xmrig | ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
Size

1.4MB
MD5

ecb09942df46b743d66b98ab112ed321
SHA1

1202734fd31ba8b0339c6a505216e5296c873b4b
SHA256

ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072
SHA512

e78a388ff8637a9838a4958f229d3d5ed1d0034a7ce520521a12d9ba06ec7d685da1ffd78f3a9d6dcae24f6d06302923f5ca44eb0cc8b337266e0084d29e3e52
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcK:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5w

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023ba7-4.dat	xmrig
behavioral2/files/0x0008000000023c90-7.dat	xmrig
behavioral2/files/0x0007000000023c96-19.dat	xmrig
behavioral2/files/0x0007000000023c94-28.dat	xmrig
behavioral2/files/0x0007000000023c97-35.dat	xmrig
behavioral2/files/0x0007000000023c9b-55.dat	xmrig
behavioral2/files/0x0007000000023c9c-56.dat	xmrig
behavioral2/files/0x0007000000023c9d-83.dat	xmrig
behavioral2/files/0x0007000000023ca8-107.dat	xmrig
behavioral2/files/0x0007000000023cab-130.dat	xmrig
behavioral2/files/0x0007000000023caa-128.dat	xmrig
behavioral2/files/0x0007000000023ca6-126.dat	xmrig
behavioral2/files/0x0007000000023ca9-124.dat	xmrig
behavioral2/files/0x0007000000023ca7-120.dat	xmrig
behavioral2/files/0x0007000000023ca5-118.dat	xmrig
behavioral2/files/0x0007000000023ca4-116.dat	xmrig
behavioral2/files/0x0007000000023ca3-113.dat	xmrig
behavioral2/files/0x0007000000023ca2-110.dat	xmrig
behavioral2/files/0x0007000000023ca1-104.dat	xmrig
behavioral2/files/0x0007000000023ca0-102.dat	xmrig
behavioral2/files/0x0007000000023c9f-98.dat	xmrig
behavioral2/files/0x0007000000023c9e-76.dat	xmrig
behavioral2/files/0x0007000000023c99-51.dat	xmrig
behavioral2/files/0x0007000000023c9a-45.dat	xmrig
behavioral2/files/0x0007000000023c98-37.dat	xmrig
behavioral2/files/0x0007000000023c95-31.dat	xmrig
behavioral2/files/0x0008000000023c91-139.dat	xmrig
behavioral2/files/0x0007000000023cad-144.dat	xmrig
behavioral2/files/0x0007000000023cae-148.dat	xmrig
behavioral2/files/0x0007000000023cac-135.dat	xmrig
behavioral2/files/0x0007000000023caf-160.dat	xmrig
behavioral2/files/0x0007000000023cb1-162.dat	xmrig
behavioral2/files/0x0007000000023cb2-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4408	LDIWFyn.exe
1544	qLgsXeN.exe
704	AjBNuWY.exe
3936	PZSipQk.exe
3660	umQZUrJ.exe
3180	PKAhjPb.exe
2808	kdmykpH.exe
2088	hfToACz.exe
2452	qEjHapK.exe
3684	IwQucTX.exe
4236	MiEwtIv.exe
2864	AABoQTN.exe
1788	HFLURYi.exe
3896	VTxRxes.exe
228	aRevAda.exe
2928	GIOTgBL.exe
1952	KBuBVWB.exe
1600	qNXimKD.exe
4420	mNcLYSW.exe
1248	aHBQroF.exe
5040	QlsxoKN.exe
636	daZcYTF.exe
2556	TsgFHQw.exe
4992	TCXODer.exe
324	cJdrhFg.exe
4364	QGXpvpx.exe
4828	fUwTLcA.exe
2036	JCGnXXT.exe
3832	PPDyVTB.exe
3520	cVvMGlk.exe
4836	LGwEOLf.exe
1848	LtjEBsz.exe
3912	UXWWqRn.exe
1124	XachQSF.exe
4948	RQnImJI.exe
828	HJpKSNW.exe
4180	AYFfhsL.exe
632	WewnIgj.exe
2152	WjoAsXJ.exe
3984	JNSqGgk.exe
2404	dFmLktX.exe
1892	CsLxZKc.exe
3276	VMONTIH.exe
4004	ByTvtpK.exe
3840	RdEDXEy.exe
1564	xCNxWYl.exe
4464	VwlxxyK.exe
1116	zjCEQhK.exe
1064	jPlIYSu.exe
1040	SOgHdYP.exe
4292	QFAiwML.exe
3656	dAslNcQ.exe
892	fbCKgBR.exe
3224	KCtCACV.exe
4956	ZfQjeAA.exe
2792	pYYeTxR.exe
4872	zSmzMew.exe
1760	CPjeqFr.exe
2908	MRDCbgm.exe
4544	cngUkxM.exe
4252	BhTpNaJ.exe
372	swjAteI.exe
2848	PNjyuZG.exe
2916	SDLiGSU.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lcGyXHM.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\tZndUph.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\sZQhAHr.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\OPrSRCi.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\ieYnhjn.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\ojZDitm.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\ByTvtpK.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\DpeNGSf.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\jNSYqBx.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\paWxGeF.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\daZcYTF.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\bJjdokm.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\JXQnuow.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\kXNKwsj.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\pdgkoAM.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\pEFcqNS.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\nCEIqdw.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\vuhUxbL.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\iyGrANt.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\ZlFhVmt.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\kbiDHWr.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\rjgnhuE.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\TiXcHfP.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\qAXzUud.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\SOgHdYP.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\jDbQFVQ.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\uNeFeHc.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\jICwwbr.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\KoAixWp.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\NqZWTcC.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\mWndpJE.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\OsaeJqV.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\OeoReWM.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\YXCCjKG.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\mjelnOP.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\QGDGtVT.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\fgDnrRK.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\yDxtNJn.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\pTyHCsn.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\DXkGdab.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\SadHCJn.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\cVvMGlk.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\rSJUgry.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\lFcwCPJ.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\NyDZuzH.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\JkVWFNl.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\QMLTXUM.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\ThRaTio.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\SYnrjJQ.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\KCtCACV.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\NcQZMEx.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\yliMhWD.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\gKQDrrC.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\QjagpQF.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\SQctlWc.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\sMRnKIP.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\HjGEWkr.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\UENRCPS.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\RdptsWL.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\qNXimKD.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\ewbdWHn.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\IhrMtei.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\MlAdTmA.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
File created	C:\Windows\System\mUMvsvo.exe	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4408	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	83
PID 2364 wrote to memory of 4408	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	83
PID 2364 wrote to memory of 1544	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	84
PID 2364 wrote to memory of 1544	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	84
PID 2364 wrote to memory of 704	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	85
PID 2364 wrote to memory of 704	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	85
PID 2364 wrote to memory of 3936	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	86
PID 2364 wrote to memory of 3936	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	86
PID 2364 wrote to memory of 3660	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	87
PID 2364 wrote to memory of 3660	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	87
PID 2364 wrote to memory of 3180	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	88
PID 2364 wrote to memory of 3180	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	88
PID 2364 wrote to memory of 2808	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	89
PID 2364 wrote to memory of 2808	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	89
PID 2364 wrote to memory of 2088	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	90
PID 2364 wrote to memory of 2088	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	90
PID 2364 wrote to memory of 2452	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	91
PID 2364 wrote to memory of 2452	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	91
PID 2364 wrote to memory of 3684	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	92
PID 2364 wrote to memory of 3684	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	92
PID 2364 wrote to memory of 4236	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	93
PID 2364 wrote to memory of 4236	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	93
PID 2364 wrote to memory of 2864	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	94
PID 2364 wrote to memory of 2864	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	94
PID 2364 wrote to memory of 1788	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	95
PID 2364 wrote to memory of 1788	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	95
PID 2364 wrote to memory of 3896	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	96
PID 2364 wrote to memory of 3896	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	96
PID 2364 wrote to memory of 228	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	97
PID 2364 wrote to memory of 228	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	97
PID 2364 wrote to memory of 2928	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	98
PID 2364 wrote to memory of 2928	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	98
PID 2364 wrote to memory of 1952	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	99
PID 2364 wrote to memory of 1952	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	99
PID 2364 wrote to memory of 1600	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	100
PID 2364 wrote to memory of 1600	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	100
PID 2364 wrote to memory of 4420	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	101
PID 2364 wrote to memory of 4420	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	101
PID 2364 wrote to memory of 1248	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	102
PID 2364 wrote to memory of 1248	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	102
PID 2364 wrote to memory of 5040	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	103
PID 2364 wrote to memory of 5040	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	103
PID 2364 wrote to memory of 636	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	104
PID 2364 wrote to memory of 636	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	104
PID 2364 wrote to memory of 2556	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	105
PID 2364 wrote to memory of 2556	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	105
PID 2364 wrote to memory of 4992	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	106
PID 2364 wrote to memory of 4992	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	106
PID 2364 wrote to memory of 324	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	107
PID 2364 wrote to memory of 324	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	107
PID 2364 wrote to memory of 4364	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	108
PID 2364 wrote to memory of 4364	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	108
PID 2364 wrote to memory of 4828	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	109
PID 2364 wrote to memory of 4828	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	109
PID 2364 wrote to memory of 2036	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	110
PID 2364 wrote to memory of 2036	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	110
PID 2364 wrote to memory of 3832	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	111
PID 2364 wrote to memory of 3832	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	111
PID 2364 wrote to memory of 3520	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	112
PID 2364 wrote to memory of 3520	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	112
PID 2364 wrote to memory of 4836	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	113
PID 2364 wrote to memory of 4836	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	113
PID 2364 wrote to memory of 3912	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	114
PID 2364 wrote to memory of 3912	2364	ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe	114

C:\Users\Admin\AppData\Local\Temp\ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe
"C:\Users\Admin\AppData\Local\Temp\ff1c5a1cf2f2241591e9e354d6932d2679558c08fbbc0f104a63627a3702b072.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\System\LDIWFyn.exe
  C:\Windows\System\LDIWFyn.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\qLgsXeN.exe
  C:\Windows\System\qLgsXeN.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\AjBNuWY.exe
  C:\Windows\System\AjBNuWY.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\PZSipQk.exe
  C:\Windows\System\PZSipQk.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\umQZUrJ.exe
  C:\Windows\System\umQZUrJ.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\PKAhjPb.exe
  C:\Windows\System\PKAhjPb.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\kdmykpH.exe
  C:\Windows\System\kdmykpH.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\hfToACz.exe
  C:\Windows\System\hfToACz.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\qEjHapK.exe
  C:\Windows\System\qEjHapK.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\IwQucTX.exe
  C:\Windows\System\IwQucTX.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\MiEwtIv.exe
  C:\Windows\System\MiEwtIv.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\AABoQTN.exe
  C:\Windows\System\AABoQTN.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\HFLURYi.exe
  C:\Windows\System\HFLURYi.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\VTxRxes.exe
  C:\Windows\System\VTxRxes.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\aRevAda.exe
  C:\Windows\System\aRevAda.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\GIOTgBL.exe
  C:\Windows\System\GIOTgBL.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\KBuBVWB.exe
  C:\Windows\System\KBuBVWB.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\qNXimKD.exe
  C:\Windows\System\qNXimKD.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\mNcLYSW.exe
  C:\Windows\System\mNcLYSW.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\aHBQroF.exe
  C:\Windows\System\aHBQroF.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\QlsxoKN.exe
  C:\Windows\System\QlsxoKN.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\daZcYTF.exe
  C:\Windows\System\daZcYTF.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\TsgFHQw.exe
  C:\Windows\System\TsgFHQw.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\TCXODer.exe
  C:\Windows\System\TCXODer.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\cJdrhFg.exe
  C:\Windows\System\cJdrhFg.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\QGXpvpx.exe
  C:\Windows\System\QGXpvpx.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\fUwTLcA.exe
  C:\Windows\System\fUwTLcA.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\JCGnXXT.exe
  C:\Windows\System\JCGnXXT.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\PPDyVTB.exe
  C:\Windows\System\PPDyVTB.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\cVvMGlk.exe
  C:\Windows\System\cVvMGlk.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\LGwEOLf.exe
  C:\Windows\System\LGwEOLf.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\UXWWqRn.exe
  C:\Windows\System\UXWWqRn.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\LtjEBsz.exe
  C:\Windows\System\LtjEBsz.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\XachQSF.exe
  C:\Windows\System\XachQSF.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\RQnImJI.exe
  C:\Windows\System\RQnImJI.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\HJpKSNW.exe
  C:\Windows\System\HJpKSNW.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\AYFfhsL.exe
  C:\Windows\System\AYFfhsL.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\WewnIgj.exe
  C:\Windows\System\WewnIgj.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\WjoAsXJ.exe
  C:\Windows\System\WjoAsXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\JNSqGgk.exe
  C:\Windows\System\JNSqGgk.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\dFmLktX.exe
  C:\Windows\System\dFmLktX.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\CsLxZKc.exe
  C:\Windows\System\CsLxZKc.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\VMONTIH.exe
  C:\Windows\System\VMONTIH.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\ByTvtpK.exe
  C:\Windows\System\ByTvtpK.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\RdEDXEy.exe
  C:\Windows\System\RdEDXEy.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\xCNxWYl.exe
  C:\Windows\System\xCNxWYl.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\VwlxxyK.exe
  C:\Windows\System\VwlxxyK.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\zjCEQhK.exe
  C:\Windows\System\zjCEQhK.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\jPlIYSu.exe
  C:\Windows\System\jPlIYSu.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\SOgHdYP.exe
  C:\Windows\System\SOgHdYP.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\QFAiwML.exe
  C:\Windows\System\QFAiwML.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\dAslNcQ.exe
  C:\Windows\System\dAslNcQ.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\fbCKgBR.exe
  C:\Windows\System\fbCKgBR.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\KCtCACV.exe
  C:\Windows\System\KCtCACV.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\ZfQjeAA.exe
  C:\Windows\System\ZfQjeAA.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\zSmzMew.exe
  C:\Windows\System\zSmzMew.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\pYYeTxR.exe
  C:\Windows\System\pYYeTxR.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\CPjeqFr.exe
  C:\Windows\System\CPjeqFr.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\MRDCbgm.exe
  C:\Windows\System\MRDCbgm.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\cngUkxM.exe
  C:\Windows\System\cngUkxM.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\BhTpNaJ.exe
  C:\Windows\System\BhTpNaJ.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\swjAteI.exe
  C:\Windows\System\swjAteI.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\PNjyuZG.exe
  C:\Windows\System\PNjyuZG.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\SDLiGSU.exe
  C:\Windows\System\SDLiGSU.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\nYTEBLW.exe
  C:\Windows\System\nYTEBLW.exe
  2⤵
  PID:4640
- C:\Windows\System\fNdXaJL.exe
  C:\Windows\System\fNdXaJL.exe
  2⤵
  PID:4428
- C:\Windows\System\GODHzyF.exe
  C:\Windows\System\GODHzyF.exe
  2⤵
  PID:2096
- C:\Windows\System\PGwbLzE.exe
  C:\Windows\System\PGwbLzE.exe
  2⤵
  PID:4404
- C:\Windows\System\hoyItiu.exe
  C:\Windows\System\hoyItiu.exe
  2⤵
  PID:4736
- C:\Windows\System\mkBKpdk.exe
  C:\Windows\System\mkBKpdk.exe
  2⤵
  PID:3020
- C:\Windows\System\XFhKUEv.exe
  C:\Windows\System\XFhKUEv.exe
  2⤵
  PID:1368
- C:\Windows\System\ThRaTio.exe
  C:\Windows\System\ThRaTio.exe
  2⤵
  PID:444
- C:\Windows\System\YXCCjKG.exe
  C:\Windows\System\YXCCjKG.exe
  2⤵
  PID:860
- C:\Windows\System\WxJxvTw.exe
  C:\Windows\System\WxJxvTw.exe
  2⤵
  PID:1388
- C:\Windows\System\NcQZMEx.exe
  C:\Windows\System\NcQZMEx.exe
  2⤵
  PID:2388
- C:\Windows\System\pAEZZqj.exe
  C:\Windows\System\pAEZZqj.exe
  2⤵
  PID:4624
- C:\Windows\System\TRCiZrX.exe
  C:\Windows\System\TRCiZrX.exe
  2⤵
  PID:4492
- C:\Windows\System\eeIHnfJ.exe
  C:\Windows\System\eeIHnfJ.exe
  2⤵
  PID:4780
- C:\Windows\System\mWndpJE.exe
  C:\Windows\System\mWndpJE.exe
  2⤵
  PID:4572
- C:\Windows\System\FkPGCsQ.exe
  C:\Windows\System\FkPGCsQ.exe
  2⤵
  PID:1532
- C:\Windows\System\GErxWPe.exe
  C:\Windows\System\GErxWPe.exe
  2⤵
  PID:2144
- C:\Windows\System\IvLuGTD.exe
  C:\Windows\System\IvLuGTD.exe
  2⤵
  PID:3776
- C:\Windows\System\HKzXWKr.exe
  C:\Windows\System\HKzXWKr.exe
  2⤵
  PID:2732
- C:\Windows\System\NojtBVe.exe
  C:\Windows\System\NojtBVe.exe
  2⤵
  PID:5080
- C:\Windows\System\yGfABrQ.exe
  C:\Windows\System\yGfABrQ.exe
  2⤵
  PID:3644
- C:\Windows\System\hhoQKiV.exe
  C:\Windows\System\hhoQKiV.exe
  2⤵
  PID:1328
- C:\Windows\System\HjGEWkr.exe
  C:\Windows\System\HjGEWkr.exe
  2⤵
  PID:2688
- C:\Windows\System\OpzVhZD.exe
  C:\Windows\System\OpzVhZD.exe
  2⤵
  PID:1968
- C:\Windows\System\ZfjOUob.exe
  C:\Windows\System\ZfjOUob.exe
  2⤵
  PID:3376
- C:\Windows\System\MBgqhFS.exe
  C:\Windows\System\MBgqhFS.exe
  2⤵
  PID:5116
- C:\Windows\System\yHriEEK.exe
  C:\Windows\System\yHriEEK.exe
  2⤵
  PID:4340
- C:\Windows\System\oFoTvzU.exe
  C:\Windows\System\oFoTvzU.exe
  2⤵
  PID:4016
- C:\Windows\System\FUbtnpR.exe
  C:\Windows\System\FUbtnpR.exe
  2⤵
  PID:3592
- C:\Windows\System\HjWAKoo.exe
  C:\Windows\System\HjWAKoo.exe
  2⤵
  PID:1976
- C:\Windows\System\zhGdnXD.exe
  C:\Windows\System\zhGdnXD.exe
  2⤵
  PID:3940
- C:\Windows\System\LGJFRNS.exe
  C:\Windows\System\LGJFRNS.exe
  2⤵
  PID:1572
- C:\Windows\System\qAEJdQq.exe
  C:\Windows\System\qAEJdQq.exe
  2⤵
  PID:1184
- C:\Windows\System\UPsIctq.exe
  C:\Windows\System\UPsIctq.exe
  2⤵
  PID:1512
- C:\Windows\System\XKEVlYo.exe
  C:\Windows\System\XKEVlYo.exe
  2⤵
  PID:3764
- C:\Windows\System\HAllBUR.exe
  C:\Windows\System\HAllBUR.exe
  2⤵
  PID:4608
- C:\Windows\System\kbbcpyV.exe
  C:\Windows\System\kbbcpyV.exe
  2⤵
  PID:3300
- C:\Windows\System\BSyHqir.exe
  C:\Windows\System\BSyHqir.exe
  2⤵
  PID:8
- C:\Windows\System\KrKorua.exe
  C:\Windows\System\KrKorua.exe
  2⤵
  PID:1052
- C:\Windows\System\njvorAh.exe
  C:\Windows\System\njvorAh.exe
  2⤵
  PID:3152
- C:\Windows\System\lUZLPcf.exe
  C:\Windows\System\lUZLPcf.exe
  2⤵
  PID:2972
- C:\Windows\System\vrVyGws.exe
  C:\Windows\System\vrVyGws.exe
  2⤵
  PID:4600
- C:\Windows\System\EbmQZOz.exe
  C:\Windows\System\EbmQZOz.exe
  2⤵
  PID:3672
- C:\Windows\System\UZKclZY.exe
  C:\Windows\System\UZKclZY.exe
  2⤵
  PID:2532
- C:\Windows\System\RoNRQHX.exe
  C:\Windows\System\RoNRQHX.exe
  2⤵
  PID:1580
- C:\Windows\System\kxtrKHH.exe
  C:\Windows\System\kxtrKHH.exe
  2⤵
  PID:2944
- C:\Windows\System\cHUpGtz.exe
  C:\Windows\System\cHUpGtz.exe
  2⤵
  PID:2664
- C:\Windows\System\AowBaaR.exe
  C:\Windows\System\AowBaaR.exe
  2⤵
  PID:4488
- C:\Windows\System\DwMDCay.exe
  C:\Windows\System\DwMDCay.exe
  2⤵
  PID:4304
- C:\Windows\System\kbiDHWr.exe
  C:\Windows\System\kbiDHWr.exe
  2⤵
  PID:3424
- C:\Windows\System\dVRmeMk.exe
  C:\Windows\System\dVRmeMk.exe
  2⤵
  PID:5052
- C:\Windows\System\rrMxEhr.exe
  C:\Windows\System\rrMxEhr.exe
  2⤵
  PID:1816
- C:\Windows\System\DlGTkQm.exe
  C:\Windows\System\DlGTkQm.exe
  2⤵
  PID:2272
- C:\Windows\System\uUFJvIQ.exe
  C:\Windows\System\uUFJvIQ.exe
  2⤵
  PID:5172
- C:\Windows\System\fxqmHNR.exe
  C:\Windows\System\fxqmHNR.exe
  2⤵
  PID:5188
- C:\Windows\System\yQxiThA.exe
  C:\Windows\System\yQxiThA.exe
  2⤵
  PID:5204
- C:\Windows\System\LbqJNRk.exe
  C:\Windows\System\LbqJNRk.exe
  2⤵
  PID:5232
- C:\Windows\System\NfotHLe.exe
  C:\Windows\System\NfotHLe.exe
  2⤵
  PID:5260
- C:\Windows\System\ReKOHau.exe
  C:\Windows\System\ReKOHau.exe
  2⤵
  PID:5288
- C:\Windows\System\BVmhqeK.exe
  C:\Windows\System\BVmhqeK.exe
  2⤵
  PID:5316
- C:\Windows\System\akDvhIx.exe
  C:\Windows\System\akDvhIx.exe
  2⤵
  PID:5336
- C:\Windows\System\gSdRbSh.exe
  C:\Windows\System\gSdRbSh.exe
  2⤵
  PID:5356
- C:\Windows\System\zVfJIFm.exe
  C:\Windows\System\zVfJIFm.exe
  2⤵
  PID:5376
- C:\Windows\System\rkjrNhx.exe
  C:\Windows\System\rkjrNhx.exe
  2⤵
  PID:5404
- C:\Windows\System\NZmXxGD.exe
  C:\Windows\System\NZmXxGD.exe
  2⤵
  PID:5436
- C:\Windows\System\wIYGzvr.exe
  C:\Windows\System\wIYGzvr.exe
  2⤵
  PID:5464
- C:\Windows\System\UmLYMRV.exe
  C:\Windows\System\UmLYMRV.exe
  2⤵
  PID:5492
- C:\Windows\System\TjmdLcn.exe
  C:\Windows\System\TjmdLcn.exe
  2⤵
  PID:5524
- C:\Windows\System\IMlrASa.exe
  C:\Windows\System\IMlrASa.exe
  2⤵
  PID:5552
- C:\Windows\System\INBsPes.exe
  C:\Windows\System\INBsPes.exe
  2⤵
  PID:5588
- C:\Windows\System\cBUGeIh.exe
  C:\Windows\System\cBUGeIh.exe
  2⤵
  PID:5612
- C:\Windows\System\xKpDmmV.exe
  C:\Windows\System\xKpDmmV.exe
  2⤵
  PID:5632
- C:\Windows\System\ifFSkZG.exe
  C:\Windows\System\ifFSkZG.exe
  2⤵
  PID:5664
- C:\Windows\System\tVsYcHa.exe
  C:\Windows\System\tVsYcHa.exe
  2⤵
  PID:5700
- C:\Windows\System\GEhJNVH.exe
  C:\Windows\System\GEhJNVH.exe
  2⤵
  PID:5732
- C:\Windows\System\tPTQoDS.exe
  C:\Windows\System\tPTQoDS.exe
  2⤵
  PID:5776
- C:\Windows\System\cDhTsGk.exe
  C:\Windows\System\cDhTsGk.exe
  2⤵
  PID:5796
- C:\Windows\System\KizVeDX.exe
  C:\Windows\System\KizVeDX.exe
  2⤵
  PID:5828
- C:\Windows\System\QCzMxzc.exe
  C:\Windows\System\QCzMxzc.exe
  2⤵
  PID:5864
- C:\Windows\System\UiGFwvp.exe
  C:\Windows\System\UiGFwvp.exe
  2⤵
  PID:5880
- C:\Windows\System\lborLTB.exe
  C:\Windows\System\lborLTB.exe
  2⤵
  PID:5904
- C:\Windows\System\yDxtNJn.exe
  C:\Windows\System\yDxtNJn.exe
  2⤵
  PID:5928
- C:\Windows\System\RWfqKCU.exe
  C:\Windows\System\RWfqKCU.exe
  2⤵
  PID:5964
- C:\Windows\System\TZtAgFs.exe
  C:\Windows\System\TZtAgFs.exe
  2⤵
  PID:6000
- C:\Windows\System\RdQvdVW.exe
  C:\Windows\System\RdQvdVW.exe
  2⤵
  PID:6032
- C:\Windows\System\gpyJOjT.exe
  C:\Windows\System\gpyJOjT.exe
  2⤵
  PID:6072
- C:\Windows\System\HWMfmmh.exe
  C:\Windows\System\HWMfmmh.exe
  2⤵
  PID:6092
- C:\Windows\System\hiFuBMX.exe
  C:\Windows\System\hiFuBMX.exe
  2⤵
  PID:6116
- C:\Windows\System\oaxlMtP.exe
  C:\Windows\System\oaxlMtP.exe
  2⤵
  PID:6140
- C:\Windows\System\xuuLkRn.exe
  C:\Windows\System\xuuLkRn.exe
  2⤵
  PID:5200
- C:\Windows\System\pdgkoAM.exe
  C:\Windows\System\pdgkoAM.exe
  2⤵
  PID:5244
- C:\Windows\System\mjelnOP.exe
  C:\Windows\System\mjelnOP.exe
  2⤵
  PID:5308
- C:\Windows\System\aPxrcDx.exe
  C:\Windows\System\aPxrcDx.exe
  2⤵
  PID:5324
- C:\Windows\System\VSAWjqW.exe
  C:\Windows\System\VSAWjqW.exe
  2⤵
  PID:5428
- C:\Windows\System\LbhOpWe.exe
  C:\Windows\System\LbhOpWe.exe
  2⤵
  PID:5568
- C:\Windows\System\yARMAyN.exe
  C:\Windows\System\yARMAyN.exe
  2⤵
  PID:5544
- C:\Windows\System\gzBvKPN.exe
  C:\Windows\System\gzBvKPN.exe
  2⤵
  PID:5660
- C:\Windows\System\xZKfXYf.exe
  C:\Windows\System\xZKfXYf.exe
  2⤵
  PID:5752
- C:\Windows\System\eGPSLgg.exe
  C:\Windows\System\eGPSLgg.exe
  2⤵
  PID:5772
- C:\Windows\System\yjJWtUC.exe
  C:\Windows\System\yjJWtUC.exe
  2⤵
  PID:5836
- C:\Windows\System\ubTInvP.exe
  C:\Windows\System\ubTInvP.exe
  2⤵
  PID:5872
- C:\Windows\System\GSRAYiK.exe
  C:\Windows\System\GSRAYiK.exe
  2⤵
  PID:5980
- C:\Windows\System\FXxwvMQ.exe
  C:\Windows\System\FXxwvMQ.exe
  2⤵
  PID:6052
- C:\Windows\System\GaJNDka.exe
  C:\Windows\System\GaJNDka.exe
  2⤵
  PID:6112
- C:\Windows\System\AcfEzIE.exe
  C:\Windows\System\AcfEzIE.exe
  2⤵
  PID:5180
- C:\Windows\System\MXJLHmi.exe
  C:\Windows\System\MXJLHmi.exe
  2⤵
  PID:5304
- C:\Windows\System\woxdeEL.exe
  C:\Windows\System\woxdeEL.exe
  2⤵
  PID:5424
- C:\Windows\System\lJRPyHJ.exe
  C:\Windows\System\lJRPyHJ.exe
  2⤵
  PID:5580
- C:\Windows\System\fGHZljk.exe
  C:\Windows\System\fGHZljk.exe
  2⤵
  PID:5720
- C:\Windows\System\RFbavcu.exe
  C:\Windows\System\RFbavcu.exe
  2⤵
  PID:5876
- C:\Windows\System\yRarjfV.exe
  C:\Windows\System\yRarjfV.exe
  2⤵
  PID:5476
- C:\Windows\System\tsDSvrD.exe
  C:\Windows\System\tsDSvrD.exe
  2⤵
  PID:6132
- C:\Windows\System\tOPrjlI.exe
  C:\Windows\System\tOPrjlI.exe
  2⤵
  PID:5936
- C:\Windows\System\biKuDoq.exe
  C:\Windows\System\biKuDoq.exe
  2⤵
  PID:6148
- C:\Windows\System\bIUFAVk.exe
  C:\Windows\System\bIUFAVk.exe
  2⤵
  PID:6180
- C:\Windows\System\JOsWrPw.exe
  C:\Windows\System\JOsWrPw.exe
  2⤵
  PID:6200
- C:\Windows\System\hJcfnse.exe
  C:\Windows\System\hJcfnse.exe
  2⤵
  PID:6228
- C:\Windows\System\ASawTMx.exe
  C:\Windows\System\ASawTMx.exe
  2⤵
  PID:6256
- C:\Windows\System\jVfrFXn.exe
  C:\Windows\System\jVfrFXn.exe
  2⤵
  PID:6288
- C:\Windows\System\VgOropg.exe
  C:\Windows\System\VgOropg.exe
  2⤵
  PID:6320
- C:\Windows\System\sOLKjzB.exe
  C:\Windows\System\sOLKjzB.exe
  2⤵
  PID:6364
- C:\Windows\System\YZkcWJh.exe
  C:\Windows\System\YZkcWJh.exe
  2⤵
  PID:6388
- C:\Windows\System\HlgefJp.exe
  C:\Windows\System\HlgefJp.exe
  2⤵
  PID:6416
- C:\Windows\System\woQrtJu.exe
  C:\Windows\System\woQrtJu.exe
  2⤵
  PID:6436
- C:\Windows\System\JiUlrnh.exe
  C:\Windows\System\JiUlrnh.exe
  2⤵
  PID:6460
- C:\Windows\System\jVDTOwv.exe
  C:\Windows\System\jVDTOwv.exe
  2⤵
  PID:6488
- C:\Windows\System\muzxeTr.exe
  C:\Windows\System\muzxeTr.exe
  2⤵
  PID:6524
- C:\Windows\System\QDgzKdh.exe
  C:\Windows\System\QDgzKdh.exe
  2⤵
  PID:6568
- C:\Windows\System\rvFELvx.exe
  C:\Windows\System\rvFELvx.exe
  2⤵
  PID:6600
- C:\Windows\System\OuJfoiQ.exe
  C:\Windows\System\OuJfoiQ.exe
  2⤵
  PID:6628
- C:\Windows\System\DdkffFA.exe
  C:\Windows\System\DdkffFA.exe
  2⤵
  PID:6656
- C:\Windows\System\ZRgwrTi.exe
  C:\Windows\System\ZRgwrTi.exe
  2⤵
  PID:6684
- C:\Windows\System\fymRGRa.exe
  C:\Windows\System\fymRGRa.exe
  2⤵
  PID:6708
- C:\Windows\System\MXpcydF.exe
  C:\Windows\System\MXpcydF.exe
  2⤵
  PID:6764
- C:\Windows\System\EFGbcaY.exe
  C:\Windows\System\EFGbcaY.exe
  2⤵
  PID:6784
- C:\Windows\System\kJuvvLO.exe
  C:\Windows\System\kJuvvLO.exe
  2⤵
  PID:6812
- C:\Windows\System\ebkTvLh.exe
  C:\Windows\System\ebkTvLh.exe
  2⤵
  PID:6836
- C:\Windows\System\kjIuYPC.exe
  C:\Windows\System\kjIuYPC.exe
  2⤵
  PID:6864
- C:\Windows\System\sPkRJNk.exe
  C:\Windows\System\sPkRJNk.exe
  2⤵
  PID:6888
- C:\Windows\System\sruzLlr.exe
  C:\Windows\System\sruzLlr.exe
  2⤵
  PID:6916
- C:\Windows\System\xrbPWVl.exe
  C:\Windows\System\xrbPWVl.exe
  2⤵
  PID:6944
- C:\Windows\System\xRqwVxn.exe
  C:\Windows\System\xRqwVxn.exe
  2⤵
  PID:6972
- C:\Windows\System\JfYZXEK.exe
  C:\Windows\System\JfYZXEK.exe
  2⤵
  PID:7008
- C:\Windows\System\oeTXcup.exe
  C:\Windows\System\oeTXcup.exe
  2⤵
  PID:7040
- C:\Windows\System\DLxOaFi.exe
  C:\Windows\System\DLxOaFi.exe
  2⤵
  PID:7068
- C:\Windows\System\KGggHfq.exe
  C:\Windows\System\KGggHfq.exe
  2⤵
  PID:7092
- C:\Windows\System\nfdJcTJ.exe
  C:\Windows\System\nfdJcTJ.exe
  2⤵
  PID:7116
- C:\Windows\System\ouOffjQ.exe
  C:\Windows\System\ouOffjQ.exe
  2⤵
  PID:7140
- C:\Windows\System\dSuYLSM.exe
  C:\Windows\System\dSuYLSM.exe
  2⤵
  PID:7164
- C:\Windows\System\pJoyKnW.exe
  C:\Windows\System\pJoyKnW.exe
  2⤵
  PID:5724
- C:\Windows\System\YdRMytg.exe
  C:\Windows\System\YdRMytg.exe
  2⤵
  PID:6244
- C:\Windows\System\SWoLkPf.exe
  C:\Windows\System\SWoLkPf.exe
  2⤵
  PID:6328
- C:\Windows\System\SFSmdkR.exe
  C:\Windows\System\SFSmdkR.exe
  2⤵
  PID:6376
- C:\Windows\System\eamHfmM.exe
  C:\Windows\System\eamHfmM.exe
  2⤵
  PID:6424
- C:\Windows\System\RlKpzdR.exe
  C:\Windows\System\RlKpzdR.exe
  2⤵
  PID:6544
- C:\Windows\System\SyMgQGn.exe
  C:\Windows\System\SyMgQGn.exe
  2⤵
  PID:6584
- C:\Windows\System\NrNQsOs.exe
  C:\Windows\System\NrNQsOs.exe
  2⤵
  PID:6640
- C:\Windows\System\FopIIxl.exe
  C:\Windows\System\FopIIxl.exe
  2⤵
  PID:6704
- C:\Windows\System\MmnlofO.exe
  C:\Windows\System\MmnlofO.exe
  2⤵
  PID:6780
- C:\Windows\System\WoziIgv.exe
  C:\Windows\System\WoziIgv.exe
  2⤵
  PID:6804
- C:\Windows\System\xvFaTTC.exe
  C:\Windows\System\xvFaTTC.exe
  2⤵
  PID:6900
- C:\Windows\System\vuhUxbL.exe
  C:\Windows\System\vuhUxbL.exe
  2⤵
  PID:6968
- C:\Windows\System\ZkbJbwD.exe
  C:\Windows\System\ZkbJbwD.exe
  2⤵
  PID:6988
- C:\Windows\System\rjgnhuE.exe
  C:\Windows\System\rjgnhuE.exe
  2⤵
  PID:7080
- C:\Windows\System\gKNkkNd.exe
  C:\Windows\System\gKNkkNd.exe
  2⤵
  PID:7156
- C:\Windows\System\uuCuYcF.exe
  C:\Windows\System\uuCuYcF.exe
  2⤵
  PID:5976
- C:\Windows\System\fjTDArp.exe
  C:\Windows\System\fjTDArp.exe
  2⤵
  PID:6280
- C:\Windows\System\FIFYdpy.exe
  C:\Windows\System\FIFYdpy.exe
  2⤵
  PID:6516
- C:\Windows\System\pESKQuU.exe
  C:\Windows\System\pESKQuU.exe
  2⤵
  PID:6648
- C:\Windows\System\pSqmCwZ.exe
  C:\Windows\System\pSqmCwZ.exe
  2⤵
  PID:6856
- C:\Windows\System\kgwjVTG.exe
  C:\Windows\System\kgwjVTG.exe
  2⤵
  PID:6908
- C:\Windows\System\pZzQnzX.exe
  C:\Windows\System\pZzQnzX.exe
  2⤵
  PID:7152
- C:\Windows\System\oJYRkmA.exe
  C:\Windows\System\oJYRkmA.exe
  2⤵
  PID:6192
- C:\Windows\System\xMOStfL.exe
  C:\Windows\System\xMOStfL.exe
  2⤵
  PID:6520
- C:\Windows\System\CUUKFKK.exe
  C:\Windows\System\CUUKFKK.exe
  2⤵
  PID:7132
- C:\Windows\System\nNNdLMZ.exe
  C:\Windows\System\nNNdLMZ.exe
  2⤵
  PID:6484
- C:\Windows\System\WDdwWGg.exe
  C:\Windows\System\WDdwWGg.exe
  2⤵
  PID:7048
- C:\Windows\System\mnoQWee.exe
  C:\Windows\System\mnoQWee.exe
  2⤵
  PID:7192
- C:\Windows\System\aoBzspF.exe
  C:\Windows\System\aoBzspF.exe
  2⤵
  PID:7216
- C:\Windows\System\tuHUCgb.exe
  C:\Windows\System\tuHUCgb.exe
  2⤵
  PID:7248
- C:\Windows\System\vEDyJPl.exe
  C:\Windows\System\vEDyJPl.exe
  2⤵
  PID:7276
- C:\Windows\System\IodAPfL.exe
  C:\Windows\System\IodAPfL.exe
  2⤵
  PID:7300
- C:\Windows\System\WkssAQf.exe
  C:\Windows\System\WkssAQf.exe
  2⤵
  PID:7320
- C:\Windows\System\uqwQkgb.exe
  C:\Windows\System\uqwQkgb.exe
  2⤵
  PID:7344
- C:\Windows\System\vZlLGzA.exe
  C:\Windows\System\vZlLGzA.exe
  2⤵
  PID:7368
- C:\Windows\System\UhAhHTQ.exe
  C:\Windows\System\UhAhHTQ.exe
  2⤵
  PID:7388
- C:\Windows\System\pmrBFHw.exe
  C:\Windows\System\pmrBFHw.exe
  2⤵
  PID:7424
- C:\Windows\System\VSJmwDH.exe
  C:\Windows\System\VSJmwDH.exe
  2⤵
  PID:7460
- C:\Windows\System\wOCxrlU.exe
  C:\Windows\System\wOCxrlU.exe
  2⤵
  PID:7492
- C:\Windows\System\ZAwCCME.exe
  C:\Windows\System\ZAwCCME.exe
  2⤵
  PID:7508
- C:\Windows\System\bTPeFPa.exe
  C:\Windows\System\bTPeFPa.exe
  2⤵
  PID:7532
- C:\Windows\System\bTPqCIl.exe
  C:\Windows\System\bTPqCIl.exe
  2⤵
  PID:7552
- C:\Windows\System\qEXBMvZ.exe
  C:\Windows\System\qEXBMvZ.exe
  2⤵
  PID:7592
- C:\Windows\System\xZXwqec.exe
  C:\Windows\System\xZXwqec.exe
  2⤵
  PID:7624
- C:\Windows\System\TToaQYQ.exe
  C:\Windows\System\TToaQYQ.exe
  2⤵
  PID:7664
- C:\Windows\System\GqxwAhD.exe
  C:\Windows\System\GqxwAhD.exe
  2⤵
  PID:7688
- C:\Windows\System\TyJlCxR.exe
  C:\Windows\System\TyJlCxR.exe
  2⤵
  PID:7708
- C:\Windows\System\IZVxhGf.exe
  C:\Windows\System\IZVxhGf.exe
  2⤵
  PID:7740
- C:\Windows\System\LBgKjOO.exe
  C:\Windows\System\LBgKjOO.exe
  2⤵
  PID:7772
- C:\Windows\System\gKQDrrC.exe
  C:\Windows\System\gKQDrrC.exe
  2⤵
  PID:7804
- C:\Windows\System\xACmWqV.exe
  C:\Windows\System\xACmWqV.exe
  2⤵
  PID:7832
- C:\Windows\System\gOfbKQG.exe
  C:\Windows\System\gOfbKQG.exe
  2⤵
  PID:7856
- C:\Windows\System\PHtPMWR.exe
  C:\Windows\System\PHtPMWR.exe
  2⤵
  PID:7884
- C:\Windows\System\ZzMYKaK.exe
  C:\Windows\System\ZzMYKaK.exe
  2⤵
  PID:7920
- C:\Windows\System\rierChV.exe
  C:\Windows\System\rierChV.exe
  2⤵
  PID:7944
- C:\Windows\System\OFMhBFB.exe
  C:\Windows\System\OFMhBFB.exe
  2⤵
  PID:7976
- C:\Windows\System\JczexSZ.exe
  C:\Windows\System\JczexSZ.exe
  2⤵
  PID:7996
- C:\Windows\System\sFVwzpZ.exe
  C:\Windows\System\sFVwzpZ.exe
  2⤵
  PID:8024
- C:\Windows\System\ripCUBh.exe
  C:\Windows\System\ripCUBh.exe
  2⤵
  PID:8056
- C:\Windows\System\lmAqYFR.exe
  C:\Windows\System\lmAqYFR.exe
  2⤵
  PID:8084
- C:\Windows\System\KTZXagR.exe
  C:\Windows\System\KTZXagR.exe
  2⤵
  PID:8116
- C:\Windows\System\zkHITXW.exe
  C:\Windows\System\zkHITXW.exe
  2⤵
  PID:8148
- C:\Windows\System\mqygMsR.exe
  C:\Windows\System\mqygMsR.exe
  2⤵
  PID:8172
- C:\Windows\System\FtNdjAf.exe
  C:\Windows\System\FtNdjAf.exe
  2⤵
  PID:7180
- C:\Windows\System\lcGyXHM.exe
  C:\Windows\System\lcGyXHM.exe
  2⤵
  PID:7244
- C:\Windows\System\ejCfRzu.exe
  C:\Windows\System\ejCfRzu.exe
  2⤵
  PID:7288
- C:\Windows\System\edXkuJw.exe
  C:\Windows\System\edXkuJw.exe
  2⤵
  PID:7356
- C:\Windows\System\oXbmgSo.exe
  C:\Windows\System\oXbmgSo.exe
  2⤵
  PID:7420
- C:\Windows\System\abDRExa.exe
  C:\Windows\System\abDRExa.exe
  2⤵
  PID:7504
- C:\Windows\System\hlNEKkV.exe
  C:\Windows\System\hlNEKkV.exe
  2⤵
  PID:7480
- C:\Windows\System\wfDUWUk.exe
  C:\Windows\System\wfDUWUk.exe
  2⤵
  PID:7636
- C:\Windows\System\UfjUCna.exe
  C:\Windows\System\UfjUCna.exe
  2⤵
  PID:7700
- C:\Windows\System\lBEZTyX.exe
  C:\Windows\System\lBEZTyX.exe
  2⤵
  PID:7780
- C:\Windows\System\myHmgBQ.exe
  C:\Windows\System\myHmgBQ.exe
  2⤵
  PID:7852
- C:\Windows\System\UeyulOd.exe
  C:\Windows\System\UeyulOd.exe
  2⤵
  PID:7936
- C:\Windows\System\yliMhWD.exe
  C:\Windows\System\yliMhWD.exe
  2⤵
  PID:8008
- C:\Windows\System\dstcOHa.exe
  C:\Windows\System\dstcOHa.exe
  2⤵
  PID:8048
- C:\Windows\System\HSLuCXk.exe
  C:\Windows\System\HSLuCXk.exe
  2⤵
  PID:8136
- C:\Windows\System\mjZWHCC.exe
  C:\Windows\System\mjZWHCC.exe
  2⤵
  PID:8164
- C:\Windows\System\xqoBrYb.exe
  C:\Windows\System\xqoBrYb.exe
  2⤵
  PID:7308
- C:\Windows\System\TDdOZZf.exe
  C:\Windows\System\TDdOZZf.exe
  2⤵
  PID:7332
- C:\Windows\System\VQvPutu.exe
  C:\Windows\System\VQvPutu.exe
  2⤵
  PID:7676
- C:\Windows\System\xZfFpTs.exe
  C:\Windows\System\xZfFpTs.exe
  2⤵
  PID:7616
- C:\Windows\System\gXVhsnL.exe
  C:\Windows\System\gXVhsnL.exe
  2⤵
  PID:7892
- C:\Windows\System\ZmeDTBN.exe
  C:\Windows\System\ZmeDTBN.exe
  2⤵
  PID:8072
- C:\Windows\System\UYFNlAG.exe
  C:\Windows\System\UYFNlAG.exe
  2⤵
  PID:6412
- C:\Windows\System\zmZkWOg.exe
  C:\Windows\System\zmZkWOg.exe
  2⤵
  PID:7484
- C:\Windows\System\jMwzPot.exe
  C:\Windows\System\jMwzPot.exe
  2⤵
  PID:7604
- C:\Windows\System\yrtufkM.exe
  C:\Windows\System\yrtufkM.exe
  2⤵
  PID:8036
- C:\Windows\System\OxcrZpP.exe
  C:\Windows\System\OxcrZpP.exe
  2⤵
  PID:8200
- C:\Windows\System\isPzVRt.exe
  C:\Windows\System\isPzVRt.exe
  2⤵
  PID:8228
- C:\Windows\System\yykdslQ.exe
  C:\Windows\System\yykdslQ.exe
  2⤵
  PID:8256
- C:\Windows\System\FXLQaOB.exe
  C:\Windows\System\FXLQaOB.exe
  2⤵
  PID:8288
- C:\Windows\System\TRyHmXE.exe
  C:\Windows\System\TRyHmXE.exe
  2⤵
  PID:8304
- C:\Windows\System\lsEMlvs.exe
  C:\Windows\System\lsEMlvs.exe
  2⤵
  PID:8336
- C:\Windows\System\nadewnT.exe
  C:\Windows\System\nadewnT.exe
  2⤵
  PID:8364
- C:\Windows\System\obBmXzQ.exe
  C:\Windows\System\obBmXzQ.exe
  2⤵
  PID:8400
- C:\Windows\System\zXQvnAO.exe
  C:\Windows\System\zXQvnAO.exe
  2⤵
  PID:8424
- C:\Windows\System\okRlJdI.exe
  C:\Windows\System\okRlJdI.exe
  2⤵
  PID:8444
- C:\Windows\System\MvvxYSy.exe
  C:\Windows\System\MvvxYSy.exe
  2⤵
  PID:8476
- C:\Windows\System\QNgnRir.exe
  C:\Windows\System\QNgnRir.exe
  2⤵
  PID:8508
- C:\Windows\System\GZOHsaa.exe
  C:\Windows\System\GZOHsaa.exe
  2⤵
  PID:8540
- C:\Windows\System\TQLJfbj.exe
  C:\Windows\System\TQLJfbj.exe
  2⤵
  PID:8556
- C:\Windows\System\FmFnqXx.exe
  C:\Windows\System\FmFnqXx.exe
  2⤵
  PID:8592
- C:\Windows\System\PEyAFdy.exe
  C:\Windows\System\PEyAFdy.exe
  2⤵
  PID:8612
- C:\Windows\System\JLrxFDA.exe
  C:\Windows\System\JLrxFDA.exe
  2⤵
  PID:8648
- C:\Windows\System\FRVMzAX.exe
  C:\Windows\System\FRVMzAX.exe
  2⤵
  PID:8668
- C:\Windows\System\wTbYslc.exe
  C:\Windows\System\wTbYslc.exe
  2⤵
  PID:8688
- C:\Windows\System\EaQZwYX.exe
  C:\Windows\System\EaQZwYX.exe
  2⤵
  PID:8708
- C:\Windows\System\tAJulUm.exe
  C:\Windows\System\tAJulUm.exe
  2⤵
  PID:8728
- C:\Windows\System\wwFNBhE.exe
  C:\Windows\System\wwFNBhE.exe
  2⤵
  PID:8752
- C:\Windows\System\xjQmGNU.exe
  C:\Windows\System\xjQmGNU.exe
  2⤵
  PID:8768
- C:\Windows\System\lJuSGtk.exe
  C:\Windows\System\lJuSGtk.exe
  2⤵
  PID:8788
- C:\Windows\System\ollpxMm.exe
  C:\Windows\System\ollpxMm.exe
  2⤵
  PID:8820
- C:\Windows\System\mInmacW.exe
  C:\Windows\System\mInmacW.exe
  2⤵
  PID:8840
- C:\Windows\System\kcyvfcS.exe
  C:\Windows\System\kcyvfcS.exe
  2⤵
  PID:8872
- C:\Windows\System\OGXRJyi.exe
  C:\Windows\System\OGXRJyi.exe
  2⤵
  PID:8900
- C:\Windows\System\laKaeBf.exe
  C:\Windows\System\laKaeBf.exe
  2⤵
  PID:8928
- C:\Windows\System\OvLFhAB.exe
  C:\Windows\System\OvLFhAB.exe
  2⤵
  PID:8956
- C:\Windows\System\uhKLxXA.exe
  C:\Windows\System\uhKLxXA.exe
  2⤵
  PID:8988
- C:\Windows\System\wtetDbO.exe
  C:\Windows\System\wtetDbO.exe
  2⤵
  PID:9012
- C:\Windows\System\JFRMIYg.exe
  C:\Windows\System\JFRMIYg.exe
  2⤵
  PID:9040
- C:\Windows\System\CmJPcPl.exe
  C:\Windows\System\CmJPcPl.exe
  2⤵
  PID:9080
- C:\Windows\System\CwynvQc.exe
  C:\Windows\System\CwynvQc.exe
  2⤵
  PID:9104
- C:\Windows\System\yJacqtp.exe
  C:\Windows\System\yJacqtp.exe
  2⤵
  PID:9132
- C:\Windows\System\tZndUph.exe
  C:\Windows\System\tZndUph.exe
  2⤵
  PID:9156
- C:\Windows\System\OEUUDiy.exe
  C:\Windows\System\OEUUDiy.exe
  2⤵
  PID:9184
- C:\Windows\System\bJjdokm.exe
  C:\Windows\System\bJjdokm.exe
  2⤵
  PID:8132
- C:\Windows\System\kESNwgr.exe
  C:\Windows\System\kESNwgr.exe
  2⤵
  PID:8196
- C:\Windows\System\cnYbZPs.exe
  C:\Windows\System\cnYbZPs.exe
  2⤵
  PID:8276
- C:\Windows\System\twHzUgV.exe
  C:\Windows\System\twHzUgV.exe
  2⤵
  PID:8348
- C:\Windows\System\jyXUXLA.exe
  C:\Windows\System\jyXUXLA.exe
  2⤵
  PID:8388
- C:\Windows\System\oAwNgmz.exe
  C:\Windows\System\oAwNgmz.exe
  2⤵
  PID:8500
- C:\Windows\System\jgWZAVd.exe
  C:\Windows\System\jgWZAVd.exe
  2⤵
  PID:8548
- C:\Windows\System\kMuTyLK.exe
  C:\Windows\System\kMuTyLK.exe
  2⤵
  PID:8636
- C:\Windows\System\dqflhyt.exe
  C:\Windows\System\dqflhyt.exe
  2⤵
  PID:8656
- C:\Windows\System\AExhznO.exe
  C:\Windows\System\AExhznO.exe
  2⤵
  PID:8744
- C:\Windows\System\YiQSKme.exe
  C:\Windows\System\YiQSKme.exe
  2⤵
  PID:8832
- C:\Windows\System\ByFzgOO.exe
  C:\Windows\System\ByFzgOO.exe
  2⤵
  PID:8912
- C:\Windows\System\mqtMfKO.exe
  C:\Windows\System\mqtMfKO.exe
  2⤵
  PID:8944
- C:\Windows\System\ezhFfTl.exe
  C:\Windows\System\ezhFfTl.exe
  2⤵
  PID:9096
- C:\Windows\System\uCtqohS.exe
  C:\Windows\System\uCtqohS.exe
  2⤵
  PID:9020
- C:\Windows\System\pTyHCsn.exe
  C:\Windows\System\pTyHCsn.exe
  2⤵
  PID:8248
- C:\Windows\System\yCVdwOS.exe
  C:\Windows\System\yCVdwOS.exe
  2⤵
  PID:8264
- C:\Windows\System\VTCKWIO.exe
  C:\Windows\System\VTCKWIO.exe
  2⤵
  PID:8380
- C:\Windows\System\paWxGeF.exe
  C:\Windows\System\paWxGeF.exe
  2⤵
  PID:8704
- C:\Windows\System\oplBXdP.exe
  C:\Windows\System\oplBXdP.exe
  2⤵
  PID:8740
- C:\Windows\System\GOqnwVB.exe
  C:\Windows\System\GOqnwVB.exe
  2⤵
  PID:9056
- C:\Windows\System\upheMIn.exe
  C:\Windows\System\upheMIn.exe
  2⤵
  PID:9148
- C:\Windows\System\BIbrvZz.exe
  C:\Windows\System\BIbrvZz.exe
  2⤵
  PID:3948
- C:\Windows\System\pWNamJo.exe
  C:\Windows\System\pWNamJo.exe
  2⤵
  PID:7436
- C:\Windows\System\RgKBJvh.exe
  C:\Windows\System\RgKBJvh.exe
  2⤵
  PID:8660
- C:\Windows\System\nWqjSDf.exe
  C:\Windows\System\nWqjSDf.exe
  2⤵
  PID:8952
- C:\Windows\System\taoltPQ.exe
  C:\Windows\System\taoltPQ.exe
  2⤵
  PID:8880
- C:\Windows\System\YOxWlLs.exe
  C:\Windows\System\YOxWlLs.exe
  2⤵
  PID:8360
- C:\Windows\System\jYJqErv.exe
  C:\Windows\System\jYJqErv.exe
  2⤵
  PID:9232
- C:\Windows\System\pUTNLPI.exe
  C:\Windows\System\pUTNLPI.exe
  2⤵
  PID:9248
- C:\Windows\System\pBMXbcW.exe
  C:\Windows\System\pBMXbcW.exe
  2⤵
  PID:9276
- C:\Windows\System\ZTyZsDP.exe
  C:\Windows\System\ZTyZsDP.exe
  2⤵
  PID:9292
- C:\Windows\System\VYcMeyI.exe
  C:\Windows\System\VYcMeyI.exe
  2⤵
  PID:9316
- C:\Windows\System\EWFKjgv.exe
  C:\Windows\System\EWFKjgv.exe
  2⤵
  PID:9348
- C:\Windows\System\IuyWEDk.exe
  C:\Windows\System\IuyWEDk.exe
  2⤵
  PID:9372
- C:\Windows\System\RcutOJy.exe
  C:\Windows\System\RcutOJy.exe
  2⤵
  PID:9392
- C:\Windows\System\FwrJTov.exe
  C:\Windows\System\FwrJTov.exe
  2⤵
  PID:9412
- C:\Windows\System\EvbIldp.exe
  C:\Windows\System\EvbIldp.exe
  2⤵
  PID:9432
- C:\Windows\System\wMLppkD.exe
  C:\Windows\System\wMLppkD.exe
  2⤵
  PID:9464
- C:\Windows\System\LFQItim.exe
  C:\Windows\System\LFQItim.exe
  2⤵
  PID:9492
- C:\Windows\System\cJaQbMR.exe
  C:\Windows\System\cJaQbMR.exe
  2⤵
  PID:9528
- C:\Windows\System\tpJYlNQ.exe
  C:\Windows\System\tpJYlNQ.exe
  2⤵
  PID:9556
- C:\Windows\System\ZwNWSvM.exe
  C:\Windows\System\ZwNWSvM.exe
  2⤵
  PID:9576
- C:\Windows\System\OvngFMy.exe
  C:\Windows\System\OvngFMy.exe
  2⤵
  PID:9596
- C:\Windows\System\cbIAcsD.exe
  C:\Windows\System\cbIAcsD.exe
  2⤵
  PID:9624
- C:\Windows\System\NLnubcZ.exe
  C:\Windows\System\NLnubcZ.exe
  2⤵
  PID:9652
- C:\Windows\System\zhaYjiH.exe
  C:\Windows\System\zhaYjiH.exe
  2⤵
  PID:9684
- C:\Windows\System\tUfcidH.exe
  C:\Windows\System\tUfcidH.exe
  2⤵
  PID:9708
- C:\Windows\System\yBXxmSG.exe
  C:\Windows\System\yBXxmSG.exe
  2⤵
  PID:9744
- C:\Windows\System\dKDrGKZ.exe
  C:\Windows\System\dKDrGKZ.exe
  2⤵
  PID:9772
- C:\Windows\System\hCzbOAh.exe
  C:\Windows\System\hCzbOAh.exe
  2⤵
  PID:9800
- C:\Windows\System\eYciKUW.exe
  C:\Windows\System\eYciKUW.exe
  2⤵
  PID:9832
- C:\Windows\System\KEQbDNO.exe
  C:\Windows\System\KEQbDNO.exe
  2⤵
  PID:9872
- C:\Windows\System\aXrmpfi.exe
  C:\Windows\System\aXrmpfi.exe
  2⤵
  PID:9896
- C:\Windows\System\TiYljat.exe
  C:\Windows\System\TiYljat.exe
  2⤵
  PID:9924
- C:\Windows\System\NNpbjAw.exe
  C:\Windows\System\NNpbjAw.exe
  2⤵
  PID:9956
- C:\Windows\System\otYJrfh.exe
  C:\Windows\System\otYJrfh.exe
  2⤵
  PID:9988
- C:\Windows\System\FOxFjps.exe
  C:\Windows\System\FOxFjps.exe
  2⤵
  PID:10020
- C:\Windows\System\qcyHMYP.exe
  C:\Windows\System\qcyHMYP.exe
  2⤵
  PID:10048
- C:\Windows\System\sZQhAHr.exe
  C:\Windows\System\sZQhAHr.exe
  2⤵
  PID:10076
- C:\Windows\System\nJGuReu.exe
  C:\Windows\System\nJGuReu.exe
  2⤵
  PID:10104
- C:\Windows\System\aMNIYaU.exe
  C:\Windows\System\aMNIYaU.exe
  2⤵
  PID:10136
- C:\Windows\System\ebIAVlK.exe
  C:\Windows\System\ebIAVlK.exe
  2⤵
  PID:10152
- C:\Windows\System\UPbLuYT.exe
  C:\Windows\System\UPbLuYT.exe
  2⤵
  PID:10184
- C:\Windows\System\kZTXKdi.exe
  C:\Windows\System\kZTXKdi.exe
  2⤵
  PID:10216
- C:\Windows\System\inWlOCK.exe
  C:\Windows\System\inWlOCK.exe
  2⤵
  PID:10236
- C:\Windows\System\REJtvSa.exe
  C:\Windows\System\REJtvSa.exe
  2⤵
  PID:9224
- C:\Windows\System\TLgrKpA.exe
  C:\Windows\System\TLgrKpA.exe
  2⤵
  PID:9328
- C:\Windows\System\ewbdWHn.exe
  C:\Windows\System\ewbdWHn.exe
  2⤵
  PID:9336
- C:\Windows\System\KyzkrLH.exe
  C:\Windows\System\KyzkrLH.exe
  2⤵
  PID:9460
- C:\Windows\System\TfmjPUn.exe
  C:\Windows\System\TfmjPUn.exe
  2⤵
  PID:9504
- C:\Windows\System\MzXumtR.exe
  C:\Windows\System\MzXumtR.exe
  2⤵
  PID:9548
- C:\Windows\System\axIDYMB.exe
  C:\Windows\System\axIDYMB.exe
  2⤵
  PID:9540
- C:\Windows\System\WXSfrmn.exe
  C:\Windows\System\WXSfrmn.exe
  2⤵
  PID:9608
- C:\Windows\System\hMPNegf.exe
  C:\Windows\System\hMPNegf.exe
  2⤵
  PID:9704
- C:\Windows\System\WWhefFA.exe
  C:\Windows\System\WWhefFA.exe
  2⤵
  PID:9692
- C:\Windows\System\uJNzJxG.exe
  C:\Windows\System\uJNzJxG.exe
  2⤵
  PID:9840
- C:\Windows\System\HfeOAzT.exe
  C:\Windows\System\HfeOAzT.exe
  2⤵
  PID:9820
- C:\Windows\System\bijTyCB.exe
  C:\Windows\System\bijTyCB.exe
  2⤵
  PID:10008
- C:\Windows\System\doUAqmY.exe
  C:\Windows\System\doUAqmY.exe
  2⤵
  PID:10040
- C:\Windows\System\VSWrZCL.exe
  C:\Windows\System\VSWrZCL.exe
  2⤵
  PID:10036
- C:\Windows\System\XEnXEOk.exe
  C:\Windows\System\XEnXEOk.exe
  2⤵
  PID:10148
- C:\Windows\System\WrjGsTk.exe
  C:\Windows\System\WrjGsTk.exe
  2⤵
  PID:10164
- C:\Windows\System\BKSSuqr.exe
  C:\Windows\System\BKSSuqr.exe
  2⤵
  PID:9268
- C:\Windows\System\KTonrgy.exe
  C:\Windows\System\KTonrgy.exe
  2⤵
  PID:9480
- C:\Windows\System\drqAnnV.exe
  C:\Windows\System\drqAnnV.exe
  2⤵
  PID:9384
- C:\Windows\System\VIEfmDi.exe
  C:\Windows\System\VIEfmDi.exe
  2⤵
  PID:9644
- C:\Windows\System\xUqPlVP.exe
  C:\Windows\System\xUqPlVP.exe
  2⤵
  PID:9852
- C:\Windows\System\kQvUZwP.exe
  C:\Windows\System\kQvUZwP.exe
  2⤵
  PID:9756
- C:\Windows\System\YKnRFxU.exe
  C:\Windows\System\YKnRFxU.exe
  2⤵
  PID:10096
- C:\Windows\System\VejmdAl.exe
  C:\Windows\System\VejmdAl.exe
  2⤵
  PID:9424
- C:\Windows\System\lcSfVSl.exe
  C:\Windows\System\lcSfVSl.exe
  2⤵
  PID:9484
- C:\Windows\System\gzDtnVN.exe
  C:\Windows\System\gzDtnVN.exe
  2⤵
  PID:10276
- C:\Windows\System\mrhgDQs.exe
  C:\Windows\System\mrhgDQs.exe
  2⤵
  PID:10316
- C:\Windows\System\hRmZAQq.exe
  C:\Windows\System\hRmZAQq.exe
  2⤵
  PID:10340
- C:\Windows\System\hwulxby.exe
  C:\Windows\System\hwulxby.exe
  2⤵
  PID:10372
- C:\Windows\System\BqmwgTT.exe
  C:\Windows\System\BqmwgTT.exe
  2⤵
  PID:10396
- C:\Windows\System\ruNLzgc.exe
  C:\Windows\System\ruNLzgc.exe
  2⤵
  PID:10420
- C:\Windows\System\rSJUgry.exe
  C:\Windows\System\rSJUgry.exe
  2⤵
  PID:10436
- C:\Windows\System\kDupmUm.exe
  C:\Windows\System\kDupmUm.exe
  2⤵
  PID:10460
- C:\Windows\System\DeYzkHV.exe
  C:\Windows\System\DeYzkHV.exe
  2⤵
  PID:10480
- C:\Windows\System\oCjQXPL.exe
  C:\Windows\System\oCjQXPL.exe
  2⤵
  PID:10508
- C:\Windows\System\GnjHCwh.exe
  C:\Windows\System\GnjHCwh.exe
  2⤵
  PID:10544
- C:\Windows\System\kLQyhFo.exe
  C:\Windows\System\kLQyhFo.exe
  2⤵
  PID:10564
- C:\Windows\System\CUWfdbe.exe
  C:\Windows\System\CUWfdbe.exe
  2⤵
  PID:10600
- C:\Windows\System\CDEYZjY.exe
  C:\Windows\System\CDEYZjY.exe
  2⤵
  PID:10640
- C:\Windows\System\NXJDuOq.exe
  C:\Windows\System\NXJDuOq.exe
  2⤵
  PID:10676
- C:\Windows\System\hpsxJSn.exe
  C:\Windows\System\hpsxJSn.exe
  2⤵
  PID:10704
- C:\Windows\System\YyPiXci.exe
  C:\Windows\System\YyPiXci.exe
  2⤵
  PID:10728
- C:\Windows\System\SbTiJAf.exe
  C:\Windows\System\SbTiJAf.exe
  2⤵
  PID:10752
- C:\Windows\System\zzGshSZ.exe
  C:\Windows\System\zzGshSZ.exe
  2⤵
  PID:10788
- C:\Windows\System\QuCyGtR.exe
  C:\Windows\System\QuCyGtR.exe
  2⤵
  PID:10816
- C:\Windows\System\FYFRACh.exe
  C:\Windows\System\FYFRACh.exe
  2⤵
  PID:10848
- C:\Windows\System\TuIZaNH.exe
  C:\Windows\System\TuIZaNH.exe
  2⤵
  PID:10864
- C:\Windows\System\KZablhc.exe
  C:\Windows\System\KZablhc.exe
  2⤵
  PID:10884
- C:\Windows\System\FhpsTlH.exe
  C:\Windows\System\FhpsTlH.exe
  2⤵
  PID:10920
- C:\Windows\System\HiHxxeR.exe
  C:\Windows\System\HiHxxeR.exe
  2⤵
  PID:10964
- C:\Windows\System\aKtKIka.exe
  C:\Windows\System\aKtKIka.exe
  2⤵
  PID:10984
- C:\Windows\System\IuFdxeE.exe
  C:\Windows\System\IuFdxeE.exe
  2⤵
  PID:11008
- C:\Windows\System\JqREzkP.exe
  C:\Windows\System\JqREzkP.exe
  2⤵
  PID:11036
- C:\Windows\System\RdptsWL.exe
  C:\Windows\System\RdptsWL.exe
  2⤵
  PID:11060
- C:\Windows\System\lcgavOw.exe
  C:\Windows\System\lcgavOw.exe
  2⤵
  PID:11096
- C:\Windows\System\VthBfPu.exe
  C:\Windows\System\VthBfPu.exe
  2⤵
  PID:11124
- C:\Windows\System\IhrMtei.exe
  C:\Windows\System\IhrMtei.exe
  2⤵
  PID:11148
- C:\Windows\System\IUsixZE.exe
  C:\Windows\System\IUsixZE.exe
  2⤵
  PID:11176
- C:\Windows\System\jyFjhTv.exe
  C:\Windows\System\jyFjhTv.exe
  2⤵
  PID:11216
- C:\Windows\System\lFcwCPJ.exe
  C:\Windows\System\lFcwCPJ.exe
  2⤵
  PID:11236
- C:\Windows\System\WRsxueb.exe
  C:\Windows\System\WRsxueb.exe
  2⤵
  PID:9312
- C:\Windows\System\gKAVcpE.exe
  C:\Windows\System\gKAVcpE.exe
  2⤵
  PID:10268
- C:\Windows\System\WLOeFOk.exe
  C:\Windows\System\WLOeFOk.exe
  2⤵
  PID:10208
- C:\Windows\System\MATiRCQ.exe
  C:\Windows\System\MATiRCQ.exe
  2⤵
  PID:9972
- C:\Windows\System\jDbQFVQ.exe
  C:\Windows\System\jDbQFVQ.exe
  2⤵
  PID:10360
- C:\Windows\System\KQyVTwj.exe
  C:\Windows\System\KQyVTwj.exe
  2⤵
  PID:10412
- C:\Windows\System\EvAREbD.exe
  C:\Windows\System\EvAREbD.exe
  2⤵
  PID:10452
- C:\Windows\System\OmCCnkm.exe
  C:\Windows\System\OmCCnkm.exe
  2⤵
  PID:10456
- C:\Windows\System\JclnPcv.exe
  C:\Windows\System\JclnPcv.exe
  2⤵
  PID:10636
- C:\Windows\System\IoAiMov.exe
  C:\Windows\System\IoAiMov.exe
  2⤵
  PID:10524
- C:\Windows\System\uXXvAne.exe
  C:\Windows\System\uXXvAne.exe
  2⤵
  PID:10656
- C:\Windows\System\YojPeBD.exe
  C:\Windows\System\YojPeBD.exe
  2⤵
  PID:10764
- C:\Windows\System\MlAdTmA.exe
  C:\Windows\System\MlAdTmA.exe
  2⤵
  PID:10944
- C:\Windows\System\XOXRxRk.exe
  C:\Windows\System\XOXRxRk.exe
  2⤵
  PID:10844
- C:\Windows\System\JuVqGAx.exe
  C:\Windows\System\JuVqGAx.exe
  2⤵
  PID:10916
- C:\Windows\System\bSZdVhi.exe
  C:\Windows\System\bSZdVhi.exe
  2⤵
  PID:11076
- C:\Windows\System\JXQnuow.exe
  C:\Windows\System\JXQnuow.exe
  2⤵
  PID:11140
- C:\Windows\System\kPGdbMB.exe
  C:\Windows\System\kPGdbMB.exe
  2⤵
  PID:11136
- C:\Windows\System\HBYODuL.exe
  C:\Windows\System\HBYODuL.exe
  2⤵
  PID:9784
- C:\Windows\System\AhxeFcH.exe
  C:\Windows\System\AhxeFcH.exe
  2⤵
  PID:10336
- C:\Windows\System\ZuHtBpB.exe
  C:\Windows\System\ZuHtBpB.exe
  2⤵
  PID:10300
- C:\Windows\System\yCIfoTn.exe
  C:\Windows\System\yCIfoTn.exe
  2⤵
  PID:10572
- C:\Windows\System\DXkGdab.exe
  C:\Windows\System\DXkGdab.exe
  2⤵
  PID:10652
- C:\Windows\System\bZVnujr.exe
  C:\Windows\System\bZVnujr.exe
  2⤵
  PID:11000
- C:\Windows\System\pEFcqNS.exe
  C:\Windows\System\pEFcqNS.exe
  2⤵
  PID:10904
- C:\Windows\System\HIgZJYO.exe
  C:\Windows\System\HIgZJYO.exe
  2⤵
  PID:9680
- C:\Windows\System\rZUduFb.exe
  C:\Windows\System\rZUduFb.exe
  2⤵
  PID:10896
- C:\Windows\System\GwzOfeO.exe
  C:\Windows\System\GwzOfeO.exe
  2⤵
  PID:10536
- C:\Windows\System\NyDZuzH.exe
  C:\Windows\System\NyDZuzH.exe
  2⤵
  PID:11268
- C:\Windows\System\yZgIBMT.exe
  C:\Windows\System\yZgIBMT.exe
  2⤵
  PID:11304
- C:\Windows\System\DQELGOz.exe
  C:\Windows\System\DQELGOz.exe
  2⤵
  PID:11328
- C:\Windows\System\XJQbfZj.exe
  C:\Windows\System\XJQbfZj.exe
  2⤵
  PID:11360
- C:\Windows\System\RTsJNbg.exe
  C:\Windows\System\RTsJNbg.exe
  2⤵
  PID:11384
- C:\Windows\System\wVotDGg.exe
  C:\Windows\System\wVotDGg.exe
  2⤵
  PID:11404
- C:\Windows\System\dBJEYVK.exe
  C:\Windows\System\dBJEYVK.exe
  2⤵
  PID:11436
- C:\Windows\System\uNeFeHc.exe
  C:\Windows\System\uNeFeHc.exe
  2⤵
  PID:11472
- C:\Windows\System\hvJjgQb.exe
  C:\Windows\System\hvJjgQb.exe
  2⤵
  PID:11500
- C:\Windows\System\JrABRCN.exe
  C:\Windows\System\JrABRCN.exe
  2⤵
  PID:11520
- C:\Windows\System\FEgTnSN.exe
  C:\Windows\System\FEgTnSN.exe
  2⤵
  PID:11552
- C:\Windows\System\ayDjkuN.exe
  C:\Windows\System\ayDjkuN.exe
  2⤵
  PID:11580
- C:\Windows\System\VbdDsQa.exe
  C:\Windows\System\VbdDsQa.exe
  2⤵
  PID:11604
- C:\Windows\System\GIiLjYh.exe
  C:\Windows\System\GIiLjYh.exe
  2⤵
  PID:11636
- C:\Windows\System\KciCPbJ.exe
  C:\Windows\System\KciCPbJ.exe
  2⤵
  PID:11664
- C:\Windows\System\OsaeJqV.exe
  C:\Windows\System\OsaeJqV.exe
  2⤵
  PID:11688
- C:\Windows\System\PDEzJCu.exe
  C:\Windows\System\PDEzJCu.exe
  2⤵
  PID:11712
- C:\Windows\System\leMzonp.exe
  C:\Windows\System\leMzonp.exe
  2⤵
  PID:11740
- C:\Windows\System\JkVWFNl.exe
  C:\Windows\System\JkVWFNl.exe
  2⤵
  PID:11772
- C:\Windows\System\fppcxrl.exe
  C:\Windows\System\fppcxrl.exe
  2⤵
  PID:11804
- C:\Windows\System\GrfjZVj.exe
  C:\Windows\System\GrfjZVj.exe
  2⤵
  PID:11824
- C:\Windows\System\uenaOna.exe
  C:\Windows\System\uenaOna.exe
  2⤵
  PID:11860
- C:\Windows\System\drAowdD.exe
  C:\Windows\System\drAowdD.exe
  2⤵
  PID:11892
- C:\Windows\System\sKkDEGq.exe
  C:\Windows\System\sKkDEGq.exe
  2⤵
  PID:11916
- C:\Windows\System\iyGrANt.exe
  C:\Windows\System\iyGrANt.exe
  2⤵
  PID:11948
- C:\Windows\System\abXfSjg.exe
  C:\Windows\System\abXfSjg.exe
  2⤵
  PID:11972
- C:\Windows\System\kDgxVtd.exe
  C:\Windows\System\kDgxVtd.exe
  2⤵
  PID:12000
- C:\Windows\System\UHtKPPl.exe
  C:\Windows\System\UHtKPPl.exe
  2⤵
  PID:12036
- C:\Windows\System\OxGjaMW.exe
  C:\Windows\System\OxGjaMW.exe
  2⤵
  PID:12060
- C:\Windows\System\VVSCbyL.exe
  C:\Windows\System\VVSCbyL.exe
  2⤵
  PID:12076
- C:\Windows\System\XZGgPhS.exe
  C:\Windows\System\XZGgPhS.exe
  2⤵
  PID:12096
- C:\Windows\System\gkqTAbM.exe
  C:\Windows\System\gkqTAbM.exe
  2⤵
  PID:12128
- C:\Windows\System\DpeNGSf.exe
  C:\Windows\System\DpeNGSf.exe
  2⤵
  PID:12152
- C:\Windows\System\fonwQrF.exe
  C:\Windows\System\fonwQrF.exe
  2⤵
  PID:12168
- C:\Windows\System\objtJYC.exe
  C:\Windows\System\objtJYC.exe
  2⤵
  PID:12192
- C:\Windows\System\LXThBkl.exe
  C:\Windows\System\LXThBkl.exe
  2⤵
  PID:12224
- C:\Windows\System\tJjmmAv.exe
  C:\Windows\System\tJjmmAv.exe
  2⤵
  PID:12260
- C:\Windows\System\eOYAUvU.exe
  C:\Windows\System\eOYAUvU.exe
  2⤵
  PID:10784
- C:\Windows\System\hGiNxtH.exe
  C:\Windows\System\hGiNxtH.exe
  2⤵
  PID:10808
- C:\Windows\System\rSurVCu.exe
  C:\Windows\System\rSurVCu.exe
  2⤵
  PID:10288
- C:\Windows\System\OPrSRCi.exe
  C:\Windows\System\OPrSRCi.exe
  2⤵
  PID:11412
- C:\Windows\System\jNSYqBx.exe
  C:\Windows\System\jNSYqBx.exe
  2⤵
  PID:11372
- C:\Windows\System\oVbGQoG.exe
  C:\Windows\System\oVbGQoG.exe
  2⤵
  PID:11324
- C:\Windows\System\ThqzDDq.exe
  C:\Windows\System\ThqzDDq.exe
  2⤵
  PID:11428
- C:\Windows\System\zkBwsTY.exe
  C:\Windows\System\zkBwsTY.exe
  2⤵
  PID:11652
- C:\Windows\System\GXcTJqW.exe
  C:\Windows\System\GXcTJqW.exe
  2⤵
  PID:11696
- C:\Windows\System\dSTzube.exe
  C:\Windows\System\dSTzube.exe
  2⤵
  PID:11752
- C:\Windows\System\fDeEYTz.exe
  C:\Windows\System\fDeEYTz.exe
  2⤵
  PID:11788
- C:\Windows\System\yNCWbVt.exe
  C:\Windows\System\yNCWbVt.exe
  2⤵
  PID:11784
- C:\Windows\System\wtOKDcz.exe
  C:\Windows\System\wtOKDcz.exe
  2⤵
  PID:11984
- C:\Windows\System\AWudIcj.exe
  C:\Windows\System\AWudIcj.exe
  2⤵
  PID:12012
- C:\Windows\System\yuyxsaB.exe
  C:\Windows\System\yuyxsaB.exe
  2⤵
  PID:12092
- C:\Windows\System\KhmyYfc.exe
  C:\Windows\System\KhmyYfc.exe
  2⤵
  PID:12248
- C:\Windows\System\FTqtpdF.exe
  C:\Windows\System\FTqtpdF.exe
  2⤵
  PID:12108
- C:\Windows\System\lxMSXAL.exe
  C:\Windows\System\lxMSXAL.exe
  2⤵
  PID:12212
- C:\Windows\System\WBJupNG.exe
  C:\Windows\System\WBJupNG.exe
  2⤵
  PID:11456
- C:\Windows\System\kXroxqw.exe
  C:\Windows\System\kXroxqw.exe
  2⤵
  PID:11400
- C:\Windows\System\PYVetOs.exe
  C:\Windows\System\PYVetOs.exe
  2⤵
  PID:11764
- C:\Windows\System\fWcXVtc.exe
  C:\Windows\System\fWcXVtc.exe
  2⤵
  PID:11872
- C:\Windows\System\sditamd.exe
  C:\Windows\System\sditamd.exe
  2⤵
  PID:11736
- C:\Windows\System\yixnmZU.exe
  C:\Windows\System\yixnmZU.exe
  2⤵
  PID:12068
- C:\Windows\System\YsdyuJv.exe
  C:\Windows\System\YsdyuJv.exe
  2⤵
  PID:11516
- C:\Windows\System\lVwtfvY.exe
  C:\Windows\System\lVwtfvY.exe
  2⤵
  PID:11300
- C:\Windows\System\XAABPYm.exe
  C:\Windows\System\XAABPYm.exe
  2⤵
  PID:11356
- C:\Windows\System\DgcMAfD.exe
  C:\Windows\System\DgcMAfD.exe
  2⤵
  PID:12296
- C:\Windows\System\tRRFZTk.exe
  C:\Windows\System\tRRFZTk.exe
  2⤵
  PID:12324
- C:\Windows\System\grVhPTt.exe
  C:\Windows\System\grVhPTt.exe
  2⤵
  PID:12352
- C:\Windows\System\kFBDZQC.exe
  C:\Windows\System\kFBDZQC.exe
  2⤵
  PID:12376
- C:\Windows\System\yMvTwAq.exe
  C:\Windows\System\yMvTwAq.exe
  2⤵
  PID:12404
- C:\Windows\System\CPenizT.exe
  C:\Windows\System\CPenizT.exe
  2⤵
  PID:12432
- C:\Windows\System\FNsPGJW.exe
  C:\Windows\System\FNsPGJW.exe
  2⤵
  PID:12460
- C:\Windows\System\pawxjbZ.exe
  C:\Windows\System\pawxjbZ.exe
  2⤵
  PID:12492
- C:\Windows\System\GrESSvW.exe
  C:\Windows\System\GrESSvW.exe
  2⤵
  PID:12516
- C:\Windows\System\EaEWnde.exe
  C:\Windows\System\EaEWnde.exe
  2⤵
  PID:12548
- C:\Windows\System\HHMCWiq.exe
  C:\Windows\System\HHMCWiq.exe
  2⤵
  PID:12568
- C:\Windows\System\FmjUrmq.exe
  C:\Windows\System\FmjUrmq.exe
  2⤵
  PID:12592
- C:\Windows\System\TagLerv.exe
  C:\Windows\System\TagLerv.exe
  2⤵
  PID:12620
- C:\Windows\System\kzZvODN.exe
  C:\Windows\System\kzZvODN.exe
  2⤵
  PID:12648
- C:\Windows\System\wuwZBCM.exe
  C:\Windows\System\wuwZBCM.exe
  2⤵
  PID:12676
- C:\Windows\System\zMhJKaT.exe
  C:\Windows\System\zMhJKaT.exe
  2⤵
  PID:12724
- C:\Windows\System\oVxCmwa.exe
  C:\Windows\System\oVxCmwa.exe
  2⤵
  PID:12752
- C:\Windows\System\jICwwbr.exe
  C:\Windows\System\jICwwbr.exe
  2⤵
  PID:12780
- C:\Windows\System\zUskvhS.exe
  C:\Windows\System\zUskvhS.exe
  2⤵
  PID:12816
- C:\Windows\System\EPlOEDW.exe
  C:\Windows\System\EPlOEDW.exe
  2⤵
  PID:12836
- C:\Windows\System\yVWobBx.exe
  C:\Windows\System\yVWobBx.exe
  2⤵
  PID:12852
- C:\Windows\System\XVVBcvF.exe
  C:\Windows\System\XVVBcvF.exe
  2⤵
  PID:12880
- C:\Windows\System\lgYQRFg.exe
  C:\Windows\System\lgYQRFg.exe
  2⤵
  PID:12916
- C:\Windows\System\DKbyQvl.exe
  C:\Windows\System\DKbyQvl.exe
  2⤵
  PID:12932
- C:\Windows\System\iqqvOoR.exe
  C:\Windows\System\iqqvOoR.exe
  2⤵
  PID:12956
- C:\Windows\System\BhaTpIW.exe
  C:\Windows\System\BhaTpIW.exe
  2⤵
  PID:12976
- C:\Windows\System\dKoXZeQ.exe
  C:\Windows\System\dKoXZeQ.exe
  2⤵
  PID:13012
- C:\Windows\System\rbaMxbY.exe
  C:\Windows\System\rbaMxbY.exe
  2⤵
  PID:13040
- C:\Windows\System\rmFKAUx.exe
  C:\Windows\System\rmFKAUx.exe
  2⤵
  PID:13064
- C:\Windows\System\EamRClF.exe
  C:\Windows\System\EamRClF.exe
  2⤵
  PID:13092
- C:\Windows\System\QHsXseh.exe
  C:\Windows\System\QHsXseh.exe
  2⤵
  PID:13124
- C:\Windows\System\jJULwLi.exe
  C:\Windows\System\jJULwLi.exe
  2⤵
  PID:13152
- C:\Windows\System\wpEagRO.exe
  C:\Windows\System\wpEagRO.exe
  2⤵
  PID:13176
- C:\Windows\System\RnwthGu.exe
  C:\Windows\System\RnwthGu.exe
  2⤵
  PID:13192
- C:\Windows\System\jlTevOE.exe
  C:\Windows\System\jlTevOE.exe
  2⤵
  PID:13212
- C:\Windows\System\PVizsSb.exe
  C:\Windows\System\PVizsSb.exe
  2⤵
  PID:13236
- C:\Windows\System\JTDGcOr.exe
  C:\Windows\System\JTDGcOr.exe
  2⤵
  PID:13264
- C:\Windows\System\znbFzjN.exe
  C:\Windows\System\znbFzjN.exe
  2⤵
  PID:13296
- C:\Windows\System\GeRcNdE.exe
  C:\Windows\System\GeRcNdE.exe
  2⤵
  PID:11728
- C:\Windows\System\POoLnCP.exe
  C:\Windows\System\POoLnCP.exe
  2⤵
  PID:11488
- C:\Windows\System\cLGmVOW.exe
  C:\Windows\System\cLGmVOW.exe
  2⤵
  PID:12316
- C:\Windows\System\cljTYyM.exe
  C:\Windows\System\cljTYyM.exe
  2⤵
  PID:12344
- C:\Windows\System\kuPSeux.exe
  C:\Windows\System\kuPSeux.exe
  2⤵
  PID:11460
- C:\Windows\System\rchUAUt.exe
  C:\Windows\System\rchUAUt.exe
  2⤵
  PID:12580
- C:\Windows\System\JhWgXCi.exe
  C:\Windows\System\JhWgXCi.exe
  2⤵
  PID:12456
- C:\Windows\System\ajzsOqc.exe
  C:\Windows\System\ajzsOqc.exe
  2⤵
  PID:12556
- C:\Windows\System\TWiQwZP.exe
  C:\Windows\System\TWiQwZP.exe
  2⤵
  PID:12512
- C:\Windows\System\GHZBgtb.exe
  C:\Windows\System\GHZBgtb.exe
  2⤵
  PID:12768
- C:\Windows\System\uBsYVGw.exe
  C:\Windows\System\uBsYVGw.exe
  2⤵
  PID:12872
- C:\Windows\System\KLwatsp.exe
  C:\Windows\System\KLwatsp.exe
  2⤵
  PID:12824
- C:\Windows\System\LlcvoUk.exe
  C:\Windows\System\LlcvoUk.exe
  2⤵
  PID:12848
- C:\Windows\System\TyfJlxx.exe
  C:\Windows\System\TyfJlxx.exe
  2⤵
  PID:12948
- C:\Windows\System\kcWMtNP.exe
  C:\Windows\System\kcWMtNP.exe
  2⤵
  PID:13052
- C:\Windows\System\swpOkUv.exe
  C:\Windows\System\swpOkUv.exe
  2⤵
  PID:13164
- C:\Windows\System\uacaTQp.exe
  C:\Windows\System\uacaTQp.exe
  2⤵
  PID:13184
- C:\Windows\System\JofYzqQ.exe
  C:\Windows\System\JofYzqQ.exe
  2⤵
  PID:12392
- C:\Windows\System\RwzdJxt.exe
  C:\Windows\System\RwzdJxt.exe
  2⤵
  PID:13272
- C:\Windows\System\srMFXxE.exe
  C:\Windows\System\srMFXxE.exe
  2⤵
  PID:12528
- C:\Windows\System\nGhSYoR.exe
  C:\Windows\System\nGhSYoR.exe
  2⤵
  PID:12364
- C:\Windows\System\QpiADqQ.exe
  C:\Windows\System\QpiADqQ.exe
  2⤵
  PID:12892
- C:\Windows\System\QGDGtVT.exe
  C:\Windows\System\QGDGtVT.exe
  2⤵
  PID:12792
- C:\Windows\System\kRNJPhR.exe
  C:\Windows\System\kRNJPhR.exe
  2⤵
  PID:12984
- C:\Windows\System\VEnfYvq.exe
  C:\Windows\System\VEnfYvq.exe
  2⤵
  PID:13260
- C:\Windows\System\NqHfyhp.exe
  C:\Windows\System\NqHfyhp.exe
  2⤵
  PID:13112
- C:\Windows\System\MawkKVw.exe
  C:\Windows\System\MawkKVw.exe
  2⤵
  PID:13328
- C:\Windows\System\YTJmIax.exe
  C:\Windows\System\YTJmIax.exe
  2⤵
  PID:13352
- C:\Windows\System\XIcOSYH.exe
  C:\Windows\System\XIcOSYH.exe
  2⤵
  PID:13380
- C:\Windows\System\clyfAyP.exe
  C:\Windows\System\clyfAyP.exe
  2⤵
  PID:13412
- C:\Windows\System\QTAdxUT.exe
  C:\Windows\System\QTAdxUT.exe
  2⤵
  PID:13432
- C:\Windows\System\CywuWuv.exe
  C:\Windows\System\CywuWuv.exe
  2⤵
  PID:13464
- C:\Windows\System\sRrEsWM.exe
  C:\Windows\System\sRrEsWM.exe
  2⤵
  PID:13492
- C:\Windows\System\FtgEfjK.exe
  C:\Windows\System\FtgEfjK.exe
  2⤵
  PID:13516
- C:\Windows\System\RynaUHe.exe
  C:\Windows\System\RynaUHe.exe
  2⤵
  PID:13548
- C:\Windows\System\jPXelwu.exe
  C:\Windows\System\jPXelwu.exe
  2⤵
  PID:13576
- C:\Windows\System\Nldbclv.exe
  C:\Windows\System\Nldbclv.exe
  2⤵
  PID:13608
- C:\Windows\System\SZqmykZ.exe
  C:\Windows\System\SZqmykZ.exe
  2⤵
  PID:13636
- C:\Windows\System\yHYmjqo.exe
  C:\Windows\System\yHYmjqo.exe
  2⤵
  PID:13660
- C:\Windows\System\SWNFhML.exe
  C:\Windows\System\SWNFhML.exe
  2⤵
  PID:13688
- C:\Windows\System\ZLeljbw.exe
  C:\Windows\System\ZLeljbw.exe
  2⤵
  PID:13716
- C:\Windows\System\FCGnCqw.exe
  C:\Windows\System\FCGnCqw.exe
  2⤵
  PID:13756
- C:\Windows\System\gnFffUY.exe
  C:\Windows\System\gnFffUY.exe
  2⤵
  PID:13788
- C:\Windows\System\JNenGfF.exe
  C:\Windows\System\JNenGfF.exe
  2⤵
  PID:13820
- C:\Windows\System\HaxmdlP.exe
  C:\Windows\System\HaxmdlP.exe
  2⤵
  PID:13848
- C:\Windows\System\FaTdRGt.exe
  C:\Windows\System\FaTdRGt.exe
  2⤵
  PID:13872
- C:\Windows\System\BeOLbem.exe
  C:\Windows\System\BeOLbem.exe
  2⤵
  PID:13900
- C:\Windows\System\yAbUEMx.exe
  C:\Windows\System\yAbUEMx.exe
  2⤵
  PID:13932
- C:\Windows\System\vdEZUOn.exe
  C:\Windows\System\vdEZUOn.exe
  2⤵
  PID:13960
- C:\Windows\System\qQXQcAS.exe
  C:\Windows\System\qQXQcAS.exe
  2⤵
  PID:13984
- C:\Windows\System\FbyZNwX.exe
  C:\Windows\System\FbyZNwX.exe
  2⤵
  PID:14020
- C:\Windows\System\ImqnvFU.exe
  C:\Windows\System\ImqnvFU.exe
  2⤵
  PID:14036
- C:\Windows\System\MEPlTnb.exe
  C:\Windows\System\MEPlTnb.exe
  2⤵
  PID:14068
- C:\Windows\System\cAScoYd.exe
  C:\Windows\System\cAScoYd.exe
  2⤵
  PID:14104
- C:\Windows\System\MFKVIQm.exe
  C:\Windows\System\MFKVIQm.exe
  2⤵
  PID:14132
- C:\Windows\System\JeGUFhA.exe
  C:\Windows\System\JeGUFhA.exe
  2⤵
  PID:14160
- C:\Windows\System\LwBPita.exe
  C:\Windows\System\LwBPita.exe
  2⤵
  PID:14184
- C:\Windows\System\LggDufY.exe
  C:\Windows\System\LggDufY.exe
  2⤵
  PID:14212
- C:\Windows\System\ohqtzOy.exe
  C:\Windows\System\ohqtzOy.exe
  2⤵
  PID:14240
- C:\Windows\System\FgaJChn.exe
  C:\Windows\System\FgaJChn.exe
  2⤵
  PID:14264
- C:\Windows\System\BRITkrW.exe
  C:\Windows\System\BRITkrW.exe
  2⤵
  PID:14300
- C:\Windows\System\yDpHjHi.exe
  C:\Windows\System\yDpHjHi.exe
  2⤵
  PID:14320
- C:\Windows\System\VgEFlVS.exe
  C:\Windows\System\VgEFlVS.exe
  2⤵
  PID:12796
- C:\Windows\System\HkrroOw.exe
  C:\Windows\System\HkrroOw.exe
  2⤵
  PID:12052
- C:\Windows\System\TCnpVUK.exe
  C:\Windows\System\TCnpVUK.exe
  2⤵
  PID:13220
- C:\Windows\System\jgPNkfM.exe
  C:\Windows\System\jgPNkfM.exe
  2⤵
  PID:12776
- C:\Windows\System\sSxSCbb.exe
  C:\Windows\System\sSxSCbb.exe
  2⤵
  PID:13368
- C:\Windows\System\inPMtHe.exe
  C:\Windows\System\inPMtHe.exe
  2⤵
  PID:13360
- C:\Windows\System\AlVlbbo.exe
  C:\Windows\System\AlVlbbo.exe
  2⤵
  PID:13584
- C:\Windows\System\GYEjJUw.exe
  C:\Windows\System\GYEjJUw.exe
  2⤵
  PID:13444
- C:\Windows\System\sZCXBWC.exe
  C:\Windows\System\sZCXBWC.exe
  2⤵
  PID:13488
- C:\Windows\System\MKmvAgq.exe
  C:\Windows\System\MKmvAgq.exe
  2⤵
  PID:13596
- C:\Windows\System\rWKrLMP.exe
  C:\Windows\System\rWKrLMP.exe
  2⤵
  PID:13776
- C:\Windows\System\TiXcHfP.exe
  C:\Windows\System\TiXcHfP.exe
  2⤵
  PID:13896
- C:\Windows\System\xeCPSiN.exe
  C:\Windows\System\xeCPSiN.exe
  2⤵
  PID:13836
- C:\Windows\System\ZimFREf.exe
  C:\Windows\System\ZimFREf.exe
  2⤵
  PID:13972
- C:\Windows\System\rOjoqJN.exe
  C:\Windows\System\rOjoqJN.exe
  2⤵
  PID:14156
- C:\Windows\System\WSkjhmz.exe
  C:\Windows\System\WSkjhmz.exe
  2⤵
  PID:14236
- C:\Windows\System\yOzpwLu.exe
  C:\Windows\System\yOzpwLu.exe
  2⤵
  PID:14124
- C:\Windows\System\jMNQzIm.exe
  C:\Windows\System\jMNQzIm.exe
  2⤵
  PID:13248
- C:\Windows\System\WTAMwmJ.exe
  C:\Windows\System\WTAMwmJ.exe
  2⤵
  PID:12908
- C:\Windows\System\ppeeLDl.exe
  C:\Windows\System\ppeeLDl.exe
  2⤵
  PID:14292
- C:\Windows\System\VlqHmbc.exe
  C:\Windows\System\VlqHmbc.exe
  2⤵
  PID:14316
- C:\Windows\System\KFhSJgo.exe
  C:\Windows\System\KFhSJgo.exe
  2⤵
  PID:11992
- C:\Windows\System\UENRCPS.exe
  C:\Windows\System\UENRCPS.exe
  2⤵
  PID:13968
- C:\Windows\System\GiSMZJO.exe
  C:\Windows\System\GiSMZJO.exe
  2⤵
  PID:13980
- C:\Windows\System\SYnrjJQ.exe
  C:\Windows\System\SYnrjJQ.exe
  2⤵
  PID:13624
- C:\Windows\System\atZddXu.exe
  C:\Windows\System\atZddXu.exe
  2⤵
  PID:14028
- C:\Windows\System\oEOCWNB.exe
  C:\Windows\System\oEOCWNB.exe
  2⤵
  PID:13920
- C:\Windows\System\nqgcsIB.exe
  C:\Windows\System\nqgcsIB.exe
  2⤵
  PID:13140
- C:\Windows\System\jcYlFcX.exe
  C:\Windows\System\jcYlFcX.exe
  2⤵
  PID:13424
- C:\Windows\System\gnaWKJN.exe
  C:\Windows\System\gnaWKJN.exe
  2⤵
  PID:14052
- C:\Windows\System\KoAixWp.exe
  C:\Windows\System\KoAixWp.exe
  2⤵
  PID:14360
- C:\Windows\System\CFrZIiB.exe
  C:\Windows\System\CFrZIiB.exe
  2⤵
  PID:14396
- C:\Windows\System\iQjyNgY.exe
  C:\Windows\System\iQjyNgY.exe
  2⤵
  PID:14432
- C:\Windows\System\tFFOrTc.exe
  C:\Windows\System\tFFOrTc.exe
  2⤵
  PID:14448
- C:\Windows\System\aNhhLqz.exe
  C:\Windows\System\aNhhLqz.exe
  2⤵
  PID:14476
- C:\Windows\System\CPKeGID.exe
  C:\Windows\System\CPKeGID.exe
  2⤵
  PID:14508
- C:\Windows\System\yGmzzyU.exe
  C:\Windows\System\yGmzzyU.exe
  2⤵
  PID:14540
- C:\Windows\System\PifddPy.exe
  C:\Windows\System\PifddPy.exe
  2⤵
  PID:14564
- C:\Windows\System\UFXAkMH.exe
  C:\Windows\System\UFXAkMH.exe
  2⤵
  PID:14600
- C:\Windows\System\uFUWNwG.exe
  C:\Windows\System\uFUWNwG.exe
  2⤵
  PID:14624
- C:\Windows\System\hFWVapd.exe
  C:\Windows\System\hFWVapd.exe
  2⤵
  PID:14652
- C:\Windows\System\ayvZtXG.exe
  C:\Windows\System\ayvZtXG.exe
  2⤵
  PID:14676
- C:\Windows\System\tpHavxm.exe
  C:\Windows\System\tpHavxm.exe
  2⤵
  PID:14712
- C:\Windows\System\AJMIYey.exe
  C:\Windows\System\AJMIYey.exe
  2⤵
  PID:14736
- C:\Windows\System\GhxoJej.exe
  C:\Windows\System\GhxoJej.exe
  2⤵
  PID:14760
- C:\Windows\System\gboKPnq.exe
  C:\Windows\System\gboKPnq.exe
  2⤵
  PID:14796
- C:\Windows\System\DeLjZyw.exe
  C:\Windows\System\DeLjZyw.exe
  2⤵
  PID:14816
- C:\Windows\System\cYmqqmO.exe
  C:\Windows\System\cYmqqmO.exe
  2⤵
  PID:14856
- C:\Windows\System\elMqlWf.exe
  C:\Windows\System\elMqlWf.exe
  2⤵
  PID:14880
- C:\Windows\System\LWohbEH.exe
  C:\Windows\System\LWohbEH.exe
  2⤵
  PID:14908
- C:\Windows\System\YCTkHZj.exe
  C:\Windows\System\YCTkHZj.exe
  2⤵
  PID:14944
- C:\Windows\System\qLNhaGw.exe
  C:\Windows\System\qLNhaGw.exe
  2⤵
  PID:14976
- C:\Windows\System\OAhTsSj.exe
  C:\Windows\System\OAhTsSj.exe
  2⤵
  PID:15004
- C:\Windows\System\lUPOgmq.exe
  C:\Windows\System\lUPOgmq.exe
  2⤵
  PID:15040
- C:\Windows\System\fPjpUhZ.exe
  C:\Windows\System\fPjpUhZ.exe
  2⤵
  PID:15060
- C:\Windows\System\fMCEwsn.exe
  C:\Windows\System\fMCEwsn.exe
  2⤵
  PID:15076
- C:\Windows\System\nzxySIc.exe
  C:\Windows\System\nzxySIc.exe
  2⤵
  PID:15108
- C:\Windows\System\QjagpQF.exe
  C:\Windows\System\QjagpQF.exe
  2⤵
  PID:15136
- C:\Windows\System\SimokjI.exe
  C:\Windows\System\SimokjI.exe
  2⤵
  PID:15164
- C:\Windows\System\MRKiAnt.exe
  C:\Windows\System\MRKiAnt.exe
  2⤵
  PID:15188
- C:\Windows\System\nCEIqdw.exe
  C:\Windows\System\nCEIqdw.exe
  2⤵
  PID:15220
- C:\Windows\System\tTWxUwQ.exe
  C:\Windows\System\tTWxUwQ.exe
  2⤵
  PID:15248
- C:\Windows\System\lYHzwNM.exe
  C:\Windows\System\lYHzwNM.exe
  2⤵
  PID:15268
- C:\Windows\System\wyTvAaP.exe
  C:\Windows\System\wyTvAaP.exe
  2⤵
  PID:15296
- C:\Windows\System\pOYoIXt.exe
  C:\Windows\System\pOYoIXt.exe
  2⤵
  PID:15324
- C:\Windows\System\NkixlSY.exe
  C:\Windows\System\NkixlSY.exe
  2⤵
  PID:15348
- C:\Windows\System\dKdfWlK.exe
  C:\Windows\System\dKdfWlK.exe
  2⤵
  PID:14100
- C:\Windows\System\xFjTgvU.exe
  C:\Windows\System\xFjTgvU.exe
  2⤵
  PID:13540
- C:\Windows\System\LLbckDG.exe
  C:\Windows\System\LLbckDG.exe
  2⤵
  PID:14548
- C:\Windows\System\MwApElH.exe
  C:\Windows\System\MwApElH.exe
  2⤵
  PID:14440
- C:\Windows\System\dugYvkm.exe
  C:\Windows\System\dugYvkm.exe
  2⤵
  PID:14488
- C:\Windows\System\fgDnrRK.exe
  C:\Windows\System\fgDnrRK.exe
  2⤵
  PID:14588
- C:\Windows\System\YrSZlJf.exe
  C:\Windows\System\YrSZlJf.exe
  2⤵
  PID:14636
- C:\Windows\System\SadHCJn.exe
  C:\Windows\System\SadHCJn.exe
  2⤵
  PID:14772
- C:\Windows\System\mZhmDCv.exe
  C:\Windows\System\mZhmDCv.exe
  2⤵
  PID:11596
- C:\Windows\System\YLenRZa.exe
  C:\Windows\System\YLenRZa.exe
  2⤵
  PID:14724
- C:\Windows\System\ieYnhjn.exe
  C:\Windows\System\ieYnhjn.exe
  2⤵
  PID:14752
- C:\Windows\System\QMLTXUM.exe
  C:\Windows\System\QMLTXUM.exe
  2⤵
  PID:14928
- C:\Windows\System\IZlJcdB.exe
  C:\Windows\System\IZlJcdB.exe
  2⤵
  PID:15024
- C:\Windows\System\ZPEhrdm.exe
  C:\Windows\System\ZPEhrdm.exe
  2⤵
  PID:15048
- C:\Windows\System\deqFmGx.exe
  C:\Windows\System\deqFmGx.exe
  2⤵
  PID:14984
- C:\Windows\System\oVjfonn.exe
  C:\Windows\System\oVjfonn.exe
  2⤵
  PID:15120
- C:\Windows\System\BwLHpmG.exe
  C:\Windows\System\BwLHpmG.exe
  2⤵
  PID:15072
- C:\Windows\System\hsPiTti.exe
  C:\Windows\System\hsPiTti.exe
  2⤵
  PID:14836
- C:\Windows\System\beiyEWA.exe
  C:\Windows\System\beiyEWA.exe
  2⤵
  PID:14872
- C:\Windows\System\lwzrxzH.exe
  C:\Windows\System\lwzrxzH.exe
  2⤵
  PID:15156
- C:\Windows\System\hJJTOrG.exe
  C:\Windows\System\hJJTOrG.exe
  2⤵
  PID:15264
- C:\Windows\System\zLtRzWZ.exe
  C:\Windows\System\zLtRzWZ.exe
  2⤵
  PID:14620
- C:\Windows\System\sNooPyG.exe
  C:\Windows\System\sNooPyG.exe
  2⤵
  PID:15228
- C:\Windows\System\fCoCTOb.exe
  C:\Windows\System\fCoCTOb.exe
  2⤵
  PID:15244
- C:\Windows\System\xYFGdGf.exe
  C:\Windows\System\xYFGdGf.exe
  2⤵
  PID:13592
- C:\Windows\System\mteQVOk.exe
  C:\Windows\System\mteQVOk.exe
  2⤵
  PID:15376
- C:\Windows\System\hevzZqk.exe
  C:\Windows\System\hevzZqk.exe
  2⤵
  PID:15404
- C:\Windows\System\QxphWAK.exe
  C:\Windows\System\QxphWAK.exe
  2⤵
  PID:15440
- C:\Windows\System\etWxiAW.exe
  C:\Windows\System\etWxiAW.exe
  2⤵
  PID:15460
- C:\Windows\System\fWHUlUN.exe
  C:\Windows\System\fWHUlUN.exe
  2⤵
  PID:15492
- C:\Windows\System\VQfKYtk.exe
  C:\Windows\System\VQfKYtk.exe
  2⤵
  PID:15520
- C:\Windows\System\DDdItGX.exe
  C:\Windows\System\DDdItGX.exe
  2⤵
  PID:15544
- C:\Windows\System\GtrHroE.exe
  C:\Windows\System\GtrHroE.exe
  2⤵
  PID:15564
- C:\Windows\System\vShYbsT.exe
  C:\Windows\System\vShYbsT.exe
  2⤵
  PID:15584
- C:\Windows\System\KzwBbvo.exe
  C:\Windows\System\KzwBbvo.exe
  2⤵
  PID:15616
- C:\Windows\System\cTFTUbR.exe
  C:\Windows\System\cTFTUbR.exe
  2⤵
  PID:15644
- C:\Windows\System\ojkQjUT.exe
  C:\Windows\System\ojkQjUT.exe
  2⤵
  PID:15664
- C:\Windows\System\Nsbeuao.exe
  C:\Windows\System\Nsbeuao.exe
  2⤵
  PID:15700
- C:\Windows\System\lOOuzZp.exe
  C:\Windows\System\lOOuzZp.exe
  2⤵
  PID:15732
- C:\Windows\System\UealOdY.exe
  C:\Windows\System\UealOdY.exe
  2⤵
  PID:15760
- C:\Windows\System\XbQcTeG.exe
  C:\Windows\System\XbQcTeG.exe
  2⤵
  PID:15780
- C:\Windows\System\jzQAhiu.exe
  C:\Windows\System\jzQAhiu.exe
  2⤵
  PID:15812
- C:\Windows\System\mUMvsvo.exe
  C:\Windows\System\mUMvsvo.exe
  2⤵
  PID:15840
- C:\Windows\System\EszQLTj.exe
  C:\Windows\System\EszQLTj.exe
  2⤵
  PID:15860
- C:\Windows\System\YIojPjs.exe
  C:\Windows\System\YIojPjs.exe
  2⤵
  PID:15892
- C:\Windows\System\pSwDkkE.exe
  C:\Windows\System\pSwDkkE.exe
  2⤵
  PID:15916
- C:\Windows\System\nOkUDHw.exe
  C:\Windows\System\nOkUDHw.exe
  2⤵
  PID:15944
- C:\Windows\System\HVQKAGf.exe
  C:\Windows\System\HVQKAGf.exe
  2⤵
  PID:15972
- C:\Windows\System\YzenLqS.exe
  C:\Windows\System\YzenLqS.exe
  2⤵
  PID:16004
- C:\Windows\System\qhBtaLt.exe
  C:\Windows\System\qhBtaLt.exe
  2⤵
  PID:16020
- C:\Windows\System\yFsyoPk.exe
  C:\Windows\System\yFsyoPk.exe
  2⤵
  PID:16048
- C:\Windows\System\yNqIzwz.exe
  C:\Windows\System\yNqIzwz.exe
  2⤵
  PID:16076
- C:\Windows\System\uNMZkKz.exe
  C:\Windows\System\uNMZkKz.exe
  2⤵
  PID:16104
- C:\Windows\System\JtlmdOv.exe
  C:\Windows\System\JtlmdOv.exe
  2⤵
  PID:16120
- C:\Windows\System\qyJCMNJ.exe
  C:\Windows\System\qyJCMNJ.exe
  2⤵
  PID:16152
- C:\Windows\System\CzBKyBE.exe
  C:\Windows\System\CzBKyBE.exe
  2⤵
  PID:16176
- C:\Windows\System\HcvHnit.exe
  C:\Windows\System\HcvHnit.exe
  2⤵
  PID:16200
- C:\Windows\System\xBFsTXG.exe
  C:\Windows\System\xBFsTXG.exe
  2⤵
  PID:16228
- C:\Windows\System\ZyNFaiv.exe
  C:\Windows\System\ZyNFaiv.exe
  2⤵
  PID:16256
- C:\Windows\System\axjYaDM.exe
  C:\Windows\System\axjYaDM.exe
  2⤵
  PID:16280
- C:\Windows\System\NIYlOTt.exe
  C:\Windows\System\NIYlOTt.exe
  2⤵
  PID:16304
- C:\Windows\System\wslBsrO.exe
  C:\Windows\System\wslBsrO.exe
  2⤵
  PID:16336
- C:\Windows\System\TmJNuOD.exe
  C:\Windows\System\TmJNuOD.exe
  2⤵
  PID:16364
- C:\Windows\System\SZgVuBy.exe
  C:\Windows\System\SZgVuBy.exe
  2⤵
  PID:13772
- C:\Windows\System\DeDuUoI.exe
  C:\Windows\System\DeDuUoI.exe
  2⤵
  PID:15092
- C:\Windows\System\KLlIeLE.exe
  C:\Windows\System\KLlIeLE.exe
  2⤵
  PID:15480
- C:\Windows\System\ojZDitm.exe
  C:\Windows\System\ojZDitm.exe
  2⤵
  PID:15472
- C:\Windows\System\rCqFjyk.exe
  C:\Windows\System\rCqFjyk.exe
  2⤵
  PID:15560
- C:\Windows\System\bdlBRew.exe
  C:\Windows\System\bdlBRew.exe
  2⤵
  PID:15636
- C:\Windows\System\TbtMawh.exe
  C:\Windows\System\TbtMawh.exe
  2⤵
  PID:15624
- C:\Windows\System\kXNKwsj.exe
  C:\Windows\System\kXNKwsj.exe
  2⤵
  PID:15676
- C:\Windows\System\WGjnBDp.exe
  C:\Windows\System\WGjnBDp.exe
  2⤵
  PID:15884
- C:\Windows\System\gRDfTqW.exe
  C:\Windows\System\gRDfTqW.exe
  2⤵
  PID:15836
- C:\Windows\System\ROaougU.exe
  C:\Windows\System\ROaougU.exe
  2⤵
  PID:15984
- C:\Windows\System\myhIEyn.exe
  C:\Windows\System\myhIEyn.exe
  2⤵
  PID:15988
- C:\Windows\System\wUFFMEB.exe
  C:\Windows\System\wUFFMEB.exe
  2⤵
  PID:16036
- C:\Windows\System\BSoooGx.exe
  C:\Windows\System\BSoooGx.exe
  2⤵
  PID:16060
- C:\Windows\System\qTMJlDM.exe
  C:\Windows\System\qTMJlDM.exe
  2⤵
  PID:16116
- C:\Windows\System\kMeNDNT.exe
  C:\Windows\System\kMeNDNT.exe
  2⤵
  PID:16216
- C:\Windows\System\bKOXQsp.exe
  C:\Windows\System\bKOXQsp.exe
  2⤵
  PID:13408
- C:\Windows\System\GaKQDBl.exe
  C:\Windows\System\GaKQDBl.exe
  2⤵
  PID:15456
- C:\Windows\System\uVmaluT.exe
  C:\Windows\System\uVmaluT.exe
  2⤵
  PID:15152
- C:\Windows\System\hfQaqUm.exe
  C:\Windows\System\hfQaqUm.exe
  2⤵
  PID:16324
- C:\Windows\System\waPCcnS.exe
  C:\Windows\System\waPCcnS.exe
  2⤵
  PID:15580
- C:\Windows\System\LActRay.exe
  C:\Windows\System\LActRay.exe
  2⤵
  PID:15832
- C:\Windows\System\ffMLGJd.exe
  C:\Windows\System\ffMLGJd.exe
  2⤵
  PID:15748
- C:\Windows\System\kPDApmn.exe
  C:\Windows\System\kPDApmn.exe
  2⤵
  PID:16064
- C:\Windows\System\LvgkukH.exe
  C:\Windows\System\LvgkukH.exe
  2⤵
  PID:16188
- C:\Windows\System\BcYLIca.exe
  C:\Windows\System\BcYLIca.exe
  2⤵
  PID:16408
- C:\Windows\System\SxCYocG.exe
  C:\Windows\System\SxCYocG.exe
  2⤵
  PID:16436
- C:\Windows\System\GxevBKO.exe
  C:\Windows\System\GxevBKO.exe
  2⤵
  PID:16464
- C:\Windows\System\FmVcdHl.exe
  C:\Windows\System\FmVcdHl.exe
  2⤵
  PID:16496
- C:\Windows\System\yBBHhpf.exe
  C:\Windows\System\yBBHhpf.exe
  2⤵
  PID:16528
- C:\Windows\System\fCjsmwa.exe
  C:\Windows\System\fCjsmwa.exe
  2⤵
  PID:16552
- C:\Windows\System\ZlFhVmt.exe
  C:\Windows\System\ZlFhVmt.exe
  2⤵
  PID:16580
- C:\Windows\System\DTaWbgg.exe
  C:\Windows\System\DTaWbgg.exe
  2⤵
  PID:16600
- C:\Windows\System\NqZWTcC.exe
  C:\Windows\System\NqZWTcC.exe
  2⤵
  PID:16620
- C:\Windows\System\lkeJSZX.exe
  C:\Windows\System\lkeJSZX.exe
  2⤵
  PID:16640
- C:\Windows\System\hPSIkmJ.exe
  C:\Windows\System\hPSIkmJ.exe
  2⤵
  PID:16672
- C:\Windows\System\eLsldKQ.exe
  C:\Windows\System\eLsldKQ.exe
  2⤵
  PID:16700
- C:\Windows\System\AAxrxXv.exe
  C:\Windows\System\AAxrxXv.exe
  2⤵
  PID:16728
- C:\Windows\System\iABnfzE.exe
  C:\Windows\System\iABnfzE.exe
  2⤵
  PID:16752
- C:\Windows\System\dJLjYUB.exe
  C:\Windows\System\dJLjYUB.exe
  2⤵
  PID:16784
- C:\Windows\System\SiIOXwa.exe
  C:\Windows\System\SiIOXwa.exe
  2⤵
  PID:16824
- C:\Windows\System\wlYkTBL.exe
  C:\Windows\System\wlYkTBL.exe
  2⤵
  PID:16852
- C:\Windows\System\XvNjpCD.exe
  C:\Windows\System\XvNjpCD.exe
  2⤵
  PID:16880
- C:\Windows\System\OSjqnSf.exe
  C:\Windows\System\OSjqnSf.exe
  2⤵
  PID:16916
- C:\Windows\System\oHsVqPw.exe
  C:\Windows\System\oHsVqPw.exe
  2⤵
  PID:16940
- C:\Windows\System\sMRnKIP.exe
  C:\Windows\System\sMRnKIP.exe
  2⤵
  PID:17156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AABoQTN.exe

Filesize
1.4MB

MD5
8cc2ba6574b8e3ee0a1a78eec31db3f0

SHA1
25ea87132394c38bb07d68ce7109e01c3e2d3267

SHA256
9691092d1016ac7ed7768d0e5d567a851def6de69a9fb0808b5e0630aac072a7

SHA512
d6d82340f274bf7264bb83a79722ee51d294033cadaf49f4ac328c4360821c77867d4ad1f4e325c71f72eafd9a86c71123d6f8c8fd23ab49892083d1b9dce230

Download Submit
C:\Windows\System\AjBNuWY.exe

Filesize
1.4MB

MD5
dfc077b306cc3069f20f851393aecf8f

SHA1
71b350906fc9ab386f7ade64e108724bddf7191d

SHA256
ee152ae2cf24b57318bbcb02cd9ca3bf8dfc7fd914c5035d25ab408461413034

SHA512
c947bc9b52b2bdee85dc9d980827377cb56e93665d1048b1a8001165248c87207b5e3167d7d90b8ae62497fa9ac8027a5868ea26e62cbf5f3f144f820d6c44fa

Download Submit
C:\Windows\System\GIOTgBL.exe

Filesize
1.4MB

MD5
cfc728b8cb05483b6b3e68bcfe8a87cd

SHA1
73e937ebda4a2ff62ead1416dab0850de1ff86b9

SHA256
a57a68955112e7a9ebae8eebc639652eb5775cf050ef3c98f9c50cc30f34301b

SHA512
58ebf74cbb195d3561a66d7324b4cbbb4ed32bd42b1af58762a22deacf4f5f899134e2b374dc050cf584b854c9a777d9e5faaa00a6ebbd11a64169d5c9ce41d7

Download Submit
C:\Windows\System\HFLURYi.exe

Filesize
1.4MB

MD5
ead0d40a60b9b7e199d4f7e40fd75817

SHA1
6e12ec9d9304d49fb599739a13e59273c55d74ba

SHA256
e9fd61f6d9342406b2a3e738c218679cd7f8035b52ce0507634fc397b0f07a08

SHA512
0371f1604884f8e1dda43159788cc78d4eaee5a92584a20f311029a2d5dcc8b159d9395c892baf9333444d6e088f22865a8b95e6b50b2197ce61519d50283dc6

Download Submit
C:\Windows\System\IwQucTX.exe

Filesize
1.4MB

MD5
494043bbce83d09baebc5535a8e1fd6b

SHA1
32b279830a493e258d8841f1fa430639086c2fb2

SHA256
a8b154806ad2244d11b9b269a6b408ff19edb53d5fdf2acbcffcbd55deef4710

SHA512
4543afb5c51096839d6cf1ed24a449b9de95e81d495ad9a6318ab63be7c4583cd7b3f838f276344db1ec52faabca2b23f375f2d1d3ffe54275983b360cd2f81c

Download Submit
C:\Windows\System\JCGnXXT.exe

Filesize
1.4MB

MD5
24898f2abc458756c89ba69cecbbb8f0

SHA1
38be1725b731ba6fe2ea68d6aeb782e289908eb3

SHA256
6383182ac5d293cc5fbbea581f69ad964de7e479e95af8479bc5f9ea5d3c88e1

SHA512
5cdeb382fd567252bf11ff1cf7da4dceb145d8a128c10638c8a4f7d0f0c404cac4299c8d82a0edc963782e1ac7c856801fd1e4af9766f0be8f80dc72f86a7249

Download Submit
C:\Windows\System\KBuBVWB.exe

Filesize
1.4MB

MD5
a354370488c8c01f910c50eed9249568

SHA1
dedf70119f101648cb30e21dfd75144c7344291b

SHA256
c3feb688eef64591762f35280c5670c6831d3eded090c766a1b2cd85f6e05b49

SHA512
121564e0007f77d150a3db88612e6011523d4ee011f0678bf1d82d5ab10eafb027dc555b7f1ca7a3d9ce3310134afd8146a54c7812908a6260a23bec588bb6da

Download Submit
C:\Windows\System\LDIWFyn.exe

Filesize
1.4MB

MD5
27af2f1c65d9985721dc05126addd9ad

SHA1
6cc7df55eaa0453373ffcb1ebd92e0cb5ba02fee

SHA256
8d3336f793760b3f91292ceda68904e1a4feb5a5a7b70df0b5ab28753449cf67

SHA512
a4299538a049b7755e0ca524b8138d98fa4f7df7b99493ac144ce8b780d4cff93dd90264da653b971dc90b076367596f41ccf6194447e11aef157836ad07e90f

Download Submit
C:\Windows\System\LGwEOLf.exe

Filesize
1.4MB

MD5
3f74c0e91c04c8d6fcd2181b2d832f39

SHA1
9b4c18ffe23536b7e0185d46573418ee366e3a81

SHA256
13187fe3df520f8fd29cc07b360c9bb8c65ce85ae793857af39404c6a3537df2

SHA512
d1a81e58ecc404017e0070cef3150de9c1c3c6bed03cefb5cc6c8a1c7de44daacc75fc6b35d32285009e1af2f6f237055e1e6b4e31e6e8ef5e20f147f3d25679

Download Submit
C:\Windows\System\LtjEBsz.exe

Filesize
1.4MB

MD5
b9dc19b957225d935146faecbb466b24

SHA1
ab0769ff071909787865b4543821671d9d1373bc

SHA256
a21d2d2ff31579f00de4cfd81765f46f04ae1f5f542947e077256d7af4f5b21f

SHA512
61d06943e24bfb363a5692ddafe4f1d07d502a486fcf7bc9a34e1a4d8b86a2840c11b89a0dbbfdef708d7add97c4248aa89aa2400ed2910f0fe225258b221493

Download Submit
C:\Windows\System\MiEwtIv.exe

Filesize
1.4MB

MD5
55d5d38a3c9f276d84915974252dd31b

SHA1
d6263cae91891f6ea483a76b02718addcbd89b77

SHA256
49093c77a5e3998807a86220723ce2a7aec2b72debdefdb7459c5d2676ba829c

SHA512
04b8d7a959b282c62a40e4bdd3fb659b6868b58a59eacc79cf770fb6979711fd54ebbbba3af995b352bd50cbbbb2dd9152bc0f26e28f81718a70f2bc8c0daffc

Download Submit
C:\Windows\System\PKAhjPb.exe

Filesize
1.4MB

MD5
6b10abb8cb53beff8d1dd6096d57ca80

SHA1
fe2b60622c776b297b42437e022156b30abd11d2

SHA256
7238b3198cb098087d519fe5bce2bb49e2e9d47b448073328232e380cb162524

SHA512
c73685a93a3aee1cae566a85b92f5579078fe0d06f4e39737f653e30a9c207824fcdcd58632995e7bb8b91a7e547f5619f10d0275c0e5ac4e01c9cad744f3940

Download Submit
C:\Windows\System\PPDyVTB.exe

Filesize
1.4MB

MD5
7ff3b20a114ea32d935f95e4d8e8608c

SHA1
bcba52fe5c8c0173d73e305cac52c5f468136f97

SHA256
4da7933438ae53bd2c390a07e8b823e6f1fcd11f69210a00e50a5f522a70fb35

SHA512
03a9e48d3d84200bfa21eda0e5704d8372c6ebeddbefa7540ce3ff26f781a632d2fdd64cad518a6467de3efc9e6d0f75772f487b5461d04ee4b9617a8d07c5b0

Download Submit
C:\Windows\System\PZSipQk.exe

Filesize
1.4MB

MD5
a319435da88a147bd85ef91a735c08c8

SHA1
6b4da4fbb92f3780094b7bfa9fc46a1a5d4bb90e

SHA256
5a058d432c6a3e50e16a33162f6408eed6fb51a69b33a93ef3322d7a995712b2

SHA512
13799a8fca96f47c20650416180784d53f82f3fd9b00b4fb50602cf28383239a64459cd4565c618f56b631f2bea413986bc254910c979685045140ba30a44047

Download Submit
C:\Windows\System\QGXpvpx.exe

Filesize
1.4MB

MD5
29dad8298373574e9154a74d866c41f1

SHA1
dc473f72957e580d392b5d62f4153077afbef6fa

SHA256
b5e954cf5c66e338e281021d657bcfc17e743df12b2ebc5ec7c76d7789a4407e

SHA512
e9b8eb6e197d71cb0c823ed712bf4c02a03b3b7fd33ef727a374ca1dea70eb65265934c7dff791c9d054fb894bb2a8834100d5676e63b457fdd6dd0030e3db48

Download Submit
C:\Windows\System\QlsxoKN.exe

Filesize
1.4MB

MD5
3c1064e63ea7716a64af98a0e974ca34

SHA1
98467772dd651be52a024fd0bff9879ab4e0823a

SHA256
ad0e94035d5845aef48d23e97aa88803452032b22cefb37214e54b0ebab224fb

SHA512
0301e52c330c113f0d414cdaa0f87b07f666dbb1641831f93f7bbdf72df8b388cf208d4a93c610bb812a94a16a145c01a26d99386a6e3760a7571a597906c97d

Download Submit
C:\Windows\System\TCXODer.exe

Filesize
1.4MB

MD5
f806f60075a6488ce9f26c2367bc153f

SHA1
3ee86dfcb7b8c0f447a47faaf080d24d62f24b79

SHA256
6e635c088e83309058d13787ade7596dc1ae3aecc106afb9c763d9940c9ae4c7

SHA512
22d3efa297f79cfb63edddf8fad274b1e892afccac7bceef709240b294298b08d1c2d327860e0a218414f7154196b5c2043f12f1af335bb19ffec412cfb19206

Download Submit
C:\Windows\System\TsgFHQw.exe

Filesize
1.4MB

MD5
fafd6cd1fb282c0a5d22b444521a077b

SHA1
d1a9d4fc2bfec7a6ccb5e1b3558d7cc77554e5c8

SHA256
bb4b29c5ef456da1787d1bf83e98c0cbf0b610eb6d1f5634409293026e46b777

SHA512
02835f65542034a8a4d2349a5b3902c8daa9d8e78c369a3ed4f61b7e841b3f48824690b7bb953b3301fa62a27c33de8b4a3bdd65be553719326ee67c5d2ccf9c

Download Submit
C:\Windows\System\UXWWqRn.exe

Filesize
1.4MB

MD5
15c3de7521358bdb5e40f76212a6cb13

SHA1
4749efd5a67e064d0c6749a2ca9f250151cd0f01

SHA256
ec46a00eee8069721ed8d5b773389854edd4d912bee782286b70b1a12f7961b7

SHA512
0295ba5e8755bb2a28e77918f99c8c445f1794a1ea1e664cd87f7ace03a88f3cef3688c2283f8efc1d03d65ddd118940cf5d7b9ce10bbf178ec2c257623f7313

Download Submit
C:\Windows\System\VTxRxes.exe

Filesize
1.4MB

MD5
10fc092254dd2dcdc0bbece733a9bd50

SHA1
ef60168560eb64658f7b2b92e094a93ea59e0baa

SHA256
3d9a9ffaada8e33613ab003f88c351612e6e4aac568bc2b8bc36a8d294315443

SHA512
adeca85cf0687e4815b21bb8621876b9d13a3d4148a4b7234bbdda86a29c08b32ab08b7201d458e46ee667e8ab9eb7435d870b9c9bcfa74d97dd1ddc78734000

Download Submit
C:\Windows\System\aHBQroF.exe

Filesize
1.4MB

MD5
ebd90f833002e3c2af2d74f24606669c

SHA1
ec5946727f20ab44a09dc6493fd5500fe8de8396

SHA256
8a68969aa4caf9c14d1c7bed68a8bb2ca74bd4288b60e09c9f2dedd048daeb6e

SHA512
bd99b1041eb509388ddadb33ecb52ee152a5007ad589b2fd708b3563e2361ac9eded3ea77aa54d03b54a7dda724a0be594128a50efb32ec92d84e3be17ec98d0

Download Submit
C:\Windows\System\aRevAda.exe

Filesize
1.4MB

MD5
51da90d3d5e62da5db25c85097f5cbf9

SHA1
271d2b9177ffb6a40fee042b7cc3f4afcfe508d6

SHA256
ba9ca6ec0cf0c57cacc449b664680bd98db48dc8be8399af9ed8030f54e9ee2a

SHA512
dedc705d7b023abae0bd1dffd39a3af27508e7053efe0f5f5fe8f1f8d1475d63dfbf8df9fbcbfa8f043066f907cb5bcd490c060e8f7d8adfa9933d78439e3c41

Download Submit
C:\Windows\System\cJdrhFg.exe

Filesize
1.4MB

MD5
70a1a86b767c20fe06975c3287f4dde3

SHA1
9130a6d7e69d3ebfd644b1b0058405e93deeef1f

SHA256
ca484d37345068f9b4445300e092b688f44f75ea27a1272cce7658f2af73919b

SHA512
ff3aad56f1842158da85f3eea19de0c726838fc90bf06ed40642796c1db9b80e2708cd35fe9f946134fe0e1ee5e711b65168df3cc39ceb8f4acc8532320137df

Download Submit
C:\Windows\System\cVvMGlk.exe

Filesize
1.4MB

MD5
e08e647629d1b3f4df4092afe16beaf2

SHA1
3c69d1147f27044da8b37e944e82f2d72fd50e1e

SHA256
a5fe3a533ab59484803820c1441751d31a05c287b4e0b817831b19b425d177d7

SHA512
9c82ddbcba6996b2db258dc5157fcf3370097862d1cc426d5c3bdf36103426de7eba6b64e8c6582a09b0ec70e79addeedbbd7cd1da2558d208a047a1106e65de

Download Submit
C:\Windows\System\daZcYTF.exe

Filesize
1.4MB

MD5
51ab6c611bc30497a70457d80fcb5743

SHA1
a9fbe131f876062ce46e35cd2b695f15fc30f05e

SHA256
0789f289460d5974f9ad81d736fe952fc19d46763c17dcf1e16346b3a2f270f7

SHA512
0e6c24d10313571bc47a181ac76ec99f6d486da32dad1bac9205d38a96d027044b3fed4557f5ab9b9aec23fe9f8e18e40180b2bc96596a43ffb39042d5c53677

Download Submit
C:\Windows\System\fUwTLcA.exe

Filesize
1.4MB

MD5
05c5949ef53e27d09de704a1f4eff06b

SHA1
a2b8ffebec587e6c917d9c2ef7b25011ee729ec6

SHA256
0fa883bbeb5bec2155c2f127a9a038d6c67ddeac592bc1381f60b943c1360c4c

SHA512
f9b08f5c0af5c2c285c28028cbc431c31647e655a90fa9845e4e3153bba190976ed78e8de6a7adaca780c7ec0985c0754dd2778438cc25d52d742cfc7e4f0030

Download Submit
C:\Windows\System\hfToACz.exe

Filesize
1.4MB

MD5
9f5a4a6b7d55b329cdf9fbd88736fa67

SHA1
49c9f306cd07a66e2458f5146667f43947d5db2c

SHA256
755cc6bd829ce9ac5d3883fc06f4f049b57c9dc7718fb84a3469645dca5f0582

SHA512
b9e7a599c6bebe5edc9fcc433fbf8b72933e99c5b800cd6507a48efbf4323226f13940e0e0116a18e45e0c65b34709a165ae3d0a46df0d208d62a37eb1ec5fff

Download Submit
C:\Windows\System\kdmykpH.exe

Filesize
1.4MB

MD5
75b48d566f29a4555d9d3ff4169c18a7

SHA1
5f33785d8699b8ece5386772ae690b042d793ea4

SHA256
fab6e83f1c5d8de496eca274bb1d26f88f9289ad66a09ef94bc35a9401501f99

SHA512
db33f203d56d93f961796d88e0cc19774c33ea604f9b2c1a8c6cb0b71eacd109dda2751bc5e03c8092e87383fc4e58b0b96cf3ca2c2824f9b878806aed822ecd

Download Submit
C:\Windows\System\mNcLYSW.exe

Filesize
1.4MB

MD5
80f4c0049b33d324f1d38b0215522501

SHA1
2d92b27d257d0d4df4629b70c99d1a21cd40e22c

SHA256
0141ff206bdb768388d411db6d4fd48d36c8dd8695ee3f1e58ad569629587b5b

SHA512
b0691d18469d001d1b0d43117436fbb5dae9e8f48132282343481f05d7c4fc9af856e0ae01ee1911b4c81d3f86c67718cc693d4c4fdb51091ed678073036f585

Download Submit
C:\Windows\System\qEjHapK.exe

Filesize
1.4MB

MD5
f48b8687921c2f6aa5857a455da14343

SHA1
e3b7f345ce2691d362d589b5e9cc88403dfd02bc

SHA256
46aa3820583db0e81e58480fa7a701dfd489de7fe2901abd68d2751bcd411085

SHA512
df7dfd7e61e6c36b4dc1a4726cc187b2a49e3096684d032cd9eafbaf71d0acacb3ec06f1e2a9569473785b19b9aef105f255f9580b30da7ca1c80ad8f18ae881

Download Submit
C:\Windows\System\qLgsXeN.exe

Filesize
1.4MB

MD5
a3f0df9c3bc60cec7ae8eef9a083c515

SHA1
f61d481037d1d3ea3c8b43e0c3338f2c197bc4ce

SHA256
8f7780c7ffe51d795197a870b08df73a9c6c1da6ec97977bfd4a4c213f5ac75e

SHA512
b39166df64fec90b73a75e8a4125dacfea728434fb081822cb25ceb2abc1da541ad4d8356b3d37b4e089bd42c564a1684368260ec2c339da050894ca8f795cd0

Download Submit
C:\Windows\System\qNXimKD.exe

Filesize
1.4MB

MD5
7c91f40559044cd5df724fe46671f90a

SHA1
32ec33d83641706d4bcbe69d0d2efadcdb56dd5f

SHA256
db4ef6b8b827a27741877477883d400ecf6998b1f2eea7ed486b806cfc5e51ac

SHA512
238f84ba37436966cfb638219e7cdd886e125b8fa169b5ca143b85b7bfa5e7fa6780ba8e25396df97a0f68e0959b3fcae304f10f2fa94f6b6c2488e5ed9c8850

Download Submit
C:\Windows\System\umQZUrJ.exe

Filesize
1.4MB

MD5
d6d8113d5859ed59530671b386fc6ddf

SHA1
20e6c239923a485dd4594288dfa7866f321ec150

SHA256
6c0f994710dd44feca9cbba1e07c715c01a13a6498b222df245ec94dc4f25e04

SHA512
40f3fc61bfcc82aeeb0cf1e60d8af009daad240f8ceec7db79d0ae0bfe34964efe0ffee10c333e4ebef4d44341ccb8f6b36c118c3b77cd9ea725f63cfa729a14

Download Submit
memory/2364-0-0x000001ACCBFB0000-0x000001ACCBFC0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads