xmrig | 6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
Size

1.6MB
MD5

8debda4ffe47774bb1cd6fa48e865515
SHA1

2cb249dbeb7ad16d6a1263b3aa4659d4b369cec9
SHA256

6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852
SHA512

c7779af346e2d6fc4a6e84e0719a1b4c81a555aa9faa075ccbfe7bc50255dbe0cd83a853ea3b45a81cb68fb7b6f22839238aa2249e40ca8afa6eaaf36ef6a291
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRegkvbAOLLJ:GemTLkNdfE0pZy+

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b32-4.dat	xmrig
behavioral2/files/0x000b000000023b8f-10.dat	xmrig
behavioral2/files/0x000a000000023b93-11.dat	xmrig
behavioral2/files/0x000a000000023b94-31.dat	xmrig
behavioral2/files/0x000a000000023b99-38.dat	xmrig
behavioral2/files/0x000a000000023b9b-64.dat	xmrig
behavioral2/files/0x000a000000023b9e-70.dat	xmrig
behavioral2/files/0x000a000000023b9d-68.dat	xmrig
behavioral2/files/0x000a000000023b9c-66.dat	xmrig
behavioral2/files/0x000a000000023b9a-62.dat	xmrig
behavioral2/files/0x000a000000023b98-60.dat	xmrig
behavioral2/files/0x000a000000023b97-52.dat	xmrig
behavioral2/files/0x000a000000023b96-44.dat	xmrig
behavioral2/files/0x000a000000023b95-43.dat	xmrig
behavioral2/files/0x000a000000023b9f-74.dat	xmrig
behavioral2/files/0x000b000000023ba0-83.dat	xmrig
behavioral2/files/0x000b000000023ba1-86.dat	xmrig
behavioral2/files/0x000b000000023ba2-91.dat	xmrig
behavioral2/files/0x0009000000023bc0-106.dat	xmrig
behavioral2/files/0x0009000000023bc1-115.dat	xmrig
behavioral2/files/0x000e000000023bc5-124.dat	xmrig
behavioral2/files/0x0008000000023bcc-137.dat	xmrig
behavioral2/files/0x0008000000023bfc-150.dat	xmrig
behavioral2/files/0x0008000000023bcd-148.dat	xmrig
behavioral2/files/0x0008000000023bca-146.dat	xmrig
behavioral2/files/0x0008000000023bc7-144.dat	xmrig
behavioral2/files/0x0008000000023bcb-140.dat	xmrig
behavioral2/files/0x0009000000023bbf-113.dat	xmrig
behavioral2/files/0x0008000000023bfd-155.dat	xmrig
behavioral2/files/0x0008000000023bfe-159.dat	xmrig
behavioral2/files/0x0008000000023bff-161.dat	xmrig
behavioral2/files/0x000a000000023baa-111.dat	xmrig
behavioral2/files/0x000b000000023b90-88.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2940	muImFVs.exe
2936	DaYJPmz.exe
3116	xvxdeyR.exe
4456	gkCBMQy.exe
2364	jMLKuOO.exe
1836	ExzuBrL.exe
2636	gGnEpkc.exe
2116	olLMnwr.exe
2172	xojoxsC.exe
3868	BwPVtMq.exe
1336	ntJSNcl.exe
3852	KfCmBWx.exe
2508	xIwUoDf.exe
2024	VeKUvkj.exe
1940	tusPCsW.exe
5032	ZsdzQiT.exe
3604	EKMdtmv.exe
1512	cerPiyw.exe
1920	bQHUTQy.exe
1396	vZkKoYN.exe
2160	IzcSJqH.exe
2308	nXTKKuy.exe
3420	liocsib.exe
2668	tEvVqWt.exe
4332	pAanrBH.exe
220	lxFOovv.exe
4208	KxSXshE.exe
4752	IwuwSxr.exe
2580	uqSLzeU.exe
2476	FgOiZRQ.exe
1704	HjYRTrI.exe
2112	zOvCJDQ.exe
3152	wBaLcBv.exe
1456	GAntkyo.exe
4172	MqxlPNd.exe
1468	OQoBTtc.exe
4220	pxDgKyg.exe
724	vjerLmU.exe
4504	BBGRdqD.exe
2492	lwDiXCP.exe
2916	imfFVNX.exe
3992	hzdYnBG.exe
1752	yGZrHoh.exe
3108	nmMIwAv.exe
4344	JZdlKTu.exe
3596	FecsUwj.exe
2136	CqgpGhU.exe
1040	ohOfyWE.exe
2756	dnOkXYp.exe
1452	mGGyuHC.exe
2028	yFQfZpY.exe
3632	yMDJOAv.exe
368	jhsKGCT.exe
1140	JfnEAPf.exe
2572	bdSPeWg.exe
920	KJGJWlD.exe
3060	qTQHKKT.exe
5112	oIWqqXx.exe
384	RGFVqtO.exe
2684	BJyWNkU.exe
3300	hZFvMvM.exe
1732	uHgwsbG.exe
4076	wOQVSOe.exe
1764	QpUNIDk.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NxDVibm.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\PNFaIDw.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\YpiroiM.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\esIAhJl.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\cXoPfzT.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\wBaLcBv.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\ohOfyWE.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\lgnwWOz.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\UIoAzHB.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\xxECZWK.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\aznCgpo.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\gUGcrXm.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\bErjVyS.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\HLbNMUX.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\PeqxKhS.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\uHgwsbG.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\DXimFZb.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\sYYaCCA.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\PeFMwpB.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\THyGAWS.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\CWimncV.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\WZUAayN.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\haMEmGh.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\XPYXXdE.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\yidOdCM.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\HuqlEzz.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\kImdWsQ.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\TcAIKgS.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\wncACuP.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\RQVEHUA.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\TepKIpC.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\yCTvxDX.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\WcmmJDg.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\emJULIX.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\cNhyvaM.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\XwWerom.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\XdiJOTU.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\rdCcpgv.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\mtriLkT.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\vvQEWRJ.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\yIpEbyz.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\djrNnyE.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\touuLrs.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\iVIWWAm.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\yiwqAmX.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\ACHBtku.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\rFbKNJc.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\vcWXYec.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\TnIQfPP.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\zlxbxXk.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\iobyTkx.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\dZyxtgD.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\NZFSFjC.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\imJzunN.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\hXNuIfS.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\EAlIvFR.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\uOodGUb.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\JCAKPlC.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\pXPmORk.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\jCVkqxS.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\GhBXhNR.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\LNWkuVA.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\SZkLqbX.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
File created	C:\Windows\System\zJqIcjH.exe	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2940	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	84
PID 4768 wrote to memory of 2940	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	84
PID 4768 wrote to memory of 2936	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	85
PID 4768 wrote to memory of 2936	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	85
PID 4768 wrote to memory of 3116	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	86
PID 4768 wrote to memory of 3116	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	86
PID 4768 wrote to memory of 4456	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	87
PID 4768 wrote to memory of 4456	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	87
PID 4768 wrote to memory of 2364	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	88
PID 4768 wrote to memory of 2364	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	88
PID 4768 wrote to memory of 1836	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	89
PID 4768 wrote to memory of 1836	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	89
PID 4768 wrote to memory of 2636	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	90
PID 4768 wrote to memory of 2636	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	90
PID 4768 wrote to memory of 2116	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	91
PID 4768 wrote to memory of 2116	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	91
PID 4768 wrote to memory of 2172	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	92
PID 4768 wrote to memory of 2172	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	92
PID 4768 wrote to memory of 3868	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	93
PID 4768 wrote to memory of 3868	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	93
PID 4768 wrote to memory of 1336	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	94
PID 4768 wrote to memory of 1336	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	94
PID 4768 wrote to memory of 3852	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	95
PID 4768 wrote to memory of 3852	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	95
PID 4768 wrote to memory of 2508	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	96
PID 4768 wrote to memory of 2508	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	96
PID 4768 wrote to memory of 2024	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	97
PID 4768 wrote to memory of 2024	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	97
PID 4768 wrote to memory of 1940	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	98
PID 4768 wrote to memory of 1940	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	98
PID 4768 wrote to memory of 5032	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	99
PID 4768 wrote to memory of 5032	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	99
PID 4768 wrote to memory of 3604	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	100
PID 4768 wrote to memory of 3604	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	100
PID 4768 wrote to memory of 1512	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	101
PID 4768 wrote to memory of 1512	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	101
PID 4768 wrote to memory of 1920	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	102
PID 4768 wrote to memory of 1920	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	102
PID 4768 wrote to memory of 1396	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	103
PID 4768 wrote to memory of 1396	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	103
PID 4768 wrote to memory of 2160	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	104
PID 4768 wrote to memory of 2160	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	104
PID 4768 wrote to memory of 2308	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	105
PID 4768 wrote to memory of 2308	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	105
PID 4768 wrote to memory of 3420	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	106
PID 4768 wrote to memory of 3420	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	106
PID 4768 wrote to memory of 2668	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	107
PID 4768 wrote to memory of 2668	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	107
PID 4768 wrote to memory of 4332	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	108
PID 4768 wrote to memory of 4332	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	108
PID 4768 wrote to memory of 220	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	109
PID 4768 wrote to memory of 220	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	109
PID 4768 wrote to memory of 4208	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	110
PID 4768 wrote to memory of 4208	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	110
PID 4768 wrote to memory of 4752	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	111
PID 4768 wrote to memory of 4752	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	111
PID 4768 wrote to memory of 2580	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	112
PID 4768 wrote to memory of 2580	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	112
PID 4768 wrote to memory of 2476	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	113
PID 4768 wrote to memory of 2476	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	113
PID 4768 wrote to memory of 1704	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	114
PID 4768 wrote to memory of 1704	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	114
PID 4768 wrote to memory of 2112	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	115
PID 4768 wrote to memory of 2112	4768	6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe	115

C:\Users\Admin\AppData\Local\Temp\6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe
"C:\Users\Admin\AppData\Local\Temp\6261cf4411f93f01d01fbe0e4933c82d5b30f78cfc93d35b0e65fd3d55325852.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\System\muImFVs.exe
  C:\Windows\System\muImFVs.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\DaYJPmz.exe
  C:\Windows\System\DaYJPmz.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\xvxdeyR.exe
  C:\Windows\System\xvxdeyR.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\gkCBMQy.exe
  C:\Windows\System\gkCBMQy.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\jMLKuOO.exe
  C:\Windows\System\jMLKuOO.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\ExzuBrL.exe
  C:\Windows\System\ExzuBrL.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\gGnEpkc.exe
  C:\Windows\System\gGnEpkc.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\olLMnwr.exe
  C:\Windows\System\olLMnwr.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\xojoxsC.exe
  C:\Windows\System\xojoxsC.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\BwPVtMq.exe
  C:\Windows\System\BwPVtMq.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\ntJSNcl.exe
  C:\Windows\System\ntJSNcl.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\KfCmBWx.exe
  C:\Windows\System\KfCmBWx.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\xIwUoDf.exe
  C:\Windows\System\xIwUoDf.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\VeKUvkj.exe
  C:\Windows\System\VeKUvkj.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\tusPCsW.exe
  C:\Windows\System\tusPCsW.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\ZsdzQiT.exe
  C:\Windows\System\ZsdzQiT.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\EKMdtmv.exe
  C:\Windows\System\EKMdtmv.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\cerPiyw.exe
  C:\Windows\System\cerPiyw.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\bQHUTQy.exe
  C:\Windows\System\bQHUTQy.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\vZkKoYN.exe
  C:\Windows\System\vZkKoYN.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\IzcSJqH.exe
  C:\Windows\System\IzcSJqH.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\nXTKKuy.exe
  C:\Windows\System\nXTKKuy.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\liocsib.exe
  C:\Windows\System\liocsib.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\tEvVqWt.exe
  C:\Windows\System\tEvVqWt.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\pAanrBH.exe
  C:\Windows\System\pAanrBH.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\lxFOovv.exe
  C:\Windows\System\lxFOovv.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\KxSXshE.exe
  C:\Windows\System\KxSXshE.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\IwuwSxr.exe
  C:\Windows\System\IwuwSxr.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\uqSLzeU.exe
  C:\Windows\System\uqSLzeU.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\FgOiZRQ.exe
  C:\Windows\System\FgOiZRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\HjYRTrI.exe
  C:\Windows\System\HjYRTrI.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\zOvCJDQ.exe
  C:\Windows\System\zOvCJDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\wBaLcBv.exe
  C:\Windows\System\wBaLcBv.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\GAntkyo.exe
  C:\Windows\System\GAntkyo.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\MqxlPNd.exe
  C:\Windows\System\MqxlPNd.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\OQoBTtc.exe
  C:\Windows\System\OQoBTtc.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\pxDgKyg.exe
  C:\Windows\System\pxDgKyg.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\vjerLmU.exe
  C:\Windows\System\vjerLmU.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\BBGRdqD.exe
  C:\Windows\System\BBGRdqD.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\lwDiXCP.exe
  C:\Windows\System\lwDiXCP.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\imfFVNX.exe
  C:\Windows\System\imfFVNX.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\hzdYnBG.exe
  C:\Windows\System\hzdYnBG.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\yGZrHoh.exe
  C:\Windows\System\yGZrHoh.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\nmMIwAv.exe
  C:\Windows\System\nmMIwAv.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\JZdlKTu.exe
  C:\Windows\System\JZdlKTu.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\FecsUwj.exe
  C:\Windows\System\FecsUwj.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\CqgpGhU.exe
  C:\Windows\System\CqgpGhU.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ohOfyWE.exe
  C:\Windows\System\ohOfyWE.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\dnOkXYp.exe
  C:\Windows\System\dnOkXYp.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\mGGyuHC.exe
  C:\Windows\System\mGGyuHC.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\yFQfZpY.exe
  C:\Windows\System\yFQfZpY.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\yMDJOAv.exe
  C:\Windows\System\yMDJOAv.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\jhsKGCT.exe
  C:\Windows\System\jhsKGCT.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\JfnEAPf.exe
  C:\Windows\System\JfnEAPf.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\bdSPeWg.exe
  C:\Windows\System\bdSPeWg.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\KJGJWlD.exe
  C:\Windows\System\KJGJWlD.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\qTQHKKT.exe
  C:\Windows\System\qTQHKKT.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\oIWqqXx.exe
  C:\Windows\System\oIWqqXx.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\RGFVqtO.exe
  C:\Windows\System\RGFVqtO.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\BJyWNkU.exe
  C:\Windows\System\BJyWNkU.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\hZFvMvM.exe
  C:\Windows\System\hZFvMvM.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\uHgwsbG.exe
  C:\Windows\System\uHgwsbG.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\wOQVSOe.exe
  C:\Windows\System\wOQVSOe.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\QpUNIDk.exe
  C:\Windows\System\QpUNIDk.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\lWuYrSw.exe
  C:\Windows\System\lWuYrSw.exe
  2⤵
  PID:1484
- C:\Windows\System\szCHIqd.exe
  C:\Windows\System\szCHIqd.exe
  2⤵
  PID:1084
- C:\Windows\System\uVISUrt.exe
  C:\Windows\System\uVISUrt.exe
  2⤵
  PID:2256
- C:\Windows\System\NFslBnV.exe
  C:\Windows\System\NFslBnV.exe
  2⤵
  PID:4060
- C:\Windows\System\fBRzylp.exe
  C:\Windows\System\fBRzylp.exe
  2⤵
  PID:4952
- C:\Windows\System\ZyTklqh.exe
  C:\Windows\System\ZyTklqh.exe
  2⤵
  PID:4032
- C:\Windows\System\syKdEsw.exe
  C:\Windows\System\syKdEsw.exe
  2⤵
  PID:4404
- C:\Windows\System\NlEwCMQ.exe
  C:\Windows\System\NlEwCMQ.exe
  2⤵
  PID:916
- C:\Windows\System\HTHSuDf.exe
  C:\Windows\System\HTHSuDf.exe
  2⤵
  PID:1136
- C:\Windows\System\ZTjqOma.exe
  C:\Windows\System\ZTjqOma.exe
  2⤵
  PID:5056
- C:\Windows\System\oVDIIOQ.exe
  C:\Windows\System\oVDIIOQ.exe
  2⤵
  PID:4372
- C:\Windows\System\HrsWqWe.exe
  C:\Windows\System\HrsWqWe.exe
  2⤵
  PID:1168
- C:\Windows\System\cOUZYSF.exe
  C:\Windows\System\cOUZYSF.exe
  2⤵
  PID:3392
- C:\Windows\System\kImdWsQ.exe
  C:\Windows\System\kImdWsQ.exe
  2⤵
  PID:2764
- C:\Windows\System\KbMyLEY.exe
  C:\Windows\System\KbMyLEY.exe
  2⤵
  PID:4312
- C:\Windows\System\dEfjKlb.exe
  C:\Windows\System\dEfjKlb.exe
  2⤵
  PID:544
- C:\Windows\System\QtxYzkQ.exe
  C:\Windows\System\QtxYzkQ.exe
  2⤵
  PID:4124
- C:\Windows\System\akyJhui.exe
  C:\Windows\System\akyJhui.exe
  2⤵
  PID:968
- C:\Windows\System\zlxbxXk.exe
  C:\Windows\System\zlxbxXk.exe
  2⤵
  PID:3740
- C:\Windows\System\bXwSjSm.exe
  C:\Windows\System\bXwSjSm.exe
  2⤵
  PID:3324
- C:\Windows\System\UkdaBfl.exe
  C:\Windows\System\UkdaBfl.exe
  2⤵
  PID:2460
- C:\Windows\System\RCmsouM.exe
  C:\Windows\System\RCmsouM.exe
  2⤵
  PID:4512
- C:\Windows\System\euAzFwM.exe
  C:\Windows\System\euAzFwM.exe
  2⤵
  PID:3764
- C:\Windows\System\vKYRHaL.exe
  C:\Windows\System\vKYRHaL.exe
  2⤵
  PID:4272
- C:\Windows\System\FPMfZnV.exe
  C:\Windows\System\FPMfZnV.exe
  2⤵
  PID:3668
- C:\Windows\System\nqWnbBd.exe
  C:\Windows\System\nqWnbBd.exe
  2⤵
  PID:2620
- C:\Windows\System\pIxaugp.exe
  C:\Windows\System\pIxaugp.exe
  2⤵
  PID:3716
- C:\Windows\System\fIBmJgl.exe
  C:\Windows\System\fIBmJgl.exe
  2⤵
  PID:4444
- C:\Windows\System\GmObodv.exe
  C:\Windows\System\GmObodv.exe
  2⤵
  PID:3400
- C:\Windows\System\BzoBaXH.exe
  C:\Windows\System\BzoBaXH.exe
  2⤵
  PID:3368
- C:\Windows\System\svOSYNT.exe
  C:\Windows\System\svOSYNT.exe
  2⤵
  PID:264
- C:\Windows\System\jvMgcJX.exe
  C:\Windows\System\jvMgcJX.exe
  2⤵
  PID:932
- C:\Windows\System\lZOFZHN.exe
  C:\Windows\System\lZOFZHN.exe
  2⤵
  PID:2324
- C:\Windows\System\aCRhicN.exe
  C:\Windows\System\aCRhicN.exe
  2⤵
  PID:4576
- C:\Windows\System\UBjTyQo.exe
  C:\Windows\System\UBjTyQo.exe
  2⤵
  PID:2560
- C:\Windows\System\iobyTkx.exe
  C:\Windows\System\iobyTkx.exe
  2⤵
  PID:1492
- C:\Windows\System\PxaMwdc.exe
  C:\Windows\System\PxaMwdc.exe
  2⤵
  PID:632
- C:\Windows\System\SDCpnqx.exe
  C:\Windows\System\SDCpnqx.exe
  2⤵
  PID:1496
- C:\Windows\System\ezzUWwH.exe
  C:\Windows\System\ezzUWwH.exe
  2⤵
  PID:3288
- C:\Windows\System\GBSosDT.exe
  C:\Windows\System\GBSosDT.exe
  2⤵
  PID:4724
- C:\Windows\System\djrNnyE.exe
  C:\Windows\System\djrNnyE.exe
  2⤵
  PID:2240
- C:\Windows\System\ndBXCmU.exe
  C:\Windows\System\ndBXCmU.exe
  2⤵
  PID:1016
- C:\Windows\System\NUropeC.exe
  C:\Windows\System\NUropeC.exe
  2⤵
  PID:2016
- C:\Windows\System\touuLrs.exe
  C:\Windows\System\touuLrs.exe
  2⤵
  PID:3564
- C:\Windows\System\sYncuTH.exe
  C:\Windows\System\sYncuTH.exe
  2⤵
  PID:5140
- C:\Windows\System\EuEvdaF.exe
  C:\Windows\System\EuEvdaF.exe
  2⤵
  PID:5168
- C:\Windows\System\yPcdetS.exe
  C:\Windows\System\yPcdetS.exe
  2⤵
  PID:5196
- C:\Windows\System\yYPyssK.exe
  C:\Windows\System\yYPyssK.exe
  2⤵
  PID:5224
- C:\Windows\System\zehuNmf.exe
  C:\Windows\System\zehuNmf.exe
  2⤵
  PID:5252
- C:\Windows\System\UUYZSBL.exe
  C:\Windows\System\UUYZSBL.exe
  2⤵
  PID:5280
- C:\Windows\System\JvQbkyG.exe
  C:\Windows\System\JvQbkyG.exe
  2⤵
  PID:5300
- C:\Windows\System\klVUpuS.exe
  C:\Windows\System\klVUpuS.exe
  2⤵
  PID:5332
- C:\Windows\System\dZyxtgD.exe
  C:\Windows\System\dZyxtgD.exe
  2⤵
  PID:5356
- C:\Windows\System\yCTvxDX.exe
  C:\Windows\System\yCTvxDX.exe
  2⤵
  PID:5392
- C:\Windows\System\eepEEHp.exe
  C:\Windows\System\eepEEHp.exe
  2⤵
  PID:5420
- C:\Windows\System\QXSrECU.exe
  C:\Windows\System\QXSrECU.exe
  2⤵
  PID:5452
- C:\Windows\System\OsBVbmu.exe
  C:\Windows\System\OsBVbmu.exe
  2⤵
  PID:5480
- C:\Windows\System\AEPiwFQ.exe
  C:\Windows\System\AEPiwFQ.exe
  2⤵
  PID:5504
- C:\Windows\System\SHlubPt.exe
  C:\Windows\System\SHlubPt.exe
  2⤵
  PID:5532
- C:\Windows\System\Ziwfata.exe
  C:\Windows\System\Ziwfata.exe
  2⤵
  PID:5756
- C:\Windows\System\NxDVibm.exe
  C:\Windows\System\NxDVibm.exe
  2⤵
  PID:5772
- C:\Windows\System\HEZVaTR.exe
  C:\Windows\System\HEZVaTR.exe
  2⤵
  PID:5788
- C:\Windows\System\whwKPPr.exe
  C:\Windows\System\whwKPPr.exe
  2⤵
  PID:5812
- C:\Windows\System\pIxqmBB.exe
  C:\Windows\System\pIxqmBB.exe
  2⤵
  PID:5836
- C:\Windows\System\ZVTCwcJ.exe
  C:\Windows\System\ZVTCwcJ.exe
  2⤵
  PID:5868
- C:\Windows\System\JxOQjZh.exe
  C:\Windows\System\JxOQjZh.exe
  2⤵
  PID:5904
- C:\Windows\System\PFFGkkT.exe
  C:\Windows\System\PFFGkkT.exe
  2⤵
  PID:5932
- C:\Windows\System\XRpSpes.exe
  C:\Windows\System\XRpSpes.exe
  2⤵
  PID:5960
- C:\Windows\System\SXoSjKC.exe
  C:\Windows\System\SXoSjKC.exe
  2⤵
  PID:6004
- C:\Windows\System\HygaxaL.exe
  C:\Windows\System\HygaxaL.exe
  2⤵
  PID:6032
- C:\Windows\System\ydbqrgp.exe
  C:\Windows\System\ydbqrgp.exe
  2⤵
  PID:6064
- C:\Windows\System\KKirMXE.exe
  C:\Windows\System\KKirMXE.exe
  2⤵
  PID:6092
- C:\Windows\System\PNTpqTZ.exe
  C:\Windows\System\PNTpqTZ.exe
  2⤵
  PID:6120
- C:\Windows\System\xMPYELV.exe
  C:\Windows\System\xMPYELV.exe
  2⤵
  PID:5124
- C:\Windows\System\FzuRFYT.exe
  C:\Windows\System\FzuRFYT.exe
  2⤵
  PID:2688
- C:\Windows\System\iVVSbsE.exe
  C:\Windows\System\iVVSbsE.exe
  2⤵
  PID:5220
- C:\Windows\System\XJIBtcl.exe
  C:\Windows\System\XJIBtcl.exe
  2⤵
  PID:5004
- C:\Windows\System\tyGigpj.exe
  C:\Windows\System\tyGigpj.exe
  2⤵
  PID:5276
- C:\Windows\System\oDZGaZw.exe
  C:\Windows\System\oDZGaZw.exe
  2⤵
  PID:5320
- C:\Windows\System\sFwVrXt.exe
  C:\Windows\System\sFwVrXt.exe
  2⤵
  PID:5408
- C:\Windows\System\lDmbovc.exe
  C:\Windows\System\lDmbovc.exe
  2⤵
  PID:5468
- C:\Windows\System\DXimFZb.exe
  C:\Windows\System\DXimFZb.exe
  2⤵
  PID:5556
- C:\Windows\System\esIAhJl.exe
  C:\Windows\System\esIAhJl.exe
  2⤵
  PID:5580
- C:\Windows\System\wbGhmQf.exe
  C:\Windows\System\wbGhmQf.exe
  2⤵
  PID:5608
- C:\Windows\System\zzcDuEd.exe
  C:\Windows\System\zzcDuEd.exe
  2⤵
  PID:5636
- C:\Windows\System\UhUvcnX.exe
  C:\Windows\System\UhUvcnX.exe
  2⤵
  PID:5668
- C:\Windows\System\NZFSFjC.exe
  C:\Windows\System\NZFSFjC.exe
  2⤵
  PID:5696
- C:\Windows\System\EwSbSlQ.exe
  C:\Windows\System\EwSbSlQ.exe
  2⤵
  PID:5720
- C:\Windows\System\tRQrzBI.exe
  C:\Windows\System\tRQrzBI.exe
  2⤵
  PID:5528
- C:\Windows\System\IpLaMbe.exe
  C:\Windows\System\IpLaMbe.exe
  2⤵
  PID:5752
- C:\Windows\System\kDNTpyp.exe
  C:\Windows\System\kDNTpyp.exe
  2⤵
  PID:5864
- C:\Windows\System\TmTEgLX.exe
  C:\Windows\System\TmTEgLX.exe
  2⤵
  PID:5920
- C:\Windows\System\CTyuWro.exe
  C:\Windows\System\CTyuWro.exe
  2⤵
  PID:5956
- C:\Windows\System\vZgdujG.exe
  C:\Windows\System\vZgdujG.exe
  2⤵
  PID:6052
- C:\Windows\System\bWoqpTD.exe
  C:\Windows\System\bWoqpTD.exe
  2⤵
  PID:6116
- C:\Windows\System\aYlxJeB.exe
  C:\Windows\System\aYlxJeB.exe
  2⤵
  PID:5244
- C:\Windows\System\kzkrGZA.exe
  C:\Windows\System\kzkrGZA.exe
  2⤵
  PID:1628
- C:\Windows\System\vsrXFhY.exe
  C:\Windows\System\vsrXFhY.exe
  2⤵
  PID:5364
- C:\Windows\System\hlaXTuN.exe
  C:\Windows\System\hlaXTuN.exe
  2⤵
  PID:5524
- C:\Windows\System\XwWerom.exe
  C:\Windows\System\XwWerom.exe
  2⤵
  PID:5632
- C:\Windows\System\YqhGQOK.exe
  C:\Windows\System\YqhGQOK.exe
  2⤵
  PID:5684
- C:\Windows\System\cOFzfWl.exe
  C:\Windows\System\cOFzfWl.exe
  2⤵
  PID:5748
- C:\Windows\System\EcUrDrk.exe
  C:\Windows\System\EcUrDrk.exe
  2⤵
  PID:5844
- C:\Windows\System\fGOjmoz.exe
  C:\Windows\System\fGOjmoz.exe
  2⤵
  PID:6024
- C:\Windows\System\VPWpBtm.exe
  C:\Windows\System\VPWpBtm.exe
  2⤵
  PID:5160
- C:\Windows\System\sEitDXs.exe
  C:\Windows\System\sEitDXs.exe
  2⤵
  PID:5460
- C:\Windows\System\YAaHxba.exe
  C:\Windows\System\YAaHxba.exe
  2⤵
  PID:5664
- C:\Windows\System\JoaFqXK.exe
  C:\Windows\System\JoaFqXK.exe
  2⤵
  PID:5856
- C:\Windows\System\bDFwELP.exe
  C:\Windows\System\bDFwELP.exe
  2⤵
  PID:5324
- C:\Windows\System\SOXqVaA.exe
  C:\Windows\System\SOXqVaA.exe
  2⤵
  PID:5736
- C:\Windows\System\wzTlpjY.exe
  C:\Windows\System\wzTlpjY.exe
  2⤵
  PID:5744
- C:\Windows\System\nfyHvWh.exe
  C:\Windows\System\nfyHvWh.exe
  2⤵
  PID:6160
- C:\Windows\System\njHNauS.exe
  C:\Windows\System\njHNauS.exe
  2⤵
  PID:6188
- C:\Windows\System\VMCznFP.exe
  C:\Windows\System\VMCznFP.exe
  2⤵
  PID:6216
- C:\Windows\System\EXxtohN.exe
  C:\Windows\System\EXxtohN.exe
  2⤵
  PID:6244
- C:\Windows\System\MeNMgtq.exe
  C:\Windows\System\MeNMgtq.exe
  2⤵
  PID:6272
- C:\Windows\System\KaNyJwl.exe
  C:\Windows\System\KaNyJwl.exe
  2⤵
  PID:6300
- C:\Windows\System\zwWGWtA.exe
  C:\Windows\System\zwWGWtA.exe
  2⤵
  PID:6328
- C:\Windows\System\OzSmDIf.exe
  C:\Windows\System\OzSmDIf.exe
  2⤵
  PID:6356
- C:\Windows\System\NCCOIKE.exe
  C:\Windows\System\NCCOIKE.exe
  2⤵
  PID:6380
- C:\Windows\System\rLkEmQM.exe
  C:\Windows\System\rLkEmQM.exe
  2⤵
  PID:6400
- C:\Windows\System\LZxYjqC.exe
  C:\Windows\System\LZxYjqC.exe
  2⤵
  PID:6432
- C:\Windows\System\DhpbFhi.exe
  C:\Windows\System\DhpbFhi.exe
  2⤵
  PID:6468
- C:\Windows\System\imJzunN.exe
  C:\Windows\System\imJzunN.exe
  2⤵
  PID:6496
- C:\Windows\System\hOCApHn.exe
  C:\Windows\System\hOCApHn.exe
  2⤵
  PID:6520
- C:\Windows\System\BTAHMZB.exe
  C:\Windows\System\BTAHMZB.exe
  2⤵
  PID:6544
- C:\Windows\System\yMaGHuW.exe
  C:\Windows\System\yMaGHuW.exe
  2⤵
  PID:6568
- C:\Windows\System\KkbRylx.exe
  C:\Windows\System\KkbRylx.exe
  2⤵
  PID:6604
- C:\Windows\System\fnjsIvO.exe
  C:\Windows\System\fnjsIvO.exe
  2⤵
  PID:6624
- C:\Windows\System\lIqPsPr.exe
  C:\Windows\System\lIqPsPr.exe
  2⤵
  PID:6644
- C:\Windows\System\fJeAeXL.exe
  C:\Windows\System\fJeAeXL.exe
  2⤵
  PID:6680
- C:\Windows\System\jQligXI.exe
  C:\Windows\System\jQligXI.exe
  2⤵
  PID:6704
- C:\Windows\System\dXUsBfF.exe
  C:\Windows\System\dXUsBfF.exe
  2⤵
  PID:6732
- C:\Windows\System\TBtUhaT.exe
  C:\Windows\System\TBtUhaT.exe
  2⤵
  PID:6756
- C:\Windows\System\lreTFGe.exe
  C:\Windows\System\lreTFGe.exe
  2⤵
  PID:6776
- C:\Windows\System\CtQwfOr.exe
  C:\Windows\System\CtQwfOr.exe
  2⤵
  PID:6804
- C:\Windows\System\cXZvNdT.exe
  C:\Windows\System\cXZvNdT.exe
  2⤵
  PID:6824
- C:\Windows\System\ERMNQiP.exe
  C:\Windows\System\ERMNQiP.exe
  2⤵
  PID:6852
- C:\Windows\System\uBlQIcU.exe
  C:\Windows\System\uBlQIcU.exe
  2⤵
  PID:6872
- C:\Windows\System\iPtabiu.exe
  C:\Windows\System\iPtabiu.exe
  2⤵
  PID:6900
- C:\Windows\System\SOliDVs.exe
  C:\Windows\System\SOliDVs.exe
  2⤵
  PID:6920
- C:\Windows\System\TcAIKgS.exe
  C:\Windows\System\TcAIKgS.exe
  2⤵
  PID:6940
- C:\Windows\System\ZmppCjA.exe
  C:\Windows\System\ZmppCjA.exe
  2⤵
  PID:6960
- C:\Windows\System\bTTFtFu.exe
  C:\Windows\System\bTTFtFu.exe
  2⤵
  PID:6984
- C:\Windows\System\PYBCSgi.exe
  C:\Windows\System\PYBCSgi.exe
  2⤵
  PID:7008
- C:\Windows\System\gUGcrXm.exe
  C:\Windows\System\gUGcrXm.exe
  2⤵
  PID:7032
- C:\Windows\System\dwDXaqc.exe
  C:\Windows\System\dwDXaqc.exe
  2⤵
  PID:7056
- C:\Windows\System\GkItwcF.exe
  C:\Windows\System\GkItwcF.exe
  2⤵
  PID:7076
- C:\Windows\System\WPDHhIF.exe
  C:\Windows\System\WPDHhIF.exe
  2⤵
  PID:7100
- C:\Windows\System\wXEuBpS.exe
  C:\Windows\System\wXEuBpS.exe
  2⤵
  PID:7124
- C:\Windows\System\WPWWhPN.exe
  C:\Windows\System\WPWWhPN.exe
  2⤵
  PID:7148
- C:\Windows\System\OwNnKjT.exe
  C:\Windows\System\OwNnKjT.exe
  2⤵
  PID:3616
- C:\Windows\System\YOqzxhj.exe
  C:\Windows\System\YOqzxhj.exe
  2⤵
  PID:6232
- C:\Windows\System\hhdbWsp.exe
  C:\Windows\System\hhdbWsp.exe
  2⤵
  PID:6312
- C:\Windows\System\bsZSaws.exe
  C:\Windows\System\bsZSaws.exe
  2⤵
  PID:6368
- C:\Windows\System\VEHXOoT.exe
  C:\Windows\System\VEHXOoT.exe
  2⤵
  PID:6464
- C:\Windows\System\CgDvGDU.exe
  C:\Windows\System\CgDvGDU.exe
  2⤵
  PID:6512
- C:\Windows\System\SGjMSDu.exe
  C:\Windows\System\SGjMSDu.exe
  2⤵
  PID:6592
- C:\Windows\System\IQEfhyr.exe
  C:\Windows\System\IQEfhyr.exe
  2⤵
  PID:6696
- C:\Windows\System\JPeXHey.exe
  C:\Windows\System\JPeXHey.exe
  2⤵
  PID:6700
- C:\Windows\System\FlVdylA.exe
  C:\Windows\System\FlVdylA.exe
  2⤵
  PID:6788
- C:\Windows\System\HsFLiBS.exe
  C:\Windows\System\HsFLiBS.exe
  2⤵
  PID:6792
- C:\Windows\System\YKNmyfZ.exe
  C:\Windows\System\YKNmyfZ.exe
  2⤵
  PID:6952
- C:\Windows\System\qPbXOtg.exe
  C:\Windows\System\qPbXOtg.exe
  2⤵
  PID:6972
- C:\Windows\System\tohbRDb.exe
  C:\Windows\System\tohbRDb.exe
  2⤵
  PID:7044
- C:\Windows\System\bRXFybz.exe
  C:\Windows\System\bRXFybz.exe
  2⤵
  PID:7064
- C:\Windows\System\AUjTXAq.exe
  C:\Windows\System\AUjTXAq.exe
  2⤵
  PID:6180
- C:\Windows\System\fJfhyAV.exe
  C:\Windows\System\fJfhyAV.exe
  2⤵
  PID:6344
- C:\Windows\System\jmbqrhQ.exe
  C:\Windows\System\jmbqrhQ.exe
  2⤵
  PID:6392
- C:\Windows\System\lgnwWOz.exe
  C:\Windows\System\lgnwWOz.exe
  2⤵
  PID:6540
- C:\Windows\System\XdiJOTU.exe
  C:\Windows\System\XdiJOTU.exe
  2⤵
  PID:6640
- C:\Windows\System\acdXggR.exe
  C:\Windows\System\acdXggR.exe
  2⤵
  PID:6892
- C:\Windows\System\RxRavFB.exe
  C:\Windows\System\RxRavFB.exe
  2⤵
  PID:6896
- C:\Windows\System\lUsukDn.exe
  C:\Windows\System\lUsukDn.exe
  2⤵
  PID:6996
- C:\Windows\System\rKtwdxa.exe
  C:\Windows\System\rKtwdxa.exe
  2⤵
  PID:6292
- C:\Windows\System\wIRKkfo.exe
  C:\Windows\System\wIRKkfo.exe
  2⤵
  PID:6156
- C:\Windows\System\UsQUDHK.exe
  C:\Windows\System\UsQUDHK.exe
  2⤵
  PID:7196
- C:\Windows\System\aNwvNRm.exe
  C:\Windows\System\aNwvNRm.exe
  2⤵
  PID:7224
- C:\Windows\System\bbaJaUw.exe
  C:\Windows\System\bbaJaUw.exe
  2⤵
  PID:7252
- C:\Windows\System\FZbgbGa.exe
  C:\Windows\System\FZbgbGa.exe
  2⤵
  PID:7284
- C:\Windows\System\XpoQnXd.exe
  C:\Windows\System\XpoQnXd.exe
  2⤵
  PID:7312
- C:\Windows\System\bVPRuHx.exe
  C:\Windows\System\bVPRuHx.exe
  2⤵
  PID:7336
- C:\Windows\System\retHRyi.exe
  C:\Windows\System\retHRyi.exe
  2⤵
  PID:7360
- C:\Windows\System\KqvjFyO.exe
  C:\Windows\System\KqvjFyO.exe
  2⤵
  PID:7388
- C:\Windows\System\zqySemk.exe
  C:\Windows\System\zqySemk.exe
  2⤵
  PID:7424
- C:\Windows\System\aAcYNjH.exe
  C:\Windows\System\aAcYNjH.exe
  2⤵
  PID:7456
- C:\Windows\System\fgihpeW.exe
  C:\Windows\System\fgihpeW.exe
  2⤵
  PID:7480
- C:\Windows\System\oxNfmGJ.exe
  C:\Windows\System\oxNfmGJ.exe
  2⤵
  PID:7500
- C:\Windows\System\RRSGmty.exe
  C:\Windows\System\RRSGmty.exe
  2⤵
  PID:7520
- C:\Windows\System\SZuwiQF.exe
  C:\Windows\System\SZuwiQF.exe
  2⤵
  PID:7544
- C:\Windows\System\eKsjTqQ.exe
  C:\Windows\System\eKsjTqQ.exe
  2⤵
  PID:7560
- C:\Windows\System\PBFyLln.exe
  C:\Windows\System\PBFyLln.exe
  2⤵
  PID:7588
- C:\Windows\System\PNFaIDw.exe
  C:\Windows\System\PNFaIDw.exe
  2⤵
  PID:7616
- C:\Windows\System\MoTZqdA.exe
  C:\Windows\System\MoTZqdA.exe
  2⤵
  PID:7640
- C:\Windows\System\yfPvlNa.exe
  C:\Windows\System\yfPvlNa.exe
  2⤵
  PID:7664
- C:\Windows\System\ZrfjkEA.exe
  C:\Windows\System\ZrfjkEA.exe
  2⤵
  PID:7688
- C:\Windows\System\kUwLRMX.exe
  C:\Windows\System\kUwLRMX.exe
  2⤵
  PID:7716
- C:\Windows\System\RjoSkUS.exe
  C:\Windows\System\RjoSkUS.exe
  2⤵
  PID:7744
- C:\Windows\System\upZRjtk.exe
  C:\Windows\System\upZRjtk.exe
  2⤵
  PID:7772
- C:\Windows\System\OAjDoro.exe
  C:\Windows\System\OAjDoro.exe
  2⤵
  PID:7800
- C:\Windows\System\GoyBNDl.exe
  C:\Windows\System\GoyBNDl.exe
  2⤵
  PID:7824
- C:\Windows\System\DYCXtKf.exe
  C:\Windows\System\DYCXtKf.exe
  2⤵
  PID:7852
- C:\Windows\System\aJxcowY.exe
  C:\Windows\System\aJxcowY.exe
  2⤵
  PID:7880
- C:\Windows\System\RkfXXdZ.exe
  C:\Windows\System\RkfXXdZ.exe
  2⤵
  PID:7908
- C:\Windows\System\EjPxfxO.exe
  C:\Windows\System\EjPxfxO.exe
  2⤵
  PID:7940
- C:\Windows\System\DkJZbbJ.exe
  C:\Windows\System\DkJZbbJ.exe
  2⤵
  PID:7964
- C:\Windows\System\nNcZlCJ.exe
  C:\Windows\System\nNcZlCJ.exe
  2⤵
  PID:7996
- C:\Windows\System\WPWTRxO.exe
  C:\Windows\System\WPWTRxO.exe
  2⤵
  PID:8028
- C:\Windows\System\fEvFjBE.exe
  C:\Windows\System\fEvFjBE.exe
  2⤵
  PID:8056
- C:\Windows\System\hdXNKcc.exe
  C:\Windows\System\hdXNKcc.exe
  2⤵
  PID:8100
- C:\Windows\System\bcGUBCW.exe
  C:\Windows\System\bcGUBCW.exe
  2⤵
  PID:8124
- C:\Windows\System\KTsdTRo.exe
  C:\Windows\System\KTsdTRo.exe
  2⤵
  PID:8144
- C:\Windows\System\gIqJWiK.exe
  C:\Windows\System\gIqJWiK.exe
  2⤵
  PID:8168
- C:\Windows\System\XATBhwa.exe
  C:\Windows\System\XATBhwa.exe
  2⤵
  PID:8188
- C:\Windows\System\JgBhpQg.exe
  C:\Windows\System\JgBhpQg.exe
  2⤵
  PID:7172
- C:\Windows\System\OBwqtQZ.exe
  C:\Windows\System\OBwqtQZ.exe
  2⤵
  PID:6508
- C:\Windows\System\wncACuP.exe
  C:\Windows\System\wncACuP.exe
  2⤵
  PID:7176
- C:\Windows\System\qikHuHT.exe
  C:\Windows\System\qikHuHT.exe
  2⤵
  PID:3020
- C:\Windows\System\pSevBwl.exe
  C:\Windows\System\pSevBwl.exe
  2⤵
  PID:7212
- C:\Windows\System\kdCtQqD.exe
  C:\Windows\System\kdCtQqD.exe
  2⤵
  PID:7412
- C:\Windows\System\hXNuIfS.exe
  C:\Windows\System\hXNuIfS.exe
  2⤵
  PID:7408
- C:\Windows\System\ACkfNBH.exe
  C:\Windows\System\ACkfNBH.exe
  2⤵
  PID:7472
- C:\Windows\System\CNyoRjE.exe
  C:\Windows\System\CNyoRjE.exe
  2⤵
  PID:7648
- C:\Windows\System\QfZHzeO.exe
  C:\Windows\System\QfZHzeO.exe
  2⤵
  PID:7580
- C:\Windows\System\suITWeM.exe
  C:\Windows\System\suITWeM.exe
  2⤵
  PID:7656
- C:\Windows\System\WhURhAG.exe
  C:\Windows\System\WhURhAG.exe
  2⤵
  PID:7732
- C:\Windows\System\okhrqPP.exe
  C:\Windows\System\okhrqPP.exe
  2⤵
  PID:7896
- C:\Windows\System\rdCcpgv.exe
  C:\Windows\System\rdCcpgv.exe
  2⤵
  PID:7820
- C:\Windows\System\pHKZwCb.exe
  C:\Windows\System\pHKZwCb.exe
  2⤵
  PID:8016
- C:\Windows\System\bGULpqN.exe
  C:\Windows\System\bGULpqN.exe
  2⤵
  PID:8064
- C:\Windows\System\ODQmGJI.exe
  C:\Windows\System\ODQmGJI.exe
  2⤵
  PID:7984
- C:\Windows\System\vCwFwTZ.exe
  C:\Windows\System\vCwFwTZ.exe
  2⤵
  PID:8180
- C:\Windows\System\akDOQqb.exe
  C:\Windows\System\akDOQqb.exe
  2⤵
  PID:6976
- C:\Windows\System\SxJuSNV.exe
  C:\Windows\System\SxJuSNV.exe
  2⤵
  PID:6436
- C:\Windows\System\pDWldOF.exe
  C:\Windows\System\pDWldOF.exe
  2⤵
  PID:7248
- C:\Windows\System\xWXeGyE.exe
  C:\Windows\System\xWXeGyE.exe
  2⤵
  PID:7556
- C:\Windows\System\znpfQLm.exe
  C:\Windows\System\znpfQLm.exe
  2⤵
  PID:7356
- C:\Windows\System\RyZFnET.exe
  C:\Windows\System\RyZFnET.exe
  2⤵
  PID:7876
- C:\Windows\System\EAlIvFR.exe
  C:\Windows\System\EAlIvFR.exe
  2⤵
  PID:8088
- C:\Windows\System\BqkXaDF.exe
  C:\Windows\System\BqkXaDF.exe
  2⤵
  PID:7696
- C:\Windows\System\XcPIclu.exe
  C:\Windows\System\XcPIclu.exe
  2⤵
  PID:7816
- C:\Windows\System\WzEYFob.exe
  C:\Windows\System\WzEYFob.exe
  2⤵
  PID:8204
- C:\Windows\System\dMIbOuN.exe
  C:\Windows\System\dMIbOuN.exe
  2⤵
  PID:8228
- C:\Windows\System\MshcZvX.exe
  C:\Windows\System\MshcZvX.exe
  2⤵
  PID:8248
- C:\Windows\System\HIsauWE.exe
  C:\Windows\System\HIsauWE.exe
  2⤵
  PID:8272
- C:\Windows\System\gGzcaPk.exe
  C:\Windows\System\gGzcaPk.exe
  2⤵
  PID:8304
- C:\Windows\System\qJsJWaK.exe
  C:\Windows\System\qJsJWaK.exe
  2⤵
  PID:8328
- C:\Windows\System\XAcXAdM.exe
  C:\Windows\System\XAcXAdM.exe
  2⤵
  PID:8356
- C:\Windows\System\coTNtNw.exe
  C:\Windows\System\coTNtNw.exe
  2⤵
  PID:8388
- C:\Windows\System\lfLSrWe.exe
  C:\Windows\System\lfLSrWe.exe
  2⤵
  PID:8408
- C:\Windows\System\vJHNvKp.exe
  C:\Windows\System\vJHNvKp.exe
  2⤵
  PID:8432
- C:\Windows\System\xcjUefV.exe
  C:\Windows\System\xcjUefV.exe
  2⤵
  PID:8456
- C:\Windows\System\AASWYTo.exe
  C:\Windows\System\AASWYTo.exe
  2⤵
  PID:8484
- C:\Windows\System\cvPtvIm.exe
  C:\Windows\System\cvPtvIm.exe
  2⤵
  PID:8512
- C:\Windows\System\TeHszrn.exe
  C:\Windows\System\TeHszrn.exe
  2⤵
  PID:8536
- C:\Windows\System\gbvuSoQ.exe
  C:\Windows\System\gbvuSoQ.exe
  2⤵
  PID:8552
- C:\Windows\System\AZacogW.exe
  C:\Windows\System\AZacogW.exe
  2⤵
  PID:8572
- C:\Windows\System\AJQMFdY.exe
  C:\Windows\System\AJQMFdY.exe
  2⤵
  PID:8616
- C:\Windows\System\tJGxKzQ.exe
  C:\Windows\System\tJGxKzQ.exe
  2⤵
  PID:8640
- C:\Windows\System\UIoAzHB.exe
  C:\Windows\System\UIoAzHB.exe
  2⤵
  PID:8668
- C:\Windows\System\GuttjXo.exe
  C:\Windows\System\GuttjXo.exe
  2⤵
  PID:8692
- C:\Windows\System\BYGcvbP.exe
  C:\Windows\System\BYGcvbP.exe
  2⤵
  PID:8712
- C:\Windows\System\FNCHJBz.exe
  C:\Windows\System\FNCHJBz.exe
  2⤵
  PID:8736
- C:\Windows\System\iBCoSMw.exe
  C:\Windows\System\iBCoSMw.exe
  2⤵
  PID:8760
- C:\Windows\System\zDtkEbZ.exe
  C:\Windows\System\zDtkEbZ.exe
  2⤵
  PID:8788
- C:\Windows\System\GogAYUy.exe
  C:\Windows\System\GogAYUy.exe
  2⤵
  PID:8820
- C:\Windows\System\yFSHuaq.exe
  C:\Windows\System\yFSHuaq.exe
  2⤵
  PID:8840
- C:\Windows\System\gNkkfOF.exe
  C:\Windows\System\gNkkfOF.exe
  2⤵
  PID:8864
- C:\Windows\System\GaxPJoy.exe
  C:\Windows\System\GaxPJoy.exe
  2⤵
  PID:8888
- C:\Windows\System\wfACITF.exe
  C:\Windows\System\wfACITF.exe
  2⤵
  PID:8924
- C:\Windows\System\WXmlIPa.exe
  C:\Windows\System\WXmlIPa.exe
  2⤵
  PID:8948
- C:\Windows\System\QPSbSpV.exe
  C:\Windows\System\QPSbSpV.exe
  2⤵
  PID:8980
- C:\Windows\System\dPXsnEu.exe
  C:\Windows\System\dPXsnEu.exe
  2⤵
  PID:9008
- C:\Windows\System\RQVEHUA.exe
  C:\Windows\System\RQVEHUA.exe
  2⤵
  PID:9036
- C:\Windows\System\lXDbxiG.exe
  C:\Windows\System\lXDbxiG.exe
  2⤵
  PID:9064
- C:\Windows\System\gRyRwTf.exe
  C:\Windows\System\gRyRwTf.exe
  2⤵
  PID:9092
- C:\Windows\System\quupUMv.exe
  C:\Windows\System\quupUMv.exe
  2⤵
  PID:9124
- C:\Windows\System\mAkFlUa.exe
  C:\Windows\System\mAkFlUa.exe
  2⤵
  PID:9152
- C:\Windows\System\lNCBsCI.exe
  C:\Windows\System\lNCBsCI.exe
  2⤵
  PID:9176
- C:\Windows\System\vbPWAYq.exe
  C:\Windows\System\vbPWAYq.exe
  2⤵
  PID:9208
- C:\Windows\System\meIUTMn.exe
  C:\Windows\System\meIUTMn.exe
  2⤵
  PID:7308
- C:\Windows\System\LUkcIqQ.exe
  C:\Windows\System\LUkcIqQ.exe
  2⤵
  PID:8044
- C:\Windows\System\jRoXxbB.exe
  C:\Windows\System\jRoXxbB.exe
  2⤵
  PID:8160
- C:\Windows\System\ytwsNJw.exe
  C:\Windows\System\ytwsNJw.exe
  2⤵
  PID:7608
- C:\Windows\System\cXoPfzT.exe
  C:\Windows\System\cXoPfzT.exe
  2⤵
  PID:8200
- C:\Windows\System\GRcXIbA.exe
  C:\Windows\System\GRcXIbA.exe
  2⤵
  PID:7756
- C:\Windows\System\ueXFRkG.exe
  C:\Windows\System\ueXFRkG.exe
  2⤵
  PID:8500
- C:\Windows\System\STUulcg.exe
  C:\Windows\System\STUulcg.exe
  2⤵
  PID:8312
- C:\Windows\System\ESapqkA.exe
  C:\Windows\System\ESapqkA.exe
  2⤵
  PID:8632
- C:\Windows\System\hjcZiWC.exe
  C:\Windows\System\hjcZiWC.exe
  2⤵
  PID:8480
- C:\Windows\System\vHRGTaA.exe
  C:\Windows\System\vHRGTaA.exe
  2⤵
  PID:8344
- C:\Windows\System\lOcNAPv.exe
  C:\Windows\System\lOcNAPv.exe
  2⤵
  PID:8376
- C:\Windows\System\NbLOJBl.exe
  C:\Windows\System\NbLOJBl.exe
  2⤵
  PID:8464
- C:\Windows\System\hPzpchQ.exe
  C:\Windows\System\hPzpchQ.exe
  2⤵
  PID:8860
- C:\Windows\System\SJlqygD.exe
  C:\Windows\System\SJlqygD.exe
  2⤵
  PID:8560
- C:\Windows\System\WfqrvtI.exe
  C:\Windows\System\WfqrvtI.exe
  2⤵
  PID:8992
- C:\Windows\System\XtqzQpL.exe
  C:\Windows\System\XtqzQpL.exe
  2⤵
  PID:9048
- C:\Windows\System\SEUCQmd.exe
  C:\Windows\System\SEUCQmd.exe
  2⤵
  PID:8704
- C:\Windows\System\KmbvCwl.exe
  C:\Windows\System\KmbvCwl.exe
  2⤵
  PID:8964
- C:\Windows\System\iwbcHFY.exe
  C:\Windows\System\iwbcHFY.exe
  2⤵
  PID:9056
- C:\Windows\System\FGpiuga.exe
  C:\Windows\System\FGpiuga.exe
  2⤵
  PID:9104
- C:\Windows\System\LfvdCDM.exe
  C:\Windows\System\LfvdCDM.exe
  2⤵
  PID:8916
- C:\Windows\System\WZUAayN.exe
  C:\Windows\System\WZUAayN.exe
  2⤵
  PID:7240
- C:\Windows\System\dZEajzN.exe
  C:\Windows\System\dZEajzN.exe
  2⤵
  PID:8224
- C:\Windows\System\wTczdUT.exe
  C:\Windows\System\wTczdUT.exe
  2⤵
  PID:8852
- C:\Windows\System\CaTgPGr.exe
  C:\Windows\System\CaTgPGr.exe
  2⤵
  PID:9220
- C:\Windows\System\vbvwbXN.exe
  C:\Windows\System\vbvwbXN.exe
  2⤵
  PID:9240
- C:\Windows\System\haMEmGh.exe
  C:\Windows\System\haMEmGh.exe
  2⤵
  PID:9272
- C:\Windows\System\vNQxTjG.exe
  C:\Windows\System\vNQxTjG.exe
  2⤵
  PID:9300
- C:\Windows\System\KNGjlMu.exe
  C:\Windows\System\KNGjlMu.exe
  2⤵
  PID:9320
- C:\Windows\System\rLwLUzi.exe
  C:\Windows\System\rLwLUzi.exe
  2⤵
  PID:9348
- C:\Windows\System\XeGMpfI.exe
  C:\Windows\System\XeGMpfI.exe
  2⤵
  PID:9384
- C:\Windows\System\uNWzTOp.exe
  C:\Windows\System\uNWzTOp.exe
  2⤵
  PID:9400
- C:\Windows\System\DcHHINM.exe
  C:\Windows\System\DcHHINM.exe
  2⤵
  PID:9436
- C:\Windows\System\jCVkqxS.exe
  C:\Windows\System\jCVkqxS.exe
  2⤵
  PID:9452
- C:\Windows\System\PBgdxwy.exe
  C:\Windows\System\PBgdxwy.exe
  2⤵
  PID:9476
- C:\Windows\System\itHtsng.exe
  C:\Windows\System\itHtsng.exe
  2⤵
  PID:9496
- C:\Windows\System\vcWXYec.exe
  C:\Windows\System\vcWXYec.exe
  2⤵
  PID:9520
- C:\Windows\System\eaetXaH.exe
  C:\Windows\System\eaetXaH.exe
  2⤵
  PID:9548
- C:\Windows\System\Qzvwber.exe
  C:\Windows\System\Qzvwber.exe
  2⤵
  PID:9588
- C:\Windows\System\XpZyDve.exe
  C:\Windows\System\XpZyDve.exe
  2⤵
  PID:9624
- C:\Windows\System\fYudvVD.exe
  C:\Windows\System\fYudvVD.exe
  2⤵
  PID:9644
- C:\Windows\System\spUJVcc.exe
  C:\Windows\System\spUJVcc.exe
  2⤵
  PID:9672
- C:\Windows\System\dpQRlvb.exe
  C:\Windows\System\dpQRlvb.exe
  2⤵
  PID:9692
- C:\Windows\System\MhnkOlQ.exe
  C:\Windows\System\MhnkOlQ.exe
  2⤵
  PID:9724
- C:\Windows\System\WcmmJDg.exe
  C:\Windows\System\WcmmJDg.exe
  2⤵
  PID:10036
- C:\Windows\System\xltgSuq.exe
  C:\Windows\System\xltgSuq.exe
  2⤵
  PID:10068
- C:\Windows\System\dLinCvP.exe
  C:\Windows\System\dLinCvP.exe
  2⤵
  PID:10116
- C:\Windows\System\wmHKiEd.exe
  C:\Windows\System\wmHKiEd.exe
  2⤵
  PID:10152
- C:\Windows\System\cFvzJpc.exe
  C:\Windows\System\cFvzJpc.exe
  2⤵
  PID:10200
- C:\Windows\System\KfzYKob.exe
  C:\Windows\System\KfzYKob.exe
  2⤵
  PID:10228
- C:\Windows\System\aAAQaQp.exe
  C:\Windows\System\aAAQaQp.exe
  2⤵
  PID:8136
- C:\Windows\System\wWkvwHZ.exe
  C:\Windows\System\wWkvwHZ.exe
  2⤵
  PID:8524
- C:\Windows\System\rmyoRRi.exe
  C:\Windows\System\rmyoRRi.exe
  2⤵
  PID:8596
- C:\Windows\System\cfWtOMt.exe
  C:\Windows\System\cfWtOMt.exe
  2⤵
  PID:9172
- C:\Windows\System\yRmRtYe.exe
  C:\Windows\System\yRmRtYe.exe
  2⤵
  PID:8748
- C:\Windows\System\AaacUrS.exe
  C:\Windows\System\AaacUrS.exe
  2⤵
  PID:8772
- C:\Windows\System\lYDVuUL.exe
  C:\Windows\System\lYDVuUL.exe
  2⤵
  PID:9236
- C:\Windows\System\fWQlHEd.exe
  C:\Windows\System\fWQlHEd.exe
  2⤵
  PID:9292
- C:\Windows\System\LfXNSyv.exe
  C:\Windows\System\LfXNSyv.exe
  2⤵
  PID:8900
- C:\Windows\System\cdvQoOm.exe
  C:\Windows\System\cdvQoOm.exe
  2⤵
  PID:8972
- C:\Windows\System\svgwUmY.exe
  C:\Windows\System\svgwUmY.exe
  2⤵
  PID:9556
- C:\Windows\System\ywWZXhg.exe
  C:\Windows\System\ywWZXhg.exe
  2⤵
  PID:9660
- C:\Windows\System\vGnFGwB.exe
  C:\Windows\System\vGnFGwB.exe
  2⤵
  PID:9260
- C:\Windows\System\tFShrzQ.exe
  C:\Windows\System\tFShrzQ.exe
  2⤵
  PID:9688
- C:\Windows\System\HvYbbQP.exe
  C:\Windows\System\HvYbbQP.exe
  2⤵
  PID:9428
- C:\Windows\System\cViIzGE.exe
  C:\Windows\System\cViIzGE.exe
  2⤵
  PID:9488
- C:\Windows\System\EwwPmVJ.exe
  C:\Windows\System\EwwPmVJ.exe
  2⤵
  PID:9460
- C:\Windows\System\SkDWjRz.exe
  C:\Windows\System\SkDWjRz.exe
  2⤵
  PID:9572
- C:\Windows\System\DviKOnC.exe
  C:\Windows\System\DviKOnC.exe
  2⤵
  PID:10144
- C:\Windows\System\sVzOgnQ.exe
  C:\Windows\System\sVzOgnQ.exe
  2⤵
  PID:10004
- C:\Windows\System\MVbrgep.exe
  C:\Windows\System\MVbrgep.exe
  2⤵
  PID:10084
- C:\Windows\System\SSPwxDe.exe
  C:\Windows\System\SSPwxDe.exe
  2⤵
  PID:10112
- C:\Windows\System\cSYsMDb.exe
  C:\Windows\System\cSYsMDb.exe
  2⤵
  PID:10092
- C:\Windows\System\eknPnkQ.exe
  C:\Windows\System\eknPnkQ.exe
  2⤵
  PID:10160
- C:\Windows\System\hqBeebj.exe
  C:\Windows\System\hqBeebj.exe
  2⤵
  PID:10224
- C:\Windows\System\JNJZPjB.exe
  C:\Windows\System\JNJZPjB.exe
  2⤵
  PID:9316
- C:\Windows\System\hLUkGaj.exe
  C:\Windows\System\hLUkGaj.exe
  2⤵
  PID:9228
- C:\Windows\System\rCsOJjL.exe
  C:\Windows\System\rCsOJjL.exe
  2⤵
  PID:8940
- C:\Windows\System\lNoQUim.exe
  C:\Windows\System\lNoQUim.exe
  2⤵
  PID:9744
- C:\Windows\System\OqPfZoj.exe
  C:\Windows\System\OqPfZoj.exe
  2⤵
  PID:9612
- C:\Windows\System\HLvULvY.exe
  C:\Windows\System\HLvULvY.exe
  2⤵
  PID:6692
- C:\Windows\System\AbFbRez.exe
  C:\Windows\System\AbFbRez.exe
  2⤵
  PID:7760
- C:\Windows\System\YpiroiM.exe
  C:\Windows\System\YpiroiM.exe
  2⤵
  PID:10216
- C:\Windows\System\mOTyKQQ.exe
  C:\Windows\System\mOTyKQQ.exe
  2⤵
  PID:10248
- C:\Windows\System\vvIAlkR.exe
  C:\Windows\System\vvIAlkR.exe
  2⤵
  PID:10280
- C:\Windows\System\qBNIwsF.exe
  C:\Windows\System\qBNIwsF.exe
  2⤵
  PID:10296
- C:\Windows\System\BmdrUlr.exe
  C:\Windows\System\BmdrUlr.exe
  2⤵
  PID:10332
- C:\Windows\System\GhBXhNR.exe
  C:\Windows\System\GhBXhNR.exe
  2⤵
  PID:10356
- C:\Windows\System\qPoafvJ.exe
  C:\Windows\System\qPoafvJ.exe
  2⤵
  PID:10384
- C:\Windows\System\RTmiibn.exe
  C:\Windows\System\RTmiibn.exe
  2⤵
  PID:10412
- C:\Windows\System\zTboLlb.exe
  C:\Windows\System\zTboLlb.exe
  2⤵
  PID:10432
- C:\Windows\System\aneqyQn.exe
  C:\Windows\System\aneqyQn.exe
  2⤵
  PID:10460
- C:\Windows\System\bErjVyS.exe
  C:\Windows\System\bErjVyS.exe
  2⤵
  PID:10488
- C:\Windows\System\GEYYMFG.exe
  C:\Windows\System\GEYYMFG.exe
  2⤵
  PID:10524
- C:\Windows\System\XSIgPQC.exe
  C:\Windows\System\XSIgPQC.exe
  2⤵
  PID:10556
- C:\Windows\System\iVIWWAm.exe
  C:\Windows\System\iVIWWAm.exe
  2⤵
  PID:10572
- C:\Windows\System\xdrFGSp.exe
  C:\Windows\System\xdrFGSp.exe
  2⤵
  PID:10608
- C:\Windows\System\aVAcTjW.exe
  C:\Windows\System\aVAcTjW.exe
  2⤵
  PID:10628
- C:\Windows\System\aSsuAfg.exe
  C:\Windows\System\aSsuAfg.exe
  2⤵
  PID:10676
- C:\Windows\System\xiAxRbr.exe
  C:\Windows\System\xiAxRbr.exe
  2⤵
  PID:10700
- C:\Windows\System\pgIxYga.exe
  C:\Windows\System\pgIxYga.exe
  2⤵
  PID:10728
- C:\Windows\System\yqbaupM.exe
  C:\Windows\System\yqbaupM.exe
  2⤵
  PID:10744
- C:\Windows\System\LPuvJnp.exe
  C:\Windows\System\LPuvJnp.exe
  2⤵
  PID:10772
- C:\Windows\System\AgPJiTV.exe
  C:\Windows\System\AgPJiTV.exe
  2⤵
  PID:10800
- C:\Windows\System\FghpNso.exe
  C:\Windows\System\FghpNso.exe
  2⤵
  PID:10828
- C:\Windows\System\TCcvFLz.exe
  C:\Windows\System\TCcvFLz.exe
  2⤵
  PID:10856
- C:\Windows\System\IBGGbsu.exe
  C:\Windows\System\IBGGbsu.exe
  2⤵
  PID:10880
- C:\Windows\System\thpKjHi.exe
  C:\Windows\System\thpKjHi.exe
  2⤵
  PID:10912
- C:\Windows\System\UcxdrJx.exe
  C:\Windows\System\UcxdrJx.exe
  2⤵
  PID:10932
- C:\Windows\System\vwrCSwm.exe
  C:\Windows\System\vwrCSwm.exe
  2⤵
  PID:10956
- C:\Windows\System\cafcMaE.exe
  C:\Windows\System\cafcMaE.exe
  2⤵
  PID:10992
- C:\Windows\System\sYnRgCR.exe
  C:\Windows\System\sYnRgCR.exe
  2⤵
  PID:11012
- C:\Windows\System\GbroLFg.exe
  C:\Windows\System\GbroLFg.exe
  2⤵
  PID:11032
- C:\Windows\System\JOZTfVT.exe
  C:\Windows\System\JOZTfVT.exe
  2⤵
  PID:11052
- C:\Windows\System\VeatpDd.exe
  C:\Windows\System\VeatpDd.exe
  2⤵
  PID:11072
- C:\Windows\System\lbMAZgf.exe
  C:\Windows\System\lbMAZgf.exe
  2⤵
  PID:11092
- C:\Windows\System\YHzGNsI.exe
  C:\Windows\System\YHzGNsI.exe
  2⤵
  PID:11116
- C:\Windows\System\njRFUTP.exe
  C:\Windows\System\njRFUTP.exe
  2⤵
  PID:11148
- C:\Windows\System\wcXxpex.exe
  C:\Windows\System\wcXxpex.exe
  2⤵
  PID:11164
- C:\Windows\System\pMwjAEF.exe
  C:\Windows\System\pMwjAEF.exe
  2⤵
  PID:11184
- C:\Windows\System\twCUuuh.exe
  C:\Windows\System\twCUuuh.exe
  2⤵
  PID:11216
- C:\Windows\System\NiVVbKr.exe
  C:\Windows\System\NiVVbKr.exe
  2⤵
  PID:11240
- C:\Windows\System\MfThXjQ.exe
  C:\Windows\System\MfThXjQ.exe
  2⤵
  PID:9336
- C:\Windows\System\yKsARCY.exe
  C:\Windows\System\yKsARCY.exe
  2⤵
  PID:10088
- C:\Windows\System\XBzobph.exe
  C:\Windows\System\XBzobph.exe
  2⤵
  PID:8448
- C:\Windows\System\mLBhKuV.exe
  C:\Windows\System\mLBhKuV.exe
  2⤵
  PID:9080
- C:\Windows\System\bqsOFaD.exe
  C:\Windows\System\bqsOFaD.exe
  2⤵
  PID:10076
- C:\Windows\System\uzYGHPi.exe
  C:\Windows\System\uzYGHPi.exe
  2⤵
  PID:10324
- C:\Windows\System\bjwxUGB.exe
  C:\Windows\System\bjwxUGB.exe
  2⤵
  PID:10260
- C:\Windows\System\VOJEXAh.exe
  C:\Windows\System\VOJEXAh.exe
  2⤵
  PID:10520
- C:\Windows\System\VGzKLmr.exe
  C:\Windows\System\VGzKLmr.exe
  2⤵
  PID:10368
- C:\Windows\System\lLXYGmh.exe
  C:\Windows\System\lLXYGmh.exe
  2⤵
  PID:9584
- C:\Windows\System\FRgOlQV.exe
  C:\Windows\System\FRgOlQV.exe
  2⤵
  PID:10312
- C:\Windows\System\fsWrLrb.exe
  C:\Windows\System\fsWrLrb.exe
  2⤵
  PID:10724
- C:\Windows\System\hUsiRiE.exe
  C:\Windows\System\hUsiRiE.exe
  2⤵
  PID:10760
- C:\Windows\System\dUayLPs.exe
  C:\Windows\System\dUayLPs.exe
  2⤵
  PID:10636
- C:\Windows\System\zmVAAbs.exe
  C:\Windows\System\zmVAAbs.exe
  2⤵
  PID:10540
- C:\Windows\System\ktMSoCu.exe
  C:\Windows\System\ktMSoCu.exe
  2⤵
  PID:10948
- C:\Windows\System\yFpXEZQ.exe
  C:\Windows\System\yFpXEZQ.exe
  2⤵
  PID:11000
- C:\Windows\System\gofuHgZ.exe
  C:\Windows\System\gofuHgZ.exe
  2⤵
  PID:10868
- C:\Windows\System\XmVqskj.exe
  C:\Windows\System\XmVqskj.exe
  2⤵
  PID:10908
- C:\Windows\System\BmpCPUv.exe
  C:\Windows\System\BmpCPUv.exe
  2⤵
  PID:10972
- C:\Windows\System\gpHyGPT.exe
  C:\Windows\System\gpHyGPT.exe
  2⤵
  PID:11172
- C:\Windows\System\OtbgFBc.exe
  C:\Windows\System\OtbgFBc.exe
  2⤵
  PID:11040
- C:\Windows\System\OQfkVDV.exe
  C:\Windows\System\OQfkVDV.exe
  2⤵
  PID:11132
- C:\Windows\System\dMbRJKs.exe
  C:\Windows\System\dMbRJKs.exe
  2⤵
  PID:11180
- C:\Windows\System\ghYiZnR.exe
  C:\Windows\System\ghYiZnR.exe
  2⤵
  PID:10380
- C:\Windows\System\zcsVELd.exe
  C:\Windows\System\zcsVELd.exe
  2⤵
  PID:10020
- C:\Windows\System\FyAIvhW.exe
  C:\Windows\System\FyAIvhW.exe
  2⤵
  PID:10404
- C:\Windows\System\AZhtqTm.exe
  C:\Windows\System\AZhtqTm.exe
  2⤵
  PID:11288
- C:\Windows\System\czufwWE.exe
  C:\Windows\System\czufwWE.exe
  2⤵
  PID:11312
- C:\Windows\System\yiwqAmX.exe
  C:\Windows\System\yiwqAmX.exe
  2⤵
  PID:11340
- C:\Windows\System\xAlqknf.exe
  C:\Windows\System\xAlqknf.exe
  2⤵
  PID:11360
- C:\Windows\System\SISTqKY.exe
  C:\Windows\System\SISTqKY.exe
  2⤵
  PID:11388
- C:\Windows\System\LjoUgGu.exe
  C:\Windows\System\LjoUgGu.exe
  2⤵
  PID:11404
- C:\Windows\System\CyDdSAe.exe
  C:\Windows\System\CyDdSAe.exe
  2⤵
  PID:11564
- C:\Windows\System\sWfSrhm.exe
  C:\Windows\System\sWfSrhm.exe
  2⤵
  PID:11624
- C:\Windows\System\WYaqVso.exe
  C:\Windows\System\WYaqVso.exe
  2⤵
  PID:11656
- C:\Windows\System\jzgyLcv.exe
  C:\Windows\System\jzgyLcv.exe
  2⤵
  PID:11676
- C:\Windows\System\sxtRciU.exe
  C:\Windows\System\sxtRciU.exe
  2⤵
  PID:11704
- C:\Windows\System\PsYKlro.exe
  C:\Windows\System\PsYKlro.exe
  2⤵
  PID:11728
- C:\Windows\System\xgfnZgh.exe
  C:\Windows\System\xgfnZgh.exe
  2⤵
  PID:11748
- C:\Windows\System\UlqnveW.exe
  C:\Windows\System\UlqnveW.exe
  2⤵
  PID:11776
- C:\Windows\System\mpSftSR.exe
  C:\Windows\System\mpSftSR.exe
  2⤵
  PID:11804
- C:\Windows\System\HHlPMIN.exe
  C:\Windows\System\HHlPMIN.exe
  2⤵
  PID:11824
- C:\Windows\System\IQjYAVl.exe
  C:\Windows\System\IQjYAVl.exe
  2⤵
  PID:11860
- C:\Windows\System\HxPdFTa.exe
  C:\Windows\System\HxPdFTa.exe
  2⤵
  PID:11884
- C:\Windows\System\GOsIdzS.exe
  C:\Windows\System\GOsIdzS.exe
  2⤵
  PID:11904
- C:\Windows\System\sYYaCCA.exe
  C:\Windows\System\sYYaCCA.exe
  2⤵
  PID:11928
- C:\Windows\System\RMozbuV.exe
  C:\Windows\System\RMozbuV.exe
  2⤵
  PID:11960
- C:\Windows\System\UAunFyZ.exe
  C:\Windows\System\UAunFyZ.exe
  2⤵
  PID:11988
- C:\Windows\System\aOYWurb.exe
  C:\Windows\System\aOYWurb.exe
  2⤵
  PID:12008
- C:\Windows\System\pKHzZXP.exe
  C:\Windows\System\pKHzZXP.exe
  2⤵
  PID:12048
- C:\Windows\System\yNEAjbi.exe
  C:\Windows\System\yNEAjbi.exe
  2⤵
  PID:12076
- C:\Windows\System\emJULIX.exe
  C:\Windows\System\emJULIX.exe
  2⤵
  PID:12092
- C:\Windows\System\ZRPcGVq.exe
  C:\Windows\System\ZRPcGVq.exe
  2⤵
  PID:12120
- C:\Windows\System\raHLLpL.exe
  C:\Windows\System\raHLLpL.exe
  2⤵
  PID:12136
- C:\Windows\System\cqXkqRN.exe
  C:\Windows\System\cqXkqRN.exe
  2⤵
  PID:12160
- C:\Windows\System\RIrGnnf.exe
  C:\Windows\System\RIrGnnf.exe
  2⤵
  PID:12184
- C:\Windows\System\CRgkohX.exe
  C:\Windows\System\CRgkohX.exe
  2⤵
  PID:12208
- C:\Windows\System\aEiYBrG.exe
  C:\Windows\System\aEiYBrG.exe
  2⤵
  PID:12224
- C:\Windows\System\feSeGWT.exe
  C:\Windows\System\feSeGWT.exe
  2⤵
  PID:12252
- C:\Windows\System\lsdcrro.exe
  C:\Windows\System\lsdcrro.exe
  2⤵
  PID:12276
- C:\Windows\System\kUQLXWu.exe
  C:\Windows\System\kUQLXWu.exe
  2⤵
  PID:11044
- C:\Windows\System\YSxJMEC.exe
  C:\Windows\System\YSxJMEC.exe
  2⤵
  PID:11208
- C:\Windows\System\SfMSgvL.exe
  C:\Windows\System\SfMSgvL.exe
  2⤵
  PID:10440
- C:\Windows\System\XTWdcAt.exe
  C:\Windows\System\XTWdcAt.exe
  2⤵
  PID:10648
- C:\Windows\System\LjqCEFk.exe
  C:\Windows\System\LjqCEFk.exe
  2⤵
  PID:10896
- C:\Windows\System\UXIbGsA.exe
  C:\Windows\System\UXIbGsA.exe
  2⤵
  PID:11540
- C:\Windows\System\vofZEPP.exe
  C:\Windows\System\vofZEPP.exe
  2⤵
  PID:10808
- C:\Windows\System\OjCNBcD.exe
  C:\Windows\System\OjCNBcD.exe
  2⤵
  PID:11228
- C:\Windows\System\cTEHjJZ.exe
  C:\Windows\System\cTEHjJZ.exe
  2⤵
  PID:11456
- C:\Windows\System\qdmZCWB.exe
  C:\Windows\System\qdmZCWB.exe
  2⤵
  PID:11608
- C:\Windows\System\SAhRAZl.exe
  C:\Windows\System\SAhRAZl.exe
  2⤵
  PID:11060
- C:\Windows\System\XEIJEUt.exe
  C:\Windows\System\XEIJEUt.exe
  2⤵
  PID:11284
- C:\Windows\System\SmrLmDa.exe
  C:\Windows\System\SmrLmDa.exe
  2⤵
  PID:11332
- C:\Windows\System\EdkuSGI.exe
  C:\Windows\System\EdkuSGI.exe
  2⤵
  PID:11380
- C:\Windows\System\cyvUFEy.exe
  C:\Windows\System\cyvUFEy.exe
  2⤵
  PID:11436
- C:\Windows\System\HNYvEeC.exe
  C:\Windows\System\HNYvEeC.exe
  2⤵
  PID:11672
- C:\Windows\System\uOodGUb.exe
  C:\Windows\System\uOodGUb.exe
  2⤵
  PID:11920
- C:\Windows\System\VzfXZjP.exe
  C:\Windows\System\VzfXZjP.exe
  2⤵
  PID:11956
- C:\Windows\System\yovXbKP.exe
  C:\Windows\System\yovXbKP.exe
  2⤵
  PID:12024
- C:\Windows\System\xcncyIZ.exe
  C:\Windows\System\xcncyIZ.exe
  2⤵
  PID:11648
- C:\Windows\System\rnDFAMv.exe
  C:\Windows\System\rnDFAMv.exe
  2⤵
  PID:11944
- C:\Windows\System\akIxCPr.exe
  C:\Windows\System\akIxCPr.exe
  2⤵
  PID:11800
- C:\Windows\System\yidOdCM.exe
  C:\Windows\System\yidOdCM.exe
  2⤵
  PID:12268
- C:\Windows\System\WNnyaKy.exe
  C:\Windows\System\WNnyaKy.exe
  2⤵
  PID:10876
- C:\Windows\System\sIatAGt.exe
  C:\Windows\System\sIatAGt.exe
  2⤵
  PID:12156
- C:\Windows\System\tJPCPeV.exe
  C:\Windows\System\tJPCPeV.exe
  2⤵
  PID:12200
- C:\Windows\System\BfZdCqM.exe
  C:\Windows\System\BfZdCqM.exe
  2⤵
  PID:11444
- C:\Windows\System\lEMBVmH.exe
  C:\Windows\System\lEMBVmH.exe
  2⤵
  PID:11272
- C:\Windows\System\UrDOUuJ.exe
  C:\Windows\System\UrDOUuJ.exe
  2⤵
  PID:12320
- C:\Windows\System\YRrcgnV.exe
  C:\Windows\System\YRrcgnV.exe
  2⤵
  PID:12344
- C:\Windows\System\PXodHIk.exe
  C:\Windows\System\PXodHIk.exe
  2⤵
  PID:12368
- C:\Windows\System\TawopDM.exe
  C:\Windows\System\TawopDM.exe
  2⤵
  PID:12392
- C:\Windows\System\TepKIpC.exe
  C:\Windows\System\TepKIpC.exe
  2⤵
  PID:12412
- C:\Windows\System\wnrRTyW.exe
  C:\Windows\System\wnrRTyW.exe
  2⤵
  PID:12440
- C:\Windows\System\HafqEUw.exe
  C:\Windows\System\HafqEUw.exe
  2⤵
  PID:12464
- C:\Windows\System\giwYxIF.exe
  C:\Windows\System\giwYxIF.exe
  2⤵
  PID:12492
- C:\Windows\System\AWyDEjf.exe
  C:\Windows\System\AWyDEjf.exe
  2⤵
  PID:12508
- C:\Windows\System\AfyOWeb.exe
  C:\Windows\System\AfyOWeb.exe
  2⤵
  PID:12536
- C:\Windows\System\UDbFVUS.exe
  C:\Windows\System\UDbFVUS.exe
  2⤵
  PID:12556
- C:\Windows\System\OFfSIjb.exe
  C:\Windows\System\OFfSIjb.exe
  2⤵
  PID:12580
- C:\Windows\System\zjgUxCH.exe
  C:\Windows\System\zjgUxCH.exe
  2⤵
  PID:12604
- C:\Windows\System\YgNROju.exe
  C:\Windows\System\YgNROju.exe
  2⤵
  PID:12624
- C:\Windows\System\QhvsBVq.exe
  C:\Windows\System\QhvsBVq.exe
  2⤵
  PID:12652
- C:\Windows\System\awDIlbp.exe
  C:\Windows\System\awDIlbp.exe
  2⤵
  PID:12688
- C:\Windows\System\AVVgZUJ.exe
  C:\Windows\System\AVVgZUJ.exe
  2⤵
  PID:12716
- C:\Windows\System\AxYVQQJ.exe
  C:\Windows\System\AxYVQQJ.exe
  2⤵
  PID:12740
- C:\Windows\System\gZFVrPn.exe
  C:\Windows\System\gZFVrPn.exe
  2⤵
  PID:12768
- C:\Windows\System\FAAdift.exe
  C:\Windows\System\FAAdift.exe
  2⤵
  PID:12784
- C:\Windows\System\qfPazND.exe
  C:\Windows\System\qfPazND.exe
  2⤵
  PID:12808
- C:\Windows\System\eyYyQTe.exe
  C:\Windows\System\eyYyQTe.exe
  2⤵
  PID:12832
- C:\Windows\System\LwZKHpF.exe
  C:\Windows\System\LwZKHpF.exe
  2⤵
  PID:12856
- C:\Windows\System\uuaVyeI.exe
  C:\Windows\System\uuaVyeI.exe
  2⤵
  PID:12884
- C:\Windows\System\ncXkKXO.exe
  C:\Windows\System\ncXkKXO.exe
  2⤵
  PID:12900
- C:\Windows\System\zwfGGPW.exe
  C:\Windows\System\zwfGGPW.exe
  2⤵
  PID:12928
- C:\Windows\System\gzQLXwI.exe
  C:\Windows\System\gzQLXwI.exe
  2⤵
  PID:12948
- C:\Windows\System\QjfRIJm.exe
  C:\Windows\System\QjfRIJm.exe
  2⤵
  PID:12980
- C:\Windows\System\AlZXctA.exe
  C:\Windows\System\AlZXctA.exe
  2⤵
  PID:13008
- C:\Windows\System\QePZVsI.exe
  C:\Windows\System\QePZVsI.exe
  2⤵
  PID:13028
- C:\Windows\System\yXiEOJq.exe
  C:\Windows\System\yXiEOJq.exe
  2⤵
  PID:13052
- C:\Windows\System\MZeXGwJ.exe
  C:\Windows\System\MZeXGwJ.exe
  2⤵
  PID:13068
- C:\Windows\System\eYJnABm.exe
  C:\Windows\System\eYJnABm.exe
  2⤵
  PID:13104
- C:\Windows\System\KMguNcc.exe
  C:\Windows\System\KMguNcc.exe
  2⤵
  PID:13132
- C:\Windows\System\psmSfjq.exe
  C:\Windows\System\psmSfjq.exe
  2⤵
  PID:13160
- C:\Windows\System\SFzMrbh.exe
  C:\Windows\System\SFzMrbh.exe
  2⤵
  PID:13192
- C:\Windows\System\IMXjqRX.exe
  C:\Windows\System\IMXjqRX.exe
  2⤵
  PID:13224
- C:\Windows\System\PeFMwpB.exe
  C:\Windows\System\PeFMwpB.exe
  2⤵
  PID:13244
- C:\Windows\System\yiXynzK.exe
  C:\Windows\System\yiXynzK.exe
  2⤵
  PID:13260
- C:\Windows\System\jCnBMrz.exe
  C:\Windows\System\jCnBMrz.exe
  2⤵
  PID:13276
- C:\Windows\System\LudXlYj.exe
  C:\Windows\System\LudXlYj.exe
  2⤵
  PID:13304
- C:\Windows\System\KbIDAlr.exe
  C:\Windows\System\KbIDAlr.exe
  2⤵
  PID:12104
- C:\Windows\System\FpbFWGR.exe
  C:\Windows\System\FpbFWGR.exe
  2⤵
  PID:10340
- C:\Windows\System\JCAKPlC.exe
  C:\Windows\System\JCAKPlC.exe
  2⤵
  PID:10980
- C:\Windows\System\kjygCfL.exe
  C:\Windows\System\kjygCfL.exe
  2⤵
  PID:12068
- C:\Windows\System\pXPmORk.exe
  C:\Windows\System\pXPmORk.exe
  2⤵
  PID:12296
- C:\Windows\System\uEpVjZY.exe
  C:\Windows\System\uEpVjZY.exe
  2⤵
  PID:11772
- C:\Windows\System\PAlEMgM.exe
  C:\Windows\System\PAlEMgM.exe
  2⤵
  PID:11496
- C:\Windows\System\sHQdzaG.exe
  C:\Windows\System\sHQdzaG.exe
  2⤵
  PID:11760
- C:\Windows\System\CpySImA.exe
  C:\Windows\System\CpySImA.exe
  2⤵
  PID:12456
- C:\Windows\System\THyGAWS.exe
  C:\Windows\System\THyGAWS.exe
  2⤵
  PID:12248
- C:\Windows\System\HKiOMtv.exe
  C:\Windows\System\HKiOMtv.exe
  2⤵
  PID:10656
- C:\Windows\System\BSBEoSm.exe
  C:\Windows\System\BSBEoSm.exe
  2⤵
  PID:9508
- C:\Windows\System\SypskVZ.exe
  C:\Windows\System\SypskVZ.exe
  2⤵
  PID:12264
- C:\Windows\System\zcyjTiL.exe
  C:\Windows\System\zcyjTiL.exe
  2⤵
  PID:12712
- C:\Windows\System\mtriLkT.exe
  C:\Windows\System\mtriLkT.exe
  2⤵
  PID:12764
- C:\Windows\System\qkimTHD.exe
  C:\Windows\System\qkimTHD.exe
  2⤵
  PID:12452
- C:\Windows\System\XexwHbA.exe
  C:\Windows\System\XexwHbA.exe
  2⤵
  PID:12912
- C:\Windows\System\EgwaDFR.exe
  C:\Windows\System\EgwaDFR.exe
  2⤵
  PID:12956
- C:\Windows\System\YzHREJP.exe
  C:\Windows\System\YzHREJP.exe
  2⤵
  PID:12116
- C:\Windows\System\ECjKIRD.exe
  C:\Windows\System\ECjKIRD.exe
  2⤵
  PID:12204
- C:\Windows\System\UkUrEpI.exe
  C:\Windows\System\UkUrEpI.exe
  2⤵
  PID:13116
- C:\Windows\System\STdElZW.exe
  C:\Windows\System\STdElZW.exe
  2⤵
  PID:12308
- C:\Windows\System\QGLkpmB.exe
  C:\Windows\System\QGLkpmB.exe
  2⤵
  PID:12796
- C:\Windows\System\MWiFdDf.exe
  C:\Windows\System\MWiFdDf.exe
  2⤵
  PID:12864
- C:\Windows\System\EqEwejs.exe
  C:\Windows\System\EqEwejs.exe
  2⤵
  PID:12892
- C:\Windows\System\QNZNctq.exe
  C:\Windows\System\QNZNctq.exe
  2⤵
  PID:13324
- C:\Windows\System\VlDcHfe.exe
  C:\Windows\System\VlDcHfe.exe
  2⤵
  PID:13348
- C:\Windows\System\CWimncV.exe
  C:\Windows\System\CWimncV.exe
  2⤵
  PID:13368
- C:\Windows\System\zPVhHwV.exe
  C:\Windows\System\zPVhHwV.exe
  2⤵
  PID:13396
- C:\Windows\System\MdsbYWa.exe
  C:\Windows\System\MdsbYWa.exe
  2⤵
  PID:13424
- C:\Windows\System\nNKRZLu.exe
  C:\Windows\System\nNKRZLu.exe
  2⤵
  PID:13440
- C:\Windows\System\XPYXXdE.exe
  C:\Windows\System\XPYXXdE.exe
  2⤵
  PID:13464
- C:\Windows\System\dnbCIrE.exe
  C:\Windows\System\dnbCIrE.exe
  2⤵
  PID:13484
- C:\Windows\System\fSWDthk.exe
  C:\Windows\System\fSWDthk.exe
  2⤵
  PID:13504
- C:\Windows\System\FEssfGR.exe
  C:\Windows\System\FEssfGR.exe
  2⤵
  PID:13528
- C:\Windows\System\sRSDqDS.exe
  C:\Windows\System\sRSDqDS.exe
  2⤵
  PID:13544
- C:\Windows\System\xxECZWK.exe
  C:\Windows\System\xxECZWK.exe
  2⤵
  PID:13572
- C:\Windows\System\yfHjnIO.exe
  C:\Windows\System\yfHjnIO.exe
  2⤵
  PID:13596
- C:\Windows\System\fmGZLFc.exe
  C:\Windows\System\fmGZLFc.exe
  2⤵
  PID:13616
- C:\Windows\System\duYLoJU.exe
  C:\Windows\System\duYLoJU.exe
  2⤵
  PID:13632
- C:\Windows\System\SaKHrud.exe
  C:\Windows\System\SaKHrud.exe
  2⤵
  PID:13672
- C:\Windows\System\pGaHtKt.exe
  C:\Windows\System\pGaHtKt.exe
  2⤵
  PID:13700
- C:\Windows\System\UQSQVpz.exe
  C:\Windows\System\UQSQVpz.exe
  2⤵
  PID:13716
- C:\Windows\System\XnRVdkA.exe
  C:\Windows\System\XnRVdkA.exe
  2⤵
  PID:13744
- C:\Windows\System\PVVUovn.exe
  C:\Windows\System\PVVUovn.exe
  2⤵
  PID:13764
- C:\Windows\System\wQOOsSs.exe
  C:\Windows\System\wQOOsSs.exe
  2⤵
  PID:13780
- C:\Windows\System\pLMGnKF.exe
  C:\Windows\System\pLMGnKF.exe
  2⤵
  PID:13800
- C:\Windows\System\TUAZcyk.exe
  C:\Windows\System\TUAZcyk.exe
  2⤵
  PID:13824
- C:\Windows\System\iFeVLDu.exe
  C:\Windows\System\iFeVLDu.exe
  2⤵
  PID:13852
- C:\Windows\System\qLaBiFp.exe
  C:\Windows\System\qLaBiFp.exe
  2⤵
  PID:13868
- C:\Windows\System\SRNZyVr.exe
  C:\Windows\System\SRNZyVr.exe
  2⤵
  PID:13900
- C:\Windows\System\MdxuRfr.exe
  C:\Windows\System\MdxuRfr.exe
  2⤵
  PID:13916
- C:\Windows\System\NPxQEiZ.exe
  C:\Windows\System\NPxQEiZ.exe
  2⤵
  PID:13936
- C:\Windows\System\whGVUfh.exe
  C:\Windows\System\whGVUfh.exe
  2⤵
  PID:13956
- C:\Windows\System\kkRJvKL.exe
  C:\Windows\System\kkRJvKL.exe
  2⤵
  PID:13984
- C:\Windows\System\aReDmsU.exe
  C:\Windows\System\aReDmsU.exe
  2⤵
  PID:14004
- C:\Windows\System\vXksIik.exe
  C:\Windows\System\vXksIik.exe
  2⤵
  PID:14040
- C:\Windows\System\dSNDIRD.exe
  C:\Windows\System\dSNDIRD.exe
  2⤵
  PID:14060
- C:\Windows\System\enmnpKc.exe
  C:\Windows\System\enmnpKc.exe
  2⤵
  PID:14084
- C:\Windows\System\urVjlWV.exe
  C:\Windows\System\urVjlWV.exe
  2⤵
  PID:14116
- C:\Windows\System\BiyqBVC.exe
  C:\Windows\System\BiyqBVC.exe
  2⤵
  PID:14140
- C:\Windows\System\reWYfGb.exe
  C:\Windows\System\reWYfGb.exe
  2⤵
  PID:14160
- C:\Windows\System\ZQiqoSZ.exe
  C:\Windows\System\ZQiqoSZ.exe
  2⤵
  PID:14176
- C:\Windows\System\DVEujtZ.exe
  C:\Windows\System\DVEujtZ.exe
  2⤵
  PID:14196
- C:\Windows\System\OrnvmXe.exe
  C:\Windows\System\OrnvmXe.exe
  2⤵
  PID:14216
- C:\Windows\System\htWWMSA.exe
  C:\Windows\System\htWWMSA.exe
  2⤵
  PID:14236
- C:\Windows\System\shXxvJE.exe
  C:\Windows\System\shXxvJE.exe
  2⤵
  PID:14268
- C:\Windows\System\ufjldHb.exe
  C:\Windows\System\ufjldHb.exe
  2⤵
  PID:14292
- C:\Windows\System\QzOKMAO.exe
  C:\Windows\System\QzOKMAO.exe
  2⤵
  PID:14316
- C:\Windows\System\yYqbbot.exe
  C:\Windows\System\yYqbbot.exe
  2⤵
  PID:12936
- C:\Windows\System\UUXbPYc.exe
  C:\Windows\System\UUXbPYc.exe
  2⤵
  PID:11260
- C:\Windows\System\IAdZjZE.exe
  C:\Windows\System\IAdZjZE.exe
  2⤵
  PID:11996
- C:\Windows\System\hgvKBiA.exe
  C:\Windows\System\hgvKBiA.exe
  2⤵
  PID:13084
- C:\Windows\System\PbhbVxP.exe
  C:\Windows\System\PbhbVxP.exe
  2⤵
  PID:13156
- C:\Windows\System\skgzaPy.exe
  C:\Windows\System\skgzaPy.exe
  2⤵
  PID:12728
- C:\Windows\System\JWQreCa.exe
  C:\Windows\System\JWQreCa.exe
  2⤵
  PID:13252
- C:\Windows\System\slwfATt.exe
  C:\Windows\System\slwfATt.exe
  2⤵
  PID:12600
- C:\Windows\System\BlJwNtB.exe
  C:\Windows\System\BlJwNtB.exe
  2⤵
  PID:12916
- C:\Windows\System\ICfPMpN.exe
  C:\Windows\System\ICfPMpN.exe
  2⤵
  PID:13340
- C:\Windows\System\sGXxIOX.exe
  C:\Windows\System\sGXxIOX.exe
  2⤵
  PID:11764
- C:\Windows\System\lWhyAEe.exe
  C:\Windows\System\lWhyAEe.exe
  2⤵
  PID:13412
- C:\Windows\System\vaVythH.exe
  C:\Windows\System\vaVythH.exe
  2⤵
  PID:12612
- C:\Windows\System\yKoSraE.exe
  C:\Windows\System\yKoSraE.exe
  2⤵
  PID:13536
- C:\Windows\System\FXPzHNy.exe
  C:\Windows\System\FXPzHNy.exe
  2⤵
  PID:12780
- C:\Windows\System\fYWlKGa.exe
  C:\Windows\System\fYWlKGa.exe
  2⤵
  PID:13612
- C:\Windows\System\irpsKrD.exe
  C:\Windows\System\irpsKrD.exe
  2⤵
  PID:13288
- C:\Windows\System\FDgcNmQ.exe
  C:\Windows\System\FDgcNmQ.exe
  2⤵
  PID:11432
- C:\Windows\System\kranjAU.exe
  C:\Windows\System\kranjAU.exe
  2⤵
  PID:13892
- C:\Windows\System\TnIQfPP.exe
  C:\Windows\System\TnIQfPP.exe
  2⤵
  PID:11724
- C:\Windows\System\bOtKtwB.exe
  C:\Windows\System\bOtKtwB.exe
  2⤵
  PID:14028
- C:\Windows\System\keueHaz.exe
  C:\Windows\System\keueHaz.exe
  2⤵
  PID:14048
- C:\Windows\System\bAwKBhp.exe
  C:\Windows\System\bAwKBhp.exe
  2⤵
  PID:14360
- C:\Windows\System\pPoHReu.exe
  C:\Windows\System\pPoHReu.exe
  2⤵
  PID:14376
- C:\Windows\System\oJaKdin.exe
  C:\Windows\System\oJaKdin.exe
  2⤵
  PID:14420
- C:\Windows\System\ACHBtku.exe
  C:\Windows\System\ACHBtku.exe
  2⤵
  PID:14444
- C:\Windows\System\pZMcwWm.exe
  C:\Windows\System\pZMcwWm.exe
  2⤵
  PID:14480
- C:\Windows\System\kGLydhm.exe
  C:\Windows\System\kGLydhm.exe
  2⤵
  PID:14500
- C:\Windows\System\ULwRIkf.exe
  C:\Windows\System\ULwRIkf.exe
  2⤵
  PID:14520
- C:\Windows\System\nUVloDK.exe
  C:\Windows\System\nUVloDK.exe
  2⤵
  PID:14552
- C:\Windows\System\XFmuzSu.exe
  C:\Windows\System\XFmuzSu.exe
  2⤵
  PID:14572
- C:\Windows\System\xAyRiAF.exe
  C:\Windows\System\xAyRiAF.exe
  2⤵
  PID:14592
- C:\Windows\System\EusEKzs.exe
  C:\Windows\System\EusEKzs.exe
  2⤵
  PID:14612
- C:\Windows\System\dEAeUgk.exe
  C:\Windows\System\dEAeUgk.exe
  2⤵
  PID:14628
- C:\Windows\System\OUMjsuZ.exe
  C:\Windows\System\OUMjsuZ.exe
  2⤵
  PID:14660
- C:\Windows\System\eeeJSZq.exe
  C:\Windows\System\eeeJSZq.exe
  2⤵
  PID:14684
- C:\Windows\System\ANaYqRw.exe
  C:\Windows\System\ANaYqRw.exe
  2⤵
  PID:14712
- C:\Windows\System\ihcIazk.exe
  C:\Windows\System\ihcIazk.exe
  2⤵
  PID:14732
- C:\Windows\System\qnVQWQS.exe
  C:\Windows\System\qnVQWQS.exe
  2⤵
  PID:14752
- C:\Windows\System\whCgliD.exe
  C:\Windows\System\whCgliD.exe
  2⤵
  PID:14776
- C:\Windows\System\ReUpqWi.exe
  C:\Windows\System\ReUpqWi.exe
  2⤵
  PID:14796
- C:\Windows\System\KHkEYzt.exe
  C:\Windows\System\KHkEYzt.exe
  2⤵
  PID:14812
- C:\Windows\System\DgcvsAo.exe
  C:\Windows\System\DgcvsAo.exe
  2⤵
  PID:14840
- C:\Windows\System\vtoIohG.exe
  C:\Windows\System\vtoIohG.exe
  2⤵
  PID:14864
- C:\Windows\System\POmTSMA.exe
  C:\Windows\System\POmTSMA.exe
  2⤵
  PID:14884
- C:\Windows\System\vtIDCQa.exe
  C:\Windows\System\vtIDCQa.exe
  2⤵
  PID:14912
- C:\Windows\System\yvgaxFC.exe
  C:\Windows\System\yvgaxFC.exe
  2⤵
  PID:14936
- C:\Windows\System\FyTiRGj.exe
  C:\Windows\System\FyTiRGj.exe
  2⤵
  PID:14960
- C:\Windows\System\yVOxYsv.exe
  C:\Windows\System\yVOxYsv.exe
  2⤵
  PID:14980
- C:\Windows\System\trNiRiH.exe
  C:\Windows\System\trNiRiH.exe
  2⤵
  PID:15004
- C:\Windows\System\WKENNGs.exe
  C:\Windows\System\WKENNGs.exe
  2⤵
  PID:15036
- C:\Windows\System\mRzKCKT.exe
  C:\Windows\System\mRzKCKT.exe
  2⤵
  PID:15060
- C:\Windows\System\OSGjgck.exe
  C:\Windows\System\OSGjgck.exe
  2⤵
  PID:15080
- C:\Windows\System\CSCEgtL.exe
  C:\Windows\System\CSCEgtL.exe
  2⤵
  PID:15104
- C:\Windows\System\hhlXzjr.exe
  C:\Windows\System\hhlXzjr.exe
  2⤵
  PID:15136
- C:\Windows\System\HLbNMUX.exe
  C:\Windows\System\HLbNMUX.exe
  2⤵
  PID:15156
- C:\Windows\System\biWAScM.exe
  C:\Windows\System\biWAScM.exe
  2⤵
  PID:15184
- C:\Windows\System\YJwfDrc.exe
  C:\Windows\System\YJwfDrc.exe
  2⤵
  PID:15204
- C:\Windows\System\Hiwbfal.exe
  C:\Windows\System\Hiwbfal.exe
  2⤵
  PID:15240
- C:\Windows\System\rpgrzWz.exe
  C:\Windows\System\rpgrzWz.exe
  2⤵
  PID:15260
- C:\Windows\System\zojGRPL.exe
  C:\Windows\System\zojGRPL.exe
  2⤵
  PID:15276
- C:\Windows\System\mKyiRAY.exe
  C:\Windows\System\mKyiRAY.exe
  2⤵
  PID:15292
- C:\Windows\System\KRvCYYX.exe
  C:\Windows\System\KRvCYYX.exe
  2⤵
  PID:15312
- C:\Windows\System\yIpEbyz.exe
  C:\Windows\System\yIpEbyz.exe
  2⤵
  PID:15328
- C:\Windows\System\GOzwmap.exe
  C:\Windows\System\GOzwmap.exe
  2⤵
  PID:15344
- C:\Windows\System\fytmjmY.exe
  C:\Windows\System\fytmjmY.exe
  2⤵
  PID:15116
- C:\Windows\System\JvYbAnl.exe
  C:\Windows\System\JvYbAnl.exe
  2⤵
  PID:13112
- C:\Windows\System\lGzrWDl.exe
  C:\Windows\System\lGzrWDl.exe
  2⤵
  PID:15144
- C:\Windows\System\dWyNDCh.exe
  C:\Windows\System\dWyNDCh.exe
  2⤵
  PID:12880
- C:\Windows\System\YALWJww.exe
  C:\Windows\System\YALWJww.exe
  2⤵
  PID:15304
- C:\Windows\System\bNSeHHu.exe
  C:\Windows\System\bNSeHHu.exe
  2⤵
  PID:13432
- C:\Windows\System\deXkXcg.exe
  C:\Windows\System\deXkXcg.exe
  2⤵
  PID:14076
- C:\Windows\System\hjioUai.exe
  C:\Windows\System\hjioUai.exe
  2⤵
  PID:14152
- C:\Windows\System\QqtxoXx.exe
  C:\Windows\System\QqtxoXx.exe
  2⤵
  PID:13624
- C:\Windows\System\WKoKmvt.exe
  C:\Windows\System\WKoKmvt.exe
  2⤵
  PID:14692
- C:\Windows\System\ZCctwrF.exe
  C:\Windows\System\ZCctwrF.exe
  2⤵
  PID:14720
- C:\Windows\System\hDprmCi.exe
  C:\Windows\System\hDprmCi.exe
  2⤵
  PID:14748
- C:\Windows\System\HuqlEzz.exe
  C:\Windows\System\HuqlEzz.exe
  2⤵
  PID:11816
- C:\Windows\System\wPVVRad.exe
  C:\Windows\System\wPVVRad.exe
  2⤵
  PID:14804
- C:\Windows\System\hhYCKzO.exe
  C:\Windows\System\hhYCKzO.exe
  2⤵
  PID:14836
- C:\Windows\System\dddTxcW.exe
  C:\Windows\System\dddTxcW.exe
  2⤵
  PID:14872
- C:\Windows\System\TMYPogX.exe
  C:\Windows\System\TMYPogX.exe
  2⤵
  PID:11532
- C:\Windows\System\kBCmsHg.exe
  C:\Windows\System\kBCmsHg.exe
  2⤵
  PID:13000
- C:\Windows\System\beKFTdM.exe
  C:\Windows\System\beKFTdM.exe
  2⤵
  PID:15324
- C:\Windows\System\negHNXR.exe
  C:\Windows\System\negHNXR.exe
  2⤵
  PID:14400
- C:\Windows\System\uwetBoT.exe
  C:\Windows\System\uwetBoT.exe
  2⤵
  PID:14452
- C:\Windows\System\dKGWnDW.exe
  C:\Windows\System\dKGWnDW.exe
  2⤵
  PID:14508
- C:\Windows\System\fREMBDp.exe
  C:\Windows\System\fREMBDp.exe
  2⤵
  PID:14548
- C:\Windows\System\jqEzUKm.exe
  C:\Windows\System\jqEzUKm.exe
  2⤵
  PID:14584
- C:\Windows\System\aznCgpo.exe
  C:\Windows\System\aznCgpo.exe
  2⤵
  PID:14072
- C:\Windows\System\bRUoPSo.exe
  C:\Windows\System\bRUoPSo.exe
  2⤵
  PID:13728
- C:\Windows\System\kxZWLdc.exe
  C:\Windows\System\kxZWLdc.exe
  2⤵
  PID:13216
- C:\Windows\System\LQFQvDX.exe
  C:\Windows\System\LQFQvDX.exe
  2⤵
  PID:15076
- C:\Windows\System\ZFfbKoS.exe
  C:\Windows\System\ZFfbKoS.exe
  2⤵
  PID:15212
- C:\Windows\System\fVZCbZv.exe
  C:\Windows\System\fVZCbZv.exe
  2⤵
  PID:15252
- C:\Windows\System\ZXSSstb.exe
  C:\Windows\System\ZXSSstb.exe
  2⤵
  PID:13560
- C:\Windows\System\lnqzbhV.exe
  C:\Windows\System\lnqzbhV.exe
  2⤵
  PID:13208
- C:\Windows\System\BMJUiht.exe
  C:\Windows\System\BMJUiht.exe
  2⤵
  PID:15392
- C:\Windows\System\WkEiuVN.exe
  C:\Windows\System\WkEiuVN.exe
  2⤵
  PID:15424
- C:\Windows\System\jmpPchv.exe
  C:\Windows\System\jmpPchv.exe
  2⤵
  PID:15464
- C:\Windows\System\VQgOLeI.exe
  C:\Windows\System\VQgOLeI.exe
  2⤵
  PID:15500
- C:\Windows\System\EjrKMgb.exe
  C:\Windows\System\EjrKMgb.exe
  2⤵
  PID:15532
- C:\Windows\System\vxgnzhJ.exe
  C:\Windows\System\vxgnzhJ.exe
  2⤵
  PID:15552
- C:\Windows\System\lvsyARd.exe
  C:\Windows\System\lvsyARd.exe
  2⤵
  PID:15596
- C:\Windows\System\CcXOzWq.exe
  C:\Windows\System\CcXOzWq.exe
  2⤵
  PID:15620
- C:\Windows\System\RDIugaX.exe
  C:\Windows\System\RDIugaX.exe
  2⤵
  PID:15636
- C:\Windows\System\TuOXpFw.exe
  C:\Windows\System\TuOXpFw.exe
  2⤵
  PID:15652
- C:\Windows\System\ykUfoAa.exe
  C:\Windows\System\ykUfoAa.exe
  2⤵
  PID:15692
- C:\Windows\System\toKGRoD.exe
  C:\Windows\System\toKGRoD.exe
  2⤵
  PID:15716
- C:\Windows\System\UxQbgHp.exe
  C:\Windows\System\UxQbgHp.exe
  2⤵
  PID:15740
- C:\Windows\System\qlShaxt.exe
  C:\Windows\System\qlShaxt.exe
  2⤵
  PID:15756
- C:\Windows\System\NedtAPZ.exe
  C:\Windows\System\NedtAPZ.exe
  2⤵
  PID:15784
- C:\Windows\System\vFPTddM.exe
  C:\Windows\System\vFPTddM.exe
  2⤵
  PID:15820
- C:\Windows\System\ABlnCCW.exe
  C:\Windows\System\ABlnCCW.exe
  2⤵
  PID:15840
- C:\Windows\System\NJHimfj.exe
  C:\Windows\System\NJHimfj.exe
  2⤵
  PID:15872
- C:\Windows\System\DilAdWc.exe
  C:\Windows\System\DilAdWc.exe
  2⤵
  PID:15892
- C:\Windows\System\tKigAZa.exe
  C:\Windows\System\tKigAZa.exe
  2⤵
  PID:15928
- C:\Windows\System\qbqnwWL.exe
  C:\Windows\System\qbqnwWL.exe
  2⤵
  PID:15948
- C:\Windows\System\KfUHBeO.exe
  C:\Windows\System\KfUHBeO.exe
  2⤵
  PID:15984
- C:\Windows\System\tWNXQmJ.exe
  C:\Windows\System\tWNXQmJ.exe
  2⤵
  PID:16020
- C:\Windows\System\OYzvBtW.exe
  C:\Windows\System\OYzvBtW.exe
  2⤵
  PID:16040
- C:\Windows\System\pthrfZg.exe
  C:\Windows\System\pthrfZg.exe
  2⤵
  PID:16060
- C:\Windows\System\XMtmcGw.exe
  C:\Windows\System\XMtmcGw.exe
  2⤵
  PID:16076
- C:\Windows\System\PXMHASn.exe
  C:\Windows\System\PXMHASn.exe
  2⤵
  PID:16104
- C:\Windows\System\fuPvedH.exe
  C:\Windows\System\fuPvedH.exe
  2⤵
  PID:16128
- C:\Windows\System\EYeusaL.exe
  C:\Windows\System\EYeusaL.exe
  2⤵
  PID:16152
- C:\Windows\System\fWhgiWc.exe
  C:\Windows\System\fWhgiWc.exe
  2⤵
  PID:16184
- C:\Windows\System\gKBpAPu.exe
  C:\Windows\System\gKBpAPu.exe
  2⤵
  PID:16204
- C:\Windows\System\pVZGtvD.exe
  C:\Windows\System\pVZGtvD.exe
  2⤵
  PID:16232
- C:\Windows\System\HEFKdJV.exe
  C:\Windows\System\HEFKdJV.exe
  2⤵
  PID:16260
- C:\Windows\System\ZPeDKsc.exe
  C:\Windows\System\ZPeDKsc.exe
  2⤵
  PID:16284
- C:\Windows\System\rrZbqWn.exe
  C:\Windows\System\rrZbqWn.exe
  2⤵
  PID:16300
- C:\Windows\System\UgFXIba.exe
  C:\Windows\System\UgFXIba.exe
  2⤵
  PID:16324
- C:\Windows\System\LNWkuVA.exe
  C:\Windows\System\LNWkuVA.exe
  2⤵
  PID:16348
- C:\Windows\System\ufOZoYz.exe
  C:\Windows\System\ufOZoYz.exe
  2⤵
  PID:16372
- C:\Windows\System\BUzXuIt.exe
  C:\Windows\System\BUzXuIt.exe
  2⤵
  PID:14136
- C:\Windows\System\qmrCNLh.exe
  C:\Windows\System\qmrCNLh.exe
  2⤵
  PID:15308
- C:\Windows\System\hhxrACY.exe
  C:\Windows\System\hhxrACY.exe
  2⤵
  PID:14312
- C:\Windows\System\XqySisF.exe
  C:\Windows\System\XqySisF.exe
  2⤵
  PID:15032
- C:\Windows\System\DMChYSg.exe
  C:\Windows\System\DMChYSg.exe
  2⤵
  PID:14708
- C:\Windows\System\vvQEWRJ.exe
  C:\Windows\System\vvQEWRJ.exe
  2⤵
  PID:14852
- C:\Windows\System\sjYOmPQ.exe
  C:\Windows\System\sjYOmPQ.exe
  2⤵
  PID:15380
- C:\Windows\System\YSuSPcR.exe
  C:\Windows\System\YSuSPcR.exe
  2⤵
  PID:15484
- C:\Windows\System\HLnMbGk.exe
  C:\Windows\System\HLnMbGk.exe
  2⤵
  PID:15568
- C:\Windows\System\oYzUhss.exe
  C:\Windows\System\oYzUhss.exe
  2⤵
  PID:16388
- C:\Windows\System\HInLuEE.exe
  C:\Windows\System\HInLuEE.exe
  2⤵
  PID:16408
- C:\Windows\System\zhfgleW.exe
  C:\Windows\System\zhfgleW.exe
  2⤵
  PID:16440
- C:\Windows\System\YVHRHIt.exe
  C:\Windows\System\YVHRHIt.exe
  2⤵
  PID:16476
- C:\Windows\System\ZBRwdwJ.exe
  C:\Windows\System\ZBRwdwJ.exe
  2⤵
  PID:16504
- C:\Windows\System\XzijdlJ.exe
  C:\Windows\System\XzijdlJ.exe
  2⤵
  PID:16520
- C:\Windows\System\RTeSxyz.exe
  C:\Windows\System\RTeSxyz.exe
  2⤵
  PID:16544
- C:\Windows\System\EkQDiKb.exe
  C:\Windows\System\EkQDiKb.exe
  2⤵
  PID:16564
- C:\Windows\System\rFbKNJc.exe
  C:\Windows\System\rFbKNJc.exe
  2⤵
  PID:16584
- C:\Windows\System\OTRPbYG.exe
  C:\Windows\System\OTRPbYG.exe
  2⤵
  PID:16608
- C:\Windows\System\cNhyvaM.exe
  C:\Windows\System\cNhyvaM.exe
  2⤵
  PID:16644
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16644 -s 248
    3⤵
    PID:12084
- C:\Windows\System\umPSIec.exe
  C:\Windows\System\umPSIec.exe
  2⤵
  PID:16660
- C:\Windows\System\LXISmYs.exe
  C:\Windows\System\LXISmYs.exe
  2⤵
  PID:16692
- C:\Windows\System\LTFverM.exe
  C:\Windows\System\LTFverM.exe
  2⤵
  PID:16716
- C:\Windows\System\FoDtLFI.exe
  C:\Windows\System\FoDtLFI.exe
  2⤵
  PID:16732
- C:\Windows\System\pvWlTWj.exe
  C:\Windows\System\pvWlTWj.exe
  2⤵
  PID:16756
- C:\Windows\System\eQVAVOh.exe
  C:\Windows\System\eQVAVOh.exe
  2⤵
  PID:16780
- C:\Windows\System\qjMdeyy.exe
  C:\Windows\System\qjMdeyy.exe
  2⤵
  PID:16804
- C:\Windows\System\ygSnhoA.exe
  C:\Windows\System\ygSnhoA.exe
  2⤵
  PID:16828
- C:\Windows\System\mALaimx.exe
  C:\Windows\System\mALaimx.exe
  2⤵
  PID:16848
- C:\Windows\System\zWBQIgU.exe
  C:\Windows\System\zWBQIgU.exe
  2⤵
  PID:16868
- C:\Windows\System\NKTjUkM.exe
  C:\Windows\System\NKTjUkM.exe
  2⤵
  PID:16900
- C:\Windows\System\NLKDAcB.exe
  C:\Windows\System\NLKDAcB.exe
  2⤵
  PID:16924
- C:\Windows\System\dZenpqS.exe
  C:\Windows\System\dZenpqS.exe
  2⤵
  PID:16952
- C:\Windows\System\uQKsJoR.exe
  C:\Windows\System\uQKsJoR.exe
  2⤵
  PID:16968
- C:\Windows\System\BpqcAWB.exe
  C:\Windows\System\BpqcAWB.exe
  2⤵
  PID:16984
- C:\Windows\System\elUGwll.exe
  C:\Windows\System\elUGwll.exe
  2⤵
  PID:17000
- C:\Windows\System\CCGSowM.exe
  C:\Windows\System\CCGSowM.exe
  2⤵
  PID:17016
- C:\Windows\System\NigoHpu.exe
  C:\Windows\System\NigoHpu.exe
  2⤵
  PID:17032
- C:\Windows\System\pnhhrAC.exe
  C:\Windows\System\pnhhrAC.exe
  2⤵
  PID:17072
- C:\Windows\System\PeqxKhS.exe
  C:\Windows\System\PeqxKhS.exe
  2⤵
  PID:17100
- C:\Windows\System\tStbsiE.exe
  C:\Windows\System\tStbsiE.exe
  2⤵
  PID:17116
- C:\Windows\System\QLAbslX.exe
  C:\Windows\System\QLAbslX.exe
  2⤵
  PID:17132
- C:\Windows\System\tHqdWAz.exe
  C:\Windows\System\tHqdWAz.exe
  2⤵
  PID:17148
- C:\Windows\System\UVWAFsw.exe
  C:\Windows\System\UVWAFsw.exe
  2⤵
  PID:17176
- C:\Windows\System\hjhvPHt.exe
  C:\Windows\System\hjhvPHt.exe
  2⤵
  PID:17192
- C:\Windows\System\mEpZQeE.exe
  C:\Windows\System\mEpZQeE.exe
  2⤵
  PID:17220
- C:\Windows\System\dYDYOLn.exe
  C:\Windows\System\dYDYOLn.exe
  2⤵
  PID:17240
- C:\Windows\System\NPlHPxe.exe
  C:\Windows\System\NPlHPxe.exe
  2⤵
  PID:17272
- C:\Windows\System\SZkLqbX.exe
  C:\Windows\System\SZkLqbX.exe
  2⤵
  PID:17308
- C:\Windows\System\tvAfjNQ.exe
  C:\Windows\System\tvAfjNQ.exe
  2⤵
  PID:17324
- C:\Windows\System\AMRMtMo.exe
  C:\Windows\System\AMRMtMo.exe
  2⤵
  PID:17340
- C:\Windows\System\GTuDEFR.exe
  C:\Windows\System\GTuDEFR.exe
  2⤵
  PID:17356
- C:\Windows\System\TAWbBkR.exe
  C:\Windows\System\TAWbBkR.exe
  2⤵
  PID:17372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BwPVtMq.exe

Filesize
1.6MB

MD5
5568627852c9b59e41be0fe52d15ca8f

SHA1
f1d1c46fedc40047f9314cf4cb94a67784273856

SHA256
c9b6e943acbd7e947ad74587c9d85c4c2d787a14bf52896d58f96d5abeca1812

SHA512
8b5102e4eb5373067e69566576f49fa75b833c6b2ff0b8249bd8c8af57c276dbafb9522cdd3fdd7b69d1ecbe4d72685dbb02d95544387ef3cb1d34d53cecb91c

Download Submit
C:\Windows\System\DaYJPmz.exe

Filesize
1.6MB

MD5
ab15d0ee6da447044778fe2422f2eaad

SHA1
97c86e295bbd841f50d00807731d6743cf4feaf4

SHA256
9c1da447403d72dd29929b27984d93211506aa1ad56ed57c24877010ae1595b6

SHA512
b88d22c80cc0a0ee65107abb324e7becef4b613ab5037bb1eeca8aebee4394cf1b87d10d99bd776390c90a40fc4be6667932e19c89280dcddb3921be249c772c

Download Submit
C:\Windows\System\EKMdtmv.exe

Filesize
1.6MB

MD5
b8b45a9b1f5766eebca071fbee40ba52

SHA1
8c6166f4488b48b12ca669502e4d8c6a2687ac82

SHA256
e334a26e597c3524ada8e97e0b65c8bf65c0e5a1e4d7f5a5e92dde7e1f7938d2

SHA512
938f60c3d35928bb7f093e5c6c30833eb20a728e9ee97756e5a56f0b26b17551a12f02982050f9899886dad0238eec5360d591d5ed6a084378887fc5fc9e9bb2

Download Submit
C:\Windows\System\ExzuBrL.exe

Filesize
1.6MB

MD5
23c665f91e84fe8080bb15d638cf4b40

SHA1
acaac1d04b1db653b4e23f2ab979738033a94a35

SHA256
4f9ba8ba94664090b9917d581dc97291227777e2044242082c27ea0bf35f629a

SHA512
c5d83df0e3ca15487bb872b369383c7e481e668b7bab93b3a08d97417c70708fe55310fc763f0c57d02792df4cb11482f4a375d12f3c9f0dc75a8ba1f5d86057

Download Submit
C:\Windows\System\FgOiZRQ.exe

Filesize
1.6MB

MD5
df40d97b5362b06fed32a0166ad080a5

SHA1
55c0204d13e2144187f9eeaa1193095455907ded

SHA256
1cd0b8ebf9d7206ea8f4c73dc4d4784972ca0e064d38e935dfc6effe34a0800c

SHA512
1fc52d12fa5db1e1a6c1e686c228fb9188f76480bd969a7a056b8d974b002ecf530ffeb22d9f1ff66c4b85b3e36994dcbf9fc79e37023e4ffa9c87b986c9104b

Download Submit
C:\Windows\System\HjYRTrI.exe

Filesize
1.6MB

MD5
3b0587e6e329eb7fc6d8fce1d2c9848c

SHA1
59c6d1dfddf52b89013b6da3c5e53762d237d1a4

SHA256
1cc69c56cef617b7f5520718b9827b02826e9b90438bc0321bf431adf73b2c8d

SHA512
6e9496f12e7fe1c6e394f7f6d087ea06a0c3a641f0d50c5acb32159092967db3f21a84607479e226edfb49e8fff9b5d3a079bb6e2ae4ac7e6f2e18ae88ed99fe

Download Submit
C:\Windows\System\IwuwSxr.exe

Filesize
1.6MB

MD5
69d2990bc7a7eea71d85fc0939eeec71

SHA1
570c2b1d77c409285930de412f9389fcb1113974

SHA256
42e22629217a19ee2a2bb9345b7ba1782d0928c9b39af33a3be83d16e077cd05

SHA512
82d70cb3bc945182834286fa3ae3eaa08bf2912ecf125606c61d47a5972fb1b33cbbb6de8286990091a5f3420d2cbea79f181e810c9a2b4f5a608108074cb99a

Download Submit
C:\Windows\System\IzcSJqH.exe

Filesize
1.6MB

MD5
277e2857537572d28e0b4dfaf8a459e2

SHA1
e6b63dc80898eebe9dbb2bfcc4acf299bd213537

SHA256
5b4b45320f92fd7f3b6665b92ec9be74f490c23808c9c14587bc625c4f9009be

SHA512
33ed3fd0f15f3f88d49ad655036a409e3554f4ec92e8aa82ab08ce2308ea9d10bc0e808d58e5885d9a347ed782a6d1370a27f61151453e99b1c11d79e2e12c4d

Download Submit
C:\Windows\System\KfCmBWx.exe

Filesize
1.6MB

MD5
2a56db7c1ba176427f44dbd833aa63b1

SHA1
7a33f107c84f33cb11e19c8f2ea8ffd8fcd17179

SHA256
2f7d0ccb02423e9080cf84f0febd05c22f647f783c18cb7446648803da1c7a1b

SHA512
b0ce4a744692ba10933b6d0c36451fbcfe95bc5551923c2cc44775ccd635f045dc9465ee6d9bbe18a1219a4e46edee69dd8fd9c77e3f0c4fef5533166242df02

Download Submit
C:\Windows\System\KxSXshE.exe

Filesize
1.6MB

MD5
7e3645adcff92fe8754a6f42e7ee3ab2

SHA1
642539e56c58e32401833ef431b3d23115700278

SHA256
2f4bd1576a81a03b0b840ab08dbfa7bec707399386fa5cfba7a0bf17c0850e44

SHA512
1c32fe0995a85ce0a4d080f3cd5664f56f16ba6ce92cc8a5d62ff666334369c67339d40556353f256262c5efa45303e316e05fe7d90d21366e806f3a2577689b

Download Submit
C:\Windows\System\VeKUvkj.exe

Filesize
1.6MB

MD5
72ca9fb480f1ad7cee848b49a7bb234b

SHA1
296b9fa85b06114fcc04e34323bfd083f810de92

SHA256
b98a58dc08649b117efc3c38906b8bc63a2ec3c2bb6a70e67bb2090832b31407

SHA512
97c8bfacbbd9ed61c10adad5f95946acecc8e1e5627de1eddcaea8e8d10bb37ac88ba75c5cf8c96ba867b54508b02703efc376593ae61f957217cf1033aa1c71

Download Submit
C:\Windows\System\ZsdzQiT.exe

Filesize
1.6MB

MD5
748e5a865cf15ad226fe4e131c1d747f

SHA1
deffc2b4dac1d92b839a928d374bf07220d40254

SHA256
d22ed74d11c945440da0cefaadabb04af6973917931975e94ab23a7361c9ac2e

SHA512
b5a276f1e3a47fb1c70587d14814e129f5c445ddf0e6f5f4838ebd77263caf62f0da3aeeb1a9840e1dc7917e73262dc9f3f780d54891ec74898e092a0f5b5f16

Download Submit
C:\Windows\System\bQHUTQy.exe

Filesize
1.6MB

MD5
6c0a907e7b20e81eb4c394038f59f215

SHA1
a544c82702b12286a6068a0bda709375af1ac7a4

SHA256
c2c18a4579b2d0d605c61441cdef0a4114fd538d8837009de9ef0221cbc3d7f8

SHA512
a12898455e884cd306250831a6f01f708d1cacfd1fb58fe81b00a271d6f5507723455afafa34d3945670716c38f7b2233b79b245f98ebc682f9e7fcf391b75cf

Download Submit
C:\Windows\System\cerPiyw.exe

Filesize
1.6MB

MD5
340a912c041ec6347cc6696f0af23dce

SHA1
7329ad213a0296c2a962a681b4ac2a598ca5d2af

SHA256
6d50cfb01cf3c4bb8dee9bad17dc740a170c2ec43faf54f879914e9199c722cf

SHA512
75c3dc10a4c72929fbb63c90a7b409b02c1508cf0bc6079f890760f7aba3b9d228e5a478fd00db1f441626723b016bd13aab4522f00135f84f8b2624f60b5cd8

Download Submit
C:\Windows\System\gGnEpkc.exe

Filesize
1.6MB

MD5
982e1cce27b5a2a3ed63c5668dc294dc

SHA1
77098706c12fd978e9a311b2a8ab695d586ab68d

SHA256
b9ce8b1c1f13b7195c03260ee6faf8d23902784905438323238cdfe322d8c3c6

SHA512
b7f448c36a753ab98ea6fba6af94884014b9eb9508e704626ab7afaa9c278acd50dda75722ee702cab89a6ea131c0c4d4fc96f32fbad271c6ae5f7ed38002668

Download Submit
C:\Windows\System\gkCBMQy.exe

Filesize
1.6MB

MD5
20bccd9e3b5a634ce2732889e09aa3b3

SHA1
5c791bff6c90ca93fb297807270b1e5a31c8bbc9

SHA256
68ddddd4a78135c69b05070f554339a9eae312cc6e0b85ecdc27dc9f554fc336

SHA512
f83acbe8212266a941a9187129d11dc33e29300d8b9f51bccb341dc4dd276fd013349d00b8af2c99864f8e5105e49baf5ec3c2bfabef4bb201e4155d6fff3344

Download Submit
C:\Windows\System\jMLKuOO.exe

Filesize
1.6MB

MD5
f56a79f36b2269eb9742926e863d0a31

SHA1
514723d3c8c4da8385ba7ac8c3ff7ff6a9c287e9

SHA256
dd4ab0184f9988fbcba5a03c76460648a84f9dc46a7097e6735496a800a34c53

SHA512
0c475fdfc5b9438124a97bf0262f0699e6d92058c656ce08333fe97dce0d46be72c99468c7ca5e2f9afb6af5c016af143d92f1a2c68608b64b884bdf60a3cc5d

Download Submit
C:\Windows\System\liocsib.exe

Filesize
1.6MB

MD5
90daecaf2a853a114c3e7dcad09b9d69

SHA1
f5a52c2c7732a0dcc9f7e7eb3a25fe45448d3376

SHA256
7917ee7864bdf7f49712b6e54cad34eeaccace8342a57c527cbe3fc060c7dd95

SHA512
30c4778c9a9018a334f8f348a3d6cf394d9bcaabf975b1c11c2351bde58667ab02c61e394a0a1438f60e91e02958d8b22902c8d397261a5527cf6f36e4c9e678

Download Submit
C:\Windows\System\lxFOovv.exe

Filesize
1.6MB

MD5
20d254b77e0d0363be28cfe45e3ac31c

SHA1
7cbd85b546f84bba08fb0136709a83662e64b552

SHA256
f15f81c7852f92542980c6fa12960a60687ee3de82d5f33dd52feacac2f6026a

SHA512
57370a4a298323a7118cb358f310fd8c8dede38a575bf45d7cf8fb938e4ede66fa81e3bd7ab7aff764a7e3b1c47bef79ecae3a653424cc8891bf48c32464846b

Download Submit
C:\Windows\System\muImFVs.exe

Filesize
1.6MB

MD5
fbf77bd79f90e5ae3bf170a5d2259c4d

SHA1
0e2c178b39f77096edaeed2b0cc6c6d33db8f609

SHA256
4cce6a9e682f6e4998fce5cc02ee85404add63b3fe56565eaf17cff365150c95

SHA512
2c72268b2e40d55235b5323bd5154b27ee87eaea3e7c4806dbb43741d26039afbc2cf7a4d5f7816c5364ff1d77d1c8903ca731ab51f0833eb5c0a14c86232572

Download Submit
C:\Windows\System\nXTKKuy.exe

Filesize
1.6MB

MD5
4d20abdf5ffcf73874441b4e71b8e395

SHA1
c2db9a8640cc47aa3a204cef78c649606e1fae51

SHA256
765afaa484782bee79cd2634c70980598bf64d662a17c1922929619e9d8f0cec

SHA512
d0a06a2ec1f67213260e7fd41df931aa012241154b5c6aa4d2408bda72de6e5b58f4e52dbbab83b7c7d893bcd629755ca5e0569f62b0be2c04c99e9a07645c4e

Download Submit
C:\Windows\System\ntJSNcl.exe

Filesize
1.6MB

MD5
c8683619a613153a6b3709debed3acf2

SHA1
42cabe39272877ccdb55d3a994ddb6bb2e8a8208

SHA256
6ad22f25e39fbd885c6fce6c40930e9644591ad935ed65755288ad100ce1c0a5

SHA512
40c582e297d4b5e0332ec3d8117201b2a69b88b1f7cce97a527c7405d8d8408d5c5c8cf793663b98b0e65c2a5660c4f6e11f38debe037b8b6ea3b07395eafa86

Download Submit
C:\Windows\System\olLMnwr.exe

Filesize
1.6MB

MD5
c39454ba048a0c5f15dd3cdf60ddfb61

SHA1
4edbb4e74fb4a2e2c3f76fb5ac47a8393ff474f8

SHA256
8886d3e28ab2b45f64a831fb3c280ba13cb64c1c2ea41f35d5727b31d852fa3f

SHA512
4705dad0e3c075498a2020d683459d56d595ddf63a8aa0f369ce8d035b138dbb6df8dc3775b4dce91c2499875bfa5c9fb340f7f7f41ca93a967f5d47384adb95

Download Submit
C:\Windows\System\pAanrBH.exe

Filesize
1.6MB

MD5
b2ab587a0a0c01deac6394f771a63446

SHA1
895b43818c143b3d3d4e70162ec6d94616fefadd

SHA256
a9117ea5d174ae2235b868358b91839ba78446a2ccdf1a061d434f68cc657cb8

SHA512
b17c9f6049fc83929a17d0d6b68a857f8b88a49d86b40bb92310c5e23bba16bfccd2a1e69da65066f5bc7a7f45535945102b916ca6a618172221767f222916c2

Download Submit
C:\Windows\System\tEvVqWt.exe

Filesize
1.6MB

MD5
2c424d19108f1b76039e23e0597042cd

SHA1
0343a8e0545fc8e18e38e786ed9fa5aa9a2f4d49

SHA256
d8ea5e07dcc351826f07e23574d1bc35e47924dfd801d3869e15bb6fe7cc6334

SHA512
2740fd3aff4d8ff3aef490ae401fca9b18f1c84c6abb79a31bdb633c1cf779ca594314beb02540f0a00cc8b51d56cc0b6345d792fad6ea341233db9df6db97dd

Download Submit
C:\Windows\System\tusPCsW.exe

Filesize
1.6MB

MD5
ff467aa40307f285731a295f06ef1e28

SHA1
6833261699bb722c76cb876c95816d271de5c212

SHA256
ae02d6d15d85636c94e05f4e65391213a7afc991d0887bb5d3dc80dac2fa6f3a

SHA512
3de3207cfc80c239cc6ae5c109318579845a458c916bf0407b2db92b06c6a5dadefb34ad36d422dc295b193ecd94151f9d4eb0d6097a659e68e5ed3f2222492e

Download Submit
C:\Windows\System\uqSLzeU.exe

Filesize
1.6MB

MD5
2b44362bf64cbd9ca78e4987a9b8395b

SHA1
36d33fd8bfc29f2709b52f6a385a76b675ea0d11

SHA256
129150f3e4b1681cddcf9da119eedacef00796ae4fe8087383dd612729fbdb6b

SHA512
20f3539750e77490a3ed5e3ea48e824c99b2f7abdb6febb41f9795fd6bdf78bdc35dbe6ce0d4aadbcc607dc9423e5cd021095f03164f1317a9ace67360d1eb39

Download Submit
C:\Windows\System\vZkKoYN.exe

Filesize
1.6MB

MD5
4ae14808b06511a659622e79916c4674

SHA1
f8b3e142a311e5a53a821b894a33b3373dcfa31b

SHA256
4c21ce06afb57ace2409d758941623139f790debc06fc3f17abb1f9997b14880

SHA512
491c9b5b667270efdb5524ae47d09582be95341cfc03b62fc4509df06f747719212d0566371818464f178015b9cdab36f9fcfa10392f7d640504406f8cc12ee0

Download Submit
C:\Windows\System\wBaLcBv.exe

Filesize
1.6MB

MD5
2e642f82be25cb374526aa4022c33227

SHA1
74b19c4b129eba18bb4d2018b2433da137c4ab90

SHA256
cef33662d181aa69a0cb77715cd564e7e79a96cad606b1678706eedbcbb6757e

SHA512
1337d8962334e158eb4afa2839e3bd7e70d82ad873ee747422e74d1d9279eac01e0e00dc02e03701b4d9d18199dd428871ecca3aa5f7f8c20cd917258f69316a

Download Submit
C:\Windows\System\xIwUoDf.exe

Filesize
1.6MB

MD5
3bc5d20d5c975d20cb9b8b94c6ed7820

SHA1
e310ac7efdfdd717265f7258406bf5a0bd754f17

SHA256
68df623c76b4b51ee6caf5356c5d0b94f358886a664c720e646f4ef721bac52f

SHA512
ee17cd95e7d33ff9325653840bf0972cc6531919e0100657cc556f39408de2434cda1f3c7411f4e903640c0ce3df528c81b4b781ce718bf98cfff38c4dc03bf3

Download Submit
C:\Windows\System\xojoxsC.exe

Filesize
1.6MB

MD5
59673c93ca723838a2416eac6f0a9fde

SHA1
f23358e3fb31767fcbb4ffa1e9cd9a3128bf00c5

SHA256
86dae8bf4f341221f149ac6b1620ff41594079af33e8b89ebfba0b0b3be779b2

SHA512
d7126210546724d9639dbb491abe6f6122da1f299580f464c2754989d2d914e038b9f79d9b018a499a39baf6227d1eefaddb986bd86b3339fc21a4244788d059

Download Submit
C:\Windows\System\xvxdeyR.exe

Filesize
1.6MB

MD5
18e20055d3e3c144a0d481df1185507b

SHA1
8680189bc35ab7472df9aa57d1da5576d22e32e0

SHA256
b06c26995596cf86bb818a43ccdd78bdcb09413176324fa4254ab3a58929ac98

SHA512
861a96d5f3add3cff34fae03e3a030d9c211d2800ffe01c6ade5f3d4dc08343f67c1102dafd6521761359f5da5042216dfe9fd5d0a31ef1a1f794864a9c4474d

Download Submit
C:\Windows\System\zOvCJDQ.exe

Filesize
1.6MB

MD5
7d43ed72c90bb7f69122195e85619600

SHA1
f86f2b07af393ab9d58ad30efd0f7995ceff0582

SHA256
a75e886d247857a830492aa821a80069fdac42eaa083e1af48236debb34509a0

SHA512
c7fb68c53f5928aee00897b0f483122cf6bd7e5f17623be76ad3b1543499abe2de43d01de55c4667729e374277ca250d330ce9263896f936c494ac201245c19e

Download Submit
memory/4768-0-0x0000026F22600000-0x0000026F22610000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads