xmrig | 92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729

Analysis

max time kernel
95s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
Size

1.2MB
MD5

05f921e22f63206f5b67ca9f9af0e0a7
SHA1

fc291790ad8a9ce6c746a7a2ce2ad329e4a95808
SHA256

92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729
SHA512

cf014a48186fef8c20fa4ff1f84d4dbf4234dbc979210fd3f220bb47e8e8c64a050f6c17c52330bac7199ef2a15f619e606097c88084242e9b5515217a4c6c47
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/ccJ39L2qCX:GezaTF8FcNkNdfE0pZ9ozttwIRx5CX

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b5b-4.dat	xmrig
behavioral2/files/0x000f000000023bc3-9.dat	xmrig
behavioral2/files/0x0009000000023bd3-8.dat	xmrig
behavioral2/files/0x000e000000023bd7-17.dat	xmrig
behavioral2/files/0x0008000000023bd9-19.dat	xmrig
behavioral2/files/0x0008000000023c0f-44.dat	xmrig
behavioral2/files/0x0008000000023bdf-49.dat	xmrig
behavioral2/files/0x0008000000023c12-65.dat	xmrig
behavioral2/files/0x0008000000023c11-68.dat	xmrig
behavioral2/files/0x0008000000023c10-66.dat	xmrig
behavioral2/files/0x0008000000023bde-63.dat	xmrig
behavioral2/files/0x0008000000023bdd-54.dat	xmrig
behavioral2/files/0x0008000000023c0e-51.dat	xmrig
behavioral2/files/0x0008000000023bdc-45.dat	xmrig
behavioral2/files/0x0008000000023c13-76.dat	xmrig
behavioral2/files/0x0008000000023c18-83.dat	xmrig
behavioral2/files/0x0009000000023bcc-89.dat	xmrig
behavioral2/files/0x0008000000023c32-97.dat	xmrig
behavioral2/files/0x0008000000023c33-108.dat	xmrig
behavioral2/files/0x0008000000023c2c-109.dat	xmrig
behavioral2/files/0x0008000000023c19-107.dat	xmrig
behavioral2/files/0x0008000000023c34-106.dat	xmrig
behavioral2/files/0x0008000000023c1a-102.dat	xmrig
behavioral2/files/0x0008000000023c36-121.dat	xmrig
behavioral2/files/0x0008000000023c37-127.dat	xmrig
behavioral2/files/0x0008000000023c35-119.dat	xmrig
behavioral2/files/0x0008000000023c53-140.dat	xmrig
behavioral2/files/0x0008000000023c63-150.dat	xmrig
behavioral2/files/0x0008000000023c64-154.dat	xmrig
behavioral2/files/0x0016000000023c4d-151.dat	xmrig
behavioral2/files/0x0008000000023c57-156.dat	xmrig
behavioral2/files/0x000b000000023c4c-145.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4020	oqpzNyV.exe
4324	eYdhYre.exe
2800	QmKfIzT.exe
4572	zAXdTjZ.exe
4576	NtzNjyw.exe
3776	jJBqRGR.exe
3780	BZqjFIf.exe
3872	jGBJrgQ.exe
5008	nRLwHrc.exe
224	GmKnecS.exe
3932	CmrgrrR.exe
3532	UOixlMA.exe
1480	fRHNOuz.exe
1152	kQetzoj.exe
1600	QsLLldH.exe
464	LAPuIDU.exe
1668	nBnglcP.exe
4992	iqAzosI.exe
3468	kTEiIxY.exe
3916	mdDlEpg.exe
228	aJMkPxS.exe
2948	FsmudLs.exe
4224	TVHZrrA.exe
2688	fOpiUYi.exe
880	ZMAomww.exe
2660	JtYpysp.exe
3300	GWxjlRr.exe
3216	YDOmLKi.exe
2436	YpbLjGm.exe
2564	tqcituL.exe
1456	MmuZPUs.exe
4872	ciPsAZA.exe
2428	ZVchqje.exe
668	EkbPXMW.exe
4976	qrzetGn.exe
3268	opCVVEM.exe
4988	pfxZJdh.exe
3964	JCXfSIY.exe
4040	DheldIA.exe
968	wpywWXB.exe
1492	mmYxUSq.exe
4340	QKRhSic.exe
4352	tZjpgYX.exe
4564	xmkAsbu.exe
5080	pIKWrwN.exe
2440	DHnyagR.exe
2284	ZvCePdw.exe
3124	aVeDroB.exe
444	LLQhwYh.exe
4884	lPeDqxC.exe
2976	PXSombD.exe
3740	YVGtNkX.exe
2956	LmAOpzP.exe
1996	cmuxVdr.exe
1428	CtEcPgj.exe
2280	DWCUeyq.exe
4392	yQbtThA.exe
4316	yqVFbuJ.exe
3272	noLpsqV.exe
3944	YuDNhLd.exe
2592	pbqknbS.exe
3604	yuhVGCR.exe
1884	vOjajgJ.exe
2452	jIvKPLC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gCZdeOR.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\OhwqQyp.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\uppvRcn.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\azBzATj.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\WWgDBep.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\OeJJWMI.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\NEUeTas.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\PCXsbEZ.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\KvWcNGF.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\dGNRYSj.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\UBqQjAh.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\GmKnecS.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\bfjkeEo.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\ezsvKnC.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\RjxrSUa.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\sNLUOAf.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\IHAyRfO.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\UbBoogQ.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\tMaPNVR.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\xFEBfYx.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\DdQQzJP.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\GNLptMZ.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\BswQNKi.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\vDDiLFG.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\nKkTFbF.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\BFzUbuq.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\bESLgYI.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\pUMyHpM.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\SWgfmWv.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\vRmouRo.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\BMnXztU.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\RLxDTql.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\pOfJkKa.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\YunqPBx.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\GJjqlBB.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\UEEWKhH.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\wpywWXB.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\OJWylWl.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\wrqsgRp.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\RGsVMQA.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\AueUvhr.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\krwEhsu.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\aPyxDNN.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\QUusLks.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\vGqyzjx.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\xJmKmjj.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\KMnumca.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\wxQZdiJ.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\QlkaCbF.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\zAXdTjZ.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\cgnBWZA.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\huzVsdD.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\OmJtDDb.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\qSctJNt.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\qIhPLfB.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\SDDESfa.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\zEyudiv.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\HNZvLMe.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\xTDStzh.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\wiBmajf.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\XBUcVZy.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\fUWOSRP.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\IHvYJVy.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
File created	C:\Windows\System\NgqrCsE.exe	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4020	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	83
PID 4512 wrote to memory of 4020	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	83
PID 4512 wrote to memory of 4324	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	84
PID 4512 wrote to memory of 4324	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	84
PID 4512 wrote to memory of 2800	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	85
PID 4512 wrote to memory of 2800	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	85
PID 4512 wrote to memory of 4572	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	86
PID 4512 wrote to memory of 4572	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	86
PID 4512 wrote to memory of 4576	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	87
PID 4512 wrote to memory of 4576	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	87
PID 4512 wrote to memory of 3776	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	88
PID 4512 wrote to memory of 3776	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	88
PID 4512 wrote to memory of 3780	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	89
PID 4512 wrote to memory of 3780	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	89
PID 4512 wrote to memory of 3872	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	90
PID 4512 wrote to memory of 3872	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	90
PID 4512 wrote to memory of 5008	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	91
PID 4512 wrote to memory of 5008	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	91
PID 4512 wrote to memory of 224	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	92
PID 4512 wrote to memory of 224	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	92
PID 4512 wrote to memory of 3932	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	93
PID 4512 wrote to memory of 3932	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	93
PID 4512 wrote to memory of 3532	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	94
PID 4512 wrote to memory of 3532	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	94
PID 4512 wrote to memory of 1480	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	95
PID 4512 wrote to memory of 1480	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	95
PID 4512 wrote to memory of 1152	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	96
PID 4512 wrote to memory of 1152	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	96
PID 4512 wrote to memory of 1600	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	97
PID 4512 wrote to memory of 1600	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	97
PID 4512 wrote to memory of 1668	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	98
PID 4512 wrote to memory of 1668	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	98
PID 4512 wrote to memory of 464	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	99
PID 4512 wrote to memory of 464	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	99
PID 4512 wrote to memory of 3468	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	100
PID 4512 wrote to memory of 3468	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	100
PID 4512 wrote to memory of 4992	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	101
PID 4512 wrote to memory of 4992	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	101
PID 4512 wrote to memory of 3916	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	102
PID 4512 wrote to memory of 3916	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	102
PID 4512 wrote to memory of 228	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	103
PID 4512 wrote to memory of 228	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	103
PID 4512 wrote to memory of 2948	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	104
PID 4512 wrote to memory of 2948	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	104
PID 4512 wrote to memory of 4224	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	105
PID 4512 wrote to memory of 4224	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	105
PID 4512 wrote to memory of 2688	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	106
PID 4512 wrote to memory of 2688	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	106
PID 4512 wrote to memory of 880	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	107
PID 4512 wrote to memory of 880	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	107
PID 4512 wrote to memory of 2660	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	108
PID 4512 wrote to memory of 2660	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	108
PID 4512 wrote to memory of 3300	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	109
PID 4512 wrote to memory of 3300	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	109
PID 4512 wrote to memory of 3216	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	110
PID 4512 wrote to memory of 3216	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	110
PID 4512 wrote to memory of 2436	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	111
PID 4512 wrote to memory of 2436	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	111
PID 4512 wrote to memory of 2564	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	112
PID 4512 wrote to memory of 2564	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	112
PID 4512 wrote to memory of 1456	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	113
PID 4512 wrote to memory of 1456	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	113
PID 4512 wrote to memory of 4872	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	114
PID 4512 wrote to memory of 4872	4512	92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe	114

C:\Users\Admin\AppData\Local\Temp\92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe
"C:\Users\Admin\AppData\Local\Temp\92340bb60fc9dda7d95427daa9cea3d14aa1ae637e929d477fa451eeee9d3729.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System\oqpzNyV.exe
  C:\Windows\System\oqpzNyV.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\eYdhYre.exe
  C:\Windows\System\eYdhYre.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\QmKfIzT.exe
  C:\Windows\System\QmKfIzT.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\zAXdTjZ.exe
  C:\Windows\System\zAXdTjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\NtzNjyw.exe
  C:\Windows\System\NtzNjyw.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\jJBqRGR.exe
  C:\Windows\System\jJBqRGR.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\BZqjFIf.exe
  C:\Windows\System\BZqjFIf.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\jGBJrgQ.exe
  C:\Windows\System\jGBJrgQ.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\nRLwHrc.exe
  C:\Windows\System\nRLwHrc.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\GmKnecS.exe
  C:\Windows\System\GmKnecS.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\CmrgrrR.exe
  C:\Windows\System\CmrgrrR.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\UOixlMA.exe
  C:\Windows\System\UOixlMA.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\fRHNOuz.exe
  C:\Windows\System\fRHNOuz.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\kQetzoj.exe
  C:\Windows\System\kQetzoj.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\QsLLldH.exe
  C:\Windows\System\QsLLldH.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\nBnglcP.exe
  C:\Windows\System\nBnglcP.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\LAPuIDU.exe
  C:\Windows\System\LAPuIDU.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\kTEiIxY.exe
  C:\Windows\System\kTEiIxY.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\iqAzosI.exe
  C:\Windows\System\iqAzosI.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\mdDlEpg.exe
  C:\Windows\System\mdDlEpg.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\aJMkPxS.exe
  C:\Windows\System\aJMkPxS.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\FsmudLs.exe
  C:\Windows\System\FsmudLs.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\TVHZrrA.exe
  C:\Windows\System\TVHZrrA.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\fOpiUYi.exe
  C:\Windows\System\fOpiUYi.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ZMAomww.exe
  C:\Windows\System\ZMAomww.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\JtYpysp.exe
  C:\Windows\System\JtYpysp.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\GWxjlRr.exe
  C:\Windows\System\GWxjlRr.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\YDOmLKi.exe
  C:\Windows\System\YDOmLKi.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\YpbLjGm.exe
  C:\Windows\System\YpbLjGm.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\tqcituL.exe
  C:\Windows\System\tqcituL.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\MmuZPUs.exe
  C:\Windows\System\MmuZPUs.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\ciPsAZA.exe
  C:\Windows\System\ciPsAZA.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\ZVchqje.exe
  C:\Windows\System\ZVchqje.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\EkbPXMW.exe
  C:\Windows\System\EkbPXMW.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\qrzetGn.exe
  C:\Windows\System\qrzetGn.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\opCVVEM.exe
  C:\Windows\System\opCVVEM.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\pfxZJdh.exe
  C:\Windows\System\pfxZJdh.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\JCXfSIY.exe
  C:\Windows\System\JCXfSIY.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\DheldIA.exe
  C:\Windows\System\DheldIA.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\wpywWXB.exe
  C:\Windows\System\wpywWXB.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\mmYxUSq.exe
  C:\Windows\System\mmYxUSq.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\tZjpgYX.exe
  C:\Windows\System\tZjpgYX.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\QKRhSic.exe
  C:\Windows\System\QKRhSic.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\xmkAsbu.exe
  C:\Windows\System\xmkAsbu.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\pIKWrwN.exe
  C:\Windows\System\pIKWrwN.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\DHnyagR.exe
  C:\Windows\System\DHnyagR.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ZvCePdw.exe
  C:\Windows\System\ZvCePdw.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\aVeDroB.exe
  C:\Windows\System\aVeDroB.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\LLQhwYh.exe
  C:\Windows\System\LLQhwYh.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\lPeDqxC.exe
  C:\Windows\System\lPeDqxC.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\YVGtNkX.exe
  C:\Windows\System\YVGtNkX.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\PXSombD.exe
  C:\Windows\System\PXSombD.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\LmAOpzP.exe
  C:\Windows\System\LmAOpzP.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\cmuxVdr.exe
  C:\Windows\System\cmuxVdr.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\CtEcPgj.exe
  C:\Windows\System\CtEcPgj.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\DWCUeyq.exe
  C:\Windows\System\DWCUeyq.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\yQbtThA.exe
  C:\Windows\System\yQbtThA.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\yqVFbuJ.exe
  C:\Windows\System\yqVFbuJ.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\noLpsqV.exe
  C:\Windows\System\noLpsqV.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\YuDNhLd.exe
  C:\Windows\System\YuDNhLd.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\pbqknbS.exe
  C:\Windows\System\pbqknbS.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\yuhVGCR.exe
  C:\Windows\System\yuhVGCR.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\vOjajgJ.exe
  C:\Windows\System\vOjajgJ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\jIvKPLC.exe
  C:\Windows\System\jIvKPLC.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\lmIbZVc.exe
  C:\Windows\System\lmIbZVc.exe
  2⤵
  PID:1036
- C:\Windows\System\gFygZRk.exe
  C:\Windows\System\gFygZRk.exe
  2⤵
  PID:1488
- C:\Windows\System\ySWbRhx.exe
  C:\Windows\System\ySWbRhx.exe
  2⤵
  PID:4004
- C:\Windows\System\nUfaKmk.exe
  C:\Windows\System\nUfaKmk.exe
  2⤵
  PID:3424
- C:\Windows\System\cYUXpXU.exe
  C:\Windows\System\cYUXpXU.exe
  2⤵
  PID:2576
- C:\Windows\System\AquheIN.exe
  C:\Windows\System\AquheIN.exe
  2⤵
  PID:1756
- C:\Windows\System\PppGyYp.exe
  C:\Windows\System\PppGyYp.exe
  2⤵
  PID:116
- C:\Windows\System\ygHLmnO.exe
  C:\Windows\System\ygHLmnO.exe
  2⤵
  PID:2124
- C:\Windows\System\DGuUKPE.exe
  C:\Windows\System\DGuUKPE.exe
  2⤵
  PID:2268
- C:\Windows\System\noyPOln.exe
  C:\Windows\System\noyPOln.exe
  2⤵
  PID:3652
- C:\Windows\System\keuAAMA.exe
  C:\Windows\System\keuAAMA.exe
  2⤵
  PID:1712
- C:\Windows\System\vyTCAyB.exe
  C:\Windows\System\vyTCAyB.exe
  2⤵
  PID:4736
- C:\Windows\System\FvjnbZI.exe
  C:\Windows\System\FvjnbZI.exe
  2⤵
  PID:4756
- C:\Windows\System\SayMNWf.exe
  C:\Windows\System\SayMNWf.exe
  2⤵
  PID:2504
- C:\Windows\System\eXZIGLB.exe
  C:\Windows\System\eXZIGLB.exe
  2⤵
  PID:2860
- C:\Windows\System\geTGuQq.exe
  C:\Windows\System\geTGuQq.exe
  2⤵
  PID:3516
- C:\Windows\System\THEOggV.exe
  C:\Windows\System\THEOggV.exe
  2⤵
  PID:3472
- C:\Windows\System\qKYBBnd.exe
  C:\Windows\System\qKYBBnd.exe
  2⤵
  PID:1392
- C:\Windows\System\NWEJvgy.exe
  C:\Windows\System\NWEJvgy.exe
  2⤵
  PID:4940
- C:\Windows\System\rWzewjS.exe
  C:\Windows\System\rWzewjS.exe
  2⤵
  PID:864
- C:\Windows\System\wNnpXZw.exe
  C:\Windows\System\wNnpXZw.exe
  2⤵
  PID:3560
- C:\Windows\System\ElmDtCa.exe
  C:\Windows\System\ElmDtCa.exe
  2⤵
  PID:372
- C:\Windows\System\AtKCrGN.exe
  C:\Windows\System\AtKCrGN.exe
  2⤵
  PID:3580
- C:\Windows\System\dShgjTg.exe
  C:\Windows\System\dShgjTg.exe
  2⤵
  PID:672
- C:\Windows\System\sVuSumV.exe
  C:\Windows\System\sVuSumV.exe
  2⤵
  PID:3544
- C:\Windows\System\JufPSej.exe
  C:\Windows\System\JufPSej.exe
  2⤵
  PID:1660
- C:\Windows\System\oZUwrbe.exe
  C:\Windows\System\oZUwrbe.exe
  2⤵
  PID:2848
- C:\Windows\System\MPCBXLj.exe
  C:\Windows\System\MPCBXLj.exe
  2⤵
  PID:5060
- C:\Windows\System\KpZdLJy.exe
  C:\Windows\System\KpZdLJy.exe
  2⤵
  PID:532
- C:\Windows\System\PQDLIyc.exe
  C:\Windows\System\PQDLIyc.exe
  2⤵
  PID:2136
- C:\Windows\System\IoSLzdY.exe
  C:\Windows\System\IoSLzdY.exe
  2⤵
  PID:4800
- C:\Windows\System\YvcRwMZ.exe
  C:\Windows\System\YvcRwMZ.exe
  2⤵
  PID:392
- C:\Windows\System\zpWVLbw.exe
  C:\Windows\System\zpWVLbw.exe
  2⤵
  PID:3492
- C:\Windows\System\bfjkeEo.exe
  C:\Windows\System\bfjkeEo.exe
  2⤵
  PID:4732
- C:\Windows\System\IxWTQDk.exe
  C:\Windows\System\IxWTQDk.exe
  2⤵
  PID:4780
- C:\Windows\System\EtkHZAR.exe
  C:\Windows\System\EtkHZAR.exe
  2⤵
  PID:2608
- C:\Windows\System\rSobCns.exe
  C:\Windows\System\rSobCns.exe
  2⤵
  PID:5112
- C:\Windows\System\lUXXooz.exe
  C:\Windows\System\lUXXooz.exe
  2⤵
  PID:4256
- C:\Windows\System\jHdWMgP.exe
  C:\Windows\System\jHdWMgP.exe
  2⤵
  PID:3336
- C:\Windows\System\cOIwDMM.exe
  C:\Windows\System\cOIwDMM.exe
  2⤵
  PID:220
- C:\Windows\System\zGHoiZI.exe
  C:\Windows\System\zGHoiZI.exe
  2⤵
  PID:3176
- C:\Windows\System\USYOjqn.exe
  C:\Windows\System\USYOjqn.exe
  2⤵
  PID:4228
- C:\Windows\System\xFEBfYx.exe
  C:\Windows\System\xFEBfYx.exe
  2⤵
  PID:1104
- C:\Windows\System\jshgSJx.exe
  C:\Windows\System\jshgSJx.exe
  2⤵
  PID:4876
- C:\Windows\System\EbRaNum.exe
  C:\Windows\System\EbRaNum.exe
  2⤵
  PID:2896
- C:\Windows\System\vvIjLOX.exe
  C:\Windows\System\vvIjLOX.exe
  2⤵
  PID:1928
- C:\Windows\System\vDCEVxN.exe
  C:\Windows\System\vDCEVxN.exe
  2⤵
  PID:1676
- C:\Windows\System\uVqFkUG.exe
  C:\Windows\System\uVqFkUG.exe
  2⤵
  PID:3716
- C:\Windows\System\zrDfBWt.exe
  C:\Windows\System\zrDfBWt.exe
  2⤵
  PID:3536
- C:\Windows\System\TMukBGz.exe
  C:\Windows\System\TMukBGz.exe
  2⤵
  PID:4384
- C:\Windows\System\LyFRKyZ.exe
  C:\Windows\System\LyFRKyZ.exe
  2⤵
  PID:908
- C:\Windows\System\LUQeDDZ.exe
  C:\Windows\System\LUQeDDZ.exe
  2⤵
  PID:1624
- C:\Windows\System\TJcvhLg.exe
  C:\Windows\System\TJcvhLg.exe
  2⤵
  PID:5148
- C:\Windows\System\EfUfiXk.exe
  C:\Windows\System\EfUfiXk.exe
  2⤵
  PID:5180
- C:\Windows\System\dYjADyu.exe
  C:\Windows\System\dYjADyu.exe
  2⤵
  PID:5200
- C:\Windows\System\uweknrU.exe
  C:\Windows\System\uweknrU.exe
  2⤵
  PID:5224
- C:\Windows\System\PwGWCLG.exe
  C:\Windows\System\PwGWCLG.exe
  2⤵
  PID:5256
- C:\Windows\System\KCCfztG.exe
  C:\Windows\System\KCCfztG.exe
  2⤵
  PID:5280
- C:\Windows\System\ovPXWVb.exe
  C:\Windows\System\ovPXWVb.exe
  2⤵
  PID:5312
- C:\Windows\System\elPjXYM.exe
  C:\Windows\System\elPjXYM.exe
  2⤵
  PID:5340
- C:\Windows\System\XBUcVZy.exe
  C:\Windows\System\XBUcVZy.exe
  2⤵
  PID:5368
- C:\Windows\System\CzBdPaL.exe
  C:\Windows\System\CzBdPaL.exe
  2⤵
  PID:5416
- C:\Windows\System\MBNlEmN.exe
  C:\Windows\System\MBNlEmN.exe
  2⤵
  PID:5452
- C:\Windows\System\dddOjPt.exe
  C:\Windows\System\dddOjPt.exe
  2⤵
  PID:5476
- C:\Windows\System\SfEokiR.exe
  C:\Windows\System\SfEokiR.exe
  2⤵
  PID:5504
- C:\Windows\System\AiCzhrW.exe
  C:\Windows\System\AiCzhrW.exe
  2⤵
  PID:5532
- C:\Windows\System\NpTWika.exe
  C:\Windows\System\NpTWika.exe
  2⤵
  PID:5548
- C:\Windows\System\fcDBHjU.exe
  C:\Windows\System\fcDBHjU.exe
  2⤵
  PID:5576
- C:\Windows\System\sPcJCRZ.exe
  C:\Windows\System\sPcJCRZ.exe
  2⤵
  PID:5608
- C:\Windows\System\MhsqMZX.exe
  C:\Windows\System\MhsqMZX.exe
  2⤵
  PID:5632
- C:\Windows\System\IWhmDjh.exe
  C:\Windows\System\IWhmDjh.exe
  2⤵
  PID:5660
- C:\Windows\System\qmMeNWt.exe
  C:\Windows\System\qmMeNWt.exe
  2⤵
  PID:5688
- C:\Windows\System\PgimWtP.exe
  C:\Windows\System\PgimWtP.exe
  2⤵
  PID:5712
- C:\Windows\System\VqcUJrG.exe
  C:\Windows\System\VqcUJrG.exe
  2⤵
  PID:5752
- C:\Windows\System\jNPFBqI.exe
  C:\Windows\System\jNPFBqI.exe
  2⤵
  PID:5772
- C:\Windows\System\DYsdBUK.exe
  C:\Windows\System\DYsdBUK.exe
  2⤵
  PID:5800
- C:\Windows\System\VhlZvCi.exe
  C:\Windows\System\VhlZvCi.exe
  2⤵
  PID:5828
- C:\Windows\System\XgvEMfa.exe
  C:\Windows\System\XgvEMfa.exe
  2⤵
  PID:5856
- C:\Windows\System\rTibIhm.exe
  C:\Windows\System\rTibIhm.exe
  2⤵
  PID:5876
- C:\Windows\System\TyhzzJR.exe
  C:\Windows\System\TyhzzJR.exe
  2⤵
  PID:5912
- C:\Windows\System\TbKhmsR.exe
  C:\Windows\System\TbKhmsR.exe
  2⤵
  PID:5940
- C:\Windows\System\ForspyS.exe
  C:\Windows\System\ForspyS.exe
  2⤵
  PID:5968
- C:\Windows\System\OJWylWl.exe
  C:\Windows\System\OJWylWl.exe
  2⤵
  PID:5996
- C:\Windows\System\gDAYOFc.exe
  C:\Windows\System\gDAYOFc.exe
  2⤵
  PID:6024
- C:\Windows\System\XscqrWT.exe
  C:\Windows\System\XscqrWT.exe
  2⤵
  PID:6048
- C:\Windows\System\LWWyXZq.exe
  C:\Windows\System\LWWyXZq.exe
  2⤵
  PID:6072
- C:\Windows\System\tCtcdcV.exe
  C:\Windows\System\tCtcdcV.exe
  2⤵
  PID:6092
- C:\Windows\System\Jecruqe.exe
  C:\Windows\System\Jecruqe.exe
  2⤵
  PID:6116
- C:\Windows\System\zQtifcb.exe
  C:\Windows\System\zQtifcb.exe
  2⤵
  PID:2828
- C:\Windows\System\gCZdeOR.exe
  C:\Windows\System\gCZdeOR.exe
  2⤵
  PID:924
- C:\Windows\System\IHAyRfO.exe
  C:\Windows\System\IHAyRfO.exe
  2⤵
  PID:5212
- C:\Windows\System\TNGvUjH.exe
  C:\Windows\System\TNGvUjH.exe
  2⤵
  PID:5248
- C:\Windows\System\doSbzur.exe
  C:\Windows\System\doSbzur.exe
  2⤵
  PID:5268
- C:\Windows\System\pfznYSm.exe
  C:\Windows\System\pfznYSm.exe
  2⤵
  PID:5356
- C:\Windows\System\lcCLIAX.exe
  C:\Windows\System\lcCLIAX.exe
  2⤵
  PID:5436
- C:\Windows\System\BADNQoK.exe
  C:\Windows\System\BADNQoK.exe
  2⤵
  PID:5516
- C:\Windows\System\gDsrmus.exe
  C:\Windows\System\gDsrmus.exe
  2⤵
  PID:5592
- C:\Windows\System\DRXNYle.exe
  C:\Windows\System\DRXNYle.exe
  2⤵
  PID:5656
- C:\Windows\System\sNLUOAf.exe
  C:\Windows\System\sNLUOAf.exe
  2⤵
  PID:5704
- C:\Windows\System\faHHTLt.exe
  C:\Windows\System\faHHTLt.exe
  2⤵
  PID:5784
- C:\Windows\System\PfptXFf.exe
  C:\Windows\System\PfptXFf.exe
  2⤵
  PID:5840
- C:\Windows\System\pPvVjzc.exe
  C:\Windows\System\pPvVjzc.exe
  2⤵
  PID:5884
- C:\Windows\System\yamlwvV.exe
  C:\Windows\System\yamlwvV.exe
  2⤵
  PID:5952
- C:\Windows\System\VJzkYmT.exe
  C:\Windows\System\VJzkYmT.exe
  2⤵
  PID:6040
- C:\Windows\System\VzzRCnN.exe
  C:\Windows\System\VzzRCnN.exe
  2⤵
  PID:6108
- C:\Windows\System\Vbbvalz.exe
  C:\Windows\System\Vbbvalz.exe
  2⤵
  PID:6124
- C:\Windows\System\fcfuQLr.exe
  C:\Windows\System\fcfuQLr.exe
  2⤵
  PID:5296
- C:\Windows\System\ccXaxuf.exe
  C:\Windows\System\ccXaxuf.exe
  2⤵
  PID:5428
- C:\Windows\System\ESLiLNN.exe
  C:\Windows\System\ESLiLNN.exe
  2⤵
  PID:5648
- C:\Windows\System\KNRrVec.exe
  C:\Windows\System\KNRrVec.exe
  2⤵
  PID:5808
- C:\Windows\System\YgakIRB.exe
  C:\Windows\System\YgakIRB.exe
  2⤵
  PID:5928
- C:\Windows\System\zEyudiv.exe
  C:\Windows\System\zEyudiv.exe
  2⤵
  PID:2516
- C:\Windows\System\vfErHjc.exe
  C:\Windows\System\vfErHjc.exe
  2⤵
  PID:5192
- C:\Windows\System\zEshbrh.exe
  C:\Windows\System\zEshbrh.exe
  2⤵
  PID:5760
- C:\Windows\System\tSbAeuN.exe
  C:\Windows\System\tSbAeuN.exe
  2⤵
  PID:5216
- C:\Windows\System\wHyJCSO.exe
  C:\Windows\System\wHyJCSO.exe
  2⤵
  PID:6168
- C:\Windows\System\RMGMNRu.exe
  C:\Windows\System\RMGMNRu.exe
  2⤵
  PID:6184
- C:\Windows\System\biHPIzg.exe
  C:\Windows\System\biHPIzg.exe
  2⤵
  PID:6212
- C:\Windows\System\sgieUcL.exe
  C:\Windows\System\sgieUcL.exe
  2⤵
  PID:6232
- C:\Windows\System\DdQQzJP.exe
  C:\Windows\System\DdQQzJP.exe
  2⤵
  PID:6264
- C:\Windows\System\sRRSqAG.exe
  C:\Windows\System\sRRSqAG.exe
  2⤵
  PID:6284
- C:\Windows\System\HxphDli.exe
  C:\Windows\System\HxphDli.exe
  2⤵
  PID:6308
- C:\Windows\System\SURxDld.exe
  C:\Windows\System\SURxDld.exe
  2⤵
  PID:6336
- C:\Windows\System\bJMsHox.exe
  C:\Windows\System\bJMsHox.exe
  2⤵
  PID:6360
- C:\Windows\System\rGUYrIw.exe
  C:\Windows\System\rGUYrIw.exe
  2⤵
  PID:6388
- C:\Windows\System\hwRTitv.exe
  C:\Windows\System\hwRTitv.exe
  2⤵
  PID:6416
- C:\Windows\System\IFnOvoD.exe
  C:\Windows\System\IFnOvoD.exe
  2⤵
  PID:6440
- C:\Windows\System\NCSLujw.exe
  C:\Windows\System\NCSLujw.exe
  2⤵
  PID:6464
- C:\Windows\System\DRoDznV.exe
  C:\Windows\System\DRoDznV.exe
  2⤵
  PID:6488
- C:\Windows\System\tRxCZXo.exe
  C:\Windows\System\tRxCZXo.exe
  2⤵
  PID:6516
- C:\Windows\System\irwdSwp.exe
  C:\Windows\System\irwdSwp.exe
  2⤵
  PID:6540
- C:\Windows\System\iOkOdww.exe
  C:\Windows\System\iOkOdww.exe
  2⤵
  PID:6568
- C:\Windows\System\PgiDmML.exe
  C:\Windows\System\PgiDmML.exe
  2⤵
  PID:6596
- C:\Windows\System\UIXdwJf.exe
  C:\Windows\System\UIXdwJf.exe
  2⤵
  PID:6616
- C:\Windows\System\lwWkryA.exe
  C:\Windows\System\lwWkryA.exe
  2⤵
  PID:6640
- C:\Windows\System\NXnAHzh.exe
  C:\Windows\System\NXnAHzh.exe
  2⤵
  PID:6672
- C:\Windows\System\ucOGNfZ.exe
  C:\Windows\System\ucOGNfZ.exe
  2⤵
  PID:6696
- C:\Windows\System\xuZRHrd.exe
  C:\Windows\System\xuZRHrd.exe
  2⤵
  PID:6716
- C:\Windows\System\sjzdpSI.exe
  C:\Windows\System\sjzdpSI.exe
  2⤵
  PID:6748
- C:\Windows\System\iSqWbJZ.exe
  C:\Windows\System\iSqWbJZ.exe
  2⤵
  PID:6768
- C:\Windows\System\upmvWLl.exe
  C:\Windows\System\upmvWLl.exe
  2⤵
  PID:6796
- C:\Windows\System\kIVHmrI.exe
  C:\Windows\System\kIVHmrI.exe
  2⤵
  PID:6824
- C:\Windows\System\UxtgUPl.exe
  C:\Windows\System\UxtgUPl.exe
  2⤵
  PID:6852
- C:\Windows\System\fptZvrY.exe
  C:\Windows\System\fptZvrY.exe
  2⤵
  PID:6876
- C:\Windows\System\vkQeJCD.exe
  C:\Windows\System\vkQeJCD.exe
  2⤵
  PID:6904
- C:\Windows\System\FiFLZZY.exe
  C:\Windows\System\FiFLZZY.exe
  2⤵
  PID:6932
- C:\Windows\System\QSnPrwJ.exe
  C:\Windows\System\QSnPrwJ.exe
  2⤵
  PID:6960
- C:\Windows\System\YiZhqBs.exe
  C:\Windows\System\YiZhqBs.exe
  2⤵
  PID:6988
- C:\Windows\System\zCAfHAb.exe
  C:\Windows\System\zCAfHAb.exe
  2⤵
  PID:7020
- C:\Windows\System\CxnyiLq.exe
  C:\Windows\System\CxnyiLq.exe
  2⤵
  PID:7048
- C:\Windows\System\uQpxxas.exe
  C:\Windows\System\uQpxxas.exe
  2⤵
  PID:7072
- C:\Windows\System\TAGJEHJ.exe
  C:\Windows\System\TAGJEHJ.exe
  2⤵
  PID:7104
- C:\Windows\System\mgUlesB.exe
  C:\Windows\System\mgUlesB.exe
  2⤵
  PID:7128
- C:\Windows\System\kRCHmjJ.exe
  C:\Windows\System\kRCHmjJ.exe
  2⤵
  PID:7160
- C:\Windows\System\ZUQraEL.exe
  C:\Windows\System\ZUQraEL.exe
  2⤵
  PID:5956
- C:\Windows\System\icEHezO.exe
  C:\Windows\System\icEHezO.exe
  2⤵
  PID:6224
- C:\Windows\System\CzVCvLp.exe
  C:\Windows\System\CzVCvLp.exe
  2⤵
  PID:6248
- C:\Windows\System\CXsAFVk.exe
  C:\Windows\System\CXsAFVk.exe
  2⤵
  PID:6300
- C:\Windows\System\FAGizXB.exe
  C:\Windows\System\FAGizXB.exe
  2⤵
  PID:6408
- C:\Windows\System\bfiiPVw.exe
  C:\Windows\System\bfiiPVw.exe
  2⤵
  PID:6436
- C:\Windows\System\AOSgjRb.exe
  C:\Windows\System\AOSgjRb.exe
  2⤵
  PID:6376
- C:\Windows\System\WaliFQJ.exe
  C:\Windows\System\WaliFQJ.exe
  2⤵
  PID:6604
- C:\Windows\System\CVGyYqp.exe
  C:\Windows\System\CVGyYqp.exe
  2⤵
  PID:6664
- C:\Windows\System\zYSFOBc.exe
  C:\Windows\System\zYSFOBc.exe
  2⤵
  PID:6536
- C:\Windows\System\sEYfvcT.exe
  C:\Windows\System\sEYfvcT.exe
  2⤵
  PID:6648
- C:\Windows\System\VHwVPYI.exe
  C:\Windows\System\VHwVPYI.exe
  2⤵
  PID:6736
- C:\Windows\System\MTDjCZl.exe
  C:\Windows\System\MTDjCZl.exe
  2⤵
  PID:6840
- C:\Windows\System\orWdkpj.exe
  C:\Windows\System\orWdkpj.exe
  2⤵
  PID:6760
- C:\Windows\System\dprUjAM.exe
  C:\Windows\System\dprUjAM.exe
  2⤵
  PID:6812
- C:\Windows\System\wrqsgRp.exe
  C:\Windows\System\wrqsgRp.exe
  2⤵
  PID:7064
- C:\Windows\System\eKoDEba.exe
  C:\Windows\System\eKoDEba.exe
  2⤵
  PID:6924
- C:\Windows\System\xJmKmjj.exe
  C:\Windows\System\xJmKmjj.exe
  2⤵
  PID:6208
- C:\Windows\System\OtnTJMj.exe
  C:\Windows\System\OtnTJMj.exe
  2⤵
  PID:7040
- C:\Windows\System\BrDdBdD.exe
  C:\Windows\System\BrDdBdD.exe
  2⤵
  PID:6344
- C:\Windows\System\BKLWkbY.exe
  C:\Windows\System\BKLWkbY.exe
  2⤵
  PID:6372
- C:\Windows\System\OfzYdAp.exe
  C:\Windows\System\OfzYdAp.exe
  2⤵
  PID:6548
- C:\Windows\System\zZIZzQi.exe
  C:\Windows\System\zZIZzQi.exe
  2⤵
  PID:6296
- C:\Windows\System\gTRLENH.exe
  C:\Windows\System\gTRLENH.exe
  2⤵
  PID:6888
- C:\Windows\System\cVrEivx.exe
  C:\Windows\System\cVrEivx.exe
  2⤵
  PID:6972
- C:\Windows\System\UiKTioK.exe
  C:\Windows\System\UiKTioK.exe
  2⤵
  PID:6220
- C:\Windows\System\RGsVMQA.exe
  C:\Windows\System\RGsVMQA.exe
  2⤵
  PID:7028
- C:\Windows\System\WNeMMPL.exe
  C:\Windows\System\WNeMMPL.exe
  2⤵
  PID:6780
- C:\Windows\System\fUWOSRP.exe
  C:\Windows\System\fUWOSRP.exe
  2⤵
  PID:7196
- C:\Windows\System\tFRtbdi.exe
  C:\Windows\System\tFRtbdi.exe
  2⤵
  PID:7216
- C:\Windows\System\hHkgvUk.exe
  C:\Windows\System\hHkgvUk.exe
  2⤵
  PID:7248
- C:\Windows\System\ykXvCLA.exe
  C:\Windows\System\ykXvCLA.exe
  2⤵
  PID:7268
- C:\Windows\System\itaaZig.exe
  C:\Windows\System\itaaZig.exe
  2⤵
  PID:7300
- C:\Windows\System\EOyPtbN.exe
  C:\Windows\System\EOyPtbN.exe
  2⤵
  PID:7332
- C:\Windows\System\RSmkoEa.exe
  C:\Windows\System\RSmkoEa.exe
  2⤵
  PID:7356
- C:\Windows\System\cnCMKkG.exe
  C:\Windows\System\cnCMKkG.exe
  2⤵
  PID:7384
- C:\Windows\System\MSKaDQo.exe
  C:\Windows\System\MSKaDQo.exe
  2⤵
  PID:7408
- C:\Windows\System\vRmouRo.exe
  C:\Windows\System\vRmouRo.exe
  2⤵
  PID:7432
- C:\Windows\System\EsppdPr.exe
  C:\Windows\System\EsppdPr.exe
  2⤵
  PID:7460
- C:\Windows\System\YETNZEo.exe
  C:\Windows\System\YETNZEo.exe
  2⤵
  PID:7488
- C:\Windows\System\cgnBWZA.exe
  C:\Windows\System\cgnBWZA.exe
  2⤵
  PID:7512
- C:\Windows\System\xspJVUK.exe
  C:\Windows\System\xspJVUK.exe
  2⤵
  PID:7532
- C:\Windows\System\blTVqUx.exe
  C:\Windows\System\blTVqUx.exe
  2⤵
  PID:7564
- C:\Windows\System\gFyahJD.exe
  C:\Windows\System\gFyahJD.exe
  2⤵
  PID:7592
- C:\Windows\System\lPflggG.exe
  C:\Windows\System\lPflggG.exe
  2⤵
  PID:7620
- C:\Windows\System\sLkjRgK.exe
  C:\Windows\System\sLkjRgK.exe
  2⤵
  PID:7652
- C:\Windows\System\QkaYVHp.exe
  C:\Windows\System\QkaYVHp.exe
  2⤵
  PID:7700
- C:\Windows\System\yJtOyUE.exe
  C:\Windows\System\yJtOyUE.exe
  2⤵
  PID:7728
- C:\Windows\System\iQeOZqN.exe
  C:\Windows\System\iQeOZqN.exe
  2⤵
  PID:7756
- C:\Windows\System\wWFpjhm.exe
  C:\Windows\System\wWFpjhm.exe
  2⤵
  PID:7788
- C:\Windows\System\FhlheZo.exe
  C:\Windows\System\FhlheZo.exe
  2⤵
  PID:7816
- C:\Windows\System\pZboQOU.exe
  C:\Windows\System\pZboQOU.exe
  2⤵
  PID:7836
- C:\Windows\System\pnUzlvi.exe
  C:\Windows\System\pnUzlvi.exe
  2⤵
  PID:7852
- C:\Windows\System\xPoTnud.exe
  C:\Windows\System\xPoTnud.exe
  2⤵
  PID:7884
- C:\Windows\System\mfniSck.exe
  C:\Windows\System\mfniSck.exe
  2⤵
  PID:7904
- C:\Windows\System\IuBzZPS.exe
  C:\Windows\System\IuBzZPS.exe
  2⤵
  PID:7936
- C:\Windows\System\wTXdxvd.exe
  C:\Windows\System\wTXdxvd.exe
  2⤵
  PID:7956
- C:\Windows\System\AueUvhr.exe
  C:\Windows\System\AueUvhr.exe
  2⤵
  PID:7988
- C:\Windows\System\afCEujo.exe
  C:\Windows\System\afCEujo.exe
  2⤵
  PID:8008
- C:\Windows\System\FhNJnds.exe
  C:\Windows\System\FhNJnds.exe
  2⤵
  PID:8028
- C:\Windows\System\TAGsmOV.exe
  C:\Windows\System\TAGsmOV.exe
  2⤵
  PID:8056
- C:\Windows\System\ieugGlN.exe
  C:\Windows\System\ieugGlN.exe
  2⤵
  PID:8080
- C:\Windows\System\xsceqEd.exe
  C:\Windows\System\xsceqEd.exe
  2⤵
  PID:8104
- C:\Windows\System\mrlBhVo.exe
  C:\Windows\System\mrlBhVo.exe
  2⤵
  PID:8136
- C:\Windows\System\DYGNHVc.exe
  C:\Windows\System\DYGNHVc.exe
  2⤵
  PID:8160
- C:\Windows\System\kEKcySv.exe
  C:\Windows\System\kEKcySv.exe
  2⤵
  PID:8184
- C:\Windows\System\EcTIuqj.exe
  C:\Windows\System\EcTIuqj.exe
  2⤵
  PID:7080
- C:\Windows\System\fFVjpiY.exe
  C:\Windows\System\fFVjpiY.exe
  2⤵
  PID:6528
- C:\Windows\System\sSQyYlp.exe
  C:\Windows\System\sSQyYlp.exe
  2⤵
  PID:7236
- C:\Windows\System\PazTuka.exe
  C:\Windows\System\PazTuka.exe
  2⤵
  PID:7296
- C:\Windows\System\dBhrVnx.exe
  C:\Windows\System\dBhrVnx.exe
  2⤵
  PID:7376
- C:\Windows\System\tuyHXDM.exe
  C:\Windows\System\tuyHXDM.exe
  2⤵
  PID:7348
- C:\Windows\System\JEpbKyl.exe
  C:\Windows\System\JEpbKyl.exe
  2⤵
  PID:7572
- C:\Windows\System\FDySGHt.exe
  C:\Windows\System\FDySGHt.exe
  2⤵
  PID:7616
- C:\Windows\System\DVOVfFo.exe
  C:\Windows\System\DVOVfFo.exe
  2⤵
  PID:7484
- C:\Windows\System\VxSgBBf.exe
  C:\Windows\System\VxSgBBf.exe
  2⤵
  PID:7500
- C:\Windows\System\nEAOaik.exe
  C:\Windows\System\nEAOaik.exe
  2⤵
  PID:7812
- C:\Windows\System\ZZLpsJQ.exe
  C:\Windows\System\ZZLpsJQ.exe
  2⤵
  PID:7528
- C:\Windows\System\SYcZqMl.exe
  C:\Windows\System\SYcZqMl.exe
  2⤵
  PID:7896
- C:\Windows\System\IlqBnab.exe
  C:\Windows\System\IlqBnab.exe
  2⤵
  PID:7772
- C:\Windows\System\kWMkAUF.exe
  C:\Windows\System\kWMkAUF.exe
  2⤵
  PID:7880
- C:\Windows\System\pXtQpSa.exe
  C:\Windows\System\pXtQpSa.exe
  2⤵
  PID:7948
- C:\Windows\System\OedDmVL.exe
  C:\Windows\System\OedDmVL.exe
  2⤵
  PID:7980
- C:\Windows\System\krltbUx.exe
  C:\Windows\System\krltbUx.exe
  2⤵
  PID:6704
- C:\Windows\System\VVsaTdd.exe
  C:\Windows\System\VVsaTdd.exe
  2⤵
  PID:6740
- C:\Windows\System\rlQitMk.exe
  C:\Windows\System\rlQitMk.exe
  2⤵
  PID:7548
- C:\Windows\System\uAqpRbq.exe
  C:\Windows\System\uAqpRbq.exe
  2⤵
  PID:7320
- C:\Windows\System\zBIQOZx.exe
  C:\Windows\System\zBIQOZx.exe
  2⤵
  PID:7096
- C:\Windows\System\tMaPNVR.exe
  C:\Windows\System\tMaPNVR.exe
  2⤵
  PID:7400
- C:\Windows\System\rzqjcxI.exe
  C:\Windows\System\rzqjcxI.exe
  2⤵
  PID:7212
- C:\Windows\System\eTXurnz.exe
  C:\Windows\System\eTXurnz.exe
  2⤵
  PID:7344
- C:\Windows\System\QyiwulQ.exe
  C:\Windows\System\QyiwulQ.exe
  2⤵
  PID:8200
- C:\Windows\System\huHsORq.exe
  C:\Windows\System\huHsORq.exe
  2⤵
  PID:8224
- C:\Windows\System\xkxVLBi.exe
  C:\Windows\System\xkxVLBi.exe
  2⤵
  PID:8248
- C:\Windows\System\ezsvKnC.exe
  C:\Windows\System\ezsvKnC.exe
  2⤵
  PID:8280
- C:\Windows\System\PGflRJG.exe
  C:\Windows\System\PGflRJG.exe
  2⤵
  PID:8304
- C:\Windows\System\IQpAVdD.exe
  C:\Windows\System\IQpAVdD.exe
  2⤵
  PID:8336
- C:\Windows\System\UdcAQOA.exe
  C:\Windows\System\UdcAQOA.exe
  2⤵
  PID:8364
- C:\Windows\System\gJotZyM.exe
  C:\Windows\System\gJotZyM.exe
  2⤵
  PID:8392
- C:\Windows\System\SnEWwhz.exe
  C:\Windows\System\SnEWwhz.exe
  2⤵
  PID:8416
- C:\Windows\System\bESLgYI.exe
  C:\Windows\System\bESLgYI.exe
  2⤵
  PID:8440
- C:\Windows\System\OvEstwR.exe
  C:\Windows\System\OvEstwR.exe
  2⤵
  PID:8472
- C:\Windows\System\kpHVYPI.exe
  C:\Windows\System\kpHVYPI.exe
  2⤵
  PID:8500
- C:\Windows\System\huzVsdD.exe
  C:\Windows\System\huzVsdD.exe
  2⤵
  PID:8532
- C:\Windows\System\okwhZDs.exe
  C:\Windows\System\okwhZDs.exe
  2⤵
  PID:8556
- C:\Windows\System\boPnOHH.exe
  C:\Windows\System\boPnOHH.exe
  2⤵
  PID:8584
- C:\Windows\System\ccSbSdw.exe
  C:\Windows\System\ccSbSdw.exe
  2⤵
  PID:8612
- C:\Windows\System\nnyiszJ.exe
  C:\Windows\System\nnyiszJ.exe
  2⤵
  PID:8636
- C:\Windows\System\RjxrSUa.exe
  C:\Windows\System\RjxrSUa.exe
  2⤵
  PID:8664
- C:\Windows\System\OmJtDDb.exe
  C:\Windows\System\OmJtDDb.exe
  2⤵
  PID:8692
- C:\Windows\System\qiowejs.exe
  C:\Windows\System\qiowejs.exe
  2⤵
  PID:8716
- C:\Windows\System\BMnXztU.exe
  C:\Windows\System\BMnXztU.exe
  2⤵
  PID:8732
- C:\Windows\System\SBjjlEj.exe
  C:\Windows\System\SBjjlEj.exe
  2⤵
  PID:8760
- C:\Windows\System\DGIekQn.exe
  C:\Windows\System\DGIekQn.exe
  2⤵
  PID:8780
- C:\Windows\System\uofIVNs.exe
  C:\Windows\System\uofIVNs.exe
  2⤵
  PID:8808
- C:\Windows\System\WkyPZcb.exe
  C:\Windows\System\WkyPZcb.exe
  2⤵
  PID:8832
- C:\Windows\System\lvAsMeT.exe
  C:\Windows\System\lvAsMeT.exe
  2⤵
  PID:8856
- C:\Windows\System\wEWlveO.exe
  C:\Windows\System\wEWlveO.exe
  2⤵
  PID:8876
- C:\Windows\System\JmzPlhw.exe
  C:\Windows\System\JmzPlhw.exe
  2⤵
  PID:8900
- C:\Windows\System\QyTyotB.exe
  C:\Windows\System\QyTyotB.exe
  2⤵
  PID:8928
- C:\Windows\System\WztnjIa.exe
  C:\Windows\System\WztnjIa.exe
  2⤵
  PID:8956
- C:\Windows\System\TvQoKww.exe
  C:\Windows\System\TvQoKww.exe
  2⤵
  PID:8988
- C:\Windows\System\qYrpkUB.exe
  C:\Windows\System\qYrpkUB.exe
  2⤵
  PID:9012
- C:\Windows\System\vajmxNo.exe
  C:\Windows\System\vajmxNo.exe
  2⤵
  PID:9032
- C:\Windows\System\DcPpVuJ.exe
  C:\Windows\System\DcPpVuJ.exe
  2⤵
  PID:9056
- C:\Windows\System\DvxejkR.exe
  C:\Windows\System\DvxejkR.exe
  2⤵
  PID:9080
- C:\Windows\System\DethEOf.exe
  C:\Windows\System\DethEOf.exe
  2⤵
  PID:9096
- C:\Windows\System\psHbEAV.exe
  C:\Windows\System\psHbEAV.exe
  2⤵
  PID:9124
- C:\Windows\System\AzfLkYe.exe
  C:\Windows\System\AzfLkYe.exe
  2⤵
  PID:9140
- C:\Windows\System\TJggkYD.exe
  C:\Windows\System\TJggkYD.exe
  2⤵
  PID:9168
- C:\Windows\System\wVQzhKm.exe
  C:\Windows\System\wVQzhKm.exe
  2⤵
  PID:9200
- C:\Windows\System\zvLRpPf.exe
  C:\Windows\System\zvLRpPf.exe
  2⤵
  PID:7996
- C:\Windows\System\oJWNfrs.exe
  C:\Windows\System\oJWNfrs.exe
  2⤵
  PID:7708
- C:\Windows\System\FMeMlnZ.exe
  C:\Windows\System\FMeMlnZ.exe
  2⤵
  PID:7264
- C:\Windows\System\ZGlsBbB.exe
  C:\Windows\System\ZGlsBbB.exe
  2⤵
  PID:8232
- C:\Windows\System\HKFJIvh.exe
  C:\Windows\System\HKFJIvh.exe
  2⤵
  PID:8268
- C:\Windows\System\GZSBrvt.exe
  C:\Windows\System\GZSBrvt.exe
  2⤵
  PID:8324
- C:\Windows\System\knmEhrZ.exe
  C:\Windows\System\knmEhrZ.exe
  2⤵
  PID:8400
- C:\Windows\System\LMnLrTB.exe
  C:\Windows\System\LMnLrTB.exe
  2⤵
  PID:8448
- C:\Windows\System\oPokpxc.exe
  C:\Windows\System\oPokpxc.exe
  2⤵
  PID:8596
- C:\Windows\System\BvzccSV.exe
  C:\Windows\System\BvzccSV.exe
  2⤵
  PID:8672
- C:\Windows\System\LpSePyx.exe
  C:\Windows\System\LpSePyx.exe
  2⤵
  PID:8460
- C:\Windows\System\iICpSAa.exe
  C:\Windows\System\iICpSAa.exe
  2⤵
  PID:8724
- C:\Windows\System\izKCMBp.exe
  C:\Windows\System\izKCMBp.exe
  2⤵
  PID:8548
- C:\Windows\System\CmPVjKx.exe
  C:\Windows\System\CmPVjKx.exe
  2⤵
  PID:8816
- C:\Windows\System\FvUwppI.exe
  C:\Windows\System\FvUwppI.exe
  2⤵
  PID:8468
- C:\Windows\System\HebEzsT.exe
  C:\Windows\System\HebEzsT.exe
  2⤵
  PID:8524
- C:\Windows\System\qshrSyJ.exe
  C:\Windows\System\qshrSyJ.exe
  2⤵
  PID:8984
- C:\Windows\System\BZnsieM.exe
  C:\Windows\System\BZnsieM.exe
  2⤵
  PID:9044
- C:\Windows\System\RFjYFZD.exe
  C:\Windows\System\RFjYFZD.exe
  2⤵
  PID:8868
- C:\Windows\System\cNgfgep.exe
  C:\Windows\System\cNgfgep.exe
  2⤵
  PID:8940
- C:\Windows\System\kumBbGV.exe
  C:\Windows\System\kumBbGV.exe
  2⤵
  PID:8020
- C:\Windows\System\zesnhoT.exe
  C:\Windows\System\zesnhoT.exe
  2⤵
  PID:9076
- C:\Windows\System\DwetYxk.exe
  C:\Windows\System\DwetYxk.exe
  2⤵
  PID:8848
- C:\Windows\System\FnisOwK.exe
  C:\Windows\System\FnisOwK.exe
  2⤵
  PID:6580
- C:\Windows\System\WfbbVHE.exe
  C:\Windows\System\WfbbVHE.exe
  2⤵
  PID:8436
- C:\Windows\System\TpBMwAL.exe
  C:\Windows\System\TpBMwAL.exe
  2⤵
  PID:9220
- C:\Windows\System\TqzOCHv.exe
  C:\Windows\System\TqzOCHv.exe
  2⤵
  PID:9244
- C:\Windows\System\OPFNjRe.exe
  C:\Windows\System\OPFNjRe.exe
  2⤵
  PID:9276
- C:\Windows\System\hWmjERc.exe
  C:\Windows\System\hWmjERc.exe
  2⤵
  PID:9308
- C:\Windows\System\TPLmGwH.exe
  C:\Windows\System\TPLmGwH.exe
  2⤵
  PID:9332
- C:\Windows\System\sMrCEDZ.exe
  C:\Windows\System\sMrCEDZ.exe
  2⤵
  PID:9364
- C:\Windows\System\BHYBqIL.exe
  C:\Windows\System\BHYBqIL.exe
  2⤵
  PID:9384
- C:\Windows\System\UcePsSv.exe
  C:\Windows\System\UcePsSv.exe
  2⤵
  PID:9416
- C:\Windows\System\GUmbbeu.exe
  C:\Windows\System\GUmbbeu.exe
  2⤵
  PID:9448
- C:\Windows\System\GlpNzMO.exe
  C:\Windows\System\GlpNzMO.exe
  2⤵
  PID:9468
- C:\Windows\System\nmpzhtb.exe
  C:\Windows\System\nmpzhtb.exe
  2⤵
  PID:9488
- C:\Windows\System\HHRAvYc.exe
  C:\Windows\System\HHRAvYc.exe
  2⤵
  PID:9516
- C:\Windows\System\eAAcUWE.exe
  C:\Windows\System\eAAcUWE.exe
  2⤵
  PID:9544
- C:\Windows\System\CZGmlpW.exe
  C:\Windows\System\CZGmlpW.exe
  2⤵
  PID:9572
- C:\Windows\System\svIdBrA.exe
  C:\Windows\System\svIdBrA.exe
  2⤵
  PID:9592
- C:\Windows\System\amnLNhF.exe
  C:\Windows\System\amnLNhF.exe
  2⤵
  PID:9620
- C:\Windows\System\ZIQEGMx.exe
  C:\Windows\System\ZIQEGMx.exe
  2⤵
  PID:9640
- C:\Windows\System\lYngAbI.exe
  C:\Windows\System\lYngAbI.exe
  2⤵
  PID:9660
- C:\Windows\System\YpuPhWu.exe
  C:\Windows\System\YpuPhWu.exe
  2⤵
  PID:9684
- C:\Windows\System\GNLptMZ.exe
  C:\Windows\System\GNLptMZ.exe
  2⤵
  PID:9712
- C:\Windows\System\cAXkICh.exe
  C:\Windows\System\cAXkICh.exe
  2⤵
  PID:9732
- C:\Windows\System\JwpaTCO.exe
  C:\Windows\System\JwpaTCO.exe
  2⤵
  PID:9756
- C:\Windows\System\cGQWHaI.exe
  C:\Windows\System\cGQWHaI.exe
  2⤵
  PID:9780
- C:\Windows\System\qfhkrNN.exe
  C:\Windows\System\qfhkrNN.exe
  2⤵
  PID:9804
- C:\Windows\System\tnkTdtC.exe
  C:\Windows\System\tnkTdtC.exe
  2⤵
  PID:9832
- C:\Windows\System\xEPzTbT.exe
  C:\Windows\System\xEPzTbT.exe
  2⤵
  PID:9860
- C:\Windows\System\wvoCdBe.exe
  C:\Windows\System\wvoCdBe.exe
  2⤵
  PID:9892
- C:\Windows\System\llZaPop.exe
  C:\Windows\System\llZaPop.exe
  2⤵
  PID:9920
- C:\Windows\System\BjeBTBn.exe
  C:\Windows\System\BjeBTBn.exe
  2⤵
  PID:9948
- C:\Windows\System\qdXrrlg.exe
  C:\Windows\System\qdXrrlg.exe
  2⤵
  PID:9976
- C:\Windows\System\vDDiLFG.exe
  C:\Windows\System\vDDiLFG.exe
  2⤵
  PID:10000
- C:\Windows\System\ddWRBMc.exe
  C:\Windows\System\ddWRBMc.exe
  2⤵
  PID:10024
- C:\Windows\System\OeJJWMI.exe
  C:\Windows\System\OeJJWMI.exe
  2⤵
  PID:10040
- C:\Windows\System\lLDlERK.exe
  C:\Windows\System\lLDlERK.exe
  2⤵
  PID:10068
- C:\Windows\System\daKajcp.exe
  C:\Windows\System\daKajcp.exe
  2⤵
  PID:10096
- C:\Windows\System\KMnumca.exe
  C:\Windows\System\KMnumca.exe
  2⤵
  PID:10120
- C:\Windows\System\OFnJwgY.exe
  C:\Windows\System\OFnJwgY.exe
  2⤵
  PID:10144
- C:\Windows\System\kHXmYFa.exe
  C:\Windows\System\kHXmYFa.exe
  2⤵
  PID:10164
- C:\Windows\System\qUjprrt.exe
  C:\Windows\System\qUjprrt.exe
  2⤵
  PID:10188
- C:\Windows\System\ffmdAvA.exe
  C:\Windows\System\ffmdAvA.exe
  2⤵
  PID:10216
- C:\Windows\System\KNAOLja.exe
  C:\Windows\System\KNAOLja.exe
  2⤵
  PID:8216
- C:\Windows\System\RNMFjUp.exe
  C:\Windows\System\RNMFjUp.exe
  2⤵
  PID:8892
- C:\Windows\System\UsCXzfs.exe
  C:\Windows\System\UsCXzfs.exe
  2⤵
  PID:8944
- C:\Windows\System\SYXvBtl.exe
  C:\Windows\System\SYXvBtl.exe
  2⤵
  PID:9132
- C:\Windows\System\IWFrUJC.exe
  C:\Windows\System\IWFrUJC.exe
  2⤵
  PID:8972
- C:\Windows\System\ytLoZbA.exe
  C:\Windows\System\ytLoZbA.exe
  2⤵
  PID:9072
- C:\Windows\System\xeqGSKL.exe
  C:\Windows\System\xeqGSKL.exe
  2⤵
  PID:8428
- C:\Windows\System\KrLnjpw.exe
  C:\Windows\System\KrLnjpw.exe
  2⤵
  PID:8804
- C:\Windows\System\erOMvGK.exe
  C:\Windows\System\erOMvGK.exe
  2⤵
  PID:8176
- C:\Windows\System\fBwDKhz.exe
  C:\Windows\System\fBwDKhz.exe
  2⤵
  PID:8748
- C:\Windows\System\OhwqQyp.exe
  C:\Windows\System\OhwqQyp.exe
  2⤵
  PID:8684
- C:\Windows\System\ZJsfiQU.exe
  C:\Windows\System\ZJsfiQU.exe
  2⤵
  PID:9612
- C:\Windows\System\zyMOuNu.exe
  C:\Windows\System\zyMOuNu.exe
  2⤵
  PID:9648
- C:\Windows\System\dnJTXbM.exe
  C:\Windows\System\dnJTXbM.exe
  2⤵
  PID:8888
- C:\Windows\System\WGzcPDT.exe
  C:\Windows\System\WGzcPDT.exe
  2⤵
  PID:9748
- C:\Windows\System\kqkLrvk.exe
  C:\Windows\System\kqkLrvk.exe
  2⤵
  PID:8952
- C:\Windows\System\dGNRYSj.exe
  C:\Windows\System\dGNRYSj.exe
  2⤵
  PID:9092
- C:\Windows\System\JdNGgTX.exe
  C:\Windows\System\JdNGgTX.exe
  2⤵
  PID:9500
- C:\Windows\System\XyicVLr.exe
  C:\Windows\System\XyicVLr.exe
  2⤵
  PID:9236
- C:\Windows\System\PinvLIR.exe
  C:\Windows\System\PinvLIR.exe
  2⤵
  PID:9328
- C:\Windows\System\TGIjXQQ.exe
  C:\Windows\System\TGIjXQQ.exe
  2⤵
  PID:9352
- C:\Windows\System\KTHJxcc.exe
  C:\Windows\System\KTHJxcc.exe
  2⤵
  PID:9412
- C:\Windows\System\BqzFkfO.exe
  C:\Windows\System\BqzFkfO.exe
  2⤵
  PID:9856
- C:\Windows\System\HqwLisD.exe
  C:\Windows\System\HqwLisD.exe
  2⤵
  PID:9504
- C:\Windows\System\AxLzfWf.exe
  C:\Windows\System\AxLzfWf.exe
  2⤵
  PID:9944
- C:\Windows\System\qQkLZSI.exe
  C:\Windows\System\qQkLZSI.exe
  2⤵
  PID:9192
- C:\Windows\System\ddjVxCM.exe
  C:\Windows\System\ddjVxCM.exe
  2⤵
  PID:10268
- C:\Windows\System\hGImSNQ.exe
  C:\Windows\System\hGImSNQ.exe
  2⤵
  PID:10296
- C:\Windows\System\oFgJulY.exe
  C:\Windows\System\oFgJulY.exe
  2⤵
  PID:10328
- C:\Windows\System\UBqQjAh.exe
  C:\Windows\System\UBqQjAh.exe
  2⤵
  PID:10352
- C:\Windows\System\zkeamcn.exe
  C:\Windows\System\zkeamcn.exe
  2⤵
  PID:10376
- C:\Windows\System\GKJKpNu.exe
  C:\Windows\System\GKJKpNu.exe
  2⤵
  PID:10400
- C:\Windows\System\NIzdUkX.exe
  C:\Windows\System\NIzdUkX.exe
  2⤵
  PID:10420
- C:\Windows\System\JWQfFhY.exe
  C:\Windows\System\JWQfFhY.exe
  2⤵
  PID:10452
- C:\Windows\System\jJkLvuq.exe
  C:\Windows\System\jJkLvuq.exe
  2⤵
  PID:10472
- C:\Windows\System\znGgdlV.exe
  C:\Windows\System\znGgdlV.exe
  2⤵
  PID:10496
- C:\Windows\System\xqLMfDN.exe
  C:\Windows\System\xqLMfDN.exe
  2⤵
  PID:10528
- C:\Windows\System\XHpcyWg.exe
  C:\Windows\System\XHpcyWg.exe
  2⤵
  PID:10556
- C:\Windows\System\spVUsLI.exe
  C:\Windows\System\spVUsLI.exe
  2⤵
  PID:10580
- C:\Windows\System\tqMzzdo.exe
  C:\Windows\System\tqMzzdo.exe
  2⤵
  PID:10616
- C:\Windows\System\Abffkrz.exe
  C:\Windows\System\Abffkrz.exe
  2⤵
  PID:10648
- C:\Windows\System\uppvRcn.exe
  C:\Windows\System\uppvRcn.exe
  2⤵
  PID:10672
- C:\Windows\System\ORlLKMO.exe
  C:\Windows\System\ORlLKMO.exe
  2⤵
  PID:10700
- C:\Windows\System\oenqqYD.exe
  C:\Windows\System\oenqqYD.exe
  2⤵
  PID:10724
- C:\Windows\System\zvZVXKo.exe
  C:\Windows\System\zvZVXKo.exe
  2⤵
  PID:10748
- C:\Windows\System\azBzATj.exe
  C:\Windows\System\azBzATj.exe
  2⤵
  PID:10776
- C:\Windows\System\kjTpRfh.exe
  C:\Windows\System\kjTpRfh.exe
  2⤵
  PID:10800
- C:\Windows\System\RLxDTql.exe
  C:\Windows\System\RLxDTql.exe
  2⤵
  PID:10828
- C:\Windows\System\ZtFVXmz.exe
  C:\Windows\System\ZtFVXmz.exe
  2⤵
  PID:10860
- C:\Windows\System\IgKxWyR.exe
  C:\Windows\System\IgKxWyR.exe
  2⤵
  PID:10880
- C:\Windows\System\CBhwysP.exe
  C:\Windows\System\CBhwysP.exe
  2⤵
  PID:10896
- C:\Windows\System\IaFadYh.exe
  C:\Windows\System\IaFadYh.exe
  2⤵
  PID:10912
- C:\Windows\System\tpRrUwq.exe
  C:\Windows\System\tpRrUwq.exe
  2⤵
  PID:10932
- C:\Windows\System\NVDRJer.exe
  C:\Windows\System\NVDRJer.exe
  2⤵
  PID:10964
- C:\Windows\System\rCpoZoh.exe
  C:\Windows\System\rCpoZoh.exe
  2⤵
  PID:10992
- C:\Windows\System\OUpDDDF.exe
  C:\Windows\System\OUpDDDF.exe
  2⤵
  PID:11024
- C:\Windows\System\SQDWwOx.exe
  C:\Windows\System\SQDWwOx.exe
  2⤵
  PID:11052
- C:\Windows\System\VKngNOA.exe
  C:\Windows\System\VKngNOA.exe
  2⤵
  PID:11076
- C:\Windows\System\qSctJNt.exe
  C:\Windows\System\qSctJNt.exe
  2⤵
  PID:11092
- C:\Windows\System\lcukwZr.exe
  C:\Windows\System\lcukwZr.exe
  2⤵
  PID:11108
- C:\Windows\System\yDNgTav.exe
  C:\Windows\System\yDNgTav.exe
  2⤵
  PID:11124
- C:\Windows\System\SWnaBZj.exe
  C:\Windows\System\SWnaBZj.exe
  2⤵
  PID:11152
- C:\Windows\System\VPJciNp.exe
  C:\Windows\System\VPJciNp.exe
  2⤵
  PID:11176
- C:\Windows\System\ifJawzw.exe
  C:\Windows\System\ifJawzw.exe
  2⤵
  PID:11208
- C:\Windows\System\pOfJkKa.exe
  C:\Windows\System\pOfJkKa.exe
  2⤵
  PID:11232
- C:\Windows\System\SiFSRtV.exe
  C:\Windows\System\SiFSRtV.exe
  2⤵
  PID:11260
- C:\Windows\System\zjbAieh.exe
  C:\Windows\System\zjbAieh.exe
  2⤵
  PID:9320
- C:\Windows\System\eKgcNYL.exe
  C:\Windows\System\eKgcNYL.exe
  2⤵
  PID:10080
- C:\Windows\System\lnDRwsX.exe
  C:\Windows\System\lnDRwsX.exe
  2⤵
  PID:9300
- C:\Windows\System\bUpTOKZ.exe
  C:\Windows\System\bUpTOKZ.exe
  2⤵
  PID:10112
- C:\Windows\System\BswQNKi.exe
  C:\Windows\System\BswQNKi.exe
  2⤵
  PID:10184
- C:\Windows\System\VnzwWny.exe
  C:\Windows\System\VnzwWny.exe
  2⤵
  PID:9932
- C:\Windows\System\bQNqbQo.exe
  C:\Windows\System\bQNqbQo.exe
  2⤵
  PID:9968
- C:\Windows\System\FslEdVe.exe
  C:\Windows\System\FslEdVe.exe
  2⤵
  PID:8172
- C:\Windows\System\BwnmUkO.exe
  C:\Windows\System\BwnmUkO.exe
  2⤵
  PID:7340
- C:\Windows\System\KZsVndw.exe
  C:\Windows\System\KZsVndw.exe
  2⤵
  PID:9272
- C:\Windows\System\RIcbpuv.exe
  C:\Windows\System\RIcbpuv.exe
  2⤵
  PID:4476
- C:\Windows\System\wVakjDf.exe
  C:\Windows\System\wVakjDf.exe
  2⤵
  PID:9616
- C:\Windows\System\zodhbrV.exe
  C:\Windows\System\zodhbrV.exe
  2⤵
  PID:10200
- C:\Windows\System\aNFlGDK.exe
  C:\Windows\System\aNFlGDK.exe
  2⤵
  PID:10544
- C:\Windows\System\UIVfXFH.exe
  C:\Windows\System\UIVfXFH.exe
  2⤵
  PID:10176
- C:\Windows\System\qYVgbWn.exe
  C:\Windows\System\qYVgbWn.exe
  2⤵
  PID:4796
- C:\Windows\System\FESPwMH.exe
  C:\Windows\System\FESPwMH.exe
  2⤵
  PID:10820
- C:\Windows\System\DGeFjrt.exe
  C:\Windows\System\DGeFjrt.exe
  2⤵
  PID:10888
- C:\Windows\System\kOfvaCr.exe
  C:\Windows\System\kOfvaCr.exe
  2⤵
  PID:10396
- C:\Windows\System\ojBDMTq.exe
  C:\Windows\System\ojBDMTq.exe
  2⤵
  PID:11020
- C:\Windows\System\jIuzNqj.exe
  C:\Windows\System\jIuzNqj.exe
  2⤵
  PID:9068
- C:\Windows\System\VSlpYQc.exe
  C:\Windows\System\VSlpYQc.exe
  2⤵
  PID:11276
- C:\Windows\System\qzZfZkd.exe
  C:\Windows\System\qzZfZkd.exe
  2⤵
  PID:11292
- C:\Windows\System\rZcUgBy.exe
  C:\Windows\System\rZcUgBy.exe
  2⤵
  PID:11308
- C:\Windows\System\swpchzG.exe
  C:\Windows\System\swpchzG.exe
  2⤵
  PID:11344
- C:\Windows\System\bRJMIzg.exe
  C:\Windows\System\bRJMIzg.exe
  2⤵
  PID:11364
- C:\Windows\System\nKkTFbF.exe
  C:\Windows\System\nKkTFbF.exe
  2⤵
  PID:11388
- C:\Windows\System\XjqbnHM.exe
  C:\Windows\System\XjqbnHM.exe
  2⤵
  PID:11412
- C:\Windows\System\fpvLecU.exe
  C:\Windows\System\fpvLecU.exe
  2⤵
  PID:11432
- C:\Windows\System\kytvYIr.exe
  C:\Windows\System\kytvYIr.exe
  2⤵
  PID:11460
- C:\Windows\System\TyZZrhL.exe
  C:\Windows\System\TyZZrhL.exe
  2⤵
  PID:11492
- C:\Windows\System\wpKQzgj.exe
  C:\Windows\System\wpKQzgj.exe
  2⤵
  PID:11512
- C:\Windows\System\mMvJjDu.exe
  C:\Windows\System\mMvJjDu.exe
  2⤵
  PID:11544
- C:\Windows\System\YCWErOb.exe
  C:\Windows\System\YCWErOb.exe
  2⤵
  PID:11572
- C:\Windows\System\akRYhgz.exe
  C:\Windows\System\akRYhgz.exe
  2⤵
  PID:11592
- C:\Windows\System\BmBDJKR.exe
  C:\Windows\System\BmBDJKR.exe
  2⤵
  PID:11612
- C:\Windows\System\zqwGHnA.exe
  C:\Windows\System\zqwGHnA.exe
  2⤵
  PID:11644
- C:\Windows\System\DjWxfVa.exe
  C:\Windows\System\DjWxfVa.exe
  2⤵
  PID:11664
- C:\Windows\System\TObAkBD.exe
  C:\Windows\System\TObAkBD.exe
  2⤵
  PID:11692
- C:\Windows\System\YCRmhme.exe
  C:\Windows\System\YCRmhme.exe
  2⤵
  PID:11720
- C:\Windows\System\DaAadSl.exe
  C:\Windows\System\DaAadSl.exe
  2⤵
  PID:11740
- C:\Windows\System\ACNczFZ.exe
  C:\Windows\System\ACNczFZ.exe
  2⤵
  PID:11760
- C:\Windows\System\AdqTxvH.exe
  C:\Windows\System\AdqTxvH.exe
  2⤵
  PID:11788
- C:\Windows\System\TnWnysj.exe
  C:\Windows\System\TnWnysj.exe
  2⤵
  PID:11812
- C:\Windows\System\VbZMHWz.exe
  C:\Windows\System\VbZMHWz.exe
  2⤵
  PID:11832
- C:\Windows\System\NZaRMlI.exe
  C:\Windows\System\NZaRMlI.exe
  2⤵
  PID:11856
- C:\Windows\System\wcDQjTP.exe
  C:\Windows\System\wcDQjTP.exe
  2⤵
  PID:11880
- C:\Windows\System\kXMnctA.exe
  C:\Windows\System\kXMnctA.exe
  2⤵
  PID:11900
- C:\Windows\System\sIyAuji.exe
  C:\Windows\System\sIyAuji.exe
  2⤵
  PID:11928
- C:\Windows\System\pbDBbOe.exe
  C:\Windows\System\pbDBbOe.exe
  2⤵
  PID:11956
- C:\Windows\System\wWTNgYE.exe
  C:\Windows\System\wWTNgYE.exe
  2⤵
  PID:11972
- C:\Windows\System\rpjEJCw.exe
  C:\Windows\System\rpjEJCw.exe
  2⤵
  PID:11996
- C:\Windows\System\gcKumwQ.exe
  C:\Windows\System\gcKumwQ.exe
  2⤵
  PID:12020
- C:\Windows\System\HwtSiNy.exe
  C:\Windows\System\HwtSiNy.exe
  2⤵
  PID:12044
- C:\Windows\System\UQamUbU.exe
  C:\Windows\System\UQamUbU.exe
  2⤵
  PID:12068
- C:\Windows\System\LEWXxYG.exe
  C:\Windows\System\LEWXxYG.exe
  2⤵
  PID:12092
- C:\Windows\System\vramotj.exe
  C:\Windows\System\vramotj.exe
  2⤵
  PID:12124
- C:\Windows\System\JLczSst.exe
  C:\Windows\System\JLczSst.exe
  2⤵
  PID:12152
- C:\Windows\System\XvZuzUn.exe
  C:\Windows\System\XvZuzUn.exe
  2⤵
  PID:12176
- C:\Windows\System\PCUtIUP.exe
  C:\Windows\System\PCUtIUP.exe
  2⤵
  PID:12204
- C:\Windows\System\CpuTrQK.exe
  C:\Windows\System\CpuTrQK.exe
  2⤵
  PID:12224
- C:\Windows\System\WdtmOBy.exe
  C:\Windows\System\WdtmOBy.exe
  2⤵
  PID:12248
- C:\Windows\System\XoPaEhB.exe
  C:\Windows\System\XoPaEhB.exe
  2⤵
  PID:12280
- C:\Windows\System\JdkTTsu.exe
  C:\Windows\System\JdkTTsu.exe
  2⤵
  PID:9820
- C:\Windows\System\qwdjXcV.exe
  C:\Windows\System\qwdjXcV.exe
  2⤵
  PID:10548
- C:\Windows\System\AbnuZfR.exe
  C:\Windows\System\AbnuZfR.exe
  2⤵
  PID:9728
- C:\Windows\System\uiUrRMB.exe
  C:\Windows\System\uiUrRMB.exe
  2⤵
  PID:10660
- C:\Windows\System\dPXsRLJ.exe
  C:\Windows\System\dPXsRLJ.exe
  2⤵
  PID:8404
- C:\Windows\System\qIhPLfB.exe
  C:\Windows\System\qIhPLfB.exe
  2⤵
  PID:9536
- C:\Windows\System\nhfLisI.exe
  C:\Windows\System\nhfLisI.exe
  2⤵
  PID:9936
- C:\Windows\System\EipGtOK.exe
  C:\Windows\System\EipGtOK.exe
  2⤵
  PID:10812
- C:\Windows\System\EmBJHNl.exe
  C:\Windows\System\EmBJHNl.exe
  2⤵
  PID:10844
- C:\Windows\System\IHvYJVy.exe
  C:\Windows\System\IHvYJVy.exe
  2⤵
  PID:10388
- C:\Windows\System\NEUeTas.exe
  C:\Windows\System\NEUeTas.exe
  2⤵
  PID:10372
- C:\Windows\System\VNCkPXl.exe
  C:\Windows\System\VNCkPXl.exe
  2⤵
  PID:10708
- C:\Windows\System\jvPmQsw.exe
  C:\Windows\System\jvPmQsw.exe
  2⤵
  PID:10412
- C:\Windows\System\xqGCzNP.exe
  C:\Windows\System\xqGCzNP.exe
  2⤵
  PID:10416
- C:\Windows\System\TdmeaGO.exe
  C:\Windows\System\TdmeaGO.exe
  2⤵
  PID:11116
- C:\Windows\System\XwVQAEb.exe
  C:\Windows\System\XwVQAEb.exe
  2⤵
  PID:11320
- C:\Windows\System\lWEuxeg.exe
  C:\Windows\System\lWEuxeg.exe
  2⤵
  PID:9264
- C:\Windows\System\nUaXYcu.exe
  C:\Windows\System\nUaXYcu.exe
  2⤵
  PID:11448
- C:\Windows\System\McQfrDm.exe
  C:\Windows\System\McQfrDm.exe
  2⤵
  PID:8624
- C:\Windows\System\XxsXYAS.exe
  C:\Windows\System\XxsXYAS.exe
  2⤵
  PID:11604
- C:\Windows\System\WUXfhly.exe
  C:\Windows\System\WUXfhly.exe
  2⤵
  PID:10492
- C:\Windows\System\zulAfug.exe
  C:\Windows\System\zulAfug.exe
  2⤵
  PID:3460
- C:\Windows\System\NHUWUgY.exe
  C:\Windows\System\NHUWUgY.exe
  2⤵
  PID:11828
- C:\Windows\System\qRlejgu.exe
  C:\Windows\System\qRlejgu.exe
  2⤵
  PID:11888
- C:\Windows\System\usSNaas.exe
  C:\Windows\System\usSNaas.exe
  2⤵
  PID:11068
- C:\Windows\System\fMIUXmt.exe
  C:\Windows\System\fMIUXmt.exe
  2⤵
  PID:11992
- C:\Windows\System\WHnnVSQ.exe
  C:\Windows\System\WHnnVSQ.exe
  2⤵
  PID:11228
- C:\Windows\System\PyyVgBr.exe
  C:\Windows\System\PyyVgBr.exe
  2⤵
  PID:12080
- C:\Windows\System\WdfUUWp.exe
  C:\Windows\System\WdfUUWp.exe
  2⤵
  PID:12144
- C:\Windows\System\FcHQGKR.exe
  C:\Windows\System\FcHQGKR.exe
  2⤵
  PID:12172
- C:\Windows\System\FyFeFuf.exe
  C:\Windows\System\FyFeFuf.exe
  2⤵
  PID:12312
- C:\Windows\System\NxbLXRh.exe
  C:\Windows\System\NxbLXRh.exe
  2⤵
  PID:12348
- C:\Windows\System\mUzlULC.exe
  C:\Windows\System\mUzlULC.exe
  2⤵
  PID:12368
- C:\Windows\System\EVrllDm.exe
  C:\Windows\System\EVrllDm.exe
  2⤵
  PID:12388
- C:\Windows\System\HUhAZkp.exe
  C:\Windows\System\HUhAZkp.exe
  2⤵
  PID:12412
- C:\Windows\System\FldZrDJ.exe
  C:\Windows\System\FldZrDJ.exe
  2⤵
  PID:12432
- C:\Windows\System\aPGVhus.exe
  C:\Windows\System\aPGVhus.exe
  2⤵
  PID:12464
- C:\Windows\System\fSWZZZS.exe
  C:\Windows\System\fSWZZZS.exe
  2⤵
  PID:12484
- C:\Windows\System\glNZwEv.exe
  C:\Windows\System\glNZwEv.exe
  2⤵
  PID:12520
- C:\Windows\System\eXULtzO.exe
  C:\Windows\System\eXULtzO.exe
  2⤵
  PID:12544
- C:\Windows\System\wxQZdiJ.exe
  C:\Windows\System\wxQZdiJ.exe
  2⤵
  PID:12572
- C:\Windows\System\gcUTNGT.exe
  C:\Windows\System\gcUTNGT.exe
  2⤵
  PID:12596
- C:\Windows\System\elRNPwH.exe
  C:\Windows\System\elRNPwH.exe
  2⤵
  PID:12620
- C:\Windows\System\LKWUzmb.exe
  C:\Windows\System\LKWUzmb.exe
  2⤵
  PID:12640
- C:\Windows\System\ExAFKbG.exe
  C:\Windows\System\ExAFKbG.exe
  2⤵
  PID:12656
- C:\Windows\System\EKNflvt.exe
  C:\Windows\System\EKNflvt.exe
  2⤵
  PID:12684
- C:\Windows\System\YsbAfAe.exe
  C:\Windows\System\YsbAfAe.exe
  2⤵
  PID:12708
- C:\Windows\System\PUtOVby.exe
  C:\Windows\System\PUtOVby.exe
  2⤵
  PID:12724
- C:\Windows\System\SUAKrKH.exe
  C:\Windows\System\SUAKrKH.exe
  2⤵
  PID:12752
- C:\Windows\System\JgoWPQg.exe
  C:\Windows\System\JgoWPQg.exe
  2⤵
  PID:12784
- C:\Windows\System\wwAZkNH.exe
  C:\Windows\System\wwAZkNH.exe
  2⤵
  PID:12808
- C:\Windows\System\QDgbUJE.exe
  C:\Windows\System\QDgbUJE.exe
  2⤵
  PID:12828
- C:\Windows\System\xXrdqio.exe
  C:\Windows\System\xXrdqio.exe
  2⤵
  PID:12856
- C:\Windows\System\KRWvzRf.exe
  C:\Windows\System\KRWvzRf.exe
  2⤵
  PID:12880
- C:\Windows\System\weqwfNh.exe
  C:\Windows\System\weqwfNh.exe
  2⤵
  PID:12904
- C:\Windows\System\XdZHirr.exe
  C:\Windows\System\XdZHirr.exe
  2⤵
  PID:12920
- C:\Windows\System\TmjaloY.exe
  C:\Windows\System\TmjaloY.exe
  2⤵
  PID:12944
- C:\Windows\System\AeJZgIg.exe
  C:\Windows\System\AeJZgIg.exe
  2⤵
  PID:12972
- C:\Windows\System\LEANzbE.exe
  C:\Windows\System\LEANzbE.exe
  2⤵
  PID:12996
- C:\Windows\System\abRdGbj.exe
  C:\Windows\System\abRdGbj.exe
  2⤵
  PID:13024
- C:\Windows\System\wIBFEul.exe
  C:\Windows\System\wIBFEul.exe
  2⤵
  PID:13056
- C:\Windows\System\IKluRVj.exe
  C:\Windows\System\IKluRVj.exe
  2⤵
  PID:13080
- C:\Windows\System\wUlsVeU.exe
  C:\Windows\System\wUlsVeU.exe
  2⤵
  PID:13112
- C:\Windows\System\hwgBNza.exe
  C:\Windows\System\hwgBNza.exe
  2⤵
  PID:13128
- C:\Windows\System\NUydoAQ.exe
  C:\Windows\System\NUydoAQ.exe
  2⤵
  PID:13152
- C:\Windows\System\IlbshyY.exe
  C:\Windows\System\IlbshyY.exe
  2⤵
  PID:13172
- C:\Windows\System\UbBoogQ.exe
  C:\Windows\System\UbBoogQ.exe
  2⤵
  PID:13192
- C:\Windows\System\GEvhIBU.exe
  C:\Windows\System\GEvhIBU.exe
  2⤵
  PID:13220
- C:\Windows\System\NgqrCsE.exe
  C:\Windows\System\NgqrCsE.exe
  2⤵
  PID:13256
- C:\Windows\System\tQIyFtU.exe
  C:\Windows\System\tQIyFtU.exe
  2⤵
  PID:13280
- C:\Windows\System\oQMkJFr.exe
  C:\Windows\System\oQMkJFr.exe
  2⤵
  PID:13304
- C:\Windows\System\JFGUlHK.exe
  C:\Windows\System\JFGUlHK.exe
  2⤵
  PID:12264
- C:\Windows\System\xTDStzh.exe
  C:\Windows\System\xTDStzh.exe
  2⤵
  PID:11556
- C:\Windows\System\XIbsIJJ.exe
  C:\Windows\System\XIbsIJJ.exe
  2⤵
  PID:11580
- C:\Windows\System\JzSYjxZ.exe
  C:\Windows\System\JzSYjxZ.exe
  2⤵
  PID:10136
- C:\Windows\System\eGvOxmr.exe
  C:\Windows\System\eGvOxmr.exe
  2⤵
  PID:9792
- C:\Windows\System\aLRPLLU.exe
  C:\Windows\System\aLRPLLU.exe
  2⤵
  PID:8776
- C:\Windows\System\FbKvGwF.exe
  C:\Windows\System\FbKvGwF.exe
  2⤵
  PID:11804
- C:\Windows\System\PCXsbEZ.exe
  C:\Windows\System\PCXsbEZ.exe
  2⤵
  PID:11864
- C:\Windows\System\GJFmqVF.exe
  C:\Windows\System\GJFmqVF.exe
  2⤵
  PID:11532
- C:\Windows\System\qUeZove.exe
  C:\Windows\System\qUeZove.exe
  2⤵
  PID:12008
- C:\Windows\System\sYWWufT.exe
  C:\Windows\System\sYWWufT.exe
  2⤵
  PID:12040
- C:\Windows\System\AiAJrAo.exe
  C:\Windows\System\AiAJrAo.exe
  2⤵
  PID:11332
- C:\Windows\System\krwEhsu.exe
  C:\Windows\System\krwEhsu.exe
  2⤵
  PID:12104
- C:\Windows\System\YunqPBx.exe
  C:\Windows\System\YunqPBx.exe
  2⤵
  PID:12164
- C:\Windows\System\RGimgoS.exe
  C:\Windows\System\RGimgoS.exe
  2⤵
  PID:12196
- C:\Windows\System\atfYGGy.exe
  C:\Windows\System\atfYGGy.exe
  2⤵
  PID:12400
- C:\Windows\System\HNZvLMe.exe
  C:\Windows\System\HNZvLMe.exe
  2⤵
  PID:12540
- C:\Windows\System\OXiiABz.exe
  C:\Windows\System\OXiiABz.exe
  2⤵
  PID:12584
- C:\Windows\System\qpLSWFU.exe
  C:\Windows\System\qpLSWFU.exe
  2⤵
  PID:12628
- C:\Windows\System\mRFmjyR.exe
  C:\Windows\System\mRFmjyR.exe
  2⤵
  PID:10260
- C:\Windows\System\YJqIjRG.exe
  C:\Windows\System\YJqIjRG.exe
  2⤵
  PID:12748
- C:\Windows\System\cacTvYJ.exe
  C:\Windows\System\cacTvYJ.exe
  2⤵
  PID:11000
- C:\Windows\System\QnaFdxC.exe
  C:\Windows\System\QnaFdxC.exe
  2⤵
  PID:11184
- C:\Windows\System\ZEOfbzp.exe
  C:\Windows\System\ZEOfbzp.exe
  2⤵
  PID:13324
- C:\Windows\System\iFKLddq.exe
  C:\Windows\System\iFKLddq.exe
  2⤵
  PID:13344
- C:\Windows\System\BqGPdwW.exe
  C:\Windows\System\BqGPdwW.exe
  2⤵
  PID:13360
- C:\Windows\System\qbAQQdk.exe
  C:\Windows\System\qbAQQdk.exe
  2⤵
  PID:13388
- C:\Windows\System\YCiISMg.exe
  C:\Windows\System\YCiISMg.exe
  2⤵
  PID:13420
- C:\Windows\System\BIcFNrg.exe
  C:\Windows\System\BIcFNrg.exe
  2⤵
  PID:13440
- C:\Windows\System\vYjtGoW.exe
  C:\Windows\System\vYjtGoW.exe
  2⤵
  PID:13468
- C:\Windows\System\dubAHsk.exe
  C:\Windows\System\dubAHsk.exe
  2⤵
  PID:13488
- C:\Windows\System\yNMjbza.exe
  C:\Windows\System\yNMjbza.exe
  2⤵
  PID:13508
- C:\Windows\System\gtdwjPD.exe
  C:\Windows\System\gtdwjPD.exe
  2⤵
  PID:13536
- C:\Windows\System\uctIReR.exe
  C:\Windows\System\uctIReR.exe
  2⤵
  PID:13560
- C:\Windows\System\UEEWKhH.exe
  C:\Windows\System\UEEWKhH.exe
  2⤵
  PID:13588
- C:\Windows\System\ZDRnnLf.exe
  C:\Windows\System\ZDRnnLf.exe
  2⤵
  PID:13620
- C:\Windows\System\fmIippE.exe
  C:\Windows\System\fmIippE.exe
  2⤵
  PID:13640
- C:\Windows\System\sjnNsyX.exe
  C:\Windows\System\sjnNsyX.exe
  2⤵
  PID:13668
- C:\Windows\System\dZkWykE.exe
  C:\Windows\System\dZkWykE.exe
  2⤵
  PID:13692
- C:\Windows\System\ukJyPGC.exe
  C:\Windows\System\ukJyPGC.exe
  2⤵
  PID:13724
- C:\Windows\System\hBwOEOE.exe
  C:\Windows\System\hBwOEOE.exe
  2⤵
  PID:13744
- C:\Windows\System\SFTEoob.exe
  C:\Windows\System\SFTEoob.exe
  2⤵
  PID:13768
- C:\Windows\System\GJjqlBB.exe
  C:\Windows\System\GJjqlBB.exe
  2⤵
  PID:13796
- C:\Windows\System\ULgtOYJ.exe
  C:\Windows\System\ULgtOYJ.exe
  2⤵
  PID:13820
- C:\Windows\System\ZTsRgng.exe
  C:\Windows\System\ZTsRgng.exe
  2⤵
  PID:13844
- C:\Windows\System\jWBZpgC.exe
  C:\Windows\System\jWBZpgC.exe
  2⤵
  PID:13876
- C:\Windows\System\ypMRUTv.exe
  C:\Windows\System\ypMRUTv.exe
  2⤵
  PID:13900
- C:\Windows\System\UBbzJVn.exe
  C:\Windows\System\UBbzJVn.exe
  2⤵
  PID:13920
- C:\Windows\System\RTOPlSo.exe
  C:\Windows\System\RTOPlSo.exe
  2⤵
  PID:13952
- C:\Windows\System\kWTpVhU.exe
  C:\Windows\System\kWTpVhU.exe
  2⤵
  PID:13968
- C:\Windows\System\EZpHuCI.exe
  C:\Windows\System\EZpHuCI.exe
  2⤵
  PID:13992
- C:\Windows\System\blrAMQg.exe
  C:\Windows\System\blrAMQg.exe
  2⤵
  PID:14012
- C:\Windows\System\imrHNsM.exe
  C:\Windows\System\imrHNsM.exe
  2⤵
  PID:14040
- C:\Windows\System\sWGzSYy.exe
  C:\Windows\System\sWGzSYy.exe
  2⤵
  PID:14068
- C:\Windows\System\kDLNaKN.exe
  C:\Windows\System\kDLNaKN.exe
  2⤵
  PID:14096
- C:\Windows\System\rQmQuTP.exe
  C:\Windows\System\rQmQuTP.exe
  2⤵
  PID:14124
- C:\Windows\System\yARuvDi.exe
  C:\Windows\System\yARuvDi.exe
  2⤵
  PID:14148
- C:\Windows\System\LhDyBxy.exe
  C:\Windows\System\LhDyBxy.exe
  2⤵
  PID:14176
- C:\Windows\System\KvWcNGF.exe
  C:\Windows\System\KvWcNGF.exe
  2⤵
  PID:14196
- C:\Windows\System\eGVCXCT.exe
  C:\Windows\System\eGVCXCT.exe
  2⤵
  PID:14224
- C:\Windows\System\vuRcYYP.exe
  C:\Windows\System\vuRcYYP.exe
  2⤵
  PID:14240
- C:\Windows\System\WuhQRhR.exe
  C:\Windows\System\WuhQRhR.exe
  2⤵
  PID:14268
- C:\Windows\System\aPyxDNN.exe
  C:\Windows\System\aPyxDNN.exe
  2⤵
  PID:14292
- C:\Windows\System\VEFrVdu.exe
  C:\Windows\System\VEFrVdu.exe
  2⤵
  PID:14316
- C:\Windows\System\lCnwLzJ.exe
  C:\Windows\System\lCnwLzJ.exe
  2⤵
  PID:12916
- C:\Windows\System\bLgzWeq.exe
  C:\Windows\System\bLgzWeq.exe
  2⤵
  PID:12928
- C:\Windows\System\tGwyAUj.exe
  C:\Windows\System\tGwyAUj.exe
  2⤵
  PID:13004
- C:\Windows\System\HcmyTlH.exe
  C:\Windows\System\HcmyTlH.exe
  2⤵
  PID:12060
- C:\Windows\System\BFzUbuq.exe
  C:\Windows\System\BFzUbuq.exe
  2⤵
  PID:13144
- C:\Windows\System\IMISXFf.exe
  C:\Windows\System\IMISXFf.exe
  2⤵
  PID:13200
- C:\Windows\System\LzkgBnQ.exe
  C:\Windows\System\LzkgBnQ.exe
  2⤵
  PID:12324
- C:\Windows\System\IBmNTdG.exe
  C:\Windows\System\IBmNTdG.exe
  2⤵
  PID:13268
- C:\Windows\System\QqOXqGW.exe
  C:\Windows\System\QqOXqGW.exe
  2⤵
  PID:11480
- C:\Windows\System\QYWXtls.exe
  C:\Windows\System\QYWXtls.exe
  2⤵
  PID:11560
- C:\Windows\System\FqfTVlL.exe
  C:\Windows\System\FqfTVlL.exe
  2⤵
  PID:12460
- C:\Windows\System\ULoDOmT.exe
  C:\Windows\System\ULoDOmT.exe
  2⤵
  PID:11672
- C:\Windows\System\vZbUXUm.exe
  C:\Windows\System\vZbUXUm.exe
  2⤵
  PID:12536
- C:\Windows\System\dVKeHpz.exe
  C:\Windows\System\dVKeHpz.exe
  2⤵
  PID:11920
- C:\Windows\System\TOhAkPs.exe
  C:\Windows\System\TOhAkPs.exe
  2⤵
  PID:11396
- C:\Windows\System\mNitBTj.exe
  C:\Windows\System\mNitBTj.exe
  2⤵
  PID:12396
- C:\Windows\System\bNZxxic.exe
  C:\Windows\System\bNZxxic.exe
  2⤵
  PID:11736
- C:\Windows\System\MhywpUj.exe
  C:\Windows\System\MhywpUj.exe
  2⤵
  PID:11404
- C:\Windows\System\IPHLvjF.exe
  C:\Windows\System\IPHLvjF.exe
  2⤵
  PID:12896
- C:\Windows\System\JtlRbID.exe
  C:\Windows\System\JtlRbID.exe
  2⤵
  PID:13436
- C:\Windows\System\QIieyud.exe
  C:\Windows\System\QIieyud.exe
  2⤵
  PID:13496
- C:\Windows\System\yLuBItj.exe
  C:\Windows\System\yLuBItj.exe
  2⤵
  PID:13584
- C:\Windows\System\FVnmYtN.exe
  C:\Windows\System\FVnmYtN.exe
  2⤵
  PID:11328
- C:\Windows\System\WCzCjXO.exe
  C:\Windows\System\WCzCjXO.exe
  2⤵
  PID:13148
- C:\Windows\System\wKZqIbt.exe
  C:\Windows\System\wKZqIbt.exe
  2⤵
  PID:14348
- C:\Windows\System\eYYsaRe.exe
  C:\Windows\System\eYYsaRe.exe
  2⤵
  PID:14380
- C:\Windows\System\keBYBrg.exe
  C:\Windows\System\keBYBrg.exe
  2⤵
  PID:14396
- C:\Windows\System\aGeYnAw.exe
  C:\Windows\System\aGeYnAw.exe
  2⤵
  PID:14412
- C:\Windows\System\jEBtCow.exe
  C:\Windows\System\jEBtCow.exe
  2⤵
  PID:14432
- C:\Windows\System\fHhjeuO.exe
  C:\Windows\System\fHhjeuO.exe
  2⤵
  PID:14464
- C:\Windows\System\IoSLZsP.exe
  C:\Windows\System\IoSLZsP.exe
  2⤵
  PID:14488
- C:\Windows\System\HlPbgMD.exe
  C:\Windows\System\HlPbgMD.exe
  2⤵
  PID:14520
- C:\Windows\System\KYaMQCL.exe
  C:\Windows\System\KYaMQCL.exe
  2⤵
  PID:14544
- C:\Windows\System\VuVAgoS.exe
  C:\Windows\System\VuVAgoS.exe
  2⤵
  PID:14560
- C:\Windows\System\wApfmAZ.exe
  C:\Windows\System\wApfmAZ.exe
  2⤵
  PID:14588
- C:\Windows\System\REiFPcf.exe
  C:\Windows\System\REiFPcf.exe
  2⤵
  PID:14616
- C:\Windows\System\pJBDTFl.exe
  C:\Windows\System\pJBDTFl.exe
  2⤵
  PID:14644
- C:\Windows\System\YqWTnwg.exe
  C:\Windows\System\YqWTnwg.exe
  2⤵
  PID:14660
- C:\Windows\System\zmSlrWf.exe
  C:\Windows\System\zmSlrWf.exe
  2⤵
  PID:14688
- C:\Windows\System\QlkaCbF.exe
  C:\Windows\System\QlkaCbF.exe
  2⤵
  PID:14720
- C:\Windows\System\DscjBsQ.exe
  C:\Windows\System\DscjBsQ.exe
  2⤵
  PID:14744
- C:\Windows\System\DNlfyTk.exe
  C:\Windows\System\DNlfyTk.exe
  2⤵
  PID:14768
- C:\Windows\System\PIPAGZU.exe
  C:\Windows\System\PIPAGZU.exe
  2⤵
  PID:14788
- C:\Windows\System\alDKnxw.exe
  C:\Windows\System\alDKnxw.exe
  2⤵
  PID:14816
- C:\Windows\System\IWasrjB.exe
  C:\Windows\System\IWasrjB.exe
  2⤵
  PID:14840
- C:\Windows\System\IxjyKRb.exe
  C:\Windows\System\IxjyKRb.exe
  2⤵
  PID:14868
- C:\Windows\System\wkNfVSQ.exe
  C:\Windows\System\wkNfVSQ.exe
  2⤵
  PID:14896
- C:\Windows\System\QNBJugT.exe
  C:\Windows\System\QNBJugT.exe
  2⤵
  PID:14920
- C:\Windows\System\DLrhNkU.exe
  C:\Windows\System\DLrhNkU.exe
  2⤵
  PID:14952
- C:\Windows\System\SKCJIWU.exe
  C:\Windows\System\SKCJIWU.exe
  2⤵
  PID:14976
- C:\Windows\System\wiBmajf.exe
  C:\Windows\System\wiBmajf.exe
  2⤵
  PID:15000
- C:\Windows\System\MtAzxKg.exe
  C:\Windows\System\MtAzxKg.exe
  2⤵
  PID:15024
- C:\Windows\System\NIbOfRp.exe
  C:\Windows\System\NIbOfRp.exe
  2⤵
  PID:15048
- C:\Windows\System\EmZkOcS.exe
  C:\Windows\System\EmZkOcS.exe
  2⤵
  PID:15072
- C:\Windows\System\mavgCpo.exe
  C:\Windows\System\mavgCpo.exe
  2⤵
  PID:15100
- C:\Windows\System\tKkbxzq.exe
  C:\Windows\System\tKkbxzq.exe
  2⤵
  PID:15116
- C:\Windows\System\vGqyzjx.exe
  C:\Windows\System\vGqyzjx.exe
  2⤵
  PID:15136
- C:\Windows\System\yOqsJEc.exe
  C:\Windows\System\yOqsJEc.exe
  2⤵
  PID:15164
- C:\Windows\System\QbmZThd.exe
  C:\Windows\System\QbmZThd.exe
  2⤵
  PID:15196
- C:\Windows\System\RAgJOqX.exe
  C:\Windows\System\RAgJOqX.exe
  2⤵
  PID:15216
- C:\Windows\System\ZmKuTzL.exe
  C:\Windows\System\ZmKuTzL.exe
  2⤵
  PID:15240
- C:\Windows\System\KplnhgV.exe
  C:\Windows\System\KplnhgV.exe
  2⤵
  PID:15268
- C:\Windows\System\AtCcslW.exe
  C:\Windows\System\AtCcslW.exe
  2⤵
  PID:15300
- C:\Windows\System\CdLgasj.exe
  C:\Windows\System\CdLgasj.exe
  2⤵
  PID:15320
- C:\Windows\System\YPZvqmu.exe
  C:\Windows\System\YPZvqmu.exe
  2⤵
  PID:15336
- C:\Windows\System\HLHhLib.exe
  C:\Windows\System\HLHhLib.exe
  2⤵
  PID:15356
- C:\Windows\System\rlJKaqj.exe
  C:\Windows\System\rlJKaqj.exe
  2⤵
  PID:13936
- C:\Windows\System\LFJgXKp.exe
  C:\Windows\System\LFJgXKp.exe
  2⤵
  PID:12452
- C:\Windows\System\yApxcPK.exe
  C:\Windows\System\yApxcPK.exe
  2⤵
  PID:11728
- C:\Windows\System\WWgDBep.exe
  C:\Windows\System\WWgDBep.exe
  2⤵
  PID:10744
- C:\Windows\System\qCaunww.exe
  C:\Windows\System\qCaunww.exe
  2⤵
  PID:12260
- C:\Windows\System\gUNYkie.exe
  C:\Windows\System\gUNYkie.exe
  2⤵
  PID:11652
- C:\Windows\System\qdoaMpZ.exe
  C:\Windows\System\qdoaMpZ.exe
  2⤵
  PID:13108
- C:\Windows\System\wwluDND.exe
  C:\Windows\System\wwluDND.exe
  2⤵
  PID:12216
- C:\Windows\System\tlFiaba.exe
  C:\Windows\System\tlFiaba.exe
  2⤵
  PID:13412
- C:\Windows\System\PyZZAaC.exe
  C:\Windows\System\PyZZAaC.exe
  2⤵
  PID:12508
- C:\Windows\System\zpIwHKv.exe
  C:\Windows\System\zpIwHKv.exe
  2⤵
  PID:11892
- C:\Windows\System\iuWpFsv.exe
  C:\Windows\System\iuWpFsv.exe
  2⤵
  PID:13556
- C:\Windows\System\AtzKlSz.exe
  C:\Windows\System\AtzKlSz.exe
  2⤵
  PID:13616
- C:\Windows\System\mdrwSkX.exe
  C:\Windows\System\mdrwSkX.exe
  2⤵
  PID:13712
- C:\Windows\System\eDCSdsR.exe
  C:\Windows\System\eDCSdsR.exe
  2⤵
  PID:13688
- C:\Windows\System\HHUlScH.exe
  C:\Windows\System\HHUlScH.exe
  2⤵
  PID:13756
- C:\Windows\System\GWsJCwp.exe
  C:\Windows\System\GWsJCwp.exe
  2⤵
  PID:13292
- C:\Windows\System\pRgYUeW.exe
  C:\Windows\System\pRgYUeW.exe
  2⤵
  PID:14392
- C:\Windows\System\ldkJElR.exe
  C:\Windows\System\ldkJElR.exe
  2⤵
  PID:10340
- C:\Windows\System\kphZTNg.exe
  C:\Windows\System\kphZTNg.exe
  2⤵
  PID:13988
- C:\Windows\System\DGnUqeQ.exe
  C:\Windows\System\DGnUqeQ.exe
  2⤵
  PID:14032
- C:\Windows\System\liZDwCS.exe
  C:\Windows\System\liZDwCS.exe
  2⤵
  PID:14584
- C:\Windows\System\QQZulEf.exe
  C:\Windows\System\QQZulEf.exe
  2⤵
  PID:14080
- C:\Windows\System\gQdWuYs.exe
  C:\Windows\System\gQdWuYs.exe
  2⤵
  PID:12032
- C:\Windows\System\uWDbXMc.exe
  C:\Windows\System\uWDbXMc.exe
  2⤵
  PID:14696
- C:\Windows\System\eaIoUmg.exe
  C:\Windows\System\eaIoUmg.exe
  2⤵
  PID:14716
- C:\Windows\System\iSZeHGU.exe
  C:\Windows\System\iSZeHGU.exe
  2⤵
  PID:15404
- C:\Windows\System\biLrjjF.exe
  C:\Windows\System\biLrjjF.exe
  2⤵
  PID:15448
- C:\Windows\System\BKYaShe.exe
  C:\Windows\System\BKYaShe.exe
  2⤵
  PID:15468
- C:\Windows\System\LncmfkI.exe
  C:\Windows\System\LncmfkI.exe
  2⤵
  PID:15500
- C:\Windows\System\AARlCht.exe
  C:\Windows\System\AARlCht.exe
  2⤵
  PID:15528
- C:\Windows\System\CjsLXSE.exe
  C:\Windows\System\CjsLXSE.exe
  2⤵
  PID:15552
- C:\Windows\System\oGTSjyz.exe
  C:\Windows\System\oGTSjyz.exe
  2⤵
  PID:15568
- C:\Windows\System\ssTjWxb.exe
  C:\Windows\System\ssTjWxb.exe
  2⤵
  PID:15600
- C:\Windows\System\IvddgnX.exe
  C:\Windows\System\IvddgnX.exe
  2⤵
  PID:15620
- C:\Windows\System\wnyTkZi.exe
  C:\Windows\System\wnyTkZi.exe
  2⤵
  PID:15652
- C:\Windows\System\zfzlHiH.exe
  C:\Windows\System\zfzlHiH.exe
  2⤵
  PID:15672
- C:\Windows\System\SDDESfa.exe
  C:\Windows\System\SDDESfa.exe
  2⤵
  PID:15692
- C:\Windows\System\JboHDGO.exe
  C:\Windows\System\JboHDGO.exe
  2⤵
  PID:15720
- C:\Windows\System\SIhujjJ.exe
  C:\Windows\System\SIhujjJ.exe
  2⤵
  PID:15744
- C:\Windows\System\brjYonK.exe
  C:\Windows\System\brjYonK.exe
  2⤵
  PID:15764
- C:\Windows\System\ZnASPLE.exe
  C:\Windows\System\ZnASPLE.exe
  2⤵
  PID:15788
- C:\Windows\System\xrKSxvG.exe
  C:\Windows\System\xrKSxvG.exe
  2⤵
  PID:15816
- C:\Windows\System\FydWAez.exe
  C:\Windows\System\FydWAez.exe
  2⤵
  PID:15832
- C:\Windows\System\LHYBFbO.exe
  C:\Windows\System\LHYBFbO.exe
  2⤵
  PID:15856
- C:\Windows\System\HenJzOi.exe
  C:\Windows\System\HenJzOi.exe
  2⤵
  PID:15888
- C:\Windows\System\AXwNQym.exe
  C:\Windows\System\AXwNQym.exe
  2⤵
  PID:15912
- C:\Windows\System\qAHgfpk.exe
  C:\Windows\System\qAHgfpk.exe
  2⤵
  PID:15936
- C:\Windows\System\QUusLks.exe
  C:\Windows\System\QUusLks.exe
  2⤵
  PID:15956
- C:\Windows\System\ncEytVw.exe
  C:\Windows\System\ncEytVw.exe
  2⤵
  PID:15984
- C:\Windows\System\YNSNRsf.exe
  C:\Windows\System\YNSNRsf.exe
  2⤵
  PID:16008
- C:\Windows\System\PnHbjow.exe
  C:\Windows\System\PnHbjow.exe
  2⤵
  PID:16036
- C:\Windows\System\xgOkzdr.exe
  C:\Windows\System\xgOkzdr.exe
  2⤵
  PID:16064
- C:\Windows\System\zIPbZtf.exe
  C:\Windows\System\zIPbZtf.exe
  2⤵
  PID:16096
- C:\Windows\System\gQdzdev.exe
  C:\Windows\System\gQdzdev.exe
  2⤵
  PID:16120
- C:\Windows\System\EqIyJrs.exe
  C:\Windows\System\EqIyJrs.exe
  2⤵
  PID:16140
- C:\Windows\System\FUClmcw.exe
  C:\Windows\System\FUClmcw.exe
  2⤵
  PID:16160
- C:\Windows\System\CtqnVSP.exe
  C:\Windows\System\CtqnVSP.exe
  2⤵
  PID:16188
- C:\Windows\System\OWBxNYX.exe
  C:\Windows\System\OWBxNYX.exe
  2⤵
  PID:16212
- C:\Windows\System\GCCcTmL.exe
  C:\Windows\System\GCCcTmL.exe
  2⤵
  PID:16244
- C:\Windows\System\IWSLdDz.exe
  C:\Windows\System\IWSLdDz.exe
  2⤵
  PID:16260
- C:\Windows\System\eriIpam.exe
  C:\Windows\System\eriIpam.exe
  2⤵
  PID:16288
- C:\Windows\System\wmsTjEW.exe
  C:\Windows\System\wmsTjEW.exe
  2⤵
  PID:16312
- C:\Windows\System\VxtTkos.exe
  C:\Windows\System\VxtTkos.exe
  2⤵
  PID:16336
- C:\Windows\System\MRDQOLd.exe
  C:\Windows\System\MRDQOLd.exe
  2⤵
  PID:16360
- C:\Windows\System\UpTqyBQ.exe
  C:\Windows\System\UpTqyBQ.exe
  2⤵
  PID:16380
- C:\Windows\System\MGCTJJC.exe
  C:\Windows\System\MGCTJJC.exe
  2⤵
  PID:14188
- C:\Windows\System\rlAzpfs.exe
  C:\Windows\System\rlAzpfs.exe
  2⤵
  PID:14232
- C:\Windows\System\XhNLJSA.exe
  C:\Windows\System\XhNLJSA.exe
  2⤵
  PID:12608
- C:\Windows\System\TVIFnVl.exe
  C:\Windows\System\TVIFnVl.exe
  2⤵
  PID:10720
- C:\Windows\System\cxDDHcb.exe
  C:\Windows\System\cxDDHcb.exe
  2⤵
  PID:14972
- C:\Windows\System\qenlkhL.exe
  C:\Windows\System\qenlkhL.exe
  2⤵
  PID:11400
- C:\Windows\System\hZIIJrf.exe
  C:\Windows\System\hZIIJrf.exe
  2⤵
  PID:13296
- C:\Windows\System\PSqQjWK.exe
  C:\Windows\System\PSqQjWK.exe
  2⤵
  PID:13528
- C:\Windows\System\ExUFkBN.exe
  C:\Windows\System\ExUFkBN.exe
  2⤵
  PID:15308
- C:\Windows\System\DbbKALf.exe
  C:\Windows\System\DbbKALf.exe
  2⤵
  PID:15344
- C:\Windows\System\iHEVgTj.exe
  C:\Windows\System\iHEVgTj.exe
  2⤵
  PID:12964
- C:\Windows\System\pWTJRUt.exe
  C:\Windows\System\pWTJRUt.exe
  2⤵
  PID:14140
- C:\Windows\System\FGUduBd.exe
  C:\Windows\System\FGUduBd.exe
  2⤵
  PID:13732
- C:\Windows\System\UzIvXSA.exe
  C:\Windows\System\UzIvXSA.exe
  2⤵
  PID:14364
- C:\Windows\System\rnleuAT.exe
  C:\Windows\System\rnleuAT.exe
  2⤵
  PID:13428
- C:\Windows\System\GPJbsZh.exe
  C:\Windows\System\GPJbsZh.exe
  2⤵
  PID:13552
- C:\Windows\System\DKskusl.exe
  C:\Windows\System\DKskusl.exe
  2⤵
  PID:13828
- C:\Windows\System\pUMyHpM.exe
  C:\Windows\System\pUMyHpM.exe
  2⤵
  PID:14456
- C:\Windows\System\rWBloJr.exe
  C:\Windows\System\rWBloJr.exe
  2⤵
  PID:14572
- C:\Windows\System\xXgbLVV.exe
  C:\Windows\System\xXgbLVV.exe
  2⤵
  PID:14628
- C:\Windows\System\BrmNwNA.exe
  C:\Windows\System\BrmNwNA.exe
  2⤵
  PID:12016
- C:\Windows\System\AfAAKMJ.exe
  C:\Windows\System\AfAAKMJ.exe
  2⤵
  PID:16408
- C:\Windows\System\nwKkLBC.exe
  C:\Windows\System\nwKkLBC.exe
  2⤵
  PID:16440
- C:\Windows\System\QNBhMRh.exe
  C:\Windows\System\QNBhMRh.exe
  2⤵
  PID:16472
- C:\Windows\System\vfUrTRR.exe
  C:\Windows\System\vfUrTRR.exe
  2⤵
  PID:16488
- C:\Windows\System\qXOGFjD.exe
  C:\Windows\System\qXOGFjD.exe
  2⤵
  PID:16504
- C:\Windows\System\EuoNnvW.exe
  C:\Windows\System\EuoNnvW.exe
  2⤵
  PID:16524
- C:\Windows\System\IulCTIn.exe
  C:\Windows\System\IulCTIn.exe
  2⤵
  PID:16552
- C:\Windows\System\dtsdBfj.exe
  C:\Windows\System\dtsdBfj.exe
  2⤵
  PID:16580
- C:\Windows\System\YLZTyOW.exe
  C:\Windows\System\YLZTyOW.exe
  2⤵
  PID:16600
- C:\Windows\System\vsOPxOX.exe
  C:\Windows\System\vsOPxOX.exe
  2⤵
  PID:16632
- C:\Windows\System\YQeJpwI.exe
  C:\Windows\System\YQeJpwI.exe
  2⤵
  PID:16652
- C:\Windows\System\JtHTMhW.exe
  C:\Windows\System\JtHTMhW.exe
  2⤵
  PID:16668
- C:\Windows\System\vJuGPVH.exe
  C:\Windows\System\vJuGPVH.exe
  2⤵
  PID:16696
- C:\Windows\System\JHuwfao.exe
  C:\Windows\System\JHuwfao.exe
  2⤵
  PID:14284
- C:\Windows\System\ounEvuy.exe
  C:\Windows\System\ounEvuy.exe
  2⤵
  PID:14912
- C:\Windows\System\mwhaLSc.exe
  C:\Windows\System\mwhaLSc.exe
  2⤵
  PID:15736
- C:\Windows\System\aSQYUAP.exe
  C:\Windows\System\aSQYUAP.exe
  2⤵
  PID:11968
- C:\Windows\System\LUbmDxn.exe
  C:\Windows\System\LUbmDxn.exe
  2⤵
  PID:15772
- C:\Windows\System\ibHGjSs.exe
  C:\Windows\System\ibHGjSs.exe
  2⤵
  PID:15824
- C:\Windows\System\ERWxUto.exe
  C:\Windows\System\ERWxUto.exe
  2⤵
  PID:15040
- C:\Windows\System\dcFkEWi.exe
  C:\Windows\System\dcFkEWi.exe
  2⤵
  PID:13272
- C:\Windows\System\QcyEcAI.exe
  C:\Windows\System\QcyEcAI.exe
  2⤵
  PID:15328
- C:\Windows\System\TEPbTws.exe
  C:\Windows\System\TEPbTws.exe
  2⤵
  PID:16252
- C:\Windows\System\tIODEKH.exe
  C:\Windows\System\tIODEKH.exe
  2⤵
  PID:16296
- C:\Windows\System\IeHkZiZ.exe
  C:\Windows\System\IeHkZiZ.exe
  2⤵
  PID:14144
- C:\Windows\System\fXsUeEP.exe
  C:\Windows\System\fXsUeEP.exe
  2⤵
  PID:12588
- C:\Windows\System\TOniJdm.exe
  C:\Windows\System\TOniJdm.exe
  2⤵
  PID:11120
- C:\Windows\System\SlUQSQu.exe
  C:\Windows\System\SlUQSQu.exe
  2⤵
  PID:13600
- C:\Windows\System\GtbQyXZ.exe
  C:\Windows\System\GtbQyXZ.exe
  2⤵
  PID:14484
- C:\Windows\System\SWgfmWv.exe
  C:\Windows\System\SWgfmWv.exe
  2⤵
  PID:13396
- C:\Windows\System\YkyqXXf.exe
  C:\Windows\System\YkyqXXf.exe
  2⤵
  PID:12988
- C:\Windows\System\MQYflsj.exe
  C:\Windows\System\MQYflsj.exe
  2⤵
  PID:13860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BZqjFIf.exe

Filesize
1.2MB

MD5
c22f2cb32e979c5993a6ca0a5e179f43

SHA1
3815e7de7a24888b7cfda804c00e942eea4a6ed9

SHA256
73371a11352cdc528a0eb372d3ae747ea9484efcb48d706ca3e8c82216dbf8b1

SHA512
cb1c8082c61b34d69ee0abb006de7dea59de6a223367dcb294ff281815c8a8217f301a642ae3f2ba93e3aee8dde407f23260d5a668c0ff9bb7edeca04b04f10d

Download Submit
C:\Windows\System\CmrgrrR.exe

Filesize
1.2MB

MD5
2d56e5eb35f7869827a35e391af0f6d6

SHA1
9aee159cb58998d13803a12dacc6ba040c7c66af

SHA256
3fc100600f12b07e401932b0f29f1d1f0534ffd866b2aa2d9df817c61a4a32a8

SHA512
2aad0097b2f5f77a11890200568446a293d4e780029f62322e2278f01bd7329fe6d746ded72011736da0fe5f94e6f525868bb53daace33bc88bdd96f5ec5090f

Download Submit
C:\Windows\System\FsmudLs.exe

Filesize
1.2MB

MD5
8c7420d7d9f19ed0ff07110cc576e3cb

SHA1
83f24a9fb8354ab83eaacf547ef72d96dd336a9d

SHA256
23347480a92d8eb8c76a47eee4b877c93a292b41b6e4f0311e94fabdaa30ea56

SHA512
00d58dc8588b33554e636a53cedc593bffd3805d0154d6cd9a5c37409f0a3331726465517471ff87e787736194c5316fc53df2dd97a154967d8af71a4c8a0e11

Download Submit
C:\Windows\System\GWxjlRr.exe

Filesize
1.2MB

MD5
5497c26cfb46768afb8c3934341c9c6f

SHA1
38230b07392b68cad31ff2e719ce5e4c8465f27c

SHA256
38883f6dd39df5c61aabaa32f28e0323eb1b55535c36702aab49585d18c54e03

SHA512
ceafa573e15bb4c969023d7626f0227d201dcdd9d7f0d11da4fc43e9b8b5951df723f2f6b30516c02e9dd0f58495d73404ab906c455e46e91ee0f40175bf29bd

Download Submit
C:\Windows\System\GmKnecS.exe

Filesize
1.2MB

MD5
b796958307b48ea81b03e68c7a58de39

SHA1
b93342349bd41f8a86e90eb86155208addb992ed

SHA256
22b1a2b20a7d3a62ff2e950402704274ede1116a778b9e434088bfc8e98292c3

SHA512
63281289cb7632abd70a9f9755587119a91c4614f809f2c09edfea2c6efa171d00012cc4ca02b1ec925be4b6b243ea72abe3be2d3b4cfdc54a3d6235695391f3

Download Submit
C:\Windows\System\JtYpysp.exe

Filesize
1.2MB

MD5
be42a07f6d53382a1c590c9a2b6a1f21

SHA1
ac489af8c217e8d205a3e41b5ab76b38426e2d3c

SHA256
bebb9f260c4e9e0faf6dfa9b83345514ec414674702df66406a5e914112bc648

SHA512
98b50a857b3ac300c04186d5e80b89633f661ab4bb196fc4072f44d47a0a856f6b5c6786ba1c4d226bc632155ad8c34198306ce1a28cdcd12e074df670f00436

Download Submit
C:\Windows\System\LAPuIDU.exe

Filesize
1.2MB

MD5
3f29517fa6b4ad3c58702059af902e41

SHA1
4824ba9b0bbaa78b0f2869f4e5958c7f611dde7c

SHA256
b580eaab7085f263565aeda731201a78a73e2fb3a0d56da42d8f0423881ce03a

SHA512
b84cca41a4f442d0b58f1d899ad6991ceb71499b9927c476399adb3f42bc01731514fe4d6b4728d8db880db8cb0f2115b361cb67985c6b6eb317dbde606bace2

Download Submit
C:\Windows\System\MmuZPUs.exe

Filesize
1.2MB

MD5
3ac66ff6270bc5f950ed9ea8ea241c8d

SHA1
4e047172056b59870dfcc4c6d33881efedde085c

SHA256
2c0e902633479882639e5e886b1073464e03b85ce7798fb248dd66f4e2696672

SHA512
107162528573c593e601116d1c097d662ae32ea3246d22dff59730deecfc29f7dfdd31fe2730ea116e8b394923bf5d7bd502cf00707d50f234b7fc1a7240603f

Download Submit
C:\Windows\System\NtzNjyw.exe

Filesize
1.2MB

MD5
4c6194bf9b5a00d95f4427072f41da9d

SHA1
a1fe152743b8f82429a40378b0b39d9dfc54ccd7

SHA256
3fed84277adbc87412d06e6a5aaeb40ebf3dc74e58d5d52c644dd02e3d9bf57c

SHA512
3cc7006a399b0eeed9fceef25a41ba11e280515bec267552420096827b5f5b6fc35e9d4c97caf54f97724eca42453a3c595f0ef2902c2c7d002d8cfdf0889c93

Download Submit
C:\Windows\System\QmKfIzT.exe

Filesize
1.2MB

MD5
0bf54dad675294728af144bb966c2aee

SHA1
04c52c0d7d5742e99cea1c70f5b75ca44a7d37f8

SHA256
1a651d94026753ee812f92687642df91d45fea592bd53b358ce4f280da034cd8

SHA512
2b8972af9decc3ac71fe559a3f478fb58e600b1559f986a3b555c1afc9b22b469125fc7f8560bc0b3528fbe6a6cec47c3fec1308ad061cf987477ea2825dc934

Download Submit
C:\Windows\System\QsLLldH.exe

Filesize
1.2MB

MD5
a0a8c838833d2a79879b75800d917474

SHA1
96e39bd6fbcdd19f119fd62b98b1b2b90f076390

SHA256
dbf5135670d8d44bdbd1461f2f1e34d0fb0bce9d6a72065849d9e7055c418858

SHA512
38b3585e4a0ed71b88f75eb318503e9f0003d5f2eee539ec4f60353bfa9fd85c27f0e968c6c343740b04728dc02a5ca752db6f14975390c6b03eb1633f7aa609

Download Submit
C:\Windows\System\TVHZrrA.exe

Filesize
1.2MB

MD5
c2c1989c61461b81153112b20fb24821

SHA1
6f1550825c5a31025f2c950ef2f53805c70b1f37

SHA256
110e319fabedfce584c00bcd495984e96895edef4a848e001d4cbaefa7182a8e

SHA512
5989a2b7ba83fc12c3412bafae8348431d7e6c98e4cabc6e9df01e98f97af433dd85d43772fdaf1d9dade8b6d0408f9c085b4f922d3ec77a28532400ae24730c

Download Submit
C:\Windows\System\UOixlMA.exe

Filesize
1.2MB

MD5
8dce82d17c8afd74afac5ef89e7bf9b2

SHA1
0410c51ac467005f15a90322ac32e6b546df0312

SHA256
fe7e72b99cdb64351c7014e407e29dfad076c8d5eea39dfb812ddfb58840d4f7

SHA512
bcbd134029c2854ef548405515ac35b691ba6ab7c2bdf23b771974f84fe73c69a15dad239d49cf9691903d5cf3de7dca1247eae26cd2948f807e2b13ef9e2530

Download Submit
C:\Windows\System\YDOmLKi.exe

Filesize
1.2MB

MD5
c50dab88ebab77283f088cf9d467fc55

SHA1
8a7abb5c30e095ac797573c81d811240c18d0319

SHA256
a7347c45d9a8f7ec1f13797cf303d3ac54a78eca07859d4f9b3b531878916a5a

SHA512
8a726c15a35574c895d61a77b7bb951e9aaee8dd5ba45b458f1ba3e9257b0dffaa1ce3ad42c62860415cf33e37580823c24bf9b2f5dd1e252455d6d708bcecb2

Download Submit
C:\Windows\System\YpbLjGm.exe

Filesize
1.2MB

MD5
e6ceb1309a98d2d8bb1369f5002ae438

SHA1
4eb342ef504b5b69ad3225bdbb4c6b11b7e6c4e6

SHA256
ed699e6f491bc25bebc77147565ddc843c1e21db45cfac6f7f7ac165656c0acb

SHA512
667f96219c8bb4c120daf2a0aa40e46ac68814922f2630e31168334fbacfe64f5f0bd2c9e4b0b17a014aa47ae275bf526ea235a6081364835602649a4a063172

Download Submit
C:\Windows\System\ZMAomww.exe

Filesize
1.2MB

MD5
4e97c25c0dae94022ed9f24318a1eb91

SHA1
1fab9ed2008a79511856c04928c71e6eb0667cc9

SHA256
6545c4df63d21a9c3671c1fe39c85db7be5d6acb9c248359997ad613c7112b34

SHA512
8384b7e4c2a3626139f462d9d0afa76b75daec08383aef5067ddafdf3708e20a25e4cb6f0a863723a58075fd42d55a6f273ec9d807b4f5946a975094e75596f2

Download Submit
C:\Windows\System\aJMkPxS.exe

Filesize
1.2MB

MD5
108f24cc889483d1d5cc8b0f2c44d2b1

SHA1
4476f091f7ac63868ec6369aff5e41a6019ef13a

SHA256
5d57dda91355362096c59df5f979803d187f3e527b0e7a8daf184ae1b520ef21

SHA512
a84d86934e37f33d06e7e6e32a8ab1e6f6579fde9ee98f10626cf19bdfe17d2db979653c14085d7983b0ff7a7afa18ec65e0cb8e68bc8054ad1de616f1562b6c

Download Submit
C:\Windows\System\ciPsAZA.exe

Filesize
1.2MB

MD5
9d7b8378bc6429a2ddb2277685cc41da

SHA1
0217136b084ad6735bcb3b25e299f3acfd02715a

SHA256
2f0d1c1f852f6132e5861c9c338f9f41c415f0ab68f8e7f36a643a6d9641bfb2

SHA512
199babf9a7c490fd03d767528fc63dccad7d78b764ba08efef3d5112f94d1528117b5d4f43f60a17b5dafe7e5253cf561e6c0ea03812464195590b73dc85b0e7

Download Submit
C:\Windows\System\eYdhYre.exe

Filesize
1.2MB

MD5
dbab5b88ad81390644b354f651736372

SHA1
e70863d608879c53499d7c2a1a97b9b84ea8dd8a

SHA256
125e9ec79cc287b25a42719415c4d5f55aeed4ba1fcdbfe18542de2d2816db98

SHA512
26c521901110eced174214e05d35bfff9b2deca0d95db5d99795a2666b2c5d8fe77c5b5dbd9fa123a646aae0622d7e9a3885e7a33122a95b68ba93ca348f2cec

Download Submit
C:\Windows\System\fOpiUYi.exe

Filesize
1.2MB

MD5
12158dfe2e8f1b2456868ad34d727dc0

SHA1
470d390dc86c4ff065fd0ecd2ad34ec586b056ac

SHA256
ba3a95d53ad513160f5b38dc87ee17f783002418e2c62a74d6e012472d000b54

SHA512
966dc94ff712bac2c3d5ebb7b39b0cee6d0bf6a011a23797bc71e669a7782f99ab42fbed05f8978aacccc978bc0d3b6f701824a23406db6880bc30ff083f3337

Download Submit
C:\Windows\System\fRHNOuz.exe

Filesize
1.2MB

MD5
d03c9d5956dd4c37124e1a05e50e66f4

SHA1
017c7e490a56698a133faf0383cf0d40a4c98000

SHA256
fdc1d86fa3ceea315e6c940863478500f67fbc57b01e67a05bea7839e1754a21

SHA512
a70b72621bd09456d6ba30fe85f4fa320370a87acb51ceaa2c5462b400afd05f24ade4a75b8e0bb03cd1d746bdf0be3f5a5d8fdfd320a8cd5ab69432ac96490f

Download Submit
C:\Windows\System\iqAzosI.exe

Filesize
1.2MB

MD5
cfbb68c6e95c8528757058981d580dd3

SHA1
7ca5576adb05fa8ce9d593818f01a5169e099e55

SHA256
134f7b054d84f79e6c10a6a2b00ad14b82f9e6bfd5c4de2f393bc51dcf61fb88

SHA512
575abed82de70a46ca781a310815ab7250cf210bf07573c7881a8bc5c0d6567db1cb09143f0f670aab72d70c8846f227eb0f152ad0f90324158bd76664d0db2a

Download Submit
C:\Windows\System\jGBJrgQ.exe

Filesize
1.2MB

MD5
da526df48b46e500d380d239a8bba1aa

SHA1
4c6bb9c7a3da963dd6e901a520c933e127cd91b5

SHA256
915cbbb6d4dbcc428f8a07d2ca3dbf6b765941e626ff87a3abe5613654baa14f

SHA512
52a64947b81afa83d82809a6d7917fd3c7d6558fe84b3c39d12d4c9b79080015cd317771f67ddc5df63d7d95bcd3053e8c413ef1069f4c32361b944489470ed2

Download Submit
C:\Windows\System\jJBqRGR.exe

Filesize
1.2MB

MD5
87945322d72faa9c1eb3967a3cf9e600

SHA1
53fd0ac6fe1b87521c444ae6acceef623f7e3ff3

SHA256
8cca822fea71cc0fd4adc6c9cf24d83df20abdcea1f356995b6d01f5ed80790c

SHA512
ac632446eda5af7b791147fbe19f46e5fddaabf30b610e75180324474b2db826fb013def29142d9d3a5139de55b17d92efff365914520b988fb6eeececd11faa

Download Submit
C:\Windows\System\kQetzoj.exe

Filesize
1.2MB

MD5
d23791e44548f323101f845758fbd7d1

SHA1
9ba48c22c5fe2fc1490c01da97efd1b5922d230d

SHA256
7867e22079cd8b5bdd33e6e908b39e0d13cf2a2301180b151874295af72fe13c

SHA512
2f4e5b7e3971776c50e3b38db2a41d3776217008d9f7aa0ed091845a5cdfc92d1bfaebae4b3aeccc4bc0a718d44fab2bccd4770585f423c2c5a6904e912b6126

Download Submit
C:\Windows\System\kTEiIxY.exe

Filesize
1.2MB

MD5
8be3de540bc069e9970e3503ce1fbc3b

SHA1
2565e1c6548d797f20a0c45aa79bb11ad598c3ef

SHA256
6d3673ab1316afbd4f1cff6aa54b3c5c810e11b7a2a4a9d07230dfe463ac9dc7

SHA512
eb0415afbe104270f7e6f531bffb75615c87c455790c9c14e7afe1f5ee4d8c06785fca95ef3773d96fcfcfcb41962f2e05cb32ecfb8c49b95abcf0588283d96a

Download Submit
C:\Windows\System\mdDlEpg.exe

Filesize
1.2MB

MD5
fd65435284bcbace0a5cd040bf17b8c6

SHA1
a4403deb0a2d94927c8883cd39987796c2535258

SHA256
8fe405dae31abaf6108a935d3e22ba241d810a6b2b41686849bd5cd47ee6dd24

SHA512
d9a7e4f79da46f13a53c90eaa71d9b19f0b09a4e745570f8c0f344b54cf55b29357c4758d521d5aec1cfb8e879b9dae4bf5bf9b141318a0726c5869e3020eeba

Download Submit
C:\Windows\System\nBnglcP.exe

Filesize
1.2MB

MD5
ce7568abd140b1de6b9b90c483dbc437

SHA1
bf0dad137b2940f9b6f534cae5e982cf15f2db7b

SHA256
0b64918ca22de527c4e5e84f7cd6655fc48139ea87d81ea5719dfd4226629267

SHA512
5c6f1b6b6908983671a92bba6f33f71b945adcd10d53121a3eb36271b17e3d95b6f53cf3bedbc37b22995f2719a720d93ebe2ad4f5b769cffc58406ee7c0e8a3

Download Submit
C:\Windows\System\nRLwHrc.exe

Filesize
1.2MB

MD5
f083cab8e186b4eecc01fe1ed433f34b

SHA1
b84b49d446dbe3d1fa146da06e4f10d05391d819

SHA256
c8227f7846872012438b24939052bbf18ab5d75ccf267ae4b00acdc063796580

SHA512
9a08f3f1d08df541a74795f5a5f5939c10792f493bc8e02d69292a2fcb00a5c6b8918cb467d37311fc5131c9d6711caa583c83a81a027829fa76f0246f1f0ef5

Download Submit
C:\Windows\System\oqpzNyV.exe

Filesize
1.2MB

MD5
d272646e3a5fb249ee393f17ab7a3401

SHA1
bd9d2ff44af13ebec57815cfbde461e8fdab5454

SHA256
ae235c92c9996fe0db8641cb2e841e549f8d99ea34d058225b2f408cf2589f38

SHA512
36c95844cad7e666e9ef53bc122ce1a15a6b98c72f349cc0a0469effd9fa01793eed19016a23885986eda41ca3b2842340470a8eb3d28833b2918b79d535f752

Download Submit
C:\Windows\System\tqcituL.exe

Filesize
1.2MB

MD5
ed2fe57e584afde623a1070b884c1c49

SHA1
2f56e600cb970cc9265c5918e5a12cc94a30242e

SHA256
0e31a0180ea69f702efc7cacb48f9624c1861492ff540bfa2d5156c332ff663a

SHA512
b8e19d3a3201ae12863bb54d36e7fd248ba91c16cd374cd6b80e251ffcff8f07ed1dabba94be27277ab504005c456ac94d2f0bc6db084cbb8af59fd6aed5e085

Download Submit
C:\Windows\System\zAXdTjZ.exe

Filesize
1.2MB

MD5
884adddb0280cbead1491e222c50a5cd

SHA1
6ea8492c3007ee34cbe79df42f353e18abc27786

SHA256
75a8b5b3e543e4ae2dce828c4ec0bfa55dcbf8d636f203a87a12215de0634f2a

SHA512
84388cd42f826136e47b0bceead8164084a730447e93cce3c07bf070bcef639a97f7ef4c00ecf654803d8a67cee04db9a8a11619831ed7459182a34d4412386c

Download Submit
memory/4512-0-0x0000023DE8EE0000-0x0000023DE8EF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads