xmrig | 96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d

Analysis

max time kernel
95s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
Size

1.2MB
MD5

946a97de1b42d6a91213d3fdd58cfa50
SHA1

2f8267db0d1c3dbbb6b0d78b1a517f3f4103aa61
SHA256

96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d
SHA512

fadbd9b3503d3fc361f044693356914900eed8e586ae078e3c74ef61dc6f6e35806fc24c064b439eabb47a67b5c0731cb4ce667c9ed00e1cab7b4a64617fb44d
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70Vwv0w9:GezaTF8FcNkNdfE0pZ9ozttwIRx2VoIs

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b88-3.dat	xmrig
behavioral2/files/0x000a000000023b8c-8.dat	xmrig
behavioral2/files/0x000a000000023b8d-6.dat	xmrig
behavioral2/files/0x000a000000023b8e-16.dat	xmrig
behavioral2/files/0x000a000000023b91-28.dat	xmrig
behavioral2/files/0x000a000000023b92-31.dat	xmrig
behavioral2/files/0x000a000000023b94-37.dat	xmrig
behavioral2/files/0x000a000000023b95-42.dat	xmrig
behavioral2/files/0x000a000000023b96-43.dat	xmrig
behavioral2/files/0x000a000000023b98-72.dat	xmrig
behavioral2/files/0x000a000000023b99-80.dat	xmrig
behavioral2/files/0x000a000000023ba6-139.dat	xmrig
behavioral2/files/0x000a000000023bab-170.dat	xmrig
behavioral2/files/0x000b000000023bae-180.dat	xmrig
behavioral2/files/0x000a000000023bad-176.dat	xmrig
behavioral2/files/0x000a000000023bac-173.dat	xmrig
behavioral2/files/0x000a000000023baa-165.dat	xmrig
behavioral2/files/0x000a000000023ba8-157.dat	xmrig
behavioral2/files/0x000a000000023ba5-147.dat	xmrig
behavioral2/files/0x000a000000023ba7-144.dat	xmrig
behavioral2/files/0x000a000000023ba4-130.dat	xmrig
behavioral2/files/0x000a000000023ba9-159.dat	xmrig
behavioral2/files/0x000a000000023ba3-128.dat	xmrig
behavioral2/files/0x000a000000023ba2-126.dat	xmrig
behavioral2/files/0x000a000000023ba1-124.dat	xmrig
behavioral2/files/0x000a000000023ba0-122.dat	xmrig
behavioral2/files/0x000a000000023b9e-120.dat	xmrig
behavioral2/files/0x000a000000023b9f-118.dat	xmrig
behavioral2/files/0x000a000000023b9a-116.dat	xmrig
behavioral2/files/0x000a000000023b9d-111.dat	xmrig
behavioral2/files/0x000a000000023b9c-97.dat	xmrig
behavioral2/files/0x000a000000023b9b-94.dat	xmrig
behavioral2/files/0x000a000000023b93-60.dat	xmrig
behavioral2/files/0x000a000000023b97-70.dat	xmrig
behavioral2/files/0x000a000000023b90-54.dat	xmrig
behavioral2/files/0x000a000000023b8f-53.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4692	gabQXZL.exe
1772	wYWBuhV.exe
4860	nioLCKG.exe
1296	WmriJDm.exe
4804	wJFfXdM.exe
2352	pmnHhVa.exe
4184	JmrUcpb.exe
3656	gGgxCDL.exe
3096	fMGIcyt.exe
2108	QXpyaVI.exe
2144	PpvjEEj.exe
4952	EMvmbyu.exe
2820	QxKerOv.exe
3480	CwscRQI.exe
680	lDedAkv.exe
2608	QKvpxOm.exe
3216	JwThDAM.exe
3768	NNXKMUO.exe
1460	fyzgwpX.exe
5012	YeZHWJn.exe
4820	aRPlgLf.exe
1576	GZyFriO.exe
5068	vGlHQFc.exe
2188	bAGxjWB.exe
4576	kCXbUtN.exe
5044	NoRemiH.exe
1328	PMHROpW.exe
4680	RbBlMSn.exe
2168	LCqUspU.exe
5048	xTSeEGy.exe
856	nIgBsWC.exe
2824	QmmeVWm.exe
1208	vzTPqOP.exe
3404	SpvUmnF.exe
3832	kQENwzh.exe
2092	DBJYgFM.exe
4800	MzqjsQw.exe
4060	OfVIKIs.exe
3336	nEsVVcr.exe
4772	qiKybuY.exe
3260	BfVunya.exe
2224	HoKJrNP.exe
2308	xWnKGdG.exe
4764	XkZDkiS.exe
4560	gNPwqKP.exe
364	sxznejk.exe
1792	azdWnhe.exe
4232	bfgARuQ.exe
2480	Ordheiw.exe
1748	vKaiEby.exe
4636	cosekyD.exe
1588	NsgNwhP.exe
3236	ovOlGfR.exe
2320	UuvzBIw.exe
4704	PUotkQX.exe
3056	BiwhESz.exe
1768	pTusADc.exe
4736	LupOzqW.exe
1084	oguQwJY.exe
5092	btUFYfz.exe
4896	kjixjMz.exe
3696	OuOQpPn.exe
3400	sjshKvi.exe
3220	iITVIEG.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CsbyJEm.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\ijALlEK.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\MzqjsQw.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\bfgARuQ.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\FEeiYrm.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\KJypAQZ.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\nLkufpC.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\QfmGTaU.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\wroEaiH.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\walhSLh.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\rncOSAl.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\KzbvRXf.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\qgyjsit.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\kpijqNl.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\hhSYRal.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\QNVKJxw.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\IfjnwOs.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\wIxOMRN.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\jHVCDZN.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\oguQwJY.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\JbrPONL.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\tGzTCfV.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\xXOvZCE.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\sBnLnfs.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\oiJccGs.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\hrNpEdq.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\pjCTqkv.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\dztTsYY.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\okWGako.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\DqqybVw.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\HfBLXqO.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\XemqLWt.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\oktNbWv.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\yrkIzAT.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\uDaEqFv.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\TudghpD.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\MneObDe.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\hJaDpSb.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\lcPwufm.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\lDedAkv.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\vKaiEby.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\btUFYfz.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\JDjqjDQ.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\swprYyq.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\kDzrNMt.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\WqEXuLY.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\drICwva.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\lcoVkRV.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\WGzwyOR.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\kyIrAUZ.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\tyXOaHs.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\YCVxLnq.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\MARaOfo.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\GtLqtrh.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\PCPAqzz.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\eGVEtNh.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\wdanVqe.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\PhSKDzZ.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\kCXbUtN.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\rHLjiYG.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\PaMjVoQ.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\wXrpUWC.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\ZGtzVIB.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
File created	C:\Windows\System\zmIHbwa.exe	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4692	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	84
PID 2656 wrote to memory of 4692	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	84
PID 2656 wrote to memory of 1772	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	85
PID 2656 wrote to memory of 1772	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	85
PID 2656 wrote to memory of 4860	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	86
PID 2656 wrote to memory of 4860	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	86
PID 2656 wrote to memory of 1296	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	87
PID 2656 wrote to memory of 1296	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	87
PID 2656 wrote to memory of 4804	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	88
PID 2656 wrote to memory of 4804	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	88
PID 2656 wrote to memory of 2352	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	89
PID 2656 wrote to memory of 2352	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	89
PID 2656 wrote to memory of 4184	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	90
PID 2656 wrote to memory of 4184	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	90
PID 2656 wrote to memory of 3656	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	91
PID 2656 wrote to memory of 3656	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	91
PID 2656 wrote to memory of 3096	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	92
PID 2656 wrote to memory of 3096	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	92
PID 2656 wrote to memory of 2108	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	93
PID 2656 wrote to memory of 2108	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	93
PID 2656 wrote to memory of 2144	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	94
PID 2656 wrote to memory of 2144	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	94
PID 2656 wrote to memory of 4952	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	95
PID 2656 wrote to memory of 4952	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	95
PID 2656 wrote to memory of 2820	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	96
PID 2656 wrote to memory of 2820	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	96
PID 2656 wrote to memory of 3480	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	97
PID 2656 wrote to memory of 3480	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	97
PID 2656 wrote to memory of 680	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	98
PID 2656 wrote to memory of 680	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	98
PID 2656 wrote to memory of 2608	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	99
PID 2656 wrote to memory of 2608	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	99
PID 2656 wrote to memory of 3216	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	100
PID 2656 wrote to memory of 3216	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	100
PID 2656 wrote to memory of 3768	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	101
PID 2656 wrote to memory of 3768	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	101
PID 2656 wrote to memory of 1460	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	102
PID 2656 wrote to memory of 1460	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	102
PID 2656 wrote to memory of 5012	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	103
PID 2656 wrote to memory of 5012	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	103
PID 2656 wrote to memory of 4820	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	104
PID 2656 wrote to memory of 4820	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	104
PID 2656 wrote to memory of 1576	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	105
PID 2656 wrote to memory of 1576	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	105
PID 2656 wrote to memory of 5068	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	106
PID 2656 wrote to memory of 5068	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	106
PID 2656 wrote to memory of 2188	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	107
PID 2656 wrote to memory of 2188	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	107
PID 2656 wrote to memory of 4576	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	108
PID 2656 wrote to memory of 4576	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	108
PID 2656 wrote to memory of 5044	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	109
PID 2656 wrote to memory of 5044	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	109
PID 2656 wrote to memory of 1328	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	110
PID 2656 wrote to memory of 1328	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	110
PID 2656 wrote to memory of 4680	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	111
PID 2656 wrote to memory of 4680	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	111
PID 2656 wrote to memory of 2168	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	112
PID 2656 wrote to memory of 2168	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	112
PID 2656 wrote to memory of 5048	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	113
PID 2656 wrote to memory of 5048	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	113
PID 2656 wrote to memory of 856	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	114
PID 2656 wrote to memory of 856	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	114
PID 2656 wrote to memory of 2824	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	115
PID 2656 wrote to memory of 2824	2656	96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe	115

C:\Users\Admin\AppData\Local\Temp\96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe
"C:\Users\Admin\AppData\Local\Temp\96d17c246cc78f2efea842dbdcba54e4bcf571bf0533897be30fbcb13c9ab88d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\System\gabQXZL.exe
  C:\Windows\System\gabQXZL.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\wYWBuhV.exe
  C:\Windows\System\wYWBuhV.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\nioLCKG.exe
  C:\Windows\System\nioLCKG.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\WmriJDm.exe
  C:\Windows\System\WmriJDm.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\wJFfXdM.exe
  C:\Windows\System\wJFfXdM.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\pmnHhVa.exe
  C:\Windows\System\pmnHhVa.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\JmrUcpb.exe
  C:\Windows\System\JmrUcpb.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\gGgxCDL.exe
  C:\Windows\System\gGgxCDL.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\fMGIcyt.exe
  C:\Windows\System\fMGIcyt.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\QXpyaVI.exe
  C:\Windows\System\QXpyaVI.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\PpvjEEj.exe
  C:\Windows\System\PpvjEEj.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\EMvmbyu.exe
  C:\Windows\System\EMvmbyu.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\QxKerOv.exe
  C:\Windows\System\QxKerOv.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\CwscRQI.exe
  C:\Windows\System\CwscRQI.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\lDedAkv.exe
  C:\Windows\System\lDedAkv.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\QKvpxOm.exe
  C:\Windows\System\QKvpxOm.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\JwThDAM.exe
  C:\Windows\System\JwThDAM.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\NNXKMUO.exe
  C:\Windows\System\NNXKMUO.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\fyzgwpX.exe
  C:\Windows\System\fyzgwpX.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\YeZHWJn.exe
  C:\Windows\System\YeZHWJn.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\aRPlgLf.exe
  C:\Windows\System\aRPlgLf.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\GZyFriO.exe
  C:\Windows\System\GZyFriO.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\vGlHQFc.exe
  C:\Windows\System\vGlHQFc.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\bAGxjWB.exe
  C:\Windows\System\bAGxjWB.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\kCXbUtN.exe
  C:\Windows\System\kCXbUtN.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\NoRemiH.exe
  C:\Windows\System\NoRemiH.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\PMHROpW.exe
  C:\Windows\System\PMHROpW.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\RbBlMSn.exe
  C:\Windows\System\RbBlMSn.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\LCqUspU.exe
  C:\Windows\System\LCqUspU.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\xTSeEGy.exe
  C:\Windows\System\xTSeEGy.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\nIgBsWC.exe
  C:\Windows\System\nIgBsWC.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\QmmeVWm.exe
  C:\Windows\System\QmmeVWm.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\vzTPqOP.exe
  C:\Windows\System\vzTPqOP.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\SpvUmnF.exe
  C:\Windows\System\SpvUmnF.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\kQENwzh.exe
  C:\Windows\System\kQENwzh.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\DBJYgFM.exe
  C:\Windows\System\DBJYgFM.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\MzqjsQw.exe
  C:\Windows\System\MzqjsQw.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\cosekyD.exe
  C:\Windows\System\cosekyD.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\OfVIKIs.exe
  C:\Windows\System\OfVIKIs.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\nEsVVcr.exe
  C:\Windows\System\nEsVVcr.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\qiKybuY.exe
  C:\Windows\System\qiKybuY.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\BfVunya.exe
  C:\Windows\System\BfVunya.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\HoKJrNP.exe
  C:\Windows\System\HoKJrNP.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\xWnKGdG.exe
  C:\Windows\System\xWnKGdG.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\XkZDkiS.exe
  C:\Windows\System\XkZDkiS.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\gNPwqKP.exe
  C:\Windows\System\gNPwqKP.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\azdWnhe.exe
  C:\Windows\System\azdWnhe.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\sxznejk.exe
  C:\Windows\System\sxznejk.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\bfgARuQ.exe
  C:\Windows\System\bfgARuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\Ordheiw.exe
  C:\Windows\System\Ordheiw.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\vKaiEby.exe
  C:\Windows\System\vKaiEby.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\NsgNwhP.exe
  C:\Windows\System\NsgNwhP.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\ovOlGfR.exe
  C:\Windows\System\ovOlGfR.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\UuvzBIw.exe
  C:\Windows\System\UuvzBIw.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\PUotkQX.exe
  C:\Windows\System\PUotkQX.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\BiwhESz.exe
  C:\Windows\System\BiwhESz.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\pTusADc.exe
  C:\Windows\System\pTusADc.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\LupOzqW.exe
  C:\Windows\System\LupOzqW.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\oguQwJY.exe
  C:\Windows\System\oguQwJY.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\btUFYfz.exe
  C:\Windows\System\btUFYfz.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\kjixjMz.exe
  C:\Windows\System\kjixjMz.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\OuOQpPn.exe
  C:\Windows\System\OuOQpPn.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\sjshKvi.exe
  C:\Windows\System\sjshKvi.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\iITVIEG.exe
  C:\Windows\System\iITVIEG.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\yZmJTCG.exe
  C:\Windows\System\yZmJTCG.exe
  2⤵
  PID:3964
- C:\Windows\System\ZtfzmlQ.exe
  C:\Windows\System\ZtfzmlQ.exe
  2⤵
  PID:2476
- C:\Windows\System\vuxyJYM.exe
  C:\Windows\System\vuxyJYM.exe
  2⤵
  PID:1708
- C:\Windows\System\vRAYpfu.exe
  C:\Windows\System\vRAYpfu.exe
  2⤵
  PID:1124
- C:\Windows\System\dATtxmm.exe
  C:\Windows\System\dATtxmm.exe
  2⤵
  PID:1704
- C:\Windows\System\KputNNE.exe
  C:\Windows\System\KputNNE.exe
  2⤵
  PID:1516
- C:\Windows\System\EsoXVGp.exe
  C:\Windows\System\EsoXVGp.exe
  2⤵
  PID:4136
- C:\Windows\System\rqnzSqX.exe
  C:\Windows\System\rqnzSqX.exe
  2⤵
  PID:3852
- C:\Windows\System\JfcIkuA.exe
  C:\Windows\System\JfcIkuA.exe
  2⤵
  PID:4552
- C:\Windows\System\xXOvZCE.exe
  C:\Windows\System\xXOvZCE.exe
  2⤵
  PID:1608
- C:\Windows\System\NJgLNcW.exe
  C:\Windows\System\NJgLNcW.exe
  2⤵
  PID:1568
- C:\Windows\System\UdjhWat.exe
  C:\Windows\System\UdjhWat.exe
  2⤵
  PID:2580
- C:\Windows\System\nrzsiUM.exe
  C:\Windows\System\nrzsiUM.exe
  2⤵
  PID:3028
- C:\Windows\System\uyghDrI.exe
  C:\Windows\System\uyghDrI.exe
  2⤵
  PID:1812
- C:\Windows\System\VEIpSaT.exe
  C:\Windows\System\VEIpSaT.exe
  2⤵
  PID:3428
- C:\Windows\System\XgEWIgZ.exe
  C:\Windows\System\XgEWIgZ.exe
  2⤵
  PID:4020
- C:\Windows\System\fXtnGcn.exe
  C:\Windows\System\fXtnGcn.exe
  2⤵
  PID:2196
- C:\Windows\System\KtRZGsD.exe
  C:\Windows\System\KtRZGsD.exe
  2⤵
  PID:2636
- C:\Windows\System\vIgGypu.exe
  C:\Windows\System\vIgGypu.exe
  2⤵
  PID:2388
- C:\Windows\System\fWmATOS.exe
  C:\Windows\System\fWmATOS.exe
  2⤵
  PID:4436
- C:\Windows\System\pjCTqkv.exe
  C:\Windows\System\pjCTqkv.exe
  2⤵
  PID:3292
- C:\Windows\System\vcbbemU.exe
  C:\Windows\System\vcbbemU.exe
  2⤵
  PID:3452
- C:\Windows\System\nAyjkWn.exe
  C:\Windows\System\nAyjkWn.exe
  2⤵
  PID:4912
- C:\Windows\System\NPTIsIR.exe
  C:\Windows\System\NPTIsIR.exe
  2⤵
  PID:1344
- C:\Windows\System\sxtgkVi.exe
  C:\Windows\System\sxtgkVi.exe
  2⤵
  PID:4064
- C:\Windows\System\idgNrgz.exe
  C:\Windows\System\idgNrgz.exe
  2⤵
  PID:4592
- C:\Windows\System\xkCPMCZ.exe
  C:\Windows\System\xkCPMCZ.exe
  2⤵
  PID:4332
- C:\Windows\System\OdwpLHo.exe
  C:\Windows\System\OdwpLHo.exe
  2⤵
  PID:4796
- C:\Windows\System\pEorMoy.exe
  C:\Windows\System\pEorMoy.exe
  2⤵
  PID:5124
- C:\Windows\System\uOuULRY.exe
  C:\Windows\System\uOuULRY.exe
  2⤵
  PID:5140
- C:\Windows\System\sYFxJjT.exe
  C:\Windows\System\sYFxJjT.exe
  2⤵
  PID:5160
- C:\Windows\System\BbLjZMk.exe
  C:\Windows\System\BbLjZMk.exe
  2⤵
  PID:5176
- C:\Windows\System\QSuTaQl.exe
  C:\Windows\System\QSuTaQl.exe
  2⤵
  PID:5192
- C:\Windows\System\zvIqDyR.exe
  C:\Windows\System\zvIqDyR.exe
  2⤵
  PID:5208
- C:\Windows\System\neqYnYk.exe
  C:\Windows\System\neqYnYk.exe
  2⤵
  PID:5224
- C:\Windows\System\SkxFsPk.exe
  C:\Windows\System\SkxFsPk.exe
  2⤵
  PID:5240
- C:\Windows\System\HibXhNZ.exe
  C:\Windows\System\HibXhNZ.exe
  2⤵
  PID:5256
- C:\Windows\System\zYBLIcg.exe
  C:\Windows\System\zYBLIcg.exe
  2⤵
  PID:5272
- C:\Windows\System\ZrkkIpI.exe
  C:\Windows\System\ZrkkIpI.exe
  2⤵
  PID:5288
- C:\Windows\System\OVwYlNY.exe
  C:\Windows\System\OVwYlNY.exe
  2⤵
  PID:5516
- C:\Windows\System\NgxzMdt.exe
  C:\Windows\System\NgxzMdt.exe
  2⤵
  PID:5532
- C:\Windows\System\PCsGsrt.exe
  C:\Windows\System\PCsGsrt.exe
  2⤵
  PID:5548
- C:\Windows\System\bQlLOyB.exe
  C:\Windows\System\bQlLOyB.exe
  2⤵
  PID:5564
- C:\Windows\System\ZJjSDks.exe
  C:\Windows\System\ZJjSDks.exe
  2⤵
  PID:5580
- C:\Windows\System\xkKpcSZ.exe
  C:\Windows\System\xkKpcSZ.exe
  2⤵
  PID:5600
- C:\Windows\System\kWACijC.exe
  C:\Windows\System\kWACijC.exe
  2⤵
  PID:5628
- C:\Windows\System\CEPpAYu.exe
  C:\Windows\System\CEPpAYu.exe
  2⤵
  PID:5648
- C:\Windows\System\lbWGMKG.exe
  C:\Windows\System\lbWGMKG.exe
  2⤵
  PID:5672
- C:\Windows\System\lixQUIE.exe
  C:\Windows\System\lixQUIE.exe
  2⤵
  PID:5696
- C:\Windows\System\lkvMEUv.exe
  C:\Windows\System\lkvMEUv.exe
  2⤵
  PID:5720
- C:\Windows\System\nhLczhW.exe
  C:\Windows\System\nhLczhW.exe
  2⤵
  PID:5744
- C:\Windows\System\bpgMxoC.exe
  C:\Windows\System\bpgMxoC.exe
  2⤵
  PID:5772
- C:\Windows\System\ZonhXQF.exe
  C:\Windows\System\ZonhXQF.exe
  2⤵
  PID:5808
- C:\Windows\System\MFjJrGq.exe
  C:\Windows\System\MFjJrGq.exe
  2⤵
  PID:5840
- C:\Windows\System\jgWuOAt.exe
  C:\Windows\System\jgWuOAt.exe
  2⤵
  PID:5868
- C:\Windows\System\jbxAdHw.exe
  C:\Windows\System\jbxAdHw.exe
  2⤵
  PID:5908
- C:\Windows\System\hpFLVau.exe
  C:\Windows\System\hpFLVau.exe
  2⤵
  PID:5932
- C:\Windows\System\tVqjqFa.exe
  C:\Windows\System\tVqjqFa.exe
  2⤵
  PID:5968
- C:\Windows\System\kUDQmXq.exe
  C:\Windows\System\kUDQmXq.exe
  2⤵
  PID:6000
- C:\Windows\System\pEYaFLv.exe
  C:\Windows\System\pEYaFLv.exe
  2⤵
  PID:6020
- C:\Windows\System\VWgrjhd.exe
  C:\Windows\System\VWgrjhd.exe
  2⤵
  PID:6044
- C:\Windows\System\LPrORVs.exe
  C:\Windows\System\LPrORVs.exe
  2⤵
  PID:6060
- C:\Windows\System\PbXcymf.exe
  C:\Windows\System\PbXcymf.exe
  2⤵
  PID:6088
- C:\Windows\System\FsqMaOH.exe
  C:\Windows\System\FsqMaOH.exe
  2⤵
  PID:6136
- C:\Windows\System\GhvAPRI.exe
  C:\Windows\System\GhvAPRI.exe
  2⤵
  PID:3508
- C:\Windows\System\qEodzGs.exe
  C:\Windows\System\qEodzGs.exe
  2⤵
  PID:736
- C:\Windows\System\BcqFNPw.exe
  C:\Windows\System\BcqFNPw.exe
  2⤵
  PID:4432
- C:\Windows\System\teMIpVO.exe
  C:\Windows\System\teMIpVO.exe
  2⤵
  PID:2924
- C:\Windows\System\JOmbwbx.exe
  C:\Windows\System\JOmbwbx.exe
  2⤵
  PID:2160
- C:\Windows\System\oYaFQpt.exe
  C:\Windows\System\oYaFQpt.exe
  2⤵
  PID:5156
- C:\Windows\System\gzUrYRS.exe
  C:\Windows\System\gzUrYRS.exe
  2⤵
  PID:5216
- C:\Windows\System\dNrOXhS.exe
  C:\Windows\System\dNrOXhS.exe
  2⤵
  PID:5248
- C:\Windows\System\ZncOPMD.exe
  C:\Windows\System\ZncOPMD.exe
  2⤵
  PID:5328
- C:\Windows\System\YVrpVYa.exe
  C:\Windows\System\YVrpVYa.exe
  2⤵
  PID:5376
- C:\Windows\System\GEBWHpb.exe
  C:\Windows\System\GEBWHpb.exe
  2⤵
  PID:5448
- C:\Windows\System\xDRdIgp.exe
  C:\Windows\System\xDRdIgp.exe
  2⤵
  PID:1076
- C:\Windows\System\tAZWGns.exe
  C:\Windows\System\tAZWGns.exe
  2⤵
  PID:2132
- C:\Windows\System\OFmfAsJ.exe
  C:\Windows\System\OFmfAsJ.exe
  2⤵
  PID:3496
- C:\Windows\System\LFxyTeP.exe
  C:\Windows\System\LFxyTeP.exe
  2⤵
  PID:1212
- C:\Windows\System\qNazZEn.exe
  C:\Windows\System\qNazZEn.exe
  2⤵
  PID:1180
- C:\Windows\System\jiEuhby.exe
  C:\Windows\System\jiEuhby.exe
  2⤵
  PID:4572
- C:\Windows\System\FATAxOz.exe
  C:\Windows\System\FATAxOz.exe
  2⤵
  PID:1896
- C:\Windows\System\ikkQGSn.exe
  C:\Windows\System\ikkQGSn.exe
  2⤵
  PID:2212
- C:\Windows\System\HQWWPrt.exe
  C:\Windows\System\HQWWPrt.exe
  2⤵
  PID:5664
- C:\Windows\System\rAVJxgK.exe
  C:\Windows\System\rAVJxgK.exe
  2⤵
  PID:5668
- C:\Windows\System\OmCEQdj.exe
  C:\Windows\System\OmCEQdj.exe
  2⤵
  PID:5740
- C:\Windows\System\oktNbWv.exe
  C:\Windows\System\oktNbWv.exe
  2⤵
  PID:5756
- C:\Windows\System\yKPYPoa.exe
  C:\Windows\System\yKPYPoa.exe
  2⤵
  PID:5880
- C:\Windows\System\oGtoycu.exe
  C:\Windows\System\oGtoycu.exe
  2⤵
  PID:5940
- C:\Windows\System\VzIgpzK.exe
  C:\Windows\System\VzIgpzK.exe
  2⤵
  PID:5988
- C:\Windows\System\iYlVdZb.exe
  C:\Windows\System\iYlVdZb.exe
  2⤵
  PID:6032
- C:\Windows\System\AvePZmK.exe
  C:\Windows\System\AvePZmK.exe
  2⤵
  PID:6080
- C:\Windows\System\GtLqtrh.exe
  C:\Windows\System\GtLqtrh.exe
  2⤵
  PID:2784
- C:\Windows\System\EZEjsrf.exe
  C:\Windows\System\EZEjsrf.exe
  2⤵
  PID:2692
- C:\Windows\System\Wtoysng.exe
  C:\Windows\System\Wtoysng.exe
  2⤵
  PID:5008
- C:\Windows\System\mqVwmHH.exe
  C:\Windows\System\mqVwmHH.exe
  2⤵
  PID:2912
- C:\Windows\System\uGOlChT.exe
  C:\Windows\System\uGOlChT.exe
  2⤵
  PID:5280
- C:\Windows\System\ngZMdtG.exe
  C:\Windows\System\ngZMdtG.exe
  2⤵
  PID:5368
- C:\Windows\System\JNvCvxt.exe
  C:\Windows\System\JNvCvxt.exe
  2⤵
  PID:3896
- C:\Windows\System\rBbDwiw.exe
  C:\Windows\System\rBbDwiw.exe
  2⤵
  PID:3128
- C:\Windows\System\ZvkLSzM.exe
  C:\Windows\System\ZvkLSzM.exe
  2⤵
  PID:2616
- C:\Windows\System\ooZmrcm.exe
  C:\Windows\System\ooZmrcm.exe
  2⤵
  PID:5544
- C:\Windows\System\lhgNVrg.exe
  C:\Windows\System\lhgNVrg.exe
  2⤵
  PID:5660
- C:\Windows\System\AFAOWeH.exe
  C:\Windows\System\AFAOWeH.exe
  2⤵
  PID:5852
- C:\Windows\System\xSumASq.exe
  C:\Windows\System\xSumASq.exe
  2⤵
  PID:6056
- C:\Windows\System\wvIJTJG.exe
  C:\Windows\System\wvIJTJG.exe
  2⤵
  PID:6012
- C:\Windows\System\itApHvx.exe
  C:\Windows\System\itApHvx.exe
  2⤵
  PID:3624
- C:\Windows\System\nWSLTmZ.exe
  C:\Windows\System\nWSLTmZ.exe
  2⤵
  PID:1996
- C:\Windows\System\aWsfgny.exe
  C:\Windows\System\aWsfgny.exe
  2⤵
  PID:3396
- C:\Windows\System\lnUIZoh.exe
  C:\Windows\System\lnUIZoh.exe
  2⤵
  PID:1080
- C:\Windows\System\OuaxZhS.exe
  C:\Windows\System\OuaxZhS.exe
  2⤵
  PID:5764
- C:\Windows\System\OPStnun.exe
  C:\Windows\System\OPStnun.exe
  2⤵
  PID:5184
- C:\Windows\System\Hxsmesn.exe
  C:\Windows\System\Hxsmesn.exe
  2⤵
  PID:5688
- C:\Windows\System\oJVmUUE.exe
  C:\Windows\System\oJVmUUE.exe
  2⤵
  PID:6148
- C:\Windows\System\WvHmfhp.exe
  C:\Windows\System\WvHmfhp.exe
  2⤵
  PID:6172
- C:\Windows\System\hfXuNqN.exe
  C:\Windows\System\hfXuNqN.exe
  2⤵
  PID:6196
- C:\Windows\System\sYgJdZm.exe
  C:\Windows\System\sYgJdZm.exe
  2⤵
  PID:6216
- C:\Windows\System\lIFQtuF.exe
  C:\Windows\System\lIFQtuF.exe
  2⤵
  PID:6240
- C:\Windows\System\RKicLUK.exe
  C:\Windows\System\RKicLUK.exe
  2⤵
  PID:6272
- C:\Windows\System\EnKbwYj.exe
  C:\Windows\System\EnKbwYj.exe
  2⤵
  PID:6292
- C:\Windows\System\qoRzJwB.exe
  C:\Windows\System\qoRzJwB.exe
  2⤵
  PID:6320
- C:\Windows\System\yrkIzAT.exe
  C:\Windows\System\yrkIzAT.exe
  2⤵
  PID:6344
- C:\Windows\System\rHEDcmb.exe
  C:\Windows\System\rHEDcmb.exe
  2⤵
  PID:6384
- C:\Windows\System\AFqZIxW.exe
  C:\Windows\System\AFqZIxW.exe
  2⤵
  PID:6412
- C:\Windows\System\qEnOlWN.exe
  C:\Windows\System\qEnOlWN.exe
  2⤵
  PID:6440
- C:\Windows\System\qgyjsit.exe
  C:\Windows\System\qgyjsit.exe
  2⤵
  PID:6468
- C:\Windows\System\QcpsNfE.exe
  C:\Windows\System\QcpsNfE.exe
  2⤵
  PID:6488
- C:\Windows\System\YCWvmhG.exe
  C:\Windows\System\YCWvmhG.exe
  2⤵
  PID:6516
- C:\Windows\System\KlOhyXn.exe
  C:\Windows\System\KlOhyXn.exe
  2⤵
  PID:6544
- C:\Windows\System\muyfGsz.exe
  C:\Windows\System\muyfGsz.exe
  2⤵
  PID:6560
- C:\Windows\System\PtYUaaa.exe
  C:\Windows\System\PtYUaaa.exe
  2⤵
  PID:6576
- C:\Windows\System\sOVuoui.exe
  C:\Windows\System\sOVuoui.exe
  2⤵
  PID:6600
- C:\Windows\System\JqVlQRz.exe
  C:\Windows\System\JqVlQRz.exe
  2⤵
  PID:6628
- C:\Windows\System\PhpznDy.exe
  C:\Windows\System\PhpznDy.exe
  2⤵
  PID:6656
- C:\Windows\System\xXdRzfw.exe
  C:\Windows\System\xXdRzfw.exe
  2⤵
  PID:6680
- C:\Windows\System\HGDvBhW.exe
  C:\Windows\System\HGDvBhW.exe
  2⤵
  PID:6712
- C:\Windows\System\VkfKZIt.exe
  C:\Windows\System\VkfKZIt.exe
  2⤵
  PID:6736
- C:\Windows\System\bVtxyne.exe
  C:\Windows\System\bVtxyne.exe
  2⤵
  PID:6768
- C:\Windows\System\DZKSqTW.exe
  C:\Windows\System\DZKSqTW.exe
  2⤵
  PID:6800
- C:\Windows\System\zGkXGyZ.exe
  C:\Windows\System\zGkXGyZ.exe
  2⤵
  PID:6832
- C:\Windows\System\mvXHPbG.exe
  C:\Windows\System\mvXHPbG.exe
  2⤵
  PID:6852
- C:\Windows\System\oRTmBDp.exe
  C:\Windows\System\oRTmBDp.exe
  2⤵
  PID:6876
- C:\Windows\System\OPTFfFX.exe
  C:\Windows\System\OPTFfFX.exe
  2⤵
  PID:6904
- C:\Windows\System\kAbnjwW.exe
  C:\Windows\System\kAbnjwW.exe
  2⤵
  PID:6932
- C:\Windows\System\UtavXda.exe
  C:\Windows\System\UtavXda.exe
  2⤵
  PID:6964
- C:\Windows\System\EWmPNbR.exe
  C:\Windows\System\EWmPNbR.exe
  2⤵
  PID:6988
- C:\Windows\System\hWUdOEr.exe
  C:\Windows\System\hWUdOEr.exe
  2⤵
  PID:7020
- C:\Windows\System\FGwWHRE.exe
  C:\Windows\System\FGwWHRE.exe
  2⤵
  PID:7044
- C:\Windows\System\ILgmqiS.exe
  C:\Windows\System\ILgmqiS.exe
  2⤵
  PID:7072
- C:\Windows\System\VenuGvp.exe
  C:\Windows\System\VenuGvp.exe
  2⤵
  PID:7100
- C:\Windows\System\uDaEqFv.exe
  C:\Windows\System\uDaEqFv.exe
  2⤵
  PID:7128
- C:\Windows\System\TzkquMS.exe
  C:\Windows\System\TzkquMS.exe
  2⤵
  PID:5620
- C:\Windows\System\KXjxIBj.exe
  C:\Windows\System\KXjxIBj.exe
  2⤵
  PID:6188
- C:\Windows\System\ApDbkze.exe
  C:\Windows\System\ApDbkze.exe
  2⤵
  PID:5824
- C:\Windows\System\GJQOKYG.exe
  C:\Windows\System\GJQOKYG.exe
  2⤵
  PID:6236
- C:\Windows\System\cSFrmco.exe
  C:\Windows\System\cSFrmco.exe
  2⤵
  PID:6212
- C:\Windows\System\FIOMDeK.exe
  C:\Windows\System\FIOMDeK.exe
  2⤵
  PID:6336
- C:\Windows\System\jZxEQfa.exe
  C:\Windows\System\jZxEQfa.exe
  2⤵
  PID:6404
- C:\Windows\System\FKZOfSR.exe
  C:\Windows\System\FKZOfSR.exe
  2⤵
  PID:6432
- C:\Windows\System\CgihIal.exe
  C:\Windows\System\CgihIal.exe
  2⤵
  PID:6532
- C:\Windows\System\abAsoQW.exe
  C:\Windows\System\abAsoQW.exe
  2⤵
  PID:6504
- C:\Windows\System\SXOhERe.exe
  C:\Windows\System\SXOhERe.exe
  2⤵
  PID:6696
- C:\Windows\System\XMkxlzx.exe
  C:\Windows\System\XMkxlzx.exe
  2⤵
  PID:6752
- C:\Windows\System\kOMkqJp.exe
  C:\Windows\System\kOMkqJp.exe
  2⤵
  PID:6728
- C:\Windows\System\BrZiFac.exe
  C:\Windows\System\BrZiFac.exe
  2⤵
  PID:6884
- C:\Windows\System\FMnLtsD.exe
  C:\Windows\System\FMnLtsD.exe
  2⤵
  PID:6940
- C:\Windows\System\DnLERBg.exe
  C:\Windows\System\DnLERBg.exe
  2⤵
  PID:6916
- C:\Windows\System\VYQHJwx.exe
  C:\Windows\System\VYQHJwx.exe
  2⤵
  PID:7092
- C:\Windows\System\mxGGkOS.exe
  C:\Windows\System\mxGGkOS.exe
  2⤵
  PID:5944
- C:\Windows\System\hnrzagR.exe
  C:\Windows\System\hnrzagR.exe
  2⤵
  PID:6264
- C:\Windows\System\YCXOAdY.exe
  C:\Windows\System\YCXOAdY.exe
  2⤵
  PID:6284
- C:\Windows\System\WDnaOXv.exe
  C:\Windows\System\WDnaOXv.exe
  2⤵
  PID:6400
- C:\Windows\System\rHSYutN.exe
  C:\Windows\System\rHSYutN.exe
  2⤵
  PID:6116
- C:\Windows\System\IdBhQbb.exe
  C:\Windows\System\IdBhQbb.exe
  2⤵
  PID:6944
- C:\Windows\System\boUqYpj.exe
  C:\Windows\System\boUqYpj.exe
  2⤵
  PID:6232
- C:\Windows\System\CBmvMqh.exe
  C:\Windows\System\CBmvMqh.exe
  2⤵
  PID:7184
- C:\Windows\System\TFgybbH.exe
  C:\Windows\System\TFgybbH.exe
  2⤵
  PID:7216
- C:\Windows\System\LwIBEIv.exe
  C:\Windows\System\LwIBEIv.exe
  2⤵
  PID:7240
- C:\Windows\System\UDbDLpy.exe
  C:\Windows\System\UDbDLpy.exe
  2⤵
  PID:7264
- C:\Windows\System\ZZAccik.exe
  C:\Windows\System\ZZAccik.exe
  2⤵
  PID:7292
- C:\Windows\System\zuBIMTJ.exe
  C:\Windows\System\zuBIMTJ.exe
  2⤵
  PID:7312
- C:\Windows\System\DEFhelD.exe
  C:\Windows\System\DEFhelD.exe
  2⤵
  PID:7344
- C:\Windows\System\UIsEbWN.exe
  C:\Windows\System\UIsEbWN.exe
  2⤵
  PID:7368
- C:\Windows\System\TFHCYeo.exe
  C:\Windows\System\TFHCYeo.exe
  2⤵
  PID:7396
- C:\Windows\System\FHgpoEY.exe
  C:\Windows\System\FHgpoEY.exe
  2⤵
  PID:7428
- C:\Windows\System\vQeNVAX.exe
  C:\Windows\System\vQeNVAX.exe
  2⤵
  PID:7456
- C:\Windows\System\wIxOMRN.exe
  C:\Windows\System\wIxOMRN.exe
  2⤵
  PID:7484
- C:\Windows\System\wuCdbvG.exe
  C:\Windows\System\wuCdbvG.exe
  2⤵
  PID:7512
- C:\Windows\System\xhKfggo.exe
  C:\Windows\System\xhKfggo.exe
  2⤵
  PID:7540
- C:\Windows\System\WGzwyOR.exe
  C:\Windows\System\WGzwyOR.exe
  2⤵
  PID:7568
- C:\Windows\System\GOeqbze.exe
  C:\Windows\System\GOeqbze.exe
  2⤵
  PID:7596
- C:\Windows\System\tfSxutC.exe
  C:\Windows\System\tfSxutC.exe
  2⤵
  PID:7624
- C:\Windows\System\kyIrAUZ.exe
  C:\Windows\System\kyIrAUZ.exe
  2⤵
  PID:7656
- C:\Windows\System\RffUWGv.exe
  C:\Windows\System\RffUWGv.exe
  2⤵
  PID:7680
- C:\Windows\System\UpFqkim.exe
  C:\Windows\System\UpFqkim.exe
  2⤵
  PID:7712
- C:\Windows\System\oUshaSD.exe
  C:\Windows\System\oUshaSD.exe
  2⤵
  PID:7744
- C:\Windows\System\zdYSpMv.exe
  C:\Windows\System\zdYSpMv.exe
  2⤵
  PID:7780
- C:\Windows\System\rKyqEDk.exe
  C:\Windows\System\rKyqEDk.exe
  2⤵
  PID:7800
- C:\Windows\System\TPhlhkW.exe
  C:\Windows\System\TPhlhkW.exe
  2⤵
  PID:7824
- C:\Windows\System\XCbVUts.exe
  C:\Windows\System\XCbVUts.exe
  2⤵
  PID:7844
- C:\Windows\System\POLfqzo.exe
  C:\Windows\System\POLfqzo.exe
  2⤵
  PID:7872
- C:\Windows\System\NJbuEWg.exe
  C:\Windows\System\NJbuEWg.exe
  2⤵
  PID:7900
- C:\Windows\System\WZzQWJX.exe
  C:\Windows\System\WZzQWJX.exe
  2⤵
  PID:7932
- C:\Windows\System\zlGfClZ.exe
  C:\Windows\System\zlGfClZ.exe
  2⤵
  PID:7960
- C:\Windows\System\SOZshLm.exe
  C:\Windows\System\SOZshLm.exe
  2⤵
  PID:7984
- C:\Windows\System\olWEpGK.exe
  C:\Windows\System\olWEpGK.exe
  2⤵
  PID:8000
- C:\Windows\System\uGQROeY.exe
  C:\Windows\System\uGQROeY.exe
  2⤵
  PID:8028
- C:\Windows\System\SSdgyJz.exe
  C:\Windows\System\SSdgyJz.exe
  2⤵
  PID:8056
- C:\Windows\System\WJyKDVW.exe
  C:\Windows\System\WJyKDVW.exe
  2⤵
  PID:8080
- C:\Windows\System\teAZGCe.exe
  C:\Windows\System\teAZGCe.exe
  2⤵
  PID:8108
- C:\Windows\System\rEJSLyh.exe
  C:\Windows\System\rEJSLyh.exe
  2⤵
  PID:8136
- C:\Windows\System\rMcwSPj.exe
  C:\Windows\System\rMcwSPj.exe
  2⤵
  PID:8164
- C:\Windows\System\UZfrfQs.exe
  C:\Windows\System\UZfrfQs.exe
  2⤵
  PID:8180
- C:\Windows\System\tyXOaHs.exe
  C:\Windows\System\tyXOaHs.exe
  2⤵
  PID:6588
- C:\Windows\System\SIBVkrL.exe
  C:\Windows\System\SIBVkrL.exe
  2⤵
  PID:6664
- C:\Windows\System\CqJVKYo.exe
  C:\Windows\System\CqJVKYo.exe
  2⤵
  PID:7040
- C:\Windows\System\hQnbNFw.exe
  C:\Windows\System\hQnbNFw.exe
  2⤵
  PID:6364
- C:\Windows\System\mwrVtjZ.exe
  C:\Windows\System\mwrVtjZ.exe
  2⤵
  PID:6824
- C:\Windows\System\BKrXsno.exe
  C:\Windows\System\BKrXsno.exe
  2⤵
  PID:6952
- C:\Windows\System\VhusTxe.exe
  C:\Windows\System\VhusTxe.exe
  2⤵
  PID:7412
- C:\Windows\System\YCVxLnq.exe
  C:\Windows\System\YCVxLnq.exe
  2⤵
  PID:7444
- C:\Windows\System\fNTvomc.exe
  C:\Windows\System\fNTvomc.exe
  2⤵
  PID:7492
- C:\Windows\System\pcYrhjm.exe
  C:\Windows\System\pcYrhjm.exe
  2⤵
  PID:7536
- C:\Windows\System\ZhUxAqV.exe
  C:\Windows\System\ZhUxAqV.exe
  2⤵
  PID:7692
- C:\Windows\System\mwNdWqh.exe
  C:\Windows\System\mwNdWqh.exe
  2⤵
  PID:7340
- C:\Windows\System\VhEGMeD.exe
  C:\Windows\System\VhEGMeD.exe
  2⤵
  PID:7440
- C:\Windows\System\fZafMda.exe
  C:\Windows\System\fZafMda.exe
  2⤵
  PID:7740
- C:\Windows\System\LUmavuN.exe
  C:\Windows\System\LUmavuN.exe
  2⤵
  PID:7820
- C:\Windows\System\hBuxJhT.exe
  C:\Windows\System\hBuxJhT.exe
  2⤵
  PID:7760
- C:\Windows\System\wJmBmWl.exe
  C:\Windows\System\wJmBmWl.exe
  2⤵
  PID:7948
- C:\Windows\System\tlTYxpw.exe
  C:\Windows\System\tlTYxpw.exe
  2⤵
  PID:7996
- C:\Windows\System\BBEtFPg.exe
  C:\Windows\System\BBEtFPg.exe
  2⤵
  PID:8124
- C:\Windows\System\IxfsyML.exe
  C:\Windows\System\IxfsyML.exe
  2⤵
  PID:7884
- C:\Windows\System\JyDNvAK.exe
  C:\Windows\System\JyDNvAK.exe
  2⤵
  PID:8068
- C:\Windows\System\xBmefgc.exe
  C:\Windows\System\xBmefgc.exe
  2⤵
  PID:7228
- C:\Windows\System\KsqGkKd.exe
  C:\Windows\System\KsqGkKd.exe
  2⤵
  PID:8024
- C:\Windows\System\bHQUsEq.exe
  C:\Windows\System\bHQUsEq.exe
  2⤵
  PID:7256
- C:\Windows\System\DMFHhEe.exe
  C:\Windows\System\DMFHhEe.exe
  2⤵
  PID:7172
- C:\Windows\System\Onfingv.exe
  C:\Windows\System\Onfingv.exe
  2⤵
  PID:7708
- C:\Windows\System\wWBZRPN.exe
  C:\Windows\System\wWBZRPN.exe
  2⤵
  PID:7796
- C:\Windows\System\LSvvzZv.exe
  C:\Windows\System\LSvvzZv.exe
  2⤵
  PID:8220
- C:\Windows\System\QSyjuRR.exe
  C:\Windows\System\QSyjuRR.exe
  2⤵
  PID:8252
- C:\Windows\System\RtEYpNY.exe
  C:\Windows\System\RtEYpNY.exe
  2⤵
  PID:8276
- C:\Windows\System\OsrJLtk.exe
  C:\Windows\System\OsrJLtk.exe
  2⤵
  PID:8300
- C:\Windows\System\BnGXYdn.exe
  C:\Windows\System\BnGXYdn.exe
  2⤵
  PID:8324
- C:\Windows\System\WIzMOne.exe
  C:\Windows\System\WIzMOne.exe
  2⤵
  PID:8344
- C:\Windows\System\gPNurfz.exe
  C:\Windows\System\gPNurfz.exe
  2⤵
  PID:8368
- C:\Windows\System\qKcsxND.exe
  C:\Windows\System\qKcsxND.exe
  2⤵
  PID:8396
- C:\Windows\System\oTVYbcD.exe
  C:\Windows\System\oTVYbcD.exe
  2⤵
  PID:8420
- C:\Windows\System\WTLhoNV.exe
  C:\Windows\System\WTLhoNV.exe
  2⤵
  PID:8448
- C:\Windows\System\tHzIBxC.exe
  C:\Windows\System\tHzIBxC.exe
  2⤵
  PID:8476
- C:\Windows\System\SPJbdCv.exe
  C:\Windows\System\SPJbdCv.exe
  2⤵
  PID:8504
- C:\Windows\System\PYFVYDg.exe
  C:\Windows\System\PYFVYDg.exe
  2⤵
  PID:8528
- C:\Windows\System\LxnUrUa.exe
  C:\Windows\System\LxnUrUa.exe
  2⤵
  PID:8556
- C:\Windows\System\ZsUSVND.exe
  C:\Windows\System\ZsUSVND.exe
  2⤵
  PID:8656
- C:\Windows\System\GvKXMhN.exe
  C:\Windows\System\GvKXMhN.exe
  2⤵
  PID:8688
- C:\Windows\System\nEvLBPw.exe
  C:\Windows\System\nEvLBPw.exe
  2⤵
  PID:8720
- C:\Windows\System\LqYpPhK.exe
  C:\Windows\System\LqYpPhK.exe
  2⤵
  PID:8748
- C:\Windows\System\cvnrAnk.exe
  C:\Windows\System\cvnrAnk.exe
  2⤵
  PID:8780
- C:\Windows\System\lySafEL.exe
  C:\Windows\System\lySafEL.exe
  2⤵
  PID:8800
- C:\Windows\System\ljATrcF.exe
  C:\Windows\System\ljATrcF.exe
  2⤵
  PID:8836
- C:\Windows\System\gHhfJXm.exe
  C:\Windows\System\gHhfJXm.exe
  2⤵
  PID:8876
- C:\Windows\System\SsWeWgR.exe
  C:\Windows\System\SsWeWgR.exe
  2⤵
  PID:8904
- C:\Windows\System\bgXqoKB.exe
  C:\Windows\System\bgXqoKB.exe
  2⤵
  PID:8928
- C:\Windows\System\mDuyGxH.exe
  C:\Windows\System\mDuyGxH.exe
  2⤵
  PID:8956
- C:\Windows\System\TnoyvNU.exe
  C:\Windows\System\TnoyvNU.exe
  2⤵
  PID:8980
- C:\Windows\System\RnMjrRq.exe
  C:\Windows\System\RnMjrRq.exe
  2⤵
  PID:9012
- C:\Windows\System\btGsusR.exe
  C:\Windows\System\btGsusR.exe
  2⤵
  PID:9032
- C:\Windows\System\xODsEYE.exe
  C:\Windows\System\xODsEYE.exe
  2⤵
  PID:9052
- C:\Windows\System\kyzeQav.exe
  C:\Windows\System\kyzeQav.exe
  2⤵
  PID:9080
- C:\Windows\System\HNPrkus.exe
  C:\Windows\System\HNPrkus.exe
  2⤵
  PID:9108
- C:\Windows\System\CjrPqmD.exe
  C:\Windows\System\CjrPqmD.exe
  2⤵
  PID:9128
- C:\Windows\System\KaYqLYB.exe
  C:\Windows\System\KaYqLYB.exe
  2⤵
  PID:9160
- C:\Windows\System\CpPrkdM.exe
  C:\Windows\System\CpPrkdM.exe
  2⤵
  PID:9184
- C:\Windows\System\gQxLqRl.exe
  C:\Windows\System\gQxLqRl.exe
  2⤵
  PID:7816
- C:\Windows\System\uvaTcry.exe
  C:\Windows\System\uvaTcry.exe
  2⤵
  PID:8172
- C:\Windows\System\whWkqyR.exe
  C:\Windows\System\whWkqyR.exe
  2⤵
  PID:7856
- C:\Windows\System\rvoDKuf.exe
  C:\Windows\System\rvoDKuf.exe
  2⤵
  PID:7472
- C:\Windows\System\Glzfofb.exe
  C:\Windows\System\Glzfofb.exe
  2⤵
  PID:8076
- C:\Windows\System\AYLTrpc.exe
  C:\Windows\System\AYLTrpc.exe
  2⤵
  PID:8264
- C:\Windows\System\ZGtzVIB.exe
  C:\Windows\System\ZGtzVIB.exe
  2⤵
  PID:7356
- C:\Windows\System\rHLjiYG.exe
  C:\Windows\System\rHLjiYG.exe
  2⤵
  PID:8132
- C:\Windows\System\sBnLnfs.exe
  C:\Windows\System\sBnLnfs.exe
  2⤵
  PID:8320
- C:\Windows\System\PBGemEw.exe
  C:\Windows\System\PBGemEw.exe
  2⤵
  PID:8384
- C:\Windows\System\qLQjnUL.exe
  C:\Windows\System\qLQjnUL.exe
  2⤵
  PID:8208
- C:\Windows\System\FyHvGor.exe
  C:\Windows\System\FyHvGor.exe
  2⤵
  PID:8288
- C:\Windows\System\DehpWOg.exe
  C:\Windows\System\DehpWOg.exe
  2⤵
  PID:8712
- C:\Windows\System\LoSZMKL.exe
  C:\Windows\System\LoSZMKL.exe
  2⤵
  PID:8468
- C:\Windows\System\PCPAqzz.exe
  C:\Windows\System\PCPAqzz.exe
  2⤵
  PID:8796
- C:\Windows\System\LeBjRXX.exe
  C:\Windows\System\LeBjRXX.exe
  2⤵
  PID:8852
- C:\Windows\System\fUjEUMp.exe
  C:\Windows\System\fUjEUMp.exe
  2⤵
  PID:8732
- C:\Windows\System\yWbNoad.exe
  C:\Windows\System\yWbNoad.exe
  2⤵
  PID:8868
- C:\Windows\System\pqoDSJp.exe
  C:\Windows\System\pqoDSJp.exe
  2⤵
  PID:8764
- C:\Windows\System\wroEaiH.exe
  C:\Windows\System\wroEaiH.exe
  2⤵
  PID:9020
- C:\Windows\System\BImSUUk.exe
  C:\Windows\System\BImSUUk.exe
  2⤵
  PID:9156
- C:\Windows\System\AtEZxia.exe
  C:\Windows\System\AtEZxia.exe
  2⤵
  PID:9092
- C:\Windows\System\gtzocKg.exe
  C:\Windows\System\gtzocKg.exe
  2⤵
  PID:8968
- C:\Windows\System\rXPfVYW.exe
  C:\Windows\System\rXPfVYW.exe
  2⤵
  PID:7916
- C:\Windows\System\yTKOeLS.exe
  C:\Windows\System\yTKOeLS.exe
  2⤵
  PID:6788
- C:\Windows\System\fKbkVMs.exe
  C:\Windows\System\fKbkVMs.exe
  2⤵
  PID:7604
- C:\Windows\System\pVKsAbF.exe
  C:\Windows\System\pVKsAbF.exe
  2⤵
  PID:8416
- C:\Windows\System\kDzrNMt.exe
  C:\Windows\System\kDzrNMt.exe
  2⤵
  PID:7392
- C:\Windows\System\dvFbdtT.exe
  C:\Windows\System\dvFbdtT.exe
  2⤵
  PID:9196
- C:\Windows\System\SKFfsJM.exe
  C:\Windows\System\SKFfsJM.exe
  2⤵
  PID:6408
- C:\Windows\System\FDtSfJi.exe
  C:\Windows\System\FDtSfJi.exe
  2⤵
  PID:9044
- C:\Windows\System\oiJccGs.exe
  C:\Windows\System\oiJccGs.exe
  2⤵
  PID:9144
- C:\Windows\System\azFoECJ.exe
  C:\Windows\System\azFoECJ.exe
  2⤵
  PID:9232
- C:\Windows\System\kTcvoyz.exe
  C:\Windows\System\kTcvoyz.exe
  2⤵
  PID:9256
- C:\Windows\System\enfhBgD.exe
  C:\Windows\System\enfhBgD.exe
  2⤵
  PID:9284
- C:\Windows\System\iFQIRnJ.exe
  C:\Windows\System\iFQIRnJ.exe
  2⤵
  PID:9300
- C:\Windows\System\harltWx.exe
  C:\Windows\System\harltWx.exe
  2⤵
  PID:9324
- C:\Windows\System\UBdejhw.exe
  C:\Windows\System\UBdejhw.exe
  2⤵
  PID:9352
- C:\Windows\System\ZbVVcpC.exe
  C:\Windows\System\ZbVVcpC.exe
  2⤵
  PID:9372
- C:\Windows\System\lldNgWF.exe
  C:\Windows\System\lldNgWF.exe
  2⤵
  PID:9396
- C:\Windows\System\JywPrut.exe
  C:\Windows\System\JywPrut.exe
  2⤵
  PID:9424
- C:\Windows\System\kqiiaVH.exe
  C:\Windows\System\kqiiaVH.exe
  2⤵
  PID:9452
- C:\Windows\System\xCQypan.exe
  C:\Windows\System\xCQypan.exe
  2⤵
  PID:9476
- C:\Windows\System\ZlghbdA.exe
  C:\Windows\System\ZlghbdA.exe
  2⤵
  PID:9504
- C:\Windows\System\MjATNmh.exe
  C:\Windows\System\MjATNmh.exe
  2⤵
  PID:9524
- C:\Windows\System\BmadTOX.exe
  C:\Windows\System\BmadTOX.exe
  2⤵
  PID:9552
- C:\Windows\System\TudghpD.exe
  C:\Windows\System\TudghpD.exe
  2⤵
  PID:9580
- C:\Windows\System\Mkqxhgj.exe
  C:\Windows\System\Mkqxhgj.exe
  2⤵
  PID:9608
- C:\Windows\System\LsUBwBp.exe
  C:\Windows\System\LsUBwBp.exe
  2⤵
  PID:9636
- C:\Windows\System\XMmwTtc.exe
  C:\Windows\System\XMmwTtc.exe
  2⤵
  PID:9668
- C:\Windows\System\ZzffzwJ.exe
  C:\Windows\System\ZzffzwJ.exe
  2⤵
  PID:9700
- C:\Windows\System\jpqRlsI.exe
  C:\Windows\System\jpqRlsI.exe
  2⤵
  PID:9736
- C:\Windows\System\ymCdyyX.exe
  C:\Windows\System\ymCdyyX.exe
  2⤵
  PID:9756
- C:\Windows\System\GdXLZQo.exe
  C:\Windows\System\GdXLZQo.exe
  2⤵
  PID:9788
- C:\Windows\System\KKqmFyX.exe
  C:\Windows\System\KKqmFyX.exe
  2⤵
  PID:9816
- C:\Windows\System\nLOCQaz.exe
  C:\Windows\System\nLOCQaz.exe
  2⤵
  PID:9840
- C:\Windows\System\vMOBpco.exe
  C:\Windows\System\vMOBpco.exe
  2⤵
  PID:9856
- C:\Windows\System\VJBzVZN.exe
  C:\Windows\System\VJBzVZN.exe
  2⤵
  PID:9884
- C:\Windows\System\LOxogtc.exe
  C:\Windows\System\LOxogtc.exe
  2⤵
  PID:9904
- C:\Windows\System\drCHKes.exe
  C:\Windows\System\drCHKes.exe
  2⤵
  PID:9932
- C:\Windows\System\FBwPBxt.exe
  C:\Windows\System\FBwPBxt.exe
  2⤵
  PID:9952
- C:\Windows\System\dCFfPEF.exe
  C:\Windows\System\dCFfPEF.exe
  2⤵
  PID:9980
- C:\Windows\System\akloOOx.exe
  C:\Windows\System\akloOOx.exe
  2⤵
  PID:10008
- C:\Windows\System\GThgrBk.exe
  C:\Windows\System\GThgrBk.exe
  2⤵
  PID:10028
- C:\Windows\System\wyyHdBD.exe
  C:\Windows\System\wyyHdBD.exe
  2⤵
  PID:10056
- C:\Windows\System\jfqoIKS.exe
  C:\Windows\System\jfqoIKS.exe
  2⤵
  PID:10084
- C:\Windows\System\KomISGM.exe
  C:\Windows\System\KomISGM.exe
  2⤵
  PID:10120
- C:\Windows\System\WYPegct.exe
  C:\Windows\System\WYPegct.exe
  2⤵
  PID:10140
- C:\Windows\System\EXWQISE.exe
  C:\Windows\System\EXWQISE.exe
  2⤵
  PID:10172
- C:\Windows\System\OlMoCTy.exe
  C:\Windows\System\OlMoCTy.exe
  2⤵
  PID:10188
- C:\Windows\System\PBZRote.exe
  C:\Windows\System\PBZRote.exe
  2⤵
  PID:10208
- C:\Windows\System\LwfpRyN.exe
  C:\Windows\System\LwfpRyN.exe
  2⤵
  PID:10232
- C:\Windows\System\maOjEoW.exe
  C:\Windows\System\maOjEoW.exe
  2⤵
  PID:9180
- C:\Windows\System\eSsPFym.exe
  C:\Windows\System\eSsPFym.exe
  2⤵
  PID:8516
- C:\Windows\System\zKHspNX.exe
  C:\Windows\System\zKHspNX.exe
  2⤵
  PID:8940
- C:\Windows\System\bIyNQIT.exe
  C:\Windows\System\bIyNQIT.exe
  2⤵
  PID:9252
- C:\Windows\System\lxttGxp.exe
  C:\Windows\System\lxttGxp.exe
  2⤵
  PID:9280
- C:\Windows\System\oSwYpvA.exe
  C:\Windows\System\oSwYpvA.exe
  2⤵
  PID:9364
- C:\Windows\System\aBscCSG.exe
  C:\Windows\System\aBscCSG.exe
  2⤵
  PID:8236
- C:\Windows\System\XhfDotd.exe
  C:\Windows\System\XhfDotd.exe
  2⤵
  PID:9296
- C:\Windows\System\WbRVZMr.exe
  C:\Windows\System\WbRVZMr.exe
  2⤵
  PID:9404
- C:\Windows\System\DxiPoAm.exe
  C:\Windows\System\DxiPoAm.exe
  2⤵
  PID:9628
- C:\Windows\System\HOxxolk.exe
  C:\Windows\System\HOxxolk.exe
  2⤵
  PID:9732
- C:\Windows\System\FScSWdB.exe
  C:\Windows\System\FScSWdB.exe
  2⤵
  PID:9320
- C:\Windows\System\qYHuVpR.exe
  C:\Windows\System\qYHuVpR.exe
  2⤵
  PID:9592
- C:\Windows\System\nPMWHOa.exe
  C:\Windows\System\nPMWHOa.exe
  2⤵
  PID:9900
- C:\Windows\System\QmNZxZq.exe
  C:\Windows\System\QmNZxZq.exe
  2⤵
  PID:9972
- C:\Windows\System\RfPtksP.exe
  C:\Windows\System\RfPtksP.exe
  2⤵
  PID:10000
- C:\Windows\System\NHNiXDL.exe
  C:\Windows\System\NHNiXDL.exe
  2⤵
  PID:10052
- C:\Windows\System\BxjwJcu.exe
  C:\Windows\System\BxjwJcu.exe
  2⤵
  PID:9828
- C:\Windows\System\zKQolTG.exe
  C:\Windows\System\zKQolTG.exe
  2⤵
  PID:9848
- C:\Windows\System\WzHUZjR.exe
  C:\Windows\System\WzHUZjR.exe
  2⤵
  PID:9644
- C:\Windows\System\qvZBNhE.exe
  C:\Windows\System\qvZBNhE.exe
  2⤵
  PID:8648
- C:\Windows\System\nhFMQrl.exe
  C:\Windows\System\nhFMQrl.exe
  2⤵
  PID:9440
- C:\Windows\System\kpEHRUq.exe
  C:\Windows\System\kpEHRUq.exe
  2⤵
  PID:10268
- C:\Windows\System\UFwGkIB.exe
  C:\Windows\System\UFwGkIB.exe
  2⤵
  PID:10296
- C:\Windows\System\JrloFQc.exe
  C:\Windows\System\JrloFQc.exe
  2⤵
  PID:10316
- C:\Windows\System\rTsGhyP.exe
  C:\Windows\System\rTsGhyP.exe
  2⤵
  PID:10340
- C:\Windows\System\aRJcXvM.exe
  C:\Windows\System\aRJcXvM.exe
  2⤵
  PID:10368
- C:\Windows\System\jvXKzmQ.exe
  C:\Windows\System\jvXKzmQ.exe
  2⤵
  PID:10396
- C:\Windows\System\zyXyuUv.exe
  C:\Windows\System\zyXyuUv.exe
  2⤵
  PID:10420
- C:\Windows\System\JbrPONL.exe
  C:\Windows\System\JbrPONL.exe
  2⤵
  PID:10452
- C:\Windows\System\TcuMluV.exe
  C:\Windows\System\TcuMluV.exe
  2⤵
  PID:10472
- C:\Windows\System\GBzwVkz.exe
  C:\Windows\System\GBzwVkz.exe
  2⤵
  PID:10500
- C:\Windows\System\pPuMari.exe
  C:\Windows\System\pPuMari.exe
  2⤵
  PID:10524
- C:\Windows\System\XZsbOWn.exe
  C:\Windows\System\XZsbOWn.exe
  2⤵
  PID:10548
- C:\Windows\System\uirfLGk.exe
  C:\Windows\System\uirfLGk.exe
  2⤵
  PID:10584
- C:\Windows\System\AcEkWYx.exe
  C:\Windows\System\AcEkWYx.exe
  2⤵
  PID:10608
- C:\Windows\System\VuzqpSu.exe
  C:\Windows\System\VuzqpSu.exe
  2⤵
  PID:10628
- C:\Windows\System\MneObDe.exe
  C:\Windows\System\MneObDe.exe
  2⤵
  PID:10656
- C:\Windows\System\MtlPJpO.exe
  C:\Windows\System\MtlPJpO.exe
  2⤵
  PID:10680
- C:\Windows\System\gdQNoZi.exe
  C:\Windows\System\gdQNoZi.exe
  2⤵
  PID:10704
- C:\Windows\System\ywqiNzj.exe
  C:\Windows\System\ywqiNzj.exe
  2⤵
  PID:10728
- C:\Windows\System\nvvwGxg.exe
  C:\Windows\System\nvvwGxg.exe
  2⤵
  PID:10756
- C:\Windows\System\VmDncRM.exe
  C:\Windows\System\VmDncRM.exe
  2⤵
  PID:10780
- C:\Windows\System\yAlugpe.exe
  C:\Windows\System\yAlugpe.exe
  2⤵
  PID:10812
- C:\Windows\System\oEEFteB.exe
  C:\Windows\System\oEEFteB.exe
  2⤵
  PID:10844
- C:\Windows\System\opgPfqQ.exe
  C:\Windows\System\opgPfqQ.exe
  2⤵
  PID:10868
- C:\Windows\System\rtRQAte.exe
  C:\Windows\System\rtRQAte.exe
  2⤵
  PID:10892
- C:\Windows\System\uqMBRvn.exe
  C:\Windows\System\uqMBRvn.exe
  2⤵
  PID:10912
- C:\Windows\System\kIrbxoH.exe
  C:\Windows\System\kIrbxoH.exe
  2⤵
  PID:10932
- C:\Windows\System\getnLZi.exe
  C:\Windows\System\getnLZi.exe
  2⤵
  PID:10956
- C:\Windows\System\xcHsurD.exe
  C:\Windows\System\xcHsurD.exe
  2⤵
  PID:10984
- C:\Windows\System\gdjVbcS.exe
  C:\Windows\System\gdjVbcS.exe
  2⤵
  PID:11000
- C:\Windows\System\RpLktmp.exe
  C:\Windows\System\RpLktmp.exe
  2⤵
  PID:11028
- C:\Windows\System\wwXCNSM.exe
  C:\Windows\System\wwXCNSM.exe
  2⤵
  PID:11064
- C:\Windows\System\PWTooyZ.exe
  C:\Windows\System\PWTooyZ.exe
  2⤵
  PID:11088
- C:\Windows\System\dPwhfBr.exe
  C:\Windows\System\dPwhfBr.exe
  2⤵
  PID:11108
- C:\Windows\System\nPnLytH.exe
  C:\Windows\System\nPnLytH.exe
  2⤵
  PID:11140
- C:\Windows\System\NPNaNXy.exe
  C:\Windows\System\NPNaNXy.exe
  2⤵
  PID:11168
- C:\Windows\System\IKNwSVl.exe
  C:\Windows\System\IKNwSVl.exe
  2⤵
  PID:11196
- C:\Windows\System\eKhLGEE.exe
  C:\Windows\System\eKhLGEE.exe
  2⤵
  PID:11224
- C:\Windows\System\ypklTDQ.exe
  C:\Windows\System\ypklTDQ.exe
  2⤵
  PID:11252
- C:\Windows\System\jUdCOFb.exe
  C:\Windows\System\jUdCOFb.exe
  2⤵
  PID:9392
- C:\Windows\System\xQDxSkz.exe
  C:\Windows\System\xQDxSkz.exe
  2⤵
  PID:10220
- C:\Windows\System\CsbyJEm.exe
  C:\Windows\System\CsbyJEm.exe
  2⤵
  PID:8684
- C:\Windows\System\CDSriCq.exe
  C:\Windows\System\CDSriCq.exe
  2⤵
  PID:6616
- C:\Windows\System\aXExbiB.exe
  C:\Windows\System\aXExbiB.exe
  2⤵
  PID:9360
- C:\Windows\System\IXewQLh.exe
  C:\Windows\System\IXewQLh.exe
  2⤵
  PID:9620
- C:\Windows\System\vGKxJfy.exe
  C:\Windows\System\vGKxJfy.exe
  2⤵
  PID:9576
- C:\Windows\System\hJaDpSb.exe
  C:\Windows\System\hJaDpSb.exe
  2⤵
  PID:10468
- C:\Windows\System\tCmzUtm.exe
  C:\Windows\System\tCmzUtm.exe
  2⤵
  PID:10044
- C:\Windows\System\uYDOhEd.exe
  C:\Windows\System\uYDOhEd.exe
  2⤵
  PID:9876
- C:\Windows\System\DnNzoLt.exe
  C:\Windows\System\DnNzoLt.exe
  2⤵
  PID:9136
- C:\Windows\System\obPCvEG.exe
  C:\Windows\System\obPCvEG.exe
  2⤵
  PID:9520
- C:\Windows\System\FEPyHtr.exe
  C:\Windows\System\FEPyHtr.exe
  2⤵
  PID:10676
- C:\Windows\System\IYHjDyl.exe
  C:\Windows\System\IYHjDyl.exe
  2⤵
  PID:10712
- C:\Windows\System\nZOVILf.exe
  C:\Windows\System\nZOVILf.exe
  2⤵
  PID:10748
- C:\Windows\System\kpijqNl.exe
  C:\Windows\System\kpijqNl.exe
  2⤵
  PID:10444
- C:\Windows\System\MARaOfo.exe
  C:\Windows\System\MARaOfo.exe
  2⤵
  PID:10148
- C:\Windows\System\iIAQdAj.exe
  C:\Windows\System\iIAQdAj.exe
  2⤵
  PID:9720
- C:\Windows\System\eBPCECn.exe
  C:\Windows\System\eBPCECn.exe
  2⤵
  PID:10652
- C:\Windows\System\POtGZAS.exe
  C:\Windows\System\POtGZAS.exe
  2⤵
  PID:11084
- C:\Windows\System\lEotZXw.exe
  C:\Windows\System\lEotZXw.exe
  2⤵
  PID:10740
- C:\Windows\System\IpycHrK.exe
  C:\Windows\System\IpycHrK.exe
  2⤵
  PID:10776
- C:\Windows\System\dztTsYY.exe
  C:\Windows\System\dztTsYY.exe
  2⤵
  PID:10820
- C:\Windows\System\kkPptMF.exe
  C:\Windows\System\kkPptMF.exe
  2⤵
  PID:11236
- C:\Windows\System\jCmBYuA.exe
  C:\Windows\System\jCmBYuA.exe
  2⤵
  PID:8652
- C:\Windows\System\wrxRrZa.exe
  C:\Windows\System\wrxRrZa.exe
  2⤵
  PID:10544
- C:\Windows\System\XmXmBvt.exe
  C:\Windows\System\XmXmBvt.exe
  2⤵
  PID:10600
- C:\Windows\System\clCsKfu.exe
  C:\Windows\System\clCsKfu.exe
  2⤵
  PID:10624
- C:\Windows\System\EQtEsYK.exe
  C:\Windows\System\EQtEsYK.exe
  2⤵
  PID:11060
- C:\Windows\System\VqaBLEo.exe
  C:\Windows\System\VqaBLEo.exe
  2⤵
  PID:11296
- C:\Windows\System\xFbNxzz.exe
  C:\Windows\System\xFbNxzz.exe
  2⤵
  PID:11320
- C:\Windows\System\KnKxPlK.exe
  C:\Windows\System\KnKxPlK.exe
  2⤵
  PID:11340
- C:\Windows\System\uYYceBB.exe
  C:\Windows\System\uYYceBB.exe
  2⤵
  PID:11372
- C:\Windows\System\eGVEtNh.exe
  C:\Windows\System\eGVEtNh.exe
  2⤵
  PID:11392
- C:\Windows\System\XcZPXmr.exe
  C:\Windows\System\XcZPXmr.exe
  2⤵
  PID:11416
- C:\Windows\System\jaTmWRR.exe
  C:\Windows\System\jaTmWRR.exe
  2⤵
  PID:11440
- C:\Windows\System\oUVKWCk.exe
  C:\Windows\System\oUVKWCk.exe
  2⤵
  PID:11464
- C:\Windows\System\tlTLPeb.exe
  C:\Windows\System\tlTLPeb.exe
  2⤵
  PID:11488
- C:\Windows\System\kFGsNKO.exe
  C:\Windows\System\kFGsNKO.exe
  2⤵
  PID:11508
- C:\Windows\System\QGTPzMA.exe
  C:\Windows\System\QGTPzMA.exe
  2⤵
  PID:11528
- C:\Windows\System\WjybANL.exe
  C:\Windows\System\WjybANL.exe
  2⤵
  PID:11552
- C:\Windows\System\Lpjsnld.exe
  C:\Windows\System\Lpjsnld.exe
  2⤵
  PID:11568
- C:\Windows\System\IEylMND.exe
  C:\Windows\System\IEylMND.exe
  2⤵
  PID:11596
- C:\Windows\System\PugGQts.exe
  C:\Windows\System\PugGQts.exe
  2⤵
  PID:11620
- C:\Windows\System\LPHmBjt.exe
  C:\Windows\System\LPHmBjt.exe
  2⤵
  PID:11644
- C:\Windows\System\AEyydSk.exe
  C:\Windows\System\AEyydSk.exe
  2⤵
  PID:11668
- C:\Windows\System\zwWDagk.exe
  C:\Windows\System\zwWDagk.exe
  2⤵
  PID:11692
- C:\Windows\System\ObdTUic.exe
  C:\Windows\System\ObdTUic.exe
  2⤵
  PID:11712
- C:\Windows\System\xncLzBD.exe
  C:\Windows\System\xncLzBD.exe
  2⤵
  PID:11736
- C:\Windows\System\hhSYRal.exe
  C:\Windows\System\hhSYRal.exe
  2⤵
  PID:11764
- C:\Windows\System\RIvEIEe.exe
  C:\Windows\System\RIvEIEe.exe
  2⤵
  PID:11792
- C:\Windows\System\wWBoxZF.exe
  C:\Windows\System\wWBoxZF.exe
  2⤵
  PID:11808
- C:\Windows\System\YYzlwPG.exe
  C:\Windows\System\YYzlwPG.exe
  2⤵
  PID:11836
- C:\Windows\System\aBGXdOr.exe
  C:\Windows\System\aBGXdOr.exe
  2⤵
  PID:11860
- C:\Windows\System\noGpTlv.exe
  C:\Windows\System\noGpTlv.exe
  2⤵
  PID:11888
- C:\Windows\System\pmcXhui.exe
  C:\Windows\System\pmcXhui.exe
  2⤵
  PID:11908
- C:\Windows\System\uAZJxqy.exe
  C:\Windows\System\uAZJxqy.exe
  2⤵
  PID:11944
- C:\Windows\System\GIzdZBG.exe
  C:\Windows\System\GIzdZBG.exe
  2⤵
  PID:11964
- C:\Windows\System\cezmhCw.exe
  C:\Windows\System\cezmhCw.exe
  2⤵
  PID:11984
- C:\Windows\System\xjYfQll.exe
  C:\Windows\System\xjYfQll.exe
  2⤵
  PID:12004
- C:\Windows\System\swxuEHt.exe
  C:\Windows\System\swxuEHt.exe
  2⤵
  PID:12024
- C:\Windows\System\NuhXoew.exe
  C:\Windows\System\NuhXoew.exe
  2⤵
  PID:12052
- C:\Windows\System\TtFxnvs.exe
  C:\Windows\System\TtFxnvs.exe
  2⤵
  PID:12076
- C:\Windows\System\WQnRpLV.exe
  C:\Windows\System\WQnRpLV.exe
  2⤵
  PID:12100
- C:\Windows\System\DuDbXgZ.exe
  C:\Windows\System\DuDbXgZ.exe
  2⤵
  PID:12132
- C:\Windows\System\tooWszV.exe
  C:\Windows\System\tooWszV.exe
  2⤵
  PID:12156
- C:\Windows\System\tGzTCfV.exe
  C:\Windows\System\tGzTCfV.exe
  2⤵
  PID:12184
- C:\Windows\System\CSGudss.exe
  C:\Windows\System\CSGudss.exe
  2⤵
  PID:12212
- C:\Windows\System\XpOUDpb.exe
  C:\Windows\System\XpOUDpb.exe
  2⤵
  PID:12232
- C:\Windows\System\bYJIEqp.exe
  C:\Windows\System\bYJIEqp.exe
  2⤵
  PID:12252
- C:\Windows\System\kphGNMd.exe
  C:\Windows\System\kphGNMd.exe
  2⤵
  PID:12276
- C:\Windows\System\mlaeUpl.exe
  C:\Windows\System\mlaeUpl.exe
  2⤵
  PID:10696
- C:\Windows\System\sFdKoDi.exe
  C:\Windows\System\sFdKoDi.exe
  2⤵
  PID:11016
- C:\Windows\System\HQQSjox.exe
  C:\Windows\System\HQQSjox.exe
  2⤵
  PID:11132
- C:\Windows\System\KzbvRXf.exe
  C:\Windows\System\KzbvRXf.exe
  2⤵
  PID:10068
- C:\Windows\System\djdzmBY.exe
  C:\Windows\System\djdzmBY.exe
  2⤵
  PID:10976
- C:\Windows\System\cIiSpcb.exe
  C:\Windows\System\cIiSpcb.exe
  2⤵
  PID:9512
- C:\Windows\System\FVlhnsZ.exe
  C:\Windows\System\FVlhnsZ.exe
  2⤵
  PID:9836
- C:\Windows\System\iVHJuIZ.exe
  C:\Windows\System\iVHJuIZ.exe
  2⤵
  PID:10356
- C:\Windows\System\nSvmGoK.exe
  C:\Windows\System\nSvmGoK.exe
  2⤵
  PID:11460
- C:\Windows\System\NUpumYg.exe
  C:\Windows\System\NUpumYg.exe
  2⤵
  PID:11504
- C:\Windows\System\VuaogBY.exe
  C:\Windows\System\VuaogBY.exe
  2⤵
  PID:11220
- C:\Windows\System\KqjrJjV.exe
  C:\Windows\System\KqjrJjV.exe
  2⤵
  PID:11616
- C:\Windows\System\hrNpEdq.exe
  C:\Windows\System\hrNpEdq.exe
  2⤵
  PID:11660
- C:\Windows\System\BUPIwlH.exe
  C:\Windows\System\BUPIwlH.exe
  2⤵
  PID:11724
- C:\Windows\System\YbRjakH.exe
  C:\Windows\System\YbRjakH.exe
  2⤵
  PID:10248
- C:\Windows\System\VAuXVsz.exe
  C:\Windows\System\VAuXVsz.exe
  2⤵
  PID:11896
- C:\Windows\System\TponsBC.exe
  C:\Windows\System\TponsBC.exe
  2⤵
  PID:11980
- C:\Windows\System\zqilOBN.exe
  C:\Windows\System\zqilOBN.exe
  2⤵
  PID:12296
- C:\Windows\System\RqNdwtH.exe
  C:\Windows\System\RqNdwtH.exe
  2⤵
  PID:12324
- C:\Windows\System\gbivnOH.exe
  C:\Windows\System\gbivnOH.exe
  2⤵
  PID:12348
- C:\Windows\System\aGzXRmF.exe
  C:\Windows\System\aGzXRmF.exe
  2⤵
  PID:12372
- C:\Windows\System\BFtnbOW.exe
  C:\Windows\System\BFtnbOW.exe
  2⤵
  PID:12400
- C:\Windows\System\zmIHbwa.exe
  C:\Windows\System\zmIHbwa.exe
  2⤵
  PID:12420
- C:\Windows\System\JUOqRbe.exe
  C:\Windows\System\JUOqRbe.exe
  2⤵
  PID:12444
- C:\Windows\System\XkblLUY.exe
  C:\Windows\System\XkblLUY.exe
  2⤵
  PID:12464
- C:\Windows\System\FrSBvHc.exe
  C:\Windows\System\FrSBvHc.exe
  2⤵
  PID:12488
- C:\Windows\System\GEzKkik.exe
  C:\Windows\System\GEzKkik.exe
  2⤵
  PID:12516
- C:\Windows\System\HqMuHFd.exe
  C:\Windows\System\HqMuHFd.exe
  2⤵
  PID:12544
- C:\Windows\System\UtVDkvH.exe
  C:\Windows\System\UtVDkvH.exe
  2⤵
  PID:12568
- C:\Windows\System\qMEzUYc.exe
  C:\Windows\System\qMEzUYc.exe
  2⤵
  PID:12592
- C:\Windows\System\grODHzs.exe
  C:\Windows\System\grODHzs.exe
  2⤵
  PID:12620
- C:\Windows\System\OexyGPo.exe
  C:\Windows\System\OexyGPo.exe
  2⤵
  PID:12644
- C:\Windows\System\baqNJRa.exe
  C:\Windows\System\baqNJRa.exe
  2⤵
  PID:12668
- C:\Windows\System\nFavnwL.exe
  C:\Windows\System\nFavnwL.exe
  2⤵
  PID:12696
- C:\Windows\System\ylfOlKk.exe
  C:\Windows\System\ylfOlKk.exe
  2⤵
  PID:12720
- C:\Windows\System\qOoUFvi.exe
  C:\Windows\System\qOoUFvi.exe
  2⤵
  PID:12748
- C:\Windows\System\snKXgon.exe
  C:\Windows\System\snKXgon.exe
  2⤵
  PID:12768
- C:\Windows\System\ZsJFuUW.exe
  C:\Windows\System\ZsJFuUW.exe
  2⤵
  PID:12800
- C:\Windows\System\SQqKUkD.exe
  C:\Windows\System\SQqKUkD.exe
  2⤵
  PID:12824
- C:\Windows\System\pExPniu.exe
  C:\Windows\System\pExPniu.exe
  2⤵
  PID:12860
- C:\Windows\System\qWbbBsG.exe
  C:\Windows\System\qWbbBsG.exe
  2⤵
  PID:12884
- C:\Windows\System\JQdPUgM.exe
  C:\Windows\System\JQdPUgM.exe
  2⤵
  PID:12908
- C:\Windows\System\walhSLh.exe
  C:\Windows\System\walhSLh.exe
  2⤵
  PID:12936
- C:\Windows\System\HIFrwrv.exe
  C:\Windows\System\HIFrwrv.exe
  2⤵
  PID:12952
- C:\Windows\System\vHLRvXx.exe
  C:\Windows\System\vHLRvXx.exe
  2⤵
  PID:12980
- C:\Windows\System\FSIVAsT.exe
  C:\Windows\System\FSIVAsT.exe
  2⤵
  PID:13000
- C:\Windows\System\ZYcOUpi.exe
  C:\Windows\System\ZYcOUpi.exe
  2⤵
  PID:13032
- C:\Windows\System\ksbyXkp.exe
  C:\Windows\System\ksbyXkp.exe
  2⤵
  PID:13056
- C:\Windows\System\jwzMcxr.exe
  C:\Windows\System\jwzMcxr.exe
  2⤵
  PID:13076
- C:\Windows\System\GLAzttH.exe
  C:\Windows\System\GLAzttH.exe
  2⤵
  PID:13100
- C:\Windows\System\CcyfqCS.exe
  C:\Windows\System\CcyfqCS.exe
  2⤵
  PID:13124
- C:\Windows\System\FEeiYrm.exe
  C:\Windows\System\FEeiYrm.exe
  2⤵
  PID:13152
- C:\Windows\System\GSVCrPt.exe
  C:\Windows\System\GSVCrPt.exe
  2⤵
  PID:13176
- C:\Windows\System\UWMEidF.exe
  C:\Windows\System\UWMEidF.exe
  2⤵
  PID:13204
- C:\Windows\System\EpJjYvt.exe
  C:\Windows\System\EpJjYvt.exe
  2⤵
  PID:13236
- C:\Windows\System\JAvJDsP.exe
  C:\Windows\System\JAvJDsP.exe
  2⤵
  PID:13256
- C:\Windows\System\jHVCDZN.exe
  C:\Windows\System\jHVCDZN.exe
  2⤵
  PID:13292
- C:\Windows\System\ijALlEK.exe
  C:\Windows\System\ijALlEK.exe
  2⤵
  PID:12176
- C:\Windows\System\phuEwwu.exe
  C:\Windows\System\phuEwwu.exe
  2⤵
  PID:11752
- C:\Windows\System\mHHgAGe.exe
  C:\Windows\System\mHHgAGe.exe
  2⤵
  PID:11800
- C:\Windows\System\dfGdUqR.exe
  C:\Windows\System\dfGdUqR.exe
  2⤵
  PID:11348
- C:\Windows\System\RHWlbKG.exe
  C:\Windows\System\RHWlbKG.exe
  2⤵
  PID:10532
- C:\Windows\System\efhoFav.exe
  C:\Windows\System\efhoFav.exe
  2⤵
  PID:11428
- C:\Windows\System\KJypAQZ.exe
  C:\Windows\System\KJypAQZ.exe
  2⤵
  PID:11956
- C:\Windows\System\gqAPdbL.exe
  C:\Windows\System\gqAPdbL.exe
  2⤵
  PID:12000
- C:\Windows\System\PrzEJup.exe
  C:\Windows\System\PrzEJup.exe
  2⤵
  PID:11524
- C:\Windows\System\FwnXELY.exe
  C:\Windows\System\FwnXELY.exe
  2⤵
  PID:12072
- C:\Windows\System\AHZaOWk.exe
  C:\Windows\System\AHZaOWk.exe
  2⤵
  PID:12112
- C:\Windows\System\xBfjGzY.exe
  C:\Windows\System\xBfjGzY.exe
  2⤵
  PID:12140
- C:\Windows\System\tpPwqXY.exe
  C:\Windows\System\tpPwqXY.exe
  2⤵
  PID:12168
- C:\Windows\System\whKiYOW.exe
  C:\Windows\System\whKiYOW.exe
  2⤵
  PID:11684
- C:\Windows\System\vdNAvPT.exe
  C:\Windows\System\vdNAvPT.exe
  2⤵
  PID:12476
- C:\Windows\System\LADKtpO.exe
  C:\Windows\System\LADKtpO.exe
  2⤵
  PID:10440
- C:\Windows\System\FuOZrWC.exe
  C:\Windows\System\FuOZrWC.exe
  2⤵
  PID:9224
- C:\Windows\System\hRLiTIi.exe
  C:\Windows\System\hRLiTIi.exe
  2⤵
  PID:11884
- C:\Windows\System\mWoDDSE.exe
  C:\Windows\System\mWoDDSE.exe
  2⤵
  PID:12716
- C:\Windows\System\SYEoAHZ.exe
  C:\Windows\System\SYEoAHZ.exe
  2⤵
  PID:12744
- C:\Windows\System\vRhZhFO.exe
  C:\Windows\System\vRhZhFO.exe
  2⤵
  PID:9800
- C:\Windows\System\kYLCryj.exe
  C:\Windows\System\kYLCryj.exe
  2⤵
  PID:11720
- C:\Windows\System\negmSPb.exe
  C:\Windows\System\negmSPb.exe
  2⤵
  PID:12092
- C:\Windows\System\Xjaubtf.exe
  C:\Windows\System\Xjaubtf.exe
  2⤵
  PID:13028
- C:\Windows\System\tcmlSpY.exe
  C:\Windows\System\tcmlSpY.exe
  2⤵
  PID:13120
- C:\Windows\System\kRDzwkj.exe
  C:\Windows\System\kRDzwkj.exe
  2⤵
  PID:13164
- C:\Windows\System\JBNTSOP.exe
  C:\Windows\System\JBNTSOP.exe
  2⤵
  PID:12460
- C:\Windows\System\rCVyYNu.exe
  C:\Windows\System\rCVyYNu.exe
  2⤵
  PID:13336
- C:\Windows\System\DzGHdeG.exe
  C:\Windows\System\DzGHdeG.exe
  2⤵
  PID:13360
- C:\Windows\System\NkSTlCX.exe
  C:\Windows\System\NkSTlCX.exe
  2⤵
  PID:13380
- C:\Windows\System\CALRxSt.exe
  C:\Windows\System\CALRxSt.exe
  2⤵
  PID:13404
- C:\Windows\System\AeGXyib.exe
  C:\Windows\System\AeGXyib.exe
  2⤵
  PID:13428
- C:\Windows\System\UtXBGNC.exe
  C:\Windows\System\UtXBGNC.exe
  2⤵
  PID:13448
- C:\Windows\System\rnrZKLw.exe
  C:\Windows\System\rnrZKLw.exe
  2⤵
  PID:13476
- C:\Windows\System\meaIMRB.exe
  C:\Windows\System\meaIMRB.exe
  2⤵
  PID:13500
- C:\Windows\System\ttzfWyC.exe
  C:\Windows\System\ttzfWyC.exe
  2⤵
  PID:13532
- C:\Windows\System\dtSdOVF.exe
  C:\Windows\System\dtSdOVF.exe
  2⤵
  PID:13564
- C:\Windows\System\uPOjBhn.exe
  C:\Windows\System\uPOjBhn.exe
  2⤵
  PID:13584
- C:\Windows\System\UwbmLil.exe
  C:\Windows\System\UwbmLil.exe
  2⤵
  PID:13612
- C:\Windows\System\HkzBGIs.exe
  C:\Windows\System\HkzBGIs.exe
  2⤵
  PID:13636
- C:\Windows\System\nSnzmDx.exe
  C:\Windows\System\nSnzmDx.exe
  2⤵
  PID:13656
- C:\Windows\System\DCZidHU.exe
  C:\Windows\System\DCZidHU.exe
  2⤵
  PID:13676
- C:\Windows\System\IGqIsRA.exe
  C:\Windows\System\IGqIsRA.exe
  2⤵
  PID:13692
- C:\Windows\System\PaMjVoQ.exe
  C:\Windows\System\PaMjVoQ.exe
  2⤵
  PID:13712
- C:\Windows\System\shGCvEb.exe
  C:\Windows\System\shGCvEb.exe
  2⤵
  PID:13732
- C:\Windows\System\rLuQgfE.exe
  C:\Windows\System\rLuQgfE.exe
  2⤵
  PID:13760
- C:\Windows\System\ggjEEyo.exe
  C:\Windows\System\ggjEEyo.exe
  2⤵
  PID:13776
- C:\Windows\System\zWnkqIt.exe
  C:\Windows\System\zWnkqIt.exe
  2⤵
  PID:13800
- C:\Windows\System\okWGako.exe
  C:\Windows\System\okWGako.exe
  2⤵
  PID:13824
- C:\Windows\System\NvTMyCI.exe
  C:\Windows\System\NvTMyCI.exe
  2⤵
  PID:13852
- C:\Windows\System\wXrpUWC.exe
  C:\Windows\System\wXrpUWC.exe
  2⤵
  PID:13876
- C:\Windows\System\ReVxlhn.exe
  C:\Windows\System\ReVxlhn.exe
  2⤵
  PID:13900
- C:\Windows\System\jdLHPUb.exe
  C:\Windows\System\jdLHPUb.exe
  2⤵
  PID:13920
- C:\Windows\System\IunhZxO.exe
  C:\Windows\System\IunhZxO.exe
  2⤵
  PID:13948
- C:\Windows\System\OgHJBiG.exe
  C:\Windows\System\OgHJBiG.exe
  2⤵
  PID:13968
- C:\Windows\System\tKkOdag.exe
  C:\Windows\System\tKkOdag.exe
  2⤵
  PID:13992
- C:\Windows\System\yReNrmd.exe
  C:\Windows\System\yReNrmd.exe
  2⤵
  PID:14012
- C:\Windows\System\robghWy.exe
  C:\Windows\System\robghWy.exe
  2⤵
  PID:14036
- C:\Windows\System\RgJGfeD.exe
  C:\Windows\System\RgJGfeD.exe
  2⤵
  PID:14072
- C:\Windows\System\nTaNfpQ.exe
  C:\Windows\System\nTaNfpQ.exe
  2⤵
  PID:14092
- C:\Windows\System\hYogjud.exe
  C:\Windows\System\hYogjud.exe
  2⤵
  PID:14112
- C:\Windows\System\brARslc.exe
  C:\Windows\System\brARslc.exe
  2⤵
  PID:14140
- C:\Windows\System\IoHWWkq.exe
  C:\Windows\System\IoHWWkq.exe
  2⤵
  PID:14164
- C:\Windows\System\VcdBPTq.exe
  C:\Windows\System\VcdBPTq.exe
  2⤵
  PID:14192
- C:\Windows\System\gCGfAcY.exe
  C:\Windows\System\gCGfAcY.exe
  2⤵
  PID:14216
- C:\Windows\System\jOzRIvY.exe
  C:\Windows\System\jOzRIvY.exe
  2⤵
  PID:14236
- C:\Windows\System\jrEkbqu.exe
  C:\Windows\System\jrEkbqu.exe
  2⤵
  PID:14264
- C:\Windows\System\PvOfBOz.exe
  C:\Windows\System\PvOfBOz.exe
  2⤵
  PID:14300
- C:\Windows\System\FusMifF.exe
  C:\Windows\System\FusMifF.exe
  2⤵
  PID:14320
- C:\Windows\System\DgRgjWb.exe
  C:\Windows\System\DgRgjWb.exe
  2⤵
  PID:13268
- C:\Windows\System\pJBZDyU.exe
  C:\Windows\System\pJBZDyU.exe
  2⤵
  PID:11124
- C:\Windows\System\rncOSAl.exe
  C:\Windows\System\rncOSAl.exe
  2⤵
  PID:9464
- C:\Windows\System\EDaGLWC.exe
  C:\Windows\System\EDaGLWC.exe
  2⤵
  PID:12604
- C:\Windows\System\slQpopX.exe
  C:\Windows\System\slQpopX.exe
  2⤵
  PID:11408
- C:\Windows\System\OoXxlzy.exe
  C:\Windows\System\OoXxlzy.exe
  2⤵
  PID:10284
- C:\Windows\System\YiaiwBK.exe
  C:\Windows\System\YiaiwBK.exe
  2⤵
  PID:12788
- C:\Windows\System\SDOMynR.exe
  C:\Windows\System\SDOMynR.exe
  2⤵
  PID:10464
- C:\Windows\System\nLkufpC.exe
  C:\Windows\System\nLkufpC.exe
  2⤵
  PID:12220
- C:\Windows\System\sqePzIy.exe
  C:\Windows\System\sqePzIy.exe
  2⤵
  PID:12924
- C:\Windows\System\pyIETRD.exe
  C:\Windows\System\pyIETRD.exe
  2⤵
  PID:12972
- C:\Windows\System\wDDoaoK.exe
  C:\Windows\System\wDDoaoK.exe
  2⤵
  PID:12836
- C:\Windows\System\OsRekDY.exe
  C:\Windows\System\OsRekDY.exe
  2⤵
  PID:12200
- C:\Windows\System\UgcHjNS.exe
  C:\Windows\System\UgcHjNS.exe
  2⤵
  PID:12456
- C:\Windows\System\uuNumxS.exe
  C:\Windows\System\uuNumxS.exe
  2⤵
  PID:13356
- C:\Windows\System\OeNTGQA.exe
  C:\Windows\System\OeNTGQA.exe
  2⤵
  PID:12588
- C:\Windows\System\ibqMkAw.exe
  C:\Windows\System\ibqMkAw.exe
  2⤵
  PID:13492
- C:\Windows\System\hYllqQD.exe
  C:\Windows\System\hYllqQD.exe
  2⤵
  PID:12664
- C:\Windows\System\luKAEjQ.exe
  C:\Windows\System\luKAEjQ.exe
  2⤵
  PID:11608
- C:\Windows\System\TlDdWqZ.exe
  C:\Windows\System\TlDdWqZ.exe
  2⤵
  PID:12304
- C:\Windows\System\DqqybVw.exe
  C:\Windows\System\DqqybVw.exe
  2⤵
  PID:13788
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13788 -s 248
    3⤵
    PID:17372
- C:\Windows\System\VDUfrSt.exe
  C:\Windows\System\VDUfrSt.exe
  2⤵
  PID:12512
- C:\Windows\System\bgyVJWq.exe
  C:\Windows\System\bgyVJWq.exe
  2⤵
  PID:12896
- C:\Windows\System\byWBmwq.exe
  C:\Windows\System\byWBmwq.exe
  2⤵
  PID:13872
- C:\Windows\System\tRYMsAV.exe
  C:\Windows\System\tRYMsAV.exe
  2⤵
  PID:13932
- C:\Windows\System\ToaNbzJ.exe
  C:\Windows\System\ToaNbzJ.exe
  2⤵
  PID:13040
- C:\Windows\System\jwLDQLq.exe
  C:\Windows\System\jwLDQLq.exe
  2⤵
  PID:13984
- C:\Windows\System\RaptKXO.exe
  C:\Windows\System\RaptKXO.exe
  2⤵
  PID:14008
- C:\Windows\System\lDoGXek.exe
  C:\Windows\System\lDoGXek.exe
  2⤵
  PID:14360
- C:\Windows\System\QNVKJxw.exe
  C:\Windows\System\QNVKJxw.exe
  2⤵
  PID:14396
- C:\Windows\System\VhtMCuM.exe
  C:\Windows\System\VhtMCuM.exe
  2⤵
  PID:14412
- C:\Windows\System\teFIasi.exe
  C:\Windows\System\teFIasi.exe
  2⤵
  PID:14440
- C:\Windows\System\wimCDcs.exe
  C:\Windows\System\wimCDcs.exe
  2⤵
  PID:14468
- C:\Windows\System\UvsPnkT.exe
  C:\Windows\System\UvsPnkT.exe
  2⤵
  PID:14496
- C:\Windows\System\tJOKubK.exe
  C:\Windows\System\tJOKubK.exe
  2⤵
  PID:14524
- C:\Windows\System\WqEXuLY.exe
  C:\Windows\System\WqEXuLY.exe
  2⤵
  PID:14564
- C:\Windows\System\knZEhOb.exe
  C:\Windows\System\knZEhOb.exe
  2⤵
  PID:14608
- C:\Windows\System\hBAezIn.exe
  C:\Windows\System\hBAezIn.exe
  2⤵
  PID:14640
- C:\Windows\System\CQvijpv.exe
  C:\Windows\System\CQvijpv.exe
  2⤵
  PID:14696
- C:\Windows\System\YfMpnSA.exe
  C:\Windows\System\YfMpnSA.exe
  2⤵
  PID:14732
- C:\Windows\System\wdanVqe.exe
  C:\Windows\System\wdanVqe.exe
  2⤵
  PID:14772
- C:\Windows\System\ASajHlL.exe
  C:\Windows\System\ASajHlL.exe
  2⤵
  PID:14816
- C:\Windows\System\NvOfujc.exe
  C:\Windows\System\NvOfujc.exe
  2⤵
  PID:14832
- C:\Windows\System\rayFwNl.exe
  C:\Windows\System\rayFwNl.exe
  2⤵
  PID:14852
- C:\Windows\System\XoqYFnw.exe
  C:\Windows\System\XoqYFnw.exe
  2⤵
  PID:14884
- C:\Windows\System\LZmXiJL.exe
  C:\Windows\System\LZmXiJL.exe
  2⤵
  PID:14900
- C:\Windows\System\Pkfmxkf.exe
  C:\Windows\System\Pkfmxkf.exe
  2⤵
  PID:14916
- C:\Windows\System\mUguWWs.exe
  C:\Windows\System\mUguWWs.exe
  2⤵
  PID:14932
- C:\Windows\System\qjOHXqZ.exe
  C:\Windows\System\qjOHXqZ.exe
  2⤵
  PID:14948
- C:\Windows\System\FIJaPTw.exe
  C:\Windows\System\FIJaPTw.exe
  2⤵
  PID:14964
- C:\Windows\System\JZEGupJ.exe
  C:\Windows\System\JZEGupJ.exe
  2⤵
  PID:14980
- C:\Windows\System\xBVWanN.exe
  C:\Windows\System\xBVWanN.exe
  2⤵
  PID:15000
- C:\Windows\System\dMtSglL.exe
  C:\Windows\System\dMtSglL.exe
  2⤵
  PID:15020
- C:\Windows\System\NmBVcMW.exe
  C:\Windows\System\NmBVcMW.exe
  2⤵
  PID:15036
- C:\Windows\System\ircrpnB.exe
  C:\Windows\System\ircrpnB.exe
  2⤵
  PID:15052
- C:\Windows\System\bvvxACh.exe
  C:\Windows\System\bvvxACh.exe
  2⤵
  PID:15068
- C:\Windows\System\SjoQZDZ.exe
  C:\Windows\System\SjoQZDZ.exe
  2⤵
  PID:15084
- C:\Windows\System\IkxxIPS.exe
  C:\Windows\System\IkxxIPS.exe
  2⤵
  PID:15100
- C:\Windows\System\pYflfLv.exe
  C:\Windows\System\pYflfLv.exe
  2⤵
  PID:15120
- C:\Windows\System\dMMfApJ.exe
  C:\Windows\System\dMMfApJ.exe
  2⤵
  PID:15152
- C:\Windows\System\GciCDSu.exe
  C:\Windows\System\GciCDSu.exe
  2⤵
  PID:15172
- C:\Windows\System\aNcbnHb.exe
  C:\Windows\System\aNcbnHb.exe
  2⤵
  PID:15188
- C:\Windows\System\RaCdkSU.exe
  C:\Windows\System\RaCdkSU.exe
  2⤵
  PID:15208
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15208 -s 248
    3⤵
    PID:17116
- C:\Windows\System\pGwhFyA.exe
  C:\Windows\System\pGwhFyA.exe
  2⤵
  PID:15248
- C:\Windows\System\ItRziHa.exe
  C:\Windows\System\ItRziHa.exe
  2⤵
  PID:15276
- C:\Windows\System\liOLYQk.exe
  C:\Windows\System\liOLYQk.exe
  2⤵
  PID:15316
- C:\Windows\System\nSCutAr.exe
  C:\Windows\System\nSCutAr.exe
  2⤵
  PID:15352
- C:\Windows\System\hCcLGiF.exe
  C:\Windows\System\hCcLGiF.exe
  2⤵
  PID:12904
- C:\Windows\System\wzsWkBr.exe
  C:\Windows\System\wzsWkBr.exe
  2⤵
  PID:12228
- C:\Windows\System\WdWPGAH.exe
  C:\Windows\System\WdWPGAH.exe
  2⤵
  PID:14232
- C:\Windows\System\aRQGCwK.exe
  C:\Windows\System\aRQGCwK.exe
  2⤵
  PID:13368
- C:\Windows\System\QZHZBbW.exe
  C:\Windows\System\QZHZBbW.exe
  2⤵
  PID:11772
- C:\Windows\System\lIWHPhY.exe
  C:\Windows\System\lIWHPhY.exe
  2⤵
  PID:13644
- C:\Windows\System\bQAVaFU.exe
  C:\Windows\System\bQAVaFU.exe
  2⤵
  PID:12964
- C:\Windows\System\fhIMFsA.exe
  C:\Windows\System\fhIMFsA.exe
  2⤵
  PID:13068
- C:\Windows\System\meQflrw.exe
  C:\Windows\System\meQflrw.exe
  2⤵
  PID:12384
- C:\Windows\System\oYBDlLm.exe
  C:\Windows\System\oYBDlLm.exe
  2⤵
  PID:11580
- C:\Windows\System\ilxfXpT.exe
  C:\Windows\System\ilxfXpT.exe
  2⤵
  PID:13884
- C:\Windows\System\NYZEgVt.exe
  C:\Windows\System\NYZEgVt.exe
  2⤵
  PID:10904
- C:\Windows\System\tcvPCtH.exe
  C:\Windows\System\tcvPCtH.exe
  2⤵
  PID:14600
- C:\Windows\System\AdZuPnI.exe
  C:\Windows\System\AdZuPnI.exe
  2⤵
  PID:12508
- C:\Windows\System\hDbbOoG.exe
  C:\Windows\System\hDbbOoG.exe
  2⤵
  PID:9992
- C:\Windows\System\TVNuEQp.exe
  C:\Windows\System\TVNuEQp.exe
  2⤵
  PID:13556
- C:\Windows\System\DdIMjMB.exe
  C:\Windows\System\DdIMjMB.exe
  2⤵
  PID:13604
- C:\Windows\System\EvQHVRs.exe
  C:\Windows\System\EvQHVRs.exe
  2⤵
  PID:13220
- C:\Windows\System\ITLCUkN.exe
  C:\Windows\System\ITLCUkN.exe
  2⤵
  PID:14680
- C:\Windows\System\ylPjTnA.exe
  C:\Windows\System\ylPjTnA.exe
  2⤵
  PID:13796
- C:\Windows\System\YlgJyRT.exe
  C:\Windows\System\YlgJyRT.exe
  2⤵
  PID:14720
- C:\Windows\System\dAWQErN.exe
  C:\Windows\System\dAWQErN.exe
  2⤵
  PID:13956
- C:\Windows\System\iJPvRXk.exe
  C:\Windows\System\iJPvRXk.exe
  2⤵
  PID:13936
- C:\Windows\System\rEWUByt.exe
  C:\Windows\System\rEWUByt.exe
  2⤵
  PID:14052
- C:\Windows\System\CdvpaCQ.exe
  C:\Windows\System\CdvpaCQ.exe
  2⤵
  PID:14452
- C:\Windows\System\JfgZrXf.exe
  C:\Windows\System\JfgZrXf.exe
  2⤵
  PID:14800
- C:\Windows\System\BXHQMuV.exe
  C:\Windows\System\BXHQMuV.exe
  2⤵
  PID:15376
- C:\Windows\System\jDHQfuH.exe
  C:\Windows\System\jDHQfuH.exe
  2⤵
  PID:15392
- C:\Windows\System\eIuNuOr.exe
  C:\Windows\System\eIuNuOr.exe
  2⤵
  PID:15408
- C:\Windows\System\QAdhLfo.exe
  C:\Windows\System\QAdhLfo.exe
  2⤵
  PID:15424
- C:\Windows\System\tGOmath.exe
  C:\Windows\System\tGOmath.exe
  2⤵
  PID:15452
- C:\Windows\System\UgPqKvU.exe
  C:\Windows\System\UgPqKvU.exe
  2⤵
  PID:15476
- C:\Windows\System\tUcWoXS.exe
  C:\Windows\System\tUcWoXS.exe
  2⤵
  PID:15508
- C:\Windows\System\PBATYTb.exe
  C:\Windows\System\PBATYTb.exe
  2⤵
  PID:15532
- C:\Windows\System\lbnkoHN.exe
  C:\Windows\System\lbnkoHN.exe
  2⤵
  PID:15568
- C:\Windows\System\ABZJeWM.exe
  C:\Windows\System\ABZJeWM.exe
  2⤵
  PID:15600
- C:\Windows\System\ZdgVGXh.exe
  C:\Windows\System\ZdgVGXh.exe
  2⤵
  PID:15624
- C:\Windows\System\zZaJDCL.exe
  C:\Windows\System\zZaJDCL.exe
  2⤵
  PID:15644
- C:\Windows\System\FUwXebl.exe
  C:\Windows\System\FUwXebl.exe
  2⤵
  PID:15668
- C:\Windows\System\QsWDAdP.exe
  C:\Windows\System\QsWDAdP.exe
  2⤵
  PID:15700
- C:\Windows\System\IfjnwOs.exe
  C:\Windows\System\IfjnwOs.exe
  2⤵
  PID:15716
- C:\Windows\System\JDjqjDQ.exe
  C:\Windows\System\JDjqjDQ.exe
  2⤵
  PID:15748
- C:\Windows\System\nddQGda.exe
  C:\Windows\System\nddQGda.exe
  2⤵
  PID:15780
- C:\Windows\System\bxdxyXJ.exe
  C:\Windows\System\bxdxyXJ.exe
  2⤵
  PID:15808
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15808 -s 248
    3⤵
    PID:17256
- C:\Windows\System\PhSKDzZ.exe
  C:\Windows\System\PhSKDzZ.exe
  2⤵
  PID:15828
- C:\Windows\System\TmwdSHu.exe
  C:\Windows\System\TmwdSHu.exe
  2⤵
  PID:15852
- C:\Windows\System\ZhoIzKO.exe
  C:\Windows\System\ZhoIzKO.exe
  2⤵
  PID:15876
- C:\Windows\System\ORKcGIn.exe
  C:\Windows\System\ORKcGIn.exe
  2⤵
  PID:15900
- C:\Windows\System\Mkowuln.exe
  C:\Windows\System\Mkowuln.exe
  2⤵
  PID:15936
- C:\Windows\System\spqlieT.exe
  C:\Windows\System\spqlieT.exe
  2⤵
  PID:15956
- C:\Windows\System\UswxGQc.exe
  C:\Windows\System\UswxGQc.exe
  2⤵
  PID:15992
- C:\Windows\System\hJRRvXz.exe
  C:\Windows\System\hJRRvXz.exe
  2⤵
  PID:16008
- C:\Windows\System\SvITQxO.exe
  C:\Windows\System\SvITQxO.exe
  2⤵
  PID:16032
- C:\Windows\System\DeBGAKl.exe
  C:\Windows\System\DeBGAKl.exe
  2⤵
  PID:16048
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16048 -s 248
    3⤵
    PID:14944
- C:\Windows\System\OptqmMt.exe
  C:\Windows\System\OptqmMt.exe
  2⤵
  PID:16068
- C:\Windows\System\xCLfBBE.exe
  C:\Windows\System\xCLfBBE.exe
  2⤵
  PID:16084
- C:\Windows\System\ZACyZrQ.exe
  C:\Windows\System\ZACyZrQ.exe
  2⤵
  PID:16108
- C:\Windows\System\ufzOlaA.exe
  C:\Windows\System\ufzOlaA.exe
  2⤵
  PID:16136
- C:\Windows\System\RKFToMv.exe
  C:\Windows\System\RKFToMv.exe
  2⤵
  PID:16160
- C:\Windows\System\xIinzKL.exe
  C:\Windows\System\xIinzKL.exe
  2⤵
  PID:16180
- C:\Windows\System\nGzXODP.exe
  C:\Windows\System\nGzXODP.exe
  2⤵
  PID:16212
- C:\Windows\System\YrIJKUK.exe
  C:\Windows\System\YrIJKUK.exe
  2⤵
  PID:16240
- C:\Windows\System\rDuTZsk.exe
  C:\Windows\System\rDuTZsk.exe
  2⤵
  PID:16272
- C:\Windows\System\ccqEwat.exe
  C:\Windows\System\ccqEwat.exe
  2⤵
  PID:16308
- C:\Windows\System\lcPwufm.exe
  C:\Windows\System\lcPwufm.exe
  2⤵
  PID:16332
- C:\Windows\System\eJFYWwn.exe
  C:\Windows\System\eJFYWwn.exe
  2⤵
  PID:16356
- C:\Windows\System\ZwQtPpy.exe
  C:\Windows\System\ZwQtPpy.exe
  2⤵
  PID:15028
- C:\Windows\System\EHeVyPZ.exe
  C:\Windows\System\EHeVyPZ.exe
  2⤵
  PID:15284
- C:\Windows\System\onLIgJA.exe
  C:\Windows\System\onLIgJA.exe
  2⤵
  PID:14160
- C:\Windows\System\OXZGnls.exe
  C:\Windows\System\OXZGnls.exe
  2⤵
  PID:13092
- C:\Windows\System\vmFQsgH.exe
  C:\Windows\System\vmFQsgH.exe
  2⤵
  PID:14228
- C:\Windows\System\zxCRhdh.exe
  C:\Windows\System\zxCRhdh.exe
  2⤵
  PID:14308
- C:\Windows\System\jwRRWrx.exe
  C:\Windows\System\jwRRWrx.exe
  2⤵
  PID:13664
- C:\Windows\System\vhMKATc.exe
  C:\Windows\System\vhMKATc.exe
  2⤵
  PID:12728
- C:\Windows\System\aJtaxBl.exe
  C:\Windows\System\aJtaxBl.exe
  2⤵
  PID:12452
- C:\Windows\System\bwNugMr.exe
  C:\Windows\System\bwNugMr.exe
  2⤵
  PID:13768
- C:\Windows\System\SLvMdNK.exe
  C:\Windows\System\SLvMdNK.exe
  2⤵
  PID:14108
- C:\Windows\System\ENMUmKu.exe
  C:\Windows\System\ENMUmKu.exe
  2⤵
  PID:13440
- C:\Windows\System\drICwva.exe
  C:\Windows\System\drICwva.exe
  2⤵
  PID:14488
- C:\Windows\System\HhWvEUK.exe
  C:\Windows\System\HhWvEUK.exe
  2⤵
  PID:14840
- C:\Windows\System\zPNLuem.exe
  C:\Windows\System\zPNLuem.exe
  2⤵
  PID:14880
- C:\Windows\System\ZgshWAN.exe
  C:\Windows\System\ZgshWAN.exe
  2⤵
  PID:13960
- C:\Windows\System\jxjtjFX.exe
  C:\Windows\System\jxjtjFX.exe
  2⤵
  PID:15012
- C:\Windows\System\oBtFSQn.exe
  C:\Windows\System\oBtFSQn.exe
  2⤵
  PID:15048
- C:\Windows\System\ClgHVFz.exe
  C:\Windows\System\ClgHVFz.exe
  2⤵
  PID:15416
- C:\Windows\System\kqQktSM.exe
  C:\Windows\System\kqQktSM.exe
  2⤵
  PID:15464
- C:\Windows\System\quzGCqc.exe
  C:\Windows\System\quzGCqc.exe
  2⤵
  PID:14540
- C:\Windows\System\sjnuxYE.exe
  C:\Windows\System\sjnuxYE.exe
  2⤵
  PID:15608
- C:\Windows\System\yvRsMuo.exe
  C:\Windows\System\yvRsMuo.exe
  2⤵
  PID:16408
- C:\Windows\System\tMCpvPX.exe
  C:\Windows\System\tMCpvPX.exe
  2⤵
  PID:16436
- C:\Windows\System\mDWNYcL.exe
  C:\Windows\System\mDWNYcL.exe
  2⤵
  PID:16452
- C:\Windows\System\pwuTVvd.exe
  C:\Windows\System\pwuTVvd.exe
  2⤵
  PID:16472
- C:\Windows\System\UrqclHg.exe
  C:\Windows\System\UrqclHg.exe
  2⤵
  PID:16488
- C:\Windows\System\PQJwQOp.exe
  C:\Windows\System\PQJwQOp.exe
  2⤵
  PID:16516
- C:\Windows\System\vZuuYUb.exe
  C:\Windows\System\vZuuYUb.exe
  2⤵
  PID:16532
- C:\Windows\System\rDCqkjv.exe
  C:\Windows\System\rDCqkjv.exe
  2⤵
  PID:16552
- C:\Windows\System\CVlVzoa.exe
  C:\Windows\System\CVlVzoa.exe
  2⤵
  PID:16568
- C:\Windows\System\DYIEWcj.exe
  C:\Windows\System\DYIEWcj.exe
  2⤵
  PID:16592
- C:\Windows\System\wHBiifF.exe
  C:\Windows\System\wHBiifF.exe
  2⤵
  PID:16616
- C:\Windows\System\BYowufI.exe
  C:\Windows\System\BYowufI.exe
  2⤵
  PID:16652
- C:\Windows\System\vcHnUmW.exe
  C:\Windows\System\vcHnUmW.exe
  2⤵
  PID:16676
- C:\Windows\System\SDuvXai.exe
  C:\Windows\System\SDuvXai.exe
  2⤵
  PID:16696
- C:\Windows\System\LSYRITo.exe
  C:\Windows\System\LSYRITo.exe
  2⤵
  PID:16720
- C:\Windows\System\kaJyOeS.exe
  C:\Windows\System\kaJyOeS.exe
  2⤵
  PID:16748
- C:\Windows\System\tTdpGsy.exe
  C:\Windows\System\tTdpGsy.exe
  2⤵
  PID:16764
- C:\Windows\System\tWTqgio.exe
  C:\Windows\System\tWTqgio.exe
  2⤵
  PID:16792
- C:\Windows\System\hAjVWWv.exe
  C:\Windows\System\hAjVWWv.exe
  2⤵
  PID:16816
- C:\Windows\System\fYMlVDS.exe
  C:\Windows\System\fYMlVDS.exe
  2⤵
  PID:16832
- C:\Windows\System\khYdMSS.exe
  C:\Windows\System\khYdMSS.exe
  2⤵
  PID:16856
- C:\Windows\System\zwQWKZh.exe
  C:\Windows\System\zwQWKZh.exe
  2⤵
  PID:16880
- C:\Windows\System\qbqwbwg.exe
  C:\Windows\System\qbqwbwg.exe
  2⤵
  PID:16908
- C:\Windows\System\AZZnKZM.exe
  C:\Windows\System\AZZnKZM.exe
  2⤵
  PID:16944
- C:\Windows\System\BxyMbno.exe
  C:\Windows\System\BxyMbno.exe
  2⤵
  PID:16984
- C:\Windows\System\QfmGTaU.exe
  C:\Windows\System\QfmGTaU.exe
  2⤵
  PID:17008
- C:\Windows\System\hYYztYj.exe
  C:\Windows\System\hYYztYj.exe
  2⤵
  PID:17024
- C:\Windows\System\HanvvvI.exe
  C:\Windows\System\HanvvvI.exe
  2⤵
  PID:17052
- C:\Windows\System\fDbXzWi.exe
  C:\Windows\System\fDbXzWi.exe
  2⤵
  PID:17080
- C:\Windows\System\HfBLXqO.exe
  C:\Windows\System\HfBLXqO.exe
  2⤵
  PID:17108
- C:\Windows\System\EzAMuoN.exe
  C:\Windows\System\EzAMuoN.exe
  2⤵
  PID:17128
- C:\Windows\System\awmifCF.exe
  C:\Windows\System\awmifCF.exe
  2⤵
  PID:17160
- C:\Windows\System\lcoVkRV.exe
  C:\Windows\System\lcoVkRV.exe
  2⤵
  PID:17180
- C:\Windows\System\HSGrauW.exe
  C:\Windows\System\HSGrauW.exe
  2⤵
  PID:17216
- C:\Windows\System\XemqLWt.exe
  C:\Windows\System\XemqLWt.exe
  2⤵
  PID:17244
- C:\Windows\System\soqkDkY.exe
  C:\Windows\System\soqkDkY.exe
  2⤵
  PID:17260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CwscRQI.exe

Filesize
1.2MB

MD5
9153fc9776f90451387b3fb3943c1fac

SHA1
788f436976a41b225c1545f12a314d8b54d9ccdb

SHA256
05126e5d1701a9d69147ea75b69a46f1dd7179796eca1eaae1e52f7a769e9f25

SHA512
9fbea4378c28440865744d5b82dd170952b8a3514560f2f4fb191cb8cfefcfc2815ddfa796b6b32aad44e0960640089f29c21f51d88a524af30a4229d0aa68da

Download Submit
C:\Windows\System\DBJYgFM.exe

Filesize
1.2MB

MD5
dfb059f9bc57801f943f831086911caa

SHA1
ad302364b0272bc94d4451c810215350f98a0d2f

SHA256
516f32bf1990ede837dfb185966a201c162aff09c3dc0c20a6b568e65477ff84

SHA512
c75dd8714c9f889d331e62979f9b5bc888e4521d7110eff12c5ad6b01d1d16f16ae0f3041c451648e7dca4dbc53ef95623aec04b8c799ec6b07ec4b016d9c7b7

Download Submit
C:\Windows\System\EMvmbyu.exe

Filesize
1.2MB

MD5
37a319df0d2e91b3d635b07d70108c35

SHA1
5679a3385c00d7212756ce6945ac0b0f07b9f642

SHA256
d6ebfd23fdec89d0c2e1ead05dfcc2ebf5bfaabd52d9e0cba692ba1470d606c8

SHA512
c401f5560deba6455f974625e70ffd1b754331953ef31cab4a78c86e6b6c10662eb0f600d45f51a59b7f833854215f5193241c5f7abd1645ff2681dd43fe63d6

Download Submit
C:\Windows\System\GZyFriO.exe

Filesize
1.2MB

MD5
b3f683bcd8b89274712659a8d4dab6dd

SHA1
781e923aef871bc2164d69babb6938cf356ca408

SHA256
66e8db6b78619cb0f583e0902a18cacf45f219f4f219b45c2430915c613cd81d

SHA512
5136c92f192c2a8e862dcce171e4b4f6a7ba8b26c0414069e579370bafb8cfca7ecb173adf4afc57a6e519dc310acdcb6d75d02c108039826b2e0f02cd0c901a

Download Submit
C:\Windows\System\JmrUcpb.exe

Filesize
1.2MB

MD5
86c1ef0042d708e56f72bc52fdcaf2cf

SHA1
50ac5063b084c75d392e6c8cf6598d6c5bd939f2

SHA256
4411cfbc2177268c40bf284893fad85fd6766d36fa65e9a88880e025789bb7e4

SHA512
07c678df76e7c46f22cbc77fc16d26617f17170ddb63bccfe5740ae34336c7e0cd4ebfee7efe72c361d10f11e10344c7aefa48f6eff307d9d934b316acfc8f6b

Download Submit
C:\Windows\System\JwThDAM.exe

Filesize
1.2MB

MD5
2887f858c23d723490f7e74d38b94d62

SHA1
263673e2bafd4cd38895d16aa1860c8e6160a59c

SHA256
210d9c69b70d0c5d6d1ae5e2719a3008fcd7d53fa6c7062c19c153fb7e4149be

SHA512
a4eb9e8735e1c68bf6d8f56d0d96a5f02d2a015666cfe63539a8d6c12419b56d6d97e8e6da360d0e3f535ea09ce0b204d8ae165a22fc4a1320fca5a59494f1ee

Download Submit
C:\Windows\System\LCqUspU.exe

Filesize
1.2MB

MD5
13f6fac997cd67aa57f896135899b39e

SHA1
82703c382ccffb2cbd16c28fc7ae4771397aa411

SHA256
6a82d2aa9bc5dbbd87688eb04b664c9169f2fa4d4488788047c53f0d3f50e267

SHA512
3fb06eafabd064dc0d45b1d70ee3e8d5a35fe4d639f9eb6feb8e71824faa91dbe5247d5ada8cda17b50db63aed30bca14015191db7d34fec5b86f9744247d9fe

Download Submit
C:\Windows\System\NNXKMUO.exe

Filesize
1.2MB

MD5
de57426b68fdec4b46fea5abef25aec3

SHA1
163cf494ecb6aea14d42fe767b7dd00e8605deab

SHA256
35493c9d64870198250b4ce8b68a563fa6b509aff2f4f6fe28b1f2ff4d04730c

SHA512
e0a5c8b3272fcf78ce56ec6773a165fc97f9b03a887643f7f58e54f015d478d02a65fd60f99c8f3aed58799c59c68693e33314ff354533f3a00b3088a2e1c215

Download Submit
C:\Windows\System\NoRemiH.exe

Filesize
1.2MB

MD5
895eaa0c43ef102eac4adea7a03ca6c9

SHA1
b1424fb3cc0ffb6bbe60e5b1a1e4829e0de7103b

SHA256
881e31c57eafdb636674e0ad83493e36e6018692d65d31a36160b71edfe0f255

SHA512
022b283b6c78a41d71a4135b96699107d75e8f7666a12c592b80cdeaea0df7ec40c2588e9f1ec55fd9a4bb5c21bfc8e330af971e91057ca6a2d0faad01076335

Download Submit
C:\Windows\System\PMHROpW.exe

Filesize
1.2MB

MD5
c4d84a18cc148ce8cc515ce12004a0cc

SHA1
db8b85a4e83af7529b6345d7c6449884223a9a22

SHA256
e0201226fee9d4957bb4e4151f137a945d331cfe84cf8b7ecdd910ebf3ee3e9a

SHA512
eb1045e1b992f8f47f39c9c62c82d99d73ed4aec6bd8d97b42696e9d37526438a0f18efde71721843baf5660737530262a43429592be15a95f803e6809f0707b

Download Submit
C:\Windows\System\PpvjEEj.exe

Filesize
1.2MB

MD5
b73e5463e701a52f867f6129eb5db69a

SHA1
2b86c38251f74b0171a07037dcccf185b9edf6b1

SHA256
032b9f11b92a035390c63958b0c5cec999f3ec9c0e62fe9885cbc7073fd29232

SHA512
e8c043318c7ebed991e01f85dde77f826a56de36ce3eaa824b70d12375e80dad35e1a665c7ba4692063ac2d6f042410604e22ff11487131f3bafc1c7ed6317c2

Download Submit
C:\Windows\System\QKvpxOm.exe

Filesize
1.2MB

MD5
593dd7bd21f6c2001b8bcab130465efb

SHA1
c2b2f3a0c89f343fb6be6efac77b83acc831eb3f

SHA256
7d22fd8765af9addf88fd8f43813fc353de4b551c6212d1b17109226394ce7c2

SHA512
148e15be355818aae3666c088a8f3346f0215da48750743ba59410393152d213a77026dfc2b237d2afb05df142ef04c64237463810d6d88045a1a8682f514a12

Download Submit
C:\Windows\System\QXpyaVI.exe

Filesize
1.2MB

MD5
0b898fcfdee3bb4dbe86f42657b1a2ca

SHA1
cd5360cc78985446063596ae264432b8d5d384f0

SHA256
3e761c73311a113fd30df66be76fcd8418ac4cdd4714bfe31f3a8417d1bb690c

SHA512
5595c9fc5b7be49638130e62fbb81cd358e45d52fee7d179c7ed4ff5293ade99cd81785d44387700d4e3b6105d6e852ba984473c284990683570a00d1448dc29

Download Submit
C:\Windows\System\QmmeVWm.exe

Filesize
1.2MB

MD5
801dcf9f3aaa8df3d3a496c0d0853594

SHA1
c23ae62699d434816cf3295373be86de9e011eab

SHA256
686c5c9820dd4163b0c91a8f9635b0bc92ac981a58a5e47fae06eef9135c03f0

SHA512
c556ef43a1f944b2c9f1627eac5c6c71460d87c22e598d1d56f261fcf45411059103d3ab5e92616dddbb0c4c58dd25aa13e5fa7d4562d7b5b8c48839aefd581d

Download Submit
C:\Windows\System\QxKerOv.exe

Filesize
1.2MB

MD5
1a2d08abb581e38b196d4a9f7afeafc3

SHA1
a2fa54f87cabb44e028e26ab24c91a76d67226ae

SHA256
fd088048692abe10b5b3d3fc8e058e7721c5148d293110023d560dd562bb0dcc

SHA512
cc6d14ffedcc649853f9c35cd2d184ff9bf78f93b5dd232bb184ce48b21680f3fa87ad7ffa75e4c9a0521b1dd453a715f1eae0d7a66917a239f719cdd41fc48a

Download Submit
C:\Windows\System\RbBlMSn.exe

Filesize
1.2MB

MD5
fcbe152a02abbe72c028fee52246b858

SHA1
68ab8b22528d396a3c35f9ee509003aac7e46241

SHA256
089130211cf05cdca810e1ebb73c082a8e99991ad5b74f09b96fcac841a45ac2

SHA512
0896cda2c90720973823fc78ec65d8f2d16b63bf2cae42ac5749db3ae58e458801aff6b99ece7a99c822231e0dd573ee5370b79d7127315449fda2bfced9a26d

Download Submit
C:\Windows\System\SpvUmnF.exe

Filesize
1.2MB

MD5
a037c01cfaaac1c84ffa87a62267d737

SHA1
803100a74c6facd8a11a2b222ad060cb81d4501b

SHA256
5c92db5b4aa7763ab4a65fc3936b70e320f9b8fe708777a50a7b01f9418ce7f9

SHA512
737414dec4f9e6599bf889d9e56c015373254c9f403551596ba1d9bab6f4020f0039eceb0aac23b724a66abcae12b69053939d2de2f1972868bc1248845a1d80

Download Submit
C:\Windows\System\WmriJDm.exe

Filesize
1.2MB

MD5
4a1bb0fbb8915eb197b57e9be6098974

SHA1
9feca1316b64fc1db7254481c0a10b5e7b22f183

SHA256
72d786f1cb0a04d6bcf2691ae859e78b51c578cd35df4ec871cdbba5aadffa67

SHA512
3b25b5cb2dc03c72b5236c29e2afe40fef40f3142c6e7a14b0e571d518df18270a67d43cc1cdc657ff7ea17ab5cd9dbf6f63ab4da2d771ab91988efed3788fdc

Download Submit
C:\Windows\System\YeZHWJn.exe

Filesize
1.2MB

MD5
60ade5bb63005732a8c2fce3369d6db8

SHA1
d6df96bd9595364557a2754e8f7326f272a9afec

SHA256
33cb8eb1e84e770dcb51f44ae4976c9482c5eb07bbb8a59776b8ba69d856c7f2

SHA512
2d01649a7c99affdec9d06459f1a31b0e4d88b488ee16c2179e8291751222c21b1065d66f0095dfc5bf7a60de8755e3ff3fb8f66fc72f253380c9a465d95b2e1

Download Submit
C:\Windows\System\aRPlgLf.exe

Filesize
1.2MB

MD5
a22686efbc4871f4522021febc083fb9

SHA1
e4dbf886f4a74ed5861fed8dd6ff7f15d176f976

SHA256
fc37f416e72663472270581bcfb2cb5ab1ced85b32fda5c74ca9ffa31cec5bd7

SHA512
9df7de8687e193d52e65e3d05075b62ba971e3e291103206586c3fc0799fdc501e7769513f4cd92d85baef4c356f20153735d4bf314b7ff62a6e2a6305b428c0

Download Submit
C:\Windows\System\bAGxjWB.exe

Filesize
1.2MB

MD5
76f405eded42f6e00cf419458fdfeb7a

SHA1
d5b74a9bc94438d588c44f1cc0ba7bd9f741d185

SHA256
54933cf8dd34dadc48a41b7f16824db536fb2eb6bca85d01fb6d3f77a446efa4

SHA512
c9e1b4236258615095e9ba05dd42b1be5092163eb60999a42ffa6dba53ed6d540708a1212c1dc69d22a8ccadeb767bc24367d2715fcd880da69d83ec9e1e8d0b

Download Submit
C:\Windows\System\fMGIcyt.exe

Filesize
1.2MB

MD5
5719fccb957b92036a8ffb5d53abb8aa

SHA1
a86a3bc40930e16b21ab1583b61b69959d5d5469

SHA256
27e5d4f33813a7146566b8faea1dd02bf643143b39eb0c56eefdc84079fa1d53

SHA512
c4c438168579761566b840d0e9cf3b807d569e3c4624257dc7de50bd7fcd0dfb276a7baf0b6d094350d6b40f0264c73536d31743e978aa219f83af934ab46926

Download Submit
C:\Windows\System\fyzgwpX.exe

Filesize
1.2MB

MD5
45646ed8222409c5b4803536cd1520a5

SHA1
0ee38999be9b6b0a2f94c37d1ba3b684e633b06e

SHA256
5610a88842fab93c3d3b1163afb5f45d35114f72326ddea7a76c15a8a9265e6e

SHA512
b98c39c4f5cb06d776950bd282b4325ed070efc31f9ecc3809f572cbdf212d9aebf4531b1a1144d79b71da9283a14198127abebd3664ebb841e7c5cf2ae03665

Download Submit
C:\Windows\System\gGgxCDL.exe

Filesize
1.2MB

MD5
33cf75df702432c1f4be2a65fa86c2d5

SHA1
7d3e105deaa057f224d13387206124e26b3f4ea5

SHA256
a9f7c1253d0213b2695f1d55f64a714007a4636461d4ebb587005a01b3923fbe

SHA512
5c96f8b54ba509c48e29cfdb9b7c083844c041f3152989bf64133a170f870228fc00ce934af6e1581770d54faa1c375a9270555e2d1eeeb873d34389f04ed465

Download Submit
C:\Windows\System\gabQXZL.exe

Filesize
1.2MB

MD5
2a98cc40a8875c1e4b4aae58d9dc4bf1

SHA1
9d84ef57335631c14a14ee35f3e0f0021f6c9e6f

SHA256
b585a1f7036b3041e7197979f72a5403c1f8342d889864e18f75e949cbfc7d0f

SHA512
63437676454bf8a968720107b53d1f7db2a7e002b6954e75c801bfd7255906c5fd2743980ffbc864cdebb47e5dc9b9869622e4eed16b14e90f378e95683fdf9a

Download Submit
C:\Windows\System\kCXbUtN.exe

Filesize
1.2MB

MD5
ee4072125ba3cdc41d52676529cec238

SHA1
d9004fcad248c3da9ca551bcdd41a165f6586534

SHA256
7c18afac706ffbd501f81dc239beb366c5df2735a57dbaa275e3c6d582d7587d

SHA512
9b4a84b12208e1ef18b4ca5976f7d63e24388c96b163c10ec8869fc8f2b4d2f8f94423402ed736d48c057bf90cbd195fe06f5884ea6710c075472455b362e4d0

Download Submit
C:\Windows\System\kQENwzh.exe

Filesize
1.2MB

MD5
3ecd63b63eebe5afc0b265d5fdaf7b16

SHA1
b36bdb8638631f29f5d5ef9f865a1b1aceedad50

SHA256
7eb08c4acc3588b1856e5d6af34c9a73c1676a101bfb77b9cab3fd3c5fb1181b

SHA512
2a6defdfccb748e5e7395176d668df79bacd30ffa9c58f47f081c6872fbd3a3b884150015284cb5e546229a9e6b86ac89f51a13aa1181251f57bab16b8eae442

Download Submit
C:\Windows\System\lDedAkv.exe

Filesize
1.2MB

MD5
aa337cf885bc11be7872418facc78139

SHA1
daeae2e84c00800e69b197d7848c448b6a3428d0

SHA256
04a61389f8ca60399cbd57453094af8248cd3577b05f5e1e153eff19f5e43326

SHA512
c7a0b729c9e011204a56c62e0998686e667cad82ac203f81f294f71572a47f88c3eff5311dc1a9f1a7201d664d6b4072b6a928f2de03fb0378c548efd0b070e4

Download Submit
C:\Windows\System\nIgBsWC.exe

Filesize
1.2MB

MD5
2eb242c01e8c5ce972667d2d301bbb15

SHA1
f411efdd6e6bdf41053ceaa194be8bf9aa9f92b3

SHA256
64a0d8a6a9c2dcadb9a356735c08c9ebef2c429a107f50be1e608986703a747b

SHA512
6b18185b0ccd48a506ad004426eaea35e42f8532bbbf77a3c4d7f89ad66d34575b91e545fdd628f652553d776ec9151cb2536b09afe257eb8f451368070c2b24

Download Submit
C:\Windows\System\nioLCKG.exe

Filesize
1.2MB

MD5
729e5e71339527527e219f625a851546

SHA1
82a347eb4b6b690fe4275c0cbbc82972fb7ab0c0

SHA256
59b7df96ab3d80cda654a45cab5f3c9fbee927c908f2eccbbb98dafcd1096781

SHA512
a548bb6004e126b069efd532dd6d6dbffae9b161ae2e7c641cb20117c4265fd083ece52742fc0859f497f9673ba73ece53ac888181cb5f33cb5b45661c459314

Download Submit
C:\Windows\System\pmnHhVa.exe

Filesize
1.2MB

MD5
7e000859ad2f3bbc949fa4fe0f5c8615

SHA1
aa7f3df5f86b80a00aed07b2664b7f67cb286c0e

SHA256
f92722cc9585e43e7705005f9926c8306b772d0331f018f0d6347014bf616692

SHA512
1f833a5325b070a52ca73c367102fbcafea4b3fdc4dcdd430cbdcd86908a7dd014fdb39efba6fa3bca132967a13ca2be59435b90bedba5775db16dd830e9a218

Download Submit
C:\Windows\System\vGlHQFc.exe

Filesize
1.2MB

MD5
b3b6f973859d336a270e2d3358ad0857

SHA1
933e6b195e99c089efb3be0b3856deaa55555b9e

SHA256
1d9259753079639f578ece7788c4d6237f8fc65aa3f7b495df02bc9e8063f71a

SHA512
5ee0623659c2342ad3df4738de2e5d29c4a999c33f125db1c4ca83b765dec7e68ab604821c2a09f0112a50df690b860d215f78f19faae27a8aae75732aa5afd7

Download Submit
C:\Windows\System\vzTPqOP.exe

Filesize
1.2MB

MD5
59d1de24675a9378459bae28decfdef3

SHA1
8235e40514d2c73c0fdbd6527ee0a45aee17de00

SHA256
d4bd702f2329a0f3f033e8912242a2379aca7f122e9383246468fc7c98b328be

SHA512
76400fc8d98fc85721e4017732b7205816313e108af5c9e44bc11e5d2f7ba2f56a8a3325c10eeacdb12a55d02c241989f659b693eb05e19ad3750057d60a903a

Download Submit
C:\Windows\System\wJFfXdM.exe

Filesize
1.2MB

MD5
f800c8b9bf01164a9eb0f83fdbed32b9

SHA1
164f108c4c2e4fd4da5dbc0d8085f4176b7d311d

SHA256
7083e446e5d421563d9e83890e9cadc2bfdadafb45c37567502497cae0e530fb

SHA512
7907e75cff40998edb7145e77f02265c9069dcb52726900e3107e8ddefc21551854f744639831d08666844f132b5be7c22ec1686c965ca09a4999e8a10caf5f1

Download Submit
C:\Windows\System\wYWBuhV.exe

Filesize
1.2MB

MD5
c0c18d6e9a4f828a1c98368781b32964

SHA1
ce8f4706c3177f8199888cbc3f2a93460ee94a74

SHA256
0cecfd6b8286649a31c37d95215b35ee6077c162d853b7a97034fabfe74ce518

SHA512
c8d1124755a81aad3f1198c463926ab3da02f8cc352c011c73193a05af645818ae4e38eb9d042bac9e6d8e2efe6baa43f670fb8294557f25b9edd122a8203230

Download Submit
C:\Windows\System\xTSeEGy.exe

Filesize
1.2MB

MD5
2742b51eefcf608a75faf75d1743a810

SHA1
d760d70e8ac7c24ebf56d8b1cd61169a63b719c6

SHA256
645432caca769875d84c8afa523a1477d2a69a1372e8a8da9e1b9105746bc5a6

SHA512
de6b16a437c7d771f720cc94bcb90943f477802e6f8dafbac965fbb0cecd7f07382ee403362fd42ad2270c7aa910a7f33048e7d6866b44f49562484cb00e9065

Download Submit
memory/2656-0-0x0000023D2D7E0000-0x0000023D2D7F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads