xmrig | 4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
Size

1.8MB
MD5

fed993cadd2cc448973d0cb4b811ba4e
SHA1

31ea2c63bc303de7123301e2e39abadc6014d423
SHA256

4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa
SHA512

0177833d92154cad2375d9b9b7957ba371846a96e8a5086cd5a129e5b6ce4f1b0b5f6c486eda07bd28ffb052da785f56c4a9bb902b8701df418724adc1bb9fb8
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRvzcd8M3wN7K8e:GemTLkNdfE0pZys

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b82-4.dat	xmrig
behavioral2/files/0x0007000000023c78-9.dat	xmrig
behavioral2/files/0x0007000000023c79-14.dat	xmrig
behavioral2/files/0x0007000000023c7a-19.dat	xmrig
behavioral2/files/0x0007000000023c7c-38.dat	xmrig
behavioral2/files/0x0007000000023c80-48.dat	xmrig
behavioral2/files/0x0007000000023c82-60.dat	xmrig
behavioral2/files/0x0007000000023c84-69.dat	xmrig
behavioral2/files/0x0007000000023c83-85.dat	xmrig
behavioral2/files/0x0007000000023c85-95.dat	xmrig
behavioral2/files/0x0007000000023c88-93.dat	xmrig
behavioral2/files/0x0007000000023c87-91.dat	xmrig
behavioral2/files/0x0007000000023c86-89.dat	xmrig
behavioral2/files/0x0008000000023c75-79.dat	xmrig
behavioral2/files/0x0007000000023c81-66.dat	xmrig
behavioral2/files/0x0007000000023c7f-52.dat	xmrig
behavioral2/files/0x0007000000023c7d-42.dat	xmrig
behavioral2/files/0x0007000000023c7e-45.dat	xmrig
behavioral2/files/0x0007000000023c7b-24.dat	xmrig
behavioral2/files/0x0007000000023c89-99.dat	xmrig
behavioral2/files/0x0007000000023c8a-103.dat	xmrig
behavioral2/files/0x0007000000023c8b-109.dat	xmrig
behavioral2/files/0x0007000000023c8c-115.dat	xmrig
behavioral2/files/0x0007000000023c8e-119.dat	xmrig
behavioral2/files/0x0007000000023c8f-123.dat	xmrig
behavioral2/files/0x0007000000023c90-134.dat	xmrig
behavioral2/files/0x0007000000023c92-136.dat	xmrig
behavioral2/files/0x0007000000023c91-149.dat	xmrig
behavioral2/files/0x0007000000023c95-155.dat	xmrig
behavioral2/files/0x0007000000023c94-153.dat	xmrig
behavioral2/files/0x0007000000023c93-151.dat	xmrig
behavioral2/files/0x0007000000023c96-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
312	XWpNdlC.exe
4944	taPibwK.exe
2964	QkmWEGf.exe
216	JWpkGqx.exe
2376	WxKTHGf.exe
3144	UVWNCtI.exe
368	fXDFepG.exe
2288	egnnbOG.exe
1120	bMuWqHh.exe
2020	ryTyfKI.exe
4756	MAEPFtM.exe
2856	gmewodf.exe
3752	gtsYMVV.exe
3288	COFqyys.exe
1600	QKAQoCu.exe
3120	ByaCGKk.exe
632	XEFaiCq.exe
4724	dZThCzw.exe
1592	RPqYxEB.exe
3720	cvzzWjG.exe
3316	FQgdnrt.exe
4316	ankbOyf.exe
2644	MBWiXsb.exe
4596	gnWTjhx.exe
3328	KvljeTn.exe
3176	xtmtVzT.exe
3568	oGEqvax.exe
2160	RSuOXVD.exe
4544	IUdwQGU.exe
4008	reIuSNH.exe
1636	ukVXyDG.exe
1464	SQIDXTS.exe
4340	MNLgNwY.exe
968	HFfIzZS.exe
2224	cBscacB.exe
3596	wCRPXcV.exe
3812	gqgYLal.exe
4548	YIRusTL.exe
4204	bQkFThG.exe
2516	cZfUtIQ.exe
1236	hbhxSoh.exe
3016	BplQEgw.exe
2408	SIkSyhd.exe
3164	GBzsbGw.exe
2908	cXVoTub.exe
3760	cOvnSKm.exe
828	blsmLHm.exe
1072	GWYonPy.exe
4352	SKfExut.exe
4740	eZTvLrJ.exe
1184	KmuuipV.exe
5036	yroIsoL.exe
1792	YuwNKBR.exe
4684	XrDRktL.exe
2572	PeNHLSK.exe
4392	VpmnbJk.exe
3084	mhZEywE.exe
3128	bLgFAZU.exe
5056	GOZDvLL.exe
2016	VwHtGax.exe
3764	YHFzxRz.exe
2828	qGQIcnB.exe
1476	aXxtxlB.exe
2312	TBUAUbP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lpkFYfQ.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\vwhkOBl.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\XVuiBox.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\blsmLHm.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\FERIFpG.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\bjgNlUT.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\BlJHzKC.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\yksrVtX.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\NNpDMAH.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\tLCbfIV.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\hDeOdgB.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\MHCayZT.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\nXNtRTO.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\bMuWqHh.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\FZtLkNF.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\GWYonPy.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\wZCovrA.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\wZyFaHa.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\aGtMIlf.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\uRJALAF.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\SRpGYJm.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\Vjiamth.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\GoSATNk.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\lmYqLAQ.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\HbSqhdW.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\psyLiYJ.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\CdEfLrk.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\oDaVDCR.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\qdDsXbl.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\cvsGjFF.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\XfkBRKf.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\mdorziB.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\ouUdFsg.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\IbVNHjE.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\lyLvWHD.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\yLuneFm.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\yDujBTb.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\JStsNiL.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\NITYSOj.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\rnMKRHx.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\IlfdlHC.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\RRxuovg.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\GiMrugm.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\ZWULJTW.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\lkXXrLP.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\WSPCnqK.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\FybwyWp.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\XMRViUZ.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\KJQHlYv.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\ZQdxGIW.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\cYgPGaO.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\HdulEkQ.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\wQCaNRY.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\ryTyfKI.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\FTJWVOD.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\WFRyJnX.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\hwiEoAK.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\gdDxgmm.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\PoedKui.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\bdxlNJp.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\CfkAPVe.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\uRRttHV.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\aMmCgHH.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
File created	C:\Windows\System\QFiDbex.exe	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 312	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	86
PID 4996 wrote to memory of 312	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	86
PID 4996 wrote to memory of 4944	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	87
PID 4996 wrote to memory of 4944	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	87
PID 4996 wrote to memory of 2964	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	88
PID 4996 wrote to memory of 2964	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	88
PID 4996 wrote to memory of 216	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	89
PID 4996 wrote to memory of 216	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	89
PID 4996 wrote to memory of 2376	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	90
PID 4996 wrote to memory of 2376	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	90
PID 4996 wrote to memory of 3144	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	91
PID 4996 wrote to memory of 3144	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	91
PID 4996 wrote to memory of 368	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	92
PID 4996 wrote to memory of 368	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	92
PID 4996 wrote to memory of 2288	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	93
PID 4996 wrote to memory of 2288	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	93
PID 4996 wrote to memory of 1120	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	94
PID 4996 wrote to memory of 1120	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	94
PID 4996 wrote to memory of 2020	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	95
PID 4996 wrote to memory of 2020	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	95
PID 4996 wrote to memory of 4756	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	96
PID 4996 wrote to memory of 4756	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	96
PID 4996 wrote to memory of 2856	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	97
PID 4996 wrote to memory of 2856	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	97
PID 4996 wrote to memory of 3752	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	98
PID 4996 wrote to memory of 3752	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	98
PID 4996 wrote to memory of 3288	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	99
PID 4996 wrote to memory of 3288	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	99
PID 4996 wrote to memory of 1600	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	100
PID 4996 wrote to memory of 1600	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	100
PID 4996 wrote to memory of 3120	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	101
PID 4996 wrote to memory of 3120	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	101
PID 4996 wrote to memory of 632	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	102
PID 4996 wrote to memory of 632	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	102
PID 4996 wrote to memory of 4724	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	103
PID 4996 wrote to memory of 4724	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	103
PID 4996 wrote to memory of 1592	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	104
PID 4996 wrote to memory of 1592	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	104
PID 4996 wrote to memory of 3720	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	105
PID 4996 wrote to memory of 3720	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	105
PID 4996 wrote to memory of 3316	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	106
PID 4996 wrote to memory of 3316	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	106
PID 4996 wrote to memory of 4316	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	107
PID 4996 wrote to memory of 4316	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	107
PID 4996 wrote to memory of 2644	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	108
PID 4996 wrote to memory of 2644	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	108
PID 4996 wrote to memory of 4596	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	109
PID 4996 wrote to memory of 4596	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	109
PID 4996 wrote to memory of 3328	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	110
PID 4996 wrote to memory of 3328	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	110
PID 4996 wrote to memory of 3176	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	111
PID 4996 wrote to memory of 3176	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	111
PID 4996 wrote to memory of 3568	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	112
PID 4996 wrote to memory of 3568	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	112
PID 4996 wrote to memory of 2160	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	113
PID 4996 wrote to memory of 2160	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	113
PID 4996 wrote to memory of 4544	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	114
PID 4996 wrote to memory of 4544	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	114
PID 4996 wrote to memory of 4008	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	115
PID 4996 wrote to memory of 4008	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	115
PID 4996 wrote to memory of 1636	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	116
PID 4996 wrote to memory of 1636	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	116
PID 4996 wrote to memory of 1464	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	117
PID 4996 wrote to memory of 1464	4996	4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe	117

C:\Users\Admin\AppData\Local\Temp\4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe
"C:\Users\Admin\AppData\Local\Temp\4dc48707204793fa1b2a55fc0bda2f5a1aca49ee1269553f19dff4cc36e296aa.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\System\XWpNdlC.exe
  C:\Windows\System\XWpNdlC.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\taPibwK.exe
  C:\Windows\System\taPibwK.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\QkmWEGf.exe
  C:\Windows\System\QkmWEGf.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\JWpkGqx.exe
  C:\Windows\System\JWpkGqx.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\WxKTHGf.exe
  C:\Windows\System\WxKTHGf.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\UVWNCtI.exe
  C:\Windows\System\UVWNCtI.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\fXDFepG.exe
  C:\Windows\System\fXDFepG.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\egnnbOG.exe
  C:\Windows\System\egnnbOG.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\bMuWqHh.exe
  C:\Windows\System\bMuWqHh.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\ryTyfKI.exe
  C:\Windows\System\ryTyfKI.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\MAEPFtM.exe
  C:\Windows\System\MAEPFtM.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\gmewodf.exe
  C:\Windows\System\gmewodf.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\gtsYMVV.exe
  C:\Windows\System\gtsYMVV.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\COFqyys.exe
  C:\Windows\System\COFqyys.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\QKAQoCu.exe
  C:\Windows\System\QKAQoCu.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ByaCGKk.exe
  C:\Windows\System\ByaCGKk.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\XEFaiCq.exe
  C:\Windows\System\XEFaiCq.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\dZThCzw.exe
  C:\Windows\System\dZThCzw.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\RPqYxEB.exe
  C:\Windows\System\RPqYxEB.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\cvzzWjG.exe
  C:\Windows\System\cvzzWjG.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\FQgdnrt.exe
  C:\Windows\System\FQgdnrt.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\ankbOyf.exe
  C:\Windows\System\ankbOyf.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\MBWiXsb.exe
  C:\Windows\System\MBWiXsb.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\gnWTjhx.exe
  C:\Windows\System\gnWTjhx.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\KvljeTn.exe
  C:\Windows\System\KvljeTn.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\xtmtVzT.exe
  C:\Windows\System\xtmtVzT.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\oGEqvax.exe
  C:\Windows\System\oGEqvax.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\RSuOXVD.exe
  C:\Windows\System\RSuOXVD.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\IUdwQGU.exe
  C:\Windows\System\IUdwQGU.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\reIuSNH.exe
  C:\Windows\System\reIuSNH.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\ukVXyDG.exe
  C:\Windows\System\ukVXyDG.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\SQIDXTS.exe
  C:\Windows\System\SQIDXTS.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\MNLgNwY.exe
  C:\Windows\System\MNLgNwY.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\HFfIzZS.exe
  C:\Windows\System\HFfIzZS.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\cBscacB.exe
  C:\Windows\System\cBscacB.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\wCRPXcV.exe
  C:\Windows\System\wCRPXcV.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\gqgYLal.exe
  C:\Windows\System\gqgYLal.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\YIRusTL.exe
  C:\Windows\System\YIRusTL.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\bQkFThG.exe
  C:\Windows\System\bQkFThG.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\cZfUtIQ.exe
  C:\Windows\System\cZfUtIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\hbhxSoh.exe
  C:\Windows\System\hbhxSoh.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\BplQEgw.exe
  C:\Windows\System\BplQEgw.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\SIkSyhd.exe
  C:\Windows\System\SIkSyhd.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\GBzsbGw.exe
  C:\Windows\System\GBzsbGw.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\cXVoTub.exe
  C:\Windows\System\cXVoTub.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\cOvnSKm.exe
  C:\Windows\System\cOvnSKm.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\blsmLHm.exe
  C:\Windows\System\blsmLHm.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\GWYonPy.exe
  C:\Windows\System\GWYonPy.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\SKfExut.exe
  C:\Windows\System\SKfExut.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\eZTvLrJ.exe
  C:\Windows\System\eZTvLrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\KmuuipV.exe
  C:\Windows\System\KmuuipV.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\yroIsoL.exe
  C:\Windows\System\yroIsoL.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\YuwNKBR.exe
  C:\Windows\System\YuwNKBR.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\XrDRktL.exe
  C:\Windows\System\XrDRktL.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\PeNHLSK.exe
  C:\Windows\System\PeNHLSK.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\VpmnbJk.exe
  C:\Windows\System\VpmnbJk.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\mhZEywE.exe
  C:\Windows\System\mhZEywE.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\bLgFAZU.exe
  C:\Windows\System\bLgFAZU.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\GOZDvLL.exe
  C:\Windows\System\GOZDvLL.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\VwHtGax.exe
  C:\Windows\System\VwHtGax.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\YHFzxRz.exe
  C:\Windows\System\YHFzxRz.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\qGQIcnB.exe
  C:\Windows\System\qGQIcnB.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\aXxtxlB.exe
  C:\Windows\System\aXxtxlB.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\TBUAUbP.exe
  C:\Windows\System\TBUAUbP.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\xoRPFdM.exe
  C:\Windows\System\xoRPFdM.exe
  2⤵
  PID:944
- C:\Windows\System\cvsGjFF.exe
  C:\Windows\System\cvsGjFF.exe
  2⤵
  PID:1944
- C:\Windows\System\ASoCNwd.exe
  C:\Windows\System\ASoCNwd.exe
  2⤵
  PID:4076
- C:\Windows\System\beSdZOS.exe
  C:\Windows\System\beSdZOS.exe
  2⤵
  PID:5012
- C:\Windows\System\FybwyWp.exe
  C:\Windows\System\FybwyWp.exe
  2⤵
  PID:3132
- C:\Windows\System\slpRKsN.exe
  C:\Windows\System\slpRKsN.exe
  2⤵
  PID:5020
- C:\Windows\System\tphZIbr.exe
  C:\Windows\System\tphZIbr.exe
  2⤵
  PID:1144
- C:\Windows\System\PHybxNK.exe
  C:\Windows\System\PHybxNK.exe
  2⤵
  PID:876
- C:\Windows\System\QhqpIDv.exe
  C:\Windows\System\QhqpIDv.exe
  2⤵
  PID:468
- C:\Windows\System\bsoLGIv.exe
  C:\Windows\System\bsoLGIv.exe
  2⤵
  PID:1672
- C:\Windows\System\SSgwbnI.exe
  C:\Windows\System\SSgwbnI.exe
  2⤵
  PID:972
- C:\Windows\System\bZUlpVF.exe
  C:\Windows\System\bZUlpVF.exe
  2⤵
  PID:2360
- C:\Windows\System\QwqsrFI.exe
  C:\Windows\System\QwqsrFI.exe
  2⤵
  PID:5108
- C:\Windows\System\coCmXbk.exe
  C:\Windows\System\coCmXbk.exe
  2⤵
  PID:4176
- C:\Windows\System\rAjjNWF.exe
  C:\Windows\System\rAjjNWF.exe
  2⤵
  PID:4436
- C:\Windows\System\fjADCwv.exe
  C:\Windows\System\fjADCwv.exe
  2⤵
  PID:4552
- C:\Windows\System\CwoizbT.exe
  C:\Windows\System\CwoizbT.exe
  2⤵
  PID:4012
- C:\Windows\System\VjXjfbK.exe
  C:\Windows\System\VjXjfbK.exe
  2⤵
  PID:3588
- C:\Windows\System\gIJrNDs.exe
  C:\Windows\System\gIJrNDs.exe
  2⤵
  PID:3156
- C:\Windows\System\drwEMmU.exe
  C:\Windows\System\drwEMmU.exe
  2⤵
  PID:3240
- C:\Windows\System\MMCqDlt.exe
  C:\Windows\System\MMCqDlt.exe
  2⤵
  PID:2652
- C:\Windows\System\CJsCklW.exe
  C:\Windows\System\CJsCklW.exe
  2⤵
  PID:4476
- C:\Windows\System\kNiurog.exe
  C:\Windows\System\kNiurog.exe
  2⤵
  PID:2112
- C:\Windows\System\OXXQWnU.exe
  C:\Windows\System\OXXQWnU.exe
  2⤵
  PID:784
- C:\Windows\System\JnclZcR.exe
  C:\Windows\System\JnclZcR.exe
  2⤵
  PID:1952
- C:\Windows\System\AIPIrVe.exe
  C:\Windows\System\AIPIrVe.exe
  2⤵
  PID:4412
- C:\Windows\System\NKLsocl.exe
  C:\Windows\System\NKLsocl.exe
  2⤵
  PID:2268
- C:\Windows\System\iwfrTjV.exe
  C:\Windows\System\iwfrTjV.exe
  2⤵
  PID:3172
- C:\Windows\System\aHNYRJK.exe
  C:\Windows\System\aHNYRJK.exe
  2⤵
  PID:4312
- C:\Windows\System\nyIqVMv.exe
  C:\Windows\System\nyIqVMv.exe
  2⤵
  PID:4988
- C:\Windows\System\GMqYwnn.exe
  C:\Windows\System\GMqYwnn.exe
  2⤵
  PID:4288
- C:\Windows\System\slUoovQ.exe
  C:\Windows\System\slUoovQ.exe
  2⤵
  PID:5076
- C:\Windows\System\GxJItra.exe
  C:\Windows\System\GxJItra.exe
  2⤵
  PID:4268
- C:\Windows\System\qhegkKx.exe
  C:\Windows\System\qhegkKx.exe
  2⤵
  PID:2248
- C:\Windows\System\YreQIZw.exe
  C:\Windows\System\YreQIZw.exe
  2⤵
  PID:4564
- C:\Windows\System\qgoPmDJ.exe
  C:\Windows\System\qgoPmDJ.exe
  2⤵
  PID:4272
- C:\Windows\System\BIebVQZ.exe
  C:\Windows\System\BIebVQZ.exe
  2⤵
  PID:4260
- C:\Windows\System\vqtxBMw.exe
  C:\Windows\System\vqtxBMw.exe
  2⤵
  PID:2800
- C:\Windows\System\iNZuwIw.exe
  C:\Windows\System\iNZuwIw.exe
  2⤵
  PID:2612
- C:\Windows\System\ZLUgHDH.exe
  C:\Windows\System\ZLUgHDH.exe
  2⤵
  PID:1712
- C:\Windows\System\zUlQGBc.exe
  C:\Windows\System\zUlQGBc.exe
  2⤵
  PID:5152
- C:\Windows\System\MoCuyYx.exe
  C:\Windows\System\MoCuyYx.exe
  2⤵
  PID:5176
- C:\Windows\System\ODpQTik.exe
  C:\Windows\System\ODpQTik.exe
  2⤵
  PID:5200
- C:\Windows\System\GoFCXOj.exe
  C:\Windows\System\GoFCXOj.exe
  2⤵
  PID:5224
- C:\Windows\System\lxdbnGi.exe
  C:\Windows\System\lxdbnGi.exe
  2⤵
  PID:5252
- C:\Windows\System\oowwddA.exe
  C:\Windows\System\oowwddA.exe
  2⤵
  PID:5288
- C:\Windows\System\JStsNiL.exe
  C:\Windows\System\JStsNiL.exe
  2⤵
  PID:5304
- C:\Windows\System\mgbPfHw.exe
  C:\Windows\System\mgbPfHw.exe
  2⤵
  PID:5328
- C:\Windows\System\sIIjThY.exe
  C:\Windows\System\sIIjThY.exe
  2⤵
  PID:5352
- C:\Windows\System\jrxgizj.exe
  C:\Windows\System\jrxgizj.exe
  2⤵
  PID:5376
- C:\Windows\System\EnoZoQc.exe
  C:\Windows\System\EnoZoQc.exe
  2⤵
  PID:5400
- C:\Windows\System\SCHoqZg.exe
  C:\Windows\System\SCHoqZg.exe
  2⤵
  PID:5432
- C:\Windows\System\tPjcFFj.exe
  C:\Windows\System\tPjcFFj.exe
  2⤵
  PID:5468
- C:\Windows\System\XeZaKnR.exe
  C:\Windows\System\XeZaKnR.exe
  2⤵
  PID:5504
- C:\Windows\System\pLlzJqr.exe
  C:\Windows\System\pLlzJqr.exe
  2⤵
  PID:5532
- C:\Windows\System\MdhAPzu.exe
  C:\Windows\System\MdhAPzu.exe
  2⤵
  PID:5560
- C:\Windows\System\CBULsTz.exe
  C:\Windows\System\CBULsTz.exe
  2⤵
  PID:5596
- C:\Windows\System\gjtFlWE.exe
  C:\Windows\System\gjtFlWE.exe
  2⤵
  PID:5620
- C:\Windows\System\hatqzHG.exe
  C:\Windows\System\hatqzHG.exe
  2⤵
  PID:5648
- C:\Windows\System\TtQbMYQ.exe
  C:\Windows\System\TtQbMYQ.exe
  2⤵
  PID:5684
- C:\Windows\System\CBYPHMY.exe
  C:\Windows\System\CBYPHMY.exe
  2⤵
  PID:5712
- C:\Windows\System\TrzEJcK.exe
  C:\Windows\System\TrzEJcK.exe
  2⤵
  PID:5744
- C:\Windows\System\JGoYURx.exe
  C:\Windows\System\JGoYURx.exe
  2⤵
  PID:5760
- C:\Windows\System\sLsjdRy.exe
  C:\Windows\System\sLsjdRy.exe
  2⤵
  PID:5792
- C:\Windows\System\OKGDGsd.exe
  C:\Windows\System\OKGDGsd.exe
  2⤵
  PID:5824
- C:\Windows\System\IvWGduz.exe
  C:\Windows\System\IvWGduz.exe
  2⤵
  PID:5856
- C:\Windows\System\YbFiNNg.exe
  C:\Windows\System\YbFiNNg.exe
  2⤵
  PID:5884
- C:\Windows\System\IDfToQF.exe
  C:\Windows\System\IDfToQF.exe
  2⤵
  PID:5916
- C:\Windows\System\UluUHfO.exe
  C:\Windows\System\UluUHfO.exe
  2⤵
  PID:5940
- C:\Windows\System\WgjfbUg.exe
  C:\Windows\System\WgjfbUg.exe
  2⤵
  PID:5980
- C:\Windows\System\yWOmDTV.exe
  C:\Windows\System\yWOmDTV.exe
  2⤵
  PID:6000
- C:\Windows\System\xFamRdJ.exe
  C:\Windows\System\xFamRdJ.exe
  2⤵
  PID:6036
- C:\Windows\System\clShqJv.exe
  C:\Windows\System\clShqJv.exe
  2⤵
  PID:6052
- C:\Windows\System\tgffkLa.exe
  C:\Windows\System\tgffkLa.exe
  2⤵
  PID:6080
- C:\Windows\System\BiSPYBY.exe
  C:\Windows\System\BiSPYBY.exe
  2⤵
  PID:6108
- C:\Windows\System\RXqgvDp.exe
  C:\Windows\System\RXqgvDp.exe
  2⤵
  PID:6136
- C:\Windows\System\Vtdrktm.exe
  C:\Windows\System\Vtdrktm.exe
  2⤵
  PID:5128
- C:\Windows\System\sZHkAPm.exe
  C:\Windows\System\sZHkAPm.exe
  2⤵
  PID:5196
- C:\Windows\System\tLCbfIV.exe
  C:\Windows\System\tLCbfIV.exe
  2⤵
  PID:5220
- C:\Windows\System\KeYYNSz.exe
  C:\Windows\System\KeYYNSz.exe
  2⤵
  PID:5324
- C:\Windows\System\nQaktGh.exe
  C:\Windows\System\nQaktGh.exe
  2⤵
  PID:5392
- C:\Windows\System\CLMPHPI.exe
  C:\Windows\System\CLMPHPI.exe
  2⤵
  PID:5496
- C:\Windows\System\bnSpJdk.exe
  C:\Windows\System\bnSpJdk.exe
  2⤵
  PID:5572
- C:\Windows\System\xvQXiTz.exe
  C:\Windows\System\xvQXiTz.exe
  2⤵
  PID:5588
- C:\Windows\System\HziKtIY.exe
  C:\Windows\System\HziKtIY.exe
  2⤵
  PID:5616
- C:\Windows\System\CXoWWTc.exe
  C:\Windows\System\CXoWWTc.exe
  2⤵
  PID:5724
- C:\Windows\System\SaqKoFV.exe
  C:\Windows\System\SaqKoFV.exe
  2⤵
  PID:5816
- C:\Windows\System\RahYstj.exe
  C:\Windows\System\RahYstj.exe
  2⤵
  PID:5848
- C:\Windows\System\GLLBqkJ.exe
  C:\Windows\System\GLLBqkJ.exe
  2⤵
  PID:5952
- C:\Windows\System\AFJinXQ.exe
  C:\Windows\System\AFJinXQ.exe
  2⤵
  PID:6028
- C:\Windows\System\azdNfKx.exe
  C:\Windows\System\azdNfKx.exe
  2⤵
  PID:6100
- C:\Windows\System\NtvFzmN.exe
  C:\Windows\System\NtvFzmN.exe
  2⤵
  PID:6120
- C:\Windows\System\opyIQEn.exe
  C:\Windows\System\opyIQEn.exe
  2⤵
  PID:5184
- C:\Windows\System\JrriwyV.exe
  C:\Windows\System\JrriwyV.exe
  2⤵
  PID:5336
- C:\Windows\System\cNriAeZ.exe
  C:\Windows\System\cNriAeZ.exe
  2⤵
  PID:5548
- C:\Windows\System\vQtNsTt.exe
  C:\Windows\System\vQtNsTt.exe
  2⤵
  PID:5632
- C:\Windows\System\GxHSPAd.exe
  C:\Windows\System\GxHSPAd.exe
  2⤵
  PID:5776
- C:\Windows\System\DQMwfwP.exe
  C:\Windows\System\DQMwfwP.exe
  2⤵
  PID:6008
- C:\Windows\System\QHxHRba.exe
  C:\Windows\System\QHxHRba.exe
  2⤵
  PID:5172
- C:\Windows\System\CzqECde.exe
  C:\Windows\System\CzqECde.exe
  2⤵
  PID:5420
- C:\Windows\System\LAaEdSp.exe
  C:\Windows\System\LAaEdSp.exe
  2⤵
  PID:5772
- C:\Windows\System\ZQdxGIW.exe
  C:\Windows\System\ZQdxGIW.exe
  2⤵
  PID:6024
- C:\Windows\System\xLisxZH.exe
  C:\Windows\System\xLisxZH.exe
  2⤵
  PID:5872
- C:\Windows\System\jgPepur.exe
  C:\Windows\System\jgPepur.exe
  2⤵
  PID:6164
- C:\Windows\System\pRJxjBx.exe
  C:\Windows\System\pRJxjBx.exe
  2⤵
  PID:6192
- C:\Windows\System\vAykvsy.exe
  C:\Windows\System\vAykvsy.exe
  2⤵
  PID:6208
- C:\Windows\System\roXhLaS.exe
  C:\Windows\System\roXhLaS.exe
  2⤵
  PID:6240
- C:\Windows\System\RPaRTVc.exe
  C:\Windows\System\RPaRTVc.exe
  2⤵
  PID:6276
- C:\Windows\System\eBvWCKw.exe
  C:\Windows\System\eBvWCKw.exe
  2⤵
  PID:6308
- C:\Windows\System\eNkaFiW.exe
  C:\Windows\System\eNkaFiW.exe
  2⤵
  PID:6332
- C:\Windows\System\rWiaIDe.exe
  C:\Windows\System\rWiaIDe.exe
  2⤵
  PID:6364
- C:\Windows\System\nhbGBjh.exe
  C:\Windows\System\nhbGBjh.exe
  2⤵
  PID:6388
- C:\Windows\System\ZWULJTW.exe
  C:\Windows\System\ZWULJTW.exe
  2⤵
  PID:6412
- C:\Windows\System\omtwDHA.exe
  C:\Windows\System\omtwDHA.exe
  2⤵
  PID:6444
- C:\Windows\System\IZnTQur.exe
  C:\Windows\System\IZnTQur.exe
  2⤵
  PID:6472
- C:\Windows\System\toVRMJt.exe
  C:\Windows\System\toVRMJt.exe
  2⤵
  PID:6500
- C:\Windows\System\nyINCVY.exe
  C:\Windows\System\nyINCVY.exe
  2⤵
  PID:6532
- C:\Windows\System\OKKAUQy.exe
  C:\Windows\System\OKKAUQy.exe
  2⤵
  PID:6556
- C:\Windows\System\FERIFpG.exe
  C:\Windows\System\FERIFpG.exe
  2⤵
  PID:6584
- C:\Windows\System\HaPbKhJ.exe
  C:\Windows\System\HaPbKhJ.exe
  2⤵
  PID:6612
- C:\Windows\System\lkXXrLP.exe
  C:\Windows\System\lkXXrLP.exe
  2⤵
  PID:6640
- C:\Windows\System\OdcZxCl.exe
  C:\Windows\System\OdcZxCl.exe
  2⤵
  PID:6656
- C:\Windows\System\MVfFqwH.exe
  C:\Windows\System\MVfFqwH.exe
  2⤵
  PID:6684
- C:\Windows\System\QLYxKYg.exe
  C:\Windows\System\QLYxKYg.exe
  2⤵
  PID:6712
- C:\Windows\System\UykfrHR.exe
  C:\Windows\System\UykfrHR.exe
  2⤵
  PID:6756
- C:\Windows\System\CfDFGqg.exe
  C:\Windows\System\CfDFGqg.exe
  2⤵
  PID:6776
- C:\Windows\System\bxDBTuH.exe
  C:\Windows\System\bxDBTuH.exe
  2⤵
  PID:6808
- C:\Windows\System\pvKdAbh.exe
  C:\Windows\System\pvKdAbh.exe
  2⤵
  PID:6828
- C:\Windows\System\GYuTLEm.exe
  C:\Windows\System\GYuTLEm.exe
  2⤵
  PID:6844
- C:\Windows\System\ptjBqnp.exe
  C:\Windows\System\ptjBqnp.exe
  2⤵
  PID:6868
- C:\Windows\System\IKGIznu.exe
  C:\Windows\System\IKGIznu.exe
  2⤵
  PID:6892
- C:\Windows\System\IDnyfkl.exe
  C:\Windows\System\IDnyfkl.exe
  2⤵
  PID:6920
- C:\Windows\System\wZCovrA.exe
  C:\Windows\System\wZCovrA.exe
  2⤵
  PID:6948
- C:\Windows\System\QIYdNLB.exe
  C:\Windows\System\QIYdNLB.exe
  2⤵
  PID:6988
- C:\Windows\System\SkrtORl.exe
  C:\Windows\System\SkrtORl.exe
  2⤵
  PID:7016
- C:\Windows\System\cZocDIA.exe
  C:\Windows\System\cZocDIA.exe
  2⤵
  PID:7040
- C:\Windows\System\uOyvcpp.exe
  C:\Windows\System\uOyvcpp.exe
  2⤵
  PID:7060
- C:\Windows\System\rxXaQVg.exe
  C:\Windows\System\rxXaQVg.exe
  2⤵
  PID:7096
- C:\Windows\System\xRVFjrE.exe
  C:\Windows\System\xRVFjrE.exe
  2⤵
  PID:7128
- C:\Windows\System\lyLvWHD.exe
  C:\Windows\System\lyLvWHD.exe
  2⤵
  PID:7156
- C:\Windows\System\TlCpgVg.exe
  C:\Windows\System\TlCpgVg.exe
  2⤵
  PID:6152
- C:\Windows\System\QrDKyJZ.exe
  C:\Windows\System\QrDKyJZ.exe
  2⤵
  PID:6232
- C:\Windows\System\mVZFOAr.exe
  C:\Windows\System\mVZFOAr.exe
  2⤵
  PID:6292
- C:\Windows\System\VQtgXsF.exe
  C:\Windows\System\VQtgXsF.exe
  2⤵
  PID:6372
- C:\Windows\System\PsAqwWW.exe
  C:\Windows\System\PsAqwWW.exe
  2⤵
  PID:6508
- C:\Windows\System\cySrqnN.exe
  C:\Windows\System\cySrqnN.exe
  2⤵
  PID:6496
- C:\Windows\System\DQkfzHz.exe
  C:\Windows\System\DQkfzHz.exe
  2⤵
  PID:6544
- C:\Windows\System\fQEShyb.exe
  C:\Windows\System\fQEShyb.exe
  2⤵
  PID:6624
- C:\Windows\System\XfkBRKf.exe
  C:\Windows\System\XfkBRKf.exe
  2⤵
  PID:6696
- C:\Windows\System\DlYzIGj.exe
  C:\Windows\System\DlYzIGj.exe
  2⤵
  PID:6772
- C:\Windows\System\TDicKlx.exe
  C:\Windows\System\TDicKlx.exe
  2⤵
  PID:6840
- C:\Windows\System\RueHwsV.exe
  C:\Windows\System\RueHwsV.exe
  2⤵
  PID:6836
- C:\Windows\System\XyudLey.exe
  C:\Windows\System\XyudLey.exe
  2⤵
  PID:6944
- C:\Windows\System\cYgPGaO.exe
  C:\Windows\System\cYgPGaO.exe
  2⤵
  PID:7012
- C:\Windows\System\PHrlpod.exe
  C:\Windows\System\PHrlpod.exe
  2⤵
  PID:7080
- C:\Windows\System\bfTQHHa.exe
  C:\Windows\System\bfTQHHa.exe
  2⤵
  PID:7152
- C:\Windows\System\PQxfiDU.exe
  C:\Windows\System\PQxfiDU.exe
  2⤵
  PID:6176
- C:\Windows\System\KAqYIlg.exe
  C:\Windows\System\KAqYIlg.exe
  2⤵
  PID:6404
- C:\Windows\System\WSPCnqK.exe
  C:\Windows\System\WSPCnqK.exe
  2⤵
  PID:5340
- C:\Windows\System\rRLInAe.exe
  C:\Windows\System\rRLInAe.exe
  2⤵
  PID:6720
- C:\Windows\System\RxhBUjG.exe
  C:\Windows\System\RxhBUjG.exe
  2⤵
  PID:6864
- C:\Windows\System\fZviVRh.exe
  C:\Windows\System\fZviVRh.exe
  2⤵
  PID:6928
- C:\Windows\System\tpqhRYE.exe
  C:\Windows\System\tpqhRYE.exe
  2⤵
  PID:7136
- C:\Windows\System\dFgiOYu.exe
  C:\Windows\System\dFgiOYu.exe
  2⤵
  PID:7104
- C:\Windows\System\VpzChpY.exe
  C:\Windows\System\VpzChpY.exe
  2⤵
  PID:6528
- C:\Windows\System\aeEnwal.exe
  C:\Windows\System\aeEnwal.exe
  2⤵
  PID:6916
- C:\Windows\System\ZlzKLkI.exe
  C:\Windows\System\ZlzKLkI.exe
  2⤵
  PID:7188
- C:\Windows\System\GDEExqN.exe
  C:\Windows\System\GDEExqN.exe
  2⤵
  PID:7208
- C:\Windows\System\kSJrACg.exe
  C:\Windows\System\kSJrACg.exe
  2⤵
  PID:7228
- C:\Windows\System\rnDULtW.exe
  C:\Windows\System\rnDULtW.exe
  2⤵
  PID:7264
- C:\Windows\System\hwPwOST.exe
  C:\Windows\System\hwPwOST.exe
  2⤵
  PID:7296
- C:\Windows\System\nmzFAOS.exe
  C:\Windows\System\nmzFAOS.exe
  2⤵
  PID:7328
- C:\Windows\System\YEOIvrO.exe
  C:\Windows\System\YEOIvrO.exe
  2⤵
  PID:7352
- C:\Windows\System\qzkxlRP.exe
  C:\Windows\System\qzkxlRP.exe
  2⤵
  PID:7372
- C:\Windows\System\ajuynjn.exe
  C:\Windows\System\ajuynjn.exe
  2⤵
  PID:7400
- C:\Windows\System\lnpzOUd.exe
  C:\Windows\System\lnpzOUd.exe
  2⤵
  PID:7432
- C:\Windows\System\IFgwsjB.exe
  C:\Windows\System\IFgwsjB.exe
  2⤵
  PID:7460
- C:\Windows\System\yTfPbYx.exe
  C:\Windows\System\yTfPbYx.exe
  2⤵
  PID:7484
- C:\Windows\System\UpoYcZS.exe
  C:\Windows\System\UpoYcZS.exe
  2⤵
  PID:7504
- C:\Windows\System\LrHzDHR.exe
  C:\Windows\System\LrHzDHR.exe
  2⤵
  PID:7532
- C:\Windows\System\JsvWKOl.exe
  C:\Windows\System\JsvWKOl.exe
  2⤵
  PID:7556
- C:\Windows\System\POwYjOf.exe
  C:\Windows\System\POwYjOf.exe
  2⤵
  PID:7572
- C:\Windows\System\fJxqIKK.exe
  C:\Windows\System\fJxqIKK.exe
  2⤵
  PID:7600
- C:\Windows\System\TmGikIG.exe
  C:\Windows\System\TmGikIG.exe
  2⤵
  PID:7628
- C:\Windows\System\zgpkaWh.exe
  C:\Windows\System\zgpkaWh.exe
  2⤵
  PID:7652
- C:\Windows\System\YutDXDR.exe
  C:\Windows\System\YutDXDR.exe
  2⤵
  PID:7680
- C:\Windows\System\AiCSXAZ.exe
  C:\Windows\System\AiCSXAZ.exe
  2⤵
  PID:7708
- C:\Windows\System\ntkIxnG.exe
  C:\Windows\System\ntkIxnG.exe
  2⤵
  PID:7736
- C:\Windows\System\wZyFaHa.exe
  C:\Windows\System\wZyFaHa.exe
  2⤵
  PID:7764
- C:\Windows\System\psuwNPQ.exe
  C:\Windows\System\psuwNPQ.exe
  2⤵
  PID:7792
- C:\Windows\System\MPFrMyS.exe
  C:\Windows\System\MPFrMyS.exe
  2⤵
  PID:7812
- C:\Windows\System\PthmRVD.exe
  C:\Windows\System\PthmRVD.exe
  2⤵
  PID:7840
- C:\Windows\System\QvyxpCi.exe
  C:\Windows\System\QvyxpCi.exe
  2⤵
  PID:7868
- C:\Windows\System\KJQHlYv.exe
  C:\Windows\System\KJQHlYv.exe
  2⤵
  PID:7892
- C:\Windows\System\BTOusYP.exe
  C:\Windows\System\BTOusYP.exe
  2⤵
  PID:7920
- C:\Windows\System\aMmCgHH.exe
  C:\Windows\System\aMmCgHH.exe
  2⤵
  PID:7952
- C:\Windows\System\lwwmWwB.exe
  C:\Windows\System\lwwmWwB.exe
  2⤵
  PID:7980
- C:\Windows\System\DBeNjUL.exe
  C:\Windows\System\DBeNjUL.exe
  2⤵
  PID:8016
- C:\Windows\System\cqXQeGH.exe
  C:\Windows\System\cqXQeGH.exe
  2⤵
  PID:8036
- C:\Windows\System\PnPCpkn.exe
  C:\Windows\System\PnPCpkn.exe
  2⤵
  PID:8076
- C:\Windows\System\rTKhQbZ.exe
  C:\Windows\System\rTKhQbZ.exe
  2⤵
  PID:8100
- C:\Windows\System\NRFMfsW.exe
  C:\Windows\System\NRFMfsW.exe
  2⤵
  PID:8124
- C:\Windows\System\ZtmfxCL.exe
  C:\Windows\System\ZtmfxCL.exe
  2⤵
  PID:8160
- C:\Windows\System\AFoMVdC.exe
  C:\Windows\System\AFoMVdC.exe
  2⤵
  PID:8188
- C:\Windows\System\KuoevWZ.exe
  C:\Windows\System\KuoevWZ.exe
  2⤵
  PID:6400
- C:\Windows\System\GtDalBb.exe
  C:\Windows\System\GtDalBb.exe
  2⤵
  PID:7184
- C:\Windows\System\pEjniHC.exe
  C:\Windows\System\pEjniHC.exe
  2⤵
  PID:7252
- C:\Windows\System\pfkzTyQ.exe
  C:\Windows\System\pfkzTyQ.exe
  2⤵
  PID:7316
- C:\Windows\System\qcKynhP.exe
  C:\Windows\System\qcKynhP.exe
  2⤵
  PID:7368
- C:\Windows\System\WuuOLsl.exe
  C:\Windows\System\WuuOLsl.exe
  2⤵
  PID:7348
- C:\Windows\System\TskrbOd.exe
  C:\Windows\System\TskrbOd.exe
  2⤵
  PID:7480
- C:\Windows\System\YEAPMDi.exe
  C:\Windows\System\YEAPMDi.exe
  2⤵
  PID:7540
- C:\Windows\System\kljsJxi.exe
  C:\Windows\System\kljsJxi.exe
  2⤵
  PID:7640
- C:\Windows\System\UTfBcgX.exe
  C:\Windows\System\UTfBcgX.exe
  2⤵
  PID:7648
- C:\Windows\System\ToFPYHK.exe
  C:\Windows\System\ToFPYHK.exe
  2⤵
  PID:7704
- C:\Windows\System\dxvpLSC.exe
  C:\Windows\System\dxvpLSC.exe
  2⤵
  PID:7752
- C:\Windows\System\xrsTktx.exe
  C:\Windows\System\xrsTktx.exe
  2⤵
  PID:7836
- C:\Windows\System\sGRSkMw.exe
  C:\Windows\System\sGRSkMw.exe
  2⤵
  PID:7948
- C:\Windows\System\pVoQObE.exe
  C:\Windows\System\pVoQObE.exe
  2⤵
  PID:7976
- C:\Windows\System\XdvAtPZ.exe
  C:\Windows\System\XdvAtPZ.exe
  2⤵
  PID:8028
- C:\Windows\System\zKeheCQ.exe
  C:\Windows\System\zKeheCQ.exe
  2⤵
  PID:8148
- C:\Windows\System\GsdPxbU.exe
  C:\Windows\System\GsdPxbU.exe
  2⤵
  PID:8140
- C:\Windows\System\mqTWwtc.exe
  C:\Windows\System\mqTWwtc.exe
  2⤵
  PID:7204
- C:\Windows\System\HkkzQYW.exe
  C:\Windows\System\HkkzQYW.exe
  2⤵
  PID:7636
- C:\Windows\System\yFXVXJc.exe
  C:\Windows\System\yFXVXJc.exe
  2⤵
  PID:7412
- C:\Windows\System\NITYSOj.exe
  C:\Windows\System\NITYSOj.exe
  2⤵
  PID:7832
- C:\Windows\System\mdorziB.exe
  C:\Windows\System\mdorziB.exe
  2⤵
  PID:7876
- C:\Windows\System\PoedKui.exe
  C:\Windows\System\PoedKui.exe
  2⤵
  PID:7964
- C:\Windows\System\MdOGPHq.exe
  C:\Windows\System\MdOGPHq.exe
  2⤵
  PID:7592
- C:\Windows\System\RwcJGCC.exe
  C:\Windows\System\RwcJGCC.exe
  2⤵
  PID:7364
- C:\Windows\System\VHTShyS.exe
  C:\Windows\System\VHTShyS.exe
  2⤵
  PID:7584
- C:\Windows\System\eQKprOs.exe
  C:\Windows\System\eQKprOs.exe
  2⤵
  PID:8212
- C:\Windows\System\TToyNpU.exe
  C:\Windows\System\TToyNpU.exe
  2⤵
  PID:8240
- C:\Windows\System\wcJcBBS.exe
  C:\Windows\System\wcJcBBS.exe
  2⤵
  PID:8260
- C:\Windows\System\zNdEATk.exe
  C:\Windows\System\zNdEATk.exe
  2⤵
  PID:8288
- C:\Windows\System\zUAfhdT.exe
  C:\Windows\System\zUAfhdT.exe
  2⤵
  PID:8312
- C:\Windows\System\nIQsHbT.exe
  C:\Windows\System\nIQsHbT.exe
  2⤵
  PID:8332
- C:\Windows\System\hdUtyKF.exe
  C:\Windows\System\hdUtyKF.exe
  2⤵
  PID:8368
- C:\Windows\System\psyLiYJ.exe
  C:\Windows\System\psyLiYJ.exe
  2⤵
  PID:8392
- C:\Windows\System\nQxwGcp.exe
  C:\Windows\System\nQxwGcp.exe
  2⤵
  PID:8416
- C:\Windows\System\OXbnQpd.exe
  C:\Windows\System\OXbnQpd.exe
  2⤵
  PID:8444
- C:\Windows\System\hDeOdgB.exe
  C:\Windows\System\hDeOdgB.exe
  2⤵
  PID:8476
- C:\Windows\System\wUzECPM.exe
  C:\Windows\System\wUzECPM.exe
  2⤵
  PID:8508
- C:\Windows\System\TlACPvG.exe
  C:\Windows\System\TlACPvG.exe
  2⤵
  PID:8536
- C:\Windows\System\IjXqpKm.exe
  C:\Windows\System\IjXqpKm.exe
  2⤵
  PID:8560
- C:\Windows\System\bzpRfrr.exe
  C:\Windows\System\bzpRfrr.exe
  2⤵
  PID:8580
- C:\Windows\System\ouUdFsg.exe
  C:\Windows\System\ouUdFsg.exe
  2⤵
  PID:8608
- C:\Windows\System\wPCgMDc.exe
  C:\Windows\System\wPCgMDc.exe
  2⤵
  PID:8632
- C:\Windows\System\HFzuOHd.exe
  C:\Windows\System\HFzuOHd.exe
  2⤵
  PID:8664
- C:\Windows\System\nMPxAXx.exe
  C:\Windows\System\nMPxAXx.exe
  2⤵
  PID:8692
- C:\Windows\System\gNMzjhC.exe
  C:\Windows\System\gNMzjhC.exe
  2⤵
  PID:8720
- C:\Windows\System\tTohVvK.exe
  C:\Windows\System\tTohVvK.exe
  2⤵
  PID:8752
- C:\Windows\System\kiKjcGm.exe
  C:\Windows\System\kiKjcGm.exe
  2⤵
  PID:8784
- C:\Windows\System\FZtLkNF.exe
  C:\Windows\System\FZtLkNF.exe
  2⤵
  PID:8816
- C:\Windows\System\XqXncoT.exe
  C:\Windows\System\XqXncoT.exe
  2⤵
  PID:8848
- C:\Windows\System\aJWTeQZ.exe
  C:\Windows\System\aJWTeQZ.exe
  2⤵
  PID:8876
- C:\Windows\System\YxlzMPr.exe
  C:\Windows\System\YxlzMPr.exe
  2⤵
  PID:8896
- C:\Windows\System\AzkYfGg.exe
  C:\Windows\System\AzkYfGg.exe
  2⤵
  PID:8932
- C:\Windows\System\LyTbXyd.exe
  C:\Windows\System\LyTbXyd.exe
  2⤵
  PID:8956
- C:\Windows\System\jpeQBMb.exe
  C:\Windows\System\jpeQBMb.exe
  2⤵
  PID:8988
- C:\Windows\System\qBoATwl.exe
  C:\Windows\System\qBoATwl.exe
  2⤵
  PID:9024
- C:\Windows\System\eFSqKkT.exe
  C:\Windows\System\eFSqKkT.exe
  2⤵
  PID:9052
- C:\Windows\System\JVbBbYm.exe
  C:\Windows\System\JVbBbYm.exe
  2⤵
  PID:9080
- C:\Windows\System\rnMKRHx.exe
  C:\Windows\System\rnMKRHx.exe
  2⤵
  PID:9108
- C:\Windows\System\jYNogUm.exe
  C:\Windows\System\jYNogUm.exe
  2⤵
  PID:9128
- C:\Windows\System\ADsxVSs.exe
  C:\Windows\System\ADsxVSs.exe
  2⤵
  PID:9156
- C:\Windows\System\tYBTeUu.exe
  C:\Windows\System\tYBTeUu.exe
  2⤵
  PID:9180
- C:\Windows\System\FsoWVZv.exe
  C:\Windows\System\FsoWVZv.exe
  2⤵
  PID:9212
- C:\Windows\System\FeIzwyv.exe
  C:\Windows\System\FeIzwyv.exe
  2⤵
  PID:7748
- C:\Windows\System\qfbnUjJ.exe
  C:\Windows\System\qfbnUjJ.exe
  2⤵
  PID:6604
- C:\Windows\System\LXsjmvn.exe
  C:\Windows\System\LXsjmvn.exe
  2⤵
  PID:8248
- C:\Windows\System\uZIpKxm.exe
  C:\Windows\System\uZIpKxm.exe
  2⤵
  PID:8360
- C:\Windows\System\olTTXab.exe
  C:\Windows\System\olTTXab.exe
  2⤵
  PID:8500
- C:\Windows\System\phYkaEV.exe
  C:\Windows\System\phYkaEV.exe
  2⤵
  PID:8356
- C:\Windows\System\QimjbNf.exe
  C:\Windows\System\QimjbNf.exe
  2⤵
  PID:8568
- C:\Windows\System\gdDxgmm.exe
  C:\Windows\System\gdDxgmm.exe
  2⤵
  PID:8640
- C:\Windows\System\xGgFfzI.exe
  C:\Windows\System\xGgFfzI.exe
  2⤵
  PID:8680
- C:\Windows\System\nJBgobS.exe
  C:\Windows\System\nJBgobS.exe
  2⤵
  PID:8652
- C:\Windows\System\CdEfLrk.exe
  C:\Windows\System\CdEfLrk.exe
  2⤵
  PID:8676
- C:\Windows\System\KRbWZNr.exe
  C:\Windows\System\KRbWZNr.exe
  2⤵
  PID:8808
- C:\Windows\System\rPaWuDV.exe
  C:\Windows\System\rPaWuDV.exe
  2⤵
  PID:8864
- C:\Windows\System\eNwuEHa.exe
  C:\Windows\System\eNwuEHa.exe
  2⤵
  PID:8944
- C:\Windows\System\YlqLxJz.exe
  C:\Windows\System\YlqLxJz.exe
  2⤵
  PID:9048
- C:\Windows\System\LHrFPVt.exe
  C:\Windows\System\LHrFPVt.exe
  2⤵
  PID:9136
- C:\Windows\System\fWluVyg.exe
  C:\Windows\System\fWluVyg.exe
  2⤵
  PID:9168
- C:\Windows\System\QlUvCDm.exe
  C:\Windows\System\QlUvCDm.exe
  2⤵
  PID:8280
- C:\Windows\System\EnnYpaD.exe
  C:\Windows\System\EnnYpaD.exe
  2⤵
  PID:8348
- C:\Windows\System\DRxNble.exe
  C:\Windows\System\DRxNble.exe
  2⤵
  PID:8308
- C:\Windows\System\WqcSOEE.exe
  C:\Windows\System\WqcSOEE.exe
  2⤵
  PID:8528
- C:\Windows\System\fRKdhTg.exe
  C:\Windows\System\fRKdhTg.exe
  2⤵
  PID:8924
- C:\Windows\System\MDUDAcS.exe
  C:\Windows\System\MDUDAcS.exe
  2⤵
  PID:9020
- C:\Windows\System\fzXRDpp.exe
  C:\Windows\System\fzXRDpp.exe
  2⤵
  PID:8952
- C:\Windows\System\bnmlDWh.exe
  C:\Windows\System\bnmlDWh.exe
  2⤵
  PID:6676
- C:\Windows\System\zuGsZFF.exe
  C:\Windows\System\zuGsZFF.exe
  2⤵
  PID:9228
- C:\Windows\System\TqfQcpy.exe
  C:\Windows\System\TqfQcpy.exe
  2⤵
  PID:9256
- C:\Windows\System\agCBFFO.exe
  C:\Windows\System\agCBFFO.exe
  2⤵
  PID:9280
- C:\Windows\System\UMvCMHa.exe
  C:\Windows\System\UMvCMHa.exe
  2⤵
  PID:9316
- C:\Windows\System\yvZXiCB.exe
  C:\Windows\System\yvZXiCB.exe
  2⤵
  PID:9352
- C:\Windows\System\KBtGsfB.exe
  C:\Windows\System\KBtGsfB.exe
  2⤵
  PID:9380
- C:\Windows\System\qrEtXfI.exe
  C:\Windows\System\qrEtXfI.exe
  2⤵
  PID:9412
- C:\Windows\System\aTvEujw.exe
  C:\Windows\System\aTvEujw.exe
  2⤵
  PID:9440
- C:\Windows\System\njwjXdx.exe
  C:\Windows\System\njwjXdx.exe
  2⤵
  PID:9460
- C:\Windows\System\OFNFfLh.exe
  C:\Windows\System\OFNFfLh.exe
  2⤵
  PID:9496
- C:\Windows\System\KvKcMJl.exe
  C:\Windows\System\KvKcMJl.exe
  2⤵
  PID:9524
- C:\Windows\System\bVKeoBQ.exe
  C:\Windows\System\bVKeoBQ.exe
  2⤵
  PID:9560
- C:\Windows\System\kUanOUB.exe
  C:\Windows\System\kUanOUB.exe
  2⤵
  PID:9588
- C:\Windows\System\aBsEmSO.exe
  C:\Windows\System\aBsEmSO.exe
  2⤵
  PID:9612
- C:\Windows\System\OwZjYiZ.exe
  C:\Windows\System\OwZjYiZ.exe
  2⤵
  PID:9640
- C:\Windows\System\AFxVmLW.exe
  C:\Windows\System\AFxVmLW.exe
  2⤵
  PID:9656
- C:\Windows\System\dbBiTiA.exe
  C:\Windows\System\dbBiTiA.exe
  2⤵
  PID:9684
- C:\Windows\System\MHCayZT.exe
  C:\Windows\System\MHCayZT.exe
  2⤵
  PID:9712
- C:\Windows\System\pzRlDux.exe
  C:\Windows\System\pzRlDux.exe
  2⤵
  PID:9744
- C:\Windows\System\JtVpyOW.exe
  C:\Windows\System\JtVpyOW.exe
  2⤵
  PID:9768
- C:\Windows\System\HdulEkQ.exe
  C:\Windows\System\HdulEkQ.exe
  2⤵
  PID:9796
- C:\Windows\System\BaKTmBr.exe
  C:\Windows\System\BaKTmBr.exe
  2⤵
  PID:9820
- C:\Windows\System\FpbbVCz.exe
  C:\Windows\System\FpbbVCz.exe
  2⤵
  PID:9840
- C:\Windows\System\ANHbICm.exe
  C:\Windows\System\ANHbICm.exe
  2⤵
  PID:9868
- C:\Windows\System\xqLQrKc.exe
  C:\Windows\System\xqLQrKc.exe
  2⤵
  PID:9896
- C:\Windows\System\tZEzawp.exe
  C:\Windows\System\tZEzawp.exe
  2⤵
  PID:9916
- C:\Windows\System\dXNKhSP.exe
  C:\Windows\System\dXNKhSP.exe
  2⤵
  PID:9948
- C:\Windows\System\EgELLNm.exe
  C:\Windows\System\EgELLNm.exe
  2⤵
  PID:9976
- C:\Windows\System\qfdVobJ.exe
  C:\Windows\System\qfdVobJ.exe
  2⤵
  PID:10008
- C:\Windows\System\SvaPeoO.exe
  C:\Windows\System\SvaPeoO.exe
  2⤵
  PID:10036
- C:\Windows\System\ytpHSSk.exe
  C:\Windows\System\ytpHSSk.exe
  2⤵
  PID:10064
- C:\Windows\System\AwNpzJN.exe
  C:\Windows\System\AwNpzJN.exe
  2⤵
  PID:10096
- C:\Windows\System\XVnAZhE.exe
  C:\Windows\System\XVnAZhE.exe
  2⤵
  PID:10128
- C:\Windows\System\Yfvnstn.exe
  C:\Windows\System\Yfvnstn.exe
  2⤵
  PID:10160
- C:\Windows\System\PJfGDjX.exe
  C:\Windows\System\PJfGDjX.exe
  2⤵
  PID:10188
- C:\Windows\System\ayPFByk.exe
  C:\Windows\System\ayPFByk.exe
  2⤵
  PID:10216
- C:\Windows\System\gbZttpt.exe
  C:\Windows\System\gbZttpt.exe
  2⤵
  PID:9096
- C:\Windows\System\ilBztrZ.exe
  C:\Windows\System\ilBztrZ.exe
  2⤵
  PID:8828
- C:\Windows\System\pPQpprm.exe
  C:\Windows\System\pPQpprm.exe
  2⤵
  PID:9124
- C:\Windows\System\kXaiYnz.exe
  C:\Windows\System\kXaiYnz.exe
  2⤵
  PID:9312
- C:\Windows\System\ZdyFvwW.exe
  C:\Windows\System\ZdyFvwW.exe
  2⤵
  PID:9272
- C:\Windows\System\vmOzuGS.exe
  C:\Windows\System\vmOzuGS.exe
  2⤵
  PID:9336
- C:\Windows\System\zVSTojr.exe
  C:\Windows\System\zVSTojr.exe
  2⤵
  PID:9512
- C:\Windows\System\wlMpTlg.exe
  C:\Windows\System\wlMpTlg.exe
  2⤵
  PID:9624
- C:\Windows\System\dNstdtd.exe
  C:\Windows\System\dNstdtd.exe
  2⤵
  PID:9648
- C:\Windows\System\mBFSoAp.exe
  C:\Windows\System\mBFSoAp.exe
  2⤵
  PID:9676
- C:\Windows\System\uKiYZbr.exe
  C:\Windows\System\uKiYZbr.exe
  2⤵
  PID:9724
- C:\Windows\System\jUbmnGH.exe
  C:\Windows\System\jUbmnGH.exe
  2⤵
  PID:9752
- C:\Windows\System\NIYsIFa.exe
  C:\Windows\System\NIYsIFa.exe
  2⤵
  PID:9884
- C:\Windows\System\rDvYSNI.exe
  C:\Windows\System\rDvYSNI.exe
  2⤵
  PID:9892
- C:\Windows\System\gMAjtoQ.exe
  C:\Windows\System\gMAjtoQ.exe
  2⤵
  PID:10000
- C:\Windows\System\bjgNlUT.exe
  C:\Windows\System\bjgNlUT.exe
  2⤵
  PID:10048
- C:\Windows\System\ITFEfiH.exe
  C:\Windows\System\ITFEfiH.exe
  2⤵
  PID:10108
- C:\Windows\System\PoaMnYZ.exe
  C:\Windows\System\PoaMnYZ.exe
  2⤵
  PID:10172
- C:\Windows\System\URirZsn.exe
  C:\Windows\System\URirZsn.exe
  2⤵
  PID:8996
- C:\Windows\System\PBhWjlA.exe
  C:\Windows\System\PBhWjlA.exe
  2⤵
  PID:9292
- C:\Windows\System\pfWsYxK.exe
  C:\Windows\System\pfWsYxK.exe
  2⤵
  PID:9456
- C:\Windows\System\hwOLftY.exe
  C:\Windows\System\hwOLftY.exe
  2⤵
  PID:9544
- C:\Windows\System\FsdWCxp.exe
  C:\Windows\System\FsdWCxp.exe
  2⤵
  PID:9728
- C:\Windows\System\tLpxleJ.exe
  C:\Windows\System\tLpxleJ.exe
  2⤵
  PID:9964
- C:\Windows\System\GoSATNk.exe
  C:\Windows\System\GoSATNk.exe
  2⤵
  PID:8556
- C:\Windows\System\jTOHMKX.exe
  C:\Windows\System\jTOHMKX.exe
  2⤵
  PID:10024
- C:\Windows\System\SJTStHp.exe
  C:\Windows\System\SJTStHp.exe
  2⤵
  PID:9252
- C:\Windows\System\jMUPvJH.exe
  C:\Windows\System\jMUPvJH.exe
  2⤵
  PID:9576
- C:\Windows\System\bdxlNJp.exe
  C:\Windows\System\bdxlNJp.exe
  2⤵
  PID:10076
- C:\Windows\System\IUyisPE.exe
  C:\Windows\System\IUyisPE.exe
  2⤵
  PID:10232
- C:\Windows\System\fdHQsRk.exe
  C:\Windows\System\fdHQsRk.exe
  2⤵
  PID:10268
- C:\Windows\System\IdlvjXt.exe
  C:\Windows\System\IdlvjXt.exe
  2⤵
  PID:10292
- C:\Windows\System\UYbNiLA.exe
  C:\Windows\System\UYbNiLA.exe
  2⤵
  PID:10316
- C:\Windows\System\WvyjGsq.exe
  C:\Windows\System\WvyjGsq.exe
  2⤵
  PID:10348
- C:\Windows\System\XTIJiCQ.exe
  C:\Windows\System\XTIJiCQ.exe
  2⤵
  PID:10376
- C:\Windows\System\KnXjjUN.exe
  C:\Windows\System\KnXjjUN.exe
  2⤵
  PID:10396
- C:\Windows\System\IlfdlHC.exe
  C:\Windows\System\IlfdlHC.exe
  2⤵
  PID:10428
- C:\Windows\System\aGtMIlf.exe
  C:\Windows\System\aGtMIlf.exe
  2⤵
  PID:10464
- C:\Windows\System\xcxKJdB.exe
  C:\Windows\System\xcxKJdB.exe
  2⤵
  PID:10488
- C:\Windows\System\mAxbxXA.exe
  C:\Windows\System\mAxbxXA.exe
  2⤵
  PID:10512
- C:\Windows\System\EoJwedB.exe
  C:\Windows\System\EoJwedB.exe
  2⤵
  PID:10536
- C:\Windows\System\wQCaNRY.exe
  C:\Windows\System\wQCaNRY.exe
  2⤵
  PID:10564
- C:\Windows\System\TreUBWB.exe
  C:\Windows\System\TreUBWB.exe
  2⤵
  PID:10592
- C:\Windows\System\YcscKsu.exe
  C:\Windows\System\YcscKsu.exe
  2⤵
  PID:10620
- C:\Windows\System\OzZBUbT.exe
  C:\Windows\System\OzZBUbT.exe
  2⤵
  PID:10640
- C:\Windows\System\OwxHQls.exe
  C:\Windows\System\OwxHQls.exe
  2⤵
  PID:10680
- C:\Windows\System\ndYBEIm.exe
  C:\Windows\System\ndYBEIm.exe
  2⤵
  PID:10712
- C:\Windows\System\DxSKXkd.exe
  C:\Windows\System\DxSKXkd.exe
  2⤵
  PID:10736
- C:\Windows\System\zMjFydz.exe
  C:\Windows\System\zMjFydz.exe
  2⤵
  PID:10760
- C:\Windows\System\fKriLCX.exe
  C:\Windows\System\fKriLCX.exe
  2⤵
  PID:10800
- C:\Windows\System\MLaiqPK.exe
  C:\Windows\System\MLaiqPK.exe
  2⤵
  PID:10824
- C:\Windows\System\lKSTrZK.exe
  C:\Windows\System\lKSTrZK.exe
  2⤵
  PID:10852
- C:\Windows\System\TTJhrRh.exe
  C:\Windows\System\TTJhrRh.exe
  2⤵
  PID:10868
- C:\Windows\System\RJVQcGh.exe
  C:\Windows\System\RJVQcGh.exe
  2⤵
  PID:10884
- C:\Windows\System\MYFNWtZ.exe
  C:\Windows\System\MYFNWtZ.exe
  2⤵
  PID:10908
- C:\Windows\System\aSKkDKa.exe
  C:\Windows\System\aSKkDKa.exe
  2⤵
  PID:10936
- C:\Windows\System\xhoUDVu.exe
  C:\Windows\System\xhoUDVu.exe
  2⤵
  PID:10968
- C:\Windows\System\VWaazSq.exe
  C:\Windows\System\VWaazSq.exe
  2⤵
  PID:10992
- C:\Windows\System\ZmHCQzX.exe
  C:\Windows\System\ZmHCQzX.exe
  2⤵
  PID:11016
- C:\Windows\System\GpUxmep.exe
  C:\Windows\System\GpUxmep.exe
  2⤵
  PID:11052
- C:\Windows\System\DGzvpob.exe
  C:\Windows\System\DGzvpob.exe
  2⤵
  PID:11068
- C:\Windows\System\WFGSyjV.exe
  C:\Windows\System\WFGSyjV.exe
  2⤵
  PID:11092
- C:\Windows\System\wKfZgzd.exe
  C:\Windows\System\wKfZgzd.exe
  2⤵
  PID:11120
- C:\Windows\System\bjRvyjh.exe
  C:\Windows\System\bjRvyjh.exe
  2⤵
  PID:11140
- C:\Windows\System\pGkpsYe.exe
  C:\Windows\System\pGkpsYe.exe
  2⤵
  PID:11168
- C:\Windows\System\YEXGHmz.exe
  C:\Windows\System\YEXGHmz.exe
  2⤵
  PID:11204
- C:\Windows\System\YyIZmXy.exe
  C:\Windows\System\YyIZmXy.exe
  2⤵
  PID:11228
- C:\Windows\System\IbVNHjE.exe
  C:\Windows\System\IbVNHjE.exe
  2⤵
  PID:9596
- C:\Windows\System\jzJQQSY.exe
  C:\Windows\System\jzJQQSY.exe
  2⤵
  PID:9864
- C:\Windows\System\uxGZjCL.exe
  C:\Windows\System\uxGZjCL.exe
  2⤵
  PID:10212
- C:\Windows\System\VbyPAWl.exe
  C:\Windows\System\VbyPAWl.exe
  2⤵
  PID:10404
- C:\Windows\System\iCAscfn.exe
  C:\Windows\System\iCAscfn.exe
  2⤵
  PID:10248
- C:\Windows\System\hIRxqZB.exe
  C:\Windows\System\hIRxqZB.exe
  2⤵
  PID:10472
- C:\Windows\System\QLmwBnP.exe
  C:\Windows\System\QLmwBnP.exe
  2⤵
  PID:10628
- C:\Windows\System\XHVkeDP.exe
  C:\Windows\System\XHVkeDP.exe
  2⤵
  PID:10724
- C:\Windows\System\mBPCqps.exe
  C:\Windows\System\mBPCqps.exe
  2⤵
  PID:10772
- C:\Windows\System\BqGepFL.exe
  C:\Windows\System\BqGepFL.exe
  2⤵
  PID:10560
- C:\Windows\System\ywJiThG.exe
  C:\Windows\System\ywJiThG.exe
  2⤵
  PID:10648
- C:\Windows\System\eJGmwXR.exe
  C:\Windows\System\eJGmwXR.exe
  2⤵
  PID:10848
- C:\Windows\System\FTJWVOD.exe
  C:\Windows\System\FTJWVOD.exe
  2⤵
  PID:11108
- C:\Windows\System\avXNllE.exe
  C:\Windows\System\avXNllE.exe
  2⤵
  PID:11012
- C:\Windows\System\YczZQTw.exe
  C:\Windows\System\YczZQTw.exe
  2⤵
  PID:10920
- C:\Windows\System\FLYHcOX.exe
  C:\Windows\System\FLYHcOX.exe
  2⤵
  PID:10964
- C:\Windows\System\RZqCnpX.exe
  C:\Windows\System\RZqCnpX.exe
  2⤵
  PID:11184
- C:\Windows\System\IskriRQ.exe
  C:\Windows\System\IskriRQ.exe
  2⤵
  PID:11064
- C:\Windows\System\lqRnhbr.exe
  C:\Windows\System\lqRnhbr.exe
  2⤵
  PID:9652
- C:\Windows\System\vuGmPOB.exe
  C:\Windows\System\vuGmPOB.exe
  2⤵
  PID:11104
- C:\Windows\System\WTFMWOU.exe
  C:\Windows\System\WTFMWOU.exe
  2⤵
  PID:10616
- C:\Windows\System\FObPQHt.exe
  C:\Windows\System\FObPQHt.exe
  2⤵
  PID:9332
- C:\Windows\System\CRRKCAz.exe
  C:\Windows\System\CRRKCAz.exe
  2⤵
  PID:10280
- C:\Windows\System\roEAYfO.exe
  C:\Windows\System\roEAYfO.exe
  2⤵
  PID:10704
- C:\Windows\System\YGUNoEc.exe
  C:\Windows\System\YGUNoEc.exe
  2⤵
  PID:10668
- C:\Windows\System\yDujBTb.exe
  C:\Windows\System\yDujBTb.exe
  2⤵
  PID:10312
- C:\Windows\System\XHxlcff.exe
  C:\Windows\System\XHxlcff.exe
  2⤵
  PID:11276
- C:\Windows\System\oESjLxd.exe
  C:\Windows\System\oESjLxd.exe
  2⤵
  PID:11308
- C:\Windows\System\mnfpqcS.exe
  C:\Windows\System\mnfpqcS.exe
  2⤵
  PID:11332
- C:\Windows\System\qkPaIAf.exe
  C:\Windows\System\qkPaIAf.exe
  2⤵
  PID:11364
- C:\Windows\System\avAfrxW.exe
  C:\Windows\System\avAfrxW.exe
  2⤵
  PID:11396
- C:\Windows\System\YKcOKnR.exe
  C:\Windows\System\YKcOKnR.exe
  2⤵
  PID:11412
- C:\Windows\System\jqZunBF.exe
  C:\Windows\System\jqZunBF.exe
  2⤵
  PID:11432
- C:\Windows\System\DPNlEqZ.exe
  C:\Windows\System\DPNlEqZ.exe
  2⤵
  PID:11488
- C:\Windows\System\orrdVpK.exe
  C:\Windows\System\orrdVpK.exe
  2⤵
  PID:11512
- C:\Windows\System\qLBkVmA.exe
  C:\Windows\System\qLBkVmA.exe
  2⤵
  PID:11552
- C:\Windows\System\cjfkqvp.exe
  C:\Windows\System\cjfkqvp.exe
  2⤵
  PID:11572
- C:\Windows\System\smpokSg.exe
  C:\Windows\System\smpokSg.exe
  2⤵
  PID:11604
- C:\Windows\System\uRJALAF.exe
  C:\Windows\System\uRJALAF.exe
  2⤵
  PID:11628
- C:\Windows\System\MeiTeND.exe
  C:\Windows\System\MeiTeND.exe
  2⤵
  PID:11644
- C:\Windows\System\RaxtUZp.exe
  C:\Windows\System\RaxtUZp.exe
  2⤵
  PID:11664
- C:\Windows\System\OcVFVmH.exe
  C:\Windows\System\OcVFVmH.exe
  2⤵
  PID:11684
- C:\Windows\System\jyzSCqX.exe
  C:\Windows\System\jyzSCqX.exe
  2⤵
  PID:11712
- C:\Windows\System\VxiUYIK.exe
  C:\Windows\System\VxiUYIK.exe
  2⤵
  PID:11740
- C:\Windows\System\jGjTRHF.exe
  C:\Windows\System\jGjTRHF.exe
  2⤵
  PID:11776
- C:\Windows\System\AFeYzGV.exe
  C:\Windows\System\AFeYzGV.exe
  2⤵
  PID:11796
- C:\Windows\System\FLllnjn.exe
  C:\Windows\System\FLllnjn.exe
  2⤵
  PID:11820
- C:\Windows\System\ieBCEWC.exe
  C:\Windows\System\ieBCEWC.exe
  2⤵
  PID:11844
- C:\Windows\System\fVayNFd.exe
  C:\Windows\System\fVayNFd.exe
  2⤵
  PID:12016
- C:\Windows\System\ANiYoeX.exe
  C:\Windows\System\ANiYoeX.exe
  2⤵
  PID:12040
- C:\Windows\System\EQOPTfj.exe
  C:\Windows\System\EQOPTfj.exe
  2⤵
  PID:12080
- C:\Windows\System\JqfzzcC.exe
  C:\Windows\System\JqfzzcC.exe
  2⤵
  PID:12112
- C:\Windows\System\GdpaUVk.exe
  C:\Windows\System\GdpaUVk.exe
  2⤵
  PID:12148
- C:\Windows\System\lZwmRTa.exe
  C:\Windows\System\lZwmRTa.exe
  2⤵
  PID:12172
- C:\Windows\System\UcABqAq.exe
  C:\Windows\System\UcABqAq.exe
  2⤵
  PID:12196
- C:\Windows\System\lwFHTKT.exe
  C:\Windows\System\lwFHTKT.exe
  2⤵
  PID:12220
- C:\Windows\System\lRgwPXo.exe
  C:\Windows\System\lRgwPXo.exe
  2⤵
  PID:12248
- C:\Windows\System\lqjvimk.exe
  C:\Windows\System\lqjvimk.exe
  2⤵
  PID:12264
- C:\Windows\System\PkVhJIR.exe
  C:\Windows\System\PkVhJIR.exe
  2⤵
  PID:11100
- C:\Windows\System\iABvIDC.exe
  C:\Windows\System\iABvIDC.exe
  2⤵
  PID:10932
- C:\Windows\System\elXGoGX.exe
  C:\Windows\System\elXGoGX.exe
  2⤵
  PID:11004
- C:\Windows\System\mSEsBPi.exe
  C:\Windows\System\mSEsBPi.exe
  2⤵
  PID:11528
- C:\Windows\System\bxmEbhJ.exe
  C:\Windows\System\bxmEbhJ.exe
  2⤵
  PID:11388
- C:\Windows\System\GqYCkyo.exe
  C:\Windows\System\GqYCkyo.exe
  2⤵
  PID:11548
- C:\Windows\System\tZSOQAE.exe
  C:\Windows\System\tZSOQAE.exe
  2⤵
  PID:11496
- C:\Windows\System\zCDgJLM.exe
  C:\Windows\System\zCDgJLM.exe
  2⤵
  PID:11564
- C:\Windows\System\wFLMRVt.exe
  C:\Windows\System\wFLMRVt.exe
  2⤵
  PID:11596
- C:\Windows\System\DbzvDFe.exe
  C:\Windows\System\DbzvDFe.exe
  2⤵
  PID:11640
- C:\Windows\System\TnIQyqn.exe
  C:\Windows\System\TnIQyqn.exe
  2⤵
  PID:11588
- C:\Windows\System\ylcAhGM.exe
  C:\Windows\System\ylcAhGM.exe
  2⤵
  PID:11968
- C:\Windows\System\fXYVYKA.exe
  C:\Windows\System\fXYVYKA.exe
  2⤵
  PID:11960
- C:\Windows\System\mkXZkcv.exe
  C:\Windows\System\mkXZkcv.exe
  2⤵
  PID:11972
- C:\Windows\System\ZQtpsYF.exe
  C:\Windows\System\ZQtpsYF.exe
  2⤵
  PID:12088
- C:\Windows\System\QNUYjTS.exe
  C:\Windows\System\QNUYjTS.exe
  2⤵
  PID:12056
- C:\Windows\System\FeLxPDy.exe
  C:\Windows\System\FeLxPDy.exe
  2⤵
  PID:12188
- C:\Windows\System\NkPNWSB.exe
  C:\Windows\System\NkPNWSB.exe
  2⤵
  PID:12236
- C:\Windows\System\jcmZZqE.exe
  C:\Windows\System\jcmZZqE.exe
  2⤵
  PID:12232
- C:\Windows\System\ZhKedsI.exe
  C:\Windows\System\ZhKedsI.exe
  2⤵
  PID:10840
- C:\Windows\System\oDaVDCR.exe
  C:\Windows\System\oDaVDCR.exe
  2⤵
  PID:10752
- C:\Windows\System\kafvACo.exe
  C:\Windows\System\kafvACo.exe
  2⤵
  PID:11500
- C:\Windows\System\XrKYGxW.exe
  C:\Windows\System\XrKYGxW.exe
  2⤵
  PID:11704
- C:\Windows\System\WFRyJnX.exe
  C:\Windows\System\WFRyJnX.exe
  2⤵
  PID:11788
- C:\Windows\System\rfXwkSk.exe
  C:\Windows\System\rfXwkSk.exe
  2⤵
  PID:11816
- C:\Windows\System\elxCGXn.exe
  C:\Windows\System\elxCGXn.exe
  2⤵
  PID:11856
- C:\Windows\System\uIZhyrx.exe
  C:\Windows\System\uIZhyrx.exe
  2⤵
  PID:11236
- C:\Windows\System\BBWFjdR.exe
  C:\Windows\System\BBWFjdR.exe
  2⤵
  PID:11380
- C:\Windows\System\aqCoriv.exe
  C:\Windows\System\aqCoriv.exe
  2⤵
  PID:12260
- C:\Windows\System\TEQkPpV.exe
  C:\Windows\System\TEQkPpV.exe
  2⤵
  PID:12292
- C:\Windows\System\tyReNTt.exe
  C:\Windows\System\tyReNTt.exe
  2⤵
  PID:12312
- C:\Windows\System\nOomukT.exe
  C:\Windows\System\nOomukT.exe
  2⤵
  PID:12336
- C:\Windows\System\dpAuVcY.exe
  C:\Windows\System\dpAuVcY.exe
  2⤵
  PID:12352
- C:\Windows\System\qaHIEhi.exe
  C:\Windows\System\qaHIEhi.exe
  2⤵
  PID:12380
- C:\Windows\System\XMRViUZ.exe
  C:\Windows\System\XMRViUZ.exe
  2⤵
  PID:12408
- C:\Windows\System\WRIykRB.exe
  C:\Windows\System\WRIykRB.exe
  2⤵
  PID:12436
- C:\Windows\System\PRFXzeJ.exe
  C:\Windows\System\PRFXzeJ.exe
  2⤵
  PID:12452
- C:\Windows\System\qRDDBHA.exe
  C:\Windows\System\qRDDBHA.exe
  2⤵
  PID:12480
- C:\Windows\System\kPBbGaV.exe
  C:\Windows\System\kPBbGaV.exe
  2⤵
  PID:12500
- C:\Windows\System\YWDOnEB.exe
  C:\Windows\System\YWDOnEB.exe
  2⤵
  PID:12532
- C:\Windows\System\JlGOsjf.exe
  C:\Windows\System\JlGOsjf.exe
  2⤵
  PID:12560
- C:\Windows\System\uwvODTy.exe
  C:\Windows\System\uwvODTy.exe
  2⤵
  PID:12576
- C:\Windows\System\kONLkaE.exe
  C:\Windows\System\kONLkaE.exe
  2⤵
  PID:12596
- C:\Windows\System\SyqDFPn.exe
  C:\Windows\System\SyqDFPn.exe
  2⤵
  PID:12636
- C:\Windows\System\hwiEoAK.exe
  C:\Windows\System\hwiEoAK.exe
  2⤵
  PID:12660
- C:\Windows\System\SNizVBr.exe
  C:\Windows\System\SNizVBr.exe
  2⤵
  PID:12676
- C:\Windows\System\POYlWis.exe
  C:\Windows\System\POYlWis.exe
  2⤵
  PID:12704
- C:\Windows\System\wdBKjHF.exe
  C:\Windows\System\wdBKjHF.exe
  2⤵
  PID:12732
- C:\Windows\System\zIkyNRb.exe
  C:\Windows\System\zIkyNRb.exe
  2⤵
  PID:12752
- C:\Windows\System\gXReDLi.exe
  C:\Windows\System\gXReDLi.exe
  2⤵
  PID:12780
- C:\Windows\System\lmYqLAQ.exe
  C:\Windows\System\lmYqLAQ.exe
  2⤵
  PID:12816
- C:\Windows\System\GsXOWvH.exe
  C:\Windows\System\GsXOWvH.exe
  2⤵
  PID:12836
- C:\Windows\System\QPlmhUD.exe
  C:\Windows\System\QPlmhUD.exe
  2⤵
  PID:12864
- C:\Windows\System\eobbqfA.exe
  C:\Windows\System\eobbqfA.exe
  2⤵
  PID:12892
- C:\Windows\System\NbgAhZI.exe
  C:\Windows\System\NbgAhZI.exe
  2⤵
  PID:12920
- C:\Windows\System\vmfAiNb.exe
  C:\Windows\System\vmfAiNb.exe
  2⤵
  PID:12940
- C:\Windows\System\yLuneFm.exe
  C:\Windows\System\yLuneFm.exe
  2⤵
  PID:12968
- C:\Windows\System\KjTwZDe.exe
  C:\Windows\System\KjTwZDe.exe
  2⤵
  PID:13000
- C:\Windows\System\xkmtNqE.exe
  C:\Windows\System\xkmtNqE.exe
  2⤵
  PID:13016
- C:\Windows\System\NUmcWtK.exe
  C:\Windows\System\NUmcWtK.exe
  2⤵
  PID:13040
- C:\Windows\System\hEsKkqS.exe
  C:\Windows\System\hEsKkqS.exe
  2⤵
  PID:13064
- C:\Windows\System\FhLhzIR.exe
  C:\Windows\System\FhLhzIR.exe
  2⤵
  PID:13096
- C:\Windows\System\dKueDMf.exe
  C:\Windows\System\dKueDMf.exe
  2⤵
  PID:13124
- C:\Windows\System\aHmdjSW.exe
  C:\Windows\System\aHmdjSW.exe
  2⤵
  PID:13144
- C:\Windows\System\uaHjkfX.exe
  C:\Windows\System\uaHjkfX.exe
  2⤵
  PID:13164
- C:\Windows\System\gRUwLYr.exe
  C:\Windows\System\gRUwLYr.exe
  2⤵
  PID:13188
- C:\Windows\System\dmNmaby.exe
  C:\Windows\System\dmNmaby.exe
  2⤵
  PID:13212
- C:\Windows\System\rdSNFSW.exe
  C:\Windows\System\rdSNFSW.exe
  2⤵
  PID:13232
- C:\Windows\System\esHBvsf.exe
  C:\Windows\System\esHBvsf.exe
  2⤵
  PID:13264
- C:\Windows\System\mBPRWvM.exe
  C:\Windows\System\mBPRWvM.exe
  2⤵
  PID:13280
- C:\Windows\System\fBtvEZM.exe
  C:\Windows\System\fBtvEZM.exe
  2⤵
  PID:13304
- C:\Windows\System\yctVSuZ.exe
  C:\Windows\System\yctVSuZ.exe
  2⤵
  PID:11760
- C:\Windows\System\cwfgEqE.exe
  C:\Windows\System\cwfgEqE.exe
  2⤵
  PID:12300
- C:\Windows\System\DduhxQO.exe
  C:\Windows\System\DduhxQO.exe
  2⤵
  PID:12304
- C:\Windows\System\TAUaMTt.exe
  C:\Windows\System\TAUaMTt.exe
  2⤵
  PID:12404
- C:\Windows\System\rUQrDjv.exe
  C:\Windows\System\rUQrDjv.exe
  2⤵
  PID:12444
- C:\Windows\System\yVURaRE.exe
  C:\Windows\System\yVURaRE.exe
  2⤵
  PID:12496
- C:\Windows\System\cdJDLgi.exe
  C:\Windows\System\cdJDLgi.exe
  2⤵
  PID:12712
- C:\Windows\System\VVhrJfy.exe
  C:\Windows\System\VVhrJfy.exe
  2⤵
  PID:12648
- C:\Windows\System\qfZAuID.exe
  C:\Windows\System\qfZAuID.exe
  2⤵
  PID:12568
- C:\Windows\System\GXIttkv.exe
  C:\Windows\System\GXIttkv.exe
  2⤵
  PID:12716
- C:\Windows\System\AZtXytJ.exe
  C:\Windows\System\AZtXytJ.exe
  2⤵
  PID:12884
- C:\Windows\System\vFKoxBP.exe
  C:\Windows\System\vFKoxBP.exe
  2⤵
  PID:12812
- C:\Windows\System\lpkFYfQ.exe
  C:\Windows\System\lpkFYfQ.exe
  2⤵
  PID:12904
- C:\Windows\System\FLKAhVn.exe
  C:\Windows\System\FLKAhVn.exe
  2⤵
  PID:13136
- C:\Windows\System\twthdZz.exe
  C:\Windows\System\twthdZz.exe
  2⤵
  PID:13012
- C:\Windows\System\yQHuXRl.exe
  C:\Windows\System\yQHuXRl.exe
  2⤵
  PID:13260
- C:\Windows\System\LTuDRHA.exe
  C:\Windows\System\LTuDRHA.exe
  2⤵
  PID:11580
- C:\Windows\System\YNtfwjq.exe
  C:\Windows\System\YNtfwjq.exe
  2⤵
  PID:13140
- C:\Windows\System\BzNcYMu.exe
  C:\Windows\System\BzNcYMu.exe
  2⤵
  PID:13036
- C:\Windows\System\RRxuovg.exe
  C:\Windows\System\RRxuovg.exe
  2⤵
  PID:13104
- C:\Windows\System\mnHbpLd.exe
  C:\Windows\System\mnHbpLd.exe
  2⤵
  PID:11536
- C:\Windows\System\DxQpGIv.exe
  C:\Windows\System\DxQpGIv.exe
  2⤵
  PID:13332
- C:\Windows\System\CfkAPVe.exe
  C:\Windows\System\CfkAPVe.exe
  2⤵
  PID:13356
- C:\Windows\System\PhQRMOG.exe
  C:\Windows\System\PhQRMOG.exe
  2⤵
  PID:13380
- C:\Windows\System\wVRWAHw.exe
  C:\Windows\System\wVRWAHw.exe
  2⤵
  PID:13396
- C:\Windows\System\CEOUyMO.exe
  C:\Windows\System\CEOUyMO.exe
  2⤵
  PID:13412
- C:\Windows\System\UWxxgqL.exe
  C:\Windows\System\UWxxgqL.exe
  2⤵
  PID:13440
- C:\Windows\System\HGSxLiJ.exe
  C:\Windows\System\HGSxLiJ.exe
  2⤵
  PID:13552
- C:\Windows\System\iFiasmz.exe
  C:\Windows\System\iFiasmz.exe
  2⤵
  PID:13568
- C:\Windows\System\wxfimLR.exe
  C:\Windows\System\wxfimLR.exe
  2⤵
  PID:13588
- C:\Windows\System\ABqCuJA.exe
  C:\Windows\System\ABqCuJA.exe
  2⤵
  PID:13616
- C:\Windows\System\CyiLffU.exe
  C:\Windows\System\CyiLffU.exe
  2⤵
  PID:13672
- C:\Windows\System\Jglrvgf.exe
  C:\Windows\System\Jglrvgf.exe
  2⤵
  PID:13712
- C:\Windows\System\tWgxaHN.exe
  C:\Windows\System\tWgxaHN.exe
  2⤵
  PID:13728
- C:\Windows\System\YbvukIB.exe
  C:\Windows\System\YbvukIB.exe
  2⤵
  PID:13748
- C:\Windows\System\QFiDbex.exe
  C:\Windows\System\QFiDbex.exe
  2⤵
  PID:13784
- C:\Windows\System\fwRVkce.exe
  C:\Windows\System\fwRVkce.exe
  2⤵
  PID:13808
- C:\Windows\System\lphQTjn.exe
  C:\Windows\System\lphQTjn.exe
  2⤵
  PID:13852
- C:\Windows\System\olencQM.exe
  C:\Windows\System\olencQM.exe
  2⤵
  PID:13872
- C:\Windows\System\tAERVXj.exe
  C:\Windows\System\tAERVXj.exe
  2⤵
  PID:13920
- C:\Windows\System\lNkpqaR.exe
  C:\Windows\System\lNkpqaR.exe
  2⤵
  PID:13952
- C:\Windows\System\xZJvdLR.exe
  C:\Windows\System\xZJvdLR.exe
  2⤵
  PID:13976
- C:\Windows\System\YbOXhGt.exe
  C:\Windows\System\YbOXhGt.exe
  2⤵
  PID:14008
- C:\Windows\System\vXYyawn.exe
  C:\Windows\System\vXYyawn.exe
  2⤵
  PID:14028
- C:\Windows\System\kNBbRwR.exe
  C:\Windows\System\kNBbRwR.exe
  2⤵
  PID:14056
- C:\Windows\System\QwGSiNu.exe
  C:\Windows\System\QwGSiNu.exe
  2⤵
  PID:14084
- C:\Windows\System\JPMhMPw.exe
  C:\Windows\System\JPMhMPw.exe
  2⤵
  PID:14100
- C:\Windows\System\cqYyYpK.exe
  C:\Windows\System\cqYyYpK.exe
  2⤵
  PID:14124
- C:\Windows\System\FcgyEnx.exe
  C:\Windows\System\FcgyEnx.exe
  2⤵
  PID:14140
- C:\Windows\System\uXSAOaH.exe
  C:\Windows\System\uXSAOaH.exe
  2⤵
  PID:14160
- C:\Windows\System\baocDWS.exe
  C:\Windows\System\baocDWS.exe
  2⤵
  PID:14180
- C:\Windows\System\HzcdDNF.exe
  C:\Windows\System\HzcdDNF.exe
  2⤵
  PID:14208
- C:\Windows\System\uRRttHV.exe
  C:\Windows\System\uRRttHV.exe
  2⤵
  PID:14228
- C:\Windows\System\ipJTpAl.exe
  C:\Windows\System\ipJTpAl.exe
  2⤵
  PID:14252
- C:\Windows\System\DGVgTfN.exe
  C:\Windows\System\DGVgTfN.exe
  2⤵
  PID:14272
- C:\Windows\System\hGGMhpS.exe
  C:\Windows\System\hGGMhpS.exe
  2⤵
  PID:14292
- C:\Windows\System\dwhPlIu.exe
  C:\Windows\System\dwhPlIu.exe
  2⤵
  PID:14312
- C:\Windows\System\AVNRcAS.exe
  C:\Windows\System\AVNRcAS.exe
  2⤵
  PID:14328
- C:\Windows\System\TclsUkP.exe
  C:\Windows\System\TclsUkP.exe
  2⤵
  PID:13204
- C:\Windows\System\BceLNCD.exe
  C:\Windows\System\BceLNCD.exe
  2⤵
  PID:13172
- C:\Windows\System\SRpGYJm.exe
  C:\Windows\System\SRpGYJm.exe
  2⤵
  PID:12516
- C:\Windows\System\GpqRMrI.exe
  C:\Windows\System\GpqRMrI.exe
  2⤵
  PID:13296
- C:\Windows\System\oNtAJtV.exe
  C:\Windows\System\oNtAJtV.exe
  2⤵
  PID:12468
- C:\Windows\System\hbZbnCD.exe
  C:\Windows\System\hbZbnCD.exe
  2⤵
  PID:13404
- C:\Windows\System\oXvUQqA.exe
  C:\Windows\System\oXvUQqA.exe
  2⤵
  PID:12556
- C:\Windows\System\TwvRrtG.exe
  C:\Windows\System\TwvRrtG.exe
  2⤵
  PID:12872
- C:\Windows\System\KRXLlri.exe
  C:\Windows\System\KRXLlri.exe
  2⤵
  PID:12992
- C:\Windows\System\qdDsXbl.exe
  C:\Windows\System\qdDsXbl.exe
  2⤵
  PID:13388
- C:\Windows\System\CZWsoUh.exe
  C:\Windows\System\CZWsoUh.exe
  2⤵
  PID:13476
- C:\Windows\System\qWCpSZJ.exe
  C:\Windows\System\qWCpSZJ.exe
  2⤵
  PID:13364
- C:\Windows\System\xLaPSKW.exe
  C:\Windows\System\xLaPSKW.exe
  2⤵
  PID:13560
- C:\Windows\System\ZQWoEDz.exe
  C:\Windows\System\ZQWoEDz.exe
  2⤵
  PID:13608
- C:\Windows\System\WWaFpaK.exe
  C:\Windows\System\WWaFpaK.exe
  2⤵
  PID:13720
- C:\Windows\System\BlJHzKC.exe
  C:\Windows\System\BlJHzKC.exe
  2⤵
  PID:13704
- C:\Windows\System\opAIwpk.exe
  C:\Windows\System\opAIwpk.exe
  2⤵
  PID:13804
- C:\Windows\System\pKCUHpE.exe
  C:\Windows\System\pKCUHpE.exe
  2⤵
  PID:14000
- C:\Windows\System\SLzoxGD.exe
  C:\Windows\System\SLzoxGD.exe
  2⤵
  PID:14072
- C:\Windows\System\zqsKRUw.exe
  C:\Windows\System\zqsKRUw.exe
  2⤵
  PID:13988
- C:\Windows\System\qTaMqhj.exe
  C:\Windows\System\qTaMqhj.exe
  2⤵
  PID:14092
- C:\Windows\System\NmJTHVb.exe
  C:\Windows\System\NmJTHVb.exe
  2⤵
  PID:14304
- C:\Windows\System\CQSlSpC.exe
  C:\Windows\System\CQSlSpC.exe
  2⤵
  PID:14156
- C:\Windows\System\sCzSwDV.exe
  C:\Windows\System\sCzSwDV.exe
  2⤵
  PID:12748
- C:\Windows\System\pbPyxFM.exe
  C:\Windows\System\pbPyxFM.exe
  2⤵
  PID:14096
- C:\Windows\System\OWMpCew.exe
  C:\Windows\System\OWMpCew.exe
  2⤵
  PID:13432
- C:\Windows\System\LmhzNlY.exe
  C:\Windows\System\LmhzNlY.exe
  2⤵
  PID:14132
- C:\Windows\System\MhAdsze.exe
  C:\Windows\System\MhAdsze.exe
  2⤵
  PID:12524
- C:\Windows\System\DKfSjgl.exe
  C:\Windows\System\DKfSjgl.exe
  2⤵
  PID:13692
- C:\Windows\System\iZkUCCD.exe
  C:\Windows\System\iZkUCCD.exe
  2⤵
  PID:13896
- C:\Windows\System\fwCbOoP.exe
  C:\Windows\System\fwCbOoP.exe
  2⤵
  PID:14364
- C:\Windows\System\BboKlHi.exe
  C:\Windows\System\BboKlHi.exe
  2⤵
  PID:14384
- C:\Windows\System\oABgKOv.exe
  C:\Windows\System\oABgKOv.exe
  2⤵
  PID:14404
- C:\Windows\System\lsDjxqf.exe
  C:\Windows\System\lsDjxqf.exe
  2⤵
  PID:14420
- C:\Windows\System\SSDwGos.exe
  C:\Windows\System\SSDwGos.exe
  2⤵
  PID:14440
- C:\Windows\System\azWbnYs.exe
  C:\Windows\System\azWbnYs.exe
  2⤵
  PID:14464
- C:\Windows\System\fpVzLZu.exe
  C:\Windows\System\fpVzLZu.exe
  2⤵
  PID:14488
- C:\Windows\System\UrBrPEE.exe
  C:\Windows\System\UrBrPEE.exe
  2⤵
  PID:14520
- C:\Windows\System\AjnaPab.exe
  C:\Windows\System\AjnaPab.exe
  2⤵
  PID:14536
- C:\Windows\System\vwhkOBl.exe
  C:\Windows\System\vwhkOBl.exe
  2⤵
  PID:14560
- C:\Windows\System\OcFpvpL.exe
  C:\Windows\System\OcFpvpL.exe
  2⤵
  PID:14580
- C:\Windows\System\tkTkKFU.exe
  C:\Windows\System\tkTkKFU.exe
  2⤵
  PID:14604
- C:\Windows\System\iEaazVs.exe
  C:\Windows\System\iEaazVs.exe
  2⤵
  PID:14620
- C:\Windows\System\RMKPAOH.exe
  C:\Windows\System\RMKPAOH.exe
  2⤵
  PID:14644
- C:\Windows\System\wsFVHtP.exe
  C:\Windows\System\wsFVHtP.exe
  2⤵
  PID:14676
- C:\Windows\System\jcisMxm.exe
  C:\Windows\System\jcisMxm.exe
  2⤵
  PID:14692
- C:\Windows\System\sqKolXW.exe
  C:\Windows\System\sqKolXW.exe
  2⤵
  PID:14724
- C:\Windows\System\qzapJmp.exe
  C:\Windows\System\qzapJmp.exe
  2⤵
  PID:14748
- C:\Windows\System\laUQZGM.exe
  C:\Windows\System\laUQZGM.exe
  2⤵
  PID:14776
- C:\Windows\System\bgkrmGZ.exe
  C:\Windows\System\bgkrmGZ.exe
  2⤵
  PID:14804
- C:\Windows\System\rwlnRSD.exe
  C:\Windows\System\rwlnRSD.exe
  2⤵
  PID:14828
- C:\Windows\System\UgROqSV.exe
  C:\Windows\System\UgROqSV.exe
  2⤵
  PID:14848
- C:\Windows\System\ntyogIB.exe
  C:\Windows\System\ntyogIB.exe
  2⤵
  PID:14876
- C:\Windows\System\soiCtRw.exe
  C:\Windows\System\soiCtRw.exe
  2⤵
  PID:14892
- C:\Windows\System\qtZYuGw.exe
  C:\Windows\System\qtZYuGw.exe
  2⤵
  PID:14908
- C:\Windows\System\VCBinId.exe
  C:\Windows\System\VCBinId.exe
  2⤵
  PID:14928
- C:\Windows\System\xPLLbtW.exe
  C:\Windows\System\xPLLbtW.exe
  2⤵
  PID:14948
- C:\Windows\System\YWtKJqA.exe
  C:\Windows\System\YWtKJqA.exe
  2⤵
  PID:14972
- C:\Windows\System\IfzdTds.exe
  C:\Windows\System\IfzdTds.exe
  2⤵
  PID:14988
- C:\Windows\System\HhkrUHk.exe
  C:\Windows\System\HhkrUHk.exe
  2⤵
  PID:15028
- C:\Windows\System\wQylocu.exe
  C:\Windows\System\wQylocu.exe
  2⤵
  PID:15056
- C:\Windows\System\agHMCfA.exe
  C:\Windows\System\agHMCfA.exe
  2⤵
  PID:15072
- C:\Windows\System\AFAXDoY.exe
  C:\Windows\System\AFAXDoY.exe
  2⤵
  PID:15108
- C:\Windows\System\QIrcoHj.exe
  C:\Windows\System\QIrcoHj.exe
  2⤵
  PID:15136
- C:\Windows\System\qtIDzQP.exe
  C:\Windows\System\qtIDzQP.exe
  2⤵
  PID:15152
- C:\Windows\System\pirllfS.exe
  C:\Windows\System\pirllfS.exe
  2⤵
  PID:15176
- C:\Windows\System\AgjeZhl.exe
  C:\Windows\System\AgjeZhl.exe
  2⤵
  PID:15196
- C:\Windows\System\CwzpFKM.exe
  C:\Windows\System\CwzpFKM.exe
  2⤵
  PID:15220
- C:\Windows\System\ZdEZZyz.exe
  C:\Windows\System\ZdEZZyz.exe
  2⤵
  PID:15256
- C:\Windows\System\cLLyQPO.exe
  C:\Windows\System\cLLyQPO.exe
  2⤵
  PID:15280
- C:\Windows\System\YRErXdN.exe
  C:\Windows\System\YRErXdN.exe
  2⤵
  PID:15308
- C:\Windows\System\xDerrOk.exe
  C:\Windows\System\xDerrOk.exe
  2⤵
  PID:15336
- C:\Windows\System\DUBEjGS.exe
  C:\Windows\System\DUBEjGS.exe
  2⤵
  PID:14024
- C:\Windows\System\XWicrNG.exe
  C:\Windows\System\XWicrNG.exe
  2⤵
  PID:13184
- C:\Windows\System\spGJApr.exe
  C:\Windows\System\spGJApr.exe
  2⤵
  PID:13928
- C:\Windows\System\LotvFcN.exe
  C:\Windows\System\LotvFcN.exe
  2⤵
  PID:13524
- C:\Windows\System\gkfLeOg.exe
  C:\Windows\System\gkfLeOg.exe
  2⤵
  PID:13576
- C:\Windows\System\HJFQpGz.exe
  C:\Windows\System\HJFQpGz.exe
  2⤵
  PID:13796
- C:\Windows\System\lpSrYOG.exe
  C:\Windows\System\lpSrYOG.exe
  2⤵
  PID:13668
- C:\Windows\System\nXNtRTO.exe
  C:\Windows\System\nXNtRTO.exe
  2⤵
  PID:13964
- C:\Windows\System\BqtoWIz.exe
  C:\Windows\System\BqtoWIz.exe
  2⤵
  PID:14400
- C:\Windows\System\qPaewsS.exe
  C:\Windows\System\qPaewsS.exe
  2⤵
  PID:13664
- C:\Windows\System\DnvWRCL.exe
  C:\Windows\System\DnvWRCL.exe
  2⤵
  PID:14480
- C:\Windows\System\ybYvILU.exe
  C:\Windows\System\ybYvILU.exe
  2⤵
  PID:14588
- C:\Windows\System\xGrkLbe.exe
  C:\Windows\System\xGrkLbe.exe
  2⤵
  PID:14656
- C:\Windows\System\NDhfqJV.exe
  C:\Windows\System\NDhfqJV.exe
  2⤵
  PID:14436
- C:\Windows\System\MezXTOa.exe
  C:\Windows\System\MezXTOa.exe
  2⤵
  PID:14476
- C:\Windows\System\yksrVtX.exe
  C:\Windows\System\yksrVtX.exe
  2⤵
  PID:14904
- C:\Windows\System\VpvCEqm.exe
  C:\Windows\System\VpvCEqm.exe
  2⤵
  PID:14632
- C:\Windows\System\NDHNFGV.exe
  C:\Windows\System\NDHNFGV.exe
  2⤵
  PID:14984
- C:\Windows\System\ZIdSsTT.exe
  C:\Windows\System\ZIdSsTT.exe
  2⤵
  PID:15104
- C:\Windows\System\uACgNJJ.exe
  C:\Windows\System\uACgNJJ.exe
  2⤵
  PID:14796
- C:\Windows\System\HyGJsox.exe
  C:\Windows\System\HyGJsox.exe
  2⤵
  PID:2008
- C:\Windows\System\xEDiSdf.exe
  C:\Windows\System\xEDiSdf.exe
  2⤵
  PID:15332
- C:\Windows\System\QTSRlnv.exe
  C:\Windows\System\QTSRlnv.exe
  2⤵
  PID:15384
- C:\Windows\System\feaaHLE.exe
  C:\Windows\System\feaaHLE.exe
  2⤵
  PID:15404
- C:\Windows\System\jcnDvzf.exe
  C:\Windows\System\jcnDvzf.exe
  2⤵
  PID:15424
- C:\Windows\System\GSkifdH.exe
  C:\Windows\System\GSkifdH.exe
  2⤵
  PID:15456
- C:\Windows\System\kelCfVJ.exe
  C:\Windows\System\kelCfVJ.exe
  2⤵
  PID:15496
- C:\Windows\System\BkHQeFq.exe
  C:\Windows\System\BkHQeFq.exe
  2⤵
  PID:15516
- C:\Windows\System\mcTIpDN.exe
  C:\Windows\System\mcTIpDN.exe
  2⤵
  PID:15532
- C:\Windows\System\HbSqhdW.exe
  C:\Windows\System\HbSqhdW.exe
  2⤵
  PID:15548
- C:\Windows\System\desjwKd.exe
  C:\Windows\System\desjwKd.exe
  2⤵
  PID:15592
- C:\Windows\System\IGytStz.exe
  C:\Windows\System\IGytStz.exe
  2⤵
  PID:15608
- C:\Windows\System\hkssBaU.exe
  C:\Windows\System\hkssBaU.exe
  2⤵
  PID:15636
- C:\Windows\System\eLEHWOM.exe
  C:\Windows\System\eLEHWOM.exe
  2⤵
  PID:15656
- C:\Windows\System\FaEmTiW.exe
  C:\Windows\System\FaEmTiW.exe
  2⤵
  PID:15688
- C:\Windows\System\euYtBGi.exe
  C:\Windows\System\euYtBGi.exe
  2⤵
  PID:15708
- C:\Windows\System\WcAsLEs.exe
  C:\Windows\System\WcAsLEs.exe
  2⤵
  PID:15744
- C:\Windows\System\fviRhKD.exe
  C:\Windows\System\fviRhKD.exe
  2⤵
  PID:15764
- C:\Windows\System\SvZkljt.exe
  C:\Windows\System\SvZkljt.exe
  2⤵
  PID:15784
- C:\Windows\System\BdXIGgq.exe
  C:\Windows\System\BdXIGgq.exe
  2⤵
  PID:15804
- C:\Windows\System\CiUjXpz.exe
  C:\Windows\System\CiUjXpz.exe
  2⤵
  PID:15832
- C:\Windows\System\BVLNmtA.exe
  C:\Windows\System\BVLNmtA.exe
  2⤵
  PID:15848
- C:\Windows\System\WFyfZDg.exe
  C:\Windows\System\WFyfZDg.exe
  2⤵
  PID:15876
- C:\Windows\System\ByatMTr.exe
  C:\Windows\System\ByatMTr.exe
  2⤵
  PID:15900
- C:\Windows\System\vkHZEjw.exe
  C:\Windows\System\vkHZEjw.exe
  2⤵
  PID:15928
- C:\Windows\System\YcdlyFC.exe
  C:\Windows\System\YcdlyFC.exe
  2⤵
  PID:15952
- C:\Windows\System\dLhHmkd.exe
  C:\Windows\System\dLhHmkd.exe
  2⤵
  PID:15968
- C:\Windows\System\PKsZEtl.exe
  C:\Windows\System\PKsZEtl.exe
  2⤵
  PID:15996
- C:\Windows\System\ICrpeEi.exe
  C:\Windows\System\ICrpeEi.exe
  2⤵
  PID:16024
- C:\Windows\System\jxydMBs.exe
  C:\Windows\System\jxydMBs.exe
  2⤵
  PID:16044
- C:\Windows\System\KkFgPHH.exe
  C:\Windows\System\KkFgPHH.exe
  2⤵
  PID:16064
- C:\Windows\System\pbVZKSP.exe
  C:\Windows\System\pbVZKSP.exe
  2⤵
  PID:16092
- C:\Windows\System\XVuiBox.exe
  C:\Windows\System\XVuiBox.exe
  2⤵
  PID:16116
- C:\Windows\System\wDioSYe.exe
  C:\Windows\System\wDioSYe.exe
  2⤵
  PID:16140
- C:\Windows\System\YeGEqaz.exe
  C:\Windows\System\YeGEqaz.exe
  2⤵
  PID:16164
- C:\Windows\System\XTotNxm.exe
  C:\Windows\System\XTotNxm.exe
  2⤵
  PID:16184
- C:\Windows\System\PcRdeVz.exe
  C:\Windows\System\PcRdeVz.exe
  2⤵
  PID:16208
- C:\Windows\System\vcfEBLO.exe
  C:\Windows\System\vcfEBLO.exe
  2⤵
  PID:16224
- C:\Windows\System\EZFClAo.exe
  C:\Windows\System\EZFClAo.exe
  2⤵
  PID:16256
- C:\Windows\System\buZTIRJ.exe
  C:\Windows\System\buZTIRJ.exe
  2⤵
  PID:16284
- C:\Windows\System\pMeHZZk.exe
  C:\Windows\System\pMeHZZk.exe
  2⤵
  PID:16308
- C:\Windows\System\DZKRrBh.exe
  C:\Windows\System\DZKRrBh.exe
  2⤵
  PID:16328
- C:\Windows\System\bwlMDbr.exe
  C:\Windows\System\bwlMDbr.exe
  2⤵
  PID:16348
- C:\Windows\System\NPVfTyp.exe
  C:\Windows\System\NPVfTyp.exe
  2⤵
  PID:15356
- C:\Windows\System\UEloBiG.exe
  C:\Windows\System\UEloBiG.exe
  2⤵
  PID:14968
- C:\Windows\System\TLJlDhR.exe
  C:\Windows\System\TLJlDhR.exe
  2⤵
  PID:14704
- C:\Windows\System\garBOvR.exe
  C:\Windows\System\garBOvR.exe
  2⤵
  PID:15052
- C:\Windows\System\UNWVrYg.exe
  C:\Windows\System\UNWVrYg.exe
  2⤵
  PID:14772
- C:\Windows\System\mKHNvEv.exe
  C:\Windows\System\mKHNvEv.exe
  2⤵
  PID:14824
- C:\Windows\System\EldwqiP.exe
  C:\Windows\System\EldwqiP.exe
  2⤵
  PID:14672
- C:\Windows\System\WIGeJBj.exe
  C:\Windows\System\WIGeJBj.exe
  2⤵
  PID:14900
- C:\Windows\System\AdGdUyk.exe
  C:\Windows\System\AdGdUyk.exe
  2⤵
  PID:15000
- C:\Windows\System\GiMrugm.exe
  C:\Windows\System\GiMrugm.exe
  2⤵
  PID:13968
- C:\Windows\System\uMxMXhG.exe
  C:\Windows\System\uMxMXhG.exe
  2⤵
  PID:15092
- C:\Windows\System\AudfAxx.exe
  C:\Windows\System\AudfAxx.exe
  2⤵
  PID:15624
- C:\Windows\System\luazWDx.exe
  C:\Windows\System\luazWDx.exe
  2⤵
  PID:14532
- C:\Windows\System\KdspuMJ.exe
  C:\Windows\System\KdspuMJ.exe
  2⤵
  PID:15208
- C:\Windows\System\FqjKQpL.exe
  C:\Windows\System\FqjKQpL.exe
  2⤵
  PID:15268
- C:\Windows\System\AQfrYog.exe
  C:\Windows\System\AQfrYog.exe
  2⤵
  PID:14452
- C:\Windows\System\DONEzNS.exe
  C:\Windows\System\DONEzNS.exe
  2⤵
  PID:15884
- C:\Windows\System\aZUSWcH.exe
  C:\Windows\System\aZUSWcH.exe
  2⤵
  PID:15312
- C:\Windows\System\wpRewok.exe
  C:\Windows\System\wpRewok.exe
  2⤵
  PID:15960
- C:\Windows\System\MwXleVJ.exe
  C:\Windows\System\MwXleVJ.exe
  2⤵
  PID:13348
- C:\Windows\System\NNpDMAH.exe
  C:\Windows\System\NNpDMAH.exe
  2⤵
  PID:16020
- C:\Windows\System\OmAVyvz.exe
  C:\Windows\System\OmAVyvz.exe
  2⤵
  PID:14380
- C:\Windows\System\BpikNpG.exe
  C:\Windows\System\BpikNpG.exe
  2⤵
  PID:16176
- C:\Windows\System\UWmMoMV.exe
  C:\Windows\System\UWmMoMV.exe
  2⤵
  PID:15676
- C:\Windows\System\nVHnPVA.exe
  C:\Windows\System\nVHnPVA.exe
  2⤵
  PID:16396
- C:\Windows\System\sKqtDXf.exe
  C:\Windows\System\sKqtDXf.exe
  2⤵
  PID:16412
- C:\Windows\System\dQUaVBA.exe
  C:\Windows\System\dQUaVBA.exe
  2⤵
  PID:16448
- C:\Windows\System\RwUyqPe.exe
  C:\Windows\System\RwUyqPe.exe
  2⤵
  PID:16464
- C:\Windows\System\cCCwxrw.exe
  C:\Windows\System\cCCwxrw.exe
  2⤵
  PID:16484
- C:\Windows\System\vsUukbf.exe
  C:\Windows\System\vsUukbf.exe
  2⤵
  PID:16520
- C:\Windows\System\nAATaiF.exe
  C:\Windows\System\nAATaiF.exe
  2⤵
  PID:16548
- C:\Windows\System\WBVAWsA.exe
  C:\Windows\System\WBVAWsA.exe
  2⤵
  PID:16576
- C:\Windows\System\MUDDHQm.exe
  C:\Windows\System\MUDDHQm.exe
  2⤵
  PID:16596
- C:\Windows\System\wJAxeAO.exe
  C:\Windows\System\wJAxeAO.exe
  2⤵
  PID:16616
- C:\Windows\System\VmFiCVV.exe
  C:\Windows\System\VmFiCVV.exe
  2⤵
  PID:16636
- C:\Windows\System\xnFVDLD.exe
  C:\Windows\System\xnFVDLD.exe
  2⤵
  PID:16656
- C:\Windows\System\cxMWwaG.exe
  C:\Windows\System\cxMWwaG.exe
  2⤵
  PID:16684
- C:\Windows\System\kDmRMVi.exe
  C:\Windows\System\kDmRMVi.exe
  2⤵
  PID:16700
- C:\Windows\System\HvbaMIF.exe
  C:\Windows\System\HvbaMIF.exe
  2⤵
  PID:16728
- C:\Windows\System\HpXyWVd.exe
  C:\Windows\System\HpXyWVd.exe
  2⤵
  PID:16756
- C:\Windows\System\sbvdYwY.exe
  C:\Windows\System\sbvdYwY.exe
  2⤵
  PID:16784
- C:\Windows\System\zlOuhxW.exe
  C:\Windows\System\zlOuhxW.exe
  2⤵
  PID:16804
- C:\Windows\System\aurcrHE.exe
  C:\Windows\System\aurcrHE.exe
  2⤵
  PID:17268
- C:\Windows\System\OZJBXtg.exe
  C:\Windows\System\OZJBXtg.exe
  2⤵
  PID:17284
- C:\Windows\System\imAuxRR.exe
  C:\Windows\System\imAuxRR.exe
  2⤵
  PID:17300
- C:\Windows\System\ujHHgFh.exe
  C:\Windows\System\ujHHgFh.exe
  2⤵
  PID:17316
- C:\Windows\System\VetwYOj.exe
  C:\Windows\System\VetwYOj.exe
  2⤵
  PID:17340
- C:\Windows\System\PdcgqPX.exe
  C:\Windows\System\PdcgqPX.exe
  2⤵
  PID:17364
- C:\Windows\System\nmnBOgf.exe
  C:\Windows\System\nmnBOgf.exe
  2⤵
  PID:17380
- C:\Windows\System\svpiHIJ.exe
  C:\Windows\System\svpiHIJ.exe
  2⤵
  PID:17396
- C:\Windows\System\YdOMMbG.exe
  C:\Windows\System\YdOMMbG.exe
  2⤵
  PID:16292
- C:\Windows\System\Vjiamth.exe
  C:\Windows\System\Vjiamth.exe
  2⤵
  PID:14688
- C:\Windows\System\IXTXDEN.exe
  C:\Windows\System\IXTXDEN.exe
  2⤵
  PID:14936
- C:\Windows\System\JfPVXhq.exe
  C:\Windows\System\JfPVXhq.exe
  2⤵
  PID:15864
- C:\Windows\System\aVHKgGc.exe
  C:\Windows\System\aVHKgGc.exe
  2⤵
  PID:15908
- C:\Windows\System\ovQWWms.exe
  C:\Windows\System\ovQWWms.exe
  2⤵
  PID:15920
- C:\Windows\System\hWtiXEq.exe
  C:\Windows\System\hWtiXEq.exe
  2⤵
  PID:15948
- C:\Windows\System\PRPfLKq.exe
  C:\Windows\System\PRPfLKq.exe
  2⤵
  PID:15376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ByaCGKk.exe

Filesize
1.8MB

MD5
588189b8b1055b4e0baa3dc93633babc

SHA1
0c802e0ed961e04f5d202d84cc43f00e34012395

SHA256
ea074bf03ec11302717a9267bc0a9fe83af0312f2e166da6d269b2d5594baa54

SHA512
f57f708ab556329d9eac75f899b594f6b076ec436ed96ebe4ee0c7c35c9cf51e3a265c6c7bea4a1ba4827f9351533691849289594bbdd457f283a040a042aa5e

Download Submit
C:\Windows\System\COFqyys.exe

Filesize
1.8MB

MD5
7795d03af25a1ad1ff1f4cf746f1a6e7

SHA1
d87592367961e0638f710489b28d618de3f96595

SHA256
7202939b4091119be4efaa6e847862040f48fb7842e3190a666eacdd311d5117

SHA512
81539f787573be8bb14d77dcab75da9e3741c131ac11920963a4980f9eeaab50ed82f0b106a32dcf5b02784391e6076da5e6965c2a43dd9db74400daa14a70cf

Download Submit
C:\Windows\System\FQgdnrt.exe

Filesize
1.8MB

MD5
eb239c74bc7090f991ccc1c5024bef39

SHA1
bd515cf9cc4d2a90de1e9c81dc8b73d1d295a7f6

SHA256
31be4925cc00957f00e3d477aff72258621a878d636c22cc03429412654ea009

SHA512
70f54cd1597c66cc58a1e01a7a529c1ca4223f6366795d704c1042d33b5d2257106986851da1e72bb71135390ae1ac1238c1800f4653c70888178a5f7538d964

Download Submit
C:\Windows\System\IUdwQGU.exe

Filesize
1.8MB

MD5
2f47a1237d156572869e9e82c326ed19

SHA1
8d191fedfef5e1cde77b34aa342b8747580132ee

SHA256
3108abff00b77abb01563487e5ab23c14434aa80ec22fbbbfd472621df35bac4

SHA512
8c17b36b117ec1e92ef939cf27089c5fe3c238f560961bba1280bc86efe51586bd0d269d39ae94c79fd7262f92561211fb13a590c57f8478ab0c6292636d1199

Download Submit
C:\Windows\System\JWpkGqx.exe

Filesize
1.8MB

MD5
2de2740fef6ca4b68f2bca2f29fda8cc

SHA1
781ebeb7640d8ce7fce43807fac8a9306e2bf64c

SHA256
1eee479bdee7504b93126c130b7e917d9bedc4ccae80ea7cadf1ad6aa1346eec

SHA512
cbadb04a1266d5a04677198c5d419180fd4cd3534b711c263e0be28734896af46334efe8bbbb2c9c5ce7a72e41c270cbe565ff9eff4b68e33d9899ef9ac7f2ac

Download Submit
C:\Windows\System\KvljeTn.exe

Filesize
1.8MB

MD5
7bc7871c06f420ba8c366e755470bdb1

SHA1
16e3b893374d831c7f7e541aed0aceccaeabf414

SHA256
37a4bffa553f3f33db0974ac8fd89b6176bc217174b3e3cf6d415d923d0ba799

SHA512
7dc68a52dea7ade353772caf7fbf5c3dae294121b9b3919f45d6236a06d07267514143f34935d9d069960f3b6e39af0be462b5a6afc460a91704618051df86c8

Download Submit
C:\Windows\System\MAEPFtM.exe

Filesize
1.8MB

MD5
377fc54c43ddc3908641efadf584b617

SHA1
2dfa932d33db5e98182219d8e4d239ea556c13ec

SHA256
4aec49ca51ce5d22fbe933801be1d3451a67a8f47b6de234437696a520364a09

SHA512
6106118eb3911c2e30ba5c1c7937dc268e5e4f06b200233abe5255da25dcf9dc7f4715d479a2ad341df55bce76c9e42604133b5865e11ddaf67b22cdb64faf2b

Download Submit
C:\Windows\System\MBWiXsb.exe

Filesize
1.8MB

MD5
099f42614296547dec60d052593990ed

SHA1
4b329f60e6dd39b9587e6362c7d91fb5d2226fe3

SHA256
82604cd7cea672528344eb47993c51a7d7112d41933b1882be7096462efb68e5

SHA512
ad13e41fbfbb7ad5f8bf714e29f07a9245c024bfe4222bd1d7bdacebd9e3dc30b743258f9954ae8ab2145cfa56b6690945b4623db6f26b030e6744e954229922

Download Submit
C:\Windows\System\QKAQoCu.exe

Filesize
1.8MB

MD5
ff1b43521a8b0006377d0899f120d77b

SHA1
a3aa40597458ec827bf8aaad7d84e6c745edc997

SHA256
1ef3af5dbb89d0b70a276339d42ad6e030bc5f4c7578af2d2f8bb85f42cc7810

SHA512
0eb2272267a41a8a9ea6b3ff969ea9febca84d25eb7d12b08df76ccc372ab3dd1e4d87c8a05ae0f597fcc76565be8812ebd2841d1e0f868fa135346399552ae8

Download Submit
C:\Windows\System\QkmWEGf.exe

Filesize
1.8MB

MD5
b56224160dee1fbed8eb5f3e8b3ab368

SHA1
2fd1b1432d8d0b202180cc2a28c02288391c9611

SHA256
0dbe65541bd0dabe236a5001515593e428920dc44c3e3dac69f30eac23d70cb2

SHA512
9807a218cec5fd02bab0285a126160adff94fd2066820576fd4707f1551f80010cbc4f3104e9c834584dddcfbdda3658807b19d6c03923c490e94ae412373112

Download Submit
C:\Windows\System\RPqYxEB.exe

Filesize
1.8MB

MD5
1660f9d8c587d48591052901ce915ee1

SHA1
a1e4b4494b031bd2729144e5e15b825c516c4eea

SHA256
7ab2b1594da2ff4944a8c0d66bdbc2c095d8b420c87c37c54e5e6e2583409a07

SHA512
f00b9f51630242508b57e69f7e8b2e75f2bec57276d4b7c6d0ee85e016c76b936961fb28aba699c4fc558537fa477b5ec36306f522ab5411d29ca972ff49100e

Download Submit
C:\Windows\System\RSuOXVD.exe

Filesize
1.8MB

MD5
d7beaca05eebaa897dd44396d9132b74

SHA1
f4900735419a2134a3607914f720795db0ccc573

SHA256
3cd52b74351355a7be4845183d3249557f52d41763a1a5b94c93cca2f98d31bb

SHA512
f47273e978f7036d015b273eaa815593ab7dc1f2207564f70e242c4dc60699af1b2096058bcf09711af69293578e9e559f5b764cde3442343b2e3fd7d4264f75

Download Submit
C:\Windows\System\SQIDXTS.exe

Filesize
1.8MB

MD5
5c03951cc72ecfa3535fa6ec07a4fd45

SHA1
85f11ab92fa87b97eb63645b240d32b98350b903

SHA256
4c616052f40efb7bea5c99e526adf7ca01b9e0bac1431574f9e43ee55c8f5a86

SHA512
b14d100719d2872b97d6896e0a8d8e45799858882e66b5c14be13a47648f5f4bffa8645467e47bec84b9c3e17fa3df52680bde5d2dc7701b0ae7069d01e2acd1

Download Submit
C:\Windows\System\UVWNCtI.exe

Filesize
1.8MB

MD5
3a79f64e2875f7fe566c621eb72a50e6

SHA1
f19f4c36a4e0cd09b256d573858e7e9eff6109da

SHA256
e77eb2d5c9ee74ddf7fd5a69cd67d0c5a0d65a1ed2214df383e99310260d2e8f

SHA512
5e87f91327e09346219878378dda89ac9c28d59f8b7619dff78e955be443d9c71fcc7670086eebb381ef24fba6fd3d58b96d6aa933095fd1af9cd469476bd1d2

Download Submit
C:\Windows\System\WxKTHGf.exe

Filesize
1.8MB

MD5
5cd88644ec1b512dc74ed5ef07f0139e

SHA1
ba709af011639a4c78e23797ab1b69f9fe103463

SHA256
99519bbcb23ebb62be601d4d21ce93ec5ae72334d42cb08ead5ab9d95a4bd8c1

SHA512
9407bd13c725a687ef30b0bcfd62f715e9849fc32b5ad7475ae011e71ca6dde246e48cc83c63b767f5ac3895300193deeaff61d46f7ecbbcb96b561abe213cf8

Download Submit
C:\Windows\System\XEFaiCq.exe

Filesize
1.8MB

MD5
b40b1dda32b25182d55dd5c96fd692b4

SHA1
15f1340c63a3579cbf2f5abc739f357dffef90cc

SHA256
302bfc0589720600357803099bbf1fbd5cc8bf691080dfeb46d775bcdfd82e9b

SHA512
6fc7ae46e544144a3345693ec64b3a1bcfd9c5fbed0a50d2973bc4b721cc579c545d04abf4e8b6a59ee1e5babf65573db0d9299a653442dc2c1137d7acdae518

Download Submit
C:\Windows\System\XWpNdlC.exe

Filesize
1.8MB

MD5
5dc0331d33f45d5e771227bd09d2fb3d

SHA1
6389797e804cb84c583e4328bf5ad3730d91e157

SHA256
4316682d926cf942711d25f95862a4ee8f9d7f2ffe840312c9bba519f5f510bb

SHA512
70873435c17881357e2916d4c3a6af605abbb80e914fdd77f37c9ab51799858e5a749f3794324aff927b52640d05e105703b886b11fcd84a452733419668bbbf

Download Submit
C:\Windows\System\ankbOyf.exe

Filesize
1.8MB

MD5
2e7d756f045c9c5ed0624034e9349926

SHA1
e512545f267e51784c60a6705f1c79f58324b7f4

SHA256
34fc82a67dcd54ae2cb725060dde72e8c0505da8c903e139464b0dd3d984220b

SHA512
41b6fb99622d2b317deb1d2f94a176b30ac65ec433cb032feefa17a23107d0b02a19dc3120e668c8dc484eefa5b1f96d3c076eeb6a4b714f011136903a31de94

Download Submit
C:\Windows\System\bMuWqHh.exe

Filesize
1.8MB

MD5
f82daa6e0504e223669c759e7d34a769

SHA1
1dbf003ff6e20bccf7ab79ed013bbdcf64f2b286

SHA256
be284dfe9b7afc0a9d65a8114f6c73b7eb6098bb5f4b25c9dd924763f2f38ada

SHA512
75b7cee798026156c20b56ddcb562ee5c6e80f3efe595c8fb7c94fb8e05b79edcd21c261d1987984854ef4f7df9ae55a864c6b789ce80af15947bf5abf1fcdfa

Download Submit
C:\Windows\System\cvzzWjG.exe

Filesize
1.8MB

MD5
4b6f4400c40be0ea5579cfeb0499f3b8

SHA1
f34ae0c180a878988a61ffbd726dbdd318e3a3ef

SHA256
ab092113980bb97e991ae1959cb53dffa38e75ba691dc2af3d056f67c8aa194c

SHA512
0b04bcc0d9fc7717ad98397ac30893fccb9d024485c2c73b94ec03b66c49c84b650db378946624e67f3250463df9d0226f3a00124c9a9388b3f97044f027e02f

Download Submit
C:\Windows\System\dZThCzw.exe

Filesize
1.8MB

MD5
88a8a938caf9e0c65fc436e3887f3795

SHA1
7652f0b4a03735b1b81c347de1d51e10e4e1e2fb

SHA256
b286d48618b68dfc3e1bdf1501b1f8522c1371f6c8e49d5befb3f5e9f35e41d4

SHA512
fcddd5a063a5e037a7214a94ce318f75fc0c8fd90ecc1b5d1d9a3259bc6fbfe33248ca2797c369edb902f0ed4ec381e68372361bc946a007174731eb5a5e90cc

Download Submit
C:\Windows\System\egnnbOG.exe

Filesize
1.8MB

MD5
909a8e0037da483571328852f22e40b8

SHA1
c16fdb840885a1feea3d6ad3bded75d08b26248f

SHA256
866487667dfbb2a5fb9c5e980835640373f04a5433062ba17d55cf038f16a4af

SHA512
c8c58d4ebc4660b80eddb1c8f2d610dc23454fb6bb7ed658d61133e9a75545360aad72a19c8da289c0341147188805a1674a45e1cdb79d9f03e7f9dce41da9e2

Download Submit
C:\Windows\System\fXDFepG.exe

Filesize
1.8MB

MD5
c517b7f2df3c00bfc5448761209c053b

SHA1
aac45c4bab48256f0497db5355d75f7afdaa4711

SHA256
74054243d50dc4cb819fbf53815dbae2eea7e8ff1bb15a98cc8198ae69c4dae1

SHA512
b6561e70dff3d929a02e1e5ec09729b8c02a4d0ecbfb22043c3227f8395f9a576bd8dd4a2a742ec0fc347c68431664d2a871543134aabd2ad24ba99eb1be9a85

Download Submit
C:\Windows\System\gmewodf.exe

Filesize
1.8MB

MD5
3a319df0520fabf4b77a0ee3b1ec1f76

SHA1
7e743af80577ab1524c8d8607a3fe467e46ea324

SHA256
c4f60de359db9c31044c269a1257106114400b4a77a6d2bbc1fc4926896f1bcf

SHA512
38874992143e43baa90a46f0f003ba7e96cc6dff77f39cdd242a406ec57bbc41193c69d209495bfc69e77096580c9e9c830ebae10f94c2804d4bcbb514f53498

Download Submit
C:\Windows\System\gnWTjhx.exe

Filesize
1.8MB

MD5
136019c0691ce9cd3733b03b28254f1e

SHA1
ef53cd20d2e6212f3f6e1de48ee6f1381a34455b

SHA256
206987230a874383a9437cfcc4b83f5940d4d84ef259fc843aa5143a623aa28e

SHA512
f3838af74676d099b65f6212cc651dd39a6ce1002aff0a7d392cd334513499bbcd370dc5ae87e36c7f421f2b47c08c2291d0d6d0343b4a25dc40319899a23dc5

Download Submit
C:\Windows\System\gtsYMVV.exe

Filesize
1.8MB

MD5
5f7f1fef21d728e573862f04701dc949

SHA1
ed3e817f62622e4c76d73d40a900a2df5be5a0a9

SHA256
8e3bc60aec636fdf3cebaea1a3eb2e31ce179c7b37776f3c9f7520c68fb4ca59

SHA512
32ea1584e8c6ff0a966f687835310bb1494b4bad3af441d502b2990a373bc7cafe2877b801f0831246c2f87022cbd629b85023b09845ec73ccbc82f58d66b2c2

Download Submit
C:\Windows\System\oGEqvax.exe

Filesize
1.8MB

MD5
8d456b7b183088ae7935ed590c309519

SHA1
b8f3b2195c0c18f58fc9eae88b2b2f096b3f1e6a

SHA256
ebab799ce988b1d6ddef76a3982cc24df49edf872df49dce7ac445fdd328dfe9

SHA512
9678ceaff396d60135a0879558bf8dc8216f02b82d71653ba294ad5af0d9224197c649616be6016f5023d3f86a40deb3bdedd20c5d3fbe252dfbffc14312f035

Download Submit
C:\Windows\System\reIuSNH.exe

Filesize
1.8MB

MD5
9f042245b94276a81123530824b03efd

SHA1
f6d5aeb0d54dcad57908e4244402d4e3c04ca21f

SHA256
d447e7fb0eb8d7d1e2ed38f27da517d973f64b096f34e78a8444142bfc8c3698

SHA512
ae71b4e2a7e4d3fb3317eccf291eb3d0952a1b77ee9babd7b5f3bdee23f189a3a05a2478829ba255c71670f878a4523e0f5ff5555dcd1deb31fda3e47cc4362c

Download Submit
C:\Windows\System\ryTyfKI.exe

Filesize
1.8MB

MD5
c5bc2a3a3a4a9e217a99bc204e86fe0f

SHA1
38e03070aeeb5f60e0c546bc800dfd5c06f3ebac

SHA256
e703d1ef937d3f9adea7cf2b36f6d877042b9d1a4ed08d9d6633f907e1ae19f8

SHA512
37c88a4749a6001e67b227daa842bf09fdc5b791b242c00926acf06326335541660713b7b5f31a2143fc374f57237e14c0a997047996b34a8da807ccd178b573

Download Submit
C:\Windows\System\taPibwK.exe

Filesize
1.8MB

MD5
13bba5d112de010c211d88c051c033bf

SHA1
1cba4930a1f45576d03ac606d8e3ac3360a64a09

SHA256
26bf32412cbc2d91c4d517381f1779a8846beadb05c35c5a7f9a20f765a282cf

SHA512
c9d970d0ca9804138c11f1d1e3aece8ddc2ef68420de1abf97194921a8645a33e06f6def39556ed4ed82a76f8a8f041b88487c442a2a15d01e575d1d324bd091

Download Submit
C:\Windows\System\ukVXyDG.exe

Filesize
1.8MB

MD5
b22c9aede378a6cefd31cd97f2a8c022

SHA1
eccf7a8dde96372b3256c676ca3811fcd1d4e10b

SHA256
17d19f213970cb788b69ef58226303b9b289551d2446d8d079780e42825c67a7

SHA512
631e06bed19ec2b376d58591093c98de94617bc9e0e8f9b19d65cf645bcc21f1f53c2ecb6ce78033c72d8be3b0121a17a333a99336d89002b428bca8df0424ad

Download Submit
C:\Windows\System\xtmtVzT.exe

Filesize
1.8MB

MD5
7f260d7284ca10872e80aef8b8992e70

SHA1
11be37251eade3494a3c2e54d9e536b06e48b8f8

SHA256
9995be32348a6314ad96e8748a6455937356c553fac7bf5cfe392cbc51b816cf

SHA512
92637424d7595d99c37269c113f36406c8cfdd27041a66524ffc0583f778b03bf5458f4c789992d63a182620e50ce8e2d0216858a1c712880162b31c542e0dce

Download Submit
memory/4996-0-0x00000228CC6E0000-0x00000228CC6F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads