PID:8748
- C:\Windows\System\WnvHSnV.exe
  C:\Windows\System\WnvHSnV.exe
  2⤵
  PID:8768
- C:\Windows\System\MltLVMq.exe
  C:\Windows\System\MltLVMq.exe
  2⤵
  PID:8792
- C:\Windows\System\MgMgQZG.exe
  C:\Windows\System\MgMgQZG.exe
  2⤵
  PID:8824
- C:\Windows\System\iUVklNY.exe
  C:\Windows\System\iUVklNY.exe
  2⤵
  PID:8844
- C:\Windows\System\DklivFG.exe
  C:\Windows\System\DklivFG.exe
  2⤵
  PID:8888
- C:\Windows\System\ZUQaZWu.exe
  C:\Windows\System\ZUQaZWu.exe
  2⤵
  PID:8916
- C:\Windows\System\jNmoOld.exe
  C:\Windows\System\jNmoOld.exe
  2⤵
  PID:8944
- C:\Windows\System\hxRlzpA.exe
  C:\Windows\System\hxRlzpA.exe
  2⤵
  PID:8960
- C:\Windows\System\PQXriNV.exe
  C:\Windows\System\PQXriNV.exe
  2⤵
  PID:8988
- C:\Windows\System\PsXPIGa.exe
  C:\Windows\System\PsXPIGa.exe
  2⤵
  PID:9016
- C:\Windows\System\wKpUEWN.exe
  C:\Windows\System\wKpUEWN.exe
  2⤵
  PID:9040
- C:\Windows\System\hbzdeEC.exe
  C:\Windows\System\hbzdeEC.exe
  2⤵
  PID:9072
- C:\Windows\System\lnUPyhH.exe
  C:\Windows\System\lnUPyhH.exe
  2⤵
  PID:9100
- C:\Windows\System\UwRImuS.exe
  C:\Windows\System\UwRImuS.exe
  2⤵
  PID:9132
- C:\Windows\System\bEVCQAz.exe
  C:\Windows\System\bEVCQAz.exe
  2⤵
  PID:9152
- C:\Windows\System\NYDFQCc.exe
  C:\Windows\System\NYDFQCc.exe
  2⤵
  PID:9180
- C:\Windows\System\NrSfGoa.exe
  C:\Windows\System\NrSfGoa.exe
  2⤵
  PID:7336
- C:\Windows\System\YMDypwL.exe
  C:\Windows\System\YMDypwL.exe
  2⤵
  PID:8080
- C:\Windows\System\sqGdeFI.exe
  C:\Windows\System\sqGdeFI.exe
  2⤵
  PID:8240
- C:\Windows\System\FtRNlqv.exe
  C:\Windows\System\FtRNlqv.exe
  2⤵
  PID:8356
- C:\Windows\System\HiBepKa.exe
  C:\Windows\System\HiBepKa.exe
  2⤵
  PID:8384
- C:\Windows\System\oEhZdWJ.exe
  C:\Windows\System\oEhZdWJ.exe
  2⤵
  PID:8436
- C:\Windows\System\mYyusQW.exe
  C:\Windows\System\mYyusQW.exe
  2⤵
  PID:8496
- C:\Windows\System\ZUvAznx.exe
  C:\Windows\System\ZUvAznx.exe
  2⤵
  PID:8592
- C:\Windows\System\xdLnIYR.exe
  C:\Windows\System\xdLnIYR.exe
  2⤵
  PID:8652
- C:\Windows\System\OJZgNsa.exe
  C:\Windows\System\OJZgNsa.exe
  2⤵
  PID:8688
- C:\Windows\System\tdaFNwR.exe
  C:\Windows\System\tdaFNwR.exe
  2⤵
  PID:8764
- C:\Windows\System\IkGbVzZ.exe
  C:\Windows\System\IkGbVzZ.exe
  2⤵
  PID:8868
- C:\Windows\System\rMmhUll.exe
  C:\Windows\System\rMmhUll.exe
  2⤵
  PID:8928
- C:\Windows\System\PHlmXCS.exe
  C:\Windows\System\PHlmXCS.exe
  2⤵
  PID:8984
- C:\Windows\System\FDqzupc.exe
  C:\Windows\System\FDqzupc.exe
  2⤵
  PID:9064
- C:\Windows\System\sFTNTtq.exe
  C:\Windows\System\sFTNTtq.exe
  2⤵
  PID:9108
- C:\Windows\System\gywLbgc.exe
  C:\Windows\System\gywLbgc.exe
  2⤵
  PID:9176
- C:\Windows\System\GvziUze.exe
  C:\Windows\System\GvziUze.exe
  2⤵
  PID:8264
- C:\Windows\System\ElqKdPt.exe
  C:\Windows\System\ElqKdPt.exe
  2⤵
  PID:8412
- C:\Windows\System\iKLanEt.exe
  C:\Windows\System\iKLanEt.exe
  2⤵
  PID:8544
- C:\Windows\System\LWasdXS.exe
  C:\Windows\System\LWasdXS.exe
  2⤵
  PID:8596
- C:\Windows\System\dEnvKyj.exe
  C:\Windows\System\dEnvKyj.exe
  2⤵
  PID:8788
- C:\Windows\System\OIqoYty.exe
  C:\Windows\System\OIqoYty.exe
  2⤵
  PID:8884
- C:\Windows\System\MWhWcWv.exe
  C:\Windows\System\MWhWcWv.exe
  2⤵
  PID:9200
- C:\Windows\System\fsdVwlh.exe
  C:\Windows\System\fsdVwlh.exe
  2⤵
  PID:8280
- C:\Windows\System\goZWIBE.exe
  C:\Windows\System\goZWIBE.exe
  2⤵
  PID:8528
- C:\Windows\System\mpNGpBJ.exe
  C:\Windows\System\mpNGpBJ.exe
  2⤵
  PID:8816
- C:\Windows\System\YucSjer.exe
  C:\Windows\System\YucSjer.exe
  2⤵
  PID:8808
- C:\Windows\System\CwQEqdg.exe
  C:\Windows\System\CwQEqdg.exe
  2⤵
  PID:9224
- C:\Windows\System\NKOGddJ.exe
  C:\Windows\System\NKOGddJ.exe
  2⤵
  PID:9244
- C:\Windows\System\dYNfLuT.exe
  C:\Windows\System\dYNfLuT.exe
  2⤵
  PID:9280
- C:\Windows\System\UalDwRT.exe
  C:\Windows\System\UalDwRT.exe
  2⤵
  PID:9308
- C:\Windows\System\DwECVuf.exe
  C:\Windows\System\DwECVuf.exe
  2⤵
  PID:9328
- C:\Windows\System\aRInUzj.exe
  C:\Windows\System\aRInUzj.exe
  2⤵
  PID:9356
- C:\Windows\System\psAqMzw.exe
  C:\Windows\System\psAqMzw.exe
  2⤵
  PID:9392
- C:\Windows\System\FjshCEq.exe
  C:\Windows\System\FjshCEq.exe
  2⤵
  PID:9420
- C:\Windows\System\rLguhWJ.exe
  C:\Windows\System\rLguhWJ.exe
  2⤵
  PID:9436
- C:\Windows\System\JpIMkeq.exe
  C:\Windows\System\JpIMkeq.exe
  2⤵
  PID:9464
- C:\Windows\System\zpJMvTb.exe
  C:\Windows\System\zpJMvTb.exe
  2⤵
  PID:9484
- C:\Windows\System\nYKfKSY.exe
  C:\Windows\System\nYKfKSY.exe
  2⤵
  PID:9520
- C:\Windows\System\IWGTIbD.exe
  C:\Windows\System\IWGTIbD.exe
  2⤵
  PID:9536
- C:\Windows\System\keLbdGa.exe
  C:\Windows\System\keLbdGa.exe
  2⤵
  PID:9564
- C:\Windows\System\cCasZAS.exe
  C:\Windows\System\cCasZAS.exe
  2⤵
  PID:9592
- C:\Windows\System\KlvjIBI.exe
  C:\Windows\System\KlvjIBI.exe
  2⤵
  PID:9632
- C:\Windows\System\iNiVkQN.exe
  C:\Windows\System\iNiVkQN.exe
  2⤵
  PID:9664
- C:\Windows\System\ZXgqZCU.exe
  C:\Windows\System\ZXgqZCU.exe
  2⤵
  PID:9688
- C:\Windows\System\ixKxwzv.exe
  C:\Windows\System\ixKxwzv.exe
  2⤵
  PID:9716
- C:\Windows\System\nuFQmMy.exe
  C:\Windows\System\nuFQmMy.exe
  2⤵
  PID:9756
- C:\Windows\System\qfcOSzU.exe
  C:\Windows\System\qfcOSzU.exe
  2⤵
  PID:9772
- C:\Windows\System\dLtunFh.exe
  C:\Windows\System\dLtunFh.exe
  2⤵
  PID:9788
- C:\Windows\System\ZsviZfd.exe
  C:\Windows\System\ZsviZfd.exe
  2⤵
  PID:9816
- C:\Windows\System\QAheGUS.exe
  C:\Windows\System\QAheGUS.exe
  2⤵
  PID:9848
- C:\Windows\System\OgIHYtG.exe
  C:\Windows\System\OgIHYtG.exe
  2⤵
  PID:9876
- C:\Windows\System\KAPijOO.exe
  C:\Windows\System\KAPijOO.exe
  2⤵
  PID:9908
- C:\Windows\System\JxLcEUa.exe
  C:\Windows\System\JxLcEUa.exe
  2⤵
  PID:9940
- C:\Windows\System\DQxucVE.exe
  C:\Windows\System\DQxucVE.exe
  2⤵
  PID:9968
- C:\Windows\System\XbukwUK.exe
  C:\Windows\System\XbukwUK.exe
  2⤵
  PID:9996
- C:\Windows\System\AjXfpAb.exe
  C:\Windows\System\AjXfpAb.exe
  2⤵
  PID:10024
- C:\Windows\System\skMpkhl.exe
  C:\Windows\System\skMpkhl.exe
  2⤵
  PID:10052
- C:\Windows\System\cxQtIoh.exe
  C:\Windows\System\cxQtIoh.exe
  2⤵
  PID:10072
- C:\Windows\System\DOyzojH.exe
  C:\Windows\System\DOyzojH.exe
  2⤵
  PID:10088
- C:\Windows\System\JpshYKD.exe
  C:\Windows\System\JpshYKD.exe
  2⤵
  PID:10148
- C:\Windows\System\BWJbADL.exe
  C:\Windows\System\BWJbADL.exe
  2⤵
  PID:10176
- C:\Windows\System\saRiBsq.exe
  C:\Windows\System\saRiBsq.exe
  2⤵
  PID:10196
- C:\Windows\System\KmWbMgV.exe
  C:\Windows\System\KmWbMgV.exe
  2⤵
  PID:10236
- C:\Windows\System\PifGoYV.exe
  C:\Windows\System\PifGoYV.exe
  2⤵
  PID:9140
- C:\Windows\System\xezhaoc.exe
  C:\Windows\System\xezhaoc.exe
  2⤵
  PID:9292
- C:\Windows\System\xRgBhiK.exe
  C:\Windows\System\xRgBhiK.exe
  2⤵
  PID:9388
- C:\Windows\System\LSCRoUG.exe
  C:\Windows\System\LSCRoUG.exe
  2⤵
  PID:9404
- C:\Windows\System\WlMvMcU.exe
  C:\Windows\System\WlMvMcU.exe
  2⤵
  PID:9452
- C:\Windows\System\CJwIGAe.exe
  C:\Windows\System\CJwIGAe.exe
  2⤵
  PID:9556
- C:\Windows\System\QHyLLsO.exe
  C:\Windows\System\QHyLLsO.exe
  2⤵
  PID:9640
- C:\Windows\System\GEOehzR.exe
  C:\Windows\System\GEOehzR.exe
  2⤵
  PID:9684
- C:\Windows\System\LAclcTg.exe
  C:\Windows\System\LAclcTg.exe
  2⤵
  PID:9740
- C:\Windows\System\AmyQqfF.exe
  C:\Windows\System\AmyQqfF.exe
  2⤵
  PID:9860
- C:\Windows\System\MtFfuTW.exe
  C:\Windows\System\MtFfuTW.exe
  2⤵
  PID:9900
- C:\Windows\System\uQfNtND.exe
  C:\Windows\System\uQfNtND.exe
  2⤵
  PID:9992
- C:\Windows\System\PjeiCVj.exe
  C:\Windows\System\PjeiCVj.exe
  2⤵
  PID:9980
- C:\Windows\System\QRRANcL.exe
  C:\Windows\System\QRRANcL.exe
  2⤵
  PID:10044
- C:\Windows\System\pWSbRHY.exe
  C:\Windows\System\pWSbRHY.exe
  2⤵
  PID:10140
- C:\Windows\System\gihVSmv.exe
  C:\Windows\System\gihVSmv.exe
  2⤵
  PID:10208
- C:\Windows\System\CTKtyCS.exe
  C:\Windows\System\CTKtyCS.exe
  2⤵
  PID:9412
- C:\Windows\System\jgvitmS.exe
  C:\Windows\System\jgvitmS.exe
  2⤵
  PID:9448
- C:\Windows\System\EQYtFil.exe
  C:\Windows\System\EQYtFil.exe
  2⤵
  PID:9576
- C:\Windows\System\YdPPkgm.exe
  C:\Windows\System\YdPPkgm.exe
  2⤵
  PID:9732
- C:\Windows\System\gQVfIPL.exe
  C:\Windows\System\gQVfIPL.exe
  2⤵
  PID:9780
- C:\Windows\System\LgSvdRG.exe
  C:\Windows\System\LgSvdRG.exe
  2⤵
  PID:9976
- C:\Windows\System\obMAYaO.exe
  C:\Windows\System\obMAYaO.exe
  2⤵
  PID:10160
- C:\Windows\System\rptjfSt.exe
  C:\Windows\System\rptjfSt.exe
  2⤵
  PID:9432
- C:\Windows\System\TpDckTN.exe
  C:\Windows\System\TpDckTN.exe
  2⤵
  PID:9748
- C:\Windows\System\eAlvZeS.exe
  C:\Windows\System\eAlvZeS.exe
  2⤵
  PID:9300
- C:\Windows\System\GlEwIfa.exe
  C:\Windows\System\GlEwIfa.exe
  2⤵
  PID:9744
- C:\Windows\System\XwaxwVq.exe
  C:\Windows\System\XwaxwVq.exe
  2⤵
  PID:10248
- C:\Windows\System\nmODoMo.exe
  C:\Windows\System\nmODoMo.exe
  2⤵
  PID:10264
- C:\Windows\System\nEFMlcy.exe
  C:\Windows\System\nEFMlcy.exe
  2⤵
  PID:10296
- C:\Windows\System\vuDjZZa.exe
  C:\Windows\System\vuDjZZa.exe
  2⤵
  PID:10316
- C:\Windows\System\movgTAa.exe
  C:\Windows\System\movgTAa.exe
  2⤵
  PID:10344
- C:\Windows\System\hhUTXWT.exe
  C:\Windows\System\hhUTXWT.exe
  2⤵
  PID:10368
- C:\Windows\System\kAHEKKT.exe
  C:\Windows\System\kAHEKKT.exe
  2⤵
  PID:10420
- C:\Windows\System\dygxoYM.exe
  C:\Windows\System\dygxoYM.exe
  2⤵
  PID:10444
- C:\Windows\System\wmbPqwd.exe
  C:\Windows\System\wmbPqwd.exe
  2⤵
  PID:10472
- C:\Windows\System\DnCietF.exe
  C:\Windows\System\DnCietF.exe
  2⤵
  PID:10488
- C:\Windows\System\mKmpxtT.exe
  C:\Windows\System\mKmpxtT.exe
  2⤵
  PID:10516
- C:\Windows\System\DWiUZPn.exe
  C:\Windows\System\DWiUZPn.exe
  2⤵
  PID:10552
- C:\Windows\System\WLKrPNl.exe
  C:\Windows\System\WLKrPNl.exe
  2⤵
  PID:10588
- C:\Windows\System\uwsOzGb.exe
  C:\Windows\System\uwsOzGb.exe
  2⤵
  PID:10624
- C:\Windows\System\KNmvTRz.exe
  C:\Windows\System\KNmvTRz.exe
  2⤵
  PID:10648
- C:\Windows\System\pzNSdKA.exe
  C:\Windows\System\pzNSdKA.exe
  2⤵
  PID:10680
- C:\Windows\System\DuPBiqo.exe
  C:\Windows\System\DuPBiqo.exe
  2⤵
  PID:10708
- C:\Windows\System\SFKmaDT.exe
  C:\Windows\System\SFKmaDT.exe
  2⤵
  PID:10736
- C:\Windows\System\OBykpRE.exe
  C:\Windows\System\OBykpRE.exe
  2⤵
  PID:10768
- C:\Windows\System\oxzVdUJ.exe
  C:\Windows\System\oxzVdUJ.exe
  2⤵
  PID:10796
- C:\Windows\System\EXLfsXW.exe
  C:\Windows\System\EXLfsXW.exe
  2⤵
  PID:10824
- C:\Windows\System\dxkBqSC.exe
  C:\Windows\System\dxkBqSC.exe
  2⤵
  PID:10856
- C:\Windows\System\lOCIAKS.exe
  C:\Windows\System\lOCIAKS.exe
  2⤵
  PID:10880
- C:\Windows\System\XtjSOiD.exe
  C:\Windows\System\XtjSOiD.exe
  2⤵
  PID:10908
- C:\Windows\System\phjoKql.exe
  C:\Windows\System\phjoKql.exe
  2⤵
  PID:10936
- C:\Windows\System\rRYMQQG.exe
  C:\Windows\System\rRYMQQG.exe
  2⤵
  PID:10956
- C:\Windows\System\oxqxoJf.exe
  C:\Windows\System\oxqxoJf.exe
  2⤵
  PID:10992
- C:\Windows\System\dFturZx.exe
  C:\Windows\System\dFturZx.exe
  2⤵
  PID:11020
- C:\Windows\System\IjXGUMQ.exe
  C:\Windows\System\IjXGUMQ.exe
  2⤵
  PID:11048
- C:\Windows\System\cAMaMbm.exe
  C:\Windows\System\cAMaMbm.exe
  2⤵
  PID:11064
- C:\Windows\System\XVzadgM.exe
  C:\Windows\System\XVzadgM.exe
  2⤵
  PID:11084
- C:\Windows\System\NwLBYbN.exe
  C:\Windows\System\NwLBYbN.exe
  2⤵
  PID:11120
- C:\Windows\System\nyAUuVF.exe
  C:\Windows\System\nyAUuVF.exe
  2⤵
  PID:11160
- C:\Windows\System\knlPFsU.exe
  C:\Windows\System\knlPFsU.exe
  2⤵
  PID:11180
- C:\Windows\System\UEGczIE.exe
  C:\Windows\System\UEGczIE.exe
  2⤵
  PID:11216
- C:\Windows\System\pCnuYaj.exe
  C:\Windows\System\pCnuYaj.exe
  2⤵
  PID:11240
- C:\Windows\System\UuMENXZ.exe
  C:\Windows\System\UuMENXZ.exe
  2⤵
  PID:9472
- C:\Windows\System\yvACMJd.exe
  C:\Windows\System\yvACMJd.exe
  2⤵
  PID:9648
- C:\Windows\System\llQhjIJ.exe
  C:\Windows\System\llQhjIJ.exe
  2⤵
  PID:10364
- C:\Windows\System\xOaCJRa.exe
  C:\Windows\System\xOaCJRa.exe
  2⤵
  PID:10436
- C:\Windows\System\KkDsIOx.exe
  C:\Windows\System\KkDsIOx.exe
  2⤵
  PID:10460
- C:\Windows\System\WDCQuwL.exe
  C:\Windows\System\WDCQuwL.exe
  2⤵
  PID:10500
- C:\Windows\System\sDDYTDi.exe
  C:\Windows\System\sDDYTDi.exe
  2⤵
  PID:10612
- C:\Windows\System\JJUNQqc.exe
  C:\Windows\System\JJUNQqc.exe
  2⤵
  PID:10664
- C:\Windows\System\UonCalJ.exe
  C:\Windows\System\UonCalJ.exe
  2⤵
  PID:10756
- C:\Windows\System\ztHahnQ.exe
  C:\Windows\System\ztHahnQ.exe
  2⤵
  PID:10816
- C:\Windows\System\iCemken.exe
  C:\Windows\System\iCemken.exe
  2⤵
  PID:10876
- C:\Windows\System\JrfkxRb.exe
  C:\Windows\System\JrfkxRb.exe
  2⤵
  PID:10964
- C:\Windows\System\HzIZXVX.exe
  C:\Windows\System\HzIZXVX.exe
  2⤵
  PID:10980
- C:\Windows\System\pjMjhdY.exe
  C:\Windows\System\pjMjhdY.exe
  2⤵
  PID:11080
- C:\Windows\System\ksaYkeF.exe
  C:\Windows\System\ksaYkeF.exe
  2⤵
  PID:11140
- C:\Windows\System\tvNsJBY.exe
  C:\Windows\System\tvNsJBY.exe
  2⤵
  PID:11204
- C:\Windows\System\YHXgQiW.exe
  C:\Windows\System\YHXgQiW.exe
  2⤵
  PID:10256
- C:\Windows\System\qRuUaNY.exe
  C:\Windows\System\qRuUaNY.exe
  2⤵
  PID:10308
- C:\Windows\System\xRDKGsm.exe
  C:\Windows\System\xRDKGsm.exe
  2⤵
  PID:10536
- C:\Windows\System\orPeXEB.exe
  C:\Windows\System\orPeXEB.exe
  2⤵
  PID:10676
- C:\Windows\System\RioixFz.exe
  C:\Windows\System\RioixFz.exe
  2⤵
  PID:10792
- C:\Windows\System\kdOssHj.exe
  C:\Windows\System\kdOssHj.exe
  2⤵
  PID:11036
- C:\Windows\System\xxoDVgH.exe
  C:\Windows\System\xxoDVgH.exe
  2⤵
  PID:11096
- C:\Windows\System\Xgeeebb.exe
  C:\Windows\System\Xgeeebb.exe
  2⤵
  PID:10408
- C:\Windows\System\NnkGFiF.exe
  C:\Windows\System\NnkGFiF.exe
  2⤵
  PID:10596
- C:\Windows\System\MqeRJaD.exe
  C:\Windows\System\MqeRJaD.exe
  2⤵
  PID:10788
- C:\Windows\System\oeEoPfy.exe
  C:\Windows\System\oeEoPfy.exe
  2⤵
  PID:11200
- C:\Windows\System\iYWMRHe.exe
  C:\Windows\System\iYWMRHe.exe
  2⤵
  PID:10920
- C:\Windows\System\PeUVrid.exe
  C:\Windows\System\PeUVrid.exe
  2⤵
  PID:11296
- C:\Windows\System\meEanhL.exe
  C:\Windows\System\meEanhL.exe
  2⤵
  PID:11324
- C:\Windows\System\mVkzVFU.exe
  C:\Windows\System\mVkzVFU.exe
  2⤵
  PID:11352
- C:\Windows\System\YghEYZY.exe
  C:\Windows\System\YghEYZY.exe
  2⤵
  PID:11380
- C:\Windows\System\DQsUPUW.exe
  C:\Windows\System\DQsUPUW.exe
  2⤵
  PID:11408
- C:\Windows\System\TTdjsts.exe
  C:\Windows\System\TTdjsts.exe
  2⤵
  PID:11436
- C:\Windows\System\JuiWmmP.exe
  C:\Windows\System\JuiWmmP.exe
  2⤵
  PID:11464
- C:\Windows\System\NNiMxeF.exe
  C:\Windows\System\NNiMxeF.exe
  2⤵
  PID:11504
- C:\Windows\System\AgrUlqb.exe
  C:\Windows\System\AgrUlqb.exe
  2⤵
  PID:11528
- C:\Windows\System\RNHdfuk.exe
  C:\Windows\System\RNHdfuk.exe
  2⤵
  PID:11548
- C:\Windows\System\Gkwkhdv.exe
  C:\Windows\System\Gkwkhdv.exe
  2⤵
  PID:11588
- C:\Windows\System\eLPPxVZ.exe
  C:\Windows\System\eLPPxVZ.exe
  2⤵
  PID:11616
- C:\Windows\System\VqAgRyn.exe
  C:\Windows\System\VqAgRyn.exe
  2⤵
  PID:11644
- C:\Windows\System\oNRRCam.exe
  C:\Windows\System\oNRRCam.exe
  2⤵
  PID:11672
- C:\Windows\System\kDSZevR.exe
  C:\Windows\System\kDSZevR.exe
  2⤵
  PID:11692
- C:\Windows\System\dVKOQyZ.exe
  C:\Windows\System\dVKOQyZ.exe
  2⤵
  PID:11728
- C:\Windows\System\gOUIgkg.exe
  C:\Windows\System\gOUIgkg.exe
  2⤵
  PID:11756
- C:\Windows\System\ssZpXni.exe
  C:\Windows\System\ssZpXni.exe
  2⤵
  PID:11772
- C:\Windows\System\SioYWzc.exe
  C:\Windows\System\SioYWzc.exe
  2⤵
  PID:11800
- C:\Windows\System\QzKHdlm.exe
  C:\Windows\System\QzKHdlm.exe
  2⤵
  PID:11828
- C:\Windows\System\cEwNqFF.exe
  C:\Windows\System\cEwNqFF.exe
  2⤵
  PID:11856
- C:\Windows\System\UVoLGHc.exe
  C:\Windows\System\UVoLGHc.exe
  2⤵
  PID:11884
- C:\Windows\System\FCsycBp.exe
  C:\Windows\System\FCsycBp.exe
  2⤵
  PID:11916
- C:\Windows\System\jyLchbt.exe
  C:\Windows\System\jyLchbt.exe
  2⤵
  PID:11952
- C:\Windows\System\zKXpdjh.exe
  C:\Windows\System\zKXpdjh.exe
  2⤵
  PID:11980
- C:\Windows\System\KirEQxe.exe
  C:\Windows\System\KirEQxe.exe
  2⤵
  PID:12004
- C:\Windows\System\lqcoIpD.exe
  C:\Windows\System\lqcoIpD.exe
  2⤵
  PID:12024
- C:\Windows\System\NcuqoqJ.exe
  C:\Windows\System\NcuqoqJ.exe
  2⤵
  PID:12064
- C:\Windows\System\azfDMIK.exe
  C:\Windows\System\azfDMIK.exe
  2⤵
  PID:12080
- C:\Windows\System\bPtMXuL.exe
  C:\Windows\System\bPtMXuL.exe
  2⤵
  PID:12100
- C:\Windows\System\uoaTLwY.exe
  C:\Windows\System\uoaTLwY.exe
  2⤵
  PID:12132
- C:\Windows\System\PkoIJMy.exe
  C:\Windows\System\PkoIJMy.exe
  2⤵
  PID:12164
- C:\Windows\System\veWcGLh.exe
  C:\Windows\System\veWcGLh.exe
  2⤵
  PID:12192
- C:\Windows\System\rGkneti.exe
  C:\Windows\System\rGkneti.exe
  2⤵
  PID:12224
- C:\Windows\System\HjKYtck.exe
  C:\Windows\System\HjKYtck.exe
  2⤵
  PID:12244
- C:\Windows\System\ylFCHBV.exe
  C:\Windows\System\ylFCHBV.exe
  2⤵
  PID:12264
- C:\Windows\System\sqHOhtt.exe
  C:\Windows\System\sqHOhtt.exe
  2⤵
  PID:11056
- C:\Windows\System\wTwmmPA.exe
  C:\Windows\System\wTwmmPA.exe
  2⤵
  PID:11284
- C:\Windows\System\galUxlY.exe
  C:\Windows\System\galUxlY.exe
  2⤵
  PID:11336
- C:\Windows\System\GrBVMqi.exe
  C:\Windows\System\GrBVMqi.exe
  2⤵
  PID:11400
- C:\Windows\System\LdNnNwG.exe
  C:\Windows\System\LdNnNwG.exe
  2⤵
  PID:11460
- C:\Windows\System\fySuLTa.exe
  C:\Windows\System\fySuLTa.exe
  2⤵
  PID:11580
- C:\Windows\System\CZlxXcN.exe
  C:\Windows\System\CZlxXcN.exe
  2⤵
  PID:11636
- C:\Windows\System\BRjnSkl.exe
  C:\Windows\System\BRjnSkl.exe
  2⤵
  PID:11688
- C:\Windows\System\vtuIxFF.exe
  C:\Windows\System\vtuIxFF.exe
  2⤵
  PID:11768
- C:\Windows\System\iWmbqTu.exe
  C:\Windows\System\iWmbqTu.exe
  2⤵
  PID:11824
- C:\Windows\System\zpmDsaH.exe
  C:\Windows\System\zpmDsaH.exe
  2⤵
  PID:11876
- C:\Windows\System\LmufIFo.exe
  C:\Windows\System\LmufIFo.exe
  2⤵
  PID:11940
- C:\Windows\System\zERQWGV.exe
  C:\Windows\System\zERQWGV.exe
  2⤵
  PID:11992
- C:\Windows\System\UYhfTlC.exe
  C:\Windows\System\UYhfTlC.exe
  2⤵
  PID:12040
- C:\Windows\System\BXZsWTA.exe
  C:\Windows\System\BXZsWTA.exe
  2⤵
  PID:12120
- C:\Windows\System\lBwpmsW.exe
  C:\Windows\System\lBwpmsW.exe
  2⤵
  PID:12152
- C:\Windows\System\GoTZJNV.exe
  C:\Windows\System\GoTZJNV.exe
  2⤵
  PID:11316
- C:\Windows\System\xreqGJY.exe
  C:\Windows\System\xreqGJY.exe
  2⤵
  PID:11396
- C:\Windows\System\mddtMww.exe
  C:\Windows\System\mddtMww.exe
  2⤵
  PID:11540
- C:\Windows\System\JOYkjDt.exe
  C:\Windows\System\JOYkjDt.exe
  2⤵
  PID:11848
- C:\Windows\System\RVqkjKK.exe
  C:\Windows\System\RVqkjKK.exe
  2⤵
  PID:11792
- C:\Windows\System\xvAOAdT.exe
  C:\Windows\System\xvAOAdT.exe
  2⤵
  PID:12148
- C:\Windows\System\kOABUVU.exe
  C:\Windows\System\kOABUVU.exe
  2⤵
  PID:12060
- C:\Windows\System\VDloJoa.exe
  C:\Windows\System\VDloJoa.exe
  2⤵
  PID:11424
- C:\Windows\System\PqULCtx.exe
  C:\Windows\System\PqULCtx.exe
  2⤵
  PID:11716
- C:\Windows\System\lQZpHOT.exe
  C:\Windows\System\lQZpHOT.exe
  2⤵
  PID:11944
- C:\Windows\System\eWfseST.exe
  C:\Windows\System\eWfseST.exe
  2⤵
  PID:11900
- C:\Windows\System\CAKpAyn.exe
  C:\Windows\System\CAKpAyn.exe
  2⤵
  PID:12292
- C:\Windows\System\SzSJYjW.exe
  C:\Windows\System\SzSJYjW.exe
  2⤵
  PID:12320
- C:\Windows\System\XXJWNWD.exe
  C:\Windows\System\XXJWNWD.exe
  2⤵
  PID:12348
- C:\Windows\System\XeZTpAv.exe
  C:\Windows\System\XeZTpAv.exe
  2⤵
  PID:12376
- C:\Windows\System\scrLUTT.exe
  C:\Windows\System\scrLUTT.exe
  2⤵
  PID:12392
- C:\Windows\System\ZIzSnTm.exe
  C:\Windows\System\ZIzSnTm.exe
  2⤵
  PID:12420
- C:\Windows\System\VMOyGxs.exe
  C:\Windows\System\VMOyGxs.exe
  2⤵
  PID:12448
- C:\Windows\System\KKlvuLK.exe
  C:\Windows\System\KKlvuLK.exe
  2⤵
  PID:12476
- C:\Windows\System\nsHfNKz.exe
  C:\Windows\System\nsHfNKz.exe
  2⤵
  PID:12500
- C:\Windows\System\DIKYtdH.exe
  C:\Windows\System\DIKYtdH.exe
  2⤵
  PID:12528
- C:\Windows\System\coaqMGn.exe
  C:\Windows\System\coaqMGn.exe
  2⤵
  PID:12548
- C:\Windows\System\YXlcZsS.exe
  C:\Windows\System\YXlcZsS.exe
  2⤵
  PID:12576
- C:\Windows\System\ojUTeks.exe
  C:\Windows\System\ojUTeks.exe
  2⤵
  PID:12592
- C:\Windows\System\EksGyNW.exe
  C:\Windows\System\EksGyNW.exe
  2⤵
  PID:12616
- C:\Windows\System\tkakOzn.exe
  C:\Windows\System\tkakOzn.exe
  2⤵
  PID:12636
- C:\Windows\System\NLqGStP.exe
  C:\Windows\System\NLqGStP.exe
  2⤵
  PID:12664
- C:\Windows\System\hgQjikD.exe
  C:\Windows\System\hgQjikD.exe
  2⤵
  PID:12688
- C:\Windows\System\oIRHgDn.exe
  C:\Windows\System\oIRHgDn.exe
  2⤵
  PID:12704
- C:\Windows\System\MrnFPCy.exe
  C:\Windows\System\MrnFPCy.exe
  2⤵
  PID:12740
- C:\Windows\System\QrFttOR.exe
  C:\Windows\System\QrFttOR.exe
  2⤵
  PID:12808
- C:\Windows\System\TvlXnrx.exe
  C:\Windows\System\TvlXnrx.exe
  2⤵
  PID:12864
- C:\Windows\System\caclaho.exe
  C:\Windows\System\caclaho.exe
  2⤵
  PID:12880
- C:\Windows\System\TLMNPdO.exe
  C:\Windows\System\TLMNPdO.exe
  2⤵
  PID:12896
- C:\Windows\System\nFIDMRm.exe
  C:\Windows\System\nFIDMRm.exe
  2⤵
  PID:12928
- C:\Windows\System\ckdfnir.exe
  C:\Windows\System\ckdfnir.exe
  2⤵
  PID:12952
- C:\Windows\System\lZahdJX.exe
  C:\Windows\System\lZahdJX.exe
  2⤵
  PID:12980
- C:\Windows\System\GcsqrNz.exe
  C:\Windows\System\GcsqrNz.exe
  2⤵
  PID:13020
- C:\Windows\System\KYbFqQw.exe
  C:\Windows\System\KYbFqQw.exe
  2⤵
  PID:13044
- C:\Windows\System\RSDFFov.exe
  C:\Windows\System\RSDFFov.exe
  2⤵
  PID:13076
- C:\Windows\System\REYIHGR.exe
  C:\Windows\System\REYIHGR.exe
  2⤵
  PID:13092
- C:\Windows\System\mZSLMCv.exe
  C:\Windows\System\mZSLMCv.exe
  2⤵
  PID:13116
- C:\Windows\System\zSycatT.exe
  C:\Windows\System\zSycatT.exe
  2⤵
  PID:13144
- C:\Windows\System\OcvwIcK.exe
  C:\Windows\System\OcvwIcK.exe
  2⤵
  PID:13172
- C:\Windows\System\CEEoTjk.exe
  C:\Windows\System\CEEoTjk.exe
  2⤵
  PID:13192
- C:\Windows\System\QGVMlEX.exe
  C:\Windows\System\QGVMlEX.exe
  2⤵
  PID:13240
- C:\Windows\System\kaAhyfF.exe
  C:\Windows\System\kaAhyfF.exe
  2⤵
  PID:13260
- C:\Windows\System\uHDSYdu.exe
  C:\Windows\System\uHDSYdu.exe
  2⤵
  PID:13280
- C:\Windows\System\YXePpdJ.exe
  C:\Windows\System\YXePpdJ.exe
  2⤵
  PID:13304
- C:\Windows\System\pBpJEFw.exe
  C:\Windows\System\pBpJEFw.exe
  2⤵
  PID:12332
- C:\Windows\System\PSSDwRu.exe
  C:\Windows\System\PSSDwRu.exe
  2⤵
  PID:12412
- C:\Windows\System\FtHKOiu.exe
  C:\Windows\System\FtHKOiu.exe
  2⤵
  PID:12516
- C:\Windows\System\IFOJULR.exe
  C:\Windows\System\IFOJULR.exe
  2⤵
  PID:12544
- C:\Windows\System\ZNYOPgF.exe
  C:\Windows\System\ZNYOPgF.exe
  2⤵
  PID:12632
- C:\Windows\System\yctcPVN.exe
  C:\Windows\System\yctcPVN.exe
  2⤵
  PID:12660
- C:\Windows\System\RwREOvn.exe
  C:\Windows\System\RwREOvn.exe
  2⤵
  PID:12768
- C:\Windows\System\omnrAst.exe
  C:\Windows\System\omnrAst.exe
  2⤵
  PID:12736
- C:\Windows\System\oIdblEe.exe
  C:\Windows\System\oIdblEe.exe
  2⤵
  PID:12888
- C:\Windows\System\IDDtoLh.exe
  C:\Windows\System\IDDtoLh.exe
  2⤵
  PID:12920
- C:\Windows\System\jZYbqZd.exe
  C:\Windows\System\jZYbqZd.exe
  2⤵
  PID:13012
- C:\Windows\System\jYqqOgx.exe
  C:\Windows\System\jYqqOgx.exe
  2⤵
  PID:13052
- C:\Windows\System\wJQnQTH.exe
  C:\Windows\System\wJQnQTH.exe
  2⤵
  PID:13104
- C:\Windows\System\XyfrLKH.exe
  C:\Windows\System\XyfrLKH.exe
  2⤵
  PID:13212
- C:\Windows\System\DjjhkMa.exe
  C:\Windows\System\DjjhkMa.exe
  2⤵
  PID:13292
- C:\Windows\System\NCqoRnI.exe
  C:\Windows\System\NCqoRnI.exe
  2⤵
  PID:12372
- C:\Windows\System\rehoYNy.exe
  C:\Windows\System\rehoYNy.exe
  2⤵
  PID:12492
- C:\Windows\System\ivagYQk.exe
  C:\Windows\System\ivagYQk.exe
  2⤵
  PID:12728
- C:\Windows\System\unDYbOZ.exe
  C:\Windows\System\unDYbOZ.exe
  2⤵
  PID:12732
- C:\Windows\System\jkjupVc.exe
  C:\Windows\System\jkjupVc.exe
  2⤵
  PID:12908
- C:\Windows\System\LFsSTiw.exe
  C:\Windows\System\LFsSTiw.exe
  2⤵
  PID:13032
- C:\Windows\System\MwfYexB.exe
  C:\Windows\System\MwfYexB.exe
  2⤵
  PID:13064
- C:\Windows\System\qkEdwez.exe
  C:\Windows\System\qkEdwez.exe
  2⤵
  PID:12560
- C:\Windows\System\LFDeffl.exe
  C:\Windows\System\LFDeffl.exe
  2⤵
  PID:12872
- C:\Windows\System\BGoFGeW.exe
  C:\Windows\System\BGoFGeW.exe
  2⤵
  PID:13288
- C:\Windows\System\EVuRhZD.exe
  C:\Windows\System\EVuRhZD.exe
  2⤵
  PID:12800
- C:\Windows\System\cUYQjLb.exe
  C:\Windows\System\cUYQjLb.exe
  2⤵
  PID:13128
- C:\Windows\System\hCAJNIu.exe
  C:\Windows\System\hCAJNIu.exe
  2⤵
  PID:13328
- C:\Windows\System\wtnoqYO.exe
  C:\Windows\System\wtnoqYO.exe
  2⤵
  PID:13356
- C:\Windows\System\UMsBsOe.exe
  C:\Windows\System\UMsBsOe.exe
  2⤵
  PID:13384
- C:\Windows\System\jbxraVB.exe
  C:\Windows\System\jbxraVB.exe
  2⤵
  PID:13412
- C:\Windows\System\kdcpqYy.exe
  C:\Windows\System\kdcpqYy.exe
  2⤵
  PID:13448
- C:\Windows\System\NrrxdSN.exe
  C:\Windows\System\NrrxdSN.exe
  2⤵
  PID:13468
- C:\Windows\System\qtQQEQy.exe
  C:\Windows\System\qtQQEQy.exe
  2⤵
  PID:13500
- C:\Windows\System\uBuVRRV.exe
  C:\Windows\System\uBuVRRV.exe
  2⤵
  PID:13536
- C:\Windows\System\ybeUKwF.exe
  C:\Windows\System\ybeUKwF.exe
  2⤵
  PID:13564
- C:\Windows\System\pczJHhP.exe
  C:\Windows\System\pczJHhP.exe
  2⤵
  PID:13592
- C:\Windows\System\CmguIKW.exe
  C:\Windows\System\CmguIKW.exe
  2⤵
  PID:13616
- C:\Windows\System\FFcGMvi.exe
  C:\Windows\System\FFcGMvi.exe
  2⤵
  PID:13648
- C:\Windows\System\ZMmKanQ.exe
  C:\Windows\System\ZMmKanQ.exe
  2⤵
  PID:13676
- C:\Windows\System\kunaMIm.exe
  C:\Windows\System\kunaMIm.exe
  2⤵
  PID:13696
- C:\Windows\System\FFTbLYe.exe
  C:\Windows\System\FFTbLYe.exe
  2⤵
  PID:13720
- C:\Windows\System\bYZrIdY.exe
  C:\Windows\System\bYZrIdY.exe
  2⤵
  PID:13740
- C:\Windows\System\kxHyFft.exe
  C:\Windows\System\kxHyFft.exe
  2⤵
  PID:13776
- C:\Windows\System\MTjWFTF.exe
  C:\Windows\System\MTjWFTF.exe
  2⤵
  PID:13816
- C:\Windows\System\vNjNIZt.exe
  C:\Windows\System\vNjNIZt.exe
  2⤵
  PID:13844
- C:\Windows\System\ZaIwphC.exe
  C:\Windows\System\ZaIwphC.exe
  2⤵
  PID:13868
- C:\Windows\System\FMeSKAj.exe
  C:\Windows\System\FMeSKAj.exe
  2⤵
  PID:13888
- C:\Windows\System\coLXFYp.exe
  C:\Windows\System\coLXFYp.exe
  2⤵
  PID:13908
- C:\Windows\System\ZnvQmVV.exe
  C:\Windows\System\ZnvQmVV.exe
  2⤵
  PID:13936
- C:\Windows\System\bqVswIB.exe
  C:\Windows\System\bqVswIB.exe
  2⤵
  PID:13960
- C:\Windows\System\tyugbIg.exe
  C:\Windows\System\tyugbIg.exe
  2⤵
  PID:13988
- C:\Windows\System\PrYpuQD.exe
  C:\Windows\System\PrYpuQD.exe
  2⤵
  PID:14012
- C:\Windows\System\VPcDsVB.exe
  C:\Windows\System\VPcDsVB.exe
  2⤵
  PID:14064
- C:\Windows\System\wLTIDmU.exe
  C:\Windows\System\wLTIDmU.exe
  2⤵
  PID:14096
- C:\Windows\System\NqEQNTP.exe
  C:\Windows\System\NqEQNTP.exe
  2⤵
  PID:14112
- C:\Windows\System\UCbRJvZ.exe
  C:\Windows\System\UCbRJvZ.exe
  2⤵
  PID:14152
- C:\Windows\System\kGdsnaD.exe
  C:\Windows\System\kGdsnaD.exe
  2⤵
  PID:14168
- C:\Windows\System\fIECmye.exe
  C:\Windows\System\fIECmye.exe
  2⤵
  PID:14184
- C:\Windows\System\MFeDOnN.exe
  C:\Windows\System\MFeDOnN.exe
  2⤵
  PID:14208
- C:\Windows\System\yeVvDul.exe
  C:\Windows\System\yeVvDul.exe
  2⤵
  PID:14248
- C:\Windows\System\jfwMzcu.exe
  C:\Windows\System\jfwMzcu.exe
  2⤵
  PID:14280
- C:\Windows\System\dcNxSdN.exe
  C:\Windows\System\dcNxSdN.exe
  2⤵
  PID:14320
- C:\Windows\System\eMWdrEl.exe
  C:\Windows\System\eMWdrEl.exe
  2⤵
  PID:13068
- C:\Windows\System\JOaTocP.exe
  C:\Windows\System\JOaTocP.exe
  2⤵
  PID:13396
- C:\Windows\System\MUXCFDe.exe
  C:\Windows\System\MUXCFDe.exe
  2⤵
  PID:13436
- C:\Windows\System\cfnEDgC.exe
  C:\Windows\System\cfnEDgC.exe
  2⤵
  PID:13524
- C:\Windows\System\kvIabrW.exe
  C:\Windows\System\kvIabrW.exe
  2⤵
  PID:13576
- C:\Windows\System\khgMmAY.exe
  C:\Windows\System\khgMmAY.exe
  2⤵
  PID:13632
- C:\Windows\System\PQPxRTC.exe
  C:\Windows\System\PQPxRTC.exe
  2⤵
  PID:13748
- C:\Windows\System\rNkZrzo.exe
  C:\Windows\System\rNkZrzo.exe
  2⤵
  PID:13808
- C:\Windows\System\xTOkttO.exe
  C:\Windows\System\xTOkttO.exe
  2⤵
  PID:13840
- C:\Windows\System\JOAvFOY.exe
  C:\Windows\System\JOAvFOY.exe
  2⤵
  PID:13972
- C:\Windows\System\DbzSSBd.exe
  C:\Windows\System\DbzSSBd.exe
  2⤵
  PID:13916
- C:\Windows\System\fBQBHfv.exe
  C:\Windows\System\fBQBHfv.exe
  2⤵
  PID:14008
- C:\Windows\System\euvhAOX.exe
  C:\Windows\System\euvhAOX.exe
  2⤵
  PID:14056
- C:\Windows\System\xkNilTt.exe
  C:\Windows\System\xkNilTt.exe
  2⤵
  PID:14144
- C:\Windows\System\TzufvMB.exe
  C:\Windows\System\TzufvMB.exe
  2⤵
  PID:14140
- C:\Windows\System\dzmCncs.exe
  C:\Windows\System\dzmCncs.exe
  2⤵
  PID:14204
- C:\Windows\System\RVfkdoH.exe
  C:\Windows\System\RVfkdoH.exe
  2⤵
  PID:14268
- C:\Windows\System\ohdWHmO.exe
  C:\Windows\System\ohdWHmO.exe
  2⤵
  PID:13344
- C:\Windows\System\ZofLoFv.exe
  C:\Windows\System\ZofLoFv.exe
  2⤵
  PID:13664
- C:\Windows\System\FjslCLZ.exe
  C:\Windows\System\FjslCLZ.exe
  2⤵
  PID:13944
- C:\Windows\System\phFodwo.exe
  C:\Windows\System\phFodwo.exe
  2⤵
  PID:14004
- C:\Windows\System\fgPcViM.exe
  C:\Windows\System\fgPcViM.exe
  2⤵
  PID:14108
- C:\Windows\System\NvTBIXK.exe
  C:\Windows\System\NvTBIXK.exe
  2⤵
  PID:14228
- C:\Windows\System\jkKallS.exe
  C:\Windows\System\jkKallS.exe
  2⤵
  PID:13624
- C:\Windows\System\IZnWSjC.exe
  C:\Windows\System\IZnWSjC.exe
  2⤵
  PID:13928
- C:\Windows\System\smsVOPH.exe
  C:\Windows\System\smsVOPH.exe
  2⤵
  PID:14304
- C:\Windows\System\MHOlqgB.exe
  C:\Windows\System\MHOlqgB.exe
  2⤵
  PID:14104
- C:\Windows\System\zxcFBeX.exe
  C:\Windows\System\zxcFBeX.exe
  2⤵
  PID:14344
- C:\Windows\System\OoHQAeY.exe
  C:\Windows\System\OoHQAeY.exe
  2⤵
  PID:14368
- C:\Windows\System\KbMwaVm.exe
  C:\Windows\System\KbMwaVm.exe
  2⤵
  PID:14412
- C:\Windows\System\zLBpqLV.exe
  C:\Windows\System\zLBpqLV.exe
  2⤵
  PID:14440
- C:\Windows\System\mtnykTd.exe
  C:\Windows\System\mtnykTd.exe
  2⤵
  PID:14456
- C:\Windows\System\BnnaAgu.exe
  C:\Windows\System\BnnaAgu.exe
  2⤵
  PID:14480
- C:\Windows\System\VlYfZjl.exe
  C:\Windows\System\VlYfZjl.exe
  2⤵
  PID:14508
- C:\Windows\System\NXTFHKl.exe
  C:\Windows\System\NXTFHKl.exe
  2⤵
  PID:14552
- C:\Windows\System\DZekjbn.exe
  C:\Windows\System\DZekjbn.exe
  2⤵
  PID:14568
- C:\Windows\System\UphvoIt.exe
  C:\Windows\System\UphvoIt.exe
  2⤵
  PID:14596
- C:\Windows\System\jkmJmWC.exe
  C:\Windows\System\jkmJmWC.exe
  2⤵
  PID:14616
- C:\Windows\System\yehBmaj.exe
  C:\Windows\System\yehBmaj.exe
  2⤵
  PID:14652
- C:\Windows\System\RWhBfry.exe
  C:\Windows\System\RWhBfry.exe
  2⤵
  PID:14692
- C:\Windows\System\IcjAhIS.exe
  C:\Windows\System\IcjAhIS.exe
  2⤵
  PID:14712
- C:\Windows\System\XzknKeT.exe
  C:\Windows\System\XzknKeT.exe
  2⤵
  PID:14744
- C:\Windows\System\UDLoJcb.exe
  C:\Windows\System\UDLoJcb.exe
  2⤵
  PID:14768
- C:\Windows\System\vQIbtcJ.exe
  C:\Windows\System\vQIbtcJ.exe
  2⤵
  PID:14792
- C:\Windows\System\aZcIvrc.exe
  C:\Windows\System\aZcIvrc.exe
  2⤵
  PID:14816
- C:\Windows\System\mPNqLbF.exe
  C:\Windows\System\mPNqLbF.exe
  2⤵
  PID:14836
- C:\Windows\System\HgQKOaG.exe
  C:\Windows\System\HgQKOaG.exe
  2⤵
  PID:14860
- C:\Windows\System\LXbIFbt.exe
  C:\Windows\System\LXbIFbt.exe
  2⤵
  PID:14884
- C:\Windows\System\YvlGVSu.exe
  C:\Windows\System\YvlGVSu.exe
  2⤵
  PID:14924
- C:\Windows\System\JMkFYPy.exe
  C:\Windows\System\JMkFYPy.exe
  2⤵
  PID:14948
- C:\Windows\System\BfaUGae.exe
  C:\Windows\System\BfaUGae.exe
  2⤵
  PID:14976
- C:\Windows\System\qJQKUAD.exe
  C:\Windows\System\qJQKUAD.exe
  2⤵
  PID:15008
- C:\Windows\System\AjhAxnj.exe
  C:\Windows\System\AjhAxnj.exe
  2⤵
  PID:15036
- C:\Windows\System\RCtRDBL.exe
  C:\Windows\System\RCtRDBL.exe
  2⤵
  PID:15056
- C:\Windows\System\BKUnZtP.exe
  C:\Windows\System\BKUnZtP.exe
  2⤵
  PID:15080
- C:\Windows\System\efoTrKO.exe
  C:\Windows\System\efoTrKO.exe
  2⤵
  PID:15108
- C:\Windows\System\rkOpqKG.exe
  C:\Windows\System\rkOpqKG.exe
  2⤵
  PID:15140
- C:\Windows\System\QlRaswY.exe
  C:\Windows\System\QlRaswY.exe
  2⤵
  PID:15180
- C:\Windows\System\oRFPUIW.exe
  C:\Windows\System\oRFPUIW.exe
  2⤵
  PID:15212
- C:\Windows\System\UqwNkvm.exe
  C:\Windows\System\UqwNkvm.exe
  2⤵
  PID:15240
- C:\Windows\System\dEpbNnE.exe
  C:\Windows\System\dEpbNnE.exe
  2⤵
  PID:15280
- C:\Windows\System\VCLAVHq.exe
  C:\Windows\System\VCLAVHq.exe
  2⤵
  PID:15300
- C:\Windows\System\CTiAyIz.exe
  C:\Windows\System\CTiAyIz.exe
  2⤵
  PID:15324
- C:\Windows\System\LPDUByl.exe
  C:\Windows\System\LPDUByl.exe
  2⤵
  PID:15340
- C:\Windows\System\ZmoQBlR.exe
  C:\Windows\System\ZmoQBlR.exe
  2⤵
  PID:13460
- C:\Windows\System\pqvKcgE.exe
  C:\Windows\System\pqvKcgE.exe
  2⤵
  PID:14436
- C:\Windows\System\AtpRapw.exe
  C:\Windows\System\AtpRapw.exe
  2⤵
  PID:14476
- C:\Windows\System\FLJMnKC.exe
  C:\Windows\System\FLJMnKC.exe
  2⤵
  PID:14496
- C:\Windows\System\kwODUDi.exe
  C:\Windows\System\kwODUDi.exe
  2⤵
  PID:14604
- C:\Windows\System\VhuDMHc.exe
  C:\Windows\System\VhuDMHc.exe
  2⤵
  PID:14676
- C:\Windows\System\psLLPxm.exe
  C:\Windows\System\psLLPxm.exe
  2⤵
  PID:14788
- C:\Windows\System\dWrWgLH.exe
  C:\Windows\System\dWrWgLH.exe
  2⤵
  PID:14804
- C:\Windows\System\wijWGhS.exe
  C:\Windows\System\wijWGhS.exe
  2⤵
  PID:14900
- C:\Windows\System\KyLOipk.exe
  C:\Windows\System\KyLOipk.exe
  2⤵
  PID:14964
- C:\Windows\System\aFwClHM.exe
  C:\Windows\System\aFwClHM.exe
  2⤵
  PID:15044
- C:\Windows\System\JBNFgAk.exe
  C:\Windows\System\JBNFgAk.exe
  2⤵
  PID:15076
- C:\Windows\System\YHBvmUv.exe
  C:\Windows\System\YHBvmUv.exe
  2⤵
  PID:15164
- C:\Windows\System\DGYaUym.exe
  C:\Windows\System\DGYaUym.exe
  2⤵
  PID:15176
- C:\Windows\System\bIYRvQA.exe
  C:\Windows\System\bIYRvQA.exe
  2⤵
  PID:15316
- C:\Windows\System\imNBXJJ.exe
  C:\Windows\System\imNBXJJ.exe
  2⤵
  PID:15356
- C:\Windows\System\KMGivHK.exe
  C:\Windows\System\KMGivHK.exe
  2⤵
  PID:14564
- C:\Windows\System\EmKLrog.exe
  C:\Windows\System\EmKLrog.exe
  2⤵
  PID:14624
- C:\Windows\System\fYMxSqn.exe
  C:\Windows\System\fYMxSqn.exe
  2⤵
  PID:14856
- C:\Windows\System\VpHZozx.exe
  C:\Windows\System\VpHZozx.exe
  2⤵
  PID:14916
- C:\Windows\System\ukTVmzm.exe
  C:\Windows\System\ukTVmzm.exe
  2⤵
  PID:14992
- C:\Windows\System\kEXIiIt.exe
  C:\Windows\System\kEXIiIt.exe
  2⤵
  PID:15156
- C:\Windows\System\YKaEgIr.exe
  C:\Windows\System\YKaEgIr.exe
  2⤵
  PID:14356
- C:\Windows\System\ablTDcU.exe
  C:\Windows\System\ablTDcU.exe
  2⤵
  PID:14540
- C:\Windows\System\KuOAtJm.exe
  C:\Windows\System\KuOAtJm.exe
  2⤵
  PID:14424
- C:\Windows\System\npPUvJa.exe
  C:\Windows\System\npPUvJa.exe
  2⤵
  PID:15368
- C:\Windows\System\TzqIAQh.exe
  C:\Windows\System\TzqIAQh.exe
  2⤵
  PID:15404
- C:\Windows\System\rbDXKdE.exe
  C:\Windows\System\rbDXKdE.exe
  2⤵
  PID:15436
- C:\Windows\System\PtJzIVI.exe
  C:\Windows\System\PtJzIVI.exe
  2⤵
  PID:15452
- C:\Windows\System\iieapdC.exe
  C:\Windows\System\iieapdC.exe
  2⤵
  PID:15484
- C:\Windows\System\zyAyXic.exe
  C:\Windows\System\zyAyXic.exe
  2⤵
  PID:15532
- C:\Windows\System\IZNpLSP.exe
  C:\Windows\System\IZNpLSP.exe
  2⤵
  PID:15560
- C:\Windows\System\aBUsyHv.exe
  C:\Windows\System\aBUsyHv.exe
  2⤵
  PID:15576
- C:\Windows\System\AapiqBD.exe
  C:\Windows\System\AapiqBD.exe
  2⤵
  PID:15616
- C:\Windows\System\jbTRbVO.exe
  C:\Windows\System\jbTRbVO.exe
  2⤵
  PID:15648
- C:\Windows\System\EXhchsO.exe
  C:\Windows\System\EXhchsO.exe
  2⤵
  PID:15676
- C:\Windows\System\AltSTZP.exe
  C:\Windows\System\AltSTZP.exe
  2⤵
  PID:15704
- C:\Windows\System\CJLPQGy.exe
  C:\Windows\System\CJLPQGy.exe
  2⤵
  PID:15724
- C:\Windows\System\GqECkNr.exe
  C:\Windows\System\GqECkNr.exe
  2⤵
  PID:15760
- C:\Windows\System\YdOjLjw.exe
  C:\Windows\System\YdOjLjw.exe
  2⤵
  PID:15776
- C:\Windows\System\TJJPkjJ.exe
  C:\Windows\System\TJJPkjJ.exe
  2⤵
  PID:15816
- C:\Windows\System\dOSRqlP.exe
  C:\Windows\System\dOSRqlP.exe
  2⤵
  PID:15844
- C:\Windows\System\GWUMtkr.exe
  C:\Windows\System\GWUMtkr.exe
  2⤵
  PID:15872
- C:\Windows\System\DpBqBuT.exe
  C:\Windows\System\DpBqBuT.exe
  2⤵
  PID:15900
- C:\Windows\System\DfeCCER.exe
  C:\Windows\System\DfeCCER.exe
  2⤵
  PID:15916
- C:\Windows\System\FQFyYqt.exe
  C:\Windows\System\FQFyYqt.exe
  2⤵
  PID:15948
- C:\Windows\System\cPiMHOH.exe
  C:\Windows\System\cPiMHOH.exe
  2⤵
  PID:15972
- C:\Windows\System\DXXfBLb.exe
  C:\Windows\System\DXXfBLb.exe
  2⤵
  PID:15996
- C:\Windows\System\frLzDaa.exe
  C:\Windows\System\frLzDaa.exe
  2⤵
  PID:16024
- C:\Windows\System\gzcSxEl.exe
  C:\Windows\System\gzcSxEl.exe
  2⤵
  PID:16044
- C:\Windows\System\NiCseYG.exe
  C:\Windows\System\NiCseYG.exe
  2⤵
  PID:16076
- C:\Windows\System\fhEKITm.exe
  C:\Windows\System\fhEKITm.exe
  2⤵
  PID:16096
- C:\Windows\System\DaRTBfg.exe
  C:\Windows\System\DaRTBfg.exe
  2⤵
  PID:16124
- C:\Windows\System\UepkAQs.exe
  C:\Windows\System\UepkAQs.exe
  2⤵
  PID:16152
- C:\Windows\System\GFdABDI.exe
  C:\Windows\System\GFdABDI.exe
  2⤵
  PID:16196
- C:\Windows\System\XNNBPxj.exe
  C:\Windows\System\XNNBPxj.exe
  2⤵
  PID:16236
- C:\Windows\System\ZTuUiww.exe
  C:\Windows\System\ZTuUiww.exe
  2⤵
  PID:16256
- C:\Windows\System\cbKbgCi.exe
  C:\Windows\System\cbKbgCi.exe
  2⤵
  PID:16280
- C:\Windows\System\fqlPjmL.exe
  C:\Windows\System\fqlPjmL.exe
  2⤵
  PID:16320
- C:\Windows\System\DEBCkzz.exe
  C:\Windows\System\DEBCkzz.exe
  2⤵
  PID:16336
- C:\Windows\System\Fezdpgs.exe
  C:\Windows\System\Fezdpgs.exe
  2⤵
  PID:16352
- C:\Windows\System\xfyKCCY.exe
  C:\Windows\System\xfyKCCY.exe
  2⤵
  PID:16368
- C:\Windows\System\ulKGFaw.exe
  C:\Windows\System\ulKGFaw.exe
  2⤵
  PID:15472
- C:\Windows\System\UdpnFIQ.exe
  C:\Windows\System\UdpnFIQ.exe
  2⤵
  PID:15524
- C:\Windows\System\JBkiapK.exe
  C:\Windows\System\JBkiapK.exe
  2⤵
  PID:15572
- C:\Windows\System\zkcHKEz.exe
  C:\Windows\System\zkcHKEz.exe
  2⤵
  PID:15668
- C:\Windows\System\oZiHlMA.exe
  C:\Windows\System\oZiHlMA.exe
  2⤵
  PID:15748
- C:\Windows\System\zaJxylW.exe
  C:\Windows\System\zaJxylW.exe
  2⤵
  PID:15836
- C:\Windows\System\acHQykz.exe
  C:\Windows\System\acHQykz.exe
  2⤵
  PID:15868
- C:\Windows\System\GqGjSIM.exe
  C:\Windows\System\GqGjSIM.exe
  2⤵
  PID:15912
- C:\Windows\System\FFBnUdy.exe
  C:\Windows\System\FFBnUdy.exe
  2⤵
  PID:16008
- C:\Windows\System\qoCmHwg.exe
  C:\Windows\System\qoCmHwg.exe
  2⤵
  PID:16012
- C:\Windows\System\kZPfqIX.exe
  C:\Windows\System\kZPfqIX.exe
  2⤵
  PID:16084
- C:\Windows\System\VdDeoUz.exe
  C:\Windows\System\VdDeoUz.exe
  2⤵
  PID:16176
- C:\Windows\System\IawmhBk.exe
  C:\Windows\System\IawmhBk.exe
  2⤵
  PID:16232
- C:\Windows\System\ILiCzfi.exe
  C:\Windows\System\ILiCzfi.exe
  2⤵
  PID:16264
- C:\Windows\System\VXPsCAO.exe
  C:\Windows\System\VXPsCAO.exe
  2⤵
  PID:16348
- C:\Windows\System\PCtXvsY.exe
  C:\Windows\System\PCtXvsY.exe
  2⤵
  PID:15388
- C:\Windows\System\NBPMxPU.exe
  C:\Windows\System\NBPMxPU.exe
  2⤵
  PID:15736
- C:\Windows\System\qjYtszf.exe
  C:\Windows\System\qjYtszf.exe
  2⤵
  PID:15812
- C:\Windows\System\AYmilVR.exe
  C:\Windows\System\AYmilVR.exe
  2⤵
  PID:15908
- C:\Windows\System\jOuIwWN.exe
  C:\Windows\System\jOuIwWN.exe
  2⤵
  PID:16068
- C:\Windows\System\cCmnZgu.exe
  C:\Windows\System\cCmnZgu.exe
  2⤵
  PID:16276
- C:\Windows\System\TPtKJtZ.exe
  C:\Windows\System\TPtKJtZ.exe
  2⤵
  PID:16332
- C:\Windows\System\uqVWwXK.exe
  C:\Windows\System\uqVWwXK.exe
  2⤵
  PID:15636
- C:\Windows\System\JwGBaxR.exe
  C:\Windows\System\JwGBaxR.exe
  2⤵
  PID:15992
- C:\Windows\System\PaXEMkl.exe
  C:\Windows\System\PaXEMkl.exe
  2⤵
  PID:15548
- C:\Windows\System\RFlPbYz.exe
  C:\Windows\System\RFlPbYz.exe
  2⤵
  PID:16388
- C:\Windows\System\BfLYeDH.exe
  C:\Windows\System\BfLYeDH.exe
  2⤵
  PID:16428
- C:\Windows\System\ISOvGXn.exe
  C:\Windows\System\ISOvGXn.exe
  2⤵
  PID:16456
- C:\Windows\System\iedvYBb.exe
  C:\Windows\System\iedvYBb.exe
  2⤵
  PID:16484
- C:\Windows\System\wZXfemg.exe
  C:\Windows\System\wZXfemg.exe
  2⤵
  PID:16504
- C:\Windows\System\joodBVa.exe
  C:\Windows\System\joodBVa.exe
  2⤵
  PID:16540
- C:\Windows\System\airlrUW.exe
  C:\Windows\System\airlrUW.exe
  2⤵
  PID:16568
- C:\Windows\System\UBFwnYP.exe
  C:\Windows\System\UBFwnYP.exe
  2⤵
  PID:16588
- C:\Windows\System\VILHcuv.exe
  C:\Windows\System\VILHcuv.exe
  2⤵
  PID:16612
- C:\Windows\System\REUwKkv.exe
  C:\Windows\System\REUwKkv.exe
  2⤵
  PID:16636
- C:\Windows\System\OGGfwsb.exe
  C:\Windows\System\OGGfwsb.exe
  2⤵
  PID:16660
- C:\Windows\System\wSGBcEZ.exe
  C:\Windows\System\wSGBcEZ.exe
  2⤵
  PID:16692
- C:\Windows\System\mNvaWfs.exe
  C:\Windows\System\mNvaWfs.exe
  2⤵
  PID:16720
- C:\Windows\System\UIhtguU.exe
  C:\Windows\System\UIhtguU.exe
  2⤵
  PID:16752
- C:\Windows\System\qGaDBlN.exe
  C:\Windows\System\qGaDBlN.exe
  2⤵
  PID:16776
- C:\Windows\System\UXVxAuL.exe
  C:\Windows\System\UXVxAuL.exe
  2⤵
  PID:16808
- C:\Windows\System\jLrJZIg.exe
  C:\Windows\System\jLrJZIg.exe
  2⤵
  PID:16828
- C:\Windows\System\vuVsdZU.exe
  C:\Windows\System\vuVsdZU.exe
  2⤵
  PID:16848
- C:\Windows\System\yYTlyYE.exe
  C:\Windows\System\yYTlyYE.exe
  2⤵
  PID:16876
- C:\Windows\System\LVlsBpc.exe
  C:\Windows\System\LVlsBpc.exe
  2⤵
  PID:16936
- C:\Windows\System\cuwOTDZ.exe
  C:\Windows\System\cuwOTDZ.exe
  2⤵
  PID:16964
- C:\Windows\System\UwjvSqd.exe
  C:\Windows\System\UwjvSqd.exe
  2⤵
  PID:16980
- C:\Windows\System\NWsRMjR.exe
  C:\Windows\System\NWsRMjR.exe
  2⤵
  PID:16996
- C:\Windows\System\CrXIvtp.exe
  C:\Windows\System\CrXIvtp.exe
  2⤵
  PID:17016
- C:\Windows\System\PiGiHja.exe
  C:\Windows\System\PiGiHja.exe
  2⤵
  PID:17036
- C:\Windows\System\IbfxAVV.exe
  C:\Windows\System\IbfxAVV.exe
  2⤵
  PID:17060
- C:\Windows\System\LkYKbwr.exe
  C:\Windows\System\LkYKbwr.exe
  2⤵
  PID:17096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BYEUCjC.exe

Filesize
1.4MB

MD5
a3887f0ce45d4ecc27d79d339e712245

SHA1
ab42b9f033882c152a236bd05d796a299e45265a

SHA256
74a387e82b8b221aab48c2ec2b3fb70b6196bdf3596fb5fec2003717632f1211

SHA512
c01568a9a566711ed7a7be9a7ba782d8d0d871f8a4dc2fd31302bafddb139a825aed9dcdedf0eef4a174c831a64f47707184b5027ed83af69acfd9775c2e8b2a

Download Submit
C:\Windows\System\FNTTHpJ.exe

Filesize
1.4MB

MD5
c52b4c95755dd4a78b067e3c42df13ec

SHA1
43f1aff90163af573175362052e574f9617e3b96

SHA256
2ab2fedd01d0bd83fc476777ab03a8dc4304c5d386463b874197e9cf4a0b4071

SHA512
095a3c9b48aebf8e7bc834342f6dc6fb9361806895a936b2ba11e07d2137a1198e487cf2569ae81b72a49d2b776f319669fe16531aaf3c6a05baaa2da1468de3

Download Submit
C:\Windows\System\FxMLRFk.exe

Filesize
1.4MB

MD5
396a9399c900cc1d269bf20d0165f7bc

SHA1
cd9a277f8be373051f30f78fe8077e53f24c8f22

SHA256
8d6051d3d475d5128d81cbe4c3d5b0e9dd9d40cae9aca83594a155c2f896e9a8

SHA512
416f046d08bbbb1d2e99750b82ed3c859e3a50a3a1ed1f314bb5f119afc7c0458cd7e0d86469adcb1375bd2478036ad2d574fb0a7c5aabbd8f5e24b5addd0d90

Download Submit
C:\Windows\System\GeBURfu.exe

Filesize
1.4MB

MD5
b396044353f659c8960edb503342b077

SHA1
00282fed298994345c5afcd2f7e2d60fca4fe66d

SHA256
ed4a317563b282c4117345912b8482580c8b0cfeef3384c7e9ab386689fc0ef5

SHA512
1e1259c2f1276afb03fb6d6c761af9089990b7dd32d41fbd9ab794cbc2f997d7a44d25fea58044d760eb3abacb896da51572c126920d21b54641300531f3bfac

Download Submit
C:\Windows\System\GuCdkMy.exe

Filesize
1.4MB

MD5
9d72ca5120f7ddc75b0a7623e948da51

SHA1
dd31e4804f1b4fc92a94a06572d947f61a796c0a

SHA256
739406d5110a1378b78ce86a8eb0d0a223a38be61a5c833212cb40420ea5a999

SHA512
409e92314e4224aaa6958934c0f37ecb875fb1c11ec5ab84830310c315797e5bf3d19b6a7136036ca1afe8285d5290544e710eaa20ac1493235883171fdfd81b

Download Submit
C:\Windows\System\IhbDoea.exe

Filesize
1.4MB

MD5
21d5e2dfc83351196f5ab62034ec87a1

SHA1
dc7eb57bfec6e599fb25187ec9da196a24b6d168

SHA256
0822e85db6cffddc570dee9257962caa9c68e670a59266521b4952cbce390967

SHA512
b63757daaddce5bc45888d31c0f08ddce064c4d677447121b50d7872155f09cc760f9d2c48dfe3c57783492990120f03240bf081256d20b111fb6348eb923900

Download Submit
C:\Windows\System\LJRoLPt.exe

Filesize
1.4MB

MD5
102cbfe5c7c91cd662aac6c7266dd926

SHA1
0dbe66e6fb4d59b4089db7988fd0fa43abe4d4de

SHA256
0cbf505439b4057ccfbcc6d2bcfc9fa4eb93730db601666517ee1a501e1e90a5

SHA512
049e13179f56773509fedf9524a3d02fdcdfaaf5b33a974c0c7b59eb7f57f820a68afc598645e739f667d29b90d0980a0e14fe597881283d88013f824ee9f92b

Download Submit
C:\Windows\System\OjexVQR.exe

Filesize
1.4MB

MD5
84183b8a56cc27afe794b96339fdd8d4

SHA1
2f892bc4f3e53f0b0e265b2f0b9a66be323eb43a

SHA256
ef08ca34ab0aba5366e3019f710607a354dbee3a71d1cd896dda19d0b3de4409

SHA512
17ccd7c6f9a5d9c5379b582454c20e704b5cad405b35a74105ee3343f7de7eb4bf3e81f837afbd19e346906aa3d056144fe3e2320eed4b9b38c6fb6ac80efe93

Download Submit
C:\Windows\System\QgCUjrY.exe

Filesize
1.4MB

MD5
f63abc1dd3d8025f7353253d025d6534

SHA1
2793ba2d5a92d77faf29369f90a5defb47c41b66

SHA256
07d9cd5053415af09cee7c0ae4fe8c3c5f7f6768c59f07ae742937ad4f4c0412

SHA512
307da6209583366088e4e4a2c48a4401188a0e22a7a9cd7216b620edb1157a0439645e1aaf1103cf4180dff4ff3695f4de50241099d236da83c76f166b5fa584

Download Submit
C:\Windows\System\SOGOTEa.exe

Filesize
1.4MB

MD5
09058ee601cb2503cc91a12361dc6efa

SHA1
ad5dcb736d087a6406ce0eb851bb6a120caa92ee

SHA256
84bae55e291440f7d53f64ecb3ee81dcbdf313d7c1bf2f8bfdc16a6392259fe3

SHA512
3e989729ec308a446f88a54a53800119d34318e8b2e15100c0f10a9d5ba54e2c8e3cf74b772b0d7991f8c2a94555ead7509e80ef09f943cc6b004f91c4850ab4

Download Submit
C:\Windows\System\SnEnJpA.exe

Filesize
1.4MB

MD5
31aa25e345e97d7c992561d533bb714a

SHA1
c5a8de80f3703c9ae0cb19b2c9dce1a71bbff611

SHA256
d6ea54491ebea52e596344c049111f15300fa9770f5a77ca2944986800f0bf08

SHA512
adec098ff6b67e9096d87fecd3b79999320f1be296b5d37072aa9399cb477cf9f30552df7ba92808384e8b332a52f1ceb4e6be41bdde70610893b34ea8cc633b

Download Submit
C:\Windows\System\TUHYEFx.exe

Filesize
1.4MB

MD5
95f9b42ab99bad6965b25eeb87905e7b

SHA1
78cd278d44b39cd6dc16ab14d9f35b0ce15bd87e

SHA256
c28371d1deb2e4e38f327f5f4e5b8f90cb3790ac9a7b53d04dc936cd73043619

SHA512
353d63eb18f7d463b910d610193b64cb45588f6b1036a70acaf1691f4a7ad9ecc526baa00853755280c79893bd2fcc0e044bd2a5e6a3867a943e3162af7cf4a7

Download Submit
C:\Windows\System\UCinFtK.exe

Filesize
1.4MB

MD5
59705afff4f9a88c038a94ea79a3ac99

SHA1
33387e619afa95e08f15ce09f8f130b40aeb0174

SHA256
5cae1d3c27e36e6493512bc50ab6b7753bd76514572789b009505bd8fd6e2751

SHA512
0639f747fb074510e94302a77d8c4102e28f00a828b82bf8184a68e789ca66eec6679160c9f629925b1828350780041ebded18cc3fe7c15261ab3f9c4c659392

Download Submit
C:\Windows\System\XTfuvOg.exe

Filesize
1.4MB

MD5
6970b149d71e30db12a04067cba19933

SHA1
cf102855418f2b4ec72dceb2e05be944df0c9f06

SHA256
ed4558dfc27e34e50b5d91c5240e602ee4f5af0513fd1a9742fe5101d10158ea

SHA512
b2bfb7cc75cebcbcf0bbd352b3f0a6bb3e063f293727afba5ecaa1f79d71935259b8e1b44deac714b9feafa4f2a51816ac2a675478e3204ba061249a9c52ffed

Download Submit
C:\Windows\System\YZthmeV.exe

Filesize
1.4MB

MD5
1067a1c897818862806d32e661bf2c37

SHA1
f59b0f132abd2d7c009b6fa29499164759aade76

SHA256
b97dd02a06ad3e00c9c11a2c082a09700f83d4e360135e3b0e6e4badc07da952

SHA512
0979e77e5e5d4d0e03105a4de053731a8401647b6fbc83c0ff20ec55e7ba8c296dd4c6f3932a35465c8765099a2f12c2a7444ecd4219aa7116581022a1a730a4

Download Submit
C:\Windows\System\ZVbtmVL.exe

Filesize
1.4MB

MD5
5c5460ea018a751b416911fd59e47334

SHA1
7e3c880c435f10327f748e304bf9afa4fe55f59b

SHA256
0fbbc2a88cbd304ef1d69b33558d71a63b8ae02bfd094f95d5d99b6ff8e31da8

SHA512
3321ef2a016e6c89553e36c682316f78163720b0273a6838ed58b8423c47bc8d69ce2ae7e57207c81eea2433e4db813fb0a718f361b6982051011c957dde3ab2

Download Submit
C:\Windows\System\cWmAVZf.exe

Filesize
1.4MB

MD5
b68b53c09c24fa7faad3eb92c3786e8f

SHA1
72ab23b884bb675505fc89522cafe46f4e2029c6

SHA256
c6b72b90d0335df9dd833747fb62b054fcaaba31e68c077436e7cda61e7486ab

SHA512
bf15ff43d35346f6c9300578578b0e23e9bce71ab47090157d1e7c216636eb30f76967161966de15b4b6ddd27036513fb5194541832956659c417dc7e4f22328

Download Submit
C:\Windows\System\cgDLzcp.exe

Filesize
1.4MB

MD5
7106c3b0e6119f2793e30e05e6d8d626

SHA1
2e07661f96b92648ff208e677e0396697ad3743b

SHA256
7d16e75eddddb92b0fe9b1369fc493e35956c58cf6d11bc4785d9098d5288821

SHA512
279561fbd0c7800899206a01110320be05541698d6bb3cc01c11bffded10e93c93a1c863c1cd92ca431b27225112a47aa64f4e6d00d07405e25ec33626bb3c2b

Download Submit
C:\Windows\System\cgJvDSZ.exe

Filesize
1.4MB

MD5
8ff8a1f37797b0293715fe052e5ce85e

SHA1
e6586bff43fed556a0380c9558ebd2aab9d09e8c

SHA256
b234caeb4c03904bc06b88cc6baf311dd762d88f44c34af262f3f00bfcc2d375

SHA512
cb0227ed6bb31f260bd10fe842cf6429fa584b88a95bc0e520db0f4c7cbec069cb5135ffc840d9a55af5efde22be75d7b181f0389fde7d6080c27f096d69b561

Download Submit
C:\Windows\System\fZDuPUA.exe

Filesize
1.4MB

MD5
283414275a0d5f712efd0b0f8e4db904

SHA1
5a351564f8e7fc78ddf0ef16be74926de8285e2f

SHA256
fe495986afd2e6483a9abc16f70e9768e603c833a29cafa2796b1da161826382

SHA512
3eb7a0d039a92e1d4e85626e8a012c67c7bedf86e6456ae28f48e376f8c64dc52c0f33dda31f1d15761135034c835d1cfeb1d7f09d056988d727d0767427a35b

Download Submit
C:\Windows\System\gGYWiKe.exe

Filesize
1.4MB

MD5
1d760f2002b6a35497c697c124bc4f32

SHA1
a3439ec25265775b85c94b4ef1adac1b779b1773

SHA256
5d0484ae0bbd236ce378cbdc15aff7475b78d3d18c80ecfdfe0cdb5d84c8ab06

SHA512
6943e3f01cf3f43710ed219477a5a34ba271b9d7bfe87369e421c15f80e945e365470bf159d01da9eb84b88e44db3f61949fa17c85bde07bed9486742c1a8c8d

Download Submit
C:\Windows\System\ghAePSL.exe

Filesize
1.4MB

MD5
c4f81d016491b2f2603550257ae3ae05

SHA1
4f54dd150b0137b85039c029ebc0e8a7b681011b

SHA256
10e22c1143b1c8addba4515cd53852240ffd05c94f6215f2840d43b1a629de2d

SHA512
84d0e83ac283323afd3ece6a1c1b5c541df882661ba5a30f8b7c1857423fe4c69992a707fdcd6c8556a749cd2ee04bdc811ac0ebc95d9a70a45922082fc4e442

Download Submit
C:\Windows\System\goJQXNQ.exe

Filesize
1.4MB

MD5
fbd1740ab471f5b0a3d11b984999baf6

SHA1
f1ae3730fc2ba69bf11604a4036c01f6425a40a6

SHA256
7cc1e66e4ae5d0aa0275e6419f1d6a08e4f96e229a1f20205edc4ce1bdd66664

SHA512
def285dacc5f7a32c07505c811b26c245e5be41a0098666c66c67602af907077f5e9882639274f35024d7bbb1fa0a09afd313430fa31c0fa37fd7e85f215b1a6

Download Submit
C:\Windows\System\iwhfLTI.exe

Filesize
1.4MB

MD5
ca18fca5a3e785f113a6e87750723158

SHA1
b86eff2c19f814ea8730fd8cd5df2538966adfac

SHA256
5a83c6ddbbc9f7e870ddf650f9ca3fd3a0b15d3a7e729a6aa3c25155b5b3ee81

SHA512
5c61b68a1f94cb47f6f9178e22789ff3ef39f443531528a2882e87095995d1e9cf2761ce5938496256832839af46409921c8cfc051305877acda399e09228cfe

Download Submit
C:\Windows\System\pFPvcXC.exe

Filesize
1.4MB

MD5
3fe71150ea4abbb14f6f585622c6eae3

SHA1
578645a36fe651ef1f932e5868054ad245178614

SHA256
deb7e9abbcd26f2c16191e0aa7213dc60030be11c0c15ccb9e0920836b2ac9f5

SHA512
8543e407d87b9c23851c79e72eab991c745182a342d8483873be44d13a41c7749ff32b734a7a93e10c711ecb49e2508c155f53fd9ff6c108d9a77752bfb36f14

Download Submit
C:\Windows\System\pGHGaat.exe

Filesize
1.4MB

MD5
d57f3bc160eb1589ab244866779e1f11

SHA1
4c39a17924173fbf624301df1083402b5878c520

SHA256
fe6b073704ca2a0ec6dc4a97ef7ef44c60ee3bc92963daddcde2b701296e511e

SHA512
fd3454a34f20ae8699b821e37616ee33c1d0ea009f388cd2f6ebc59e786732766951392efb3ae4d04955dabe35eda6fc48e24b9540fa4a51013681ffab9429e2

Download Submit
C:\Windows\System\pOpBNFX.exe

Filesize
1.4MB

MD5
0f52ebff289419ffc333946ad5d34158

SHA1
520c02f9e16f52927d7e704421074d64bf773ee9

SHA256
2b34c87bff87163f34e0ea008acb1572d9303ad63f0eb24b8698c30e0880b132

SHA512
cb284b84968030b2ba02bb531ad06ae4c6bc26f96564122a21cf7a71d9349db7154b32bf3c7f5f087aad952a71f875dde1f492dacf273f35158627487fd8b3b6

Download Submit
C:\Windows\System\rEHGoeF.exe

Filesize
1.4MB

MD5
374b62f2dfd80b8e4e5825eeb1aaf7f3

SHA1
54d5a1f58902c75200f5d576a9df7f6ea7359688

SHA256
53f31d902709f9bfd9a79d717ff2b39db5efcfc0a4778e0badddd9c53a7605d4

SHA512
66bba9fbd83a1d84f4433b09e3d4aef5c9ff3b127795dfa45e284afa3dbe2f7df901313fed7e85bc6a57f5f7092e0d4a7b1045ca6370c95682ead30e6b5b653f

Download Submit
C:\Windows\System\rGdTtOv.exe

Filesize
1.4MB

MD5
e930204b3489968ee22d57b546e6db7a

SHA1
ab599c81317886f94aeb04edcf1d0ff072c8ac8e

SHA256
a616555216770ff85250de37e8c8f1fa438b4ff90648cb83311dc608cadce554

SHA512
b0be815c49f25b8e3a7f65d1d0542d610337574c624cb4e184aa587871c1529477adda233071798f389e7c5be222eef3b682fca76c9776b9a247d7b64701a972

Download Submit
C:\Windows\System\tJfEPUf.exe

Filesize
1.4MB

MD5
a023d98dbbaacc631436d905c7875839

SHA1
c6f9911bc74a976bebaccc57fb2d4db71ea5d37a

SHA256
ce22ad2cc5a20cac9ce52cd109925f03cc6d86ab1477a8c13841f42a6f260280

SHA512
e8a15be877a736c8f633d5510bc22e4a69cb501a1a691f9d71eedf4547fe859b4ca810730311972c0dcb8738c21e7a508b4cd2458051fe911a66de24c9094d02

Download Submit
C:\Windows\System\vGMKEbg.exe

Filesize
1.4MB

MD5
0842c0c57e01567305531a876b40ed0d

SHA1
832dfdf8223149bac5c9b7b935ff55f8bf5c9162

SHA256
6aa3d792ff8f6b74de0049e2c603ab504fbcf6a2f5275bc8c22f84bcd8521474

SHA512
d217b96d87ef80c2af7da0c776d03e6ddfcd315438296d49f9b3b6a40feb8b529efe603bb7cf3bf643c0717e4473e510de82501d79414a1ef926466847dafbdf

Download Submit
C:\Windows\System\wXBRGZq.exe

Filesize
1.4MB

MD5
e4824ff66c751f9140d6b88f3fc957b1

SHA1
e512fc4f32ad4fe024daed9c42361d4a604e34d1

SHA256
065979284946ff1ac84ce0e2b9330b6a55da5b685e752540cf48965a85f74245

SHA512
64f3220f1704e9483da0b6bdbe51685718278000ee552b9d8fb0ee40d6df23c2f33b5c4875a923c18bb87e4fd99fc405f42e9b09219580a0f8a9d52f540a4d8b

Download Submit
C:\Windows\System\wbWKPPN.exe

Filesize
1.4MB

MD5
48b5a0cdbfe02fa60ccfed8ae65cb168

SHA1
45e7fc7c03846969ec6715f665060cc375600c30

SHA256
97dcb9c75f96dae7a4706bf8d92f6323a04cc437641a7c76550997c2522efdca

SHA512
26432d9ebe660d98313729c630b538eb808bb1f6998c2818a3cdbe8593e0e35b373263e3804ab858261465b5564c1b6ad4ef83c1786f4cbc3e17f9c56a886cb4

Download Submit
memory/3000-0-0x0000025C8ECD0000-0x0000025C8ECE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads