xmrig | b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914

Analysis

max time kernel
94s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
Size

1.7MB
MD5

198f9b7cc88a39baf368580dd14e0473
SHA1

ce94fc29295bc2a4981da6a5fa1c175f977de016
SHA256

b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914
SHA512

43c4652755510c57ae2b9dbbfab596221aef2a10ea48dc949712c2b26f583e1b028f718acd0a5322aec7a86f59a4e1c59f8608aa87fa4487f9961a7d13d54782
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYgDpHBxW5HT:GemTLkNdfE0pZyc

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c59-3.dat	xmrig
behavioral2/files/0x0007000000023cc2-15.dat	xmrig
behavioral2/files/0x0007000000023cc6-37.dat	xmrig
behavioral2/files/0x0007000000023cc8-47.dat	xmrig
behavioral2/files/0x0007000000023cd0-81.dat	xmrig
behavioral2/files/0x0007000000023cd5-108.dat	xmrig
behavioral2/files/0x0007000000023cd9-128.dat	xmrig
behavioral2/files/0x0007000000023ce0-161.dat	xmrig
behavioral2/files/0x0007000000023cde-157.dat	xmrig
behavioral2/files/0x0007000000023cdf-156.dat	xmrig
behavioral2/files/0x0007000000023cdd-152.dat	xmrig
behavioral2/files/0x0007000000023cdc-147.dat	xmrig
behavioral2/files/0x0007000000023cdb-142.dat	xmrig
behavioral2/files/0x0007000000023cda-136.dat	xmrig
behavioral2/files/0x0007000000023cd8-126.dat	xmrig
behavioral2/files/0x0007000000023cd7-122.dat	xmrig
behavioral2/files/0x0007000000023cd6-117.dat	xmrig
behavioral2/files/0x0007000000023cd4-106.dat	xmrig
behavioral2/files/0x0007000000023cd3-102.dat	xmrig
behavioral2/files/0x0007000000023cd2-96.dat	xmrig
behavioral2/files/0x0007000000023cd1-92.dat	xmrig
behavioral2/files/0x0007000000023ccf-82.dat	xmrig
behavioral2/files/0x0007000000023cce-77.dat	xmrig
behavioral2/files/0x0007000000023ccd-72.dat	xmrig
behavioral2/files/0x0007000000023ccc-67.dat	xmrig
behavioral2/files/0x0007000000023ccb-61.dat	xmrig
behavioral2/files/0x0007000000023cca-57.dat	xmrig
behavioral2/files/0x0007000000023cc9-51.dat	xmrig
behavioral2/files/0x0007000000023cc7-41.dat	xmrig
behavioral2/files/0x0007000000023cc5-31.dat	xmrig
behavioral2/files/0x0007000000023cc4-24.dat	xmrig
behavioral2/files/0x0007000000023cc3-18.dat	xmrig
behavioral2/files/0x000a000000023cba-16.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2544	VjEubaU.exe
1048	eXBKQMQ.exe
2888	DMUhUdS.exe
1556	GHEjtTl.exe
4384	LaooXOq.exe
4480	DsDgMPx.exe
4728	DxljTsw.exe
2976	NxVadoG.exe
2456	jwoBftn.exe
1604	hoxPdsF.exe
2876	uYuDhjw.exe
2168	govNHKF.exe
3636	ETFtyvW.exe
3140	qJdGUlp.exe
1632	oBtuGZs.exe
3940	QEahNiq.exe
4672	VygstNM.exe
3128	mwGQVLX.exe
2420	PqkOdNA.exe
4832	ShClzyL.exe
4876	ALXWUFf.exe
4484	cksRscn.exe
2448	lqowRyp.exe
3812	TAqqIAk.exe
3460	UDXlGEt.exe
1464	iZgFLER.exe
3100	wYKJkqj.exe
3056	egQMigd.exe
2508	uwTgrSI.exe
3640	ZVMvqtc.exe
2096	THikSxh.exe
2724	KtnAnrp.exe
4952	oBBokSz.exe
4248	mHqFVKq.exe
1816	vpmHrsV.exe
2320	GjcKgLS.exe
2092	lAHuhBL.exe
384	uiwTfNM.exe
2256	eGNdPrm.exe
3448	FZPQSWs.exe
4552	KWkhcCT.exe
3020	ElaZTux.exe
3848	cVALwWJ.exe
4688	MFRmPXn.exe
1692	pjBDAdj.exe
708	xJBHmlL.exe
320	whDfdUU.exe
764	tUJcZvi.exe
3676	ZYvCiqy.exe
3620	NBBbRlp.exe
3084	drigeOM.exe
4232	uRQafje.exe
868	doTikmb.exe
2620	DumTaDd.exe
32	pZqYmOd.exe
2436	aKflXlC.exe
3824	ytAKJzx.exe
1028	LwJAnHQ.exe
4292	ooEGhhi.exe
4396	wJtakwk.exe
220	LqNDcgw.exe
2268	QXGHcyV.exe
3052	oqBmchL.exe
4420	HYvFhJU.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jSIMOGt.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\aCrqPaN.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\HVAVGrt.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\JnBXbjo.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\YuuTISF.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\WZOhbSk.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\LttHybL.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\pImzRDw.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\ZmHiQBl.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\LBTwuGE.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\guYdSWM.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\ZhKTcGH.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\WkTAXBq.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\wCMFwij.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\TpuZqwh.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\NdoRxqM.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\nnNiYtn.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\XcEaDur.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\gEFqgaY.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\FmimSMR.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\ZllPLIe.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\dPPffwT.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\GvBPrrb.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\hDFLWTv.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\svApBuN.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\klpSWHA.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\VmHIqbT.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\fmRdHiU.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\oWCPjxo.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\NgMdbFA.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\vOcHTbo.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\rrDNcJW.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\MfLGAwu.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\efRzBJH.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\JHFliad.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\YJMFtaf.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\aHjmTAA.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\NuLVPeS.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\WRucHRZ.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\EMTKlnN.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\EMOYJRJ.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\tSjhEkM.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\wNlfszR.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\ZZBnmtK.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\NVaBjZk.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\HDPwvuf.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\VWqJqVq.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\nXJrNjX.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\wnttYaP.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\aFkRyMy.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\leWbklk.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\pjrUEGb.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\ZrtoptP.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\doTikmb.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\WxEptbT.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\PCxIqgx.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\FTFFavz.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\YeEtCDN.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\bIZxFnI.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\QhwBXDz.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\tPsxUMm.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\oanctIF.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\tWmAmca.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
File created	C:\Windows\System\IcdcEYw.exe	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 2544	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	83
PID 228 wrote to memory of 2544	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	83
PID 228 wrote to memory of 1048	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	84
PID 228 wrote to memory of 1048	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	84
PID 228 wrote to memory of 1556	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	85
PID 228 wrote to memory of 1556	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	85
PID 228 wrote to memory of 2888	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	86
PID 228 wrote to memory of 2888	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	86
PID 228 wrote to memory of 4384	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	87
PID 228 wrote to memory of 4384	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	87
PID 228 wrote to memory of 4480	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	88
PID 228 wrote to memory of 4480	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	88
PID 228 wrote to memory of 4728	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	89
PID 228 wrote to memory of 4728	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	89
PID 228 wrote to memory of 2976	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	90
PID 228 wrote to memory of 2976	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	90
PID 228 wrote to memory of 2456	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	91
PID 228 wrote to memory of 2456	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	91
PID 228 wrote to memory of 1604	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	92
PID 228 wrote to memory of 1604	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	92
PID 228 wrote to memory of 2876	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	93
PID 228 wrote to memory of 2876	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	93
PID 228 wrote to memory of 2168	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	94
PID 228 wrote to memory of 2168	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	94
PID 228 wrote to memory of 3636	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	95
PID 228 wrote to memory of 3636	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	95
PID 228 wrote to memory of 3140	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	96
PID 228 wrote to memory of 3140	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	96
PID 228 wrote to memory of 1632	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	97
PID 228 wrote to memory of 1632	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	97
PID 228 wrote to memory of 3940	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	98
PID 228 wrote to memory of 3940	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	98
PID 228 wrote to memory of 4672	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	99
PID 228 wrote to memory of 4672	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	99
PID 228 wrote to memory of 3128	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	100
PID 228 wrote to memory of 3128	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	100
PID 228 wrote to memory of 2420	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	101
PID 228 wrote to memory of 2420	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	101
PID 228 wrote to memory of 4832	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	102
PID 228 wrote to memory of 4832	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	102
PID 228 wrote to memory of 4876	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	103
PID 228 wrote to memory of 4876	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	103
PID 228 wrote to memory of 4484	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	104
PID 228 wrote to memory of 4484	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	104
PID 228 wrote to memory of 2448	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	105
PID 228 wrote to memory of 2448	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	105
PID 228 wrote to memory of 3812	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	106
PID 228 wrote to memory of 3812	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	106
PID 228 wrote to memory of 3460	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	107
PID 228 wrote to memory of 3460	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	107
PID 228 wrote to memory of 1464	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	108
PID 228 wrote to memory of 1464	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	108
PID 228 wrote to memory of 3100	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	109
PID 228 wrote to memory of 3100	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	109
PID 228 wrote to memory of 3056	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	110
PID 228 wrote to memory of 3056	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	110
PID 228 wrote to memory of 2508	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	111
PID 228 wrote to memory of 2508	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	111
PID 228 wrote to memory of 3640	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	112
PID 228 wrote to memory of 3640	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	112
PID 228 wrote to memory of 2096	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	113
PID 228 wrote to memory of 2096	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	113
PID 228 wrote to memory of 2724	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	114
PID 228 wrote to memory of 2724	228	b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe	114

C:\Users\Admin\AppData\Local\Temp\b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe
"C:\Users\Admin\AppData\Local\Temp\b30cc2adfa220686c8b3aa9951ffa93fd473e4a9c7e8c56db45a3e6abe011914.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\System\VjEubaU.exe
  C:\Windows\System\VjEubaU.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\eXBKQMQ.exe
  C:\Windows\System\eXBKQMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\GHEjtTl.exe
  C:\Windows\System\GHEjtTl.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\DMUhUdS.exe
  C:\Windows\System\DMUhUdS.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\LaooXOq.exe
  C:\Windows\System\LaooXOq.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\DsDgMPx.exe
  C:\Windows\System\DsDgMPx.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\DxljTsw.exe
  C:\Windows\System\DxljTsw.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\NxVadoG.exe
  C:\Windows\System\NxVadoG.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\jwoBftn.exe
  C:\Windows\System\jwoBftn.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\hoxPdsF.exe
  C:\Windows\System\hoxPdsF.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\uYuDhjw.exe
  C:\Windows\System\uYuDhjw.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\govNHKF.exe
  C:\Windows\System\govNHKF.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ETFtyvW.exe
  C:\Windows\System\ETFtyvW.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\qJdGUlp.exe
  C:\Windows\System\qJdGUlp.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\oBtuGZs.exe
  C:\Windows\System\oBtuGZs.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\QEahNiq.exe
  C:\Windows\System\QEahNiq.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\VygstNM.exe
  C:\Windows\System\VygstNM.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\mwGQVLX.exe
  C:\Windows\System\mwGQVLX.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\PqkOdNA.exe
  C:\Windows\System\PqkOdNA.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\ShClzyL.exe
  C:\Windows\System\ShClzyL.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\ALXWUFf.exe
  C:\Windows\System\ALXWUFf.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\cksRscn.exe
  C:\Windows\System\cksRscn.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\lqowRyp.exe
  C:\Windows\System\lqowRyp.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\TAqqIAk.exe
  C:\Windows\System\TAqqIAk.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\UDXlGEt.exe
  C:\Windows\System\UDXlGEt.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\iZgFLER.exe
  C:\Windows\System\iZgFLER.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\wYKJkqj.exe
  C:\Windows\System\wYKJkqj.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\egQMigd.exe
  C:\Windows\System\egQMigd.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\uwTgrSI.exe
  C:\Windows\System\uwTgrSI.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\ZVMvqtc.exe
  C:\Windows\System\ZVMvqtc.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\THikSxh.exe
  C:\Windows\System\THikSxh.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\KtnAnrp.exe
  C:\Windows\System\KtnAnrp.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\oBBokSz.exe
  C:\Windows\System\oBBokSz.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\mHqFVKq.exe
  C:\Windows\System\mHqFVKq.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\vpmHrsV.exe
  C:\Windows\System\vpmHrsV.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\GjcKgLS.exe
  C:\Windows\System\GjcKgLS.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\lAHuhBL.exe
  C:\Windows\System\lAHuhBL.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\uiwTfNM.exe
  C:\Windows\System\uiwTfNM.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\eGNdPrm.exe
  C:\Windows\System\eGNdPrm.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\FZPQSWs.exe
  C:\Windows\System\FZPQSWs.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\KWkhcCT.exe
  C:\Windows\System\KWkhcCT.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\ElaZTux.exe
  C:\Windows\System\ElaZTux.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\cVALwWJ.exe
  C:\Windows\System\cVALwWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\MFRmPXn.exe
  C:\Windows\System\MFRmPXn.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\pjBDAdj.exe
  C:\Windows\System\pjBDAdj.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\xJBHmlL.exe
  C:\Windows\System\xJBHmlL.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\whDfdUU.exe
  C:\Windows\System\whDfdUU.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\tUJcZvi.exe
  C:\Windows\System\tUJcZvi.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\ZYvCiqy.exe
  C:\Windows\System\ZYvCiqy.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\NBBbRlp.exe
  C:\Windows\System\NBBbRlp.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\drigeOM.exe
  C:\Windows\System\drigeOM.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\uRQafje.exe
  C:\Windows\System\uRQafje.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\doTikmb.exe
  C:\Windows\System\doTikmb.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\DumTaDd.exe
  C:\Windows\System\DumTaDd.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\pZqYmOd.exe
  C:\Windows\System\pZqYmOd.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\aKflXlC.exe
  C:\Windows\System\aKflXlC.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\ytAKJzx.exe
  C:\Windows\System\ytAKJzx.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\LwJAnHQ.exe
  C:\Windows\System\LwJAnHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\ooEGhhi.exe
  C:\Windows\System\ooEGhhi.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\wJtakwk.exe
  C:\Windows\System\wJtakwk.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\LqNDcgw.exe
  C:\Windows\System\LqNDcgw.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\QXGHcyV.exe
  C:\Windows\System\QXGHcyV.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\oqBmchL.exe
  C:\Windows\System\oqBmchL.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\HYvFhJU.exe
  C:\Windows\System\HYvFhJU.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\ESOQtOJ.exe
  C:\Windows\System\ESOQtOJ.exe
  2⤵
  PID:2292
- C:\Windows\System\JrtBJdw.exe
  C:\Windows\System\JrtBJdw.exe
  2⤵
  PID:3892
- C:\Windows\System\YMylrRB.exe
  C:\Windows\System\YMylrRB.exe
  2⤵
  PID:224
- C:\Windows\System\HLDLbqj.exe
  C:\Windows\System\HLDLbqj.exe
  2⤵
  PID:4684
- C:\Windows\System\mBGmTAz.exe
  C:\Windows\System\mBGmTAz.exe
  2⤵
  PID:4712
- C:\Windows\System\SRliZPx.exe
  C:\Windows\System\SRliZPx.exe
  2⤵
  PID:412
- C:\Windows\System\ISIMPiJ.exe
  C:\Windows\System\ISIMPiJ.exe
  2⤵
  PID:760
- C:\Windows\System\LPqGkKE.exe
  C:\Windows\System\LPqGkKE.exe
  2⤵
  PID:1372
- C:\Windows\System\rtVPpRB.exe
  C:\Windows\System\rtVPpRB.exe
  2⤵
  PID:1140
- C:\Windows\System\pImzRDw.exe
  C:\Windows\System\pImzRDw.exe
  2⤵
  PID:2264
- C:\Windows\System\UGKnJQS.exe
  C:\Windows\System\UGKnJQS.exe
  2⤵
  PID:3452
- C:\Windows\System\cVtwagT.exe
  C:\Windows\System\cVtwagT.exe
  2⤵
  PID:1112
- C:\Windows\System\aJfHcsk.exe
  C:\Windows\System\aJfHcsk.exe
  2⤵
  PID:1652
- C:\Windows\System\FedbhXZ.exe
  C:\Windows\System\FedbhXZ.exe
  2⤵
  PID:1332
- C:\Windows\System\wCCQxFE.exe
  C:\Windows\System\wCCQxFE.exe
  2⤵
  PID:4680
- C:\Windows\System\ghjlVtQ.exe
  C:\Windows\System\ghjlVtQ.exe
  2⤵
  PID:4344
- C:\Windows\System\nziEwaI.exe
  C:\Windows\System\nziEwaI.exe
  2⤵
  PID:1168
- C:\Windows\System\eedKmvl.exe
  C:\Windows\System\eedKmvl.exe
  2⤵
  PID:4392
- C:\Windows\System\wCMFwij.exe
  C:\Windows\System\wCMFwij.exe
  2⤵
  PID:2692
- C:\Windows\System\uLIGECt.exe
  C:\Windows\System\uLIGECt.exe
  2⤵
  PID:4612
- C:\Windows\System\SuuVGRt.exe
  C:\Windows\System\SuuVGRt.exe
  2⤵
  PID:4472
- C:\Windows\System\VWqJqVq.exe
  C:\Windows\System\VWqJqVq.exe
  2⤵
  PID:4592
- C:\Windows\System\qelLXMV.exe
  C:\Windows\System\qelLXMV.exe
  2⤵
  PID:3028
- C:\Windows\System\eIWNhcY.exe
  C:\Windows\System\eIWNhcY.exe
  2⤵
  PID:3584
- C:\Windows\System\EeijSeL.exe
  C:\Windows\System\EeijSeL.exe
  2⤵
  PID:4064
- C:\Windows\System\zXYAASK.exe
  C:\Windows\System\zXYAASK.exe
  2⤵
  PID:1948
- C:\Windows\System\IpVdRWP.exe
  C:\Windows\System\IpVdRWP.exe
  2⤵
  PID:3928
- C:\Windows\System\dUISvFO.exe
  C:\Windows\System\dUISvFO.exe
  2⤵
  PID:3036
- C:\Windows\System\hIDFMlY.exe
  C:\Windows\System\hIDFMlY.exe
  2⤵
  PID:3432
- C:\Windows\System\bEuXJSs.exe
  C:\Windows\System\bEuXJSs.exe
  2⤵
  PID:4364
- C:\Windows\System\WxEptbT.exe
  C:\Windows\System\WxEptbT.exe
  2⤵
  PID:5128
- C:\Windows\System\eihKtbL.exe
  C:\Windows\System\eihKtbL.exe
  2⤵
  PID:5156
- C:\Windows\System\eEKFqTs.exe
  C:\Windows\System\eEKFqTs.exe
  2⤵
  PID:5184
- C:\Windows\System\wMdAPtT.exe
  C:\Windows\System\wMdAPtT.exe
  2⤵
  PID:5212
- C:\Windows\System\gHxxxTW.exe
  C:\Windows\System\gHxxxTW.exe
  2⤵
  PID:5236
- C:\Windows\System\UTiiSuv.exe
  C:\Windows\System\UTiiSuv.exe
  2⤵
  PID:5300
- C:\Windows\System\BhOSbsD.exe
  C:\Windows\System\BhOSbsD.exe
  2⤵
  PID:5316
- C:\Windows\System\PzwnYWr.exe
  C:\Windows\System\PzwnYWr.exe
  2⤵
  PID:5332
- C:\Windows\System\AWqOZFo.exe
  C:\Windows\System\AWqOZFo.exe
  2⤵
  PID:5360
- C:\Windows\System\fkpwKKG.exe
  C:\Windows\System\fkpwKKG.exe
  2⤵
  PID:5384
- C:\Windows\System\zqjUwhH.exe
  C:\Windows\System\zqjUwhH.exe
  2⤵
  PID:5412
- C:\Windows\System\ZIhvjFv.exe
  C:\Windows\System\ZIhvjFv.exe
  2⤵
  PID:5440
- C:\Windows\System\bCddQDO.exe
  C:\Windows\System\bCddQDO.exe
  2⤵
  PID:5468
- C:\Windows\System\cxAafcD.exe
  C:\Windows\System\cxAafcD.exe
  2⤵
  PID:5496
- C:\Windows\System\qvulrAS.exe
  C:\Windows\System\qvulrAS.exe
  2⤵
  PID:5516
- C:\Windows\System\EZqxNnd.exe
  C:\Windows\System\EZqxNnd.exe
  2⤵
  PID:5544
- C:\Windows\System\zWPIqhP.exe
  C:\Windows\System\zWPIqhP.exe
  2⤵
  PID:5572
- C:\Windows\System\XcEaDur.exe
  C:\Windows\System\XcEaDur.exe
  2⤵
  PID:5600
- C:\Windows\System\xRUmBhO.exe
  C:\Windows\System\xRUmBhO.exe
  2⤵
  PID:5628
- C:\Windows\System\RssRyfA.exe
  C:\Windows\System\RssRyfA.exe
  2⤵
  PID:5656
- C:\Windows\System\NISfKqZ.exe
  C:\Windows\System\NISfKqZ.exe
  2⤵
  PID:5684
- C:\Windows\System\pbUPotQ.exe
  C:\Windows\System\pbUPotQ.exe
  2⤵
  PID:5712
- C:\Windows\System\lmhHcqY.exe
  C:\Windows\System\lmhHcqY.exe
  2⤵
  PID:5740
- C:\Windows\System\mofSwez.exe
  C:\Windows\System\mofSwez.exe
  2⤵
  PID:5768
- C:\Windows\System\GzIJVjY.exe
  C:\Windows\System\GzIJVjY.exe
  2⤵
  PID:5796
- C:\Windows\System\NzowmIS.exe
  C:\Windows\System\NzowmIS.exe
  2⤵
  PID:5824
- C:\Windows\System\uisgHYC.exe
  C:\Windows\System\uisgHYC.exe
  2⤵
  PID:5852
- C:\Windows\System\NKUdKKc.exe
  C:\Windows\System\NKUdKKc.exe
  2⤵
  PID:5880
- C:\Windows\System\hzyoEJi.exe
  C:\Windows\System\hzyoEJi.exe
  2⤵
  PID:5908
- C:\Windows\System\gHeZawU.exe
  C:\Windows\System\gHeZawU.exe
  2⤵
  PID:5936
- C:\Windows\System\EMOYJRJ.exe
  C:\Windows\System\EMOYJRJ.exe
  2⤵
  PID:5968
- C:\Windows\System\PxcAcCD.exe
  C:\Windows\System\PxcAcCD.exe
  2⤵
  PID:5992
- C:\Windows\System\NxylepO.exe
  C:\Windows\System\NxylepO.exe
  2⤵
  PID:6020
- C:\Windows\System\ElUoeOl.exe
  C:\Windows\System\ElUoeOl.exe
  2⤵
  PID:6048
- C:\Windows\System\JnRgaMG.exe
  C:\Windows\System\JnRgaMG.exe
  2⤵
  PID:6076
- C:\Windows\System\zCkMoDz.exe
  C:\Windows\System\zCkMoDz.exe
  2⤵
  PID:6104
- C:\Windows\System\hDFLWTv.exe
  C:\Windows\System\hDFLWTv.exe
  2⤵
  PID:6132
- C:\Windows\System\bbgudyI.exe
  C:\Windows\System\bbgudyI.exe
  2⤵
  PID:3308
- C:\Windows\System\TmcPgse.exe
  C:\Windows\System\TmcPgse.exe
  2⤵
  PID:2028
- C:\Windows\System\eyQyeqg.exe
  C:\Windows\System\eyQyeqg.exe
  2⤵
  PID:4072
- C:\Windows\System\TpuZqwh.exe
  C:\Windows\System\TpuZqwh.exe
  2⤵
  PID:1796
- C:\Windows\System\hIMaDdw.exe
  C:\Windows\System\hIMaDdw.exe
  2⤵
  PID:1980
- C:\Windows\System\JnBXbjo.exe
  C:\Windows\System\JnBXbjo.exe
  2⤵
  PID:4756
- C:\Windows\System\LWPebqg.exe
  C:\Windows\System\LWPebqg.exe
  2⤵
  PID:5192
- C:\Windows\System\RqWPLeu.exe
  C:\Windows\System\RqWPLeu.exe
  2⤵
  PID:5252
- C:\Windows\System\xAyYbgw.exe
  C:\Windows\System\xAyYbgw.exe
  2⤵
  PID:5324
- C:\Windows\System\WGgdjhY.exe
  C:\Windows\System\WGgdjhY.exe
  2⤵
  PID:5376
- C:\Windows\System\VUTNJgZ.exe
  C:\Windows\System\VUTNJgZ.exe
  2⤵
  PID:5436
- C:\Windows\System\egiMKsf.exe
  C:\Windows\System\egiMKsf.exe
  2⤵
  PID:5492
- C:\Windows\System\LlXRdxj.exe
  C:\Windows\System\LlXRdxj.exe
  2⤵
  PID:5560
- C:\Windows\System\yVXOvTk.exe
  C:\Windows\System\yVXOvTk.exe
  2⤵
  PID:5620
- C:\Windows\System\tOTozHt.exe
  C:\Windows\System\tOTozHt.exe
  2⤵
  PID:5696
- C:\Windows\System\MJEswpt.exe
  C:\Windows\System\MJEswpt.exe
  2⤵
  PID:5756
- C:\Windows\System\nCzuNCP.exe
  C:\Windows\System\nCzuNCP.exe
  2⤵
  PID:5816
- C:\Windows\System\kwmgOFM.exe
  C:\Windows\System\kwmgOFM.exe
  2⤵
  PID:5892
- C:\Windows\System\LNifgSR.exe
  C:\Windows\System\LNifgSR.exe
  2⤵
  PID:5952
- C:\Windows\System\gmgQMQu.exe
  C:\Windows\System\gmgQMQu.exe
  2⤵
  PID:6012
- C:\Windows\System\AmXEwpV.exe
  C:\Windows\System\AmXEwpV.exe
  2⤵
  PID:6068
- C:\Windows\System\hevSiDO.exe
  C:\Windows\System\hevSiDO.exe
  2⤵
  PID:2460
- C:\Windows\System\zUFbWld.exe
  C:\Windows\System\zUFbWld.exe
  2⤵
  PID:2532
- C:\Windows\System\yAJFTmi.exe
  C:\Windows\System\yAJFTmi.exe
  2⤵
  PID:1744
- C:\Windows\System\BUhCSAc.exe
  C:\Windows\System\BUhCSAc.exe
  2⤵
  PID:5228
- C:\Windows\System\eakGzQd.exe
  C:\Windows\System\eakGzQd.exe
  2⤵
  PID:4724
- C:\Windows\System\yQCBLiI.exe
  C:\Windows\System\yQCBLiI.exe
  2⤵
  PID:5532
- C:\Windows\System\KMMnzDi.exe
  C:\Windows\System\KMMnzDi.exe
  2⤵
  PID:6148
- C:\Windows\System\JjgMcUX.exe
  C:\Windows\System\JjgMcUX.exe
  2⤵
  PID:6180
- C:\Windows\System\ZNIQfKu.exe
  C:\Windows\System\ZNIQfKu.exe
  2⤵
  PID:6196
- C:\Windows\System\ekxHupX.exe
  C:\Windows\System\ekxHupX.exe
  2⤵
  PID:6224
- C:\Windows\System\BskvYoV.exe
  C:\Windows\System\BskvYoV.exe
  2⤵
  PID:6252
- C:\Windows\System\vbNgomU.exe
  C:\Windows\System\vbNgomU.exe
  2⤵
  PID:6280
- C:\Windows\System\YtGVLjx.exe
  C:\Windows\System\YtGVLjx.exe
  2⤵
  PID:6308
- C:\Windows\System\SRPmMaH.exe
  C:\Windows\System\SRPmMaH.exe
  2⤵
  PID:6336
- C:\Windows\System\DPUBVOf.exe
  C:\Windows\System\DPUBVOf.exe
  2⤵
  PID:6364
- C:\Windows\System\VmHIqbT.exe
  C:\Windows\System\VmHIqbT.exe
  2⤵
  PID:6392
- C:\Windows\System\xaEkTWg.exe
  C:\Windows\System\xaEkTWg.exe
  2⤵
  PID:6420
- C:\Windows\System\teMcrFb.exe
  C:\Windows\System\teMcrFb.exe
  2⤵
  PID:6448
- C:\Windows\System\ZmHiQBl.exe
  C:\Windows\System\ZmHiQBl.exe
  2⤵
  PID:6476
- C:\Windows\System\OmlHGIX.exe
  C:\Windows\System\OmlHGIX.exe
  2⤵
  PID:6504
- C:\Windows\System\ixQfqDH.exe
  C:\Windows\System\ixQfqDH.exe
  2⤵
  PID:6532
- C:\Windows\System\lRJkrYf.exe
  C:\Windows\System\lRJkrYf.exe
  2⤵
  PID:6560
- C:\Windows\System\skOvTWX.exe
  C:\Windows\System\skOvTWX.exe
  2⤵
  PID:6588
- C:\Windows\System\IfajDyq.exe
  C:\Windows\System\IfajDyq.exe
  2⤵
  PID:6616
- C:\Windows\System\XLjvWvX.exe
  C:\Windows\System\XLjvWvX.exe
  2⤵
  PID:6644
- C:\Windows\System\TyuvdVl.exe
  C:\Windows\System\TyuvdVl.exe
  2⤵
  PID:6672
- C:\Windows\System\MZOdyWY.exe
  C:\Windows\System\MZOdyWY.exe
  2⤵
  PID:6700
- C:\Windows\System\gmbJcVu.exe
  C:\Windows\System\gmbJcVu.exe
  2⤵
  PID:6728
- C:\Windows\System\MrDYmXS.exe
  C:\Windows\System\MrDYmXS.exe
  2⤵
  PID:6756
- C:\Windows\System\DLCDiES.exe
  C:\Windows\System\DLCDiES.exe
  2⤵
  PID:6784
- C:\Windows\System\Zuobcuq.exe
  C:\Windows\System\Zuobcuq.exe
  2⤵
  PID:6812
- C:\Windows\System\veVaNbE.exe
  C:\Windows\System\veVaNbE.exe
  2⤵
  PID:6836
- C:\Windows\System\HMysbcf.exe
  C:\Windows\System\HMysbcf.exe
  2⤵
  PID:6868
- C:\Windows\System\LabSjJa.exe
  C:\Windows\System\LabSjJa.exe
  2⤵
  PID:6896
- C:\Windows\System\BqTJZmv.exe
  C:\Windows\System\BqTJZmv.exe
  2⤵
  PID:6928
- C:\Windows\System\xOxOnCw.exe
  C:\Windows\System\xOxOnCw.exe
  2⤵
  PID:6956
- C:\Windows\System\FUGwsbc.exe
  C:\Windows\System\FUGwsbc.exe
  2⤵
  PID:6984
- C:\Windows\System\mnpjYtR.exe
  C:\Windows\System\mnpjYtR.exe
  2⤵
  PID:7008
- C:\Windows\System\gEFqgaY.exe
  C:\Windows\System\gEFqgaY.exe
  2⤵
  PID:7040
- C:\Windows\System\ZgZgXrJ.exe
  C:\Windows\System\ZgZgXrJ.exe
  2⤵
  PID:7068
- C:\Windows\System\LgjdXRn.exe
  C:\Windows\System\LgjdXRn.exe
  2⤵
  PID:7096
- C:\Windows\System\VTAnTFr.exe
  C:\Windows\System\VTAnTFr.exe
  2⤵
  PID:7124
- C:\Windows\System\NdoRxqM.exe
  C:\Windows\System\NdoRxqM.exe
  2⤵
  PID:7152
- C:\Windows\System\VPzLusd.exe
  C:\Windows\System\VPzLusd.exe
  2⤵
  PID:5784
- C:\Windows\System\oVOEnjj.exe
  C:\Windows\System\oVOEnjj.exe
  2⤵
  PID:3048
- C:\Windows\System\HQdzKHw.exe
  C:\Windows\System\HQdzKHw.exe
  2⤵
  PID:6004
- C:\Windows\System\zculQIG.exe
  C:\Windows\System\zculQIG.exe
  2⤵
  PID:6120
- C:\Windows\System\ynGmUwW.exe
  C:\Windows\System\ynGmUwW.exe
  2⤵
  PID:2152
- C:\Windows\System\EJnQEPv.exe
  C:\Windows\System\EJnQEPv.exe
  2⤵
  PID:5428
- C:\Windows\System\AvsBqGX.exe
  C:\Windows\System\AvsBqGX.exe
  2⤵
  PID:5672
- C:\Windows\System\EZNGCgg.exe
  C:\Windows\System\EZNGCgg.exe
  2⤵
  PID:6212
- C:\Windows\System\zHYrADm.exe
  C:\Windows\System\zHYrADm.exe
  2⤵
  PID:6268
- C:\Windows\System\yyCnXna.exe
  C:\Windows\System\yyCnXna.exe
  2⤵
  PID:3900
- C:\Windows\System\yLwlNcB.exe
  C:\Windows\System\yLwlNcB.exe
  2⤵
  PID:6376
- C:\Windows\System\FKPRKiT.exe
  C:\Windows\System\FKPRKiT.exe
  2⤵
  PID:6548
- C:\Windows\System\ajwkfql.exe
  C:\Windows\System\ajwkfql.exe
  2⤵
  PID:6632
- C:\Windows\System\OjRSsNZ.exe
  C:\Windows\System\OjRSsNZ.exe
  2⤵
  PID:6688
- C:\Windows\System\bhuJWPz.exe
  C:\Windows\System\bhuJWPz.exe
  2⤵
  PID:6768
- C:\Windows\System\fbUGdLB.exe
  C:\Windows\System\fbUGdLB.exe
  2⤵
  PID:6828
- C:\Windows\System\VtYLtnx.exe
  C:\Windows\System\VtYLtnx.exe
  2⤵
  PID:6888
- C:\Windows\System\hwCzuWa.exe
  C:\Windows\System\hwCzuWa.exe
  2⤵
  PID:6916
- C:\Windows\System\PkgSFQI.exe
  C:\Windows\System\PkgSFQI.exe
  2⤵
  PID:3600
- C:\Windows\System\TXZLkma.exe
  C:\Windows\System\TXZLkma.exe
  2⤵
  PID:7004
- C:\Windows\System\SvsXYOc.exe
  C:\Windows\System\SvsXYOc.exe
  2⤵
  PID:7056
- C:\Windows\System\fWHeouV.exe
  C:\Windows\System\fWHeouV.exe
  2⤵
  PID:7116
- C:\Windows\System\ecuSmQj.exe
  C:\Windows\System\ecuSmQj.exe
  2⤵
  PID:7140
- C:\Windows\System\ohpkqEr.exe
  C:\Windows\System\ohpkqEr.exe
  2⤵
  PID:5728
- C:\Windows\System\TJtEVaW.exe
  C:\Windows\System\TJtEVaW.exe
  2⤵
  PID:4456
- C:\Windows\System\isZGSpd.exe
  C:\Windows\System\isZGSpd.exe
  2⤵
  PID:2956
- C:\Windows\System\rBYxwNM.exe
  C:\Windows\System\rBYxwNM.exe
  2⤵
  PID:780
- C:\Windows\System\bQOPICR.exe
  C:\Windows\System\bQOPICR.exe
  2⤵
  PID:3604
- C:\Windows\System\jGLZAWy.exe
  C:\Windows\System\jGLZAWy.exe
  2⤵
  PID:4236
- C:\Windows\System\aOBkHZr.exe
  C:\Windows\System\aOBkHZr.exe
  2⤵
  PID:1912
- C:\Windows\System\fmRdHiU.exe
  C:\Windows\System\fmRdHiU.exe
  2⤵
  PID:6296
- C:\Windows\System\tDrQRBT.exe
  C:\Windows\System\tDrQRBT.exe
  2⤵
  PID:6492
- C:\Windows\System\sfjPget.exe
  C:\Windows\System\sfjPget.exe
  2⤵
  PID:4768
- C:\Windows\System\vQSvIvx.exe
  C:\Windows\System\vQSvIvx.exe
  2⤵
  PID:6664
- C:\Windows\System\dXbGAdz.exe
  C:\Windows\System\dXbGAdz.exe
  2⤵
  PID:6824
- C:\Windows\System\jQxBhdp.exe
  C:\Windows\System\jQxBhdp.exe
  2⤵
  PID:1152
- C:\Windows\System\pehMXQe.exe
  C:\Windows\System\pehMXQe.exe
  2⤵
  PID:6944
- C:\Windows\System\EaSKJSF.exe
  C:\Windows\System\EaSKJSF.exe
  2⤵
  PID:7136
- C:\Windows\System\UeTgdOV.exe
  C:\Windows\System\UeTgdOV.exe
  2⤵
  PID:5984
- C:\Windows\System\nMtLVzj.exe
  C:\Windows\System\nMtLVzj.exe
  2⤵
  PID:2312
- C:\Windows\System\oHdShPv.exe
  C:\Windows\System\oHdShPv.exe
  2⤵
  PID:6244
- C:\Windows\System\BSqMfEm.exe
  C:\Windows\System\BSqMfEm.exe
  2⤵
  PID:2496
- C:\Windows\System\qhjxjbV.exe
  C:\Windows\System\qhjxjbV.exe
  2⤵
  PID:6544
- C:\Windows\System\dPPffwT.exe
  C:\Windows\System\dPPffwT.exe
  2⤵
  PID:6740
- C:\Windows\System\EYpsfrT.exe
  C:\Windows\System\EYpsfrT.exe
  2⤵
  PID:2804
- C:\Windows\System\RlcJTXj.exe
  C:\Windows\System\RlcJTXj.exe
  2⤵
  PID:4352
- C:\Windows\System\lWtsgkc.exe
  C:\Windows\System\lWtsgkc.exe
  2⤵
  PID:3500
- C:\Windows\System\vbKfEgp.exe
  C:\Windows\System\vbKfEgp.exe
  2⤵
  PID:6660
- C:\Windows\System\tSjhEkM.exe
  C:\Windows\System\tSjhEkM.exe
  2⤵
  PID:7184
- C:\Windows\System\OLhxGwj.exe
  C:\Windows\System\OLhxGwj.exe
  2⤵
  PID:7212
- C:\Windows\System\JHrJCIp.exe
  C:\Windows\System\JHrJCIp.exe
  2⤵
  PID:7240
- C:\Windows\System\QNXaVQp.exe
  C:\Windows\System\QNXaVQp.exe
  2⤵
  PID:7260
- C:\Windows\System\EwSNSuR.exe
  C:\Windows\System\EwSNSuR.exe
  2⤵
  PID:7276
- C:\Windows\System\qjuZHDb.exe
  C:\Windows\System\qjuZHDb.exe
  2⤵
  PID:7296
- C:\Windows\System\opOHdIz.exe
  C:\Windows\System\opOHdIz.exe
  2⤵
  PID:7312
- C:\Windows\System\MfxiTrD.exe
  C:\Windows\System\MfxiTrD.exe
  2⤵
  PID:7336
- C:\Windows\System\viScjfY.exe
  C:\Windows\System\viScjfY.exe
  2⤵
  PID:7360
- C:\Windows\System\RmLccxR.exe
  C:\Windows\System\RmLccxR.exe
  2⤵
  PID:7432
- C:\Windows\System\TeMzeHk.exe
  C:\Windows\System\TeMzeHk.exe
  2⤵
  PID:7480
- C:\Windows\System\UwWhQvf.exe
  C:\Windows\System\UwWhQvf.exe
  2⤵
  PID:7508
- C:\Windows\System\tHhbWZC.exe
  C:\Windows\System\tHhbWZC.exe
  2⤵
  PID:7524
- C:\Windows\System\KtLAylZ.exe
  C:\Windows\System\KtLAylZ.exe
  2⤵
  PID:7552
- C:\Windows\System\tPsxUMm.exe
  C:\Windows\System\tPsxUMm.exe
  2⤵
  PID:7580
- C:\Windows\System\wpTySZO.exe
  C:\Windows\System\wpTySZO.exe
  2⤵
  PID:7608
- C:\Windows\System\YgAxuoX.exe
  C:\Windows\System\YgAxuoX.exe
  2⤵
  PID:7624
- C:\Windows\System\ATMQSsT.exe
  C:\Windows\System\ATMQSsT.exe
  2⤵
  PID:7664
- C:\Windows\System\tjlSibs.exe
  C:\Windows\System\tjlSibs.exe
  2⤵
  PID:7684
- C:\Windows\System\QLreZyC.exe
  C:\Windows\System\QLreZyC.exe
  2⤵
  PID:7720
- C:\Windows\System\OVElOoi.exe
  C:\Windows\System\OVElOoi.exe
  2⤵
  PID:7740
- C:\Windows\System\IwLHfPO.exe
  C:\Windows\System\IwLHfPO.exe
  2⤵
  PID:7772
- C:\Windows\System\pDZnnPM.exe
  C:\Windows\System\pDZnnPM.exe
  2⤵
  PID:7816
- C:\Windows\System\Dfthymh.exe
  C:\Windows\System\Dfthymh.exe
  2⤵
  PID:7840
- C:\Windows\System\WmYnkxZ.exe
  C:\Windows\System\WmYnkxZ.exe
  2⤵
  PID:7860
- C:\Windows\System\FsUMBSH.exe
  C:\Windows\System\FsUMBSH.exe
  2⤵
  PID:7888
- C:\Windows\System\QNSPbHh.exe
  C:\Windows\System\QNSPbHh.exe
  2⤵
  PID:7916
- C:\Windows\System\sRzYdSH.exe
  C:\Windows\System\sRzYdSH.exe
  2⤵
  PID:7948
- C:\Windows\System\DgpjynR.exe
  C:\Windows\System\DgpjynR.exe
  2⤵
  PID:7972
- C:\Windows\System\wNlfszR.exe
  C:\Windows\System\wNlfszR.exe
  2⤵
  PID:8000
- C:\Windows\System\EqJrTAr.exe
  C:\Windows\System\EqJrTAr.exe
  2⤵
  PID:8024
- C:\Windows\System\hvAQDPL.exe
  C:\Windows\System\hvAQDPL.exe
  2⤵
  PID:8056
- C:\Windows\System\ANgyIkE.exe
  C:\Windows\System\ANgyIkE.exe
  2⤵
  PID:8084
- C:\Windows\System\cPmtQMq.exe
  C:\Windows\System\cPmtQMq.exe
  2⤵
  PID:8112
- C:\Windows\System\vcIDdWT.exe
  C:\Windows\System\vcIDdWT.exe
  2⤵
  PID:8152
- C:\Windows\System\Yllgzor.exe
  C:\Windows\System\Yllgzor.exe
  2⤵
  PID:8168
- C:\Windows\System\jKaNWYm.exe
  C:\Windows\System\jKaNWYm.exe
  2⤵
  PID:8184
- C:\Windows\System\WXsZRMf.exe
  C:\Windows\System\WXsZRMf.exe
  2⤵
  PID:7024
- C:\Windows\System\NSrwaIa.exe
  C:\Windows\System\NSrwaIa.exe
  2⤵
  PID:7232
- C:\Windows\System\ZZBnmtK.exe
  C:\Windows\System\ZZBnmtK.exe
  2⤵
  PID:7380
- C:\Windows\System\xvrvGiw.exe
  C:\Windows\System\xvrvGiw.exe
  2⤵
  PID:7452
- C:\Windows\System\WwSSnNH.exe
  C:\Windows\System\WwSSnNH.exe
  2⤵
  PID:7500
- C:\Windows\System\sKQuYCc.exe
  C:\Windows\System\sKQuYCc.exe
  2⤵
  PID:7564
- C:\Windows\System\lAWUIIg.exe
  C:\Windows\System\lAWUIIg.exe
  2⤵
  PID:7620
- C:\Windows\System\lrpqlAu.exe
  C:\Windows\System\lrpqlAu.exe
  2⤵
  PID:7672
- C:\Windows\System\zcwqSyx.exe
  C:\Windows\System\zcwqSyx.exe
  2⤵
  PID:7756
- C:\Windows\System\HoBPAjE.exe
  C:\Windows\System\HoBPAjE.exe
  2⤵
  PID:7812
- C:\Windows\System\IpqNarC.exe
  C:\Windows\System\IpqNarC.exe
  2⤵
  PID:7876
- C:\Windows\System\dczJooS.exe
  C:\Windows\System\dczJooS.exe
  2⤵
  PID:7932
- C:\Windows\System\pyyZGgr.exe
  C:\Windows\System\pyyZGgr.exe
  2⤵
  PID:7964
- C:\Windows\System\OSWXHOH.exe
  C:\Windows\System\OSWXHOH.exe
  2⤵
  PID:8044
- C:\Windows\System\dWojIrE.exe
  C:\Windows\System\dWojIrE.exe
  2⤵
  PID:8076
- C:\Windows\System\gZXTpWn.exe
  C:\Windows\System\gZXTpWn.exe
  2⤵
  PID:6356
- C:\Windows\System\FrvmaNx.exe
  C:\Windows\System\FrvmaNx.exe
  2⤵
  PID:7176
- C:\Windows\System\HJOdYLR.exe
  C:\Windows\System\HJOdYLR.exe
  2⤵
  PID:7476
- C:\Windows\System\PtTQImW.exe
  C:\Windows\System\PtTQImW.exe
  2⤵
  PID:7596
- C:\Windows\System\QRnDWwj.exe
  C:\Windows\System\QRnDWwj.exe
  2⤵
  PID:7804
- C:\Windows\System\MuEltlM.exe
  C:\Windows\System\MuEltlM.exe
  2⤵
  PID:7872
- C:\Windows\System\ZPDEjMw.exe
  C:\Windows\System\ZPDEjMw.exe
  2⤵
  PID:8040
- C:\Windows\System\HyRBiif.exe
  C:\Windows\System\HyRBiif.exe
  2⤵
  PID:6628
- C:\Windows\System\vFUxYlW.exe
  C:\Windows\System\vFUxYlW.exe
  2⤵
  PID:7544
- C:\Windows\System\NgMdbFA.exe
  C:\Windows\System\NgMdbFA.exe
  2⤵
  PID:7648
- C:\Windows\System\mpwBVwJ.exe
  C:\Windows\System\mpwBVwJ.exe
  2⤵
  PID:8180
- C:\Windows\System\NVaBjZk.exe
  C:\Windows\System\NVaBjZk.exe
  2⤵
  PID:8196
- C:\Windows\System\bmmjiyv.exe
  C:\Windows\System\bmmjiyv.exe
  2⤵
  PID:8212
- C:\Windows\System\YFLtOOu.exe
  C:\Windows\System\YFLtOOu.exe
  2⤵
  PID:8252
- C:\Windows\System\AjONavI.exe
  C:\Windows\System\AjONavI.exe
  2⤵
  PID:8280
- C:\Windows\System\xNHIqxQ.exe
  C:\Windows\System\xNHIqxQ.exe
  2⤵
  PID:8308
- C:\Windows\System\ltPnEfj.exe
  C:\Windows\System\ltPnEfj.exe
  2⤵
  PID:8324
- C:\Windows\System\qLRUeAE.exe
  C:\Windows\System\qLRUeAE.exe
  2⤵
  PID:8364
- C:\Windows\System\IahDANB.exe
  C:\Windows\System\IahDANB.exe
  2⤵
  PID:8384
- C:\Windows\System\yOvqxeV.exe
  C:\Windows\System\yOvqxeV.exe
  2⤵
  PID:8408
- C:\Windows\System\GSFEKjc.exe
  C:\Windows\System\GSFEKjc.exe
  2⤵
  PID:8432
- C:\Windows\System\EzQMtZI.exe
  C:\Windows\System\EzQMtZI.exe
  2⤵
  PID:8452
- C:\Windows\System\tlixUQG.exe
  C:\Windows\System\tlixUQG.exe
  2⤵
  PID:8480
- C:\Windows\System\QkuFkGa.exe
  C:\Windows\System\QkuFkGa.exe
  2⤵
  PID:8516
- C:\Windows\System\EvKNpEa.exe
  C:\Windows\System\EvKNpEa.exe
  2⤵
  PID:8548
- C:\Windows\System\SLZRxDj.exe
  C:\Windows\System\SLZRxDj.exe
  2⤵
  PID:8588
- C:\Windows\System\NxPHusi.exe
  C:\Windows\System\NxPHusi.exe
  2⤵
  PID:8604
- C:\Windows\System\TlHilFz.exe
  C:\Windows\System\TlHilFz.exe
  2⤵
  PID:8644
- C:\Windows\System\MVrdaww.exe
  C:\Windows\System\MVrdaww.exe
  2⤵
  PID:8660
- C:\Windows\System\MYSczJk.exe
  C:\Windows\System\MYSczJk.exe
  2⤵
  PID:8688
- C:\Windows\System\NGLicNE.exe
  C:\Windows\System\NGLicNE.exe
  2⤵
  PID:8704
- C:\Windows\System\yjbJiEr.exe
  C:\Windows\System\yjbJiEr.exe
  2⤵
  PID:8736
- C:\Windows\System\dVqANgU.exe
  C:\Windows\System\dVqANgU.exe
  2⤵
  PID:8784
- C:\Windows\System\ZkVjGho.exe
  C:\Windows\System\ZkVjGho.exe
  2⤵
  PID:8800
- C:\Windows\System\VtutoRz.exe
  C:\Windows\System\VtutoRz.exe
  2⤵
  PID:8840
- C:\Windows\System\mntsDGf.exe
  C:\Windows\System\mntsDGf.exe
  2⤵
  PID:8868
- C:\Windows\System\HDPwvuf.exe
  C:\Windows\System\HDPwvuf.exe
  2⤵
  PID:8884
- C:\Windows\System\WRucHRZ.exe
  C:\Windows\System\WRucHRZ.exe
  2⤵
  PID:8924
- C:\Windows\System\QlDaIMR.exe
  C:\Windows\System\QlDaIMR.exe
  2⤵
  PID:8940
- C:\Windows\System\ttVRUlf.exe
  C:\Windows\System\ttVRUlf.exe
  2⤵
  PID:8980
- C:\Windows\System\IbOWKpQ.exe
  C:\Windows\System\IbOWKpQ.exe
  2⤵
  PID:9008
- C:\Windows\System\qdsmAue.exe
  C:\Windows\System\qdsmAue.exe
  2⤵
  PID:9024
- C:\Windows\System\FPPrYKF.exe
  C:\Windows\System\FPPrYKF.exe
  2⤵
  PID:9064
- C:\Windows\System\aBkKvXb.exe
  C:\Windows\System\aBkKvXb.exe
  2⤵
  PID:9080
- C:\Windows\System\cCKHSHi.exe
  C:\Windows\System\cCKHSHi.exe
  2⤵
  PID:9120
- C:\Windows\System\oEWrvWo.exe
  C:\Windows\System\oEWrvWo.exe
  2⤵
  PID:9140
- C:\Windows\System\JsyuoSW.exe
  C:\Windows\System\JsyuoSW.exe
  2⤵
  PID:9176
- C:\Windows\System\tjCaJng.exe
  C:\Windows\System\tjCaJng.exe
  2⤵
  PID:9200
- C:\Windows\System\aEveMbq.exe
  C:\Windows\System\aEveMbq.exe
  2⤵
  PID:8204
- C:\Windows\System\aFkRyMy.exe
  C:\Windows\System\aFkRyMy.exe
  2⤵
  PID:8264
- C:\Windows\System\qXMioVM.exe
  C:\Windows\System\qXMioVM.exe
  2⤵
  PID:8300
- C:\Windows\System\loFtEIX.exe
  C:\Windows\System\loFtEIX.exe
  2⤵
  PID:8372
- C:\Windows\System\tCIMXFb.exe
  C:\Windows\System\tCIMXFb.exe
  2⤵
  PID:8444
- C:\Windows\System\hKLmInT.exe
  C:\Windows\System\hKLmInT.exe
  2⤵
  PID:8504
- C:\Windows\System\znyAXJp.exe
  C:\Windows\System\znyAXJp.exe
  2⤵
  PID:8536
- C:\Windows\System\NgZXMBP.exe
  C:\Windows\System\NgZXMBP.exe
  2⤵
  PID:8636
- C:\Windows\System\hjYqfXd.exe
  C:\Windows\System\hjYqfXd.exe
  2⤵
  PID:8724
- C:\Windows\System\SfxlQJT.exe
  C:\Windows\System\SfxlQJT.exe
  2⤵
  PID:8792
- C:\Windows\System\uAQxLNR.exe
  C:\Windows\System\uAQxLNR.exe
  2⤵
  PID:8856
- C:\Windows\System\GtFSNBE.exe
  C:\Windows\System\GtFSNBE.exe
  2⤵
  PID:8908
- C:\Windows\System\wmKMTAY.exe
  C:\Windows\System\wmKMTAY.exe
  2⤵
  PID:9000
- C:\Windows\System\iarfFVs.exe
  C:\Windows\System\iarfFVs.exe
  2⤵
  PID:9020
- C:\Windows\System\oiPGZxD.exe
  C:\Windows\System\oiPGZxD.exe
  2⤵
  PID:9100
- C:\Windows\System\cwNTOAj.exe
  C:\Windows\System\cwNTOAj.exe
  2⤵
  PID:9136
- C:\Windows\System\TDCFxNf.exe
  C:\Windows\System\TDCFxNf.exe
  2⤵
  PID:9208
- C:\Windows\System\GFmrTqS.exe
  C:\Windows\System\GFmrTqS.exe
  2⤵
  PID:8236
- C:\Windows\System\kSpFQJb.exe
  C:\Windows\System\kSpFQJb.exe
  2⤵
  PID:8772
- C:\Windows\System\LMxQXaw.exe
  C:\Windows\System\LMxQXaw.exe
  2⤵
  PID:8680
- C:\Windows\System\FwCBzrn.exe
  C:\Windows\System\FwCBzrn.exe
  2⤵
  PID:8976
- C:\Windows\System\ZsCKoer.exe
  C:\Windows\System\ZsCKoer.exe
  2⤵
  PID:9076
- C:\Windows\System\pVgQOBG.exe
  C:\Windows\System\pVgQOBG.exe
  2⤵
  PID:9212
- C:\Windows\System\XWagcqX.exe
  C:\Windows\System\XWagcqX.exe
  2⤵
  PID:8904
- C:\Windows\System\NzXRrvf.exe
  C:\Windows\System\NzXRrvf.exe
  2⤵
  PID:8316
- C:\Windows\System\WQtXCKQ.exe
  C:\Windows\System\WQtXCKQ.exe
  2⤵
  PID:8320
- C:\Windows\System\aHjmTAA.exe
  C:\Windows\System\aHjmTAA.exe
  2⤵
  PID:8468
- C:\Windows\System\FluPzUl.exe
  C:\Windows\System\FluPzUl.exe
  2⤵
  PID:9248
- C:\Windows\System\lvbSQKR.exe
  C:\Windows\System\lvbSQKR.exe
  2⤵
  PID:9272
- C:\Windows\System\gNhJvcX.exe
  C:\Windows\System\gNhJvcX.exe
  2⤵
  PID:9296
- C:\Windows\System\RgnTAwb.exe
  C:\Windows\System\RgnTAwb.exe
  2⤵
  PID:9324
- C:\Windows\System\vSWyRIH.exe
  C:\Windows\System\vSWyRIH.exe
  2⤵
  PID:9352
- C:\Windows\System\MEocegE.exe
  C:\Windows\System\MEocegE.exe
  2⤵
  PID:9368
- C:\Windows\System\vbZhRAt.exe
  C:\Windows\System\vbZhRAt.exe
  2⤵
  PID:9412
- C:\Windows\System\rWMvkSu.exe
  C:\Windows\System\rWMvkSu.exe
  2⤵
  PID:9448
- C:\Windows\System\IgRrVAl.exe
  C:\Windows\System\IgRrVAl.exe
  2⤵
  PID:9464
- C:\Windows\System\OufaNRY.exe
  C:\Windows\System\OufaNRY.exe
  2⤵
  PID:9480
- C:\Windows\System\PDRcUIt.exe
  C:\Windows\System\PDRcUIt.exe
  2⤵
  PID:9512
- C:\Windows\System\UVtMhDQ.exe
  C:\Windows\System\UVtMhDQ.exe
  2⤵
  PID:9536
- C:\Windows\System\uNvbDwm.exe
  C:\Windows\System\uNvbDwm.exe
  2⤵
  PID:9560
- C:\Windows\System\CLQkWHb.exe
  C:\Windows\System\CLQkWHb.exe
  2⤵
  PID:9596
- C:\Windows\System\DSxPTIM.exe
  C:\Windows\System\DSxPTIM.exe
  2⤵
  PID:9620
- C:\Windows\System\oanctIF.exe
  C:\Windows\System\oanctIF.exe
  2⤵
  PID:9652
- C:\Windows\System\YuuTISF.exe
  C:\Windows\System\YuuTISF.exe
  2⤵
  PID:9676
- C:\Windows\System\NLQfwiW.exe
  C:\Windows\System\NLQfwiW.exe
  2⤵
  PID:9708
- C:\Windows\System\KnEYgWQ.exe
  C:\Windows\System\KnEYgWQ.exe
  2⤵
  PID:9744
- C:\Windows\System\tiuMxGc.exe
  C:\Windows\System\tiuMxGc.exe
  2⤵
  PID:9800
- C:\Windows\System\RUVtNfU.exe
  C:\Windows\System\RUVtNfU.exe
  2⤵
  PID:9820
- C:\Windows\System\nspeRtU.exe
  C:\Windows\System\nspeRtU.exe
  2⤵
  PID:9852
- C:\Windows\System\jIFhgRA.exe
  C:\Windows\System\jIFhgRA.exe
  2⤵
  PID:9880
- C:\Windows\System\MSDTvnB.exe
  C:\Windows\System\MSDTvnB.exe
  2⤵
  PID:9900
- C:\Windows\System\vGRGxmc.exe
  C:\Windows\System\vGRGxmc.exe
  2⤵
  PID:9928
- C:\Windows\System\UocXNZh.exe
  C:\Windows\System\UocXNZh.exe
  2⤵
  PID:9948
- C:\Windows\System\rIEBrZu.exe
  C:\Windows\System\rIEBrZu.exe
  2⤵
  PID:9984
- C:\Windows\System\UZGXZXG.exe
  C:\Windows\System\UZGXZXG.exe
  2⤵
  PID:10012
- C:\Windows\System\YtJXSOH.exe
  C:\Windows\System\YtJXSOH.exe
  2⤵
  PID:10032
- C:\Windows\System\oFfcXzw.exe
  C:\Windows\System\oFfcXzw.exe
  2⤵
  PID:10056
- C:\Windows\System\upEruNn.exe
  C:\Windows\System\upEruNn.exe
  2⤵
  PID:10104
- C:\Windows\System\ABPAqgp.exe
  C:\Windows\System\ABPAqgp.exe
  2⤵
  PID:10124
- C:\Windows\System\WvErvUp.exe
  C:\Windows\System\WvErvUp.exe
  2⤵
  PID:10144
- C:\Windows\System\CDthUYh.exe
  C:\Windows\System\CDthUYh.exe
  2⤵
  PID:10172
- C:\Windows\System\aELtTlk.exe
  C:\Windows\System\aELtTlk.exe
  2⤵
  PID:10200
- C:\Windows\System\QxWXqBJ.exe
  C:\Windows\System\QxWXqBJ.exe
  2⤵
  PID:10236
- C:\Windows\System\omiWLSJ.exe
  C:\Windows\System\omiWLSJ.exe
  2⤵
  PID:9280
- C:\Windows\System\htYAXqX.exe
  C:\Windows\System\htYAXqX.exe
  2⤵
  PID:9364
- C:\Windows\System\zPlOGjJ.exe
  C:\Windows\System\zPlOGjJ.exe
  2⤵
  PID:9400
- C:\Windows\System\TWWkumQ.exe
  C:\Windows\System\TWWkumQ.exe
  2⤵
  PID:9472
- C:\Windows\System\AOlPqve.exe
  C:\Windows\System\AOlPqve.exe
  2⤵
  PID:9508
- C:\Windows\System\SRaqPjR.exe
  C:\Windows\System\SRaqPjR.exe
  2⤵
  PID:9616
- C:\Windows\System\aTsFjlZ.exe
  C:\Windows\System\aTsFjlZ.exe
  2⤵
  PID:9736
- C:\Windows\System\ueCdxwR.exe
  C:\Windows\System\ueCdxwR.exe
  2⤵
  PID:9688
- C:\Windows\System\tWmAmca.exe
  C:\Windows\System\tWmAmca.exe
  2⤵
  PID:9788
- C:\Windows\System\pWgqivq.exe
  C:\Windows\System\pWgqivq.exe
  2⤵
  PID:9844
- C:\Windows\System\GeoupcI.exe
  C:\Windows\System\GeoupcI.exe
  2⤵
  PID:9892
- C:\Windows\System\pStaqgp.exe
  C:\Windows\System\pStaqgp.exe
  2⤵
  PID:9976
- C:\Windows\System\jkhKpAr.exe
  C:\Windows\System\jkhKpAr.exe
  2⤵
  PID:10028
- C:\Windows\System\HAKkdgK.exe
  C:\Windows\System\HAKkdgK.exe
  2⤵
  PID:10120
- C:\Windows\System\FVXRlrf.exe
  C:\Windows\System\FVXRlrf.exe
  2⤵
  PID:10136
- C:\Windows\System\zeaTCQH.exe
  C:\Windows\System\zeaTCQH.exe
  2⤵
  PID:10228
- C:\Windows\System\LvYAnva.exe
  C:\Windows\System\LvYAnva.exe
  2⤵
  PID:9244
- C:\Windows\System\FYwomlg.exe
  C:\Windows\System\FYwomlg.exe
  2⤵
  PID:9436
- C:\Windows\System\dcMymSU.exe
  C:\Windows\System\dcMymSU.exe
  2⤵
  PID:9608
- C:\Windows\System\NOUYhvA.exe
  C:\Windows\System\NOUYhvA.exe
  2⤵
  PID:9732
- C:\Windows\System\GaHAgKL.exe
  C:\Windows\System\GaHAgKL.exe
  2⤵
  PID:9828
- C:\Windows\System\DjkFuOM.exe
  C:\Windows\System\DjkFuOM.exe
  2⤵
  PID:10100
- C:\Windows\System\yhUycRp.exe
  C:\Windows\System\yhUycRp.exe
  2⤵
  PID:10164
- C:\Windows\System\GzEtoAV.exe
  C:\Windows\System\GzEtoAV.exe
  2⤵
  PID:9240
- C:\Windows\System\MyOlBFw.exe
  C:\Windows\System\MyOlBFw.exe
  2⤵
  PID:9692
- C:\Windows\System\zlqlyWK.exe
  C:\Windows\System\zlqlyWK.exe
  2⤵
  PID:9944
- C:\Windows\System\gQdeQaZ.exe
  C:\Windows\System\gQdeQaZ.exe
  2⤵
  PID:10068
- C:\Windows\System\RbmaCkJ.exe
  C:\Windows\System\RbmaCkJ.exe
  2⤵
  PID:9864
- C:\Windows\System\dETkYPU.exe
  C:\Windows\System\dETkYPU.exe
  2⤵
  PID:10268
- C:\Windows\System\JJOnBdw.exe
  C:\Windows\System\JJOnBdw.exe
  2⤵
  PID:10296
- C:\Windows\System\cBXoaLS.exe
  C:\Windows\System\cBXoaLS.exe
  2⤵
  PID:10324
- C:\Windows\System\qhLCmQi.exe
  C:\Windows\System\qhLCmQi.exe
  2⤵
  PID:10352
- C:\Windows\System\GbCTcyO.exe
  C:\Windows\System\GbCTcyO.exe
  2⤵
  PID:10368
- C:\Windows\System\eTKJqlH.exe
  C:\Windows\System\eTKJqlH.exe
  2⤵
  PID:10384
- C:\Windows\System\lfEsiyz.exe
  C:\Windows\System\lfEsiyz.exe
  2⤵
  PID:10424
- C:\Windows\System\hlkCmDN.exe
  C:\Windows\System\hlkCmDN.exe
  2⤵
  PID:10452
- C:\Windows\System\UdLWOEc.exe
  C:\Windows\System\UdLWOEc.exe
  2⤵
  PID:10492
- C:\Windows\System\sQqRmOZ.exe
  C:\Windows\System\sQqRmOZ.exe
  2⤵
  PID:10520
- C:\Windows\System\oWCPjxo.exe
  C:\Windows\System\oWCPjxo.exe
  2⤵
  PID:10548
- C:\Windows\System\lGmWdsv.exe
  C:\Windows\System\lGmWdsv.exe
  2⤵
  PID:10576
- C:\Windows\System\JCbSJIB.exe
  C:\Windows\System\JCbSJIB.exe
  2⤵
  PID:10592
- C:\Windows\System\fxxZgHP.exe
  C:\Windows\System\fxxZgHP.exe
  2⤵
  PID:10620
- C:\Windows\System\uejvoge.exe
  C:\Windows\System\uejvoge.exe
  2⤵
  PID:10644
- C:\Windows\System\KGcaJFq.exe
  C:\Windows\System\KGcaJFq.exe
  2⤵
  PID:10676
- C:\Windows\System\lHpPwnK.exe
  C:\Windows\System\lHpPwnK.exe
  2⤵
  PID:10712
- C:\Windows\System\nCfGyuD.exe
  C:\Windows\System\nCfGyuD.exe
  2⤵
  PID:10728
- C:\Windows\System\ElLbrVp.exe
  C:\Windows\System\ElLbrVp.exe
  2⤵
  PID:10748
- C:\Windows\System\jSIMOGt.exe
  C:\Windows\System\jSIMOGt.exe
  2⤵
  PID:10776
- C:\Windows\System\iuuXMyJ.exe
  C:\Windows\System\iuuXMyJ.exe
  2⤵
  PID:10804
- C:\Windows\System\cabhvrG.exe
  C:\Windows\System\cabhvrG.exe
  2⤵
  PID:10856
- C:\Windows\System\aYblxsb.exe
  C:\Windows\System\aYblxsb.exe
  2⤵
  PID:10872
- C:\Windows\System\CZQsqdc.exe
  C:\Windows\System\CZQsqdc.exe
  2⤵
  PID:10888
- C:\Windows\System\rzSPgem.exe
  C:\Windows\System\rzSPgem.exe
  2⤵
  PID:10912
- C:\Windows\System\LBTwuGE.exe
  C:\Windows\System\LBTwuGE.exe
  2⤵
  PID:10932
- C:\Windows\System\wyCpjqR.exe
  C:\Windows\System\wyCpjqR.exe
  2⤵
  PID:10956
- C:\Windows\System\KWrKViC.exe
  C:\Windows\System\KWrKViC.exe
  2⤵
  PID:10984
- C:\Windows\System\LagLzSE.exe
  C:\Windows\System\LagLzSE.exe
  2⤵
  PID:11020
- C:\Windows\System\qWcGpqq.exe
  C:\Windows\System\qWcGpqq.exe
  2⤵
  PID:11036
- C:\Windows\System\exDJQKs.exe
  C:\Windows\System\exDJQKs.exe
  2⤵
  PID:11116
- C:\Windows\System\zDGIuvw.exe
  C:\Windows\System\zDGIuvw.exe
  2⤵
  PID:11148
- C:\Windows\System\avdkpdt.exe
  C:\Windows\System\avdkpdt.exe
  2⤵
  PID:11168
- C:\Windows\System\QxzgApj.exe
  C:\Windows\System\QxzgApj.exe
  2⤵
  PID:11204
- C:\Windows\System\fjLOwQe.exe
  C:\Windows\System\fjLOwQe.exe
  2⤵
  PID:11232
- C:\Windows\System\sLJlEqk.exe
  C:\Windows\System\sLJlEqk.exe
  2⤵
  PID:11248
- C:\Windows\System\nCDfnLK.exe
  C:\Windows\System\nCDfnLK.exe
  2⤵
  PID:10248
- C:\Windows\System\XNmRcOL.exe
  C:\Windows\System\XNmRcOL.exe
  2⤵
  PID:10280
- C:\Windows\System\yOlVxhJ.exe
  C:\Windows\System\yOlVxhJ.exe
  2⤵
  PID:10360
- C:\Windows\System\bYfxisq.exe
  C:\Windows\System\bYfxisq.exe
  2⤵
  PID:10380
- C:\Windows\System\WWdRCrD.exe
  C:\Windows\System\WWdRCrD.exe
  2⤵
  PID:10516
- C:\Windows\System\IsaXOvk.exe
  C:\Windows\System\IsaXOvk.exe
  2⤵
  PID:10584
- C:\Windows\System\TjtYPwN.exe
  C:\Windows\System\TjtYPwN.exe
  2⤵
  PID:10640
- C:\Windows\System\HFtTTpS.exe
  C:\Windows\System\HFtTTpS.exe
  2⤵
  PID:10692
- C:\Windows\System\yUkWAKi.exe
  C:\Windows\System\yUkWAKi.exe
  2⤵
  PID:10736
- C:\Windows\System\bkzKznh.exe
  C:\Windows\System\bkzKznh.exe
  2⤵
  PID:10868
- C:\Windows\System\TyRBWIS.exe
  C:\Windows\System\TyRBWIS.exe
  2⤵
  PID:10864
- C:\Windows\System\GvBPrrb.exe
  C:\Windows\System\GvBPrrb.exe
  2⤵
  PID:10948
- C:\Windows\System\zGoGqPB.exe
  C:\Windows\System\zGoGqPB.exe
  2⤵
  PID:11004
- C:\Windows\System\gLkiCmj.exe
  C:\Windows\System\gLkiCmj.exe
  2⤵
  PID:11156
- C:\Windows\System\MyTKiyc.exe
  C:\Windows\System\MyTKiyc.exe
  2⤵
  PID:11128
- C:\Windows\System\zfHWeZg.exe
  C:\Windows\System\zfHWeZg.exe
  2⤵
  PID:11220
- C:\Windows\System\ELtarRN.exe
  C:\Windows\System\ELtarRN.exe
  2⤵
  PID:10412
- C:\Windows\System\WnPhYpT.exe
  C:\Windows\System\WnPhYpT.exe
  2⤵
  PID:10404
- C:\Windows\System\FDDXRot.exe
  C:\Windows\System\FDDXRot.exe
  2⤵
  PID:10572
- C:\Windows\System\AhMzbue.exe
  C:\Windows\System\AhMzbue.exe
  2⤵
  PID:10700
- C:\Windows\System\zrRoant.exe
  C:\Windows\System\zrRoant.exe
  2⤵
  PID:10884
- C:\Windows\System\XrAbJPg.exe
  C:\Windows\System\XrAbJPg.exe
  2⤵
  PID:11132
- C:\Windows\System\lQCaZQt.exe
  C:\Windows\System\lQCaZQt.exe
  2⤵
  PID:11188
- C:\Windows\System\YuSlWVr.exe
  C:\Windows\System\YuSlWVr.exe
  2⤵
  PID:10564
- C:\Windows\System\FHXEKmM.exe
  C:\Windows\System\FHXEKmM.exe
  2⤵
  PID:10188
- C:\Windows\System\TtqVvRk.exe
  C:\Windows\System\TtqVvRk.exe
  2⤵
  PID:10320
- C:\Windows\System\YpPASNG.exe
  C:\Windows\System\YpPASNG.exe
  2⤵
  PID:10656
- C:\Windows\System\vuZiiSR.exe
  C:\Windows\System\vuZiiSR.exe
  2⤵
  PID:11052
- C:\Windows\System\UNbdWLR.exe
  C:\Windows\System\UNbdWLR.exe
  2⤵
  PID:11268
- C:\Windows\System\DPzlhjH.exe
  C:\Windows\System\DPzlhjH.exe
  2⤵
  PID:11304
- C:\Windows\System\fnKbNfw.exe
  C:\Windows\System\fnKbNfw.exe
  2⤵
  PID:11356
- C:\Windows\System\BLwLXDG.exe
  C:\Windows\System\BLwLXDG.exe
  2⤵
  PID:11384
- C:\Windows\System\mVJJyyx.exe
  C:\Windows\System\mVJJyyx.exe
  2⤵
  PID:11404
- C:\Windows\System\ojvyfjI.exe
  C:\Windows\System\ojvyfjI.exe
  2⤵
  PID:11428
- C:\Windows\System\kElsuIs.exe
  C:\Windows\System\kElsuIs.exe
  2⤵
  PID:11456
- C:\Windows\System\rrDNcJW.exe
  C:\Windows\System\rrDNcJW.exe
  2⤵
  PID:11484
- C:\Windows\System\UceKwcM.exe
  C:\Windows\System\UceKwcM.exe
  2⤵
  PID:11512
- C:\Windows\System\aCrqPaN.exe
  C:\Windows\System\aCrqPaN.exe
  2⤵
  PID:11536
- C:\Windows\System\Ivvhzil.exe
  C:\Windows\System\Ivvhzil.exe
  2⤵
  PID:11568
- C:\Windows\System\mfmscpK.exe
  C:\Windows\System\mfmscpK.exe
  2⤵
  PID:11584
- C:\Windows\System\tppvGPc.exe
  C:\Windows\System\tppvGPc.exe
  2⤵
  PID:11624
- C:\Windows\System\TqyzfTR.exe
  C:\Windows\System\TqyzfTR.exe
  2⤵
  PID:11668
- C:\Windows\System\daHcsiI.exe
  C:\Windows\System\daHcsiI.exe
  2⤵
  PID:11684
- C:\Windows\System\jhgunuV.exe
  C:\Windows\System\jhgunuV.exe
  2⤵
  PID:11724
- C:\Windows\System\FuRDylF.exe
  C:\Windows\System\FuRDylF.exe
  2⤵
  PID:11744
- C:\Windows\System\PBxfbah.exe
  C:\Windows\System\PBxfbah.exe
  2⤵
  PID:11768
- C:\Windows\System\QCBaXnx.exe
  C:\Windows\System\QCBaXnx.exe
  2⤵
  PID:11808
- C:\Windows\System\CogpCId.exe
  C:\Windows\System\CogpCId.exe
  2⤵
  PID:11836
- C:\Windows\System\DQIyyze.exe
  C:\Windows\System\DQIyyze.exe
  2⤵
  PID:11852
- C:\Windows\System\daCuFRD.exe
  C:\Windows\System\daCuFRD.exe
  2⤵
  PID:11892
- C:\Windows\System\OGPbqGe.exe
  C:\Windows\System\OGPbqGe.exe
  2⤵
  PID:11920
- C:\Windows\System\rrWZPJa.exe
  C:\Windows\System\rrWZPJa.exe
  2⤵
  PID:11948
- C:\Windows\System\HbuRhLH.exe
  C:\Windows\System\HbuRhLH.exe
  2⤵
  PID:11976
- C:\Windows\System\XPMazTy.exe
  C:\Windows\System\XPMazTy.exe
  2⤵
  PID:12004
- C:\Windows\System\LzswFjh.exe
  C:\Windows\System\LzswFjh.exe
  2⤵
  PID:12020
- C:\Windows\System\wYuasPn.exe
  C:\Windows\System\wYuasPn.exe
  2⤵
  PID:12048
- C:\Windows\System\TbMknhk.exe
  C:\Windows\System\TbMknhk.exe
  2⤵
  PID:12076
- C:\Windows\System\ZhKTcGH.exe
  C:\Windows\System\ZhKTcGH.exe
  2⤵
  PID:12104
- C:\Windows\System\svApBuN.exe
  C:\Windows\System\svApBuN.exe
  2⤵
  PID:12132
- C:\Windows\System\FLxLaTU.exe
  C:\Windows\System\FLxLaTU.exe
  2⤵
  PID:12148
- C:\Windows\System\lVilATU.exe
  C:\Windows\System\lVilATU.exe
  2⤵
  PID:12176
- C:\Windows\System\MfLGAwu.exe
  C:\Windows\System\MfLGAwu.exe
  2⤵
  PID:12200
- C:\Windows\System\PUErOAX.exe
  C:\Windows\System\PUErOAX.exe
  2⤵
  PID:12244
- C:\Windows\System\pRJscSo.exe
  C:\Windows\System\pRJscSo.exe
  2⤵
  PID:12260
- C:\Windows\System\oiDubTv.exe
  C:\Windows\System\oiDubTv.exe
  2⤵
  PID:11288
- C:\Windows\System\VyvlduR.exe
  C:\Windows\System\VyvlduR.exe
  2⤵
  PID:11376
- C:\Windows\System\WePSniQ.exe
  C:\Windows\System\WePSniQ.exe
  2⤵
  PID:11412
- C:\Windows\System\GtBeTPG.exe
  C:\Windows\System\GtBeTPG.exe
  2⤵
  PID:11496
- C:\Windows\System\XBFmqfy.exe
  C:\Windows\System\XBFmqfy.exe
  2⤵
  PID:11500
- C:\Windows\System\LJdgIyy.exe
  C:\Windows\System\LJdgIyy.exe
  2⤵
  PID:11580
- C:\Windows\System\fVCPgnw.exe
  C:\Windows\System\fVCPgnw.exe
  2⤵
  PID:11652
- C:\Windows\System\BsxqUcr.exe
  C:\Windows\System\BsxqUcr.exe
  2⤵
  PID:11712
- C:\Windows\System\VuRyAuZ.exe
  C:\Windows\System\VuRyAuZ.exe
  2⤵
  PID:11780
- C:\Windows\System\tsaBEom.exe
  C:\Windows\System\tsaBEom.exe
  2⤵
  PID:11864
- C:\Windows\System\BaJRiUk.exe
  C:\Windows\System\BaJRiUk.exe
  2⤵
  PID:11912
- C:\Windows\System\nXJrNjX.exe
  C:\Windows\System\nXJrNjX.exe
  2⤵
  PID:11996
- C:\Windows\System\fSUlQYh.exe
  C:\Windows\System\fSUlQYh.exe
  2⤵
  PID:12036
- C:\Windows\System\ezZqbeh.exe
  C:\Windows\System\ezZqbeh.exe
  2⤵
  PID:12092
- C:\Windows\System\LuACVVG.exe
  C:\Windows\System\LuACVVG.exe
  2⤵
  PID:12168
- C:\Windows\System\ZwiKBlw.exe
  C:\Windows\System\ZwiKBlw.exe
  2⤵
  PID:10336
- C:\Windows\System\SYBrnhh.exe
  C:\Windows\System\SYBrnhh.exe
  2⤵
  PID:11348
- C:\Windows\System\xshrrJN.exe
  C:\Windows\System\xshrrJN.exe
  2⤵
  PID:11532
- C:\Windows\System\GqQZrBm.exe
  C:\Windows\System\GqQZrBm.exe
  2⤵
  PID:11708
- C:\Windows\System\DGjCeuf.exe
  C:\Windows\System\DGjCeuf.exe
  2⤵
  PID:11848
- C:\Windows\System\FScnJgt.exe
  C:\Windows\System\FScnJgt.exe
  2⤵
  PID:11960
- C:\Windows\System\jDuurCl.exe
  C:\Windows\System\jDuurCl.exe
  2⤵
  PID:12064
- C:\Windows\System\gSElTvH.exe
  C:\Windows\System\gSElTvH.exe
  2⤵
  PID:12188
- C:\Windows\System\zimeWqW.exe
  C:\Windows\System\zimeWqW.exe
  2⤵
  PID:11452
- C:\Windows\System\gFWUVOI.exe
  C:\Windows\System\gFWUVOI.exe
  2⤵
  PID:11760
- C:\Windows\System\jgxspNL.exe
  C:\Windows\System\jgxspNL.exe
  2⤵
  PID:12116
- C:\Windows\System\cuzKayo.exe
  C:\Windows\System\cuzKayo.exe
  2⤵
  PID:11620
- C:\Windows\System\RzZNzUC.exe
  C:\Windows\System\RzZNzUC.exe
  2⤵
  PID:12304
- C:\Windows\System\HVAVGrt.exe
  C:\Windows\System\HVAVGrt.exe
  2⤵
  PID:12324
- C:\Windows\System\dCehcPu.exe
  C:\Windows\System\dCehcPu.exe
  2⤵
  PID:12348
- C:\Windows\System\FTFFavz.exe
  C:\Windows\System\FTFFavz.exe
  2⤵
  PID:12376
- C:\Windows\System\cugxDEV.exe
  C:\Windows\System\cugxDEV.exe
  2⤵
  PID:12404
- C:\Windows\System\wUKRwRo.exe
  C:\Windows\System\wUKRwRo.exe
  2⤵
  PID:12444
- C:\Windows\System\dCBDmSf.exe
  C:\Windows\System\dCBDmSf.exe
  2⤵
  PID:12472
- C:\Windows\System\YeEtCDN.exe
  C:\Windows\System\YeEtCDN.exe
  2⤵
  PID:12500
- C:\Windows\System\HuDoIAt.exe
  C:\Windows\System\HuDoIAt.exe
  2⤵
  PID:12524
- C:\Windows\System\TCklcBG.exe
  C:\Windows\System\TCklcBG.exe
  2⤵
  PID:12544
- C:\Windows\System\ykLVTYu.exe
  C:\Windows\System\ykLVTYu.exe
  2⤵
  PID:12564
- C:\Windows\System\QedUZkV.exe
  C:\Windows\System\QedUZkV.exe
  2⤵
  PID:12600
- C:\Windows\System\ttINuHc.exe
  C:\Windows\System\ttINuHc.exe
  2⤵
  PID:12624
- C:\Windows\System\aEZaelk.exe
  C:\Windows\System\aEZaelk.exe
  2⤵
  PID:12656
- C:\Windows\System\mRUYrwh.exe
  C:\Windows\System\mRUYrwh.exe
  2⤵
  PID:12688
- C:\Windows\System\SCGPHzD.exe
  C:\Windows\System\SCGPHzD.exe
  2⤵
  PID:12716
- C:\Windows\System\XmEXtIm.exe
  C:\Windows\System\XmEXtIm.exe
  2⤵
  PID:12752
- C:\Windows\System\sPdmlXG.exe
  C:\Windows\System\sPdmlXG.exe
  2⤵
  PID:12772
- C:\Windows\System\nxRmLXH.exe
  C:\Windows\System\nxRmLXH.exe
  2⤵
  PID:12808
- C:\Windows\System\gNAIUfD.exe
  C:\Windows\System\gNAIUfD.exe
  2⤵
  PID:12828
- C:\Windows\System\xpPolZm.exe
  C:\Windows\System\xpPolZm.exe
  2⤵
  PID:12856
- C:\Windows\System\mCkEzvA.exe
  C:\Windows\System\mCkEzvA.exe
  2⤵
  PID:12872
- C:\Windows\System\YFBQcga.exe
  C:\Windows\System\YFBQcga.exe
  2⤵
  PID:12924
- C:\Windows\System\gAqStSR.exe
  C:\Windows\System\gAqStSR.exe
  2⤵
  PID:12952
- C:\Windows\System\HEgeRNd.exe
  C:\Windows\System\HEgeRNd.exe
  2⤵
  PID:12980
- C:\Windows\System\xmyuuRi.exe
  C:\Windows\System\xmyuuRi.exe
  2⤵
  PID:13008
- C:\Windows\System\gKjWaKR.exe
  C:\Windows\System\gKjWaKR.exe
  2⤵
  PID:13032
- C:\Windows\System\leWbklk.exe
  C:\Windows\System\leWbklk.exe
  2⤵
  PID:13056
- C:\Windows\System\sOTYiew.exe
  C:\Windows\System\sOTYiew.exe
  2⤵
  PID:13084
- C:\Windows\System\RZyQGyF.exe
  C:\Windows\System\RZyQGyF.exe
  2⤵
  PID:13140
- C:\Windows\System\KvHsRWJ.exe
  C:\Windows\System\KvHsRWJ.exe
  2⤵
  PID:13156
- C:\Windows\System\zkTnJEi.exe
  C:\Windows\System\zkTnJEi.exe
  2⤵
  PID:13184
- C:\Windows\System\WKsfwPH.exe
  C:\Windows\System\WKsfwPH.exe
  2⤵
  PID:13212
- C:\Windows\System\ezitkyw.exe
  C:\Windows\System\ezitkyw.exe
  2⤵
  PID:13228
- C:\Windows\System\JGmBGJZ.exe
  C:\Windows\System\JGmBGJZ.exe
  2⤵
  PID:13280
- C:\Windows\System\PkEnthN.exe
  C:\Windows\System\PkEnthN.exe
  2⤵
  PID:13308
- C:\Windows\System\XUkecBD.exe
  C:\Windows\System\XUkecBD.exe
  2⤵
  PID:12320
- C:\Windows\System\SPpCxJY.exe
  C:\Windows\System\SPpCxJY.exe
  2⤵
  PID:12360
- C:\Windows\System\lTFysbS.exe
  C:\Windows\System\lTFysbS.exe
  2⤵
  PID:12456
- C:\Windows\System\OKnFkdL.exe
  C:\Windows\System\OKnFkdL.exe
  2⤵
  PID:12516
- C:\Windows\System\koSSNWg.exe
  C:\Windows\System\koSSNWg.exe
  2⤵
  PID:12588
- C:\Windows\System\LayrIEM.exe
  C:\Windows\System\LayrIEM.exe
  2⤵
  PID:12616
- C:\Windows\System\HNyoWgZ.exe
  C:\Windows\System\HNyoWgZ.exe
  2⤵
  PID:12648
- C:\Windows\System\CecRSPw.exe
  C:\Windows\System\CecRSPw.exe
  2⤵
  PID:12748
- C:\Windows\System\AJEAHuH.exe
  C:\Windows\System\AJEAHuH.exe
  2⤵
  PID:12864
- C:\Windows\System\tZokchZ.exe
  C:\Windows\System\tZokchZ.exe
  2⤵
  PID:12896
- C:\Windows\System\uGyQnxp.exe
  C:\Windows\System\uGyQnxp.exe
  2⤵
  PID:12940
- C:\Windows\System\QPmPxyD.exe
  C:\Windows\System\QPmPxyD.exe
  2⤵
  PID:12964
- C:\Windows\System\flKYsvN.exe
  C:\Windows\System\flKYsvN.exe
  2⤵
  PID:13044
- C:\Windows\System\NpQkvUr.exe
  C:\Windows\System\NpQkvUr.exe
  2⤵
  PID:13096
- C:\Windows\System\FvEriFL.exe
  C:\Windows\System\FvEriFL.exe
  2⤵
  PID:13132
- C:\Windows\System\ModDQJz.exe
  C:\Windows\System\ModDQJz.exe
  2⤵
  PID:13220
- C:\Windows\System\feXfgPx.exe
  C:\Windows\System\feXfgPx.exe
  2⤵
  PID:13276
- C:\Windows\System\OZylhQw.exe
  C:\Windows\System\OZylhQw.exe
  2⤵
  PID:12520
- C:\Windows\System\BEkMHqh.exe
  C:\Windows\System\BEkMHqh.exe
  2⤵
  PID:12672
- C:\Windows\System\sbkBgZk.exe
  C:\Windows\System\sbkBgZk.exe
  2⤵
  PID:12728
- C:\Windows\System\NWjQjCx.exe
  C:\Windows\System\NWjQjCx.exe
  2⤵
  PID:12936
- C:\Windows\System\JwuKFeb.exe
  C:\Windows\System\JwuKFeb.exe
  2⤵
  PID:13072
- C:\Windows\System\cUiDsNC.exe
  C:\Windows\System\cUiDsNC.exe
  2⤵
  PID:13136
- C:\Windows\System\WPPQLPL.exe
  C:\Windows\System\WPPQLPL.exe
  2⤵
  PID:13296
- C:\Windows\System\YOFdiNB.exe
  C:\Windows\System\YOFdiNB.exe
  2⤵
  PID:12744
- C:\Windows\System\IvsGcZl.exe
  C:\Windows\System\IvsGcZl.exe
  2⤵
  PID:12968
- C:\Windows\System\BJNrIJF.exe
  C:\Windows\System\BJNrIJF.exe
  2⤵
  PID:11656
- C:\Windows\System\BdJHCKB.exe
  C:\Windows\System\BdJHCKB.exe
  2⤵
  PID:13252
- C:\Windows\System\tXkQdGm.exe
  C:\Windows\System\tXkQdGm.exe
  2⤵
  PID:13332
- C:\Windows\System\IrJlWsC.exe
  C:\Windows\System\IrJlWsC.exe
  2⤵
  PID:13372
- C:\Windows\System\cFffmyJ.exe
  C:\Windows\System\cFffmyJ.exe
  2⤵
  PID:13400
- C:\Windows\System\ODTsIoN.exe
  C:\Windows\System\ODTsIoN.exe
  2⤵
  PID:13416
- C:\Windows\System\dxSBGEB.exe
  C:\Windows\System\dxSBGEB.exe
  2⤵
  PID:13448
- C:\Windows\System\yvZKkbE.exe
  C:\Windows\System\yvZKkbE.exe
  2⤵
  PID:13472
- C:\Windows\System\hMnTlyo.exe
  C:\Windows\System\hMnTlyo.exe
  2⤵
  PID:13512
- C:\Windows\System\BRhlVKT.exe
  C:\Windows\System\BRhlVKT.exe
  2⤵
  PID:13528
- C:\Windows\System\PpjCYzS.exe
  C:\Windows\System\PpjCYzS.exe
  2⤵
  PID:13568
- C:\Windows\System\pjrUEGb.exe
  C:\Windows\System\pjrUEGb.exe
  2⤵
  PID:13596
- C:\Windows\System\vUBxVpv.exe
  C:\Windows\System\vUBxVpv.exe
  2⤵
  PID:13612
- C:\Windows\System\bNGOMqi.exe
  C:\Windows\System\bNGOMqi.exe
  2⤵
  PID:13628
- C:\Windows\System\osrTftD.exe
  C:\Windows\System\osrTftD.exe
  2⤵
  PID:13652
- C:\Windows\System\dHXzOJU.exe
  C:\Windows\System\dHXzOJU.exe
  2⤵
  PID:13676
- C:\Windows\System\ZPlREug.exe
  C:\Windows\System\ZPlREug.exe
  2⤵
  PID:13708
- C:\Windows\System\zouIuWl.exe
  C:\Windows\System\zouIuWl.exe
  2⤵
  PID:13736
- C:\Windows\System\OFlDVzZ.exe
  C:\Windows\System\OFlDVzZ.exe
  2⤵
  PID:13768
- C:\Windows\System\WrlZcLl.exe
  C:\Windows\System\WrlZcLl.exe
  2⤵
  PID:13800
- C:\Windows\System\FmimSMR.exe
  C:\Windows\System\FmimSMR.exe
  2⤵
  PID:13816
- C:\Windows\System\XrPuijX.exe
  C:\Windows\System\XrPuijX.exe
  2⤵
  PID:13852
- C:\Windows\System\WkTAXBq.exe
  C:\Windows\System\WkTAXBq.exe
  2⤵
  PID:13880
- C:\Windows\System\OGLaXdl.exe
  C:\Windows\System\OGLaXdl.exe
  2⤵
  PID:13924
- C:\Windows\System\fSrVNQm.exe
  C:\Windows\System\fSrVNQm.exe
  2⤵
  PID:13964
- C:\Windows\System\aauWbNR.exe
  C:\Windows\System\aauWbNR.exe
  2⤵
  PID:13988
- C:\Windows\System\nnNiYtn.exe
  C:\Windows\System\nnNiYtn.exe
  2⤵
  PID:14016
- C:\Windows\System\bPDeNYr.exe
  C:\Windows\System\bPDeNYr.exe
  2⤵
  PID:14036
- C:\Windows\System\eFIQRvU.exe
  C:\Windows\System\eFIQRvU.exe
  2⤵
  PID:14076
- C:\Windows\System\rwlOkDK.exe
  C:\Windows\System\rwlOkDK.exe
  2⤵
  PID:14104
- C:\Windows\System\pInjbsF.exe
  C:\Windows\System\pInjbsF.exe
  2⤵
  PID:14120
- C:\Windows\System\nAHoAeR.exe
  C:\Windows\System\nAHoAeR.exe
  2⤵
  PID:14144
- C:\Windows\System\qsJtyDG.exe
  C:\Windows\System\qsJtyDG.exe
  2⤵
  PID:14164
- C:\Windows\System\PzUaMmP.exe
  C:\Windows\System\PzUaMmP.exe
  2⤵
  PID:14200
- C:\Windows\System\GjwuvIU.exe
  C:\Windows\System\GjwuvIU.exe
  2⤵
  PID:14220
- C:\Windows\System\DjfFNlv.exe
  C:\Windows\System\DjfFNlv.exe
  2⤵
  PID:14260
- C:\Windows\System\jKmFsBw.exe
  C:\Windows\System\jKmFsBw.exe
  2⤵
  PID:14276
- C:\Windows\System\KXNXeuu.exe
  C:\Windows\System\KXNXeuu.exe
  2⤵
  PID:14304
- C:\Windows\System\mEZBTqH.exe
  C:\Windows\System\mEZBTqH.exe
  2⤵
  PID:12884
- C:\Windows\System\BAFhjie.exe
  C:\Windows\System\BAFhjie.exe
  2⤵
  PID:13344
- C:\Windows\System\UGTpYFQ.exe
  C:\Windows\System\UGTpYFQ.exe
  2⤵
  PID:13388
- C:\Windows\System\wnttYaP.exe
  C:\Windows\System\wnttYaP.exe
  2⤵
  PID:13456
- C:\Windows\System\dCoyVho.exe
  C:\Windows\System\dCoyVho.exe
  2⤵
  PID:13548
- C:\Windows\System\bCTTXic.exe
  C:\Windows\System\bCTTXic.exe
  2⤵
  PID:13608
- C:\Windows\System\lPhRKog.exe
  C:\Windows\System\lPhRKog.exe
  2⤵
  PID:13660
- C:\Windows\System\hWhiyQD.exe
  C:\Windows\System\hWhiyQD.exe
  2⤵
  PID:13700
- C:\Windows\System\JOdPOPo.exe
  C:\Windows\System\JOdPOPo.exe
  2⤵
  PID:13844
- C:\Windows\System\qNtjjKs.exe
  C:\Windows\System\qNtjjKs.exe
  2⤵
  PID:13900
- C:\Windows\System\OIpLbzS.exe
  C:\Windows\System\OIpLbzS.exe
  2⤵
  PID:13916
- C:\Windows\System\stWumzt.exe
  C:\Windows\System\stWumzt.exe
  2⤵
  PID:13980
- C:\Windows\System\NSaLUYG.exe
  C:\Windows\System\NSaLUYG.exe
  2⤵
  PID:14112
- C:\Windows\System\XiQrESj.exe
  C:\Windows\System\XiQrESj.exe
  2⤵
  PID:14160
- C:\Windows\System\qchatHZ.exe
  C:\Windows\System\qchatHZ.exe
  2⤵
  PID:14248
- C:\Windows\System\AGOrlJH.exe
  C:\Windows\System\AGOrlJH.exe
  2⤵
  PID:14216
- C:\Windows\System\TpmPBse.exe
  C:\Windows\System\TpmPBse.exe
  2⤵
  PID:14300
- C:\Windows\System\qeapbmn.exe
  C:\Windows\System\qeapbmn.exe
  2⤵
  PID:13368
- C:\Windows\System\LjzdgsX.exe
  C:\Windows\System\LjzdgsX.exe
  2⤵
  PID:13648
- C:\Windows\System\jwqKMzJ.exe
  C:\Windows\System\jwqKMzJ.exe
  2⤵
  PID:13780
- C:\Windows\System\GpLCArm.exe
  C:\Windows\System\GpLCArm.exe
  2⤵
  PID:13936
- C:\Windows\System\MNBMGFX.exe
  C:\Windows\System\MNBMGFX.exe
  2⤵
  PID:14064
- C:\Windows\System\bGFtExv.exe
  C:\Windows\System\bGFtExv.exe
  2⤵
  PID:14192
- C:\Windows\System\rKVrfQl.exe
  C:\Windows\System\rKVrfQl.exe
  2⤵
  PID:13316
- C:\Windows\System\xkZxEWM.exe
  C:\Windows\System\xkZxEWM.exe
  2⤵
  PID:13584
- C:\Windows\System\umbyeuO.exe
  C:\Windows\System\umbyeuO.exe
  2⤵
  PID:13864
- C:\Windows\System\jhwmITB.exe
  C:\Windows\System\jhwmITB.exe
  2⤵
  PID:13552
- C:\Windows\System\UzZERUG.exe
  C:\Windows\System\UzZERUG.exe
  2⤵
  PID:14008
- C:\Windows\System\dCgvxlw.exe
  C:\Windows\System\dCgvxlw.exe
  2⤵
  PID:14356
- C:\Windows\System\EkWBUyO.exe
  C:\Windows\System\EkWBUyO.exe
  2⤵
  PID:14380
- C:\Windows\System\NBqXITE.exe
  C:\Windows\System\NBqXITE.exe
  2⤵
  PID:14408
- C:\Windows\System\WZOhbSk.exe
  C:\Windows\System\WZOhbSk.exe
  2⤵
  PID:14432
- C:\Windows\System\HheTJrx.exe
  C:\Windows\System\HheTJrx.exe
  2⤵
  PID:14464
- C:\Windows\System\yDulLvT.exe
  C:\Windows\System\yDulLvT.exe
  2⤵
  PID:14492
- C:\Windows\System\YdByCGc.exe
  C:\Windows\System\YdByCGc.exe
  2⤵
  PID:14516
- C:\Windows\System\ksgZTSg.exe
  C:\Windows\System\ksgZTSg.exe
  2⤵
  PID:14576
- C:\Windows\System\qausOYO.exe
  C:\Windows\System\qausOYO.exe
  2⤵
  PID:14616
- C:\Windows\System\aeCSqIC.exe
  C:\Windows\System\aeCSqIC.exe
  2⤵
  PID:14644
- C:\Windows\System\lghjnlM.exe
  C:\Windows\System\lghjnlM.exe
  2⤵
  PID:14668
- C:\Windows\System\JeEjURC.exe
  C:\Windows\System\JeEjURC.exe
  2⤵
  PID:14712
- C:\Windows\System\hDVngpC.exe
  C:\Windows\System\hDVngpC.exe
  2⤵
  PID:14728
- C:\Windows\System\gHLJYgD.exe
  C:\Windows\System\gHLJYgD.exe
  2⤵
  PID:14756
- C:\Windows\System\aAbhbVw.exe
  C:\Windows\System\aAbhbVw.exe
  2⤵
  PID:14784
- C:\Windows\System\OKxyXQv.exe
  C:\Windows\System\OKxyXQv.exe
  2⤵
  PID:14808
- C:\Windows\System\YQBOejj.exe
  C:\Windows\System\YQBOejj.exe
  2⤵
  PID:14840
- C:\Windows\System\raZTluq.exe
  C:\Windows\System\raZTluq.exe
  2⤵
  PID:14864
- C:\Windows\System\Unywkno.exe
  C:\Windows\System\Unywkno.exe
  2⤵
  PID:14896
- C:\Windows\System\JgCklkO.exe
  C:\Windows\System\JgCklkO.exe
  2⤵
  PID:14916
- C:\Windows\System\xLpKQrr.exe
  C:\Windows\System\xLpKQrr.exe
  2⤵
  PID:14936
- C:\Windows\System\mWovief.exe
  C:\Windows\System\mWovief.exe
  2⤵
  PID:14956
- C:\Windows\System\JPutrUh.exe
  C:\Windows\System\JPutrUh.exe
  2⤵
  PID:15000
- C:\Windows\System\OKxBJjF.exe
  C:\Windows\System\OKxBJjF.exe
  2⤵
  PID:15024
- C:\Windows\System\xNTKoWT.exe
  C:\Windows\System\xNTKoWT.exe
  2⤵
  PID:15056
- C:\Windows\System\oLwzVzb.exe
  C:\Windows\System\oLwzVzb.exe
  2⤵
  PID:15104
- C:\Windows\System\ldEPPPj.exe
  C:\Windows\System\ldEPPPj.exe
  2⤵
  PID:15124
- C:\Windows\System\rtItFWZ.exe
  C:\Windows\System\rtItFWZ.exe
  2⤵
  PID:15160
- C:\Windows\System\LkchvJm.exe
  C:\Windows\System\LkchvJm.exe
  2⤵
  PID:15176
- C:\Windows\System\zfeLFhO.exe
  C:\Windows\System\zfeLFhO.exe
  2⤵
  PID:15200
- C:\Windows\System\pTntVRZ.exe
  C:\Windows\System\pTntVRZ.exe
  2⤵
  PID:15224
- C:\Windows\System\EGnLTRd.exe
  C:\Windows\System\EGnLTRd.exe
  2⤵
  PID:15264
- C:\Windows\System\VDkYPqH.exe
  C:\Windows\System\VDkYPqH.exe
  2⤵
  PID:15292
- C:\Windows\System\fdcwfBc.exe
  C:\Windows\System\fdcwfBc.exe
  2⤵
  PID:15320
- C:\Windows\System\GyUvRMo.exe
  C:\Windows\System\GyUvRMo.exe
  2⤵
  PID:15340
- C:\Windows\System\bIunbcl.exe
  C:\Windows\System\bIunbcl.exe
  2⤵
  PID:14140
- C:\Windows\System\nAklFGn.exe
  C:\Windows\System\nAklFGn.exe
  2⤵
  PID:14428
- C:\Windows\System\xSENYun.exe
  C:\Windows\System\xSENYun.exe
  2⤵
  PID:14532
- C:\Windows\System\bIZxFnI.exe
  C:\Windows\System\bIZxFnI.exe
  2⤵
  PID:14508
- C:\Windows\System\PcZeEGb.exe
  C:\Windows\System\PcZeEGb.exe
  2⤵
  PID:14504
- C:\Windows\System\JauCFKn.exe
  C:\Windows\System\JauCFKn.exe
  2⤵
  PID:14636
- C:\Windows\System\OwTvncu.exe
  C:\Windows\System\OwTvncu.exe
  2⤵
  PID:14748
- C:\Windows\System\LttHybL.exe
  C:\Windows\System\LttHybL.exe
  2⤵
  PID:14768
- C:\Windows\System\CUbsqRo.exe
  C:\Windows\System\CUbsqRo.exe
  2⤵
  PID:14820
- C:\Windows\System\eXMfcrt.exe
  C:\Windows\System\eXMfcrt.exe
  2⤵
  PID:14888
- C:\Windows\System\QdccpPs.exe
  C:\Windows\System\QdccpPs.exe
  2⤵
  PID:14928
- C:\Windows\System\pXhRcaq.exe
  C:\Windows\System\pXhRcaq.exe
  2⤵
  PID:15048
- C:\Windows\System\WTUMEGk.exe
  C:\Windows\System\WTUMEGk.exe
  2⤵
  PID:15096
- C:\Windows\System\fifXdiI.exe
  C:\Windows\System\fifXdiI.exe
  2⤵
  PID:15152
- C:\Windows\System\kvAJZMO.exe
  C:\Windows\System\kvAJZMO.exe
  2⤵
  PID:15192
- C:\Windows\System\vOcHTbo.exe
  C:\Windows\System\vOcHTbo.exe
  2⤵
  PID:15284
- C:\Windows\System\YeLWjSs.exe
  C:\Windows\System\YeLWjSs.exe
  2⤵
  PID:15304
- C:\Windows\System\kEIQWLX.exe
  C:\Windows\System\kEIQWLX.exe
  2⤵
  PID:15356
- C:\Windows\System\PQIKIuL.exe
  C:\Windows\System\PQIKIuL.exe
  2⤵
  PID:14376
- C:\Windows\System\UdepWHn.exe
  C:\Windows\System\UdepWHn.exe
  2⤵
  PID:14628
- C:\Windows\System\bhtlnkv.exe
  C:\Windows\System\bhtlnkv.exe
  2⤵
  PID:14796
- C:\Windows\System\mWPoLMh.exe
  C:\Windows\System\mWPoLMh.exe
  2⤵
  PID:15208
- C:\Windows\System\qIIqhJm.exe
  C:\Windows\System\qIIqhJm.exe
  2⤵
  PID:15308
- C:\Windows\System\TAlhUhk.exe
  C:\Windows\System\TAlhUhk.exe
  2⤵
  PID:14444
- C:\Windows\System\HkEVNJx.exe
  C:\Windows\System\HkEVNJx.exe
  2⤵
  PID:14720
- C:\Windows\System\cdUTKib.exe
  C:\Windows\System\cdUTKib.exe
  2⤵
  PID:14924
- C:\Windows\System\ESJvGqf.exe
  C:\Windows\System\ESJvGqf.exe
  2⤵
  PID:15276
- C:\Windows\System\grsEBdH.exe
  C:\Windows\System\grsEBdH.exe
  2⤵
  PID:15212
- C:\Windows\System\wfXgeBE.exe
  C:\Windows\System\wfXgeBE.exe
  2⤵
  PID:15372
- C:\Windows\System\XvzltJY.exe
  C:\Windows\System\XvzltJY.exe
  2⤵
  PID:15404
- C:\Windows\System\wAvAbUM.exe
  C:\Windows\System\wAvAbUM.exe
  2⤵
  PID:15420
- C:\Windows\System\uOgsgbH.exe
  C:\Windows\System\uOgsgbH.exe
  2⤵
  PID:15464
- C:\Windows\System\ZllPLIe.exe
  C:\Windows\System\ZllPLIe.exe
  2⤵
  PID:15488
- C:\Windows\System\axsXisl.exe
  C:\Windows\System\axsXisl.exe
  2⤵
  PID:15516
- C:\Windows\System\PzVyeGH.exe
  C:\Windows\System\PzVyeGH.exe
  2⤵
  PID:15536
- C:\Windows\System\ekXeDyB.exe
  C:\Windows\System\ekXeDyB.exe
  2⤵
  PID:15556
- C:\Windows\System\XHJYEqC.exe
  C:\Windows\System\XHJYEqC.exe
  2⤵
  PID:15584
- C:\Windows\System\YuihdcP.exe
  C:\Windows\System\YuihdcP.exe
  2⤵
  PID:15620
- C:\Windows\System\CosAIWv.exe
  C:\Windows\System\CosAIWv.exe
  2⤵
  PID:15652
- C:\Windows\System\EMTKlnN.exe
  C:\Windows\System\EMTKlnN.exe
  2⤵
  PID:15672
- C:\Windows\System\dFOYVYo.exe
  C:\Windows\System\dFOYVYo.exe
  2⤵
  PID:15700
- C:\Windows\System\nHZArsK.exe
  C:\Windows\System\nHZArsK.exe
  2⤵
  PID:15732
- C:\Windows\System\ZQVMqKH.exe
  C:\Windows\System\ZQVMqKH.exe
  2⤵
  PID:15772
- C:\Windows\System\HjRVusb.exe
  C:\Windows\System\HjRVusb.exe
  2⤵
  PID:15796
- C:\Windows\System\yYyaoVi.exe
  C:\Windows\System\yYyaoVi.exe
  2⤵
  PID:15816
- C:\Windows\System\eduljrK.exe
  C:\Windows\System\eduljrK.exe
  2⤵
  PID:15832
- C:\Windows\System\QQtNTPq.exe
  C:\Windows\System\QQtNTPq.exe
  2⤵
  PID:15868
- C:\Windows\System\DtsfFxu.exe
  C:\Windows\System\DtsfFxu.exe
  2⤵
  PID:15904
- C:\Windows\System\yHxdWJa.exe
  C:\Windows\System\yHxdWJa.exe
  2⤵
  PID:15936
- C:\Windows\System\cWmKUUA.exe
  C:\Windows\System\cWmKUUA.exe
  2⤵
  PID:15964
- C:\Windows\System\cqyVcak.exe
  C:\Windows\System\cqyVcak.exe
  2⤵
  PID:15984
- C:\Windows\System\RdelqNS.exe
  C:\Windows\System\RdelqNS.exe
  2⤵
  PID:16008
- C:\Windows\System\nKaFuLs.exe
  C:\Windows\System\nKaFuLs.exe
  2⤵
  PID:16044
- C:\Windows\System\PpFNdIJ.exe
  C:\Windows\System\PpFNdIJ.exe
  2⤵
  PID:16068
- C:\Windows\System\klpSWHA.exe
  C:\Windows\System\klpSWHA.exe
  2⤵
  PID:16108
- C:\Windows\System\VWdowWO.exe
  C:\Windows\System\VWdowWO.exe
  2⤵
  PID:16148
- C:\Windows\System\LYbnPOG.exe
  C:\Windows\System\LYbnPOG.exe
  2⤵
  PID:16164
- C:\Windows\System\WAQvOlz.exe
  C:\Windows\System\WAQvOlz.exe
  2⤵
  PID:16204
- C:\Windows\System\gXSTieX.exe
  C:\Windows\System\gXSTieX.exe
  2⤵
  PID:16232
- C:\Windows\System\cJRRtXW.exe
  C:\Windows\System\cJRRtXW.exe
  2⤵
  PID:16252
- C:\Windows\System\SqlxcgK.exe
  C:\Windows\System\SqlxcgK.exe
  2⤵
  PID:16276
- C:\Windows\System\LlzSQEc.exe
  C:\Windows\System\LlzSQEc.exe
  2⤵
  PID:16300
- C:\Windows\System\ueVPCeH.exe
  C:\Windows\System\ueVPCeH.exe
  2⤵
  PID:16344
- C:\Windows\System\efRzBJH.exe
  C:\Windows\System\efRzBJH.exe
  2⤵
  PID:16360
- C:\Windows\System\wIjyyWV.exe
  C:\Windows\System\wIjyyWV.exe
  2⤵
  PID:15368
- C:\Windows\System\sdlDGof.exe
  C:\Windows\System\sdlDGof.exe
  2⤵
  PID:15444
- C:\Windows\System\mxkyAcJ.exe
  C:\Windows\System\mxkyAcJ.exe
  2⤵
  PID:15484
- C:\Windows\System\xFTwjKz.exe
  C:\Windows\System\xFTwjKz.exe
  2⤵
  PID:15552
- C:\Windows\System\fGMOCRP.exe
  C:\Windows\System\fGMOCRP.exe
  2⤵
  PID:15632
- C:\Windows\System\huQxDzP.exe
  C:\Windows\System\huQxDzP.exe
  2⤵
  PID:15644
- C:\Windows\System\XKILVzV.exe
  C:\Windows\System\XKILVzV.exe
  2⤵
  PID:15744
- C:\Windows\System\rUZgcsS.exe
  C:\Windows\System\rUZgcsS.exe
  2⤵
  PID:15828
- C:\Windows\System\LhRtUnT.exe
  C:\Windows\System\LhRtUnT.exe
  2⤵
  PID:15856
- C:\Windows\System\wZttRFb.exe
  C:\Windows\System\wZttRFb.exe
  2⤵
  PID:15960
- C:\Windows\System\HKWKuRg.exe
  C:\Windows\System\HKWKuRg.exe
  2⤵
  PID:16052
- C:\Windows\System\AexPSxT.exe
  C:\Windows\System\AexPSxT.exe
  2⤵
  PID:16060
- C:\Windows\System\YqAKoEq.exe
  C:\Windows\System\YqAKoEq.exe
  2⤵
  PID:16104
- C:\Windows\System\swkmYER.exe
  C:\Windows\System\swkmYER.exe
  2⤵
  PID:16196
- C:\Windows\System\vdwbEry.exe
  C:\Windows\System\vdwbEry.exe
  2⤵
  PID:16240
- C:\Windows\System\twxNjfq.exe
  C:\Windows\System\twxNjfq.exe
  2⤵
  PID:16296
- C:\Windows\System\HwAFKkz.exe
  C:\Windows\System\HwAFKkz.exe
  2⤵
  PID:16332
- C:\Windows\System\ZUMiyRk.exe
  C:\Windows\System\ZUMiyRk.exe
  2⤵
  PID:15364
- C:\Windows\System\CzIlXBT.exe
  C:\Windows\System\CzIlXBT.exe
  2⤵
  PID:15640
- C:\Windows\System\JJBNaWZ.exe
  C:\Windows\System\JJBNaWZ.exe
  2⤵
  PID:15716
- C:\Windows\System\RDbadMt.exe
  C:\Windows\System\RDbadMt.exe
  2⤵
  PID:15900
- C:\Windows\System\NuLVPeS.exe
  C:\Windows\System\NuLVPeS.exe
  2⤵
  PID:16092
- C:\Windows\System\kuTgwVu.exe
  C:\Windows\System\kuTgwVu.exe
  2⤵
  PID:16160
- C:\Windows\System\wHYrGjV.exe
  C:\Windows\System\wHYrGjV.exe
  2⤵
  PID:15568
- C:\Windows\System\DZvbgcc.exe
  C:\Windows\System\DZvbgcc.exe
  2⤵
  PID:15612
- C:\Windows\System\TzoOvpu.exe
  C:\Windows\System\TzoOvpu.exe
  2⤵
  PID:16272
- C:\Windows\System\bWVaGgA.exe
  C:\Windows\System\bWVaGgA.exe
  2⤵
  PID:15996
- C:\Windows\System\QhwBXDz.exe
  C:\Windows\System\QhwBXDz.exe
  2⤵
  PID:16392
- C:\Windows\System\YLchfRF.exe
  C:\Windows\System\YLchfRF.exe
  2⤵
  PID:16408
- C:\Windows\System\JbnLDSy.exe
  C:\Windows\System\JbnLDSy.exe
  2⤵
  PID:16448
- C:\Windows\System\DnwDnbE.exe
  C:\Windows\System\DnwDnbE.exe
  2⤵
  PID:16468
- C:\Windows\System\tPXuwuH.exe
  C:\Windows\System\tPXuwuH.exe
  2⤵
  PID:16492
- C:\Windows\System\QwgQwze.exe
  C:\Windows\System\QwgQwze.exe
  2⤵
  PID:16532
- C:\Windows\System\aqkrvYx.exe
  C:\Windows\System\aqkrvYx.exe
  2⤵
  PID:16556
- C:\Windows\System\YgzkXEz.exe
  C:\Windows\System\YgzkXEz.exe
  2⤵
  PID:16576
- C:\Windows\System\PCxIqgx.exe
  C:\Windows\System\PCxIqgx.exe
  2⤵
  PID:16596
- C:\Windows\System\IcdcEYw.exe
  C:\Windows\System\IcdcEYw.exe
  2⤵
  PID:16616
- C:\Windows\System\NhnCdGP.exe
  C:\Windows\System\NhnCdGP.exe
  2⤵
  PID:16648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ALXWUFf.exe

Filesize
1.7MB

MD5
4863f837526b6bd39850d80475997a79

SHA1
5e113a85ecd0972f516b5cf2474440823cd8e61e

SHA256
5e06dac6396936d159a07f25cf5f1e0bf67725f28ccc35e4921d011597b10280

SHA512
67169430970eecfc880533278f849ba01d5c6d3ea22c2877857cae5699c573314440fb90ac505b6447a0540dade2ea2d9a644af016fc824c48893acdbe80a2db

Download Submit
C:\Windows\System\DMUhUdS.exe

Filesize
1.7MB

MD5
6c28cf2b20041de0ad3f10b01d945618

SHA1
96983e210fc0286d9dbe65c54200edadea2ae664

SHA256
5e20f9257698b6ba080d07912503dd25c90f51be4fb208d3e08d1d2e879703db

SHA512
d6ef05e6a1b365562e446ed02c75cdd19f59ade0905da0b51f091a262201641e73402d2d6870c9e35ba0e6e6823aac160241e128eba558ca4b040eabb3ca4ae8

Download Submit
C:\Windows\System\DsDgMPx.exe

Filesize
1.7MB

MD5
0fa4ecba7eff98674eb1afd6ac9a5fec

SHA1
b15dd0159115658c7ebea5fb30e1e85eb770939e

SHA256
4fac55027183740a2c6f0f81eb7306f6d870eeac6c38f89d4acc4361f28b7671

SHA512
ba86cc5910c13fa401255211f80cb7b38ec0f4488dd992d6407efca3b1378f3eaca9146e2fcbdd9f1354ba4abfb5510c25914d3f9011412fc8ec6770b54a01c6

Download Submit
C:\Windows\System\DxljTsw.exe

Filesize
1.7MB

MD5
50e167758842260cc438363090424317

SHA1
8ef204e0eaadaa07f72c3f7537cb412004bfcc7c

SHA256
69f2b3af5ef49210299ff87d42af965dc610b009ff4b3f56ef8b7e0ac31620ae

SHA512
0e6ba519f30a3393d6a6cb67abc9cb762858315f3203acb081a46b94acde6323f92c68dadf209dba76bec28beeaf55bd22977c04771e741912704213517b37f6

Download Submit
C:\Windows\System\ETFtyvW.exe

Filesize
1.7MB

MD5
4e5f34ba18dff34d3e9a9982b1f1b637

SHA1
b2727fb159be0657fa123961c47fe420e80879a2

SHA256
2e64f49c05b6a27db591ff75e630999b91f808deb8a08f5972a1d771f7b2f795

SHA512
4bb32bc1138b14412cd89d44835574a66f84b7a3b747c221fe0121b64f9e8a36c4755b133b92f99aabbab7563e7ef925423611213ed47af942263d2453e26ead

Download Submit
C:\Windows\System\GHEjtTl.exe

Filesize
1.7MB

MD5
039801aca71e2f7fc6158e0e4d718dad

SHA1
b3fca32f2bfc4b09fc27b894e1c20f19f7b8102d

SHA256
905d140d087c09fda378ed7f5381f812893ec3af3da28c8716c1cd948ca19a91

SHA512
909fe09fe790761a22d46d58a58dcf2396860eb7e0c96a2b68fb35f3d1e8eb6c150c46594946f02b26822522acde3425efdc5d1303d00229a7ac4e9000717c64

Download Submit
C:\Windows\System\KtnAnrp.exe

Filesize
1.7MB

MD5
9ec32fe8fd3228d1220a4003b47d40a7

SHA1
a094bdac603077295ed96f8dbecbc51ea00ca9de

SHA256
91bfa72305b5909a6b992a498e481c7e7dfd0b3de3d24f4d3dda65cf500c044b

SHA512
e3f72d0178e98cd416a371c181b28d0ef82b1eba66106a9c22cdf2a530cf27dbc98cd33fbf4de5f6412653506bdddb3f56595818f0f2610015c492012948fa11

Download Submit
C:\Windows\System\LaooXOq.exe

Filesize
1.7MB

MD5
76e64243c33ce90083e7bcc5f4524b1f

SHA1
a2248dcc1cb7d2af310096bdeda7d94e7960d26e

SHA256
48ced6ccac9aebc3910e1171fd094465a22472438d57f2634c5520ed844cce29

SHA512
d6dd40a93a71d42868545c6dc1aff056817e3492fc60280548aab63501abdcbda7669201a51c913c84bb1e5aaaa802e175431281065b4505734315cea463c96a

Download Submit
C:\Windows\System\NxVadoG.exe

Filesize
1.7MB

MD5
84b276f43475f5515cc14ec8c2a78610

SHA1
8fd57cf157be9bf6e4d28cbd6b2de6fa78fa4cf9

SHA256
d1aa783a24c19274954aee05be685de6de52f08315307d8f11f79b912558e971

SHA512
0a2bb29ae1e6c3a008879c8750f6db3aae8f52a04cbd8a78f3b4882bc723e05911a8cee3a419a75f625ae96aa2c80590eaa9cd6b1b5cb4cc2ef0dcb61e49c3fb

Download Submit
C:\Windows\System\PqkOdNA.exe

Filesize
1.7MB

MD5
f7b51380782914b12897646f3e3b841e

SHA1
62da6d41677470de5f9dedc304ece6ca0814c545

SHA256
c8feeb08a39c62e731580c1180c5a988bf20c7558d423612a35ad2ba2b020519

SHA512
908be33345a5f4b838e723c307ae17c0ae1ccc7e4198b3689fae4c50493779de66e093b629e443d6521f5974cf2e4b97e91a413ce827581624539d67d4be1332

Download Submit
C:\Windows\System\QEahNiq.exe

Filesize
1.7MB

MD5
87763343c52e016ba2a10ae553dedf58

SHA1
90805788afbd1cbbbbadc0310e8bd7d8afab6508

SHA256
3c5f910814e03aef32c109c440951c5b2c31c47b138f4fdf6e1ccadc2163e456

SHA512
36e416f1a9065d49b3d1b2a759f8016a8066d9554d64cd0709f14a94b510f08e9aea73ceb37874e0bf368a12921603fc3a4f13e12534134da52c9a0aad8c3e50

Download Submit
C:\Windows\System\ShClzyL.exe

Filesize
1.7MB

MD5
20ca87ac0cfa7072a3cc6fe511b67b5e

SHA1
1bea4ee7130586d610a0e7baf3704f90c970c61e

SHA256
f50b35f88d3acb0fbc62911038752d1dc776f7a112143bf73dc315935f2abe85

SHA512
409edc61100d575f3ac5689b9382e60d9b903468ceed4ef2c0de916874a03fb91f8d62e830f5fd763356be69519cc443e35146ca698d3dcfa6eb7ca192b4130b

Download Submit
C:\Windows\System\TAqqIAk.exe

Filesize
1.7MB

MD5
21bf4f310ecb50242f83d3c158e2ec89

SHA1
d060ef8097f6752acca096b1d13f6513a5933be7

SHA256
5d2db32d981d0bd0e54d3ceec2e22bddabf4afe7d49850dc75dfb598f090cfac

SHA512
cf44e78d57b39feaf8d99f919eb67b9e04ab96e42b9de7809946df121efd9504e191b80afb1409b9a37eb9f095383739e414888137cc9d7f63554209be0b89a2

Download Submit
C:\Windows\System\THikSxh.exe

Filesize
1.7MB

MD5
8b90b588abb66ef8254a3d5611f5f442

SHA1
284fac3cb33aa514f3c6ea8e208ac5d15e062711

SHA256
5fdda2bb34f9a08866f3f55599406ddc2c0b6ba95e1966d93f87cdba046bd04c

SHA512
8de9528934ad2abcf8cafdb4c70fa04464c5a82647bc7509b5133ade600fe17bf2b7de9d56666dce8a5facff3089761c97391db31a537a4ecda0314caaedfa31

Download Submit
C:\Windows\System\UDXlGEt.exe

Filesize
1.7MB

MD5
bd7c88c1c9e8d4da978076aac7a94be9

SHA1
bc1735b3bdcfc29090b1730f88b4cafb8c05d805

SHA256
057aef174842c435f1a3e64a24d81a5f0836fac92ec8911e5f2c5983da7606b7

SHA512
667b6593587c688fd13408fbd3c6374df3a3c4c919e0f98ae2ebf12551d29ed06c59c514cbf4c5a801528d0653162f46a6d27035321fdfa6fd3965e8097d6177

Download Submit
C:\Windows\System\VjEubaU.exe

Filesize
1.7MB

MD5
dafa087ed24f2c51dbe01c64509c5a22

SHA1
297cd8e422647d49ae2f701929800af3f0d0daab

SHA256
a50e86968f71be2e1da500d3cbb9c667d74b3dd3025955113fcc6da5fd58eced

SHA512
4533c14097ac225ae337cae0c99802ea05fa1ef63996d9f499ccbc0322c3b08def6ec16fee33ba283a1d4916d9a078606827f65bcb832eb54b02417a1d1a7514

Download Submit
C:\Windows\System\VygstNM.exe

Filesize
1.7MB

MD5
5f75439f24509e22530439ab0394f585

SHA1
ae24f67470b30fd6dbd4a74aad4e351e412c1be3

SHA256
4cbd31d2c6d286eeedd2ec25027d5a632ed3caf05d8f94f7ee3a847b883f3011

SHA512
7ca4c8ef471802e8f6797cdf7ddc0fc6ecb29bf3b850f2db5ee64be31c3fd4ec1f1c6742ec9c87c30ce7066e58c2145ff38e3cd074ba4a10c7fda01af79416e5

Download Submit
C:\Windows\System\ZVMvqtc.exe

Filesize
1.7MB

MD5
45339f016188f7b312b9160df334a833

SHA1
68c06e0d4fb3ffe36d6dd6594f6610a5f46f3311

SHA256
3c512080b22ff55ef2cf24d8bb37ad9eefd936ec19bae6da6c67379e6335de80

SHA512
51fdf8dcd30cf06f548346311ffe9265da01f96458d512fa7d18372f08c7889128d9f5f31b3f008b9698346905b3f44d0866876d40bd4cb4e59064e6413563aa

Download Submit
C:\Windows\System\cksRscn.exe

Filesize
1.7MB

MD5
d2cfbcf0debbb78a09e8eab8cb92079a

SHA1
d12f1faae96535a0c4b9d28656b3109dee672e9f

SHA256
403c80b4d160121a26927d976dc8f87601a84885ba03df5b4ccaf6ae06e65f2a

SHA512
0cff445bd16395ab8eea706b7e007d40a4a7f3e8c9d1e6891865cc5ac6d84f5fff8b3e7383a2b39af9d9688a0a772a89501f6b4a0bc5a982962932c253665ca9

Download Submit
C:\Windows\System\eXBKQMQ.exe

Filesize
1.7MB

MD5
f6da37253740be36e0ff2c6b0b212757

SHA1
46245ca7de05d0238b52caa29e7b1bfac489f930

SHA256
7f0ef5963aa77be092b59e153b75e54be119b7867b6fa45d4c83f7dd82c6e041

SHA512
b64d2e8458097c5d114c79a5fb0dcd6bd2925a0c97a16deb4234e53da5a381e0428c6ba8c5df8e223ce5928f2e5da21cb33c25416b2975a5d093436539a555ef

Download Submit
C:\Windows\System\egQMigd.exe

Filesize
1.7MB

MD5
607b641b2afed79dbd2286d4d3391a23

SHA1
373397dca339adcd90f345ceeaf2af06012ea7f7

SHA256
16e3ee570981ea7ec36363161775953bb120ecb572b351ff8975739d755d0acf

SHA512
0e82ee4582360a164ab186102c69b504f127fc5d33042d1f04db79b1f3c4856ee6b8f03876606e0f4d6de97c4bc95c9a670c557454a7fe42197dad6783c378d0

Download Submit
C:\Windows\System\govNHKF.exe

Filesize
1.7MB

MD5
6cf152a1670d99f2209d8833b4fd7d59

SHA1
be36c2f6164c5ef5d502701f24099f1e5b9f1b67

SHA256
f041725b886608cfccd1778823bcb73aa62ed15e3dea9526da45033ab0d5d478

SHA512
6d0afdce56b4f0ae8ee61960cd60e62f9171f473128de4939ae433045032669191ddef77abc9554beffd31270f9d49e238a2190601397935a03fab93abe854b3

Download Submit
C:\Windows\System\hoxPdsF.exe

Filesize
1.7MB

MD5
0f3c2e6ff9eeaa6a3cb61bec9ead38b7

SHA1
2b7f2f524e3b9e53ca1d73f1cda7092614dae073

SHA256
a0810dcd1d99cfc92748f5e620598c251483ebfacfff2cac6bad74911f8e03f5

SHA512
c9b5a8dbe0f2ddda41a5f659a79e315fc210b03ff786cb729220344ca830382ace561849ec23ddee47aceffcaf913f4436594acf510090cae449b76c8304814d

Download Submit
C:\Windows\System\iZgFLER.exe

Filesize
1.7MB

MD5
dc7ac05b7ecf55ff00271a0c6e83eeaa

SHA1
b108ee1746b383bdda4ec1c7bdbb50b8da0661fe

SHA256
4c01e7a8d5f5b28069338dcdeb1c4db79b4cce145205a0696b5538fef0581274

SHA512
595e9b4531cc9f1688f12e58cac04b4ee2b128d6179ac362718482c2a66f514feadc6c0d88393cedd8044c939d583af10e9636050dd2bda7c68895f506311483

Download Submit
C:\Windows\System\jwoBftn.exe

Filesize
1.7MB

MD5
c3dda11880719e43026a961a9d1ca9ec

SHA1
73ebd96b782072100a05c6e80b41aed38ab4cebb

SHA256
6655f359cb9c4c839b34451058eb4ed1bffcf1bd4c2250053b31722f159f133c

SHA512
ac195ba87d3fc5f27efd82c392d0e6de56ec5fb76a49e3d9c0bebc36143b9bcfa1ec320aaa100a02817e15686bb3b2119d84d0438000d3ee6d167151f49b079d

Download Submit
C:\Windows\System\lqowRyp.exe

Filesize
1.7MB

MD5
7bec7405ce90031154b1dd14871a165b

SHA1
2dea1da4b74cf6076086b3c0a7f815c2de899b58

SHA256
679d95138aac69e5c397f6415728bfad4dc9d7cc0f8302f8c3e67c649b873e00

SHA512
1f2a8d3f61035874db7144e6f941a597c11b09e30864a06337c70839ecb311cc09f9defb706560c9d0cc3f7a544256f797ef02a5b3c21f006bb611690b371013

Download Submit
C:\Windows\System\mwGQVLX.exe

Filesize
1.7MB

MD5
2628791ca092a213374ef956b9f54916

SHA1
105284acc15a65e650ae2a38f78cadac7901fddb

SHA256
e827abe8b373d8e3d28870109964492f626e262334643054d2b1c89faf398c65

SHA512
acda7b0235f7e116047d3cdb127fb57249ecd335b192c142f8c9233056152868cfabc42cb9a53d6f57e130ff27ccf38df0a28d9f6d7eb3d3ce117b41cb197e27

Download Submit
C:\Windows\System\oBBokSz.exe

Filesize
1.8MB

MD5
8a4533278c4290982f7807427a7cb13b

SHA1
9c47902953aa66c122323df95fd45cd45e573fc7

SHA256
33e7dbe51df7fbb42c428d501f4a04ef3fd21887aeb49293dd204be70da823fc

SHA512
01785d2bd6c01656d4b1f5e30af6854f5d0aa5071ed332f33ff301abeb37c220204c6915f5f30ff359ee8d6085d871008f12283e9ba080ac279a7bb54c14358b

Download Submit
C:\Windows\System\oBtuGZs.exe

Filesize
1.7MB

MD5
d1f8aac6d0738e75432db9e00ed1d5b6

SHA1
96bc5e51fd1ea39b77bfc56b9481e24106c24d25

SHA256
443645c00326816108b6c898e114dee257fcf750514e47cb243c3839e47d906d

SHA512
bcb4c2e5c96b413d64833c9d03d1e3761a7d19807fd81c14fd38632fcec48dc8dad9984a4a77f08971e5d42e08cadc43572d7f73ed12f0f006aeeb6d5f3896da

Download Submit
C:\Windows\System\qJdGUlp.exe

Filesize
1.7MB

MD5
fb7587d4aecadc072d8ed83a16e23036

SHA1
8203ea1b1205e06a41b92956ab221ddb2d2d29f3

SHA256
7e2a02cf9d62af1841940c2532fbea9a343ce1a94058d9b56f80d59ca861f52c

SHA512
0948cf31d0070fbd8c6b83342d0f01e2f0fb062b5e546cf797ab9d5e6acbbf6ed9a4804bc89b2411258959d3ab5c64de6094f0c18e11c7c673b8cf559217a615

Download Submit
C:\Windows\System\uYuDhjw.exe

Filesize
1.7MB

MD5
3890b8e73c6cbc68c389273e9cd9db6e

SHA1
65cece1adf60dd7dc569404e54b3f7b27de08de9

SHA256
a593c2f5994ac7ac66c299924d9b408b2235c916e347c4eaba53fd419122c8b8

SHA512
6fb5889ba3c17bc43d1f32da9925164843b07080c6db31daa70aa529893d80c65323bf0d525618b8300567503ecc3d3630d114e6adbabc67d321a2453a1e74c6

Download Submit
C:\Windows\System\uwTgrSI.exe

Filesize
1.7MB

MD5
c35770d7425acc2c2d6ed1e92900bc17

SHA1
1eed0d566910e33db48607cb4557621c54b24fe7

SHA256
2cefbe01f4523eed71a87e6bedc54bbd91367fb7910e81c38cfd569e71fb5640

SHA512
a2dab64df492cad3cf9649a2231813b979dec756a52d7adf1e4ffa6f7459c08e4490a68e60bf2c5ff5f6c430e840e462aa235dd87aef7dd3809e280b4e66f17a

Download Submit
C:\Windows\System\wYKJkqj.exe

Filesize
1.7MB

MD5
38c66203a1733684a993bb8902357bda

SHA1
8614ce0cf76d9e2de81fd38e744fcf945a81bb27

SHA256
7b165e06350cd0a918fe864b121cf671369d55e4c478e26570da1211acb4e94c

SHA512
54be019bb2f784296e17c18e2261dcd012e0d9e20e081a7b4fa0cf0052c69cceaf11ee8c26aae91d4407d841fafe1d1d90357c655c99aa0f96b2234a9923d442

Download Submit
memory/228-0-0x000002A0A4970000-0x000002A0A4980000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads