xmrig | b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9

Analysis

max time kernel
93s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
Size

1.5MB
MD5

05df3e62c453692fa1cabf7d6a80d707
SHA1

4e9d7ed4bb2d967e4f79fd5bae33adb4c656dce6
SHA256

b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9
SHA512

f57d1414885b5c73c62dff2bfd32d06551490ac43e888d8200b26839aa712fdd56a51691273b04520034906dfe5c510059610f0f0590f9a0847c24a2e39421ec
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5pbkTPLEU4+:GezaTF8FcNkNdfE0pZ9ozttwIRxeq/2

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c59-3.dat	xmrig
behavioral2/files/0x000a000000023cba-9.dat	xmrig
behavioral2/files/0x0007000000023cc2-14.dat	xmrig
behavioral2/files/0x0007000000023cc3-19.dat	xmrig
behavioral2/files/0x0007000000023cc7-40.dat	xmrig
behavioral2/files/0x0007000000023ccd-67.dat	xmrig
behavioral2/files/0x0007000000023cdf-157.dat	xmrig
behavioral2/files/0x0007000000023ce0-162.dat	xmrig
behavioral2/files/0x0007000000023cde-160.dat	xmrig
behavioral2/files/0x0007000000023cdd-155.dat	xmrig
behavioral2/files/0x0007000000023cdc-150.dat	xmrig
behavioral2/files/0x0007000000023cdb-145.dat	xmrig
behavioral2/files/0x0007000000023cda-140.dat	xmrig
behavioral2/files/0x0007000000023cd9-135.dat	xmrig
behavioral2/files/0x0007000000023cd8-127.dat	xmrig
behavioral2/files/0x0007000000023cd7-123.dat	xmrig
behavioral2/files/0x0007000000023cd6-118.dat	xmrig
behavioral2/files/0x0007000000023cd5-112.dat	xmrig
behavioral2/files/0x0007000000023cd4-108.dat	xmrig
behavioral2/files/0x0007000000023cd3-102.dat	xmrig
behavioral2/files/0x0007000000023cd2-98.dat	xmrig
behavioral2/files/0x0007000000023cd1-92.dat	xmrig
behavioral2/files/0x0007000000023cd0-88.dat	xmrig
behavioral2/files/0x0007000000023ccf-85.dat	xmrig
behavioral2/files/0x0007000000023cce-80.dat	xmrig
behavioral2/files/0x0007000000023ccc-70.dat	xmrig
behavioral2/files/0x0007000000023ccb-65.dat	xmrig
behavioral2/files/0x0007000000023cca-60.dat	xmrig
behavioral2/files/0x0007000000023cc9-52.dat	xmrig
behavioral2/files/0x0007000000023cc8-45.dat	xmrig
behavioral2/files/0x0007000000023cc6-35.dat	xmrig
behavioral2/files/0x0007000000023cc5-30.dat	xmrig
behavioral2/files/0x0007000000023cc4-25.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4908	iAajqrt.exe
1312	ipYACpo.exe
1952	lKUWcRl.exe
2600	kPomalo.exe
4112	UKafxsd.exe
1860	JrMwbOx.exe
1476	aYzXFFQ.exe
2976	fvoDquU.exe
4604	kVoOhLL.exe
2876	UXywaDa.exe
1664	qSQbvUD.exe
2292	BRmskCl.exe
2636	yeXnpuJ.exe
1240	CEFSeIb.exe
2820	ENJqPCp.exe
2236	yhhQytE.exe
2032	WgMuytl.exe
372	CyNqsSN.exe
1888	SJPGgxm.exe
1940	zwfqrLs.exe
4108	iVUapjI.exe
4544	YkDahNR.exe
2912	zrsZzbt.exe
4048	SNtSYnf.exe
3416	whUFndZ.exe
3436	CcNheJU.exe
2224	sjcVFej.exe
4128	beIJiDG.exe
2056	HcJctrO.exe
1008	FguiebG.exe
2336	KUIptUE.exe
3488	OVaFasx.exe
4808	SjZxioI.exe
2536	RpOcmMj.exe
1816	TBgRRmg.exe
3476	hvHtzjS.exe
2488	BxhmkWM.exe
1112	yTEQddq.exe
1164	NGqGBJE.exe
1980	kWwyNbp.exe
2072	enrMTnS.exe
3020	qpriJXc.exe
4452	EunIouu.exe
3348	llebKRu.exe
3272	BNOPAXA.exe
4760	DxxuANU.exe
4960	rdrnIzP.exe
764	JDhnOwd.exe
3172	xCecvFZ.exe
4716	KODCUyw.exe
3616	PtEKOoT.exe
3864	rYrWbKr.exe
4860	NMlQBqd.exe
2692	wDzcsEK.exe
440	LVZdjvw.exe
4432	wsteqCs.exe
5104	JZMmvrY.exe
2452	OVniter.exe
4300	dCvJWzb.exe
4320	nQAcaRQ.exe
4428	zgLZwBY.exe
4384	HdvYQxO.exe
1036	UOdLcMO.exe
4420	rrUUGYI.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\maXLFan.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\XXcgpgq.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\qMQwdBf.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\NQrUSZp.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\MBfgQcy.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\GOfQCSJ.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\EYtzKoR.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\UbRlcpT.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\sGUBmdb.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\KeJGvav.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\MdrNCBD.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\QPjQrIb.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\rfCbABr.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\ECNmoZE.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\tafBZSt.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\MdqsOaU.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\VxaOCjh.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\tREyARr.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\rTeTcop.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\RYxDxvf.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\cwXBUDj.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\HVRNPwt.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\VucwfNY.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\KHLPrYl.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\WEEodSp.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\CWsnNNR.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\tIZiZFi.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\oiUhwHm.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\eAxUzup.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\UDZeBex.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\mbMuWMq.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\jMdaWnR.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\DuxDeBs.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\yyaKQul.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\vpweuJu.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\JZMmvrY.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\OlnBuzu.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\QLyhvIO.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\GieJXOU.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\IGwcefs.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\CEFSeIb.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\qFArJKs.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\rfqwFKa.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\lFglAIq.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\wpdhiAE.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\jskZZtU.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\vuZhikc.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\EPYpgnP.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\kCyLzrU.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\qwnsRwc.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\eXJemAM.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\WgnLbrA.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\rrUUGYI.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\eHLBrxR.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\cxNMRyf.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\qdtNXrw.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\fXSbYOC.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\NTdIQxi.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\NHiVhQT.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\CtxVsIC.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\mlVAYOg.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\ogBGOpZ.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\ikZqOXj.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
File created	C:\Windows\System\UOclmAC.exe	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4908	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	83
PID 3196 wrote to memory of 4908	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	83
PID 3196 wrote to memory of 1312	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	84
PID 3196 wrote to memory of 1312	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	84
PID 3196 wrote to memory of 1952	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	85
PID 3196 wrote to memory of 1952	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	85
PID 3196 wrote to memory of 2600	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	86
PID 3196 wrote to memory of 2600	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	86
PID 3196 wrote to memory of 4112	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	87
PID 3196 wrote to memory of 4112	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	87
PID 3196 wrote to memory of 1860	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	88
PID 3196 wrote to memory of 1860	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	88
PID 3196 wrote to memory of 1476	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	89
PID 3196 wrote to memory of 1476	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	89
PID 3196 wrote to memory of 2976	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	90
PID 3196 wrote to memory of 2976	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	90
PID 3196 wrote to memory of 4604	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	91
PID 3196 wrote to memory of 4604	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	91
PID 3196 wrote to memory of 2876	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	92
PID 3196 wrote to memory of 2876	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	92
PID 3196 wrote to memory of 1664	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	93
PID 3196 wrote to memory of 1664	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	93
PID 3196 wrote to memory of 2292	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	94
PID 3196 wrote to memory of 2292	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	94
PID 3196 wrote to memory of 2636	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	95
PID 3196 wrote to memory of 2636	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	95
PID 3196 wrote to memory of 1240	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	96
PID 3196 wrote to memory of 1240	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	96
PID 3196 wrote to memory of 2820	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	97
PID 3196 wrote to memory of 2820	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	97
PID 3196 wrote to memory of 2236	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	98
PID 3196 wrote to memory of 2236	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	98
PID 3196 wrote to memory of 2032	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	99
PID 3196 wrote to memory of 2032	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	99
PID 3196 wrote to memory of 372	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	100
PID 3196 wrote to memory of 372	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	100
PID 3196 wrote to memory of 1888	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	101
PID 3196 wrote to memory of 1888	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	101
PID 3196 wrote to memory of 1940	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	102
PID 3196 wrote to memory of 1940	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	102
PID 3196 wrote to memory of 4108	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	103
PID 3196 wrote to memory of 4108	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	103
PID 3196 wrote to memory of 4544	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	104
PID 3196 wrote to memory of 4544	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	104
PID 3196 wrote to memory of 2912	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	105
PID 3196 wrote to memory of 2912	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	105
PID 3196 wrote to memory of 4048	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	106
PID 3196 wrote to memory of 4048	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	106
PID 3196 wrote to memory of 3416	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	107
PID 3196 wrote to memory of 3416	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	107
PID 3196 wrote to memory of 3436	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	108
PID 3196 wrote to memory of 3436	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	108
PID 3196 wrote to memory of 2224	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	109
PID 3196 wrote to memory of 2224	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	109
PID 3196 wrote to memory of 4128	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	110
PID 3196 wrote to memory of 4128	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	110
PID 3196 wrote to memory of 2056	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	111
PID 3196 wrote to memory of 2056	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	111
PID 3196 wrote to memory of 1008	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	112
PID 3196 wrote to memory of 1008	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	112
PID 3196 wrote to memory of 2336	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	113
PID 3196 wrote to memory of 2336	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	113
PID 3196 wrote to memory of 3488	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	114
PID 3196 wrote to memory of 3488	3196	b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe	114

C:\Users\Admin\AppData\Local\Temp\b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe
"C:\Users\Admin\AppData\Local\Temp\b6dd0c6805fed6a38389f16bfaad94a2928cab9ff929ece7c62d54aff919efb9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\System\iAajqrt.exe
  C:\Windows\System\iAajqrt.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\ipYACpo.exe
  C:\Windows\System\ipYACpo.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\lKUWcRl.exe
  C:\Windows\System\lKUWcRl.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\kPomalo.exe
  C:\Windows\System\kPomalo.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\UKafxsd.exe
  C:\Windows\System\UKafxsd.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\JrMwbOx.exe
  C:\Windows\System\JrMwbOx.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\aYzXFFQ.exe
  C:\Windows\System\aYzXFFQ.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\fvoDquU.exe
  C:\Windows\System\fvoDquU.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\kVoOhLL.exe
  C:\Windows\System\kVoOhLL.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\UXywaDa.exe
  C:\Windows\System\UXywaDa.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\qSQbvUD.exe
  C:\Windows\System\qSQbvUD.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\BRmskCl.exe
  C:\Windows\System\BRmskCl.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\yeXnpuJ.exe
  C:\Windows\System\yeXnpuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\CEFSeIb.exe
  C:\Windows\System\CEFSeIb.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\ENJqPCp.exe
  C:\Windows\System\ENJqPCp.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\yhhQytE.exe
  C:\Windows\System\yhhQytE.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\WgMuytl.exe
  C:\Windows\System\WgMuytl.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\CyNqsSN.exe
  C:\Windows\System\CyNqsSN.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\SJPGgxm.exe
  C:\Windows\System\SJPGgxm.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\zwfqrLs.exe
  C:\Windows\System\zwfqrLs.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\iVUapjI.exe
  C:\Windows\System\iVUapjI.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\YkDahNR.exe
  C:\Windows\System\YkDahNR.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\zrsZzbt.exe
  C:\Windows\System\zrsZzbt.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\SNtSYnf.exe
  C:\Windows\System\SNtSYnf.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\whUFndZ.exe
  C:\Windows\System\whUFndZ.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\CcNheJU.exe
  C:\Windows\System\CcNheJU.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\sjcVFej.exe
  C:\Windows\System\sjcVFej.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\beIJiDG.exe
  C:\Windows\System\beIJiDG.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\HcJctrO.exe
  C:\Windows\System\HcJctrO.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\FguiebG.exe
  C:\Windows\System\FguiebG.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\KUIptUE.exe
  C:\Windows\System\KUIptUE.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\OVaFasx.exe
  C:\Windows\System\OVaFasx.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\SjZxioI.exe
  C:\Windows\System\SjZxioI.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\RpOcmMj.exe
  C:\Windows\System\RpOcmMj.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\TBgRRmg.exe
  C:\Windows\System\TBgRRmg.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\hvHtzjS.exe
  C:\Windows\System\hvHtzjS.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\BxhmkWM.exe
  C:\Windows\System\BxhmkWM.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\yTEQddq.exe
  C:\Windows\System\yTEQddq.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\NGqGBJE.exe
  C:\Windows\System\NGqGBJE.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\kWwyNbp.exe
  C:\Windows\System\kWwyNbp.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\enrMTnS.exe
  C:\Windows\System\enrMTnS.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\qpriJXc.exe
  C:\Windows\System\qpriJXc.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\EunIouu.exe
  C:\Windows\System\EunIouu.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\llebKRu.exe
  C:\Windows\System\llebKRu.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\BNOPAXA.exe
  C:\Windows\System\BNOPAXA.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\DxxuANU.exe
  C:\Windows\System\DxxuANU.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\rdrnIzP.exe
  C:\Windows\System\rdrnIzP.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\JDhnOwd.exe
  C:\Windows\System\JDhnOwd.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\xCecvFZ.exe
  C:\Windows\System\xCecvFZ.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\KODCUyw.exe
  C:\Windows\System\KODCUyw.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\PtEKOoT.exe
  C:\Windows\System\PtEKOoT.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\rYrWbKr.exe
  C:\Windows\System\rYrWbKr.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\NMlQBqd.exe
  C:\Windows\System\NMlQBqd.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\wDzcsEK.exe
  C:\Windows\System\wDzcsEK.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\LVZdjvw.exe
  C:\Windows\System\LVZdjvw.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\wsteqCs.exe
  C:\Windows\System\wsteqCs.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\JZMmvrY.exe
  C:\Windows\System\JZMmvrY.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\OVniter.exe
  C:\Windows\System\OVniter.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\dCvJWzb.exe
  C:\Windows\System\dCvJWzb.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\nQAcaRQ.exe
  C:\Windows\System\nQAcaRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\zgLZwBY.exe
  C:\Windows\System\zgLZwBY.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\HdvYQxO.exe
  C:\Windows\System\HdvYQxO.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\UOdLcMO.exe
  C:\Windows\System\UOdLcMO.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\rrUUGYI.exe
  C:\Windows\System\rrUUGYI.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\tafBZSt.exe
  C:\Windows\System\tafBZSt.exe
  2⤵
  PID:3600
- C:\Windows\System\zZhobHP.exe
  C:\Windows\System\zZhobHP.exe
  2⤵
  PID:4224
- C:\Windows\System\MQldGrB.exe
  C:\Windows\System\MQldGrB.exe
  2⤵
  PID:224
- C:\Windows\System\ctvWUFt.exe
  C:\Windows\System\ctvWUFt.exe
  2⤵
  PID:4932
- C:\Windows\System\AZEhiHP.exe
  C:\Windows\System\AZEhiHP.exe
  2⤵
  PID:4352
- C:\Windows\System\DuxDeBs.exe
  C:\Windows\System\DuxDeBs.exe
  2⤵
  PID:4600
- C:\Windows\System\OPUrcsB.exe
  C:\Windows\System\OPUrcsB.exe
  2⤵
  PID:1388
- C:\Windows\System\OlnBuzu.exe
  C:\Windows\System\OlnBuzu.exe
  2⤵
  PID:2508
- C:\Windows\System\voAxGsP.exe
  C:\Windows\System\voAxGsP.exe
  2⤵
  PID:3928
- C:\Windows\System\YaaBkNl.exe
  C:\Windows\System\YaaBkNl.exe
  2⤵
  PID:3572
- C:\Windows\System\yyaKQul.exe
  C:\Windows\System\yyaKQul.exe
  2⤵
  PID:2932
- C:\Windows\System\nIdlrUA.exe
  C:\Windows\System\nIdlrUA.exe
  2⤵
  PID:3944
- C:\Windows\System\mOiUTXM.exe
  C:\Windows\System\mOiUTXM.exe
  2⤵
  PID:1652
- C:\Windows\System\gnxyfgQ.exe
  C:\Windows\System\gnxyfgQ.exe
  2⤵
  PID:3364
- C:\Windows\System\XADRLmg.exe
  C:\Windows\System\XADRLmg.exe
  2⤵
  PID:3340
- C:\Windows\System\InDRPIh.exe
  C:\Windows\System\InDRPIh.exe
  2⤵
  PID:3924
- C:\Windows\System\kdzjFBr.exe
  C:\Windows\System\kdzjFBr.exe
  2⤵
  PID:3120
- C:\Windows\System\UMAliwO.exe
  C:\Windows\System\UMAliwO.exe
  2⤵
  PID:3004
- C:\Windows\System\RLwFKxT.exe
  C:\Windows\System\RLwFKxT.exe
  2⤵
  PID:1932
- C:\Windows\System\VIdLdDm.exe
  C:\Windows\System\VIdLdDm.exe
  2⤵
  PID:3952
- C:\Windows\System\GVfZmRT.exe
  C:\Windows\System\GVfZmRT.exe
  2⤵
  PID:4396
- C:\Windows\System\WOOKASh.exe
  C:\Windows\System\WOOKASh.exe
  2⤵
  PID:3368
- C:\Windows\System\gLXqrZi.exe
  C:\Windows\System\gLXqrZi.exe
  2⤵
  PID:4388
- C:\Windows\System\OVyuQEz.exe
  C:\Windows\System\OVyuQEz.exe
  2⤵
  PID:1040
- C:\Windows\System\MdrNCBD.exe
  C:\Windows\System\MdrNCBD.exe
  2⤵
  PID:4832
- C:\Windows\System\oWRSedn.exe
  C:\Windows\System\oWRSedn.exe
  2⤵
  PID:1064
- C:\Windows\System\CWsnNNR.exe
  C:\Windows\System\CWsnNNR.exe
  2⤵
  PID:1140
- C:\Windows\System\fZOCKME.exe
  C:\Windows\System\fZOCKME.exe
  2⤵
  PID:5136
- C:\Windows\System\MSVYdVX.exe
  C:\Windows\System\MSVYdVX.exe
  2⤵
  PID:5160
- C:\Windows\System\QkEHZWy.exe
  C:\Windows\System\QkEHZWy.exe
  2⤵
  PID:5188
- C:\Windows\System\GOfQCSJ.exe
  C:\Windows\System\GOfQCSJ.exe
  2⤵
  PID:5220
- C:\Windows\System\LZyDGeU.exe
  C:\Windows\System\LZyDGeU.exe
  2⤵
  PID:5244
- C:\Windows\System\rSbQvUS.exe
  C:\Windows\System\rSbQvUS.exe
  2⤵
  PID:5272
- C:\Windows\System\inJjTKp.exe
  C:\Windows\System\inJjTKp.exe
  2⤵
  PID:5300
- C:\Windows\System\FxeurvL.exe
  C:\Windows\System\FxeurvL.exe
  2⤵
  PID:5328
- C:\Windows\System\DqPWRYe.exe
  C:\Windows\System\DqPWRYe.exe
  2⤵
  PID:5356
- C:\Windows\System\ncnwLuP.exe
  C:\Windows\System\ncnwLuP.exe
  2⤵
  PID:5384
- C:\Windows\System\mnCNTNy.exe
  C:\Windows\System\mnCNTNy.exe
  2⤵
  PID:5412
- C:\Windows\System\BlpCdYS.exe
  C:\Windows\System\BlpCdYS.exe
  2⤵
  PID:5440
- C:\Windows\System\yLZLlQO.exe
  C:\Windows\System\yLZLlQO.exe
  2⤵
  PID:5468
- C:\Windows\System\xhvKKEh.exe
  C:\Windows\System\xhvKKEh.exe
  2⤵
  PID:5492
- C:\Windows\System\nogQNbI.exe
  C:\Windows\System\nogQNbI.exe
  2⤵
  PID:5524
- C:\Windows\System\CicUrQY.exe
  C:\Windows\System\CicUrQY.exe
  2⤵
  PID:5556
- C:\Windows\System\sMssOQV.exe
  C:\Windows\System\sMssOQV.exe
  2⤵
  PID:5584
- C:\Windows\System\QrCnSPZ.exe
  C:\Windows\System\QrCnSPZ.exe
  2⤵
  PID:5612
- C:\Windows\System\RUbuPJN.exe
  C:\Windows\System\RUbuPJN.exe
  2⤵
  PID:5636
- C:\Windows\System\QVSsMMw.exe
  C:\Windows\System\QVSsMMw.exe
  2⤵
  PID:5664
- C:\Windows\System\QdTcxkv.exe
  C:\Windows\System\QdTcxkv.exe
  2⤵
  PID:5704
- C:\Windows\System\RlVrtUE.exe
  C:\Windows\System\RlVrtUE.exe
  2⤵
  PID:5732
- C:\Windows\System\faoTKQU.exe
  C:\Windows\System\faoTKQU.exe
  2⤵
  PID:5756
- C:\Windows\System\IxeEowH.exe
  C:\Windows\System\IxeEowH.exe
  2⤵
  PID:5776
- C:\Windows\System\sBJlEAP.exe
  C:\Windows\System\sBJlEAP.exe
  2⤵
  PID:5808
- C:\Windows\System\vwsYINF.exe
  C:\Windows\System\vwsYINF.exe
  2⤵
  PID:5836
- C:\Windows\System\FGzgHuA.exe
  C:\Windows\System\FGzgHuA.exe
  2⤵
  PID:5860
- C:\Windows\System\RUGBhFY.exe
  C:\Windows\System\RUGBhFY.exe
  2⤵
  PID:5892
- C:\Windows\System\bHcMjHn.exe
  C:\Windows\System\bHcMjHn.exe
  2⤵
  PID:5916
- C:\Windows\System\lcWqIDi.exe
  C:\Windows\System\lcWqIDi.exe
  2⤵
  PID:5948
- C:\Windows\System\pHubbrv.exe
  C:\Windows\System\pHubbrv.exe
  2⤵
  PID:5972
- C:\Windows\System\sRDUcHF.exe
  C:\Windows\System\sRDUcHF.exe
  2⤵
  PID:6036
- C:\Windows\System\vrJZkqK.exe
  C:\Windows\System\vrJZkqK.exe
  2⤵
  PID:6052
- C:\Windows\System\PQeTgqQ.exe
  C:\Windows\System\PQeTgqQ.exe
  2⤵
  PID:6068
- C:\Windows\System\GwQsdke.exe
  C:\Windows\System\GwQsdke.exe
  2⤵
  PID:6092
- C:\Windows\System\KRJkYgN.exe
  C:\Windows\System\KRJkYgN.exe
  2⤵
  PID:6120
- C:\Windows\System\miPOJbv.exe
  C:\Windows\System\miPOJbv.exe
  2⤵
  PID:3452
- C:\Windows\System\gGWptAU.exe
  C:\Windows\System\gGWptAU.exe
  2⤵
  PID:4240
- C:\Windows\System\jxheccM.exe
  C:\Windows\System\jxheccM.exe
  2⤵
  PID:2904
- C:\Windows\System\OyNdBLn.exe
  C:\Windows\System\OyNdBLn.exe
  2⤵
  PID:1628
- C:\Windows\System\xmHFOxn.exe
  C:\Windows\System\xmHFOxn.exe
  2⤵
  PID:2648
- C:\Windows\System\kUOgnsz.exe
  C:\Windows\System\kUOgnsz.exe
  2⤵
  PID:3176
- C:\Windows\System\tyUyEnq.exe
  C:\Windows\System\tyUyEnq.exe
  2⤵
  PID:3888
- C:\Windows\System\bcJWlra.exe
  C:\Windows\System\bcJWlra.exe
  2⤵
  PID:2020
- C:\Windows\System\YPOYiSB.exe
  C:\Windows\System\YPOYiSB.exe
  2⤵
  PID:5152
- C:\Windows\System\zqCHSdG.exe
  C:\Windows\System\zqCHSdG.exe
  2⤵
  PID:5228
- C:\Windows\System\npnwThV.exe
  C:\Windows\System\npnwThV.exe
  2⤵
  PID:5288
- C:\Windows\System\tPDatRY.exe
  C:\Windows\System\tPDatRY.exe
  2⤵
  PID:5348
- C:\Windows\System\bFndhnm.exe
  C:\Windows\System\bFndhnm.exe
  2⤵
  PID:5424
- C:\Windows\System\heUnarA.exe
  C:\Windows\System\heUnarA.exe
  2⤵
  PID:5484
- C:\Windows\System\SYvtLRt.exe
  C:\Windows\System\SYvtLRt.exe
  2⤵
  PID:5544
- C:\Windows\System\LdOsKKj.exe
  C:\Windows\System\LdOsKKj.exe
  2⤵
  PID:5620
- C:\Windows\System\ECNmoZE.exe
  C:\Windows\System\ECNmoZE.exe
  2⤵
  PID:5676
- C:\Windows\System\nBTvSeQ.exe
  C:\Windows\System\nBTvSeQ.exe
  2⤵
  PID:5744
- C:\Windows\System\MmPUohN.exe
  C:\Windows\System\MmPUohN.exe
  2⤵
  PID:5796
- C:\Windows\System\lFglAIq.exe
  C:\Windows\System\lFglAIq.exe
  2⤵
  PID:5872
- C:\Windows\System\wSJYcnz.exe
  C:\Windows\System\wSJYcnz.exe
  2⤵
  PID:5932
- C:\Windows\System\pZOOvmQ.exe
  C:\Windows\System\pZOOvmQ.exe
  2⤵
  PID:6004
- C:\Windows\System\ISqgbCt.exe
  C:\Windows\System\ISqgbCt.exe
  2⤵
  PID:6064
- C:\Windows\System\mxHpjLZ.exe
  C:\Windows\System\mxHpjLZ.exe
  2⤵
  PID:6136
- C:\Windows\System\MJbUlgI.exe
  C:\Windows\System\MJbUlgI.exe
  2⤵
  PID:4680
- C:\Windows\System\lLUcYCV.exe
  C:\Windows\System\lLUcYCV.exe
  2⤵
  PID:3032
- C:\Windows\System\csUMbXf.exe
  C:\Windows\System\csUMbXf.exe
  2⤵
  PID:2660
- C:\Windows\System\GahfoGk.exe
  C:\Windows\System\GahfoGk.exe
  2⤵
  PID:5144
- C:\Windows\System\kjWHGmN.exe
  C:\Windows\System\kjWHGmN.exe
  2⤵
  PID:5320
- C:\Windows\System\nABdVFN.exe
  C:\Windows\System\nABdVFN.exe
  2⤵
  PID:840
- C:\Windows\System\LmMTzya.exe
  C:\Windows\System\LmMTzya.exe
  2⤵
  PID:5592
- C:\Windows\System\mbMuWMq.exe
  C:\Windows\System\mbMuWMq.exe
  2⤵
  PID:5720
- C:\Windows\System\LYsKfOk.exe
  C:\Windows\System\LYsKfOk.exe
  2⤵
  PID:5900
- C:\Windows\System\QLeajpr.exe
  C:\Windows\System\QLeajpr.exe
  2⤵
  PID:5992
- C:\Windows\System\pBDTRpo.exe
  C:\Windows\System\pBDTRpo.exe
  2⤵
  PID:6148
- C:\Windows\System\PdMhqWY.exe
  C:\Windows\System\PdMhqWY.exe
  2⤵
  PID:6176
- C:\Windows\System\vAMymyJ.exe
  C:\Windows\System\vAMymyJ.exe
  2⤵
  PID:6204
- C:\Windows\System\DvxoasP.exe
  C:\Windows\System\DvxoasP.exe
  2⤵
  PID:6232
- C:\Windows\System\bhuJsiC.exe
  C:\Windows\System\bhuJsiC.exe
  2⤵
  PID:6256
- C:\Windows\System\DGFMMLW.exe
  C:\Windows\System\DGFMMLW.exe
  2⤵
  PID:6284
- C:\Windows\System\fnaVxWw.exe
  C:\Windows\System\fnaVxWw.exe
  2⤵
  PID:6312
- C:\Windows\System\VucwfNY.exe
  C:\Windows\System\VucwfNY.exe
  2⤵
  PID:6348
- C:\Windows\System\QvcCqUV.exe
  C:\Windows\System\QvcCqUV.exe
  2⤵
  PID:6380
- C:\Windows\System\ibqNHBV.exe
  C:\Windows\System\ibqNHBV.exe
  2⤵
  PID:6408
- C:\Windows\System\sUwjZmo.exe
  C:\Windows\System\sUwjZmo.exe
  2⤵
  PID:6428
- C:\Windows\System\uqSAyGA.exe
  C:\Windows\System\uqSAyGA.exe
  2⤵
  PID:6456
- C:\Windows\System\TkfNIGe.exe
  C:\Windows\System\TkfNIGe.exe
  2⤵
  PID:6484
- C:\Windows\System\mHKImKF.exe
  C:\Windows\System\mHKImKF.exe
  2⤵
  PID:6512
- C:\Windows\System\ysxPwiD.exe
  C:\Windows\System\ysxPwiD.exe
  2⤵
  PID:6540
- C:\Windows\System\PVqZOKr.exe
  C:\Windows\System\PVqZOKr.exe
  2⤵
  PID:6568
- C:\Windows\System\zycZkUu.exe
  C:\Windows\System\zycZkUu.exe
  2⤵
  PID:6596
- C:\Windows\System\sZEimSk.exe
  C:\Windows\System\sZEimSk.exe
  2⤵
  PID:6624
- C:\Windows\System\CUenLiO.exe
  C:\Windows\System\CUenLiO.exe
  2⤵
  PID:6652
- C:\Windows\System\zwGBQDz.exe
  C:\Windows\System\zwGBQDz.exe
  2⤵
  PID:6680
- C:\Windows\System\BnIkYRa.exe
  C:\Windows\System\BnIkYRa.exe
  2⤵
  PID:6708
- C:\Windows\System\wpdhiAE.exe
  C:\Windows\System\wpdhiAE.exe
  2⤵
  PID:6736
- C:\Windows\System\dtKscif.exe
  C:\Windows\System\dtKscif.exe
  2⤵
  PID:6760
- C:\Windows\System\LNZUKoE.exe
  C:\Windows\System\LNZUKoE.exe
  2⤵
  PID:6788
- C:\Windows\System\nCJlmdc.exe
  C:\Windows\System\nCJlmdc.exe
  2⤵
  PID:6820
- C:\Windows\System\FVoouBd.exe
  C:\Windows\System\FVoouBd.exe
  2⤵
  PID:6844
- C:\Windows\System\gccRhbT.exe
  C:\Windows\System\gccRhbT.exe
  2⤵
  PID:6876
- C:\Windows\System\OYLCUJl.exe
  C:\Windows\System\OYLCUJl.exe
  2⤵
  PID:6904
- C:\Windows\System\aVLYbba.exe
  C:\Windows\System\aVLYbba.exe
  2⤵
  PID:6952
- C:\Windows\System\QPjQrIb.exe
  C:\Windows\System\QPjQrIb.exe
  2⤵
  PID:7032
- C:\Windows\System\HqyywFw.exe
  C:\Windows\System\HqyywFw.exe
  2⤵
  PID:7072
- C:\Windows\System\bQmNBbj.exe
  C:\Windows\System\bQmNBbj.exe
  2⤵
  PID:7088
- C:\Windows\System\yCacZiC.exe
  C:\Windows\System\yCacZiC.exe
  2⤵
  PID:7112
- C:\Windows\System\HUpOUlv.exe
  C:\Windows\System\HUpOUlv.exe
  2⤵
  PID:7144
- C:\Windows\System\bIlCJRQ.exe
  C:\Windows\System\bIlCJRQ.exe
  2⤵
  PID:7160
- C:\Windows\System\NfbYZDs.exe
  C:\Windows\System\NfbYZDs.exe
  2⤵
  PID:3372
- C:\Windows\System\EtBAYOk.exe
  C:\Windows\System\EtBAYOk.exe
  2⤵
  PID:4292
- C:\Windows\System\xMVkyXf.exe
  C:\Windows\System\xMVkyXf.exe
  2⤵
  PID:5396
- C:\Windows\System\EaARakW.exe
  C:\Windows\System\EaARakW.exe
  2⤵
  PID:5700
- C:\Windows\System\HlitgXQ.exe
  C:\Windows\System\HlitgXQ.exe
  2⤵
  PID:3528
- C:\Windows\System\FUDbyTU.exe
  C:\Windows\System\FUDbyTU.exe
  2⤵
  PID:6188
- C:\Windows\System\qDsMALm.exe
  C:\Windows\System\qDsMALm.exe
  2⤵
  PID:6224
- C:\Windows\System\bRRsppl.exe
  C:\Windows\System\bRRsppl.exe
  2⤵
  PID:6280
- C:\Windows\System\POBmWxm.exe
  C:\Windows\System\POBmWxm.exe
  2⤵
  PID:6368
- C:\Windows\System\UMqQJxB.exe
  C:\Windows\System\UMqQJxB.exe
  2⤵
  PID:6404
- C:\Windows\System\ztviEeR.exe
  C:\Windows\System\ztviEeR.exe
  2⤵
  PID:3636
- C:\Windows\System\zIzFVkE.exe
  C:\Windows\System\zIzFVkE.exe
  2⤵
  PID:3140
- C:\Windows\System\zmsrumR.exe
  C:\Windows\System\zmsrumR.exe
  2⤵
  PID:6524
- C:\Windows\System\nldJDwG.exe
  C:\Windows\System\nldJDwG.exe
  2⤵
  PID:6584
- C:\Windows\System\lvIPOhq.exe
  C:\Windows\System\lvIPOhq.exe
  2⤵
  PID:6640
- C:\Windows\System\kCyLzrU.exe
  C:\Windows\System\kCyLzrU.exe
  2⤵
  PID:4876
- C:\Windows\System\OdwbNMb.exe
  C:\Windows\System\OdwbNMb.exe
  2⤵
  PID:6724
- C:\Windows\System\LlwOMrR.exe
  C:\Windows\System\LlwOMrR.exe
  2⤵
  PID:6752
- C:\Windows\System\VhxYdOt.exe
  C:\Windows\System\VhxYdOt.exe
  2⤵
  PID:6780
- C:\Windows\System\BCbePuE.exe
  C:\Windows\System\BCbePuE.exe
  2⤵
  PID:2448
- C:\Windows\System\WTeaQuf.exe
  C:\Windows\System\WTeaQuf.exe
  2⤵
  PID:1948
- C:\Windows\System\QnnugbR.exe
  C:\Windows\System\QnnugbR.exe
  2⤵
  PID:5000
- C:\Windows\System\ZBYAtlM.exe
  C:\Windows\System\ZBYAtlM.exe
  2⤵
  PID:2144
- C:\Windows\System\RHnzAnD.exe
  C:\Windows\System\RHnzAnD.exe
  2⤵
  PID:2264
- C:\Windows\System\uvlnmTN.exe
  C:\Windows\System\uvlnmTN.exe
  2⤵
  PID:6972
- C:\Windows\System\bGVGDFF.exe
  C:\Windows\System\bGVGDFF.exe
  2⤵
  PID:6984
- C:\Windows\System\mSSYguq.exe
  C:\Windows\System\mSSYguq.exe
  2⤵
  PID:7080
- C:\Windows\System\OITqxNB.exe
  C:\Windows\System\OITqxNB.exe
  2⤵
  PID:7136
- C:\Windows\System\CqfrKFo.exe
  C:\Windows\System\CqfrKFo.exe
  2⤵
  PID:888
- C:\Windows\System\eAxUzup.exe
  C:\Windows\System\eAxUzup.exe
  2⤵
  PID:5648
- C:\Windows\System\HRaAWIX.exe
  C:\Windows\System\HRaAWIX.exe
  2⤵
  PID:3900
- C:\Windows\System\nsmmZts.exe
  C:\Windows\System\nsmmZts.exe
  2⤵
  PID:6308
- C:\Windows\System\iqmpOEZ.exe
  C:\Windows\System\iqmpOEZ.exe
  2⤵
  PID:1696
- C:\Windows\System\sRclgyu.exe
  C:\Windows\System\sRclgyu.exe
  2⤵
  PID:6472
- C:\Windows\System\BYMaeir.exe
  C:\Windows\System\BYMaeir.exe
  2⤵
  PID:6616
- C:\Windows\System\zDqISjn.exe
  C:\Windows\System\zDqISjn.exe
  2⤵
  PID:6664
- C:\Windows\System\GkyxTeW.exe
  C:\Windows\System\GkyxTeW.exe
  2⤵
  PID:3672
- C:\Windows\System\yWEaTvc.exe
  C:\Windows\System\yWEaTvc.exe
  2⤵
  PID:6804
- C:\Windows\System\lDeTbIT.exe
  C:\Windows\System\lDeTbIT.exe
  2⤵
  PID:2516
- C:\Windows\System\AjaaTse.exe
  C:\Windows\System\AjaaTse.exe
  2⤵
  PID:7016
- C:\Windows\System\jMdaWnR.exe
  C:\Windows\System\jMdaWnR.exe
  2⤵
  PID:7108
- C:\Windows\System\SbBToCW.exe
  C:\Windows\System\SbBToCW.exe
  2⤵
  PID:7128
- C:\Windows\System\pTTEzxt.exe
  C:\Windows\System\pTTEzxt.exe
  2⤵
  PID:6364
- C:\Windows\System\KTayHas.exe
  C:\Windows\System\KTayHas.exe
  2⤵
  PID:3972
- C:\Windows\System\tIZiZFi.exe
  C:\Windows\System\tIZiZFi.exe
  2⤵
  PID:3744
- C:\Windows\System\drZBviu.exe
  C:\Windows\System\drZBviu.exe
  2⤵
  PID:4968
- C:\Windows\System\XFKSdxb.exe
  C:\Windows\System\XFKSdxb.exe
  2⤵
  PID:7000
- C:\Windows\System\spMIRYR.exe
  C:\Windows\System\spMIRYR.exe
  2⤵
  PID:6112
- C:\Windows\System\yEsPAmS.exe
  C:\Windows\System\yEsPAmS.exe
  2⤵
  PID:6560
- C:\Windows\System\bPrXVgr.exe
  C:\Windows\System\bPrXVgr.exe
  2⤵
  PID:7184
- C:\Windows\System\bAarpqH.exe
  C:\Windows\System\bAarpqH.exe
  2⤵
  PID:7212
- C:\Windows\System\xTICujd.exe
  C:\Windows\System\xTICujd.exe
  2⤵
  PID:7240
- C:\Windows\System\gkOmwYp.exe
  C:\Windows\System\gkOmwYp.exe
  2⤵
  PID:7260
- C:\Windows\System\TcgUNee.exe
  C:\Windows\System\TcgUNee.exe
  2⤵
  PID:7308
- C:\Windows\System\SsPFVmi.exe
  C:\Windows\System\SsPFVmi.exe
  2⤵
  PID:7328
- C:\Windows\System\SnQwMhw.exe
  C:\Windows\System\SnQwMhw.exe
  2⤵
  PID:7364
- C:\Windows\System\zhlHxyY.exe
  C:\Windows\System\zhlHxyY.exe
  2⤵
  PID:7380
- C:\Windows\System\WUjvhnJ.exe
  C:\Windows\System\WUjvhnJ.exe
  2⤵
  PID:7408
- C:\Windows\System\rTeTcop.exe
  C:\Windows\System\rTeTcop.exe
  2⤵
  PID:7436
- C:\Windows\System\nOgusor.exe
  C:\Windows\System\nOgusor.exe
  2⤵
  PID:7460
- C:\Windows\System\bQAgjJR.exe
  C:\Windows\System\bQAgjJR.exe
  2⤵
  PID:7492
- C:\Windows\System\naGUoSe.exe
  C:\Windows\System\naGUoSe.exe
  2⤵
  PID:7508
- C:\Windows\System\GzAMUKE.exe
  C:\Windows\System\GzAMUKE.exe
  2⤵
  PID:7532
- C:\Windows\System\JVEfMFt.exe
  C:\Windows\System\JVEfMFt.exe
  2⤵
  PID:7552
- C:\Windows\System\WGYtzUz.exe
  C:\Windows\System\WGYtzUz.exe
  2⤵
  PID:7596
- C:\Windows\System\DWrUrcR.exe
  C:\Windows\System\DWrUrcR.exe
  2⤵
  PID:7616
- C:\Windows\System\bOilJeT.exe
  C:\Windows\System\bOilJeT.exe
  2⤵
  PID:7660
- C:\Windows\System\zgGWMkY.exe
  C:\Windows\System\zgGWMkY.exe
  2⤵
  PID:7700
- C:\Windows\System\YTrxVYS.exe
  C:\Windows\System\YTrxVYS.exe
  2⤵
  PID:7716
- C:\Windows\System\tbeUxUI.exe
  C:\Windows\System\tbeUxUI.exe
  2⤵
  PID:7744
- C:\Windows\System\GMZyenx.exe
  C:\Windows\System\GMZyenx.exe
  2⤵
  PID:7772
- C:\Windows\System\XCyWAQv.exe
  C:\Windows\System\XCyWAQv.exe
  2⤵
  PID:7800
- C:\Windows\System\LXbTWMd.exe
  C:\Windows\System\LXbTWMd.exe
  2⤵
  PID:7844
- C:\Windows\System\UdKhCtx.exe
  C:\Windows\System\UdKhCtx.exe
  2⤵
  PID:7880
- C:\Windows\System\sKSugmb.exe
  C:\Windows\System\sKSugmb.exe
  2⤵
  PID:7908
- C:\Windows\System\xbgVXFy.exe
  C:\Windows\System\xbgVXFy.exe
  2⤵
  PID:7924
- C:\Windows\System\nGAahrV.exe
  C:\Windows\System\nGAahrV.exe
  2⤵
  PID:7952
- C:\Windows\System\NrbXSVs.exe
  C:\Windows\System\NrbXSVs.exe
  2⤵
  PID:7980
- C:\Windows\System\XKfVlok.exe
  C:\Windows\System\XKfVlok.exe
  2⤵
  PID:8008
- C:\Windows\System\RctWQEx.exe
  C:\Windows\System\RctWQEx.exe
  2⤵
  PID:8024
- C:\Windows\System\ONOuwFH.exe
  C:\Windows\System\ONOuwFH.exe
  2⤵
  PID:8064
- C:\Windows\System\LysWHbY.exe
  C:\Windows\System\LysWHbY.exe
  2⤵
  PID:8080
- C:\Windows\System\gPkeyAM.exe
  C:\Windows\System\gPkeyAM.exe
  2⤵
  PID:8108
- C:\Windows\System\ZeDiaXo.exe
  C:\Windows\System\ZeDiaXo.exe
  2⤵
  PID:8136
- C:\Windows\System\ouRTWqE.exe
  C:\Windows\System\ouRTWqE.exe
  2⤵
  PID:8172
- C:\Windows\System\FBpiWhU.exe
  C:\Windows\System\FBpiWhU.exe
  2⤵
  PID:7176
- C:\Windows\System\PpcmSTv.exe
  C:\Windows\System\PpcmSTv.exe
  2⤵
  PID:7304
- C:\Windows\System\DiaOdIg.exe
  C:\Windows\System\DiaOdIg.exe
  2⤵
  PID:7356
- C:\Windows\System\yNQSLHX.exe
  C:\Windows\System\yNQSLHX.exe
  2⤵
  PID:7396
- C:\Windows\System\jskZZtU.exe
  C:\Windows\System\jskZZtU.exe
  2⤵
  PID:7452
- C:\Windows\System\nSGcJIe.exe
  C:\Windows\System\nSGcJIe.exe
  2⤵
  PID:7544
- C:\Windows\System\XAhjTyt.exe
  C:\Windows\System\XAhjTyt.exe
  2⤵
  PID:7572
- C:\Windows\System\wwOHPOU.exe
  C:\Windows\System\wwOHPOU.exe
  2⤵
  PID:7652
- C:\Windows\System\bKLCdGo.exe
  C:\Windows\System\bKLCdGo.exe
  2⤵
  PID:7684
- C:\Windows\System\uuTJanX.exe
  C:\Windows\System\uuTJanX.exe
  2⤵
  PID:7756
- C:\Windows\System\jNXoLXj.exe
  C:\Windows\System\jNXoLXj.exe
  2⤵
  PID:7836
- C:\Windows\System\oBzHnbV.exe
  C:\Windows\System\oBzHnbV.exe
  2⤵
  PID:7900
- C:\Windows\System\qLTXiPZ.exe
  C:\Windows\System\qLTXiPZ.exe
  2⤵
  PID:7992
- C:\Windows\System\jFYLuOz.exe
  C:\Windows\System\jFYLuOz.exe
  2⤵
  PID:8036
- C:\Windows\System\dAmUMix.exe
  C:\Windows\System\dAmUMix.exe
  2⤵
  PID:8152
- C:\Windows\System\rdyNVYU.exe
  C:\Windows\System\rdyNVYU.exe
  2⤵
  PID:7248
- C:\Windows\System\YCnEJFt.exe
  C:\Windows\System\YCnEJFt.exe
  2⤵
  PID:7376
- C:\Windows\System\CIvmJBX.exe
  C:\Windows\System\CIvmJBX.exe
  2⤵
  PID:7500
- C:\Windows\System\VwxInrU.exe
  C:\Windows\System\VwxInrU.exe
  2⤵
  PID:7708
- C:\Windows\System\GvNhClT.exe
  C:\Windows\System\GvNhClT.exe
  2⤵
  PID:7680
- C:\Windows\System\aHtgKfe.exe
  C:\Windows\System\aHtgKfe.exe
  2⤵
  PID:8000
- C:\Windows\System\MpDOCfs.exe
  C:\Windows\System\MpDOCfs.exe
  2⤵
  PID:8120
- C:\Windows\System\hlTugUX.exe
  C:\Windows\System\hlTugUX.exe
  2⤵
  PID:7316
- C:\Windows\System\DBFSbss.exe
  C:\Windows\System\DBFSbss.exe
  2⤵
  PID:7740
- C:\Windows\System\OjkNbSf.exe
  C:\Windows\System\OjkNbSf.exe
  2⤵
  PID:8076
- C:\Windows\System\IWnvwfI.exe
  C:\Windows\System\IWnvwfI.exe
  2⤵
  PID:7608
- C:\Windows\System\vgohpiE.exe
  C:\Windows\System\vgohpiE.exe
  2⤵
  PID:8200
- C:\Windows\System\voWSJcD.exe
  C:\Windows\System\voWSJcD.exe
  2⤵
  PID:8240
- C:\Windows\System\ABzmUSQ.exe
  C:\Windows\System\ABzmUSQ.exe
  2⤵
  PID:8256
- C:\Windows\System\WqoNfou.exe
  C:\Windows\System\WqoNfou.exe
  2⤵
  PID:8292
- C:\Windows\System\QOasVax.exe
  C:\Windows\System\QOasVax.exe
  2⤵
  PID:8312
- C:\Windows\System\vBoDEpq.exe
  C:\Windows\System\vBoDEpq.exe
  2⤵
  PID:8344
- C:\Windows\System\WmydVyG.exe
  C:\Windows\System\WmydVyG.exe
  2⤵
  PID:8368
- C:\Windows\System\NgnAAYp.exe
  C:\Windows\System\NgnAAYp.exe
  2⤵
  PID:8412
- C:\Windows\System\AsJbSid.exe
  C:\Windows\System\AsJbSid.exe
  2⤵
  PID:8440
- C:\Windows\System\ftKIzmp.exe
  C:\Windows\System\ftKIzmp.exe
  2⤵
  PID:8468
- C:\Windows\System\zGZtBeH.exe
  C:\Windows\System\zGZtBeH.exe
  2⤵
  PID:8496
- C:\Windows\System\XdrphhX.exe
  C:\Windows\System\XdrphhX.exe
  2⤵
  PID:8524
- C:\Windows\System\aWigFCL.exe
  C:\Windows\System\aWigFCL.exe
  2⤵
  PID:8552
- C:\Windows\System\kGoqXcU.exe
  C:\Windows\System\kGoqXcU.exe
  2⤵
  PID:8580
- C:\Windows\System\WjtBfVP.exe
  C:\Windows\System\WjtBfVP.exe
  2⤵
  PID:8596
- C:\Windows\System\MlDntoA.exe
  C:\Windows\System\MlDntoA.exe
  2⤵
  PID:8636
- C:\Windows\System\IYdgVCq.exe
  C:\Windows\System\IYdgVCq.exe
  2⤵
  PID:8664
- C:\Windows\System\pRRwOoT.exe
  C:\Windows\System\pRRwOoT.exe
  2⤵
  PID:8684
- C:\Windows\System\HCzYpzW.exe
  C:\Windows\System\HCzYpzW.exe
  2⤵
  PID:8708
- C:\Windows\System\SWNmTWD.exe
  C:\Windows\System\SWNmTWD.exe
  2⤵
  PID:8748
- C:\Windows\System\lLEMytV.exe
  C:\Windows\System\lLEMytV.exe
  2⤵
  PID:8768
- C:\Windows\System\yjGFxOY.exe
  C:\Windows\System\yjGFxOY.exe
  2⤵
  PID:8792
- C:\Windows\System\fDqCivR.exe
  C:\Windows\System\fDqCivR.exe
  2⤵
  PID:8812
- C:\Windows\System\ogBGOpZ.exe
  C:\Windows\System\ogBGOpZ.exe
  2⤵
  PID:8844
- C:\Windows\System\RGoPeat.exe
  C:\Windows\System\RGoPeat.exe
  2⤵
  PID:8872
- C:\Windows\System\ZbzNLaa.exe
  C:\Windows\System\ZbzNLaa.exe
  2⤵
  PID:8904
- C:\Windows\System\INRmOCR.exe
  C:\Windows\System\INRmOCR.exe
  2⤵
  PID:8924
- C:\Windows\System\yxqabnB.exe
  C:\Windows\System\yxqabnB.exe
  2⤵
  PID:8960
- C:\Windows\System\xilmiMu.exe
  C:\Windows\System\xilmiMu.exe
  2⤵
  PID:9000
- C:\Windows\System\EYtzKoR.exe
  C:\Windows\System\EYtzKoR.exe
  2⤵
  PID:9028
- C:\Windows\System\tiQyKIE.exe
  C:\Windows\System\tiQyKIE.exe
  2⤵
  PID:9056
- C:\Windows\System\DEORtFv.exe
  C:\Windows\System\DEORtFv.exe
  2⤵
  PID:9084
- C:\Windows\System\uMJIQsJ.exe
  C:\Windows\System\uMJIQsJ.exe
  2⤵
  PID:9112
- C:\Windows\System\lSolXkZ.exe
  C:\Windows\System\lSolXkZ.exe
  2⤵
  PID:9128
- C:\Windows\System\bQZSScP.exe
  C:\Windows\System\bQZSScP.exe
  2⤵
  PID:9144
- C:\Windows\System\RYxDxvf.exe
  C:\Windows\System\RYxDxvf.exe
  2⤵
  PID:9160
- C:\Windows\System\jzmLdpH.exe
  C:\Windows\System\jzmLdpH.exe
  2⤵
  PID:9180
- C:\Windows\System\XSzEwjt.exe
  C:\Windows\System\XSzEwjt.exe
  2⤵
  PID:9200
- C:\Windows\System\CfbLIpt.exe
  C:\Windows\System\CfbLIpt.exe
  2⤵
  PID:8208
- C:\Windows\System\vBPwDyz.exe
  C:\Windows\System\vBPwDyz.exe
  2⤵
  PID:8252
- C:\Windows\System\BKuUYmg.exe
  C:\Windows\System\BKuUYmg.exe
  2⤵
  PID:8324
- C:\Windows\System\GYOOFuy.exe
  C:\Windows\System\GYOOFuy.exe
  2⤵
  PID:8456
- C:\Windows\System\EwlyrIP.exe
  C:\Windows\System\EwlyrIP.exe
  2⤵
  PID:8512
- C:\Windows\System\BdUIMiR.exe
  C:\Windows\System\BdUIMiR.exe
  2⤵
  PID:8564
- C:\Windows\System\TQnpSBW.exe
  C:\Windows\System\TQnpSBW.exe
  2⤵
  PID:8728
- C:\Windows\System\TDyfzzY.exe
  C:\Windows\System\TDyfzzY.exe
  2⤵
  PID:8756
- C:\Windows\System\VZAtIEs.exe
  C:\Windows\System\VZAtIEs.exe
  2⤵
  PID:8832
- C:\Windows\System\XWoTDld.exe
  C:\Windows\System\XWoTDld.exe
  2⤵
  PID:8884
- C:\Windows\System\URlKbxx.exe
  C:\Windows\System\URlKbxx.exe
  2⤵
  PID:8944
- C:\Windows\System\kBHSUnC.exe
  C:\Windows\System\kBHSUnC.exe
  2⤵
  PID:9016
- C:\Windows\System\wjHhXQU.exe
  C:\Windows\System\wjHhXQU.exe
  2⤵
  PID:9072
- C:\Windows\System\eExmlBu.exe
  C:\Windows\System\eExmlBu.exe
  2⤵
  PID:9156
- C:\Windows\System\qclVWjU.exe
  C:\Windows\System\qclVWjU.exe
  2⤵
  PID:8224
- C:\Windows\System\RssMiRm.exe
  C:\Windows\System\RssMiRm.exe
  2⤵
  PID:8404
- C:\Windows\System\ANuaXFA.exe
  C:\Windows\System\ANuaXFA.exe
  2⤵
  PID:8424
- C:\Windows\System\yBjueMQ.exe
  C:\Windows\System\yBjueMQ.exe
  2⤵
  PID:8616
- C:\Windows\System\GXCYGWN.exe
  C:\Windows\System\GXCYGWN.exe
  2⤵
  PID:8860
- C:\Windows\System\EVLWLma.exe
  C:\Windows\System\EVLWLma.exe
  2⤵
  PID:8988
- C:\Windows\System\OGiQPbq.exe
  C:\Windows\System\OGiQPbq.exe
  2⤵
  PID:9196
- C:\Windows\System\gGcXMBI.exe
  C:\Windows\System\gGcXMBI.exe
  2⤵
  PID:8536
- C:\Windows\System\qMQwdBf.exe
  C:\Windows\System\qMQwdBf.exe
  2⤵
  PID:8620
- C:\Windows\System\mcHdLqi.exe
  C:\Windows\System\mcHdLqi.exe
  2⤵
  PID:8868
- C:\Windows\System\SoznwUa.exe
  C:\Windows\System\SoznwUa.exe
  2⤵
  PID:9212
- C:\Windows\System\oiUhwHm.exe
  C:\Windows\System\oiUhwHm.exe
  2⤵
  PID:9236
- C:\Windows\System\WpBgwFq.exe
  C:\Windows\System\WpBgwFq.exe
  2⤵
  PID:9276
- C:\Windows\System\vtovGUu.exe
  C:\Windows\System\vtovGUu.exe
  2⤵
  PID:9300
- C:\Windows\System\zIZbxdV.exe
  C:\Windows\System\zIZbxdV.exe
  2⤵
  PID:9324
- C:\Windows\System\vJoNcDl.exe
  C:\Windows\System\vJoNcDl.exe
  2⤵
  PID:9352
- C:\Windows\System\idXvYXS.exe
  C:\Windows\System\idXvYXS.exe
  2⤵
  PID:9372
- C:\Windows\System\yZpXWNr.exe
  C:\Windows\System\yZpXWNr.exe
  2⤵
  PID:9416
- C:\Windows\System\AZoWKDc.exe
  C:\Windows\System\AZoWKDc.exe
  2⤵
  PID:9440
- C:\Windows\System\KwOHYVm.exe
  C:\Windows\System\KwOHYVm.exe
  2⤵
  PID:9464
- C:\Windows\System\qzJZqoF.exe
  C:\Windows\System\qzJZqoF.exe
  2⤵
  PID:9508
- C:\Windows\System\iOWfGrL.exe
  C:\Windows\System\iOWfGrL.exe
  2⤵
  PID:9536
- C:\Windows\System\ktkevqe.exe
  C:\Windows\System\ktkevqe.exe
  2⤵
  PID:9552
- C:\Windows\System\DtZSzNs.exe
  C:\Windows\System\DtZSzNs.exe
  2⤵
  PID:9584
- C:\Windows\System\LSEzeCZ.exe
  C:\Windows\System\LSEzeCZ.exe
  2⤵
  PID:9608
- C:\Windows\System\BrxnmfJ.exe
  C:\Windows\System\BrxnmfJ.exe
  2⤵
  PID:9636
- C:\Windows\System\wEcnuen.exe
  C:\Windows\System\wEcnuen.exe
  2⤵
  PID:9664
- C:\Windows\System\JYaIqxw.exe
  C:\Windows\System\JYaIqxw.exe
  2⤵
  PID:9696
- C:\Windows\System\IFMTlqS.exe
  C:\Windows\System\IFMTlqS.exe
  2⤵
  PID:9720
- C:\Windows\System\jwZAOpR.exe
  C:\Windows\System\jwZAOpR.exe
  2⤵
  PID:9760
- C:\Windows\System\MHQMFSr.exe
  C:\Windows\System\MHQMFSr.exe
  2⤵
  PID:9776
- C:\Windows\System\lktdHhu.exe
  C:\Windows\System\lktdHhu.exe
  2⤵
  PID:9804
- C:\Windows\System\tFpQMhK.exe
  C:\Windows\System\tFpQMhK.exe
  2⤵
  PID:9824
- C:\Windows\System\YRPknjm.exe
  C:\Windows\System\YRPknjm.exe
  2⤵
  PID:9860
- C:\Windows\System\dyBpDXQ.exe
  C:\Windows\System\dyBpDXQ.exe
  2⤵
  PID:9884
- C:\Windows\System\GxFDytj.exe
  C:\Windows\System\GxFDytj.exe
  2⤵
  PID:9908
- C:\Windows\System\WgAQiJK.exe
  C:\Windows\System\WgAQiJK.exe
  2⤵
  PID:9932
- C:\Windows\System\fYQEIKI.exe
  C:\Windows\System\fYQEIKI.exe
  2⤵
  PID:9960
- C:\Windows\System\QXVmEXs.exe
  C:\Windows\System\QXVmEXs.exe
  2⤵
  PID:10012
- C:\Windows\System\UbolUnW.exe
  C:\Windows\System\UbolUnW.exe
  2⤵
  PID:10028
- C:\Windows\System\cxNMRyf.exe
  C:\Windows\System\cxNMRyf.exe
  2⤵
  PID:10056
- C:\Windows\System\GInEGcN.exe
  C:\Windows\System\GInEGcN.exe
  2⤵
  PID:10084
- C:\Windows\System\IhhnPma.exe
  C:\Windows\System\IhhnPma.exe
  2⤵
  PID:10112
- C:\Windows\System\PnxFywR.exe
  C:\Windows\System\PnxFywR.exe
  2⤵
  PID:10140
- C:\Windows\System\PHfZSpt.exe
  C:\Windows\System\PHfZSpt.exe
  2⤵
  PID:10168
- C:\Windows\System\SGtavxR.exe
  C:\Windows\System\SGtavxR.exe
  2⤵
  PID:10196
- C:\Windows\System\YJgdaZG.exe
  C:\Windows\System\YJgdaZG.exe
  2⤵
  PID:10216
- C:\Windows\System\BmcHjGN.exe
  C:\Windows\System\BmcHjGN.exe
  2⤵
  PID:9224
- C:\Windows\System\McWNcRr.exe
  C:\Windows\System\McWNcRr.exe
  2⤵
  PID:9288
- C:\Windows\System\uBKzccB.exe
  C:\Windows\System\uBKzccB.exe
  2⤵
  PID:9400
- C:\Windows\System\laBZnvD.exe
  C:\Windows\System\laBZnvD.exe
  2⤵
  PID:9396
- C:\Windows\System\uFGBmQM.exe
  C:\Windows\System\uFGBmQM.exe
  2⤵
  PID:9484
- C:\Windows\System\sEoVusQ.exe
  C:\Windows\System\sEoVusQ.exe
  2⤵
  PID:9548
- C:\Windows\System\fXNTAKn.exe
  C:\Windows\System\fXNTAKn.exe
  2⤵
  PID:9620
- C:\Windows\System\KHLPrYl.exe
  C:\Windows\System\KHLPrYl.exe
  2⤵
  PID:9656
- C:\Windows\System\sKPPStQ.exe
  C:\Windows\System\sKPPStQ.exe
  2⤵
  PID:9756
- C:\Windows\System\lcQhtWE.exe
  C:\Windows\System\lcQhtWE.exe
  2⤵
  PID:9772
- C:\Windows\System\LlYKdss.exe
  C:\Windows\System\LlYKdss.exe
  2⤵
  PID:9904
- C:\Windows\System\PYNGkcq.exe
  C:\Windows\System\PYNGkcq.exe
  2⤵
  PID:9972
- C:\Windows\System\nDdaxgZ.exe
  C:\Windows\System\nDdaxgZ.exe
  2⤵
  PID:10048
- C:\Windows\System\ejgvGUL.exe
  C:\Windows\System\ejgvGUL.exe
  2⤵
  PID:10124
- C:\Windows\System\XMbOmOB.exe
  C:\Windows\System\XMbOmOB.exe
  2⤵
  PID:10164
- C:\Windows\System\jthhatG.exe
  C:\Windows\System\jthhatG.exe
  2⤵
  PID:10224
- C:\Windows\System\KJcNTRm.exe
  C:\Windows\System\KJcNTRm.exe
  2⤵
  PID:9364
- C:\Windows\System\qFArJKs.exe
  C:\Windows\System\qFArJKs.exe
  2⤵
  PID:9456
- C:\Windows\System\jlHXyHn.exe
  C:\Windows\System\jlHXyHn.exe
  2⤵
  PID:9624
- C:\Windows\System\qdtNXrw.exe
  C:\Windows\System\qdtNXrw.exe
  2⤵
  PID:9716
- C:\Windows\System\QyfYRBf.exe
  C:\Windows\System\QyfYRBf.exe
  2⤵
  PID:9872
- C:\Windows\System\lgxQEgy.exe
  C:\Windows\System\lgxQEgy.exe
  2⤵
  PID:9956
- C:\Windows\System\pcqDtBo.exe
  C:\Windows\System\pcqDtBo.exe
  2⤵
  PID:10132
- C:\Windows\System\XThfaUB.exe
  C:\Windows\System\XThfaUB.exe
  2⤵
  PID:9424
- C:\Windows\System\NpSERYT.exe
  C:\Windows\System\NpSERYT.exe
  2⤵
  PID:9800
- C:\Windows\System\OTkSvDF.exe
  C:\Windows\System\OTkSvDF.exe
  2⤵
  PID:10096
- C:\Windows\System\aZeIbZP.exe
  C:\Windows\System\aZeIbZP.exe
  2⤵
  PID:9336
- C:\Windows\System\MhuGphS.exe
  C:\Windows\System\MhuGphS.exe
  2⤵
  PID:9928
- C:\Windows\System\LLYNFea.exe
  C:\Windows\System\LLYNFea.exe
  2⤵
  PID:10260
- C:\Windows\System\itkjubw.exe
  C:\Windows\System\itkjubw.exe
  2⤵
  PID:10288
- C:\Windows\System\qltsVam.exe
  C:\Windows\System\qltsVam.exe
  2⤵
  PID:10312
- C:\Windows\System\eaJfFYh.exe
  C:\Windows\System\eaJfFYh.exe
  2⤵
  PID:10336
- C:\Windows\System\UrKNPKT.exe
  C:\Windows\System\UrKNPKT.exe
  2⤵
  PID:10392
- C:\Windows\System\KccIcHJ.exe
  C:\Windows\System\KccIcHJ.exe
  2⤵
  PID:10428
- C:\Windows\System\BmmiwKn.exe
  C:\Windows\System\BmmiwKn.exe
  2⤵
  PID:10460
- C:\Windows\System\kPSpneP.exe
  C:\Windows\System\kPSpneP.exe
  2⤵
  PID:10476
- C:\Windows\System\uYogVTd.exe
  C:\Windows\System\uYogVTd.exe
  2⤵
  PID:10516
- C:\Windows\System\aNuJyCB.exe
  C:\Windows\System\aNuJyCB.exe
  2⤵
  PID:10544
- C:\Windows\System\LKKjpzX.exe
  C:\Windows\System\LKKjpzX.exe
  2⤵
  PID:10580
- C:\Windows\System\iahKAWk.exe
  C:\Windows\System\iahKAWk.exe
  2⤵
  PID:10608
- C:\Windows\System\UDZeBex.exe
  C:\Windows\System\UDZeBex.exe
  2⤵
  PID:10636
- C:\Windows\System\veJbEEI.exe
  C:\Windows\System\veJbEEI.exe
  2⤵
  PID:10656
- C:\Windows\System\TVITMWT.exe
  C:\Windows\System\TVITMWT.exe
  2⤵
  PID:10684
- C:\Windows\System\txjGnFD.exe
  C:\Windows\System\txjGnFD.exe
  2⤵
  PID:10724
- C:\Windows\System\EPYpgnP.exe
  C:\Windows\System\EPYpgnP.exe
  2⤵
  PID:10744
- C:\Windows\System\YItdfvp.exe
  C:\Windows\System\YItdfvp.exe
  2⤵
  PID:10780
- C:\Windows\System\XQpcWpB.exe
  C:\Windows\System\XQpcWpB.exe
  2⤵
  PID:10808
- C:\Windows\System\RCjeoxn.exe
  C:\Windows\System\RCjeoxn.exe
  2⤵
  PID:10836
- C:\Windows\System\NQrUSZp.exe
  C:\Windows\System\NQrUSZp.exe
  2⤵
  PID:10860
- C:\Windows\System\gAKxzLK.exe
  C:\Windows\System\gAKxzLK.exe
  2⤵
  PID:10880
- C:\Windows\System\XxZFUJX.exe
  C:\Windows\System\XxZFUJX.exe
  2⤵
  PID:10912
- C:\Windows\System\xebpYmN.exe
  C:\Windows\System\xebpYmN.exe
  2⤵
  PID:10948
- C:\Windows\System\pSoNHfP.exe
  C:\Windows\System\pSoNHfP.exe
  2⤵
  PID:10972
- C:\Windows\System\lEdHhUL.exe
  C:\Windows\System\lEdHhUL.exe
  2⤵
  PID:10996
- C:\Windows\System\bVMIuoY.exe
  C:\Windows\System\bVMIuoY.exe
  2⤵
  PID:11028
- C:\Windows\System\NHiVhQT.exe
  C:\Windows\System\NHiVhQT.exe
  2⤵
  PID:11052
- C:\Windows\System\rDfoYoj.exe
  C:\Windows\System\rDfoYoj.exe
  2⤵
  PID:11068
- C:\Windows\System\qgdjdxa.exe
  C:\Windows\System\qgdjdxa.exe
  2⤵
  PID:11116
- C:\Windows\System\YCbkFGk.exe
  C:\Windows\System\YCbkFGk.exe
  2⤵
  PID:11148
- C:\Windows\System\OUKYspd.exe
  C:\Windows\System\OUKYspd.exe
  2⤵
  PID:11176
- C:\Windows\System\pqnvDlb.exe
  C:\Windows\System\pqnvDlb.exe
  2⤵
  PID:11204
- C:\Windows\System\eHLBrxR.exe
  C:\Windows\System\eHLBrxR.exe
  2⤵
  PID:11220
- C:\Windows\System\uvSQfwu.exe
  C:\Windows\System\uvSQfwu.exe
  2⤵
  PID:11248
- C:\Windows\System\WkIfOSg.exe
  C:\Windows\System\WkIfOSg.exe
  2⤵
  PID:9340
- C:\Windows\System\afdjnsv.exe
  C:\Windows\System\afdjnsv.exe
  2⤵
  PID:10304
- C:\Windows\System\HNgEZQR.exe
  C:\Windows\System\HNgEZQR.exe
  2⤵
  PID:10404
- C:\Windows\System\WRCeqER.exe
  C:\Windows\System\WRCeqER.exe
  2⤵
  PID:10472
- C:\Windows\System\udPhXwo.exe
  C:\Windows\System\udPhXwo.exe
  2⤵
  PID:10500
- C:\Windows\System\ftgmlwb.exe
  C:\Windows\System\ftgmlwb.exe
  2⤵
  PID:10600
- C:\Windows\System\QtIlGOQ.exe
  C:\Windows\System\QtIlGOQ.exe
  2⤵
  PID:10644
- C:\Windows\System\IFXOfFm.exe
  C:\Windows\System\IFXOfFm.exe
  2⤵
  PID:10756
- C:\Windows\System\ELHelgz.exe
  C:\Windows\System\ELHelgz.exe
  2⤵
  PID:10792
- C:\Windows\System\zSktTPX.exe
  C:\Windows\System\zSktTPX.exe
  2⤵
  PID:10856
- C:\Windows\System\DsJBKRV.exe
  C:\Windows\System\DsJBKRV.exe
  2⤵
  PID:10924
- C:\Windows\System\vEwPHdL.exe
  C:\Windows\System\vEwPHdL.exe
  2⤵
  PID:10992
- C:\Windows\System\rfqwFKa.exe
  C:\Windows\System\rfqwFKa.exe
  2⤵
  PID:11012
- C:\Windows\System\VwJebmG.exe
  C:\Windows\System\VwJebmG.exe
  2⤵
  PID:11092
- C:\Windows\System\lTpjTrd.exe
  C:\Windows\System\lTpjTrd.exe
  2⤵
  PID:11192
- C:\Windows\System\NQbjBip.exe
  C:\Windows\System\NQbjBip.exe
  2⤵
  PID:11232
- C:\Windows\System\fipRJmM.exe
  C:\Windows\System\fipRJmM.exe
  2⤵
  PID:9880
- C:\Windows\System\vUdnfpR.exe
  C:\Windows\System\vUdnfpR.exe
  2⤵
  PID:10440
- C:\Windows\System\YSriELC.exe
  C:\Windows\System\YSriELC.exe
  2⤵
  PID:10624
- C:\Windows\System\uMYMQBg.exe
  C:\Windows\System\uMYMQBg.exe
  2⤵
  PID:10800
- C:\Windows\System\IdjCvLV.exe
  C:\Windows\System\IdjCvLV.exe
  2⤵
  PID:8972
- C:\Windows\System\FXOuEEz.exe
  C:\Windows\System\FXOuEEz.exe
  2⤵
  PID:11168
- C:\Windows\System\zXtMADv.exe
  C:\Windows\System\zXtMADv.exe
  2⤵
  PID:10280
- C:\Windows\System\UXvOIrz.exe
  C:\Windows\System\UXvOIrz.exe
  2⤵
  PID:10708
- C:\Windows\System\AStmtVT.exe
  C:\Windows\System\AStmtVT.exe
  2⤵
  PID:11160
- C:\Windows\System\ipTEIKx.exe
  C:\Windows\System\ipTEIKx.exe
  2⤵
  PID:10824
- C:\Windows\System\ZHEWhEZ.exe
  C:\Windows\System\ZHEWhEZ.exe
  2⤵
  PID:10596
- C:\Windows\System\zUHpAxo.exe
  C:\Windows\System\zUHpAxo.exe
  2⤵
  PID:11284
- C:\Windows\System\JqRiKvI.exe
  C:\Windows\System\JqRiKvI.exe
  2⤵
  PID:11312
- C:\Windows\System\MwYZLyQ.exe
  C:\Windows\System\MwYZLyQ.exe
  2⤵
  PID:11340
- C:\Windows\System\nHNheqR.exe
  C:\Windows\System\nHNheqR.exe
  2⤵
  PID:11360
- C:\Windows\System\fWlnLqA.exe
  C:\Windows\System\fWlnLqA.exe
  2⤵
  PID:11392
- C:\Windows\System\GKuvEsR.exe
  C:\Windows\System\GKuvEsR.exe
  2⤵
  PID:11424
- C:\Windows\System\haVEBVp.exe
  C:\Windows\System\haVEBVp.exe
  2⤵
  PID:11464
- C:\Windows\System\lDhlhVq.exe
  C:\Windows\System\lDhlhVq.exe
  2⤵
  PID:11488
- C:\Windows\System\ymKgbrv.exe
  C:\Windows\System\ymKgbrv.exe
  2⤵
  PID:11520
- C:\Windows\System\HSDZFAM.exe
  C:\Windows\System\HSDZFAM.exe
  2⤵
  PID:11548
- C:\Windows\System\VUPCGQl.exe
  C:\Windows\System\VUPCGQl.exe
  2⤵
  PID:11568
- C:\Windows\System\KRglUIh.exe
  C:\Windows\System\KRglUIh.exe
  2⤵
  PID:11600
- C:\Windows\System\fXuccEo.exe
  C:\Windows\System\fXuccEo.exe
  2⤵
  PID:11620
- C:\Windows\System\NGEJUGS.exe
  C:\Windows\System\NGEJUGS.exe
  2⤵
  PID:11644
- C:\Windows\System\tfPSYCq.exe
  C:\Windows\System\tfPSYCq.exe
  2⤵
  PID:11668
- C:\Windows\System\JKeEeAF.exe
  C:\Windows\System\JKeEeAF.exe
  2⤵
  PID:11704
- C:\Windows\System\SawHxJM.exe
  C:\Windows\System\SawHxJM.exe
  2⤵
  PID:11724
- C:\Windows\System\JWOaniS.exe
  C:\Windows\System\JWOaniS.exe
  2⤵
  PID:11744
- C:\Windows\System\apCYHIS.exe
  C:\Windows\System\apCYHIS.exe
  2⤵
  PID:11764
- C:\Windows\System\VVfnArt.exe
  C:\Windows\System\VVfnArt.exe
  2⤵
  PID:11824
- C:\Windows\System\CkdOvSq.exe
  C:\Windows\System\CkdOvSq.exe
  2⤵
  PID:11848
- C:\Windows\System\TIgfdQf.exe
  C:\Windows\System\TIgfdQf.exe
  2⤵
  PID:11872
- C:\Windows\System\qKrhfxk.exe
  C:\Windows\System\qKrhfxk.exe
  2⤵
  PID:11888
- C:\Windows\System\hPPTTbr.exe
  C:\Windows\System\hPPTTbr.exe
  2⤵
  PID:11932
- C:\Windows\System\yvNmQPI.exe
  C:\Windows\System\yvNmQPI.exe
  2⤵
  PID:11952
- C:\Windows\System\jqtOeTT.exe
  C:\Windows\System\jqtOeTT.exe
  2⤵
  PID:11972
- C:\Windows\System\svEcEYg.exe
  C:\Windows\System\svEcEYg.exe
  2⤵
  PID:12024
- C:\Windows\System\EWYSWPX.exe
  C:\Windows\System\EWYSWPX.exe
  2⤵
  PID:12052
- C:\Windows\System\RGUBFEy.exe
  C:\Windows\System\RGUBFEy.exe
  2⤵
  PID:12080
- C:\Windows\System\PxJjBtO.exe
  C:\Windows\System\PxJjBtO.exe
  2⤵
  PID:12112
- C:\Windows\System\LUgxDAD.exe
  C:\Windows\System\LUgxDAD.exe
  2⤵
  PID:12140
- C:\Windows\System\ufdnWfy.exe
  C:\Windows\System\ufdnWfy.exe
  2⤵
  PID:12168
- C:\Windows\System\LKNXGzv.exe
  C:\Windows\System\LKNXGzv.exe
  2⤵
  PID:12196
- C:\Windows\System\mrSCOri.exe
  C:\Windows\System\mrSCOri.exe
  2⤵
  PID:12212
- C:\Windows\System\dhZWVMw.exe
  C:\Windows\System\dhZWVMw.exe
  2⤵
  PID:12232
- C:\Windows\System\lOZdniM.exe
  C:\Windows\System\lOZdniM.exe
  2⤵
  PID:12264
- C:\Windows\System\lHeQMVd.exe
  C:\Windows\System\lHeQMVd.exe
  2⤵
  PID:11196
- C:\Windows\System\MBfgQcy.exe
  C:\Windows\System\MBfgQcy.exe
  2⤵
  PID:11336
- C:\Windows\System\QeThLvl.exe
  C:\Windows\System\QeThLvl.exe
  2⤵
  PID:11384
- C:\Windows\System\qyjMKpM.exe
  C:\Windows\System\qyjMKpM.exe
  2⤵
  PID:11444
- C:\Windows\System\HUtoXFx.exe
  C:\Windows\System\HUtoXFx.exe
  2⤵
  PID:11484
- C:\Windows\System\uMwhHKx.exe
  C:\Windows\System\uMwhHKx.exe
  2⤵
  PID:11612
- C:\Windows\System\XpvcciY.exe
  C:\Windows\System\XpvcciY.exe
  2⤵
  PID:11676
- C:\Windows\System\YshVNMQ.exe
  C:\Windows\System\YshVNMQ.exe
  2⤵
  PID:11784
- C:\Windows\System\jcFZPBW.exe
  C:\Windows\System\jcFZPBW.exe
  2⤵
  PID:11792
- C:\Windows\System\vuZhikc.exe
  C:\Windows\System\vuZhikc.exe
  2⤵
  PID:11864
- C:\Windows\System\vjyiaCx.exe
  C:\Windows\System\vjyiaCx.exe
  2⤵
  PID:11920
- C:\Windows\System\qMKHuei.exe
  C:\Windows\System\qMKHuei.exe
  2⤵
  PID:11984
- C:\Windows\System\wSlgmWS.exe
  C:\Windows\System\wSlgmWS.exe
  2⤵
  PID:12036
- C:\Windows\System\mGeGGmL.exe
  C:\Windows\System\mGeGGmL.exe
  2⤵
  PID:12076
- C:\Windows\System\LsRHaOB.exe
  C:\Windows\System\LsRHaOB.exe
  2⤵
  PID:12132
- C:\Windows\System\UdoGgFW.exe
  C:\Windows\System\UdoGgFW.exe
  2⤵
  PID:12208
- C:\Windows\System\VDKlIFX.exe
  C:\Windows\System\VDKlIFX.exe
  2⤵
  PID:12280
- C:\Windows\System\zFLAxwy.exe
  C:\Windows\System\zFLAxwy.exe
  2⤵
  PID:11332
- C:\Windows\System\sGUBmdb.exe
  C:\Windows\System\sGUBmdb.exe
  2⤵
  PID:11480
- C:\Windows\System\FbJbQCi.exe
  C:\Windows\System\FbJbQCi.exe
  2⤵
  PID:11632
- C:\Windows\System\qNPtJnt.exe
  C:\Windows\System\qNPtJnt.exe
  2⤵
  PID:11756
- C:\Windows\System\vJNwnpA.exe
  C:\Windows\System\vJNwnpA.exe
  2⤵
  PID:11940
- C:\Windows\System\tUNWMyi.exe
  C:\Windows\System\tUNWMyi.exe
  2⤵
  PID:12104
- C:\Windows\System\fIuuzWn.exe
  C:\Windows\System\fIuuzWn.exe
  2⤵
  PID:12180
- C:\Windows\System\KeJGvav.exe
  C:\Windows\System\KeJGvav.exe
  2⤵
  PID:11664
- C:\Windows\System\eXzPhKi.exe
  C:\Windows\System\eXzPhKi.exe
  2⤵
  PID:11732
- C:\Windows\System\sANLiNM.exe
  C:\Windows\System\sANLiNM.exe
  2⤵
  PID:11380
- C:\Windows\System\fSIXYfO.exe
  C:\Windows\System\fSIXYfO.exe
  2⤵
  PID:12228
- C:\Windows\System\cdOCFYx.exe
  C:\Windows\System\cdOCFYx.exe
  2⤵
  PID:12312
- C:\Windows\System\QXTDdss.exe
  C:\Windows\System\QXTDdss.exe
  2⤵
  PID:12336
- C:\Windows\System\QNYjhMv.exe
  C:\Windows\System\QNYjhMv.exe
  2⤵
  PID:12356
- C:\Windows\System\kyzJFNa.exe
  C:\Windows\System\kyzJFNa.exe
  2⤵
  PID:12376
- C:\Windows\System\vbySnxU.exe
  C:\Windows\System\vbySnxU.exe
  2⤵
  PID:12412
- C:\Windows\System\GZtitjB.exe
  C:\Windows\System\GZtitjB.exe
  2⤵
  PID:12448
- C:\Windows\System\jciCxAC.exe
  C:\Windows\System\jciCxAC.exe
  2⤵
  PID:12468
- C:\Windows\System\COZUGcM.exe
  C:\Windows\System\COZUGcM.exe
  2⤵
  PID:12508
- C:\Windows\System\CsbFyQy.exe
  C:\Windows\System\CsbFyQy.exe
  2⤵
  PID:12532
- C:\Windows\System\pdMKwnL.exe
  C:\Windows\System\pdMKwnL.exe
  2⤵
  PID:12552
- C:\Windows\System\zAMNEzO.exe
  C:\Windows\System\zAMNEzO.exe
  2⤵
  PID:12580
- C:\Windows\System\COMsIKg.exe
  C:\Windows\System\COMsIKg.exe
  2⤵
  PID:12608
- C:\Windows\System\ZguyIcz.exe
  C:\Windows\System\ZguyIcz.exe
  2⤵
  PID:12624
- C:\Windows\System\MQZPfan.exe
  C:\Windows\System\MQZPfan.exe
  2⤵
  PID:12644
- C:\Windows\System\vZipvTS.exe
  C:\Windows\System\vZipvTS.exe
  2⤵
  PID:12664
- C:\Windows\System\aGSWayg.exe
  C:\Windows\System\aGSWayg.exe
  2⤵
  PID:12692
- C:\Windows\System\VhipIgR.exe
  C:\Windows\System\VhipIgR.exe
  2⤵
  PID:12708
- C:\Windows\System\PbsEdxm.exe
  C:\Windows\System\PbsEdxm.exe
  2⤵
  PID:12744
- C:\Windows\System\rkwQuHE.exe
  C:\Windows\System\rkwQuHE.exe
  2⤵
  PID:12764
- C:\Windows\System\mEynPww.exe
  C:\Windows\System\mEynPww.exe
  2⤵
  PID:12788
- C:\Windows\System\nHEBpah.exe
  C:\Windows\System\nHEBpah.exe
  2⤵
  PID:12820
- C:\Windows\System\CUiUZMm.exe
  C:\Windows\System\CUiUZMm.exe
  2⤵
  PID:12844
- C:\Windows\System\zLkGztS.exe
  C:\Windows\System\zLkGztS.exe
  2⤵
  PID:12896
- C:\Windows\System\eKfmLyJ.exe
  C:\Windows\System\eKfmLyJ.exe
  2⤵
  PID:12924
- C:\Windows\System\GrqjqJE.exe
  C:\Windows\System\GrqjqJE.exe
  2⤵
  PID:12960
- C:\Windows\System\ABrIFrc.exe
  C:\Windows\System\ABrIFrc.exe
  2⤵
  PID:12980
- C:\Windows\System\hNCAWiP.exe
  C:\Windows\System\hNCAWiP.exe
  2⤵
  PID:13024
- C:\Windows\System\EnUYuyj.exe
  C:\Windows\System\EnUYuyj.exe
  2⤵
  PID:13056
- C:\Windows\System\afzsJfS.exe
  C:\Windows\System\afzsJfS.exe
  2⤵
  PID:13084
- C:\Windows\System\qRewLGo.exe
  C:\Windows\System\qRewLGo.exe
  2⤵
  PID:13100
- C:\Windows\System\LoXNcxn.exe
  C:\Windows\System\LoXNcxn.exe
  2⤵
  PID:13136
- C:\Windows\System\YzQFDPA.exe
  C:\Windows\System\YzQFDPA.exe
  2⤵
  PID:13164
- C:\Windows\System\mZMqxgC.exe
  C:\Windows\System\mZMqxgC.exe
  2⤵
  PID:13196
- C:\Windows\System\ESqihGF.exe
  C:\Windows\System\ESqihGF.exe
  2⤵
  PID:13212
- C:\Windows\System\sQaenmi.exe
  C:\Windows\System\sQaenmi.exe
  2⤵
  PID:13240
- C:\Windows\System\AzMjVjL.exe
  C:\Windows\System\AzMjVjL.exe
  2⤵
  PID:13288
- C:\Windows\System\WsPUuJR.exe
  C:\Windows\System\WsPUuJR.exe
  2⤵
  PID:13308
- C:\Windows\System\yxSUphj.exe
  C:\Windows\System\yxSUphj.exe
  2⤵
  PID:12348
- C:\Windows\System\fXSbYOC.exe
  C:\Windows\System\fXSbYOC.exe
  2⤵
  PID:12408
- C:\Windows\System\yjBBnkx.exe
  C:\Windows\System\yjBBnkx.exe
  2⤵
  PID:12484
- C:\Windows\System\MZYRfyE.exe
  C:\Windows\System\MZYRfyE.exe
  2⤵
  PID:12520
- C:\Windows\System\ROgPQXV.exe
  C:\Windows\System\ROgPQXV.exe
  2⤵
  PID:12620
- C:\Windows\System\SJMkQSn.exe
  C:\Windows\System\SJMkQSn.exe
  2⤵
  PID:12636
- C:\Windows\System\JNsDTCr.exe
  C:\Windows\System\JNsDTCr.exe
  2⤵
  PID:12752
- C:\Windows\System\hTSassc.exe
  C:\Windows\System\hTSassc.exe
  2⤵
  PID:12776
- C:\Windows\System\XLATCYt.exe
  C:\Windows\System\XLATCYt.exe
  2⤵
  PID:12904
- C:\Windows\System\vCrCQVf.exe
  C:\Windows\System\vCrCQVf.exe
  2⤵
  PID:12912
- C:\Windows\System\BlSZQJa.exe
  C:\Windows\System\BlSZQJa.exe
  2⤵
  PID:12976
- C:\Windows\System\JmosxbM.exe
  C:\Windows\System\JmosxbM.exe
  2⤵
  PID:13076
- C:\Windows\System\bVGqMQq.exe
  C:\Windows\System\bVGqMQq.exe
  2⤵
  PID:13092
- C:\Windows\System\OhIGWMx.exe
  C:\Windows\System\OhIGWMx.exe
  2⤵
  PID:13204
- C:\Windows\System\UKpszAq.exe
  C:\Windows\System\UKpszAq.exe
  2⤵
  PID:13300
- C:\Windows\System\Urdtkmj.exe
  C:\Windows\System\Urdtkmj.exe
  2⤵
  PID:12296
- C:\Windows\System\wpCOlNb.exe
  C:\Windows\System\wpCOlNb.exe
  2⤵
  PID:12440
- C:\Windows\System\xFsNTtB.exe
  C:\Windows\System\xFsNTtB.exe
  2⤵
  PID:12592
- C:\Windows\System\MIDExTs.exe
  C:\Windows\System\MIDExTs.exe
  2⤵
  PID:12800
- C:\Windows\System\ndHMABp.exe
  C:\Windows\System\ndHMABp.exe
  2⤵
  PID:12872
- C:\Windows\System\CwXKodB.exe
  C:\Windows\System\CwXKodB.exe
  2⤵
  PID:12952
- C:\Windows\System\QlsHsxF.exe
  C:\Windows\System\QlsHsxF.exe
  2⤵
  PID:13184
- C:\Windows\System\rfCbABr.exe
  C:\Windows\System\rfCbABr.exe
  2⤵
  PID:12328
- C:\Windows\System\ONWzmzS.exe
  C:\Windows\System\ONWzmzS.exe
  2⤵
  PID:12496
- C:\Windows\System\JvLQNfA.exe
  C:\Windows\System\JvLQNfA.exe
  2⤵
  PID:12780
- C:\Windows\System\ntcJLsp.exe
  C:\Windows\System\ntcJLsp.exe
  2⤵
  PID:13096
- C:\Windows\System\rRjJHjp.exe
  C:\Windows\System\rRjJHjp.exe
  2⤵
  PID:13112
- C:\Windows\System\lNWOYzm.exe
  C:\Windows\System\lNWOYzm.exe
  2⤵
  PID:13328
- C:\Windows\System\WYpNoCx.exe
  C:\Windows\System\WYpNoCx.exe
  2⤵
  PID:13392
- C:\Windows\System\uifprhY.exe
  C:\Windows\System\uifprhY.exe
  2⤵
  PID:13428
- C:\Windows\System\OUPdycr.exe
  C:\Windows\System\OUPdycr.exe
  2⤵
  PID:13460
- C:\Windows\System\KgZnzht.exe
  C:\Windows\System\KgZnzht.exe
  2⤵
  PID:13476
- C:\Windows\System\MdqsOaU.exe
  C:\Windows\System\MdqsOaU.exe
  2⤵
  PID:13516
- C:\Windows\System\OgsvMrP.exe
  C:\Windows\System\OgsvMrP.exe
  2⤵
  PID:13532
- C:\Windows\System\mlVAYOg.exe
  C:\Windows\System\mlVAYOg.exe
  2⤵
  PID:13572
- C:\Windows\System\YkCWrVC.exe
  C:\Windows\System\YkCWrVC.exe
  2⤵
  PID:13588
- C:\Windows\System\xkxUDpf.exe
  C:\Windows\System\xkxUDpf.exe
  2⤵
  PID:13620
- C:\Windows\System\rEaZWgF.exe
  C:\Windows\System\rEaZWgF.exe
  2⤵
  PID:13644
- C:\Windows\System\Haqirsv.exe
  C:\Windows\System\Haqirsv.exe
  2⤵
  PID:13664
- C:\Windows\System\OZZNFGs.exe
  C:\Windows\System\OZZNFGs.exe
  2⤵
  PID:13708
- C:\Windows\System\kvrhUCQ.exe
  C:\Windows\System\kvrhUCQ.exe
  2⤵
  PID:13736
- C:\Windows\System\qiDSQgR.exe
  C:\Windows\System\qiDSQgR.exe
  2⤵
  PID:13756
- C:\Windows\System\mPuVVTY.exe
  C:\Windows\System\mPuVVTY.exe
  2⤵
  PID:13780
- C:\Windows\System\xOqbhYN.exe
  C:\Windows\System\xOqbhYN.exe
  2⤵
  PID:13836
- C:\Windows\System\kINqvmI.exe
  C:\Windows\System\kINqvmI.exe
  2⤵
  PID:13852
- C:\Windows\System\mURBqUn.exe
  C:\Windows\System\mURBqUn.exe
  2⤵
  PID:13880
- C:\Windows\System\kifzmNG.exe
  C:\Windows\System\kifzmNG.exe
  2⤵
  PID:13920
- C:\Windows\System\QnfJjUa.exe
  C:\Windows\System\QnfJjUa.exe
  2⤵
  PID:13948
- C:\Windows\System\xmKLkzN.exe
  C:\Windows\System\xmKLkzN.exe
  2⤵
  PID:13964
- C:\Windows\System\RtrCGhU.exe
  C:\Windows\System\RtrCGhU.exe
  2⤵
  PID:13984
- C:\Windows\System\sGvGhGh.exe
  C:\Windows\System\sGvGhGh.exe
  2⤵
  PID:14008
- C:\Windows\System\XiKyHTU.exe
  C:\Windows\System\XiKyHTU.exe
  2⤵
  PID:14028
- C:\Windows\System\UaQfsAx.exe
  C:\Windows\System\UaQfsAx.exe
  2⤵
  PID:14052
- C:\Windows\System\tuNNBXI.exe
  C:\Windows\System\tuNNBXI.exe
  2⤵
  PID:14080
- C:\Windows\System\chzktFT.exe
  C:\Windows\System\chzktFT.exe
  2⤵
  PID:14104
- C:\Windows\System\KACrlzX.exe
  C:\Windows\System\KACrlzX.exe
  2⤵
  PID:14140
- C:\Windows\System\hIwAAfG.exe
  C:\Windows\System\hIwAAfG.exe
  2⤵
  PID:14160
- C:\Windows\System\AajhYWT.exe
  C:\Windows\System\AajhYWT.exe
  2⤵
  PID:14192
- C:\Windows\System\qiLDJVo.exe
  C:\Windows\System\qiLDJVo.exe
  2⤵
  PID:14208
- C:\Windows\System\uZiDMdo.exe
  C:\Windows\System\uZiDMdo.exe
  2⤵
  PID:14276
- C:\Windows\System\mhaHsop.exe
  C:\Windows\System\mhaHsop.exe
  2⤵
  PID:14300
- C:\Windows\System\KznzumN.exe
  C:\Windows\System\KznzumN.exe
  2⤵
  PID:14328
- C:\Windows\System\UOclmAC.exe
  C:\Windows\System\UOclmAC.exe
  2⤵
  PID:12700
- C:\Windows\System\CBWdIiT.exe
  C:\Windows\System\CBWdIiT.exe
  2⤵
  PID:13324
- C:\Windows\System\SKEcMHY.exe
  C:\Windows\System\SKEcMHY.exe
  2⤵
  PID:13388
- C:\Windows\System\maXLFan.exe
  C:\Windows\System\maXLFan.exe
  2⤵
  PID:13452
- C:\Windows\System\qwnsRwc.exe
  C:\Windows\System\qwnsRwc.exe
  2⤵
  PID:13524
- C:\Windows\System\WMyVuQT.exe
  C:\Windows\System\WMyVuQT.exe
  2⤵
  PID:13628
- C:\Windows\System\bytRuqa.exe
  C:\Windows\System\bytRuqa.exe
  2⤵
  PID:13696
- C:\Windows\System\cGeMdoj.exe
  C:\Windows\System\cGeMdoj.exe
  2⤵
  PID:13804
- C:\Windows\System\GMRxQoJ.exe
  C:\Windows\System\GMRxQoJ.exe
  2⤵
  PID:13816
- C:\Windows\System\tLLsxlT.exe
  C:\Windows\System\tLLsxlT.exe
  2⤵
  PID:13844
- C:\Windows\System\bGlssYy.exe
  C:\Windows\System\bGlssYy.exe
  2⤵
  PID:13956
- C:\Windows\System\IEgBsMt.exe
  C:\Windows\System\IEgBsMt.exe
  2⤵
  PID:13972
- C:\Windows\System\KxWFijb.exe
  C:\Windows\System\KxWFijb.exe
  2⤵
  PID:14040
- C:\Windows\System\EwMEmRe.exe
  C:\Windows\System\EwMEmRe.exe
  2⤵
  PID:14128
- C:\Windows\System\YItfKkP.exe
  C:\Windows\System\YItfKkP.exe
  2⤵
  PID:14204
- C:\Windows\System\VDDZKoH.exe
  C:\Windows\System\VDDZKoH.exe
  2⤵
  PID:14292
- C:\Windows\System\cwXBUDj.exe
  C:\Windows\System\cwXBUDj.exe
  2⤵
  PID:13320
- C:\Windows\System\GPoiJlR.exe
  C:\Windows\System\GPoiJlR.exe
  2⤵
  PID:13448
- C:\Windows\System\WgnLbrA.exe
  C:\Windows\System\WgnLbrA.exe
  2⤵
  PID:13508
- C:\Windows\System\UbRlcpT.exe
  C:\Windows\System\UbRlcpT.exe
  2⤵
  PID:13704
- C:\Windows\System\qSxbmLL.exe
  C:\Windows\System\qSxbmLL.exe
  2⤵
  PID:13828
- C:\Windows\System\oiNPKft.exe
  C:\Windows\System\oiNPKft.exe
  2⤵
  PID:13992
- C:\Windows\System\PVAmWbs.exe
  C:\Windows\System\PVAmWbs.exe
  2⤵
  PID:14044
- C:\Windows\System\xPOQRrL.exe
  C:\Windows\System\xPOQRrL.exe
  2⤵
  PID:13336
- C:\Windows\System\wdzcUVX.exe
  C:\Windows\System\wdzcUVX.exe
  2⤵
  PID:13528
- C:\Windows\System\NQThPLh.exe
  C:\Windows\System\NQThPLh.exe
  2⤵
  PID:14116
- C:\Windows\System\wIIYzlV.exe
  C:\Windows\System\wIIYzlV.exe
  2⤵
  PID:14272
- C:\Windows\System\ikZqOXj.exe
  C:\Windows\System\ikZqOXj.exe
  2⤵
  PID:13372
- C:\Windows\System\xZyoAeR.exe
  C:\Windows\System\xZyoAeR.exe
  2⤵
  PID:14356
- C:\Windows\System\cuItFTW.exe
  C:\Windows\System\cuItFTW.exe
  2⤵
  PID:14372
- C:\Windows\System\rSSUDnM.exe
  C:\Windows\System\rSSUDnM.exe
  2⤵
  PID:14396
- C:\Windows\System\QLyhvIO.exe
  C:\Windows\System\QLyhvIO.exe
  2⤵
  PID:14416
- C:\Windows\System\UgEZKzb.exe
  C:\Windows\System\UgEZKzb.exe
  2⤵
  PID:14456
- C:\Windows\System\HxNdHME.exe
  C:\Windows\System\HxNdHME.exe
  2⤵
  PID:14476
- C:\Windows\System\ZPwIwGz.exe
  C:\Windows\System\ZPwIwGz.exe
  2⤵
  PID:14496
- C:\Windows\System\GbUXiyg.exe
  C:\Windows\System\GbUXiyg.exe
  2⤵
  PID:14528
- C:\Windows\System\dwxJzWl.exe
  C:\Windows\System\dwxJzWl.exe
  2⤵
  PID:14560
- C:\Windows\System\GieJXOU.exe
  C:\Windows\System\GieJXOU.exe
  2⤵
  PID:14580
- C:\Windows\System\oHtLvZV.exe
  C:\Windows\System\oHtLvZV.exe
  2⤵
  PID:14624
- C:\Windows\System\lBLKRMG.exe
  C:\Windows\System\lBLKRMG.exe
  2⤵
  PID:14644
- C:\Windows\System\VgZwNWq.exe
  C:\Windows\System\VgZwNWq.exe
  2⤵
  PID:14692
- C:\Windows\System\GbItLuu.exe
  C:\Windows\System\GbItLuu.exe
  2⤵
  PID:14720
- C:\Windows\System\xRedIWw.exe
  C:\Windows\System\xRedIWw.exe
  2⤵
  PID:14736
- C:\Windows\System\htyPEFV.exe
  C:\Windows\System\htyPEFV.exe
  2⤵
  PID:14760
- C:\Windows\System\oPCpiJu.exe
  C:\Windows\System\oPCpiJu.exe
  2⤵
  PID:14784
- C:\Windows\System\ZFLvaHZ.exe
  C:\Windows\System\ZFLvaHZ.exe
  2⤵
  PID:14832
- C:\Windows\System\rGXqOiP.exe
  C:\Windows\System\rGXqOiP.exe
  2⤵
  PID:14860
- C:\Windows\System\YHiTecs.exe
  C:\Windows\System\YHiTecs.exe
  2⤵
  PID:14888
- C:\Windows\System\zZqieyY.exe
  C:\Windows\System\zZqieyY.exe
  2⤵
  PID:14908
- C:\Windows\System\eXJemAM.exe
  C:\Windows\System\eXJemAM.exe
  2⤵
  PID:14932
- C:\Windows\System\hCYqtXE.exe
  C:\Windows\System\hCYqtXE.exe
  2⤵
  PID:14952
- C:\Windows\System\QGvFEWO.exe
  C:\Windows\System\QGvFEWO.exe
  2⤵
  PID:15000
- C:\Windows\System\CxaTupv.exe
  C:\Windows\System\CxaTupv.exe
  2⤵
  PID:15016
- C:\Windows\System\wiKcKdM.exe
  C:\Windows\System\wiKcKdM.exe
  2⤵
  PID:15044
- C:\Windows\System\nKpsUfI.exe
  C:\Windows\System\nKpsUfI.exe
  2⤵
  PID:15080
- C:\Windows\System\vjfYIpi.exe
  C:\Windows\System\vjfYIpi.exe
  2⤵
  PID:15100
- C:\Windows\System\xaiYywL.exe
  C:\Windows\System\xaiYywL.exe
  2⤵
  PID:15128
- C:\Windows\System\oZNsBOB.exe
  C:\Windows\System\oZNsBOB.exe
  2⤵
  PID:15144
- C:\Windows\System\sglfDUb.exe
  C:\Windows\System\sglfDUb.exe
  2⤵
  PID:15160
- C:\Windows\System\NfZkKzm.exe
  C:\Windows\System\NfZkKzm.exe
  2⤵
  PID:15184
- C:\Windows\System\CGWHbtB.exe
  C:\Windows\System\CGWHbtB.exe
  2⤵
  PID:15208
- C:\Windows\System\jwcbJHS.exe
  C:\Windows\System\jwcbJHS.exe
  2⤵
  PID:15228
- C:\Windows\System\CtxVsIC.exe
  C:\Windows\System\CtxVsIC.exe
  2⤵
  PID:15256
- C:\Windows\System\jiQSlTW.exe
  C:\Windows\System\jiQSlTW.exe
  2⤵
  PID:15296
- C:\Windows\System\xPKxZVE.exe
  C:\Windows\System\xPKxZVE.exe
  2⤵
  PID:15348
- C:\Windows\System\paaYvSf.exe
  C:\Windows\System\paaYvSf.exe
  2⤵
  PID:14384
- C:\Windows\System\GpneiMd.exe
  C:\Windows\System\GpneiMd.exe
  2⤵
  PID:14428
- C:\Windows\System\mfmrcZT.exe
  C:\Windows\System\mfmrcZT.exe
  2⤵
  PID:14472
- C:\Windows\System\cVEboIA.exe
  C:\Windows\System\cVEboIA.exe
  2⤵
  PID:14572
- C:\Windows\System\kpFgDJN.exe
  C:\Windows\System\kpFgDJN.exe
  2⤵
  PID:14596
- C:\Windows\System\XpJRInB.exe
  C:\Windows\System\XpJRInB.exe
  2⤵
  PID:14660
- C:\Windows\System\gGuivsY.exe
  C:\Windows\System\gGuivsY.exe
  2⤵
  PID:14732
- C:\Windows\System\wdXSvfk.exe
  C:\Windows\System\wdXSvfk.exe
  2⤵
  PID:14772
- C:\Windows\System\haXbPRc.exe
  C:\Windows\System\haXbPRc.exe
  2⤵
  PID:14876
- C:\Windows\System\wXnEtdG.exe
  C:\Windows\System\wXnEtdG.exe
  2⤵
  PID:14964
- C:\Windows\System\xEoYjna.exe
  C:\Windows\System\xEoYjna.exe
  2⤵
  PID:14988
- C:\Windows\System\xiaKsmG.exe
  C:\Windows\System\xiaKsmG.exe
  2⤵
  PID:15092
- C:\Windows\System\WsiidfQ.exe
  C:\Windows\System\WsiidfQ.exe
  2⤵
  PID:15136
- C:\Windows\System\uAFJBbB.exe
  C:\Windows\System\uAFJBbB.exe
  2⤵
  PID:15220
- C:\Windows\System\eYKGKTu.exe
  C:\Windows\System\eYKGKTu.exe
  2⤵
  PID:15240
- C:\Windows\System\FdeOwmf.exe
  C:\Windows\System\FdeOwmf.exe
  2⤵
  PID:15328
- C:\Windows\System\SfGjKuc.exe
  C:\Windows\System\SfGjKuc.exe
  2⤵
  PID:14408
- C:\Windows\System\chhETgJ.exe
  C:\Windows\System\chhETgJ.exe
  2⤵
  PID:14488
- C:\Windows\System\vvVLaSw.exe
  C:\Windows\System\vvVLaSw.exe
  2⤵
  PID:14616
- C:\Windows\System\HzuTAMj.exe
  C:\Windows\System\HzuTAMj.exe
  2⤵
  PID:14904
- C:\Windows\System\hSpFzCY.exe
  C:\Windows\System\hSpFzCY.exe
  2⤵
  PID:15036
- C:\Windows\System\PtpnQQo.exe
  C:\Windows\System\PtpnQQo.exe
  2⤵
  PID:15028
- C:\Windows\System\AEcjWbK.exe
  C:\Windows\System\AEcjWbK.exe
  2⤵
  PID:15324
- C:\Windows\System\Vsprnca.exe
  C:\Windows\System\Vsprnca.exe
  2⤵
  PID:14464
- C:\Windows\System\HnPYUpb.exe
  C:\Windows\System\HnPYUpb.exe
  2⤵
  PID:14844
- C:\Windows\System\UwHLoWL.exe
  C:\Windows\System\UwHLoWL.exe
  2⤵
  PID:15248
- C:\Windows\System\KKYGMCs.exe
  C:\Windows\System\KKYGMCs.exe
  2⤵
  PID:14568
- C:\Windows\System\HhMAkcr.exe
  C:\Windows\System\HhMAkcr.exe
  2⤵
  PID:15388
- C:\Windows\System\HGLDaKJ.exe
  C:\Windows\System\HGLDaKJ.exe
  2⤵
  PID:15416
- C:\Windows\System\inbhvaw.exe
  C:\Windows\System\inbhvaw.exe
  2⤵
  PID:15432
- C:\Windows\System\zQNyOpC.exe
  C:\Windows\System\zQNyOpC.exe
  2⤵
  PID:15452
- C:\Windows\System\XajzpiD.exe
  C:\Windows\System\XajzpiD.exe
  2⤵
  PID:15488
- C:\Windows\System\jOEkVQg.exe
  C:\Windows\System\jOEkVQg.exe
  2⤵
  PID:15508
- C:\Windows\System\EcYdZqJ.exe
  C:\Windows\System\EcYdZqJ.exe
  2⤵
  PID:15528
- C:\Windows\System\qrmLKCs.exe
  C:\Windows\System\qrmLKCs.exe
  2⤵
  PID:15568
- C:\Windows\System\qgIPCcY.exe
  C:\Windows\System\qgIPCcY.exe
  2⤵
  PID:15588
- C:\Windows\System\dCckRcL.exe
  C:\Windows\System\dCckRcL.exe
  2⤵
  PID:15632
- C:\Windows\System\deMbATk.exe
  C:\Windows\System\deMbATk.exe
  2⤵
  PID:15660
- C:\Windows\System\XRwshpJ.exe
  C:\Windows\System\XRwshpJ.exe
  2⤵
  PID:15688
- C:\Windows\System\cIOwVhA.exe
  C:\Windows\System\cIOwVhA.exe
  2⤵
  PID:15704
- C:\Windows\System\JISbNYy.exe
  C:\Windows\System\JISbNYy.exe
  2⤵
  PID:15736
- C:\Windows\System\CBgNCXk.exe
  C:\Windows\System\CBgNCXk.exe
  2⤵
  PID:15756
- C:\Windows\System\dxSjLqA.exe
  C:\Windows\System\dxSjLqA.exe
  2⤵
  PID:15776
- C:\Windows\System\Noxreiy.exe
  C:\Windows\System\Noxreiy.exe
  2⤵
  PID:15796
- C:\Windows\System\uyGrVLc.exe
  C:\Windows\System\uyGrVLc.exe
  2⤵
  PID:15816
- C:\Windows\System\lvLihfw.exe
  C:\Windows\System\lvLihfw.exe
  2⤵
  PID:15840
- C:\Windows\System\wOaqzJS.exe
  C:\Windows\System\wOaqzJS.exe
  2⤵
  PID:15860
- C:\Windows\System\WfXAKkS.exe
  C:\Windows\System\WfXAKkS.exe
  2⤵
  PID:15924
- C:\Windows\System\MzrJBTQ.exe
  C:\Windows\System\MzrJBTQ.exe
  2⤵
  PID:15952
- C:\Windows\System\OwjEJbG.exe
  C:\Windows\System\OwjEJbG.exe
  2⤵
  PID:15980
- C:\Windows\System\zNBPsSP.exe
  C:\Windows\System\zNBPsSP.exe
  2⤵
  PID:15996
- C:\Windows\System\KopykdH.exe
  C:\Windows\System\KopykdH.exe
  2⤵
  PID:16016
- C:\Windows\System\ChxCIAb.exe
  C:\Windows\System\ChxCIAb.exe
  2⤵
  PID:16036
- C:\Windows\System\kmCxxRp.exe
  C:\Windows\System\kmCxxRp.exe
  2⤵
  PID:16064
- C:\Windows\System\AhYrkuS.exe
  C:\Windows\System\AhYrkuS.exe
  2⤵
  PID:16088
- C:\Windows\System\nIIcykG.exe
  C:\Windows\System\nIIcykG.exe
  2⤵
  PID:16116
- C:\Windows\System\lnDiKPu.exe
  C:\Windows\System\lnDiKPu.exe
  2⤵
  PID:16152
- C:\Windows\System\RvaiBqo.exe
  C:\Windows\System\RvaiBqo.exe
  2⤵
  PID:16208
- C:\Windows\System\HVRNPwt.exe
  C:\Windows\System\HVRNPwt.exe
  2⤵
  PID:16260
- C:\Windows\System\IGwcefs.exe
  C:\Windows\System\IGwcefs.exe
  2⤵
  PID:16280
- C:\Windows\System\cNkTYdD.exe
  C:\Windows\System\cNkTYdD.exe
  2⤵
  PID:16304
- C:\Windows\System\NYowdya.exe
  C:\Windows\System\NYowdya.exe
  2⤵
  PID:16324
- C:\Windows\System\ixolezV.exe
  C:\Windows\System\ixolezV.exe
  2⤵
  PID:16364
- C:\Windows\System\LWulTed.exe
  C:\Windows\System\LWulTed.exe
  2⤵
  PID:15380
- C:\Windows\System\ezUfLjg.exe
  C:\Windows\System\ezUfLjg.exe
  2⤵
  PID:15408
- C:\Windows\System\yrbEHuZ.exe
  C:\Windows\System\yrbEHuZ.exe
  2⤵
  PID:15476
- C:\Windows\System\iijCCUr.exe
  C:\Windows\System\iijCCUr.exe
  2⤵
  PID:15544
- C:\Windows\System\NTdIQxi.exe
  C:\Windows\System\NTdIQxi.exe
  2⤵
  PID:15560
- C:\Windows\System\sgmGauA.exe
  C:\Windows\System\sgmGauA.exe
  2⤵
  PID:15628
- C:\Windows\System\OocqfSJ.exe
  C:\Windows\System\OocqfSJ.exe
  2⤵
  PID:15752
- C:\Windows\System\avrZdig.exe
  C:\Windows\System\avrZdig.exe
  2⤵
  PID:15744
- C:\Windows\System\DUbuYxe.exe
  C:\Windows\System\DUbuYxe.exe
  2⤵
  PID:15808
- C:\Windows\System\SVrfhSr.exe
  C:\Windows\System\SVrfhSr.exe
  2⤵
  PID:15912
- C:\Windows\System\JWzDptK.exe
  C:\Windows\System\JWzDptK.exe
  2⤵
  PID:15976
- C:\Windows\System\AmRyNOz.exe
  C:\Windows\System\AmRyNOz.exe
  2⤵
  PID:16052
- C:\Windows\System\nThgwwy.exe
  C:\Windows\System\nThgwwy.exe
  2⤵
  PID:16100
- C:\Windows\System\WSGjoYd.exe
  C:\Windows\System\WSGjoYd.exe
  2⤵
  PID:16204
- C:\Windows\System\EDTFJPB.exe
  C:\Windows\System\EDTFJPB.exe
  2⤵
  PID:16228
- C:\Windows\System\GVYDcDY.exe
  C:\Windows\System\GVYDcDY.exe
  2⤵
  PID:16300
- C:\Windows\System\ioYVXWm.exe
  C:\Windows\System\ioYVXWm.exe
  2⤵
  PID:16336
- C:\Windows\System\dIsKvFw.exe
  C:\Windows\System\dIsKvFw.exe
  2⤵
  PID:15276
- C:\Windows\System\rptrmix.exe
  C:\Windows\System\rptrmix.exe
  2⤵
  PID:15496
- C:\Windows\System\KJOxACN.exe
  C:\Windows\System\KJOxACN.exe
  2⤵
  PID:15728
- C:\Windows\System\CJHgHsi.exe
  C:\Windows\System\CJHgHsi.exe
  2⤵
  PID:16032
- C:\Windows\System\LAeOagT.exe
  C:\Windows\System\LAeOagT.exe
  2⤵
  PID:16024
- C:\Windows\System\RpxmnGl.exe
  C:\Windows\System\RpxmnGl.exe
  2⤵
  PID:16268
- C:\Windows\System\nOtzFNv.exe
  C:\Windows\System\nOtzFNv.exe
  2⤵
  PID:15404
- C:\Windows\System\zqaiskF.exe
  C:\Windows\System\zqaiskF.exe
  2⤵
  PID:11104
- C:\Windows\System\XXcgpgq.exe
  C:\Windows\System\XXcgpgq.exe
  2⤵
  PID:15948
- C:\Windows\System\ldvBnoE.exe
  C:\Windows\System\ldvBnoE.exe
  2⤵
  PID:16276
- C:\Windows\System\uFktUJJ.exe
  C:\Windows\System\uFktUJJ.exe
  2⤵
  PID:2240
- C:\Windows\System\uQuOSPb.exe
  C:\Windows\System\uQuOSPb.exe
  2⤵
  PID:16312
- C:\Windows\System\WEEodSp.exe
  C:\Windows\System\WEEodSp.exe
  2⤵
  PID:16396
- C:\Windows\System\EFEeMHT.exe
  C:\Windows\System\EFEeMHT.exe
  2⤵
  PID:16424
- C:\Windows\System\iqLQXIw.exe
  C:\Windows\System\iqLQXIw.exe
  2⤵
  PID:16448
- C:\Windows\System\HrYQbdz.exe
  C:\Windows\System\HrYQbdz.exe
  2⤵
  PID:16468
- C:\Windows\System\dLzJDLu.exe
  C:\Windows\System\dLzJDLu.exe
  2⤵
  PID:16504
- C:\Windows\System\uTRYhxT.exe
  C:\Windows\System\uTRYhxT.exe
  2⤵
  PID:16532
- C:\Windows\System\fFpBZto.exe
  C:\Windows\System\fFpBZto.exe
  2⤵
  PID:16552
- C:\Windows\System\mHLyWZN.exe
  C:\Windows\System\mHLyWZN.exe
  2⤵
  PID:16584
- C:\Windows\System\IELyeld.exe
  C:\Windows\System\IELyeld.exe
  2⤵
  PID:16616
- C:\Windows\System\JKYxdfC.exe
  C:\Windows\System\JKYxdfC.exe
  2⤵
  PID:16636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BRmskCl.exe

Filesize
1.5MB

MD5
69bc589fa0795827adb73a503229435e

SHA1
0089cd75fe1bcedb17aacd518455620baa709ff6

SHA256
e626182fca70bf5867b3930c80aede208faefb7efcf9bc1bf5b61b3f98441f1c

SHA512
2e93f05b8f9829b3957237d8563571d93e84a13971e59ce8f10594f5c95d756cb3f567050f75db5d23aaac19044ba77b0adf13ed2904bd01bf136ded98bbe22a

Download Submit
C:\Windows\System\CEFSeIb.exe

Filesize
1.5MB

MD5
ab6cdaff73b0b0af55f7e16de31b8022

SHA1
a5cd322acb6f66573623b6c9a1623c53da2bd5de

SHA256
81373c44ca4fd35f7a73cbe5e53955c8cce92d5cd942d817957b203ca1e3f53b

SHA512
6324cfb2b195a5dd0e28c6c78ba685ce85a0d782999b9a7714456e4be0924e28b919dbe095cf820e6b7c7e37662f626a0c661f38e84f4272d97bb370e56be51f

Download Submit
C:\Windows\System\CcNheJU.exe

Filesize
1.5MB

MD5
e1cd65e4737a0307905f4c873c1bc1ab

SHA1
80b690e61ed655a935e14ad855dceac8739e8da1

SHA256
89c1115f7626ed499b0ff23b6af7d03a1dd1919bebb8a7c1eb0e7093e3038f9e

SHA512
e3e48523481005698660be64d77cb83cd09946d59e6852415952edd14ad65d0a558d2733c7b410da705b3e53346f505dd75389870b1207aea6aba746d321f80a

Download Submit
C:\Windows\System\CyNqsSN.exe

Filesize
1.5MB

MD5
4b73625cff5120bb826ba66efc8010b5

SHA1
be0f679168f175bfd8080182d935d57917402640

SHA256
f349bf7f59d4a74ead5cb39b4f8d3d026414f10b978045d833dbd7c507d60892

SHA512
42667b993017586c72df0b79d22101af534161059b6bb3f3e83f36d60b31c0c88553d2e9bb04a1ac44c4abf1902e271152643549927a29880bc13285e825fce1

Download Submit
C:\Windows\System\ENJqPCp.exe

Filesize
1.5MB

MD5
bf971c5a5b87d53bf42d7f88ef0bf7a7

SHA1
e9e776503b215126ff85d6ae29fdfbdf02067771

SHA256
6531efd0481e60e81356ea3dbdd1e1f6371507c152f66b8dba2739443f17244b

SHA512
4c240b5b88d890c891ab0f7754964972b313bd885b1129fdf975c5b0cf250ead8398c0969b75634852879d4bcb27d4e2175109b18cc0a1bb206174b2b9d7f6c8

Download Submit
C:\Windows\System\FguiebG.exe

Filesize
1.5MB

MD5
a34fed0ac40cd3ab06cf793e85261fa8

SHA1
45be8cbfd1d6662317f22af62b2378542f8a7e19

SHA256
819f83e9b841c250202b6f59f7d7f5a99d166918aec385a1fb86e8a4257ed31d

SHA512
9534657bb0e9a25cc93c0542c3c19c073a22d0f21b77d36d8d18044fbfce24f60823a0bcdff076fb41d5ad9f69cb7ef9421965f593189f0db56d044b23be0808

Download Submit
C:\Windows\System\HcJctrO.exe

Filesize
1.5MB

MD5
403e7aa0fc56ef52107a6c2098f4a584

SHA1
e21cff5da77f0a5e92d73223cd0fe7d4f8e2b53a

SHA256
98bfb9fa0e299fdc4b1a75088f24f125bf9b38051bf50c7adc205e291ec97fa1

SHA512
ee7b892d7a7b0349fe78f4f5cc2c289d2a895ee5dd49c57029aaf9412c522115f68cbc446509ff2f909752913cf19da4db059f9a32addc200d6d8c68c7a0bb10

Download Submit
C:\Windows\System\JrMwbOx.exe

Filesize
1.5MB

MD5
2a47ed3ebe420ee4e8ca151867ebda93

SHA1
972d8401226927f74c4cca85cf3b2da0229fea89

SHA256
5cedc99fcb5aba6e6c8c4906aa31437ad8959cff352c8c98094c842ac65c51d6

SHA512
a0006dfddd13a240df1cb383e9f03c22506aa042fe06566b67e4cd80c0091c19bf3c8059ab2377a2592de89f51dfc3b2eb350eca4d72681fd5d88f1911c9b7c2

Download Submit
C:\Windows\System\KUIptUE.exe

Filesize
1.5MB

MD5
081e3f7287ec4f257ae451b921a8034a

SHA1
6e6ebafc2f28d67458cf99c992b0185dbd26f8a3

SHA256
07e14c02c635fdad6ba06bcf0cf5ddccdf8eb760c87cb4fcb73ba716284db2e9

SHA512
7f099271220a764f366fca2f9606c4be94589e0653d4b61e0c5e9cfbac6e24b02eaed01b73b3dc1e58a9583c347b5e827523fbcd441004845ee3f4701c630055

Download Submit
C:\Windows\System\OVaFasx.exe

Filesize
1.5MB

MD5
1eb6924b617a6ec7613c79b7918a0970

SHA1
8b6997160d45807e16e0be138a52adcbca61c626

SHA256
fb465905694640356486e2148d9620132ae2398643edd0e844437e7ad0381e49

SHA512
85ea2cdc9518ceb71b963066cc68cac65986c0796efc81cfd347784df20ad526a2e05ee9824b29d4003bb6db4d619a9763e326e6cacab14565a6f7d08f47b366

Download Submit
C:\Windows\System\SJPGgxm.exe

Filesize
1.5MB

MD5
b4375968bdd1c50c3eac0cea4de690b8

SHA1
4ae2e6198347347893be6a5ed28e4635ef755d4a

SHA256
299a60f68ee6ef14e263d3bc7bbdee14ba7ccdad34cb6a919f46638129e70652

SHA512
f3192d2ee2fe0d02282323bf4b9ca5814533e3b8c8280bcc6143edaf541f61c122f827788c14223b7b08f31bf0dc7165627e34a3af643639e07d5c505a464e32

Download Submit
C:\Windows\System\SNtSYnf.exe

Filesize
1.5MB

MD5
484c8843826ae0835fd7fb2eee41137b

SHA1
ebe3f06d42b2cdaa70d2a3caeb7624769843ca25

SHA256
9d93e64b4158fa5444c19228f6ef9d57288d68bb675849dfc8e789eb7fc38e54

SHA512
9b30480693f0c4d55361c83b1b95cf2ffa082e76cc9e9f7f7039ea6a0179ef6b88193c7563e20eeb87a4cd81fe6888cdde269ceb103eb1c45512f629f1bdd24f

Download Submit
C:\Windows\System\SjZxioI.exe

Filesize
1.5MB

MD5
b50d62123ad87de2e7a7c6c4b888f431

SHA1
48328f6df2885f783dbad7b26daae7253ef3c176

SHA256
58eb85f5e1cdabf5c6f6086b04c92f151d2a8d286297c67c3b5f867ecfbc94a0

SHA512
290de279d3e020660288df6e1f2d11453dc5ccb9c493a3d057d3396035518ac3453111c8136a373c71f1db103fc0318833bd10a22e8a7533f4bf56037806c98b

Download Submit
C:\Windows\System\UKafxsd.exe

Filesize
1.5MB

MD5
9007d29d7fa7d5bb3ea933ec682041aa

SHA1
3125bd9484b856aa8c9cb2ef91f08e05b65b54ec

SHA256
bc24f232283283862f40b51ce3b507d208475a20de06730129df2353e699c865

SHA512
4b0e4cd37941af5ad587fb2f0f19ce6abe42f3fd20becd02884ba00b6670b291547127962a1f44430e099a3a9f45b08e6a707bd6cf16435a9c0b68ffed84edd0

Download Submit
C:\Windows\System\UXywaDa.exe

Filesize
1.5MB

MD5
38a31736c3bfaccf20a095346cc4bc35

SHA1
e8656cbedd6fcd59e02fb440839c313d9805a588

SHA256
226851c7f57856c05a8e19bb579eb496820808a8f809e560b22c8d48d0cf1208

SHA512
937f813afb53ff54b66f3d7123eaca5cf99ac2cf354a38d465e0d3c81c3489111456814b07a9513d973cf4064460a84e4206f531f4b75cc0f6d82e0bab0b3557

Download Submit
C:\Windows\System\WgMuytl.exe

Filesize
1.5MB

MD5
193653086cf25289ae8f980228a72182

SHA1
965dc7382df752bb20759f80c415da8bc36ddafc

SHA256
8b4d4b8f27f473e2e9a9a1582ea7532ee56b9a37afb4f1f04bae82bdde8d0177

SHA512
a2dc1c15dbfe3158145e72a2cf2bfc55d68407e6552a99e4ec30494ec0050a5ba85598a07c0bcfb635a5a686f24c0d1478be1b977277eeaa2733be0c9bb5d5c6

Download Submit
C:\Windows\System\YkDahNR.exe

Filesize
1.5MB

MD5
73830b1a2687a2b283bb180f5b82bb5d

SHA1
8e9690bb8b9519385325a1f3f954115f1ea9e5e9

SHA256
29d72bf75cd3f95f942131462ab7d29eb148f543db924714649b3c22e8f2b80d

SHA512
d97382ee24525b8c8e2c8b0423783397886bd4b8ff0c97a7ccc1c0de1ca67122d50259d95a128c216ce78d1aa5f7cefea52869009c5039022a5ebb35863ee547

Download Submit
C:\Windows\System\aYzXFFQ.exe

Filesize
1.5MB

MD5
adce70b3ed3b0a1d706814c66343d4d9

SHA1
343e7fc4dd3b350bb7d9f0ad8fdda98fb101220a

SHA256
d6df3145659d2ada475232dbc62d4e3e889770eccb90d5c86420c56901dbd475

SHA512
74ab6ee66b025e06872843d26da57d1db2158e194bf21b3f450e6a131eda488d215efe7e7b1013fc8f19a16bcd7076b1aab0648397d403f67351076e1698734a

Download Submit
C:\Windows\System\beIJiDG.exe

Filesize
1.5MB

MD5
1b5ce9c1179a7a1c9104807f83b6002c

SHA1
d3833cbe937d12f4773849c014fcc0bafcf918d5

SHA256
d800a5ed300dee3efc86d3a9e18a700e06ee00daacb3e06ac97408c3312a0f1c

SHA512
3d5c545e6b95f38f05107bad23067112dd7542708b4fc4401c48bf2b8e60f3cded4a8ee42bca3d69f899f72cf1d4e19c92e63aa56a82a27ffb0d907f1b2d8827

Download Submit
C:\Windows\System\fvoDquU.exe

Filesize
1.5MB

MD5
af4a9b157de3bd33215e6b5b0c752e0b

SHA1
aa798b9c24f8f6dd227251667951c5f080958011

SHA256
0f5b5002cb4b036c518204aadd6f936cdf04e9a28b6fe7c9ae8b93d61dfa52f7

SHA512
6c7ed1b73cfcb561e6398f07172decf80f913df72fb996185eb1b3476a46e58421d05bcd4dcb33670ef10e2b5035c3d74ce6dafeb66d51d6c4a911743598b86b

Download Submit
C:\Windows\System\iAajqrt.exe

Filesize
1.5MB

MD5
c496b160a3f1e7f486b5e641dde8705b

SHA1
7eba82ef1252a48d47f422f1b2004e6362e52686

SHA256
af2166ed9f54d70b1f88f73a2f4c666e447370ac4bb60c5a0d15e74cac416ccd

SHA512
027efc24d31a3cefa5ec483ba42fa9540906379b4e120426c9924e11b51d68ee700f350f0a616e74b5806813e75daa1f34d0cbd99c5ad38b93cb64e53f2b09bc

Download Submit
C:\Windows\System\iVUapjI.exe

Filesize
1.5MB

MD5
671febee8fd626b055a50ca607a15dd8

SHA1
2e23bf6a1334c74ef19f7721d4c249d971e13c42

SHA256
20ff00a68b4dae8eb1d8658ab362f11b2c4b30528133aba74c3e411a8bd0c8fd

SHA512
5a5e7929bcc03b02818c448edffe3392b325f0e8ab2cb2842c838cf54ba28f196ee44b67b8538b7c531878b5be2c6ca620a0ab9005cf31bf460e5be3bc8e90bd

Download Submit
C:\Windows\System\ipYACpo.exe

Filesize
1.5MB

MD5
333e74ecd247ff33a7da52b433291757

SHA1
a4b5999a167b8b5a4651ea753b3d00602bdc1636

SHA256
3e8174139d7ceacf07011e384ee8305d7aa053b98cd88fad18c5a87aeb4d49d5

SHA512
5b5e91c370dc59a9b8080fac8373fc5707536ee50f139ce79ea76aef322254ab80fc92788b0695011dda54c9f18bcf0a4583f07d299a61382924c9957a9482eb

Download Submit
C:\Windows\System\kPomalo.exe

Filesize
1.5MB

MD5
0eda9cfc37cc83a3c15563387e77c49c

SHA1
436c88fdea03d322abb5ab501a97c42c9fb35405

SHA256
7c5956c9e5344f24502631d8ec909d4656581cde8c7270ee7120482c12d6e161

SHA512
47cfc07e533eae8b2f0e6ff5e60a1641692033604626bf8a9b3a5b24c1494894bf6b2105422bbd21c76311a3df752e1b17213abc3d5f587a8388668bb6d6a760

Download Submit
C:\Windows\System\kVoOhLL.exe

Filesize
1.5MB

MD5
d018db7787881dc0f1bb286cfb59baec

SHA1
1e5185c19c26abb8dfca348407bc9fca377ad4ab

SHA256
c72af15ea5cbb8194800ae4b86216913249076493d28cdcfb72ceeb249d4985a

SHA512
ef0e1b5d4e58fce24804d71a5425260c3b77b57c21704b5aec8a1ffec917266a606504d1a571de0802a134449038fd564268ef20598f691f50a26bc4f7d8a77b

Download Submit
C:\Windows\System\lKUWcRl.exe

Filesize
1.5MB

MD5
90182814299295638d63c64a10ba6541

SHA1
21de6e3f14468aaa76dd5dcfcc7dc2c06101a547

SHA256
4cbc58dfa20ca1d26038743949f39c85295dac04d393bdfc367f426b4588c1a8

SHA512
dcf2cdcba537469c1ff2f6e38aef4e65068ecb3b9a4915e8d8d72c2de24e8b460f91566bdf81568406f193c89ca17f794fbe3e6f27d14af8571a7b5b6bfdfa36

Download Submit
C:\Windows\System\qSQbvUD.exe

Filesize
1.5MB

MD5
2073c08992d8f5a320f5a376c1260fb6

SHA1
c1ab5d4d3de8083b5f05a99d94cafe0f18ae2204

SHA256
76f5c6c24ba87fea8ec8ee60f9bf00b21e5870cda117525921167d39336227a2

SHA512
a68f006f1eeba7d6e8cc5fdf3c69d5b6007ede92228bf10978e6c7c345b635c99310328f236544b24df8ec72b1fe8d103bbb5287f6c006b944b6fda2794a9f42

Download Submit
C:\Windows\System\sjcVFej.exe

Filesize
1.5MB

MD5
0bac6a8ec3a1e859f2fc8c3156aad20a

SHA1
db388fb434da32efd0cd360015c88bec85e32bd9

SHA256
5b97c964a62c939a559ca4837a278158418c2c01b621c53641cf6e20e5237ed5

SHA512
1d129e4a51d870ccba84b878810b1f0abebff922f6a4ebba49ec356b42a2d01cbe230d964c2040b70f3642621e83d445ce55ae11fb993b4a13f3287552090fc0

Download Submit
C:\Windows\System\whUFndZ.exe

Filesize
1.5MB

MD5
ca63586a2d7d4a0f8a37e618399a8436

SHA1
bf8b96e650df1c03df09e0e13bb12155bdacd1a3

SHA256
6cedcc94abc5c826d4fadbd5d4f82cb789efcfbc9b0663104c5dce1554dc831a

SHA512
7cea75d0e2f2e7d87c6ec78ebc7768c36049b3c87561010be323e6106df65b5c12341b7e9edc97a1d44e1e4b438e2390dc7c2b4551bfef2300d7a155080a384a

Download Submit
C:\Windows\System\yeXnpuJ.exe

Filesize
1.5MB

MD5
d983b9225e355086edb20fe5fcbfe41a

SHA1
b694112349824e9282ad4c32995c1510584a753d

SHA256
0ad32567a5f2122f84ca591d1be7c63db683f3a20a1ee6910447e1a93643a646

SHA512
40b49b0fc50afbbd6343fe73e46e62b8be68647e4b5995d953c33913a7c5b595c56c431fbf12f4639f2ff70290f39012aca39cddb20d7cb016954853270e107d

Download Submit
C:\Windows\System\yhhQytE.exe

Filesize
1.5MB

MD5
30788f9b38365999e1c564f392eeafa1

SHA1
f2e14e54f32d854fff5089c65438fc9281a34b92

SHA256
06c6ed69d47453046ec99c51b8eb00f1dcfc01b5f0c579a0c2c9fcbdc28931cc

SHA512
bb1b42ad30cad25ed1673d07124a11e70bbec312f1aa03d6e9fde681f608b125b9671fcb2dc8f416a77f868624f1e0d4a73a1a85a83bf39eec6fddf3c30a7b95

Download Submit
C:\Windows\System\zrsZzbt.exe

Filesize
1.5MB

MD5
7b2b71d00f6512b8a716de37625f2e8f

SHA1
217ef17d4ba72c4f3427691f1dc88170d2c49657

SHA256
81dbed7ab44641991a22758203bc34b6245d495f8ff0d22c94adacc955f963c5

SHA512
7735d78805decda2a95c370a83bfebdd819f65fa1e92690010898eb76eebba8f677bd1ac644ae4ca1ae2baec0eb78079c463601307aaa4a8534998837bd04a4f

Download Submit
C:\Windows\System\zwfqrLs.exe

Filesize
1.5MB

MD5
ad9b6f6a110ce7c8510ecfa763fd4378

SHA1
d4dc9f4dd8158f56aa828aea9cd0ab1e1b014fa6

SHA256
5803db7195aee462c90716e039e24883de98e5ad42c4c503e00119ca7de5cd9a

SHA512
95662fb06fbb1ee57843db11181d50f4ec773fc0af6fd8a448b34cfc4a483dc4546ec1716478caf0f5714766bbd228bbb6c169d4bf17f65050ffec738b2e0324

Download Submit
memory/3196-0-0x00000123F3CD0000-0x00000123F3CE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads