xmrig | 922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
Size

1.3MB
MD5

3bc1e38b68ca42129f149729db06e91a
SHA1

45253958908471cba01ca33cd808b3cf520fd2aa
SHA256

922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562
SHA512

dd26809b6b06659af840355f07d141eb26c47a07fed83567888f6ff0e0af51c50b1da998c269c54573c78bf7e74eaeaabf45aa4686115f616c3b8555a9cfc14a
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph7GW/2GaU:GezaTF8FcNkNdfE0pZ9ozttwIRxoW/2M

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023cab-4.dat	xmrig
behavioral2/files/0x0007000000023cb1-8.dat	xmrig
behavioral2/files/0x0007000000023cb0-10.dat	xmrig
behavioral2/files/0x0007000000023cb6-39.dat	xmrig
behavioral2/files/0x0007000000023cb8-49.dat	xmrig
behavioral2/files/0x0007000000023cbc-73.dat	xmrig
behavioral2/files/0x0007000000023cc6-119.dat	xmrig
behavioral2/files/0x0007000000023ccc-149.dat	xmrig
behavioral2/files/0x0007000000023ccf-162.dat	xmrig
behavioral2/files/0x0007000000023ccd-158.dat	xmrig
behavioral2/files/0x0007000000023cce-157.dat	xmrig
behavioral2/files/0x0007000000023ccb-147.dat	xmrig
behavioral2/files/0x0007000000023cca-143.dat	xmrig
behavioral2/files/0x0007000000023cc9-140.dat	xmrig
behavioral2/files/0x0007000000023cc8-135.dat	xmrig
behavioral2/files/0x0007000000023cc7-127.dat	xmrig
behavioral2/files/0x0007000000023cc5-117.dat	xmrig
behavioral2/files/0x0007000000023cc4-113.dat	xmrig
behavioral2/files/0x0007000000023cc3-107.dat	xmrig
behavioral2/files/0x0007000000023cc2-103.dat	xmrig
behavioral2/files/0x0007000000023cc1-95.dat	xmrig
behavioral2/files/0x0007000000023cc0-93.dat	xmrig
behavioral2/files/0x0007000000023cbf-87.dat	xmrig
behavioral2/files/0x0007000000023cbe-83.dat	xmrig
behavioral2/files/0x0007000000023cbd-78.dat	xmrig
behavioral2/files/0x0007000000023cbb-67.dat	xmrig
behavioral2/files/0x0007000000023cba-63.dat	xmrig
behavioral2/files/0x0007000000023cb9-57.dat	xmrig
behavioral2/files/0x0007000000023cb7-47.dat	xmrig
behavioral2/files/0x0007000000023cb5-37.dat	xmrig
behavioral2/files/0x0007000000023cb4-33.dat	xmrig
behavioral2/files/0x0007000000023cb3-27.dat	xmrig
behavioral2/files/0x0007000000023cb2-22.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2596	JWUSJWX.exe
4572	XOnrVam.exe
4664	VUGTNDc.exe
2736	LUNAaqz.exe
2252	EzrdtWN.exe
4756	tHxtsSy.exe
548	HASvVJk.exe
2840	wRuwXcf.exe
1744	EVwgpmu.exe
3648	nMgkphX.exe
2784	AdQLDOf.exe
2132	TOTuiri.exe
348	qloIRIM.exe
1160	nFOzEfD.exe
1444	DPHxniE.exe
392	UGkmNAM.exe
4872	jLmoEFp.exe
220	RjIeqhN.exe
3568	CTjIojn.exe
1112	QsJCrza.exe
1368	ZdTEdmd.exe
4580	UDKSsOB.exe
4612	kZKObBq.exe
4376	hZPwTzj.exe
5060	oAqkJmo.exe
4656	HtkRtrD.exe
3940	zjeERdb.exe
1176	GQdQJnW.exe
4840	dgTGZqV.exe
1164	snBXyUV.exe
744	RnMKHhl.exe
2480	PdvWLvs.exe
2240	EcmzEsT.exe
332	KTvsLHz.exe
1484	jJKObFV.exe
2312	gftaFqX.exe
1624	kbmhITz.exe
1520	zeGrxob.exe
3080	lnIeviB.exe
1104	ucptSas.exe
3956	RdeTxOj.exe
4084	oUAoWQT.exe
2424	qXvxycW.exe
1456	WpsFPEJ.exe
4468	HOFkzJf.exe
4584	scSWeCk.exe
4788	OBmnMsX.exe
2100	NjcLoyY.exe
4876	KIXozYY.exe
4272	NpCbDAa.exe
1932	pKHqjcW.exe
3444	uLDwjlm.exe
5004	QPJBPPP.exe
2816	DBUydox.exe
2484	fYJSZBq.exe
1804	LxFDZAA.exe
4400	FzBCMri.exe
5020	WimowNV.exe
4768	nuvlJKF.exe
4668	EhThMIa.exe
5108	KBCdOig.exe
540	lCMweJy.exe
1432	EPlzcrv.exe
3640	LcRnyhA.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JyFnwwQ.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\dbipXVB.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\IlbidUf.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\HOFkzJf.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\TxCDZVm.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\FhlLmMI.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\dQLWEmB.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\YwFAmwa.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\PUMfKbh.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\rejulyr.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\sjsiyOG.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\xkePSjc.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\ycLjBdl.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\ZQSLxRz.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\zGJbyTa.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\PiwDbFQ.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\kbmhITz.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\scSWeCk.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\WimowNV.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\exLFvlP.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\ffsDQer.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\fYJSZBq.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\nuvlJKF.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\akQswue.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\bnOWVVw.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\RKXRvnh.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\oMXGWFL.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\Xybfupe.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\fwsZJnJ.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\WpsFPEJ.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\FYlMROM.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\vKOoiJh.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\TRjbWgA.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\FZwPvkc.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\tDonPXd.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\fhzmwro.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\bbdISjm.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\ezxkdku.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\rmzuZoM.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\PeIrXyP.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\qsRimzx.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\ApPwDOD.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\KBCdOig.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\UFUVABI.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\ydfBxxg.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\MbSUzto.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\tHxtsSy.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\qPTPbrO.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\REAPOmF.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\JWUSJWX.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\lJlDnSj.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\SsTvuvd.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\XkEcwzd.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\quQIkKZ.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\SytpCif.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\lwmuvlR.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\isIVBwl.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\lPSmRPy.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\kTkMOwn.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\aXoiBti.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\eBslxMm.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\radWPwQ.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\EcmzEsT.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
File created	C:\Windows\System\MtuYFpv.exe	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 2596	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	83
PID 5032 wrote to memory of 2596	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	83
PID 5032 wrote to memory of 4572	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	84
PID 5032 wrote to memory of 4572	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	84
PID 5032 wrote to memory of 4664	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	85
PID 5032 wrote to memory of 4664	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	85
PID 5032 wrote to memory of 2736	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	86
PID 5032 wrote to memory of 2736	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	86
PID 5032 wrote to memory of 2252	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	87
PID 5032 wrote to memory of 2252	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	87
PID 5032 wrote to memory of 4756	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	88
PID 5032 wrote to memory of 4756	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	88
PID 5032 wrote to memory of 548	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	89
PID 5032 wrote to memory of 548	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	89
PID 5032 wrote to memory of 2840	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	90
PID 5032 wrote to memory of 2840	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	90
PID 5032 wrote to memory of 1744	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	91
PID 5032 wrote to memory of 1744	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	91
PID 5032 wrote to memory of 3648	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	92
PID 5032 wrote to memory of 3648	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	92
PID 5032 wrote to memory of 2784	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	93
PID 5032 wrote to memory of 2784	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	93
PID 5032 wrote to memory of 2132	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	94
PID 5032 wrote to memory of 2132	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	94
PID 5032 wrote to memory of 348	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	95
PID 5032 wrote to memory of 348	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	95
PID 5032 wrote to memory of 1160	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	96
PID 5032 wrote to memory of 1160	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	96
PID 5032 wrote to memory of 1444	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	97
PID 5032 wrote to memory of 1444	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	97
PID 5032 wrote to memory of 392	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	98
PID 5032 wrote to memory of 392	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	98
PID 5032 wrote to memory of 4872	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	99
PID 5032 wrote to memory of 4872	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	99
PID 5032 wrote to memory of 220	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	100
PID 5032 wrote to memory of 220	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	100
PID 5032 wrote to memory of 3568	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	101
PID 5032 wrote to memory of 3568	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	101
PID 5032 wrote to memory of 1112	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	102
PID 5032 wrote to memory of 1112	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	102
PID 5032 wrote to memory of 1368	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	103
PID 5032 wrote to memory of 1368	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	103
PID 5032 wrote to memory of 4580	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	104
PID 5032 wrote to memory of 4580	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	104
PID 5032 wrote to memory of 4612	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	105
PID 5032 wrote to memory of 4612	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	105
PID 5032 wrote to memory of 4376	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	106
PID 5032 wrote to memory of 4376	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	106
PID 5032 wrote to memory of 5060	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	107
PID 5032 wrote to memory of 5060	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	107
PID 5032 wrote to memory of 4656	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	108
PID 5032 wrote to memory of 4656	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	108
PID 5032 wrote to memory of 3940	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	109
PID 5032 wrote to memory of 3940	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	109
PID 5032 wrote to memory of 1176	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	110
PID 5032 wrote to memory of 1176	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	110
PID 5032 wrote to memory of 4840	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	111
PID 5032 wrote to memory of 4840	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	111
PID 5032 wrote to memory of 1164	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	112
PID 5032 wrote to memory of 1164	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	112
PID 5032 wrote to memory of 744	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	113
PID 5032 wrote to memory of 744	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	113
PID 5032 wrote to memory of 2480	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	114
PID 5032 wrote to memory of 2480	5032	922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe	114

C:\Users\Admin\AppData\Local\Temp\922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe
"C:\Users\Admin\AppData\Local\Temp\922f1bec977f74892408dab47a9fa7be96dca44b0cd8a76c1786fa04360e2562.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\System\JWUSJWX.exe
  C:\Windows\System\JWUSJWX.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\XOnrVam.exe
  C:\Windows\System\XOnrVam.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\VUGTNDc.exe
  C:\Windows\System\VUGTNDc.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\LUNAaqz.exe
  C:\Windows\System\LUNAaqz.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\EzrdtWN.exe
  C:\Windows\System\EzrdtWN.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\tHxtsSy.exe
  C:\Windows\System\tHxtsSy.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\HASvVJk.exe
  C:\Windows\System\HASvVJk.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\wRuwXcf.exe
  C:\Windows\System\wRuwXcf.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\EVwgpmu.exe
  C:\Windows\System\EVwgpmu.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\nMgkphX.exe
  C:\Windows\System\nMgkphX.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\AdQLDOf.exe
  C:\Windows\System\AdQLDOf.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\TOTuiri.exe
  C:\Windows\System\TOTuiri.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\qloIRIM.exe
  C:\Windows\System\qloIRIM.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\nFOzEfD.exe
  C:\Windows\System\nFOzEfD.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\DPHxniE.exe
  C:\Windows\System\DPHxniE.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\UGkmNAM.exe
  C:\Windows\System\UGkmNAM.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\jLmoEFp.exe
  C:\Windows\System\jLmoEFp.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\RjIeqhN.exe
  C:\Windows\System\RjIeqhN.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\CTjIojn.exe
  C:\Windows\System\CTjIojn.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\QsJCrza.exe
  C:\Windows\System\QsJCrza.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\ZdTEdmd.exe
  C:\Windows\System\ZdTEdmd.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\UDKSsOB.exe
  C:\Windows\System\UDKSsOB.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\kZKObBq.exe
  C:\Windows\System\kZKObBq.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\hZPwTzj.exe
  C:\Windows\System\hZPwTzj.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\oAqkJmo.exe
  C:\Windows\System\oAqkJmo.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\HtkRtrD.exe
  C:\Windows\System\HtkRtrD.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\zjeERdb.exe
  C:\Windows\System\zjeERdb.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\GQdQJnW.exe
  C:\Windows\System\GQdQJnW.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\dgTGZqV.exe
  C:\Windows\System\dgTGZqV.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\snBXyUV.exe
  C:\Windows\System\snBXyUV.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\RnMKHhl.exe
  C:\Windows\System\RnMKHhl.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\PdvWLvs.exe
  C:\Windows\System\PdvWLvs.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\EcmzEsT.exe
  C:\Windows\System\EcmzEsT.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\KTvsLHz.exe
  C:\Windows\System\KTvsLHz.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\jJKObFV.exe
  C:\Windows\System\jJKObFV.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\gftaFqX.exe
  C:\Windows\System\gftaFqX.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\kbmhITz.exe
  C:\Windows\System\kbmhITz.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\zeGrxob.exe
  C:\Windows\System\zeGrxob.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\lnIeviB.exe
  C:\Windows\System\lnIeviB.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\ucptSas.exe
  C:\Windows\System\ucptSas.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\RdeTxOj.exe
  C:\Windows\System\RdeTxOj.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\oUAoWQT.exe
  C:\Windows\System\oUAoWQT.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\qXvxycW.exe
  C:\Windows\System\qXvxycW.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\WpsFPEJ.exe
  C:\Windows\System\WpsFPEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\HOFkzJf.exe
  C:\Windows\System\HOFkzJf.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\scSWeCk.exe
  C:\Windows\System\scSWeCk.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\OBmnMsX.exe
  C:\Windows\System\OBmnMsX.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\NjcLoyY.exe
  C:\Windows\System\NjcLoyY.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\KIXozYY.exe
  C:\Windows\System\KIXozYY.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\NpCbDAa.exe
  C:\Windows\System\NpCbDAa.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\pKHqjcW.exe
  C:\Windows\System\pKHqjcW.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\uLDwjlm.exe
  C:\Windows\System\uLDwjlm.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\QPJBPPP.exe
  C:\Windows\System\QPJBPPP.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\DBUydox.exe
  C:\Windows\System\DBUydox.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\fYJSZBq.exe
  C:\Windows\System\fYJSZBq.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\LxFDZAA.exe
  C:\Windows\System\LxFDZAA.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\FzBCMri.exe
  C:\Windows\System\FzBCMri.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\WimowNV.exe
  C:\Windows\System\WimowNV.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\nuvlJKF.exe
  C:\Windows\System\nuvlJKF.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\EhThMIa.exe
  C:\Windows\System\EhThMIa.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\KBCdOig.exe
  C:\Windows\System\KBCdOig.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\lCMweJy.exe
  C:\Windows\System\lCMweJy.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\EPlzcrv.exe
  C:\Windows\System\EPlzcrv.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\LcRnyhA.exe
  C:\Windows\System\LcRnyhA.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\loJQYQS.exe
  C:\Windows\System\loJQYQS.exe
  2⤵
  PID:224
- C:\Windows\System\SSKoUKe.exe
  C:\Windows\System\SSKoUKe.exe
  2⤵
  PID:4244
- C:\Windows\System\fUtrBax.exe
  C:\Windows\System\fUtrBax.exe
  2⤵
  PID:1700
- C:\Windows\System\GEsKltW.exe
  C:\Windows\System\GEsKltW.exe
  2⤵
  PID:2524
- C:\Windows\System\IsjfKuq.exe
  C:\Windows\System\IsjfKuq.exe
  2⤵
  PID:2400
- C:\Windows\System\wTUjjQD.exe
  C:\Windows\System\wTUjjQD.exe
  2⤵
  PID:3996
- C:\Windows\System\RVdGMfs.exe
  C:\Windows\System\RVdGMfs.exe
  2⤵
  PID:2892
- C:\Windows\System\WHJSNkB.exe
  C:\Windows\System\WHJSNkB.exe
  2⤵
  PID:2348
- C:\Windows\System\pratEOQ.exe
  C:\Windows\System\pratEOQ.exe
  2⤵
  PID:4260
- C:\Windows\System\quQIkKZ.exe
  C:\Windows\System\quQIkKZ.exe
  2⤵
  PID:4404
- C:\Windows\System\LxZoLyG.exe
  C:\Windows\System\LxZoLyG.exe
  2⤵
  PID:2800
- C:\Windows\System\zwFwsCe.exe
  C:\Windows\System\zwFwsCe.exe
  2⤵
  PID:1172
- C:\Windows\System\tsRSFMX.exe
  C:\Windows\System\tsRSFMX.exe
  2⤵
  PID:3928
- C:\Windows\System\LUAZrjZ.exe
  C:\Windows\System\LUAZrjZ.exe
  2⤵
  PID:4036
- C:\Windows\System\hNoJwpE.exe
  C:\Windows\System\hNoJwpE.exe
  2⤵
  PID:1536
- C:\Windows\System\UXceMbS.exe
  C:\Windows\System\UXceMbS.exe
  2⤵
  PID:4592
- C:\Windows\System\yoiZACZ.exe
  C:\Windows\System\yoiZACZ.exe
  2⤵
  PID:760
- C:\Windows\System\aeGABIL.exe
  C:\Windows\System\aeGABIL.exe
  2⤵
  PID:4512
- C:\Windows\System\kwkyCWp.exe
  C:\Windows\System\kwkyCWp.exe
  2⤵
  PID:4280
- C:\Windows\System\UJjhhny.exe
  C:\Windows\System\UJjhhny.exe
  2⤵
  PID:2448
- C:\Windows\System\BvStOQc.exe
  C:\Windows\System\BvStOQc.exe
  2⤵
  PID:4288
- C:\Windows\System\rmymyzK.exe
  C:\Windows\System\rmymyzK.exe
  2⤵
  PID:1648
- C:\Windows\System\mVbClwm.exe
  C:\Windows\System\mVbClwm.exe
  2⤵
  PID:5124
- C:\Windows\System\NeLVpOj.exe
  C:\Windows\System\NeLVpOj.exe
  2⤵
  PID:5148
- C:\Windows\System\exLFvlP.exe
  C:\Windows\System\exLFvlP.exe
  2⤵
  PID:5176
- C:\Windows\System\RLZmBsI.exe
  C:\Windows\System\RLZmBsI.exe
  2⤵
  PID:5208
- C:\Windows\System\sjsiyOG.exe
  C:\Windows\System\sjsiyOG.exe
  2⤵
  PID:5232
- C:\Windows\System\GNmaSNr.exe
  C:\Windows\System\GNmaSNr.exe
  2⤵
  PID:5260
- C:\Windows\System\edboNii.exe
  C:\Windows\System\edboNii.exe
  2⤵
  PID:5288
- C:\Windows\System\QKCyVnM.exe
  C:\Windows\System\QKCyVnM.exe
  2⤵
  PID:5316
- C:\Windows\System\egbmCmg.exe
  C:\Windows\System\egbmCmg.exe
  2⤵
  PID:5344
- C:\Windows\System\oPplOgU.exe
  C:\Windows\System\oPplOgU.exe
  2⤵
  PID:5376
- C:\Windows\System\FtdOtVd.exe
  C:\Windows\System\FtdOtVd.exe
  2⤵
  PID:5400
- C:\Windows\System\bnYjZry.exe
  C:\Windows\System\bnYjZry.exe
  2⤵
  PID:5432
- C:\Windows\System\PhQfOkJ.exe
  C:\Windows\System\PhQfOkJ.exe
  2⤵
  PID:5460
- C:\Windows\System\jGggBFw.exe
  C:\Windows\System\jGggBFw.exe
  2⤵
  PID:5488
- C:\Windows\System\TVKDihW.exe
  C:\Windows\System\TVKDihW.exe
  2⤵
  PID:5516
- C:\Windows\System\zdmVqFG.exe
  C:\Windows\System\zdmVqFG.exe
  2⤵
  PID:5540
- C:\Windows\System\FYlMROM.exe
  C:\Windows\System\FYlMROM.exe
  2⤵
  PID:5568
- C:\Windows\System\hircuiR.exe
  C:\Windows\System\hircuiR.exe
  2⤵
  PID:5596
- C:\Windows\System\JMMWhEw.exe
  C:\Windows\System\JMMWhEw.exe
  2⤵
  PID:5624
- C:\Windows\System\bbdISjm.exe
  C:\Windows\System\bbdISjm.exe
  2⤵
  PID:5656
- C:\Windows\System\bUkNqOX.exe
  C:\Windows\System\bUkNqOX.exe
  2⤵
  PID:5684
- C:\Windows\System\xPqdJIF.exe
  C:\Windows\System\xPqdJIF.exe
  2⤵
  PID:5708
- C:\Windows\System\bIfflWh.exe
  C:\Windows\System\bIfflWh.exe
  2⤵
  PID:5736
- C:\Windows\System\eLQABey.exe
  C:\Windows\System\eLQABey.exe
  2⤵
  PID:5768
- C:\Windows\System\sJEMrux.exe
  C:\Windows\System\sJEMrux.exe
  2⤵
  PID:5792
- C:\Windows\System\dFrGIrH.exe
  C:\Windows\System\dFrGIrH.exe
  2⤵
  PID:5824
- C:\Windows\System\ubDmZPO.exe
  C:\Windows\System\ubDmZPO.exe
  2⤵
  PID:5852
- C:\Windows\System\XLraZkr.exe
  C:\Windows\System\XLraZkr.exe
  2⤵
  PID:5880
- C:\Windows\System\VavuTgT.exe
  C:\Windows\System\VavuTgT.exe
  2⤵
  PID:5904
- C:\Windows\System\nKuMSws.exe
  C:\Windows\System\nKuMSws.exe
  2⤵
  PID:5932
- C:\Windows\System\ACcyYXf.exe
  C:\Windows\System\ACcyYXf.exe
  2⤵
  PID:5960
- C:\Windows\System\ulmfYNU.exe
  C:\Windows\System\ulmfYNU.exe
  2⤵
  PID:5988
- C:\Windows\System\MUtVaFj.exe
  C:\Windows\System\MUtVaFj.exe
  2⤵
  PID:6016
- C:\Windows\System\YFrLlaP.exe
  C:\Windows\System\YFrLlaP.exe
  2⤵
  PID:6044
- C:\Windows\System\dYJxWEl.exe
  C:\Windows\System\dYJxWEl.exe
  2⤵
  PID:6068
- C:\Windows\System\kNLBtcI.exe
  C:\Windows\System\kNLBtcI.exe
  2⤵
  PID:6100
- C:\Windows\System\fDVCGNt.exe
  C:\Windows\System\fDVCGNt.exe
  2⤵
  PID:6128
- C:\Windows\System\HSXOVkP.exe
  C:\Windows\System\HSXOVkP.exe
  2⤵
  PID:4268
- C:\Windows\System\EldENWs.exe
  C:\Windows\System\EldENWs.exe
  2⤵
  PID:1168
- C:\Windows\System\jdAufNA.exe
  C:\Windows\System\jdAufNA.exe
  2⤵
  PID:4360
- C:\Windows\System\JyFnwwQ.exe
  C:\Windows\System\JyFnwwQ.exe
  2⤵
  PID:1540
- C:\Windows\System\ULTSlkx.exe
  C:\Windows\System\ULTSlkx.exe
  2⤵
  PID:2212
- C:\Windows\System\nbhHeUi.exe
  C:\Windows\System\nbhHeUi.exe
  2⤵
  PID:3512
- C:\Windows\System\QxFRxHz.exe
  C:\Windows\System\QxFRxHz.exe
  2⤵
  PID:1500
- C:\Windows\System\orlLulg.exe
  C:\Windows\System\orlLulg.exe
  2⤵
  PID:3516
- C:\Windows\System\LpFVyGE.exe
  C:\Windows\System\LpFVyGE.exe
  2⤵
  PID:5168
- C:\Windows\System\GKvlYiG.exe
  C:\Windows\System\GKvlYiG.exe
  2⤵
  PID:5228
- C:\Windows\System\Egopapc.exe
  C:\Windows\System\Egopapc.exe
  2⤵
  PID:5304
- C:\Windows\System\weZHxRn.exe
  C:\Windows\System\weZHxRn.exe
  2⤵
  PID:5364
- C:\Windows\System\UMlwRIg.exe
  C:\Windows\System\UMlwRIg.exe
  2⤵
  PID:5440
- C:\Windows\System\IuKWnQF.exe
  C:\Windows\System\IuKWnQF.exe
  2⤵
  PID:5504
- C:\Windows\System\VDNcwzW.exe
  C:\Windows\System\VDNcwzW.exe
  2⤵
  PID:5560
- C:\Windows\System\oguwnjs.exe
  C:\Windows\System\oguwnjs.exe
  2⤵
  PID:4628
- C:\Windows\System\QyqMVPm.exe
  C:\Windows\System\QyqMVPm.exe
  2⤵
  PID:5676
- C:\Windows\System\Sihfxuc.exe
  C:\Windows\System\Sihfxuc.exe
  2⤵
  PID:5756
- C:\Windows\System\YkVyVJD.exe
  C:\Windows\System\YkVyVJD.exe
  2⤵
  PID:5832
- C:\Windows\System\rdTWgzH.exe
  C:\Windows\System\rdTWgzH.exe
  2⤵
  PID:5888
- C:\Windows\System\QZrWpnm.exe
  C:\Windows\System\QZrWpnm.exe
  2⤵
  PID:5952
- C:\Windows\System\nxzAYJo.exe
  C:\Windows\System\nxzAYJo.exe
  2⤵
  PID:6008
- C:\Windows\System\OgJdKoe.exe
  C:\Windows\System\OgJdKoe.exe
  2⤵
  PID:2508
- C:\Windows\System\xkePSjc.exe
  C:\Windows\System\xkePSjc.exe
  2⤵
  PID:228
- C:\Windows\System\yaYuWBT.exe
  C:\Windows\System\yaYuWBT.exe
  2⤵
  PID:1792
- C:\Windows\System\VztajOl.exe
  C:\Windows\System\VztajOl.exe
  2⤵
  PID:4368
- C:\Windows\System\iBcsqGb.exe
  C:\Windows\System\iBcsqGb.exe
  2⤵
  PID:400
- C:\Windows\System\ZuWLxhn.exe
  C:\Windows\System\ZuWLxhn.exe
  2⤵
  PID:5224
- C:\Windows\System\cibjdNJ.exe
  C:\Windows\System\cibjdNJ.exe
  2⤵
  PID:5336
- C:\Windows\System\dHWzAjB.exe
  C:\Windows\System\dHWzAjB.exe
  2⤵
  PID:2916
- C:\Windows\System\DoHOvtU.exe
  C:\Windows\System\DoHOvtU.exe
  2⤵
  PID:5608
- C:\Windows\System\QBufXrP.exe
  C:\Windows\System\QBufXrP.exe
  2⤵
  PID:5724
- C:\Windows\System\DSRKqCg.exe
  C:\Windows\System\DSRKqCg.exe
  2⤵
  PID:5872
- C:\Windows\System\FNXtuCa.exe
  C:\Windows\System\FNXtuCa.exe
  2⤵
  PID:4236
- C:\Windows\System\AIxXSID.exe
  C:\Windows\System\AIxXSID.exe
  2⤵
  PID:4212
- C:\Windows\System\vNjGUfj.exe
  C:\Windows\System\vNjGUfj.exe
  2⤵
  PID:6172
- C:\Windows\System\MjPIyCC.exe
  C:\Windows\System\MjPIyCC.exe
  2⤵
  PID:6200
- C:\Windows\System\vGJWkpS.exe
  C:\Windows\System\vGJWkpS.exe
  2⤵
  PID:6228
- C:\Windows\System\KppeoRq.exe
  C:\Windows\System\KppeoRq.exe
  2⤵
  PID:6256
- C:\Windows\System\mfJtaPY.exe
  C:\Windows\System\mfJtaPY.exe
  2⤵
  PID:6284
- C:\Windows\System\QVKcsqc.exe
  C:\Windows\System\QVKcsqc.exe
  2⤵
  PID:6312
- C:\Windows\System\phuZEUf.exe
  C:\Windows\System\phuZEUf.exe
  2⤵
  PID:6340
- C:\Windows\System\bgIhTGt.exe
  C:\Windows\System\bgIhTGt.exe
  2⤵
  PID:6368
- C:\Windows\System\nlBwmFY.exe
  C:\Windows\System\nlBwmFY.exe
  2⤵
  PID:6396
- C:\Windows\System\ICtIgeo.exe
  C:\Windows\System\ICtIgeo.exe
  2⤵
  PID:6424
- C:\Windows\System\qPTPbrO.exe
  C:\Windows\System\qPTPbrO.exe
  2⤵
  PID:6452
- C:\Windows\System\huJcOaM.exe
  C:\Windows\System\huJcOaM.exe
  2⤵
  PID:6480
- C:\Windows\System\MQNdnZK.exe
  C:\Windows\System\MQNdnZK.exe
  2⤵
  PID:6508
- C:\Windows\System\MtCzOul.exe
  C:\Windows\System\MtCzOul.exe
  2⤵
  PID:6536
- C:\Windows\System\qZOykHF.exe
  C:\Windows\System\qZOykHF.exe
  2⤵
  PID:6560
- C:\Windows\System\xrLzPGk.exe
  C:\Windows\System\xrLzPGk.exe
  2⤵
  PID:6592
- C:\Windows\System\frkCxTm.exe
  C:\Windows\System\frkCxTm.exe
  2⤵
  PID:6616
- C:\Windows\System\ExPeetM.exe
  C:\Windows\System\ExPeetM.exe
  2⤵
  PID:6648
- C:\Windows\System\DGNWaWM.exe
  C:\Windows\System\DGNWaWM.exe
  2⤵
  PID:6676
- C:\Windows\System\MQMlcsq.exe
  C:\Windows\System\MQMlcsq.exe
  2⤵
  PID:6708
- C:\Windows\System\fhmmJtJ.exe
  C:\Windows\System\fhmmJtJ.exe
  2⤵
  PID:6732
- C:\Windows\System\ddLddCb.exe
  C:\Windows\System\ddLddCb.exe
  2⤵
  PID:6756
- C:\Windows\System\XsXjSgl.exe
  C:\Windows\System\XsXjSgl.exe
  2⤵
  PID:6788
- C:\Windows\System\GPtinDr.exe
  C:\Windows\System\GPtinDr.exe
  2⤵
  PID:6848
- C:\Windows\System\SFMROkP.exe
  C:\Windows\System\SFMROkP.exe
  2⤵
  PID:6872
- C:\Windows\System\NdRmcad.exe
  C:\Windows\System\NdRmcad.exe
  2⤵
  PID:6892
- C:\Windows\System\yHGfnLX.exe
  C:\Windows\System\yHGfnLX.exe
  2⤵
  PID:6912
- C:\Windows\System\NrtmHLF.exe
  C:\Windows\System\NrtmHLF.exe
  2⤵
  PID:6944
- C:\Windows\System\PiDLxYn.exe
  C:\Windows\System\PiDLxYn.exe
  2⤵
  PID:7020
- C:\Windows\System\jUltFeI.exe
  C:\Windows\System\jUltFeI.exe
  2⤵
  PID:7036
- C:\Windows\System\ZFzrcqn.exe
  C:\Windows\System\ZFzrcqn.exe
  2⤵
  PID:7060
- C:\Windows\System\bAuZIAr.exe
  C:\Windows\System\bAuZIAr.exe
  2⤵
  PID:7076
- C:\Windows\System\QtSokDa.exe
  C:\Windows\System\QtSokDa.exe
  2⤵
  PID:7092
- C:\Windows\System\MtuYFpv.exe
  C:\Windows\System\MtuYFpv.exe
  2⤵
  PID:7108
- C:\Windows\System\FjHknTy.exe
  C:\Windows\System\FjHknTy.exe
  2⤵
  PID:1720
- C:\Windows\System\ZjkWiMu.exe
  C:\Windows\System\ZjkWiMu.exe
  2⤵
  PID:3496
- C:\Windows\System\ghpqsAl.exe
  C:\Windows\System\ghpqsAl.exe
  2⤵
  PID:5160
- C:\Windows\System\APomWrz.exe
  C:\Windows\System\APomWrz.exe
  2⤵
  PID:5412
- C:\Windows\System\cUvPDjw.exe
  C:\Windows\System\cUvPDjw.exe
  2⤵
  PID:5920
- C:\Windows\System\hpHiIMt.exe
  C:\Windows\System\hpHiIMt.exe
  2⤵
  PID:6160
- C:\Windows\System\ccMOSVj.exe
  C:\Windows\System\ccMOSVj.exe
  2⤵
  PID:6216
- C:\Windows\System\kQCJtwq.exe
  C:\Windows\System\kQCJtwq.exe
  2⤵
  PID:6268
- C:\Windows\System\nNxaJhS.exe
  C:\Windows\System\nNxaJhS.exe
  2⤵
  PID:6296
- C:\Windows\System\TvKftMA.exe
  C:\Windows\System\TvKftMA.exe
  2⤵
  PID:6360
- C:\Windows\System\sNWrlJM.exe
  C:\Windows\System\sNWrlJM.exe
  2⤵
  PID:6416
- C:\Windows\System\KRZhOLq.exe
  C:\Windows\System\KRZhOLq.exe
  2⤵
  PID:6444
- C:\Windows\System\zhOYrDD.exe
  C:\Windows\System\zhOYrDD.exe
  2⤵
  PID:6472
- C:\Windows\System\tMTLfxN.exe
  C:\Windows\System\tMTLfxN.exe
  2⤵
  PID:6580
- C:\Windows\System\nQYmcvL.exe
  C:\Windows\System\nQYmcvL.exe
  2⤵
  PID:6604
- C:\Windows\System\abeNzrJ.exe
  C:\Windows\System\abeNzrJ.exe
  2⤵
  PID:6640
- C:\Windows\System\QieojSs.exe
  C:\Windows\System\QieojSs.exe
  2⤵
  PID:2160
- C:\Windows\System\NEohPAw.exe
  C:\Windows\System\NEohPAw.exe
  2⤵
  PID:6744
- C:\Windows\System\lOQtWju.exe
  C:\Windows\System\lOQtWju.exe
  2⤵
  PID:6692
- C:\Windows\System\wHaJHyY.exe
  C:\Windows\System\wHaJHyY.exe
  2⤵
  PID:6772
- C:\Windows\System\DONfxVI.exe
  C:\Windows\System\DONfxVI.exe
  2⤵
  PID:4692
- C:\Windows\System\DodQaoA.exe
  C:\Windows\System\DodQaoA.exe
  2⤵
  PID:412
- C:\Windows\System\CnDitZw.exe
  C:\Windows\System\CnDitZw.exe
  2⤵
  PID:6864
- C:\Windows\System\npDkBRW.exe
  C:\Windows\System\npDkBRW.exe
  2⤵
  PID:6928
- C:\Windows\System\ZWbHpMQ.exe
  C:\Windows\System\ZWbHpMQ.exe
  2⤵
  PID:6980
- C:\Windows\System\vDNHhDm.exe
  C:\Windows\System\vDNHhDm.exe
  2⤵
  PID:7084
- C:\Windows\System\YqkPyZu.exe
  C:\Windows\System\YqkPyZu.exe
  2⤵
  PID:7052
- C:\Windows\System\ycLjBdl.exe
  C:\Windows\System\ycLjBdl.exe
  2⤵
  PID:5528
- C:\Windows\System\QEgyHLI.exe
  C:\Windows\System\QEgyHLI.exe
  2⤵
  PID:5804
- C:\Windows\System\yYeFGla.exe
  C:\Windows\System\yYeFGla.exe
  2⤵
  PID:6088
- C:\Windows\System\OLWZpGb.exe
  C:\Windows\System\OLWZpGb.exe
  2⤵
  PID:6244
- C:\Windows\System\gGSKzVu.exe
  C:\Windows\System\gGSKzVu.exe
  2⤵
  PID:3664
- C:\Windows\System\agkkLnk.exe
  C:\Windows\System\agkkLnk.exe
  2⤵
  PID:6440
- C:\Windows\System\NaSZYag.exe
  C:\Windows\System\NaSZYag.exe
  2⤵
  PID:6576
- C:\Windows\System\cwLiqMc.exe
  C:\Windows\System\cwLiqMc.exe
  2⤵
  PID:6636
- C:\Windows\System\KtCOqlh.exe
  C:\Windows\System\KtCOqlh.exe
  2⤵
  PID:6660
- C:\Windows\System\voOLgfy.exe
  C:\Windows\System\voOLgfy.exe
  2⤵
  PID:6664
- C:\Windows\System\lwcyakU.exe
  C:\Windows\System\lwcyakU.exe
  2⤵
  PID:5096
- C:\Windows\System\iYmpiWI.exe
  C:\Windows\System\iYmpiWI.exe
  2⤵
  PID:7044
- C:\Windows\System\zBXbrPQ.exe
  C:\Windows\System\zBXbrPQ.exe
  2⤵
  PID:456
- C:\Windows\System\wKkBUSP.exe
  C:\Windows\System\wKkBUSP.exe
  2⤵
  PID:6188
- C:\Windows\System\nfOvoOT.exe
  C:\Windows\System\nfOvoOT.exe
  2⤵
  PID:6468
- C:\Windows\System\ULKMJlS.exe
  C:\Windows\System\ULKMJlS.exe
  2⤵
  PID:4600
- C:\Windows\System\NcHjqTF.exe
  C:\Windows\System\NcHjqTF.exe
  2⤵
  PID:7104
- C:\Windows\System\lEYBEZP.exe
  C:\Windows\System\lEYBEZP.exe
  2⤵
  PID:4524
- C:\Windows\System\twhEBHC.exe
  C:\Windows\System\twhEBHC.exe
  2⤵
  PID:1020
- C:\Windows\System\vpiGKPU.exe
  C:\Windows\System\vpiGKPU.exe
  2⤵
  PID:6700
- C:\Windows\System\uHGpEcc.exe
  C:\Windows\System\uHGpEcc.exe
  2⤵
  PID:4652
- C:\Windows\System\ReOPTDG.exe
  C:\Windows\System\ReOPTDG.exe
  2⤵
  PID:3856
- C:\Windows\System\hjZzYlH.exe
  C:\Windows\System\hjZzYlH.exe
  2⤵
  PID:7196
- C:\Windows\System\ZHmhgWS.exe
  C:\Windows\System\ZHmhgWS.exe
  2⤵
  PID:7232
- C:\Windows\System\MhnUneG.exe
  C:\Windows\System\MhnUneG.exe
  2⤵
  PID:7256
- C:\Windows\System\ZsOzdZe.exe
  C:\Windows\System\ZsOzdZe.exe
  2⤵
  PID:7272
- C:\Windows\System\EprTkxK.exe
  C:\Windows\System\EprTkxK.exe
  2⤵
  PID:7296
- C:\Windows\System\pKszlpQ.exe
  C:\Windows\System\pKszlpQ.exe
  2⤵
  PID:7352
- C:\Windows\System\lWYpzCo.exe
  C:\Windows\System\lWYpzCo.exe
  2⤵
  PID:7380
- C:\Windows\System\tBGpTdK.exe
  C:\Windows\System\tBGpTdK.exe
  2⤵
  PID:7396
- C:\Windows\System\SEfGWMQ.exe
  C:\Windows\System\SEfGWMQ.exe
  2⤵
  PID:7428
- C:\Windows\System\aoZjYIk.exe
  C:\Windows\System\aoZjYIk.exe
  2⤵
  PID:7464
- C:\Windows\System\ofShwnO.exe
  C:\Windows\System\ofShwnO.exe
  2⤵
  PID:7484
- C:\Windows\System\tPaiYTY.exe
  C:\Windows\System\tPaiYTY.exe
  2⤵
  PID:7512
- C:\Windows\System\PYKjACS.exe
  C:\Windows\System\PYKjACS.exe
  2⤵
  PID:7532
- C:\Windows\System\jqmEbKb.exe
  C:\Windows\System\jqmEbKb.exe
  2⤵
  PID:7556
- C:\Windows\System\ndkGPas.exe
  C:\Windows\System\ndkGPas.exe
  2⤵
  PID:7588
- C:\Windows\System\grzfUcp.exe
  C:\Windows\System\grzfUcp.exe
  2⤵
  PID:7616
- C:\Windows\System\mnjWxWU.exe
  C:\Windows\System\mnjWxWU.exe
  2⤵
  PID:7664
- C:\Windows\System\UFUVABI.exe
  C:\Windows\System\UFUVABI.exe
  2⤵
  PID:7680
- C:\Windows\System\SNJlWpu.exe
  C:\Windows\System\SNJlWpu.exe
  2⤵
  PID:7720
- C:\Windows\System\NoDsXkc.exe
  C:\Windows\System\NoDsXkc.exe
  2⤵
  PID:7736
- C:\Windows\System\sIBQpKe.exe
  C:\Windows\System\sIBQpKe.exe
  2⤵
  PID:7760
- C:\Windows\System\xbdiqsX.exe
  C:\Windows\System\xbdiqsX.exe
  2⤵
  PID:7784
- C:\Windows\System\EzSNClK.exe
  C:\Windows\System\EzSNClK.exe
  2⤵
  PID:7832
- C:\Windows\System\UpJDGhU.exe
  C:\Windows\System\UpJDGhU.exe
  2⤵
  PID:7860
- C:\Windows\System\EtyCfDB.exe
  C:\Windows\System\EtyCfDB.exe
  2⤵
  PID:7888
- C:\Windows\System\AVwXHPi.exe
  C:\Windows\System\AVwXHPi.exe
  2⤵
  PID:7904
- C:\Windows\System\JwKvSBO.exe
  C:\Windows\System\JwKvSBO.exe
  2⤵
  PID:7932
- C:\Windows\System\LYmRFaV.exe
  C:\Windows\System\LYmRFaV.exe
  2⤵
  PID:7972
- C:\Windows\System\wtMjYov.exe
  C:\Windows\System\wtMjYov.exe
  2⤵
  PID:8000
- C:\Windows\System\MpjKCSO.exe
  C:\Windows\System\MpjKCSO.exe
  2⤵
  PID:8028
- C:\Windows\System\YPqwBsh.exe
  C:\Windows\System\YPqwBsh.exe
  2⤵
  PID:8056
- C:\Windows\System\zJEWRDM.exe
  C:\Windows\System\zJEWRDM.exe
  2⤵
  PID:8084
- C:\Windows\System\gbjeKFo.exe
  C:\Windows\System\gbjeKFo.exe
  2⤵
  PID:8104
- C:\Windows\System\wHaeIZG.exe
  C:\Windows\System\wHaeIZG.exe
  2⤵
  PID:8128
- C:\Windows\System\cSSRqpp.exe
  C:\Windows\System\cSSRqpp.exe
  2⤵
  PID:8144
- C:\Windows\System\VgEvRBy.exe
  C:\Windows\System\VgEvRBy.exe
  2⤵
  PID:8168
- C:\Windows\System\ZpjOFVZ.exe
  C:\Windows\System\ZpjOFVZ.exe
  2⤵
  PID:7228
- C:\Windows\System\HEqDTcl.exe
  C:\Windows\System\HEqDTcl.exe
  2⤵
  PID:7292
- C:\Windows\System\YCbETVY.exe
  C:\Windows\System\YCbETVY.exe
  2⤵
  PID:7320
- C:\Windows\System\yhRZdHS.exe
  C:\Windows\System\yhRZdHS.exe
  2⤵
  PID:7372
- C:\Windows\System\TxCDZVm.exe
  C:\Windows\System\TxCDZVm.exe
  2⤵
  PID:7452
- C:\Windows\System\OVCnunw.exe
  C:\Windows\System\OVCnunw.exe
  2⤵
  PID:7500
- C:\Windows\System\BnqGgfy.exe
  C:\Windows\System\BnqGgfy.exe
  2⤵
  PID:7572
- C:\Windows\System\FhlLmMI.exe
  C:\Windows\System\FhlLmMI.exe
  2⤵
  PID:7640
- C:\Windows\System\KwltaLJ.exe
  C:\Windows\System\KwltaLJ.exe
  2⤵
  PID:7708
- C:\Windows\System\CqrtBLr.exe
  C:\Windows\System\CqrtBLr.exe
  2⤵
  PID:7748
- C:\Windows\System\ekIURwc.exe
  C:\Windows\System\ekIURwc.exe
  2⤵
  PID:7852
- C:\Windows\System\ezxkdku.exe
  C:\Windows\System\ezxkdku.exe
  2⤵
  PID:7872
- C:\Windows\System\vNnTdRF.exe
  C:\Windows\System\vNnTdRF.exe
  2⤵
  PID:7956
- C:\Windows\System\hzpLoEK.exe
  C:\Windows\System\hzpLoEK.exe
  2⤵
  PID:8040
- C:\Windows\System\ducizfW.exe
  C:\Windows\System\ducizfW.exe
  2⤵
  PID:8092
- C:\Windows\System\vZrgJbr.exe
  C:\Windows\System\vZrgJbr.exe
  2⤵
  PID:8156
- C:\Windows\System\QMylZmP.exe
  C:\Windows\System\QMylZmP.exe
  2⤵
  PID:7224
- C:\Windows\System\qCWASbQ.exe
  C:\Windows\System\qCWASbQ.exe
  2⤵
  PID:7412
- C:\Windows\System\wPqpLQH.exe
  C:\Windows\System\wPqpLQH.exe
  2⤵
  PID:7540
- C:\Windows\System\vTsxJWd.exe
  C:\Windows\System\vTsxJWd.exe
  2⤵
  PID:7608
- C:\Windows\System\byTqPjR.exe
  C:\Windows\System\byTqPjR.exe
  2⤵
  PID:7756
- C:\Windows\System\XYvXAKV.exe
  C:\Windows\System\XYvXAKV.exe
  2⤵
  PID:8024
- C:\Windows\System\fIjRdHF.exe
  C:\Windows\System\fIjRdHF.exe
  2⤵
  PID:7268
- C:\Windows\System\GavQaUk.exe
  C:\Windows\System\GavQaUk.exe
  2⤵
  PID:7524
- C:\Windows\System\mFQilUc.exe
  C:\Windows\System\mFQilUc.exe
  2⤵
  PID:8120
- C:\Windows\System\oUHjata.exe
  C:\Windows\System\oUHjata.exe
  2⤵
  PID:7344
- C:\Windows\System\kJyAjjJ.exe
  C:\Windows\System\kJyAjjJ.exe
  2⤵
  PID:8136
- C:\Windows\System\lfoSLeo.exe
  C:\Windows\System\lfoSLeo.exe
  2⤵
  PID:8208
- C:\Windows\System\pVmxFqi.exe
  C:\Windows\System\pVmxFqi.exe
  2⤵
  PID:8228
- C:\Windows\System\CLujJAt.exe
  C:\Windows\System\CLujJAt.exe
  2⤵
  PID:8252
- C:\Windows\System\AqMlgdh.exe
  C:\Windows\System\AqMlgdh.exe
  2⤵
  PID:8292
- C:\Windows\System\CfWvxzE.exe
  C:\Windows\System\CfWvxzE.exe
  2⤵
  PID:8308
- C:\Windows\System\SbPhphi.exe
  C:\Windows\System\SbPhphi.exe
  2⤵
  PID:8324
- C:\Windows\System\lwmuvlR.exe
  C:\Windows\System\lwmuvlR.exe
  2⤵
  PID:8356
- C:\Windows\System\ozCHfKy.exe
  C:\Windows\System\ozCHfKy.exe
  2⤵
  PID:8380
- C:\Windows\System\pVYqeaV.exe
  C:\Windows\System\pVYqeaV.exe
  2⤵
  PID:8404
- C:\Windows\System\BjYqiol.exe
  C:\Windows\System\BjYqiol.exe
  2⤵
  PID:8436
- C:\Windows\System\IhPHNpK.exe
  C:\Windows\System\IhPHNpK.exe
  2⤵
  PID:8476
- C:\Windows\System\mWkLuqz.exe
  C:\Windows\System\mWkLuqz.exe
  2⤵
  PID:8492
- C:\Windows\System\obosGNH.exe
  C:\Windows\System\obosGNH.exe
  2⤵
  PID:8520
- C:\Windows\System\VEgZveN.exe
  C:\Windows\System\VEgZveN.exe
  2⤵
  PID:8540
- C:\Windows\System\cfsYlHJ.exe
  C:\Windows\System\cfsYlHJ.exe
  2⤵
  PID:8596
- C:\Windows\System\RMrvuTj.exe
  C:\Windows\System\RMrvuTj.exe
  2⤵
  PID:8616
- C:\Windows\System\BodPbFp.exe
  C:\Windows\System\BodPbFp.exe
  2⤵
  PID:8632
- C:\Windows\System\NieaIhQ.exe
  C:\Windows\System\NieaIhQ.exe
  2⤵
  PID:8660
- C:\Windows\System\akQswue.exe
  C:\Windows\System\akQswue.exe
  2⤵
  PID:8688
- C:\Windows\System\aEMthLR.exe
  C:\Windows\System\aEMthLR.exe
  2⤵
  PID:8716
- C:\Windows\System\ZXwBJPW.exe
  C:\Windows\System\ZXwBJPW.exe
  2⤵
  PID:8752
- C:\Windows\System\XOYIurn.exe
  C:\Windows\System\XOYIurn.exe
  2⤵
  PID:8768
- C:\Windows\System\jiXgJeD.exe
  C:\Windows\System\jiXgJeD.exe
  2⤵
  PID:8784
- C:\Windows\System\HkKahns.exe
  C:\Windows\System\HkKahns.exe
  2⤵
  PID:8808
- C:\Windows\System\aGsCKzq.exe
  C:\Windows\System\aGsCKzq.exe
  2⤵
  PID:8828
- C:\Windows\System\QiHZfSj.exe
  C:\Windows\System\QiHZfSj.exe
  2⤵
  PID:8848
- C:\Windows\System\zvBVjiK.exe
  C:\Windows\System\zvBVjiK.exe
  2⤵
  PID:8864
- C:\Windows\System\yApTdGT.exe
  C:\Windows\System\yApTdGT.exe
  2⤵
  PID:8908
- C:\Windows\System\ydfBxxg.exe
  C:\Windows\System\ydfBxxg.exe
  2⤵
  PID:8924
- C:\Windows\System\gbKscCV.exe
  C:\Windows\System\gbKscCV.exe
  2⤵
  PID:8968
- C:\Windows\System\Fqlkokm.exe
  C:\Windows\System\Fqlkokm.exe
  2⤵
  PID:8984
- C:\Windows\System\lpRDlOg.exe
  C:\Windows\System\lpRDlOg.exe
  2⤵
  PID:9012
- C:\Windows\System\DsrSLdE.exe
  C:\Windows\System\DsrSLdE.exe
  2⤵
  PID:9044
- C:\Windows\System\doaNafn.exe
  C:\Windows\System\doaNafn.exe
  2⤵
  PID:9084
- C:\Windows\System\ynnqvfc.exe
  C:\Windows\System\ynnqvfc.exe
  2⤵
  PID:9116
- C:\Windows\System\VJBSkYq.exe
  C:\Windows\System\VJBSkYq.exe
  2⤵
  PID:9140
- C:\Windows\System\lMbjyxl.exe
  C:\Windows\System\lMbjyxl.exe
  2⤵
  PID:9164
- C:\Windows\System\bdYlXof.exe
  C:\Windows\System\bdYlXof.exe
  2⤵
  PID:9184
- C:\Windows\System\SXgFtxW.exe
  C:\Windows\System\SXgFtxW.exe
  2⤵
  PID:7704
- C:\Windows\System\FFwxGOx.exe
  C:\Windows\System\FFwxGOx.exe
  2⤵
  PID:8268
- C:\Windows\System\YNTkohR.exe
  C:\Windows\System\YNTkohR.exe
  2⤵
  PID:8316
- C:\Windows\System\aqouKxI.exe
  C:\Windows\System\aqouKxI.exe
  2⤵
  PID:8336
- C:\Windows\System\ffsDQer.exe
  C:\Windows\System\ffsDQer.exe
  2⤵
  PID:8460
- C:\Windows\System\GaAfdMs.exe
  C:\Windows\System\GaAfdMs.exe
  2⤵
  PID:8608
- C:\Windows\System\aFdLPWe.exe
  C:\Windows\System\aFdLPWe.exe
  2⤵
  PID:8644
- C:\Windows\System\GtqrVZg.exe
  C:\Windows\System\GtqrVZg.exe
  2⤵
  PID:8748
- C:\Windows\System\nNCDRMy.exe
  C:\Windows\System\nNCDRMy.exe
  2⤵
  PID:8824
- C:\Windows\System\YkTNULw.exe
  C:\Windows\System\YkTNULw.exe
  2⤵
  PID:8836
- C:\Windows\System\rOcNmXk.exe
  C:\Windows\System\rOcNmXk.exe
  2⤵
  PID:8952
- C:\Windows\System\wLMtDTo.exe
  C:\Windows\System\wLMtDTo.exe
  2⤵
  PID:9004
- C:\Windows\System\JCvsnCj.exe
  C:\Windows\System\JCvsnCj.exe
  2⤵
  PID:9076
- C:\Windows\System\FPAfzsE.exe
  C:\Windows\System\FPAfzsE.exe
  2⤵
  PID:9036
- C:\Windows\System\fxrpXXa.exe
  C:\Windows\System\fxrpXXa.exe
  2⤵
  PID:9180
- C:\Windows\System\tdSlPGH.exe
  C:\Windows\System\tdSlPGH.exe
  2⤵
  PID:9160
- C:\Windows\System\rGclEpQ.exe
  C:\Windows\System\rGclEpQ.exe
  2⤵
  PID:8216
- C:\Windows\System\EgAPMOp.exe
  C:\Windows\System\EgAPMOp.exe
  2⤵
  PID:8652
- C:\Windows\System\YIBugqb.exe
  C:\Windows\System\YIBugqb.exe
  2⤵
  PID:8792
- C:\Windows\System\jkYwzkd.exe
  C:\Windows\System\jkYwzkd.exe
  2⤵
  PID:8948
- C:\Windows\System\inwelHq.exe
  C:\Windows\System\inwelHq.exe
  2⤵
  PID:9092
- C:\Windows\System\WZiAIdq.exe
  C:\Windows\System\WZiAIdq.exe
  2⤵
  PID:8248
- C:\Windows\System\nqiGwnO.exe
  C:\Windows\System\nqiGwnO.exe
  2⤵
  PID:8416
- C:\Windows\System\pXeGwLe.exe
  C:\Windows\System\pXeGwLe.exe
  2⤵
  PID:8920
- C:\Windows\System\LPxiNyD.exe
  C:\Windows\System\LPxiNyD.exe
  2⤵
  PID:8816
- C:\Windows\System\ctlmYjR.exe
  C:\Windows\System\ctlmYjR.exe
  2⤵
  PID:8800
- C:\Windows\System\ZkBrBki.exe
  C:\Windows\System\ZkBrBki.exe
  2⤵
  PID:9236
- C:\Windows\System\gqrzQEr.exe
  C:\Windows\System\gqrzQEr.exe
  2⤵
  PID:9260
- C:\Windows\System\yeuuGPi.exe
  C:\Windows\System\yeuuGPi.exe
  2⤵
  PID:9288
- C:\Windows\System\iXEwIec.exe
  C:\Windows\System\iXEwIec.exe
  2⤵
  PID:9316
- C:\Windows\System\jBxvyuB.exe
  C:\Windows\System\jBxvyuB.exe
  2⤵
  PID:9336
- C:\Windows\System\lPQtgjl.exe
  C:\Windows\System\lPQtgjl.exe
  2⤵
  PID:9360
- C:\Windows\System\mPfnVzm.exe
  C:\Windows\System\mPfnVzm.exe
  2⤵
  PID:9400
- C:\Windows\System\GOptIsh.exe
  C:\Windows\System\GOptIsh.exe
  2⤵
  PID:9428
- C:\Windows\System\VpUUtVn.exe
  C:\Windows\System\VpUUtVn.exe
  2⤵
  PID:9444
- C:\Windows\System\QtKlYSI.exe
  C:\Windows\System\QtKlYSI.exe
  2⤵
  PID:9476
- C:\Windows\System\lJlDnSj.exe
  C:\Windows\System\lJlDnSj.exe
  2⤵
  PID:9496
- C:\Windows\System\BZZWfIQ.exe
  C:\Windows\System\BZZWfIQ.exe
  2⤵
  PID:9516
- C:\Windows\System\rmzuZoM.exe
  C:\Windows\System\rmzuZoM.exe
  2⤵
  PID:9544
- C:\Windows\System\MxEuGpF.exe
  C:\Windows\System\MxEuGpF.exe
  2⤵
  PID:9572
- C:\Windows\System\lsszWaP.exe
  C:\Windows\System\lsszWaP.exe
  2⤵
  PID:9596
- C:\Windows\System\jBGZdZB.exe
  C:\Windows\System\jBGZdZB.exe
  2⤵
  PID:9664
- C:\Windows\System\rJtRWLC.exe
  C:\Windows\System\rJtRWLC.exe
  2⤵
  PID:9692
- C:\Windows\System\UHBCZYZ.exe
  C:\Windows\System\UHBCZYZ.exe
  2⤵
  PID:9708
- C:\Windows\System\AtYmaDp.exe
  C:\Windows\System\AtYmaDp.exe
  2⤵
  PID:9748
- C:\Windows\System\rDRzCbF.exe
  C:\Windows\System\rDRzCbF.exe
  2⤵
  PID:9764
- C:\Windows\System\McMGbxm.exe
  C:\Windows\System\McMGbxm.exe
  2⤵
  PID:9796
- C:\Windows\System\YOpNZat.exe
  C:\Windows\System\YOpNZat.exe
  2⤵
  PID:9820
- C:\Windows\System\PeIrXyP.exe
  C:\Windows\System\PeIrXyP.exe
  2⤵
  PID:9848
- C:\Windows\System\NzTShSc.exe
  C:\Windows\System\NzTShSc.exe
  2⤵
  PID:9880
- C:\Windows\System\djYCRsg.exe
  C:\Windows\System\djYCRsg.exe
  2⤵
  PID:9904
- C:\Windows\System\odBHkls.exe
  C:\Windows\System\odBHkls.exe
  2⤵
  PID:9932
- C:\Windows\System\wAOkYxs.exe
  C:\Windows\System\wAOkYxs.exe
  2⤵
  PID:9972
- C:\Windows\System\vduJaij.exe
  C:\Windows\System\vduJaij.exe
  2⤵
  PID:10000
- C:\Windows\System\kZwlusq.exe
  C:\Windows\System\kZwlusq.exe
  2⤵
  PID:10028
- C:\Windows\System\ttLPraj.exe
  C:\Windows\System\ttLPraj.exe
  2⤵
  PID:10044
- C:\Windows\System\sXMUtcS.exe
  C:\Windows\System\sXMUtcS.exe
  2⤵
  PID:10084
- C:\Windows\System\FftlOEN.exe
  C:\Windows\System\FftlOEN.exe
  2⤵
  PID:10112
- C:\Windows\System\MjJfTHQ.exe
  C:\Windows\System\MjJfTHQ.exe
  2⤵
  PID:10140
- C:\Windows\System\BMqdbWH.exe
  C:\Windows\System\BMqdbWH.exe
  2⤵
  PID:10160
- C:\Windows\System\cVaufmU.exe
  C:\Windows\System\cVaufmU.exe
  2⤵
  PID:10196
- C:\Windows\System\fQWSOgY.exe
  C:\Windows\System\fQWSOgY.exe
  2⤵
  PID:10224
- C:\Windows\System\FnfvwOL.exe
  C:\Windows\System\FnfvwOL.exe
  2⤵
  PID:8532
- C:\Windows\System\ffTicCg.exe
  C:\Windows\System\ffTicCg.exe
  2⤵
  PID:9248
- C:\Windows\System\aWXJuZz.exe
  C:\Windows\System\aWXJuZz.exe
  2⤵
  PID:9308
- C:\Windows\System\hkYQGQf.exe
  C:\Windows\System\hkYQGQf.exe
  2⤵
  PID:9328
- C:\Windows\System\gJWBWdY.exe
  C:\Windows\System\gJWBWdY.exe
  2⤵
  PID:9420
- C:\Windows\System\cBPNoIp.exe
  C:\Windows\System\cBPNoIp.exe
  2⤵
  PID:9468
- C:\Windows\System\cQiLaCt.exe
  C:\Windows\System\cQiLaCt.exe
  2⤵
  PID:9512
- C:\Windows\System\YiwdSHB.exe
  C:\Windows\System\YiwdSHB.exe
  2⤵
  PID:9588
- C:\Windows\System\erCXARS.exe
  C:\Windows\System\erCXARS.exe
  2⤵
  PID:9680
- C:\Windows\System\jqemaJn.exe
  C:\Windows\System\jqemaJn.exe
  2⤵
  PID:9724
- C:\Windows\System\NlDybae.exe
  C:\Windows\System\NlDybae.exe
  2⤵
  PID:9840
- C:\Windows\System\pHeaBka.exe
  C:\Windows\System\pHeaBka.exe
  2⤵
  PID:9896
- C:\Windows\System\pKKwmBq.exe
  C:\Windows\System\pKKwmBq.exe
  2⤵
  PID:9968
- C:\Windows\System\pYBauPp.exe
  C:\Windows\System\pYBauPp.exe
  2⤵
  PID:10012
- C:\Windows\System\kWtocMZ.exe
  C:\Windows\System\kWtocMZ.exe
  2⤵
  PID:10076
- C:\Windows\System\mcqduHZ.exe
  C:\Windows\System\mcqduHZ.exe
  2⤵
  PID:10148
- C:\Windows\System\JPAlKkP.exe
  C:\Windows\System\JPAlKkP.exe
  2⤵
  PID:10184
- C:\Windows\System\CTVIoUG.exe
  C:\Windows\System\CTVIoUG.exe
  2⤵
  PID:10216
- C:\Windows\System\RmUnuLg.exe
  C:\Windows\System\RmUnuLg.exe
  2⤵
  PID:9384
- C:\Windows\System\YXHFOJw.exe
  C:\Windows\System\YXHFOJw.exe
  2⤵
  PID:9396
- C:\Windows\System\ydlyLoN.exe
  C:\Windows\System\ydlyLoN.exe
  2⤵
  PID:9504
- C:\Windows\System\ipBCMuq.exe
  C:\Windows\System\ipBCMuq.exe
  2⤵
  PID:10016
- C:\Windows\System\vKOoiJh.exe
  C:\Windows\System\vKOoiJh.exe
  2⤵
  PID:10100
- C:\Windows\System\aWeQRym.exe
  C:\Windows\System\aWeQRym.exe
  2⤵
  PID:10212
- C:\Windows\System\DKxfIPD.exe
  C:\Windows\System\DKxfIPD.exe
  2⤵
  PID:9352
- C:\Windows\System\JNqArJQ.exe
  C:\Windows\System\JNqArJQ.exe
  2⤵
  PID:9992
- C:\Windows\System\ijKbHZx.exe
  C:\Windows\System\ijKbHZx.exe
  2⤵
  PID:9436
- C:\Windows\System\kHBIFAH.exe
  C:\Windows\System\kHBIFAH.exe
  2⤵
  PID:10248
- C:\Windows\System\bCcRzlY.exe
  C:\Windows\System\bCcRzlY.exe
  2⤵
  PID:10280
- C:\Windows\System\eSdczvO.exe
  C:\Windows\System\eSdczvO.exe
  2⤵
  PID:10304
- C:\Windows\System\tHSIAGF.exe
  C:\Windows\System\tHSIAGF.exe
  2⤵
  PID:10348
- C:\Windows\System\wdmwLGs.exe
  C:\Windows\System\wdmwLGs.exe
  2⤵
  PID:10364
- C:\Windows\System\yVxutdA.exe
  C:\Windows\System\yVxutdA.exe
  2⤵
  PID:10392
- C:\Windows\System\uKwrnFR.exe
  C:\Windows\System\uKwrnFR.exe
  2⤵
  PID:10420
- C:\Windows\System\FiJaBwg.exe
  C:\Windows\System\FiJaBwg.exe
  2⤵
  PID:10460
- C:\Windows\System\UPvjLaj.exe
  C:\Windows\System\UPvjLaj.exe
  2⤵
  PID:10480
- C:\Windows\System\rKvLCHu.exe
  C:\Windows\System\rKvLCHu.exe
  2⤵
  PID:10504
- C:\Windows\System\lJhIasS.exe
  C:\Windows\System\lJhIasS.exe
  2⤵
  PID:10528
- C:\Windows\System\lHYipsd.exe
  C:\Windows\System\lHYipsd.exe
  2⤵
  PID:10564
- C:\Windows\System\ylwkDZC.exe
  C:\Windows\System\ylwkDZC.exe
  2⤵
  PID:10612
- C:\Windows\System\EwSAYzQ.exe
  C:\Windows\System\EwSAYzQ.exe
  2⤵
  PID:10628
- C:\Windows\System\wvDoHmg.exe
  C:\Windows\System\wvDoHmg.exe
  2⤵
  PID:10656
- C:\Windows\System\UOOPmsN.exe
  C:\Windows\System\UOOPmsN.exe
  2⤵
  PID:10696
- C:\Windows\System\rKouqgI.exe
  C:\Windows\System\rKouqgI.exe
  2⤵
  PID:10712
- C:\Windows\System\dPzxrJy.exe
  C:\Windows\System\dPzxrJy.exe
  2⤵
  PID:10752
- C:\Windows\System\yThtvcV.exe
  C:\Windows\System\yThtvcV.exe
  2⤵
  PID:10768
- C:\Windows\System\FhdgFeL.exe
  C:\Windows\System\FhdgFeL.exe
  2⤵
  PID:10784
- C:\Windows\System\cTUCTaU.exe
  C:\Windows\System\cTUCTaU.exe
  2⤵
  PID:10808
- C:\Windows\System\yoFCXJo.exe
  C:\Windows\System\yoFCXJo.exe
  2⤵
  PID:10836
- C:\Windows\System\eGlMAMe.exe
  C:\Windows\System\eGlMAMe.exe
  2⤵
  PID:10880
- C:\Windows\System\EWYYFhX.exe
  C:\Windows\System\EWYYFhX.exe
  2⤵
  PID:10920
- C:\Windows\System\mxvJpRv.exe
  C:\Windows\System\mxvJpRv.exe
  2⤵
  PID:10948
- C:\Windows\System\BlHgrTe.exe
  C:\Windows\System\BlHgrTe.exe
  2⤵
  PID:10964
- C:\Windows\System\GQCZhxT.exe
  C:\Windows\System\GQCZhxT.exe
  2⤵
  PID:10988
- C:\Windows\System\VwsanRw.exe
  C:\Windows\System\VwsanRw.exe
  2⤵
  PID:11032
- C:\Windows\System\OfRFswI.exe
  C:\Windows\System\OfRFswI.exe
  2⤵
  PID:11052
- C:\Windows\System\SApJwgK.exe
  C:\Windows\System\SApJwgK.exe
  2⤵
  PID:11072
- C:\Windows\System\nceMJGd.exe
  C:\Windows\System\nceMJGd.exe
  2⤵
  PID:11100
- C:\Windows\System\MOCaVzO.exe
  C:\Windows\System\MOCaVzO.exe
  2⤵
  PID:11128
- C:\Windows\System\AOprtrT.exe
  C:\Windows\System\AOprtrT.exe
  2⤵
  PID:11156
- C:\Windows\System\qsRimzx.exe
  C:\Windows\System\qsRimzx.exe
  2⤵
  PID:11180
- C:\Windows\System\RPVMFht.exe
  C:\Windows\System\RPVMFht.exe
  2⤵
  PID:11220
- C:\Windows\System\wyESUlu.exe
  C:\Windows\System\wyESUlu.exe
  2⤵
  PID:11260
- C:\Windows\System\mxdXPQR.exe
  C:\Windows\System\mxdXPQR.exe
  2⤵
  PID:9492
- C:\Windows\System\cRXOnYD.exe
  C:\Windows\System\cRXOnYD.exe
  2⤵
  PID:10276
- C:\Windows\System\ENcEkrO.exe
  C:\Windows\System\ENcEkrO.exe
  2⤵
  PID:10324
- C:\Windows\System\flJaurY.exe
  C:\Windows\System\flJaurY.exe
  2⤵
  PID:10372
- C:\Windows\System\HltEXuE.exe
  C:\Windows\System\HltEXuE.exe
  2⤵
  PID:10444
- C:\Windows\System\cajTTxf.exe
  C:\Windows\System\cajTTxf.exe
  2⤵
  PID:10524
- C:\Windows\System\aylcnxT.exe
  C:\Windows\System\aylcnxT.exe
  2⤵
  PID:10600
- C:\Windows\System\UYtiBKw.exe
  C:\Windows\System\UYtiBKw.exe
  2⤵
  PID:10640
- C:\Windows\System\XbORitj.exe
  C:\Windows\System\XbORitj.exe
  2⤵
  PID:10800
- C:\Windows\System\thbeaBl.exe
  C:\Windows\System\thbeaBl.exe
  2⤵
  PID:10828
- C:\Windows\System\GEDTTwL.exe
  C:\Windows\System\GEDTTwL.exe
  2⤵
  PID:4424
- C:\Windows\System\BpqTZoi.exe
  C:\Windows\System\BpqTZoi.exe
  2⤵
  PID:10936
- C:\Windows\System\tFdvWte.exe
  C:\Windows\System\tFdvWte.exe
  2⤵
  PID:10984
- C:\Windows\System\sWtIduA.exe
  C:\Windows\System\sWtIduA.exe
  2⤵
  PID:11040
- C:\Windows\System\kjPvrjw.exe
  C:\Windows\System\kjPvrjw.exe
  2⤵
  PID:11168
- C:\Windows\System\GWPsxiq.exe
  C:\Windows\System\GWPsxiq.exe
  2⤵
  PID:11200
- C:\Windows\System\tHrWRZa.exe
  C:\Windows\System\tHrWRZa.exe
  2⤵
  PID:11252
- C:\Windows\System\zxhVyKC.exe
  C:\Windows\System\zxhVyKC.exe
  2⤵
  PID:10596
- C:\Windows\System\sRhjkCm.exe
  C:\Windows\System\sRhjkCm.exe
  2⤵
  PID:10704
- C:\Windows\System\ATCzbvc.exe
  C:\Windows\System\ATCzbvc.exe
  2⤵
  PID:10860
- C:\Windows\System\iQFWSlN.exe
  C:\Windows\System\iQFWSlN.exe
  2⤵
  PID:10916
- C:\Windows\System\gnzfdxv.exe
  C:\Windows\System\gnzfdxv.exe
  2⤵
  PID:11124
- C:\Windows\System\oFiIzES.exe
  C:\Windows\System\oFiIzES.exe
  2⤵
  PID:10244
- C:\Windows\System\jHLGFjH.exe
  C:\Windows\System\jHLGFjH.exe
  2⤵
  PID:10168
- C:\Windows\System\jTYreqT.exe
  C:\Windows\System\jTYreqT.exe
  2⤵
  PID:11060
- C:\Windows\System\eXsBUcK.exe
  C:\Windows\System\eXsBUcK.exe
  2⤵
  PID:10496
- C:\Windows\System\JQEblJf.exe
  C:\Windows\System\JQEblJf.exe
  2⤵
  PID:11268
- C:\Windows\System\ToQJRIg.exe
  C:\Windows\System\ToQJRIg.exe
  2⤵
  PID:11296
- C:\Windows\System\vYRlMxX.exe
  C:\Windows\System\vYRlMxX.exe
  2⤵
  PID:11324
- C:\Windows\System\hwEBoEa.exe
  C:\Windows\System\hwEBoEa.exe
  2⤵
  PID:11364
- C:\Windows\System\jgqdYCc.exe
  C:\Windows\System\jgqdYCc.exe
  2⤵
  PID:11384
- C:\Windows\System\THCCQlX.exe
  C:\Windows\System\THCCQlX.exe
  2⤵
  PID:11408
- C:\Windows\System\IHeeJdz.exe
  C:\Windows\System\IHeeJdz.exe
  2⤵
  PID:11436
- C:\Windows\System\YgJFMVh.exe
  C:\Windows\System\YgJFMVh.exe
  2⤵
  PID:11476
- C:\Windows\System\bnOWVVw.exe
  C:\Windows\System\bnOWVVw.exe
  2⤵
  PID:11492
- C:\Windows\System\seqqFoV.exe
  C:\Windows\System\seqqFoV.exe
  2⤵
  PID:11532
- C:\Windows\System\wgGMvof.exe
  C:\Windows\System\wgGMvof.exe
  2⤵
  PID:11560
- C:\Windows\System\WDnlHru.exe
  C:\Windows\System\WDnlHru.exe
  2⤵
  PID:11588
- C:\Windows\System\SsTvuvd.exe
  C:\Windows\System\SsTvuvd.exe
  2⤵
  PID:11616
- C:\Windows\System\cPKNFzK.exe
  C:\Windows\System\cPKNFzK.exe
  2⤵
  PID:11644
- C:\Windows\System\radWPwQ.exe
  C:\Windows\System\radWPwQ.exe
  2⤵
  PID:11660
- C:\Windows\System\tZldxqh.exe
  C:\Windows\System\tZldxqh.exe
  2⤵
  PID:11684
- C:\Windows\System\FdToQej.exe
  C:\Windows\System\FdToQej.exe
  2⤵
  PID:11728
- C:\Windows\System\ABmxdhb.exe
  C:\Windows\System\ABmxdhb.exe
  2⤵
  PID:11756
- C:\Windows\System\TpjyAPl.exe
  C:\Windows\System\TpjyAPl.exe
  2⤵
  PID:11780
- C:\Windows\System\ZWfOkZa.exe
  C:\Windows\System\ZWfOkZa.exe
  2⤵
  PID:11812
- C:\Windows\System\LyIEaAj.exe
  C:\Windows\System\LyIEaAj.exe
  2⤵
  PID:11836
- C:\Windows\System\VINOZVz.exe
  C:\Windows\System\VINOZVz.exe
  2⤵
  PID:11856
- C:\Windows\System\fMygHbk.exe
  C:\Windows\System\fMygHbk.exe
  2⤵
  PID:11888
- C:\Windows\System\jKeSwFN.exe
  C:\Windows\System\jKeSwFN.exe
  2⤵
  PID:11908
- C:\Windows\System\NuOBpxI.exe
  C:\Windows\System\NuOBpxI.exe
  2⤵
  PID:11932
- C:\Windows\System\KTZvJOc.exe
  C:\Windows\System\KTZvJOc.exe
  2⤵
  PID:11976
- C:\Windows\System\quoUrob.exe
  C:\Windows\System\quoUrob.exe
  2⤵
  PID:12008
- C:\Windows\System\vgUIJZE.exe
  C:\Windows\System\vgUIJZE.exe
  2⤵
  PID:12036
- C:\Windows\System\AUPnMik.exe
  C:\Windows\System\AUPnMik.exe
  2⤵
  PID:12056
- C:\Windows\System\ZuZQOim.exe
  C:\Windows\System\ZuZQOim.exe
  2⤵
  PID:12092
- C:\Windows\System\OdXusNo.exe
  C:\Windows\System\OdXusNo.exe
  2⤵
  PID:12116
- C:\Windows\System\mlOQAhM.exe
  C:\Windows\System\mlOQAhM.exe
  2⤵
  PID:12148
- C:\Windows\System\rvzmaHg.exe
  C:\Windows\System\rvzmaHg.exe
  2⤵
  PID:12176
- C:\Windows\System\StFBgIK.exe
  C:\Windows\System\StFBgIK.exe
  2⤵
  PID:12216
- C:\Windows\System\HJxUczA.exe
  C:\Windows\System\HJxUczA.exe
  2⤵
  PID:12232
- C:\Windows\System\JwXLFqt.exe
  C:\Windows\System\JwXLFqt.exe
  2⤵
  PID:12260
- C:\Windows\System\sYRzIQa.exe
  C:\Windows\System\sYRzIQa.exe
  2⤵
  PID:11028
- C:\Windows\System\ItiKihu.exe
  C:\Windows\System\ItiKihu.exe
  2⤵
  PID:11288
- C:\Windows\System\GZupTiD.exe
  C:\Windows\System\GZupTiD.exe
  2⤵
  PID:11360
- C:\Windows\System\qJndbal.exe
  C:\Windows\System\qJndbal.exe
  2⤵
  PID:11404
- C:\Windows\System\zcbkkqY.exe
  C:\Windows\System\zcbkkqY.exe
  2⤵
  PID:11456
- C:\Windows\System\NSVRtwu.exe
  C:\Windows\System\NSVRtwu.exe
  2⤵
  PID:11556
- C:\Windows\System\ZQSLxRz.exe
  C:\Windows\System\ZQSLxRz.exe
  2⤵
  PID:11632
- C:\Windows\System\WorfnCS.exe
  C:\Windows\System\WorfnCS.exe
  2⤵
  PID:11652
- C:\Windows\System\CnbTvao.exe
  C:\Windows\System\CnbTvao.exe
  2⤵
  PID:11724
- C:\Windows\System\rawUOjC.exe
  C:\Windows\System\rawUOjC.exe
  2⤵
  PID:11796
- C:\Windows\System\zkKHpuJ.exe
  C:\Windows\System\zkKHpuJ.exe
  2⤵
  PID:11924
- C:\Windows\System\IgktupF.exe
  C:\Windows\System\IgktupF.exe
  2⤵
  PID:11996
- C:\Windows\System\pnnSXpq.exe
  C:\Windows\System\pnnSXpq.exe
  2⤵
  PID:12028
- C:\Windows\System\hqndaEn.exe
  C:\Windows\System\hqndaEn.exe
  2⤵
  PID:12080
- C:\Windows\System\oBYvJLp.exe
  C:\Windows\System\oBYvJLp.exe
  2⤵
  PID:12140
- C:\Windows\System\NPWOopj.exe
  C:\Windows\System\NPWOopj.exe
  2⤵
  PID:12200
- C:\Windows\System\uxtgcsx.exe
  C:\Windows\System\uxtgcsx.exe
  2⤵
  PID:12248
- C:\Windows\System\woGrTRh.exe
  C:\Windows\System\woGrTRh.exe
  2⤵
  PID:11484
- C:\Windows\System\UGFMfKw.exe
  C:\Windows\System\UGFMfKw.exe
  2⤵
  PID:11528
- C:\Windows\System\wZWZMBw.exe
  C:\Windows\System\wZWZMBw.exe
  2⤵
  PID:11604
- C:\Windows\System\MgkJrWq.exe
  C:\Windows\System\MgkJrWq.exe
  2⤵
  PID:11880
- C:\Windows\System\EEXpvaR.exe
  C:\Windows\System\EEXpvaR.exe
  2⤵
  PID:11872
- C:\Windows\System\cYkzaZR.exe
  C:\Windows\System\cYkzaZR.exe
  2⤵
  PID:12044
- C:\Windows\System\cazxqMd.exe
  C:\Windows\System\cazxqMd.exe
  2⤵
  PID:12244
- C:\Windows\System\NPglKbB.exe
  C:\Windows\System\NPglKbB.exe
  2⤵
  PID:11420
- C:\Windows\System\TqVIRyO.exe
  C:\Windows\System\TqVIRyO.exe
  2⤵
  PID:11820
- C:\Windows\System\OuxCSsc.exe
  C:\Windows\System\OuxCSsc.exe
  2⤵
  PID:12020
- C:\Windows\System\oMXGWFL.exe
  C:\Windows\System\oMXGWFL.exe
  2⤵
  PID:11628
- C:\Windows\System\XocYawZ.exe
  C:\Windows\System\XocYawZ.exe
  2⤵
  PID:12308
- C:\Windows\System\dlBFNUi.exe
  C:\Windows\System\dlBFNUi.exe
  2⤵
  PID:12356
- C:\Windows\System\dANTUnx.exe
  C:\Windows\System\dANTUnx.exe
  2⤵
  PID:12372
- C:\Windows\System\dQLWEmB.exe
  C:\Windows\System\dQLWEmB.exe
  2⤵
  PID:12396
- C:\Windows\System\HosZWWs.exe
  C:\Windows\System\HosZWWs.exe
  2⤵
  PID:12424
- C:\Windows\System\IanPhiq.exe
  C:\Windows\System\IanPhiq.exe
  2⤵
  PID:12452
- C:\Windows\System\FzodnWb.exe
  C:\Windows\System\FzodnWb.exe
  2⤵
  PID:12484
- C:\Windows\System\SllMBCE.exe
  C:\Windows\System\SllMBCE.exe
  2⤵
  PID:12500
- C:\Windows\System\awPHuXM.exe
  C:\Windows\System\awPHuXM.exe
  2⤵
  PID:12524
- C:\Windows\System\BzJgLaz.exe
  C:\Windows\System\BzJgLaz.exe
  2⤵
  PID:12572
- C:\Windows\System\MyZlvHp.exe
  C:\Windows\System\MyZlvHp.exe
  2⤵
  PID:12592
- C:\Windows\System\PJqorOB.exe
  C:\Windows\System\PJqorOB.exe
  2⤵
  PID:12612
- C:\Windows\System\SytpCif.exe
  C:\Windows\System\SytpCif.exe
  2⤵
  PID:12640
- C:\Windows\System\TGVvGmR.exe
  C:\Windows\System\TGVvGmR.exe
  2⤵
  PID:12660
- C:\Windows\System\isAzxyW.exe
  C:\Windows\System\isAzxyW.exe
  2⤵
  PID:12688
- C:\Windows\System\FYRWbPp.exe
  C:\Windows\System\FYRWbPp.exe
  2⤵
  PID:12712
- C:\Windows\System\LgOJnFH.exe
  C:\Windows\System\LgOJnFH.exe
  2⤵
  PID:12756
- C:\Windows\System\hgdgnFd.exe
  C:\Windows\System\hgdgnFd.exe
  2⤵
  PID:12772
- C:\Windows\System\BqDWXvt.exe
  C:\Windows\System\BqDWXvt.exe
  2⤵
  PID:12800
- C:\Windows\System\itiRYzj.exe
  C:\Windows\System\itiRYzj.exe
  2⤵
  PID:12848
- C:\Windows\System\vvQSuac.exe
  C:\Windows\System\vvQSuac.exe
  2⤵
  PID:12864
- C:\Windows\System\wNtfaEt.exe
  C:\Windows\System\wNtfaEt.exe
  2⤵
  PID:12904
- C:\Windows\System\wVRemzv.exe
  C:\Windows\System\wVRemzv.exe
  2⤵
  PID:12920
- C:\Windows\System\kPXmuxH.exe
  C:\Windows\System\kPXmuxH.exe
  2⤵
  PID:12952
- C:\Windows\System\FYqTKQK.exe
  C:\Windows\System\FYqTKQK.exe
  2⤵
  PID:13000
- C:\Windows\System\cNgrgmg.exe
  C:\Windows\System\cNgrgmg.exe
  2⤵
  PID:13028
- C:\Windows\System\pidjuRW.exe
  C:\Windows\System\pidjuRW.exe
  2⤵
  PID:13056
- C:\Windows\System\RLbNhem.exe
  C:\Windows\System\RLbNhem.exe
  2⤵
  PID:13084
- C:\Windows\System\dcAoQAn.exe
  C:\Windows\System\dcAoQAn.exe
  2⤵
  PID:13100
- C:\Windows\System\ZzrhCYT.exe
  C:\Windows\System\ZzrhCYT.exe
  2⤵
  PID:13140
- C:\Windows\System\rTmMzAh.exe
  C:\Windows\System\rTmMzAh.exe
  2⤵
  PID:13156
- C:\Windows\System\iBPiwLs.exe
  C:\Windows\System\iBPiwLs.exe
  2⤵
  PID:13176
- C:\Windows\System\vXTlnjm.exe
  C:\Windows\System\vXTlnjm.exe
  2⤵
  PID:13204
- C:\Windows\System\kwzKKIm.exe
  C:\Windows\System\kwzKKIm.exe
  2⤵
  PID:13228
- C:\Windows\System\cqVFYrj.exe
  C:\Windows\System\cqVFYrj.exe
  2⤵
  PID:13272
- C:\Windows\System\RKXRvnh.exe
  C:\Windows\System\RKXRvnh.exe
  2⤵
  PID:13292
- C:\Windows\System\isIVBwl.exe
  C:\Windows\System\isIVBwl.exe
  2⤵
  PID:12296
- C:\Windows\System\njVRZCN.exe
  C:\Windows\System\njVRZCN.exe
  2⤵
  PID:12364
- C:\Windows\System\UfVRyeg.exe
  C:\Windows\System\UfVRyeg.exe
  2⤵
  PID:12412
- C:\Windows\System\wMTLgRZ.exe
  C:\Windows\System\wMTLgRZ.exe
  2⤵
  PID:12472
- C:\Windows\System\erpCugq.exe
  C:\Windows\System\erpCugq.exe
  2⤵
  PID:12512
- C:\Windows\System\UqneDAn.exe
  C:\Windows\System\UqneDAn.exe
  2⤵
  PID:12604
- C:\Windows\System\mCzKFgY.exe
  C:\Windows\System\mCzKFgY.exe
  2⤵
  PID:12624
- C:\Windows\System\FGkNyjV.exe
  C:\Windows\System\FGkNyjV.exe
  2⤵
  PID:12676
- C:\Windows\System\GeqxcTj.exe
  C:\Windows\System\GeqxcTj.exe
  2⤵
  PID:12768
- C:\Windows\System\MuOmbEu.exe
  C:\Windows\System\MuOmbEu.exe
  2⤵
  PID:12856
- C:\Windows\System\QygWPpj.exe
  C:\Windows\System\QygWPpj.exe
  2⤵
  PID:12932
- C:\Windows\System\hTqYOZg.exe
  C:\Windows\System\hTqYOZg.exe
  2⤵
  PID:12960
- C:\Windows\System\CGhOLVa.exe
  C:\Windows\System\CGhOLVa.exe
  2⤵
  PID:12996
- C:\Windows\System\TMvCSHP.exe
  C:\Windows\System\TMvCSHP.exe
  2⤵
  PID:13072
- C:\Windows\System\ionfIlG.exe
  C:\Windows\System\ionfIlG.exe
  2⤵
  PID:13148
- C:\Windows\System\uVmqtzN.exe
  C:\Windows\System\uVmqtzN.exe
  2⤵
  PID:13164
- C:\Windows\System\MSagXxM.exe
  C:\Windows\System\MSagXxM.exe
  2⤵
  PID:13252
- C:\Windows\System\oVAmfxC.exe
  C:\Windows\System\oVAmfxC.exe
  2⤵
  PID:12516
- C:\Windows\System\FtaXPRW.exe
  C:\Windows\System\FtaXPRW.exe
  2⤵
  PID:12600
- C:\Windows\System\ALDsKzf.exe
  C:\Windows\System\ALDsKzf.exe
  2⤵
  PID:12696
- C:\Windows\System\owBIVse.exe
  C:\Windows\System\owBIVse.exe
  2⤵
  PID:12884
- C:\Windows\System\uelAmzu.exe
  C:\Windows\System\uelAmzu.exe
  2⤵
  PID:12948
- C:\Windows\System\VTjwopK.exe
  C:\Windows\System\VTjwopK.exe
  2⤵
  PID:13188
- C:\Windows\System\huZxODL.exe
  C:\Windows\System\huZxODL.exe
  2⤵
  PID:11656
- C:\Windows\System\CXNOXfZ.exe
  C:\Windows\System\CXNOXfZ.exe
  2⤵
  PID:12656
- C:\Windows\System\KtDxKyw.exe
  C:\Windows\System\KtDxKyw.exe
  2⤵
  PID:13068
- C:\Windows\System\VFHQoZN.exe
  C:\Windows\System\VFHQoZN.exe
  2⤵
  PID:13044
- C:\Windows\System\lPSmRPy.exe
  C:\Windows\System\lPSmRPy.exe
  2⤵
  PID:12316
- C:\Windows\System\KNDCOeg.exe
  C:\Windows\System\KNDCOeg.exe
  2⤵
  PID:13328
- C:\Windows\System\nHcXtwQ.exe
  C:\Windows\System\nHcXtwQ.exe
  2⤵
  PID:13364
- C:\Windows\System\irpHtJZ.exe
  C:\Windows\System\irpHtJZ.exe
  2⤵
  PID:13392
- C:\Windows\System\GTNBYvz.exe
  C:\Windows\System\GTNBYvz.exe
  2⤵
  PID:13412
- C:\Windows\System\frSyFjB.exe
  C:\Windows\System\frSyFjB.exe
  2⤵
  PID:13432
- C:\Windows\System\AzXILzM.exe
  C:\Windows\System\AzXILzM.exe
  2⤵
  PID:13480
- C:\Windows\System\DyMiPWn.exe
  C:\Windows\System\DyMiPWn.exe
  2⤵
  PID:13508
- C:\Windows\System\ztBGLHx.exe
  C:\Windows\System\ztBGLHx.exe
  2⤵
  PID:13532
- C:\Windows\System\muVlKYQ.exe
  C:\Windows\System\muVlKYQ.exe
  2⤵
  PID:13552
- C:\Windows\System\XkCARLU.exe
  C:\Windows\System\XkCARLU.exe
  2⤵
  PID:13592
- C:\Windows\System\aAEBFzZ.exe
  C:\Windows\System\aAEBFzZ.exe
  2⤵
  PID:13608
- C:\Windows\System\IYaUyEc.exe
  C:\Windows\System\IYaUyEc.exe
  2⤵
  PID:13624
- C:\Windows\System\VOcfImj.exe
  C:\Windows\System\VOcfImj.exe
  2⤵
  PID:13668
- C:\Windows\System\QEkhJSK.exe
  C:\Windows\System\QEkhJSK.exe
  2⤵
  PID:13704
- C:\Windows\System\OmFcnKM.exe
  C:\Windows\System\OmFcnKM.exe
  2⤵
  PID:13720
- C:\Windows\System\oCUefoO.exe
  C:\Windows\System\oCUefoO.exe
  2⤵
  PID:13748
- C:\Windows\System\qkDgOqn.exe
  C:\Windows\System\qkDgOqn.exe
  2⤵
  PID:13772
- C:\Windows\System\bwFVBjg.exe
  C:\Windows\System\bwFVBjg.exe
  2⤵
  PID:13796
- C:\Windows\System\DyGeEMn.exe
  C:\Windows\System\DyGeEMn.exe
  2⤵
  PID:13816
- C:\Windows\System\ZdjJnZT.exe
  C:\Windows\System\ZdjJnZT.exe
  2⤵
  PID:13840
- C:\Windows\System\ubgYDzS.exe
  C:\Windows\System\ubgYDzS.exe
  2⤵
  PID:13860
- C:\Windows\System\CpCwkgh.exe
  C:\Windows\System\CpCwkgh.exe
  2⤵
  PID:13896
- C:\Windows\System\dvnztKT.exe
  C:\Windows\System\dvnztKT.exe
  2⤵
  PID:13912
- C:\Windows\System\bnAJJjI.exe
  C:\Windows\System\bnAJJjI.exe
  2⤵
  PID:13936
- C:\Windows\System\SdYfiWc.exe
  C:\Windows\System\SdYfiWc.exe
  2⤵
  PID:13952
- C:\Windows\System\dbipXVB.exe
  C:\Windows\System\dbipXVB.exe
  2⤵
  PID:14000
- C:\Windows\System\QQuSjiS.exe
  C:\Windows\System\QQuSjiS.exe
  2⤵
  PID:14028
- C:\Windows\System\JjEoVCh.exe
  C:\Windows\System\JjEoVCh.exe
  2⤵
  PID:14044
- C:\Windows\System\YGChxWZ.exe
  C:\Windows\System\YGChxWZ.exe
  2⤵
  PID:14072
- C:\Windows\System\vHVagWt.exe
  C:\Windows\System\vHVagWt.exe
  2⤵
  PID:14132
- C:\Windows\System\BOMleXW.exe
  C:\Windows\System\BOMleXW.exe
  2⤵
  PID:14160
- C:\Windows\System\pPZpZBi.exe
  C:\Windows\System\pPZpZBi.exe
  2⤵
  PID:14196
- C:\Windows\System\REAPOmF.exe
  C:\Windows\System\REAPOmF.exe
  2⤵
  PID:14216
- C:\Windows\System\zgfMHzj.exe
  C:\Windows\System\zgfMHzj.exe
  2⤵
  PID:14240
- C:\Windows\System\hGOeWfF.exe
  C:\Windows\System\hGOeWfF.exe
  2⤵
  PID:14272
- C:\Windows\System\jsBZwXu.exe
  C:\Windows\System\jsBZwXu.exe
  2⤵
  PID:14300
- C:\Windows\System\DTcniFS.exe
  C:\Windows\System\DTcniFS.exe
  2⤵
  PID:14324
- C:\Windows\System\ZMDvBzu.exe
  C:\Windows\System\ZMDvBzu.exe
  2⤵
  PID:13340
- C:\Windows\System\qhOrUBq.exe
  C:\Windows\System\qhOrUBq.exe
  2⤵
  PID:13452
- C:\Windows\System\QRrhakb.exe
  C:\Windows\System\QRrhakb.exe
  2⤵
  PID:13496
- C:\Windows\System\jjwhchs.exe
  C:\Windows\System\jjwhchs.exe
  2⤵
  PID:13588
- C:\Windows\System\VIfRVal.exe
  C:\Windows\System\VIfRVal.exe
  2⤵
  PID:13616
- C:\Windows\System\XzIolAs.exe
  C:\Windows\System\XzIolAs.exe
  2⤵
  PID:13688
- C:\Windows\System\klcEBud.exe
  C:\Windows\System\klcEBud.exe
  2⤵
  PID:13740
- C:\Windows\System\IEoODpT.exe
  C:\Windows\System\IEoODpT.exe
  2⤵
  PID:13832
- C:\Windows\System\ONlMaKw.exe
  C:\Windows\System\ONlMaKw.exe
  2⤵
  PID:13924
- C:\Windows\System\DkcrsbF.exe
  C:\Windows\System\DkcrsbF.exe
  2⤵
  PID:13992
- C:\Windows\System\xoDiYKU.exe
  C:\Windows\System\xoDiYKU.exe
  2⤵
  PID:14084
- C:\Windows\System\AyhHdkK.exe
  C:\Windows\System\AyhHdkK.exe
  2⤵
  PID:14112
- C:\Windows\System\eeYLVcn.exe
  C:\Windows\System\eeYLVcn.exe
  2⤵
  PID:14124
- C:\Windows\System\QtejxYs.exe
  C:\Windows\System\QtejxYs.exe
  2⤵
  PID:14236
- C:\Windows\System\JjsTmII.exe
  C:\Windows\System\JjsTmII.exe
  2⤵
  PID:14288
- C:\Windows\System\tFQAzzR.exe
  C:\Windows\System\tFQAzzR.exe
  2⤵
  PID:13052
- C:\Windows\System\owbIoCh.exe
  C:\Windows\System\owbIoCh.exe
  2⤵
  PID:13544
- C:\Windows\System\vGhFfrP.exe
  C:\Windows\System\vGhFfrP.exe
  2⤵
  PID:13716
- C:\Windows\System\PUMfKbh.exe
  C:\Windows\System\PUMfKbh.exe
  2⤵
  PID:13784
- C:\Windows\System\uEsAHdi.exe
  C:\Windows\System\uEsAHdi.exe
  2⤵
  PID:13920
- C:\Windows\System\kpWscrS.exe
  C:\Windows\System\kpWscrS.exe
  2⤵
  PID:14008
- C:\Windows\System\plSMnaG.exe
  C:\Windows\System\plSMnaG.exe
  2⤵
  PID:14140
- C:\Windows\System\zGJbyTa.exe
  C:\Windows\System\zGJbyTa.exe
  2⤵
  PID:14292
- C:\Windows\System\VXnHwbD.exe
  C:\Windows\System\VXnHwbD.exe
  2⤵
  PID:13640
- C:\Windows\System\YSduwyj.exe
  C:\Windows\System\YSduwyj.exe
  2⤵
  PID:13908
- C:\Windows\System\aYkfCxu.exe
  C:\Windows\System\aYkfCxu.exe
  2⤵
  PID:13500
- C:\Windows\System\VJSmNZk.exe
  C:\Windows\System\VJSmNZk.exe
  2⤵
  PID:14344
- C:\Windows\System\rejulyr.exe
  C:\Windows\System\rejulyr.exe
  2⤵
  PID:14380
- C:\Windows\System\HJhqEuz.exe
  C:\Windows\System\HJhqEuz.exe
  2⤵
  PID:14420
- C:\Windows\System\mUOoLVX.exe
  C:\Windows\System\mUOoLVX.exe
  2⤵
  PID:14448
- C:\Windows\System\UkcWWWa.exe
  C:\Windows\System\UkcWWWa.exe
  2⤵
  PID:14464
- C:\Windows\System\BpQFpcd.exe
  C:\Windows\System\BpQFpcd.exe
  2⤵
  PID:14488
- C:\Windows\System\kTkMOwn.exe
  C:\Windows\System\kTkMOwn.exe
  2⤵
  PID:14516
- C:\Windows\System\CbGJntm.exe
  C:\Windows\System\CbGJntm.exe
  2⤵
  PID:14536
- C:\Windows\System\LMlMuEE.exe
  C:\Windows\System\LMlMuEE.exe
  2⤵
  PID:14564
- C:\Windows\System\jIaZVQY.exe
  C:\Windows\System\jIaZVQY.exe
  2⤵
  PID:14584
- C:\Windows\System\mCBlyfO.exe
  C:\Windows\System\mCBlyfO.exe
  2⤵
  PID:14624
- C:\Windows\System\wMzycUo.exe
  C:\Windows\System\wMzycUo.exe
  2⤵
  PID:14660
- C:\Windows\System\GflGwEQ.exe
  C:\Windows\System\GflGwEQ.exe
  2⤵
  PID:14684
- C:\Windows\System\ntXAPyB.exe
  C:\Windows\System\ntXAPyB.exe
  2⤵
  PID:14708
- C:\Windows\System\ZZPDoiZ.exe
  C:\Windows\System\ZZPDoiZ.exe
  2⤵
  PID:14752
- C:\Windows\System\rhsMkCu.exe
  C:\Windows\System\rhsMkCu.exe
  2⤵
  PID:14780
- C:\Windows\System\qmPinJq.exe
  C:\Windows\System\qmPinJq.exe
  2⤵
  PID:14804
- C:\Windows\System\HAmcESj.exe
  C:\Windows\System\HAmcESj.exe
  2⤵
  PID:14832
- C:\Windows\System\SRYkpze.exe
  C:\Windows\System\SRYkpze.exe
  2⤵
  PID:14860
- C:\Windows\System\EJxJJxS.exe
  C:\Windows\System\EJxJJxS.exe
  2⤵
  PID:14888
- C:\Windows\System\ceFHBVI.exe
  C:\Windows\System\ceFHBVI.exe
  2⤵
  PID:14916
- C:\Windows\System\UZMGOiG.exe
  C:\Windows\System\UZMGOiG.exe
  2⤵
  PID:14932
- C:\Windows\System\jYrYrdb.exe
  C:\Windows\System\jYrYrdb.exe
  2⤵
  PID:14984
- C:\Windows\System\rWLZOHr.exe
  C:\Windows\System\rWLZOHr.exe
  2⤵
  PID:15008
- C:\Windows\System\KiJAVFz.exe
  C:\Windows\System\KiJAVFz.exe
  2⤵
  PID:15028
- C:\Windows\System\coAIpSe.exe
  C:\Windows\System\coAIpSe.exe
  2⤵
  PID:15048
- C:\Windows\System\mGBBJWm.exe
  C:\Windows\System\mGBBJWm.exe
  2⤵
  PID:15076
- C:\Windows\System\RRTAQXB.exe
  C:\Windows\System\RRTAQXB.exe
  2⤵
  PID:15104
- C:\Windows\System\NvEFQkT.exe
  C:\Windows\System\NvEFQkT.exe
  2⤵
  PID:15124
- C:\Windows\System\TSMBwEc.exe
  C:\Windows\System\TSMBwEc.exe
  2⤵
  PID:15148
- C:\Windows\System\AxfzmwW.exe
  C:\Windows\System\AxfzmwW.exe
  2⤵
  PID:15168
- C:\Windows\System\YyQfXbo.exe
  C:\Windows\System\YyQfXbo.exe
  2⤵
  PID:15212
- C:\Windows\System\eAerUYH.exe
  C:\Windows\System\eAerUYH.exe
  2⤵
  PID:15244
- C:\Windows\System\sNoupEU.exe
  C:\Windows\System\sNoupEU.exe
  2⤵
  PID:15280
- C:\Windows\System\sROcvML.exe
  C:\Windows\System\sROcvML.exe
  2⤵
  PID:15300
- C:\Windows\System\JUuWxVo.exe
  C:\Windows\System\JUuWxVo.exe
  2⤵
  PID:15348
- C:\Windows\System\lfFjYZr.exe
  C:\Windows\System\lfFjYZr.exe
  2⤵
  PID:13644
- C:\Windows\System\fwsZJnJ.exe
  C:\Windows\System\fwsZJnJ.exe
  2⤵
  PID:13944
- C:\Windows\System\KTmezVM.exe
  C:\Windows\System\KTmezVM.exe
  2⤵
  PID:14392
- C:\Windows\System\OAtzhTQ.exe
  C:\Windows\System\OAtzhTQ.exe
  2⤵
  PID:14432
- C:\Windows\System\TRjbWgA.exe
  C:\Windows\System\TRjbWgA.exe
  2⤵
  PID:14552
- C:\Windows\System\IICuhAq.exe
  C:\Windows\System\IICuhAq.exe
  2⤵
  PID:14616
- C:\Windows\System\yGRRdjD.exe
  C:\Windows\System\yGRRdjD.exe
  2⤵
  PID:14640
- C:\Windows\System\uPRCPNN.exe
  C:\Windows\System\uPRCPNN.exe
  2⤵
  PID:14728
- C:\Windows\System\xJKNGbs.exe
  C:\Windows\System\xJKNGbs.exe
  2⤵
  PID:14768
- C:\Windows\System\CIzYasa.exe
  C:\Windows\System\CIzYasa.exe
  2⤵
  PID:14820
- C:\Windows\System\WfQueJN.exe
  C:\Windows\System\WfQueJN.exe
  2⤵
  PID:14900
- C:\Windows\System\OvuVBfP.exe
  C:\Windows\System\OvuVBfP.exe
  2⤵
  PID:14908
- C:\Windows\System\RQdMXcL.exe
  C:\Windows\System\RQdMXcL.exe
  2⤵
  PID:15068
- C:\Windows\System\Xybfupe.exe
  C:\Windows\System\Xybfupe.exe
  2⤵
  PID:15092
- C:\Windows\System\FZwPvkc.exe
  C:\Windows\System\FZwPvkc.exe
  2⤵
  PID:15204
- C:\Windows\System\khyqjTl.exe
  C:\Windows\System\khyqjTl.exe
  2⤵
  PID:15264
- C:\Windows\System\lSoGOzT.exe
  C:\Windows\System\lSoGOzT.exe
  2⤵
  PID:15340
- C:\Windows\System\VzSDIOd.exe
  C:\Windows\System\VzSDIOd.exe
  2⤵
  PID:14340
- C:\Windows\System\TOqbNXO.exe
  C:\Windows\System\TOqbNXO.exe
  2⤵
  PID:14416
- C:\Windows\System\OHJbqUx.exe
  C:\Windows\System\OHJbqUx.exe
  2⤵
  PID:14788
- C:\Windows\System\JwJmHjt.exe
  C:\Windows\System\JwJmHjt.exe
  2⤵
  PID:14212
- C:\Windows\System\FJNHsVu.exe
  C:\Windows\System\FJNHsVu.exe
  2⤵
  PID:15044
- C:\Windows\System\QcZfpVX.exe
  C:\Windows\System\QcZfpVX.exe
  2⤵
  PID:15224
- C:\Windows\System\slRIWMQ.exe
  C:\Windows\System\slRIWMQ.exe
  2⤵
  PID:15308
- C:\Windows\System\DDAaAvw.exe
  C:\Windows\System\DDAaAvw.exe
  2⤵
  PID:14668
- C:\Windows\System\oQxbbcs.exe
  C:\Windows\System\oQxbbcs.exe
  2⤵
  PID:15004
- C:\Windows\System\ltnezfZ.exe
  C:\Windows\System\ltnezfZ.exe
  2⤵
  PID:14544
- C:\Windows\System\kpzYQjf.exe
  C:\Windows\System\kpzYQjf.exe
  2⤵
  PID:14040
- C:\Windows\System\wFtWWYL.exe
  C:\Windows\System\wFtWWYL.exe
  2⤵
  PID:15364
- C:\Windows\System\IDewbpa.exe
  C:\Windows\System\IDewbpa.exe
  2⤵
  PID:15392
- C:\Windows\System\BYADmih.exe
  C:\Windows\System\BYADmih.exe
  2⤵
  PID:15408
- C:\Windows\System\Zzawewb.exe
  C:\Windows\System\Zzawewb.exe
  2⤵
  PID:15436
- C:\Windows\System\DNFAMIV.exe
  C:\Windows\System\DNFAMIV.exe
  2⤵
  PID:15464
- C:\Windows\System\raKdSKv.exe
  C:\Windows\System\raKdSKv.exe
  2⤵
  PID:15508
- C:\Windows\System\nOxoGfB.exe
  C:\Windows\System\nOxoGfB.exe
  2⤵
  PID:15544
- C:\Windows\System\SYvhiaa.exe
  C:\Windows\System\SYvhiaa.exe
  2⤵
  PID:15568
- C:\Windows\System\GlNRebi.exe
  C:\Windows\System\GlNRebi.exe
  2⤵
  PID:15592
- C:\Windows\System\tDonPXd.exe
  C:\Windows\System\tDonPXd.exe
  2⤵
  PID:15628
- C:\Windows\System\icqUyVQ.exe
  C:\Windows\System\icqUyVQ.exe
  2⤵
  PID:15644
- C:\Windows\System\NfGtEhA.exe
  C:\Windows\System\NfGtEhA.exe
  2⤵
  PID:15668
- C:\Windows\System\qXWuNbL.exe
  C:\Windows\System\qXWuNbL.exe
  2⤵
  PID:15692
- C:\Windows\System\dTlRDrZ.exe
  C:\Windows\System\dTlRDrZ.exe
  2⤵
  PID:15740
- C:\Windows\System\RgOJlnL.exe
  C:\Windows\System\RgOJlnL.exe
  2⤵
  PID:15768
- C:\Windows\System\dgytrzw.exe
  C:\Windows\System\dgytrzw.exe
  2⤵
  PID:15796
- C:\Windows\System\fhzmwro.exe
  C:\Windows\System\fhzmwro.exe
  2⤵
  PID:15812
- C:\Windows\System\IlbidUf.exe
  C:\Windows\System\IlbidUf.exe
  2⤵
  PID:15828
- C:\Windows\System\zSpclTh.exe
  C:\Windows\System\zSpclTh.exe
  2⤵
  PID:15864
- C:\Windows\System\ImhIUfk.exe
  C:\Windows\System\ImhIUfk.exe
  2⤵
  PID:15900
- C:\Windows\System\wPabXHp.exe
  C:\Windows\System\wPabXHp.exe
  2⤵
  PID:15924
- C:\Windows\System\SiwYFRB.exe
  C:\Windows\System\SiwYFRB.exe
  2⤵
  PID:15956
- C:\Windows\System\ApPwDOD.exe
  C:\Windows\System\ApPwDOD.exe
  2⤵
  PID:15984
- C:\Windows\System\aNFATvz.exe
  C:\Windows\System\aNFATvz.exe
  2⤵
  PID:16004
- C:\Windows\System\MfHOyDI.exe
  C:\Windows\System\MfHOyDI.exe
  2⤵
  PID:16020
- C:\Windows\System\MbSUzto.exe
  C:\Windows\System\MbSUzto.exe
  2⤵
  PID:16088
- C:\Windows\System\oSHueeH.exe
  C:\Windows\System\oSHueeH.exe
  2⤵
  PID:16108
- C:\Windows\System\asJduBe.exe
  C:\Windows\System\asJduBe.exe
  2⤵
  PID:16132
- C:\Windows\System\PUlraIe.exe
  C:\Windows\System\PUlraIe.exe
  2⤵
  PID:16172
- C:\Windows\System\lhClDsy.exe
  C:\Windows\System\lhClDsy.exe
  2⤵
  PID:16188
- C:\Windows\System\NKdvuTd.exe
  C:\Windows\System\NKdvuTd.exe
  2⤵
  PID:16208
- C:\Windows\System\wXqCgHB.exe
  C:\Windows\System\wXqCgHB.exe
  2⤵
  PID:16232
- C:\Windows\System\XkEcwzd.exe
  C:\Windows\System\XkEcwzd.exe
  2⤵
  PID:16272
- C:\Windows\System\LflePMT.exe
  C:\Windows\System\LflePMT.exe
  2⤵
  PID:16292
- C:\Windows\System\WKiCPgg.exe
  C:\Windows\System\WKiCPgg.exe
  2⤵
  PID:16312
- C:\Windows\System\bRDuxLF.exe
  C:\Windows\System\bRDuxLF.exe
  2⤵
  PID:16340
- C:\Windows\System\deMyjPE.exe
  C:\Windows\System\deMyjPE.exe
  2⤵
  PID:16372
- C:\Windows\System\aXoiBti.exe
  C:\Windows\System\aXoiBti.exe
  2⤵
  PID:15380
- C:\Windows\System\eZxAOcd.exe
  C:\Windows\System\eZxAOcd.exe
  2⤵
  PID:15388
- C:\Windows\System\CjbYBoe.exe
  C:\Windows\System\CjbYBoe.exe
  2⤵
  PID:15480
- C:\Windows\System\msIUyRu.exe
  C:\Windows\System\msIUyRu.exe
  2⤵
  PID:15556
- C:\Windows\System\nxZtZFI.exe
  C:\Windows\System\nxZtZFI.exe
  2⤵
  PID:15652
- C:\Windows\System\xtFSdiZ.exe
  C:\Windows\System\xtFSdiZ.exe
  2⤵
  PID:15712
- C:\Windows\System\xxmstKc.exe
  C:\Windows\System\xxmstKc.exe
  2⤵
  PID:15804
- C:\Windows\System\UdeIjQw.exe
  C:\Windows\System\UdeIjQw.exe
  2⤵
  PID:15856
- C:\Windows\System\bXeRTYH.exe
  C:\Windows\System\bXeRTYH.exe
  2⤵
  PID:15908
- C:\Windows\System\VMDDTRf.exe
  C:\Windows\System\VMDDTRf.exe
  2⤵
  PID:15968
- C:\Windows\System\XPLNIeB.exe
  C:\Windows\System\XPLNIeB.exe
  2⤵
  PID:16016
- C:\Windows\System\gaSFjTM.exe
  C:\Windows\System\gaSFjTM.exe
  2⤵
  PID:16116
- C:\Windows\System\XvHYvZC.exe
  C:\Windows\System\XvHYvZC.exe
  2⤵
  PID:16204
- C:\Windows\System\GJWwkDV.exe
  C:\Windows\System\GJWwkDV.exe
  2⤵
  PID:16324
- C:\Windows\System\QUtRCQc.exe
  C:\Windows\System\QUtRCQc.exe
  2⤵
  PID:16304
- C:\Windows\System\OdOvAFy.exe
  C:\Windows\System\OdOvAFy.exe
  2⤵
  PID:16336
- C:\Windows\System\YvYXiZC.exe
  C:\Windows\System\YvYXiZC.exe
  2⤵
  PID:15276
- C:\Windows\System\NmgFAEi.exe
  C:\Windows\System\NmgFAEi.exe
  2⤵
  PID:15536
- C:\Windows\System\iUYMojj.exe
  C:\Windows\System\iUYMojj.exe
  2⤵
  PID:15760
- C:\Windows\System\XGWoIYT.exe
  C:\Windows\System\XGWoIYT.exe
  2⤵
  PID:15872
- C:\Windows\System\dKMnzPy.exe
  C:\Windows\System\dKMnzPy.exe
  2⤵
  PID:15036
- C:\Windows\System\pQJfiTw.exe
  C:\Windows\System\pQJfiTw.exe
  2⤵
  PID:16104
- C:\Windows\System\qzpgHXc.exe
  C:\Windows\System\qzpgHXc.exe
  2⤵
  PID:16288
- C:\Windows\System\fsYPyUP.exe
  C:\Windows\System\fsYPyUP.exe
  2⤵
  PID:15444
- C:\Windows\System\JBvfTee.exe
  C:\Windows\System\JBvfTee.exe
  2⤵
  PID:15912
- C:\Windows\System\ZLxOTtd.exe
  C:\Windows\System\ZLxOTtd.exe
  2⤵
  PID:16100
- C:\Windows\System\TNgSMbA.exe
  C:\Windows\System\TNgSMbA.exe
  2⤵
  PID:16228
- C:\Windows\System\zkdVccQ.exe
  C:\Windows\System\zkdVccQ.exe
  2⤵
  PID:16152
- C:\Windows\System\SFuYAeF.exe
  C:\Windows\System\SFuYAeF.exe
  2⤵
  PID:16400
- C:\Windows\System\XUKZrGI.exe
  C:\Windows\System\XUKZrGI.exe
  2⤵
  PID:16464
- C:\Windows\System\jmbMnli.exe
  C:\Windows\System\jmbMnli.exe
  2⤵
  PID:16492
- C:\Windows\System\LTBcElY.exe
  C:\Windows\System\LTBcElY.exe
  2⤵
  PID:16532
- C:\Windows\System\opokJEP.exe
  C:\Windows\System\opokJEP.exe
  2⤵
  PID:16548
- C:\Windows\System\cHigPdt.exe
  C:\Windows\System\cHigPdt.exe
  2⤵
  PID:16564
- C:\Windows\System\rhVPoOP.exe
  C:\Windows\System\rhVPoOP.exe
  2⤵
  PID:16608
- C:\Windows\System\cGqbLeR.exe
  C:\Windows\System\cGqbLeR.exe
  2⤵
  PID:16632
- C:\Windows\System\tjtidkx.exe
  C:\Windows\System\tjtidkx.exe
  2⤵
  PID:16672
- C:\Windows\System\fbaEJKC.exe
  C:\Windows\System\fbaEJKC.exe
  2⤵
  PID:16696
- C:\Windows\System\hcFhiOi.exe
  C:\Windows\System\hcFhiOi.exe
  2⤵
  PID:16728
- C:\Windows\System\rHJjRlr.exe
  C:\Windows\System\rHJjRlr.exe
  2⤵
  PID:16748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AdQLDOf.exe

Filesize
1.3MB

MD5
acc70620a2a034fa94ad1881ab441a5c

SHA1
16926e8df32edc9fa912cd529289c3df2f64adc4

SHA256
aec9c96935ce4e2825dd57ede8ac95dc7386e68592d351becf3ee4aa7934a697

SHA512
469f7836b11e5886778e078e5357ddce750ccb7fd8fcdea65d218d9276bc153104538b3a2cf3a3c05300c7627b4e3878501b02a498ce30ea4d96b3076813e3cc

Download Submit
C:\Windows\System\CTjIojn.exe

Filesize
1.3MB

MD5
85e3e2e3b7adf4bb59dedc20e6ab812a

SHA1
b5e641388f90630380dfaa6d6d00ccb81e6abc4d

SHA256
7290cc3392a30e5cb3da2c909529b6050341bd6529edeb680a94d846aab9c346

SHA512
92a1d9595f71008f129fdd763789946ae3108b8ffb0ee149c57b9a7787b05de4daf9356ccfab3fc077b52a41098211ae4f7039600879cfbd1f45348b19029d86

Download Submit
C:\Windows\System\DPHxniE.exe

Filesize
1.3MB

MD5
d3b734d74e10a5867f28800ba6d6a9bf

SHA1
8778707a15eb35bd1ae453d35ede248a58d88b72

SHA256
cb485ea129c41a2099a4e4468a2c554ffd1b7dfa1f409e16010f6486e1398ea2

SHA512
ffb2dd080f08bb8a8fce65eda0a51dc28a7b18f0b6c07179b7c95a2b40293509091d53d62b6df61087a9eca3a345173c5af684eafb0ea72945e33a494d75f545

Download Submit
C:\Windows\System\EVwgpmu.exe

Filesize
1.3MB

MD5
588cefe85a7de2fa159fc7167c8e7b36

SHA1
6e8b57c03fbad25491b6ffa266f71dbf9fba2739

SHA256
a02199ce6e989b10529b6ebae1f820fe2d363445f06da38e4b2a79c5e0f8adb3

SHA512
943cdf9d239ca5a8064049052414cba7da5ae0088db2cefdbaa6ee761c0923c47b1d287e655b0c96f864c3280f0c1829e71931a1ee0d996eb9b7d2dc5cb536a4

Download Submit
C:\Windows\System\EcmzEsT.exe

Filesize
1.3MB

MD5
00aa7955af89c0495a11d63240f61a0c

SHA1
baea44c1701a82ca731591e09241ea8389ad8140

SHA256
c27e16c8008774911f69de07a1172baa4a01d3569ae2cddbc44aae25a213c02f

SHA512
0fa67c7e4d0e8c681e6cf5e57c24abff7403b28418a85843f0f98d902d1c5f518128cb226189c8ba581df94f1b3eb92bfac872497bf3134f9946753fbb3c5110

Download Submit
C:\Windows\System\EzrdtWN.exe

Filesize
1.3MB

MD5
fe094d07ae9dc0b0e16f95a14bfe483c

SHA1
fda6e42f6b5201f5bc2aea1dbee1643843f2f790

SHA256
26314263a61417e6155ae4182ac137aac88266fb7beb2d93ef1f2878ef887f46

SHA512
399b01c534a44dfd7212b3c1c4b9a3ff85343308b4b6490ca85730dec7e9ea3bb8ffd5089cb8a8bdfcced5fd3802998c51f2c1e3f29e9f2d2d8cc40952bb531f

Download Submit
C:\Windows\System\GQdQJnW.exe

Filesize
1.3MB

MD5
5cd0cd31b9fcac181eae834a52b971d8

SHA1
f508eaabc004307b9793c713137c6ca395c665a8

SHA256
90edf2c7e8839db4837515d3a359c44afed4845f969454254035bd6b37a00921

SHA512
63ff139d3955009f59bad89e92b4f56650e0639fe606c245ef7d1fe44403564252377b6216d1863ed926b1617425cdd56c5f2b7d92ceaddad53751256360bb70

Download Submit
C:\Windows\System\HASvVJk.exe

Filesize
1.3MB

MD5
fb758df0c9883c16f3951e43b0a6b450

SHA1
d4ea3a104cbc3089338218250e33af20e7bf0c38

SHA256
97cfe6d98dfe7e3622089ce5912bb785f8366ace89a6db19b2f2351e580e2acb

SHA512
e6215f148711de5365481fb868704e7f94868f9c44a7b72c7d6a5eb26ffd30fc77a0ff4e005495b92a8c42dbd81fd890637b8b5339ccf3c77d761da9bf8d8f33

Download Submit
C:\Windows\System\HtkRtrD.exe

Filesize
1.3MB

MD5
63ab350490a7f48835f6f66729d242f7

SHA1
44ac1205432f39b960ad48456f547ed57d540693

SHA256
06aace311890b92c06391f448453cb1cb4ff5389ff6a505d73cef539b7bf1179

SHA512
42dde5d0c014467455205ee69b9d6a9d3c78498f9991c873b2aba3ff9655c839d17536055e9b23b44c11073b3490991dec7e0ba3e98a8a676afc7f8a872fcbe0

Download Submit
C:\Windows\System\JWUSJWX.exe

Filesize
1.3MB

MD5
fb5abcea75e1b99c3c9d2a23ff78a62e

SHA1
f4fbf7a2ae2cec4a199ea2f5dc3a76a490f23038

SHA256
d74b931310a78a67966ce026ecd368755224e7880c11fdd549220e1a2aaff5e8

SHA512
a388c3f53895545f04082b3c992ecf63ab8c597d128228b6e99064e2ce67ec4db6d63bdac029917a3244ddf555f23773079f6c1845307e935c7ae699f48bb4a1

Download Submit
C:\Windows\System\LUNAaqz.exe

Filesize
1.3MB

MD5
d009c99e04c0afdd3dcf33253f37d906

SHA1
65a37f7b311c84e95a79c457f251d679b9bb5294

SHA256
fe7a5fcc7c948057caa4b279262207975cbb12c6326918cf5bcb22f9b76566c8

SHA512
95c18fdebae8c4a472a3f89837b4dd209193498ba28a3d47658c0f96d7faf6397c3f69a79dc89db3448780b932ec72574209e4cfaf17954de82fb9b73a9ba6cb

Download Submit
C:\Windows\System\PdvWLvs.exe

Filesize
1.3MB

MD5
e2d2184d8abfe47bc290c6feb32d504d

SHA1
8c9b3d2a4cb382f55b1995bb8c3272ffa96e0240

SHA256
2abdd0e1a5ab36a89cb62f1fbd8d6976bf6774a73b9d3ef71db018a898f040e6

SHA512
7ea74ec0ac718c152c79e56744d15de7a2facaeb3a71e6325705740859de9292591d0fca208849ede5494d1a49ebfa238c6664b85de1e9e22582c5aafbae3634

Download Submit
C:\Windows\System\QsJCrza.exe

Filesize
1.3MB

MD5
e9d2c2a71d382a0b4c491adfee110064

SHA1
c9dba2e08b0aa9d051f85fc34de0d67e5ed4655c

SHA256
b43089a28b6ff2678c2500a1f80dd09eb9cfac3f7cf74d4cebc0284d5b012cc3

SHA512
7169c1189d1c41d225c09d8ddf1da5c7f2eaa75400bf1d5b980b32fe35517de9df26af3fe2a9de6178b5ee62e7e708981f89a853e45354662aae9a3609286d5f

Download Submit
C:\Windows\System\RjIeqhN.exe

Filesize
1.3MB

MD5
3abdcaf2637bc4bde9056bfd1e55af81

SHA1
d2a4bb682901323e86cfee467d2caddfcb348f9b

SHA256
811e1183721d5257d0d9d72d555fcf001219437fe5b346637d1e2e98938dd805

SHA512
0a64022898a9eb3396b712fe2563e197fcc304a50a4dc2343bbb4c463c151351194a8cfb17414d980511303551b2fab59cce4c38ed349cc188126dfa0c53702a

Download Submit
C:\Windows\System\RnMKHhl.exe

Filesize
1.3MB

MD5
a07d3fff42236593a0809cf7af0d6053

SHA1
d10ab9c609b8af722f85846c1c5e000d6a0fed42

SHA256
f0c5ea0e8e326bec996001a7ca241092e6224cc757c6135d42062338c103a899

SHA512
04b42065ec3402df1158de44ccff12aa427219a7fce556b4d2a08c7489c86b7b86c43f76d4248dbc49c479cff1c19cb0be2999194d71f83cb9fe767799d13a93

Download Submit
C:\Windows\System\TOTuiri.exe

Filesize
1.3MB

MD5
1b4a2def92a6ad74c435e347732c50d7

SHA1
3d0b9c12d6b236838c57fc00fa4186f540ca7ede

SHA256
d8d62304b18237c2fece76d940fd2a9b9f35e42d9dea7aa8c2dba616c0198311

SHA512
4af532bf9cec908e4d0e89c1afc227340ecbf48d573901c4fa2cdf0ae0dec80c84ea37fd08046b1632e0ffff7d16e5a5ec9537ff8897d6ed0f6cc581bed51ec9

Download Submit
C:\Windows\System\UDKSsOB.exe

Filesize
1.3MB

MD5
d7911057597f5c9b66f91d97c57bbc1f

SHA1
5ffcaeed5e7253a84ba632b3ebdb001cb8deb10b

SHA256
0b38f5bdf736e94b17c24c329cabad253aef1126ddddc2c866a3fa2a9f7739f9

SHA512
3dd0d01f17a7efa5cccc72d18b6ee42635c74870eee3a0f12add34aead77328a582611df8d3267da372176c3530468614b94a0bbd7ee55602c7422026091c0d9

Download Submit
C:\Windows\System\UGkmNAM.exe

Filesize
1.3MB

MD5
e434996a5e06b997abd23e59955c7adb

SHA1
9c61c85f88642065c07a1f8ba1ee80c9be474f0d

SHA256
8c3bb02a5628610d8d53f52d4bc37a773e5749a3bcaa254c25f64f0644fe17a9

SHA512
e2fc135e3591534b2db1d8b008b2ce97edb8cb96854be6c76a999923cd0338045064375388724c75f7b49dc5600fd4e024f63ceade0de61b878a44f2c1e8b44a

Download Submit
C:\Windows\System\VUGTNDc.exe

Filesize
1.3MB

MD5
a14424696098ebc33f0fb7034c7cab24

SHA1
87bc53a7d1e74c88f0c850b7ac39d9346fadac07

SHA256
61ef6fe179cd65e8b3749fc8145e1e55b1ac4971fedb4f9e70782e267e0eb872

SHA512
b2023eb9d5683510159f3079f0463d229cdec724abc9b003d4b68e56b1bea0807538e7de75b76812a03731ebe2fae895b6da7c3bc70cd3829e29900356757790

Download Submit
C:\Windows\System\XOnrVam.exe

Filesize
1.3MB

MD5
dfc5631c65b349d673a91ea0b348a7af

SHA1
d0c4ed6795db27830eb2f6a6354b3300df520c47

SHA256
59edf8c8aab604d59fedc4aceeb54f970661b36e49aacc647c7c13c8138c89b6

SHA512
588c8aa3b76f184cf830bf8892a8c3e03b8bc6072abecc093ff42235392502c35c9f684b3b1d697f2ce5ff7b27c52fd3d63402fd2bf10930da701a66cf7bab5c

Download Submit
C:\Windows\System\ZdTEdmd.exe

Filesize
1.3MB

MD5
a65b4e1225d672e85aa4022789dd3f7b

SHA1
507bcca09d17b594fe6cb1564baff65de64c782c

SHA256
b0b384956c1261c69f198c6ff9c5c22dd71e1117612a98fb5559e3f787e60362

SHA512
b7adbcb35d8f7a83952d8366ce273b27f44e307ea8d42d6962f07742ea15c585ae1ea84cfe3d6c97c86dcba7fcd64fb87e0025241fa7ce0c238f759bec3b441f

Download Submit
C:\Windows\System\dgTGZqV.exe

Filesize
1.3MB

MD5
5490f5049119d2742b5887e91715ad7b

SHA1
de7c670a314773a4d731293fee90529b5a2232f7

SHA256
a077f400298606caa336363bb0993d878d41c9f76fa7d72e31f721e143556e65

SHA512
088e742018c981f45adf091e8bea9284868202be0c3da47ba11abf97627345489e023727f0c82eb9f19750c4a5895499f491ddef7f39f5d4945befad24dfe9cd

Download Submit
C:\Windows\System\hZPwTzj.exe

Filesize
1.3MB

MD5
32805a39569e7107c3fa01fca6444fa7

SHA1
f333e3ef7e7138ba92a6d5ea30d2811dcfb5ca45

SHA256
a98d73a9d715bee00a2f9269050872d57e4864c79c9949ca44d066a92d9b6d77

SHA512
a4225b6d8033a3eb703c27fbd6484d66a4bcfff6cc7adcbb6aa637e53c45644f0ec8184aee14a253bda29a2d03c041fa4fd49dfe5f1954d0d12ae5216c96204a

Download Submit
C:\Windows\System\jLmoEFp.exe

Filesize
1.3MB

MD5
c437241c312dac6c19b446b70a359b78

SHA1
0ada8ded3ee8cdf115728cf83590a1e2db92f94e

SHA256
d581970a47196efa392f786c1f25d5b06b3d78e746cd9e4785060632243667f7

SHA512
67e5061c163da3850391cbd5c571b4a661991816161959d6840d6f9b19443a01a41b2738e7b98ba2bd367a060dbd9b3156cc7a160d42688e2b785ab22e9c6009

Download Submit
C:\Windows\System\kZKObBq.exe

Filesize
1.3MB

MD5
500d21d99aa1451f4081a1b6d3167729

SHA1
c024de5a07f8dd812ad8bdb22b0cccc15904e051

SHA256
602cb26ee67861c652a396c5c6feb4203f3a8e9dbdd053ffc7eee1a03223f70f

SHA512
4796c7a4d14a1b98f8564b39f9399e219d4f2f03b5e4e74a68244594b11770317a0d4848df1995c5a5fdc758b2e1fd4c94ab4b2408962e3eab3000384ae28278

Download Submit
C:\Windows\System\nFOzEfD.exe

Filesize
1.3MB

MD5
85d754a94148ae62739b604a2b98620a

SHA1
a745ae6e0458d219abf5030e4ae991467c9168ff

SHA256
499302938be9ed3ebbc0afaa6976dea3ebcb8b98f28ef12e42b4481af3af2bf8

SHA512
1e192764f40d9274c434d1fd1eb2178365ac3ae9dac93ece05852e56b93f44ffed706c744c332a66d4f2704c16416cd4ee8d881d321e7b1397cdbaea84abfba8

Download Submit
C:\Windows\System\nMgkphX.exe

Filesize
1.3MB

MD5
280756cd99dfa3885d3914f211c43a25

SHA1
fd0f421f9e5512ae58a356d3d4375369881bed42

SHA256
cb3b99146181ed1d649e6872db9201a4335dee242ae3491cbd9f2ffe3bcdf1f7

SHA512
78ab310add3e1634f031eed1311e1fbe06b4b0c8aa6dcd61febdd0f4af9f88e01b78e38635281315b0c8ebd6e504bbed534d87c92c9f46e98601897de1069c58

Download Submit
C:\Windows\System\oAqkJmo.exe

Filesize
1.3MB

MD5
61cda12f1ea958ef7452cc5c5bb2d260

SHA1
c4c60b0ce426c3e90432fc21c117758f6375b971

SHA256
28559f0f7057d720be43b08265d7c3cbcacdb47e9b4a7d82d50a7cf95d37bd0b

SHA512
186edd2d78e155eb9ca9f4aa8120a645b4610731bc4225f90517c6ac5238ecc5aeb5229b1111ed7b45270b1a2da1ae6c3cb40fd46c5d38530817f115ccacc7eb

Download Submit
C:\Windows\System\qloIRIM.exe

Filesize
1.3MB

MD5
ec854c6627aa3447aa87788ae227042a

SHA1
71a4ecddff213d5b860ca30ab3ac5ae657899ab6

SHA256
69f3561387b7b4a00d2a4e9fb157e44038b067ecfc709c115f0bad1174e5eebe

SHA512
a3df3f1c513faf8a476c7e1e9c359463bc257f2e838bfb3177201459009ac537dc12bdada9eebff507a34b11b5089e3537eed00790097d60a2301724115e7af5

Download Submit
C:\Windows\System\snBXyUV.exe

Filesize
1.3MB

MD5
ca2d81ebd78ea5bed78ed6277733b122

SHA1
c3fb3fe8257f9bee1aafc1c9705e0d063e24d3eb

SHA256
0c948dfa83aeeded6b97c45ff90d583079ae2a1293dfaaf7a2d29a59883640ba

SHA512
c0e18bb4c9d76cd898451b40cfa1bf0faa8766559b0ff383cbd81c87f9b06e388a3d7ce25a4bf68550eeaca81d4a936c3c705dc599886e0bb3e727c979dad759

Download Submit
C:\Windows\System\tHxtsSy.exe

Filesize
1.3MB

MD5
335a25923e4eb9d8718916bb8d2dde82

SHA1
a106b091065f3a57160cfc0458d1c4d0477427bc

SHA256
cc3edb3b8ce77787f010a87ef86efb36fe962622f6c997db06f0e9f00fd886d6

SHA512
d1751568addef19f61a62ab131ceb7271873fd7b4cc3add6001cb91ca4f68a82e4a0c18186fb6ab9831da6128bea2654011114979b0542afed35217500405e3c

Download Submit
C:\Windows\System\wRuwXcf.exe

Filesize
1.3MB

MD5
fc5cb187b6ca4d8506184f21855bdf36

SHA1
83e368aa1ccfd16f6a78e3a47a7896dfd550659d

SHA256
e15ba6ace9e0eefa9bccd1ae8b9537241cbcb33fe0307411da10bbed8eeb9101

SHA512
e2981e328fca304fd507d8bffaf0e89b1bc29b9b15960b738cf836c78fcabc9ec48bd5f9c05de2975a330b57346139140edf6995ce093c2c8c27b7ea8ae92088

Download Submit
C:\Windows\System\zjeERdb.exe

Filesize
1.3MB

MD5
de02972fe17d6b6230de7eb9e923c8bb

SHA1
1b9c51b61852d19c12d8a117bd06e327b6e905f6

SHA256
45ad68eacf4aaf4b67fa2f392c7bf79900e35ec8c2ab0767833da23f588e7cf5

SHA512
63932536214fe97d37a3c731324480089c400047efc24b582babfb341062590b04e261c2b00a60b4a45bc719ed0f7c1c2e2af0c08ecfb5f332295f7fd54f7eeb

Download Submit
memory/5032-0-0x000001F873050000-0x000001F873060000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads