xmrig | 46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02

Analysis

max time kernel
94s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
Size

1.6MB
MD5

0ae317f7c9df60857a260336e1062587
SHA1

a3b0fb5e6c91bb64c1f438ad61301de9ce407aa5
SHA256

46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02
SHA512

7af8b46a2e65f8e883f163f1df653b0e02520733b8a650da05f3b62f6917e146c27575af4892ff4b997f6697d075dc95a581f4660bb79ec596378e69d1432425
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRx3Qi+PWiJpv:GemTLkNdfE0pZyG

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b7e-3.dat	xmrig
behavioral2/files/0x000a000000023c58-9.dat	xmrig
behavioral2/files/0x0007000000023c72-8.dat	xmrig
behavioral2/files/0x0007000000023c73-18.dat	xmrig
behavioral2/files/0x0007000000023c75-24.dat	xmrig
behavioral2/files/0x0007000000023c76-28.dat	xmrig
behavioral2/files/0x0007000000023c79-45.dat	xmrig
behavioral2/files/0x0007000000023c7a-51.dat	xmrig
behavioral2/files/0x0007000000023c7b-54.dat	xmrig
behavioral2/files/0x0007000000023c7c-61.dat	xmrig
behavioral2/files/0x0007000000023c83-94.dat	xmrig
behavioral2/files/0x0007000000023c84-105.dat	xmrig
behavioral2/files/0x0007000000023c8e-148.dat	xmrig
behavioral2/files/0x0007000000023c92-169.dat	xmrig
behavioral2/files/0x0007000000023c91-167.dat	xmrig
behavioral2/files/0x0007000000023c90-164.dat	xmrig
behavioral2/files/0x0007000000023c8f-159.dat	xmrig
behavioral2/files/0x0007000000023c8d-144.dat	xmrig
behavioral2/files/0x0007000000023c8c-142.dat	xmrig
behavioral2/files/0x0007000000023c8b-140.dat	xmrig
behavioral2/files/0x0007000000023c8a-138.dat	xmrig
behavioral2/files/0x0007000000023c89-136.dat	xmrig
behavioral2/files/0x0007000000023c88-134.dat	xmrig
behavioral2/files/0x0007000000023c87-129.dat	xmrig
behavioral2/files/0x0007000000023c86-127.dat	xmrig
behavioral2/files/0x0007000000023c85-125.dat	xmrig
behavioral2/files/0x0007000000023c82-90.dat	xmrig
behavioral2/files/0x0007000000023c81-88.dat	xmrig
behavioral2/files/0x0007000000023c7e-86.dat	xmrig
behavioral2/files/0x0007000000023c80-84.dat	xmrig
behavioral2/files/0x0007000000023c7f-82.dat	xmrig
behavioral2/files/0x0007000000023c7d-80.dat	xmrig
behavioral2/files/0x0007000000023c78-40.dat	xmrig
behavioral2/files/0x0007000000023c77-35.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4004	khejeGy.exe
2648	dYfVglm.exe
1732	VFCwDZd.exe
4476	vBnnvGn.exe
924	vFTUucn.exe
5064	rUiLxwT.exe
1896	rEZLHBG.exe
3904	kwysRYG.exe
628	GeWwtaz.exe
1172	oCmPzCi.exe
2688	lnOrdtk.exe
2852	BByFfPw.exe
4776	ygwXsQu.exe
4100	ZvXNnIc.exe
2424	pkQiapI.exe
516	gWvgPvE.exe
2368	tQhwMij.exe
3500	WqPSUbE.exe
2680	SIZoOxs.exe
3480	yynJUfI.exe
3240	HDnAXsG.exe
1000	fIawZaJ.exe
4268	sMCVCWT.exe
2604	RycRMMY.exe
3572	xAZfOFe.exe
3636	FLbbumP.exe
2840	glpObYX.exe
4900	expeBmS.exe
2292	POLaoeU.exe
5080	yJaGXfY.exe
4344	faLgQuH.exe
1620	SDFctiu.exe
3836	EeEfWdZ.exe
4372	cprBKuf.exe
1524	HpMBdtM.exe
4208	JQkLdwB.exe
2956	JDYPLNo.exe
3896	PCyqUkH.exe
4992	koEyINQ.exe
3796	zjgQeZp.exe
4500	vAVxGsF.exe
1728	QiQHkLd.exe
5092	LmDluEO.exe
4712	TZeDBIa.exe
4704	aFVOWRT.exe
2460	GEMJUlB.exe
4504	RLSxTyX.exe
4328	ctpynVc.exe
3456	WogJNgI.exe
756	mSUVIMC.exe
4628	jhJBQuA.exe
4736	JNYHMhp.exe
1404	STATGOr.exe
2216	PVIcFBQ.exe
4668	iVooZsf.exe
5020	JxonXWE.exe
3100	JyhAvnB.exe
4912	xzamFnK.exe
3648	PkfwGvY.exe
4332	jVZeTDn.exe
3684	ZIqWtSj.exe
4956	TPVDlah.exe
2268	zjvgDWY.exe
1204	nrlSDdu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vFTUucn.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\goHhoKA.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\RaMBCZY.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\oCmPzCi.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\MyVLZcF.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\pMXztNZ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\dkTDjHS.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\cXrzqDm.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\POLaoeU.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\lWIjNFl.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ItivLTn.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\jqbDVAW.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\cwPRcId.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\caqhKgv.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\grCqpLA.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\hXNdxfA.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\xQrPYKy.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\DtSyjZh.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\wwYhNCc.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\OxdNWYz.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\qSmTzGd.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\TcMQnxW.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\WBEVbRQ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\SJTTfAu.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\RSDGSAV.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\WQSvWce.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\RsfqmeZ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\OssIOJe.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\LTrLbBI.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\bIqbaBJ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\tqYaFZq.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\zuVdgYX.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\bbNLZBZ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\luIgFOp.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\RLSxTyX.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\pibFjnW.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\gkHXXyv.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ZbvgMYm.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\pckFIfH.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\GZFROJF.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\gCdNXqF.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\CLLRGyQ.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\DXqefZV.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\LsctFWj.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\GeoKEnn.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\vxcXOhN.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\SftxNVB.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\RXbeClN.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\lJvRmYW.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\fTOMyad.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\yyLwNwH.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\GHzEOKP.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\ZxiAwfx.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\VeKigmS.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\OHauXvB.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\zHwHzix.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\NXaRNJo.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\dKKyHmD.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\CuNFdRg.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\HDnAXsG.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\WJbYvXL.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\aUYFwqK.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\gRaWehh.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
File created	C:\Windows\System\LhWbZWk.exe	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 4004	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	85
PID 1340 wrote to memory of 4004	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	85
PID 1340 wrote to memory of 2648	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	86
PID 1340 wrote to memory of 2648	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	86
PID 1340 wrote to memory of 1732	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	87
PID 1340 wrote to memory of 1732	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	87
PID 1340 wrote to memory of 4476	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	88
PID 1340 wrote to memory of 4476	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	88
PID 1340 wrote to memory of 924	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	89
PID 1340 wrote to memory of 924	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	89
PID 1340 wrote to memory of 5064	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	90
PID 1340 wrote to memory of 5064	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	90
PID 1340 wrote to memory of 1896	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	91
PID 1340 wrote to memory of 1896	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	91
PID 1340 wrote to memory of 3904	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	92
PID 1340 wrote to memory of 3904	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	92
PID 1340 wrote to memory of 628	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	93
PID 1340 wrote to memory of 628	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	93
PID 1340 wrote to memory of 1172	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	94
PID 1340 wrote to memory of 1172	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	94
PID 1340 wrote to memory of 2688	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	95
PID 1340 wrote to memory of 2688	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	95
PID 1340 wrote to memory of 2852	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	96
PID 1340 wrote to memory of 2852	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	96
PID 1340 wrote to memory of 4100	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	97
PID 1340 wrote to memory of 4100	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	97
PID 1340 wrote to memory of 4776	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	98
PID 1340 wrote to memory of 4776	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	98
PID 1340 wrote to memory of 2424	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	99
PID 1340 wrote to memory of 2424	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	99
PID 1340 wrote to memory of 516	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	100
PID 1340 wrote to memory of 516	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	100
PID 1340 wrote to memory of 2368	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	101
PID 1340 wrote to memory of 2368	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	101
PID 1340 wrote to memory of 3500	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	102
PID 1340 wrote to memory of 3500	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	102
PID 1340 wrote to memory of 2680	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	103
PID 1340 wrote to memory of 2680	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	103
PID 1340 wrote to memory of 3480	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	104
PID 1340 wrote to memory of 3480	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	104
PID 1340 wrote to memory of 3240	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	105
PID 1340 wrote to memory of 3240	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	105
PID 1340 wrote to memory of 1000	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	106
PID 1340 wrote to memory of 1000	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	106
PID 1340 wrote to memory of 4268	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	107
PID 1340 wrote to memory of 4268	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	107
PID 1340 wrote to memory of 2604	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	108
PID 1340 wrote to memory of 2604	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	108
PID 1340 wrote to memory of 3572	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	109
PID 1340 wrote to memory of 3572	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	109
PID 1340 wrote to memory of 3636	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	110
PID 1340 wrote to memory of 3636	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	110
PID 1340 wrote to memory of 2840	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	111
PID 1340 wrote to memory of 2840	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	111
PID 1340 wrote to memory of 4900	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	112
PID 1340 wrote to memory of 4900	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	112
PID 1340 wrote to memory of 2292	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	113
PID 1340 wrote to memory of 2292	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	113
PID 1340 wrote to memory of 5080	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	114
PID 1340 wrote to memory of 5080	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	114
PID 1340 wrote to memory of 4344	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	115
PID 1340 wrote to memory of 4344	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	115
PID 1340 wrote to memory of 1620	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	116
PID 1340 wrote to memory of 1620	1340	46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe	116

C:\Users\Admin\AppData\Local\Temp\46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe
"C:\Users\Admin\AppData\Local\Temp\46afdf940244aebea5dae7a78ee9ed2c1305f890672e572bacb910edacd94f02.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\System\khejeGy.exe
  C:\Windows\System\khejeGy.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\dYfVglm.exe
  C:\Windows\System\dYfVglm.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\VFCwDZd.exe
  C:\Windows\System\VFCwDZd.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\vBnnvGn.exe
  C:\Windows\System\vBnnvGn.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\vFTUucn.exe
  C:\Windows\System\vFTUucn.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\rUiLxwT.exe
  C:\Windows\System\rUiLxwT.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\rEZLHBG.exe
  C:\Windows\System\rEZLHBG.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\kwysRYG.exe
  C:\Windows\System\kwysRYG.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\GeWwtaz.exe
  C:\Windows\System\GeWwtaz.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\oCmPzCi.exe
  C:\Windows\System\oCmPzCi.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\lnOrdtk.exe
  C:\Windows\System\lnOrdtk.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\BByFfPw.exe
  C:\Windows\System\BByFfPw.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\ZvXNnIc.exe
  C:\Windows\System\ZvXNnIc.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\ygwXsQu.exe
  C:\Windows\System\ygwXsQu.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\pkQiapI.exe
  C:\Windows\System\pkQiapI.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\gWvgPvE.exe
  C:\Windows\System\gWvgPvE.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\tQhwMij.exe
  C:\Windows\System\tQhwMij.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\WqPSUbE.exe
  C:\Windows\System\WqPSUbE.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\SIZoOxs.exe
  C:\Windows\System\SIZoOxs.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\yynJUfI.exe
  C:\Windows\System\yynJUfI.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\HDnAXsG.exe
  C:\Windows\System\HDnAXsG.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\fIawZaJ.exe
  C:\Windows\System\fIawZaJ.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\sMCVCWT.exe
  C:\Windows\System\sMCVCWT.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\RycRMMY.exe
  C:\Windows\System\RycRMMY.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\xAZfOFe.exe
  C:\Windows\System\xAZfOFe.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\FLbbumP.exe
  C:\Windows\System\FLbbumP.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\glpObYX.exe
  C:\Windows\System\glpObYX.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\expeBmS.exe
  C:\Windows\System\expeBmS.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\POLaoeU.exe
  C:\Windows\System\POLaoeU.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\yJaGXfY.exe
  C:\Windows\System\yJaGXfY.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\faLgQuH.exe
  C:\Windows\System\faLgQuH.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\SDFctiu.exe
  C:\Windows\System\SDFctiu.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\EeEfWdZ.exe
  C:\Windows\System\EeEfWdZ.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\cprBKuf.exe
  C:\Windows\System\cprBKuf.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\HpMBdtM.exe
  C:\Windows\System\HpMBdtM.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\JQkLdwB.exe
  C:\Windows\System\JQkLdwB.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\JDYPLNo.exe
  C:\Windows\System\JDYPLNo.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\PCyqUkH.exe
  C:\Windows\System\PCyqUkH.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\koEyINQ.exe
  C:\Windows\System\koEyINQ.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\zjgQeZp.exe
  C:\Windows\System\zjgQeZp.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\vAVxGsF.exe
  C:\Windows\System\vAVxGsF.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\QiQHkLd.exe
  C:\Windows\System\QiQHkLd.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\LmDluEO.exe
  C:\Windows\System\LmDluEO.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\TZeDBIa.exe
  C:\Windows\System\TZeDBIa.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\aFVOWRT.exe
  C:\Windows\System\aFVOWRT.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\GEMJUlB.exe
  C:\Windows\System\GEMJUlB.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\RLSxTyX.exe
  C:\Windows\System\RLSxTyX.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\ctpynVc.exe
  C:\Windows\System\ctpynVc.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\WogJNgI.exe
  C:\Windows\System\WogJNgI.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\mSUVIMC.exe
  C:\Windows\System\mSUVIMC.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\jhJBQuA.exe
  C:\Windows\System\jhJBQuA.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\JNYHMhp.exe
  C:\Windows\System\JNYHMhp.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\STATGOr.exe
  C:\Windows\System\STATGOr.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\PVIcFBQ.exe
  C:\Windows\System\PVIcFBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\iVooZsf.exe
  C:\Windows\System\iVooZsf.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\JxonXWE.exe
  C:\Windows\System\JxonXWE.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\JyhAvnB.exe
  C:\Windows\System\JyhAvnB.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\xzamFnK.exe
  C:\Windows\System\xzamFnK.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\PkfwGvY.exe
  C:\Windows\System\PkfwGvY.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\jVZeTDn.exe
  C:\Windows\System\jVZeTDn.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\ZIqWtSj.exe
  C:\Windows\System\ZIqWtSj.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\TPVDlah.exe
  C:\Windows\System\TPVDlah.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\zjvgDWY.exe
  C:\Windows\System\zjvgDWY.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\nrlSDdu.exe
  C:\Windows\System\nrlSDdu.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\GKzppTJ.exe
  C:\Windows\System\GKzppTJ.exe
  2⤵
  PID:3556
- C:\Windows\System\yyLwNwH.exe
  C:\Windows\System\yyLwNwH.exe
  2⤵
  PID:692
- C:\Windows\System\GZFROJF.exe
  C:\Windows\System\GZFROJF.exe
  2⤵
  PID:1688
- C:\Windows\System\tfAafeb.exe
  C:\Windows\System\tfAafeb.exe
  2⤵
  PID:2592
- C:\Windows\System\alrMCBO.exe
  C:\Windows\System\alrMCBO.exe
  2⤵
  PID:4984
- C:\Windows\System\ArbTXVQ.exe
  C:\Windows\System\ArbTXVQ.exe
  2⤵
  PID:4700
- C:\Windows\System\WuAUkoS.exe
  C:\Windows\System\WuAUkoS.exe
  2⤵
  PID:5032
- C:\Windows\System\TcMQnxW.exe
  C:\Windows\System\TcMQnxW.exe
  2⤵
  PID:4460
- C:\Windows\System\WPeVAzh.exe
  C:\Windows\System\WPeVAzh.exe
  2⤵
  PID:4008
- C:\Windows\System\FXkyhhh.exe
  C:\Windows\System\FXkyhhh.exe
  2⤵
  PID:3652
- C:\Windows\System\lorKtal.exe
  C:\Windows\System\lorKtal.exe
  2⤵
  PID:884
- C:\Windows\System\WQSvWce.exe
  C:\Windows\System\WQSvWce.exe
  2⤵
  PID:4492
- C:\Windows\System\vjPSjWf.exe
  C:\Windows\System\vjPSjWf.exe
  2⤵
  PID:3328
- C:\Windows\System\kFolVTJ.exe
  C:\Windows\System\kFolVTJ.exe
  2⤵
  PID:2556
- C:\Windows\System\JHgAKhV.exe
  C:\Windows\System\JHgAKhV.exe
  2⤵
  PID:2904
- C:\Windows\System\NJtAHXT.exe
  C:\Windows\System\NJtAHXT.exe
  2⤵
  PID:1416
- C:\Windows\System\RaEqsBv.exe
  C:\Windows\System\RaEqsBv.exe
  2⤵
  PID:2192
- C:\Windows\System\NEMkdMB.exe
  C:\Windows\System\NEMkdMB.exe
  2⤵
  PID:2124
- C:\Windows\System\uTovXxW.exe
  C:\Windows\System\uTovXxW.exe
  2⤵
  PID:1188
- C:\Windows\System\pKdtDpE.exe
  C:\Windows\System\pKdtDpE.exe
  2⤵
  PID:1536
- C:\Windows\System\OjPzOmM.exe
  C:\Windows\System\OjPzOmM.exe
  2⤵
  PID:3928
- C:\Windows\System\iQKggbg.exe
  C:\Windows\System\iQKggbg.exe
  2⤵
  PID:736
- C:\Windows\System\OzxvRrS.exe
  C:\Windows\System\OzxvRrS.exe
  2⤵
  PID:3232
- C:\Windows\System\NcDtVjX.exe
  C:\Windows\System\NcDtVjX.exe
  2⤵
  PID:3276
- C:\Windows\System\tKVoTEe.exe
  C:\Windows\System\tKVoTEe.exe
  2⤵
  PID:4080
- C:\Windows\System\VxUvJzC.exe
  C:\Windows\System\VxUvJzC.exe
  2⤵
  PID:3960
- C:\Windows\System\CHVekjB.exe
  C:\Windows\System\CHVekjB.exe
  2⤵
  PID:2028
- C:\Windows\System\mNcdSdm.exe
  C:\Windows\System\mNcdSdm.exe
  2⤵
  PID:4944
- C:\Windows\System\SDwLHFL.exe
  C:\Windows\System\SDwLHFL.exe
  2⤵
  PID:3964
- C:\Windows\System\QLSpSEp.exe
  C:\Windows\System\QLSpSEp.exe
  2⤵
  PID:1532
- C:\Windows\System\RtKilnS.exe
  C:\Windows\System\RtKilnS.exe
  2⤵
  PID:1860
- C:\Windows\System\TWrHkrM.exe
  C:\Windows\System\TWrHkrM.exe
  2⤵
  PID:4688
- C:\Windows\System\FqfyZux.exe
  C:\Windows\System\FqfyZux.exe
  2⤵
  PID:2608
- C:\Windows\System\pibFjnW.exe
  C:\Windows\System\pibFjnW.exe
  2⤵
  PID:1744
- C:\Windows\System\AlrQGqJ.exe
  C:\Windows\System\AlrQGqJ.exe
  2⤵
  PID:792
- C:\Windows\System\nZlDUgm.exe
  C:\Windows\System\nZlDUgm.exe
  2⤵
  PID:1696
- C:\Windows\System\Pumsneu.exe
  C:\Windows\System\Pumsneu.exe
  2⤵
  PID:2096
- C:\Windows\System\nYLIWFt.exe
  C:\Windows\System\nYLIWFt.exe
  2⤵
  PID:4748
- C:\Windows\System\MbxjPhv.exe
  C:\Windows\System\MbxjPhv.exe
  2⤵
  PID:4644
- C:\Windows\System\eLjhwfr.exe
  C:\Windows\System\eLjhwfr.exe
  2⤵
  PID:3120
- C:\Windows\System\VFuoDHZ.exe
  C:\Windows\System\VFuoDHZ.exe
  2⤵
  PID:1580
- C:\Windows\System\EslCtBI.exe
  C:\Windows\System\EslCtBI.exe
  2⤵
  PID:5140
- C:\Windows\System\qJDcKQT.exe
  C:\Windows\System\qJDcKQT.exe
  2⤵
  PID:5168
- C:\Windows\System\JlbxGWm.exe
  C:\Windows\System\JlbxGWm.exe
  2⤵
  PID:5200
- C:\Windows\System\AxSKLUv.exe
  C:\Windows\System\AxSKLUv.exe
  2⤵
  PID:5228
- C:\Windows\System\dKKyHmD.exe
  C:\Windows\System\dKKyHmD.exe
  2⤵
  PID:5264
- C:\Windows\System\UgOEamF.exe
  C:\Windows\System\UgOEamF.exe
  2⤵
  PID:5284
- C:\Windows\System\HGeezgj.exe
  C:\Windows\System\HGeezgj.exe
  2⤵
  PID:5312
- C:\Windows\System\xNDclzJ.exe
  C:\Windows\System\xNDclzJ.exe
  2⤵
  PID:5340
- C:\Windows\System\xEONOCQ.exe
  C:\Windows\System\xEONOCQ.exe
  2⤵
  PID:5368
- C:\Windows\System\bsUOueg.exe
  C:\Windows\System\bsUOueg.exe
  2⤵
  PID:5396
- C:\Windows\System\fRGEHDZ.exe
  C:\Windows\System\fRGEHDZ.exe
  2⤵
  PID:5432
- C:\Windows\System\HVWDoIc.exe
  C:\Windows\System\HVWDoIc.exe
  2⤵
  PID:5452
- C:\Windows\System\pckFIfH.exe
  C:\Windows\System\pckFIfH.exe
  2⤵
  PID:5480
- C:\Windows\System\tVJZvHp.exe
  C:\Windows\System\tVJZvHp.exe
  2⤵
  PID:5508
- C:\Windows\System\puXRxNt.exe
  C:\Windows\System\puXRxNt.exe
  2⤵
  PID:5536
- C:\Windows\System\SolFLQz.exe
  C:\Windows\System\SolFLQz.exe
  2⤵
  PID:5564
- C:\Windows\System\HDZmHnl.exe
  C:\Windows\System\HDZmHnl.exe
  2⤵
  PID:5592
- C:\Windows\System\vIxkytS.exe
  C:\Windows\System\vIxkytS.exe
  2⤵
  PID:5624
- C:\Windows\System\QuyhnHS.exe
  C:\Windows\System\QuyhnHS.exe
  2⤵
  PID:5648
- C:\Windows\System\MlJuimj.exe
  C:\Windows\System\MlJuimj.exe
  2⤵
  PID:5676
- C:\Windows\System\KiXVOVZ.exe
  C:\Windows\System\KiXVOVZ.exe
  2⤵
  PID:5704
- C:\Windows\System\llSGDjf.exe
  C:\Windows\System\llSGDjf.exe
  2⤵
  PID:5732
- C:\Windows\System\OUdmBUI.exe
  C:\Windows\System\OUdmBUI.exe
  2⤵
  PID:5748
- C:\Windows\System\KhWNAFh.exe
  C:\Windows\System\KhWNAFh.exe
  2⤵
  PID:5768
- C:\Windows\System\QXMmINr.exe
  C:\Windows\System\QXMmINr.exe
  2⤵
  PID:5792
- C:\Windows\System\KdKuoXN.exe
  C:\Windows\System\KdKuoXN.exe
  2⤵
  PID:5824
- C:\Windows\System\KvoLGaZ.exe
  C:\Windows\System\KvoLGaZ.exe
  2⤵
  PID:5856
- C:\Windows\System\OhjtZFQ.exe
  C:\Windows\System\OhjtZFQ.exe
  2⤵
  PID:5884
- C:\Windows\System\DQYeBZX.exe
  C:\Windows\System\DQYeBZX.exe
  2⤵
  PID:5900
- C:\Windows\System\LhWbZWk.exe
  C:\Windows\System\LhWbZWk.exe
  2⤵
  PID:5920
- C:\Windows\System\OgnYSsZ.exe
  C:\Windows\System\OgnYSsZ.exe
  2⤵
  PID:5940
- C:\Windows\System\RhMEXbn.exe
  C:\Windows\System\RhMEXbn.exe
  2⤵
  PID:5960
- C:\Windows\System\vfnOxuO.exe
  C:\Windows\System\vfnOxuO.exe
  2⤵
  PID:5988
- C:\Windows\System\aUupUVy.exe
  C:\Windows\System\aUupUVy.exe
  2⤵
  PID:6012
- C:\Windows\System\dcVdxIN.exe
  C:\Windows\System\dcVdxIN.exe
  2⤵
  PID:6040
- C:\Windows\System\JXAkmqW.exe
  C:\Windows\System\JXAkmqW.exe
  2⤵
  PID:6060
- C:\Windows\System\RsfqmeZ.exe
  C:\Windows\System\RsfqmeZ.exe
  2⤵
  PID:6092
- C:\Windows\System\DjskpFv.exe
  C:\Windows\System\DjskpFv.exe
  2⤵
  PID:6120
- C:\Windows\System\OssIOJe.exe
  C:\Windows\System\OssIOJe.exe
  2⤵
  PID:6140
- C:\Windows\System\UVWugvJ.exe
  C:\Windows\System\UVWugvJ.exe
  2⤵
  PID:5160
- C:\Windows\System\XlabfDM.exe
  C:\Windows\System\XlabfDM.exe
  2⤵
  PID:5220
- C:\Windows\System\WiriWqX.exe
  C:\Windows\System\WiriWqX.exe
  2⤵
  PID:5296
- C:\Windows\System\SMWkFIw.exe
  C:\Windows\System\SMWkFIw.exe
  2⤵
  PID:5364
- C:\Windows\System\pzPzeuE.exe
  C:\Windows\System\pzPzeuE.exe
  2⤵
  PID:5408
- C:\Windows\System\DVerGkk.exe
  C:\Windows\System\DVerGkk.exe
  2⤵
  PID:5448
- C:\Windows\System\HIzbVTK.exe
  C:\Windows\System\HIzbVTK.exe
  2⤵
  PID:5520
- C:\Windows\System\VBYlcPK.exe
  C:\Windows\System\VBYlcPK.exe
  2⤵
  PID:5576
- C:\Windows\System\nFzcFDb.exe
  C:\Windows\System\nFzcFDb.exe
  2⤵
  PID:5660
- C:\Windows\System\kbdQKGV.exe
  C:\Windows\System\kbdQKGV.exe
  2⤵
  PID:5744
- C:\Windows\System\pyaOPgm.exe
  C:\Windows\System\pyaOPgm.exe
  2⤵
  PID:5864
- C:\Windows\System\xnrrwvk.exe
  C:\Windows\System\xnrrwvk.exe
  2⤵
  PID:5956
- C:\Windows\System\xQraVqd.exe
  C:\Windows\System\xQraVqd.exe
  2⤵
  PID:6000
- C:\Windows\System\xLQjlJT.exe
  C:\Windows\System\xLQjlJT.exe
  2⤵
  PID:6080
- C:\Windows\System\CKcCyzR.exe
  C:\Windows\System\CKcCyzR.exe
  2⤵
  PID:6052
- C:\Windows\System\chfONVZ.exe
  C:\Windows\System\chfONVZ.exe
  2⤵
  PID:5132
- C:\Windows\System\IwiUMDB.exe
  C:\Windows\System\IwiUMDB.exe
  2⤵
  PID:5352
- C:\Windows\System\rPQfPtI.exe
  C:\Windows\System\rPQfPtI.exe
  2⤵
  PID:5472
- C:\Windows\System\JZxbthW.exe
  C:\Windows\System\JZxbthW.exe
  2⤵
  PID:5604
- C:\Windows\System\qQEyQHg.exe
  C:\Windows\System\qQEyQHg.exe
  2⤵
  PID:5896
- C:\Windows\System\gjNxAQU.exe
  C:\Windows\System\gjNxAQU.exe
  2⤵
  PID:5908
- C:\Windows\System\dMzMMlU.exe
  C:\Windows\System\dMzMMlU.exe
  2⤵
  PID:6056
- C:\Windows\System\eXFGjlQ.exe
  C:\Windows\System\eXFGjlQ.exe
  2⤵
  PID:5556
- C:\Windows\System\preopLX.exe
  C:\Windows\System\preopLX.exe
  2⤵
  PID:5420
- C:\Windows\System\sQODctW.exe
  C:\Windows\System\sQODctW.exe
  2⤵
  PID:5152
- C:\Windows\System\rWXGdAp.exe
  C:\Windows\System\rWXGdAp.exe
  2⤵
  PID:6168
- C:\Windows\System\RTQwoZD.exe
  C:\Windows\System\RTQwoZD.exe
  2⤵
  PID:6204
- C:\Windows\System\aunGfkc.exe
  C:\Windows\System\aunGfkc.exe
  2⤵
  PID:6224
- C:\Windows\System\WQomvIv.exe
  C:\Windows\System\WQomvIv.exe
  2⤵
  PID:6260
- C:\Windows\System\LKeWKeJ.exe
  C:\Windows\System\LKeWKeJ.exe
  2⤵
  PID:6292
- C:\Windows\System\lMZlulf.exe
  C:\Windows\System\lMZlulf.exe
  2⤵
  PID:6324
- C:\Windows\System\SiPPgYM.exe
  C:\Windows\System\SiPPgYM.exe
  2⤵
  PID:6356
- C:\Windows\System\yTspBNb.exe
  C:\Windows\System\yTspBNb.exe
  2⤵
  PID:6392
- C:\Windows\System\QdUDxux.exe
  C:\Windows\System\QdUDxux.exe
  2⤵
  PID:6420
- C:\Windows\System\bvVfjIf.exe
  C:\Windows\System\bvVfjIf.exe
  2⤵
  PID:6448
- C:\Windows\System\UGCFBKW.exe
  C:\Windows\System\UGCFBKW.exe
  2⤵
  PID:6484
- C:\Windows\System\xSCjkSd.exe
  C:\Windows\System\xSCjkSd.exe
  2⤵
  PID:6504
- C:\Windows\System\BUHSrQr.exe
  C:\Windows\System\BUHSrQr.exe
  2⤵
  PID:6536
- C:\Windows\System\frwBcdv.exe
  C:\Windows\System\frwBcdv.exe
  2⤵
  PID:6572
- C:\Windows\System\BnosSWu.exe
  C:\Windows\System\BnosSWu.exe
  2⤵
  PID:6600
- C:\Windows\System\tVZkqdK.exe
  C:\Windows\System\tVZkqdK.exe
  2⤵
  PID:6628
- C:\Windows\System\lvJHHxD.exe
  C:\Windows\System\lvJHHxD.exe
  2⤵
  PID:6656
- C:\Windows\System\QxkBkpu.exe
  C:\Windows\System\QxkBkpu.exe
  2⤵
  PID:6684
- C:\Windows\System\wBqGSbe.exe
  C:\Windows\System\wBqGSbe.exe
  2⤵
  PID:6712
- C:\Windows\System\wZYGJsb.exe
  C:\Windows\System\wZYGJsb.exe
  2⤵
  PID:6740
- C:\Windows\System\gbvWzPp.exe
  C:\Windows\System\gbvWzPp.exe
  2⤵
  PID:6768
- C:\Windows\System\EVYfkXH.exe
  C:\Windows\System\EVYfkXH.exe
  2⤵
  PID:6792
- C:\Windows\System\dcfhCZs.exe
  C:\Windows\System\dcfhCZs.exe
  2⤵
  PID:6824
- C:\Windows\System\kCElHKS.exe
  C:\Windows\System\kCElHKS.exe
  2⤵
  PID:6848
- C:\Windows\System\yziqpgn.exe
  C:\Windows\System\yziqpgn.exe
  2⤵
  PID:6880
- C:\Windows\System\blrDIqT.exe
  C:\Windows\System\blrDIqT.exe
  2⤵
  PID:6912
- C:\Windows\System\AsHDRFr.exe
  C:\Windows\System\AsHDRFr.exe
  2⤵
  PID:6936
- C:\Windows\System\ytxDFeF.exe
  C:\Windows\System\ytxDFeF.exe
  2⤵
  PID:6964
- C:\Windows\System\krUgrpK.exe
  C:\Windows\System\krUgrpK.exe
  2⤵
  PID:6992
- C:\Windows\System\mugGjcz.exe
  C:\Windows\System\mugGjcz.exe
  2⤵
  PID:7020
- C:\Windows\System\yokIwwr.exe
  C:\Windows\System\yokIwwr.exe
  2⤵
  PID:7056
- C:\Windows\System\qAypWgz.exe
  C:\Windows\System\qAypWgz.exe
  2⤵
  PID:7080
- C:\Windows\System\FfsGYob.exe
  C:\Windows\System\FfsGYob.exe
  2⤵
  PID:7104
- C:\Windows\System\eVpBlNt.exe
  C:\Windows\System\eVpBlNt.exe
  2⤵
  PID:7132
- C:\Windows\System\eqipwAW.exe
  C:\Windows\System\eqipwAW.exe
  2⤵
  PID:7152
- C:\Windows\System\YWTzqDX.exe
  C:\Windows\System\YWTzqDX.exe
  2⤵
  PID:6156
- C:\Windows\System\cMZGrsq.exe
  C:\Windows\System\cMZGrsq.exe
  2⤵
  PID:6196
- C:\Windows\System\jFabJUC.exe
  C:\Windows\System\jFabJUC.exe
  2⤵
  PID:6304
- C:\Windows\System\buoBuxT.exe
  C:\Windows\System\buoBuxT.exe
  2⤵
  PID:6316
- C:\Windows\System\YmvlUpD.exe
  C:\Windows\System\YmvlUpD.exe
  2⤵
  PID:6404
- C:\Windows\System\ujJfTrr.exe
  C:\Windows\System\ujJfTrr.exe
  2⤵
  PID:6460
- C:\Windows\System\WtMxQFj.exe
  C:\Windows\System\WtMxQFj.exe
  2⤵
  PID:6524
- C:\Windows\System\ZMGyEGa.exe
  C:\Windows\System\ZMGyEGa.exe
  2⤵
  PID:6620
- C:\Windows\System\hHxztMk.exe
  C:\Windows\System\hHxztMk.exe
  2⤵
  PID:6648
- C:\Windows\System\XYEtdJd.exe
  C:\Windows\System\XYEtdJd.exe
  2⤵
  PID:6696
- C:\Windows\System\GeoKEnn.exe
  C:\Windows\System\GeoKEnn.exe
  2⤵
  PID:6756
- C:\Windows\System\llFKBFA.exe
  C:\Windows\System\llFKBFA.exe
  2⤵
  PID:6872
- C:\Windows\System\cGMuaBd.exe
  C:\Windows\System\cGMuaBd.exe
  2⤵
  PID:6892
- C:\Windows\System\ktcpRLS.exe
  C:\Windows\System\ktcpRLS.exe
  2⤵
  PID:6956
- C:\Windows\System\gUsLFjH.exe
  C:\Windows\System\gUsLFjH.exe
  2⤵
  PID:7032
- C:\Windows\System\xqogZQq.exe
  C:\Windows\System\xqogZQq.exe
  2⤵
  PID:7088
- C:\Windows\System\wYLIlMi.exe
  C:\Windows\System\wYLIlMi.exe
  2⤵
  PID:5380
- C:\Windows\System\DRqHwxz.exe
  C:\Windows\System\DRqHwxz.exe
  2⤵
  PID:6340
- C:\Windows\System\sUVMDjm.exe
  C:\Windows\System\sUVMDjm.exe
  2⤵
  PID:6444
- C:\Windows\System\NzziIVl.exe
  C:\Windows\System\NzziIVl.exe
  2⤵
  PID:6680
- C:\Windows\System\lHYkbQL.exe
  C:\Windows\System\lHYkbQL.exe
  2⤵
  PID:6728
- C:\Windows\System\VbXVZkE.exe
  C:\Windows\System\VbXVZkE.exe
  2⤵
  PID:6836
- C:\Windows\System\moXzdVS.exe
  C:\Windows\System\moXzdVS.exe
  2⤵
  PID:5548
- C:\Windows\System\gkHXXyv.exe
  C:\Windows\System\gkHXXyv.exe
  2⤵
  PID:6288
- C:\Windows\System\ulpGoQs.exe
  C:\Windows\System\ulpGoQs.exe
  2⤵
  PID:6584
- C:\Windows\System\xFOPRRR.exe
  C:\Windows\System\xFOPRRR.exe
  2⤵
  PID:6984
- C:\Windows\System\vxcXOhN.exe
  C:\Windows\System\vxcXOhN.exe
  2⤵
  PID:6348
- C:\Windows\System\IXvCcIj.exe
  C:\Windows\System\IXvCcIj.exe
  2⤵
  PID:6436
- C:\Windows\System\CppwKLA.exe
  C:\Windows\System\CppwKLA.exe
  2⤵
  PID:7204
- C:\Windows\System\bIqbaBJ.exe
  C:\Windows\System\bIqbaBJ.exe
  2⤵
  PID:7220
- C:\Windows\System\fZmgXwu.exe
  C:\Windows\System\fZmgXwu.exe
  2⤵
  PID:7260
- C:\Windows\System\EszpQSP.exe
  C:\Windows\System\EszpQSP.exe
  2⤵
  PID:7292
- C:\Windows\System\xQrPYKy.exe
  C:\Windows\System\xQrPYKy.exe
  2⤵
  PID:7320
- C:\Windows\System\vnSRlOV.exe
  C:\Windows\System\vnSRlOV.exe
  2⤵
  PID:7344
- C:\Windows\System\xsvOiYb.exe
  C:\Windows\System\xsvOiYb.exe
  2⤵
  PID:7376
- C:\Windows\System\xvSgwGJ.exe
  C:\Windows\System\xvSgwGJ.exe
  2⤵
  PID:7404
- C:\Windows\System\CTJthry.exe
  C:\Windows\System\CTJthry.exe
  2⤵
  PID:7436
- C:\Windows\System\eKYNinm.exe
  C:\Windows\System\eKYNinm.exe
  2⤵
  PID:7464
- C:\Windows\System\TVihRkM.exe
  C:\Windows\System\TVihRkM.exe
  2⤵
  PID:7484
- C:\Windows\System\uwOkoDc.exe
  C:\Windows\System\uwOkoDc.exe
  2⤵
  PID:7516
- C:\Windows\System\XYqkCHA.exe
  C:\Windows\System\XYqkCHA.exe
  2⤵
  PID:7540
- C:\Windows\System\QuBcGRN.exe
  C:\Windows\System\QuBcGRN.exe
  2⤵
  PID:7568
- C:\Windows\System\HSjTimv.exe
  C:\Windows\System\HSjTimv.exe
  2⤵
  PID:7596
- C:\Windows\System\FQbPwBR.exe
  C:\Windows\System\FQbPwBR.exe
  2⤵
  PID:7624
- C:\Windows\System\HioGZBn.exe
  C:\Windows\System\HioGZBn.exe
  2⤵
  PID:7652
- C:\Windows\System\LWehBIQ.exe
  C:\Windows\System\LWehBIQ.exe
  2⤵
  PID:7688
- C:\Windows\System\pJQahbW.exe
  C:\Windows\System\pJQahbW.exe
  2⤵
  PID:7712
- C:\Windows\System\exlmhOr.exe
  C:\Windows\System\exlmhOr.exe
  2⤵
  PID:7744
- C:\Windows\System\LNMUaPB.exe
  C:\Windows\System\LNMUaPB.exe
  2⤵
  PID:7776
- C:\Windows\System\vCKlNBP.exe
  C:\Windows\System\vCKlNBP.exe
  2⤵
  PID:7792
- C:\Windows\System\GORHBjg.exe
  C:\Windows\System\GORHBjg.exe
  2⤵
  PID:7808
- C:\Windows\System\MAuussY.exe
  C:\Windows\System\MAuussY.exe
  2⤵
  PID:7832
- C:\Windows\System\YQWqTTo.exe
  C:\Windows\System\YQWqTTo.exe
  2⤵
  PID:7860
- C:\Windows\System\DnJaotB.exe
  C:\Windows\System\DnJaotB.exe
  2⤵
  PID:7888
- C:\Windows\System\pMmKqnV.exe
  C:\Windows\System\pMmKqnV.exe
  2⤵
  PID:7920
- C:\Windows\System\hnRSNfr.exe
  C:\Windows\System\hnRSNfr.exe
  2⤵
  PID:7940
- C:\Windows\System\tksVMRh.exe
  C:\Windows\System\tksVMRh.exe
  2⤵
  PID:7960
- C:\Windows\System\jvvlAZL.exe
  C:\Windows\System\jvvlAZL.exe
  2⤵
  PID:7984
- C:\Windows\System\ElUbpZL.exe
  C:\Windows\System\ElUbpZL.exe
  2⤵
  PID:8016
- C:\Windows\System\NvpaoGc.exe
  C:\Windows\System\NvpaoGc.exe
  2⤵
  PID:8048
- C:\Windows\System\FazWqUz.exe
  C:\Windows\System\FazWqUz.exe
  2⤵
  PID:8096
- C:\Windows\System\DWVHAYP.exe
  C:\Windows\System\DWVHAYP.exe
  2⤵
  PID:8116
- C:\Windows\System\zpSewjg.exe
  C:\Windows\System\zpSewjg.exe
  2⤵
  PID:8156
- C:\Windows\System\WJbYvXL.exe
  C:\Windows\System\WJbYvXL.exe
  2⤵
  PID:8176
- C:\Windows\System\CtDOJpv.exe
  C:\Windows\System\CtDOJpv.exe
  2⤵
  PID:7184
- C:\Windows\System\FGaglOU.exe
  C:\Windows\System\FGaglOU.exe
  2⤵
  PID:7248
- C:\Windows\System\SBoBFDi.exe
  C:\Windows\System\SBoBFDi.exe
  2⤵
  PID:7280
- C:\Windows\System\sohnVaL.exe
  C:\Windows\System\sohnVaL.exe
  2⤵
  PID:7356
- C:\Windows\System\TNnKwLT.exe
  C:\Windows\System\TNnKwLT.exe
  2⤵
  PID:7428
- C:\Windows\System\VotTSFF.exe
  C:\Windows\System\VotTSFF.exe
  2⤵
  PID:7472
- C:\Windows\System\GLCWDdG.exe
  C:\Windows\System\GLCWDdG.exe
  2⤵
  PID:7528
- C:\Windows\System\GuJOqTd.exe
  C:\Windows\System\GuJOqTd.exe
  2⤵
  PID:7580
- C:\Windows\System\xOJNyfn.exe
  C:\Windows\System\xOJNyfn.exe
  2⤵
  PID:7664
- C:\Windows\System\xJGhkqT.exe
  C:\Windows\System\xJGhkqT.exe
  2⤵
  PID:7764
- C:\Windows\System\qqFYACt.exe
  C:\Windows\System\qqFYACt.exe
  2⤵
  PID:7788
- C:\Windows\System\lWIjNFl.exe
  C:\Windows\System\lWIjNFl.exe
  2⤵
  PID:7844
- C:\Windows\System\CtlXEbc.exe
  C:\Windows\System\CtlXEbc.exe
  2⤵
  PID:7928
- C:\Windows\System\EGAzeVX.exe
  C:\Windows\System\EGAzeVX.exe
  2⤵
  PID:7912
- C:\Windows\System\rOWpYPy.exe
  C:\Windows\System\rOWpYPy.exe
  2⤵
  PID:7992
- C:\Windows\System\gDdUuFO.exe
  C:\Windows\System\gDdUuFO.exe
  2⤵
  PID:8036
- C:\Windows\System\kokgDVS.exe
  C:\Windows\System\kokgDVS.exe
  2⤵
  PID:8128
- C:\Windows\System\YdrZMgj.exe
  C:\Windows\System\YdrZMgj.exe
  2⤵
  PID:7160
- C:\Windows\System\poyhsnL.exe
  C:\Windows\System\poyhsnL.exe
  2⤵
  PID:7368
- C:\Windows\System\iVlTBiQ.exe
  C:\Windows\System\iVlTBiQ.exe
  2⤵
  PID:7412
- C:\Windows\System\IgyjqFi.exe
  C:\Windows\System\IgyjqFi.exe
  2⤵
  PID:7508
- C:\Windows\System\mzDnthE.exe
  C:\Windows\System\mzDnthE.exe
  2⤵
  PID:7768
- C:\Windows\System\fUCzoyO.exe
  C:\Windows\System\fUCzoyO.exe
  2⤵
  PID:7908
- C:\Windows\System\ASlDPYz.exe
  C:\Windows\System\ASlDPYz.exe
  2⤵
  PID:6760
- C:\Windows\System\YCCpZdc.exe
  C:\Windows\System\YCCpZdc.exe
  2⤵
  PID:7620
- C:\Windows\System\LkFtEEW.exe
  C:\Windows\System\LkFtEEW.exe
  2⤵
  PID:7532
- C:\Windows\System\tMOYScI.exe
  C:\Windows\System\tMOYScI.exe
  2⤵
  PID:8204
- C:\Windows\System\cOxWEnC.exe
  C:\Windows\System\cOxWEnC.exe
  2⤵
  PID:8224
- C:\Windows\System\LTrLbBI.exe
  C:\Windows\System\LTrLbBI.exe
  2⤵
  PID:8252
- C:\Windows\System\AFOgqAt.exe
  C:\Windows\System\AFOgqAt.exe
  2⤵
  PID:8280
- C:\Windows\System\OnFVVVg.exe
  C:\Windows\System\OnFVVVg.exe
  2⤵
  PID:8312
- C:\Windows\System\YRlbaPL.exe
  C:\Windows\System\YRlbaPL.exe
  2⤵
  PID:8356
- C:\Windows\System\rufZwpD.exe
  C:\Windows\System\rufZwpD.exe
  2⤵
  PID:8380
- C:\Windows\System\SWIuxyW.exe
  C:\Windows\System\SWIuxyW.exe
  2⤵
  PID:8408
- C:\Windows\System\SvwsaLs.exe
  C:\Windows\System\SvwsaLs.exe
  2⤵
  PID:8428
- C:\Windows\System\kqCaySp.exe
  C:\Windows\System\kqCaySp.exe
  2⤵
  PID:8448
- C:\Windows\System\fkJYhsy.exe
  C:\Windows\System\fkJYhsy.exe
  2⤵
  PID:8480
- C:\Windows\System\tPtXuFq.exe
  C:\Windows\System\tPtXuFq.exe
  2⤵
  PID:8508
- C:\Windows\System\DntQtRd.exe
  C:\Windows\System\DntQtRd.exe
  2⤵
  PID:8540
- C:\Windows\System\WBEVbRQ.exe
  C:\Windows\System\WBEVbRQ.exe
  2⤵
  PID:8568
- C:\Windows\System\IFgxqRT.exe
  C:\Windows\System\IFgxqRT.exe
  2⤵
  PID:8600
- C:\Windows\System\hZbeNRz.exe
  C:\Windows\System\hZbeNRz.exe
  2⤵
  PID:8636
- C:\Windows\System\ljRorrI.exe
  C:\Windows\System\ljRorrI.exe
  2⤵
  PID:8664
- C:\Windows\System\OIKuIFE.exe
  C:\Windows\System\OIKuIFE.exe
  2⤵
  PID:8704
- C:\Windows\System\GOOOxoc.exe
  C:\Windows\System\GOOOxoc.exe
  2⤵
  PID:8732
- C:\Windows\System\xtEwBuQ.exe
  C:\Windows\System\xtEwBuQ.exe
  2⤵
  PID:8748
- C:\Windows\System\OcioDiZ.exe
  C:\Windows\System\OcioDiZ.exe
  2⤵
  PID:8780
- C:\Windows\System\lurxlVS.exe
  C:\Windows\System\lurxlVS.exe
  2⤵
  PID:8808
- C:\Windows\System\jNqBdYb.exe
  C:\Windows\System\jNqBdYb.exe
  2⤵
  PID:8832
- C:\Windows\System\JKhPqvG.exe
  C:\Windows\System\JKhPqvG.exe
  2⤵
  PID:8864
- C:\Windows\System\aJReSyP.exe
  C:\Windows\System\aJReSyP.exe
  2⤵
  PID:8888
- C:\Windows\System\vouzooL.exe
  C:\Windows\System\vouzooL.exe
  2⤵
  PID:8928
- C:\Windows\System\GIPHezo.exe
  C:\Windows\System\GIPHezo.exe
  2⤵
  PID:8956
- C:\Windows\System\pzBfJLu.exe
  C:\Windows\System\pzBfJLu.exe
  2⤵
  PID:8984
- C:\Windows\System\ODKUOaR.exe
  C:\Windows\System\ODKUOaR.exe
  2⤵
  PID:9024
- C:\Windows\System\YIWHNKT.exe
  C:\Windows\System\YIWHNKT.exe
  2⤵
  PID:9044
- C:\Windows\System\hXknopt.exe
  C:\Windows\System\hXknopt.exe
  2⤵
  PID:9068
- C:\Windows\System\ANVIjIl.exe
  C:\Windows\System\ANVIjIl.exe
  2⤵
  PID:9096
- C:\Windows\System\LRkSuSs.exe
  C:\Windows\System\LRkSuSs.exe
  2⤵
  PID:9128
- C:\Windows\System\lmETuyZ.exe
  C:\Windows\System\lmETuyZ.exe
  2⤵
  PID:9164
- C:\Windows\System\CESViDp.exe
  C:\Windows\System\CESViDp.exe
  2⤵
  PID:9192
- C:\Windows\System\hlQFnRO.exe
  C:\Windows\System\hlQFnRO.exe
  2⤵
  PID:7424
- C:\Windows\System\YscPdLe.exe
  C:\Windows\System\YscPdLe.exe
  2⤵
  PID:7308
- C:\Windows\System\DqbNbqy.exe
  C:\Windows\System\DqbNbqy.exe
  2⤵
  PID:8216
- C:\Windows\System\xfsmeez.exe
  C:\Windows\System\xfsmeez.exe
  2⤵
  PID:8220
- C:\Windows\System\BuSNOvY.exe
  C:\Windows\System\BuSNOvY.exe
  2⤵
  PID:8328
- C:\Windows\System\CuNFdRg.exe
  C:\Windows\System\CuNFdRg.exe
  2⤵
  PID:8340
- C:\Windows\System\xeUJeYr.exe
  C:\Windows\System\xeUJeYr.exe
  2⤵
  PID:8404
- C:\Windows\System\ENDqhkc.exe
  C:\Windows\System\ENDqhkc.exe
  2⤵
  PID:8472
- C:\Windows\System\opHQHkL.exe
  C:\Windows\System\opHQHkL.exe
  2⤵
  PID:8492
- C:\Windows\System\uVmbsvR.exe
  C:\Windows\System\uVmbsvR.exe
  2⤵
  PID:8576
- C:\Windows\System\qNTtNIV.exe
  C:\Windows\System\qNTtNIV.exe
  2⤵
  PID:8696
- C:\Windows\System\ZIpSKAx.exe
  C:\Windows\System\ZIpSKAx.exe
  2⤵
  PID:8684
- C:\Windows\System\EDfITWu.exe
  C:\Windows\System\EDfITWu.exe
  2⤵
  PID:8804
- C:\Windows\System\VssooZQ.exe
  C:\Windows\System\VssooZQ.exe
  2⤵
  PID:8908
- C:\Windows\System\KCUNGmh.exe
  C:\Windows\System\KCUNGmh.exe
  2⤵
  PID:8952
- C:\Windows\System\fhUOtAo.exe
  C:\Windows\System\fhUOtAo.exe
  2⤵
  PID:8968
- C:\Windows\System\ZLBSNpX.exe
  C:\Windows\System\ZLBSNpX.exe
  2⤵
  PID:9052
- C:\Windows\System\iUzbqld.exe
  C:\Windows\System\iUzbqld.exe
  2⤵
  PID:9108
- C:\Windows\System\dilWwOL.exe
  C:\Windows\System\dilWwOL.exe
  2⤵
  PID:9180
- C:\Windows\System\wfOoIel.exe
  C:\Windows\System\wfOoIel.exe
  2⤵
  PID:7804
- C:\Windows\System\zubHnsl.exe
  C:\Windows\System\zubHnsl.exe
  2⤵
  PID:8248
- C:\Windows\System\wGhlVya.exe
  C:\Windows\System\wGhlVya.exe
  2⤵
  PID:8272
- C:\Windows\System\HyLthiT.exe
  C:\Windows\System\HyLthiT.exe
  2⤵
  PID:8620
- C:\Windows\System\RvaxKVK.exe
  C:\Windows\System\RvaxKVK.exe
  2⤵
  PID:8772
- C:\Windows\System\MDrezsT.exe
  C:\Windows\System\MDrezsT.exe
  2⤵
  PID:8724
- C:\Windows\System\QqGdJGs.exe
  C:\Windows\System\QqGdJGs.exe
  2⤵
  PID:8972
- C:\Windows\System\KhqFjng.exe
  C:\Windows\System\KhqFjng.exe
  2⤵
  PID:9208
- C:\Windows\System\myRUhBv.exe
  C:\Windows\System\myRUhBv.exe
  2⤵
  PID:9084
- C:\Windows\System\LRvmeXN.exe
  C:\Windows\System\LRvmeXN.exe
  2⤵
  PID:8672
- C:\Windows\System\dVbGinb.exe
  C:\Windows\System\dVbGinb.exe
  2⤵
  PID:8468
- C:\Windows\System\HBMSzfk.exe
  C:\Windows\System\HBMSzfk.exe
  2⤵
  PID:9232
- C:\Windows\System\pzQmdCw.exe
  C:\Windows\System\pzQmdCw.exe
  2⤵
  PID:9252
- C:\Windows\System\wOLGAoX.exe
  C:\Windows\System\wOLGAoX.exe
  2⤵
  PID:9284
- C:\Windows\System\ZQyXVMV.exe
  C:\Windows\System\ZQyXVMV.exe
  2⤵
  PID:9304
- C:\Windows\System\rTLYrAM.exe
  C:\Windows\System\rTLYrAM.exe
  2⤵
  PID:9328
- C:\Windows\System\ypMXOWl.exe
  C:\Windows\System\ypMXOWl.exe
  2⤵
  PID:9364
- C:\Windows\System\WnuuYZz.exe
  C:\Windows\System\WnuuYZz.exe
  2⤵
  PID:9400
- C:\Windows\System\aDFeCJu.exe
  C:\Windows\System\aDFeCJu.exe
  2⤵
  PID:9440
- C:\Windows\System\LmnUqEk.exe
  C:\Windows\System\LmnUqEk.exe
  2⤵
  PID:9468
- C:\Windows\System\vcslCZH.exe
  C:\Windows\System\vcslCZH.exe
  2⤵
  PID:9500
- C:\Windows\System\AwvzMZk.exe
  C:\Windows\System\AwvzMZk.exe
  2⤵
  PID:9532
- C:\Windows\System\TNNvoAh.exe
  C:\Windows\System\TNNvoAh.exe
  2⤵
  PID:9560
- C:\Windows\System\pyKlpiI.exe
  C:\Windows\System\pyKlpiI.exe
  2⤵
  PID:9588
- C:\Windows\System\SVPHJEI.exe
  C:\Windows\System\SVPHJEI.exe
  2⤵
  PID:9608
- C:\Windows\System\DiLeAJr.exe
  C:\Windows\System\DiLeAJr.exe
  2⤵
  PID:9644
- C:\Windows\System\VRWUFkS.exe
  C:\Windows\System\VRWUFkS.exe
  2⤵
  PID:9692
- C:\Windows\System\WbOPvjK.exe
  C:\Windows\System\WbOPvjK.exe
  2⤵
  PID:9720
- C:\Windows\System\ErbNhPj.exe
  C:\Windows\System\ErbNhPj.exe
  2⤵
  PID:9752
- C:\Windows\System\TsgTToo.exe
  C:\Windows\System\TsgTToo.exe
  2⤵
  PID:9772
- C:\Windows\System\HMoPgCA.exe
  C:\Windows\System\HMoPgCA.exe
  2⤵
  PID:9800
- C:\Windows\System\PiBKkoB.exe
  C:\Windows\System\PiBKkoB.exe
  2⤵
  PID:9824
- C:\Windows\System\jINMzvM.exe
  C:\Windows\System\jINMzvM.exe
  2⤵
  PID:9856
- C:\Windows\System\JsigbYu.exe
  C:\Windows\System\JsigbYu.exe
  2⤵
  PID:9892
- C:\Windows\System\sJITbVO.exe
  C:\Windows\System\sJITbVO.exe
  2⤵
  PID:9924
- C:\Windows\System\SIEQnuN.exe
  C:\Windows\System\SIEQnuN.exe
  2⤵
  PID:9956
- C:\Windows\System\SyriZrY.exe
  C:\Windows\System\SyriZrY.exe
  2⤵
  PID:9992
- C:\Windows\System\vKSAcCP.exe
  C:\Windows\System\vKSAcCP.exe
  2⤵
  PID:10008
- C:\Windows\System\vZTccKl.exe
  C:\Windows\System\vZTccKl.exe
  2⤵
  PID:10044
- C:\Windows\System\xOTjZbd.exe
  C:\Windows\System\xOTjZbd.exe
  2⤵
  PID:10072
- C:\Windows\System\VhFKDXf.exe
  C:\Windows\System\VhFKDXf.exe
  2⤵
  PID:10096
- C:\Windows\System\MUWKVrw.exe
  C:\Windows\System\MUWKVrw.exe
  2⤵
  PID:10112
- C:\Windows\System\IzPkALq.exe
  C:\Windows\System\IzPkALq.exe
  2⤵
  PID:10132
- C:\Windows\System\khzSWPo.exe
  C:\Windows\System\khzSWPo.exe
  2⤵
  PID:10164
- C:\Windows\System\WpZSheM.exe
  C:\Windows\System\WpZSheM.exe
  2⤵
  PID:10192
- C:\Windows\System\jzoHQkI.exe
  C:\Windows\System\jzoHQkI.exe
  2⤵
  PID:10228
- C:\Windows\System\pHLFgQj.exe
  C:\Windows\System\pHLFgQj.exe
  2⤵
  PID:8916
- C:\Windows\System\PNvJqVp.exe
  C:\Windows\System\PNvJqVp.exe
  2⤵
  PID:9228
- C:\Windows\System\IyqLowl.exe
  C:\Windows\System\IyqLowl.exe
  2⤵
  PID:9220
- C:\Windows\System\yfJArUc.exe
  C:\Windows\System\yfJArUc.exe
  2⤵
  PID:9264
- C:\Windows\System\BJUIVXj.exe
  C:\Windows\System\BJUIVXj.exe
  2⤵
  PID:9316
- C:\Windows\System\CzTUhES.exe
  C:\Windows\System\CzTUhES.exe
  2⤵
  PID:9524
- C:\Windows\System\SftxNVB.exe
  C:\Windows\System\SftxNVB.exe
  2⤵
  PID:9572
- C:\Windows\System\XViuhlv.exe
  C:\Windows\System\XViuhlv.exe
  2⤵
  PID:9604
- C:\Windows\System\PCOIIHL.exe
  C:\Windows\System\PCOIIHL.exe
  2⤵
  PID:9676
- C:\Windows\System\HigrUFi.exe
  C:\Windows\System\HigrUFi.exe
  2⤵
  PID:9740
- C:\Windows\System\VDORTej.exe
  C:\Windows\System\VDORTej.exe
  2⤵
  PID:9820
- C:\Windows\System\aTTRHeS.exe
  C:\Windows\System\aTTRHeS.exe
  2⤵
  PID:9836
- C:\Windows\System\OvfzgIB.exe
  C:\Windows\System\OvfzgIB.exe
  2⤵
  PID:9964
- C:\Windows\System\vppECwB.exe
  C:\Windows\System\vppECwB.exe
  2⤵
  PID:10060
- C:\Windows\System\CrbhnpZ.exe
  C:\Windows\System\CrbhnpZ.exe
  2⤵
  PID:10080
- C:\Windows\System\ZzTayTq.exe
  C:\Windows\System\ZzTayTq.exe
  2⤵
  PID:10156
- C:\Windows\System\ZdMyNxm.exe
  C:\Windows\System\ZdMyNxm.exe
  2⤵
  PID:9148
- C:\Windows\System\YyMSGLp.exe
  C:\Windows\System\YyMSGLp.exe
  2⤵
  PID:8820
- C:\Windows\System\zqeRymH.exe
  C:\Windows\System\zqeRymH.exe
  2⤵
  PID:8768
- C:\Windows\System\ItivLTn.exe
  C:\Windows\System\ItivLTn.exe
  2⤵
  PID:9452
- C:\Windows\System\tdUjKpW.exe
  C:\Windows\System\tdUjKpW.exe
  2⤵
  PID:4980
- C:\Windows\System\VEvPyOM.exe
  C:\Windows\System\VEvPyOM.exe
  2⤵
  PID:9464
- C:\Windows\System\RLtBFpj.exe
  C:\Windows\System\RLtBFpj.exe
  2⤵
  PID:9708
- C:\Windows\System\DuBiMlV.exe
  C:\Windows\System\DuBiMlV.exe
  2⤵
  PID:9988
- C:\Windows\System\edYiFTZ.exe
  C:\Windows\System\edYiFTZ.exe
  2⤵
  PID:10148
- C:\Windows\System\eKWvLMm.exe
  C:\Windows\System\eKWvLMm.exe
  2⤵
  PID:9152
- C:\Windows\System\wTJnjNR.exe
  C:\Windows\System\wTJnjNR.exe
  2⤵
  PID:9268
- C:\Windows\System\KnYdoOI.exe
  C:\Windows\System\KnYdoOI.exe
  2⤵
  PID:9480
- C:\Windows\System\IMvwCOk.exe
  C:\Windows\System\IMvwCOk.exe
  2⤵
  PID:9880
- C:\Windows\System\bbZLtad.exe
  C:\Windows\System\bbZLtad.exe
  2⤵
  PID:8388
- C:\Windows\System\JgZLrDq.exe
  C:\Windows\System\JgZLrDq.exe
  2⤵
  PID:10260
- C:\Windows\System\gCdNXqF.exe
  C:\Windows\System\gCdNXqF.exe
  2⤵
  PID:10292
- C:\Windows\System\oxrJkHi.exe
  C:\Windows\System\oxrJkHi.exe
  2⤵
  PID:10316
- C:\Windows\System\jqbDVAW.exe
  C:\Windows\System\jqbDVAW.exe
  2⤵
  PID:10340
- C:\Windows\System\RXbeClN.exe
  C:\Windows\System\RXbeClN.exe
  2⤵
  PID:10368
- C:\Windows\System\QprVgUu.exe
  C:\Windows\System\QprVgUu.exe
  2⤵
  PID:10400
- C:\Windows\System\HVcGmfN.exe
  C:\Windows\System\HVcGmfN.exe
  2⤵
  PID:10428
- C:\Windows\System\rNZAUrn.exe
  C:\Windows\System\rNZAUrn.exe
  2⤵
  PID:10468
- C:\Windows\System\NUCpuiq.exe
  C:\Windows\System\NUCpuiq.exe
  2⤵
  PID:10504
- C:\Windows\System\rMWOETS.exe
  C:\Windows\System\rMWOETS.exe
  2⤵
  PID:10536
- C:\Windows\System\MyVLZcF.exe
  C:\Windows\System\MyVLZcF.exe
  2⤵
  PID:10564
- C:\Windows\System\NyXwEWe.exe
  C:\Windows\System\NyXwEWe.exe
  2⤵
  PID:10592
- C:\Windows\System\MdLmpBt.exe
  C:\Windows\System\MdLmpBt.exe
  2⤵
  PID:10624
- C:\Windows\System\EtDFjMI.exe
  C:\Windows\System\EtDFjMI.exe
  2⤵
  PID:10648
- C:\Windows\System\DtSyjZh.exe
  C:\Windows\System\DtSyjZh.exe
  2⤵
  PID:10680
- C:\Windows\System\LzAQXmL.exe
  C:\Windows\System\LzAQXmL.exe
  2⤵
  PID:10712
- C:\Windows\System\siMmFOX.exe
  C:\Windows\System\siMmFOX.exe
  2⤵
  PID:10740
- C:\Windows\System\eWZbDte.exe
  C:\Windows\System\eWZbDte.exe
  2⤵
  PID:10760
- C:\Windows\System\oPYCiJN.exe
  C:\Windows\System\oPYCiJN.exe
  2⤵
  PID:10784
- C:\Windows\System\IThesOy.exe
  C:\Windows\System\IThesOy.exe
  2⤵
  PID:10816
- C:\Windows\System\urtziPY.exe
  C:\Windows\System\urtziPY.exe
  2⤵
  PID:10840
- C:\Windows\System\Dcvbxcc.exe
  C:\Windows\System\Dcvbxcc.exe
  2⤵
  PID:10872
- C:\Windows\System\YsybYIm.exe
  C:\Windows\System\YsybYIm.exe
  2⤵
  PID:10912
- C:\Windows\System\uvWLgGS.exe
  C:\Windows\System\uvWLgGS.exe
  2⤵
  PID:10932
- C:\Windows\System\ZZurtne.exe
  C:\Windows\System\ZZurtne.exe
  2⤵
  PID:10956
- C:\Windows\System\aRBieAi.exe
  C:\Windows\System\aRBieAi.exe
  2⤵
  PID:10980
- C:\Windows\System\ZIZgwoY.exe
  C:\Windows\System\ZIZgwoY.exe
  2⤵
  PID:11000
- C:\Windows\System\QOvpltI.exe
  C:\Windows\System\QOvpltI.exe
  2⤵
  PID:11028
- C:\Windows\System\hLDaMrZ.exe
  C:\Windows\System\hLDaMrZ.exe
  2⤵
  PID:11064
- C:\Windows\System\NVziLhs.exe
  C:\Windows\System\NVziLhs.exe
  2⤵
  PID:11088
- C:\Windows\System\cPVlGAR.exe
  C:\Windows\System\cPVlGAR.exe
  2⤵
  PID:11120
- C:\Windows\System\YvMNMGP.exe
  C:\Windows\System\YvMNMGP.exe
  2⤵
  PID:11144
- C:\Windows\System\vTPaVpI.exe
  C:\Windows\System\vTPaVpI.exe
  2⤵
  PID:11180
- C:\Windows\System\GuMunhm.exe
  C:\Windows\System\GuMunhm.exe
  2⤵
  PID:11208
- C:\Windows\System\vOHbNDD.exe
  C:\Windows\System\vOHbNDD.exe
  2⤵
  PID:11232
- C:\Windows\System\xetHGXW.exe
  C:\Windows\System\xetHGXW.exe
  2⤵
  PID:11252
- C:\Windows\System\SbVwlrr.exe
  C:\Windows\System\SbVwlrr.exe
  2⤵
  PID:10252
- C:\Windows\System\tqYaFZq.exe
  C:\Windows\System\tqYaFZq.exe
  2⤵
  PID:9792
- C:\Windows\System\lJvRmYW.exe
  C:\Windows\System\lJvRmYW.exe
  2⤵
  PID:10360
- C:\Windows\System\AcMTKKz.exe
  C:\Windows\System\AcMTKKz.exe
  2⤵
  PID:10420
- C:\Windows\System\vLryCZI.exe
  C:\Windows\System\vLryCZI.exe
  2⤵
  PID:10448
- C:\Windows\System\qxdMWsG.exe
  C:\Windows\System\qxdMWsG.exe
  2⤵
  PID:10532
- C:\Windows\System\fznTuov.exe
  C:\Windows\System\fznTuov.exe
  2⤵
  PID:10644
- C:\Windows\System\jolzjCQ.exe
  C:\Windows\System\jolzjCQ.exe
  2⤵
  PID:10860
- C:\Windows\System\lZJkLGf.exe
  C:\Windows\System\lZJkLGf.exe
  2⤵
  PID:10904
- C:\Windows\System\qomBmxs.exe
  C:\Windows\System\qomBmxs.exe
  2⤵
  PID:10884
- C:\Windows\System\aUYFwqK.exe
  C:\Windows\System\aUYFwqK.exe
  2⤵
  PID:10968
- C:\Windows\System\nkPzoFH.exe
  C:\Windows\System\nkPzoFH.exe
  2⤵
  PID:11012
- C:\Windows\System\jTpKZys.exe
  C:\Windows\System\jTpKZys.exe
  2⤵
  PID:11040
- C:\Windows\System\RDmeyuE.exe
  C:\Windows\System\RDmeyuE.exe
  2⤵
  PID:11128
- C:\Windows\System\INaCHCX.exe
  C:\Windows\System\INaCHCX.exe
  2⤵
  PID:11224
- C:\Windows\System\aoilnjk.exe
  C:\Windows\System\aoilnjk.exe
  2⤵
  PID:10280
- C:\Windows\System\PNqGDvd.exe
  C:\Windows\System\PNqGDvd.exe
  2⤵
  PID:10356
- C:\Windows\System\vZJBGFH.exe
  C:\Windows\System\vZJBGFH.exe
  2⤵
  PID:10552
- C:\Windows\System\YWeVvzn.exe
  C:\Windows\System\YWeVvzn.exe
  2⤵
  PID:10632
- C:\Windows\System\aswdqgN.exe
  C:\Windows\System\aswdqgN.exe
  2⤵
  PID:10608
- C:\Windows\System\GtkYZsF.exe
  C:\Windows\System\GtkYZsF.exe
  2⤵
  PID:2964
- C:\Windows\System\JBoemDC.exe
  C:\Windows\System\JBoemDC.exe
  2⤵
  PID:1684
- C:\Windows\System\zqvBqKi.exe
  C:\Windows\System\zqvBqKi.exe
  2⤵
  PID:10800
- C:\Windows\System\EZNaHiO.exe
  C:\Windows\System\EZNaHiO.exe
  2⤵
  PID:10972
- C:\Windows\System\WrlHnki.exe
  C:\Windows\System\WrlHnki.exe
  2⤵
  PID:11084
- C:\Windows\System\mzzimsZ.exe
  C:\Windows\System\mzzimsZ.exe
  2⤵
  PID:11220
- C:\Windows\System\RwXcuoi.exe
  C:\Windows\System\RwXcuoi.exe
  2⤵
  PID:10336
- C:\Windows\System\nFCUwFZ.exe
  C:\Windows\System\nFCUwFZ.exe
  2⤵
  PID:672
- C:\Windows\System\EXNKJgk.exe
  C:\Windows\System\EXNKJgk.exe
  2⤵
  PID:10024
- C:\Windows\System\BOZUppK.exe
  C:\Windows\System\BOZUppK.exe
  2⤵
  PID:11136
- C:\Windows\System\EaCnYlO.exe
  C:\Windows\System\EaCnYlO.exe
  2⤵
  PID:2960
- C:\Windows\System\ujvxfcm.exe
  C:\Windows\System\ujvxfcm.exe
  2⤵
  PID:11272
- C:\Windows\System\goHhoKA.exe
  C:\Windows\System\goHhoKA.exe
  2⤵
  PID:11292
- C:\Windows\System\dhPevSL.exe
  C:\Windows\System\dhPevSL.exe
  2⤵
  PID:11320
- C:\Windows\System\fQfdPMK.exe
  C:\Windows\System\fQfdPMK.exe
  2⤵
  PID:11352
- C:\Windows\System\yQITQXc.exe
  C:\Windows\System\yQITQXc.exe
  2⤵
  PID:11388
- C:\Windows\System\tfoYvGN.exe
  C:\Windows\System\tfoYvGN.exe
  2⤵
  PID:11424
- C:\Windows\System\rIzTqrn.exe
  C:\Windows\System\rIzTqrn.exe
  2⤵
  PID:11444
- C:\Windows\System\svDMTev.exe
  C:\Windows\System\svDMTev.exe
  2⤵
  PID:11460
- C:\Windows\System\YTjWPzd.exe
  C:\Windows\System\YTjWPzd.exe
  2⤵
  PID:11488
- C:\Windows\System\vJElUot.exe
  C:\Windows\System\vJElUot.exe
  2⤵
  PID:11520
- C:\Windows\System\kVFOjLa.exe
  C:\Windows\System\kVFOjLa.exe
  2⤵
  PID:11548
- C:\Windows\System\bbNLZBZ.exe
  C:\Windows\System\bbNLZBZ.exe
  2⤵
  PID:11576
- C:\Windows\System\caqhKgv.exe
  C:\Windows\System\caqhKgv.exe
  2⤵
  PID:11608
- C:\Windows\System\KGnOZpo.exe
  C:\Windows\System\KGnOZpo.exe
  2⤵
  PID:11624
- C:\Windows\System\YoCXOqE.exe
  C:\Windows\System\YoCXOqE.exe
  2⤵
  PID:11652
- C:\Windows\System\RldafVN.exe
  C:\Windows\System\RldafVN.exe
  2⤵
  PID:11676
- C:\Windows\System\aVVQkMD.exe
  C:\Windows\System\aVVQkMD.exe
  2⤵
  PID:11704
- C:\Windows\System\OdWKMNH.exe
  C:\Windows\System\OdWKMNH.exe
  2⤵
  PID:11732
- C:\Windows\System\LFnBzdW.exe
  C:\Windows\System\LFnBzdW.exe
  2⤵
  PID:11764
- C:\Windows\System\CLLRGyQ.exe
  C:\Windows\System\CLLRGyQ.exe
  2⤵
  PID:11788
- C:\Windows\System\qFmqqrS.exe
  C:\Windows\System\qFmqqrS.exe
  2⤵
  PID:11820
- C:\Windows\System\luIgFOp.exe
  C:\Windows\System\luIgFOp.exe
  2⤵
  PID:11836
- C:\Windows\System\EEEtVmN.exe
  C:\Windows\System\EEEtVmN.exe
  2⤵
  PID:11860
- C:\Windows\System\StZhuUu.exe
  C:\Windows\System\StZhuUu.exe
  2⤵
  PID:11888
- C:\Windows\System\WIhSFSo.exe
  C:\Windows\System\WIhSFSo.exe
  2⤵
  PID:11912
- C:\Windows\System\SJTTfAu.exe
  C:\Windows\System\SJTTfAu.exe
  2⤵
  PID:11940
- C:\Windows\System\VkaZSfi.exe
  C:\Windows\System\VkaZSfi.exe
  2⤵
  PID:11976
- C:\Windows\System\GImRIYq.exe
  C:\Windows\System\GImRIYq.exe
  2⤵
  PID:12004
- C:\Windows\System\MJGVQDJ.exe
  C:\Windows\System\MJGVQDJ.exe
  2⤵
  PID:12028
- C:\Windows\System\zHNVRUq.exe
  C:\Windows\System\zHNVRUq.exe
  2⤵
  PID:12052
- C:\Windows\System\UnmaQzq.exe
  C:\Windows\System\UnmaQzq.exe
  2⤵
  PID:12080
- C:\Windows\System\oJYawvO.exe
  C:\Windows\System\oJYawvO.exe
  2⤵
  PID:12108
- C:\Windows\System\QwKxilk.exe
  C:\Windows\System\QwKxilk.exe
  2⤵
  PID:12136
- C:\Windows\System\VFtKdoM.exe
  C:\Windows\System\VFtKdoM.exe
  2⤵
  PID:12172
- C:\Windows\System\DXqefZV.exe
  C:\Windows\System\DXqefZV.exe
  2⤵
  PID:12192
- C:\Windows\System\AECBaSX.exe
  C:\Windows\System\AECBaSX.exe
  2⤵
  PID:12228
- C:\Windows\System\mdaXuag.exe
  C:\Windows\System\mdaXuag.exe
  2⤵
  PID:12252
- C:\Windows\System\LcsuPJF.exe
  C:\Windows\System\LcsuPJF.exe
  2⤵
  PID:12284
- C:\Windows\System\NoCTBsd.exe
  C:\Windows\System\NoCTBsd.exe
  2⤵
  PID:11316
- C:\Windows\System\YciWWzP.exe
  C:\Windows\System\YciWWzP.exe
  2⤵
  PID:11344
- C:\Windows\System\VsEhqKr.exe
  C:\Windows\System\VsEhqKr.exe
  2⤵
  PID:11432
- C:\Windows\System\tywLMkT.exe
  C:\Windows\System\tywLMkT.exe
  2⤵
  PID:11480
- C:\Windows\System\ULscagS.exe
  C:\Windows\System\ULscagS.exe
  2⤵
  PID:11528
- C:\Windows\System\LjZRAUl.exe
  C:\Windows\System\LjZRAUl.exe
  2⤵
  PID:11572
- C:\Windows\System\UfWDvnF.exe
  C:\Windows\System\UfWDvnF.exe
  2⤵
  PID:11716
- C:\Windows\System\eMWNDmD.exe
  C:\Windows\System\eMWNDmD.exe
  2⤵
  PID:11752
- C:\Windows\System\OHauXvB.exe
  C:\Windows\System\OHauXvB.exe
  2⤵
  PID:11848
- C:\Windows\System\zCRyvtH.exe
  C:\Windows\System\zCRyvtH.exe
  2⤵
  PID:11936
- C:\Windows\System\JLTnNjo.exe
  C:\Windows\System\JLTnNjo.exe
  2⤵
  PID:11904
- C:\Windows\System\nrnohhK.exe
  C:\Windows\System\nrnohhK.exe
  2⤵
  PID:12016
- C:\Windows\System\EHeDaLA.exe
  C:\Windows\System\EHeDaLA.exe
  2⤵
  PID:12048
- C:\Windows\System\ykvwxlF.exe
  C:\Windows\System\ykvwxlF.exe
  2⤵
  PID:12212
- C:\Windows\System\shiYsUx.exe
  C:\Windows\System\shiYsUx.exe
  2⤵
  PID:9868
- C:\Windows\System\KdtGRvt.exe
  C:\Windows\System\KdtGRvt.exe
  2⤵
  PID:11308
- C:\Windows\System\THFzrrj.exe
  C:\Windows\System\THFzrrj.exe
  2⤵
  PID:12264
- C:\Windows\System\lwHgNyZ.exe
  C:\Windows\System\lwHgNyZ.exe
  2⤵
  PID:11640
- C:\Windows\System\xejtvDa.exe
  C:\Windows\System\xejtvDa.exe
  2⤵
  PID:11616
- C:\Windows\System\AeLIJAH.exe
  C:\Windows\System\AeLIJAH.exe
  2⤵
  PID:11828
- C:\Windows\System\lQvPJmL.exe
  C:\Windows\System\lQvPJmL.exe
  2⤵
  PID:11972
- C:\Windows\System\YyZXyGR.exe
  C:\Windows\System\YyZXyGR.exe
  2⤵
  PID:12184
- C:\Windows\System\DbYupHN.exe
  C:\Windows\System\DbYupHN.exe
  2⤵
  PID:12204
- C:\Windows\System\sDLEjEo.exe
  C:\Windows\System\sDLEjEo.exe
  2⤵
  PID:11960
- C:\Windows\System\BeZoSva.exe
  C:\Windows\System\BeZoSva.exe
  2⤵
  PID:12092
- C:\Windows\System\belLmkc.exe
  C:\Windows\System\belLmkc.exe
  2⤵
  PID:11332
- C:\Windows\System\jmOSJom.exe
  C:\Windows\System\jmOSJom.exe
  2⤵
  PID:12304
- C:\Windows\System\bljpIMK.exe
  C:\Windows\System\bljpIMK.exe
  2⤵
  PID:12332
- C:\Windows\System\USbqrxg.exe
  C:\Windows\System\USbqrxg.exe
  2⤵
  PID:12352
- C:\Windows\System\VlAOfJv.exe
  C:\Windows\System\VlAOfJv.exe
  2⤵
  PID:12384
- C:\Windows\System\qOpATyo.exe
  C:\Windows\System\qOpATyo.exe
  2⤵
  PID:12420
- C:\Windows\System\XfUxsua.exe
  C:\Windows\System\XfUxsua.exe
  2⤵
  PID:12444
- C:\Windows\System\eLIMeAn.exe
  C:\Windows\System\eLIMeAn.exe
  2⤵
  PID:12460
- C:\Windows\System\FHeFkiI.exe
  C:\Windows\System\FHeFkiI.exe
  2⤵
  PID:12492
- C:\Windows\System\VyOGPeM.exe
  C:\Windows\System\VyOGPeM.exe
  2⤵
  PID:12516
- C:\Windows\System\VZqxglI.exe
  C:\Windows\System\VZqxglI.exe
  2⤵
  PID:12544
- C:\Windows\System\FPTuuSB.exe
  C:\Windows\System\FPTuuSB.exe
  2⤵
  PID:12568
- C:\Windows\System\dSomUBq.exe
  C:\Windows\System\dSomUBq.exe
  2⤵
  PID:12596
- C:\Windows\System\tMinHSi.exe
  C:\Windows\System\tMinHSi.exe
  2⤵
  PID:12628
- C:\Windows\System\yICZJfy.exe
  C:\Windows\System\yICZJfy.exe
  2⤵
  PID:12660
- C:\Windows\System\DxVUuax.exe
  C:\Windows\System\DxVUuax.exe
  2⤵
  PID:12680
- C:\Windows\System\HfPaWLp.exe
  C:\Windows\System\HfPaWLp.exe
  2⤵
  PID:12708
- C:\Windows\System\mukWIiq.exe
  C:\Windows\System\mukWIiq.exe
  2⤵
  PID:12736
- C:\Windows\System\vPobrUN.exe
  C:\Windows\System\vPobrUN.exe
  2⤵
  PID:12760
- C:\Windows\System\dwmahJG.exe
  C:\Windows\System\dwmahJG.exe
  2⤵
  PID:12796
- C:\Windows\System\bNASzAD.exe
  C:\Windows\System\bNASzAD.exe
  2⤵
  PID:12816
- C:\Windows\System\FQaRbtJ.exe
  C:\Windows\System\FQaRbtJ.exe
  2⤵
  PID:12848
- C:\Windows\System\ccBKhRp.exe
  C:\Windows\System\ccBKhRp.exe
  2⤵
  PID:12868
- C:\Windows\System\SmJMjXP.exe
  C:\Windows\System\SmJMjXP.exe
  2⤵
  PID:12892
- C:\Windows\System\cPRqrhb.exe
  C:\Windows\System\cPRqrhb.exe
  2⤵
  PID:12924
- C:\Windows\System\ZHDqNHJ.exe
  C:\Windows\System\ZHDqNHJ.exe
  2⤵
  PID:12952
- C:\Windows\System\SiLQIHV.exe
  C:\Windows\System\SiLQIHV.exe
  2⤵
  PID:12988
- C:\Windows\System\SIpTsNE.exe
  C:\Windows\System\SIpTsNE.exe
  2⤵
  PID:13020
- C:\Windows\System\eLWbfTL.exe
  C:\Windows\System\eLWbfTL.exe
  2⤵
  PID:13052
- C:\Windows\System\wTBFTJh.exe
  C:\Windows\System\wTBFTJh.exe
  2⤵
  PID:13080
- C:\Windows\System\JMdnCys.exe
  C:\Windows\System\JMdnCys.exe
  2⤵
  PID:13116
- C:\Windows\System\LpayrjO.exe
  C:\Windows\System\LpayrjO.exe
  2⤵
  PID:13136
- C:\Windows\System\xHCOuZM.exe
  C:\Windows\System\xHCOuZM.exe
  2⤵
  PID:13164
- C:\Windows\System\GHzEOKP.exe
  C:\Windows\System\GHzEOKP.exe
  2⤵
  PID:13192
- C:\Windows\System\luKsubg.exe
  C:\Windows\System\luKsubg.exe
  2⤵
  PID:13212
- C:\Windows\System\LVWeZJM.exe
  C:\Windows\System\LVWeZJM.exe
  2⤵
  PID:13240
- C:\Windows\System\dbnMvrF.exe
  C:\Windows\System\dbnMvrF.exe
  2⤵
  PID:13264
- C:\Windows\System\XpRMXfY.exe
  C:\Windows\System\XpRMXfY.exe
  2⤵
  PID:13288
- C:\Windows\System\YXMtDxy.exe
  C:\Windows\System\YXMtDxy.exe
  2⤵
  PID:13308
- C:\Windows\System\pDgOnOn.exe
  C:\Windows\System\pDgOnOn.exe
  2⤵
  PID:12300
- C:\Windows\System\ZMFZQby.exe
  C:\Windows\System\ZMFZQby.exe
  2⤵
  PID:12340
- C:\Windows\System\lJbHVJE.exe
  C:\Windows\System\lJbHVJE.exe
  2⤵
  PID:12372
- C:\Windows\System\WIxEIrp.exe
  C:\Windows\System\WIxEIrp.exe
  2⤵
  PID:12528
- C:\Windows\System\JoqdxGC.exe
  C:\Windows\System\JoqdxGC.exe
  2⤵
  PID:12440
- C:\Windows\System\yjVzcaN.exe
  C:\Windows\System\yjVzcaN.exe
  2⤵
  PID:12656
- C:\Windows\System\NFjnNCd.exe
  C:\Windows\System\NFjnNCd.exe
  2⤵
  PID:12720
- C:\Windows\System\LXazxGc.exe
  C:\Windows\System\LXazxGc.exe
  2⤵
  PID:12772
- C:\Windows\System\PjPYfJO.exe
  C:\Windows\System\PjPYfJO.exe
  2⤵
  PID:12844
- C:\Windows\System\PKyrxJa.exe
  C:\Windows\System\PKyrxJa.exe
  2⤵
  PID:12828
- C:\Windows\System\Ssvgned.exe
  C:\Windows\System\Ssvgned.exe
  2⤵
  PID:12908
- C:\Windows\System\gRaWehh.exe
  C:\Windows\System\gRaWehh.exe
  2⤵
  PID:13064
- C:\Windows\System\LDWuaJe.exe
  C:\Windows\System\LDWuaJe.exe
  2⤵
  PID:13180
- C:\Windows\System\NcbzmPk.exe
  C:\Windows\System\NcbzmPk.exe
  2⤵
  PID:13152
- C:\Windows\System\itqAMeH.exe
  C:\Windows\System\itqAMeH.exe
  2⤵
  PID:13252
- C:\Windows\System\bauedKZ.exe
  C:\Windows\System\bauedKZ.exe
  2⤵
  PID:13260
- C:\Windows\System\eZCROAu.exe
  C:\Windows\System\eZCROAu.exe
  2⤵
  PID:13276
- C:\Windows\System\HxojjsE.exe
  C:\Windows\System\HxojjsE.exe
  2⤵
  PID:12396
- C:\Windows\System\vcVyXDM.exe
  C:\Windows\System\vcVyXDM.exe
  2⤵
  PID:12452
- C:\Windows\System\flaqhKO.exe
  C:\Windows\System\flaqhKO.exe
  2⤵
  PID:12724
- C:\Windows\System\anRuooe.exe
  C:\Windows\System\anRuooe.exe
  2⤵
  PID:12840
- C:\Windows\System\lqjkWzx.exe
  C:\Windows\System\lqjkWzx.exe
  2⤵
  PID:13012
- C:\Windows\System\LsctFWj.exe
  C:\Windows\System\LsctFWj.exe
  2⤵
  PID:12968
- C:\Windows\System\LWBRBop.exe
  C:\Windows\System\LWBRBop.exe
  2⤵
  PID:10948
- C:\Windows\System\CprIAhZ.exe
  C:\Windows\System\CprIAhZ.exe
  2⤵
  PID:12748
- C:\Windows\System\zuOjbRC.exe
  C:\Windows\System\zuOjbRC.exe
  2⤵
  PID:13324
- C:\Windows\System\mfUpTjE.exe
  C:\Windows\System\mfUpTjE.exe
  2⤵
  PID:13352
- C:\Windows\System\WqleOrI.exe
  C:\Windows\System\WqleOrI.exe
  2⤵
  PID:13376
- C:\Windows\System\wtthzaG.exe
  C:\Windows\System\wtthzaG.exe
  2⤵
  PID:13396
- C:\Windows\System\xjBCYCO.exe
  C:\Windows\System\xjBCYCO.exe
  2⤵
  PID:13424
- C:\Windows\System\SAydryY.exe
  C:\Windows\System\SAydryY.exe
  2⤵
  PID:13448
- C:\Windows\System\wwYhNCc.exe
  C:\Windows\System\wwYhNCc.exe
  2⤵
  PID:13476
- C:\Windows\System\RSrukzX.exe
  C:\Windows\System\RSrukzX.exe
  2⤵
  PID:13500
- C:\Windows\System\yTfHXTh.exe
  C:\Windows\System\yTfHXTh.exe
  2⤵
  PID:13520
- C:\Windows\System\UuotWSh.exe
  C:\Windows\System\UuotWSh.exe
  2⤵
  PID:13556
- C:\Windows\System\ksNCvjy.exe
  C:\Windows\System\ksNCvjy.exe
  2⤵
  PID:13592
- C:\Windows\System\EacFatt.exe
  C:\Windows\System\EacFatt.exe
  2⤵
  PID:13616
- C:\Windows\System\ifhMCIl.exe
  C:\Windows\System\ifhMCIl.exe
  2⤵
  PID:13652
- C:\Windows\System\iybGyDw.exe
  C:\Windows\System\iybGyDw.exe
  2⤵
  PID:13692
- C:\Windows\System\pMXztNZ.exe
  C:\Windows\System\pMXztNZ.exe
  2⤵
  PID:13716
- C:\Windows\System\SrtNdrM.exe
  C:\Windows\System\SrtNdrM.exe
  2⤵
  PID:13744
- C:\Windows\System\wZWDPig.exe
  C:\Windows\System\wZWDPig.exe
  2⤵
  PID:13768
- C:\Windows\System\Zoutofq.exe
  C:\Windows\System\Zoutofq.exe
  2⤵
  PID:13808
- C:\Windows\System\rFboxhe.exe
  C:\Windows\System\rFboxhe.exe
  2⤵
  PID:13836
- C:\Windows\System\GMsNeYe.exe
  C:\Windows\System\GMsNeYe.exe
  2⤵
  PID:13860
- C:\Windows\System\RAMWZeS.exe
  C:\Windows\System\RAMWZeS.exe
  2⤵
  PID:13892
- C:\Windows\System\FJMVWWU.exe
  C:\Windows\System\FJMVWWU.exe
  2⤵
  PID:13912
- C:\Windows\System\lMRAlvq.exe
  C:\Windows\System\lMRAlvq.exe
  2⤵
  PID:13940
- C:\Windows\System\hszMPRw.exe
  C:\Windows\System\hszMPRw.exe
  2⤵
  PID:13964
- C:\Windows\System\CwWsxLg.exe
  C:\Windows\System\CwWsxLg.exe
  2⤵
  PID:13988
- C:\Windows\System\LUgElHb.exe
  C:\Windows\System\LUgElHb.exe
  2⤵
  PID:14016
- C:\Windows\System\bHVxoUI.exe
  C:\Windows\System\bHVxoUI.exe
  2⤵
  PID:14040
- C:\Windows\System\uCmDXWo.exe
  C:\Windows\System\uCmDXWo.exe
  2⤵
  PID:14068
- C:\Windows\System\AvxnNLK.exe
  C:\Windows\System\AvxnNLK.exe
  2⤵
  PID:14092
- C:\Windows\System\gcFunlm.exe
  C:\Windows\System\gcFunlm.exe
  2⤵
  PID:14128
- C:\Windows\System\gPVzezU.exe
  C:\Windows\System\gPVzezU.exe
  2⤵
  PID:14148
- C:\Windows\System\qCGWQNs.exe
  C:\Windows\System\qCGWQNs.exe
  2⤵
  PID:14228
- C:\Windows\System\DMyeRFW.exe
  C:\Windows\System\DMyeRFW.exe
  2⤵
  PID:14256
- C:\Windows\System\aRzHufv.exe
  C:\Windows\System\aRzHufv.exe
  2⤵
  PID:14284
- C:\Windows\System\ovJPBQX.exe
  C:\Windows\System\ovJPBQX.exe
  2⤵
  PID:14316
- C:\Windows\System\VZCjvcd.exe
  C:\Windows\System\VZCjvcd.exe
  2⤵
  PID:13040
- C:\Windows\System\ktjBjTc.exe
  C:\Windows\System\ktjBjTc.exe
  2⤵
  PID:13336
- C:\Windows\System\NtxhLyT.exe
  C:\Windows\System\NtxhLyT.exe
  2⤵
  PID:13296
- C:\Windows\System\PzfqVEY.exe
  C:\Windows\System\PzfqVEY.exe
  2⤵
  PID:13368
- C:\Windows\System\sKfiKeH.exe
  C:\Windows\System\sKfiKeH.exe
  2⤵
  PID:13372
- C:\Windows\System\twadkWc.exe
  C:\Windows\System\twadkWc.exe
  2⤵
  PID:13456
- C:\Windows\System\fxJTdJB.exe
  C:\Windows\System\fxJTdJB.exe
  2⤵
  PID:13540
- C:\Windows\System\KZLhSMT.exe
  C:\Windows\System\KZLhSMT.exe
  2⤵
  PID:13640
- C:\Windows\System\fSiVBdb.exe
  C:\Windows\System\fSiVBdb.exe
  2⤵
  PID:13632
- C:\Windows\System\sZQlpfe.exe
  C:\Windows\System\sZQlpfe.exe
  2⤵
  PID:13704
- C:\Windows\System\jHcoVQZ.exe
  C:\Windows\System\jHcoVQZ.exe
  2⤵
  PID:13756
- C:\Windows\System\LfNgkih.exe
  C:\Windows\System\LfNgkih.exe
  2⤵
  PID:13788
- C:\Windows\System\cCGNNxZ.exe
  C:\Windows\System\cCGNNxZ.exe
  2⤵
  PID:13956
- C:\Windows\System\HpcUhcx.exe
  C:\Windows\System\HpcUhcx.exe
  2⤵
  PID:14000
- C:\Windows\System\WfTfRRo.exe
  C:\Windows\System\WfTfRRo.exe
  2⤵
  PID:14008
- C:\Windows\System\grCqpLA.exe
  C:\Windows\System\grCqpLA.exe
  2⤵
  PID:14180
- C:\Windows\System\cwuFSXy.exe
  C:\Windows\System\cwuFSXy.exe
  2⤵
  PID:14088
- C:\Windows\System\LimPQBV.exe
  C:\Windows\System\LimPQBV.exe
  2⤵
  PID:14216
- C:\Windows\System\kpWVyRF.exe
  C:\Windows\System\kpWVyRF.exe
  2⤵
  PID:13416
- C:\Windows\System\PRChtgb.exe
  C:\Windows\System\PRChtgb.exe
  2⤵
  PID:13496
- C:\Windows\System\QfUnGDt.exe
  C:\Windows\System\QfUnGDt.exe
  2⤵
  PID:13436
- C:\Windows\System\JeywmDS.exe
  C:\Windows\System\JeywmDS.exe
  2⤵
  PID:13856
- C:\Windows\System\obiaETf.exe
  C:\Windows\System\obiaETf.exe
  2⤵
  PID:13872
- C:\Windows\System\xEagItB.exe
  C:\Windows\System\xEagItB.exe
  2⤵
  PID:14036
- C:\Windows\System\lAeTOhS.exe
  C:\Windows\System\lAeTOhS.exe
  2⤵
  PID:14248
- C:\Windows\System\ELQgrpu.exe
  C:\Windows\System\ELQgrpu.exe
  2⤵
  PID:14056
- C:\Windows\System\PhFUOmF.exe
  C:\Windows\System\PhFUOmF.exe
  2⤵
  PID:13444
- C:\Windows\System\wtOwzrf.exe
  C:\Windows\System\wtOwzrf.exe
  2⤵
  PID:13568
- C:\Windows\System\DUipIKb.exe
  C:\Windows\System\DUipIKb.exe
  2⤵
  PID:13932
- C:\Windows\System\KmQjOMz.exe
  C:\Windows\System\KmQjOMz.exe
  2⤵
  PID:14344
- C:\Windows\System\rxCHZSS.exe
  C:\Windows\System\rxCHZSS.exe
  2⤵
  PID:14384
- C:\Windows\System\mvcDbRZ.exe
  C:\Windows\System\mvcDbRZ.exe
  2⤵
  PID:14408
- C:\Windows\System\DyuyfIm.exe
  C:\Windows\System\DyuyfIm.exe
  2⤵
  PID:14424
- C:\Windows\System\LzJxNOl.exe
  C:\Windows\System\LzJxNOl.exe
  2⤵
  PID:14448
- C:\Windows\System\miNeCTP.exe
  C:\Windows\System\miNeCTP.exe
  2⤵
  PID:14472
- C:\Windows\System\GMSTWhL.exe
  C:\Windows\System\GMSTWhL.exe
  2⤵
  PID:14492
- C:\Windows\System\ZxiAwfx.exe
  C:\Windows\System\ZxiAwfx.exe
  2⤵
  PID:14520
- C:\Windows\System\vLMBpyg.exe
  C:\Windows\System\vLMBpyg.exe
  2⤵
  PID:14548
- C:\Windows\System\FsWqxJo.exe
  C:\Windows\System\FsWqxJo.exe
  2⤵
  PID:14568
- C:\Windows\System\SGCHYTQ.exe
  C:\Windows\System\SGCHYTQ.exe
  2⤵
  PID:14592
- C:\Windows\System\iwMiSjz.exe
  C:\Windows\System\iwMiSjz.exe
  2⤵
  PID:14620
- C:\Windows\System\RCGBNjs.exe
  C:\Windows\System\RCGBNjs.exe
  2⤵
  PID:14656
- C:\Windows\System\DwByvNp.exe
  C:\Windows\System\DwByvNp.exe
  2⤵
  PID:14684
- C:\Windows\System\ttwjpGR.exe
  C:\Windows\System\ttwjpGR.exe
  2⤵
  PID:14720
- C:\Windows\System\hPGAyqX.exe
  C:\Windows\System\hPGAyqX.exe
  2⤵
  PID:14756
- C:\Windows\System\qPGByvV.exe
  C:\Windows\System\qPGByvV.exe
  2⤵
  PID:14784
- C:\Windows\System\OnDIIcj.exe
  C:\Windows\System\OnDIIcj.exe
  2⤵
  PID:14820
- C:\Windows\System\zLbRlcr.exe
  C:\Windows\System\zLbRlcr.exe
  2⤵
  PID:14860
- C:\Windows\System\sWNLpsQ.exe
  C:\Windows\System\sWNLpsQ.exe
  2⤵
  PID:14892
- C:\Windows\System\CMmELbD.exe
  C:\Windows\System\CMmELbD.exe
  2⤵
  PID:14912
- C:\Windows\System\pDzKboN.exe
  C:\Windows\System\pDzKboN.exe
  2⤵
  PID:14936
- C:\Windows\System\MORIhdU.exe
  C:\Windows\System\MORIhdU.exe
  2⤵
  PID:14972
- C:\Windows\System\ceCBZdI.exe
  C:\Windows\System\ceCBZdI.exe
  2⤵
  PID:14992
- C:\Windows\System\gEtPOoX.exe
  C:\Windows\System\gEtPOoX.exe
  2⤵
  PID:15024
- C:\Windows\System\KKZNyzH.exe
  C:\Windows\System\KKZNyzH.exe
  2⤵
  PID:15048
- C:\Windows\System\bczQVSW.exe
  C:\Windows\System\bczQVSW.exe
  2⤵
  PID:15072
- C:\Windows\System\gFDGyjU.exe
  C:\Windows\System\gFDGyjU.exe
  2⤵
  PID:15108
- C:\Windows\System\slovUdC.exe
  C:\Windows\System\slovUdC.exe
  2⤵
  PID:15132
- C:\Windows\System\wcXUCSZ.exe
  C:\Windows\System\wcXUCSZ.exe
  2⤵
  PID:15156
- C:\Windows\System\eMbeGBo.exe
  C:\Windows\System\eMbeGBo.exe
  2⤵
  PID:15268
- C:\Windows\System\ZbvgMYm.exe
  C:\Windows\System\ZbvgMYm.exe
  2⤵
  PID:15284
- C:\Windows\System\tCSLHKT.exe
  C:\Windows\System\tCSLHKT.exe
  2⤵
  PID:15308
- C:\Windows\System\dnhMCch.exe
  C:\Windows\System\dnhMCch.exe
  2⤵
  PID:15332
- C:\Windows\System\zHwHzix.exe
  C:\Windows\System\zHwHzix.exe
  2⤵
  PID:13204
- C:\Windows\System\xXRcxwf.exe
  C:\Windows\System\xXRcxwf.exe
  2⤵
  PID:14032
- C:\Windows\System\lgPFgvM.exe
  C:\Windows\System\lgPFgvM.exe
  2⤵
  PID:14368
- C:\Windows\System\vQSbQyi.exe
  C:\Windows\System\vQSbQyi.exe
  2⤵
  PID:14364
- C:\Windows\System\ppFiCrY.exe
  C:\Windows\System\ppFiCrY.exe
  2⤵
  PID:14400
- C:\Windows\System\wlYbHzv.exe
  C:\Windows\System\wlYbHzv.exe
  2⤵
  PID:14536
- C:\Windows\System\iAQauVl.exe
  C:\Windows\System\iAQauVl.exe
  2⤵
  PID:14740
- C:\Windows\System\zKSuccM.exe
  C:\Windows\System\zKSuccM.exe
  2⤵
  PID:14616
- C:\Windows\System\DtyyuLQ.exe
  C:\Windows\System\DtyyuLQ.exe
  2⤵
  PID:14664
- C:\Windows\System\UuyQJyl.exe
  C:\Windows\System\UuyQJyl.exe
  2⤵
  PID:14884
- C:\Windows\System\QIWZJAY.exe
  C:\Windows\System\QIWZJAY.exe
  2⤵
  PID:14832
- C:\Windows\System\ExDSsOk.exe
  C:\Windows\System\ExDSsOk.exe
  2⤵
  PID:14876
- C:\Windows\System\kJYveVg.exe
  C:\Windows\System\kJYveVg.exe
  2⤵
  PID:14900
- C:\Windows\System\pESsBbo.exe
  C:\Windows\System\pESsBbo.exe
  2⤵
  PID:14924
- C:\Windows\System\mJuOrbm.exe
  C:\Windows\System\mJuOrbm.exe
  2⤵
  PID:15100
- C:\Windows\System\wvpRAEf.exe
  C:\Windows\System\wvpRAEf.exe
  2⤵
  PID:15060
- C:\Windows\System\kQnyaPW.exe
  C:\Windows\System\kQnyaPW.exe
  2⤵
  PID:15240
- C:\Windows\System\Eblyisi.exe
  C:\Windows\System\Eblyisi.exe
  2⤵
  PID:15304
- C:\Windows\System\KuQXCmu.exe
  C:\Windows\System\KuQXCmu.exe
  2⤵
  PID:15352
- C:\Windows\System\ugTmmWi.exe
  C:\Windows\System\ugTmmWi.exe
  2⤵
  PID:14420
- C:\Windows\System\BupKliK.exe
  C:\Windows\System\BupKliK.exe
  2⤵
  PID:14512
- C:\Windows\System\PUsexTr.exe
  C:\Windows\System\PUsexTr.exe
  2⤵
  PID:14652
- C:\Windows\System\zuVdgYX.exe
  C:\Windows\System\zuVdgYX.exe
  2⤵
  PID:14872
- C:\Windows\System\HEhwcbv.exe
  C:\Windows\System\HEhwcbv.exe
  2⤵
  PID:14988
- C:\Windows\System\sjEKUiu.exe
  C:\Windows\System\sjEKUiu.exe
  2⤵
  PID:15040
- C:\Windows\System\iCGnltT.exe
  C:\Windows\System\iCGnltT.exe
  2⤵
  PID:15044
- C:\Windows\System\pSgHvtJ.exe
  C:\Windows\System\pSgHvtJ.exe
  2⤵
  PID:14436
- C:\Windows\System\veXwitt.exe
  C:\Windows\System\veXwitt.exe
  2⤵
  PID:14780
- C:\Windows\System\TzXyGTa.exe
  C:\Windows\System\TzXyGTa.exe
  2⤵
  PID:14808
- C:\Windows\System\EmqHTQd.exe
  C:\Windows\System\EmqHTQd.exe
  2⤵
  PID:15176
- C:\Windows\System\yZzNKQU.exe
  C:\Windows\System\yZzNKQU.exe
  2⤵
  PID:15384
- C:\Windows\System\qsirfVm.exe
  C:\Windows\System\qsirfVm.exe
  2⤵
  PID:15400
- C:\Windows\System\hXNdxfA.exe
  C:\Windows\System\hXNdxfA.exe
  2⤵
  PID:15436
- C:\Windows\System\sMviDwa.exe
  C:\Windows\System\sMviDwa.exe
  2⤵
  PID:15464
- C:\Windows\System\DNYeRiW.exe
  C:\Windows\System\DNYeRiW.exe
  2⤵
  PID:15496
- C:\Windows\System\ijFNXXx.exe
  C:\Windows\System\ijFNXXx.exe
  2⤵
  PID:15528
- C:\Windows\System\bxYQncL.exe
  C:\Windows\System\bxYQncL.exe
  2⤵
  PID:15548
- C:\Windows\System\BXHHDhP.exe
  C:\Windows\System\BXHHDhP.exe
  2⤵
  PID:15572
- C:\Windows\System\kSfgYfL.exe
  C:\Windows\System\kSfgYfL.exe
  2⤵
  PID:15608
- C:\Windows\System\toWWpEz.exe
  C:\Windows\System\toWWpEz.exe
  2⤵
  PID:15632
- C:\Windows\System\BRTxbco.exe
  C:\Windows\System\BRTxbco.exe
  2⤵
  PID:15664
- C:\Windows\System\RSDGSAV.exe
  C:\Windows\System\RSDGSAV.exe
  2⤵
  PID:15688
- C:\Windows\System\heeQHxN.exe
  C:\Windows\System\heeQHxN.exe
  2⤵
  PID:15716
- C:\Windows\System\cKIKTEW.exe
  C:\Windows\System\cKIKTEW.exe
  2⤵
  PID:15732
- C:\Windows\System\kIUpizj.exe
  C:\Windows\System\kIUpizj.exe
  2⤵
  PID:15756
- C:\Windows\System\koMSpDO.exe
  C:\Windows\System\koMSpDO.exe
  2⤵
  PID:15860
- C:\Windows\System\QMgoUdW.exe
  C:\Windows\System\QMgoUdW.exe
  2⤵
  PID:15876
- C:\Windows\System\cwPRcId.exe
  C:\Windows\System\cwPRcId.exe
  2⤵
  PID:15892
- C:\Windows\System\soxjPEO.exe
  C:\Windows\System\soxjPEO.exe
  2⤵
  PID:15920
- C:\Windows\System\VeuLTLL.exe
  C:\Windows\System\VeuLTLL.exe
  2⤵
  PID:15948
- C:\Windows\System\tecJRIJ.exe
  C:\Windows\System\tecJRIJ.exe
  2⤵
  PID:15972
- C:\Windows\System\dkTDjHS.exe
  C:\Windows\System\dkTDjHS.exe
  2⤵
  PID:15996
- C:\Windows\System\tRDzJbg.exe
  C:\Windows\System\tRDzJbg.exe
  2⤵
  PID:16028
- C:\Windows\System\yzieFCw.exe
  C:\Windows\System\yzieFCw.exe
  2⤵
  PID:16056
- C:\Windows\System\uIxKxam.exe
  C:\Windows\System\uIxKxam.exe
  2⤵
  PID:16076
- C:\Windows\System\IaEtSjX.exe
  C:\Windows\System\IaEtSjX.exe
  2⤵
  PID:16100
- C:\Windows\System\EEPnZxQ.exe
  C:\Windows\System\EEPnZxQ.exe
  2⤵
  PID:16132
- C:\Windows\System\MrXjBUa.exe
  C:\Windows\System\MrXjBUa.exe
  2⤵
  PID:16148
- C:\Windows\System\OxdNWYz.exe
  C:\Windows\System\OxdNWYz.exe
  2⤵
  PID:16180
- C:\Windows\System\hNtCXxn.exe
  C:\Windows\System\hNtCXxn.exe
  2⤵
  PID:16204
- C:\Windows\System\CuFfnGy.exe
  C:\Windows\System\CuFfnGy.exe
  2⤵
  PID:16236
- C:\Windows\System\UHGKZln.exe
  C:\Windows\System\UHGKZln.exe
  2⤵
  PID:16264
- C:\Windows\System\PXUgPhG.exe
  C:\Windows\System\PXUgPhG.exe
  2⤵
  PID:16288
- C:\Windows\System\dYfsbQH.exe
  C:\Windows\System\dYfsbQH.exe
  2⤵
  PID:16316
- C:\Windows\System\PvhTuWf.exe
  C:\Windows\System\PvhTuWf.exe
  2⤵
  PID:16344
- C:\Windows\System\rmnvTOb.exe
  C:\Windows\System\rmnvTOb.exe
  2⤵
  PID:16368
- C:\Windows\System\IYqLNfi.exe
  C:\Windows\System\IYqLNfi.exe
  2⤵
  PID:14360
- C:\Windows\System\RrYyMsP.exe
  C:\Windows\System\RrYyMsP.exe
  2⤵
  PID:15364
- C:\Windows\System\gBLorGg.exe
  C:\Windows\System\gBLorGg.exe
  2⤵
  PID:15396
- C:\Windows\System\MjdMrqn.exe
  C:\Windows\System\MjdMrqn.exe
  2⤵
  PID:15492
- C:\Windows\System\cXrzqDm.exe
  C:\Windows\System\cXrzqDm.exe
  2⤵
  PID:15524
- C:\Windows\System\dcKvYCk.exe
  C:\Windows\System\dcKvYCk.exe
  2⤵
  PID:15624
- C:\Windows\System\UluUITE.exe
  C:\Windows\System\UluUITE.exe
  2⤵
  PID:15564
- C:\Windows\System\mstNxIA.exe
  C:\Windows\System\mstNxIA.exe
  2⤵
  PID:15644
- C:\Windows\System\BJgDmQr.exe
  C:\Windows\System\BJgDmQr.exe
  2⤵
  PID:15752
- C:\Windows\System\RCmFcDS.exe
  C:\Windows\System\RCmFcDS.exe
  2⤵
  PID:15832
- C:\Windows\System\QBBllkM.exe
  C:\Windows\System\QBBllkM.exe
  2⤵
  PID:15872
- C:\Windows\System\qSmTzGd.exe
  C:\Windows\System\qSmTzGd.exe
  2⤵
  PID:15912
- C:\Windows\System\qEGFcNn.exe
  C:\Windows\System\qEGFcNn.exe
  2⤵
  PID:15960
- C:\Windows\System\oJPlaSQ.exe
  C:\Windows\System\oJPlaSQ.exe
  2⤵
  PID:16048
- C:\Windows\System\RhJuhYr.exe
  C:\Windows\System\RhJuhYr.exe
  2⤵
  PID:16112
- C:\Windows\System\aEbCWkj.exe
  C:\Windows\System\aEbCWkj.exe
  2⤵
  PID:16140
- C:\Windows\System\QnatcOp.exe
  C:\Windows\System\QnatcOp.exe
  2⤵
  PID:16220
- C:\Windows\System\ILyjFof.exe
  C:\Windows\System\ILyjFof.exe
  2⤵
  PID:16324
- C:\Windows\System\tUHGpsW.exe
  C:\Windows\System\tUHGpsW.exe
  2⤵
  PID:16376
- C:\Windows\System\iNxpWmk.exe
  C:\Windows\System\iNxpWmk.exe
  2⤵
  PID:15428
- C:\Windows\System\VWBqYzf.exe
  C:\Windows\System\VWBqYzf.exe
  2⤵
  PID:15480
- C:\Windows\System\fHYttrY.exe
  C:\Windows\System\fHYttrY.exe
  2⤵
  PID:15728
- C:\Windows\System\fxieDoL.exe
  C:\Windows\System\fxieDoL.exe
  2⤵
  PID:15660
- C:\Windows\System\VeKigmS.exe
  C:\Windows\System\VeKigmS.exe
  2⤵
  PID:15940
- C:\Windows\System\YarUAaE.exe
  C:\Windows\System\YarUAaE.exe
  2⤵
  PID:16068
- C:\Windows\System\cyyRkAZ.exe
  C:\Windows\System\cyyRkAZ.exe
  2⤵
  PID:16096
- C:\Windows\System\QCqjBFb.exe
  C:\Windows\System\QCqjBFb.exe
  2⤵
  PID:15376
- C:\Windows\System\tJbFfAB.exe
  C:\Windows\System\tJbFfAB.exe
  2⤵
  PID:15596
- C:\Windows\System\aQjedmT.exe
  C:\Windows\System\aQjedmT.exe
  2⤵
  PID:16400
- C:\Windows\System\sqtSurj.exe
  C:\Windows\System\sqtSurj.exe
  2⤵
  PID:16436
- C:\Windows\System\dvOYagj.exe
  C:\Windows\System\dvOYagj.exe
  2⤵
  PID:16452
- C:\Windows\System\oALIMFU.exe
  C:\Windows\System\oALIMFU.exe
  2⤵
  PID:16480
- C:\Windows\System\lNvuKag.exe
  C:\Windows\System\lNvuKag.exe
  2⤵
  PID:16496
- C:\Windows\System\ysBrBri.exe
  C:\Windows\System\ysBrBri.exe
  2⤵
  PID:16540
- C:\Windows\System\ZXlMVWM.exe
  C:\Windows\System\ZXlMVWM.exe
  2⤵
  PID:16564
- C:\Windows\System\FFlzwhT.exe
  C:\Windows\System\FFlzwhT.exe
  2⤵
  PID:16588
- C:\Windows\System\dxugNJR.exe
  C:\Windows\System\dxugNJR.exe
  2⤵
  PID:16608
- C:\Windows\System\mxuRZWH.exe
  C:\Windows\System\mxuRZWH.exe
  2⤵
  PID:16640
- C:\Windows\System\QDmbQjM.exe
  C:\Windows\System\QDmbQjM.exe
  2⤵
  PID:16664
- C:\Windows\System\fTOMyad.exe
  C:\Windows\System\fTOMyad.exe
  2⤵
  PID:16688
- C:\Windows\System\MAIGWUT.exe
  C:\Windows\System\MAIGWUT.exe
  2⤵
  PID:16712
- C:\Windows\System\GvdGkeC.exe
  C:\Windows\System\GvdGkeC.exe
  2⤵
  PID:16740
- C:\Windows\System\QcXbvsZ.exe
  C:\Windows\System\QcXbvsZ.exe
  2⤵
  PID:16768
- C:\Windows\System\nssyCNn.exe
  C:\Windows\System\nssyCNn.exe
  2⤵
  PID:16784
- C:\Windows\System\OoyHvpO.exe
  C:\Windows\System\OoyHvpO.exe
  2⤵
  PID:16812
- C:\Windows\System\NXaRNJo.exe
  C:\Windows\System\NXaRNJo.exe
  2⤵
  PID:16840
- C:\Windows\System\IoPGbGp.exe
  C:\Windows\System\IoPGbGp.exe
  2⤵
  PID:16864
- C:\Windows\System\LfZKJZT.exe
  C:\Windows\System\LfZKJZT.exe
  2⤵
  PID:16896
- C:\Windows\System\NaxYvAZ.exe
  C:\Windows\System\NaxYvAZ.exe
  2⤵
  PID:16916
- C:\Windows\System\VlAyEZp.exe
  C:\Windows\System\VlAyEZp.exe
  2⤵
  PID:16948
- C:\Windows\System\YKpwSwc.exe
  C:\Windows\System\YKpwSwc.exe
  2⤵
  PID:16984
- C:\Windows\System\JLHEzhi.exe
  C:\Windows\System\JLHEzhi.exe
  2⤵
  PID:17012
- C:\Windows\System\MIuqWtj.exe
  C:\Windows\System\MIuqWtj.exe
  2⤵
  PID:17052
- C:\Windows\System\cUOvLWR.exe
  C:\Windows\System\cUOvLWR.exe
  2⤵
  PID:17084
- C:\Windows\System\dgUSqnY.exe
  C:\Windows\System\dgUSqnY.exe
  2⤵
  PID:17112
- C:\Windows\System\HhDnFct.exe
  C:\Windows\System\HhDnFct.exe
  2⤵
  PID:17288
- C:\Windows\System\QtJltOQ.exe
  C:\Windows\System\QtJltOQ.exe
  2⤵
  PID:17304
- C:\Windows\System\wNYQUKp.exe
  C:\Windows\System\wNYQUKp.exe
  2⤵
  PID:17320
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17320 -s 248
    3⤵
    PID:16780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BByFfPw.exe

Filesize
1.6MB

MD5
019d72e0f398efc685ffa38ee9f1d840

SHA1
b5134c64a20553819c5d29b75c5b0d8bb19caacd

SHA256
6cdcf4bbe3c2c30c4b72c32368941dca6532e478462c24af9b8b81186ef314d6

SHA512
0f55752a844293d38956abed97b12b4ddc38507904b74d00710b24f4dc631d14e342544f1b0641a15bf56c61d4607262b481d1b28eb7fdf85a5faecca2f8ea6f

Download Submit
C:\Windows\System\EeEfWdZ.exe

Filesize
1.6MB

MD5
bd38b46cbba8fa87d676df7ce1c42875

SHA1
6a4323c4bf9a280982c6c553ac9caec821bbf831

SHA256
bec9035303668097b62da43e63731a6249e0b1d5c9765239e6a72d1987659498

SHA512
99ebacfdd8ff7fbdc5f6405f3963b5629cb637a95ecf4463a998906d18393315c36831084d8fdf0201302c2637814968f43f8a35d0a991571d3cee80c346891f

Download Submit
C:\Windows\System\FLbbumP.exe

Filesize
1.6MB

MD5
5bae1c3aa740729d065c56c1c6058499

SHA1
a9ccdaba4c85587f0213f928e8cf498fe24722f6

SHA256
7f37553ada363ce8a4999e37c5518b94ddad51078d15e040c17992505da87ca5

SHA512
13202daf8ee2cf1f7b30b7d87f39c4fe4c2edb5cb251bf1b3dade2c4251463f4500aea2f15c1da3b186119cbd8b9dc97aa8c312c08ac264e0c0f1159a5eebb9a

Download Submit
C:\Windows\System\GeWwtaz.exe

Filesize
1.6MB

MD5
538fd49893abf3cfcf443813ecdac856

SHA1
37ccdd1719e193f9a39b08ded6767ef517d8b1e9

SHA256
8c79dc642cbdb4956d571e9f2283e60bc9b265c062824db20d6bb11387fa2a9d

SHA512
4ee7a37d8e9cb32ceb4cd4cb229d61d8cca1e7c4a5755cc25f0a64e15416ff7a77c115e12ba2a02e9c5e6c438226a2182c61e407072f3a11e49601381fa7575d

Download Submit
C:\Windows\System\HDnAXsG.exe

Filesize
1.6MB

MD5
79626aaf916c5ec2e5342540d39087b7

SHA1
03243da885fa53f04d6f19b1809b844a67d24f58

SHA256
af7858a786c29c3700bd9ff6b84ca2b517d397bd040c6b993c4b21ac8cfac3ca

SHA512
ac83689c4767177171dda32afbe8728a24a437a280114a15f99da2166e8c1a529b4445006f26292eaf41d54cb36ed4749180a417d5653b73290ef0f19055ebd4

Download Submit
C:\Windows\System\POLaoeU.exe

Filesize
1.6MB

MD5
e58331c665325a6c75bd5709ab1bc1bc

SHA1
7c529fd12ac2bf7989af880c8c17b065a5d13308

SHA256
e146b757ef221ade7e311293b3483386b97522707b0105920b14b50b6d7e22f4

SHA512
5782da83feabd95e11c52d76580b8ceb770e5de90bdf85031e7a396fe12f205e78d2c74e7abeffbf783e1ee00752611a3eca307fe27c9ef274dd4b7576abde17

Download Submit
C:\Windows\System\RycRMMY.exe

Filesize
1.6MB

MD5
2a22cfbe5ff6cfcf3c8994ae9192f9a9

SHA1
c7dbcfe4b52117327e20958923442b67c6d06d20

SHA256
5c1cb264bc4dfbc61d26d8580eeec43c87ec252665d6af4f18a1f7ace3a0fea0

SHA512
4a2ea2f50abf4934893670248b27266a0ef9991f66559359e7f4518ea3296df7156bb21d90a05af95f6bed817d22d21c80edbe00dcaa7fbf3281af6d56304f9a

Download Submit
C:\Windows\System\SDFctiu.exe

Filesize
1.6MB

MD5
d25657cebb354e8c512bf6d48510239a

SHA1
d732d1408b3f4b5781b8c49524b690a1b77bd3f8

SHA256
b5d62681860c18c14a645ca86eca15c8e68af0c2d7122a35e26ff6686a4dc50d

SHA512
ecaecd47d29d240f8b8fccae4c40a775f5d42170e73b0d970c823ffa0d66c74d753fc29b0bbbe616282595c4b4787269185479ad4ebd1b37eb4d00796fbeb310

Download Submit
C:\Windows\System\SIZoOxs.exe

Filesize
1.6MB

MD5
dbe84c0e585d0fae21279e4ad6079db9

SHA1
0a5c4bbde67f79863ddc36eac2b7f102018fe5a9

SHA256
b5ac5aa666e161dbd1011523d176ff30286bbb562f8ce021a020e204b24ab826

SHA512
17b47cb3e5aa106920ed2f291cf4f66d939235db5ac5d2d0a0ce96d7e80ec05aed7c254e467181e01b2a336ca8bdaad4a05fbd87e2eada57f0f5ab6033c86f1d

Download Submit
C:\Windows\System\VFCwDZd.exe

Filesize
1.6MB

MD5
032719c8c403a61db7a9a86a8ca22e1c

SHA1
1c9fd014c11971e6a5962ef4b3791a9a49a7c23b

SHA256
0e6076fbf5e9a9e380db03f8f1914d9620d78af52ed61f902af66b04459bb005

SHA512
afec59fcec02af9f99e4696670386a7cd802c814281e7bd306131490344b2f7c484b28054bb6a8cdc7c2b5602210da140b198a72c8cc79a508a4b5b4d631c20c

Download Submit
C:\Windows\System\WqPSUbE.exe

Filesize
1.6MB

MD5
80aeb2df469e18f8c93fc9cdd4e710fe

SHA1
ea497d554b1d26df2f68540ebb63d01d09deb9f2

SHA256
4ddf3576de5e35a30a21cac596740fa38506832996734083b6892732d541490d

SHA512
624f0ffa3e02c6713be56b066d8e4e69733aad6f392c290fae965f4057282462d4b955b35cf5a0bf585b16ee0ebd419a829cd13c4f4b54f28e6ea99dcf275a82

Download Submit
C:\Windows\System\ZvXNnIc.exe

Filesize
1.6MB

MD5
d6c8415f0093de689fe85ebb3316af52

SHA1
89ca3c5b5b5995762e69fa736d8137b81e130844

SHA256
3820d4ba5c3172074dd41b97386ca0c6d964f866f73a51b93a4145f7be30a0f0

SHA512
b3b1b3bae456eab93c08f69ef52cdf35dab15061cc39e4a58c7b4c3ff6aea39f136691e8620dda1cf58a3e3f29d2b955e56691bf4d5bc80ba47a61eb9c724b53

Download Submit
C:\Windows\System\cprBKuf.exe

Filesize
1.6MB

MD5
7a2850de483fd6fd4c8c5183da0ee859

SHA1
07b4915926e02cef1713cee4579a581a38810e80

SHA256
6be4cf99c0b09029e8471540b27b4887f58bbd902135fc1856e501ce5afba6c3

SHA512
912112baa1c048c7c8ae76e184f93b769cf8c50789af3980781d2ba418fe08fcf87b4a7d66743eb0e5d6cfcb3e10fe7853c6ddc785d7f1bb2683d504dc7c0a22

Download Submit
C:\Windows\System\dYfVglm.exe

Filesize
1.6MB

MD5
ea0cee73442e9b878c544f9aea2b9aaa

SHA1
506edafd1a810010809c68e0450277e58e98688f

SHA256
a1515201ca9de4d6d149cb829bd4f069038c09ec8c20a657d257e3310bf3dd6a

SHA512
7d0e7fa8af715a999783e171a504421acf1496815c804eca8c14c6bca1dc858a01eec6586d9ca6a20e5137b7a1471d4980799b7eb29d405c8fcc007a6884c4dc

Download Submit
C:\Windows\System\expeBmS.exe

Filesize
1.6MB

MD5
848fd5ae12d5b0f85bd4f56ec1974e56

SHA1
ef74d37197db3575b986c637271ab4be755d8574

SHA256
ccf3f9e460b8eade025414dd6df75170c2ed0b2bde4ba897d83b90614d03e9c4

SHA512
c0613f65b206d28989905bf22a8a54b28a69a947c145052d063f21917e2802ae6ed6fd8e9a7f4c0aa77e1d6d1643e89b9b3530cd9f4f7162f2f36a17a4c49f1a

Download Submit
C:\Windows\System\fIawZaJ.exe

Filesize
1.6MB

MD5
e169a9dfacfc2747ed6ea665b6375164

SHA1
5ab685a1f299288d4b2ea414eae1d4f124b41732

SHA256
c3681ea2a202acbbb5503b1bd72382cf5c2accafa4b811880d9fbc656ed8ff55

SHA512
7a4149f67c9f16ef94a53b8dc85d42516e649105d4f5b0761f41633f641b0140a93a5f12b21e682975c2bddfdf49e352ce489224e1a7fde3853ac67b53812142

Download Submit
C:\Windows\System\faLgQuH.exe

Filesize
1.6MB

MD5
21ebc17aa21e21aa2844220c8eabec09

SHA1
66cc2a2155c567e5630abf0dd9015b44f0a25c39

SHA256
7e89613ef0aa41380727748439f847ab54e13ef9e503c071c6c00373ec42043d

SHA512
9d9f53521479f78f4101a0a4e8891bc6d87fc2e9b7f294e4893d61ebe07c187a305190b5d144614db7763544a5a21293f9dce12cbce550ae950c96b7dfe15a86

Download Submit
C:\Windows\System\gWvgPvE.exe

Filesize
1.6MB

MD5
b20031aa7545ae839305b3ca190f5476

SHA1
24703857d490e94da1e8905d6e80ff19113fed70

SHA256
2e6045dcbcb98a4c9da7f5d7d4a2cfd8959cd48c9467235a0640a0c83378516e

SHA512
108f37a740eaab5392fe9c72f3c18a7b4cbf70324a6a4c672f1733f7e9d773573b43a64eb5eb40fa9c9496ff0fcf5e9cdf9795c30247d38d38552c6a6427c7f2

Download Submit
C:\Windows\System\glpObYX.exe

Filesize
1.6MB

MD5
3939c147ef2ec7d1c87787855df928d0

SHA1
0dccf706f8794d93fca31f7a467ed080eead3063

SHA256
fbe3d4ddb999edd2c2b27d983c54f8fd6b6357e7a9cd2958c16ac3423fe269bf

SHA512
7b903090e5ccfa5a5fc0397e4171868207a959dc193c9d5b7f236caf2241de674042145fb28b6569dd8d20b7cf89ad437bab0e7aaec7a9c5009f5ecc710644cc

Download Submit
C:\Windows\System\khejeGy.exe

Filesize
1.6MB

MD5
6c0f95f0cf7a73d4500d194ac8814934

SHA1
e19a4bc411d27b48c75eb76955d653abac335697

SHA256
1a78b3c8fe2c7dbad61059285d385ec9ce819885229809235ad28e4a09566df1

SHA512
2e294f6141e9a8f544885370d22ddd22d00726c5ac2fbe391b37e15cabcdca814c2d3b7f9b196a1c867c282181cd435db450a96563f3bc09d583ab59b8ed043f

Download Submit
C:\Windows\System\kwysRYG.exe

Filesize
1.6MB

MD5
5c5eea68b27dfaedde7d6c8b61f94c73

SHA1
51926525e94aa674897761cee25c1cbf1f982bd9

SHA256
0623576c1c22846a92a7e82f386243dbc3ebd2675922522fbf82a1c6d3708de4

SHA512
33cbcb1abdae537474e4e208a8ffb25cf458a55e75ecb71bd85c88f2685a0f529fbf3b97adfca11763340e3bba56924577d7e49dbf5be62a7174ee618700f01c

Download Submit
C:\Windows\System\lnOrdtk.exe

Filesize
1.6MB

MD5
20db542a8f68a965e487e189cf788761

SHA1
a2d2c02694342bf2c9940635d008d5cd238301a5

SHA256
eb889a7b4570ec27603e9f0d14cdba26bb5870cdb1717664d549bcccc644d2ce

SHA512
8dccbdfc1c782b0e37762e8df3e1d3d69e2e178f60d500668284e1cf5899701ea94b8f2f4df0eb25f53b8cee7a3de930ac471cc8546eee61959354595ff04b6b

Download Submit
C:\Windows\System\oCmPzCi.exe

Filesize
1.6MB

MD5
cbe96607675d91c7fb57bb15a61b2da1

SHA1
b466493748ff1f75b3a3a8469d17c20bcfc5c4a8

SHA256
85460c460c737048923610f0e7ceb1c33ab97c17e0a172c084f3a469029bb5fc

SHA512
f128cdf38d1fed0b38386d7bf1f1ff5f1a12d16c1943a60525a43eacd6f46e914663549889bdcc09e12467980d175103032ddb1fcf375452545cee31b7215917

Download Submit
C:\Windows\System\pkQiapI.exe

Filesize
1.6MB

MD5
317eab32839540e7a196575cc4ff9872

SHA1
4de8449283f4ddfddda472c6d4fe21dc9a7ceae9

SHA256
769ca46c9229684c108b1758496f4de2a8b0851fc3cec78e8cca035944c1fb6a

SHA512
d5421910e24fc3fb6ea3c537d043a5cf02b1774518a4f6243e0381df40e3ad47baa2dbfac78694a88eda827db1b1ba30bc709e3284982b999ce556d0229692b9

Download Submit
C:\Windows\System\rEZLHBG.exe

Filesize
1.6MB

MD5
cd021724dfe6a707384beb725e82655d

SHA1
7722363874571a961fffef1f145a0fac39953f56

SHA256
0b98c8d1db254656cc8f023d26de27df2d5e1f21b36f0e53a2ba88fbf8a019ea

SHA512
af530994dd0965097b0ae9ea2cf4e2de425567b5531ecdb47a093d4a007c70c584785501e85e28dc290e0e299046242ade14f69a2a571e47ee7cd642c87cb86e

Download Submit
C:\Windows\System\rUiLxwT.exe

Filesize
1.6MB

MD5
8fb86a6b9e5f78f499689063deee3fc7

SHA1
608018204ddd32251fdca3a713946f219e8f8cc0

SHA256
b6baf723993932421fcaa4dc97eb8955048c77364a14f23c18c2ed2d3cd31831

SHA512
938d3efe8768df808820f9fb9096137f0407696d1cc19ac74d61413a0885e72e5765a4a2d1dde36b3f104a952d88f111959e092f7bc8241d68947195c98e7bff

Download Submit
C:\Windows\System\sMCVCWT.exe

Filesize
1.6MB

MD5
5e68a30c60f34b98452bfd1b381cb300

SHA1
5fe022bfde12a5c03977d371ae601aea5c4783ae

SHA256
865ac4cefd73ed601de5379e921442c55c9a9c37daa87a668dc07d779de61b73

SHA512
0faecf69f2dab73d52702630dcf3a32269fdaf24d7a23f44abb9a3360126f6364329903f2cf2b133e2e29ad3b1339876d794c4da0edb1b57221da9bfd9d99a25

Download Submit
C:\Windows\System\tQhwMij.exe

Filesize
1.6MB

MD5
fcc1b13cf0cf267924929e0d01bc9acc

SHA1
cb0a831a8f365713a0bd3b600607fcc86f76eb3d

SHA256
e4558bab20abfc55805fbdd452a2c00ad26a33a3e0179d3a818febe444a32ef1

SHA512
77130f600bb0f230f402a5654cb0008e28a9480da462577344bb085ca46f2c8a44e96de8ec9038e143ca3542cea7d347c32ee95765703caf89d58790f586da5c

Download Submit
C:\Windows\System\vBnnvGn.exe

Filesize
1.6MB

MD5
1458cac4a5a26f03c0b37d5db3e4e381

SHA1
c89512507dbcb0b0dd1c75b461a079e2dda2bc34

SHA256
65a96074efbae5bbe40090a4ade6356ce2d2d86c4fd27f06c483c701615ba860

SHA512
27625a1002181bc04a1c95308a8780b69af22359ff0e76b2ad6edbd3f152086a15e4c9f4c38cac87f91c258fa186c47065b91c6fe8fc999b50b715677dfe8d10

Download Submit
C:\Windows\System\vFTUucn.exe

Filesize
1.6MB

MD5
2934f1d411b66215c55a884fb749d59a

SHA1
d06ddeeedb4320ae9b946aab87f04c910c27bfb9

SHA256
02259291f10a5120ebc02755d6fa99e6ff6b61b80e8e9d749dd542b928f29f90

SHA512
90f11e460b7d096f34ddb184280aa26232e8d7d5c14868af932607692d2fe086b82cee10e99e029a31a9a580ebfa124a91cf969aef95ec7194aec834fc76faab

Download Submit
C:\Windows\System\xAZfOFe.exe

Filesize
1.6MB

MD5
6198f8eb7f5eb4406a3b9567322fafbf

SHA1
56548ac8182b1893b4555e3ab7b12b8dfe7984eb

SHA256
c7d66f187bb79d729e7b935e4fbba4f38228b02047fd4840e4eac3239104fb63

SHA512
84f7fd7cce3aa8549b1db1ab3d322d30e38603f76c46c179e3a6be472a7cf3d126e8b7ae0cd1200aba1ddbfdaf32c0a9d6aedd03c83bbe452caca9bb925b1b08

Download Submit
C:\Windows\System\yJaGXfY.exe

Filesize
1.6MB

MD5
1d6c70be72a3d4644cb354c4626049dc

SHA1
8c48352731c0b5c083776787b417527b084caa0d

SHA256
a98aa2a17e3c794070c3f90d17fdd60abcb9b6834871a26e22f319470f0cc4cf

SHA512
951116e40b64f0747ca62ce8319271669c4c6d5d9252f1d028aaebc5de2c455e162e0540a97e635f267c156822da4ef54f7172274b373d3d22f18f2db0c878a1

Download Submit
C:\Windows\System\ygwXsQu.exe

Filesize
1.6MB

MD5
57f2b44cd91904ba8e6053b004b6442a

SHA1
2994f0c1aaaca421cfea99acf0f2db131f0ae16e

SHA256
04cff08db355430bea78fdb07ebec6b20d9452612556fbc6cecd25da8814346e

SHA512
08f12af3c6615f7ccd2d98cd5f8ca42a86a40510d1fb33ca973738e1cfe54ae99f14dbe20d03a586e76c70326c8e0f4d88e111b5f46db9c24ccac2df3ca21ebd

Download Submit
C:\Windows\System\yynJUfI.exe

Filesize
1.6MB

MD5
7ffea985fae3ab78f8bd38b8ff2859fd

SHA1
e85a784cce684a5c9ab6d17a3b752c573aeb5112

SHA256
85e6c052a226d35087fdda95c2d50e210f7bb9f33fdb0a5a6524682cee53b932

SHA512
383d33fd4104d55b29b0bc977de65ddab7ea810f22891afd81f69316a79e3f45a8bd4af8aff49a8e0370a8cd2595b2e6b0c84953aaedd9608da54bf6255f4fc2

Download Submit
memory/1340-0-0x000001A39F0E0000-0x000001A39F0F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads