xmrig | 38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
Size

1.4MB
MD5

a026097232fec5d5ce692ae3ed67e0a6
SHA1

af81de9181bc07fd0de52b33eb0f4a19bf0fcf3b
SHA256

38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5
SHA512

29f8cc6548accbf6a7d416fff9d9987dcfcdcc58fad56f584b976dfe1a3c7109b640dda821bc9aff5ad58f1b5ac84c332614ae6598b4b6db57478ac62835cadd
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcf:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5F

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b54-4.dat	xmrig
behavioral2/files/0x000a000000023b68-6.dat	xmrig
behavioral2/files/0x000a000000023b69-15.dat	xmrig
behavioral2/files/0x000a000000023b6b-25.dat	xmrig
behavioral2/files/0x000a000000023b6c-35.dat	xmrig
behavioral2/files/0x000a000000023b6a-28.dat	xmrig
behavioral2/files/0x000b000000023b64-16.dat	xmrig
behavioral2/files/0x000a000000023b6d-39.dat	xmrig
behavioral2/files/0x000a000000023b6f-42.dat	xmrig
behavioral2/files/0x000a000000023b70-49.dat	xmrig
behavioral2/files/0x000b000000023b65-54.dat	xmrig
behavioral2/files/0x000a000000023b71-59.dat	xmrig
behavioral2/files/0x000a000000023b72-64.dat	xmrig
behavioral2/files/0x000a000000023b73-67.dat	xmrig
behavioral2/files/0x000a000000023b74-71.dat	xmrig
behavioral2/files/0x000a000000023b76-82.dat	xmrig
behavioral2/files/0x000a000000023b79-97.dat	xmrig
behavioral2/files/0x000a000000023b7a-102.dat	xmrig
behavioral2/files/0x000a000000023b7c-114.dat	xmrig
behavioral2/files/0x000a000000023b7d-124.dat	xmrig
behavioral2/files/0x0031000000023b7f-130.dat	xmrig
behavioral2/files/0x000a000000023b7e-128.dat	xmrig
behavioral2/files/0x000a000000023b7b-119.dat	xmrig
behavioral2/files/0x000a000000023b78-110.dat	xmrig
behavioral2/files/0x000a000000023b75-100.dat	xmrig
behavioral2/files/0x000a000000023b77-91.dat	xmrig
behavioral2/files/0x0031000000023b80-134.dat	xmrig
behavioral2/files/0x0031000000023b81-137.dat	xmrig
behavioral2/files/0x000a000000023b84-150.dat	xmrig
behavioral2/files/0x000a000000023b82-151.dat	xmrig
behavioral2/files/0x000a000000023b86-162.dat	xmrig
behavioral2/files/0x000a000000023b83-157.dat	xmrig
behavioral2/files/0x000a000000023b85-156.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3148	rJtVYld.exe
4816	UnBhTSu.exe
1492	WMNFHVF.exe
2640	IKHIkNZ.exe
1088	gJBKzrj.exe
64	pmBBywq.exe
1164	YNqNkal.exe
5000	hOWuvBS.exe
1460	RzZRBwo.exe
4460	FdVpPRx.exe
5108	fnTUXvz.exe
3172	xJGkbzt.exe
4600	qjHtFki.exe
3732	zEIjics.exe
2004	gyOZfpU.exe
1668	invqQeh.exe
4556	umTtLHI.exe
4776	AzXjjiT.exe
3812	GsKeskE.exe
2196	bqBbXbN.exe
2160	EYyFFLl.exe
3584	pPBhiVc.exe
3220	qIHOGNc.exe
1268	nddhEIO.exe
3644	YMiRjFS.exe
944	OwDxJcj.exe
1016	YqSBwkP.exe
5116	TbqTGQH.exe
4040	ynktyDs.exe
2752	xiHTkZz.exe
4784	PJGhlnl.exe
3656	tOXspYe.exe
2728	lOknvKX.exe
3580	nDLdhuC.exe
4896	EDvmCvN.exe
3484	KkfISom.exe
1912	aOlAZsb.exe
3204	DbjPwOT.exe
4216	AyevZQm.exe
3208	eLpdzKk.exe
5028	siDtJyv.exe
5072	pPAeJXp.exe
540	NfYuxQR.exe
3036	riAktXx.exe
1928	jOLudjE.exe
4684	SweCybc.exe
1980	biHauKE.exe
3980	selCnTW.exe
3188	HnxMAGv.exe
740	TqScwja.exe
1336	oxGmXMZ.exe
2140	pVlBRER.exe
4584	jLgdkxx.exe
1288	VPikfRv.exe
3196	LQPuIdt.exe
2384	zohofPk.exe
1612	aAAfbTi.exe
624	qbWqGyS.exe
3032	avImmGB.exe
1624	lqDWJth.exe
1480	RTQLfUI.exe
3692	mzjbmnC.exe
4652	gUqmHaK.exe
2980	QjohOyo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AEZAEQE.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\sMdQwpn.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\imyCkYT.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\yMsQApd.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\nEJhCJA.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\vQxHzry.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\ksKbgDp.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\JiMtbsd.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\LcDVnom.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\pVlBRER.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\AlprJOR.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\TPdUufb.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\AAXNRbr.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\VEBKNWY.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\uPAyJvp.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\mzjbmnC.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\wbHfCiJ.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\FwdJnZu.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\epaiDhU.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\jtWDGgC.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\qbWqGyS.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\iuZWqzj.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\MlrlGYk.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\pWpAQxd.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\vFstxJF.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\JKOAZHE.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\vsubKbt.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\EGLUKgo.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\YKGRviy.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\zypEZEi.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\DzUrkiK.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\EEcUJle.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\ptGztXW.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\jwfGyYL.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\lQfnDtX.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\nDLdhuC.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\pmvQcdA.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\bPVOgVE.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\dXJjLNW.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\Idenwna.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\icDrKYi.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\oDnotDh.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\XpRyUmQ.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\oOkReDL.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\bpnNeZu.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\YBIXkFM.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\NwdyjyU.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\XhYfrfg.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\nSsaOYB.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\JADBUlq.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\TxPSbEC.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\zCbJJgq.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\nVfkoSe.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\BcuFgpQ.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\FfypPKi.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\azpWWxi.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\ivKxwdY.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\qVfavnl.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\RyzIwzk.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\YMiRjFS.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\WknhLDZ.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\bCRLqjS.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\jkNjiKc.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
File created	C:\Windows\System\gusZBOR.exe	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 3148	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	85
PID 1200 wrote to memory of 3148	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	85
PID 1200 wrote to memory of 4816	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	86
PID 1200 wrote to memory of 4816	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	86
PID 1200 wrote to memory of 1492	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	87
PID 1200 wrote to memory of 1492	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	87
PID 1200 wrote to memory of 2640	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	88
PID 1200 wrote to memory of 2640	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	88
PID 1200 wrote to memory of 1088	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	89
PID 1200 wrote to memory of 1088	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	89
PID 1200 wrote to memory of 64	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	90
PID 1200 wrote to memory of 64	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	90
PID 1200 wrote to memory of 1164	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	91
PID 1200 wrote to memory of 1164	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	91
PID 1200 wrote to memory of 5000	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	92
PID 1200 wrote to memory of 5000	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	92
PID 1200 wrote to memory of 1460	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	93
PID 1200 wrote to memory of 1460	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	93
PID 1200 wrote to memory of 4460	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	94
PID 1200 wrote to memory of 4460	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	94
PID 1200 wrote to memory of 5108	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	95
PID 1200 wrote to memory of 5108	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	95
PID 1200 wrote to memory of 3172	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	96
PID 1200 wrote to memory of 3172	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	96
PID 1200 wrote to memory of 4600	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	97
PID 1200 wrote to memory of 4600	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	97
PID 1200 wrote to memory of 3732	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	98
PID 1200 wrote to memory of 3732	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	98
PID 1200 wrote to memory of 2004	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	99
PID 1200 wrote to memory of 2004	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	99
PID 1200 wrote to memory of 1668	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	100
PID 1200 wrote to memory of 1668	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	100
PID 1200 wrote to memory of 4556	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	101
PID 1200 wrote to memory of 4556	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	101
PID 1200 wrote to memory of 4776	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	102
PID 1200 wrote to memory of 4776	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	102
PID 1200 wrote to memory of 3812	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	103
PID 1200 wrote to memory of 3812	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	103
PID 1200 wrote to memory of 2196	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	104
PID 1200 wrote to memory of 2196	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	104
PID 1200 wrote to memory of 2160	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	105
PID 1200 wrote to memory of 2160	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	105
PID 1200 wrote to memory of 3584	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	106
PID 1200 wrote to memory of 3584	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	106
PID 1200 wrote to memory of 3220	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	107
PID 1200 wrote to memory of 3220	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	107
PID 1200 wrote to memory of 1268	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	108
PID 1200 wrote to memory of 1268	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	108
PID 1200 wrote to memory of 3644	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	109
PID 1200 wrote to memory of 3644	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	109
PID 1200 wrote to memory of 944	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	110
PID 1200 wrote to memory of 944	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	110
PID 1200 wrote to memory of 1016	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	111
PID 1200 wrote to memory of 1016	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	111
PID 1200 wrote to memory of 5116	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	112
PID 1200 wrote to memory of 5116	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	112
PID 1200 wrote to memory of 4040	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	113
PID 1200 wrote to memory of 4040	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	113
PID 1200 wrote to memory of 2752	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	114
PID 1200 wrote to memory of 2752	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	114
PID 1200 wrote to memory of 4784	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	115
PID 1200 wrote to memory of 4784	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	115
PID 1200 wrote to memory of 3656	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	116
PID 1200 wrote to memory of 3656	1200	38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe	116

C:\Users\Admin\AppData\Local\Temp\38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe
"C:\Users\Admin\AppData\Local\Temp\38d3d9bb68a0fb845a4f99667edddd04151cb8c4ca2bc9dfd0cdf3ae734069e5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\System\rJtVYld.exe
  C:\Windows\System\rJtVYld.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\UnBhTSu.exe
  C:\Windows\System\UnBhTSu.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\WMNFHVF.exe
  C:\Windows\System\WMNFHVF.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\IKHIkNZ.exe
  C:\Windows\System\IKHIkNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\gJBKzrj.exe
  C:\Windows\System\gJBKzrj.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\pmBBywq.exe
  C:\Windows\System\pmBBywq.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\YNqNkal.exe
  C:\Windows\System\YNqNkal.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\hOWuvBS.exe
  C:\Windows\System\hOWuvBS.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\RzZRBwo.exe
  C:\Windows\System\RzZRBwo.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\FdVpPRx.exe
  C:\Windows\System\FdVpPRx.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\fnTUXvz.exe
  C:\Windows\System\fnTUXvz.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\xJGkbzt.exe
  C:\Windows\System\xJGkbzt.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\qjHtFki.exe
  C:\Windows\System\qjHtFki.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\zEIjics.exe
  C:\Windows\System\zEIjics.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\gyOZfpU.exe
  C:\Windows\System\gyOZfpU.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\invqQeh.exe
  C:\Windows\System\invqQeh.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\umTtLHI.exe
  C:\Windows\System\umTtLHI.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\AzXjjiT.exe
  C:\Windows\System\AzXjjiT.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\GsKeskE.exe
  C:\Windows\System\GsKeskE.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\bqBbXbN.exe
  C:\Windows\System\bqBbXbN.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\EYyFFLl.exe
  C:\Windows\System\EYyFFLl.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\pPBhiVc.exe
  C:\Windows\System\pPBhiVc.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\qIHOGNc.exe
  C:\Windows\System\qIHOGNc.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\nddhEIO.exe
  C:\Windows\System\nddhEIO.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\YMiRjFS.exe
  C:\Windows\System\YMiRjFS.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\OwDxJcj.exe
  C:\Windows\System\OwDxJcj.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\YqSBwkP.exe
  C:\Windows\System\YqSBwkP.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\TbqTGQH.exe
  C:\Windows\System\TbqTGQH.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\ynktyDs.exe
  C:\Windows\System\ynktyDs.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\xiHTkZz.exe
  C:\Windows\System\xiHTkZz.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\PJGhlnl.exe
  C:\Windows\System\PJGhlnl.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\tOXspYe.exe
  C:\Windows\System\tOXspYe.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\lOknvKX.exe
  C:\Windows\System\lOknvKX.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\nDLdhuC.exe
  C:\Windows\System\nDLdhuC.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\EDvmCvN.exe
  C:\Windows\System\EDvmCvN.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\KkfISom.exe
  C:\Windows\System\KkfISom.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\aOlAZsb.exe
  C:\Windows\System\aOlAZsb.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\DbjPwOT.exe
  C:\Windows\System\DbjPwOT.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\AyevZQm.exe
  C:\Windows\System\AyevZQm.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\eLpdzKk.exe
  C:\Windows\System\eLpdzKk.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\siDtJyv.exe
  C:\Windows\System\siDtJyv.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\pPAeJXp.exe
  C:\Windows\System\pPAeJXp.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\NfYuxQR.exe
  C:\Windows\System\NfYuxQR.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\riAktXx.exe
  C:\Windows\System\riAktXx.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\SweCybc.exe
  C:\Windows\System\SweCybc.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\jOLudjE.exe
  C:\Windows\System\jOLudjE.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\biHauKE.exe
  C:\Windows\System\biHauKE.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\selCnTW.exe
  C:\Windows\System\selCnTW.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\HnxMAGv.exe
  C:\Windows\System\HnxMAGv.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\TqScwja.exe
  C:\Windows\System\TqScwja.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\oxGmXMZ.exe
  C:\Windows\System\oxGmXMZ.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\pVlBRER.exe
  C:\Windows\System\pVlBRER.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\jLgdkxx.exe
  C:\Windows\System\jLgdkxx.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\VPikfRv.exe
  C:\Windows\System\VPikfRv.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\LQPuIdt.exe
  C:\Windows\System\LQPuIdt.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\zohofPk.exe
  C:\Windows\System\zohofPk.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\aAAfbTi.exe
  C:\Windows\System\aAAfbTi.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\qbWqGyS.exe
  C:\Windows\System\qbWqGyS.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\avImmGB.exe
  C:\Windows\System\avImmGB.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\lqDWJth.exe
  C:\Windows\System\lqDWJth.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\RTQLfUI.exe
  C:\Windows\System\RTQLfUI.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\mzjbmnC.exe
  C:\Windows\System\mzjbmnC.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\gUqmHaK.exe
  C:\Windows\System\gUqmHaK.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\QjohOyo.exe
  C:\Windows\System\QjohOyo.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\mXVDJME.exe
  C:\Windows\System\mXVDJME.exe
  2⤵
  PID:5068
- C:\Windows\System\aOfUTud.exe
  C:\Windows\System\aOfUTud.exe
  2⤵
  PID:1708
- C:\Windows\System\cHEUVVp.exe
  C:\Windows\System\cHEUVVp.exe
  2⤵
  PID:1096
- C:\Windows\System\yOeKbEC.exe
  C:\Windows\System\yOeKbEC.exe
  2⤵
  PID:2556
- C:\Windows\System\jcTZCVx.exe
  C:\Windows\System\jcTZCVx.exe
  2⤵
  PID:3532
- C:\Windows\System\UqfvllT.exe
  C:\Windows\System\UqfvllT.exe
  2⤵
  PID:4176
- C:\Windows\System\thyyEiF.exe
  C:\Windows\System\thyyEiF.exe
  2⤵
  PID:3100
- C:\Windows\System\IjAVZlY.exe
  C:\Windows\System\IjAVZlY.exe
  2⤵
  PID:440
- C:\Windows\System\jmBOpOy.exe
  C:\Windows\System\jmBOpOy.exe
  2⤵
  PID:1920
- C:\Windows\System\WbRFfyB.exe
  C:\Windows\System\WbRFfyB.exe
  2⤵
  PID:2940
- C:\Windows\System\VMTXFEl.exe
  C:\Windows\System\VMTXFEl.exe
  2⤵
  PID:2268
- C:\Windows\System\PCLhSsz.exe
  C:\Windows\System\PCLhSsz.exe
  2⤵
  PID:3104
- C:\Windows\System\xwIvEDV.exe
  C:\Windows\System\xwIvEDV.exe
  2⤵
  PID:4520
- C:\Windows\System\Pvhvysv.exe
  C:\Windows\System\Pvhvysv.exe
  2⤵
  PID:1280
- C:\Windows\System\FwIDzGZ.exe
  C:\Windows\System\FwIDzGZ.exe
  2⤵
  PID:516
- C:\Windows\System\wBnTIuf.exe
  C:\Windows\System\wBnTIuf.exe
  2⤵
  PID:1084
- C:\Windows\System\RlieAka.exe
  C:\Windows\System\RlieAka.exe
  2⤵
  PID:920
- C:\Windows\System\qEgnziC.exe
  C:\Windows\System\qEgnziC.exe
  2⤵
  PID:3916
- C:\Windows\System\zTLMkHS.exe
  C:\Windows\System\zTLMkHS.exe
  2⤵
  PID:1760
- C:\Windows\System\XpRyUmQ.exe
  C:\Windows\System\XpRyUmQ.exe
  2⤵
  PID:1308
- C:\Windows\System\yBKRwZm.exe
  C:\Windows\System\yBKRwZm.exe
  2⤵
  PID:1996
- C:\Windows\System\bnmaFpd.exe
  C:\Windows\System\bnmaFpd.exe
  2⤵
  PID:4364
- C:\Windows\System\gxOXDAR.exe
  C:\Windows\System\gxOXDAR.exe
  2⤵
  PID:2372
- C:\Windows\System\iVnMGxs.exe
  C:\Windows\System\iVnMGxs.exe
  2⤵
  PID:4536
- C:\Windows\System\bvCideg.exe
  C:\Windows\System\bvCideg.exe
  2⤵
  PID:2992
- C:\Windows\System\wCgqucc.exe
  C:\Windows\System\wCgqucc.exe
  2⤵
  PID:3660
- C:\Windows\System\IPyVcov.exe
  C:\Windows\System\IPyVcov.exe
  2⤵
  PID:4884
- C:\Windows\System\rNbPLBS.exe
  C:\Windows\System\rNbPLBS.exe
  2⤵
  PID:3444
- C:\Windows\System\ZqMUKLC.exe
  C:\Windows\System\ZqMUKLC.exe
  2⤵
  PID:232
- C:\Windows\System\OGEHeNG.exe
  C:\Windows\System\OGEHeNG.exe
  2⤵
  PID:880
- C:\Windows\System\gPwmdDm.exe
  C:\Windows\System\gPwmdDm.exe
  2⤵
  PID:1260
- C:\Windows\System\aNiFVIs.exe
  C:\Windows\System\aNiFVIs.exe
  2⤵
  PID:1112
- C:\Windows\System\SHMICMM.exe
  C:\Windows\System\SHMICMM.exe
  2⤵
  PID:3696
- C:\Windows\System\YyxMJWb.exe
  C:\Windows\System\YyxMJWb.exe
  2⤵
  PID:2300
- C:\Windows\System\AdQBzHn.exe
  C:\Windows\System\AdQBzHn.exe
  2⤵
  PID:5132
- C:\Windows\System\icHBUSp.exe
  C:\Windows\System\icHBUSp.exe
  2⤵
  PID:5160
- C:\Windows\System\CGmOLBI.exe
  C:\Windows\System\CGmOLBI.exe
  2⤵
  PID:5188
- C:\Windows\System\YNRJtDO.exe
  C:\Windows\System\YNRJtDO.exe
  2⤵
  PID:5212
- C:\Windows\System\cKoqZlu.exe
  C:\Windows\System\cKoqZlu.exe
  2⤵
  PID:5244
- C:\Windows\System\AUgUQad.exe
  C:\Windows\System\AUgUQad.exe
  2⤵
  PID:5272
- C:\Windows\System\ileDxRA.exe
  C:\Windows\System\ileDxRA.exe
  2⤵
  PID:5292
- C:\Windows\System\WGHImnl.exe
  C:\Windows\System\WGHImnl.exe
  2⤵
  PID:5332
- C:\Windows\System\gSrOdsP.exe
  C:\Windows\System\gSrOdsP.exe
  2⤵
  PID:5380
- C:\Windows\System\pDHuhOq.exe
  C:\Windows\System\pDHuhOq.exe
  2⤵
  PID:5396
- C:\Windows\System\zlkxxmp.exe
  C:\Windows\System\zlkxxmp.exe
  2⤵
  PID:5424
- C:\Windows\System\jtWDGgC.exe
  C:\Windows\System\jtWDGgC.exe
  2⤵
  PID:5452
- C:\Windows\System\VmBzJuv.exe
  C:\Windows\System\VmBzJuv.exe
  2⤵
  PID:5492
- C:\Windows\System\PCkVVdN.exe
  C:\Windows\System\PCkVVdN.exe
  2⤵
  PID:5528
- C:\Windows\System\EMgTMuD.exe
  C:\Windows\System\EMgTMuD.exe
  2⤵
  PID:5548
- C:\Windows\System\HDUQdcL.exe
  C:\Windows\System\HDUQdcL.exe
  2⤵
  PID:5576
- C:\Windows\System\PIdwvQR.exe
  C:\Windows\System\PIdwvQR.exe
  2⤵
  PID:5604
- C:\Windows\System\HypTJPB.exe
  C:\Windows\System\HypTJPB.exe
  2⤵
  PID:5636
- C:\Windows\System\eOkKJWK.exe
  C:\Windows\System\eOkKJWK.exe
  2⤵
  PID:5660
- C:\Windows\System\uWnAIlx.exe
  C:\Windows\System\uWnAIlx.exe
  2⤵
  PID:5676
- C:\Windows\System\AlprJOR.exe
  C:\Windows\System\AlprJOR.exe
  2⤵
  PID:5712
- C:\Windows\System\FUDoJwE.exe
  C:\Windows\System\FUDoJwE.exe
  2⤵
  PID:5740
- C:\Windows\System\hAGNFSY.exe
  C:\Windows\System\hAGNFSY.exe
  2⤵
  PID:5772
- C:\Windows\System\ASWWhNs.exe
  C:\Windows\System\ASWWhNs.exe
  2⤵
  PID:5800
- C:\Windows\System\rVLNwEo.exe
  C:\Windows\System\rVLNwEo.exe
  2⤵
  PID:5820
- C:\Windows\System\MAnzODK.exe
  C:\Windows\System\MAnzODK.exe
  2⤵
  PID:5848
- C:\Windows\System\HZZnjUC.exe
  C:\Windows\System\HZZnjUC.exe
  2⤵
  PID:5876
- C:\Windows\System\zHaMkbJ.exe
  C:\Windows\System\zHaMkbJ.exe
  2⤵
  PID:5912
- C:\Windows\System\eIYOqFw.exe
  C:\Windows\System\eIYOqFw.exe
  2⤵
  PID:5944
- C:\Windows\System\iIxwXZW.exe
  C:\Windows\System\iIxwXZW.exe
  2⤵
  PID:5972
- C:\Windows\System\dXJjLNW.exe
  C:\Windows\System\dXJjLNW.exe
  2⤵
  PID:6000
- C:\Windows\System\lQXDmKY.exe
  C:\Windows\System\lQXDmKY.exe
  2⤵
  PID:6028
- C:\Windows\System\gcmTuyl.exe
  C:\Windows\System\gcmTuyl.exe
  2⤵
  PID:6056
- C:\Windows\System\osqKkmK.exe
  C:\Windows\System\osqKkmK.exe
  2⤵
  PID:6084
- C:\Windows\System\gazhCcv.exe
  C:\Windows\System\gazhCcv.exe
  2⤵
  PID:6112
- C:\Windows\System\iLBsguH.exe
  C:\Windows\System\iLBsguH.exe
  2⤵
  PID:6140
- C:\Windows\System\RtmuEoE.exe
  C:\Windows\System\RtmuEoE.exe
  2⤵
  PID:5140
- C:\Windows\System\FcQAiKH.exe
  C:\Windows\System\FcQAiKH.exe
  2⤵
  PID:5196
- C:\Windows\System\wZthavC.exe
  C:\Windows\System\wZthavC.exe
  2⤵
  PID:5268
- C:\Windows\System\EEcUJle.exe
  C:\Windows\System\EEcUJle.exe
  2⤵
  PID:5388
- C:\Windows\System\lUkpjvg.exe
  C:\Windows\System\lUkpjvg.exe
  2⤵
  PID:5436
- C:\Windows\System\pbMXbZT.exe
  C:\Windows\System\pbMXbZT.exe
  2⤵
  PID:5508
- C:\Windows\System\xHbODOo.exe
  C:\Windows\System\xHbODOo.exe
  2⤵
  PID:5560
- C:\Windows\System\HLCGnyN.exe
  C:\Windows\System\HLCGnyN.exe
  2⤵
  PID:5624
- C:\Windows\System\OifbpVN.exe
  C:\Windows\System\OifbpVN.exe
  2⤵
  PID:5688
- C:\Windows\System\jahUrfv.exe
  C:\Windows\System\jahUrfv.exe
  2⤵
  PID:5748
- C:\Windows\System\MIRImQQ.exe
  C:\Windows\System\MIRImQQ.exe
  2⤵
  PID:5812
- C:\Windows\System\OlMTscC.exe
  C:\Windows\System\OlMTscC.exe
  2⤵
  PID:5864
- C:\Windows\System\ZhLSEDd.exe
  C:\Windows\System\ZhLSEDd.exe
  2⤵
  PID:5940
- C:\Windows\System\nFavrZa.exe
  C:\Windows\System\nFavrZa.exe
  2⤵
  PID:6020
- C:\Windows\System\vpJVnYj.exe
  C:\Windows\System\vpJVnYj.exe
  2⤵
  PID:6096
- C:\Windows\System\RhMZZYx.exe
  C:\Windows\System\RhMZZYx.exe
  2⤵
  PID:5148
- C:\Windows\System\BbreNSJ.exe
  C:\Windows\System\BbreNSJ.exe
  2⤵
  PID:5280
- C:\Windows\System\INaAkUv.exe
  C:\Windows\System\INaAkUv.exe
  2⤵
  PID:5460
- C:\Windows\System\WknhLDZ.exe
  C:\Windows\System\WknhLDZ.exe
  2⤵
  PID:5600
- C:\Windows\System\LajEWlK.exe
  C:\Windows\System\LajEWlK.exe
  2⤵
  PID:5792
- C:\Windows\System\CXkOcpS.exe
  C:\Windows\System\CXkOcpS.exe
  2⤵
  PID:5844
- C:\Windows\System\azpWWxi.exe
  C:\Windows\System\azpWWxi.exe
  2⤵
  PID:5996
- C:\Windows\System\ClfsmgK.exe
  C:\Windows\System\ClfsmgK.exe
  2⤵
  PID:5176
- C:\Windows\System\TvKBhfg.exe
  C:\Windows\System\TvKBhfg.exe
  2⤵
  PID:5544
- C:\Windows\System\IuGwzRl.exe
  C:\Windows\System\IuGwzRl.exe
  2⤵
  PID:5856
- C:\Windows\System\dAjiphK.exe
  C:\Windows\System\dAjiphK.exe
  2⤵
  PID:5536
- C:\Windows\System\LFwnUpv.exe
  C:\Windows\System\LFwnUpv.exe
  2⤵
  PID:6076
- C:\Windows\System\anrTkPl.exe
  C:\Windows\System\anrTkPl.exe
  2⤵
  PID:6152
- C:\Windows\System\jyHcoIm.exe
  C:\Windows\System\jyHcoIm.exe
  2⤵
  PID:6180
- C:\Windows\System\JMLRPTO.exe
  C:\Windows\System\JMLRPTO.exe
  2⤵
  PID:6208
- C:\Windows\System\IGKAEGr.exe
  C:\Windows\System\IGKAEGr.exe
  2⤵
  PID:6240
- C:\Windows\System\MBXEjDf.exe
  C:\Windows\System\MBXEjDf.exe
  2⤵
  PID:6264
- C:\Windows\System\zPqGqxs.exe
  C:\Windows\System\zPqGqxs.exe
  2⤵
  PID:6296
- C:\Windows\System\AARHZsS.exe
  C:\Windows\System\AARHZsS.exe
  2⤵
  PID:6324
- C:\Windows\System\XhYfrfg.exe
  C:\Windows\System\XhYfrfg.exe
  2⤵
  PID:6352
- C:\Windows\System\hZVhehK.exe
  C:\Windows\System\hZVhehK.exe
  2⤵
  PID:6380
- C:\Windows\System\lYknBNa.exe
  C:\Windows\System\lYknBNa.exe
  2⤵
  PID:6408
- C:\Windows\System\TxPSbEC.exe
  C:\Windows\System\TxPSbEC.exe
  2⤵
  PID:6436
- C:\Windows\System\WEpDAzv.exe
  C:\Windows\System\WEpDAzv.exe
  2⤵
  PID:6464
- C:\Windows\System\TeifhMj.exe
  C:\Windows\System\TeifhMj.exe
  2⤵
  PID:6492
- C:\Windows\System\UskPedQ.exe
  C:\Windows\System\UskPedQ.exe
  2⤵
  PID:6520
- C:\Windows\System\DxOwedI.exe
  C:\Windows\System\DxOwedI.exe
  2⤵
  PID:6548
- C:\Windows\System\tGvdumt.exe
  C:\Windows\System\tGvdumt.exe
  2⤵
  PID:6576
- C:\Windows\System\ivJYZfF.exe
  C:\Windows\System\ivJYZfF.exe
  2⤵
  PID:6604
- C:\Windows\System\EaJuXhB.exe
  C:\Windows\System\EaJuXhB.exe
  2⤵
  PID:6632
- C:\Windows\System\cBKXSuE.exe
  C:\Windows\System\cBKXSuE.exe
  2⤵
  PID:6660
- C:\Windows\System\LbqAWUr.exe
  C:\Windows\System\LbqAWUr.exe
  2⤵
  PID:6692
- C:\Windows\System\yNpKjIm.exe
  C:\Windows\System\yNpKjIm.exe
  2⤵
  PID:6720
- C:\Windows\System\pgoXwNs.exe
  C:\Windows\System\pgoXwNs.exe
  2⤵
  PID:6748
- C:\Windows\System\iTMMnXJ.exe
  C:\Windows\System\iTMMnXJ.exe
  2⤵
  PID:6776
- C:\Windows\System\YyxREAY.exe
  C:\Windows\System\YyxREAY.exe
  2⤵
  PID:6804
- C:\Windows\System\FwdJnZu.exe
  C:\Windows\System\FwdJnZu.exe
  2⤵
  PID:6832
- C:\Windows\System\dnRIWbs.exe
  C:\Windows\System\dnRIWbs.exe
  2⤵
  PID:6860
- C:\Windows\System\LnLHeZi.exe
  C:\Windows\System\LnLHeZi.exe
  2⤵
  PID:6888
- C:\Windows\System\GIFHCiP.exe
  C:\Windows\System\GIFHCiP.exe
  2⤵
  PID:6916
- C:\Windows\System\Idenwna.exe
  C:\Windows\System\Idenwna.exe
  2⤵
  PID:6944
- C:\Windows\System\BGOUDPk.exe
  C:\Windows\System\BGOUDPk.exe
  2⤵
  PID:6976
- C:\Windows\System\GpynpcE.exe
  C:\Windows\System\GpynpcE.exe
  2⤵
  PID:7000
- C:\Windows\System\gvuNvCW.exe
  C:\Windows\System\gvuNvCW.exe
  2⤵
  PID:7028
- C:\Windows\System\CsZXqsp.exe
  C:\Windows\System\CsZXqsp.exe
  2⤵
  PID:7056
- C:\Windows\System\VBrinzW.exe
  C:\Windows\System\VBrinzW.exe
  2⤵
  PID:7084
- C:\Windows\System\FjaEubt.exe
  C:\Windows\System\FjaEubt.exe
  2⤵
  PID:7112
- C:\Windows\System\mLuZsYt.exe
  C:\Windows\System\mLuZsYt.exe
  2⤵
  PID:7140
- C:\Windows\System\IREWZhy.exe
  C:\Windows\System\IREWZhy.exe
  2⤵
  PID:6148
- C:\Windows\System\wbHfCiJ.exe
  C:\Windows\System\wbHfCiJ.exe
  2⤵
  PID:6204
- C:\Windows\System\QLPXyMG.exe
  C:\Windows\System\QLPXyMG.exe
  2⤵
  PID:6260
- C:\Windows\System\KaCbhPh.exe
  C:\Windows\System\KaCbhPh.exe
  2⤵
  PID:6336
- C:\Windows\System\sglcwWf.exe
  C:\Windows\System\sglcwWf.exe
  2⤵
  PID:6400
- C:\Windows\System\ToZUZrf.exe
  C:\Windows\System\ToZUZrf.exe
  2⤵
  PID:6460
- C:\Windows\System\TxzMaQa.exe
  C:\Windows\System\TxzMaQa.exe
  2⤵
  PID:6512
- C:\Windows\System\rCJYBbk.exe
  C:\Windows\System\rCJYBbk.exe
  2⤵
  PID:6596
- C:\Windows\System\OkIfiwR.exe
  C:\Windows\System\OkIfiwR.exe
  2⤵
  PID:6624
- C:\Windows\System\imyCkYT.exe
  C:\Windows\System\imyCkYT.exe
  2⤵
  PID:6684
- C:\Windows\System\oSmoWsK.exe
  C:\Windows\System\oSmoWsK.exe
  2⤵
  PID:6740
- C:\Windows\System\jthBDQY.exe
  C:\Windows\System\jthBDQY.exe
  2⤵
  PID:6800
- C:\Windows\System\jtazUHC.exe
  C:\Windows\System\jtazUHC.exe
  2⤵
  PID:6852
- C:\Windows\System\gHdQUMc.exe
  C:\Windows\System\gHdQUMc.exe
  2⤵
  PID:6884
- C:\Windows\System\yqbOHuv.exe
  C:\Windows\System\yqbOHuv.exe
  2⤵
  PID:6968
- C:\Windows\System\NoWRiEY.exe
  C:\Windows\System\NoWRiEY.exe
  2⤵
  PID:7012
- C:\Windows\System\bfeHXPv.exe
  C:\Windows\System\bfeHXPv.exe
  2⤵
  PID:7020
- C:\Windows\System\tCMHYkv.exe
  C:\Windows\System\tCMHYkv.exe
  2⤵
  PID:7076
- C:\Windows\System\TPdUufb.exe
  C:\Windows\System\TPdUufb.exe
  2⤵
  PID:7156
- C:\Windows\System\UuIFzuR.exe
  C:\Windows\System\UuIFzuR.exe
  2⤵
  PID:6276
- C:\Windows\System\kWlKjYg.exe
  C:\Windows\System\kWlKjYg.exe
  2⤵
  PID:6364
- C:\Windows\System\VaNHofX.exe
  C:\Windows\System\VaNHofX.exe
  2⤵
  PID:6504
- C:\Windows\System\grYCKkm.exe
  C:\Windows\System\grYCKkm.exe
  2⤵
  PID:6616
- C:\Windows\System\YiZzpKu.exe
  C:\Windows\System\YiZzpKu.exe
  2⤵
  PID:6828
- C:\Windows\System\vFstxJF.exe
  C:\Windows\System\vFstxJF.exe
  2⤵
  PID:6936
- C:\Windows\System\wqEFjjD.exe
  C:\Windows\System\wqEFjjD.exe
  2⤵
  PID:7132
- C:\Windows\System\hKKPYXd.exe
  C:\Windows\System\hKKPYXd.exe
  2⤵
  PID:6200
- C:\Windows\System\bEJomtk.exe
  C:\Windows\System\bEJomtk.exe
  2⤵
  PID:6448
- C:\Windows\System\xojjjZw.exe
  C:\Windows\System\xojjjZw.exe
  2⤵
  PID:6856
- C:\Windows\System\DqpIBbd.exe
  C:\Windows\System\DqpIBbd.exe
  2⤵
  PID:6312
- C:\Windows\System\VerSYoK.exe
  C:\Windows\System\VerSYoK.exe
  2⤵
  PID:6600
- C:\Windows\System\XxoxwBe.exe
  C:\Windows\System\XxoxwBe.exe
  2⤵
  PID:2200
- C:\Windows\System\DBDuDub.exe
  C:\Windows\System\DBDuDub.exe
  2⤵
  PID:6292
- C:\Windows\System\DlSExEB.exe
  C:\Windows\System\DlSExEB.exe
  2⤵
  PID:7180
- C:\Windows\System\xLxmRar.exe
  C:\Windows\System\xLxmRar.exe
  2⤵
  PID:7216
- C:\Windows\System\seQJDda.exe
  C:\Windows\System\seQJDda.exe
  2⤵
  PID:7248
- C:\Windows\System\qbqTOwP.exe
  C:\Windows\System\qbqTOwP.exe
  2⤵
  PID:7276
- C:\Windows\System\cFAUcsp.exe
  C:\Windows\System\cFAUcsp.exe
  2⤵
  PID:7304
- C:\Windows\System\AcngXZE.exe
  C:\Windows\System\AcngXZE.exe
  2⤵
  PID:7332
- C:\Windows\System\nSsaOYB.exe
  C:\Windows\System\nSsaOYB.exe
  2⤵
  PID:7356
- C:\Windows\System\WHyldjb.exe
  C:\Windows\System\WHyldjb.exe
  2⤵
  PID:7384
- C:\Windows\System\iaEUkTP.exe
  C:\Windows\System\iaEUkTP.exe
  2⤵
  PID:7420
- C:\Windows\System\RaeevFg.exe
  C:\Windows\System\RaeevFg.exe
  2⤵
  PID:7436
- C:\Windows\System\RunkNlb.exe
  C:\Windows\System\RunkNlb.exe
  2⤵
  PID:7464
- C:\Windows\System\GetBRes.exe
  C:\Windows\System\GetBRes.exe
  2⤵
  PID:7508
- C:\Windows\System\arhkfWX.exe
  C:\Windows\System\arhkfWX.exe
  2⤵
  PID:7524
- C:\Windows\System\RhcNaLy.exe
  C:\Windows\System\RhcNaLy.exe
  2⤵
  PID:7556
- C:\Windows\System\ykDWfTO.exe
  C:\Windows\System\ykDWfTO.exe
  2⤵
  PID:7592
- C:\Windows\System\xivrIGF.exe
  C:\Windows\System\xivrIGF.exe
  2⤵
  PID:7620
- C:\Windows\System\ZkQZJMq.exe
  C:\Windows\System\ZkQZJMq.exe
  2⤵
  PID:7636
- C:\Windows\System\zloQsbf.exe
  C:\Windows\System\zloQsbf.exe
  2⤵
  PID:7656
- C:\Windows\System\eEwGdNL.exe
  C:\Windows\System\eEwGdNL.exe
  2⤵
  PID:7684
- C:\Windows\System\nFOltmM.exe
  C:\Windows\System\nFOltmM.exe
  2⤵
  PID:7704
- C:\Windows\System\JgtjvkN.exe
  C:\Windows\System\JgtjvkN.exe
  2⤵
  PID:7732
- C:\Windows\System\FjbYqup.exe
  C:\Windows\System\FjbYqup.exe
  2⤵
  PID:7760
- C:\Windows\System\bZgymoe.exe
  C:\Windows\System\bZgymoe.exe
  2⤵
  PID:7788
- C:\Windows\System\kMfIRKK.exe
  C:\Windows\System\kMfIRKK.exe
  2⤵
  PID:7820
- C:\Windows\System\XARQqEb.exe
  C:\Windows\System\XARQqEb.exe
  2⤵
  PID:7852
- C:\Windows\System\nEJhCJA.exe
  C:\Windows\System\nEJhCJA.exe
  2⤵
  PID:7884
- C:\Windows\System\ehvdxql.exe
  C:\Windows\System\ehvdxql.exe
  2⤵
  PID:7912
- C:\Windows\System\EhzGYPi.exe
  C:\Windows\System\EhzGYPi.exe
  2⤵
  PID:7948
- C:\Windows\System\oFiBTqz.exe
  C:\Windows\System\oFiBTqz.exe
  2⤵
  PID:7980
- C:\Windows\System\LUrNafe.exe
  C:\Windows\System\LUrNafe.exe
  2⤵
  PID:8008
- C:\Windows\System\WXnVnRE.exe
  C:\Windows\System\WXnVnRE.exe
  2⤵
  PID:8032
- C:\Windows\System\VdALwIr.exe
  C:\Windows\System\VdALwIr.exe
  2⤵
  PID:8064
- C:\Windows\System\HWhOWTC.exe
  C:\Windows\System\HWhOWTC.exe
  2⤵
  PID:8100
- C:\Windows\System\UacSmze.exe
  C:\Windows\System\UacSmze.exe
  2⤵
  PID:8128
- C:\Windows\System\fjQCRCb.exe
  C:\Windows\System\fjQCRCb.exe
  2⤵
  PID:8156
- C:\Windows\System\dotAung.exe
  C:\Windows\System\dotAung.exe
  2⤵
  PID:6760
- C:\Windows\System\aWwPGcy.exe
  C:\Windows\System\aWwPGcy.exe
  2⤵
  PID:7228
- C:\Windows\System\cRpAOHT.exe
  C:\Windows\System\cRpAOHT.exe
  2⤵
  PID:7296
- C:\Windows\System\KEWfXNJ.exe
  C:\Windows\System\KEWfXNJ.exe
  2⤵
  PID:7372
- C:\Windows\System\SSDSXtw.exe
  C:\Windows\System\SSDSXtw.exe
  2⤵
  PID:7412
- C:\Windows\System\SzWqVKw.exe
  C:\Windows\System\SzWqVKw.exe
  2⤵
  PID:7452
- C:\Windows\System\jBCJxgD.exe
  C:\Windows\System\jBCJxgD.exe
  2⤵
  PID:7496
- C:\Windows\System\FrqAxzS.exe
  C:\Windows\System\FrqAxzS.exe
  2⤵
  PID:7576
- C:\Windows\System\yPTkMIf.exe
  C:\Windows\System\yPTkMIf.exe
  2⤵
  PID:7644
- C:\Windows\System\KLZXQrz.exe
  C:\Windows\System\KLZXQrz.exe
  2⤵
  PID:7724
- C:\Windows\System\RRZnqXK.exe
  C:\Windows\System\RRZnqXK.exe
  2⤵
  PID:7772
- C:\Windows\System\kCnRBSX.exe
  C:\Windows\System\kCnRBSX.exe
  2⤵
  PID:7864
- C:\Windows\System\ojBquEg.exe
  C:\Windows\System\ojBquEg.exe
  2⤵
  PID:4044
- C:\Windows\System\dWuiisQ.exe
  C:\Windows\System\dWuiisQ.exe
  2⤵
  PID:7904
- C:\Windows\System\DsGUbrH.exe
  C:\Windows\System\DsGUbrH.exe
  2⤵
  PID:7944
- C:\Windows\System\KQqstlb.exe
  C:\Windows\System\KQqstlb.exe
  2⤵
  PID:8024
- C:\Windows\System\jVJLzbL.exe
  C:\Windows\System\jVJLzbL.exe
  2⤵
  PID:8140
- C:\Windows\System\ScBcPOg.exe
  C:\Windows\System\ScBcPOg.exe
  2⤵
  PID:7196
- C:\Windows\System\KAHZDjY.exe
  C:\Windows\System\KAHZDjY.exe
  2⤵
  PID:7348
- C:\Windows\System\crpXkxv.exe
  C:\Windows\System\crpXkxv.exe
  2⤵
  PID:7536
- C:\Windows\System\Pxvcflp.exe
  C:\Windows\System\Pxvcflp.exe
  2⤵
  PID:7492
- C:\Windows\System\orPkIzT.exe
  C:\Windows\System\orPkIzT.exe
  2⤵
  PID:7680
- C:\Windows\System\jvYvOSE.exe
  C:\Windows\System\jvYvOSE.exe
  2⤵
  PID:7892
- C:\Windows\System\odrcLwR.exe
  C:\Windows\System\odrcLwR.exe
  2⤵
  PID:8092
- C:\Windows\System\HvheqVH.exe
  C:\Windows\System\HvheqVH.exe
  2⤵
  PID:7396
- C:\Windows\System\FBhjVGZ.exe
  C:\Windows\System\FBhjVGZ.exe
  2⤵
  PID:7520
- C:\Windows\System\zJJCzvh.exe
  C:\Windows\System\zJJCzvh.exe
  2⤵
  PID:7932
- C:\Windows\System\gnlYdYN.exe
  C:\Windows\System\gnlYdYN.exe
  2⤵
  PID:8052
- C:\Windows\System\KHnGdoa.exe
  C:\Windows\System\KHnGdoa.exe
  2⤵
  PID:7712
- C:\Windows\System\edGRuKM.exe
  C:\Windows\System\edGRuKM.exe
  2⤵
  PID:8220
- C:\Windows\System\NxUZJue.exe
  C:\Windows\System\NxUZJue.exe
  2⤵
  PID:8260
- C:\Windows\System\BcEFMJD.exe
  C:\Windows\System\BcEFMJD.exe
  2⤵
  PID:8288
- C:\Windows\System\wXBhyji.exe
  C:\Windows\System\wXBhyji.exe
  2⤵
  PID:8316
- C:\Windows\System\AFyePrm.exe
  C:\Windows\System\AFyePrm.exe
  2⤵
  PID:8344
- C:\Windows\System\yMsQApd.exe
  C:\Windows\System\yMsQApd.exe
  2⤵
  PID:8372
- C:\Windows\System\pYSRUbk.exe
  C:\Windows\System\pYSRUbk.exe
  2⤵
  PID:8400
- C:\Windows\System\VyMBaeR.exe
  C:\Windows\System\VyMBaeR.exe
  2⤵
  PID:8428
- C:\Windows\System\gBcUHRN.exe
  C:\Windows\System\gBcUHRN.exe
  2⤵
  PID:8456
- C:\Windows\System\tDJpIPh.exe
  C:\Windows\System\tDJpIPh.exe
  2⤵
  PID:8484
- C:\Windows\System\lSsCmMX.exe
  C:\Windows\System\lSsCmMX.exe
  2⤵
  PID:8512
- C:\Windows\System\AAXNRbr.exe
  C:\Windows\System\AAXNRbr.exe
  2⤵
  PID:8540
- C:\Windows\System\CTLXqpF.exe
  C:\Windows\System\CTLXqpF.exe
  2⤵
  PID:8568
- C:\Windows\System\CufRTDW.exe
  C:\Windows\System\CufRTDW.exe
  2⤵
  PID:8596
- C:\Windows\System\iLKMPiU.exe
  C:\Windows\System\iLKMPiU.exe
  2⤵
  PID:8624
- C:\Windows\System\UpKpyzc.exe
  C:\Windows\System\UpKpyzc.exe
  2⤵
  PID:8640
- C:\Windows\System\tEwljvS.exe
  C:\Windows\System\tEwljvS.exe
  2⤵
  PID:8668
- C:\Windows\System\zCbJJgq.exe
  C:\Windows\System\zCbJJgq.exe
  2⤵
  PID:8708
- C:\Windows\System\XPJusuN.exe
  C:\Windows\System\XPJusuN.exe
  2⤵
  PID:8736
- C:\Windows\System\KyCNfYT.exe
  C:\Windows\System\KyCNfYT.exe
  2⤵
  PID:8764
- C:\Windows\System\DzUrkiK.exe
  C:\Windows\System\DzUrkiK.exe
  2⤵
  PID:8792
- C:\Windows\System\vhdwhKr.exe
  C:\Windows\System\vhdwhKr.exe
  2⤵
  PID:8820
- C:\Windows\System\KNmCtIt.exe
  C:\Windows\System\KNmCtIt.exe
  2⤵
  PID:8848
- C:\Windows\System\EYtoAhd.exe
  C:\Windows\System\EYtoAhd.exe
  2⤵
  PID:8876
- C:\Windows\System\sIQSKEZ.exe
  C:\Windows\System\sIQSKEZ.exe
  2⤵
  PID:8904
- C:\Windows\System\ibKgGfD.exe
  C:\Windows\System\ibKgGfD.exe
  2⤵
  PID:8928
- C:\Windows\System\sMdQwpn.exe
  C:\Windows\System\sMdQwpn.exe
  2⤵
  PID:8960
- C:\Windows\System\ckjyvjD.exe
  C:\Windows\System\ckjyvjD.exe
  2⤵
  PID:8988
- C:\Windows\System\tMbBDrh.exe
  C:\Windows\System\tMbBDrh.exe
  2⤵
  PID:9016
- C:\Windows\System\jdNIPGa.exe
  C:\Windows\System\jdNIPGa.exe
  2⤵
  PID:9044
- C:\Windows\System\EvTxVLY.exe
  C:\Windows\System\EvTxVLY.exe
  2⤵
  PID:9072
- C:\Windows\System\ilMWleH.exe
  C:\Windows\System\ilMWleH.exe
  2⤵
  PID:9096
- C:\Windows\System\uWvAMfA.exe
  C:\Windows\System\uWvAMfA.exe
  2⤵
  PID:9116
- C:\Windows\System\OghRyLK.exe
  C:\Windows\System\OghRyLK.exe
  2⤵
  PID:9144
- C:\Windows\System\zGnHbAT.exe
  C:\Windows\System\zGnHbAT.exe
  2⤵
  PID:9172
- C:\Windows\System\sascYZb.exe
  C:\Windows\System\sascYZb.exe
  2⤵
  PID:9200
- C:\Windows\System\TkivzWb.exe
  C:\Windows\System\TkivzWb.exe
  2⤵
  PID:7376
- C:\Windows\System\tGdhoxL.exe
  C:\Windows\System\tGdhoxL.exe
  2⤵
  PID:8256
- C:\Windows\System\zppmNAW.exe
  C:\Windows\System\zppmNAW.exe
  2⤵
  PID:8328
- C:\Windows\System\gGLPWdS.exe
  C:\Windows\System\gGLPWdS.exe
  2⤵
  PID:8360
- C:\Windows\System\ulCxPPH.exe
  C:\Windows\System\ulCxPPH.exe
  2⤵
  PID:8416
- C:\Windows\System\PMQSMkn.exe
  C:\Windows\System\PMQSMkn.exe
  2⤵
  PID:8504
- C:\Windows\System\rKbBYQA.exe
  C:\Windows\System\rKbBYQA.exe
  2⤵
  PID:2920
- C:\Windows\System\HRnJDRF.exe
  C:\Windows\System\HRnJDRF.exe
  2⤵
  PID:4612
- C:\Windows\System\BzVBnKf.exe
  C:\Windows\System\BzVBnKf.exe
  2⤵
  PID:8592
- C:\Windows\System\IUYGqjT.exe
  C:\Windows\System\IUYGqjT.exe
  2⤵
  PID:8692
- C:\Windows\System\FfNFbkO.exe
  C:\Windows\System\FfNFbkO.exe
  2⤵
  PID:8752
- C:\Windows\System\NYQkPRs.exe
  C:\Windows\System\NYQkPRs.exe
  2⤵
  PID:8816
- C:\Windows\System\xDMbVsD.exe
  C:\Windows\System\xDMbVsD.exe
  2⤵
  PID:8872
- C:\Windows\System\CBGJXxw.exe
  C:\Windows\System\CBGJXxw.exe
  2⤵
  PID:8972
- C:\Windows\System\bIAVpzM.exe
  C:\Windows\System\bIAVpzM.exe
  2⤵
  PID:9028
- C:\Windows\System\kPEVSEy.exe
  C:\Windows\System\kPEVSEy.exe
  2⤵
  PID:9056
- C:\Windows\System\clUiyPR.exe
  C:\Windows\System\clUiyPR.exe
  2⤵
  PID:9140
- C:\Windows\System\wmemzYd.exe
  C:\Windows\System\wmemzYd.exe
  2⤵
  PID:9212
- C:\Windows\System\CfIrvig.exe
  C:\Windows\System\CfIrvig.exe
  2⤵
  PID:8232
- C:\Windows\System\DFfMLpj.exe
  C:\Windows\System\DFfMLpj.exe
  2⤵
  PID:8392
- C:\Windows\System\blzCrzu.exe
  C:\Windows\System\blzCrzu.exe
  2⤵
  PID:8552
- C:\Windows\System\THptNvB.exe
  C:\Windows\System\THptNvB.exe
  2⤵
  PID:8580
- C:\Windows\System\nORNljQ.exe
  C:\Windows\System\nORNljQ.exe
  2⤵
  PID:8636
- C:\Windows\System\NOfOUpb.exe
  C:\Windows\System\NOfOUpb.exe
  2⤵
  PID:8784
- C:\Windows\System\oowfdfV.exe
  C:\Windows\System\oowfdfV.exe
  2⤵
  PID:8900
- C:\Windows\System\CIHTHea.exe
  C:\Windows\System\CIHTHea.exe
  2⤵
  PID:9064
- C:\Windows\System\uooGcld.exe
  C:\Windows\System\uooGcld.exe
  2⤵
  PID:8252
- C:\Windows\System\JKbksGb.exe
  C:\Windows\System\JKbksGb.exe
  2⤵
  PID:8340
- C:\Windows\System\wKOAwIG.exe
  C:\Windows\System\wKOAwIG.exe
  2⤵
  PID:8720
- C:\Windows\System\JKOAZHE.exe
  C:\Windows\System\JKOAZHE.exe
  2⤵
  PID:9008
- C:\Windows\System\JcowDpj.exe
  C:\Windows\System\JcowDpj.exe
  2⤵
  PID:9224
- C:\Windows\System\UTnbuck.exe
  C:\Windows\System\UTnbuck.exe
  2⤵
  PID:9256
- C:\Windows\System\icDrKYi.exe
  C:\Windows\System\icDrKYi.exe
  2⤵
  PID:9284
- C:\Windows\System\epaiDhU.exe
  C:\Windows\System\epaiDhU.exe
  2⤵
  PID:9312
- C:\Windows\System\NEDoWuP.exe
  C:\Windows\System\NEDoWuP.exe
  2⤵
  PID:9340
- C:\Windows\System\bCRLqjS.exe
  C:\Windows\System\bCRLqjS.exe
  2⤵
  PID:9372
- C:\Windows\System\RCBuNRK.exe
  C:\Windows\System\RCBuNRK.exe
  2⤵
  PID:9400
- C:\Windows\System\WbqMsWW.exe
  C:\Windows\System\WbqMsWW.exe
  2⤵
  PID:9436
- C:\Windows\System\hsuuUJt.exe
  C:\Windows\System\hsuuUJt.exe
  2⤵
  PID:9472
- C:\Windows\System\rCgagNX.exe
  C:\Windows\System\rCgagNX.exe
  2⤵
  PID:9492
- C:\Windows\System\YevhJlj.exe
  C:\Windows\System\YevhJlj.exe
  2⤵
  PID:9528
- C:\Windows\System\vsubKbt.exe
  C:\Windows\System\vsubKbt.exe
  2⤵
  PID:9560
- C:\Windows\System\gioWPck.exe
  C:\Windows\System\gioWPck.exe
  2⤵
  PID:9592
- C:\Windows\System\PcayiPd.exe
  C:\Windows\System\PcayiPd.exe
  2⤵
  PID:9624
- C:\Windows\System\VGkcvcV.exe
  C:\Windows\System\VGkcvcV.exe
  2⤵
  PID:9656
- C:\Windows\System\gusZBOR.exe
  C:\Windows\System\gusZBOR.exe
  2⤵
  PID:9684
- C:\Windows\System\xUtgoZt.exe
  C:\Windows\System\xUtgoZt.exe
  2⤵
  PID:9700
- C:\Windows\System\IWtRRTD.exe
  C:\Windows\System\IWtRRTD.exe
  2⤵
  PID:9720
- C:\Windows\System\iaGmIdE.exe
  C:\Windows\System\iaGmIdE.exe
  2⤵
  PID:9744
- C:\Windows\System\JvzqlRf.exe
  C:\Windows\System\JvzqlRf.exe
  2⤵
  PID:9784
- C:\Windows\System\Osiivpk.exe
  C:\Windows\System\Osiivpk.exe
  2⤵
  PID:9824
- C:\Windows\System\nRDNlme.exe
  C:\Windows\System\nRDNlme.exe
  2⤵
  PID:9840
- C:\Windows\System\ypsaswy.exe
  C:\Windows\System\ypsaswy.exe
  2⤵
  PID:9868
- C:\Windows\System\TZaEWaQ.exe
  C:\Windows\System\TZaEWaQ.exe
  2⤵
  PID:9888
- C:\Windows\System\dQQEZnf.exe
  C:\Windows\System\dQQEZnf.exe
  2⤵
  PID:9912
- C:\Windows\System\uaRKtMt.exe
  C:\Windows\System\uaRKtMt.exe
  2⤵
  PID:9940
- C:\Windows\System\LOgIXEQ.exe
  C:\Windows\System\LOgIXEQ.exe
  2⤵
  PID:9980
- C:\Windows\System\UTjRGwp.exe
  C:\Windows\System\UTjRGwp.exe
  2⤵
  PID:10020
- C:\Windows\System\LJuRrGJ.exe
  C:\Windows\System\LJuRrGJ.exe
  2⤵
  PID:10048
- C:\Windows\System\PHAbHbB.exe
  C:\Windows\System\PHAbHbB.exe
  2⤵
  PID:10076
- C:\Windows\System\hHWUfKG.exe
  C:\Windows\System\hHWUfKG.exe
  2⤵
  PID:10104
- C:\Windows\System\KtDlthE.exe
  C:\Windows\System\KtDlthE.exe
  2⤵
  PID:10132
- C:\Windows\System\QumbHZe.exe
  C:\Windows\System\QumbHZe.exe
  2⤵
  PID:10160
- C:\Windows\System\NbJUdpi.exe
  C:\Windows\System\NbJUdpi.exe
  2⤵
  PID:10188
- C:\Windows\System\GcWCrxU.exe
  C:\Windows\System\GcWCrxU.exe
  2⤵
  PID:10216
- C:\Windows\System\yzNIwSG.exe
  C:\Windows\System\yzNIwSG.exe
  2⤵
  PID:8300
- C:\Windows\System\OZTpbNM.exe
  C:\Windows\System\OZTpbNM.exe
  2⤵
  PID:9184
- C:\Windows\System\nmjKuES.exe
  C:\Windows\System\nmjKuES.exe
  2⤵
  PID:9324
- C:\Windows\System\RkkWvfh.exe
  C:\Windows\System\RkkWvfh.exe
  2⤵
  PID:9352
- C:\Windows\System\ddYnmdh.exe
  C:\Windows\System\ddYnmdh.exe
  2⤵
  PID:9396
- C:\Windows\System\wzpolRM.exe
  C:\Windows\System\wzpolRM.exe
  2⤵
  PID:9464
- C:\Windows\System\pyVqqrv.exe
  C:\Windows\System\pyVqqrv.exe
  2⤵
  PID:9524
- C:\Windows\System\deLkdHg.exe
  C:\Windows\System\deLkdHg.exe
  2⤵
  PID:9616
- C:\Windows\System\yxsvjmE.exe
  C:\Windows\System\yxsvjmE.exe
  2⤵
  PID:9680
- C:\Windows\System\EEblIIt.exe
  C:\Windows\System\EEblIIt.exe
  2⤵
  PID:9732
- C:\Windows\System\SlknGZm.exe
  C:\Windows\System\SlknGZm.exe
  2⤵
  PID:9772
- C:\Windows\System\UaECBPS.exe
  C:\Windows\System\UaECBPS.exe
  2⤵
  PID:9836
- C:\Windows\System\ipUVAAF.exe
  C:\Windows\System\ipUVAAF.exe
  2⤵
  PID:9900
- C:\Windows\System\EGLUKgo.exe
  C:\Windows\System\EGLUKgo.exe
  2⤵
  PID:9956
- C:\Windows\System\uZegOay.exe
  C:\Windows\System\uZegOay.exe
  2⤵
  PID:10044
- C:\Windows\System\EeVvUgL.exe
  C:\Windows\System\EeVvUgL.exe
  2⤵
  PID:10116
- C:\Windows\System\uhuMctk.exe
  C:\Windows\System\uhuMctk.exe
  2⤵
  PID:10184
- C:\Windows\System\ZydXtrO.exe
  C:\Windows\System\ZydXtrO.exe
  2⤵
  PID:8812
- C:\Windows\System\ennzBoI.exe
  C:\Windows\System\ennzBoI.exe
  2⤵
  PID:9332
- C:\Windows\System\WsPZUiw.exe
  C:\Windows\System\WsPZUiw.exe
  2⤵
  PID:9460
- C:\Windows\System\VbBmHUV.exe
  C:\Windows\System\VbBmHUV.exe
  2⤵
  PID:9588
- C:\Windows\System\fdQhEVF.exe
  C:\Windows\System\fdQhEVF.exe
  2⤵
  PID:9668
- C:\Windows\System\CsvqyTf.exe
  C:\Windows\System\CsvqyTf.exe
  2⤵
  PID:9740
- C:\Windows\System\BmWyBJW.exe
  C:\Windows\System\BmWyBJW.exe
  2⤵
  PID:9876
- C:\Windows\System\QJhzpcK.exe
  C:\Windows\System\QJhzpcK.exe
  2⤵
  PID:10008
- C:\Windows\System\WsaEILW.exe
  C:\Windows\System\WsaEILW.exe
  2⤵
  PID:10096
- C:\Windows\System\wysgRev.exe
  C:\Windows\System\wysgRev.exe
  2⤵
  PID:9308
- C:\Windows\System\jHnBoEb.exe
  C:\Windows\System\jHnBoEb.exe
  2⤵
  PID:9652
- C:\Windows\System\MfegQZA.exe
  C:\Windows\System\MfegQZA.exe
  2⤵
  PID:9860
- C:\Windows\System\xUKpMUR.exe
  C:\Windows\System\xUKpMUR.exe
  2⤵
  PID:9976
- C:\Windows\System\CyjVJSv.exe
  C:\Windows\System\CyjVJSv.exe
  2⤵
  PID:9644
- C:\Windows\System\pmvQcdA.exe
  C:\Windows\System\pmvQcdA.exe
  2⤵
  PID:10264
- C:\Windows\System\vQxHzry.exe
  C:\Windows\System\vQxHzry.exe
  2⤵
  PID:10288
- C:\Windows\System\vQaXffH.exe
  C:\Windows\System\vQaXffH.exe
  2⤵
  PID:10320
- C:\Windows\System\SLcbnEt.exe
  C:\Windows\System\SLcbnEt.exe
  2⤵
  PID:10348
- C:\Windows\System\mHXdYJt.exe
  C:\Windows\System\mHXdYJt.exe
  2⤵
  PID:10388
- C:\Windows\System\duaYMmw.exe
  C:\Windows\System\duaYMmw.exe
  2⤵
  PID:10420
- C:\Windows\System\MLQZkRv.exe
  C:\Windows\System\MLQZkRv.exe
  2⤵
  PID:10448
- C:\Windows\System\gLDzPUE.exe
  C:\Windows\System\gLDzPUE.exe
  2⤵
  PID:10476
- C:\Windows\System\MpvYHeW.exe
  C:\Windows\System\MpvYHeW.exe
  2⤵
  PID:10496
- C:\Windows\System\TzFDaZj.exe
  C:\Windows\System\TzFDaZj.exe
  2⤵
  PID:10524
- C:\Windows\System\YAJhGyz.exe
  C:\Windows\System\YAJhGyz.exe
  2⤵
  PID:10556
- C:\Windows\System\JAmAnuI.exe
  C:\Windows\System\JAmAnuI.exe
  2⤵
  PID:10584
- C:\Windows\System\UdKgQMy.exe
  C:\Windows\System\UdKgQMy.exe
  2⤵
  PID:10612
- C:\Windows\System\TdjVuqE.exe
  C:\Windows\System\TdjVuqE.exe
  2⤵
  PID:10632
- C:\Windows\System\yWfVeck.exe
  C:\Windows\System\yWfVeck.exe
  2⤵
  PID:10656
- C:\Windows\System\LQupSrY.exe
  C:\Windows\System\LQupSrY.exe
  2⤵
  PID:10688
- C:\Windows\System\LgHJRxX.exe
  C:\Windows\System\LgHJRxX.exe
  2⤵
  PID:10720
- C:\Windows\System\SLNuzwp.exe
  C:\Windows\System\SLNuzwp.exe
  2⤵
  PID:10748
- C:\Windows\System\MvBGFvd.exe
  C:\Windows\System\MvBGFvd.exe
  2⤵
  PID:10772
- C:\Windows\System\CwZdLTn.exe
  C:\Windows\System\CwZdLTn.exe
  2⤵
  PID:10796
- C:\Windows\System\yfxBLit.exe
  C:\Windows\System\yfxBLit.exe
  2⤵
  PID:10828
- C:\Windows\System\lyRTiGd.exe
  C:\Windows\System\lyRTiGd.exe
  2⤵
  PID:10856
- C:\Windows\System\nJvHXoq.exe
  C:\Windows\System\nJvHXoq.exe
  2⤵
  PID:10876
- C:\Windows\System\hveGLew.exe
  C:\Windows\System\hveGLew.exe
  2⤵
  PID:10904
- C:\Windows\System\ynnYjKD.exe
  C:\Windows\System\ynnYjKD.exe
  2⤵
  PID:10924
- C:\Windows\System\UPSnbmK.exe
  C:\Windows\System\UPSnbmK.exe
  2⤵
  PID:10956
- C:\Windows\System\YjsyYrm.exe
  C:\Windows\System\YjsyYrm.exe
  2⤵
  PID:10980
- C:\Windows\System\TdCTjvf.exe
  C:\Windows\System\TdCTjvf.exe
  2⤵
  PID:11008
- C:\Windows\System\bieeUQm.exe
  C:\Windows\System\bieeUQm.exe
  2⤵
  PID:11036
- C:\Windows\System\jRJwMjK.exe
  C:\Windows\System\jRJwMjK.exe
  2⤵
  PID:11068
- C:\Windows\System\rXFpBRX.exe
  C:\Windows\System\rXFpBRX.exe
  2⤵
  PID:11088
- C:\Windows\System\DgNEWBN.exe
  C:\Windows\System\DgNEWBN.exe
  2⤵
  PID:11116
- C:\Windows\System\awBCvxC.exe
  C:\Windows\System\awBCvxC.exe
  2⤵
  PID:11220
- C:\Windows\System\yyKCVKf.exe
  C:\Windows\System\yyKCVKf.exe
  2⤵
  PID:11240
- C:\Windows\System\nVfkoSe.exe
  C:\Windows\System\nVfkoSe.exe
  2⤵
  PID:9448
- C:\Windows\System\tgYvIqY.exe
  C:\Windows\System\tgYvIqY.exe
  2⤵
  PID:9484
- C:\Windows\System\YAOxZHq.exe
  C:\Windows\System\YAOxZHq.exe
  2⤵
  PID:10336
- C:\Windows\System\BWEtTvv.exe
  C:\Windows\System\BWEtTvv.exe
  2⤵
  PID:10368
- C:\Windows\System\JADBUlq.exe
  C:\Windows\System\JADBUlq.exe
  2⤵
  PID:10444
- C:\Windows\System\pHqLdTW.exe
  C:\Windows\System\pHqLdTW.exe
  2⤵
  PID:10472
- C:\Windows\System\TsziMEm.exe
  C:\Windows\System\TsziMEm.exe
  2⤵
  PID:10600
- C:\Windows\System\AfYXCYn.exe
  C:\Windows\System\AfYXCYn.exe
  2⤵
  PID:10572
- C:\Windows\System\EPXWlJm.exe
  C:\Windows\System\EPXWlJm.exe
  2⤵
  PID:10712
- C:\Windows\System\msYNSon.exe
  C:\Windows\System\msYNSon.exe
  2⤵
  PID:1528
- C:\Windows\System\HdrMzFa.exe
  C:\Windows\System\HdrMzFa.exe
  2⤵
  PID:10788
- C:\Windows\System\fDZyDkP.exe
  C:\Windows\System\fDZyDkP.exe
  2⤵
  PID:10848
- C:\Windows\System\ZATCFwm.exe
  C:\Windows\System\ZATCFwm.exe
  2⤵
  PID:11064
- C:\Windows\System\adjqttf.exe
  C:\Windows\System\adjqttf.exe
  2⤵
  PID:10948
- C:\Windows\System\aBQxObG.exe
  C:\Windows\System\aBQxObG.exe
  2⤵
  PID:11044
- C:\Windows\System\bpnNeZu.exe
  C:\Windows\System\bpnNeZu.exe
  2⤵
  PID:11192
- C:\Windows\System\WsFnHGR.exe
  C:\Windows\System\WsFnHGR.exe
  2⤵
  PID:11080
- C:\Windows\System\xCswQiD.exe
  C:\Windows\System\xCswQiD.exe
  2⤵
  PID:7840
- C:\Windows\System\RpQOmIM.exe
  C:\Windows\System\RpQOmIM.exe
  2⤵
  PID:10428
- C:\Windows\System\glbzcDX.exe
  C:\Windows\System\glbzcDX.exe
  2⤵
  PID:10440
- C:\Windows\System\ukkvuhZ.exe
  C:\Windows\System\ukkvuhZ.exe
  2⤵
  PID:10700
- C:\Windows\System\cBdecyE.exe
  C:\Windows\System\cBdecyE.exe
  2⤵
  PID:10844
- C:\Windows\System\TGSCEMY.exe
  C:\Windows\System\TGSCEMY.exe
  2⤵
  PID:10936
- C:\Windows\System\aMMdBll.exe
  C:\Windows\System\aMMdBll.exe
  2⤵
  PID:11096
- C:\Windows\System\cLXTDKs.exe
  C:\Windows\System\cLXTDKs.exe
  2⤵
  PID:10488
- C:\Windows\System\qEOeMaJ.exe
  C:\Windows\System\qEOeMaJ.exe
  2⤵
  PID:10520
- C:\Windows\System\JeNYegC.exe
  C:\Windows\System\JeNYegC.exe
  2⤵
  PID:11056
- C:\Windows\System\sbUnvoQ.exe
  C:\Windows\System\sbUnvoQ.exe
  2⤵
  PID:10308
- C:\Windows\System\hiMnCqR.exe
  C:\Windows\System\hiMnCqR.exe
  2⤵
  PID:11288
- C:\Windows\System\hMKzgKX.exe
  C:\Windows\System\hMKzgKX.exe
  2⤵
  PID:11312
- C:\Windows\System\GbVKiAq.exe
  C:\Windows\System\GbVKiAq.exe
  2⤵
  PID:11332
- C:\Windows\System\DTshFlH.exe
  C:\Windows\System\DTshFlH.exe
  2⤵
  PID:11348
- C:\Windows\System\SjfOoVw.exe
  C:\Windows\System\SjfOoVw.exe
  2⤵
  PID:11372
- C:\Windows\System\vVXlZgH.exe
  C:\Windows\System\vVXlZgH.exe
  2⤵
  PID:11404
- C:\Windows\System\CmNrwUP.exe
  C:\Windows\System\CmNrwUP.exe
  2⤵
  PID:11440
- C:\Windows\System\pxFrgDz.exe
  C:\Windows\System\pxFrgDz.exe
  2⤵
  PID:11472
- C:\Windows\System\vGfFSha.exe
  C:\Windows\System\vGfFSha.exe
  2⤵
  PID:11508
- C:\Windows\System\XOSwBMx.exe
  C:\Windows\System\XOSwBMx.exe
  2⤵
  PID:11536
- C:\Windows\System\pCtviYu.exe
  C:\Windows\System\pCtviYu.exe
  2⤵
  PID:11564
- C:\Windows\System\yEyqQXr.exe
  C:\Windows\System\yEyqQXr.exe
  2⤵
  PID:11588
- C:\Windows\System\xZAbJBM.exe
  C:\Windows\System\xZAbJBM.exe
  2⤵
  PID:11624
- C:\Windows\System\fWntSFm.exe
  C:\Windows\System\fWntSFm.exe
  2⤵
  PID:11652
- C:\Windows\System\GikGLgq.exe
  C:\Windows\System\GikGLgq.exe
  2⤵
  PID:11676
- C:\Windows\System\XguShed.exe
  C:\Windows\System\XguShed.exe
  2⤵
  PID:11720
- C:\Windows\System\yshveSR.exe
  C:\Windows\System\yshveSR.exe
  2⤵
  PID:11748
- C:\Windows\System\vupFmRB.exe
  C:\Windows\System\vupFmRB.exe
  2⤵
  PID:11784
- C:\Windows\System\tBSxMmS.exe
  C:\Windows\System\tBSxMmS.exe
  2⤵
  PID:11816
- C:\Windows\System\XMQIKdD.exe
  C:\Windows\System\XMQIKdD.exe
  2⤵
  PID:11844
- C:\Windows\System\ApanbSu.exe
  C:\Windows\System\ApanbSu.exe
  2⤵
  PID:11884
- C:\Windows\System\FDEXPaV.exe
  C:\Windows\System\FDEXPaV.exe
  2⤵
  PID:11912
- C:\Windows\System\fGeRIsW.exe
  C:\Windows\System\fGeRIsW.exe
  2⤵
  PID:11940
- C:\Windows\System\RCumxje.exe
  C:\Windows\System\RCumxje.exe
  2⤵
  PID:11968
- C:\Windows\System\nznEXQM.exe
  C:\Windows\System\nznEXQM.exe
  2⤵
  PID:11996
- C:\Windows\System\GsCKcKg.exe
  C:\Windows\System\GsCKcKg.exe
  2⤵
  PID:12012
- C:\Windows\System\MPwMaej.exe
  C:\Windows\System\MPwMaej.exe
  2⤵
  PID:12040
- C:\Windows\System\XIFVNCq.exe
  C:\Windows\System\XIFVNCq.exe
  2⤵
  PID:12068
- C:\Windows\System\zsYuxAM.exe
  C:\Windows\System\zsYuxAM.exe
  2⤵
  PID:12096
- C:\Windows\System\rxcQYGi.exe
  C:\Windows\System\rxcQYGi.exe
  2⤵
  PID:12124
- C:\Windows\System\ABayOBd.exe
  C:\Windows\System\ABayOBd.exe
  2⤵
  PID:12160
- C:\Windows\System\mIFAnnk.exe
  C:\Windows\System\mIFAnnk.exe
  2⤵
  PID:12180
- C:\Windows\System\ndthkVf.exe
  C:\Windows\System\ndthkVf.exe
  2⤵
  PID:12200
- C:\Windows\System\bwfIjPe.exe
  C:\Windows\System\bwfIjPe.exe
  2⤵
  PID:12236
- C:\Windows\System\cPfRTjg.exe
  C:\Windows\System\cPfRTjg.exe
  2⤵
  PID:12264
- C:\Windows\System\GmPpnpr.exe
  C:\Windows\System\GmPpnpr.exe
  2⤵
  PID:11212
- C:\Windows\System\NbCEIQJ.exe
  C:\Windows\System\NbCEIQJ.exe
  2⤵
  PID:11340
- C:\Windows\System\qOhiLYi.exe
  C:\Windows\System\qOhiLYi.exe
  2⤵
  PID:11328
- C:\Windows\System\SBYWEhp.exe
  C:\Windows\System\SBYWEhp.exe
  2⤵
  PID:11364
- C:\Windows\System\yyayNDa.exe
  C:\Windows\System\yyayNDa.exe
  2⤵
  PID:11456
- C:\Windows\System\myOQBIj.exe
  C:\Windows\System\myOQBIj.exe
  2⤵
  PID:11504
- C:\Windows\System\OWecvrW.exe
  C:\Windows\System\OWecvrW.exe
  2⤵
  PID:11532
- C:\Windows\System\flSZNPA.exe
  C:\Windows\System\flSZNPA.exe
  2⤵
  PID:11620
- C:\Windows\System\mGgFDGo.exe
  C:\Windows\System\mGgFDGo.exe
  2⤵
  PID:11664
- C:\Windows\System\iuZWqzj.exe
  C:\Windows\System\iuZWqzj.exe
  2⤵
  PID:11740
- C:\Windows\System\qVuxgmm.exe
  C:\Windows\System\qVuxgmm.exe
  2⤵
  PID:11768
- C:\Windows\System\mmQPfSu.exe
  C:\Windows\System\mmQPfSu.exe
  2⤵
  PID:11868
- C:\Windows\System\KdBanhq.exe
  C:\Windows\System\KdBanhq.exe
  2⤵
  PID:11876
- C:\Windows\System\tTkxlES.exe
  C:\Windows\System\tTkxlES.exe
  2⤵
  PID:11952
- C:\Windows\System\LlKYPRF.exe
  C:\Windows\System\LlKYPRF.exe
  2⤵
  PID:12028
- C:\Windows\System\NkvGEeS.exe
  C:\Windows\System\NkvGEeS.exe
  2⤵
  PID:12092
- C:\Windows\System\TztNCoD.exe
  C:\Windows\System\TztNCoD.exe
  2⤵
  PID:12168
- C:\Windows\System\AxUgFlg.exe
  C:\Windows\System\AxUgFlg.exe
  2⤵
  PID:12216
- C:\Windows\System\TCurlvR.exe
  C:\Windows\System\TCurlvR.exe
  2⤵
  PID:11272
- C:\Windows\System\HqueFNz.exe
  C:\Windows\System\HqueFNz.exe
  2⤵
  PID:11416
- C:\Windows\System\oDnotDh.exe
  C:\Windows\System\oDnotDh.exe
  2⤵
  PID:11596
- C:\Windows\System\YBIXkFM.exe
  C:\Windows\System\YBIXkFM.exe
  2⤵
  PID:11756
- C:\Windows\System\YliyJKa.exe
  C:\Windows\System\YliyJKa.exe
  2⤵
  PID:11928
- C:\Windows\System\QGZKrEy.exe
  C:\Windows\System\QGZKrEy.exe
  2⤵
  PID:11908
- C:\Windows\System\HPolGdS.exe
  C:\Windows\System\HPolGdS.exe
  2⤵
  PID:12196
- C:\Windows\System\sOCNGyi.exe
  C:\Windows\System\sOCNGyi.exe
  2⤵
  PID:11496
- C:\Windows\System\PmEbgRq.exe
  C:\Windows\System\PmEbgRq.exe
  2⤵
  PID:11728
- C:\Windows\System\SycRlTo.exe
  C:\Windows\System\SycRlTo.exe
  2⤵
  PID:12060
- C:\Windows\System\llSHFEV.exe
  C:\Windows\System\llSHFEV.exe
  2⤵
  PID:12308
- C:\Windows\System\gAGsqnZ.exe
  C:\Windows\System\gAGsqnZ.exe
  2⤵
  PID:12332
- C:\Windows\System\micGCqg.exe
  C:\Windows\System\micGCqg.exe
  2⤵
  PID:12356
- C:\Windows\System\pQeTbcQ.exe
  C:\Windows\System\pQeTbcQ.exe
  2⤵
  PID:12388
- C:\Windows\System\iwLKsGC.exe
  C:\Windows\System\iwLKsGC.exe
  2⤵
  PID:12424
- C:\Windows\System\rhItFku.exe
  C:\Windows\System\rhItFku.exe
  2⤵
  PID:12464
- C:\Windows\System\JEXiBPQ.exe
  C:\Windows\System\JEXiBPQ.exe
  2⤵
  PID:12492
- C:\Windows\System\vSkQiio.exe
  C:\Windows\System\vSkQiio.exe
  2⤵
  PID:12532
- C:\Windows\System\XSKWPJO.exe
  C:\Windows\System\XSKWPJO.exe
  2⤵
  PID:12568
- C:\Windows\System\VQqbdcl.exe
  C:\Windows\System\VQqbdcl.exe
  2⤵
  PID:12584
- C:\Windows\System\HdyJvhj.exe
  C:\Windows\System\HdyJvhj.exe
  2⤵
  PID:12612
- C:\Windows\System\HPhubkz.exe
  C:\Windows\System\HPhubkz.exe
  2⤵
  PID:12640
- C:\Windows\System\ylTLfAi.exe
  C:\Windows\System\ylTLfAi.exe
  2⤵
  PID:12668
- C:\Windows\System\YFWWodt.exe
  C:\Windows\System\YFWWodt.exe
  2⤵
  PID:12708
- C:\Windows\System\FhssbaP.exe
  C:\Windows\System\FhssbaP.exe
  2⤵
  PID:12736
- C:\Windows\System\pvmDoaR.exe
  C:\Windows\System\pvmDoaR.exe
  2⤵
  PID:12768
- C:\Windows\System\ptGztXW.exe
  C:\Windows\System\ptGztXW.exe
  2⤵
  PID:12800
- C:\Windows\System\yIQvvKZ.exe
  C:\Windows\System\yIQvvKZ.exe
  2⤵
  PID:12820
- C:\Windows\System\lDgmbse.exe
  C:\Windows\System\lDgmbse.exe
  2⤵
  PID:12860
- C:\Windows\System\VardwMm.exe
  C:\Windows\System\VardwMm.exe
  2⤵
  PID:12900
- C:\Windows\System\IiwUvVG.exe
  C:\Windows\System\IiwUvVG.exe
  2⤵
  PID:12932
- C:\Windows\System\hiqrILD.exe
  C:\Windows\System\hiqrILD.exe
  2⤵
  PID:12960
- C:\Windows\System\nXIfFpv.exe
  C:\Windows\System\nXIfFpv.exe
  2⤵
  PID:12988
- C:\Windows\System\viYgyQO.exe
  C:\Windows\System\viYgyQO.exe
  2⤵
  PID:13012
- C:\Windows\System\alCegGl.exe
  C:\Windows\System\alCegGl.exe
  2⤵
  PID:13032
- C:\Windows\System\ECTrVQs.exe
  C:\Windows\System\ECTrVQs.exe
  2⤵
  PID:13060
- C:\Windows\System\VEBKNWY.exe
  C:\Windows\System\VEBKNWY.exe
  2⤵
  PID:13096
- C:\Windows\System\zvscYeg.exe
  C:\Windows\System\zvscYeg.exe
  2⤵
  PID:13124
- C:\Windows\System\eNhcZmt.exe
  C:\Windows\System\eNhcZmt.exe
  2⤵
  PID:13144
- C:\Windows\System\rwCvSPq.exe
  C:\Windows\System\rwCvSPq.exe
  2⤵
  PID:13184
- C:\Windows\System\fiLHbJt.exe
  C:\Windows\System\fiLHbJt.exe
  2⤵
  PID:13200
- C:\Windows\System\GqHQyxi.exe
  C:\Windows\System\GqHQyxi.exe
  2⤵
  PID:13220
- C:\Windows\System\qOvEVQb.exe
  C:\Windows\System\qOvEVQb.exe
  2⤵
  PID:13256
- C:\Windows\System\ykiTobq.exe
  C:\Windows\System\ykiTobq.exe
  2⤵
  PID:13284
- C:\Windows\System\pyYNTCq.exe
  C:\Windows\System\pyYNTCq.exe
  2⤵
  PID:12032
- C:\Windows\System\spnBWBz.exe
  C:\Windows\System\spnBWBz.exe
  2⤵
  PID:11360
- C:\Windows\System\RApDYry.exe
  C:\Windows\System\RApDYry.exe
  2⤵
  PID:12340
- C:\Windows\System\MxMTtUx.exe
  C:\Windows\System\MxMTtUx.exe
  2⤵
  PID:12400
- C:\Windows\System\vCnUwQO.exe
  C:\Windows\System\vCnUwQO.exe
  2⤵
  PID:12448
- C:\Windows\System\ggnJpDj.exe
  C:\Windows\System\ggnJpDj.exe
  2⤵
  PID:12484
- C:\Windows\System\NNLECUV.exe
  C:\Windows\System\NNLECUV.exe
  2⤵
  PID:12564
- C:\Windows\System\yeiybbD.exe
  C:\Windows\System\yeiybbD.exe
  2⤵
  PID:12600
- C:\Windows\System\pkABxly.exe
  C:\Windows\System\pkABxly.exe
  2⤵
  PID:12692
- C:\Windows\System\ZhUIrzb.exe
  C:\Windows\System\ZhUIrzb.exe
  2⤵
  PID:12752
- C:\Windows\System\zixANac.exe
  C:\Windows\System\zixANac.exe
  2⤵
  PID:12812
- C:\Windows\System\uETTjCo.exe
  C:\Windows\System\uETTjCo.exe
  2⤵
  PID:12884
- C:\Windows\System\FKnbnDs.exe
  C:\Windows\System\FKnbnDs.exe
  2⤵
  PID:12956
- C:\Windows\System\wwIttuc.exe
  C:\Windows\System\wwIttuc.exe
  2⤵
  PID:13020
- C:\Windows\System\fnXXebt.exe
  C:\Windows\System\fnXXebt.exe
  2⤵
  PID:13092
- C:\Windows\System\pglmTSu.exe
  C:\Windows\System\pglmTSu.exe
  2⤵
  PID:13168
- C:\Windows\System\OHrjNeb.exe
  C:\Windows\System\OHrjNeb.exe
  2⤵
  PID:13216
- C:\Windows\System\CyLABju.exe
  C:\Windows\System\CyLABju.exe
  2⤵
  PID:13296
- C:\Windows\System\sZjGkKy.exe
  C:\Windows\System\sZjGkKy.exe
  2⤵
  PID:12456
- C:\Windows\System\kKVQeOM.exe
  C:\Windows\System\kKVQeOM.exe
  2⤵
  PID:12560
- C:\Windows\System\ZrAgrXa.exe
  C:\Windows\System\ZrAgrXa.exe
  2⤵
  PID:12680
- C:\Windows\System\VxowXux.exe
  C:\Windows\System\VxowXux.exe
  2⤵
  PID:12872
- C:\Windows\System\jwfGyYL.exe
  C:\Windows\System\jwfGyYL.exe
  2⤵
  PID:13072
- C:\Windows\System\mbFJtQm.exe
  C:\Windows\System\mbFJtQm.exe
  2⤵
  PID:13208
- C:\Windows\System\NEmGuLU.exe
  C:\Windows\System\NEmGuLU.exe
  2⤵
  PID:12352
- C:\Windows\System\SdOeNdl.exe
  C:\Windows\System\SdOeNdl.exe
  2⤵
  PID:12928
- C:\Windows\System\sbVswce.exe
  C:\Windows\System\sbVswce.exe
  2⤵
  PID:13180
- C:\Windows\System\tvYYoPo.exe
  C:\Windows\System\tvYYoPo.exe
  2⤵
  PID:13320
- C:\Windows\System\hibleHu.exe
  C:\Windows\System\hibleHu.exe
  2⤵
  PID:13344
- C:\Windows\System\fLrAClR.exe
  C:\Windows\System\fLrAClR.exe
  2⤵
  PID:13380
- C:\Windows\System\wXdDvyK.exe
  C:\Windows\System\wXdDvyK.exe
  2⤵
  PID:13408
- C:\Windows\System\rklrDDj.exe
  C:\Windows\System\rklrDDj.exe
  2⤵
  PID:13440
- C:\Windows\System\MqwUMDV.exe
  C:\Windows\System\MqwUMDV.exe
  2⤵
  PID:13456
- C:\Windows\System\BcuFgpQ.exe
  C:\Windows\System\BcuFgpQ.exe
  2⤵
  PID:13488
- C:\Windows\System\iWTkStQ.exe
  C:\Windows\System\iWTkStQ.exe
  2⤵
  PID:13512
- C:\Windows\System\tejlBEY.exe
  C:\Windows\System\tejlBEY.exe
  2⤵
  PID:13536
- C:\Windows\System\KhjsLNH.exe
  C:\Windows\System\KhjsLNH.exe
  2⤵
  PID:13556
- C:\Windows\System\CHXGqPH.exe
  C:\Windows\System\CHXGqPH.exe
  2⤵
  PID:13580
- C:\Windows\System\rnWSCwd.exe
  C:\Windows\System\rnWSCwd.exe
  2⤵
  PID:13608
- C:\Windows\System\vOSYipy.exe
  C:\Windows\System\vOSYipy.exe
  2⤵
  PID:13632
- C:\Windows\System\pXCuRba.exe
  C:\Windows\System\pXCuRba.exe
  2⤵
  PID:13664
- C:\Windows\System\vbERdow.exe
  C:\Windows\System\vbERdow.exe
  2⤵
  PID:13700
- C:\Windows\System\xMgFgoD.exe
  C:\Windows\System\xMgFgoD.exe
  2⤵
  PID:13732
- C:\Windows\System\spjBKLv.exe
  C:\Windows\System\spjBKLv.exe
  2⤵
  PID:13752
- C:\Windows\System\mEfpJDm.exe
  C:\Windows\System\mEfpJDm.exe
  2⤵
  PID:13772
- C:\Windows\System\bRayyYO.exe
  C:\Windows\System\bRayyYO.exe
  2⤵
  PID:13792
- C:\Windows\System\NmKkvaD.exe
  C:\Windows\System\NmKkvaD.exe
  2⤵
  PID:13816
- C:\Windows\System\uxbyyGU.exe
  C:\Windows\System\uxbyyGU.exe
  2⤵
  PID:13840
- C:\Windows\System\BstufvR.exe
  C:\Windows\System\BstufvR.exe
  2⤵
  PID:13872
- C:\Windows\System\zpLszHa.exe
  C:\Windows\System\zpLszHa.exe
  2⤵
  PID:13904
- C:\Windows\System\MJoyiFp.exe
  C:\Windows\System\MJoyiFp.exe
  2⤵
  PID:13936
- C:\Windows\System\ImNvtsB.exe
  C:\Windows\System\ImNvtsB.exe
  2⤵
  PID:13964
- C:\Windows\System\BdhNMXG.exe
  C:\Windows\System\BdhNMXG.exe
  2⤵
  PID:13992
- C:\Windows\System\zzfNTUZ.exe
  C:\Windows\System\zzfNTUZ.exe
  2⤵
  PID:14024
- C:\Windows\System\hfppnhg.exe
  C:\Windows\System\hfppnhg.exe
  2⤵
  PID:14052
- C:\Windows\System\sLgcAue.exe
  C:\Windows\System\sLgcAue.exe
  2⤵
  PID:14072
- C:\Windows\System\ZWqSyEA.exe
  C:\Windows\System\ZWqSyEA.exe
  2⤵
  PID:14096
- C:\Windows\System\AFDQCcZ.exe
  C:\Windows\System\AFDQCcZ.exe
  2⤵
  PID:14116
- C:\Windows\System\BQepnBK.exe
  C:\Windows\System\BQepnBK.exe
  2⤵
  PID:14148
- C:\Windows\System\VnHwavR.exe
  C:\Windows\System\VnHwavR.exe
  2⤵
  PID:14180
- C:\Windows\System\WcqdsuC.exe
  C:\Windows\System\WcqdsuC.exe
  2⤵
  PID:14208
- C:\Windows\System\rXgoApm.exe
  C:\Windows\System\rXgoApm.exe
  2⤵
  PID:14240
- C:\Windows\System\cUcALWH.exe
  C:\Windows\System\cUcALWH.exe
  2⤵
  PID:14268
- C:\Windows\System\xIUTWFH.exe
  C:\Windows\System\xIUTWFH.exe
  2⤵
  PID:14292
- C:\Windows\System\Eswpbiw.exe
  C:\Windows\System\Eswpbiw.exe
  2⤵
  PID:14308
- C:\Windows\System\FTiRFty.exe
  C:\Windows\System\FTiRFty.exe
  2⤵
  PID:12372
- C:\Windows\System\gyDDiBn.exe
  C:\Windows\System\gyDDiBn.exe
  2⤵
  PID:13164
- C:\Windows\System\ZSQDhNt.exe
  C:\Windows\System\ZSQDhNt.exe
  2⤵
  PID:13372
- C:\Windows\System\kLewPsg.exe
  C:\Windows\System\kLewPsg.exe
  2⤵
  PID:13420
- C:\Windows\System\uwjuUnP.exe
  C:\Windows\System\uwjuUnP.exe
  2⤵
  PID:13452
- C:\Windows\System\hXaRmuR.exe
  C:\Windows\System\hXaRmuR.exe
  2⤵
  PID:13548
- C:\Windows\System\qDmRCsh.exe
  C:\Windows\System\qDmRCsh.exe
  2⤵
  PID:13568
- C:\Windows\System\iSUmrcz.exe
  C:\Windows\System\iSUmrcz.exe
  2⤵
  PID:13604
- C:\Windows\System\IQNjYYa.exe
  C:\Windows\System\IQNjYYa.exe
  2⤵
  PID:13708
- C:\Windows\System\ArTOVuv.exe
  C:\Windows\System\ArTOVuv.exe
  2⤵
  PID:13740
- C:\Windows\System\DQzQHWi.exe
  C:\Windows\System\DQzQHWi.exe
  2⤵
  PID:13860
- C:\Windows\System\ksKbgDp.exe
  C:\Windows\System\ksKbgDp.exe
  2⤵
  PID:13920
- C:\Windows\System\ivKxwdY.exe
  C:\Windows\System\ivKxwdY.exe
  2⤵
  PID:13916
- C:\Windows\System\mPAIFaN.exe
  C:\Windows\System\mPAIFaN.exe
  2⤵
  PID:14060
- C:\Windows\System\BFeubnY.exe
  C:\Windows\System\BFeubnY.exe
  2⤵
  PID:14068
- C:\Windows\System\CxQRDkp.exe
  C:\Windows\System\CxQRDkp.exe
  2⤵
  PID:14136
- C:\Windows\System\sLfOWZW.exe
  C:\Windows\System\sLfOWZW.exe
  2⤵
  PID:14108
- C:\Windows\System\UxpJMvs.exe
  C:\Windows\System\UxpJMvs.exe
  2⤵
  PID:14288
- C:\Windows\System\GpdlDco.exe
  C:\Windows\System\GpdlDco.exe
  2⤵
  PID:13364
- C:\Windows\System\bpnzrDJ.exe
  C:\Windows\System\bpnzrDJ.exe
  2⤵
  PID:14300
- C:\Windows\System\DNjbilp.exe
  C:\Windows\System\DNjbilp.exe
  2⤵
  PID:13572
- C:\Windows\System\iflIjya.exe
  C:\Windows\System\iflIjya.exe
  2⤵
  PID:13468
- C:\Windows\System\YKGRviy.exe
  C:\Windows\System\YKGRviy.exe
  2⤵
  PID:13724
- C:\Windows\System\gzAaelz.exe
  C:\Windows\System\gzAaelz.exe
  2⤵
  PID:14168
- C:\Windows\System\hbbaXvA.exe
  C:\Windows\System\hbbaXvA.exe
  2⤵
  PID:14004
- C:\Windows\System\hhewtHY.exe
  C:\Windows\System\hhewtHY.exe
  2⤵
  PID:14280
- C:\Windows\System\jkNjiKc.exe
  C:\Windows\System\jkNjiKc.exe
  2⤵
  PID:14160
- C:\Windows\System\WqnutIc.exe
  C:\Windows\System\WqnutIc.exe
  2⤵
  PID:14200
- C:\Windows\System\cWnNwKo.exe
  C:\Windows\System\cWnNwKo.exe
  2⤵
  PID:14364
- C:\Windows\System\hkYDpIk.exe
  C:\Windows\System\hkYDpIk.exe
  2⤵
  PID:14384
- C:\Windows\System\WNBUOGY.exe
  C:\Windows\System\WNBUOGY.exe
  2⤵
  PID:14424
- C:\Windows\System\UOXneaj.exe
  C:\Windows\System\UOXneaj.exe
  2⤵
  PID:14444
- C:\Windows\System\jCgnRPj.exe
  C:\Windows\System\jCgnRPj.exe
  2⤵
  PID:14472
- C:\Windows\System\kIEtZkk.exe
  C:\Windows\System\kIEtZkk.exe
  2⤵
  PID:14500
- C:\Windows\System\RrdMgyq.exe
  C:\Windows\System\RrdMgyq.exe
  2⤵
  PID:14536
- C:\Windows\System\euMxvWZ.exe
  C:\Windows\System\euMxvWZ.exe
  2⤵
  PID:14568
- C:\Windows\System\qVfavnl.exe
  C:\Windows\System\qVfavnl.exe
  2⤵
  PID:14600
- C:\Windows\System\AiRawoC.exe
  C:\Windows\System\AiRawoC.exe
  2⤵
  PID:14624
- C:\Windows\System\xVDqgWK.exe
  C:\Windows\System\xVDqgWK.exe
  2⤵
  PID:14644
- C:\Windows\System\wBwcCbJ.exe
  C:\Windows\System\wBwcCbJ.exe
  2⤵
  PID:14672
- C:\Windows\System\ZWWoeqh.exe
  C:\Windows\System\ZWWoeqh.exe
  2⤵
  PID:14704
- C:\Windows\System\nwOyrnr.exe
  C:\Windows\System\nwOyrnr.exe
  2⤵
  PID:14732
- C:\Windows\System\yLaHUaN.exe
  C:\Windows\System\yLaHUaN.exe
  2⤵
  PID:14756
- C:\Windows\System\vxNQdXw.exe
  C:\Windows\System\vxNQdXw.exe
  2⤵
  PID:14776
- C:\Windows\System\BFCPypC.exe
  C:\Windows\System\BFCPypC.exe
  2⤵
  PID:14808
- C:\Windows\System\itMByWp.exe
  C:\Windows\System\itMByWp.exe
  2⤵
  PID:14840
- C:\Windows\System\SUTbCNR.exe
  C:\Windows\System\SUTbCNR.exe
  2⤵
  PID:14864
- C:\Windows\System\qvErisE.exe
  C:\Windows\System\qvErisE.exe
  2⤵
  PID:14892
- C:\Windows\System\KYGkFkf.exe
  C:\Windows\System\KYGkFkf.exe
  2⤵
  PID:14920
- C:\Windows\System\sBeTmgC.exe
  C:\Windows\System\sBeTmgC.exe
  2⤵
  PID:14944
- C:\Windows\System\NlGIWvE.exe
  C:\Windows\System\NlGIWvE.exe
  2⤵
  PID:14964
- C:\Windows\System\nICtlUV.exe
  C:\Windows\System\nICtlUV.exe
  2⤵
  PID:15004
- C:\Windows\System\CuKkIjT.exe
  C:\Windows\System\CuKkIjT.exe
  2⤵
  PID:15032
- C:\Windows\System\GdCRdmL.exe
  C:\Windows\System\GdCRdmL.exe
  2⤵
  PID:15060
- C:\Windows\System\PYGHRkE.exe
  C:\Windows\System\PYGHRkE.exe
  2⤵
  PID:15092
- C:\Windows\System\PIVTeWJ.exe
  C:\Windows\System\PIVTeWJ.exe
  2⤵
  PID:15120
- C:\Windows\System\OrxUgXf.exe
  C:\Windows\System\OrxUgXf.exe
  2⤵
  PID:15140
- C:\Windows\System\sIjAqGG.exe
  C:\Windows\System\sIjAqGG.exe
  2⤵
  PID:15172
- C:\Windows\System\MlrlGYk.exe
  C:\Windows\System\MlrlGYk.exe
  2⤵
  PID:15208
- C:\Windows\System\oneFOnZ.exe
  C:\Windows\System\oneFOnZ.exe
  2⤵
  PID:15224
- C:\Windows\System\zqevvMM.exe
  C:\Windows\System\zqevvMM.exe
  2⤵
  PID:15252
- C:\Windows\System\IwAYENL.exe
  C:\Windows\System\IwAYENL.exe
  2⤵
  PID:15280
- C:\Windows\System\jOOhSiX.exe
  C:\Windows\System\jOOhSiX.exe
  2⤵
  PID:15308
- C:\Windows\System\ElCuSLa.exe
  C:\Windows\System\ElCuSLa.exe
  2⤵
  PID:15336
- C:\Windows\System\fvPFQef.exe
  C:\Windows\System\fvPFQef.exe
  2⤵
  PID:15356
- C:\Windows\System\rROxCBP.exe
  C:\Windows\System\rROxCBP.exe
  2⤵
  PID:13648
- C:\Windows\System\wZPWUzi.exe
  C:\Windows\System\wZPWUzi.exe
  2⤵
  PID:14344
- C:\Windows\System\Jlhxrzx.exe
  C:\Windows\System\Jlhxrzx.exe
  2⤵
  PID:13728
- C:\Windows\System\fcTqoXn.exe
  C:\Windows\System\fcTqoXn.exe
  2⤵
  PID:13472
- C:\Windows\System\TQYXaoC.exe
  C:\Windows\System\TQYXaoC.exe
  2⤵
  PID:14524
- C:\Windows\System\VFTXIkf.exe
  C:\Windows\System\VFTXIkf.exe
  2⤵
  PID:14592
- C:\Windows\System\wjocYkE.exe
  C:\Windows\System\wjocYkE.exe
  2⤵
  PID:14640
- C:\Windows\System\cHkrJWW.exe
  C:\Windows\System\cHkrJWW.exe
  2⤵
  PID:14556
- C:\Windows\System\MqOezYQ.exe
  C:\Windows\System\MqOezYQ.exe
  2⤵
  PID:14580
- C:\Windows\System\KspkvPJ.exe
  C:\Windows\System\KspkvPJ.exe
  2⤵
  PID:14856
- C:\Windows\System\jIldLSc.exe
  C:\Windows\System\jIldLSc.exe
  2⤵
  PID:14800
- C:\Windows\System\HTwvYzP.exe
  C:\Windows\System\HTwvYzP.exe
  2⤵
  PID:15028
- C:\Windows\System\yaftDqV.exe
  C:\Windows\System\yaftDqV.exe
  2⤵
  PID:14828
- C:\Windows\System\AEZAEQE.exe
  C:\Windows\System\AEZAEQE.exe
  2⤵
  PID:14876
- C:\Windows\System\RyzIwzk.exe
  C:\Windows\System\RyzIwzk.exe
  2⤵
  PID:15080
- C:\Windows\System\wvpcKgs.exe
  C:\Windows\System\wvpcKgs.exe
  2⤵
  PID:15056
- C:\Windows\System\rhJLJvc.exe
  C:\Windows\System\rhJLJvc.exe
  2⤵
  PID:15296
- C:\Windows\System\pMgZzcN.exe
  C:\Windows\System\pMgZzcN.exe
  2⤵
  PID:15240
- C:\Windows\System\wFWQldv.exe
  C:\Windows\System\wFWQldv.exe
  2⤵
  PID:15328
- C:\Windows\System\sqDlTYA.exe
  C:\Windows\System\sqDlTYA.exe
  2⤵
  PID:14360
- C:\Windows\System\QCVlfhC.exe
  C:\Windows\System\QCVlfhC.exe
  2⤵
  PID:14792
- C:\Windows\System\amUbfcw.exe
  C:\Windows\System\amUbfcw.exe
  2⤵
  PID:14440
- C:\Windows\System\dAVnigb.exe
  C:\Windows\System\dAVnigb.exe
  2⤵
  PID:14880
- C:\Windows\System\ehRmNXQ.exe
  C:\Windows\System\ehRmNXQ.exe
  2⤵
  PID:13984
- C:\Windows\System\BPbSbYN.exe
  C:\Windows\System\BPbSbYN.exe
  2⤵
  PID:15348
- C:\Windows\System\PnAmsNv.exe
  C:\Windows\System\PnAmsNv.exe
  2⤵
  PID:15276
- C:\Windows\System\yUbNfEV.exe
  C:\Windows\System\yUbNfEV.exe
  2⤵
  PID:15372
- C:\Windows\System\MFblpqG.exe
  C:\Windows\System\MFblpqG.exe
  2⤵
  PID:15392
- C:\Windows\System\QshHawf.exe
  C:\Windows\System\QshHawf.exe
  2⤵
  PID:15424
- C:\Windows\System\EniYDQb.exe
  C:\Windows\System\EniYDQb.exe
  2⤵
  PID:15448
- C:\Windows\System\iwBGbmN.exe
  C:\Windows\System\iwBGbmN.exe
  2⤵
  PID:15476
- C:\Windows\System\iMZRGPw.exe
  C:\Windows\System\iMZRGPw.exe
  2⤵
  PID:15504
- C:\Windows\System\vYeYVHf.exe
  C:\Windows\System\vYeYVHf.exe
  2⤵
  PID:15524
- C:\Windows\System\beVYsYJ.exe
  C:\Windows\System\beVYsYJ.exe
  2⤵
  PID:15556
- C:\Windows\System\HlFEYmG.exe
  C:\Windows\System\HlFEYmG.exe
  2⤵
  PID:15588
- C:\Windows\System\pxANrzl.exe
  C:\Windows\System\pxANrzl.exe
  2⤵
  PID:15612
- C:\Windows\System\vNqyaWL.exe
  C:\Windows\System\vNqyaWL.exe
  2⤵
  PID:15632
- C:\Windows\System\PNEPlCY.exe
  C:\Windows\System\PNEPlCY.exe
  2⤵
  PID:15656
- C:\Windows\System\JdclPzI.exe
  C:\Windows\System\JdclPzI.exe
  2⤵
  PID:15692
- C:\Windows\System\RgKDuFw.exe
  C:\Windows\System\RgKDuFw.exe
  2⤵
  PID:15716
- C:\Windows\System\ixdBUVi.exe
  C:\Windows\System\ixdBUVi.exe
  2⤵
  PID:15752
- C:\Windows\System\eBEKOKB.exe
  C:\Windows\System\eBEKOKB.exe
  2⤵
  PID:15772
- C:\Windows\System\TXFKyKR.exe
  C:\Windows\System\TXFKyKR.exe
  2⤵
  PID:15796
- C:\Windows\System\OGSSXNg.exe
  C:\Windows\System\OGSSXNg.exe
  2⤵
  PID:15828
- C:\Windows\System\hMxmYHY.exe
  C:\Windows\System\hMxmYHY.exe
  2⤵
  PID:15856
- C:\Windows\System\ZXLxZYh.exe
  C:\Windows\System\ZXLxZYh.exe
  2⤵
  PID:15900
- C:\Windows\System\RljUZGj.exe
  C:\Windows\System\RljUZGj.exe
  2⤵
  PID:15924
- C:\Windows\System\flAkoJh.exe
  C:\Windows\System\flAkoJh.exe
  2⤵
  PID:15952
- C:\Windows\System\jOfFYyW.exe
  C:\Windows\System\jOfFYyW.exe
  2⤵
  PID:15976
- C:\Windows\System\TriFOCf.exe
  C:\Windows\System\TriFOCf.exe
  2⤵
  PID:16008
- C:\Windows\System\QYPfrga.exe
  C:\Windows\System\QYPfrga.exe
  2⤵
  PID:16040
- C:\Windows\System\tlyVMFb.exe
  C:\Windows\System\tlyVMFb.exe
  2⤵
  PID:16068
- C:\Windows\System\gtGFXQP.exe
  C:\Windows\System\gtGFXQP.exe
  2⤵
  PID:16096
- C:\Windows\System\LbRQIls.exe
  C:\Windows\System\LbRQIls.exe
  2⤵
  PID:16124
- C:\Windows\System\bBIveKT.exe
  C:\Windows\System\bBIveKT.exe
  2⤵
  PID:16148
- C:\Windows\System\GMJRabV.exe
  C:\Windows\System\GMJRabV.exe
  2⤵
  PID:16172
- C:\Windows\System\mJBaHQE.exe
  C:\Windows\System\mJBaHQE.exe
  2⤵
  PID:16200
- C:\Windows\System\RLueZuV.exe
  C:\Windows\System\RLueZuV.exe
  2⤵
  PID:16224
- C:\Windows\System\XoGbaro.exe
  C:\Windows\System\XoGbaro.exe
  2⤵
  PID:16252
- C:\Windows\System\XGtfgdu.exe
  C:\Windows\System\XGtfgdu.exe
  2⤵
  PID:16280
- C:\Windows\System\BojQqdQ.exe
  C:\Windows\System\BojQqdQ.exe
  2⤵
  PID:16296
- C:\Windows\System\lAANImm.exe
  C:\Windows\System\lAANImm.exe
  2⤵
  PID:16328
- C:\Windows\System\fWfndRh.exe
  C:\Windows\System\fWfndRh.exe
  2⤵
  PID:16356
- C:\Windows\System\oOkReDL.exe
  C:\Windows\System\oOkReDL.exe
  2⤵
  PID:15128
- C:\Windows\System\lCmpDdF.exe
  C:\Windows\System\lCmpDdF.exe
  2⤵
  PID:15196
- C:\Windows\System\NwdyjyU.exe
  C:\Windows\System\NwdyjyU.exe
  2⤵
  PID:15380
- C:\Windows\System\thNxFFV.exe
  C:\Windows\System\thNxFFV.exe
  2⤵
  PID:15436
- C:\Windows\System\MWELWOc.exe
  C:\Windows\System\MWELWOc.exe
  2⤵
  PID:14436
- C:\Windows\System\rkAVGxr.exe
  C:\Windows\System\rkAVGxr.exe
  2⤵
  PID:15516
- C:\Windows\System\ZgtTfQC.exe
  C:\Windows\System\ZgtTfQC.exe
  2⤵
  PID:15644
- C:\Windows\System\gzGVlJu.exe
  C:\Windows\System\gzGVlJu.exe
  2⤵
  PID:15596
- C:\Windows\System\TkualpT.exe
  C:\Windows\System\TkualpT.exe
  2⤵
  PID:15744
- C:\Windows\System\slRISaM.exe
  C:\Windows\System\slRISaM.exe
  2⤵
  PID:15804
- C:\Windows\System\CciJeNc.exe
  C:\Windows\System\CciJeNc.exe
  2⤵
  PID:15872
- C:\Windows\System\FAFyDtK.exe
  C:\Windows\System\FAFyDtK.exe
  2⤵
  PID:15912
- C:\Windows\System\kIrbTpt.exe
  C:\Windows\System\kIrbTpt.exe
  2⤵
  PID:16020
- C:\Windows\System\jhtqhwm.exe
  C:\Windows\System\jhtqhwm.exe
  2⤵
  PID:15944
- C:\Windows\System\XgPwzsc.exe
  C:\Windows\System\XgPwzsc.exe
  2⤵
  PID:16144
- C:\Windows\System\hCEPtIA.exe
  C:\Windows\System\hCEPtIA.exe
  2⤵
  PID:15920
- C:\Windows\System\emOOSEq.exe
  C:\Windows\System\emOOSEq.exe
  2⤵
  PID:16076
- C:\Windows\System\XnJuHTv.exe
  C:\Windows\System\XnJuHTv.exe
  2⤵
  PID:16364
- C:\Windows\System\yClSXYD.exe
  C:\Windows\System\yClSXYD.exe
  2⤵
  PID:16376
- C:\Windows\System\StyDorz.exe
  C:\Windows\System\StyDorz.exe
  2⤵
  PID:16308
- C:\Windows\System\BIXRRNF.exe
  C:\Windows\System\BIXRRNF.exe
  2⤵
  PID:14084
- C:\Windows\System\fdBbLmL.exe
  C:\Windows\System\fdBbLmL.exe
  2⤵
  PID:15628
- C:\Windows\System\bzHjMAG.exe
  C:\Windows\System\bzHjMAG.exe
  2⤵
  PID:15608
- C:\Windows\System\fpBEuNv.exe
  C:\Windows\System\fpBEuNv.exe
  2⤵
  PID:15864
- C:\Windows\System\BtTTOXp.exe
  C:\Windows\System\BtTTOXp.exe
  2⤵
  PID:15672
- C:\Windows\System\pDSHmVx.exe
  C:\Windows\System\pDSHmVx.exe
  2⤵
  PID:15444
- C:\Windows\System\tiuBtSs.exe
  C:\Windows\System\tiuBtSs.exe
  2⤵
  PID:16272
- C:\Windows\System\uPAyJvp.exe
  C:\Windows\System\uPAyJvp.exe
  2⤵
  PID:15472
- C:\Windows\System\IVQeiBP.exe
  C:\Windows\System\IVQeiBP.exe
  2⤵
  PID:16404
- C:\Windows\System\MfNrXsq.exe
  C:\Windows\System\MfNrXsq.exe
  2⤵
  PID:16428
- C:\Windows\System\mGTFpCJ.exe
  C:\Windows\System\mGTFpCJ.exe
  2⤵
  PID:16460
- C:\Windows\System\FOVRYuk.exe
  C:\Windows\System\FOVRYuk.exe
  2⤵
  PID:16484
- C:\Windows\System\stgzuDx.exe
  C:\Windows\System\stgzuDx.exe
  2⤵
  PID:16512
- C:\Windows\System\JiMtbsd.exe
  C:\Windows\System\JiMtbsd.exe
  2⤵
  PID:16552
- C:\Windows\System\CdwsbsB.exe
  C:\Windows\System\CdwsbsB.exe
  2⤵
  PID:16816
- C:\Windows\System\XVEpmmV.exe
  C:\Windows\System\XVEpmmV.exe
  2⤵
  PID:16832
- C:\Windows\System\QpxZDJQ.exe
  C:\Windows\System\QpxZDJQ.exe
  2⤵
  PID:16848
- C:\Windows\System\UniBgAI.exe
  C:\Windows\System\UniBgAI.exe
  2⤵
  PID:16868
- C:\Windows\System\UfmCaZh.exe
  C:\Windows\System\UfmCaZh.exe
  2⤵
  PID:16896
- C:\Windows\System\oosHcZF.exe
  C:\Windows\System\oosHcZF.exe
  2⤵
  PID:16932
- C:\Windows\System\iVpTugT.exe
  C:\Windows\System\iVpTugT.exe
  2⤵
  PID:16956
- C:\Windows\System\bPpWKnL.exe
  C:\Windows\System\bPpWKnL.exe
  2⤵
  PID:16984
- C:\Windows\System\PlwCjSk.exe
  C:\Windows\System\PlwCjSk.exe
  2⤵
  PID:17012
- C:\Windows\System\EqFFRYg.exe
  C:\Windows\System\EqFFRYg.exe
  2⤵
  PID:17044
- C:\Windows\System\jzLLyYW.exe
  C:\Windows\System\jzLLyYW.exe
  2⤵
  PID:17068
- C:\Windows\System\xSMTKBQ.exe
  C:\Windows\System\xSMTKBQ.exe
  2⤵
  PID:17088
- C:\Windows\System\bPVOgVE.exe
  C:\Windows\System\bPVOgVE.exe
  2⤵
  PID:17116
- C:\Windows\System\ODrlYxc.exe
  C:\Windows\System\ODrlYxc.exe
  2⤵
  PID:17140
- C:\Windows\System\qKQpaQv.exe
  C:\Windows\System\qKQpaQv.exe
  2⤵
  PID:17160
- C:\Windows\System\aZZKvHM.exe
  C:\Windows\System\aZZKvHM.exe
  2⤵
  PID:17188
- C:\Windows\System\WgpWyXz.exe
  C:\Windows\System\WgpWyXz.exe
  2⤵
  PID:17208
- C:\Windows\System\VlykXHG.exe
  C:\Windows\System\VlykXHG.exe
  2⤵
  PID:17240
- C:\Windows\System\ESGgxLO.exe
  C:\Windows\System\ESGgxLO.exe
  2⤵
  PID:17268
- C:\Windows\System\gNtdVrM.exe
  C:\Windows\System\gNtdVrM.exe
  2⤵
  PID:17300
- C:\Windows\System\mDYAYFe.exe
  C:\Windows\System\mDYAYFe.exe
  2⤵
  PID:17320
- C:\Windows\System\EudgmPa.exe
  C:\Windows\System\EudgmPa.exe
  2⤵
  PID:17336
- C:\Windows\System\vsrdnUo.exe
  C:\Windows\System\vsrdnUo.exe
  2⤵
  PID:17360
- C:\Windows\System\kMIyNYJ.exe
  C:\Windows\System\kMIyNYJ.exe
  2⤵
  PID:17392
- C:\Windows\System\YPrXURW.exe
  C:\Windows\System\YPrXURW.exe
  2⤵
  PID:16056
- C:\Windows\System\VZsrMRA.exe
  C:\Windows\System\VZsrMRA.exe
  2⤵
  PID:15404
- C:\Windows\System\vPEKjGp.exe
  C:\Windows\System\vPEKjGp.exe
  2⤵
  PID:16396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AzXjjiT.exe

Filesize
1.4MB

MD5
95b1cac7406ee423bcbc0a52dac1d102

SHA1
6394267bf38ea26d8782033391a74fc60199dca6

SHA256
f21747351e6e48a6b52eb26e2368383b19062641641ffd695866c1ebdc4b86a7

SHA512
590c88a2e68be8cd9d646ff0bc27f9462ed730f298bdd272c26a66c804bef3924b4670a2e30376660a385b33a995faa1b85e08a08d4032221d03f83e520a0282

Download Submit
C:\Windows\System\EYyFFLl.exe

Filesize
1.5MB

MD5
94b55cef556ae0961753b19f7e41b72b

SHA1
6d99cc70d416bca82064955dc829bbeb3d5b6e6e

SHA256
bcd9d5478e4fc290419f3d4503cdafb758b1d4da34d1387ee1b59f4ecaabfbc7

SHA512
a6b115adc331122835d8d3e7996af4d0076a661aede9ab64108f0f42cd24870be13e24f9f4fa5a176f458e1c902c2e49f243188772e1c5fc865e6aa82ecc51a3

Download Submit
C:\Windows\System\FdVpPRx.exe

Filesize
1.4MB

MD5
66dfdfbcb4f781d9579be2c2284550a9

SHA1
e77340e81556dabba7e80675524124c64093af0d

SHA256
12407e32c15989a6f36a082f440256c8708c005a195619f9c02fbf7b4c16351e

SHA512
1cd18e4be07a9472081109ac01a321778d1ec7f3f3caa2e25eaa0bc2fef8be62b8872ad62312160049ee46298663fed2ae3900f01afab0d6e8dea129c88f8373

Download Submit
C:\Windows\System\GsKeskE.exe

Filesize
1.4MB

MD5
d12874c681016da78c66813de7655ad4

SHA1
4eb8810bdfb1aab96cf6cf292d7aa254f75a3bf4

SHA256
378f97b16de6fe03115e266d7238eea3c954ef5f25d4e203b1cfebe2451f4eac

SHA512
65a476017ad39e246ecfdf8b8f43d4ad1a644bb0374c7909ce0c3442098b13fda445501a421312f28aef9270376cb44ec779659bfa9d454b7d8d5eea4623793b

Download Submit
C:\Windows\System\IKHIkNZ.exe

Filesize
1.4MB

MD5
a540d4b68481eb5e38be4301a22e0e42

SHA1
a8a258829368b256efe3aa1c0c3f64ffa132519e

SHA256
99a8a7329c12f71c82daa780eb5f495bef19514cd3be1759d47ef2dc1e3f2044

SHA512
e64130e30d906625154f3bdc979896c1b86fcfb331b94fc9fd892964c51707d3c7944de27afb58b04830b1bfc4af43b2a3ea28b261d1e4f00b41c1238fac6313

Download Submit
C:\Windows\System\OwDxJcj.exe

Filesize
1.5MB

MD5
8cb312a6f2b7292bac9415a0ba005b13

SHA1
91c1e1ea7f3cbf48997d112570b19be5fc5118ed

SHA256
93030cc1e6aba1178afde1831a1b0a00f4d1fb1a6f0121181921b904a1b9262d

SHA512
416854ffee19082ae718a49538cd6904c1e9aa7af7037c9638d988462f74ec99e2a08a256a9138c228038d8bff17bf4eba4aa499e4d138e408c6f7c179529355

Download Submit
C:\Windows\System\PJGhlnl.exe

Filesize
1.5MB

MD5
cf8eaa5e8e98e681bcac43f30434ef11

SHA1
a1224d1739369f4ff01f3766c9a0431fbec3bc34

SHA256
9b3689c246cccc692a7dc62d4c06ab2def9355eb44b64949677a3179cd431779

SHA512
d2aeacf68233774870cb982e3cccdf3bb1b452d8368a2c5269af1003574e146d8630c565cd7b1eeef2968db26574b26053323dabeb9acade22d2573df24755a6

Download Submit
C:\Windows\System\RzZRBwo.exe

Filesize
1.4MB

MD5
2fbc65f00e9b188fc6a60ef955f1d967

SHA1
be2c47846fbdfd9d3a9889925b1a82140f528f69

SHA256
009ced68b13dd55918dbbf7f2cbcd0688183bfa8c3d63f72c6cfcb537100de97

SHA512
7316fa67a5994c03a6feaa563402c96eb185c5433d9a4554af63b38e93755f5c42608e8499417dc4f1e3041f77acb43d1c226caf9e410e26fd277906864f7c96

Download Submit
C:\Windows\System\TbqTGQH.exe

Filesize
1.5MB

MD5
36bd2cbc38c473040822da6c4cd779ff

SHA1
5ef685f8d5954f5a59472984bd9884569f344810

SHA256
9c2a90b4e9ff53eb60388a51eda81a3203c9370362b0484544863df45691989d

SHA512
7d67b4b35734c21cb98a51ed33ef4c311c679c852e29ba677c2e0b6f4377671e36b417e09243480b0443e96c0d243f5fe4e99fb25e2f59821825d4e0dc4849a7

Download Submit
C:\Windows\System\UnBhTSu.exe

Filesize
1.4MB

MD5
511787736702bcfb0a1a612a378013f2

SHA1
51f2d5dbbe5784a2902dc32865d935ca2d780491

SHA256
ca4776b3829ede604964063c00409ac5b56e886b66ac3cffcfb987587153e65b

SHA512
b2222bfc6203a765d4fbd2d07411cb9649c89809fb7a10aa729ded69a814fe5e7272078f8c1b6a6066c4ca3990b3ccb41942413656019713ac15c2cf98e91bcd

Download Submit
C:\Windows\System\WMNFHVF.exe

Filesize
1.4MB

MD5
0e87a2fbacb2867daf677a12cf3ecbaf

SHA1
84ba8228a7cc0c1149f53e667c0038d3e0641536

SHA256
3b6b5e8e38cb074ea9661c4ca363b603e9070139fc843a8071805d78cf46c206

SHA512
f6926b1876d36ab2ef55f413f8f8d1cd9e8f211c79e5815ddb9ce4075730dd00834c51b5c8679b8d6ce8bcd890fb5716591b2e7fc43f14bf2ef177c27df6fd00

Download Submit
C:\Windows\System\YMiRjFS.exe

Filesize
1.5MB

MD5
d2a939e9f20a230aba23ee9d2d907a8f

SHA1
4f14b5165ba8067197b9a61138623a856614623d

SHA256
f43cbc3e398a49377fff32a095c5473bfdb0ab77f4aff38360d1c619b12b6f6e

SHA512
ca8f106b5dc828b749db039146101473e5d111c1739d7304653086a2e36e2d389636f657e7458378e27b13579a5c15ba058e5637e420bdf2a76fc384dba8225d

Download Submit
C:\Windows\System\YNqNkal.exe

Filesize
1.4MB

MD5
98c1644d8d9b81b1daf3c0e9b6e680e4

SHA1
3ce6db73d5390b52a2eef739b391e9d554e0c755

SHA256
6fb46b3f988abaa58aab76739bffbbb709133ba65769d440346da22071ca0e51

SHA512
35f9d2862279e2f11308e618224e4e9897af4e9a60af73feffc911a2b99e2ac5ddc5401760fc28b7c32efaa90899d5c27d36f511359f83ac4e89dbecc45d4959

Download Submit
C:\Windows\System\YqSBwkP.exe

Filesize
1.5MB

MD5
32ee6601d9bdcfc92311ffdc67137966

SHA1
45387518d6cfd23323445e148bf0d8be6f39b58f

SHA256
883fba0209623f8f11ce8741dbcd744349a41d1650110134f535dc8b5de92f83

SHA512
ba565730595df40ad09364ca86964701d2f789ccbfcf98283c0c8cedd723ed4bb058fefbc582e24fa8fd176004be6a5c396c1f9f28a207df579b092624ac832b

Download Submit
C:\Windows\System\bqBbXbN.exe

Filesize
1.4MB

MD5
9938e71d30a330f3261ffe4784a383ff

SHA1
ce6e1ca48a42bced339bde11427bb2db33b345b4

SHA256
afa018c453b972cc5caa26239cef2d3ce40c371e6ab678449576096020346f3e

SHA512
409bf639a9be2386dad55e1efdc4ad6ffdc8ef576a93eb845b90a020898e3340710a1e892321d59ab37d6a204af5482b3fd3e96af3ff56e7da855b77b8eff3f6

Download Submit
C:\Windows\System\fnTUXvz.exe

Filesize
1.4MB

MD5
c2f1fced28b3339eb18b7a79eb8d391e

SHA1
15c5bdce9877bcad7cc11c6f9758da7f2af2b111

SHA256
8714847e61d72b9b550350c5f2b6f6047c01ceeb7c062f55d17ca5baba9ba275

SHA512
52ea2331881e09a4076775402c5d7971f5d7f54067a1426053d23bcec9230b2ad808383cd6a06ffd5bae256ac4079232684a4610f20627c29fea39e280798735

Download Submit
C:\Windows\System\gJBKzrj.exe

Filesize
1.4MB

MD5
244fd60e31be0fc93f959a4e3c0145aa

SHA1
945b6d119ce529f1af8e4c544b7c06d624c668d6

SHA256
cf8224ca5b467ff31a5cb98d58d8b061de99165577e1beb1d5c5b2e39d7749c5

SHA512
896778e3d355dabd00de531b47c1e399533f9ccd3c501e357167560ba84c17fba3abe7416f7655cfac8204ccb76be7dd725810a8509f303dfa872b5978000736

Download Submit
C:\Windows\System\gyOZfpU.exe

Filesize
1.4MB

MD5
d790eae99c3dc2f55cfe60b296527180

SHA1
8100fbf92c72f5092c5f22c3738cb6e5cf549b34

SHA256
d0c75ff4d7eea175e8545c24cf03c734931ecac65bc38d40f3e482b822d21b2c

SHA512
22564b13b46eee56c1e6b9f15d46b5e3085ee920a20baa71e63595cf22248c294cef5576ea52ac7db0e3fb84916c66ffc486ada3a0e5c3b13fb079a9921f2ca5

Download Submit
C:\Windows\System\hOWuvBS.exe

Filesize
1.4MB

MD5
053cc421b75c50fc4a450bb3f3123df2

SHA1
09c833cddd5706beb734a80e6ac35a31bdc1af3e

SHA256
94e5d8cdee45ad7f96328063e625f31ce858cab9a03a0dfbb6f87846a36ec44c

SHA512
e10b188687f76e4da317282167b03cd736eca13627f255f11d8aeed6d8b6b67ea83abb4e318c79ab2534f2f1155d2212cb3f28ca3cb858bb62bfb1b91c688c18

Download Submit
C:\Windows\System\invqQeh.exe

Filesize
1.4MB

MD5
9ebecfe3bb9ccc10af04e9b31f73b62f

SHA1
779a6b0ecd72209fb65849ae50c7d802f2d740d0

SHA256
a50a9420feab641aaaa013e36641da6802e208269250d8ac59d44fe21ace8971

SHA512
3a17bf75cd7b803c83a05f0d73a38ad75111283d4ba35e2c124e1529a96afcea2ecd788a89dfd5c9bd90ccf93f2d94938ab94450500507e3d83649ecbe201e76

Download Submit
C:\Windows\System\lOknvKX.exe

Filesize
1.5MB

MD5
44f80f336c5c972b5c198d777e98ff3a

SHA1
71d0ee3ef2b0e304d99b773a0257f5803d0b1a43

SHA256
acdde4978e0d55c4b20e112ac5d0b6a87f819d54b6deb0a3af80385742431ac3

SHA512
1906bcf0bf8cd3ec1f3eb1207dc2faec3bcfb7c3291a5e1c74f80e0d14cfb9d860f75cdc27b114fe4ba4ff8c6048cdfe7f2c5dc079f1940e0b80c1368d399969

Download Submit
C:\Windows\System\nddhEIO.exe

Filesize
1.5MB

MD5
fe95d9ab9a2d8559dc431b845f9ee34f

SHA1
2b6d18960813393e6f545a0a4a2387d5e002b00a

SHA256
878887137275cd85391728352c9eeb9d28aec390e2b0d66cd17d54e47b15e241

SHA512
939f18df6310afe19d60cf186aa34086d94b1de2a0d498b713db220c011b8f4ce6dad3d2e4709dcbf4d50fde426fde22ad18d3e9402430f0e5c35d90a7117096

Download Submit
C:\Windows\System\pPBhiVc.exe

Filesize
1.5MB

MD5
b6c585f45555fdb02332704b3dfde75a

SHA1
74adcc90e868d8b89e383b85b8ec705c8ea2f9e6

SHA256
a76943b7d1d8cd1823a57b1742331130945b645988367f0e8fa480815880e228

SHA512
924d8d952b3ba5fbe91dbf7d4aa0484c6e3753253739b00c61cc1b08158693c15568b982851550b61aeaa6ea9c983fe1ac1460bab979c36a602736976f2c3b03

Download Submit
C:\Windows\System\pmBBywq.exe

Filesize
1.4MB

MD5
c5a1cb6a409ac0da5410b4cf5c462d0b

SHA1
3bc72919725253479b6fb7384edf808a9459eef5

SHA256
84d09279e9dd910a26ede76a1c57fe26629f6a2a6a555adf05b2b85970535bd8

SHA512
fd31fc94ed87e8f03dd4cc8a7f8e1b46730dcbc29fed60958d5115165f8b895ea5930d73f428904cd4b69045524ae245cca9c963fd0f0f2399eea6142cb4302a

Download Submit
C:\Windows\System\qIHOGNc.exe

Filesize
1.5MB

MD5
05870c6335fd8b1c66a14bd1762c9621

SHA1
7bbe162a3bbd25a436ab52750b8fe2afa196e5ed

SHA256
d08f86a029dd2830710c4c0cf5b661207ea54a293c0c50da20b3eb82f4609232

SHA512
1dc473dd4f3ead04c70fd2be9736168d09148e2a5b5b1891530d7bd13ec99ea5e53c800c1146df997098c35e13a68c28e4202b0197a3463211bfaa720026de34

Download Submit
C:\Windows\System\qjHtFki.exe

Filesize
1.4MB

MD5
930734646f3db18cd30e29239c4541ad

SHA1
e98f9e66717cb01fbf72ea3a1739c08ac371d4c3

SHA256
5446a09136285560c03d7469e5ffa5d4653abbc4c421b6ef96df3b10d9e3fb8a

SHA512
37557f07afb747f8874efccc5eea4913a1e977a5c7cd9acfa1145b90319b315964bb01696e48f4ea227d04d2588581c6593569a78eef3e3d0cf4ac2414e67b2c

Download Submit
C:\Windows\System\rJtVYld.exe

Filesize
1.4MB

MD5
8dc9091b3409dd615bbd3c64fde4fcaa

SHA1
2edf24ab4722e1faf42889040b7aa555331c66d4

SHA256
4670c02e5264a7462c88eaf2cd33913c7bbe72136023821d2f01963277e1f21b

SHA512
4af24699a025c5930d1f311f9d8f6693431f7ad83a7eed7c55f5db31dba9921bc645bae4a4c936fdab1fea025bfed8f7101b92861c90b5552f589855fe63809b

Download Submit
C:\Windows\System\tOXspYe.exe

Filesize
1.5MB

MD5
35fbec5315d172305dea643f1ff29369

SHA1
76382c795ce951b1e35ed9ba234dfd7a92ad3cbc

SHA256
327cee596351d49dae02f59f6cb53b00d1a64f5394aecfcd600edc725f2171f7

SHA512
30b9cf5fd5c03dd3d750f81b8ea29ba6953c0a28788e70363237f34f07cfae895a7c0dc4b0e83f17cdd4d51cd5bb8ca11f0b6c4b5d23fe20f9e40c58ecb82e4b

Download Submit
C:\Windows\System\umTtLHI.exe

Filesize
1.4MB

MD5
6e70d3592f237c96e4fa371cd68c3ca8

SHA1
a29371b693759871c3241677fe9becbbe0665f73

SHA256
8e44296d9c03467df13da3259d069051306915d2f64c5fb12b5873535405aff1

SHA512
9d74b136a9fd5086d49c6e9ca10316cd45a02e1d67610d84ec0fa7197d563f151783d359bd6b07896fa1dcbaf1104063920a9a745db2089462664610e7ce08d8

Download Submit
C:\Windows\System\xJGkbzt.exe

Filesize
1.4MB

MD5
3b3fca3a57e8d49a41d0807a906952a0

SHA1
a140cdfaa74a156a7cf7c097b4a2fe825a7b2265

SHA256
4322a5876ab167678c1d654fe8bd79ed462d1e797c06d3c0108bedf0b1a1b3ae

SHA512
3fab4be93f46c11914329370b0d5a182102f135d8a0aadaa2dd7b94de5c145ea150ec568c40b1f1782481b5ec4aa779a641a7520b9e56ccad97d240609239c1a

Download Submit
C:\Windows\System\xiHTkZz.exe

Filesize
1.5MB

MD5
5a4b1273cfb84ca2e8fd841304b10588

SHA1
324babaeb3576f22f42458d63c2aec9291c69336

SHA256
bf1d67621ef599ae459d614bf7a96501c2cafbee8c2d0fb97f659c8da8d921d7

SHA512
a40cff3a5efa859f806accd024081e40b710a0c65f5895c4b1058ce22199acdd4d41235beb1b3fe029db55aac1a840c46e6d0e462cc2068e5accd2f9a5a48180

Download Submit
C:\Windows\System\ynktyDs.exe

Filesize
1.5MB

MD5
8ecbef70af43bace36929210c545bd8c

SHA1
9d4d828b9373621255fa36d62ebb3690302ad70a

SHA256
318aed00016ae6cdc7a39095014a2630aa65e45ef441a45f64e909fe15f41428

SHA512
42f224f4af641ccf987920e070d0128a3c6755b2fe2500ecfc151b12a3c97c2e5dd3f497d59cab2d14b2b420f44b22327388b9565ac6c6b93abe153054012b3a

Download Submit
C:\Windows\System\zEIjics.exe

Filesize
1.4MB

MD5
01d3613e90c102bc5d71744004394ad5

SHA1
4ca746f2911bbb08c85d91e773247c4fde349be8

SHA256
5d578171df8bcd2b390f619ce340739b972e15d54566d076c92cc03afeac6b3e

SHA512
6fc9df622617a38f99aeef5ecdcd43eb4300d9a0a8ed4c4d786e021b2f95be7a67a0a2aaadc644741fa278dc5625082786a300be81867616b5f7d93e12730589

Download Submit
memory/1200-0-0x000002204D320000-0x000002204D330000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads