xmrig | aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544

Analysis

max time kernel
93s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
Size

1.3MB
MD5

2499a2eb1ceb49beb03d0b5ccd067008
SHA1

63a4999fd344b4130b30fbb232e450082bbbaced
SHA256

aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544
SHA512

d27dfaa03fcd042ad4f88f25cac837dc3dc6f5e40b6bf26a7030f828a7ae3257d27cf6fa3b819dc148e298e346a4e4fce67c097c4ddaf2d308bc256a97f912f1
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrSx2mOIm709Bs/:GezaTF8FcNkNdfE0pZ9ozttwIRQeb6ge

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c01-4.dat	xmrig
behavioral2/files/0x0008000000023c9d-9.dat	xmrig
behavioral2/files/0x0007000000023c9e-8.dat	xmrig
behavioral2/files/0x0007000000023ca0-23.dat	xmrig
behavioral2/files/0x0007000000023ca1-29.dat	xmrig
behavioral2/files/0x0007000000023c9f-20.dat	xmrig
behavioral2/files/0x0007000000023ca2-36.dat	xmrig
behavioral2/files/0x0007000000023ca3-37.dat	xmrig
behavioral2/files/0x0007000000023ca4-44.dat	xmrig
behavioral2/files/0x0007000000023ca5-55.dat	xmrig
behavioral2/files/0x0008000000023c9b-52.dat	xmrig
behavioral2/files/0x0007000000023ca6-59.dat	xmrig
behavioral2/files/0x0007000000023ca7-63.dat	xmrig
behavioral2/files/0x0007000000023ca8-69.dat	xmrig
behavioral2/files/0x0007000000023caa-72.dat	xmrig
behavioral2/files/0x0007000000023cab-78.dat	xmrig
behavioral2/files/0x0007000000023cac-85.dat	xmrig
behavioral2/files/0x0007000000023cae-89.dat	xmrig
behavioral2/files/0x0007000000023caf-96.dat	xmrig
behavioral2/files/0x0007000000023cb1-102.dat	xmrig
behavioral2/files/0x0007000000023cb2-108.dat	xmrig
behavioral2/files/0x0007000000023cb0-103.dat	xmrig
behavioral2/files/0x0007000000023cb3-113.dat	xmrig
behavioral2/files/0x0007000000023cb4-118.dat	xmrig
behavioral2/files/0x0007000000023cb5-124.dat	xmrig
behavioral2/files/0x0007000000023cb6-129.dat	xmrig
behavioral2/files/0x0007000000023cb7-132.dat	xmrig
behavioral2/files/0x0007000000023cb8-140.dat	xmrig
behavioral2/files/0x0007000000023cb9-145.dat	xmrig
behavioral2/files/0x0007000000023cba-149.dat	xmrig
behavioral2/files/0x0007000000023cbb-152.dat	xmrig
behavioral2/files/0x0007000000023cbc-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4500	NmhgnQu.exe
1052	edysFBG.exe
4976	qNCImwc.exe
3584	UQtMfkC.exe
2520	PoKrlGE.exe
4448	HglTNVq.exe
1520	NVqQHZX.exe
848	rKECVGG.exe
2276	HIGslAW.exe
4644	qEcCQRj.exe
2872	YwtlrAR.exe
2928	BWPHEoh.exe
2992	wgsLkDQ.exe
2172	QsciFTy.exe
1884	fYkPSzy.exe
1544	pHgjEtG.exe
208	WtMKoTH.exe
4292	wBdvioq.exe
3048	sISsxPO.exe
2724	MVvKScb.exe
5084	eIBIIZr.exe
4708	jnlXjCe.exe
2240	XmiNNqc.exe
4304	RwKDXhX.exe
2168	wAZIyqp.exe
4744	MPYplOj.exe
1524	GXHtTZD.exe
2720	XcLEfUZ.exe
1700	sYemSFP.exe
4596	vRdFOfp.exe
4924	tKVQHHe.exe
904	Thlfkyv.exe
3324	sxotEyb.exe
4688	RwTqUjY.exe
4836	UZMJceq.exe
660	UsdMzfH.exe
2524	zhjHIPq.exe
4432	zmSwCzR.exe
4740	AVYrXJt.exe
3836	UdmUngV.exe
5096	xaFRogH.exe
4116	LCQYVvi.exe
3092	DufYtwm.exe
3376	yAkNQxX.exe
3940	fclSGZy.exe
1480	ixAcLuM.exe
792	cIoYKMK.exe
4336	QqcYQRT.exe
2268	iekVHfX.exe
2868	dyJVoAv.exe
3340	JkUDaak.exe
2032	hkgVtmh.exe
4268	IaFdCar.exe
5116	HXSapUt.exe
4508	rPpgLHX.exe
5012	cZMNHaA.exe
2688	uMbECJE.exe
2816	GwzsgbR.exe
2112	xhgBMAt.exe
3644	DxvYIQm.exe
3624	deCAUGw.exe
1644	fQSrCeg.exe
1408	ydaGEuO.exe
2228	PMxNylG.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NJMwJZV.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\sUBKSMZ.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\yLgJPkN.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\vCHYGAT.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\umGVLCW.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\cgnkLWY.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\CZWwobW.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\klwttZP.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\JGDFsSv.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\nNXjgjJ.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\iQUcdMM.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\bFbfuDS.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\YNIphom.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\yQfrZnD.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\CyjyoWe.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\EVlmkiI.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\iYCqmUy.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\RgkOAUZ.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\EzLtnKx.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\TGXAHvX.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\AwkeMwW.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\ccDVVOT.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\HJwIGKL.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\kbWJmaU.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\SVsRtrm.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\bEAWdYK.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\DXnZXND.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\wflqxvO.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\xEwBoRK.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\FrkNGbp.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\cKQUXCi.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\VHFlrXa.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\uunaCzM.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\dccfmRA.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\IVyyrSy.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\RzYSNhg.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\gZqZCMt.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\AqOuHyc.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\MsBbfmu.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\xvGLeyV.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\mWTtlpD.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\JsKLNTn.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\fDidPrV.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\pgsZMKf.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\qFpbtfV.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\KolbayD.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\dYCnjiw.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\MDuHLpf.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\gHZPfAT.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\hlLmcrq.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\bvwiHBK.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\syJYiqr.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\SFZKysp.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\RokcPym.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\GmXDzHj.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\XQelbur.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\aJayHHz.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\TLsOfTL.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\jnGquJR.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\IHtvFMU.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\BiTwlvW.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\uaUgxZf.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\VEefShD.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
File created	C:\Windows\System\HKDykaa.exe	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4500	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	83
PID 3316 wrote to memory of 4500	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	83
PID 3316 wrote to memory of 1052	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	84
PID 3316 wrote to memory of 1052	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	84
PID 3316 wrote to memory of 4976	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	85
PID 3316 wrote to memory of 4976	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	85
PID 3316 wrote to memory of 3584	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	86
PID 3316 wrote to memory of 3584	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	86
PID 3316 wrote to memory of 2520	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	87
PID 3316 wrote to memory of 2520	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	87
PID 3316 wrote to memory of 4448	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	88
PID 3316 wrote to memory of 4448	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	88
PID 3316 wrote to memory of 1520	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	89
PID 3316 wrote to memory of 1520	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	89
PID 3316 wrote to memory of 848	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	90
PID 3316 wrote to memory of 848	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	90
PID 3316 wrote to memory of 2276	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	91
PID 3316 wrote to memory of 2276	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	91
PID 3316 wrote to memory of 4644	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	92
PID 3316 wrote to memory of 4644	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	92
PID 3316 wrote to memory of 2872	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	93
PID 3316 wrote to memory of 2872	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	93
PID 3316 wrote to memory of 2928	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	94
PID 3316 wrote to memory of 2928	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	94
PID 3316 wrote to memory of 2992	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	95
PID 3316 wrote to memory of 2992	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	95
PID 3316 wrote to memory of 2172	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	96
PID 3316 wrote to memory of 2172	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	96
PID 3316 wrote to memory of 1884	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	97
PID 3316 wrote to memory of 1884	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	97
PID 3316 wrote to memory of 1544	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	98
PID 3316 wrote to memory of 1544	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	98
PID 3316 wrote to memory of 208	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	99
PID 3316 wrote to memory of 208	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	99
PID 3316 wrote to memory of 4292	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	100
PID 3316 wrote to memory of 4292	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	100
PID 3316 wrote to memory of 3048	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	101
PID 3316 wrote to memory of 3048	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	101
PID 3316 wrote to memory of 2724	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	102
PID 3316 wrote to memory of 2724	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	102
PID 3316 wrote to memory of 5084	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	103
PID 3316 wrote to memory of 5084	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	103
PID 3316 wrote to memory of 4708	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	104
PID 3316 wrote to memory of 4708	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	104
PID 3316 wrote to memory of 2240	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	105
PID 3316 wrote to memory of 2240	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	105
PID 3316 wrote to memory of 4304	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	106
PID 3316 wrote to memory of 4304	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	106
PID 3316 wrote to memory of 2168	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	107
PID 3316 wrote to memory of 2168	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	107
PID 3316 wrote to memory of 4744	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	108
PID 3316 wrote to memory of 4744	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	108
PID 3316 wrote to memory of 1524	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	109
PID 3316 wrote to memory of 1524	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	109
PID 3316 wrote to memory of 2720	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	110
PID 3316 wrote to memory of 2720	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	110
PID 3316 wrote to memory of 1700	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	111
PID 3316 wrote to memory of 1700	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	111
PID 3316 wrote to memory of 4596	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	112
PID 3316 wrote to memory of 4596	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	112
PID 3316 wrote to memory of 4924	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	113
PID 3316 wrote to memory of 4924	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	113
PID 3316 wrote to memory of 904	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	114
PID 3316 wrote to memory of 904	3316	aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe	114

C:\Users\Admin\AppData\Local\Temp\aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe
"C:\Users\Admin\AppData\Local\Temp\aa64ab30c32c750241e741ffa24e2e4d15043fca22c688d6c0871e111daad544.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\System\NmhgnQu.exe
  C:\Windows\System\NmhgnQu.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\edysFBG.exe
  C:\Windows\System\edysFBG.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\qNCImwc.exe
  C:\Windows\System\qNCImwc.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\UQtMfkC.exe
  C:\Windows\System\UQtMfkC.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\PoKrlGE.exe
  C:\Windows\System\PoKrlGE.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\HglTNVq.exe
  C:\Windows\System\HglTNVq.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\NVqQHZX.exe
  C:\Windows\System\NVqQHZX.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\rKECVGG.exe
  C:\Windows\System\rKECVGG.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\HIGslAW.exe
  C:\Windows\System\HIGslAW.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\qEcCQRj.exe
  C:\Windows\System\qEcCQRj.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\YwtlrAR.exe
  C:\Windows\System\YwtlrAR.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\BWPHEoh.exe
  C:\Windows\System\BWPHEoh.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\wgsLkDQ.exe
  C:\Windows\System\wgsLkDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\QsciFTy.exe
  C:\Windows\System\QsciFTy.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\fYkPSzy.exe
  C:\Windows\System\fYkPSzy.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\pHgjEtG.exe
  C:\Windows\System\pHgjEtG.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\WtMKoTH.exe
  C:\Windows\System\WtMKoTH.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\wBdvioq.exe
  C:\Windows\System\wBdvioq.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\sISsxPO.exe
  C:\Windows\System\sISsxPO.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\MVvKScb.exe
  C:\Windows\System\MVvKScb.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\eIBIIZr.exe
  C:\Windows\System\eIBIIZr.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\jnlXjCe.exe
  C:\Windows\System\jnlXjCe.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\XmiNNqc.exe
  C:\Windows\System\XmiNNqc.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\RwKDXhX.exe
  C:\Windows\System\RwKDXhX.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\wAZIyqp.exe
  C:\Windows\System\wAZIyqp.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\MPYplOj.exe
  C:\Windows\System\MPYplOj.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\GXHtTZD.exe
  C:\Windows\System\GXHtTZD.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\XcLEfUZ.exe
  C:\Windows\System\XcLEfUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\sYemSFP.exe
  C:\Windows\System\sYemSFP.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\vRdFOfp.exe
  C:\Windows\System\vRdFOfp.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\tKVQHHe.exe
  C:\Windows\System\tKVQHHe.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\Thlfkyv.exe
  C:\Windows\System\Thlfkyv.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\sxotEyb.exe
  C:\Windows\System\sxotEyb.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\RwTqUjY.exe
  C:\Windows\System\RwTqUjY.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\UZMJceq.exe
  C:\Windows\System\UZMJceq.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\UsdMzfH.exe
  C:\Windows\System\UsdMzfH.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\zhjHIPq.exe
  C:\Windows\System\zhjHIPq.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\zmSwCzR.exe
  C:\Windows\System\zmSwCzR.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\AVYrXJt.exe
  C:\Windows\System\AVYrXJt.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\UdmUngV.exe
  C:\Windows\System\UdmUngV.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\xaFRogH.exe
  C:\Windows\System\xaFRogH.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\LCQYVvi.exe
  C:\Windows\System\LCQYVvi.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\DufYtwm.exe
  C:\Windows\System\DufYtwm.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\yAkNQxX.exe
  C:\Windows\System\yAkNQxX.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\fclSGZy.exe
  C:\Windows\System\fclSGZy.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\ixAcLuM.exe
  C:\Windows\System\ixAcLuM.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\cIoYKMK.exe
  C:\Windows\System\cIoYKMK.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\QqcYQRT.exe
  C:\Windows\System\QqcYQRT.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\iekVHfX.exe
  C:\Windows\System\iekVHfX.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\dyJVoAv.exe
  C:\Windows\System\dyJVoAv.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\JkUDaak.exe
  C:\Windows\System\JkUDaak.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\hkgVtmh.exe
  C:\Windows\System\hkgVtmh.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\IaFdCar.exe
  C:\Windows\System\IaFdCar.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\HXSapUt.exe
  C:\Windows\System\HXSapUt.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\rPpgLHX.exe
  C:\Windows\System\rPpgLHX.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\cZMNHaA.exe
  C:\Windows\System\cZMNHaA.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\uMbECJE.exe
  C:\Windows\System\uMbECJE.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\GwzsgbR.exe
  C:\Windows\System\GwzsgbR.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\xhgBMAt.exe
  C:\Windows\System\xhgBMAt.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\DxvYIQm.exe
  C:\Windows\System\DxvYIQm.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\deCAUGw.exe
  C:\Windows\System\deCAUGw.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\fQSrCeg.exe
  C:\Windows\System\fQSrCeg.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ydaGEuO.exe
  C:\Windows\System\ydaGEuO.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\PMxNylG.exe
  C:\Windows\System\PMxNylG.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\SiSICZA.exe
  C:\Windows\System\SiSICZA.exe
  2⤵
  PID:4348
- C:\Windows\System\RisxtbK.exe
  C:\Windows\System\RisxtbK.exe
  2⤵
  PID:4204
- C:\Windows\System\LISvkYw.exe
  C:\Windows\System\LISvkYw.exe
  2⤵
  PID:3876
- C:\Windows\System\qlcGkHV.exe
  C:\Windows\System\qlcGkHV.exe
  2⤵
  PID:4536
- C:\Windows\System\zjMDNuS.exe
  C:\Windows\System\zjMDNuS.exe
  2⤵
  PID:2844
- C:\Windows\System\FOcKnks.exe
  C:\Windows\System\FOcKnks.exe
  2⤵
  PID:3804
- C:\Windows\System\ZGjSqLf.exe
  C:\Windows\System\ZGjSqLf.exe
  2⤵
  PID:2728
- C:\Windows\System\cUvZerI.exe
  C:\Windows\System\cUvZerI.exe
  2⤵
  PID:5036
- C:\Windows\System\bOoEQHB.exe
  C:\Windows\System\bOoEQHB.exe
  2⤵
  PID:528
- C:\Windows\System\dEyBGFS.exe
  C:\Windows\System\dEyBGFS.exe
  2⤵
  PID:1980
- C:\Windows\System\dPxsKdI.exe
  C:\Windows\System\dPxsKdI.exe
  2⤵
  PID:2040
- C:\Windows\System\FjqrZjh.exe
  C:\Windows\System\FjqrZjh.exe
  2⤵
  PID:384
- C:\Windows\System\jfGaQxY.exe
  C:\Windows\System\jfGaQxY.exe
  2⤵
  PID:4028
- C:\Windows\System\vCHYGAT.exe
  C:\Windows\System\vCHYGAT.exe
  2⤵
  PID:1748
- C:\Windows\System\ZxhXcdZ.exe
  C:\Windows\System\ZxhXcdZ.exe
  2⤵
  PID:3900
- C:\Windows\System\IgaDbYZ.exe
  C:\Windows\System\IgaDbYZ.exe
  2⤵
  PID:2952
- C:\Windows\System\awcEpDO.exe
  C:\Windows\System\awcEpDO.exe
  2⤵
  PID:3160
- C:\Windows\System\ItAeupW.exe
  C:\Windows\System\ItAeupW.exe
  2⤵
  PID:3004
- C:\Windows\System\VMdRddM.exe
  C:\Windows\System\VMdRddM.exe
  2⤵
  PID:1220
- C:\Windows\System\WAKcTwW.exe
  C:\Windows\System\WAKcTwW.exe
  2⤵
  PID:1504
- C:\Windows\System\yuDajrQ.exe
  C:\Windows\System\yuDajrQ.exe
  2⤵
  PID:3356
- C:\Windows\System\XTfQLFO.exe
  C:\Windows\System\XTfQLFO.exe
  2⤵
  PID:3824
- C:\Windows\System\jPouiov.exe
  C:\Windows\System\jPouiov.exe
  2⤵
  PID:724
- C:\Windows\System\oisEPSB.exe
  C:\Windows\System\oisEPSB.exe
  2⤵
  PID:1768
- C:\Windows\System\VmjEwKu.exe
  C:\Windows\System\VmjEwKu.exe
  2⤵
  PID:2336
- C:\Windows\System\eTdsgjw.exe
  C:\Windows\System\eTdsgjw.exe
  2⤵
  PID:4532
- C:\Windows\System\OGWzUXn.exe
  C:\Windows\System\OGWzUXn.exe
  2⤵
  PID:2080
- C:\Windows\System\fFjHWzM.exe
  C:\Windows\System\fFjHWzM.exe
  2⤵
  PID:4280
- C:\Windows\System\IZtHKIz.exe
  C:\Windows\System\IZtHKIz.exe
  2⤵
  PID:3456
- C:\Windows\System\zExGukK.exe
  C:\Windows\System\zExGukK.exe
  2⤵
  PID:3148
- C:\Windows\System\aChWWIT.exe
  C:\Windows\System\aChWWIT.exe
  2⤵
  PID:4956
- C:\Windows\System\nEsQqzZ.exe
  C:\Windows\System\nEsQqzZ.exe
  2⤵
  PID:2588
- C:\Windows\System\RZqwJfm.exe
  C:\Windows\System\RZqwJfm.exe
  2⤵
  PID:2176
- C:\Windows\System\ROuWaen.exe
  C:\Windows\System\ROuWaen.exe
  2⤵
  PID:4732
- C:\Windows\System\qtBEAow.exe
  C:\Windows\System\qtBEAow.exe
  2⤵
  PID:380
- C:\Windows\System\dxEZFiA.exe
  C:\Windows\System\dxEZFiA.exe
  2⤵
  PID:2852
- C:\Windows\System\KvRYXfU.exe
  C:\Windows\System\KvRYXfU.exe
  2⤵
  PID:3628
- C:\Windows\System\MjKhZnM.exe
  C:\Windows\System\MjKhZnM.exe
  2⤵
  PID:2684
- C:\Windows\System\LDYBBOp.exe
  C:\Windows\System\LDYBBOp.exe
  2⤵
  PID:4968
- C:\Windows\System\OITWpjR.exe
  C:\Windows\System\OITWpjR.exe
  2⤵
  PID:2560
- C:\Windows\System\vuqqOqo.exe
  C:\Windows\System\vuqqOqo.exe
  2⤵
  PID:4576
- C:\Windows\System\dACgLLu.exe
  C:\Windows\System\dACgLLu.exe
  2⤵
  PID:5020
- C:\Windows\System\DcCIxkF.exe
  C:\Windows\System\DcCIxkF.exe
  2⤵
  PID:3984
- C:\Windows\System\EnaBYOe.exe
  C:\Windows\System\EnaBYOe.exe
  2⤵
  PID:4252
- C:\Windows\System\TzDgUdl.exe
  C:\Windows\System\TzDgUdl.exe
  2⤵
  PID:3036
- C:\Windows\System\QeuSTtp.exe
  C:\Windows\System\QeuSTtp.exe
  2⤵
  PID:4196
- C:\Windows\System\KxKaMzW.exe
  C:\Windows\System\KxKaMzW.exe
  2⤵
  PID:2436
- C:\Windows\System\WpFVfbn.exe
  C:\Windows\System\WpFVfbn.exe
  2⤵
  PID:3732
- C:\Windows\System\WpMuhoI.exe
  C:\Windows\System\WpMuhoI.exe
  2⤵
  PID:4800
- C:\Windows\System\afyYizp.exe
  C:\Windows\System\afyYizp.exe
  2⤵
  PID:1044
- C:\Windows\System\rdZWQuZ.exe
  C:\Windows\System\rdZWQuZ.exe
  2⤵
  PID:2200
- C:\Windows\System\zLJqXjm.exe
  C:\Windows\System\zLJqXjm.exe
  2⤵
  PID:2576
- C:\Windows\System\nGMQkpx.exe
  C:\Windows\System\nGMQkpx.exe
  2⤵
  PID:2360
- C:\Windows\System\rDhiePK.exe
  C:\Windows\System\rDhiePK.exe
  2⤵
  PID:2460
- C:\Windows\System\WSFJjId.exe
  C:\Windows\System\WSFJjId.exe
  2⤵
  PID:5148
- C:\Windows\System\kAgtqpB.exe
  C:\Windows\System\kAgtqpB.exe
  2⤵
  PID:5168
- C:\Windows\System\IsQIjgo.exe
  C:\Windows\System\IsQIjgo.exe
  2⤵
  PID:5192
- C:\Windows\System\HzLcboW.exe
  C:\Windows\System\HzLcboW.exe
  2⤵
  PID:5224
- C:\Windows\System\kzqREpm.exe
  C:\Windows\System\kzqREpm.exe
  2⤵
  PID:5260
- C:\Windows\System\lUGfSuQ.exe
  C:\Windows\System\lUGfSuQ.exe
  2⤵
  PID:5288
- C:\Windows\System\yNPtOaL.exe
  C:\Windows\System\yNPtOaL.exe
  2⤵
  PID:5308
- C:\Windows\System\IwlZRWY.exe
  C:\Windows\System\IwlZRWY.exe
  2⤵
  PID:5344
- C:\Windows\System\XxHSIQk.exe
  C:\Windows\System\XxHSIQk.exe
  2⤵
  PID:5364
- C:\Windows\System\OGLQAjB.exe
  C:\Windows\System\OGLQAjB.exe
  2⤵
  PID:5396
- C:\Windows\System\rqgdAgl.exe
  C:\Windows\System\rqgdAgl.exe
  2⤵
  PID:5412
- C:\Windows\System\aYgtugK.exe
  C:\Windows\System\aYgtugK.exe
  2⤵
  PID:5440
- C:\Windows\System\eBVimkc.exe
  C:\Windows\System\eBVimkc.exe
  2⤵
  PID:5476
- C:\Windows\System\HjTdrvs.exe
  C:\Windows\System\HjTdrvs.exe
  2⤵
  PID:5504
- C:\Windows\System\YIyCYZY.exe
  C:\Windows\System\YIyCYZY.exe
  2⤵
  PID:5556
- C:\Windows\System\yzVmERa.exe
  C:\Windows\System\yzVmERa.exe
  2⤵
  PID:5572
- C:\Windows\System\umGVLCW.exe
  C:\Windows\System\umGVLCW.exe
  2⤵
  PID:5592
- C:\Windows\System\vNWaKPC.exe
  C:\Windows\System\vNWaKPC.exe
  2⤵
  PID:5628
- C:\Windows\System\rMTVGwa.exe
  C:\Windows\System\rMTVGwa.exe
  2⤵
  PID:5644
- C:\Windows\System\HkPbskn.exe
  C:\Windows\System\HkPbskn.exe
  2⤵
  PID:5664
- C:\Windows\System\RzYSNhg.exe
  C:\Windows\System\RzYSNhg.exe
  2⤵
  PID:5692
- C:\Windows\System\RsSPkHf.exe
  C:\Windows\System\RsSPkHf.exe
  2⤵
  PID:5728
- C:\Windows\System\IjCEkEZ.exe
  C:\Windows\System\IjCEkEZ.exe
  2⤵
  PID:5748
- C:\Windows\System\fEkGeOU.exe
  C:\Windows\System\fEkGeOU.exe
  2⤵
  PID:5784
- C:\Windows\System\TeDvAdT.exe
  C:\Windows\System\TeDvAdT.exe
  2⤵
  PID:5800
- C:\Windows\System\FqHuDql.exe
  C:\Windows\System\FqHuDql.exe
  2⤵
  PID:5852
- C:\Windows\System\KOlHERI.exe
  C:\Windows\System\KOlHERI.exe
  2⤵
  PID:5868
- C:\Windows\System\HCKpSia.exe
  C:\Windows\System\HCKpSia.exe
  2⤵
  PID:5896
- C:\Windows\System\wWsXZPv.exe
  C:\Windows\System\wWsXZPv.exe
  2⤵
  PID:5912
- C:\Windows\System\RerTZWl.exe
  C:\Windows\System\RerTZWl.exe
  2⤵
  PID:5928
- C:\Windows\System\BatyyKW.exe
  C:\Windows\System\BatyyKW.exe
  2⤵
  PID:5948
- C:\Windows\System\LLriYNJ.exe
  C:\Windows\System\LLriYNJ.exe
  2⤵
  PID:5984
- C:\Windows\System\wUHvqPR.exe
  C:\Windows\System\wUHvqPR.exe
  2⤵
  PID:6012
- C:\Windows\System\shgsnyQ.exe
  C:\Windows\System\shgsnyQ.exe
  2⤵
  PID:6036
- C:\Windows\System\VsvUNzy.exe
  C:\Windows\System\VsvUNzy.exe
  2⤵
  PID:6060
- C:\Windows\System\rspqTDq.exe
  C:\Windows\System\rspqTDq.exe
  2⤵
  PID:6108
- C:\Windows\System\MbzlAot.exe
  C:\Windows\System\MbzlAot.exe
  2⤵
  PID:6128
- C:\Windows\System\naACMYh.exe
  C:\Windows\System\naACMYh.exe
  2⤵
  PID:5160
- C:\Windows\System\rZjPyqY.exe
  C:\Windows\System\rZjPyqY.exe
  2⤵
  PID:5204
- C:\Windows\System\PWioImp.exe
  C:\Windows\System\PWioImp.exe
  2⤵
  PID:5272
- C:\Windows\System\TGXAHvX.exe
  C:\Windows\System\TGXAHvX.exe
  2⤵
  PID:5384
- C:\Windows\System\oxGFNNI.exe
  C:\Windows\System\oxGFNNI.exe
  2⤵
  PID:5492
- C:\Windows\System\GMYDHvs.exe
  C:\Windows\System\GMYDHvs.exe
  2⤵
  PID:5564
- C:\Windows\System\XRUtExC.exe
  C:\Windows\System\XRUtExC.exe
  2⤵
  PID:5588
- C:\Windows\System\zypJYqo.exe
  C:\Windows\System\zypJYqo.exe
  2⤵
  PID:5616
- C:\Windows\System\jikihjs.exe
  C:\Windows\System\jikihjs.exe
  2⤵
  PID:5736
- C:\Windows\System\vvStHej.exe
  C:\Windows\System\vvStHej.exe
  2⤵
  PID:5820
- C:\Windows\System\yQTfnxH.exe
  C:\Windows\System\yQTfnxH.exe
  2⤵
  PID:5844
- C:\Windows\System\imRUZwE.exe
  C:\Windows\System\imRUZwE.exe
  2⤵
  PID:5956
- C:\Windows\System\SpYOURC.exe
  C:\Windows\System\SpYOURC.exe
  2⤵
  PID:5972
- C:\Windows\System\eVjTPqZ.exe
  C:\Windows\System\eVjTPqZ.exe
  2⤵
  PID:6048
- C:\Windows\System\SAGklyf.exe
  C:\Windows\System\SAGklyf.exe
  2⤵
  PID:6116
- C:\Windows\System\GrhTIcC.exe
  C:\Windows\System\GrhTIcC.exe
  2⤵
  PID:5136
- C:\Windows\System\GmhVGRN.exe
  C:\Windows\System\GmhVGRN.exe
  2⤵
  PID:5448
- C:\Windows\System\hQFdamc.exe
  C:\Windows\System\hQFdamc.exe
  2⤵
  PID:5500
- C:\Windows\System\eaWlGWh.exe
  C:\Windows\System\eaWlGWh.exe
  2⤵
  PID:5744
- C:\Windows\System\kWwMBjK.exe
  C:\Windows\System\kWwMBjK.exe
  2⤵
  PID:5864
- C:\Windows\System\OuKBjOf.exe
  C:\Windows\System\OuKBjOf.exe
  2⤵
  PID:5940
- C:\Windows\System\qjmsJzM.exe
  C:\Windows\System\qjmsJzM.exe
  2⤵
  PID:6080
- C:\Windows\System\GWOGEmp.exe
  C:\Windows\System\GWOGEmp.exe
  2⤵
  PID:5184
- C:\Windows\System\voJUnGe.exe
  C:\Windows\System\voJUnGe.exe
  2⤵
  PID:5968
- C:\Windows\System\aNmLepO.exe
  C:\Windows\System\aNmLepO.exe
  2⤵
  PID:5884
- C:\Windows\System\gplWjDT.exe
  C:\Windows\System\gplWjDT.exe
  2⤵
  PID:5920
- C:\Windows\System\wzqGhQD.exe
  C:\Windows\System\wzqGhQD.exe
  2⤵
  PID:6168
- C:\Windows\System\hIXDqWn.exe
  C:\Windows\System\hIXDqWn.exe
  2⤵
  PID:6212
- C:\Windows\System\CZWwobW.exe
  C:\Windows\System\CZWwobW.exe
  2⤵
  PID:6240
- C:\Windows\System\OkaMeks.exe
  C:\Windows\System\OkaMeks.exe
  2⤵
  PID:6256
- C:\Windows\System\GHPvSsk.exe
  C:\Windows\System\GHPvSsk.exe
  2⤵
  PID:6284
- C:\Windows\System\dynnRec.exe
  C:\Windows\System\dynnRec.exe
  2⤵
  PID:6312
- C:\Windows\System\rDxnTVJ.exe
  C:\Windows\System\rDxnTVJ.exe
  2⤵
  PID:6332
- C:\Windows\System\ZFnRgvv.exe
  C:\Windows\System\ZFnRgvv.exe
  2⤵
  PID:6364
- C:\Windows\System\motfDkT.exe
  C:\Windows\System\motfDkT.exe
  2⤵
  PID:6404
- C:\Windows\System\stVnbEy.exe
  C:\Windows\System\stVnbEy.exe
  2⤵
  PID:6432
- C:\Windows\System\rFgyTgR.exe
  C:\Windows\System\rFgyTgR.exe
  2⤵
  PID:6460
- C:\Windows\System\gZrjrEw.exe
  C:\Windows\System\gZrjrEw.exe
  2⤵
  PID:6496
- C:\Windows\System\VoAwCAk.exe
  C:\Windows\System\VoAwCAk.exe
  2⤵
  PID:6512
- C:\Windows\System\UrjWJDm.exe
  C:\Windows\System\UrjWJDm.exe
  2⤵
  PID:6560
- C:\Windows\System\xYswMFq.exe
  C:\Windows\System\xYswMFq.exe
  2⤵
  PID:6576
- C:\Windows\System\ALeYQAk.exe
  C:\Windows\System\ALeYQAk.exe
  2⤵
  PID:6604
- C:\Windows\System\ADPiunG.exe
  C:\Windows\System\ADPiunG.exe
  2⤵
  PID:6620
- C:\Windows\System\vuKMCvR.exe
  C:\Windows\System\vuKMCvR.exe
  2⤵
  PID:6652
- C:\Windows\System\IGIOObK.exe
  C:\Windows\System\IGIOObK.exe
  2⤵
  PID:6680
- C:\Windows\System\bFbfuDS.exe
  C:\Windows\System\bFbfuDS.exe
  2⤵
  PID:6708
- C:\Windows\System\XznbyQw.exe
  C:\Windows\System\XznbyQw.exe
  2⤵
  PID:6740
- C:\Windows\System\GxCaNtC.exe
  C:\Windows\System\GxCaNtC.exe
  2⤵
  PID:6772
- C:\Windows\System\NJMwJZV.exe
  C:\Windows\System\NJMwJZV.exe
  2⤵
  PID:6788
- C:\Windows\System\XUdAEKD.exe
  C:\Windows\System\XUdAEKD.exe
  2⤵
  PID:6820
- C:\Windows\System\vOyGEWY.exe
  C:\Windows\System\vOyGEWY.exe
  2⤵
  PID:6844
- C:\Windows\System\JmyIdeY.exe
  C:\Windows\System\JmyIdeY.exe
  2⤵
  PID:6860
- C:\Windows\System\UerHzFS.exe
  C:\Windows\System\UerHzFS.exe
  2⤵
  PID:6924
- C:\Windows\System\aEnjlZm.exe
  C:\Windows\System\aEnjlZm.exe
  2⤵
  PID:6940
- C:\Windows\System\sOQKDHg.exe
  C:\Windows\System\sOQKDHg.exe
  2⤵
  PID:6968
- C:\Windows\System\xulRRZT.exe
  C:\Windows\System\xulRRZT.exe
  2⤵
  PID:6996
- C:\Windows\System\HoBCaVu.exe
  C:\Windows\System\HoBCaVu.exe
  2⤵
  PID:7024
- C:\Windows\System\RTHttjB.exe
  C:\Windows\System\RTHttjB.exe
  2⤵
  PID:7064
- C:\Windows\System\sWolgLn.exe
  C:\Windows\System\sWolgLn.exe
  2⤵
  PID:7084
- C:\Windows\System\JAzxIdC.exe
  C:\Windows\System\JAzxIdC.exe
  2⤵
  PID:7108
- C:\Windows\System\fiMKIyg.exe
  C:\Windows\System\fiMKIyg.exe
  2⤵
  PID:7136
- C:\Windows\System\dZfJjqt.exe
  C:\Windows\System\dZfJjqt.exe
  2⤵
  PID:7152
- C:\Windows\System\lfYCOzl.exe
  C:\Windows\System\lfYCOzl.exe
  2⤵
  PID:6104
- C:\Windows\System\klwttZP.exe
  C:\Windows\System\klwttZP.exe
  2⤵
  PID:6196
- C:\Windows\System\XKRuAuG.exe
  C:\Windows\System\XKRuAuG.exe
  2⤵
  PID:6300
- C:\Windows\System\jSdGKQT.exe
  C:\Windows\System\jSdGKQT.exe
  2⤵
  PID:6356
- C:\Windows\System\DUFaJSQ.exe
  C:\Windows\System\DUFaJSQ.exe
  2⤵
  PID:6428
- C:\Windows\System\AhtnHMt.exe
  C:\Windows\System\AhtnHMt.exe
  2⤵
  PID:6540
- C:\Windows\System\QnCoUyw.exe
  C:\Windows\System\QnCoUyw.exe
  2⤵
  PID:6504
- C:\Windows\System\nzXHfgd.exe
  C:\Windows\System\nzXHfgd.exe
  2⤵
  PID:6640
- C:\Windows\System\zONbrDy.exe
  C:\Windows\System\zONbrDy.exe
  2⤵
  PID:6664
- C:\Windows\System\hBdhYnc.exe
  C:\Windows\System\hBdhYnc.exe
  2⤵
  PID:6784
- C:\Windows\System\sXOAUOU.exe
  C:\Windows\System\sXOAUOU.exe
  2⤵
  PID:6800
- C:\Windows\System\aRCsDFc.exe
  C:\Windows\System\aRCsDFc.exe
  2⤵
  PID:6876
- C:\Windows\System\sUBKSMZ.exe
  C:\Windows\System\sUBKSMZ.exe
  2⤵
  PID:6932
- C:\Windows\System\oYTQznV.exe
  C:\Windows\System\oYTQznV.exe
  2⤵
  PID:6980
- C:\Windows\System\IEbtKvg.exe
  C:\Windows\System\IEbtKvg.exe
  2⤵
  PID:7124
- C:\Windows\System\gZqZCMt.exe
  C:\Windows\System\gZqZCMt.exe
  2⤵
  PID:5332
- C:\Windows\System\VpehbtW.exe
  C:\Windows\System\VpehbtW.exe
  2⤵
  PID:6236
- C:\Windows\System\yQWVEPM.exe
  C:\Windows\System\yQWVEPM.exe
  2⤵
  PID:6480
- C:\Windows\System\JsRuLeq.exe
  C:\Windows\System\JsRuLeq.exe
  2⤵
  PID:6600
- C:\Windows\System\NnCkddR.exe
  C:\Windows\System\NnCkddR.exe
  2⤵
  PID:6588
- C:\Windows\System\kpucTFN.exe
  C:\Windows\System\kpucTFN.exe
  2⤵
  PID:6816
- C:\Windows\System\eOIrwtc.exe
  C:\Windows\System\eOIrwtc.exe
  2⤵
  PID:6920
- C:\Windows\System\AFRbLvh.exe
  C:\Windows\System\AFRbLvh.exe
  2⤵
  PID:6412
- C:\Windows\System\GBBWTrj.exe
  C:\Windows\System\GBBWTrj.exe
  2⤵
  PID:6752
- C:\Windows\System\kGpiyAB.exe
  C:\Windows\System\kGpiyAB.exe
  2⤵
  PID:6936
- C:\Windows\System\NsVxpxd.exe
  C:\Windows\System\NsVxpxd.exe
  2⤵
  PID:6616
- C:\Windows\System\kbBBgZt.exe
  C:\Windows\System\kbBBgZt.exe
  2⤵
  PID:7100
- C:\Windows\System\sJqfKUX.exe
  C:\Windows\System\sJqfKUX.exe
  2⤵
  PID:7180
- C:\Windows\System\tSjbiSW.exe
  C:\Windows\System\tSjbiSW.exe
  2⤵
  PID:7208
- C:\Windows\System\AqOuHyc.exe
  C:\Windows\System\AqOuHyc.exe
  2⤵
  PID:7228
- C:\Windows\System\tXrKTwp.exe
  C:\Windows\System\tXrKTwp.exe
  2⤵
  PID:7252
- C:\Windows\System\dnRxcaP.exe
  C:\Windows\System\dnRxcaP.exe
  2⤵
  PID:7280
- C:\Windows\System\vkqJdsE.exe
  C:\Windows\System\vkqJdsE.exe
  2⤵
  PID:7300
- C:\Windows\System\AsXlBfn.exe
  C:\Windows\System\AsXlBfn.exe
  2⤵
  PID:7328
- C:\Windows\System\iFhbGGV.exe
  C:\Windows\System\iFhbGGV.exe
  2⤵
  PID:7356
- C:\Windows\System\nzVvOGc.exe
  C:\Windows\System\nzVvOGc.exe
  2⤵
  PID:7400
- C:\Windows\System\EMGNKrR.exe
  C:\Windows\System\EMGNKrR.exe
  2⤵
  PID:7424
- C:\Windows\System\RokcPym.exe
  C:\Windows\System\RokcPym.exe
  2⤵
  PID:7456
- C:\Windows\System\NmpCaJa.exe
  C:\Windows\System\NmpCaJa.exe
  2⤵
  PID:7500
- C:\Windows\System\BMbJcuX.exe
  C:\Windows\System\BMbJcuX.exe
  2⤵
  PID:7528
- C:\Windows\System\qqTlOFD.exe
  C:\Windows\System\qqTlOFD.exe
  2⤵
  PID:7556
- C:\Windows\System\zTkSDGJ.exe
  C:\Windows\System\zTkSDGJ.exe
  2⤵
  PID:7572
- C:\Windows\System\KAqMcJL.exe
  C:\Windows\System\KAqMcJL.exe
  2⤵
  PID:7588
- C:\Windows\System\GsZckjt.exe
  C:\Windows\System\GsZckjt.exe
  2⤵
  PID:7608
- C:\Windows\System\hPSTXDN.exe
  C:\Windows\System\hPSTXDN.exe
  2⤵
  PID:7644
- C:\Windows\System\LWXbEVW.exe
  C:\Windows\System\LWXbEVW.exe
  2⤵
  PID:7672
- C:\Windows\System\nCFsjzT.exe
  C:\Windows\System\nCFsjzT.exe
  2⤵
  PID:7700
- C:\Windows\System\UaNZQnC.exe
  C:\Windows\System\UaNZQnC.exe
  2⤵
  PID:7732
- C:\Windows\System\EHXWUHj.exe
  C:\Windows\System\EHXWUHj.exe
  2⤵
  PID:7768
- C:\Windows\System\ORbhloM.exe
  C:\Windows\System\ORbhloM.exe
  2⤵
  PID:7796
- C:\Windows\System\KNXNgNW.exe
  C:\Windows\System\KNXNgNW.exe
  2⤵
  PID:7816
- C:\Windows\System\AwkeMwW.exe
  C:\Windows\System\AwkeMwW.exe
  2⤵
  PID:7844
- C:\Windows\System\boqFscv.exe
  C:\Windows\System\boqFscv.exe
  2⤵
  PID:7872
- C:\Windows\System\DiSKRNM.exe
  C:\Windows\System\DiSKRNM.exe
  2⤵
  PID:7908
- C:\Windows\System\iLSvvuM.exe
  C:\Windows\System\iLSvvuM.exe
  2⤵
  PID:7936
- C:\Windows\System\SmSYASn.exe
  C:\Windows\System\SmSYASn.exe
  2⤵
  PID:7952
- C:\Windows\System\XXsuHns.exe
  C:\Windows\System\XXsuHns.exe
  2⤵
  PID:7980
- C:\Windows\System\kbWJmaU.exe
  C:\Windows\System\kbWJmaU.exe
  2⤵
  PID:8012
- C:\Windows\System\mBojFij.exe
  C:\Windows\System\mBojFij.exe
  2⤵
  PID:8036
- C:\Windows\System\sSvXUxt.exe
  C:\Windows\System\sSvXUxt.exe
  2⤵
  PID:8052
- C:\Windows\System\BJOgmix.exe
  C:\Windows\System\BJOgmix.exe
  2⤵
  PID:8076
- C:\Windows\System\qQkUcrX.exe
  C:\Windows\System\qQkUcrX.exe
  2⤵
  PID:8100
- C:\Windows\System\cZfTxdN.exe
  C:\Windows\System\cZfTxdN.exe
  2⤵
  PID:8128
- C:\Windows\System\GGpGQjg.exe
  C:\Windows\System\GGpGQjg.exe
  2⤵
  PID:8156
- C:\Windows\System\RLPopft.exe
  C:\Windows\System\RLPopft.exe
  2⤵
  PID:8176
- C:\Windows\System\qGYzSJv.exe
  C:\Windows\System\qGYzSJv.exe
  2⤵
  PID:7244
- C:\Windows\System\oSASNeO.exe
  C:\Windows\System\oSASNeO.exe
  2⤵
  PID:7276
- C:\Windows\System\OBFnPKu.exe
  C:\Windows\System\OBFnPKu.exe
  2⤵
  PID:7440
- C:\Windows\System\vNgNbYC.exe
  C:\Windows\System\vNgNbYC.exe
  2⤵
  PID:7492
- C:\Windows\System\hEhnEaD.exe
  C:\Windows\System\hEhnEaD.exe
  2⤵
  PID:7544
- C:\Windows\System\iLiRnqe.exe
  C:\Windows\System\iLiRnqe.exe
  2⤵
  PID:7604
- C:\Windows\System\BKkYqmm.exe
  C:\Windows\System\BKkYqmm.exe
  2⤵
  PID:7684
- C:\Windows\System\SIdoBhD.exe
  C:\Windows\System\SIdoBhD.exe
  2⤵
  PID:7764
- C:\Windows\System\KKkYBQO.exe
  C:\Windows\System\KKkYBQO.exe
  2⤵
  PID:7832
- C:\Windows\System\WXoyYuO.exe
  C:\Windows\System\WXoyYuO.exe
  2⤵
  PID:7868
- C:\Windows\System\DghJTvF.exe
  C:\Windows\System\DghJTvF.exe
  2⤵
  PID:7896
- C:\Windows\System\xEwBoRK.exe
  C:\Windows\System\xEwBoRK.exe
  2⤵
  PID:7944
- C:\Windows\System\HiDwcsr.exe
  C:\Windows\System\HiDwcsr.exe
  2⤵
  PID:8064
- C:\Windows\System\VUSKNID.exe
  C:\Windows\System\VUSKNID.exe
  2⤵
  PID:8164
- C:\Windows\System\jDWfbnF.exe
  C:\Windows\System\jDWfbnF.exe
  2⤵
  PID:7236
- C:\Windows\System\ugFulsh.exe
  C:\Windows\System\ugFulsh.exe
  2⤵
  PID:7408
- C:\Windows\System\BfDVMDL.exe
  C:\Windows\System\BfDVMDL.exe
  2⤵
  PID:7480
- C:\Windows\System\DPiEtgr.exe
  C:\Windows\System\DPiEtgr.exe
  2⤵
  PID:7696
- C:\Windows\System\fLTOXZb.exe
  C:\Windows\System\fLTOXZb.exe
  2⤵
  PID:7836
- C:\Windows\System\udwBWxM.exe
  C:\Windows\System\udwBWxM.exe
  2⤵
  PID:8008
- C:\Windows\System\oeJTtNC.exe
  C:\Windows\System\oeJTtNC.exe
  2⤵
  PID:8048
- C:\Windows\System\UBstnRQ.exe
  C:\Windows\System\UBstnRQ.exe
  2⤵
  PID:7420
- C:\Windows\System\erolfNJ.exe
  C:\Windows\System\erolfNJ.exe
  2⤵
  PID:7656
- C:\Windows\System\ccDVVOT.exe
  C:\Windows\System\ccDVVOT.exe
  2⤵
  PID:7840
- C:\Windows\System\VOLwYwh.exe
  C:\Windows\System\VOLwYwh.exe
  2⤵
  PID:7296
- C:\Windows\System\LoMvoDs.exe
  C:\Windows\System\LoMvoDs.exe
  2⤵
  PID:7920
- C:\Windows\System\BGyuBRc.exe
  C:\Windows\System\BGyuBRc.exe
  2⤵
  PID:8220
- C:\Windows\System\xJOUBDB.exe
  C:\Windows\System\xJOUBDB.exe
  2⤵
  PID:8248
- C:\Windows\System\fcJhyMP.exe
  C:\Windows\System\fcJhyMP.exe
  2⤵
  PID:8288
- C:\Windows\System\zabKCqM.exe
  C:\Windows\System\zabKCqM.exe
  2⤵
  PID:8308
- C:\Windows\System\YmKvLFx.exe
  C:\Windows\System\YmKvLFx.exe
  2⤵
  PID:8340
- C:\Windows\System\rDLVwQA.exe
  C:\Windows\System\rDLVwQA.exe
  2⤵
  PID:8364
- C:\Windows\System\lvPIOrD.exe
  C:\Windows\System\lvPIOrD.exe
  2⤵
  PID:8392
- C:\Windows\System\YTPcHVw.exe
  C:\Windows\System\YTPcHVw.exe
  2⤵
  PID:8416
- C:\Windows\System\TDbMYeC.exe
  C:\Windows\System\TDbMYeC.exe
  2⤵
  PID:8436
- C:\Windows\System\iLMBsfr.exe
  C:\Windows\System\iLMBsfr.exe
  2⤵
  PID:8488
- C:\Windows\System\vfAuWVx.exe
  C:\Windows\System\vfAuWVx.exe
  2⤵
  PID:8504
- C:\Windows\System\OZUplOo.exe
  C:\Windows\System\OZUplOo.exe
  2⤵
  PID:8532
- C:\Windows\System\yygkgBB.exe
  C:\Windows\System\yygkgBB.exe
  2⤵
  PID:8560
- C:\Windows\System\GZRMrUn.exe
  C:\Windows\System\GZRMrUn.exe
  2⤵
  PID:8580
- C:\Windows\System\pQUQSJx.exe
  C:\Windows\System\pQUQSJx.exe
  2⤵
  PID:8604
- C:\Windows\System\QUNZNqD.exe
  C:\Windows\System\QUNZNqD.exe
  2⤵
  PID:8656
- C:\Windows\System\uZYXcBD.exe
  C:\Windows\System\uZYXcBD.exe
  2⤵
  PID:8684
- C:\Windows\System\nzZVJlE.exe
  C:\Windows\System\nzZVJlE.exe
  2⤵
  PID:8712
- C:\Windows\System\cidoLJf.exe
  C:\Windows\System\cidoLJf.exe
  2⤵
  PID:8740
- C:\Windows\System\RPRREeF.exe
  C:\Windows\System\RPRREeF.exe
  2⤵
  PID:8768
- C:\Windows\System\lfbgspt.exe
  C:\Windows\System\lfbgspt.exe
  2⤵
  PID:8784
- C:\Windows\System\oIJEiJb.exe
  C:\Windows\System\oIJEiJb.exe
  2⤵
  PID:8812
- C:\Windows\System\vCHmZbI.exe
  C:\Windows\System\vCHmZbI.exe
  2⤵
  PID:8840
- C:\Windows\System\aFzrSCv.exe
  C:\Windows\System\aFzrSCv.exe
  2⤵
  PID:8868
- C:\Windows\System\PdKUVFP.exe
  C:\Windows\System\PdKUVFP.exe
  2⤵
  PID:8908
- C:\Windows\System\ndCOOry.exe
  C:\Windows\System\ndCOOry.exe
  2⤵
  PID:8936
- C:\Windows\System\tmkIvtH.exe
  C:\Windows\System\tmkIvtH.exe
  2⤵
  PID:8964
- C:\Windows\System\BacpzIQ.exe
  C:\Windows\System\BacpzIQ.exe
  2⤵
  PID:8992
- C:\Windows\System\WrTNlBr.exe
  C:\Windows\System\WrTNlBr.exe
  2⤵
  PID:9020
- C:\Windows\System\INwwoGY.exe
  C:\Windows\System\INwwoGY.exe
  2⤵
  PID:9048
- C:\Windows\System\hSGnSTj.exe
  C:\Windows\System\hSGnSTj.exe
  2⤵
  PID:9076
- C:\Windows\System\BeBTCRX.exe
  C:\Windows\System\BeBTCRX.exe
  2⤵
  PID:9104
- C:\Windows\System\IeCQLeT.exe
  C:\Windows\System\IeCQLeT.exe
  2⤵
  PID:9132
- C:\Windows\System\CIyYCXp.exe
  C:\Windows\System\CIyYCXp.exe
  2⤵
  PID:9160
- C:\Windows\System\PXOUaIS.exe
  C:\Windows\System\PXOUaIS.exe
  2⤵
  PID:9176
- C:\Windows\System\LylyNJT.exe
  C:\Windows\System\LylyNJT.exe
  2⤵
  PID:9196
- C:\Windows\System\aigMXNt.exe
  C:\Windows\System\aigMXNt.exe
  2⤵
  PID:8212
- C:\Windows\System\wdAytPG.exe
  C:\Windows\System\wdAytPG.exe
  2⤵
  PID:8284
- C:\Windows\System\KnXgjFU.exe
  C:\Windows\System\KnXgjFU.exe
  2⤵
  PID:8328
- C:\Windows\System\wKtPBUt.exe
  C:\Windows\System\wKtPBUt.exe
  2⤵
  PID:8404
- C:\Windows\System\GBsnfXv.exe
  C:\Windows\System\GBsnfXv.exe
  2⤵
  PID:8412
- C:\Windows\System\jCVRwMn.exe
  C:\Windows\System\jCVRwMn.exe
  2⤵
  PID:8548
- C:\Windows\System\eDBjoWs.exe
  C:\Windows\System\eDBjoWs.exe
  2⤵
  PID:8596
- C:\Windows\System\iwuNmzo.exe
  C:\Windows\System\iwuNmzo.exe
  2⤵
  PID:8668
- C:\Windows\System\GMmhvzC.exe
  C:\Windows\System\GMmhvzC.exe
  2⤵
  PID:8728
- C:\Windows\System\ekRSIjC.exe
  C:\Windows\System\ekRSIjC.exe
  2⤵
  PID:8796
- C:\Windows\System\QkxhlVw.exe
  C:\Windows\System\QkxhlVw.exe
  2⤵
  PID:8888
- C:\Windows\System\MvTdioo.exe
  C:\Windows\System\MvTdioo.exe
  2⤵
  PID:8960
- C:\Windows\System\qNztfpw.exe
  C:\Windows\System\qNztfpw.exe
  2⤵
  PID:8988
- C:\Windows\System\DAtRPvb.exe
  C:\Windows\System\DAtRPvb.exe
  2⤵
  PID:9060
- C:\Windows\System\qLYsSTv.exe
  C:\Windows\System\qLYsSTv.exe
  2⤵
  PID:9124
- C:\Windows\System\fGYbEBQ.exe
  C:\Windows\System\fGYbEBQ.exe
  2⤵
  PID:9152
- C:\Windows\System\FCPGrnf.exe
  C:\Windows\System\FCPGrnf.exe
  2⤵
  PID:8204
- C:\Windows\System\VMPxAGp.exe
  C:\Windows\System\VMPxAGp.exe
  2⤵
  PID:8432
- C:\Windows\System\hvjMoRv.exe
  C:\Windows\System\hvjMoRv.exe
  2⤵
  PID:8496
- C:\Windows\System\mksKekS.exe
  C:\Windows\System\mksKekS.exe
  2⤵
  PID:8752
- C:\Windows\System\TdOfFAC.exe
  C:\Windows\System\TdOfFAC.exe
  2⤵
  PID:8708
- C:\Windows\System\Yzfdrfq.exe
  C:\Windows\System\Yzfdrfq.exe
  2⤵
  PID:9016
- C:\Windows\System\fOPAICb.exe
  C:\Windows\System\fOPAICb.exe
  2⤵
  PID:9100
- C:\Windows\System\fnGYLiI.exe
  C:\Windows\System\fnGYLiI.exe
  2⤵
  PID:9192
- C:\Windows\System\jgdoaRP.exe
  C:\Windows\System\jgdoaRP.exe
  2⤵
  PID:8632
- C:\Windows\System\uLUbUYC.exe
  C:\Windows\System\uLUbUYC.exe
  2⤵
  PID:8976
- C:\Windows\System\rWgSKae.exe
  C:\Windows\System\rWgSKae.exe
  2⤵
  PID:8696
- C:\Windows\System\yJpfCSx.exe
  C:\Windows\System\yJpfCSx.exe
  2⤵
  PID:9220
- C:\Windows\System\ppUogCS.exe
  C:\Windows\System\ppUogCS.exe
  2⤵
  PID:9252
- C:\Windows\System\OHSauAH.exe
  C:\Windows\System\OHSauAH.exe
  2⤵
  PID:9276
- C:\Windows\System\uNWxXvC.exe
  C:\Windows\System\uNWxXvC.exe
  2⤵
  PID:9296
- C:\Windows\System\rAbhoOt.exe
  C:\Windows\System\rAbhoOt.exe
  2⤵
  PID:9320
- C:\Windows\System\ikjRNaS.exe
  C:\Windows\System\ikjRNaS.exe
  2⤵
  PID:9360
- C:\Windows\System\QUMcTHi.exe
  C:\Windows\System\QUMcTHi.exe
  2⤵
  PID:9376
- C:\Windows\System\NDaLvTd.exe
  C:\Windows\System\NDaLvTd.exe
  2⤵
  PID:9404
- C:\Windows\System\vhytClL.exe
  C:\Windows\System\vhytClL.exe
  2⤵
  PID:9436
- C:\Windows\System\gUonXVh.exe
  C:\Windows\System\gUonXVh.exe
  2⤵
  PID:9472
- C:\Windows\System\BqXRXSf.exe
  C:\Windows\System\BqXRXSf.exe
  2⤵
  PID:9496
- C:\Windows\System\gpRJSdc.exe
  C:\Windows\System\gpRJSdc.exe
  2⤵
  PID:9524
- C:\Windows\System\thfqIyP.exe
  C:\Windows\System\thfqIyP.exe
  2⤵
  PID:9556
- C:\Windows\System\gASAmfz.exe
  C:\Windows\System\gASAmfz.exe
  2⤵
  PID:9576
- C:\Windows\System\btmakko.exe
  C:\Windows\System\btmakko.exe
  2⤵
  PID:9632
- C:\Windows\System\RHTMsYj.exe
  C:\Windows\System\RHTMsYj.exe
  2⤵
  PID:9648
- C:\Windows\System\GYBOddG.exe
  C:\Windows\System\GYBOddG.exe
  2⤵
  PID:9672
- C:\Windows\System\NNeAJbr.exe
  C:\Windows\System\NNeAJbr.exe
  2⤵
  PID:9704
- C:\Windows\System\dXjjiIC.exe
  C:\Windows\System\dXjjiIC.exe
  2⤵
  PID:9732
- C:\Windows\System\SVsRtrm.exe
  C:\Windows\System\SVsRtrm.exe
  2⤵
  PID:9752
- C:\Windows\System\QiBkBVc.exe
  C:\Windows\System\QiBkBVc.exe
  2⤵
  PID:9800
- C:\Windows\System\NXTPvtr.exe
  C:\Windows\System\NXTPvtr.exe
  2⤵
  PID:9828
- C:\Windows\System\DsjkJTs.exe
  C:\Windows\System\DsjkJTs.exe
  2⤵
  PID:9844
- C:\Windows\System\jpralSU.exe
  C:\Windows\System\jpralSU.exe
  2⤵
  PID:9872
- C:\Windows\System\bEAWdYK.exe
  C:\Windows\System\bEAWdYK.exe
  2⤵
  PID:9904
- C:\Windows\System\wLnotGU.exe
  C:\Windows\System\wLnotGU.exe
  2⤵
  PID:9928
- C:\Windows\System\oZrzavr.exe
  C:\Windows\System\oZrzavr.exe
  2⤵
  PID:9968
- C:\Windows\System\UlufzvN.exe
  C:\Windows\System\UlufzvN.exe
  2⤵
  PID:9996
- C:\Windows\System\zbCibdk.exe
  C:\Windows\System\zbCibdk.exe
  2⤵
  PID:10036
- C:\Windows\System\TkIfsqe.exe
  C:\Windows\System\TkIfsqe.exe
  2⤵
  PID:10052
- C:\Windows\System\nRrlQqR.exe
  C:\Windows\System\nRrlQqR.exe
  2⤵
  PID:10080
- C:\Windows\System\Eqhlvze.exe
  C:\Windows\System\Eqhlvze.exe
  2⤵
  PID:10108
- C:\Windows\System\bbWBlxW.exe
  C:\Windows\System\bbWBlxW.exe
  2⤵
  PID:10128
- C:\Windows\System\nMtnCjF.exe
  C:\Windows\System\nMtnCjF.exe
  2⤵
  PID:10156
- C:\Windows\System\DTOMVyt.exe
  C:\Windows\System\DTOMVyt.exe
  2⤵
  PID:10184
- C:\Windows\System\oOKAiSx.exe
  C:\Windows\System\oOKAiSx.exe
  2⤵
  PID:10208
- C:\Windows\System\IYKBGXW.exe
  C:\Windows\System\IYKBGXW.exe
  2⤵
  PID:9244
- C:\Windows\System\bvwiHBK.exe
  C:\Windows\System\bvwiHBK.exe
  2⤵
  PID:9312
- C:\Windows\System\YNMisSI.exe
  C:\Windows\System\YNMisSI.exe
  2⤵
  PID:9336
- C:\Windows\System\hnWIAAK.exe
  C:\Windows\System\hnWIAAK.exe
  2⤵
  PID:9368
- C:\Windows\System\dSuRMLr.exe
  C:\Windows\System\dSuRMLr.exe
  2⤵
  PID:9508
- C:\Windows\System\hbHCTcZ.exe
  C:\Windows\System\hbHCTcZ.exe
  2⤵
  PID:9572
- C:\Windows\System\DXnZXND.exe
  C:\Windows\System\DXnZXND.exe
  2⤵
  PID:9644
- C:\Windows\System\sRbARvE.exe
  C:\Windows\System\sRbARvE.exe
  2⤵
  PID:9696
- C:\Windows\System\sUsANDA.exe
  C:\Windows\System\sUsANDA.exe
  2⤵
  PID:9760
- C:\Windows\System\cSJnyxk.exe
  C:\Windows\System\cSJnyxk.exe
  2⤵
  PID:9820
- C:\Windows\System\diUkWUK.exe
  C:\Windows\System\diUkWUK.exe
  2⤵
  PID:9892
- C:\Windows\System\lUKlKdo.exe
  C:\Windows\System\lUKlKdo.exe
  2⤵
  PID:9960
- C:\Windows\System\efYlbIF.exe
  C:\Windows\System\efYlbIF.exe
  2⤵
  PID:10032
- C:\Windows\System\rPsYIGI.exe
  C:\Windows\System\rPsYIGI.exe
  2⤵
  PID:10092
- C:\Windows\System\tPDOZTG.exe
  C:\Windows\System\tPDOZTG.exe
  2⤵
  PID:10140
- C:\Windows\System\ywFNnnG.exe
  C:\Windows\System\ywFNnnG.exe
  2⤵
  PID:10196
- C:\Windows\System\IyIBTCR.exe
  C:\Windows\System\IyIBTCR.exe
  2⤵
  PID:9272
- C:\Windows\System\UQSyQCU.exe
  C:\Windows\System\UQSyQCU.exe
  2⤵
  PID:9512
- C:\Windows\System\mmZLKAj.exe
  C:\Windows\System\mmZLKAj.exe
  2⤵
  PID:9660
- C:\Windows\System\sdimIwY.exe
  C:\Windows\System\sdimIwY.exe
  2⤵
  PID:9796
- C:\Windows\System\lKUZYuh.exe
  C:\Windows\System\lKUZYuh.exe
  2⤵
  PID:10116
- C:\Windows\System\qgoKAza.exe
  C:\Windows\System\qgoKAza.exe
  2⤵
  PID:9480
- C:\Windows\System\GmXDzHj.exe
  C:\Windows\System\GmXDzHj.exe
  2⤵
  PID:9792
- C:\Windows\System\ddCJJhz.exe
  C:\Windows\System\ddCJJhz.exe
  2⤵
  PID:10176
- C:\Windows\System\ESHnHjR.exe
  C:\Windows\System\ESHnHjR.exe
  2⤵
  PID:9604
- C:\Windows\System\HJwIGKL.exe
  C:\Windows\System\HJwIGKL.exe
  2⤵
  PID:10248
- C:\Windows\System\ykwzuNK.exe
  C:\Windows\System\ykwzuNK.exe
  2⤵
  PID:10276
- C:\Windows\System\IHtvFMU.exe
  C:\Windows\System\IHtvFMU.exe
  2⤵
  PID:10304
- C:\Windows\System\NVvaSvC.exe
  C:\Windows\System\NVvaSvC.exe
  2⤵
  PID:10332
- C:\Windows\System\XyyEgrF.exe
  C:\Windows\System\XyyEgrF.exe
  2⤵
  PID:10360
- C:\Windows\System\nybxWkk.exe
  C:\Windows\System\nybxWkk.exe
  2⤵
  PID:10388
- C:\Windows\System\NuUJyAU.exe
  C:\Windows\System\NuUJyAU.exe
  2⤵
  PID:10428
- C:\Windows\System\urCqfvr.exe
  C:\Windows\System\urCqfvr.exe
  2⤵
  PID:10456
- C:\Windows\System\pGugRFK.exe
  C:\Windows\System\pGugRFK.exe
  2⤵
  PID:10472
- C:\Windows\System\gXwhfmN.exe
  C:\Windows\System\gXwhfmN.exe
  2⤵
  PID:10488
- C:\Windows\System\WSvMECj.exe
  C:\Windows\System\WSvMECj.exe
  2⤵
  PID:10504
- C:\Windows\System\GaVLLfJ.exe
  C:\Windows\System\GaVLLfJ.exe
  2⤵
  PID:10552
- C:\Windows\System\AnFBdUy.exe
  C:\Windows\System\AnFBdUy.exe
  2⤵
  PID:10580
- C:\Windows\System\LoPdBSf.exe
  C:\Windows\System\LoPdBSf.exe
  2⤵
  PID:10600
- C:\Windows\System\xzoMVve.exe
  C:\Windows\System\xzoMVve.exe
  2⤵
  PID:10620
- C:\Windows\System\fzFyPOr.exe
  C:\Windows\System\fzFyPOr.exe
  2⤵
  PID:10644
- C:\Windows\System\WCaQaRv.exe
  C:\Windows\System\WCaQaRv.exe
  2⤵
  PID:10692
- C:\Windows\System\TQyrsbS.exe
  C:\Windows\System\TQyrsbS.exe
  2⤵
  PID:10712
- C:\Windows\System\DMKnXqt.exe
  C:\Windows\System\DMKnXqt.exe
  2⤵
  PID:10740
- C:\Windows\System\UoqsilU.exe
  C:\Windows\System\UoqsilU.exe
  2⤵
  PID:10760
- C:\Windows\System\FCWYRQv.exe
  C:\Windows\System\FCWYRQv.exe
  2⤵
  PID:10788
- C:\Windows\System\jqdeVJv.exe
  C:\Windows\System\jqdeVJv.exe
  2⤵
  PID:10844
- C:\Windows\System\ncwSlSp.exe
  C:\Windows\System\ncwSlSp.exe
  2⤵
  PID:10868
- C:\Windows\System\uunaCzM.exe
  C:\Windows\System\uunaCzM.exe
  2⤵
  PID:10904
- C:\Windows\System\mroPXSE.exe
  C:\Windows\System\mroPXSE.exe
  2⤵
  PID:10928
- C:\Windows\System\vskjLlO.exe
  C:\Windows\System\vskjLlO.exe
  2⤵
  PID:10952
- C:\Windows\System\FSdxRUi.exe
  C:\Windows\System\FSdxRUi.exe
  2⤵
  PID:10968
- C:\Windows\System\QACJPpE.exe
  C:\Windows\System\QACJPpE.exe
  2⤵
  PID:11000
- C:\Windows\System\MzrumPf.exe
  C:\Windows\System\MzrumPf.exe
  2⤵
  PID:11020
- C:\Windows\System\EWyFNmM.exe
  C:\Windows\System\EWyFNmM.exe
  2⤵
  PID:11076
- C:\Windows\System\ukKqybH.exe
  C:\Windows\System\ukKqybH.exe
  2⤵
  PID:11100
- C:\Windows\System\qpaCjZm.exe
  C:\Windows\System\qpaCjZm.exe
  2⤵
  PID:11120
- C:\Windows\System\jlHRusA.exe
  C:\Windows\System\jlHRusA.exe
  2⤵
  PID:11140
- C:\Windows\System\oDNAdpc.exe
  C:\Windows\System\oDNAdpc.exe
  2⤵
  PID:11168
- C:\Windows\System\iwExEDn.exe
  C:\Windows\System\iwExEDn.exe
  2⤵
  PID:11192
- C:\Windows\System\DHwLWfA.exe
  C:\Windows\System\DHwLWfA.exe
  2⤵
  PID:11224
- C:\Windows\System\wUKQODZ.exe
  C:\Windows\System\wUKQODZ.exe
  2⤵
  PID:11248
- C:\Windows\System\oJXtZez.exe
  C:\Windows\System\oJXtZez.exe
  2⤵
  PID:10292
- C:\Windows\System\hZuNAVq.exe
  C:\Windows\System\hZuNAVq.exe
  2⤵
  PID:10324
- C:\Windows\System\XQelbur.exe
  C:\Windows\System\XQelbur.exe
  2⤵
  PID:10408
- C:\Windows\System\QGVKOXy.exe
  C:\Windows\System\QGVKOXy.exe
  2⤵
  PID:10496
- C:\Windows\System\zakYYcE.exe
  C:\Windows\System\zakYYcE.exe
  2⤵
  PID:10560
- C:\Windows\System\BkfzRrx.exe
  C:\Windows\System\BkfzRrx.exe
  2⤵
  PID:10572
- C:\Windows\System\uxgwkjg.exe
  C:\Windows\System\uxgwkjg.exe
  2⤵
  PID:10640
- C:\Windows\System\CTRvkwY.exe
  C:\Windows\System\CTRvkwY.exe
  2⤵
  PID:10704
- C:\Windows\System\kPOezUb.exe
  C:\Windows\System\kPOezUb.exe
  2⤵
  PID:10812
- C:\Windows\System\ZDmWhSk.exe
  C:\Windows\System\ZDmWhSk.exe
  2⤵
  PID:10852
- C:\Windows\System\MoJFcip.exe
  C:\Windows\System\MoJFcip.exe
  2⤵
  PID:10912
- C:\Windows\System\RsFuzwG.exe
  C:\Windows\System\RsFuzwG.exe
  2⤵
  PID:11016
- C:\Windows\System\VBpcxhj.exe
  C:\Windows\System\VBpcxhj.exe
  2⤵
  PID:11056
- C:\Windows\System\IKGcjNx.exe
  C:\Windows\System\IKGcjNx.exe
  2⤵
  PID:11136
- C:\Windows\System\cqCZyBh.exe
  C:\Windows\System\cqCZyBh.exe
  2⤵
  PID:11180
- C:\Windows\System\nXElsYk.exe
  C:\Windows\System\nXElsYk.exe
  2⤵
  PID:11232
- C:\Windows\System\wGJnFFk.exe
  C:\Windows\System\wGJnFFk.exe
  2⤵
  PID:10244
- C:\Windows\System\dccfmRA.exe
  C:\Windows\System\dccfmRA.exe
  2⤵
  PID:10444
- C:\Windows\System\HTkfKmY.exe
  C:\Windows\System\HTkfKmY.exe
  2⤵
  PID:10708
- C:\Windows\System\fKZWEOR.exe
  C:\Windows\System\fKZWEOR.exe
  2⤵
  PID:10828
- C:\Windows\System\FGJDZuu.exe
  C:\Windows\System\FGJDZuu.exe
  2⤵
  PID:10916
- C:\Windows\System\xZguQSO.exe
  C:\Windows\System\xZguQSO.exe
  2⤵
  PID:11188
- C:\Windows\System\XLJplhn.exe
  C:\Windows\System\XLJplhn.exe
  2⤵
  PID:10484
- C:\Windows\System\ylqgvlj.exe
  C:\Windows\System\ylqgvlj.exe
  2⤵
  PID:11012
- C:\Windows\System\xcIxAIb.exe
  C:\Windows\System\xcIxAIb.exe
  2⤵
  PID:9264
- C:\Windows\System\EMimBFS.exe
  C:\Windows\System\EMimBFS.exe
  2⤵
  PID:10836
- C:\Windows\System\zczwPAD.exe
  C:\Windows\System\zczwPAD.exe
  2⤵
  PID:10784
- C:\Windows\System\IpLBoVj.exe
  C:\Windows\System\IpLBoVj.exe
  2⤵
  PID:11300
- C:\Windows\System\QTEaFez.exe
  C:\Windows\System\QTEaFez.exe
  2⤵
  PID:11324
- C:\Windows\System\GytGEGH.exe
  C:\Windows\System\GytGEGH.exe
  2⤵
  PID:11344
- C:\Windows\System\AdifdCV.exe
  C:\Windows\System\AdifdCV.exe
  2⤵
  PID:11380
- C:\Windows\System\fdonXXR.exe
  C:\Windows\System\fdonXXR.exe
  2⤵
  PID:11408
- C:\Windows\System\dXJQjNp.exe
  C:\Windows\System\dXJQjNp.exe
  2⤵
  PID:11464
- C:\Windows\System\wCvyQKq.exe
  C:\Windows\System\wCvyQKq.exe
  2⤵
  PID:11480
- C:\Windows\System\GbDCSHC.exe
  C:\Windows\System\GbDCSHC.exe
  2⤵
  PID:11508
- C:\Windows\System\MkVnfqt.exe
  C:\Windows\System\MkVnfqt.exe
  2⤵
  PID:11536
- C:\Windows\System\yLgJPkN.exe
  C:\Windows\System\yLgJPkN.exe
  2⤵
  PID:11564
- C:\Windows\System\uaUgxZf.exe
  C:\Windows\System\uaUgxZf.exe
  2⤵
  PID:11592
- C:\Windows\System\tbWeyPx.exe
  C:\Windows\System\tbWeyPx.exe
  2⤵
  PID:11620
- C:\Windows\System\abIFgWD.exe
  C:\Windows\System\abIFgWD.exe
  2⤵
  PID:11648
- C:\Windows\System\tuhChfi.exe
  C:\Windows\System\tuhChfi.exe
  2⤵
  PID:11676
- C:\Windows\System\nJDIafv.exe
  C:\Windows\System\nJDIafv.exe
  2⤵
  PID:11696
- C:\Windows\System\GDuhrtl.exe
  C:\Windows\System\GDuhrtl.exe
  2⤵
  PID:11732
- C:\Windows\System\DzGJIqy.exe
  C:\Windows\System\DzGJIqy.exe
  2⤵
  PID:11772
- C:\Windows\System\hspfxSO.exe
  C:\Windows\System\hspfxSO.exe
  2⤵
  PID:11796
- C:\Windows\System\fuDRWXo.exe
  C:\Windows\System\fuDRWXo.exe
  2⤵
  PID:11816
- C:\Windows\System\GvAHOXC.exe
  C:\Windows\System\GvAHOXC.exe
  2⤵
  PID:11844
- C:\Windows\System\cdyPZRs.exe
  C:\Windows\System\cdyPZRs.exe
  2⤵
  PID:11864
- C:\Windows\System\yNstufn.exe
  C:\Windows\System\yNstufn.exe
  2⤵
  PID:11912
- C:\Windows\System\IemFvTH.exe
  C:\Windows\System\IemFvTH.exe
  2⤵
  PID:11932
- C:\Windows\System\akdbbhJ.exe
  C:\Windows\System\akdbbhJ.exe
  2⤵
  PID:11948
- C:\Windows\System\nDyMuBQ.exe
  C:\Windows\System\nDyMuBQ.exe
  2⤵
  PID:11988
- C:\Windows\System\FrkNGbp.exe
  C:\Windows\System\FrkNGbp.exe
  2⤵
  PID:12004
- C:\Windows\System\VwfnFWR.exe
  C:\Windows\System\VwfnFWR.exe
  2⤵
  PID:12020
- C:\Windows\System\sqxRnbq.exe
  C:\Windows\System\sqxRnbq.exe
  2⤵
  PID:12052
- C:\Windows\System\BdiozDD.exe
  C:\Windows\System\BdiozDD.exe
  2⤵
  PID:12100
- C:\Windows\System\RBKrluX.exe
  C:\Windows\System\RBKrluX.exe
  2⤵
  PID:12128
- C:\Windows\System\VfPmesY.exe
  C:\Windows\System\VfPmesY.exe
  2⤵
  PID:12156
- C:\Windows\System\MJWMIWU.exe
  C:\Windows\System\MJWMIWU.exe
  2⤵
  PID:12172
- C:\Windows\System\sFjYaLt.exe
  C:\Windows\System\sFjYaLt.exe
  2⤵
  PID:12224
- C:\Windows\System\TfGXSXs.exe
  C:\Windows\System\TfGXSXs.exe
  2⤵
  PID:12252
- C:\Windows\System\lAtnhKB.exe
  C:\Windows\System\lAtnhKB.exe
  2⤵
  PID:12280
- C:\Windows\System\yzYCWeF.exe
  C:\Windows\System\yzYCWeF.exe
  2⤵
  PID:11284
- C:\Windows\System\HFLpFXZ.exe
  C:\Windows\System\HFLpFXZ.exe
  2⤵
  PID:11364
- C:\Windows\System\pOmvMcZ.exe
  C:\Windows\System\pOmvMcZ.exe
  2⤵
  PID:11376
- C:\Windows\System\ivgCFuv.exe
  C:\Windows\System\ivgCFuv.exe
  2⤵
  PID:11472
- C:\Windows\System\ZFJBRgs.exe
  C:\Windows\System\ZFJBRgs.exe
  2⤵
  PID:11532
- C:\Windows\System\penlnmt.exe
  C:\Windows\System\penlnmt.exe
  2⤵
  PID:11576
- C:\Windows\System\UhPCbvA.exe
  C:\Windows\System\UhPCbvA.exe
  2⤵
  PID:11640
- C:\Windows\System\UrrAOCB.exe
  C:\Windows\System\UrrAOCB.exe
  2⤵
  PID:11756
- C:\Windows\System\DTEHKiU.exe
  C:\Windows\System\DTEHKiU.exe
  2⤵
  PID:11804
- C:\Windows\System\dYOvhAg.exe
  C:\Windows\System\dYOvhAg.exe
  2⤵
  PID:11884
- C:\Windows\System\cXKTOMp.exe
  C:\Windows\System\cXKTOMp.exe
  2⤵
  PID:11928
- C:\Windows\System\PlKwXjG.exe
  C:\Windows\System\PlKwXjG.exe
  2⤵
  PID:11968
- C:\Windows\System\LbWpUJX.exe
  C:\Windows\System\LbWpUJX.exe
  2⤵
  PID:12080
- C:\Windows\System\rVOBmZj.exe
  C:\Windows\System\rVOBmZj.exe
  2⤵
  PID:12096
- C:\Windows\System\gyubUZs.exe
  C:\Windows\System\gyubUZs.exe
  2⤵
  PID:12188
- C:\Windows\System\NpZRstX.exe
  C:\Windows\System\NpZRstX.exe
  2⤵
  PID:12204
- C:\Windows\System\mxJeDMH.exe
  C:\Windows\System\mxJeDMH.exe
  2⤵
  PID:12268
- C:\Windows\System\YNIphom.exe
  C:\Windows\System\YNIphom.exe
  2⤵
  PID:11392
- C:\Windows\System\iZVpXIC.exe
  C:\Windows\System\iZVpXIC.exe
  2⤵
  PID:11560
- C:\Windows\System\klEebVq.exe
  C:\Windows\System\klEebVq.exe
  2⤵
  PID:11604
- C:\Windows\System\wqUvNWc.exe
  C:\Windows\System\wqUvNWc.exe
  2⤵
  PID:11872
- C:\Windows\System\mrKLZHM.exe
  C:\Windows\System\mrKLZHM.exe
  2⤵
  PID:11944
- C:\Windows\System\TfZWXvq.exe
  C:\Windows\System\TfZWXvq.exe
  2⤵
  PID:12048
- C:\Windows\System\cqtwYoO.exe
  C:\Windows\System\cqtwYoO.exe
  2⤵
  PID:10452
- C:\Windows\System\iXqNASY.exe
  C:\Windows\System\iXqNASY.exe
  2⤵
  PID:11312
- C:\Windows\System\NoSBGze.exe
  C:\Windows\System\NoSBGze.exe
  2⤵
  PID:12200
- C:\Windows\System\TCDfwPq.exe
  C:\Windows\System\TCDfwPq.exe
  2⤵
  PID:12216
- C:\Windows\System\GCARyTU.exe
  C:\Windows\System\GCARyTU.exe
  2⤵
  PID:11972
- C:\Windows\System\zOSIYQS.exe
  C:\Windows\System\zOSIYQS.exe
  2⤵
  PID:12312
- C:\Windows\System\ZBbSVue.exe
  C:\Windows\System\ZBbSVue.exe
  2⤵
  PID:12344
- C:\Windows\System\VffnMqR.exe
  C:\Windows\System\VffnMqR.exe
  2⤵
  PID:12360
- C:\Windows\System\PWoUHUn.exe
  C:\Windows\System\PWoUHUn.exe
  2⤵
  PID:12396
- C:\Windows\System\LhGoFuE.exe
  C:\Windows\System\LhGoFuE.exe
  2⤵
  PID:12420
- C:\Windows\System\FFglfzq.exe
  C:\Windows\System\FFglfzq.exe
  2⤵
  PID:12456
- C:\Windows\System\CtsUHAg.exe
  C:\Windows\System\CtsUHAg.exe
  2⤵
  PID:12476
- C:\Windows\System\cKQUXCi.exe
  C:\Windows\System\cKQUXCi.exe
  2⤵
  PID:12508
- C:\Windows\System\spUluDC.exe
  C:\Windows\System\spUluDC.exe
  2⤵
  PID:12528
- C:\Windows\System\PZmwPoY.exe
  C:\Windows\System\PZmwPoY.exe
  2⤵
  PID:12556
- C:\Windows\System\KRGneXq.exe
  C:\Windows\System\KRGneXq.exe
  2⤵
  PID:12572
- C:\Windows\System\TLsOfTL.exe
  C:\Windows\System\TLsOfTL.exe
  2⤵
  PID:12600
- C:\Windows\System\cvQxUcJ.exe
  C:\Windows\System\cvQxUcJ.exe
  2⤵
  PID:12628
- C:\Windows\System\XteRjgO.exe
  C:\Windows\System\XteRjgO.exe
  2⤵
  PID:12648
- C:\Windows\System\cgnkLWY.exe
  C:\Windows\System\cgnkLWY.exe
  2⤵
  PID:12668
- C:\Windows\System\dyghVRb.exe
  C:\Windows\System\dyghVRb.exe
  2⤵
  PID:12696
- C:\Windows\System\rMKeeUL.exe
  C:\Windows\System\rMKeeUL.exe
  2⤵
  PID:12740
- C:\Windows\System\RgkOAUZ.exe
  C:\Windows\System\RgkOAUZ.exe
  2⤵
  PID:12764
- C:\Windows\System\FSMpmUa.exe
  C:\Windows\System\FSMpmUa.exe
  2⤵
  PID:12808
- C:\Windows\System\lSgelxB.exe
  C:\Windows\System\lSgelxB.exe
  2⤵
  PID:12860
- C:\Windows\System\gRQGoHC.exe
  C:\Windows\System\gRQGoHC.exe
  2⤵
  PID:12884
- C:\Windows\System\syJYiqr.exe
  C:\Windows\System\syJYiqr.exe
  2⤵
  PID:12912
- C:\Windows\System\wflqxvO.exe
  C:\Windows\System\wflqxvO.exe
  2⤵
  PID:12932
- C:\Windows\System\SMYjnlR.exe
  C:\Windows\System\SMYjnlR.exe
  2⤵
  PID:12960
- C:\Windows\System\AwdLcTI.exe
  C:\Windows\System\AwdLcTI.exe
  2⤵
  PID:12988
- C:\Windows\System\AaxpCBj.exe
  C:\Windows\System\AaxpCBj.exe
  2⤵
  PID:13004
- C:\Windows\System\OHDZpgq.exe
  C:\Windows\System\OHDZpgq.exe
  2⤵
  PID:13036
- C:\Windows\System\PQAPdPB.exe
  C:\Windows\System\PQAPdPB.exe
  2⤵
  PID:13084
- C:\Windows\System\pFNNhaz.exe
  C:\Windows\System\pFNNhaz.exe
  2⤵
  PID:13104
- C:\Windows\System\hZsgbTQ.exe
  C:\Windows\System\hZsgbTQ.exe
  2⤵
  PID:13140
- C:\Windows\System\hlLmcrq.exe
  C:\Windows\System\hlLmcrq.exe
  2⤵
  PID:13156
- C:\Windows\System\slBbdfL.exe
  C:\Windows\System\slBbdfL.exe
  2⤵
  PID:13188
- C:\Windows\System\crBdEis.exe
  C:\Windows\System\crBdEis.exe
  2⤵
  PID:13212
- C:\Windows\System\plAfPlt.exe
  C:\Windows\System\plAfPlt.exe
  2⤵
  PID:13244
- C:\Windows\System\dYCnjiw.exe
  C:\Windows\System\dYCnjiw.exe
  2⤵
  PID:13260
- C:\Windows\System\jdBgSGE.exe
  C:\Windows\System\jdBgSGE.exe
  2⤵
  PID:13276
- C:\Windows\System\VHFlrXa.exe
  C:\Windows\System\VHFlrXa.exe
  2⤵
  PID:13304
- C:\Windows\System\VEPYxOb.exe
  C:\Windows\System\VEPYxOb.exe
  2⤵
  PID:12328
- C:\Windows\System\PDypowy.exe
  C:\Windows\System\PDypowy.exe
  2⤵
  PID:12440
- C:\Windows\System\sxfEjZf.exe
  C:\Windows\System\sxfEjZf.exe
  2⤵
  PID:12520
- C:\Windows\System\AgUvKtn.exe
  C:\Windows\System\AgUvKtn.exe
  2⤵
  PID:12592
- C:\Windows\System\aJayHHz.exe
  C:\Windows\System\aJayHHz.exe
  2⤵
  PID:12612
- C:\Windows\System\PCpGjJq.exe
  C:\Windows\System\PCpGjJq.exe
  2⤵
  PID:12684
- C:\Windows\System\UHHHDVS.exe
  C:\Windows\System\UHHHDVS.exe
  2⤵
  PID:12736
- C:\Windows\System\ImYiHSo.exe
  C:\Windows\System\ImYiHSo.exe
  2⤵
  PID:12804
- C:\Windows\System\yfCWqAR.exe
  C:\Windows\System\yfCWqAR.exe
  2⤵
  PID:12908
- C:\Windows\System\JGDFsSv.exe
  C:\Windows\System\JGDFsSv.exe
  2⤵
  PID:12972
- C:\Windows\System\pOIDLxo.exe
  C:\Windows\System\pOIDLxo.exe
  2⤵
  PID:13024
- C:\Windows\System\zfZMrIK.exe
  C:\Windows\System\zfZMrIK.exe
  2⤵
  PID:13132
- C:\Windows\System\xGIJncX.exe
  C:\Windows\System\xGIJncX.exe
  2⤵
  PID:13176
- C:\Windows\System\xAadDhU.exe
  C:\Windows\System\xAadDhU.exe
  2⤵
  PID:13268
- C:\Windows\System\FyXgNki.exe
  C:\Windows\System\FyXgNki.exe
  2⤵
  PID:12480
- C:\Windows\System\podjOce.exe
  C:\Windows\System\podjOce.exe
  2⤵
  PID:12372
- C:\Windows\System\YAfcBdu.exe
  C:\Windows\System\YAfcBdu.exe
  2⤵
  PID:12584
- C:\Windows\System\MDuHLpf.exe
  C:\Windows\System\MDuHLpf.exe
  2⤵
  PID:12904
- C:\Windows\System\sAJhuqj.exe
  C:\Windows\System\sAJhuqj.exe
  2⤵
  PID:11924
- C:\Windows\System\XSGCYdt.exe
  C:\Windows\System\XSGCYdt.exe
  2⤵
  PID:12664
- C:\Windows\System\tAvFtPz.exe
  C:\Windows\System\tAvFtPz.exe
  2⤵
  PID:12564
- C:\Windows\System\aCjTSsj.exe
  C:\Windows\System\aCjTSsj.exe
  2⤵
  PID:13148
- C:\Windows\System\uIqWAVu.exe
  C:\Windows\System\uIqWAVu.exe
  2⤵
  PID:12500
- C:\Windows\System\KHpiZcd.exe
  C:\Windows\System\KHpiZcd.exe
  2⤵
  PID:13372
- C:\Windows\System\WkCcEtx.exe
  C:\Windows\System\WkCcEtx.exe
  2⤵
  PID:13396
- C:\Windows\System\WjmLhrI.exe
  C:\Windows\System\WjmLhrI.exe
  2⤵
  PID:13420
- C:\Windows\System\lYCImbZ.exe
  C:\Windows\System\lYCImbZ.exe
  2⤵
  PID:13444
- C:\Windows\System\GLRGlzH.exe
  C:\Windows\System\GLRGlzH.exe
  2⤵
  PID:13476
- C:\Windows\System\apNEsEI.exe
  C:\Windows\System\apNEsEI.exe
  2⤵
  PID:13508
- C:\Windows\System\LBhfDeJ.exe
  C:\Windows\System\LBhfDeJ.exe
  2⤵
  PID:13572
- C:\Windows\System\ShGMGlN.exe
  C:\Windows\System\ShGMGlN.exe
  2⤵
  PID:13592
- C:\Windows\System\jhvdssu.exe
  C:\Windows\System\jhvdssu.exe
  2⤵
  PID:13616
- C:\Windows\System\VOHpvyF.exe
  C:\Windows\System\VOHpvyF.exe
  2⤵
  PID:13636
- C:\Windows\System\PecREET.exe
  C:\Windows\System\PecREET.exe
  2⤵
  PID:13688
- C:\Windows\System\nGJuFMa.exe
  C:\Windows\System\nGJuFMa.exe
  2⤵
  PID:13728
- C:\Windows\System\phsWlOf.exe
  C:\Windows\System\phsWlOf.exe
  2⤵
  PID:13756
- C:\Windows\System\CGYsurZ.exe
  C:\Windows\System\CGYsurZ.exe
  2⤵
  PID:13784
- C:\Windows\System\QgjBWwQ.exe
  C:\Windows\System\QgjBWwQ.exe
  2⤵
  PID:13840
- C:\Windows\System\rGgPECZ.exe
  C:\Windows\System\rGgPECZ.exe
  2⤵
  PID:13872
- C:\Windows\System\vPjNXDA.exe
  C:\Windows\System\vPjNXDA.exe
  2⤵
  PID:13900
- C:\Windows\System\RhYTahS.exe
  C:\Windows\System\RhYTahS.exe
  2⤵
  PID:13916
- C:\Windows\System\nNXjgjJ.exe
  C:\Windows\System\nNXjgjJ.exe
  2⤵
  PID:13940
- C:\Windows\System\jDWGGEC.exe
  C:\Windows\System\jDWGGEC.exe
  2⤵
  PID:13956
- C:\Windows\System\PjtqWeT.exe
  C:\Windows\System\PjtqWeT.exe
  2⤵
  PID:13976
- C:\Windows\System\PZzMOrX.exe
  C:\Windows\System\PZzMOrX.exe
  2⤵
  PID:14016
- C:\Windows\System\ztxygyo.exe
  C:\Windows\System\ztxygyo.exe
  2⤵
  PID:14048
- C:\Windows\System\pgsZMKf.exe
  C:\Windows\System\pgsZMKf.exe
  2⤵
  PID:14072
- C:\Windows\System\XYwqcMy.exe
  C:\Windows\System\XYwqcMy.exe
  2⤵
  PID:14092
- C:\Windows\System\zcIMHOL.exe
  C:\Windows\System\zcIMHOL.exe
  2⤵
  PID:14120
- C:\Windows\System\TtuSypY.exe
  C:\Windows\System\TtuSypY.exe
  2⤵
  PID:14164
- C:\Windows\System\fuAnZNh.exe
  C:\Windows\System\fuAnZNh.exe
  2⤵
  PID:14188
- C:\Windows\System\UdhxSwP.exe
  C:\Windows\System\UdhxSwP.exe
  2⤵
  PID:14220
- C:\Windows\System\qFpbtfV.exe
  C:\Windows\System\qFpbtfV.exe
  2⤵
  PID:14240
- C:\Windows\System\gFBQQIv.exe
  C:\Windows\System\gFBQQIv.exe
  2⤵
  PID:14256
- C:\Windows\System\UWwxWgm.exe
  C:\Windows\System\UWwxWgm.exe
  2⤵
  PID:14300
- C:\Windows\System\HnLblwS.exe
  C:\Windows\System\HnLblwS.exe
  2⤵
  PID:14320
- C:\Windows\System\nSJuEWa.exe
  C:\Windows\System\nSJuEWa.exe
  2⤵
  PID:13336
- C:\Windows\System\mIdmNuE.exe
  C:\Windows\System\mIdmNuE.exe
  2⤵
  PID:13428
- C:\Windows\System\rrAwdwS.exe
  C:\Windows\System\rrAwdwS.exe
  2⤵
  PID:13488
- C:\Windows\System\OaXVJFh.exe
  C:\Windows\System\OaXVJFh.exe
  2⤵
  PID:13600
- C:\Windows\System\ycCcTIR.exe
  C:\Windows\System\ycCcTIR.exe
  2⤵
  PID:13632
- C:\Windows\System\MTmnkXK.exe
  C:\Windows\System\MTmnkXK.exe
  2⤵
  PID:13720
- C:\Windows\System\bghsXEk.exe
  C:\Windows\System\bghsXEk.exe
  2⤵
  PID:13768
- C:\Windows\System\oCmxfOV.exe
  C:\Windows\System\oCmxfOV.exe
  2⤵
  PID:13964
- C:\Windows\System\sIWBABW.exe
  C:\Windows\System\sIWBABW.exe
  2⤵
  PID:13952
- C:\Windows\System\woXMzhi.exe
  C:\Windows\System\woXMzhi.exe
  2⤵
  PID:14036
- C:\Windows\System\CyjyoWe.exe
  C:\Windows\System\CyjyoWe.exe
  2⤵
  PID:14148
- C:\Windows\System\OFaojuj.exe
  C:\Windows\System\OFaojuj.exe
  2⤵
  PID:14236
- C:\Windows\System\EvDXIpU.exe
  C:\Windows\System\EvDXIpU.exe
  2⤵
  PID:14272
- C:\Windows\System\EcmsbuV.exe
  C:\Windows\System\EcmsbuV.exe
  2⤵
  PID:14308
- C:\Windows\System\bdWipvN.exe
  C:\Windows\System\bdWipvN.exe
  2⤵
  PID:13388
- C:\Windows\System\JsKLNTn.exe
  C:\Windows\System\JsKLNTn.exe
  2⤵
  PID:13184
- C:\Windows\System\SXZfHwE.exe
  C:\Windows\System\SXZfHwE.exe
  2⤵
  PID:13712
- C:\Windows\System\aldkPmP.exe
  C:\Windows\System\aldkPmP.exe
  2⤵
  PID:13888
- C:\Windows\System\rmuihxY.exe
  C:\Windows\System\rmuihxY.exe
  2⤵
  PID:13928
- C:\Windows\System\ysQVTnC.exe
  C:\Windows\System\ysQVTnC.exe
  2⤵
  PID:14116
- C:\Windows\System\LebpqlL.exe
  C:\Windows\System\LebpqlL.exe
  2⤵
  PID:14232
- C:\Windows\System\oYlxPdc.exe
  C:\Windows\System\oYlxPdc.exe
  2⤵
  PID:13324
- C:\Windows\System\KolbayD.exe
  C:\Windows\System\KolbayD.exe
  2⤵
  PID:14176
- C:\Windows\System\reWFzmr.exe
  C:\Windows\System\reWFzmr.exe
  2⤵
  PID:13552
- C:\Windows\System\SJslqdq.exe
  C:\Windows\System\SJslqdq.exe
  2⤵
  PID:14348
- C:\Windows\System\Ltkiawe.exe
  C:\Windows\System\Ltkiawe.exe
  2⤵
  PID:14376
- C:\Windows\System\AgoBrVv.exe
  C:\Windows\System\AgoBrVv.exe
  2⤵
  PID:14408
- C:\Windows\System\gcnHwMj.exe
  C:\Windows\System\gcnHwMj.exe
  2⤵
  PID:14452
- C:\Windows\System\tgGzfrF.exe
  C:\Windows\System\tgGzfrF.exe
  2⤵
  PID:14468
- C:\Windows\System\sDRrNkx.exe
  C:\Windows\System\sDRrNkx.exe
  2⤵
  PID:14496
- C:\Windows\System\JVJuFek.exe
  C:\Windows\System\JVJuFek.exe
  2⤵
  PID:14532
- C:\Windows\System\dDVvMMo.exe
  C:\Windows\System\dDVvMMo.exe
  2⤵
  PID:14552
- C:\Windows\System\MuVWsma.exe
  C:\Windows\System\MuVWsma.exe
  2⤵
  PID:14580
- C:\Windows\System\BwHPFNi.exe
  C:\Windows\System\BwHPFNi.exe
  2⤵
  PID:14600
- C:\Windows\System\MFmrTAS.exe
  C:\Windows\System\MFmrTAS.exe
  2⤵
  PID:14640
- C:\Windows\System\ExOLhLM.exe
  C:\Windows\System\ExOLhLM.exe
  2⤵
  PID:14664
- C:\Windows\System\HczPBUJ.exe
  C:\Windows\System\HczPBUJ.exe
  2⤵
  PID:14692
- C:\Windows\System\ARdWPGR.exe
  C:\Windows\System\ARdWPGR.exe
  2⤵
  PID:14732
- C:\Windows\System\PEznRRI.exe
  C:\Windows\System\PEznRRI.exe
  2⤵
  PID:14760
- C:\Windows\System\mgysEkj.exe
  C:\Windows\System\mgysEkj.exe
  2⤵
  PID:14776
- C:\Windows\System\EGuMaFY.exe
  C:\Windows\System\EGuMaFY.exe
  2⤵
  PID:14804
- C:\Windows\System\RrmCgCA.exe
  C:\Windows\System\RrmCgCA.exe
  2⤵
  PID:14840
- C:\Windows\System\rxYNAHA.exe
  C:\Windows\System\rxYNAHA.exe
  2⤵
  PID:14860
- C:\Windows\System\EbwSVpW.exe
  C:\Windows\System\EbwSVpW.exe
  2⤵
  PID:14888
- C:\Windows\System\iWvSypu.exe
  C:\Windows\System\iWvSypu.exe
  2⤵
  PID:14904
- C:\Windows\System\EVoEWWc.exe
  C:\Windows\System\EVoEWWc.exe
  2⤵
  PID:14940
- C:\Windows\System\FXSHqrM.exe
  C:\Windows\System\FXSHqrM.exe
  2⤵
  PID:14972
- C:\Windows\System\CbAWFTX.exe
  C:\Windows\System\CbAWFTX.exe
  2⤵
  PID:15000
- C:\Windows\System\ZecXdjX.exe
  C:\Windows\System\ZecXdjX.exe
  2⤵
  PID:15028
- C:\Windows\System\iWomStl.exe
  C:\Windows\System\iWomStl.exe
  2⤵
  PID:15068
- C:\Windows\System\NgRXRdE.exe
  C:\Windows\System\NgRXRdE.exe
  2⤵
  PID:15096
- C:\Windows\System\VjztClY.exe
  C:\Windows\System\VjztClY.exe
  2⤵
  PID:15116
- C:\Windows\System\dpHbjIj.exe
  C:\Windows\System\dpHbjIj.exe
  2⤵
  PID:15132
- C:\Windows\System\TqmZFzb.exe
  C:\Windows\System\TqmZFzb.exe
  2⤵
  PID:15168
- C:\Windows\System\kXjbkee.exe
  C:\Windows\System\kXjbkee.exe
  2⤵
  PID:15188
- C:\Windows\System\BSyaKDx.exe
  C:\Windows\System\BSyaKDx.exe
  2⤵
  PID:15224
- C:\Windows\System\wvlLwuH.exe
  C:\Windows\System\wvlLwuH.exe
  2⤵
  PID:15264
- C:\Windows\System\FXJwmda.exe
  C:\Windows\System\FXJwmda.exe
  2⤵
  PID:15288
- C:\Windows\System\ZvJPlHU.exe
  C:\Windows\System\ZvJPlHU.exe
  2⤵
  PID:15332
- C:\Windows\System\iMwxzdM.exe
  C:\Windows\System\iMwxzdM.exe
  2⤵
  PID:15348
- C:\Windows\System\TrCdujT.exe
  C:\Windows\System\TrCdujT.exe
  2⤵
  PID:14388
- C:\Windows\System\twvRTlW.exe
  C:\Windows\System\twvRTlW.exe
  2⤵
  PID:14428
- C:\Windows\System\GlvHyxk.exe
  C:\Windows\System\GlvHyxk.exe
  2⤵
  PID:14528
- C:\Windows\System\QwRcjql.exe
  C:\Windows\System\QwRcjql.exe
  2⤵
  PID:14548
- C:\Windows\System\ToqnOpl.exe
  C:\Windows\System\ToqnOpl.exe
  2⤵
  PID:14588
- C:\Windows\System\LXcSTbp.exe
  C:\Windows\System\LXcSTbp.exe
  2⤵
  PID:14680
- C:\Windows\System\CUsiMKQ.exe
  C:\Windows\System\CUsiMKQ.exe
  2⤵
  PID:14724
- C:\Windows\System\PzobiIv.exe
  C:\Windows\System\PzobiIv.exe
  2⤵
  PID:14816
- C:\Windows\System\HTdZJwv.exe
  C:\Windows\System\HTdZJwv.exe
  2⤵
  PID:14856
- C:\Windows\System\KTUdadN.exe
  C:\Windows\System\KTUdadN.exe
  2⤵
  PID:14968
- C:\Windows\System\VVYeZbt.exe
  C:\Windows\System\VVYeZbt.exe
  2⤵
  PID:15040
- C:\Windows\System\EVlmkiI.exe
  C:\Windows\System\EVlmkiI.exe
  2⤵
  PID:15104
- C:\Windows\System\JrcNEwy.exe
  C:\Windows\System\JrcNEwy.exe
  2⤵
  PID:15160
- C:\Windows\System\qhpbwoh.exe
  C:\Windows\System\qhpbwoh.exe
  2⤵
  PID:15216
- C:\Windows\System\zLIGLEA.exe
  C:\Windows\System\zLIGLEA.exe
  2⤵
  PID:15280
- C:\Windows\System\mLObJTc.exe
  C:\Windows\System\mLObJTc.exe
  2⤵
  PID:15320
- C:\Windows\System\JqohMNI.exe
  C:\Windows\System\JqohMNI.exe
  2⤵
  PID:14488
- C:\Windows\System\fDidPrV.exe
  C:\Windows\System\fDidPrV.exe
  2⤵
  PID:14564
- C:\Windows\System\cEIzWIU.exe
  C:\Windows\System\cEIzWIU.exe
  2⤵
  PID:14624
- C:\Windows\System\udhEqfY.exe
  C:\Windows\System\udhEqfY.exe
  2⤵
  PID:14716
- C:\Windows\System\PdbPEvT.exe
  C:\Windows\System\PdbPEvT.exe
  2⤵
  PID:15128
- C:\Windows\System\roIDgDn.exe
  C:\Windows\System\roIDgDn.exe
  2⤵
  PID:15184
- C:\Windows\System\lzdyyHw.exe
  C:\Windows\System\lzdyyHw.exe
  2⤵
  PID:15260
- C:\Windows\System\LDiVXxw.exe
  C:\Windows\System\LDiVXxw.exe
  2⤵
  PID:14792
- C:\Windows\System\liciITB.exe
  C:\Windows\System\liciITB.exe
  2⤵
  PID:15048
- C:\Windows\System\ieIHqFl.exe
  C:\Windows\System\ieIHqFl.exe
  2⤵
  PID:14400
- C:\Windows\System\WAJUMVo.exe
  C:\Windows\System\WAJUMVo.exe
  2⤵
  PID:14656
- C:\Windows\System\aLkgCSb.exe
  C:\Windows\System\aLkgCSb.exe
  2⤵
  PID:15376
- C:\Windows\System\OrBpLtH.exe
  C:\Windows\System\OrBpLtH.exe
  2⤵
  PID:15416
- C:\Windows\System\CWoaeQd.exe
  C:\Windows\System\CWoaeQd.exe
  2⤵
  PID:15432
- C:\Windows\System\EzLtnKx.exe
  C:\Windows\System\EzLtnKx.exe
  2⤵
  PID:15472
- C:\Windows\System\DoMvbTO.exe
  C:\Windows\System\DoMvbTO.exe
  2⤵
  PID:15488
- C:\Windows\System\IVyyrSy.exe
  C:\Windows\System\IVyyrSy.exe
  2⤵
  PID:15516
- C:\Windows\System\PZieINI.exe
  C:\Windows\System\PZieINI.exe
  2⤵
  PID:15544
- C:\Windows\System\PzgUuCf.exe
  C:\Windows\System\PzgUuCf.exe
  2⤵
  PID:15564
- C:\Windows\System\gnyFleX.exe
  C:\Windows\System\gnyFleX.exe
  2⤵
  PID:15592
- C:\Windows\System\hRvObXs.exe
  C:\Windows\System\hRvObXs.exe
  2⤵
  PID:15612
- C:\Windows\System\wpYTzti.exe
  C:\Windows\System\wpYTzti.exe
  2⤵
  PID:15652
- C:\Windows\System\rPjITvF.exe
  C:\Windows\System\rPjITvF.exe
  2⤵
  PID:15696
- C:\Windows\System\jkrmeeH.exe
  C:\Windows\System\jkrmeeH.exe
  2⤵
  PID:15724
- C:\Windows\System\gzrSQJd.exe
  C:\Windows\System\gzrSQJd.exe
  2⤵
  PID:15740
- C:\Windows\System\rqRfCdD.exe
  C:\Windows\System\rqRfCdD.exe
  2⤵
  PID:15768
- C:\Windows\System\mWTtlpD.exe
  C:\Windows\System\mWTtlpD.exe
  2⤵
  PID:15792
- C:\Windows\System\SCtvvVr.exe
  C:\Windows\System\SCtvvVr.exe
  2⤵
  PID:15820
- C:\Windows\System\MTQpWsR.exe
  C:\Windows\System\MTQpWsR.exe
  2⤵
  PID:15852
- C:\Windows\System\HjAUiKJ.exe
  C:\Windows\System\HjAUiKJ.exe
  2⤵
  PID:15876
- C:\Windows\System\Tsbhaka.exe
  C:\Windows\System\Tsbhaka.exe
  2⤵
  PID:15908
- C:\Windows\System\USORQAZ.exe
  C:\Windows\System\USORQAZ.exe
  2⤵
  PID:15936
- C:\Windows\System\BiTwlvW.exe
  C:\Windows\System\BiTwlvW.exe
  2⤵
  PID:15964
- C:\Windows\System\GvUPHnY.exe
  C:\Windows\System\GvUPHnY.exe
  2⤵
  PID:15984
- C:\Windows\System\lhHtDxs.exe
  C:\Windows\System\lhHtDxs.exe
  2⤵
  PID:16032
- C:\Windows\System\dqNrJpg.exe
  C:\Windows\System\dqNrJpg.exe
  2⤵
  PID:16060
- C:\Windows\System\QhgugHJ.exe
  C:\Windows\System\QhgugHJ.exe
  2⤵
  PID:16076
- C:\Windows\System\dOydCBt.exe
  C:\Windows\System\dOydCBt.exe
  2⤵
  PID:16092
- C:\Windows\System\rQFqjXt.exe
  C:\Windows\System\rQFqjXt.exe
  2⤵
  PID:16120
- C:\Windows\System\UJxiiHm.exe
  C:\Windows\System\UJxiiHm.exe
  2⤵
  PID:16140
- C:\Windows\System\vJoKNnv.exe
  C:\Windows\System\vJoKNnv.exe
  2⤵
  PID:16164
- C:\Windows\System\VEefShD.exe
  C:\Windows\System\VEefShD.exe
  2⤵
  PID:16192
- C:\Windows\System\MsBbfmu.exe
  C:\Windows\System\MsBbfmu.exe
  2⤵
  PID:16224
- C:\Windows\System\gHZPfAT.exe
  C:\Windows\System\gHZPfAT.exe
  2⤵
  PID:16252
- C:\Windows\System\PRRcthd.exe
  C:\Windows\System\PRRcthd.exe
  2⤵
  PID:16296
- C:\Windows\System\sAFSLeG.exe
  C:\Windows\System\sAFSLeG.exe
  2⤵
  PID:16320
- C:\Windows\System\vUmonuj.exe
  C:\Windows\System\vUmonuj.exe
  2⤵
  PID:16340
- C:\Windows\System\Lsidxii.exe
  C:\Windows\System\Lsidxii.exe
  2⤵
  PID:15316
- C:\Windows\System\kdxUtcn.exe
  C:\Windows\System\kdxUtcn.exe
  2⤵
  PID:15448
- C:\Windows\System\ApbaqUe.exe
  C:\Windows\System\ApbaqUe.exe
  2⤵
  PID:15504
- C:\Windows\System\XqlDbuk.exe
  C:\Windows\System\XqlDbuk.exe
  2⤵
  PID:15560
- C:\Windows\System\lKdjrbM.exe
  C:\Windows\System\lKdjrbM.exe
  2⤵
  PID:15604
- C:\Windows\System\BlpPngG.exe
  C:\Windows\System\BlpPngG.exe
  2⤵
  PID:15692
- C:\Windows\System\kpYDcmR.exe
  C:\Windows\System\kpYDcmR.exe
  2⤵
  PID:15800
- C:\Windows\System\tdhYtNh.exe
  C:\Windows\System\tdhYtNh.exe
  2⤵
  PID:15900
- C:\Windows\System\xhIMTLe.exe
  C:\Windows\System\xhIMTLe.exe
  2⤵
  PID:15972
- C:\Windows\System\QqiOZzZ.exe
  C:\Windows\System\QqiOZzZ.exe
  2⤵
  PID:16024
- C:\Windows\System\qRiareF.exe
  C:\Windows\System\qRiareF.exe
  2⤵
  PID:16068
- C:\Windows\System\NvZrOVz.exe
  C:\Windows\System\NvZrOVz.exe
  2⤵
  PID:16176
- C:\Windows\System\UXiToYR.exe
  C:\Windows\System\UXiToYR.exe
  2⤵
  PID:16148
- C:\Windows\System\NipoETs.exe
  C:\Windows\System\NipoETs.exe
  2⤵
  PID:16268
- C:\Windows\System\wdggvwD.exe
  C:\Windows\System\wdggvwD.exe
  2⤵
  PID:16348
- C:\Windows\System\BEaywsJ.exe
  C:\Windows\System\BEaywsJ.exe
  2⤵
  PID:15480
- C:\Windows\System\QHuhDQK.exe
  C:\Windows\System\QHuhDQK.exe
  2⤵
  PID:15648
- C:\Windows\System\yQfrZnD.exe
  C:\Windows\System\yQfrZnD.exe
  2⤵
  PID:15760
- C:\Windows\System\lZJdcEi.exe
  C:\Windows\System\lZJdcEi.exe
  2⤵
  PID:15952
- C:\Windows\System\TZJusKB.exe
  C:\Windows\System\TZJusKB.exe
  2⤵
  PID:16052
- C:\Windows\System\AqBlpkp.exe
  C:\Windows\System\AqBlpkp.exe
  2⤵
  PID:16180
- C:\Windows\System\XFclFlU.exe
  C:\Windows\System\XFclFlU.exe
  2⤵
  PID:16280
- C:\Windows\System\sCJbcCi.exe
  C:\Windows\System\sCJbcCi.exe
  2⤵
  PID:15508
- C:\Windows\System\nzybYOn.exe
  C:\Windows\System\nzybYOn.exe
  2⤵
  PID:15956
- C:\Windows\System\yIPcrqi.exe
  C:\Windows\System\yIPcrqi.exe
  2⤵
  PID:16244
- C:\Windows\System\seaQLmb.exe
  C:\Windows\System\seaQLmb.exe
  2⤵
  PID:16396
- C:\Windows\System\dJpRCMr.exe
  C:\Windows\System\dJpRCMr.exe
  2⤵
  PID:16416
- C:\Windows\System\DeJsRLD.exe
  C:\Windows\System\DeJsRLD.exe
  2⤵
  PID:16440
- C:\Windows\System\gZXHUfP.exe
  C:\Windows\System\gZXHUfP.exe
  2⤵
  PID:16460
- C:\Windows\System\sMFXsIW.exe
  C:\Windows\System\sMFXsIW.exe
  2⤵
  PID:16524
- C:\Windows\System\IHgaJmT.exe
  C:\Windows\System\IHgaJmT.exe
  2⤵
  PID:16564
- C:\Windows\System\zFveUcw.exe
  C:\Windows\System\zFveUcw.exe
  2⤵
  PID:16584
- C:\Windows\System\VRvWvxn.exe
  C:\Windows\System\VRvWvxn.exe
  2⤵
  PID:16608
- C:\Windows\System\gcfthey.exe
  C:\Windows\System\gcfthey.exe
  2⤵
  PID:16628
- C:\Windows\System\xpGEwAs.exe
  C:\Windows\System\xpGEwAs.exe
  2⤵
  PID:16652
- C:\Windows\System\SeaKOzT.exe
  C:\Windows\System\SeaKOzT.exe
  2⤵
  PID:16668
- C:\Windows\System\ImZEVZI.exe
  C:\Windows\System\ImZEVZI.exe
  2⤵
  PID:16704
- C:\Windows\System\NSwFyIL.exe
  C:\Windows\System\NSwFyIL.exe
  2⤵
  PID:16736
- C:\Windows\System\zdfkbSu.exe
  C:\Windows\System\zdfkbSu.exe
  2⤵
  PID:16768
- C:\Windows\System\iQUcdMM.exe
  C:\Windows\System\iQUcdMM.exe
  2⤵
  PID:16816
- C:\Windows\System\ICTlzka.exe
  C:\Windows\System\ICTlzka.exe
  2⤵
  PID:16832
- C:\Windows\System\NBcFhgw.exe
  C:\Windows\System\NBcFhgw.exe
  2⤵
  PID:16848
- C:\Windows\System\EkNLSQN.exe
  C:\Windows\System\EkNLSQN.exe
  2⤵
  PID:16880
- C:\Windows\System\XJPpQlg.exe
  C:\Windows\System\XJPpQlg.exe
  2⤵
  PID:16904
- C:\Windows\System\WhyKobC.exe
  C:\Windows\System\WhyKobC.exe
  2⤵
  PID:16920
- C:\Windows\System\XpoSair.exe
  C:\Windows\System\XpoSair.exe
  2⤵
  PID:16944
- C:\Windows\System\ZLgiKnx.exe
  C:\Windows\System\ZLgiKnx.exe
  2⤵
  PID:16984
- C:\Windows\System\bzEZGXn.exe
  C:\Windows\System\bzEZGXn.exe
  2⤵
  PID:17024
- C:\Windows\System\HKDykaa.exe
  C:\Windows\System\HKDykaa.exe
  2⤵
  PID:17052
- C:\Windows\System\tWlOlEB.exe
  C:\Windows\System\tWlOlEB.exe
  2⤵
  PID:17076
- C:\Windows\System\jgmoDjy.exe
  C:\Windows\System\jgmoDjy.exe
  2⤵
  PID:17100
- C:\Windows\System\PpgqleN.exe
  C:\Windows\System\PpgqleN.exe
  2⤵
  PID:17152
- C:\Windows\System\NpYJPhM.exe
  C:\Windows\System\NpYJPhM.exe
  2⤵
  PID:17168
- C:\Windows\System\QBrkAkU.exe
  C:\Windows\System\QBrkAkU.exe
  2⤵
  PID:17208
- C:\Windows\System\UjtGBbH.exe
  C:\Windows\System\UjtGBbH.exe
  2⤵
  PID:17236
- C:\Windows\System\tAidGHG.exe
  C:\Windows\System\tAidGHG.exe
  2⤵
  PID:17264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BWPHEoh.exe

Filesize
1.3MB

MD5
c94796b599a191e7e2534297177a8329

SHA1
0461855e81424745b7f5bc96dfc9af3e967c1f06

SHA256
d5f0445f5e1f1b953a5df47d731125af9e44da7143b032765746e7a76f832ef6

SHA512
d988bdc2d09a4d095e2edaff58e768cd93d37d843b90b6cc49ce7e86cee250dedbd8e9e9105b6ab6f1642af351c21843c251f16f27effbfd0936c21ae49baa49

Download Submit
C:\Windows\System\GXHtTZD.exe

Filesize
1.4MB

MD5
6baa3fae98d1401d49e697422fc352a2

SHA1
2854bac71a9cea4896c843b986883d121b229087

SHA256
648749efd65a3f5e6ac8e7443dc875aa0f6a3586e84795f4d43e698a073fa83a

SHA512
1dc3c799ce96d2ce04a8c3968f4fdfaf05a59d926e6e51a97adcbcab7c982a508a0cb9a4bddb6515d01b8f15d35b693a402c60d42510eb1c6131250b8571cc7c

Download Submit
C:\Windows\System\HIGslAW.exe

Filesize
1.3MB

MD5
b3728361885ec3a64fe3b9d0f0168626

SHA1
33386b6cfcd58c2425dc9c676b101637339e82af

SHA256
e3596504c044db86d150e6258fffca1ce634a7443f166de21df338f542866006

SHA512
fae3aa64f99de07ffdd855e4a5d4de730fd5331e50d701cc909f42f85d95c95ad4328562111279fa78e2921b32f62b57630f022de9e75e7f76caba00ac120e9d

Download Submit
C:\Windows\System\HglTNVq.exe

Filesize
1.3MB

MD5
b6b5d504e2a04652f00bad85ab77710c

SHA1
518c6d6e8835543a016f5c36f1fb9913d11fe813

SHA256
f232a0abb25076152f81c0dc0c947b3fda0b388307efc9c7cb5dfebf4d88b4fe

SHA512
76126c2dbd8d334fad9cdce9fbd6e59cc7782d77b55f58c33507d792c3fe722792d3f9bac3cdecb1d5fff0a525468d2b17ba14b8105b8e4ad2fe4cb98e6bcf21

Download Submit
C:\Windows\System\MPYplOj.exe

Filesize
1.3MB

MD5
8c4f1c2dccade346655be617232418c8

SHA1
358d02d77d650230b8330a643116ffecf824c544

SHA256
acbe34d9bdce2a1c4da3e518bbaf16b4ba303d64e2ef3e42cb58b2f4b060d2d5

SHA512
21bf2fbf985e2b8be16d3340ca56add17eff38700d362fa098eb6935ea9c758f50f7c98c98a6b6f53bef2a1df6028b52ae5c211b9eb81d48e8ddc11c69bf4d14

Download Submit
C:\Windows\System\MVvKScb.exe

Filesize
1.3MB

MD5
2b15d70dc79ff7bcbb4c60cde28d9d9c

SHA1
3b59b0508fc47cf24924b52f97897aeb96133491

SHA256
d19c81e1aad2b5906ed702e719d2a6ce4d6010d028340e50475db6db4cad0f50

SHA512
254ba66e5501963a6dd3808e4abde29c28f55506689c1c51bb946e7a8923e425e4bf145c45cc5616350270f45b91cd17b6475726aeb04e1469b46fdaabb1e0a0

Download Submit
C:\Windows\System\NVqQHZX.exe

Filesize
1.3MB

MD5
28f8df718616ebda4fcd72c9da607f8f

SHA1
5fb5b3ad832a69b1a5aa06bad2233c7f289fd681

SHA256
20486180284ff00969f903cce459e02576bdfac2e7484f53749932da183fd758

SHA512
246ec68ab91f3554f464b03cc4824bf2865e423c9450e03dfe306d23882d0beacb2be12808d78a80e9371e5c362d20ed8b9e9bcf773e6ea6b1cb16e921f6f17b

Download Submit
C:\Windows\System\NmhgnQu.exe

Filesize
1.3MB

MD5
2484085268e9643f51a1f923c464fc55

SHA1
ccbd05dd906161f3f4e93ad41a7151fa4e619ec3

SHA256
dc9aeca38176b8aabc00c5803cd32e7bcd09b09fdfc0aa14d7d2e253a313f7fc

SHA512
bfa554715be9c5fd157119da29510e5a03d9c1c468cc21d01883fb44de9b7e9e82b70ca5037dc9fab548be54df610c21a8e62f51ed92e2d6fabfa89c74131021

Download Submit
C:\Windows\System\PoKrlGE.exe

Filesize
1.3MB

MD5
5239565b51282cf190b4db3c64653d35

SHA1
b860d5b05452ad686e5e13d89bc1480da12cca1d

SHA256
a26c5c0568aa01805887eeb9399c77b10dc8af29bffd7886321cf316044a2729

SHA512
829055cd94bdc88e80aba898c377ea8e9b41ca46c7f14ebbbc6c38227de7a7f159b55b6484c35da838590f21b3c85a169a686a6bfe952b84a1f779eb581def77

Download Submit
C:\Windows\System\QsciFTy.exe

Filesize
1.3MB

MD5
0173d30c72e9f2f5ee6568eba6036684

SHA1
8c07616574a5090e50d2c7ef103d6902b876dbe0

SHA256
ba0f61564ef20f7b3ce4924dd54c79296e94ce56078749ac1591c382aec3574b

SHA512
7ab6f39bedac97ee4555f7efed71bd5ff7538cbe413ee0a5d7f089e985edff46744d0068018af12bff8abb4a3d3e1cfd0aa1c1ea05a8fac7cd9894f57165ef4c

Download Submit
C:\Windows\System\RwKDXhX.exe

Filesize
1.3MB

MD5
0a2d6d69c8d3090c3795f85e9bd38395

SHA1
df4c6aedf53e10e6333e8fd5e832dd662445e15a

SHA256
e45b54636c7bddb9aa6f2e178acabb94af8d0778583194a5ed740a89ed6784b0

SHA512
42d19e384ad182fc2b023f2a8cfafe1c5828cbee6fd54961724bd86fe9deb8cd087cf0ffbe8dfaaa35cdd406f6d9790911a719115c8578170fca8ec2b64e46a2

Download Submit
C:\Windows\System\Thlfkyv.exe

Filesize
1.4MB

MD5
966209265c60ad11731f22358c5ed6c7

SHA1
d9fd2c43fc3aebc0a353819220d157ef82e29647

SHA256
2daed0cd56b8b949d14a719019ac34f2368081c7957a2faf931711f8494b7727

SHA512
b5fd84bd4ff00b734aed515d04c1a793245d181b6b3d81a97e53a3feedd195a10c730448431303a56669e470d167c2fbfe09a3261492b22f43c3240491416cd7

Download Submit
C:\Windows\System\UQtMfkC.exe

Filesize
1.3MB

MD5
f450ebd12b9969aadd703064369b7aff

SHA1
1e7470341f06e6c167e91f59edaa94031121ca8f

SHA256
7504bb6e80a7320513a42c2f1a61300f72cfd3d0449bcb7ba8b3a36513d2fae6

SHA512
8028a6a69e32d6f51825d4bb4bca1228d60d22726a30564cc25377326cfd6419b9dd9ed995b9ec6c80f74dd70604774cd4eb5181fe11204d96f39fd59adad402

Download Submit
C:\Windows\System\WtMKoTH.exe

Filesize
1.3MB

MD5
53fec27686a2494ac77e1014bb3a2fba

SHA1
123f98dde5fbcfc1e6b4ac1d82cf0d3cff0e36cf

SHA256
c16364a567a2d69d23d6d89acba4049a1e41f172181af5cd2c2c33af25a0aa05

SHA512
fc5c924123e5f7ca926e050970f5a524f49135682e030b8522fe73f60ffd7f29170f1a1cfb0bcc238a7e4d3de8d1e46f1afd5048c54217cd9eb5a5b9ac301698

Download Submit
C:\Windows\System\XcLEfUZ.exe

Filesize
1.4MB

MD5
711e151f5dcbec31cff1bc06c25489dc

SHA1
52a1391ee6e3b76d93084f29ff849d2c2082a849

SHA256
14af5cc1e41b50d3772573394785e697c15db33fab100bbdbba892b2aa11e13e

SHA512
c2ba79093d60a0d502f33a1b7ad79b79cf799e4a086c9345dc053e36b5c1b88e9b5cefee9e27d670dae987cacd1d9a8162f5c5f9f16f7f5552e85f37a6edeb2e

Download Submit
C:\Windows\System\XmiNNqc.exe

Filesize
1.3MB

MD5
52d05b6e792beae3e36a5600ce22c6ba

SHA1
3c585e3cc3a54bfd9fcfd0ec7dec7a86d9b6bd73

SHA256
3643a828536bea5fe2a8fd666286582ec53e69e3f5f3db779190d67cc88ff79d

SHA512
87a94bdc4a06acae1a56e31e1f774a005423f3e614cc6873e60697ff11dd539e68eb5a00660502bdbe6030f0e272086c0d89302852222abc6f66899b0e17a517

Download Submit
C:\Windows\System\YwtlrAR.exe

Filesize
1.3MB

MD5
f62dd7bbb22ef6d416b522514f2dd254

SHA1
f0b4bb8dac4ddc0af1a4055c417c004dc01d11db

SHA256
42992a4b47f0011f91ff1bf4e148151fb3afefaa49e3671c09d77e41e1c02f93

SHA512
6e375dfc886beb2f647744f0e41fdf74a1a3d6e2346208928972b2bee38ac1a416afd64e13d163b20e72b316c600624831f8a6be64acff95c8f8eecd07304731

Download Submit
C:\Windows\System\eIBIIZr.exe

Filesize
1.3MB

MD5
078279a84e46598a03efb79a553ec704

SHA1
4503d9759027de3ad58e957ad2fcecd530ff8439

SHA256
acca022f03bcb90ee5366247f9272438f1de3dd3dc792448b66247e5a6a4f27b

SHA512
8b14c7dd26d918700621ae5ae6a5e1f434af22cb2ff06e549e81272c4ad31371d1fccb655508dd49538c070f3c61d2b620ef810b9903f251011e988a07fcfbfc

Download Submit
C:\Windows\System\edysFBG.exe

Filesize
1.3MB

MD5
ec0db80cad4c5150fcb518de81670cc8

SHA1
b99b449d91c4d5f0bf9b5ecdcf38e0de7693ae71

SHA256
1daa48780e3f501058ab8575a511fb9de9a46b5826464e0c8bacc32862dd30fc

SHA512
25509cb2f5959aa87857645b10fa0875b71ae633117329e6c1952ca5a496ea85e181782055aa4a58d86b8b738fc949d870de8214b42a2b8f46a1c134a2549c3c

Download Submit
C:\Windows\System\fYkPSzy.exe

Filesize
1.3MB

MD5
f2b8fe946778fea77d8cd7bb63cf256d

SHA1
20a7fb15c4f21b1e2b8dd0c6996739d108d883df

SHA256
1aca55bcee1f363ab24b01a3e569030530b79919616d81ef8ec3fa363b568c96

SHA512
942e63989972a58302dc6949b01ec1878dfa2f90284764a9ca5fb404396586ca582b0175a116571bfe48d7dbcf8730cb177c6bb74e12df223be163b5365c86d5

Download Submit
C:\Windows\System\jnlXjCe.exe

Filesize
1.3MB

MD5
5ca6953868f84c1c41116a1bab5d0163

SHA1
2e42ec826a504df2deb1f501952c62bb66fbb810

SHA256
cfb327d08e120927563db4945bcb83f0d60d246332fa1ce5a9d0a835981a81e1

SHA512
f70820d455de3c8d2e0c9ddd99528a35e99612095cb229586f52083f0bcc2cf76e2358e02f17a0bc471264d9a759351574b76a075a5854628459cddc50031fb5

Download Submit
C:\Windows\System\pHgjEtG.exe

Filesize
1.3MB

MD5
780690727f75de3b0d64a86686e0896a

SHA1
698f1af4c4e70be00d43293fcef9de24010ec4b0

SHA256
4916d9cbe949935ff9bcb662a6ec37432b70cedcc7d97f42e4a4dd75df5f3bee

SHA512
f73a2104c148d60eac15a47f8a8d477435693c2ffc672fe1404297800cafcc00dce4a15f0564d7af8e209aada7a7af9f661eb2a3b0773d5b8b8694a8890ac825

Download Submit
C:\Windows\System\qEcCQRj.exe

Filesize
1.3MB

MD5
dd135023d082db87e262bd46e8955c59

SHA1
6da47e27164cfa32cf1a75c3da205396fdbed9d8

SHA256
6a4c036c848d377f8e26895252674ade07c0237455f90572330a4d9032e6a837

SHA512
68652142075ab47e911ef08a98d1818882d8463a3f080f6ea66fab27148ae9c127eb04b154cae553dcc54ddfd3d21c981c1cc032870660fbb8b353ab21c0087c

Download Submit
C:\Windows\System\qNCImwc.exe

Filesize
1.3MB

MD5
3098ebddf2c4a0f92aa1bd8ffaba2607

SHA1
747c837ba730f2955c7da1b9d50ddf9a251a5c81

SHA256
d4fbdb43e11b5d321b7e46fe86598487c6bd1621bb813bd50e61dfc0c7344e52

SHA512
55ffa184d7c4e0fe329be22226d9290c9e53b5dae3047cdf5143f85fa412f489b0829a15bbcc0702d4a78f34c00795a80a3a4096b66a2680a10d3325db477a33

Download Submit
C:\Windows\System\rKECVGG.exe

Filesize
1.3MB

MD5
4a45391fb415882d3325638a18cf75f5

SHA1
c899fcf7c0b56e756958507d37840838af7206ce

SHA256
16ccd2e52b878b949c9151bd54671e547f3aa44ade95935bd92e921d93a3e62a

SHA512
7d470adb5b19f98326e2adf8916117afcf428ab37b9c0356783e48501cdc96b5e34c2b556a5b78ebbef00e30ed512cd70f1f4a546b5fe53f184aa31c1e1c8f13

Download Submit
C:\Windows\System\sISsxPO.exe

Filesize
1.3MB

MD5
514af9a30562c6b517c859d2a2bc2210

SHA1
363ff65fbf68a1bde3eef9971ba5bce956fecf0e

SHA256
89bf812538e9e262111907676b8e75196733076a3044636f465f50f4778e0052

SHA512
6c8c2b84bf95148d81bccf8969e7486efaa8fd6d0f575bbed21a68f531584fd2ac508d7c6b754a465b343ebd140fcec37df477c7c74f61cacf071baff8684f1c

Download Submit
C:\Windows\System\sYemSFP.exe

Filesize
1.4MB

MD5
732e993b75643a19e03f04e20fcc64fe

SHA1
79364c489c8db92d5bc8819cc5c3fcf270a95559

SHA256
28f344d41f2820932d06f7d37a6b146fc515b6088a10e529cc04f0820b431b97

SHA512
0a15596b0c063a33bb77730d37c48ee7d9ebde4ec423234ff10c89faa52b17138d2ab423216bdcb1bedc08f81b74a02d286934a106c261a43f4e3b9586b30542

Download Submit
C:\Windows\System\tKVQHHe.exe

Filesize
1.4MB

MD5
57dd500cd83c48e9c9c3dc2dbaa28bb7

SHA1
a0d810b44dd0aff003d1ca8af91efa0ebeccc42f

SHA256
4e4e9617f990a09e437822fe5b92131a7527f1a06361df7e0800eb968ef975c3

SHA512
8b6cb53d804785a91ccfb70cae2676f52e3980042056ffbf484001bd4d776a17cec3ebb3a4a5baa31ff7ed529bdedf60fc48b4ae336f6c6f95ec480cf71ccab2

Download Submit
C:\Windows\System\vRdFOfp.exe

Filesize
1.4MB

MD5
63b9ca022bd20ef9f76d32b38ee2c52b

SHA1
7f39c568b073e8af0b3bd1459158c86d1ec1b178

SHA256
f91882a9734b05b2ce1c0080ec3c03b61282772c35e9c6eda314eeca3e318982

SHA512
50d203595f714e3d73692add0a5b41b40e4a9fddf9f9b5c0c9b48ca845b9dbfe76a098327c47121dcbe07754bc422b43e746cd707f061d98f0ea4a0f152f9c97

Download Submit
C:\Windows\System\wAZIyqp.exe

Filesize
1.3MB

MD5
72359769da324b254f630051aad2f704

SHA1
492611a1f5a7428af4e28573a41e260f7659d8d6

SHA256
ba001a045ce2904e7cd36fb997084c942e6d958ca6bef2940b8127d520d8b475

SHA512
40380e8fa4eb259e60ed3821e090d13b2fc48a6272863bf6b2cb008f5cc6bceabbaa1e23cd6d50a1e7c6c6c616363c0b0a5696797a8850e0b749c8d4ca048b40

Download Submit
C:\Windows\System\wBdvioq.exe

Filesize
1.3MB

MD5
a752ab531a333eb982275e59402931ec

SHA1
59c81b8ff49c086452b69df65b9c1282026f5b8c

SHA256
6ca9e9b46c590bffae6f2f37e2714b6ab88b46f353741cadfe43a7ee38123433

SHA512
483293e7bc48728cd433af4ce07191ed2e114f650336bfb6be6f07ffb4cc1fff7873b5d20995554387949b684f16aa494aa3b4e9eba88c8297ab582b5a3c9cf3

Download Submit
C:\Windows\System\wgsLkDQ.exe

Filesize
1.3MB

MD5
10b0c6f985e5233cfff7515ed00d5b42

SHA1
691c403abdd29476abd7f9dc9c1c29e1604dbae4

SHA256
5086586ab4e0e3d02dae58b3a96ef72800df82ece6eddce1703f625335fc1452

SHA512
0eb79f35fce2fe2c6f3e7c14bfbce2373c2a43d9fca0b82db87e77a9827a29428c81f41e3472a21ac5ec9eba9a83491a2670c61498cd6a86100f6648f1e44560

Download Submit
memory/3316-0-0x0000011DB7C40000-0x0000011DB7C50000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads