xmrig | 8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
Size

1.4MB
MD5

776e55b94ce243c8dbde883721f818f8
SHA1

dec1bb8537e9ddead1cc3d88c009a9d9a2b4000b
SHA256

8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0
SHA512

6ac8abcceb84be241d2f952bde677937bf9609536130f9dc05cb28487e7e689fa7fe695642eceb019a6e3de686aec48ba9088a5158005dfa66df59592cc9d310
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5pbkTPLEU4s:GezaTF8FcNkNdfE0pZ9ozttwIRxeq/U

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c96-4.dat	xmrig
behavioral2/files/0x0007000000023c98-7.dat	xmrig
behavioral2/files/0x0007000000023c9a-18.dat	xmrig
behavioral2/files/0x0007000000023c99-29.dat	xmrig
behavioral2/files/0x0007000000023c9d-38.dat	xmrig
behavioral2/files/0x0007000000023c9e-55.dat	xmrig
behavioral2/files/0x0007000000023ca0-53.dat	xmrig
behavioral2/files/0x0008000000023c9f-51.dat	xmrig
behavioral2/files/0x0007000000023c9c-47.dat	xmrig
behavioral2/files/0x0007000000023c9b-45.dat	xmrig
behavioral2/files/0x0007000000023c97-20.dat	xmrig
behavioral2/files/0x0007000000023ca2-61.dat	xmrig
behavioral2/files/0x0008000000023c94-65.dat	xmrig
behavioral2/files/0x0007000000023ca5-77.dat	xmrig
behavioral2/files/0x0007000000023ca7-85.dat	xmrig
behavioral2/files/0x0007000000023ca6-83.dat	xmrig
behavioral2/files/0x0007000000023ca4-68.dat	xmrig
behavioral2/files/0x0007000000023ca8-89.dat	xmrig
behavioral2/files/0x0007000000023caa-101.dat	xmrig
behavioral2/files/0x0007000000023cab-102.dat	xmrig
behavioral2/files/0x0007000000023cac-111.dat	xmrig
behavioral2/files/0x0007000000023cae-120.dat	xmrig
behavioral2/files/0x0007000000023cad-118.dat	xmrig
behavioral2/files/0x0007000000023ca9-94.dat	xmrig
behavioral2/files/0x0007000000023caf-125.dat	xmrig
behavioral2/files/0x0007000000023cb0-129.dat	xmrig
behavioral2/files/0x0007000000023cb1-134.dat	xmrig
behavioral2/files/0x0007000000023cb3-142.dat	xmrig
behavioral2/files/0x0007000000023cb5-155.dat	xmrig
behavioral2/files/0x0007000000023cb4-153.dat	xmrig
behavioral2/files/0x0007000000023cb2-145.dat	xmrig
behavioral2/files/0x0007000000023cb6-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5044	auYDKkn.exe
4992	tJxVbPl.exe
4748	TtGGFZX.exe
2776	fLNYQwV.exe
3204	ERkmAoJ.exe
5060	wAUnbQM.exe
3496	nRoSctw.exe
1828	kAsganG.exe
3280	PAfKAov.exe
824	ZIITyDp.exe
1336	FhNLaaW.exe
4876	OOTINLf.exe
3660	fVBctQo.exe
4056	SKORoXn.exe
2320	yXGMaCd.exe
4720	mTCKuqE.exe
3260	bEhjurw.exe
856	LeETWCq.exe
4404	vfUFUtu.exe
2648	yZlJBnx.exe
3568	ndHHLVc.exe
3676	ceMICtQ.exe
1320	iTAvXwy.exe
4488	ZxpDzJW.exe
2376	cMpKUbp.exe
1088	OrMqsLl.exe
2864	XZfINln.exe
3992	vdGqlPo.exe
4892	HOjLkwQ.exe
4288	wZDalyD.exe
2624	JJVekfg.exe
2924	NzonHDz.exe
2724	MPuRXOc.exe
2252	yKnObmo.exe
4624	FoURAgx.exe
4872	woysNmn.exe
2840	kBFPFSZ.exe
1832	zJeOxan.exe
1268	mgPLame.exe
1848	ljJmciq.exe
2044	ZfBrzpA.exe
904	gfUIfgB.exe
2348	nOyIgul.exe
4040	EnGAhcX.exe
4272	AIyhczP.exe
1752	JzbmrCa.exe
2260	WksOmOc.exe
2304	hrvbCQs.exe
212	xFsrqRa.exe
4388	mgzFzgp.exe
2704	IMknFHm.exe
2604	HCQMisC.exe
2960	WKDQfda.exe
4948	bvzpbhA.exe
1300	ExfymWH.exe
4016	wJDCSSG.exe
1892	UQOrQRU.exe
5012	iRfncjp.exe
4904	BUGwSMH.exe
3232	cbueOJX.exe
3712	SJCsOux.exe
1180	aPjeImm.exe
3208	xaMKWDc.exe
992	MYkYFfh.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RCgwZDY.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ucEhjHD.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\hvsurRl.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ljJmciq.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\tjSzyfX.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\PNYfLLL.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\aBBHpQF.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\lcdZJjI.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\nWfLRDu.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\xCMSPez.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\lCTiCwA.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ebpvWgN.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\YGtlEnQ.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\fCoOVfK.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ItJpgbq.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\YAjgyVe.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\MSrtdDg.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\NLRALHh.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\CVGqyHi.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\mgzFzgp.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\zVpUjlr.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\kZCCAlc.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\uKHrUnm.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ODlZWON.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\fDaURWp.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\yXGMaCd.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ARWorCS.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\LVFnROs.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\InyokSK.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\utpWJMw.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\IPGoQtB.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\OaPRKeO.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\vjAvUTR.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\Vkjkcxz.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\HoenmPv.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\TheYXoQ.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\ZLDEnSM.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\QfiSEXv.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\nRoSctw.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\rPLAwLK.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\fmJFaWi.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\szdIoMR.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\xaMKWDc.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\sAhKcLu.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\tQxcYVY.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\TtrGBIR.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\fmorQIQ.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\wZDalyD.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\LwJyZqW.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\pgjMpvV.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\SYieoIY.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\oaOSTeh.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\cceLBZn.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\rsoZRMF.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\bWTABml.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\VDvmXha.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\mMFbDpD.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\CJcnFhe.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\LeETWCq.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\enTCzYm.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\zpHwGkk.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\RghfAIh.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\zOHmMvJ.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
File created	C:\Windows\System\LPsIxAu.exe	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 5044	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	86
PID 3024 wrote to memory of 5044	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	86
PID 3024 wrote to memory of 4992	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	87
PID 3024 wrote to memory of 4992	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	87
PID 3024 wrote to memory of 4748	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	88
PID 3024 wrote to memory of 4748	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	88
PID 3024 wrote to memory of 2776	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	89
PID 3024 wrote to memory of 2776	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	89
PID 3024 wrote to memory of 3204	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	90
PID 3024 wrote to memory of 3204	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	90
PID 3024 wrote to memory of 5060	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	91
PID 3024 wrote to memory of 5060	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	91
PID 3024 wrote to memory of 3496	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	92
PID 3024 wrote to memory of 3496	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	92
PID 3024 wrote to memory of 1828	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	93
PID 3024 wrote to memory of 1828	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	93
PID 3024 wrote to memory of 1336	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	94
PID 3024 wrote to memory of 1336	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	94
PID 3024 wrote to memory of 3280	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	95
PID 3024 wrote to memory of 3280	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	95
PID 3024 wrote to memory of 824	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	96
PID 3024 wrote to memory of 824	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	96
PID 3024 wrote to memory of 4876	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	97
PID 3024 wrote to memory of 4876	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	97
PID 3024 wrote to memory of 3660	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	98
PID 3024 wrote to memory of 3660	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	98
PID 3024 wrote to memory of 4056	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	99
PID 3024 wrote to memory of 4056	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	99
PID 3024 wrote to memory of 2320	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	100
PID 3024 wrote to memory of 2320	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	100
PID 3024 wrote to memory of 4720	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	101
PID 3024 wrote to memory of 4720	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	101
PID 3024 wrote to memory of 3260	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	102
PID 3024 wrote to memory of 3260	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	102
PID 3024 wrote to memory of 856	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	103
PID 3024 wrote to memory of 856	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	103
PID 3024 wrote to memory of 4404	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	104
PID 3024 wrote to memory of 4404	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	104
PID 3024 wrote to memory of 2648	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	105
PID 3024 wrote to memory of 2648	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	105
PID 3024 wrote to memory of 3568	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	106
PID 3024 wrote to memory of 3568	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	106
PID 3024 wrote to memory of 3676	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	107
PID 3024 wrote to memory of 3676	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	107
PID 3024 wrote to memory of 1320	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	108
PID 3024 wrote to memory of 1320	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	108
PID 3024 wrote to memory of 4488	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	109
PID 3024 wrote to memory of 4488	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	109
PID 3024 wrote to memory of 2376	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	110
PID 3024 wrote to memory of 2376	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	110
PID 3024 wrote to memory of 1088	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	111
PID 3024 wrote to memory of 1088	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	111
PID 3024 wrote to memory of 2864	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	112
PID 3024 wrote to memory of 2864	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	112
PID 3024 wrote to memory of 3992	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	113
PID 3024 wrote to memory of 3992	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	113
PID 3024 wrote to memory of 4892	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	114
PID 3024 wrote to memory of 4892	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	114
PID 3024 wrote to memory of 4288	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	115
PID 3024 wrote to memory of 4288	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	115
PID 3024 wrote to memory of 2624	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	116
PID 3024 wrote to memory of 2624	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	116
PID 3024 wrote to memory of 2924	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	117
PID 3024 wrote to memory of 2924	3024	8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe	117

C:\Users\Admin\AppData\Local\Temp\8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe
"C:\Users\Admin\AppData\Local\Temp\8136b22bf502a7243c81f02877aded36a5d1699f890f8d9b3043629393705dc0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System\auYDKkn.exe
  C:\Windows\System\auYDKkn.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\tJxVbPl.exe
  C:\Windows\System\tJxVbPl.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\TtGGFZX.exe
  C:\Windows\System\TtGGFZX.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\fLNYQwV.exe
  C:\Windows\System\fLNYQwV.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\ERkmAoJ.exe
  C:\Windows\System\ERkmAoJ.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\wAUnbQM.exe
  C:\Windows\System\wAUnbQM.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\nRoSctw.exe
  C:\Windows\System\nRoSctw.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\kAsganG.exe
  C:\Windows\System\kAsganG.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\FhNLaaW.exe
  C:\Windows\System\FhNLaaW.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\PAfKAov.exe
  C:\Windows\System\PAfKAov.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\ZIITyDp.exe
  C:\Windows\System\ZIITyDp.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\OOTINLf.exe
  C:\Windows\System\OOTINLf.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\fVBctQo.exe
  C:\Windows\System\fVBctQo.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\SKORoXn.exe
  C:\Windows\System\SKORoXn.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\yXGMaCd.exe
  C:\Windows\System\yXGMaCd.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\mTCKuqE.exe
  C:\Windows\System\mTCKuqE.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\bEhjurw.exe
  C:\Windows\System\bEhjurw.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\LeETWCq.exe
  C:\Windows\System\LeETWCq.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\vfUFUtu.exe
  C:\Windows\System\vfUFUtu.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\yZlJBnx.exe
  C:\Windows\System\yZlJBnx.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\ndHHLVc.exe
  C:\Windows\System\ndHHLVc.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\ceMICtQ.exe
  C:\Windows\System\ceMICtQ.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\iTAvXwy.exe
  C:\Windows\System\iTAvXwy.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\ZxpDzJW.exe
  C:\Windows\System\ZxpDzJW.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\cMpKUbp.exe
  C:\Windows\System\cMpKUbp.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\OrMqsLl.exe
  C:\Windows\System\OrMqsLl.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\XZfINln.exe
  C:\Windows\System\XZfINln.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\vdGqlPo.exe
  C:\Windows\System\vdGqlPo.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\HOjLkwQ.exe
  C:\Windows\System\HOjLkwQ.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\wZDalyD.exe
  C:\Windows\System\wZDalyD.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\JJVekfg.exe
  C:\Windows\System\JJVekfg.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\NzonHDz.exe
  C:\Windows\System\NzonHDz.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\MPuRXOc.exe
  C:\Windows\System\MPuRXOc.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\yKnObmo.exe
  C:\Windows\System\yKnObmo.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\FoURAgx.exe
  C:\Windows\System\FoURAgx.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\woysNmn.exe
  C:\Windows\System\woysNmn.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\kBFPFSZ.exe
  C:\Windows\System\kBFPFSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\zJeOxan.exe
  C:\Windows\System\zJeOxan.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\mgPLame.exe
  C:\Windows\System\mgPLame.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\ljJmciq.exe
  C:\Windows\System\ljJmciq.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\ZfBrzpA.exe
  C:\Windows\System\ZfBrzpA.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\gfUIfgB.exe
  C:\Windows\System\gfUIfgB.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\EnGAhcX.exe
  C:\Windows\System\EnGAhcX.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\nOyIgul.exe
  C:\Windows\System\nOyIgul.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\AIyhczP.exe
  C:\Windows\System\AIyhczP.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\JzbmrCa.exe
  C:\Windows\System\JzbmrCa.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\WksOmOc.exe
  C:\Windows\System\WksOmOc.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\hrvbCQs.exe
  C:\Windows\System\hrvbCQs.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\xFsrqRa.exe
  C:\Windows\System\xFsrqRa.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\mgzFzgp.exe
  C:\Windows\System\mgzFzgp.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\IMknFHm.exe
  C:\Windows\System\IMknFHm.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\HCQMisC.exe
  C:\Windows\System\HCQMisC.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\WKDQfda.exe
  C:\Windows\System\WKDQfda.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\bvzpbhA.exe
  C:\Windows\System\bvzpbhA.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\ExfymWH.exe
  C:\Windows\System\ExfymWH.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\wJDCSSG.exe
  C:\Windows\System\wJDCSSG.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\UQOrQRU.exe
  C:\Windows\System\UQOrQRU.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\iRfncjp.exe
  C:\Windows\System\iRfncjp.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\BUGwSMH.exe
  C:\Windows\System\BUGwSMH.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\cbueOJX.exe
  C:\Windows\System\cbueOJX.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\SJCsOux.exe
  C:\Windows\System\SJCsOux.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\aPjeImm.exe
  C:\Windows\System\aPjeImm.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\xaMKWDc.exe
  C:\Windows\System\xaMKWDc.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\MYkYFfh.exe
  C:\Windows\System\MYkYFfh.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\zxaoHGB.exe
  C:\Windows\System\zxaoHGB.exe
  2⤵
  PID:2468
- C:\Windows\System\cuLaNXl.exe
  C:\Windows\System\cuLaNXl.exe
  2⤵
  PID:4492
- C:\Windows\System\tCKYZoH.exe
  C:\Windows\System\tCKYZoH.exe
  2⤵
  PID:4512
- C:\Windows\System\hlmUwMx.exe
  C:\Windows\System\hlmUwMx.exe
  2⤵
  PID:3544
- C:\Windows\System\kHReUwO.exe
  C:\Windows\System\kHReUwO.exe
  2⤵
  PID:1424
- C:\Windows\System\AirugbE.exe
  C:\Windows\System\AirugbE.exe
  2⤵
  PID:2164
- C:\Windows\System\luLnBYt.exe
  C:\Windows\System\luLnBYt.exe
  2⤵
  PID:3388
- C:\Windows\System\VcaZfUG.exe
  C:\Windows\System\VcaZfUG.exe
  2⤵
  PID:4812
- C:\Windows\System\MKwKfYh.exe
  C:\Windows\System\MKwKfYh.exe
  2⤵
  PID:4960
- C:\Windows\System\XlaZFmI.exe
  C:\Windows\System\XlaZFmI.exe
  2⤵
  PID:3968
- C:\Windows\System\IsGPOLE.exe
  C:\Windows\System\IsGPOLE.exe
  2⤵
  PID:1392
- C:\Windows\System\wtanfHJ.exe
  C:\Windows\System\wtanfHJ.exe
  2⤵
  PID:5000
- C:\Windows\System\rVSgggO.exe
  C:\Windows\System\rVSgggO.exe
  2⤵
  PID:1896
- C:\Windows\System\zCsVZdu.exe
  C:\Windows\System\zCsVZdu.exe
  2⤵
  PID:2992
- C:\Windows\System\VYEzebp.exe
  C:\Windows\System\VYEzebp.exe
  2⤵
  PID:4452
- C:\Windows\System\XQofphZ.exe
  C:\Windows\System\XQofphZ.exe
  2⤵
  PID:1928
- C:\Windows\System\mYrxqtS.exe
  C:\Windows\System\mYrxqtS.exe
  2⤵
  PID:3784
- C:\Windows\System\pfacktK.exe
  C:\Windows\System\pfacktK.exe
  2⤵
  PID:3792
- C:\Windows\System\FyBlipY.exe
  C:\Windows\System\FyBlipY.exe
  2⤵
  PID:3492
- C:\Windows\System\MazpWaP.exe
  C:\Windows\System\MazpWaP.exe
  2⤵
  PID:1840
- C:\Windows\System\QCrupHA.exe
  C:\Windows\System\QCrupHA.exe
  2⤵
  PID:1780
- C:\Windows\System\qKyErJQ.exe
  C:\Windows\System\qKyErJQ.exe
  2⤵
  PID:2344
- C:\Windows\System\fmorQIQ.exe
  C:\Windows\System\fmorQIQ.exe
  2⤵
  PID:1584
- C:\Windows\System\lgLVTAa.exe
  C:\Windows\System\lgLVTAa.exe
  2⤵
  PID:2056
- C:\Windows\System\NgBkQtN.exe
  C:\Windows\System\NgBkQtN.exe
  2⤵
  PID:2676
- C:\Windows\System\uVwWBYb.exe
  C:\Windows\System\uVwWBYb.exe
  2⤵
  PID:1908
- C:\Windows\System\VzKYapX.exe
  C:\Windows\System\VzKYapX.exe
  2⤵
  PID:3948
- C:\Windows\System\LTyTeAX.exe
  C:\Windows\System\LTyTeAX.exe
  2⤵
  PID:2700
- C:\Windows\System\CWJnWbv.exe
  C:\Windows\System\CWJnWbv.exe
  2⤵
  PID:1296
- C:\Windows\System\sUZqxtr.exe
  C:\Windows\System\sUZqxtr.exe
  2⤵
  PID:832
- C:\Windows\System\lgmeirc.exe
  C:\Windows\System\lgmeirc.exe
  2⤵
  PID:4400
- C:\Windows\System\YrpnYPG.exe
  C:\Windows\System\YrpnYPG.exe
  2⤵
  PID:216
- C:\Windows\System\vDpHPZo.exe
  C:\Windows\System\vDpHPZo.exe
  2⤵
  PID:4916
- C:\Windows\System\cmbqaCy.exe
  C:\Windows\System\cmbqaCy.exe
  2⤵
  PID:4760
- C:\Windows\System\aPSicjc.exe
  C:\Windows\System\aPSicjc.exe
  2⤵
  PID:996
- C:\Windows\System\wSkCYpt.exe
  C:\Windows\System\wSkCYpt.exe
  2⤵
  PID:4340
- C:\Windows\System\EHaTgza.exe
  C:\Windows\System\EHaTgza.exe
  2⤵
  PID:4408
- C:\Windows\System\iIWGSQA.exe
  C:\Windows\System\iIWGSQA.exe
  2⤵
  PID:3940
- C:\Windows\System\NUZcBtH.exe
  C:\Windows\System\NUZcBtH.exe
  2⤵
  PID:5128
- C:\Windows\System\NFBOWVU.exe
  C:\Windows\System\NFBOWVU.exe
  2⤵
  PID:5148
- C:\Windows\System\cnHKaSK.exe
  C:\Windows\System\cnHKaSK.exe
  2⤵
  PID:5176
- C:\Windows\System\BcnjaWv.exe
  C:\Windows\System\BcnjaWv.exe
  2⤵
  PID:5200
- C:\Windows\System\cnfkAWv.exe
  C:\Windows\System\cnfkAWv.exe
  2⤵
  PID:5236
- C:\Windows\System\pQwaaiv.exe
  C:\Windows\System\pQwaaiv.exe
  2⤵
  PID:5256
- C:\Windows\System\PmuXPyY.exe
  C:\Windows\System\PmuXPyY.exe
  2⤵
  PID:5280
- C:\Windows\System\zWQutQK.exe
  C:\Windows\System\zWQutQK.exe
  2⤵
  PID:5308
- C:\Windows\System\XTDauRO.exe
  C:\Windows\System\XTDauRO.exe
  2⤵
  PID:5336
- C:\Windows\System\nAhEzgK.exe
  C:\Windows\System\nAhEzgK.exe
  2⤵
  PID:5364
- C:\Windows\System\WGruZRa.exe
  C:\Windows\System\WGruZRa.exe
  2⤵
  PID:5396
- C:\Windows\System\MXrhhiE.exe
  C:\Windows\System\MXrhhiE.exe
  2⤵
  PID:5424
- C:\Windows\System\VZkFPqP.exe
  C:\Windows\System\VZkFPqP.exe
  2⤵
  PID:5452
- C:\Windows\System\oRDylNd.exe
  C:\Windows\System\oRDylNd.exe
  2⤵
  PID:5476
- C:\Windows\System\NvawrQP.exe
  C:\Windows\System\NvawrQP.exe
  2⤵
  PID:5496
- C:\Windows\System\MMybuCB.exe
  C:\Windows\System\MMybuCB.exe
  2⤵
  PID:5516
- C:\Windows\System\yIFKpPx.exe
  C:\Windows\System\yIFKpPx.exe
  2⤵
  PID:5548
- C:\Windows\System\jbHCqkR.exe
  C:\Windows\System\jbHCqkR.exe
  2⤵
  PID:5576
- C:\Windows\System\qjJlGwL.exe
  C:\Windows\System\qjJlGwL.exe
  2⤵
  PID:5608
- C:\Windows\System\arqEvZw.exe
  C:\Windows\System\arqEvZw.exe
  2⤵
  PID:5640
- C:\Windows\System\BpNxBAw.exe
  C:\Windows\System\BpNxBAw.exe
  2⤵
  PID:5668
- C:\Windows\System\NFBzkaW.exe
  C:\Windows\System\NFBzkaW.exe
  2⤵
  PID:5696
- C:\Windows\System\UYBHdQm.exe
  C:\Windows\System\UYBHdQm.exe
  2⤵
  PID:5732
- C:\Windows\System\fcdBaxG.exe
  C:\Windows\System\fcdBaxG.exe
  2⤵
  PID:5756
- C:\Windows\System\PefXgqi.exe
  C:\Windows\System\PefXgqi.exe
  2⤵
  PID:5776
- C:\Windows\System\IkdYNFC.exe
  C:\Windows\System\IkdYNFC.exe
  2⤵
  PID:5796
- C:\Windows\System\kODzasa.exe
  C:\Windows\System\kODzasa.exe
  2⤵
  PID:5824
- C:\Windows\System\WghtEOa.exe
  C:\Windows\System\WghtEOa.exe
  2⤵
  PID:5856
- C:\Windows\System\MPtLyuA.exe
  C:\Windows\System\MPtLyuA.exe
  2⤵
  PID:5880
- C:\Windows\System\QwRkeJY.exe
  C:\Windows\System\QwRkeJY.exe
  2⤵
  PID:5908
- C:\Windows\System\appSMnA.exe
  C:\Windows\System\appSMnA.exe
  2⤵
  PID:5932
- C:\Windows\System\NbrUYbr.exe
  C:\Windows\System\NbrUYbr.exe
  2⤵
  PID:5960
- C:\Windows\System\BZhcSfe.exe
  C:\Windows\System\BZhcSfe.exe
  2⤵
  PID:5988
- C:\Windows\System\BbkcdKc.exe
  C:\Windows\System\BbkcdKc.exe
  2⤵
  PID:6016
- C:\Windows\System\zVpUjlr.exe
  C:\Windows\System\zVpUjlr.exe
  2⤵
  PID:6040
- C:\Windows\System\hqwRqqe.exe
  C:\Windows\System\hqwRqqe.exe
  2⤵
  PID:6072
- C:\Windows\System\RdXwWZM.exe
  C:\Windows\System\RdXwWZM.exe
  2⤵
  PID:6092
- C:\Windows\System\mjHxGry.exe
  C:\Windows\System\mjHxGry.exe
  2⤵
  PID:6116
- C:\Windows\System\Jmktcuy.exe
  C:\Windows\System\Jmktcuy.exe
  2⤵
  PID:2156
- C:\Windows\System\JQEhMbt.exe
  C:\Windows\System\JQEhMbt.exe
  2⤵
  PID:4176
- C:\Windows\System\cwHYVow.exe
  C:\Windows\System\cwHYVow.exe
  2⤵
  PID:5220
- C:\Windows\System\ydelIGP.exe
  C:\Windows\System\ydelIGP.exe
  2⤵
  PID:5272
- C:\Windows\System\xinXYij.exe
  C:\Windows\System\xinXYij.exe
  2⤵
  PID:5356
- C:\Windows\System\ygAWGiI.exe
  C:\Windows\System\ygAWGiI.exe
  2⤵
  PID:5376
- C:\Windows\System\VdPjkXo.exe
  C:\Windows\System\VdPjkXo.exe
  2⤵
  PID:5484
- C:\Windows\System\rhPZxFw.exe
  C:\Windows\System\rhPZxFw.exe
  2⤵
  PID:5560
- C:\Windows\System\sAhKcLu.exe
  C:\Windows\System\sAhKcLu.exe
  2⤵
  PID:5532
- C:\Windows\System\eIKABEn.exe
  C:\Windows\System\eIKABEn.exe
  2⤵
  PID:5620
- C:\Windows\System\GYKDEZK.exe
  C:\Windows\System\GYKDEZK.exe
  2⤵
  PID:5716
- C:\Windows\System\rElvUmk.exe
  C:\Windows\System\rElvUmk.exe
  2⤵
  PID:5788
- C:\Windows\System\kieRcgw.exe
  C:\Windows\System\kieRcgw.exe
  2⤵
  PID:5892
- C:\Windows\System\nnfgCLb.exe
  C:\Windows\System\nnfgCLb.exe
  2⤵
  PID:5904
- C:\Windows\System\OEkajSt.exe
  C:\Windows\System\OEkajSt.exe
  2⤵
  PID:6000
- C:\Windows\System\kzLMith.exe
  C:\Windows\System\kzLMith.exe
  2⤵
  PID:5952
- C:\Windows\System\bXiAgMf.exe
  C:\Windows\System\bXiAgMf.exe
  2⤵
  PID:6068
- C:\Windows\System\NYSIIEP.exe
  C:\Windows\System\NYSIIEP.exe
  2⤵
  PID:5192
- C:\Windows\System\nVhVXcn.exe
  C:\Windows\System\nVhVXcn.exe
  2⤵
  PID:5540
- C:\Windows\System\FISAmqo.exe
  C:\Windows\System\FISAmqo.exe
  2⤵
  PID:5688
- C:\Windows\System\ndawmxD.exe
  C:\Windows\System\ndawmxD.exe
  2⤵
  PID:5440
- C:\Windows\System\CVurZIO.exe
  C:\Windows\System\CVurZIO.exe
  2⤵
  PID:5852
- C:\Windows\System\heXkKnk.exe
  C:\Windows\System\heXkKnk.exe
  2⤵
  PID:5784
- C:\Windows\System\xPbbeUq.exe
  C:\Windows\System\xPbbeUq.exe
  2⤵
  PID:6036
- C:\Windows\System\spZAjbl.exe
  C:\Windows\System\spZAjbl.exe
  2⤵
  PID:5164
- C:\Windows\System\SuHCVVV.exe
  C:\Windows\System\SuHCVVV.exe
  2⤵
  PID:5984
- C:\Windows\System\AmpUHIr.exe
  C:\Windows\System\AmpUHIr.exe
  2⤵
  PID:5332
- C:\Windows\System\JfETojF.exe
  C:\Windows\System\JfETojF.exe
  2⤵
  PID:6172
- C:\Windows\System\rBOAnIQ.exe
  C:\Windows\System\rBOAnIQ.exe
  2⤵
  PID:6208
- C:\Windows\System\YhxYmTi.exe
  C:\Windows\System\YhxYmTi.exe
  2⤵
  PID:6232
- C:\Windows\System\LMhxbtH.exe
  C:\Windows\System\LMhxbtH.exe
  2⤵
  PID:6264
- C:\Windows\System\DNjoDCQ.exe
  C:\Windows\System\DNjoDCQ.exe
  2⤵
  PID:6288
- C:\Windows\System\RRhjHwa.exe
  C:\Windows\System\RRhjHwa.exe
  2⤵
  PID:6316
- C:\Windows\System\FfzVJKY.exe
  C:\Windows\System\FfzVJKY.exe
  2⤵
  PID:6344
- C:\Windows\System\cjABLAX.exe
  C:\Windows\System\cjABLAX.exe
  2⤵
  PID:6368
- C:\Windows\System\QyHLhSd.exe
  C:\Windows\System\QyHLhSd.exe
  2⤵
  PID:6396
- C:\Windows\System\fhwxbRt.exe
  C:\Windows\System\fhwxbRt.exe
  2⤵
  PID:6420
- C:\Windows\System\oaOSTeh.exe
  C:\Windows\System\oaOSTeh.exe
  2⤵
  PID:6456
- C:\Windows\System\JKCxdjG.exe
  C:\Windows\System\JKCxdjG.exe
  2⤵
  PID:6484
- C:\Windows\System\dNgrEOA.exe
  C:\Windows\System\dNgrEOA.exe
  2⤵
  PID:6512
- C:\Windows\System\WQBcwNm.exe
  C:\Windows\System\WQBcwNm.exe
  2⤵
  PID:6528
- C:\Windows\System\OrrAkYe.exe
  C:\Windows\System\OrrAkYe.exe
  2⤵
  PID:6548
- C:\Windows\System\wJiRePD.exe
  C:\Windows\System\wJiRePD.exe
  2⤵
  PID:6568
- C:\Windows\System\xlqEHwu.exe
  C:\Windows\System\xlqEHwu.exe
  2⤵
  PID:6604
- C:\Windows\System\JQRROWy.exe
  C:\Windows\System\JQRROWy.exe
  2⤵
  PID:6628
- C:\Windows\System\tRdWriY.exe
  C:\Windows\System\tRdWriY.exe
  2⤵
  PID:6660
- C:\Windows\System\rPLAwLK.exe
  C:\Windows\System\rPLAwLK.exe
  2⤵
  PID:6680
- C:\Windows\System\iQgLxfs.exe
  C:\Windows\System\iQgLxfs.exe
  2⤵
  PID:6708
- C:\Windows\System\FKcHUUl.exe
  C:\Windows\System\FKcHUUl.exe
  2⤵
  PID:6736
- C:\Windows\System\MTYnWBy.exe
  C:\Windows\System\MTYnWBy.exe
  2⤵
  PID:6768
- C:\Windows\System\bYLAsGX.exe
  C:\Windows\System\bYLAsGX.exe
  2⤵
  PID:6788
- C:\Windows\System\utpWJMw.exe
  C:\Windows\System\utpWJMw.exe
  2⤵
  PID:6816
- C:\Windows\System\mNFGwBH.exe
  C:\Windows\System\mNFGwBH.exe
  2⤵
  PID:6840
- C:\Windows\System\TxGgALN.exe
  C:\Windows\System\TxGgALN.exe
  2⤵
  PID:6864
- C:\Windows\System\TobUcOj.exe
  C:\Windows\System\TobUcOj.exe
  2⤵
  PID:6880
- C:\Windows\System\fWBzvmT.exe
  C:\Windows\System\fWBzvmT.exe
  2⤵
  PID:6912
- C:\Windows\System\DnIkKgU.exe
  C:\Windows\System\DnIkKgU.exe
  2⤵
  PID:6940
- C:\Windows\System\HRZdTCy.exe
  C:\Windows\System\HRZdTCy.exe
  2⤵
  PID:6964
- C:\Windows\System\weXklXD.exe
  C:\Windows\System\weXklXD.exe
  2⤵
  PID:6992
- C:\Windows\System\MoFcrbP.exe
  C:\Windows\System\MoFcrbP.exe
  2⤵
  PID:7016
- C:\Windows\System\aSvOVbF.exe
  C:\Windows\System\aSvOVbF.exe
  2⤵
  PID:7044
- C:\Windows\System\ywWHAfe.exe
  C:\Windows\System\ywWHAfe.exe
  2⤵
  PID:7068
- C:\Windows\System\VRsVgZJ.exe
  C:\Windows\System\VRsVgZJ.exe
  2⤵
  PID:7088
- C:\Windows\System\czJOJXA.exe
  C:\Windows\System\czJOJXA.exe
  2⤵
  PID:7112
- C:\Windows\System\DSwTYXj.exe
  C:\Windows\System\DSwTYXj.exe
  2⤵
  PID:7136
- C:\Windows\System\zUKTOmM.exe
  C:\Windows\System\zUKTOmM.exe
  2⤵
  PID:5472
- C:\Windows\System\rmxIGhH.exe
  C:\Windows\System\rmxIGhH.exe
  2⤵
  PID:5804
- C:\Windows\System\kiQkJxX.exe
  C:\Windows\System\kiQkJxX.exe
  2⤵
  PID:5412
- C:\Windows\System\tLwbZUQ.exe
  C:\Windows\System\tLwbZUQ.exe
  2⤵
  PID:6240
- C:\Windows\System\JidmJSz.exe
  C:\Windows\System\JidmJSz.exe
  2⤵
  PID:6328
- C:\Windows\System\IkvlLri.exe
  C:\Windows\System\IkvlLri.exe
  2⤵
  PID:6308
- C:\Windows\System\ebpvWgN.exe
  C:\Windows\System\ebpvWgN.exe
  2⤵
  PID:6440
- C:\Windows\System\qhoPDSh.exe
  C:\Windows\System\qhoPDSh.exe
  2⤵
  PID:6412
- C:\Windows\System\hcEHCUK.exe
  C:\Windows\System\hcEHCUK.exe
  2⤵
  PID:6520
- C:\Windows\System\ZfNlLJv.exe
  C:\Windows\System\ZfNlLJv.exe
  2⤵
  PID:6648
- C:\Windows\System\cceLBZn.exe
  C:\Windows\System\cceLBZn.exe
  2⤵
  PID:6724
- C:\Windows\System\OyZNOeL.exe
  C:\Windows\System\OyZNOeL.exe
  2⤵
  PID:6696
- C:\Windows\System\kZCCAlc.exe
  C:\Windows\System\kZCCAlc.exe
  2⤵
  PID:6904
- C:\Windows\System\qyClses.exe
  C:\Windows\System\qyClses.exe
  2⤵
  PID:6936
- C:\Windows\System\SGlQYGH.exe
  C:\Windows\System\SGlQYGH.exe
  2⤵
  PID:6976
- C:\Windows\System\zTbbbbF.exe
  C:\Windows\System\zTbbbbF.exe
  2⤵
  PID:7052
- C:\Windows\System\fKcZxfK.exe
  C:\Windows\System\fKcZxfK.exe
  2⤵
  PID:7132
- C:\Windows\System\gQivjWu.exe
  C:\Windows\System\gQivjWu.exe
  2⤵
  PID:7156
- C:\Windows\System\JMSzEfz.exe
  C:\Windows\System\JMSzEfz.exe
  2⤵
  PID:6188
- C:\Windows\System\zVttQVi.exe
  C:\Windows\System\zVttQVi.exe
  2⤵
  PID:6504
- C:\Windows\System\KEdURsw.exe
  C:\Windows\System\KEdURsw.exe
  2⤵
  PID:6620
- C:\Windows\System\HCTDoSO.exe
  C:\Windows\System\HCTDoSO.exe
  2⤵
  PID:5248
- C:\Windows\System\PSAreHD.exe
  C:\Windows\System\PSAreHD.exe
  2⤵
  PID:6780
- C:\Windows\System\ywVGqJG.exe
  C:\Windows\System\ywVGqJG.exe
  2⤵
  PID:6760
- C:\Windows\System\mhmALru.exe
  C:\Windows\System\mhmALru.exe
  2⤵
  PID:6804
- C:\Windows\System\EmHvffI.exe
  C:\Windows\System\EmHvffI.exe
  2⤵
  PID:6388
- C:\Windows\System\WhjJKrD.exe
  C:\Windows\System\WhjJKrD.exe
  2⤵
  PID:7192
- C:\Windows\System\vpIBmSW.exe
  C:\Windows\System\vpIBmSW.exe
  2⤵
  PID:7212
- C:\Windows\System\KyDeCyi.exe
  C:\Windows\System\KyDeCyi.exe
  2⤵
  PID:7236
- C:\Windows\System\sMhXqKe.exe
  C:\Windows\System\sMhXqKe.exe
  2⤵
  PID:7260
- C:\Windows\System\qcgQvOF.exe
  C:\Windows\System\qcgQvOF.exe
  2⤵
  PID:7284
- C:\Windows\System\qDPDfnv.exe
  C:\Windows\System\qDPDfnv.exe
  2⤵
  PID:7316
- C:\Windows\System\Eyojshr.exe
  C:\Windows\System\Eyojshr.exe
  2⤵
  PID:7344
- C:\Windows\System\miCbUgc.exe
  C:\Windows\System\miCbUgc.exe
  2⤵
  PID:7368
- C:\Windows\System\jHgavTl.exe
  C:\Windows\System\jHgavTl.exe
  2⤵
  PID:7396
- C:\Windows\System\KDSYnNo.exe
  C:\Windows\System\KDSYnNo.exe
  2⤵
  PID:7424
- C:\Windows\System\DuhICxP.exe
  C:\Windows\System\DuhICxP.exe
  2⤵
  PID:7452
- C:\Windows\System\TERzICW.exe
  C:\Windows\System\TERzICW.exe
  2⤵
  PID:7484
- C:\Windows\System\SbqXRPL.exe
  C:\Windows\System\SbqXRPL.exe
  2⤵
  PID:7508
- C:\Windows\System\qezmWNW.exe
  C:\Windows\System\qezmWNW.exe
  2⤵
  PID:7536
- C:\Windows\System\AwZIZFK.exe
  C:\Windows\System\AwZIZFK.exe
  2⤵
  PID:7556
- C:\Windows\System\nzkLGnQ.exe
  C:\Windows\System\nzkLGnQ.exe
  2⤵
  PID:7588
- C:\Windows\System\JztWlHg.exe
  C:\Windows\System\JztWlHg.exe
  2⤵
  PID:7616
- C:\Windows\System\YPCtKdt.exe
  C:\Windows\System\YPCtKdt.exe
  2⤵
  PID:7636
- C:\Windows\System\bnABHwm.exe
  C:\Windows\System\bnABHwm.exe
  2⤵
  PID:7668
- C:\Windows\System\whQvgoO.exe
  C:\Windows\System\whQvgoO.exe
  2⤵
  PID:7696
- C:\Windows\System\IhSuBMK.exe
  C:\Windows\System\IhSuBMK.exe
  2⤵
  PID:7720
- C:\Windows\System\ARWorCS.exe
  C:\Windows\System\ARWorCS.exe
  2⤵
  PID:7744
- C:\Windows\System\aBBHpQF.exe
  C:\Windows\System\aBBHpQF.exe
  2⤵
  PID:7772
- C:\Windows\System\jpMMTlU.exe
  C:\Windows\System\jpMMTlU.exe
  2⤵
  PID:7796
- C:\Windows\System\XJVNZSk.exe
  C:\Windows\System\XJVNZSk.exe
  2⤵
  PID:7820
- C:\Windows\System\RCgwZDY.exe
  C:\Windows\System\RCgwZDY.exe
  2⤵
  PID:7844
- C:\Windows\System\uXHQUSu.exe
  C:\Windows\System\uXHQUSu.exe
  2⤵
  PID:7876
- C:\Windows\System\UGKZekM.exe
  C:\Windows\System\UGKZekM.exe
  2⤵
  PID:7896
- C:\Windows\System\HavdzPW.exe
  C:\Windows\System\HavdzPW.exe
  2⤵
  PID:7924
- C:\Windows\System\uKHrUnm.exe
  C:\Windows\System\uKHrUnm.exe
  2⤵
  PID:7948
- C:\Windows\System\dWtZcmU.exe
  C:\Windows\System\dWtZcmU.exe
  2⤵
  PID:7980
- C:\Windows\System\tBQHXaj.exe
  C:\Windows\System\tBQHXaj.exe
  2⤵
  PID:8012
- C:\Windows\System\VAKcWio.exe
  C:\Windows\System\VAKcWio.exe
  2⤵
  PID:8048
- C:\Windows\System\fufmyku.exe
  C:\Windows\System\fufmyku.exe
  2⤵
  PID:8076
- C:\Windows\System\ZVYZTgH.exe
  C:\Windows\System\ZVYZTgH.exe
  2⤵
  PID:8108
- C:\Windows\System\sOJQKwF.exe
  C:\Windows\System\sOJQKwF.exe
  2⤵
  PID:8132
- C:\Windows\System\jBgyCfF.exe
  C:\Windows\System\jBgyCfF.exe
  2⤵
  PID:8164
- C:\Windows\System\vvRngNq.exe
  C:\Windows\System\vvRngNq.exe
  2⤵
  PID:8188
- C:\Windows\System\rKthKwO.exe
  C:\Windows\System\rKthKwO.exe
  2⤵
  PID:6612
- C:\Windows\System\rdoQpTm.exe
  C:\Windows\System\rdoQpTm.exe
  2⤵
  PID:6636
- C:\Windows\System\lcdZJjI.exe
  C:\Windows\System\lcdZJjI.exe
  2⤵
  PID:6364
- C:\Windows\System\CVXHFGB.exe
  C:\Windows\System\CVXHFGB.exe
  2⤵
  PID:7208
- C:\Windows\System\DHGbAnw.exe
  C:\Windows\System\DHGbAnw.exe
  2⤵
  PID:7280
- C:\Windows\System\uADJGdd.exe
  C:\Windows\System\uADJGdd.exe
  2⤵
  PID:7388
- C:\Windows\System\aaARmfK.exe
  C:\Windows\System\aaARmfK.exe
  2⤵
  PID:7336
- C:\Windows\System\fCGBrKS.exe
  C:\Windows\System\fCGBrKS.exe
  2⤵
  PID:7528
- C:\Windows\System\KGnpeUc.exe
  C:\Windows\System\KGnpeUc.exe
  2⤵
  PID:7576
- C:\Windows\System\oxOrMGM.exe
  C:\Windows\System\oxOrMGM.exe
  2⤵
  PID:7632
- C:\Windows\System\wFnBjmF.exe
  C:\Windows\System\wFnBjmF.exe
  2⤵
  PID:7688
- C:\Windows\System\qwxhKBR.exe
  C:\Windows\System\qwxhKBR.exe
  2⤵
  PID:7596
- C:\Windows\System\rTxqbEL.exe
  C:\Windows\System\rTxqbEL.exe
  2⤵
  PID:7504
- C:\Windows\System\QjPhKgI.exe
  C:\Windows\System\QjPhKgI.exe
  2⤵
  PID:7692
- C:\Windows\System\RGODsnx.exe
  C:\Windows\System\RGODsnx.exe
  2⤵
  PID:7684
- C:\Windows\System\dAnuvUw.exe
  C:\Windows\System\dAnuvUw.exe
  2⤵
  PID:7968
- C:\Windows\System\dHAKBDZ.exe
  C:\Windows\System\dHAKBDZ.exe
  2⤵
  PID:7856
- C:\Windows\System\PqBFJjd.exe
  C:\Windows\System\PqBFJjd.exe
  2⤵
  PID:7888
- C:\Windows\System\DMaavqo.exe
  C:\Windows\System\DMaavqo.exe
  2⤵
  PID:8064
- C:\Windows\System\IPGoQtB.exe
  C:\Windows\System\IPGoQtB.exe
  2⤵
  PID:8060
- C:\Windows\System\QcAjlaj.exe
  C:\Windows\System\QcAjlaj.exe
  2⤵
  PID:8152
- C:\Windows\System\DhvLijK.exe
  C:\Windows\System\DhvLijK.exe
  2⤵
  PID:7376
- C:\Windows\System\BvLLhWs.exe
  C:\Windows\System\BvLLhWs.exe
  2⤵
  PID:7472
- C:\Windows\System\DmQWyJQ.exe
  C:\Windows\System\DmQWyJQ.exe
  2⤵
  PID:7272
- C:\Windows\System\enTCzYm.exe
  C:\Windows\System\enTCzYm.exe
  2⤵
  PID:7480
- C:\Windows\System\ZIaCGXc.exe
  C:\Windows\System\ZIaCGXc.exe
  2⤵
  PID:7296
- C:\Windows\System\LjyZFFe.exe
  C:\Windows\System\LjyZFFe.exe
  2⤵
  PID:7444
- C:\Windows\System\wcGlhHj.exe
  C:\Windows\System\wcGlhHj.exe
  2⤵
  PID:8276
- C:\Windows\System\rnxRLvV.exe
  C:\Windows\System\rnxRLvV.exe
  2⤵
  PID:8312
- C:\Windows\System\kRSPjmy.exe
  C:\Windows\System\kRSPjmy.exe
  2⤵
  PID:8360
- C:\Windows\System\NJyESbi.exe
  C:\Windows\System\NJyESbi.exe
  2⤵
  PID:8396
- C:\Windows\System\NOdRolc.exe
  C:\Windows\System\NOdRolc.exe
  2⤵
  PID:8428
- C:\Windows\System\vvKAmLZ.exe
  C:\Windows\System\vvKAmLZ.exe
  2⤵
  PID:8452
- C:\Windows\System\wzWQfXN.exe
  C:\Windows\System\wzWQfXN.exe
  2⤵
  PID:8468
- C:\Windows\System\ZdhLytD.exe
  C:\Windows\System\ZdhLytD.exe
  2⤵
  PID:8488
- C:\Windows\System\RelFKZm.exe
  C:\Windows\System\RelFKZm.exe
  2⤵
  PID:8524
- C:\Windows\System\YFIfGFq.exe
  C:\Windows\System\YFIfGFq.exe
  2⤵
  PID:8544
- C:\Windows\System\oprFYkF.exe
  C:\Windows\System\oprFYkF.exe
  2⤵
  PID:8576
- C:\Windows\System\pUmqAgt.exe
  C:\Windows\System\pUmqAgt.exe
  2⤵
  PID:8608
- C:\Windows\System\gzFwEqf.exe
  C:\Windows\System\gzFwEqf.exe
  2⤵
  PID:8628
- C:\Windows\System\zrJMcDz.exe
  C:\Windows\System\zrJMcDz.exe
  2⤵
  PID:8648
- C:\Windows\System\rsoZRMF.exe
  C:\Windows\System\rsoZRMF.exe
  2⤵
  PID:8664
- C:\Windows\System\wVLCnjQ.exe
  C:\Windows\System\wVLCnjQ.exe
  2⤵
  PID:8696
- C:\Windows\System\UgZYrYj.exe
  C:\Windows\System\UgZYrYj.exe
  2⤵
  PID:8716
- C:\Windows\System\fmLpkFy.exe
  C:\Windows\System\fmLpkFy.exe
  2⤵
  PID:8748
- C:\Windows\System\YmKcgTj.exe
  C:\Windows\System\YmKcgTj.exe
  2⤵
  PID:8776
- C:\Windows\System\PZtpnqA.exe
  C:\Windows\System\PZtpnqA.exe
  2⤵
  PID:8800
- C:\Windows\System\aIsuLic.exe
  C:\Windows\System\aIsuLic.exe
  2⤵
  PID:8816
- C:\Windows\System\VpIwygE.exe
  C:\Windows\System\VpIwygE.exe
  2⤵
  PID:8840
- C:\Windows\System\wbHvJIF.exe
  C:\Windows\System\wbHvJIF.exe
  2⤵
  PID:8868
- C:\Windows\System\fmJFaWi.exe
  C:\Windows\System\fmJFaWi.exe
  2⤵
  PID:8896
- C:\Windows\System\IldhNFQ.exe
  C:\Windows\System\IldhNFQ.exe
  2⤵
  PID:8916
- C:\Windows\System\cgomNDU.exe
  C:\Windows\System\cgomNDU.exe
  2⤵
  PID:8940
- C:\Windows\System\cLMIFcP.exe
  C:\Windows\System\cLMIFcP.exe
  2⤵
  PID:8968
- C:\Windows\System\AEeWBUE.exe
  C:\Windows\System\AEeWBUE.exe
  2⤵
  PID:8988
- C:\Windows\System\gwmnqMh.exe
  C:\Windows\System\gwmnqMh.exe
  2⤵
  PID:9012
- C:\Windows\System\kgvUAWm.exe
  C:\Windows\System\kgvUAWm.exe
  2⤵
  PID:9032
- C:\Windows\System\WDaZXui.exe
  C:\Windows\System\WDaZXui.exe
  2⤵
  PID:9060
- C:\Windows\System\sUPCdfS.exe
  C:\Windows\System\sUPCdfS.exe
  2⤵
  PID:9088
- C:\Windows\System\QoBGqmD.exe
  C:\Windows\System\QoBGqmD.exe
  2⤵
  PID:9112
- C:\Windows\System\riFcmCu.exe
  C:\Windows\System\riFcmCu.exe
  2⤵
  PID:9140
- C:\Windows\System\tLhcdIC.exe
  C:\Windows\System\tLhcdIC.exe
  2⤵
  PID:9168
- C:\Windows\System\nFaxaAZ.exe
  C:\Windows\System\nFaxaAZ.exe
  2⤵
  PID:9184
- C:\Windows\System\dUdnqSS.exe
  C:\Windows\System\dUdnqSS.exe
  2⤵
  PID:9204
- C:\Windows\System\WuCWVHT.exe
  C:\Windows\System\WuCWVHT.exe
  2⤵
  PID:7716
- C:\Windows\System\kjoHssV.exe
  C:\Windows\System\kjoHssV.exe
  2⤵
  PID:7832
- C:\Windows\System\Ilxezir.exe
  C:\Windows\System\Ilxezir.exe
  2⤵
  PID:8180
- C:\Windows\System\vSgCTkN.exe
  C:\Windows\System\vSgCTkN.exe
  2⤵
  PID:8200
- C:\Windows\System\wdjtYnO.exe
  C:\Windows\System\wdjtYnO.exe
  2⤵
  PID:8284
- C:\Windows\System\ObTmieC.exe
  C:\Windows\System\ObTmieC.exe
  2⤵
  PID:8344
- C:\Windows\System\LwJyZqW.exe
  C:\Windows\System\LwJyZqW.exe
  2⤵
  PID:8376
- C:\Windows\System\XAgIEhF.exe
  C:\Windows\System\XAgIEhF.exe
  2⤵
  PID:8404
- C:\Windows\System\fCoOVfK.exe
  C:\Windows\System\fCoOVfK.exe
  2⤵
  PID:8572
- C:\Windows\System\IphAIaZ.exe
  C:\Windows\System\IphAIaZ.exe
  2⤵
  PID:8636
- C:\Windows\System\OpXnyac.exe
  C:\Windows\System\OpXnyac.exe
  2⤵
  PID:8508
- C:\Windows\System\aIffRoH.exe
  C:\Windows\System\aIffRoH.exe
  2⤵
  PID:8764
- C:\Windows\System\ZanTSCM.exe
  C:\Windows\System\ZanTSCM.exe
  2⤵
  PID:8836
- C:\Windows\System\xRwrZUj.exe
  C:\Windows\System\xRwrZUj.exe
  2⤵
  PID:8692
- C:\Windows\System\klnNYkX.exe
  C:\Windows\System\klnNYkX.exe
  2⤵
  PID:8724
- C:\Windows\System\PhbbgbN.exe
  C:\Windows\System\PhbbgbN.exe
  2⤵
  PID:8772
- C:\Windows\System\QSZFAKw.exe
  C:\Windows\System\QSZFAKw.exe
  2⤵
  PID:8684
- C:\Windows\System\GNFlOoM.exe
  C:\Windows\System\GNFlOoM.exe
  2⤵
  PID:8964
- C:\Windows\System\MRanjXG.exe
  C:\Windows\System\MRanjXG.exe
  2⤵
  PID:9076
- C:\Windows\System\pTAbvpf.exe
  C:\Windows\System\pTAbvpf.exe
  2⤵
  PID:9096
- C:\Windows\System\uMvwuao.exe
  C:\Windows\System\uMvwuao.exe
  2⤵
  PID:9196
- C:\Windows\System\mNXUlOH.exe
  C:\Windows\System\mNXUlOH.exe
  2⤵
  PID:9052
- C:\Windows\System\MuHCStM.exe
  C:\Windows\System\MuHCStM.exe
  2⤵
  PID:9160
- C:\Windows\System\eRySXfE.exe
  C:\Windows\System\eRySXfE.exe
  2⤵
  PID:9128
- C:\Windows\System\PXtfbyu.exe
  C:\Windows\System\PXtfbyu.exe
  2⤵
  PID:8880
- C:\Windows\System\bdLsszP.exe
  C:\Windows\System\bdLsszP.exe
  2⤵
  PID:9152
- C:\Windows\System\eSspVlY.exe
  C:\Windows\System\eSspVlY.exe
  2⤵
  PID:9244
- C:\Windows\System\BJbkJtg.exe
  C:\Windows\System\BJbkJtg.exe
  2⤵
  PID:9268
- C:\Windows\System\OlKlkiV.exe
  C:\Windows\System\OlKlkiV.exe
  2⤵
  PID:9300
- C:\Windows\System\KSKDMTk.exe
  C:\Windows\System\KSKDMTk.exe
  2⤵
  PID:9336
- C:\Windows\System\VYnPPze.exe
  C:\Windows\System\VYnPPze.exe
  2⤵
  PID:9360
- C:\Windows\System\zpHwGkk.exe
  C:\Windows\System\zpHwGkk.exe
  2⤵
  PID:9380
- C:\Windows\System\baRtWiu.exe
  C:\Windows\System\baRtWiu.exe
  2⤵
  PID:9412
- C:\Windows\System\bWTABml.exe
  C:\Windows\System\bWTABml.exe
  2⤵
  PID:9440
- C:\Windows\System\mKCZSeP.exe
  C:\Windows\System\mKCZSeP.exe
  2⤵
  PID:9464
- C:\Windows\System\YQTlfZk.exe
  C:\Windows\System\YQTlfZk.exe
  2⤵
  PID:9488
- C:\Windows\System\MROTOco.exe
  C:\Windows\System\MROTOco.exe
  2⤵
  PID:9520
- C:\Windows\System\srpgEcI.exe
  C:\Windows\System\srpgEcI.exe
  2⤵
  PID:9544
- C:\Windows\System\QaIFqRf.exe
  C:\Windows\System\QaIFqRf.exe
  2⤵
  PID:9564
- C:\Windows\System\pNyMvab.exe
  C:\Windows\System\pNyMvab.exe
  2⤵
  PID:9600
- C:\Windows\System\GMTeOhy.exe
  C:\Windows\System\GMTeOhy.exe
  2⤵
  PID:9624
- C:\Windows\System\obldehZ.exe
  C:\Windows\System\obldehZ.exe
  2⤵
  PID:9648
- C:\Windows\System\WoOvWSe.exe
  C:\Windows\System\WoOvWSe.exe
  2⤵
  PID:9668
- C:\Windows\System\UTCycyV.exe
  C:\Windows\System\UTCycyV.exe
  2⤵
  PID:9688
- C:\Windows\System\OoBmCUI.exe
  C:\Windows\System\OoBmCUI.exe
  2⤵
  PID:9712
- C:\Windows\System\uIbaJsO.exe
  C:\Windows\System\uIbaJsO.exe
  2⤵
  PID:9732
- C:\Windows\System\uGVLDfZ.exe
  C:\Windows\System\uGVLDfZ.exe
  2⤵
  PID:9760
- C:\Windows\System\vfydUkz.exe
  C:\Windows\System\vfydUkz.exe
  2⤵
  PID:9788
- C:\Windows\System\UTgvqve.exe
  C:\Windows\System\UTgvqve.exe
  2⤵
  PID:9988
- C:\Windows\System\JogJJjB.exe
  C:\Windows\System\JogJJjB.exe
  2⤵
  PID:10072
- C:\Windows\System\hWAuQQp.exe
  C:\Windows\System\hWAuQQp.exe
  2⤵
  PID:10108
- C:\Windows\System\MyMlncA.exe
  C:\Windows\System\MyMlncA.exe
  2⤵
  PID:10160
- C:\Windows\System\VastaCc.exe
  C:\Windows\System\VastaCc.exe
  2⤵
  PID:10176
- C:\Windows\System\iRRjIaX.exe
  C:\Windows\System\iRRjIaX.exe
  2⤵
  PID:10192
- C:\Windows\System\dYvuuxm.exe
  C:\Windows\System\dYvuuxm.exe
  2⤵
  PID:10216
- C:\Windows\System\UHNUFzJ.exe
  C:\Windows\System\UHNUFzJ.exe
  2⤵
  PID:9176
- C:\Windows\System\otSGjCY.exe
  C:\Windows\System\otSGjCY.exe
  2⤵
  PID:8328
- C:\Windows\System\LGSWeVO.exe
  C:\Windows\System\LGSWeVO.exe
  2⤵
  PID:8484
- C:\Windows\System\fdXGBiC.exe
  C:\Windows\System\fdXGBiC.exe
  2⤵
  PID:9264
- C:\Windows\System\BbEscII.exe
  C:\Windows\System\BbEscII.exe
  2⤵
  PID:9212
- C:\Windows\System\osqlRyr.exe
  C:\Windows\System\osqlRyr.exe
  2⤵
  PID:9352
- C:\Windows\System\pHFFETs.exe
  C:\Windows\System\pHFFETs.exe
  2⤵
  PID:8744
- C:\Windows\System\szdIoMR.exe
  C:\Windows\System\szdIoMR.exe
  2⤵
  PID:9436
- C:\Windows\System\mpgdAcN.exe
  C:\Windows\System\mpgdAcN.exe
  2⤵
  PID:9292
- C:\Windows\System\TIEavtV.exe
  C:\Windows\System\TIEavtV.exe
  2⤵
  PID:9560
- C:\Windows\System\irHhJpP.exe
  C:\Windows\System\irHhJpP.exe
  2⤵
  PID:9408
- C:\Windows\System\mjmgtYX.exe
  C:\Windows\System\mjmgtYX.exe
  2⤵
  PID:9532
- C:\Windows\System\NROzQCV.exe
  C:\Windows\System\NROzQCV.exe
  2⤵
  PID:9512
- C:\Windows\System\LPbYcZr.exe
  C:\Windows\System\LPbYcZr.exe
  2⤵
  PID:9644
- C:\Windows\System\trjYXpU.exe
  C:\Windows\System\trjYXpU.exe
  2⤵
  PID:9756
- C:\Windows\System\ozHuXhq.exe
  C:\Windows\System\ozHuXhq.exe
  2⤵
  PID:9776
- C:\Windows\System\hmpddmd.exe
  C:\Windows\System\hmpddmd.exe
  2⤵
  PID:9800
- C:\Windows\System\JdGaKPw.exe
  C:\Windows\System\JdGaKPw.exe
  2⤵
  PID:10032
- C:\Windows\System\NLRALHh.exe
  C:\Windows\System\NLRALHh.exe
  2⤵
  PID:10064
- C:\Windows\System\HODqlgw.exe
  C:\Windows\System\HODqlgw.exe
  2⤵
  PID:10092
- C:\Windows\System\vCXlPfg.exe
  C:\Windows\System\vCXlPfg.exe
  2⤵
  PID:10136
- C:\Windows\System\xctdqaC.exe
  C:\Windows\System\xctdqaC.exe
  2⤵
  PID:10204
- C:\Windows\System\tntdlGr.exe
  C:\Windows\System\tntdlGr.exe
  2⤵
  PID:9108
- C:\Windows\System\LZvKuaM.exe
  C:\Windows\System\LZvKuaM.exe
  2⤵
  PID:9348
- C:\Windows\System\CCWNJwr.exe
  C:\Windows\System\CCWNJwr.exe
  2⤵
  PID:9432
- C:\Windows\System\wXQkFuq.exe
  C:\Windows\System\wXQkFuq.exe
  2⤵
  PID:9312
- C:\Windows\System\VnaNSmJ.exe
  C:\Windows\System\VnaNSmJ.exe
  2⤵
  PID:9556
- C:\Windows\System\rKZNTKa.exe
  C:\Windows\System\rKZNTKa.exe
  2⤵
  PID:9676
- C:\Windows\System\bJbwIlZ.exe
  C:\Windows\System\bJbwIlZ.exe
  2⤵
  PID:10052
- C:\Windows\System\KbdRckb.exe
  C:\Windows\System\KbdRckb.exe
  2⤵
  PID:10100
- C:\Windows\System\voWaBrW.exe
  C:\Windows\System\voWaBrW.exe
  2⤵
  PID:9236
- C:\Windows\System\HbhwjUj.exe
  C:\Windows\System\HbhwjUj.exe
  2⤵
  PID:8144
- C:\Windows\System\UPFYwUh.exe
  C:\Windows\System\UPFYwUh.exe
  2⤵
  PID:9316
- C:\Windows\System\RghfAIh.exe
  C:\Windows\System\RghfAIh.exe
  2⤵
  PID:10260
- C:\Windows\System\AgmAYSW.exe
  C:\Windows\System\AgmAYSW.exe
  2⤵
  PID:10288
- C:\Windows\System\HoenmPv.exe
  C:\Windows\System\HoenmPv.exe
  2⤵
  PID:10316
- C:\Windows\System\jsJHRfI.exe
  C:\Windows\System\jsJHRfI.exe
  2⤵
  PID:10336
- C:\Windows\System\IOjqGki.exe
  C:\Windows\System\IOjqGki.exe
  2⤵
  PID:10368
- C:\Windows\System\AXdhpbv.exe
  C:\Windows\System\AXdhpbv.exe
  2⤵
  PID:10388
- C:\Windows\System\WFxdWcC.exe
  C:\Windows\System\WFxdWcC.exe
  2⤵
  PID:10408
- C:\Windows\System\PgJUQSB.exe
  C:\Windows\System\PgJUQSB.exe
  2⤵
  PID:10440
- C:\Windows\System\wwHspJb.exe
  C:\Windows\System\wwHspJb.exe
  2⤵
  PID:10464
- C:\Windows\System\PXictGp.exe
  C:\Windows\System\PXictGp.exe
  2⤵
  PID:10488
- C:\Windows\System\pEOUydk.exe
  C:\Windows\System\pEOUydk.exe
  2⤵
  PID:10512
- C:\Windows\System\VgSBnRq.exe
  C:\Windows\System\VgSBnRq.exe
  2⤵
  PID:10536
- C:\Windows\System\udEFblf.exe
  C:\Windows\System\udEFblf.exe
  2⤵
  PID:10556
- C:\Windows\System\CgKNFxK.exe
  C:\Windows\System\CgKNFxK.exe
  2⤵
  PID:10580
- C:\Windows\System\PbDWXOV.exe
  C:\Windows\System\PbDWXOV.exe
  2⤵
  PID:10600
- C:\Windows\System\ILEFXkQ.exe
  C:\Windows\System\ILEFXkQ.exe
  2⤵
  PID:10640
- C:\Windows\System\GUyciby.exe
  C:\Windows\System\GUyciby.exe
  2⤵
  PID:10660
- C:\Windows\System\pRMliFl.exe
  C:\Windows\System\pRMliFl.exe
  2⤵
  PID:10696
- C:\Windows\System\qqjpWLx.exe
  C:\Windows\System\qqjpWLx.exe
  2⤵
  PID:10712
- C:\Windows\System\VEZDfpG.exe
  C:\Windows\System\VEZDfpG.exe
  2⤵
  PID:10732
- C:\Windows\System\kfidcoT.exe
  C:\Windows\System\kfidcoT.exe
  2⤵
  PID:10760
- C:\Windows\System\DmDNrjz.exe
  C:\Windows\System\DmDNrjz.exe
  2⤵
  PID:10784
- C:\Windows\System\GqgXntG.exe
  C:\Windows\System\GqgXntG.exe
  2⤵
  PID:10816
- C:\Windows\System\KqkKVMN.exe
  C:\Windows\System\KqkKVMN.exe
  2⤵
  PID:10832
- C:\Windows\System\YGtlEnQ.exe
  C:\Windows\System\YGtlEnQ.exe
  2⤵
  PID:10856
- C:\Windows\System\zOHmMvJ.exe
  C:\Windows\System\zOHmMvJ.exe
  2⤵
  PID:10876
- C:\Windows\System\OTgRjlC.exe
  C:\Windows\System\OTgRjlC.exe
  2⤵
  PID:10900
- C:\Windows\System\AdZEQuA.exe
  C:\Windows\System\AdZEQuA.exe
  2⤵
  PID:10920
- C:\Windows\System\AUAcsQt.exe
  C:\Windows\System\AUAcsQt.exe
  2⤵
  PID:10944
- C:\Windows\System\HXPgQWA.exe
  C:\Windows\System\HXPgQWA.exe
  2⤵
  PID:10976
- C:\Windows\System\KPeydqY.exe
  C:\Windows\System\KPeydqY.exe
  2⤵
  PID:11000
- C:\Windows\System\QSPutxw.exe
  C:\Windows\System\QSPutxw.exe
  2⤵
  PID:11028
- C:\Windows\System\YgqcUSC.exe
  C:\Windows\System\YgqcUSC.exe
  2⤵
  PID:11056
- C:\Windows\System\mUjavFl.exe
  C:\Windows\System\mUjavFl.exe
  2⤵
  PID:11084
- C:\Windows\System\kZDeqUY.exe
  C:\Windows\System\kZDeqUY.exe
  2⤵
  PID:11104
- C:\Windows\System\nhdOdmo.exe
  C:\Windows\System\nhdOdmo.exe
  2⤵
  PID:11128
- C:\Windows\System\nxTDucW.exe
  C:\Windows\System\nxTDucW.exe
  2⤵
  PID:11144
- C:\Windows\System\TMQjAsA.exe
  C:\Windows\System\TMQjAsA.exe
  2⤵
  PID:11164
- C:\Windows\System\BbOhVdZ.exe
  C:\Windows\System\BbOhVdZ.exe
  2⤵
  PID:11184
- C:\Windows\System\myADedw.exe
  C:\Windows\System\myADedw.exe
  2⤵
  PID:11204
- C:\Windows\System\oxoxnwe.exe
  C:\Windows\System\oxoxnwe.exe
  2⤵
  PID:11228
- C:\Windows\System\UCapRDw.exe
  C:\Windows\System\UCapRDw.exe
  2⤵
  PID:11260
- C:\Windows\System\jhWITQR.exe
  C:\Windows\System\jhWITQR.exe
  2⤵
  PID:9632
- C:\Windows\System\rOSpvtU.exe
  C:\Windows\System\rOSpvtU.exe
  2⤵
  PID:10252
- C:\Windows\System\FcTAyBU.exe
  C:\Windows\System\FcTAyBU.exe
  2⤵
  PID:10308
- C:\Windows\System\vnOjcBk.exe
  C:\Windows\System\vnOjcBk.exe
  2⤵
  PID:10332
- C:\Windows\System\OBvtjkx.exe
  C:\Windows\System\OBvtjkx.exe
  2⤵
  PID:10484
- C:\Windows\System\mkKqnBv.exe
  C:\Windows\System\mkKqnBv.exe
  2⤵
  PID:10360
- C:\Windows\System\rVKVWfh.exe
  C:\Windows\System\rVKVWfh.exe
  2⤵
  PID:9636
- C:\Windows\System\vQnbckB.exe
  C:\Windows\System\vQnbckB.exe
  2⤵
  PID:10248
- C:\Windows\System\nWfLRDu.exe
  C:\Windows\System\nWfLRDu.exe
  2⤵
  PID:10684
- C:\Windows\System\AeIFcKe.exe
  C:\Windows\System\AeIFcKe.exe
  2⤵
  PID:10548
- C:\Windows\System\MTWYTEC.exe
  C:\Windows\System\MTWYTEC.exe
  2⤵
  PID:10800
- C:\Windows\System\DhVsBDI.exe
  C:\Windows\System\DhVsBDI.exe
  2⤵
  PID:10612
- C:\Windows\System\fIoKSvg.exe
  C:\Windows\System\fIoKSvg.exe
  2⤵
  PID:10928
- C:\Windows\System\pbWgSYg.exe
  C:\Windows\System\pbWgSYg.exe
  2⤵
  PID:10504
- C:\Windows\System\cGMGhCw.exe
  C:\Windows\System\cGMGhCw.exe
  2⤵
  PID:10744
- C:\Windows\System\OnZMkff.exe
  C:\Windows\System\OnZMkff.exe
  2⤵
  PID:11076
- C:\Windows\System\OrUzjvA.exe
  C:\Windows\System\OrUzjvA.exe
  2⤵
  PID:11120
- C:\Windows\System\qmUdQGe.exe
  C:\Windows\System\qmUdQGe.exe
  2⤵
  PID:10624
- C:\Windows\System\UHCnedz.exe
  C:\Windows\System\UHCnedz.exe
  2⤵
  PID:11196
- C:\Windows\System\gsOlFbm.exe
  C:\Windows\System\gsOlFbm.exe
  2⤵
  PID:10968
- C:\Windows\System\vGhMpQn.exe
  C:\Windows\System\vGhMpQn.exe
  2⤵
  PID:10728
- C:\Windows\System\cWbLiGl.exe
  C:\Windows\System\cWbLiGl.exe
  2⤵
  PID:10768
- C:\Windows\System\wQaWpOJ.exe
  C:\Windows\System\wQaWpOJ.exe
  2⤵
  PID:11068
- C:\Windows\System\XguUzqN.exe
  C:\Windows\System\XguUzqN.exe
  2⤵
  PID:10756
- C:\Windows\System\oHUmfnf.exe
  C:\Windows\System\oHUmfnf.exe
  2⤵
  PID:11288
- C:\Windows\System\GYgQPBw.exe
  C:\Windows\System\GYgQPBw.exe
  2⤵
  PID:11316
- C:\Windows\System\pgjMpvV.exe
  C:\Windows\System\pgjMpvV.exe
  2⤵
  PID:11336
- C:\Windows\System\jMxMbds.exe
  C:\Windows\System\jMxMbds.exe
  2⤵
  PID:11360
- C:\Windows\System\oNYyJwe.exe
  C:\Windows\System\oNYyJwe.exe
  2⤵
  PID:11380
- C:\Windows\System\XnGuPeb.exe
  C:\Windows\System\XnGuPeb.exe
  2⤵
  PID:11400
- C:\Windows\System\tzqLzMA.exe
  C:\Windows\System\tzqLzMA.exe
  2⤵
  PID:11424
- C:\Windows\System\gnbOABt.exe
  C:\Windows\System\gnbOABt.exe
  2⤵
  PID:11456
- C:\Windows\System\XCywrJX.exe
  C:\Windows\System\XCywrJX.exe
  2⤵
  PID:11476
- C:\Windows\System\JqujCRD.exe
  C:\Windows\System\JqujCRD.exe
  2⤵
  PID:11496
- C:\Windows\System\MlWoMcb.exe
  C:\Windows\System\MlWoMcb.exe
  2⤵
  PID:11540
- C:\Windows\System\jWHKHpE.exe
  C:\Windows\System\jWHKHpE.exe
  2⤵
  PID:11560
- C:\Windows\System\AysjaUG.exe
  C:\Windows\System\AysjaUG.exe
  2⤵
  PID:11584
- C:\Windows\System\HdIXvgy.exe
  C:\Windows\System\HdIXvgy.exe
  2⤵
  PID:11608
- C:\Windows\System\PVPFZxl.exe
  C:\Windows\System\PVPFZxl.exe
  2⤵
  PID:11624
- C:\Windows\System\DYdfFSB.exe
  C:\Windows\System\DYdfFSB.exe
  2⤵
  PID:11664
- C:\Windows\System\FJpMqCy.exe
  C:\Windows\System\FJpMqCy.exe
  2⤵
  PID:11688
- C:\Windows\System\TcpfFZf.exe
  C:\Windows\System\TcpfFZf.exe
  2⤵
  PID:11712
- C:\Windows\System\AJUAXzH.exe
  C:\Windows\System\AJUAXzH.exe
  2⤵
  PID:11736
- C:\Windows\System\GYDRRhy.exe
  C:\Windows\System\GYDRRhy.exe
  2⤵
  PID:11756
- C:\Windows\System\nUIzJef.exe
  C:\Windows\System\nUIzJef.exe
  2⤵
  PID:11784
- C:\Windows\System\YFFLfng.exe
  C:\Windows\System\YFFLfng.exe
  2⤵
  PID:11812
- C:\Windows\System\oUVyiDa.exe
  C:\Windows\System\oUVyiDa.exe
  2⤵
  PID:11828
- C:\Windows\System\NTLSyzA.exe
  C:\Windows\System\NTLSyzA.exe
  2⤵
  PID:11852
- C:\Windows\System\msiAuPQ.exe
  C:\Windows\System\msiAuPQ.exe
  2⤵
  PID:11884
- C:\Windows\System\NDTDDUj.exe
  C:\Windows\System\NDTDDUj.exe
  2⤵
  PID:11908
- C:\Windows\System\GKMlLfA.exe
  C:\Windows\System\GKMlLfA.exe
  2⤵
  PID:11940
- C:\Windows\System\Cdvuppo.exe
  C:\Windows\System\Cdvuppo.exe
  2⤵
  PID:11968
- C:\Windows\System\VTuQjQt.exe
  C:\Windows\System\VTuQjQt.exe
  2⤵
  PID:11996
- C:\Windows\System\WNEmpAc.exe
  C:\Windows\System\WNEmpAc.exe
  2⤵
  PID:12016
- C:\Windows\System\VtpMoCW.exe
  C:\Windows\System\VtpMoCW.exe
  2⤵
  PID:12040
- C:\Windows\System\dEiCslD.exe
  C:\Windows\System\dEiCslD.exe
  2⤵
  PID:12064
- C:\Windows\System\vaqTHfD.exe
  C:\Windows\System\vaqTHfD.exe
  2⤵
  PID:12092
- C:\Windows\System\iZPbMUo.exe
  C:\Windows\System\iZPbMUo.exe
  2⤵
  PID:12120
- C:\Windows\System\VDvmXha.exe
  C:\Windows\System\VDvmXha.exe
  2⤵
  PID:12144
- C:\Windows\System\wezTMiS.exe
  C:\Windows\System\wezTMiS.exe
  2⤵
  PID:12168
- C:\Windows\System\WqYuFOI.exe
  C:\Windows\System\WqYuFOI.exe
  2⤵
  PID:12192
- C:\Windows\System\BfPrREi.exe
  C:\Windows\System\BfPrREi.exe
  2⤵
  PID:12220
- C:\Windows\System\tjSzyfX.exe
  C:\Windows\System\tjSzyfX.exe
  2⤵
  PID:12248
- C:\Windows\System\HiEOfFC.exe
  C:\Windows\System\HiEOfFC.exe
  2⤵
  PID:12268
- C:\Windows\System\ODlZWON.exe
  C:\Windows\System\ODlZWON.exe
  2⤵
  PID:11172
- C:\Windows\System\DtXtZXj.exe
  C:\Windows\System\DtXtZXj.exe
  2⤵
  PID:11020
- C:\Windows\System\eaaFTHw.exe
  C:\Windows\System\eaaFTHw.exe
  2⤵
  PID:10328
- C:\Windows\System\vXlLeQG.exe
  C:\Windows\System\vXlLeQG.exe
  2⤵
  PID:10936
- C:\Windows\System\UpdrBEA.exe
  C:\Windows\System\UpdrBEA.exe
  2⤵
  PID:10236
- C:\Windows\System\OaPRKeO.exe
  C:\Windows\System\OaPRKeO.exe
  2⤵
  PID:11180
- C:\Windows\System\eEkjoUy.exe
  C:\Windows\System\eEkjoUy.exe
  2⤵
  PID:11324
- C:\Windows\System\lKOxolZ.exe
  C:\Windows\System\lKOxolZ.exe
  2⤵
  PID:1652
- C:\Windows\System\lfSJudK.exe
  C:\Windows\System\lfSJudK.exe
  2⤵
  PID:10508
- C:\Windows\System\yBLBXBW.exe
  C:\Windows\System\yBLBXBW.exe
  2⤵
  PID:11464
- C:\Windows\System\JOrsIAb.exe
  C:\Windows\System\JOrsIAb.exe
  2⤵
  PID:11224
- C:\Windows\System\UfRNdZj.exe
  C:\Windows\System\UfRNdZj.exe
  2⤵
  PID:10432
- C:\Windows\System\kRHWORJ.exe
  C:\Windows\System\kRHWORJ.exe
  2⤵
  PID:11672
- C:\Windows\System\KEAIRRq.exe
  C:\Windows\System\KEAIRRq.exe
  2⤵
  PID:11744
- C:\Windows\System\NffnzOO.exe
  C:\Windows\System\NffnzOO.exe
  2⤵
  PID:11844
- C:\Windows\System\yoqSVRY.exe
  C:\Windows\System\yoqSVRY.exe
  2⤵
  PID:11872
- C:\Windows\System\HwqEVzj.exe
  C:\Windows\System\HwqEVzj.exe
  2⤵
  PID:11900
- C:\Windows\System\dMTpfKL.exe
  C:\Windows\System\dMTpfKL.exe
  2⤵
  PID:11992
- C:\Windows\System\ZnsLNjB.exe
  C:\Windows\System\ZnsLNjB.exe
  2⤵
  PID:11616
- C:\Windows\System\XsguuEF.exe
  C:\Windows\System\XsguuEF.exe
  2⤵
  PID:11656
- C:\Windows\System\sEmRPba.exe
  C:\Windows\System\sEmRPba.exe
  2⤵
  PID:12300
- C:\Windows\System\TJkbxfN.exe
  C:\Windows\System\TJkbxfN.exe
  2⤵
  PID:12328
- C:\Windows\System\TDBYExv.exe
  C:\Windows\System\TDBYExv.exe
  2⤵
  PID:12344
- C:\Windows\System\uvUPhyY.exe
  C:\Windows\System\uvUPhyY.exe
  2⤵
  PID:12368
- C:\Windows\System\reNCECN.exe
  C:\Windows\System\reNCECN.exe
  2⤵
  PID:12396
- C:\Windows\System\twKNwwY.exe
  C:\Windows\System\twKNwwY.exe
  2⤵
  PID:12420
- C:\Windows\System\oqnjsta.exe
  C:\Windows\System\oqnjsta.exe
  2⤵
  PID:12444
- C:\Windows\System\WhDoWhb.exe
  C:\Windows\System\WhDoWhb.exe
  2⤵
  PID:12460
- C:\Windows\System\aGxqhBx.exe
  C:\Windows\System\aGxqhBx.exe
  2⤵
  PID:12492
- C:\Windows\System\QmKoqcs.exe
  C:\Windows\System\QmKoqcs.exe
  2⤵
  PID:12508
- C:\Windows\System\vhGZjjR.exe
  C:\Windows\System\vhGZjjR.exe
  2⤵
  PID:12536
- C:\Windows\System\xcVwRdg.exe
  C:\Windows\System\xcVwRdg.exe
  2⤵
  PID:12552
- C:\Windows\System\jYRmxUo.exe
  C:\Windows\System\jYRmxUo.exe
  2⤵
  PID:12572
- C:\Windows\System\jGBxzOM.exe
  C:\Windows\System\jGBxzOM.exe
  2⤵
  PID:12588
- C:\Windows\System\XtDDXFm.exe
  C:\Windows\System\XtDDXFm.exe
  2⤵
  PID:12608
- C:\Windows\System\DQXpxLx.exe
  C:\Windows\System\DQXpxLx.exe
  2⤵
  PID:12628
- C:\Windows\System\cPGToJT.exe
  C:\Windows\System\cPGToJT.exe
  2⤵
  PID:12648
- C:\Windows\System\nrxzQaG.exe
  C:\Windows\System\nrxzQaG.exe
  2⤵
  PID:12668
- C:\Windows\System\IhxJvLA.exe
  C:\Windows\System\IhxJvLA.exe
  2⤵
  PID:12688
- C:\Windows\System\ZBbxCfs.exe
  C:\Windows\System\ZBbxCfs.exe
  2⤵
  PID:12716
- C:\Windows\System\TYmsDWh.exe
  C:\Windows\System\TYmsDWh.exe
  2⤵
  PID:12752
- C:\Windows\System\pOSHVsA.exe
  C:\Windows\System\pOSHVsA.exe
  2⤵
  PID:12776
- C:\Windows\System\nIFVypN.exe
  C:\Windows\System\nIFVypN.exe
  2⤵
  PID:12800
- C:\Windows\System\gzrqogq.exe
  C:\Windows\System\gzrqogq.exe
  2⤵
  PID:12820
- C:\Windows\System\swditkH.exe
  C:\Windows\System\swditkH.exe
  2⤵
  PID:12844
- C:\Windows\System\YotSqjV.exe
  C:\Windows\System\YotSqjV.exe
  2⤵
  PID:12868
- C:\Windows\System\uBSvxHc.exe
  C:\Windows\System\uBSvxHc.exe
  2⤵
  PID:12888
- C:\Windows\System\VykauzT.exe
  C:\Windows\System\VykauzT.exe
  2⤵
  PID:12904
- C:\Windows\System\YxQRJfA.exe
  C:\Windows\System\YxQRJfA.exe
  2⤵
  PID:12932
- C:\Windows\System\DKiEpXy.exe
  C:\Windows\System\DKiEpXy.exe
  2⤵
  PID:12960
- C:\Windows\System\qIzbqdR.exe
  C:\Windows\System\qIzbqdR.exe
  2⤵
  PID:12980
- C:\Windows\System\wHkxaRV.exe
  C:\Windows\System\wHkxaRV.exe
  2⤵
  PID:13004
- C:\Windows\System\QZQiApS.exe
  C:\Windows\System\QZQiApS.exe
  2⤵
  PID:13228
- C:\Windows\System\mUumySR.exe
  C:\Windows\System\mUumySR.exe
  2⤵
  PID:13256
- C:\Windows\System\OklAiiz.exe
  C:\Windows\System\OklAiiz.exe
  2⤵
  PID:13272
- C:\Windows\System\kqHQylG.exe
  C:\Windows\System\kqHQylG.exe
  2⤵
  PID:13288
- C:\Windows\System\OXlSFIM.exe
  C:\Windows\System\OXlSFIM.exe
  2⤵
  PID:13304
- C:\Windows\System\KTcYefs.exe
  C:\Windows\System\KTcYefs.exe
  2⤵
  PID:10448
- C:\Windows\System\CxDNUzD.exe
  C:\Windows\System\CxDNUzD.exe
  2⤵
  PID:11704
- C:\Windows\System\gLuXtvS.exe
  C:\Windows\System\gLuXtvS.exe
  2⤵
  PID:12264
- C:\Windows\System\xCMSPez.exe
  C:\Windows\System\xCMSPez.exe
  2⤵
  PID:11748
- C:\Windows\System\icdYlaN.exe
  C:\Windows\System\icdYlaN.exe
  2⤵
  PID:752
- C:\Windows\System\sEOQPWL.exe
  C:\Windows\System\sEOQPWL.exe
  2⤵
  PID:11344
- C:\Windows\System\WQTpMLH.exe
  C:\Windows\System\WQTpMLH.exe
  2⤵
  PID:11412
- C:\Windows\System\MdEraOz.exe
  C:\Windows\System\MdEraOz.exe
  2⤵
  PID:11440
- C:\Windows\System\uuecGay.exe
  C:\Windows\System\uuecGay.exe
  2⤵
  PID:11956
- C:\Windows\System\ZRZvSTx.exe
  C:\Windows\System\ZRZvSTx.exe
  2⤵
  PID:11452
- C:\Windows\System\yTPJAxV.exe
  C:\Windows\System\yTPJAxV.exe
  2⤵
  PID:11524
- C:\Windows\System\YPUdLnr.exe
  C:\Windows\System\YPUdLnr.exe
  2⤵
  PID:11604
- C:\Windows\System\UoTVphn.exe
  C:\Windows\System\UoTVphn.exe
  2⤵
  PID:12412
- C:\Windows\System\SozJNka.exe
  C:\Windows\System\SozJNka.exe
  2⤵
  PID:8368
- C:\Windows\System\LOXfuqs.exe
  C:\Windows\System\LOXfuqs.exe
  2⤵
  PID:10868
- C:\Windows\System\mMFbDpD.exe
  C:\Windows\System\mMFbDpD.exe
  2⤵
  PID:12036
- C:\Windows\System\dKvIVhv.exe
  C:\Windows\System\dKvIVhv.exe
  2⤵
  PID:12080
- C:\Windows\System\atodaye.exe
  C:\Windows\System\atodaye.exe
  2⤵
  PID:12860
- C:\Windows\System\rOJLTOw.exe
  C:\Windows\System\rOJLTOw.exe
  2⤵
  PID:12900
- C:\Windows\System\awzsgTp.exe
  C:\Windows\System\awzsgTp.exe
  2⤵
  PID:12140
- C:\Windows\System\atfxYNF.exe
  C:\Windows\System\atfxYNF.exe
  2⤵
  PID:12160
- C:\Windows\System\eiajsmP.exe
  C:\Windows\System\eiajsmP.exe
  2⤵
  PID:12996
- C:\Windows\System\QEFPhfx.exe
  C:\Windows\System\QEFPhfx.exe
  2⤵
  PID:12208
- C:\Windows\System\mtQhbEM.exe
  C:\Windows\System\mtQhbEM.exe
  2⤵
  PID:12336
- C:\Windows\System\JdgAYPw.exe
  C:\Windows\System\JdgAYPw.exe
  2⤵
  PID:10172
- C:\Windows\System\RAlfhIc.exe
  C:\Windows\System\RAlfhIc.exe
  2⤵
  PID:12620
- C:\Windows\System\MQDngIs.exe
  C:\Windows\System\MQDngIs.exe
  2⤵
  PID:12636
- C:\Windows\System\VTZEXnM.exe
  C:\Windows\System\VTZEXnM.exe
  2⤵
  PID:12700
- C:\Windows\System\tQxcYVY.exe
  C:\Windows\System\tQxcYVY.exe
  2⤵
  PID:12724
- C:\Windows\System\nvOtuze.exe
  C:\Windows\System\nvOtuze.exe
  2⤵
  PID:12736
- C:\Windows\System\ycTZVyK.exe
  C:\Windows\System\ycTZVyK.exe
  2⤵
  PID:13140
- C:\Windows\System\EpivjXZ.exe
  C:\Windows\System\EpivjXZ.exe
  2⤵
  PID:12880
- C:\Windows\System\RhJETyr.exe
  C:\Windows\System\RhJETyr.exe
  2⤵
  PID:12484
- C:\Windows\System\OEnsYEl.exe
  C:\Windows\System\OEnsYEl.exe
  2⤵
  PID:12180
- C:\Windows\System\bvyFKLj.exe
  C:\Windows\System\bvyFKLj.exe
  2⤵
  PID:12012
- C:\Windows\System\kmwBZWQ.exe
  C:\Windows\System\kmwBZWQ.exe
  2⤵
  PID:12796
- C:\Windows\System\pGbvWAW.exe
  C:\Windows\System\pGbvWAW.exe
  2⤵
  PID:13328
- C:\Windows\System\iRciuux.exe
  C:\Windows\System\iRciuux.exe
  2⤵
  PID:13360
- C:\Windows\System\CAFZepW.exe
  C:\Windows\System\CAFZepW.exe
  2⤵
  PID:13384
- C:\Windows\System\CugQLNe.exe
  C:\Windows\System\CugQLNe.exe
  2⤵
  PID:13400
- C:\Windows\System\lsFSvHh.exe
  C:\Windows\System\lsFSvHh.exe
  2⤵
  PID:13428
- C:\Windows\System\KNAgRMW.exe
  C:\Windows\System\KNAgRMW.exe
  2⤵
  PID:13452
- C:\Windows\System\JOoBArb.exe
  C:\Windows\System\JOoBArb.exe
  2⤵
  PID:13476
- C:\Windows\System\yuLSRXo.exe
  C:\Windows\System\yuLSRXo.exe
  2⤵
  PID:13500
- C:\Windows\System\LVFnROs.exe
  C:\Windows\System\LVFnROs.exe
  2⤵
  PID:13524
- C:\Windows\System\uyOsjCO.exe
  C:\Windows\System\uyOsjCO.exe
  2⤵
  PID:13552
- C:\Windows\System\MRvKlAX.exe
  C:\Windows\System\MRvKlAX.exe
  2⤵
  PID:13576
- C:\Windows\System\DzfCBuV.exe
  C:\Windows\System\DzfCBuV.exe
  2⤵
  PID:13600
- C:\Windows\System\kVOBMbk.exe
  C:\Windows\System\kVOBMbk.exe
  2⤵
  PID:13628
- C:\Windows\System\xPBXSwN.exe
  C:\Windows\System\xPBXSwN.exe
  2⤵
  PID:13660
- C:\Windows\System\VRvAwSD.exe
  C:\Windows\System\VRvAwSD.exe
  2⤵
  PID:13688
- C:\Windows\System\qGYgBCS.exe
  C:\Windows\System\qGYgBCS.exe
  2⤵
  PID:13712
- C:\Windows\System\DklVNab.exe
  C:\Windows\System\DklVNab.exe
  2⤵
  PID:13740
- C:\Windows\System\vjAvUTR.exe
  C:\Windows\System\vjAvUTR.exe
  2⤵
  PID:13764
- C:\Windows\System\kPIkhiG.exe
  C:\Windows\System\kPIkhiG.exe
  2⤵
  PID:13792
- C:\Windows\System\JyuvqCG.exe
  C:\Windows\System\JyuvqCG.exe
  2⤵
  PID:13808
- C:\Windows\System\FEwhtqA.exe
  C:\Windows\System\FEwhtqA.exe
  2⤵
  PID:13836
- C:\Windows\System\BaijWcH.exe
  C:\Windows\System\BaijWcH.exe
  2⤵
  PID:13864
- C:\Windows\System\dxQJcQb.exe
  C:\Windows\System\dxQJcQb.exe
  2⤵
  PID:13888
- C:\Windows\System\zuwinnO.exe
  C:\Windows\System\zuwinnO.exe
  2⤵
  PID:13916
- C:\Windows\System\xPjMAuh.exe
  C:\Windows\System\xPjMAuh.exe
  2⤵
  PID:13940
- C:\Windows\System\kmuvLrr.exe
  C:\Windows\System\kmuvLrr.exe
  2⤵
  PID:13960
- C:\Windows\System\YChOkyY.exe
  C:\Windows\System\YChOkyY.exe
  2⤵
  PID:13988
- C:\Windows\System\GQUxkQL.exe
  C:\Windows\System\GQUxkQL.exe
  2⤵
  PID:14020
- C:\Windows\System\eMJLDVX.exe
  C:\Windows\System\eMJLDVX.exe
  2⤵
  PID:14036
- C:\Windows\System\hHifbUa.exe
  C:\Windows\System\hHifbUa.exe
  2⤵
  PID:14060
- C:\Windows\System\ucEhjHD.exe
  C:\Windows\System\ucEhjHD.exe
  2⤵
  PID:14080
- C:\Windows\System\ItJpgbq.exe
  C:\Windows\System\ItJpgbq.exe
  2⤵
  PID:14100
- C:\Windows\System\tCbixJe.exe
  C:\Windows\System\tCbixJe.exe
  2⤵
  PID:14124
- C:\Windows\System\fTHFXRr.exe
  C:\Windows\System\fTHFXRr.exe
  2⤵
  PID:14148
- C:\Windows\System\uRwvTxX.exe
  C:\Windows\System\uRwvTxX.exe
  2⤵
  PID:14172
- C:\Windows\System\wnzKHMC.exe
  C:\Windows\System\wnzKHMC.exe
  2⤵
  PID:14200
- C:\Windows\System\TtrGBIR.exe
  C:\Windows\System\TtrGBIR.exe
  2⤵
  PID:14228
- C:\Windows\System\iXIzFlw.exe
  C:\Windows\System\iXIzFlw.exe
  2⤵
  PID:14244
- C:\Windows\System\zfFzXVm.exe
  C:\Windows\System\zfFzXVm.exe
  2⤵
  PID:14260
- C:\Windows\System\fHNRrHR.exe
  C:\Windows\System\fHNRrHR.exe
  2⤵
  PID:14276
- C:\Windows\System\FqjWtGG.exe
  C:\Windows\System\FqjWtGG.exe
  2⤵
  PID:14304
- C:\Windows\System\ifIBNQu.exe
  C:\Windows\System\ifIBNQu.exe
  2⤵
  PID:14328
- C:\Windows\System\fhKnbPy.exe
  C:\Windows\System\fhKnbPy.exe
  2⤵
  PID:13224
- C:\Windows\System\CxnLkzK.exe
  C:\Windows\System\CxnLkzK.exe
  2⤵
  PID:13012
- C:\Windows\System\sAquVQT.exe
  C:\Windows\System\sAquVQT.exe
  2⤵
  PID:11876
- C:\Windows\System\BMYrMGv.exe
  C:\Windows\System\BMYrMGv.exe
  2⤵
  PID:10748
- C:\Windows\System\psAuxQf.exe
  C:\Windows\System\psAuxQf.exe
  2⤵
  PID:11420
- C:\Windows\System\oddacxg.exe
  C:\Windows\System\oddacxg.exe
  2⤵
  PID:12436
- C:\Windows\System\YDhbjPi.exe
  C:\Windows\System\YDhbjPi.exe
  2⤵
  PID:12472
- C:\Windows\System\QHIeQas.exe
  C:\Windows\System\QHIeQas.exe
  2⤵
  PID:13348
- C:\Windows\System\OHxrzxu.exe
  C:\Windows\System\OHxrzxu.exe
  2⤵
  PID:11472
- C:\Windows\System\gCmPlYi.exe
  C:\Windows\System\gCmPlYi.exe
  2⤵
  PID:12884
- C:\Windows\System\SYieoIY.exe
  C:\Windows\System\SYieoIY.exe
  2⤵
  PID:13252
- C:\Windows\System\nQZFZTN.exe
  C:\Windows\System\nQZFZTN.exe
  2⤵
  PID:13492
- C:\Windows\System\IcwyuVC.exe
  C:\Windows\System\IcwyuVC.exe
  2⤵
  PID:12320
- C:\Windows\System\jxFydCH.exe
  C:\Windows\System\jxFydCH.exe
  2⤵
  PID:13644
- C:\Windows\System\OsiKguU.exe
  C:\Windows\System\OsiKguU.exe
  2⤵
  PID:13680
- C:\Windows\System\nlgxqpY.exe
  C:\Windows\System\nlgxqpY.exe
  2⤵
  PID:1900
- C:\Windows\System\PnMnwTr.exe
  C:\Windows\System\PnMnwTr.exe
  2⤵
  PID:11796
- C:\Windows\System\coCZSVe.exe
  C:\Windows\System\coCZSVe.exe
  2⤵
  PID:11924
- C:\Windows\System\xYhTNgi.exe
  C:\Windows\System\xYhTNgi.exe
  2⤵
  PID:14372
- C:\Windows\System\OGKChmt.exe
  C:\Windows\System\OGKChmt.exe
  2⤵
  PID:14392
- C:\Windows\System\HAsnqnR.exe
  C:\Windows\System\HAsnqnR.exe
  2⤵
  PID:14408
- C:\Windows\System\TzogXba.exe
  C:\Windows\System\TzogXba.exe
  2⤵
  PID:14428
- C:\Windows\System\sVvUjzh.exe
  C:\Windows\System\sVvUjzh.exe
  2⤵
  PID:14456
- C:\Windows\System\hvsurRl.exe
  C:\Windows\System\hvsurRl.exe
  2⤵
  PID:14716
- C:\Windows\System\VFLkQtl.exe
  C:\Windows\System\VFLkQtl.exe
  2⤵
  PID:14732
- C:\Windows\System\YAjgyVe.exe
  C:\Windows\System\YAjgyVe.exe
  2⤵
  PID:14752
- C:\Windows\System\YFSyyjN.exe
  C:\Windows\System\YFSyyjN.exe
  2⤵
  PID:14768
- C:\Windows\System\bmcmJyX.exe
  C:\Windows\System\bmcmJyX.exe
  2⤵
  PID:14784
- C:\Windows\System\BYnqXVv.exe
  C:\Windows\System\BYnqXVv.exe
  2⤵
  PID:14800
- C:\Windows\System\sfYAkdk.exe
  C:\Windows\System\sfYAkdk.exe
  2⤵
  PID:14816
- C:\Windows\System\tjZIDlM.exe
  C:\Windows\System\tjZIDlM.exe
  2⤵
  PID:14832
- C:\Windows\System\lCTiCwA.exe
  C:\Windows\System\lCTiCwA.exe
  2⤵
  PID:14864
- C:\Windows\System\wnEqQWG.exe
  C:\Windows\System\wnEqQWG.exe
  2⤵
  PID:14884
- C:\Windows\System\SCnwvzD.exe
  C:\Windows\System\SCnwvzD.exe
  2⤵
  PID:14900
- C:\Windows\System\Ebjjmbg.exe
  C:\Windows\System\Ebjjmbg.exe
  2⤵
  PID:14916
- C:\Windows\System\pyZKTRf.exe
  C:\Windows\System\pyZKTRf.exe
  2⤵
  PID:14932
- C:\Windows\System\InyokSK.exe
  C:\Windows\System\InyokSK.exe
  2⤵
  PID:14948
- C:\Windows\System\QetlCMW.exe
  C:\Windows\System\QetlCMW.exe
  2⤵
  PID:14964
- C:\Windows\System\pjFydTL.exe
  C:\Windows\System\pjFydTL.exe
  2⤵
  PID:14980
- C:\Windows\System\ybVydIx.exe
  C:\Windows\System\ybVydIx.exe
  2⤵
  PID:15000
- C:\Windows\System\lSxSPLM.exe
  C:\Windows\System\lSxSPLM.exe
  2⤵
  PID:15032
- C:\Windows\System\EEoqezp.exe
  C:\Windows\System\EEoqezp.exe
  2⤵
  PID:15048
- C:\Windows\System\MIqldAS.exe
  C:\Windows\System\MIqldAS.exe
  2⤵
  PID:15064
- C:\Windows\System\TVkTqGj.exe
  C:\Windows\System\TVkTqGj.exe
  2⤵
  PID:15112
- C:\Windows\System\tTgqjFc.exe
  C:\Windows\System\tTgqjFc.exe
  2⤵
  PID:15168
- C:\Windows\System\cJxuhVy.exe
  C:\Windows\System\cJxuhVy.exe
  2⤵
  PID:15188
- C:\Windows\System\runnmoi.exe
  C:\Windows\System\runnmoi.exe
  2⤵
  PID:15216
- C:\Windows\System\npRZrbT.exe
  C:\Windows\System\npRZrbT.exe
  2⤵
  PID:15232
- C:\Windows\System\lsBHQSB.exe
  C:\Windows\System\lsBHQSB.exe
  2⤵
  PID:15252
- C:\Windows\System\OZemfWz.exe
  C:\Windows\System\OZemfWz.exe
  2⤵
  PID:15280
- C:\Windows\System\vCNZGkC.exe
  C:\Windows\System\vCNZGkC.exe
  2⤵
  PID:15300
- C:\Windows\System\ThJRmLH.exe
  C:\Windows\System\ThJRmLH.exe
  2⤵
  PID:15324
- C:\Windows\System\XeCHWIp.exe
  C:\Windows\System\XeCHWIp.exe
  2⤵
  PID:15340
- C:\Windows\System\zqATPAs.exe
  C:\Windows\System\zqATPAs.exe
  2⤵
  PID:12732
- C:\Windows\System\cfBdGSw.exe
  C:\Windows\System\cfBdGSw.exe
  2⤵
  PID:11372
- C:\Windows\System\ysloupa.exe
  C:\Windows\System\ysloupa.exe
  2⤵
  PID:12532
- C:\Windows\System\CEOBFDL.exe
  C:\Windows\System\CEOBFDL.exe
  2⤵
  PID:14224
- C:\Windows\System\rqiqkwO.exe
  C:\Windows\System\rqiqkwO.exe
  2⤵
  PID:13496
- C:\Windows\System\EXpofjL.exe
  C:\Windows\System\EXpofjL.exe
  2⤵
  PID:12684
- C:\Windows\System\rFmTJJU.exe
  C:\Windows\System\rFmTJJU.exe
  2⤵
  PID:13616
- C:\Windows\System\vTPrvKV.exe
  C:\Windows\System\vTPrvKV.exe
  2⤵
  PID:13736
- C:\Windows\System\ouUpRnj.exe
  C:\Windows\System\ouUpRnj.exe
  2⤵
  PID:13908
- C:\Windows\System\gwOMFiK.exe
  C:\Windows\System\gwOMFiK.exe
  2⤵
  PID:13248
- C:\Windows\System\HsXJfpO.exe
  C:\Windows\System\HsXJfpO.exe
  2⤵
  PID:12256
- C:\Windows\System\LmmTDMN.exe
  C:\Windows\System\LmmTDMN.exe
  2⤵
  PID:14076
- C:\Windows\System\MeuwnkP.exe
  C:\Windows\System\MeuwnkP.exe
  2⤵
  PID:14156
- C:\Windows\System\UJpXgIH.exe
  C:\Windows\System\UJpXgIH.exe
  2⤵
  PID:14256
- C:\Windows\System\GfYfThl.exe
  C:\Windows\System\GfYfThl.exe
  2⤵
  PID:13464
- C:\Windows\System\qnviHlv.exe
  C:\Windows\System\qnviHlv.exe
  2⤵
  PID:13488
- C:\Windows\System\PJoLjTL.exe
  C:\Windows\System\PJoLjTL.exe
  2⤵
  PID:13548
- C:\Windows\System\NRPjPrp.exe
  C:\Windows\System\NRPjPrp.exe
  2⤵
  PID:13596
- C:\Windows\System\HPTZLTE.exe
  C:\Windows\System\HPTZLTE.exe
  2⤵
  PID:13372
- C:\Windows\System\hvbOQPi.exe
  C:\Windows\System\hvbOQPi.exe
  2⤵
  PID:14608
- C:\Windows\System\lzwupSW.exe
  C:\Windows\System\lzwupSW.exe
  2⤵
  PID:13708
- C:\Windows\System\TheYXoQ.exe
  C:\Windows\System\TheYXoQ.exe
  2⤵
  PID:13052
- C:\Windows\System\QwFkWAo.exe
  C:\Windows\System\QwFkWAo.exe
  2⤵
  PID:13820
- C:\Windows\System\vtSCpVV.exe
  C:\Windows\System\vtSCpVV.exe
  2⤵
  PID:11732
- C:\Windows\System\ChLXWiF.exe
  C:\Windows\System\ChLXWiF.exe
  2⤵
  PID:13884
- C:\Windows\System\BLuKBZy.exe
  C:\Windows\System\BLuKBZy.exe
  2⤵
  PID:15376
- C:\Windows\System\QiAZBQF.exe
  C:\Windows\System\QiAZBQF.exe
  2⤵
  PID:15392
- C:\Windows\System\ANbnRnx.exe
  C:\Windows\System\ANbnRnx.exe
  2⤵
  PID:15408
- C:\Windows\System\fDaURWp.exe
  C:\Windows\System\fDaURWp.exe
  2⤵
  PID:15424
- C:\Windows\System\KVjFKPh.exe
  C:\Windows\System\KVjFKPh.exe
  2⤵
  PID:15440
- C:\Windows\System\xgpUCOW.exe
  C:\Windows\System\xgpUCOW.exe
  2⤵
  PID:15456
- C:\Windows\System\FyGSzZw.exe
  C:\Windows\System\FyGSzZw.exe
  2⤵
  PID:15472
- C:\Windows\System\TvGtoYY.exe
  C:\Windows\System\TvGtoYY.exe
  2⤵
  PID:15504
- C:\Windows\System\xtKuInC.exe
  C:\Windows\System\xtKuInC.exe
  2⤵
  PID:15524
- C:\Windows\System\tfaxbQg.exe
  C:\Windows\System\tfaxbQg.exe
  2⤵
  PID:15552
- C:\Windows\System\oFuDyhb.exe
  C:\Windows\System\oFuDyhb.exe
  2⤵
  PID:15596
- C:\Windows\System\FnpkBWv.exe
  C:\Windows\System\FnpkBWv.exe
  2⤵
  PID:15656
- C:\Windows\System\rbptvYJ.exe
  C:\Windows\System\rbptvYJ.exe
  2⤵
  PID:15672
- C:\Windows\System\nWNGRde.exe
  C:\Windows\System\nWNGRde.exe
  2⤵
  PID:15696
- C:\Windows\System\ZLDEnSM.exe
  C:\Windows\System\ZLDEnSM.exe
  2⤵
  PID:15712
- C:\Windows\System\PrsduqM.exe
  C:\Windows\System\PrsduqM.exe
  2⤵
  PID:15736
- C:\Windows\System\qlszytF.exe
  C:\Windows\System\qlszytF.exe
  2⤵
  PID:15752
- C:\Windows\System\gAPHoLR.exe
  C:\Windows\System\gAPHoLR.exe
  2⤵
  PID:15768
- C:\Windows\System\MSrtdDg.exe
  C:\Windows\System\MSrtdDg.exe
  2⤵
  PID:15784
- C:\Windows\System\PhfwJui.exe
  C:\Windows\System\PhfwJui.exe
  2⤵
  PID:15800
- C:\Windows\System\sXFHKXv.exe
  C:\Windows\System\sXFHKXv.exe
  2⤵
  PID:15816
- C:\Windows\System\IWtqoBa.exe
  C:\Windows\System\IWtqoBa.exe
  2⤵
  PID:15832
- C:\Windows\System\yqMAVDn.exe
  C:\Windows\System\yqMAVDn.exe
  2⤵
  PID:15852
- C:\Windows\System\jBHavyN.exe
  C:\Windows\System\jBHavyN.exe
  2⤵
  PID:15868
- C:\Windows\System\NnhkmeQ.exe
  C:\Windows\System\NnhkmeQ.exe
  2⤵
  PID:15884
- C:\Windows\System\JuSTVYZ.exe
  C:\Windows\System\JuSTVYZ.exe
  2⤵
  PID:15916
- C:\Windows\System\WknPPzy.exe
  C:\Windows\System\WknPPzy.exe
  2⤵
  PID:15948
- C:\Windows\System\ytlSUSi.exe
  C:\Windows\System\ytlSUSi.exe
  2⤵
  PID:15988
- C:\Windows\System\vajYrDM.exe
  C:\Windows\System\vajYrDM.exe
  2⤵
  PID:16028
- C:\Windows\System\PzCwoOp.exe
  C:\Windows\System\PzCwoOp.exe
  2⤵
  PID:16060
- C:\Windows\System\vxPRibB.exe
  C:\Windows\System\vxPRibB.exe
  2⤵
  PID:16100
- C:\Windows\System\ZeUVZfW.exe
  C:\Windows\System\ZeUVZfW.exe
  2⤵
  PID:16128
- C:\Windows\System\jefXVQY.exe
  C:\Windows\System\jefXVQY.exe
  2⤵
  PID:16156
- C:\Windows\System\uPSupIn.exe
  C:\Windows\System\uPSupIn.exe
  2⤵
  PID:16180
- C:\Windows\System\WRbXLay.exe
  C:\Windows\System\WRbXLay.exe
  2⤵
  PID:16220
- C:\Windows\System\kycIXCt.exe
  C:\Windows\System\kycIXCt.exe
  2⤵
  PID:16244
- C:\Windows\System\AvyrAKI.exe
  C:\Windows\System\AvyrAKI.exe
  2⤵
  PID:16268
- C:\Windows\System\LPsIxAu.exe
  C:\Windows\System\LPsIxAu.exe
  2⤵
  PID:16296
- C:\Windows\System\ffAHVPq.exe
  C:\Windows\System\ffAHVPq.exe
  2⤵
  PID:16332
- C:\Windows\System\jAFUVmu.exe
  C:\Windows\System\jAFUVmu.exe
  2⤵
  PID:16352
- C:\Windows\System\RZLdUGE.exe
  C:\Windows\System\RZLdUGE.exe
  2⤵
  PID:16380
- C:\Windows\System\mbKHPQt.exe
  C:\Windows\System\mbKHPQt.exe
  2⤵
  PID:15224
- C:\Windows\System\UhiNWJb.exe
  C:\Windows\System\UhiNWJb.exe
  2⤵
  PID:15316
- C:\Windows\System\xsILRqt.exe
  C:\Windows\System\xsILRqt.exe
  2⤵
  PID:15352
- C:\Windows\System\iihRHKg.exe
  C:\Windows\System\iihRHKg.exe
  2⤵
  PID:11352
- C:\Windows\System\acEFZUS.exe
  C:\Windows\System\acEFZUS.exe
  2⤵
  PID:10844
- C:\Windows\System\acgfrdN.exe
  C:\Windows\System\acgfrdN.exe
  2⤵
  PID:13824
- C:\Windows\System\BOUMqjt.exe
  C:\Windows\System\BOUMqjt.exe
  2⤵
  PID:14272
- C:\Windows\System\mHtDmPs.exe
  C:\Windows\System\mHtDmPs.exe
  2⤵
  PID:13152
- C:\Windows\System\QDncMip.exe
  C:\Windows\System\QDncMip.exe
  2⤵
  PID:15388
- C:\Windows\System\DxsZpuL.exe
  C:\Windows\System\DxsZpuL.exe
  2⤵
  PID:15496
- C:\Windows\System\RPHOCyF.exe
  C:\Windows\System\RPHOCyF.exe
  2⤵
  PID:14400
- C:\Windows\System\kALnxHC.exe
  C:\Windows\System\kALnxHC.exe
  2⤵
  PID:15576
- C:\Windows\System\KyczfVl.exe
  C:\Windows\System\KyczfVl.exe
  2⤵
  PID:14776
- C:\Windows\System\FxhXacU.exe
  C:\Windows\System\FxhXacU.exe
  2⤵
  PID:14960
- C:\Windows\System\meiTFdq.exe
  C:\Windows\System\meiTFdq.exe
  2⤵
  PID:12212
- C:\Windows\System\NSgfAxd.exe
  C:\Windows\System\NSgfAxd.exe
  2⤵
  PID:15744
- C:\Windows\System\KAPGAPk.exe
  C:\Windows\System\KAPGAPk.exe
  2⤵
  PID:15452
- C:\Windows\System\gRWILZF.exe
  C:\Windows\System\gRWILZF.exe
  2⤵
  PID:15488
- C:\Windows\System\IpZnQqI.exe
  C:\Windows\System\IpZnQqI.exe
  2⤵
  PID:15896
- C:\Windows\System\Vkjkcxz.exe
  C:\Windows\System\Vkjkcxz.exe
  2⤵
  PID:16084
- C:\Windows\System\cVFYLbZ.exe
  C:\Windows\System\cVFYLbZ.exe
  2⤵
  PID:15604
- C:\Windows\System\YtrLpHp.exe
  C:\Windows\System\YtrLpHp.exe
  2⤵
  PID:16200
- C:\Windows\System\RDjkGSm.exe
  C:\Windows\System\RDjkGSm.exe
  2⤵
  PID:15668
- C:\Windows\System\GPieSKl.exe
  C:\Windows\System\GPieSKl.exe
  2⤵
  PID:16400
- C:\Windows\System\yQicrbT.exe
  C:\Windows\System\yQicrbT.exe
  2⤵
  PID:16416
- C:\Windows\System\BsvKpYK.exe
  C:\Windows\System\BsvKpYK.exe
  2⤵
  PID:16432
- C:\Windows\System\JKWpFZi.exe
  C:\Windows\System\JKWpFZi.exe
  2⤵
  PID:16452
- C:\Windows\System\AJPqdWP.exe
  C:\Windows\System\AJPqdWP.exe
  2⤵
  PID:16472
- C:\Windows\System\HTfYcgq.exe
  C:\Windows\System\HTfYcgq.exe
  2⤵
  PID:16504
- C:\Windows\System\ODTKwGB.exe
  C:\Windows\System\ODTKwGB.exe
  2⤵
  PID:16520
- C:\Windows\System\IpyOzxS.exe
  C:\Windows\System\IpyOzxS.exe
  2⤵
  PID:16548
- C:\Windows\System\edKIeSZ.exe
  C:\Windows\System\edKIeSZ.exe
  2⤵
  PID:16568
- C:\Windows\System\lthvmET.exe
  C:\Windows\System\lthvmET.exe
  2⤵
  PID:16592
- C:\Windows\System\zXfGqmw.exe
  C:\Windows\System\zXfGqmw.exe
  2⤵
  PID:16616
- C:\Windows\System\gZfCZFe.exe
  C:\Windows\System\gZfCZFe.exe
  2⤵
  PID:16644
- C:\Windows\System\vEWzHFA.exe
  C:\Windows\System\vEWzHFA.exe
  2⤵
  PID:16660
- C:\Windows\System\ZHcalzb.exe
  C:\Windows\System\ZHcalzb.exe
  2⤵
  PID:16684
- C:\Windows\System\DVecEQX.exe
  C:\Windows\System\DVecEQX.exe
  2⤵
  PID:16712
- C:\Windows\System\aUhduQr.exe
  C:\Windows\System\aUhduQr.exe
  2⤵
  PID:16732
- C:\Windows\System\JozXlMg.exe
  C:\Windows\System\JozXlMg.exe
  2⤵
  PID:16752
- C:\Windows\System\UFAwECX.exe
  C:\Windows\System\UFAwECX.exe
  2⤵
  PID:16776
- C:\Windows\System\poUnZVO.exe
  C:\Windows\System\poUnZVO.exe
  2⤵
  PID:16804
- C:\Windows\System\boHktgn.exe
  C:\Windows\System\boHktgn.exe
  2⤵
  PID:16820
- C:\Windows\System\hViTlaG.exe
  C:\Windows\System\hViTlaG.exe
  2⤵
  PID:16836
- C:\Windows\System\NxJPSaO.exe
  C:\Windows\System\NxJPSaO.exe
  2⤵
  PID:16880
- C:\Windows\System\bpWarrm.exe
  C:\Windows\System\bpWarrm.exe
  2⤵
  PID:16912
- C:\Windows\System\TdLpadv.exe
  C:\Windows\System\TdLpadv.exe
  2⤵
  PID:16928
- C:\Windows\System\gfUrHzj.exe
  C:\Windows\System\gfUrHzj.exe
  2⤵
  PID:16944
- C:\Windows\System\QHehLQV.exe
  C:\Windows\System\QHehLQV.exe
  2⤵
  PID:16960
- C:\Windows\System\oLbHNnI.exe
  C:\Windows\System\oLbHNnI.exe
  2⤵
  PID:16988
- C:\Windows\System\jLmPGLY.exe
  C:\Windows\System\jLmPGLY.exe
  2⤵
  PID:17016
- C:\Windows\System\Xyherax.exe
  C:\Windows\System\Xyherax.exe
  2⤵
  PID:17036
- C:\Windows\System\WuALtYc.exe
  C:\Windows\System\WuALtYc.exe
  2⤵
  PID:17056
- C:\Windows\System\zkCcGwx.exe
  C:\Windows\System\zkCcGwx.exe
  2⤵
  PID:17084
- C:\Windows\System\qNwnxNB.exe
  C:\Windows\System\qNwnxNB.exe
  2⤵
  PID:17108
- C:\Windows\System\KVHUgao.exe
  C:\Windows\System\KVHUgao.exe
  2⤵
  PID:17124
- C:\Windows\System\KyZOKZa.exe
  C:\Windows\System\KyZOKZa.exe
  2⤵
  PID:17140
- C:\Windows\System\QfiSEXv.exe
  C:\Windows\System\QfiSEXv.exe
  2⤵
  PID:17156
- C:\Windows\System\FzhPswZ.exe
  C:\Windows\System\FzhPswZ.exe
  2⤵
  PID:17172
- C:\Windows\System\CJcnFhe.exe
  C:\Windows\System\CJcnFhe.exe
  2⤵
  PID:17188
- C:\Windows\System\uCPBxvW.exe
  C:\Windows\System\uCPBxvW.exe
  2⤵
  PID:17204
- C:\Windows\System\lNxwURv.exe
  C:\Windows\System\lNxwURv.exe
  2⤵
  PID:17224
- C:\Windows\System\gVEkqXw.exe
  C:\Windows\System\gVEkqXw.exe
  2⤵
  PID:17244
- C:\Windows\System\QnsjmTF.exe
  C:\Windows\System\QnsjmTF.exe
  2⤵
  PID:17260
- C:\Windows\System\PgrljIk.exe
  C:\Windows\System\PgrljIk.exe
  2⤵
  PID:17280
- C:\Windows\System\qIYFxrX.exe
  C:\Windows\System\qIYFxrX.exe
  2⤵
  PID:17300
- C:\Windows\System\ZLiaEjN.exe
  C:\Windows\System\ZLiaEjN.exe
  2⤵
  PID:17324
- C:\Windows\System\gAfwiZZ.exe
  C:\Windows\System\gAfwiZZ.exe
  2⤵
  PID:17344
- C:\Windows\System\DWqIyVK.exe
  C:\Windows\System\DWqIyVK.exe
  2⤵
  PID:17360
- C:\Windows\System\TEpVETn.exe
  C:\Windows\System\TEpVETn.exe
  2⤵
  PID:17376
- C:\Windows\System\CVGqyHi.exe
  C:\Windows\System\CVGqyHi.exe
  2⤵
  PID:15684
- C:\Windows\System\PNYfLLL.exe
  C:\Windows\System\PNYfLLL.exe
  2⤵
  PID:16368

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:15988

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:17016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ERkmAoJ.exe

Filesize
1.4MB

MD5
2ebea21d17c19c72d42de1dc1c62e71f

SHA1
455a0ee74d1e01386c20c6a6a1d9d224f8862d7d

SHA256
ef4caee16f2e5e860efa489c784ec477ff819151ecee304c4c91c4eadfea907a

SHA512
ec07fa849e1902348549e74266c22c28c1223966841231854cd41882f9ad576514a5d2f009ba9ec84b9abc119299da8fe6038cee8314cf4d8fd04e3ff35f83ee

Download Submit
C:\Windows\System\FhNLaaW.exe

Filesize
1.4MB

MD5
2efbc72cd888b1248331ed1cfa2d15a9

SHA1
3998d1a9ba587cf4d08e5a96f8678c7907a1a693

SHA256
a26d90b047c1dd6d3171be8be60e4004fac0b9bcade797bf23786a5f0c8d20d8

SHA512
3cfc5ce03f6658ff0ecf37f9905eebe092c4b97efbf3c2f64bafefda631e005a998a2e2ff0909a7e974d8a04e392a121205c6b343bd50f284bdbd41964e8b442

Download Submit
C:\Windows\System\HOjLkwQ.exe

Filesize
1.4MB

MD5
dff3b6fedf1d51ecb5b6d2d06cb115fd

SHA1
6cf72a38251acdf825fffe77819b9a8385f0481c

SHA256
c10305c24547dd35311add2d9d69826304b13090ab6fa9393fabed7a90c41e31

SHA512
f4f8d153c9f4ef16edbc0d576b2b215312aa3d6a3ca25715e75f1a1237fc43472d8e66c49ba33d7b02f7bfd7f129fdc68b301e8ced9316deed6c17b7e2de11cf

Download Submit
C:\Windows\System\JJVekfg.exe

Filesize
1.4MB

MD5
24e8a162f17938d4c9abd9a1c994c520

SHA1
6ee1bf91943271f798c279a1fd2cdb67dfbad400

SHA256
456b9b778a27a02df3120c6c3ee14595ec74de525b1daa4d07dd540bfe7b7fd5

SHA512
f197a5e7776ccccf71b890db835b6f22ebded014aed342ebb1f8acb8c6d5f24c3970b235ca4d92fc7a7377f3cf1422146a04641de2fa7cf66974b4a69d84982f

Download Submit
C:\Windows\System\LeETWCq.exe

Filesize
1.4MB

MD5
e7f8101b02d1fdb09c9eadf8e396b998

SHA1
921ca29f60c5bd4fd1644023622354421e9f9ac6

SHA256
402eaf787aa20727e8644e53aa24f7aec319fbd78b3f9a1dc87472c6a442d689

SHA512
6bfef954848cad1eb5ea8a6004bc74b4195eec27e1003aff6414f93993ef4c345c1f239a7bb8408f6603d65f4c25f9772a174692e155e3b2e605662af57b6c1c

Download Submit
C:\Windows\System\NzonHDz.exe

Filesize
1.4MB

MD5
b2633934fc1c708e180166812e81287b

SHA1
a237058348c49388354c9659aef57fe4e40699e3

SHA256
93cdc1a4f99cce3a8cef35980e7a21cf8e6b0b523946ecd280d39c66ffebe0b3

SHA512
bb874fc94f597a841b3ab131768f446396779b35fedc08e2363a9499f8bb29d199afb19d8c6a943f5d76831c48e780bed10339757e60cbf5ba12dfeb941f0c26

Download Submit
C:\Windows\System\OOTINLf.exe

Filesize
1.4MB

MD5
65ac76f35fe2ac0b04d3da7f4a05788e

SHA1
f2966a4ef4b6a39068c986362bf0d77c7c4e7d7b

SHA256
6244766ea7d6a0cf98ccf1426e36dd99798dcafada9c11459785e3c9acf31524

SHA512
cee065073884883f14f93bfff5d90b7830bb5c1c30dff09d2556d9646ade0c8775184ad3f152abbc8f79511f9e663a3f037eff9ca8ca963a06403860205b6a19

Download Submit
C:\Windows\System\OrMqsLl.exe

Filesize
1.4MB

MD5
34ed3ac2c9850d2e559f882253ed5071

SHA1
5e8ca7db7afe86a821707ee2c39fe402d9d14062

SHA256
4d56cd47286733d32a3e4478e25dde110be7af0f717cb36a7e016c0f40ccc644

SHA512
13404cfc3e55c0cee05b70123aa18be13d86091e2f48a799fd22fcd37e88d9fb43d09b10ca43ec4df166a413d5707c6b862b28ae7d7dc21573b697bfd1b7996c

Download Submit
C:\Windows\System\PAfKAov.exe

Filesize
1.4MB

MD5
bb9ef711d98afff35054252cfcef645d

SHA1
8bac2ae67e0db3f9272b7f7bc8da8ca464aa0368

SHA256
96f3dad54d6b39001164b23e2919b92fff7073e927374d11508ae0bbda287c3e

SHA512
22a12a7a8c5c1c2e2269615a689097a4c12b83c9f9035cdc0a182479cc59f64a8f5e9bd937539cdb4829f878d642d610c5efe3993e1e40535581e4dbbf532269

Download Submit
C:\Windows\System\SKORoXn.exe

Filesize
1.4MB

MD5
2a055320f17e9edaa2be9fa58f9d3392

SHA1
38face7a4d8cfe3fa5b79163d2996f5669afa829

SHA256
54c9f07c216bc4edcc0d8b8d0810df7aba42f769e9248fb89fd24ea4bae224e7

SHA512
3fa10632cb3210a496d9b0c703e126663a978b0ff47ace924f90d4fb3de858a7ff3459d267cbd4892683ac613c933ab9e397a451e21a48e9f09bcb9a0b49e9f0

Download Submit
C:\Windows\System\TtGGFZX.exe

Filesize
1.4MB

MD5
25373206247eb565974e4f52a64fe492

SHA1
ca4c12eedee4996701d7fd70e120a7405ecba6d0

SHA256
5c4e46364b4d9ffeefaa4e46d5208b708e5055d59d2c0fa4e671ad259d0a5361

SHA512
09629759cecd0af3eb803dfd461dd32799020d3928627170fc0728cd601fb18b603b012fe9504ddfac69ba5076ecc1f6d0a0b78bdef423b1f4c11196846b44c5

Download Submit
C:\Windows\System\XZfINln.exe

Filesize
1.4MB

MD5
052fc506f6013ba1ab624cffc0e66889

SHA1
ce3f9afda467ff4f72a52f743a3e6a71f160c7ba

SHA256
a5a262c0fbe84cb8cf80de82b062492af99bb00ebcf0e42f4cf656a63a481ab2

SHA512
5413aa267f112d1874230fe673fa28974a667867af1379addd0761d1c75615e61a2a772beb0c5abcb3d9f2c0c51b6f583cce205d38b5e7b6df0dbccd7385517c

Download Submit
C:\Windows\System\ZIITyDp.exe

Filesize
1.4MB

MD5
a557a4a7de9db5667e29ea53324a99d4

SHA1
25a8bbc62317ccacba68b09019928a7516d70aeb

SHA256
c567bf839cea7da4602d635eabb795b88e48e160a489eb9dce53149140e0281d

SHA512
8dc69cb4697f12a69ccac3909cb9108010ca16c24c36b564a09a9a8a464105a7915b8bf094e1bfa1576fa7d20a73d6510a88d1e621eb6cf5fd57e8d0101add03

Download Submit
C:\Windows\System\ZxpDzJW.exe

Filesize
1.4MB

MD5
41efba8b1c39cebd407ce36ad0f686e8

SHA1
2339b49415c7648e0ffea30e01984a12a25c32f7

SHA256
6bc12b84297806e3c9bad73db46b012d1a568f2dd033aec44314943188b995d2

SHA512
38e4c7a134f6ac7c90bbd388f649695873bb829db475765a4ccedfedf3659d9eb4d684952ef9b42dcaf68a6eac5fae452fb3d6f1e82afbe893b8c3000f2b74ed

Download Submit
C:\Windows\System\auYDKkn.exe

Filesize
1.4MB

MD5
aa9eee1b8f840fd28fd1e4ed349c83f7

SHA1
964a821eaf0964a1fae59df6626f666d3606d68c

SHA256
73f12f0ba7e88c540106bac44891e56a4adf0fdc949658677a2829414d5e66ca

SHA512
932a1626f04caf88f546a322751bfcec1f47260e9e9d1584c6d30dee48b8849ce29078609c2f25800f5b02a8c4d5b712cbbfd754ec42f8c202f83934bcac66f8

Download Submit
C:\Windows\System\bEhjurw.exe

Filesize
1.4MB

MD5
eed267958cf63eeba3a2fd4677d874f0

SHA1
761f4c3a313068ceaa8df5f4b82cdfccbce6ebd0

SHA256
f2f15a2eb64027b883a32e49ccce4c9423dcd8262f9e5736e2c795e03b0d1c8e

SHA512
26356f1883fcef877befe0e7ef8b57bc99686605ca60502fe761be27b728fd332a7154078accf645158a610f8b6009beee623040defe21316716026963218066

Download Submit
C:\Windows\System\cMpKUbp.exe

Filesize
1.4MB

MD5
3883510f1723e12719e676aa4b4bb8af

SHA1
b7bb4a4a9d451f8b793e09fab945de182f37429f

SHA256
6316ada2f86dc134145693db8a8048d973165188f5be9f8066f846f78874ff04

SHA512
60a397468432d23c7c8a2a12f2fbdea9ad8669b2c405b02a080b361dc0b780f4507140e6b2b8170e2eeb86a16b290cd42e6a6eb7a2082e4d9a27ce5d18eb5c98

Download Submit
C:\Windows\System\ceMICtQ.exe

Filesize
1.4MB

MD5
4a99c0c9f94955e97e73256594648200

SHA1
4de187b1a0a24333bfbb3998cfb86da3dd9abbce

SHA256
ccddbab73b1a468870f5601c596ccec7bf5945ea355f23f058076652ed5bcfcc

SHA512
7defa13eb55d826468bb2368177c2d073b979a9d1e91aa4685f72ce2cbd35936168c7077fb829f36fc189859816ced63e7f9d25f26353dcfadfdc030bdbfe2d8

Download Submit
C:\Windows\System\fLNYQwV.exe

Filesize
1.4MB

MD5
84280e4e706d59208a167475185cbf92

SHA1
e202ff0249742fb365cd88e7f7801494beffd548

SHA256
28edc4cbe7e69a35b2455bc409a6292080843baebe7b45b45cbedf802147c431

SHA512
7bd9b6f747c45f3569f3c4df918ca5c5a30aa230c32a4033e5d4064be85c785c37e27ee3f1f9f553acf744e2a728865167fe9624fdbe8c9e520145c1a691501a

Download Submit
C:\Windows\System\fVBctQo.exe

Filesize
1.4MB

MD5
589620e5fd27fd05306858f9396b1ee0

SHA1
7d4e4067158c1229c26ddf320fb071ac44459975

SHA256
d9bac7d6f8078b6f95dffce588df4e8d5e95782b19580f84b6f11cc0a27ea494

SHA512
cd57a85e19862c0767c5772013d74f1f6fa15fa51eab41c5bf4aee61a4b73ca2b3c823e6b0538fa62e3ee4374da74062c6023b82fed1938a4ec80407cd33ef7f

Download Submit
C:\Windows\System\iTAvXwy.exe

Filesize
1.4MB

MD5
d54fb6d87dd145f1105f945b4677f2fd

SHA1
9146f97b952b7686e02f14f37d018a9f97754029

SHA256
9113366bebb3ab53c56e43fbcde0dc263ff1cb1e43a2431a1abe9aeb22999437

SHA512
517670e078fffb5f3f65e96ede563f3654d84bb3763bd08da17c9a9d702cccfa655643a3d3b4cdcc80ba67ac8462d9277301bb02c68f7c64095952ab0977db1a

Download Submit
C:\Windows\System\kAsganG.exe

Filesize
1.4MB

MD5
309b0d4d0d1ad791c249eccb91d7e1b1

SHA1
6a35964b2371e2fb9b5b7c3e2c9b541681783841

SHA256
6527d671596d30cd92451751ffb8bfcc5dcfe13a447a710461457bbb1e8ac73c

SHA512
b01c5d8815e1ccca591c9177a48a1201c41095132b231f42db0fd52e3302f84c86181c30607b09b0d0ed69bc928d05e292ec6bcbd5e297483b7dc15bbcabe4fd

Download Submit
C:\Windows\System\mTCKuqE.exe

Filesize
1.4MB

MD5
d32fe9a9c77d602bfec292bd0fa5c51d

SHA1
9845b3ac7372e065610eea0dd3a1fd2383dadd8b

SHA256
27a19ee6a4b192f29dfeb3ad50e45a56295cb97de019a5a9e87bd3e565093de3

SHA512
309faec40081690aef81c9ce2ee4c9735d77adccc26d7a6d45372c3ec663319f33529d7ab7ce0f0051440a6f6ecdc08c210058821764b77c85f7f79b8ed165ac

Download Submit
C:\Windows\System\nRoSctw.exe

Filesize
1.4MB

MD5
5fa2ba4ea989b1fdaf7eff8e249c3cde

SHA1
471aebad213742b19f263b1859fbe1d9058caa73

SHA256
c2c366002e7bd2ba3cd3344cb36e0cb34fc0d70a4862b21ab9cac6b20e06d454

SHA512
026bdf7a85bf4e16ec56ca9f72a90cbc3271d18608705b398d6aac88c9485753be19c275f50398be6998cec794f7b833189a96d6363f78596381b52c6cf539e8

Download Submit
C:\Windows\System\ndHHLVc.exe

Filesize
1.4MB

MD5
262a59b1993554d050f65c69f5737296

SHA1
91447a3d96aa20770705c6c0255d980b43184430

SHA256
a843c335e35cfc3289b4dc3c1eb3b168124c43bd67eb0bc541adcdf44167c662

SHA512
23c0a6dc284a2e64e7b5382621143735039b5afc10d02314f7bfa9daf5f1a0d6fb9fa3fcbda4f7e4e92c5f014488000917de68d6f3a3568cbd5a834e0c3ce160

Download Submit
C:\Windows\System\tJxVbPl.exe

Filesize
1.4MB

MD5
00870cd31e82f7aa43b1edccf8f6f573

SHA1
a9876f3f5922c2140b5b2f0069baa68123c38b88

SHA256
3cbd4084248247ca5546eb9cfc92c53f7f6b1111ab8cc84bfc9551d7470736da

SHA512
b3b47aab5e66e9cf8d696c24df37ba7778a1c240f02fb7335dae179785060059e8eea3734d386fbf5ae35e1e8369400f0446b05946ec2f681b2d58665723a40f

Download Submit
C:\Windows\System\vdGqlPo.exe

Filesize
1.4MB

MD5
37fa0ac845af1f0f2ef8b15d877e3e0b

SHA1
509295c0bc792ce1600332eccecbdc4bcb61fcdd

SHA256
ac43abb75d979d62a44c762ebea386673ddaf0c0e00d9792323047f67ad69b91

SHA512
0f2f2a557539c39a7259a994835f37f870d5d5e34933e4f8856708c9f2e77403419174ae15fd0627b217cf9753a549992833b8c85d35d588f658411dabe56945

Download Submit
C:\Windows\System\vfUFUtu.exe

Filesize
1.4MB

MD5
cc28d0186abce240229f6ba348c043b4

SHA1
6bc3abef5422e98ae1debda53c3d2853af41d5b2

SHA256
f703189c1b29a0302239c3a2f37259de00ea8b6f8ac3ea052755a0bc48238d99

SHA512
ea800fa186ed1d2dcc4bafb1dff1c78b069e842cf7bbf10481028cab796d95d318af321ec732731e83d27a9c3f1250b48e2b0cea114ef3c489569c95b857eff7

Download Submit
C:\Windows\System\wAUnbQM.exe

Filesize
1.4MB

MD5
a4ee6b14d1a0e96a134ea3d8ed37fbd0

SHA1
f6b34f068c9ffd55e84edc491beab0ffc2898dc3

SHA256
281b5f9d0b0c74ae4119058d1dccb2e8c1dc751b40be3b77fe9aabb0a9f8fec7

SHA512
75b3a5b26342c7fad5367153b982f0fd7479be37d5d56d820ebad4e3c2c5eb757240c9867b448fc803e2b9b8dc12501ab670b85384e18935c47cdce879d3f983

Download Submit
C:\Windows\System\wZDalyD.exe

Filesize
1.4MB

MD5
e3a1dd4c739f6acebc6d82c5a0a2fdd1

SHA1
7749ac0a058b241cce61bc48334bd0bd084ff3a0

SHA256
ddc296c26a1d0f1f7828f1f48df95ca713e9c28eee0112f41cf088f7a69930a7

SHA512
5389a6f021bf257cd6827a3bdebd81c384fbaf3ec6aff31cf7bd06339a1c21fd0a9a85c676be165efbfcea92ba094abeb98923a0e417558cede16a55d4ed5859

Download Submit
C:\Windows\System\yXGMaCd.exe

Filesize
1.4MB

MD5
bea8ff2827a08373c803b49a79ab94f6

SHA1
17797eb01217eaf5a13611c4f1e28055bc899d05

SHA256
3e96b865c25f0c0b48b5e858ca1f77eee9dfece28e18e78092d16be45706062e

SHA512
2ea28cddf1e430b7e6903ad382e1dea0b381a87d2e382b27a9ad7faaa49176d9ee6649a01875f977ec37cddeece22617e07baa14509d6798af30ff2e461740f9

Download Submit
C:\Windows\System\yZlJBnx.exe

Filesize
1.4MB

MD5
1a10664408e9c6bd5617db6ef431e4dc

SHA1
c48557e6b2821ccba88b3748905bc5a0642cb8da

SHA256
8687b29741bbd4b75550d57e34310f2a66c923d37e22592e1771a8f76550a9b1

SHA512
fef4ff5422fcbb063fe3ab2e91e247e361702998b82e9af3e1422a3c9e4b09560f76a57e50bdf7f1c4bd75c2cd9edc2715297c0f784f3e465e6a05bf14685cde

Download Submit
memory/3024-0-0x00000210DA570000-0x00000210DA580000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads