xmrig | 148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
Size

1001KB
MD5

3ba93b6e77c7d93173c3b3e302b758a2
SHA1

18d6b807a7aa648329d09f70f9fcdd589d76cae9
SHA256

148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214
SHA512

92490727a231a07d2d967f5f1d98757e9bce378a5775758de60e07511776906d8ada2d6e0b1f7c4386dba3bd9e7693c3702be4cff588633baeba5616c54a4cb2
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrb:GezaTF8FcNkNdfE0pZ9ozttwIRQn

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023bfc-4.dat	xmrig
behavioral2/files/0x0007000000023ca2-7.dat	xmrig
behavioral2/files/0x0009000000023c9d-9.dat	xmrig
behavioral2/files/0x0007000000023ca3-19.dat	xmrig
behavioral2/files/0x0007000000023ca4-24.dat	xmrig
behavioral2/files/0x0007000000023ca6-30.dat	xmrig
behavioral2/files/0x0007000000023ca7-33.dat	xmrig
behavioral2/files/0x0007000000023cab-49.dat	xmrig
behavioral2/files/0x0007000000023cad-60.dat	xmrig
behavioral2/files/0x0007000000023cb0-76.dat	xmrig
behavioral2/files/0x0007000000023cb3-94.dat	xmrig
behavioral2/files/0x0007000000023cb4-107.dat	xmrig
behavioral2/files/0x0007000000023cb9-121.dat	xmrig
behavioral2/files/0x0007000000023cbc-163.dat	xmrig
behavioral2/files/0x0007000000023cbb-161.dat	xmrig
behavioral2/files/0x0007000000023cba-159.dat	xmrig
behavioral2/files/0x0007000000023cbd-157.dat	xmrig
behavioral2/files/0x0007000000023cc3-156.dat	xmrig
behavioral2/files/0x0007000000023cc2-155.dat	xmrig
behavioral2/files/0x0007000000023cc1-154.dat	xmrig
behavioral2/files/0x0007000000023cc0-153.dat	xmrig
behavioral2/files/0x0007000000023cbf-152.dat	xmrig
behavioral2/files/0x0007000000023cbe-151.dat	xmrig
behavioral2/files/0x0007000000023cb6-126.dat	xmrig
behavioral2/files/0x0007000000023cb8-116.dat	xmrig
behavioral2/files/0x0007000000023cb7-114.dat	xmrig
behavioral2/files/0x0007000000023cb5-112.dat	xmrig
behavioral2/files/0x0007000000023cb1-101.dat	xmrig
behavioral2/files/0x0007000000023cb2-98.dat	xmrig
behavioral2/files/0x0007000000023caf-86.dat	xmrig
behavioral2/files/0x0007000000023cac-75.dat	xmrig
behavioral2/files/0x0007000000023cae-67.dat	xmrig
behavioral2/files/0x0007000000023caa-64.dat	xmrig
behavioral2/files/0x0007000000023ca9-51.dat	xmrig
behavioral2/files/0x0007000000023ca8-40.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1224	cqntOUe.exe
3340	BqZvTbH.exe
5056	JxLxxAd.exe
1332	flztMef.exe
3032	LmlXrkD.exe
1440	FcpyTkU.exe
2256	ijTBuwk.exe
2776	FSlIfnU.exe
3308	EJRVrcz.exe
4968	fTOVuiO.exe
1508	qmPedGW.exe
4628	mRZhueD.exe
5044	YoFaizl.exe
1860	CFLYyod.exe
3212	fnVPTYY.exe
4896	HQdNvEb.exe
2380	TubGFnf.exe
1276	PPjkise.exe
264	BByzQAt.exe
1680	hOPqzDI.exe
4380	OwcAyed.exe
2324	WyHtQMX.exe
892	YSUsqLz.exe
3888	BPAfZSq.exe
1972	YozvsXs.exe
1220	DcYxIzr.exe
3512	MbUWNiU.exe
1728	mwRkyln.exe
1924	hctvYIG.exe
2608	RZOmYgg.exe
3368	drtNdsD.exe
3128	YLjEYzU.exe
400	LobCPiL.exe
4616	qjooGzI.exe
2540	sTzQiWA.exe
4112	AveKczG.exe
1388	AVjyIIW.exe
976	OieYryT.exe
1012	LTpmhrq.exe
3356	uDnkmLV.exe
232	LzLiyRu.exe
3576	cLUireJ.exe
4004	QQQgrOp.exe
2132	LHslckM.exe
4540	FztogWu.exe
1852	TCLROlt.exe
5100	iFtIKjp.exe
680	MQIScLB.exe
2984	FikzHAY.exe
3420	ozvMZVa.exe
2180	YGwVmhc.exe
4944	BotluLo.exe
5032	XJpMwrl.exe
536	RITRYHv.exe
1404	hjrrKSg.exe
3400	ItraQlT.exe
2428	yPQaQZx.exe
2388	IJUHUnB.exe
684	aJiocJK.exe
2928	hUfBUPc.exe
3876	YARIjNI.exe
456	EujHiUz.exe
1384	vcqgFee.exe
756	mvUsqDG.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cPfoPIR.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\iFfBmZy.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\xxuxabf.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ikkfpuD.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\nJnobCG.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\pQUheIp.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\kDxqYsT.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\YMjQUWl.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\uVqZIEU.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\LZIDbcy.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\UDRKCwA.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ZDSmige.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\tMNAbut.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\SssULyk.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\KAgXJfb.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\QwowFrM.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\iFtIKjp.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\lCJlHaC.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\EFGEMMt.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\QsHztVc.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\pWtQzPZ.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\HzqkBQH.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\DeEUoWw.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\xmwEsJT.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ALPVnqA.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\vRBTiby.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\sPWQBUQ.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\DLuEwdX.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\AveKczG.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\KvhECVj.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\dDmFKoy.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\EjtCuAc.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\OpSkoKh.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\tifUbjP.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\JzWxBQK.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\orzsabM.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\sJEknWy.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\jXDabhK.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\DznCPPZ.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\aBVjNMS.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\RZOmYgg.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\oHKdXLp.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\abcEdOU.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\vUNToqW.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\CxTxxOJ.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\cLUireJ.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\rZalywr.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\rvrVNsQ.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\jlYOWQW.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ahvdtoV.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\EujHiUz.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\mqsJZIn.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\SxUKSfF.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\MvXgknM.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\IaWzOoj.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\ePBchlK.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\TwwZxYG.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\aYlWhbI.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\LgaYveK.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\htWxCEq.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\OdShYmk.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\PhYmojl.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\usSVNdb.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
File created	C:\Windows\System\WUnXrli.exe	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1224	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	83
PID 4900 wrote to memory of 1224	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	83
PID 4900 wrote to memory of 3340	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	84
PID 4900 wrote to memory of 3340	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	84
PID 4900 wrote to memory of 5056	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	85
PID 4900 wrote to memory of 5056	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	85
PID 4900 wrote to memory of 1332	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	86
PID 4900 wrote to memory of 1332	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	86
PID 4900 wrote to memory of 3032	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	87
PID 4900 wrote to memory of 3032	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	87
PID 4900 wrote to memory of 1440	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	88
PID 4900 wrote to memory of 1440	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	88
PID 4900 wrote to memory of 2256	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	89
PID 4900 wrote to memory of 2256	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	89
PID 4900 wrote to memory of 2776	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	90
PID 4900 wrote to memory of 2776	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	90
PID 4900 wrote to memory of 3308	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	91
PID 4900 wrote to memory of 3308	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	91
PID 4900 wrote to memory of 4968	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	92
PID 4900 wrote to memory of 4968	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	92
PID 4900 wrote to memory of 1508	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	93
PID 4900 wrote to memory of 1508	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	93
PID 4900 wrote to memory of 5044	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	94
PID 4900 wrote to memory of 5044	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	94
PID 4900 wrote to memory of 4628	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	95
PID 4900 wrote to memory of 4628	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	95
PID 4900 wrote to memory of 1860	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	96
PID 4900 wrote to memory of 1860	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	96
PID 4900 wrote to memory of 2380	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	97
PID 4900 wrote to memory of 2380	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	97
PID 4900 wrote to memory of 3212	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	98
PID 4900 wrote to memory of 3212	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	98
PID 4900 wrote to memory of 4896	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	99
PID 4900 wrote to memory of 4896	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	99
PID 4900 wrote to memory of 1276	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	100
PID 4900 wrote to memory of 1276	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	100
PID 4900 wrote to memory of 264	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	101
PID 4900 wrote to memory of 264	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	101
PID 4900 wrote to memory of 1680	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	102
PID 4900 wrote to memory of 1680	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	102
PID 4900 wrote to memory of 4380	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	103
PID 4900 wrote to memory of 4380	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	103
PID 4900 wrote to memory of 3888	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	104
PID 4900 wrote to memory of 3888	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	104
PID 4900 wrote to memory of 2324	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	105
PID 4900 wrote to memory of 2324	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	105
PID 4900 wrote to memory of 892	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	106
PID 4900 wrote to memory of 892	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	106
PID 4900 wrote to memory of 1972	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	107
PID 4900 wrote to memory of 1972	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	107
PID 4900 wrote to memory of 1220	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	108
PID 4900 wrote to memory of 1220	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	108
PID 4900 wrote to memory of 3512	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	109
PID 4900 wrote to memory of 3512	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	109
PID 4900 wrote to memory of 1728	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	110
PID 4900 wrote to memory of 1728	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	110
PID 4900 wrote to memory of 1924	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	111
PID 4900 wrote to memory of 1924	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	111
PID 4900 wrote to memory of 2608	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	112
PID 4900 wrote to memory of 2608	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	112
PID 4900 wrote to memory of 3368	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	113
PID 4900 wrote to memory of 3368	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	113
PID 4900 wrote to memory of 3128	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	114
PID 4900 wrote to memory of 3128	4900	148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe	114

C:\Users\Admin\AppData\Local\Temp\148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe
"C:\Users\Admin\AppData\Local\Temp\148eb504fd5a5668d024ac9499907174be069e76e8f7071cd4b88fdbfa6b8214.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\System\cqntOUe.exe
  C:\Windows\System\cqntOUe.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\BqZvTbH.exe
  C:\Windows\System\BqZvTbH.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\JxLxxAd.exe
  C:\Windows\System\JxLxxAd.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\flztMef.exe
  C:\Windows\System\flztMef.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\LmlXrkD.exe
  C:\Windows\System\LmlXrkD.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\FcpyTkU.exe
  C:\Windows\System\FcpyTkU.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\ijTBuwk.exe
  C:\Windows\System\ijTBuwk.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\FSlIfnU.exe
  C:\Windows\System\FSlIfnU.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\EJRVrcz.exe
  C:\Windows\System\EJRVrcz.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\fTOVuiO.exe
  C:\Windows\System\fTOVuiO.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\qmPedGW.exe
  C:\Windows\System\qmPedGW.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\YoFaizl.exe
  C:\Windows\System\YoFaizl.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\mRZhueD.exe
  C:\Windows\System\mRZhueD.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\CFLYyod.exe
  C:\Windows\System\CFLYyod.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\TubGFnf.exe
  C:\Windows\System\TubGFnf.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\fnVPTYY.exe
  C:\Windows\System\fnVPTYY.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\HQdNvEb.exe
  C:\Windows\System\HQdNvEb.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\PPjkise.exe
  C:\Windows\System\PPjkise.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\BByzQAt.exe
  C:\Windows\System\BByzQAt.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\hOPqzDI.exe
  C:\Windows\System\hOPqzDI.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\OwcAyed.exe
  C:\Windows\System\OwcAyed.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\BPAfZSq.exe
  C:\Windows\System\BPAfZSq.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\WyHtQMX.exe
  C:\Windows\System\WyHtQMX.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\YSUsqLz.exe
  C:\Windows\System\YSUsqLz.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\YozvsXs.exe
  C:\Windows\System\YozvsXs.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\DcYxIzr.exe
  C:\Windows\System\DcYxIzr.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\MbUWNiU.exe
  C:\Windows\System\MbUWNiU.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\mwRkyln.exe
  C:\Windows\System\mwRkyln.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\hctvYIG.exe
  C:\Windows\System\hctvYIG.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\RZOmYgg.exe
  C:\Windows\System\RZOmYgg.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\drtNdsD.exe
  C:\Windows\System\drtNdsD.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\YLjEYzU.exe
  C:\Windows\System\YLjEYzU.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\LobCPiL.exe
  C:\Windows\System\LobCPiL.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\qjooGzI.exe
  C:\Windows\System\qjooGzI.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\sTzQiWA.exe
  C:\Windows\System\sTzQiWA.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\AveKczG.exe
  C:\Windows\System\AveKczG.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\AVjyIIW.exe
  C:\Windows\System\AVjyIIW.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\OieYryT.exe
  C:\Windows\System\OieYryT.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\LTpmhrq.exe
  C:\Windows\System\LTpmhrq.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\uDnkmLV.exe
  C:\Windows\System\uDnkmLV.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\LzLiyRu.exe
  C:\Windows\System\LzLiyRu.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\cLUireJ.exe
  C:\Windows\System\cLUireJ.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\QQQgrOp.exe
  C:\Windows\System\QQQgrOp.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\LHslckM.exe
  C:\Windows\System\LHslckM.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\FztogWu.exe
  C:\Windows\System\FztogWu.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\TCLROlt.exe
  C:\Windows\System\TCLROlt.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\iFtIKjp.exe
  C:\Windows\System\iFtIKjp.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\MQIScLB.exe
  C:\Windows\System\MQIScLB.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\FikzHAY.exe
  C:\Windows\System\FikzHAY.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ozvMZVa.exe
  C:\Windows\System\ozvMZVa.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\YGwVmhc.exe
  C:\Windows\System\YGwVmhc.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\BotluLo.exe
  C:\Windows\System\BotluLo.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\XJpMwrl.exe
  C:\Windows\System\XJpMwrl.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\RITRYHv.exe
  C:\Windows\System\RITRYHv.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\hjrrKSg.exe
  C:\Windows\System\hjrrKSg.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\ItraQlT.exe
  C:\Windows\System\ItraQlT.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\yPQaQZx.exe
  C:\Windows\System\yPQaQZx.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\IJUHUnB.exe
  C:\Windows\System\IJUHUnB.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\aJiocJK.exe
  C:\Windows\System\aJiocJK.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\hUfBUPc.exe
  C:\Windows\System\hUfBUPc.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\YARIjNI.exe
  C:\Windows\System\YARIjNI.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\EujHiUz.exe
  C:\Windows\System\EujHiUz.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\vcqgFee.exe
  C:\Windows\System\vcqgFee.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\mvUsqDG.exe
  C:\Windows\System\mvUsqDG.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\GapBrqK.exe
  C:\Windows\System\GapBrqK.exe
  2⤵
  PID:3796
- C:\Windows\System\DuGOySM.exe
  C:\Windows\System\DuGOySM.exe
  2⤵
  PID:1904
- C:\Windows\System\WKSzYAu.exe
  C:\Windows\System\WKSzYAu.exe
  2⤵
  PID:3080
- C:\Windows\System\bUbBTRk.exe
  C:\Windows\System\bUbBTRk.exe
  2⤵
  PID:3100
- C:\Windows\System\DxEQxDH.exe
  C:\Windows\System\DxEQxDH.exe
  2⤵
  PID:224
- C:\Windows\System\bfEnSKR.exe
  C:\Windows\System\bfEnSKR.exe
  2⤵
  PID:1736
- C:\Windows\System\LLwQEGR.exe
  C:\Windows\System\LLwQEGR.exe
  2⤵
  PID:5004
- C:\Windows\System\VXNiOBH.exe
  C:\Windows\System\VXNiOBH.exe
  2⤵
  PID:3780
- C:\Windows\System\dJQpPZG.exe
  C:\Windows\System\dJQpPZG.exe
  2⤵
  PID:5048
- C:\Windows\System\NWekMbY.exe
  C:\Windows\System\NWekMbY.exe
  2⤵
  PID:2192
- C:\Windows\System\YCiJYMK.exe
  C:\Windows\System\YCiJYMK.exe
  2⤵
  PID:1064
- C:\Windows\System\UTfIRtB.exe
  C:\Windows\System\UTfIRtB.exe
  2⤵
  PID:880
- C:\Windows\System\gGbEjyF.exe
  C:\Windows\System\gGbEjyF.exe
  2⤵
  PID:2020
- C:\Windows\System\JPyvLFI.exe
  C:\Windows\System\JPyvLFI.exe
  2⤵
  PID:4120
- C:\Windows\System\iIzyofI.exe
  C:\Windows\System\iIzyofI.exe
  2⤵
  PID:4612
- C:\Windows\System\lBnnZub.exe
  C:\Windows\System\lBnnZub.exe
  2⤵
  PID:1968
- C:\Windows\System\gFboAcS.exe
  C:\Windows\System\gFboAcS.exe
  2⤵
  PID:2740
- C:\Windows\System\Cesluob.exe
  C:\Windows\System\Cesluob.exe
  2⤵
  PID:4804
- C:\Windows\System\YDvlSEh.exe
  C:\Windows\System\YDvlSEh.exe
  2⤵
  PID:1444
- C:\Windows\System\TbsyorO.exe
  C:\Windows\System\TbsyorO.exe
  2⤵
  PID:2548
- C:\Windows\System\QsJIfCh.exe
  C:\Windows\System\QsJIfCh.exe
  2⤵
  PID:1104
- C:\Windows\System\yaWjwTz.exe
  C:\Windows\System\yaWjwTz.exe
  2⤵
  PID:2144
- C:\Windows\System\IolHgyw.exe
  C:\Windows\System\IolHgyw.exe
  2⤵
  PID:964
- C:\Windows\System\cqZTWXq.exe
  C:\Windows\System\cqZTWXq.exe
  2⤵
  PID:4620
- C:\Windows\System\ZhuyuMf.exe
  C:\Windows\System\ZhuyuMf.exe
  2⤵
  PID:1156
- C:\Windows\System\GLVncGd.exe
  C:\Windows\System\GLVncGd.exe
  2⤵
  PID:2760
- C:\Windows\System\HqMSXKV.exe
  C:\Windows\System\HqMSXKV.exe
  2⤵
  PID:4584
- C:\Windows\System\bgHRrrk.exe
  C:\Windows\System\bgHRrrk.exe
  2⤵
  PID:396
- C:\Windows\System\gvyLLxw.exe
  C:\Windows\System\gvyLLxw.exe
  2⤵
  PID:5064
- C:\Windows\System\NkxUCwo.exe
  C:\Windows\System\NkxUCwo.exe
  2⤵
  PID:3324
- C:\Windows\System\bhxvAGM.exe
  C:\Windows\System\bhxvAGM.exe
  2⤵
  PID:1564
- C:\Windows\System\iUoESuD.exe
  C:\Windows\System\iUoESuD.exe
  2⤵
  PID:4480
- C:\Windows\System\rXCafYo.exe
  C:\Windows\System\rXCafYo.exe
  2⤵
  PID:2596
- C:\Windows\System\TPDEBCQ.exe
  C:\Windows\System\TPDEBCQ.exe
  2⤵
  PID:4552
- C:\Windows\System\QQcaxjw.exe
  C:\Windows\System\QQcaxjw.exe
  2⤵
  PID:2400
- C:\Windows\System\agCdiNo.exe
  C:\Windows\System\agCdiNo.exe
  2⤵
  PID:528
- C:\Windows\System\sWuMoqe.exe
  C:\Windows\System\sWuMoqe.exe
  2⤵
  PID:2276
- C:\Windows\System\eENAwQK.exe
  C:\Windows\System\eENAwQK.exe
  2⤵
  PID:4364
- C:\Windows\System\xklaEqC.exe
  C:\Windows\System\xklaEqC.exe
  2⤵
  PID:1152
- C:\Windows\System\EsMCpSn.exe
  C:\Windows\System\EsMCpSn.exe
  2⤵
  PID:592
- C:\Windows\System\zrhizMB.exe
  C:\Windows\System\zrhizMB.exe
  2⤵
  PID:1488
- C:\Windows\System\iQDMiuH.exe
  C:\Windows\System\iQDMiuH.exe
  2⤵
  PID:1424
- C:\Windows\System\OpSkoKh.exe
  C:\Windows\System\OpSkoKh.exe
  2⤵
  PID:2684
- C:\Windows\System\zSwoATk.exe
  C:\Windows\System\zSwoATk.exe
  2⤵
  PID:2572
- C:\Windows\System\XmEfuSm.exe
  C:\Windows\System\XmEfuSm.exe
  2⤵
  PID:2924
- C:\Windows\System\GQElMkz.exe
  C:\Windows\System\GQElMkz.exe
  2⤵
  PID:2500
- C:\Windows\System\OFWrgen.exe
  C:\Windows\System\OFWrgen.exe
  2⤵
  PID:4452
- C:\Windows\System\nACcfDx.exe
  C:\Windows\System\nACcfDx.exe
  2⤵
  PID:3092
- C:\Windows\System\wZmlXJp.exe
  C:\Windows\System\wZmlXJp.exe
  2⤵
  PID:3992
- C:\Windows\System\CZNUBFh.exe
  C:\Windows\System\CZNUBFh.exe
  2⤵
  PID:2004
- C:\Windows\System\WUnXrli.exe
  C:\Windows\System\WUnXrli.exe
  2⤵
  PID:4828
- C:\Windows\System\hQLAHvk.exe
  C:\Windows\System\hQLAHvk.exe
  2⤵
  PID:1688
- C:\Windows\System\GLBODld.exe
  C:\Windows\System\GLBODld.exe
  2⤵
  PID:3276
- C:\Windows\System\YCGQGUB.exe
  C:\Windows\System\YCGQGUB.exe
  2⤵
  PID:3408
- C:\Windows\System\XBviapk.exe
  C:\Windows\System\XBviapk.exe
  2⤵
  PID:1636
- C:\Windows\System\rJtdchg.exe
  C:\Windows\System\rJtdchg.exe
  2⤵
  PID:4248
- C:\Windows\System\jxuuWQI.exe
  C:\Windows\System\jxuuWQI.exe
  2⤵
  PID:1204
- C:\Windows\System\vCYTCJo.exe
  C:\Windows\System\vCYTCJo.exe
  2⤵
  PID:3372
- C:\Windows\System\pGuGzsw.exe
  C:\Windows\System\pGuGzsw.exe
  2⤵
  PID:1000
- C:\Windows\System\yMfAyek.exe
  C:\Windows\System\yMfAyek.exe
  2⤵
  PID:5136
- C:\Windows\System\GmQcVTs.exe
  C:\Windows\System\GmQcVTs.exe
  2⤵
  PID:5160
- C:\Windows\System\YWEWJGi.exe
  C:\Windows\System\YWEWJGi.exe
  2⤵
  PID:5200
- C:\Windows\System\SBKxvYQ.exe
  C:\Windows\System\SBKxvYQ.exe
  2⤵
  PID:5224
- C:\Windows\System\oJNqdER.exe
  C:\Windows\System\oJNqdER.exe
  2⤵
  PID:5260
- C:\Windows\System\bHxYSfF.exe
  C:\Windows\System\bHxYSfF.exe
  2⤵
  PID:5280
- C:\Windows\System\vNeGAuG.exe
  C:\Windows\System\vNeGAuG.exe
  2⤵
  PID:5312
- C:\Windows\System\VjwaKWN.exe
  C:\Windows\System\VjwaKWN.exe
  2⤵
  PID:5336
- C:\Windows\System\PsXicjf.exe
  C:\Windows\System\PsXicjf.exe
  2⤵
  PID:5364
- C:\Windows\System\MLZkuUo.exe
  C:\Windows\System\MLZkuUo.exe
  2⤵
  PID:5392
- C:\Windows\System\AUJmmgt.exe
  C:\Windows\System\AUJmmgt.exe
  2⤵
  PID:5424
- C:\Windows\System\ccTdcfI.exe
  C:\Windows\System\ccTdcfI.exe
  2⤵
  PID:5448
- C:\Windows\System\aEsJRRv.exe
  C:\Windows\System\aEsJRRv.exe
  2⤵
  PID:5476
- C:\Windows\System\kacaEVn.exe
  C:\Windows\System\kacaEVn.exe
  2⤵
  PID:5500
- C:\Windows\System\gpYAWNz.exe
  C:\Windows\System\gpYAWNz.exe
  2⤵
  PID:5532
- C:\Windows\System\LZIDbcy.exe
  C:\Windows\System\LZIDbcy.exe
  2⤵
  PID:5560
- C:\Windows\System\QTOsqqU.exe
  C:\Windows\System\QTOsqqU.exe
  2⤵
  PID:5588
- C:\Windows\System\NBfDsjf.exe
  C:\Windows\System\NBfDsjf.exe
  2⤵
  PID:5620
- C:\Windows\System\AiGgtZS.exe
  C:\Windows\System\AiGgtZS.exe
  2⤵
  PID:5644
- C:\Windows\System\nXIvBxH.exe
  C:\Windows\System\nXIvBxH.exe
  2⤵
  PID:5672
- C:\Windows\System\UGgXjNP.exe
  C:\Windows\System\UGgXjNP.exe
  2⤵
  PID:5700
- C:\Windows\System\FWtGXQx.exe
  C:\Windows\System\FWtGXQx.exe
  2⤵
  PID:5728
- C:\Windows\System\LsAOhlJ.exe
  C:\Windows\System\LsAOhlJ.exe
  2⤵
  PID:5756
- C:\Windows\System\NgXvPxx.exe
  C:\Windows\System\NgXvPxx.exe
  2⤵
  PID:5788
- C:\Windows\System\lCJlHaC.exe
  C:\Windows\System\lCJlHaC.exe
  2⤵
  PID:5816
- C:\Windows\System\RMlJYaB.exe
  C:\Windows\System\RMlJYaB.exe
  2⤵
  PID:5840
- C:\Windows\System\HzqkBQH.exe
  C:\Windows\System\HzqkBQH.exe
  2⤵
  PID:5876
- C:\Windows\System\iPgwVnE.exe
  C:\Windows\System\iPgwVnE.exe
  2⤵
  PID:5896
- C:\Windows\System\ZazTOTy.exe
  C:\Windows\System\ZazTOTy.exe
  2⤵
  PID:5928
- C:\Windows\System\iDyzEYZ.exe
  C:\Windows\System\iDyzEYZ.exe
  2⤵
  PID:5952
- C:\Windows\System\DVcZYrl.exe
  C:\Windows\System\DVcZYrl.exe
  2⤵
  PID:5988
- C:\Windows\System\shLDooT.exe
  C:\Windows\System\shLDooT.exe
  2⤵
  PID:6020
- C:\Windows\System\UpqdVzY.exe
  C:\Windows\System\UpqdVzY.exe
  2⤵
  PID:6036
- C:\Windows\System\tpmPtsi.exe
  C:\Windows\System\tpmPtsi.exe
  2⤵
  PID:6064
- C:\Windows\System\JFtNqMm.exe
  C:\Windows\System\JFtNqMm.exe
  2⤵
  PID:6092
- C:\Windows\System\tFJMlXn.exe
  C:\Windows\System\tFJMlXn.exe
  2⤵
  PID:6120
- C:\Windows\System\ArgQLJq.exe
  C:\Windows\System\ArgQLJq.exe
  2⤵
  PID:5132
- C:\Windows\System\eaOLcFk.exe
  C:\Windows\System\eaOLcFk.exe
  2⤵
  PID:5196
- C:\Windows\System\aaUQbzb.exe
  C:\Windows\System\aaUQbzb.exe
  2⤵
  PID:5248
- C:\Windows\System\VLHpLpN.exe
  C:\Windows\System\VLHpLpN.exe
  2⤵
  PID:5296
- C:\Windows\System\DDHGhrc.exe
  C:\Windows\System\DDHGhrc.exe
  2⤵
  PID:5352
- C:\Windows\System\alCTvhU.exe
  C:\Windows\System\alCTvhU.exe
  2⤵
  PID:5416
- C:\Windows\System\UXyOEGX.exe
  C:\Windows\System\UXyOEGX.exe
  2⤵
  PID:5488
- C:\Windows\System\hqyYdVM.exe
  C:\Windows\System\hqyYdVM.exe
  2⤵
  PID:5580
- C:\Windows\System\YgZdrus.exe
  C:\Windows\System\YgZdrus.exe
  2⤵
  PID:5640
- C:\Windows\System\KZTVByN.exe
  C:\Windows\System\KZTVByN.exe
  2⤵
  PID:5712
- C:\Windows\System\ecRaSPS.exe
  C:\Windows\System\ecRaSPS.exe
  2⤵
  PID:5796
- C:\Windows\System\mRsphou.exe
  C:\Windows\System\mRsphou.exe
  2⤵
  PID:5836
- C:\Windows\System\bKdxKde.exe
  C:\Windows\System\bKdxKde.exe
  2⤵
  PID:5908
- C:\Windows\System\KFtXTIn.exe
  C:\Windows\System\KFtXTIn.exe
  2⤵
  PID:5972
- C:\Windows\System\RMSvbdU.exe
  C:\Windows\System\RMSvbdU.exe
  2⤵
  PID:6032
- C:\Windows\System\KbXAUgI.exe
  C:\Windows\System\KbXAUgI.exe
  2⤵
  PID:6112
- C:\Windows\System\vvKyHlV.exe
  C:\Windows\System\vvKyHlV.exe
  2⤵
  PID:5188
- C:\Windows\System\zFhCcMp.exe
  C:\Windows\System\zFhCcMp.exe
  2⤵
  PID:5332
- C:\Windows\System\RjedkvJ.exe
  C:\Windows\System\RjedkvJ.exe
  2⤵
  PID:5472
- C:\Windows\System\iYzpcmd.exe
  C:\Windows\System\iYzpcmd.exe
  2⤵
  PID:5608
- C:\Windows\System\thFRgly.exe
  C:\Windows\System\thFRgly.exe
  2⤵
  PID:5684
- C:\Windows\System\TcNAGFh.exe
  C:\Windows\System\TcNAGFh.exe
  2⤵
  PID:5832
- C:\Windows\System\zJOAiAe.exe
  C:\Windows\System\zJOAiAe.exe
  2⤵
  PID:6000
- C:\Windows\System\FEYssPb.exe
  C:\Windows\System\FEYssPb.exe
  2⤵
  PID:5220
- C:\Windows\System\PclUcGy.exe
  C:\Windows\System\PclUcGy.exe
  2⤵
  PID:5508
- C:\Windows\System\LEshtmp.exe
  C:\Windows\System\LEshtmp.exe
  2⤵
  PID:6016
- C:\Windows\System\RVKnkUU.exe
  C:\Windows\System\RVKnkUU.exe
  2⤵
  PID:5696
- C:\Windows\System\XGIVOJK.exe
  C:\Windows\System\XGIVOJK.exe
  2⤵
  PID:6148
- C:\Windows\System\mqsJZIn.exe
  C:\Windows\System\mqsJZIn.exe
  2⤵
  PID:6176
- C:\Windows\System\xAZAyft.exe
  C:\Windows\System\xAZAyft.exe
  2⤵
  PID:6200
- C:\Windows\System\gfOYtDo.exe
  C:\Windows\System\gfOYtDo.exe
  2⤵
  PID:6232
- C:\Windows\System\KXCcTIt.exe
  C:\Windows\System\KXCcTIt.exe
  2⤵
  PID:6260
- C:\Windows\System\DeEUoWw.exe
  C:\Windows\System\DeEUoWw.exe
  2⤵
  PID:6288
- C:\Windows\System\XJNBqcq.exe
  C:\Windows\System\XJNBqcq.exe
  2⤵
  PID:6316
- C:\Windows\System\xYJmSvQ.exe
  C:\Windows\System\xYJmSvQ.exe
  2⤵
  PID:6336
- C:\Windows\System\ZqtVwYI.exe
  C:\Windows\System\ZqtVwYI.exe
  2⤵
  PID:6372
- C:\Windows\System\uaUuulA.exe
  C:\Windows\System\uaUuulA.exe
  2⤵
  PID:6400
- C:\Windows\System\mMZsHVi.exe
  C:\Windows\System\mMZsHVi.exe
  2⤵
  PID:6428
- C:\Windows\System\wJtvJtE.exe
  C:\Windows\System\wJtvJtE.exe
  2⤵
  PID:6456
- C:\Windows\System\JiycBoa.exe
  C:\Windows\System\JiycBoa.exe
  2⤵
  PID:6484
- C:\Windows\System\IcCLLBn.exe
  C:\Windows\System\IcCLLBn.exe
  2⤵
  PID:6508
- C:\Windows\System\sokCTZv.exe
  C:\Windows\System\sokCTZv.exe
  2⤵
  PID:6528
- C:\Windows\System\BaiAzVC.exe
  C:\Windows\System\BaiAzVC.exe
  2⤵
  PID:6560
- C:\Windows\System\UDRKCwA.exe
  C:\Windows\System\UDRKCwA.exe
  2⤵
  PID:6588
- C:\Windows\System\QsRfQCm.exe
  C:\Windows\System\QsRfQCm.exe
  2⤵
  PID:6616
- C:\Windows\System\XzKCpiu.exe
  C:\Windows\System\XzKCpiu.exe
  2⤵
  PID:6640
- C:\Windows\System\iXqXFQq.exe
  C:\Windows\System\iXqXFQq.exe
  2⤵
  PID:6672
- C:\Windows\System\toCgASB.exe
  C:\Windows\System\toCgASB.exe
  2⤵
  PID:6700
- C:\Windows\System\FbgvEKL.exe
  C:\Windows\System\FbgvEKL.exe
  2⤵
  PID:6720
- C:\Windows\System\SJwtjMe.exe
  C:\Windows\System\SJwtjMe.exe
  2⤵
  PID:6748
- C:\Windows\System\ZReSYDf.exe
  C:\Windows\System\ZReSYDf.exe
  2⤵
  PID:6772
- C:\Windows\System\QINBcGG.exe
  C:\Windows\System\QINBcGG.exe
  2⤵
  PID:6800
- C:\Windows\System\ahEVXIK.exe
  C:\Windows\System\ahEVXIK.exe
  2⤵
  PID:6832
- C:\Windows\System\DXEpJQu.exe
  C:\Windows\System\DXEpJQu.exe
  2⤵
  PID:6860
- C:\Windows\System\EFGEMMt.exe
  C:\Windows\System\EFGEMMt.exe
  2⤵
  PID:6888
- C:\Windows\System\MOfGwfC.exe
  C:\Windows\System\MOfGwfC.exe
  2⤵
  PID:6908
- C:\Windows\System\oNNelFW.exe
  C:\Windows\System\oNNelFW.exe
  2⤵
  PID:6944
- C:\Windows\System\nKHDRgW.exe
  C:\Windows\System\nKHDRgW.exe
  2⤵
  PID:6964
- C:\Windows\System\peWzPVh.exe
  C:\Windows\System\peWzPVh.exe
  2⤵
  PID:6992
- C:\Windows\System\GGQbAjR.exe
  C:\Windows\System\GGQbAjR.exe
  2⤵
  PID:7020
- C:\Windows\System\BHxbZfX.exe
  C:\Windows\System\BHxbZfX.exe
  2⤵
  PID:7044
- C:\Windows\System\vWlPSYq.exe
  C:\Windows\System\vWlPSYq.exe
  2⤵
  PID:7076
- C:\Windows\System\YzZsrLj.exe
  C:\Windows\System\YzZsrLj.exe
  2⤵
  PID:7104
- C:\Windows\System\mpdLsDh.exe
  C:\Windows\System\mpdLsDh.exe
  2⤵
  PID:7128
- C:\Windows\System\pBaAwCJ.exe
  C:\Windows\System\pBaAwCJ.exe
  2⤵
  PID:7160
- C:\Windows\System\orOHbcP.exe
  C:\Windows\System\orOHbcP.exe
  2⤵
  PID:6160
- C:\Windows\System\PrgkpYc.exe
  C:\Windows\System\PrgkpYc.exe
  2⤵
  PID:6220
- C:\Windows\System\gGpQlwi.exe
  C:\Windows\System\gGpQlwi.exe
  2⤵
  PID:6300
- C:\Windows\System\wzIYScD.exe
  C:\Windows\System\wzIYScD.exe
  2⤵
  PID:6360
- C:\Windows\System\NbehWtW.exe
  C:\Windows\System\NbehWtW.exe
  2⤵
  PID:6424
- C:\Windows\System\PTnyhqb.exe
  C:\Windows\System\PTnyhqb.exe
  2⤵
  PID:6480
- C:\Windows\System\SNPYzrF.exe
  C:\Windows\System\SNPYzrF.exe
  2⤵
  PID:6552
- C:\Windows\System\KAgXJfb.exe
  C:\Windows\System\KAgXJfb.exe
  2⤵
  PID:6612
- C:\Windows\System\unRWJLp.exe
  C:\Windows\System\unRWJLp.exe
  2⤵
  PID:6652
- C:\Windows\System\EXeIpBx.exe
  C:\Windows\System\EXeIpBx.exe
  2⤵
  PID:6740
- C:\Windows\System\QlYlOfs.exe
  C:\Windows\System\QlYlOfs.exe
  2⤵
  PID:6728
- C:\Windows\System\ObKNpjj.exe
  C:\Windows\System\ObKNpjj.exe
  2⤵
  PID:6792
- C:\Windows\System\zfaefnw.exe
  C:\Windows\System\zfaefnw.exe
  2⤵
  PID:6824
- C:\Windows\System\DFZDYmf.exe
  C:\Windows\System\DFZDYmf.exe
  2⤵
  PID:6880
- C:\Windows\System\diBzlFE.exe
  C:\Windows\System\diBzlFE.exe
  2⤵
  PID:6928
- C:\Windows\System\htWxCEq.exe
  C:\Windows\System\htWxCEq.exe
  2⤵
  PID:6976
- C:\Windows\System\paQUHHI.exe
  C:\Windows\System\paQUHHI.exe
  2⤵
  PID:7036
- C:\Windows\System\OHOWTyK.exe
  C:\Windows\System\OHOWTyK.exe
  2⤵
  PID:7088
- C:\Windows\System\QsHztVc.exe
  C:\Windows\System\QsHztVc.exe
  2⤵
  PID:6216
- C:\Windows\System\APfIvTS.exe
  C:\Windows\System\APfIvTS.exe
  2⤵
  PID:6352
- C:\Windows\System\qMLHZtD.exe
  C:\Windows\System\qMLHZtD.exe
  2⤵
  PID:6496
- C:\Windows\System\WOybzzR.exe
  C:\Windows\System\WOybzzR.exe
  2⤵
  PID:6688
- C:\Windows\System\aRCDglF.exe
  C:\Windows\System\aRCDglF.exe
  2⤵
  PID:6788
- C:\Windows\System\cPfoPIR.exe
  C:\Windows\System\cPfoPIR.exe
  2⤵
  PID:7028
- C:\Windows\System\oHKdXLp.exe
  C:\Windows\System\oHKdXLp.exe
  2⤵
  PID:7008
- C:\Windows\System\LkHfNtQ.exe
  C:\Windows\System\LkHfNtQ.exe
  2⤵
  PID:6476
- C:\Windows\System\KioXEGR.exe
  C:\Windows\System\KioXEGR.exe
  2⤵
  PID:7196
- C:\Windows\System\DkBIalN.exe
  C:\Windows\System\DkBIalN.exe
  2⤵
  PID:7216
- C:\Windows\System\uBtJgnT.exe
  C:\Windows\System\uBtJgnT.exe
  2⤵
  PID:7236
- C:\Windows\System\zphkUcs.exe
  C:\Windows\System\zphkUcs.exe
  2⤵
  PID:7256
- C:\Windows\System\tfXGdQk.exe
  C:\Windows\System\tfXGdQk.exe
  2⤵
  PID:7280
- C:\Windows\System\sGmvrlY.exe
  C:\Windows\System\sGmvrlY.exe
  2⤵
  PID:7304
- C:\Windows\System\IppczLu.exe
  C:\Windows\System\IppczLu.exe
  2⤵
  PID:7336
- C:\Windows\System\YtieQlr.exe
  C:\Windows\System\YtieQlr.exe
  2⤵
  PID:7360
- C:\Windows\System\bIEEiMf.exe
  C:\Windows\System\bIEEiMf.exe
  2⤵
  PID:7392
- C:\Windows\System\RUqAdtF.exe
  C:\Windows\System\RUqAdtF.exe
  2⤵
  PID:7420
- C:\Windows\System\KAQBIks.exe
  C:\Windows\System\KAQBIks.exe
  2⤵
  PID:7444
- C:\Windows\System\EMPaoZZ.exe
  C:\Windows\System\EMPaoZZ.exe
  2⤵
  PID:7472
- C:\Windows\System\RuqtQPO.exe
  C:\Windows\System\RuqtQPO.exe
  2⤵
  PID:7500
- C:\Windows\System\IfmlFfg.exe
  C:\Windows\System\IfmlFfg.exe
  2⤵
  PID:7536
- C:\Windows\System\jnFMcbK.exe
  C:\Windows\System\jnFMcbK.exe
  2⤵
  PID:7560
- C:\Windows\System\jfZNcuB.exe
  C:\Windows\System\jfZNcuB.exe
  2⤵
  PID:7584
- C:\Windows\System\WQAUEWi.exe
  C:\Windows\System\WQAUEWi.exe
  2⤵
  PID:7608
- C:\Windows\System\jNgrIRq.exe
  C:\Windows\System\jNgrIRq.exe
  2⤵
  PID:7632
- C:\Windows\System\CZAqZJa.exe
  C:\Windows\System\CZAqZJa.exe
  2⤵
  PID:7656
- C:\Windows\System\IQzxDfA.exe
  C:\Windows\System\IQzxDfA.exe
  2⤵
  PID:7688
- C:\Windows\System\idECkTC.exe
  C:\Windows\System\idECkTC.exe
  2⤵
  PID:7716
- C:\Windows\System\oXLLcDt.exe
  C:\Windows\System\oXLLcDt.exe
  2⤵
  PID:7740
- C:\Windows\System\aAgeFya.exe
  C:\Windows\System\aAgeFya.exe
  2⤵
  PID:7772
- C:\Windows\System\JJDfbDC.exe
  C:\Windows\System\JJDfbDC.exe
  2⤵
  PID:7796
- C:\Windows\System\drSbsFg.exe
  C:\Windows\System\drSbsFg.exe
  2⤵
  PID:7836
- C:\Windows\System\XunTFxs.exe
  C:\Windows\System\XunTFxs.exe
  2⤵
  PID:7864
- C:\Windows\System\mUlOarL.exe
  C:\Windows\System\mUlOarL.exe
  2⤵
  PID:7892
- C:\Windows\System\IMuOkju.exe
  C:\Windows\System\IMuOkju.exe
  2⤵
  PID:7916
- C:\Windows\System\JPbLUiv.exe
  C:\Windows\System\JPbLUiv.exe
  2⤵
  PID:7944
- C:\Windows\System\oyFaMAr.exe
  C:\Windows\System\oyFaMAr.exe
  2⤵
  PID:7976
- C:\Windows\System\DPYorqS.exe
  C:\Windows\System\DPYorqS.exe
  2⤵
  PID:8000
- C:\Windows\System\ZDSmige.exe
  C:\Windows\System\ZDSmige.exe
  2⤵
  PID:8024
- C:\Windows\System\abcEdOU.exe
  C:\Windows\System\abcEdOU.exe
  2⤵
  PID:8044
- C:\Windows\System\taJnTaz.exe
  C:\Windows\System\taJnTaz.exe
  2⤵
  PID:8068
- C:\Windows\System\nLKUTRJ.exe
  C:\Windows\System\nLKUTRJ.exe
  2⤵
  PID:8088
- C:\Windows\System\LWicPZK.exe
  C:\Windows\System\LWicPZK.exe
  2⤵
  PID:8108
- C:\Windows\System\XzDLdby.exe
  C:\Windows\System\XzDLdby.exe
  2⤵
  PID:8132
- C:\Windows\System\TTHkpci.exe
  C:\Windows\System\TTHkpci.exe
  2⤵
  PID:8152
- C:\Windows\System\eBPxzbw.exe
  C:\Windows\System\eBPxzbw.exe
  2⤵
  PID:8176
- C:\Windows\System\FEHoDHt.exe
  C:\Windows\System\FEHoDHt.exe
  2⤵
  PID:6664
- C:\Windows\System\hcSruYs.exe
  C:\Windows\System\hcSruYs.exe
  2⤵
  PID:6568
- C:\Windows\System\VoSJYEd.exe
  C:\Windows\System\VoSJYEd.exe
  2⤵
  PID:6956
- C:\Windows\System\CdvEIix.exe
  C:\Windows\System\CdvEIix.exe
  2⤵
  PID:7180
- C:\Windows\System\tMNAbut.exe
  C:\Windows\System\tMNAbut.exe
  2⤵
  PID:7296
- C:\Windows\System\SFeWHEF.exe
  C:\Windows\System\SFeWHEF.exe
  2⤵
  PID:7368
- C:\Windows\System\MaKGnZK.exe
  C:\Windows\System\MaKGnZK.exe
  2⤵
  PID:7404
- C:\Windows\System\cLwVHjL.exe
  C:\Windows\System\cLwVHjL.exe
  2⤵
  PID:7312
- C:\Windows\System\rpBassV.exe
  C:\Windows\System\rpBassV.exe
  2⤵
  PID:7320
- C:\Windows\System\LweuOba.exe
  C:\Windows\System\LweuOba.exe
  2⤵
  PID:7428
- C:\Windows\System\dCEeuQL.exe
  C:\Windows\System\dCEeuQL.exe
  2⤵
  PID:7604
- C:\Windows\System\JtFxfbS.exe
  C:\Windows\System\JtFxfbS.exe
  2⤵
  PID:7728
- C:\Windows\System\dsshLSZ.exe
  C:\Windows\System\dsshLSZ.exe
  2⤵
  PID:7516
- C:\Windows\System\wGXYkhu.exe
  C:\Windows\System\wGXYkhu.exe
  2⤵
  PID:7644
- C:\Windows\System\sbTfksP.exe
  C:\Windows\System\sbTfksP.exe
  2⤵
  PID:7792
- C:\Windows\System\AMcVIRJ.exe
  C:\Windows\System\AMcVIRJ.exe
  2⤵
  PID:7668
- C:\Windows\System\RLAjxGf.exe
  C:\Windows\System\RLAjxGf.exe
  2⤵
  PID:7936
- C:\Windows\System\zDNldUh.exe
  C:\Windows\System\zDNldUh.exe
  2⤵
  PID:7848
- C:\Windows\System\aqHigUG.exe
  C:\Windows\System\aqHigUG.exe
  2⤵
  PID:7928
- C:\Windows\System\rXfqPDM.exe
  C:\Windows\System\rXfqPDM.exe
  2⤵
  PID:7988
- C:\Windows\System\IrTsKyX.exe
  C:\Windows\System\IrTsKyX.exe
  2⤵
  PID:8100
- C:\Windows\System\LuEFtyl.exe
  C:\Windows\System\LuEFtyl.exe
  2⤵
  PID:6548
- C:\Windows\System\wYBPOAo.exe
  C:\Windows\System\wYBPOAo.exe
  2⤵
  PID:7344
- C:\Windows\System\XxWYpCc.exe
  C:\Windows\System\XxWYpCc.exe
  2⤵
  PID:6520
- C:\Windows\System\gyXrlmW.exe
  C:\Windows\System\gyXrlmW.exe
  2⤵
  PID:7752
- C:\Windows\System\LsYmiEQ.exe
  C:\Windows\System\LsYmiEQ.exe
  2⤵
  PID:7440
- C:\Windows\System\TcYpwZl.exe
  C:\Windows\System\TcYpwZl.exe
  2⤵
  PID:8148
- C:\Windows\System\RNkBJwt.exe
  C:\Windows\System\RNkBJwt.exe
  2⤵
  PID:7144
- C:\Windows\System\VIAOAHK.exe
  C:\Windows\System\VIAOAHK.exe
  2⤵
  PID:8016
- C:\Windows\System\kzIWcbC.exe
  C:\Windows\System\kzIWcbC.exe
  2⤵
  PID:7276
- C:\Windows\System\zlmZGph.exe
  C:\Windows\System\zlmZGph.exe
  2⤵
  PID:8204
- C:\Windows\System\cNOdjWx.exe
  C:\Windows\System\cNOdjWx.exe
  2⤵
  PID:8236
- C:\Windows\System\dyKWddm.exe
  C:\Windows\System\dyKWddm.exe
  2⤵
  PID:8256
- C:\Windows\System\nyKbjVI.exe
  C:\Windows\System\nyKbjVI.exe
  2⤵
  PID:8272
- C:\Windows\System\UghobhI.exe
  C:\Windows\System\UghobhI.exe
  2⤵
  PID:8292
- C:\Windows\System\kDxqYsT.exe
  C:\Windows\System\kDxqYsT.exe
  2⤵
  PID:8324
- C:\Windows\System\cwxQWAI.exe
  C:\Windows\System\cwxQWAI.exe
  2⤵
  PID:8348
- C:\Windows\System\xjKUJBR.exe
  C:\Windows\System\xjKUJBR.exe
  2⤵
  PID:8372
- C:\Windows\System\CNFoTNZ.exe
  C:\Windows\System\CNFoTNZ.exe
  2⤵
  PID:8404
- C:\Windows\System\enDEKNT.exe
  C:\Windows\System\enDEKNT.exe
  2⤵
  PID:8424
- C:\Windows\System\neEJBrB.exe
  C:\Windows\System\neEJBrB.exe
  2⤵
  PID:8448
- C:\Windows\System\SIGbyAc.exe
  C:\Windows\System\SIGbyAc.exe
  2⤵
  PID:8476
- C:\Windows\System\WVZGmvt.exe
  C:\Windows\System\WVZGmvt.exe
  2⤵
  PID:8500
- C:\Windows\System\UGMFNaK.exe
  C:\Windows\System\UGMFNaK.exe
  2⤵
  PID:8532
- C:\Windows\System\hfYUmYi.exe
  C:\Windows\System\hfYUmYi.exe
  2⤵
  PID:8552
- C:\Windows\System\qgGWVrC.exe
  C:\Windows\System\qgGWVrC.exe
  2⤵
  PID:8580
- C:\Windows\System\guogBKe.exe
  C:\Windows\System\guogBKe.exe
  2⤵
  PID:8608
- C:\Windows\System\GRAmRLo.exe
  C:\Windows\System\GRAmRLo.exe
  2⤵
  PID:8640
- C:\Windows\System\qduwJsd.exe
  C:\Windows\System\qduwJsd.exe
  2⤵
  PID:8656
- C:\Windows\System\PKNBRlO.exe
  C:\Windows\System\PKNBRlO.exe
  2⤵
  PID:8684
- C:\Windows\System\HQukVqY.exe
  C:\Windows\System\HQukVqY.exe
  2⤵
  PID:8712
- C:\Windows\System\vRBTiby.exe
  C:\Windows\System\vRBTiby.exe
  2⤵
  PID:8736
- C:\Windows\System\oksWWRh.exe
  C:\Windows\System\oksWWRh.exe
  2⤵
  PID:8760
- C:\Windows\System\iJYeCkz.exe
  C:\Windows\System\iJYeCkz.exe
  2⤵
  PID:8788
- C:\Windows\System\vDntzsx.exe
  C:\Windows\System\vDntzsx.exe
  2⤵
  PID:8820
- C:\Windows\System\yAxECUg.exe
  C:\Windows\System\yAxECUg.exe
  2⤵
  PID:8848
- C:\Windows\System\uKlgMsf.exe
  C:\Windows\System\uKlgMsf.exe
  2⤵
  PID:8872
- C:\Windows\System\gXnBkrg.exe
  C:\Windows\System\gXnBkrg.exe
  2⤵
  PID:8896
- C:\Windows\System\MOBFeoP.exe
  C:\Windows\System\MOBFeoP.exe
  2⤵
  PID:8916
- C:\Windows\System\JKKcoPC.exe
  C:\Windows\System\JKKcoPC.exe
  2⤵
  PID:8936
- C:\Windows\System\KKkzfqI.exe
  C:\Windows\System\KKkzfqI.exe
  2⤵
  PID:8960
- C:\Windows\System\XCYmrxV.exe
  C:\Windows\System\XCYmrxV.exe
  2⤵
  PID:8992
- C:\Windows\System\mXXJdqT.exe
  C:\Windows\System\mXXJdqT.exe
  2⤵
  PID:9024
- C:\Windows\System\EEIVdOl.exe
  C:\Windows\System\EEIVdOl.exe
  2⤵
  PID:9048
- C:\Windows\System\tlIsQHD.exe
  C:\Windows\System\tlIsQHD.exe
  2⤵
  PID:9076
- C:\Windows\System\oFZOcKa.exe
  C:\Windows\System\oFZOcKa.exe
  2⤵
  PID:9108
- C:\Windows\System\uTZlhjl.exe
  C:\Windows\System\uTZlhjl.exe
  2⤵
  PID:9132
- C:\Windows\System\pNEbWxQ.exe
  C:\Windows\System\pNEbWxQ.exe
  2⤵
  PID:9164
- C:\Windows\System\DXblsNW.exe
  C:\Windows\System\DXblsNW.exe
  2⤵
  PID:9180
- C:\Windows\System\ibErZQP.exe
  C:\Windows\System\ibErZQP.exe
  2⤵
  PID:9196
- C:\Windows\System\NQGIhQu.exe
  C:\Windows\System\NQGIhQu.exe
  2⤵
  PID:8020
- C:\Windows\System\zMsWmKf.exe
  C:\Windows\System\zMsWmKf.exe
  2⤵
  PID:7388
- C:\Windows\System\PCCdGoW.exe
  C:\Windows\System\PCCdGoW.exe
  2⤵
  PID:8040
- C:\Windows\System\gpXnCFl.exe
  C:\Windows\System\gpXnCFl.exe
  2⤵
  PID:8076
- C:\Windows\System\oNPqhbd.exe
  C:\Windows\System\oNPqhbd.exe
  2⤵
  PID:8144
- C:\Windows\System\JFiBHxh.exe
  C:\Windows\System\JFiBHxh.exe
  2⤵
  PID:7232
- C:\Windows\System\mrnePlG.exe
  C:\Windows\System\mrnePlG.exe
  2⤵
  PID:8420
- C:\Windows\System\GraTUoL.exe
  C:\Windows\System\GraTUoL.exe
  2⤵
  PID:8084
- C:\Windows\System\FTYNqxB.exe
  C:\Windows\System\FTYNqxB.exe
  2⤵
  PID:8548
- C:\Windows\System\tztDTdA.exe
  C:\Windows\System\tztDTdA.exe
  2⤵
  PID:8280
- C:\Windows\System\pWtQzPZ.exe
  C:\Windows\System\pWtQzPZ.exe
  2⤵
  PID:7248
- C:\Windows\System\URqrhtF.exe
  C:\Windows\System\URqrhtF.exe
  2⤵
  PID:8756
- C:\Windows\System\pfbGTQD.exe
  C:\Windows\System\pfbGTQD.exe
  2⤵
  PID:8812
- C:\Windows\System\NyyBBND.exe
  C:\Windows\System\NyyBBND.exe
  2⤵
  PID:8196
- C:\Windows\System\lSQzbHs.exe
  C:\Windows\System\lSQzbHs.exe
  2⤵
  PID:8912
- C:\Windows\System\IJbNASE.exe
  C:\Windows\System\IJbNASE.exe
  2⤵
  PID:8980
- C:\Windows\System\tVhHwQQ.exe
  C:\Windows\System\tVhHwQQ.exe
  2⤵
  PID:8336
- C:\Windows\System\LfOASGl.exe
  C:\Windows\System\LfOASGl.exe
  2⤵
  PID:9072
- C:\Windows\System\KvhECVj.exe
  C:\Windows\System\KvhECVj.exe
  2⤵
  PID:9192
- C:\Windows\System\NxttccI.exe
  C:\Windows\System\NxttccI.exe
  2⤵
  PID:7520
- C:\Windows\System\SxWcwlY.exe
  C:\Windows\System\SxWcwlY.exe
  2⤵
  PID:7812
- C:\Windows\System\aYlWhbI.exe
  C:\Windows\System\aYlWhbI.exe
  2⤵
  PID:8224
- C:\Windows\System\wBYGZio.exe
  C:\Windows\System\wBYGZio.exe
  2⤵
  PID:8416
- C:\Windows\System\isHENBb.exe
  C:\Windows\System\isHENBb.exe
  2⤵
  PID:8700
- C:\Windows\System\YLdPYrC.exe
  C:\Windows\System\YLdPYrC.exe
  2⤵
  PID:9088
- C:\Windows\System\QfswkfH.exe
  C:\Windows\System\QfswkfH.exe
  2⤵
  PID:8752
- C:\Windows\System\UdMSeZm.exe
  C:\Windows\System\UdMSeZm.exe
  2⤵
  PID:8784
- C:\Windows\System\sbqekrY.exe
  C:\Windows\System\sbqekrY.exe
  2⤵
  PID:9220
- C:\Windows\System\SxUKSfF.exe
  C:\Windows\System\SxUKSfF.exe
  2⤵
  PID:9244
- C:\Windows\System\QNVXQVL.exe
  C:\Windows\System\QNVXQVL.exe
  2⤵
  PID:9268
- C:\Windows\System\wFgHVfb.exe
  C:\Windows\System\wFgHVfb.exe
  2⤵
  PID:9296
- C:\Windows\System\MVDuDfX.exe
  C:\Windows\System\MVDuDfX.exe
  2⤵
  PID:9320
- C:\Windows\System\ZPHXoJw.exe
  C:\Windows\System\ZPHXoJw.exe
  2⤵
  PID:9352
- C:\Windows\System\sNpPaKj.exe
  C:\Windows\System\sNpPaKj.exe
  2⤵
  PID:9380
- C:\Windows\System\YlpdlGy.exe
  C:\Windows\System\YlpdlGy.exe
  2⤵
  PID:9404
- C:\Windows\System\gvKugYv.exe
  C:\Windows\System\gvKugYv.exe
  2⤵
  PID:9436
- C:\Windows\System\glaWWMn.exe
  C:\Windows\System\glaWWMn.exe
  2⤵
  PID:9460
- C:\Windows\System\SmLNBQH.exe
  C:\Windows\System\SmLNBQH.exe
  2⤵
  PID:9488
- C:\Windows\System\rXmOjMu.exe
  C:\Windows\System\rXmOjMu.exe
  2⤵
  PID:9516
- C:\Windows\System\LQaksBM.exe
  C:\Windows\System\LQaksBM.exe
  2⤵
  PID:9544
- C:\Windows\System\avTIFht.exe
  C:\Windows\System\avTIFht.exe
  2⤵
  PID:9568
- C:\Windows\System\qzpUiMF.exe
  C:\Windows\System\qzpUiMF.exe
  2⤵
  PID:9592
- C:\Windows\System\djUmXNi.exe
  C:\Windows\System\djUmXNi.exe
  2⤵
  PID:9620
- C:\Windows\System\errDMbN.exe
  C:\Windows\System\errDMbN.exe
  2⤵
  PID:9648
- C:\Windows\System\DHTTStz.exe
  C:\Windows\System\DHTTStz.exe
  2⤵
  PID:9664
- C:\Windows\System\WdUIaZs.exe
  C:\Windows\System\WdUIaZs.exe
  2⤵
  PID:9692
- C:\Windows\System\HhtwNib.exe
  C:\Windows\System\HhtwNib.exe
  2⤵
  PID:9720
- C:\Windows\System\SoxPyqB.exe
  C:\Windows\System\SoxPyqB.exe
  2⤵
  PID:9748
- C:\Windows\System\qHktJlf.exe
  C:\Windows\System\qHktJlf.exe
  2⤵
  PID:9772
- C:\Windows\System\dXHFQQM.exe
  C:\Windows\System\dXHFQQM.exe
  2⤵
  PID:9800
- C:\Windows\System\lhLCCJZ.exe
  C:\Windows\System\lhLCCJZ.exe
  2⤵
  PID:9828
- C:\Windows\System\bSYOkpo.exe
  C:\Windows\System\bSYOkpo.exe
  2⤵
  PID:9860
- C:\Windows\System\kACxDhR.exe
  C:\Windows\System\kACxDhR.exe
  2⤵
  PID:9892
- C:\Windows\System\ghVxtuz.exe
  C:\Windows\System\ghVxtuz.exe
  2⤵
  PID:9920
- C:\Windows\System\QHGkOPJ.exe
  C:\Windows\System\QHGkOPJ.exe
  2⤵
  PID:9940
- C:\Windows\System\giPDarf.exe
  C:\Windows\System\giPDarf.exe
  2⤵
  PID:9956
- C:\Windows\System\MLdZRic.exe
  C:\Windows\System\MLdZRic.exe
  2⤵
  PID:9984
- C:\Windows\System\KsCoZfX.exe
  C:\Windows\System\KsCoZfX.exe
  2⤵
  PID:10004
- C:\Windows\System\qwDEBIR.exe
  C:\Windows\System\qwDEBIR.exe
  2⤵
  PID:10028
- C:\Windows\System\MyeCoMu.exe
  C:\Windows\System\MyeCoMu.exe
  2⤵
  PID:10064
- C:\Windows\System\mSVOOlc.exe
  C:\Windows\System\mSVOOlc.exe
  2⤵
  PID:10084
- C:\Windows\System\BRniAkc.exe
  C:\Windows\System\BRniAkc.exe
  2⤵
  PID:10116
- C:\Windows\System\gOmnZHa.exe
  C:\Windows\System\gOmnZHa.exe
  2⤵
  PID:10144
- C:\Windows\System\VZUZgPA.exe
  C:\Windows\System\VZUZgPA.exe
  2⤵
  PID:10176
- C:\Windows\System\zpJjCYi.exe
  C:\Windows\System\zpJjCYi.exe
  2⤵
  PID:10196
- C:\Windows\System\ZCMBeJb.exe
  C:\Windows\System\ZCMBeJb.exe
  2⤵
  PID:10216
- C:\Windows\System\KnXbICH.exe
  C:\Windows\System\KnXbICH.exe
  2⤵
  PID:10236
- C:\Windows\System\PyHgJvY.exe
  C:\Windows\System\PyHgJvY.exe
  2⤵
  PID:9004
- C:\Windows\System\qWqsBqu.exe
  C:\Windows\System\qWqsBqu.exe
  2⤵
  PID:8696
- C:\Windows\System\zgXxybg.exe
  C:\Windows\System\zgXxybg.exe
  2⤵
  PID:8444
- C:\Windows\System\LnIwtfJ.exe
  C:\Windows\System\LnIwtfJ.exe
  2⤵
  PID:9152
- C:\Windows\System\sRKBOmW.exe
  C:\Windows\System\sRKBOmW.exe
  2⤵
  PID:9236
- C:\Windows\System\MvXgknM.exe
  C:\Windows\System\MvXgknM.exe
  2⤵
  PID:9044
- C:\Windows\System\rAqAXCf.exe
  C:\Windows\System\rAqAXCf.exe
  2⤵
  PID:9456
- C:\Windows\System\rkExxyX.exe
  C:\Windows\System\rkExxyX.exe
  2⤵
  PID:9484
- C:\Windows\System\yGVxdPr.exe
  C:\Windows\System\yGVxdPr.exe
  2⤵
  PID:9580
- C:\Windows\System\vBDDLLU.exe
  C:\Windows\System\vBDDLLU.exe
  2⤵
  PID:8836
- C:\Windows\System\MXEIXBu.exe
  C:\Windows\System\MXEIXBu.exe
  2⤵
  PID:9676
- C:\Windows\System\uGqklwb.exe
  C:\Windows\System\uGqklwb.exe
  2⤵
  PID:8952
- C:\Windows\System\wEiTYda.exe
  C:\Windows\System\wEiTYda.exe
  2⤵
  PID:4928
- C:\Windows\System\fkzDaKZ.exe
  C:\Windows\System\fkzDaKZ.exe
  2⤵
  PID:7708
- C:\Windows\System\iWyTkcJ.exe
  C:\Windows\System\iWyTkcJ.exe
  2⤵
  PID:9508
- C:\Windows\System\qLGICRG.exe
  C:\Windows\System\qLGICRG.exe
  2⤵
  PID:10260
- C:\Windows\System\JCeERwd.exe
  C:\Windows\System\JCeERwd.exe
  2⤵
  PID:10280
- C:\Windows\System\dDmFKoy.exe
  C:\Windows\System\dDmFKoy.exe
  2⤵
  PID:10300
- C:\Windows\System\syxSiPb.exe
  C:\Windows\System\syxSiPb.exe
  2⤵
  PID:10324
- C:\Windows\System\KHdskgk.exe
  C:\Windows\System\KHdskgk.exe
  2⤵
  PID:10344
- C:\Windows\System\oTagfiu.exe
  C:\Windows\System\oTagfiu.exe
  2⤵
  PID:10372
- C:\Windows\System\eETSBJc.exe
  C:\Windows\System\eETSBJc.exe
  2⤵
  PID:10404
- C:\Windows\System\rZalywr.exe
  C:\Windows\System\rZalywr.exe
  2⤵
  PID:10436
- C:\Windows\System\swxKXjv.exe
  C:\Windows\System\swxKXjv.exe
  2⤵
  PID:10456
- C:\Windows\System\fylBAOq.exe
  C:\Windows\System\fylBAOq.exe
  2⤵
  PID:10476
- C:\Windows\System\MHonuxJ.exe
  C:\Windows\System\MHonuxJ.exe
  2⤵
  PID:10508
- C:\Windows\System\tifUbjP.exe
  C:\Windows\System\tifUbjP.exe
  2⤵
  PID:10528
- C:\Windows\System\rvrVNsQ.exe
  C:\Windows\System\rvrVNsQ.exe
  2⤵
  PID:10548
- C:\Windows\System\IAFVPwP.exe
  C:\Windows\System\IAFVPwP.exe
  2⤵
  PID:10576
- C:\Windows\System\iTnKRei.exe
  C:\Windows\System\iTnKRei.exe
  2⤵
  PID:10600
- C:\Windows\System\icLjHmq.exe
  C:\Windows\System\icLjHmq.exe
  2⤵
  PID:10632
- C:\Windows\System\UzcKdqg.exe
  C:\Windows\System\UzcKdqg.exe
  2⤵
  PID:10648
- C:\Windows\System\fGKVtVL.exe
  C:\Windows\System\fGKVtVL.exe
  2⤵
  PID:10680
- C:\Windows\System\maXRbxf.exe
  C:\Windows\System\maXRbxf.exe
  2⤵
  PID:10700
- C:\Windows\System\nNFdcbJ.exe
  C:\Windows\System\nNFdcbJ.exe
  2⤵
  PID:10724
- C:\Windows\System\cwZpmAE.exe
  C:\Windows\System\cwZpmAE.exe
  2⤵
  PID:10752
- C:\Windows\System\DsellvR.exe
  C:\Windows\System\DsellvR.exe
  2⤵
  PID:10776
- C:\Windows\System\OdShYmk.exe
  C:\Windows\System\OdShYmk.exe
  2⤵
  PID:10800
- C:\Windows\System\BCzshTh.exe
  C:\Windows\System\BCzshTh.exe
  2⤵
  PID:10824
- C:\Windows\System\aBVjNMS.exe
  C:\Windows\System\aBVjNMS.exe
  2⤵
  PID:10852
- C:\Windows\System\YEYRkFN.exe
  C:\Windows\System\YEYRkFN.exe
  2⤵
  PID:10888
- C:\Windows\System\ffoYRQp.exe
  C:\Windows\System\ffoYRQp.exe
  2⤵
  PID:10920
- C:\Windows\System\fQFxlbo.exe
  C:\Windows\System\fQFxlbo.exe
  2⤵
  PID:10944
- C:\Windows\System\SssULyk.exe
  C:\Windows\System\SssULyk.exe
  2⤵
  PID:10972
- C:\Windows\System\WkPqnCu.exe
  C:\Windows\System\WkPqnCu.exe
  2⤵
  PID:11004
- C:\Windows\System\sfohnLm.exe
  C:\Windows\System\sfohnLm.exe
  2⤵
  PID:11024
- C:\Windows\System\sHqZjYT.exe
  C:\Windows\System\sHqZjYT.exe
  2⤵
  PID:11052
- C:\Windows\System\liLVgDQ.exe
  C:\Windows\System\liLVgDQ.exe
  2⤵
  PID:11076
- C:\Windows\System\URcTjcZ.exe
  C:\Windows\System\URcTjcZ.exe
  2⤵
  PID:11100
- C:\Windows\System\zDMzFJK.exe
  C:\Windows\System\zDMzFJK.exe
  2⤵
  PID:11124
- C:\Windows\System\ZzOGNyB.exe
  C:\Windows\System\ZzOGNyB.exe
  2⤵
  PID:11156
- C:\Windows\System\JxFLOOg.exe
  C:\Windows\System\JxFLOOg.exe
  2⤵
  PID:11180
- C:\Windows\System\vzCWQDT.exe
  C:\Windows\System\vzCWQDT.exe
  2⤵
  PID:11200
- C:\Windows\System\OyaeQoy.exe
  C:\Windows\System\OyaeQoy.exe
  2⤵
  PID:11228
- C:\Windows\System\nCdgjXR.exe
  C:\Windows\System\nCdgjXR.exe
  2⤵
  PID:11252
- C:\Windows\System\VyiMJOw.exe
  C:\Windows\System\VyiMJOw.exe
  2⤵
  PID:8676
- C:\Windows\System\SpTpUQh.exe
  C:\Windows\System\SpTpUQh.exe
  2⤵
  PID:9780
- C:\Windows\System\FiFBqfR.exe
  C:\Windows\System\FiFBqfR.exe
  2⤵
  PID:9400
- C:\Windows\System\fMdJxdo.exe
  C:\Windows\System\fMdJxdo.exe
  2⤵
  PID:9904
- C:\Windows\System\tnyMNMA.exe
  C:\Windows\System\tnyMNMA.exe
  2⤵
  PID:10020
- C:\Windows\System\IggqspH.exe
  C:\Windows\System\IggqspH.exe
  2⤵
  PID:9288
- C:\Windows\System\zxmOymr.exe
  C:\Windows\System\zxmOymr.exe
  2⤵
  PID:8588
- C:\Windows\System\fBWrtGg.exe
  C:\Windows\System\fBWrtGg.exe
  2⤵
  PID:10208
- C:\Windows\System\iyOSWUN.exe
  C:\Windows\System\iyOSWUN.exe
  2⤵
  PID:10312
- C:\Windows\System\bKudEGQ.exe
  C:\Windows\System\bKudEGQ.exe
  2⤵
  PID:10224
- C:\Windows\System\sEqLHEJ.exe
  C:\Windows\System\sEqLHEJ.exe
  2⤵
  PID:10380
- C:\Windows\System\ujCRRXk.exe
  C:\Windows\System\ujCRRXk.exe
  2⤵
  PID:9212
- C:\Windows\System\oRJdIwP.exe
  C:\Windows\System\oRJdIwP.exe
  2⤵
  PID:9844
- C:\Windows\System\KROVOck.exe
  C:\Windows\System\KROVOck.exe
  2⤵
  PID:8264
- C:\Windows\System\cRQjZvE.exe
  C:\Windows\System\cRQjZvE.exe
  2⤵
  PID:9992
- C:\Windows\System\ohsDpBQ.exe
  C:\Windows\System\ohsDpBQ.exe
  2⤵
  PID:10080
- C:\Windows\System\eRmLSpG.exe
  C:\Windows\System\eRmLSpG.exe
  2⤵
  PID:8436
- C:\Windows\System\GObsstY.exe
  C:\Windows\System\GObsstY.exe
  2⤵
  PID:10696
- C:\Windows\System\sHEzVhL.exe
  C:\Windows\System\sHEzVhL.exe
  2⤵
  PID:10296
- C:\Windows\System\ykFLoyC.exe
  C:\Windows\System\ykFLoyC.exe
  2⤵
  PID:10820
- C:\Windows\System\DTFXdsp.exe
  C:\Windows\System\DTFXdsp.exe
  2⤵
  PID:10472
- C:\Windows\System\oZfTarS.exe
  C:\Windows\System\oZfTarS.exe
  2⤵
  PID:9480
- C:\Windows\System\UbUnTIK.exe
  C:\Windows\System\UbUnTIK.exe
  2⤵
  PID:11132
- C:\Windows\System\xmwEsJT.exe
  C:\Windows\System\xmwEsJT.exe
  2⤵
  PID:10596
- C:\Windows\System\jjWhJpc.exe
  C:\Windows\System\jjWhJpc.exe
  2⤵
  PID:11276
- C:\Windows\System\eyVnmSK.exe
  C:\Windows\System\eyVnmSK.exe
  2⤵
  PID:11300
- C:\Windows\System\QamghdG.exe
  C:\Windows\System\QamghdG.exe
  2⤵
  PID:11328
- C:\Windows\System\cToTygj.exe
  C:\Windows\System\cToTygj.exe
  2⤵
  PID:11352
- C:\Windows\System\nlSgpdu.exe
  C:\Windows\System\nlSgpdu.exe
  2⤵
  PID:11380
- C:\Windows\System\CzJODWH.exe
  C:\Windows\System\CzJODWH.exe
  2⤵
  PID:11408
- C:\Windows\System\eITJfBj.exe
  C:\Windows\System\eITJfBj.exe
  2⤵
  PID:11432
- C:\Windows\System\CpShWsx.exe
  C:\Windows\System\CpShWsx.exe
  2⤵
  PID:11456
- C:\Windows\System\iyJyPqQ.exe
  C:\Windows\System\iyJyPqQ.exe
  2⤵
  PID:11484
- C:\Windows\System\cFvpBuU.exe
  C:\Windows\System\cFvpBuU.exe
  2⤵
  PID:11512
- C:\Windows\System\yqwNUqo.exe
  C:\Windows\System\yqwNUqo.exe
  2⤵
  PID:11536
- C:\Windows\System\LzINmuw.exe
  C:\Windows\System\LzINmuw.exe
  2⤵
  PID:11564
- C:\Windows\System\uiDAAdn.exe
  C:\Windows\System\uiDAAdn.exe
  2⤵
  PID:11588
- C:\Windows\System\GgDTQoK.exe
  C:\Windows\System\GgDTQoK.exe
  2⤵
  PID:11608
- C:\Windows\System\JzWxBQK.exe
  C:\Windows\System\JzWxBQK.exe
  2⤵
  PID:11624
- C:\Windows\System\EfLZuVf.exe
  C:\Windows\System\EfLZuVf.exe
  2⤵
  PID:11648
- C:\Windows\System\UUHXULm.exe
  C:\Windows\System\UUHXULm.exe
  2⤵
  PID:11680
- C:\Windows\System\orzsabM.exe
  C:\Windows\System\orzsabM.exe
  2⤵
  PID:11700
- C:\Windows\System\owdatou.exe
  C:\Windows\System\owdatou.exe
  2⤵
  PID:11728
- C:\Windows\System\VDFBTjL.exe
  C:\Windows\System\VDFBTjL.exe
  2⤵
  PID:11756
- C:\Windows\System\QGIveHW.exe
  C:\Windows\System\QGIveHW.exe
  2⤵
  PID:11780
- C:\Windows\System\ueSAsUE.exe
  C:\Windows\System\ueSAsUE.exe
  2⤵
  PID:11800
- C:\Windows\System\TViybEI.exe
  C:\Windows\System\TViybEI.exe
  2⤵
  PID:11824
- C:\Windows\System\HmlCKuj.exe
  C:\Windows\System\HmlCKuj.exe
  2⤵
  PID:11852
- C:\Windows\System\olEgecA.exe
  C:\Windows\System\olEgecA.exe
  2⤵
  PID:11880
- C:\Windows\System\jQLcjgN.exe
  C:\Windows\System\jQLcjgN.exe
  2⤵
  PID:11908
- C:\Windows\System\ixdriVV.exe
  C:\Windows\System\ixdriVV.exe
  2⤵
  PID:11936
- C:\Windows\System\tfAiovw.exe
  C:\Windows\System\tfAiovw.exe
  2⤵
  PID:11956
- C:\Windows\System\RTTqpSL.exe
  C:\Windows\System\RTTqpSL.exe
  2⤵
  PID:11976
- C:\Windows\System\OuRjSea.exe
  C:\Windows\System\OuRjSea.exe
  2⤵
  PID:11996
- C:\Windows\System\XdThcGN.exe
  C:\Windows\System\XdThcGN.exe
  2⤵
  PID:12024
- C:\Windows\System\bseLvjh.exe
  C:\Windows\System\bseLvjh.exe
  2⤵
  PID:12056
- C:\Windows\System\IzOshLT.exe
  C:\Windows\System\IzOshLT.exe
  2⤵
  PID:12080
- C:\Windows\System\WWKsWhj.exe
  C:\Windows\System\WWKsWhj.exe
  2⤵
  PID:12100
- C:\Windows\System\VaKANgi.exe
  C:\Windows\System\VaKANgi.exe
  2⤵
  PID:12124
- C:\Windows\System\YgynAXT.exe
  C:\Windows\System\YgynAXT.exe
  2⤵
  PID:12152
- C:\Windows\System\fEkRvxq.exe
  C:\Windows\System\fEkRvxq.exe
  2⤵
  PID:12180
- C:\Windows\System\ThSnmfm.exe
  C:\Windows\System\ThSnmfm.exe
  2⤵
  PID:12200
- C:\Windows\System\zgKTUup.exe
  C:\Windows\System\zgKTUup.exe
  2⤵
  PID:12228
- C:\Windows\System\YggDWLw.exe
  C:\Windows\System\YggDWLw.exe
  2⤵
  PID:12256
- C:\Windows\System\uIHlVZg.exe
  C:\Windows\System\uIHlVZg.exe
  2⤵
  PID:11244
- C:\Windows\System\JUucwIe.exe
  C:\Windows\System\JUucwIe.exe
  2⤵
  PID:10188
- C:\Windows\System\BgdDPLt.exe
  C:\Windows\System\BgdDPLt.exe
  2⤵
  PID:10276
- C:\Windows\System\qKZoqKp.exe
  C:\Windows\System\qKZoqKp.exe
  2⤵
  PID:8312
- C:\Windows\System\Wxmfuch.exe
  C:\Windows\System\Wxmfuch.exe
  2⤵
  PID:10848
- C:\Windows\System\ntAMbLl.exe
  C:\Windows\System\ntAMbLl.exe
  2⤵
  PID:10156
- C:\Windows\System\hcCdfRl.exe
  C:\Windows\System\hcCdfRl.exe
  2⤵
  PID:10896
- C:\Windows\System\UyXSNHN.exe
  C:\Windows\System\UyXSNHN.exe
  2⤵
  PID:10968
- C:\Windows\System\DBXsPAP.exe
  C:\Windows\System\DBXsPAP.exe
  2⤵
  PID:10992
- C:\Windows\System\gtXjfHx.exe
  C:\Windows\System\gtXjfHx.exe
  2⤵
  PID:11064
- C:\Windows\System\ePeVORM.exe
  C:\Windows\System\ePeVORM.exe
  2⤵
  PID:9728
- C:\Windows\System\TMPBwnZ.exe
  C:\Windows\System\TMPBwnZ.exe
  2⤵
  PID:10748
- C:\Windows\System\sPWQBUQ.exe
  C:\Windows\System\sPWQBUQ.exe
  2⤵
  PID:11016
- C:\Windows\System\bxPezYV.exe
  C:\Windows\System\bxPezYV.exe
  2⤵
  PID:10588
- C:\Windows\System\aHYGefA.exe
  C:\Windows\System\aHYGefA.exe
  2⤵
  PID:11288
- C:\Windows\System\IAOUsbj.exe
  C:\Windows\System\IAOUsbj.exe
  2⤵
  PID:11312
- C:\Windows\System\nJnobCG.exe
  C:\Windows\System\nJnobCG.exe
  2⤵
  PID:10716
- C:\Windows\System\AJQmzVn.exe
  C:\Windows\System\AJQmzVn.exe
  2⤵
  PID:9428
- C:\Windows\System\iDiFMKp.exe
  C:\Windows\System\iDiFMKp.exe
  2⤵
  PID:10052
- C:\Windows\System\ZEcWdYa.exe
  C:\Windows\System\ZEcWdYa.exe
  2⤵
  PID:10136
- C:\Windows\System\sBRMbTS.exe
  C:\Windows\System\sBRMbTS.exe
  2⤵
  PID:10320
- C:\Windows\System\ATzleQh.exe
  C:\Windows\System\ATzleQh.exe
  2⤵
  PID:9036
- C:\Windows\System\uJAjNAg.exe
  C:\Windows\System\uJAjNAg.exe
  2⤵
  PID:9340
- C:\Windows\System\HcNHZmF.exe
  C:\Windows\System\HcNHZmF.exe
  2⤵
  PID:11696
- C:\Windows\System\qdoiIDU.exe
  C:\Windows\System\qdoiIDU.exe
  2⤵
  PID:11764
- C:\Windows\System\CdXnCtg.exe
  C:\Windows\System\CdXnCtg.exe
  2⤵
  PID:10936
- C:\Windows\System\mzyKeuB.exe
  C:\Windows\System\mzyKeuB.exe
  2⤵
  PID:10500
- C:\Windows\System\RcxQpqk.exe
  C:\Windows\System\RcxQpqk.exe
  2⤵
  PID:11120
- C:\Windows\System\ItDiwhD.exe
  C:\Windows\System\ItDiwhD.exe
  2⤵
  PID:12012
- C:\Windows\System\HHBaFaU.exe
  C:\Windows\System\HHBaFaU.exe
  2⤵
  PID:8860
- C:\Windows\System\LgaYveK.exe
  C:\Windows\System\LgaYveK.exe
  2⤵
  PID:12164
- C:\Windows\System\EKNOoTa.exe
  C:\Windows\System\EKNOoTa.exe
  2⤵
  PID:11524
- C:\Windows\System\dbnjLqu.exe
  C:\Windows\System\dbnjLqu.exe
  2⤵
  PID:10712
- C:\Windows\System\OrrEkTX.exe
  C:\Windows\System\OrrEkTX.exe
  2⤵
  PID:9448
- C:\Windows\System\HeRugKl.exe
  C:\Windows\System\HeRugKl.exe
  2⤵
  PID:10424
- C:\Windows\System\IOwaNuN.exe
  C:\Windows\System\IOwaNuN.exe
  2⤵
  PID:12292
- C:\Windows\System\MWjysFC.exe
  C:\Windows\System\MWjysFC.exe
  2⤵
  PID:12312
- C:\Windows\System\xFaXIHb.exe
  C:\Windows\System\xFaXIHb.exe
  2⤵
  PID:12336
- C:\Windows\System\ZZrICHu.exe
  C:\Windows\System\ZZrICHu.exe
  2⤵
  PID:12364
- C:\Windows\System\BYnevXr.exe
  C:\Windows\System\BYnevXr.exe
  2⤵
  PID:12384
- C:\Windows\System\TkQHzKF.exe
  C:\Windows\System\TkQHzKF.exe
  2⤵
  PID:12400
- C:\Windows\System\TckoCCd.exe
  C:\Windows\System\TckoCCd.exe
  2⤵
  PID:12424
- C:\Windows\System\FQsRmDT.exe
  C:\Windows\System\FQsRmDT.exe
  2⤵
  PID:12444
- C:\Windows\System\tosFRUW.exe
  C:\Windows\System\tosFRUW.exe
  2⤵
  PID:12468
- C:\Windows\System\klkfgRp.exe
  C:\Windows\System\klkfgRp.exe
  2⤵
  PID:12492
- C:\Windows\System\xZwQgIC.exe
  C:\Windows\System\xZwQgIC.exe
  2⤵
  PID:12520
- C:\Windows\System\lAGfWbs.exe
  C:\Windows\System\lAGfWbs.exe
  2⤵
  PID:12544
- C:\Windows\System\OPoGgsI.exe
  C:\Windows\System\OPoGgsI.exe
  2⤵
  PID:12564
- C:\Windows\System\IJOKDlK.exe
  C:\Windows\System\IJOKDlK.exe
  2⤵
  PID:12588
- C:\Windows\System\vmhOFZi.exe
  C:\Windows\System\vmhOFZi.exe
  2⤵
  PID:12616
- C:\Windows\System\tvzwYKt.exe
  C:\Windows\System\tvzwYKt.exe
  2⤵
  PID:12636
- C:\Windows\System\hYTXXHw.exe
  C:\Windows\System\hYTXXHw.exe
  2⤵
  PID:12660
- C:\Windows\System\rwrueIN.exe
  C:\Windows\System\rwrueIN.exe
  2⤵
  PID:12688
- C:\Windows\System\tUEOTVE.exe
  C:\Windows\System\tUEOTVE.exe
  2⤵
  PID:12708
- C:\Windows\System\sHElVnu.exe
  C:\Windows\System\sHElVnu.exe
  2⤵
  PID:12744
- C:\Windows\System\piSnJpq.exe
  C:\Windows\System\piSnJpq.exe
  2⤵
  PID:12764
- C:\Windows\System\nLYaSjf.exe
  C:\Windows\System\nLYaSjf.exe
  2⤵
  PID:12792
- C:\Windows\System\arjuoSZ.exe
  C:\Windows\System\arjuoSZ.exe
  2⤵
  PID:12816
- C:\Windows\System\rXVjnfM.exe
  C:\Windows\System\rXVjnfM.exe
  2⤵
  PID:12836
- C:\Windows\System\EkAUcCq.exe
  C:\Windows\System\EkAUcCq.exe
  2⤵
  PID:12860
- C:\Windows\System\sJEknWy.exe
  C:\Windows\System\sJEknWy.exe
  2⤵
  PID:12892
- C:\Windows\System\SdOLTGU.exe
  C:\Windows\System\SdOLTGU.exe
  2⤵
  PID:12916
- C:\Windows\System\ltEAidd.exe
  C:\Windows\System\ltEAidd.exe
  2⤵
  PID:12940
- C:\Windows\System\ozYDepD.exe
  C:\Windows\System\ozYDepD.exe
  2⤵
  PID:12976
- C:\Windows\System\MIOlpig.exe
  C:\Windows\System\MIOlpig.exe
  2⤵
  PID:13000
- C:\Windows\System\WBTwIOL.exe
  C:\Windows\System\WBTwIOL.exe
  2⤵
  PID:13028
- C:\Windows\System\krvCBjM.exe
  C:\Windows\System\krvCBjM.exe
  2⤵
  PID:13044
- C:\Windows\System\ILVbHFL.exe
  C:\Windows\System\ILVbHFL.exe
  2⤵
  PID:13060
- C:\Windows\System\WXHrlrR.exe
  C:\Windows\System\WXHrlrR.exe
  2⤵
  PID:13088
- C:\Windows\System\lfVpXbi.exe
  C:\Windows\System\lfVpXbi.exe
  2⤵
  PID:13108
- C:\Windows\System\UmlAacT.exe
  C:\Windows\System\UmlAacT.exe
  2⤵
  PID:13132
- C:\Windows\System\BvVwiXk.exe
  C:\Windows\System\BvVwiXk.exe
  2⤵
  PID:13160
- C:\Windows\System\PffnoVG.exe
  C:\Windows\System\PffnoVG.exe
  2⤵
  PID:13188
- C:\Windows\System\oEeoxBm.exe
  C:\Windows\System\oEeoxBm.exe
  2⤵
  PID:13220
- C:\Windows\System\vzDqnKE.exe
  C:\Windows\System\vzDqnKE.exe
  2⤵
  PID:13252
- C:\Windows\System\iFfBmZy.exe
  C:\Windows\System\iFfBmZy.exe
  2⤵
  PID:13272
- C:\Windows\System\EHopksL.exe
  C:\Windows\System\EHopksL.exe
  2⤵
  PID:13296
- C:\Windows\System\EjtCuAc.exe
  C:\Windows\System\EjtCuAc.exe
  2⤵
  PID:10016
- C:\Windows\System\JEjZnJE.exe
  C:\Windows\System\JEjZnJE.exe
  2⤵
  PID:11916
- C:\Windows\System\UQBTpsm.exe
  C:\Windows\System\UQBTpsm.exe
  2⤵
  PID:12040
- C:\Windows\System\aJmucPn.exe
  C:\Windows\System\aJmucPn.exe
  2⤵
  PID:12120
- C:\Windows\System\zPnRSCS.exe
  C:\Windows\System\zPnRSCS.exe
  2⤵
  PID:11604
- C:\Windows\System\ucJVNOB.exe
  C:\Windows\System\ucJVNOB.exe
  2⤵
  PID:11660
- C:\Windows\System\tDCJpbz.exe
  C:\Windows\System\tDCJpbz.exe
  2⤵
  PID:11248
- C:\Windows\System\AEdISph.exe
  C:\Windows\System\AEdISph.exe
  2⤵
  PID:12004
- C:\Windows\System\TKhOPIW.exe
  C:\Windows\System\TKhOPIW.exe
  2⤵
  PID:11448
- C:\Windows\System\daKjVxW.exe
  C:\Windows\System\daKjVxW.exe
  2⤵
  PID:10368
- C:\Windows\System\JbQwEtc.exe
  C:\Windows\System\JbQwEtc.exe
  2⤵
  PID:12356
- C:\Windows\System\jfNyXKQ.exe
  C:\Windows\System\jfNyXKQ.exe
  2⤵
  PID:11848
- C:\Windows\System\jXDabhK.exe
  C:\Windows\System\jXDabhK.exe
  2⤵
  PID:10668
- C:\Windows\System\EwYOsqa.exe
  C:\Windows\System\EwYOsqa.exe
  2⤵
  PID:12484
- C:\Windows\System\QDxVkNt.exe
  C:\Windows\System\QDxVkNt.exe
  2⤵
  PID:11984
- C:\Windows\System\xuSfoQz.exe
  C:\Windows\System\xuSfoQz.exe
  2⤵
  PID:12036
- C:\Windows\System\gNqJYoP.exe
  C:\Windows\System\gNqJYoP.exe
  2⤵
  PID:11584
- C:\Windows\System\KjvDcce.exe
  C:\Windows\System\KjvDcce.exe
  2⤵
  PID:12760
- C:\Windows\System\KEpSchS.exe
  C:\Windows\System\KEpSchS.exe
  2⤵
  PID:12828
- C:\Windows\System\zzsMvHl.exe
  C:\Windows\System\zzsMvHl.exe
  2⤵
  PID:12872
- C:\Windows\System\BBagIpu.exe
  C:\Windows\System\BBagIpu.exe
  2⤵
  PID:13324
- C:\Windows\System\ffDAeFh.exe
  C:\Windows\System\ffDAeFh.exe
  2⤵
  PID:13348
- C:\Windows\System\GpzYXoL.exe
  C:\Windows\System\GpzYXoL.exe
  2⤵
  PID:13372
- C:\Windows\System\SgdqZsb.exe
  C:\Windows\System\SgdqZsb.exe
  2⤵
  PID:13400
- C:\Windows\System\DLuEwdX.exe
  C:\Windows\System\DLuEwdX.exe
  2⤵
  PID:13424
- C:\Windows\System\PLTPVgq.exe
  C:\Windows\System\PLTPVgq.exe
  2⤵
  PID:13448
- C:\Windows\System\SGPlChp.exe
  C:\Windows\System\SGPlChp.exe
  2⤵
  PID:13468
- C:\Windows\System\XsjYmps.exe
  C:\Windows\System\XsjYmps.exe
  2⤵
  PID:13492
- C:\Windows\System\LonHGOS.exe
  C:\Windows\System\LonHGOS.exe
  2⤵
  PID:13508
- C:\Windows\System\SZIKjxP.exe
  C:\Windows\System\SZIKjxP.exe
  2⤵
  PID:13532
- C:\Windows\System\eYJZnLp.exe
  C:\Windows\System\eYJZnLp.exe
  2⤵
  PID:13568
- C:\Windows\System\wVclEOw.exe
  C:\Windows\System\wVclEOw.exe
  2⤵
  PID:13596
- C:\Windows\System\IaWzOoj.exe
  C:\Windows\System\IaWzOoj.exe
  2⤵
  PID:13624
- C:\Windows\System\WHYQhrF.exe
  C:\Windows\System\WHYQhrF.exe
  2⤵
  PID:13648
- C:\Windows\System\shLUgRI.exe
  C:\Windows\System\shLUgRI.exe
  2⤵
  PID:13680
- C:\Windows\System\ZArILQF.exe
  C:\Windows\System\ZArILQF.exe
  2⤵
  PID:13700
- C:\Windows\System\pUiJkWA.exe
  C:\Windows\System\pUiJkWA.exe
  2⤵
  PID:13720
- C:\Windows\System\wXePQSe.exe
  C:\Windows\System\wXePQSe.exe
  2⤵
  PID:13748
- C:\Windows\System\ygYppBG.exe
  C:\Windows\System\ygYppBG.exe
  2⤵
  PID:13780
- C:\Windows\System\pRrVDOW.exe
  C:\Windows\System\pRrVDOW.exe
  2⤵
  PID:13800
- C:\Windows\System\QwowFrM.exe
  C:\Windows\System\QwowFrM.exe
  2⤵
  PID:13828
- C:\Windows\System\OXEliAq.exe
  C:\Windows\System\OXEliAq.exe
  2⤵
  PID:13860
- C:\Windows\System\rZzqBKd.exe
  C:\Windows\System\rZzqBKd.exe
  2⤵
  PID:13880
- C:\Windows\System\RyAJfFQ.exe
  C:\Windows\System\RyAJfFQ.exe
  2⤵
  PID:13912
- C:\Windows\System\UKTnilU.exe
  C:\Windows\System\UKTnilU.exe
  2⤵
  PID:13932
- C:\Windows\System\BxVXutp.exe
  C:\Windows\System\BxVXutp.exe
  2⤵
  PID:13964
- C:\Windows\System\FPSVjSa.exe
  C:\Windows\System\FPSVjSa.exe
  2⤵
  PID:13988
- C:\Windows\System\MOtCoLO.exe
  C:\Windows\System\MOtCoLO.exe
  2⤵
  PID:14012
- C:\Windows\System\cpHQloY.exe
  C:\Windows\System\cpHQloY.exe
  2⤵
  PID:12328
- C:\Windows\System\RhBVpyB.exe
  C:\Windows\System\RhBVpyB.exe
  2⤵
  PID:13260
- C:\Windows\System\QcpCwPE.exe
  C:\Windows\System\QcpCwPE.exe
  2⤵
  PID:12516
- C:\Windows\System\cElOwjd.exe
  C:\Windows\System\cElOwjd.exe
  2⤵
  PID:12576
- C:\Windows\System\AWwsXJI.exe
  C:\Windows\System\AWwsXJI.exe
  2⤵
  PID:12600
- C:\Windows\System\eXBomdx.exe
  C:\Windows\System\eXBomdx.exe
  2⤵
  PID:12240
- C:\Windows\System\qjCrbpK.exe
  C:\Windows\System\qjCrbpK.exe
  2⤵
  PID:12888
- C:\Windows\System\KHkvReP.exe
  C:\Windows\System\KHkvReP.exe
  2⤵
  PID:13332
- C:\Windows\System\XankgfS.exe
  C:\Windows\System\XankgfS.exe
  2⤵
  PID:10308
- C:\Windows\System\UIfEqRW.exe
  C:\Windows\System\UIfEqRW.exe
  2⤵
  PID:13104
- C:\Windows\System\apsodGK.exe
  C:\Windows\System\apsodGK.exe
  2⤵
  PID:12412
- C:\Windows\System\ULKSxTq.exe
  C:\Windows\System\ULKSxTq.exe
  2⤵
  PID:9868
- C:\Windows\System\xVFuHfw.exe
  C:\Windows\System\xVFuHfw.exe
  2⤵
  PID:12560
- C:\Windows\System\PVhkaxI.exe
  C:\Windows\System\PVhkaxI.exe
  2⤵
  PID:12612
- C:\Windows\System\GFmRwcj.exe
  C:\Windows\System\GFmRwcj.exe
  2⤵
  PID:12700
- C:\Windows\System\YMjQUWl.exe
  C:\Windows\System\YMjQUWl.exe
  2⤵
  PID:11296
- C:\Windows\System\xWLgHbu.exe
  C:\Windows\System\xWLgHbu.exe
  2⤵
  PID:14096
- C:\Windows\System\zQNIzrx.exe
  C:\Windows\System\zQNIzrx.exe
  2⤵
  PID:12856
- C:\Windows\System\kJRQAlm.exe
  C:\Windows\System\kJRQAlm.exe
  2⤵
  PID:13412
- C:\Windows\System\KvocUWQ.exe
  C:\Windows\System\KvocUWQ.exe
  2⤵
  PID:13432
- C:\Windows\System\opJQwJa.exe
  C:\Windows\System\opJQwJa.exe
  2⤵
  PID:13100
- C:\Windows\System\baAskSg.exe
  C:\Windows\System\baAskSg.exe
  2⤵
  PID:13608
- C:\Windows\System\rlKlZUo.exe
  C:\Windows\System\rlKlZUo.exe
  2⤵
  PID:13216
- C:\Windows\System\YcRiDCv.exe
  C:\Windows\System\YcRiDCv.exe
  2⤵
  PID:13692
- C:\Windows\System\CmDMGQe.exe
  C:\Windows\System\CmDMGQe.exe
  2⤵
  PID:14352
- C:\Windows\System\uigYSYm.exe
  C:\Windows\System\uigYSYm.exe
  2⤵
  PID:14384
- C:\Windows\System\ubjAFIH.exe
  C:\Windows\System\ubjAFIH.exe
  2⤵
  PID:14440
- C:\Windows\System\NjFLyLd.exe
  C:\Windows\System\NjFLyLd.exe
  2⤵
  PID:14472
- C:\Windows\System\tMSaWCK.exe
  C:\Windows\System\tMSaWCK.exe
  2⤵
  PID:14520
- C:\Windows\System\yuafcxW.exe
  C:\Windows\System\yuafcxW.exe
  2⤵
  PID:14536
- C:\Windows\System\ISrDrpv.exe
  C:\Windows\System\ISrDrpv.exe
  2⤵
  PID:14568
- C:\Windows\System\SpVlCTK.exe
  C:\Windows\System\SpVlCTK.exe
  2⤵
  PID:14604
- C:\Windows\System\IULhRaQ.exe
  C:\Windows\System\IULhRaQ.exe
  2⤵
  PID:14632
- C:\Windows\System\aoACIzC.exe
  C:\Windows\System\aoACIzC.exe
  2⤵
  PID:14656
- C:\Windows\System\gziQRLx.exe
  C:\Windows\System\gziQRLx.exe
  2⤵
  PID:14684
- C:\Windows\System\JPkcWZM.exe
  C:\Windows\System\JPkcWZM.exe
  2⤵
  PID:14708
- C:\Windows\System\HBwMDRq.exe
  C:\Windows\System\HBwMDRq.exe
  2⤵
  PID:14736
- C:\Windows\System\oJJFhDA.exe
  C:\Windows\System\oJJFhDA.exe
  2⤵
  PID:14768
- C:\Windows\System\ZHwNNSW.exe
  C:\Windows\System\ZHwNNSW.exe
  2⤵
  PID:14792
- C:\Windows\System\EeuYQGC.exe
  C:\Windows\System\EeuYQGC.exe
  2⤵
  PID:14816
- C:\Windows\System\pnWRTiS.exe
  C:\Windows\System\pnWRTiS.exe
  2⤵
  PID:14852
- C:\Windows\System\zMiaFZP.exe
  C:\Windows\System\zMiaFZP.exe
  2⤵
  PID:14880
- C:\Windows\System\WFZdKJu.exe
  C:\Windows\System\WFZdKJu.exe
  2⤵
  PID:14908
- C:\Windows\System\JKtBcqY.exe
  C:\Windows\System\JKtBcqY.exe
  2⤵
  PID:14932
- C:\Windows\System\VnwHycx.exe
  C:\Windows\System\VnwHycx.exe
  2⤵
  PID:14948
- C:\Windows\System\bPECfeK.exe
  C:\Windows\System\bPECfeK.exe
  2⤵
  PID:14984
- C:\Windows\System\BgptxGV.exe
  C:\Windows\System\BgptxGV.exe
  2⤵
  PID:15008
- C:\Windows\System\TrhtBut.exe
  C:\Windows\System\TrhtBut.exe
  2⤵
  PID:15040
- C:\Windows\System\eTYcRiS.exe
  C:\Windows\System\eTYcRiS.exe
  2⤵
  PID:15056
- C:\Windows\System\AsdNDVG.exe
  C:\Windows\System\AsdNDVG.exe
  2⤵
  PID:15072
- C:\Windows\System\OlXANpK.exe
  C:\Windows\System\OlXANpK.exe
  2⤵
  PID:15092
- C:\Windows\System\MiGdjfI.exe
  C:\Windows\System\MiGdjfI.exe
  2⤵
  PID:15116
- C:\Windows\System\dFJguxi.exe
  C:\Windows\System\dFJguxi.exe
  2⤵
  PID:15148
- C:\Windows\System\ePBchlK.exe
  C:\Windows\System\ePBchlK.exe
  2⤵
  PID:15184
- C:\Windows\System\lsgiTEb.exe
  C:\Windows\System\lsgiTEb.exe
  2⤵
  PID:15204
- C:\Windows\System\boYibSd.exe
  C:\Windows\System\boYibSd.exe
  2⤵
  PID:15232
- C:\Windows\System\zZUfJEM.exe
  C:\Windows\System\zZUfJEM.exe
  2⤵
  PID:15260
- C:\Windows\System\OHeaSXI.exe
  C:\Windows\System\OHeaSXI.exe
  2⤵
  PID:15284
- C:\Windows\System\YyAaLOX.exe
  C:\Windows\System\YyAaLOX.exe
  2⤵
  PID:15316
- C:\Windows\System\QpjFrYh.exe
  C:\Windows\System\QpjFrYh.exe
  2⤵
  PID:15340
- C:\Windows\System\nZRNYob.exe
  C:\Windows\System\nZRNYob.exe
  2⤵
  PID:13308
- C:\Windows\System\PoVubBY.exe
  C:\Windows\System\PoVubBY.exe
  2⤵
  PID:13812
- C:\Windows\System\tNFKVCi.exe
  C:\Windows\System\tNFKVCi.exe
  2⤵
  PID:12172
- C:\Windows\System\xxuxabf.exe
  C:\Windows\System\xxuxabf.exe
  2⤵
  PID:11096
- C:\Windows\System\bLtsldn.exe
  C:\Windows\System\bLtsldn.exe
  2⤵
  PID:13304
- C:\Windows\System\qYMmbfS.exe
  C:\Windows\System\qYMmbfS.exe
  2⤵
  PID:11552
- C:\Windows\System\PqebwIc.exe
  C:\Windows\System\PqebwIc.exe
  2⤵
  PID:12644
- C:\Windows\System\abKjnSS.exe
  C:\Windows\System\abKjnSS.exe
  2⤵
  PID:14160
- C:\Windows\System\ZSWUGFT.exe
  C:\Windows\System\ZSWUGFT.exe
  2⤵
  PID:13516
- C:\Windows\System\kwXEfzt.exe
  C:\Windows\System\kwXEfzt.exe
  2⤵
  PID:13504
- C:\Windows\System\DznCPPZ.exe
  C:\Windows\System\DznCPPZ.exe
  2⤵
  PID:13560
- C:\Windows\System\ttmUnzI.exe
  C:\Windows\System\ttmUnzI.exe
  2⤵
  PID:13208
- C:\Windows\System\ImutECc.exe
  C:\Windows\System\ImutECc.exe
  2⤵
  PID:13736
- C:\Windows\System\XIvndru.exe
  C:\Windows\System\XIvndru.exe
  2⤵
  PID:14288
- C:\Windows\System\uFwCSwy.exe
  C:\Windows\System\uFwCSwy.exe
  2⤵
  PID:13920
- C:\Windows\System\KvkdhKm.exe
  C:\Windows\System\KvkdhKm.exe
  2⤵
  PID:13944
- C:\Windows\System\AWOHwvn.exe
  C:\Windows\System\AWOHwvn.exe
  2⤵
  PID:14492
- C:\Windows\System\QzkIOPO.exe
  C:\Windows\System\QzkIOPO.exe
  2⤵
  PID:14000
- C:\Windows\System\gsjhlgW.exe
  C:\Windows\System\gsjhlgW.exe
  2⤵
  PID:14548
- C:\Windows\System\PqjVSoh.exe
  C:\Windows\System\PqjVSoh.exe
  2⤵
  PID:14588
- C:\Windows\System\BOZkBNH.exe
  C:\Windows\System\BOZkBNH.exe
  2⤵
  PID:13172
- C:\Windows\System\dfljHPD.exe
  C:\Windows\System\dfljHPD.exe
  2⤵
  PID:14648
- C:\Windows\System\UjlQExa.exe
  C:\Windows\System\UjlQExa.exe
  2⤵
  PID:11476
- C:\Windows\System\kxBRAiF.exe
  C:\Windows\System\kxBRAiF.exe
  2⤵
  PID:14840
- C:\Windows\System\XuWHxAm.exe
  C:\Windows\System\XuWHxAm.exe
  2⤵
  PID:12480
- C:\Windows\System\veXUsJW.exe
  C:\Windows\System\veXUsJW.exe
  2⤵
  PID:14180
- C:\Windows\System\TaVMltL.exe
  C:\Windows\System\TaVMltL.exe
  2⤵
  PID:9908
- C:\Windows\System\bmflNbX.exe
  C:\Windows\System\bmflNbX.exe
  2⤵
  PID:15064
- C:\Windows\System\YLtNLit.exe
  C:\Windows\System\YLtNLit.exe
  2⤵
  PID:12844
- C:\Windows\System\ZJLkGnh.exe
  C:\Windows\System\ZJLkGnh.exe
  2⤵
  PID:13420
- C:\Windows\System\ALPVnqA.exe
  C:\Windows\System\ALPVnqA.exe
  2⤵
  PID:15200
- C:\Windows\System\BHDpIoT.exe
  C:\Windows\System\BHDpIoT.exe
  2⤵
  PID:13672
- C:\Windows\System\pQUheIp.exe
  C:\Windows\System\pQUheIp.exe
  2⤵
  PID:15384
- C:\Windows\System\bukvOgN.exe
  C:\Windows\System\bukvOgN.exe
  2⤵
  PID:15412
- C:\Windows\System\fAAYRSK.exe
  C:\Windows\System\fAAYRSK.exe
  2⤵
  PID:15436
- C:\Windows\System\OIcOVAr.exe
  C:\Windows\System\OIcOVAr.exe
  2⤵
  PID:15452
- C:\Windows\System\ItVMkvJ.exe
  C:\Windows\System\ItVMkvJ.exe
  2⤵
  PID:15468
- C:\Windows\System\hlqxoXb.exe
  C:\Windows\System\hlqxoXb.exe
  2⤵
  PID:15500
- C:\Windows\System\KAQMPvS.exe
  C:\Windows\System\KAQMPvS.exe
  2⤵
  PID:15520
- C:\Windows\System\uVqZIEU.exe
  C:\Windows\System\uVqZIEU.exe
  2⤵
  PID:15544
- C:\Windows\System\aYwkRyr.exe
  C:\Windows\System\aYwkRyr.exe
  2⤵
  PID:15568
- C:\Windows\System\wZUwlFt.exe
  C:\Windows\System\wZUwlFt.exe
  2⤵
  PID:15596
- C:\Windows\System\qcvDrOt.exe
  C:\Windows\System\qcvDrOt.exe
  2⤵
  PID:15628
- C:\Windows\System\lilFNDU.exe
  C:\Windows\System\lilFNDU.exe
  2⤵
  PID:15656
- C:\Windows\System\evfjXvv.exe
  C:\Windows\System\evfjXvv.exe
  2⤵
  PID:15688
- C:\Windows\System\ckUGoIB.exe
  C:\Windows\System\ckUGoIB.exe
  2⤵
  PID:15712
- C:\Windows\System\SFiojtS.exe
  C:\Windows\System\SFiojtS.exe
  2⤵
  PID:15740
- C:\Windows\System\sICXSDN.exe
  C:\Windows\System\sICXSDN.exe
  2⤵
  PID:15768
- C:\Windows\System\xFlTmmg.exe
  C:\Windows\System\xFlTmmg.exe
  2⤵
  PID:15784
- C:\Windows\System\zdMLAyL.exe
  C:\Windows\System\zdMLAyL.exe
  2⤵
  PID:15804
- C:\Windows\System\OGQFGje.exe
  C:\Windows\System\OGQFGje.exe
  2⤵
  PID:15824
- C:\Windows\System\ydzbsZB.exe
  C:\Windows\System\ydzbsZB.exe
  2⤵
  PID:15856
- C:\Windows\System\IxnwuQM.exe
  C:\Windows\System\IxnwuQM.exe
  2⤵
  PID:15884
- C:\Windows\System\PhYmojl.exe
  C:\Windows\System\PhYmojl.exe
  2⤵
  PID:15900
- C:\Windows\System\vGYHAQH.exe
  C:\Windows\System\vGYHAQH.exe
  2⤵
  PID:15928
- C:\Windows\System\xMkHjoM.exe
  C:\Windows\System\xMkHjoM.exe
  2⤵
  PID:15956
- C:\Windows\System\qyHrLNs.exe
  C:\Windows\System\qyHrLNs.exe
  2⤵
  PID:15976
- C:\Windows\System\gxpwpAF.exe
  C:\Windows\System\gxpwpAF.exe
  2⤵
  PID:16000
- C:\Windows\System\JbCMIgG.exe
  C:\Windows\System\JbCMIgG.exe
  2⤵
  PID:16020
- C:\Windows\System\gktIISP.exe
  C:\Windows\System\gktIISP.exe
  2⤵
  PID:16044
- C:\Windows\System\VStdmEa.exe
  C:\Windows\System\VStdmEa.exe
  2⤵
  PID:16060
- C:\Windows\System\HKbWOje.exe
  C:\Windows\System\HKbWOje.exe
  2⤵
  PID:16076
- C:\Windows\System\xjuUuef.exe
  C:\Windows\System\xjuUuef.exe
  2⤵
  PID:16100
- C:\Windows\System\ReUgvsD.exe
  C:\Windows\System\ReUgvsD.exe
  2⤵
  PID:16116
- C:\Windows\System\MzSnhRL.exe
  C:\Windows\System\MzSnhRL.exe
  2⤵
  PID:16136
- C:\Windows\System\ocWHulm.exe
  C:\Windows\System\ocWHulm.exe
  2⤵
  PID:16156
- C:\Windows\System\masscYT.exe
  C:\Windows\System\masscYT.exe
  2⤵
  PID:16180
- C:\Windows\System\Fdwfimk.exe
  C:\Windows\System\Fdwfimk.exe
  2⤵
  PID:16200
- C:\Windows\System\hqPNmOV.exe
  C:\Windows\System\hqPNmOV.exe
  2⤵
  PID:16224
- C:\Windows\System\prSHUSb.exe
  C:\Windows\System\prSHUSb.exe
  2⤵
  PID:16244
- C:\Windows\System\jlYOWQW.exe
  C:\Windows\System\jlYOWQW.exe
  2⤵
  PID:16264
- C:\Windows\System\tBtcmSI.exe
  C:\Windows\System\tBtcmSI.exe
  2⤵
  PID:16280
- C:\Windows\System\WdsEMSe.exe
  C:\Windows\System\WdsEMSe.exe
  2⤵
  PID:16308
- C:\Windows\System\OymOHEQ.exe
  C:\Windows\System\OymOHEQ.exe
  2⤵
  PID:16332
- C:\Windows\System\dRBqShI.exe
  C:\Windows\System\dRBqShI.exe
  2⤵
  PID:16352
- C:\Windows\System\AfhXXoP.exe
  C:\Windows\System\AfhXXoP.exe
  2⤵
  PID:14404
- C:\Windows\System\FfdRYgg.exe
  C:\Windows\System\FfdRYgg.exe
  2⤵
  PID:14320
- C:\Windows\System\vUNToqW.exe
  C:\Windows\System\vUNToqW.exe
  2⤵
  PID:13792
- C:\Windows\System\aeoiNpd.exe
  C:\Windows\System\aeoiNpd.exe
  2⤵
  PID:11968
- C:\Windows\System\SzcRxWH.exe
  C:\Windows\System\SzcRxWH.exe
  2⤵
  PID:14668
- C:\Windows\System\ohthulW.exe
  C:\Windows\System\ohthulW.exe
  2⤵
  PID:14748
- C:\Windows\System\IabDEVe.exe
  C:\Windows\System\IabDEVe.exe
  2⤵
  PID:13148
- C:\Windows\System\HuzamJR.exe
  C:\Windows\System\HuzamJR.exe
  2⤵
  PID:13928
- C:\Windows\System\lBDQapM.exe
  C:\Windows\System\lBDQapM.exe
  2⤵
  PID:11176
- C:\Windows\System\xDNmluK.exe
  C:\Windows\System\xDNmluK.exe
  2⤵
  PID:13084
- C:\Windows\System\yZAyjYa.exe
  C:\Windows\System\yZAyjYa.exe
  2⤵
  PID:15144
- C:\Windows\System\PWaJKDE.exe
  C:\Windows\System\PWaJKDE.exe
  2⤵
  PID:15180
- C:\Windows\System\EaEvMnr.exe
  C:\Windows\System\EaEvMnr.exe
  2⤵
  PID:13096
- C:\Windows\System\jRBeHdA.exe
  C:\Windows\System\jRBeHdA.exe
  2⤵
  PID:14376
- C:\Windows\System\PKsjeSu.exe
  C:\Windows\System\PKsjeSu.exe
  2⤵
  PID:15380
- C:\Windows\System\gCmcMwp.exe
  C:\Windows\System\gCmcMwp.exe
  2⤵
  PID:15484
- C:\Windows\System\ikkfpuD.exe
  C:\Windows\System\ikkfpuD.exe
  2⤵
  PID:12788
- C:\Windows\System\iCRztgy.exe
  C:\Windows\System\iCRztgy.exe
  2⤵
  PID:14724
- C:\Windows\System\tElFyrS.exe
  C:\Windows\System\tElFyrS.exe
  2⤵
  PID:14764
- C:\Windows\System\MSrsPDQ.exe
  C:\Windows\System\MSrsPDQ.exe
  2⤵
  PID:13584
- C:\Windows\System\TqDapyF.exe
  C:\Windows\System\TqDapyF.exe
  2⤵
  PID:15800
- C:\Windows\System\TwwZxYG.exe
  C:\Windows\System\TwwZxYG.exe
  2⤵
  PID:14968
- C:\Windows\System\IXPFede.exe
  C:\Windows\System\IXPFede.exe
  2⤵
  PID:14580
- C:\Windows\System\vxYmzFB.exe
  C:\Windows\System\vxYmzFB.exe
  2⤵
  PID:15080
- C:\Windows\System\pEdRWxW.exe
  C:\Windows\System\pEdRWxW.exe
  2⤵
  PID:16392
- C:\Windows\System\kaEMkyH.exe
  C:\Windows\System\kaEMkyH.exe
  2⤵
  PID:16416
- C:\Windows\System\AZcszcZ.exe
  C:\Windows\System\AZcszcZ.exe
  2⤵
  PID:16440
- C:\Windows\System\nZKWsXi.exe
  C:\Windows\System\nZKWsXi.exe
  2⤵
  PID:16468
- C:\Windows\System\oDvWfUY.exe
  C:\Windows\System\oDvWfUY.exe
  2⤵
  PID:16488
- C:\Windows\System\PjTYjXc.exe
  C:\Windows\System\PjTYjXc.exe
  2⤵
  PID:16520
- C:\Windows\System\LijhsVh.exe
  C:\Windows\System\LijhsVh.exe
  2⤵
  PID:16544
- C:\Windows\System\pYBsIDx.exe
  C:\Windows\System\pYBsIDx.exe
  2⤵
  PID:16572
- C:\Windows\System\qzgbkXd.exe
  C:\Windows\System\qzgbkXd.exe
  2⤵
  PID:16596
- C:\Windows\System\XdInkSL.exe
  C:\Windows\System\XdInkSL.exe
  2⤵
  PID:16620
- C:\Windows\System\XTDyGnM.exe
  C:\Windows\System\XTDyGnM.exe
  2⤵
  PID:16636
- C:\Windows\System\yrNdaQY.exe
  C:\Windows\System\yrNdaQY.exe
  2⤵
  PID:16664
- C:\Windows\System\lQhwgqS.exe
  C:\Windows\System\lQhwgqS.exe
  2⤵
  PID:16688
- C:\Windows\System\OaMmoqL.exe
  C:\Windows\System\OaMmoqL.exe
  2⤵
  PID:16724
- C:\Windows\System\juuTTFb.exe
  C:\Windows\System\juuTTFb.exe
  2⤵
  PID:16740
- C:\Windows\System\cIluTcX.exe
  C:\Windows\System\cIluTcX.exe
  2⤵
  PID:16768
- C:\Windows\System\pdKUQgr.exe
  C:\Windows\System\pdKUQgr.exe
  2⤵
  PID:16808
- C:\Windows\System\ahvdtoV.exe
  C:\Windows\System\ahvdtoV.exe
  2⤵
  PID:16840
- C:\Windows\System\pdqvaDz.exe
  C:\Windows\System\pdqvaDz.exe
  2⤵
  PID:16856
- C:\Windows\System\EXVPlLW.exe
  C:\Windows\System\EXVPlLW.exe
  2⤵
  PID:16872
- C:\Windows\System\EowdaBQ.exe
  C:\Windows\System\EowdaBQ.exe
  2⤵
  PID:16892
- C:\Windows\System\aNHqImk.exe
  C:\Windows\System\aNHqImk.exe
  2⤵
  PID:16912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BByzQAt.exe

Filesize
1005KB

MD5
4e1eb6907288f2241bb5fda0aa00ee8d

SHA1
03fdc28d50421de93a37aaff4f87f2d489806430

SHA256
d7ef5a1fc84d522659bcd38e1adc4527a082189d26a84c22552ad5b3f9e0ec4a

SHA512
7841a8339a4d2f4d62c56d4c4b22cb20f6b323f6c7b7f68952233d0fdb71c17154efdb7730125f1bd5363615c8e6f3e97c84365bf29d157258cb274531bf7fcd

Download Submit
C:\Windows\System\BPAfZSq.exe

Filesize
1006KB

MD5
ef34c32d5a91b8244420efcb4ca37aef

SHA1
4b83d2892d8f99736ce2ac6521634bbc1389c5fa

SHA256
6f5d703dc1f5d2afde75364a36fbff30a8b7006a77f86b08ab3024d3b9c53e3e

SHA512
d3c9177896d5c61907fc5e8169e113deecfe4ba175376eb2817282a3085af05c549e6d1c39afd1bfa7f233564d3b9f34477d1cd73daf640b07044c755e310404

Download Submit
C:\Windows\System\BqZvTbH.exe

Filesize
1001KB

MD5
3c661ce9faed75965b86f4b864b0856b

SHA1
b0e66dca54dd8a4f4d5fecfc86f6cde3ea3fce5e

SHA256
ab610becb5d0ad84c57821d687da7c900cfe921de13b28c30ec299ef2fa13aa2

SHA512
4065cf8c022cffa52585918b0038b0bdf954daf33311d7bdaade701c7bafddf49629ef588f7087163f6105858b00f75b388b5f1e43665da9d8042b05d9ea3114

Download Submit
C:\Windows\System\CFLYyod.exe

Filesize
1004KB

MD5
eb91a48fc8c215b7cc98c948943f99bf

SHA1
8399fd1dd6a8f9b2f6dbc78a5cc497775107ecd2

SHA256
bf29df3ec4006f398bd5a76bf3748a3912170316b49146d77c230acf5294e358

SHA512
ed82a596fcd23f83b61467ff90f6e91e3459430043154fe7ee579ab85b3c205623c9b73da58cb6782e8dbf7488039abd633a87cefe86cb201d3cde470f6166a7

Download Submit
C:\Windows\System\DcYxIzr.exe

Filesize
1007KB

MD5
065913f19ed461a40b53a90688a70d65

SHA1
817f126a2e0db52cbb0a9c211c4f158abccb4e24

SHA256
a6993b50976483fb3752451a3114c20bd6e2f32e94e5665ef9e731f3a9ff9728

SHA512
12d36da3baa30b3566a3995a59f130c4616f3f185bd6c7be1583cc8faca7134f8674436bbce806fabd1b8711e0778fdf4253fabe6e9f8b27aa39b3c7616784d3

Download Submit
C:\Windows\System\EJRVrcz.exe

Filesize
1003KB

MD5
cc161315238db9b94b26bedb468a820c

SHA1
db5c1eaf652565457a5235c3c7f0ac153992e1fb

SHA256
490128458ab0f9e20f2f7d98186a14e1a476dbfce878ca7aec16a41c1859840b

SHA512
7cb2835c6a7e45989239c36abe042c382fe67be8d747fc65064a8695ec6b30cf83ab3805aa1fff8385d35a144efb068c3403cd7a77198f8757801dd92037e5b2

Download Submit
C:\Windows\System\FSlIfnU.exe

Filesize
1002KB

MD5
0551e5377ec148ed6507835b005bb905

SHA1
a21a3798344dfa2afc42967ecc8a5b94e4f0a736

SHA256
c775e537984a367b46d2cb8d5514f869fc8c4dca25765c6a90039f84d72fdabf

SHA512
e93fce1cc88b4635f7bbb16170a568d5062fdf2307bee72a32d74a48ab2f1e56fe08fc097bd869b6e7183d8f8f5dfaef78408cf0db74f6fc5e01f89a955a6dac

Download Submit
C:\Windows\System\FcpyTkU.exe

Filesize
1002KB

MD5
0b5b67f0c1ffd5357061dda4d3335887

SHA1
56c8ad23ff9a816e0b2b25c894e3673a88e56a3d

SHA256
71f0542cef0fa1a61f7435ceeb64697e2ffff5fff89eceb728fd953590643a10

SHA512
6f48a0d6213546a4308cf09fb22e23f9a152fb4eb55f55879adb2ad8f326f1e0ee34d84061623e45d9cebdf8a09d80b12c50ece89f06a4441f2bdff0a29b2a79

Download Submit
C:\Windows\System\HQdNvEb.exe

Filesize
1005KB

MD5
f416a9831c49bb4cde7bb5df3eab08f5

SHA1
29e069cc87ef3351db046def7f27a9b1aa852d39

SHA256
44d6742334ff9d7d3bbe10962baee59189438c8b5eb2a01ac99f3414035dbc49

SHA512
1d7000c4c993bcc5715377aa9bda2383c8630b154e02353d5ac03efb55e414dc24c5c2f9f946f7b255caf04dbc1a4c53753463d61fe30e5bc89ab9e6ef0e2e60

Download Submit
C:\Windows\System\JxLxxAd.exe

Filesize
1001KB

MD5
373fd49b15c37a90c05cef2d5cd29ebf

SHA1
d7701671755ffd93e9b223e1438ae19b674f509d

SHA256
add2977968676d17bdd2b8efd79adb2a24aa9223cb0cabcdeace6defc15f927c

SHA512
a3aabf493c4a747415e1e08cfb7192ed1f0dacee50320f30584f4c6d1f17dff92c967894347e1612cd1e21edc960a0c2de9e54a7a331638aab9feb5c66da8f8a

Download Submit
C:\Windows\System\LmlXrkD.exe

Filesize
1002KB

MD5
8511fbf65c04249bcb6443a93886bf03

SHA1
f0a9fadf3bcda858ee21917ebb6d51a94ec991d0

SHA256
ce0c9b94ac510743f966fa71b6a03db4d3bae0a4645d9ef61f66a29efdcec774

SHA512
f590faba1d0abf1001163d51dbc58ee33660094318209f1a7283db83c35677c85c82eef75661daac4613a66f55eb7be1080271a4cbdc2194e3c4d7c43443ce0a

Download Submit
C:\Windows\System\LobCPiL.exe

Filesize
1009KB

MD5
8fe1e6ef2a6b6b8b62a2bd3ddbcac1ff

SHA1
579f37c5f109e51e33cd7d58f6bd60890477664c

SHA256
cfb05c9f3b1abcfe7821fbabe6030c1dccee7aae59c8e01a55b00131716abf81

SHA512
2789779292835f4e0105f5406bd26699c56de9fb86ad111db1d98e434cb337ad870189d2b69796ca67c245a2004da0b7b90f468fe648dcd6d248726f478b6c87

Download Submit
C:\Windows\System\MbUWNiU.exe

Filesize
1007KB

MD5
63ceab6ce914c7527edfff8e5d138a64

SHA1
a3867d6645e23c8f12caa0140bf1ba5f1cd9b51a

SHA256
4ced64523033d8c5e79d58ccb2a5041d3f57141294393ab696d73a8e1843058e

SHA512
2d64ae4b2c698fd60f2479fbd018ac5dad48023d5cd1e1cf05363c07565acdd0c86888386666dc6ed76e19d87fd5056ceeb74a0a613512de7ac8bb0792fd9367

Download Submit
C:\Windows\System\OwcAyed.exe

Filesize
1006KB

MD5
dacb1d465c5f5bb3083c131d4876a6fb

SHA1
c79de498ce6fde5551da66d77c37d0bc2ae40317

SHA256
42794ac32c1655d014449d991b7df1c464c12f19da658741728f01712c194b73

SHA512
c7dfdd7d4d076f3af3dfea798903b71f5c53da1fc049785db06fb5596d9ecfb78478add719a6271c57ac7adcee7c4fba73ecded4025f6c8ecc3f747b4716c26d

Download Submit
C:\Windows\System\PPjkise.exe

Filesize
1005KB

MD5
903fee2b4101bebf96bd8b75da9852f3

SHA1
c97fbfcda24d7e807382058f282e4a7d2dc18841

SHA256
a1839a77b169de7087bd7ce7fd275dfb42635614fd95587e8a56bbbdb12dd060

SHA512
ea13e8d5cb3d40fc3ba3c7f903fe698b967152ba3720cab15a27c0e84aec8cc5cbe17f9b7e70ab217301645a9c81b65094c8eab7d884df20dd5f040bda9b97f2

Download Submit
C:\Windows\System\RZOmYgg.exe

Filesize
1008KB

MD5
9a3dd681bf0bd637ed87d098827b1b9d

SHA1
cf0d890703c378639c2a2105c4d1655a1e357d08

SHA256
5ddcabc00e209c77eb9b11efe744ead31f75d0b7d44ca8d4742db25eb40163fd

SHA512
9a3d18f4c34f843050a02db7d88294b083a60111715b7fbf200022fc03a5dcdaef9195b67f628131bf207b481496243a847a68d8e7b43ee34d7f5a73d8557c93

Download Submit
C:\Windows\System\TubGFnf.exe

Filesize
1004KB

MD5
835c546fe9752f0a9abcb6d0fe2c4c0c

SHA1
022468bd6191223a194885f1a67f988edb8bdd79

SHA256
73443c27ebe9c711abe41c4f66537fb0a5a478ff3cd534a186dbaa871addb546

SHA512
7f591a4f5807b455d57f7d37e63438654f00f422a8d2c96a143a4a3febec1049e5fa8492ef212d593c9b94086a1ed85bbb5569f5993f837d68f9b73d10d62724

Download Submit
C:\Windows\System\WyHtQMX.exe

Filesize
1006KB

MD5
145e5442022e07d67e13de1ffb44850e

SHA1
c83479ace04e9bf69c2846c29de76c426dbdd12b

SHA256
19662c010e8390c608bdb1fbbc56f93bd9d641937b9b53259cc968d2d1d8ccfa

SHA512
1fb5bd5b1b57c34595d78d0b75f321431d3f3640fd3285e7dafae5196eb9f077a4b3d872548151a8728adf6f2faf24a4353f123323521d6c004f0ab5dbd84db7

Download Submit
C:\Windows\System\YLjEYzU.exe

Filesize
1008KB

MD5
b4bc296b4ad0c916bc8cd3898fd7b340

SHA1
3a9d1f6e11a8f9354505f694727a3bff62e209a0

SHA256
ee44b52588afba7b7d171bab27af20c05b4ec15e826960b3fa0d8bd2f37218a1

SHA512
f27d5e38bc646ab2b2b2572d604707cb3ed07f8454c176c80d6fa0e958bda86aca4574736b6aaa7f9f5c87b1020f9423a36186dd545fb1b125b7758acab08227

Download Submit
C:\Windows\System\YSUsqLz.exe

Filesize
1006KB

MD5
a060ada0970014b1565643fe0d6676c6

SHA1
79f8ee7a885cbf59a52c9f4883fe2b236a1d6d84

SHA256
ae7a41b453ec2da0bd49458d7b043c95be98c4b5ca6d80612e86ce5b96818dbc

SHA512
e9cbc65c6569c8375dbb25caf3931a08aa5b34b098b247f9a5ddd2165a43126b435ed9b8d8498921c2e9a50e0974bb98b3af80e9ac40379b52945a406e91d432

Download Submit
C:\Windows\System\YoFaizl.exe

Filesize
1003KB

MD5
4f026a6380401c376103fb0cfcdd0401

SHA1
72edf58afb2c195b1ba0da7eb6d0657835a1f6ff

SHA256
0942ef2239f9660dfe5e5be9f59d486736fd318664cefdad7370f35003ccc88f

SHA512
9d76671ed19782cab8adf55f54782363b97b4a22b9af4ac1affcfdcc1f55c210ab20d8160706a7ea93701f83d490a5c938298e1a6b744574638d42357964d5fd

Download Submit
C:\Windows\System\YozvsXs.exe

Filesize
1007KB

MD5
b1e356f1ed9fd52b24ed3ab2d13b9233

SHA1
77505facae74e5ceb415d97ff6a705bdb560f603

SHA256
6432f6b341b5e3c76380f8dce5251ec49e622e1f7655358168ec7773bf36fb64

SHA512
69fb182fe8ab4794cbf90e2226a47cd5eea2613aecf02c400948ccf88e0c32895ba6d1aad285e6795781256fcc60429f6196d9a7b5cbba9ef43e41f9ed23f607

Download Submit
C:\Windows\System\cqntOUe.exe

Filesize
1001KB

MD5
368c5ba3428a1806be01a2f63300ad42

SHA1
068cd66aef40e5cd2f6175c3019804366bc8a594

SHA256
3b61099b605a7945c1d584873443f0eb330cc7f39ac4d206f1f04c76a757f62f

SHA512
d83c669ca26c2e609179281245aee2f828db8129907ed8a5c91946a345e8712700c57e814f39032efa5c9f446c4d1d54f727ccca56d1fa89186838074589e1ab

Download Submit
C:\Windows\System\drtNdsD.exe

Filesize
1008KB

MD5
d67a164cd9a69ed6feee9eb40de2e36c

SHA1
4a2d2848e363a8bf6ae4c9326fcbaf603bc90a96

SHA256
b844a9f62c09042fe1066797fdabdb001bd1b2f29811f76254c58347d46363a9

SHA512
1850de457ba2b499de58040843e0a10e28d218b58ddc636241f2332e3383aa790920c927b6f32443565d5a924534561e53a08b57f93cb83fcfe051cb6892c4dd

Download Submit
C:\Windows\System\fTOVuiO.exe

Filesize
1003KB

MD5
0d93a3960062c2844eefafbdf255b088

SHA1
d6f6332eb3fe9464ab1cd0a5d274015e5ce8ca4d

SHA256
3f2e83dd4d660ded0cc5ff5aa7c30bb806f2e29bc48debf54a89ecd2bcc7dea8

SHA512
0f695dd4a858a99723fb6f34601f3d6e5598d872701f77f7e7befbed14a85862c2207294bc0ba84c68a8c7a338fb4828c47b494112f7290b37fd40382e031c31

Download Submit
C:\Windows\System\flztMef.exe

Filesize
1001KB

MD5
2bc3554045318bcf2631bd34872b1dea

SHA1
2f00211e39b8186a6f5ffe66c242e1f6d748bef3

SHA256
2be9a5dcec8ddf6599121d36c851e3f1750346759b127a6a9951483a4efdda58

SHA512
f39b8bd436cae77eacb22b3231fadcad802fe1d75e1ece95512ccc38da3af1bef18fa7320d861484a8d556a5c39fc8e4346c8537a22abc259156e291e78fc02e

Download Submit
C:\Windows\System\fnVPTYY.exe

Filesize
1004KB

MD5
b95e2a4bd335f75eb3e08a6d0b230ecb

SHA1
98b3218ab14e322dafd586cec308689f63394193

SHA256
7e030c7c932df4197eb0e43d976f6922131daa38d664d856f92cd23fa0e1169a

SHA512
4d3aa87f29a6b9ba9ae4c043e4e91e11dfaa05cea1d8422e7e5749324f7f1222557a28276a22ee67cde64ad0f1d9c1e3b5f49bac7098dca8be0172495c7c0e16

Download Submit
C:\Windows\System\hOPqzDI.exe

Filesize
1005KB

MD5
c7e7d66f30ce1ccb992eb14b84544f33

SHA1
75d454725d612b9412b84f9f5d6e35d793189e1a

SHA256
ee599bff7cfd4f8de85d4b340a16a569f33cec8607b01b873842bbeae02e48b8

SHA512
b459a9c8117b42f249e0bdb34ec0adaebfe82e2a0d52d3087d2ea35c41f29476a539d70b7c0bf2b973dd32f3cac546c244c410536dd536d2769421b6a6cac83d

Download Submit
C:\Windows\System\hctvYIG.exe

Filesize
1008KB

MD5
3b137d598a08d91dbd448d25a6a42e73

SHA1
8decd86691d93ed19efee46ccf10527a3b7a61ad

SHA256
e81945fb668923c252fa3faac946a499c32f7f50bf4148000ebcc61d9de10e0d

SHA512
215ae1fc914dbb527a9161048c251f344b5bf7cc8e3d4204cea7e8c6988b0aff5b62aee9df12bf5fe4dfd511f0daefd253be5f0fef19dbbd69f87326c665a383

Download Submit
C:\Windows\System\ijTBuwk.exe

Filesize
1002KB

MD5
4ac66c4c4f4e89bb662b1b3dc6942bf8

SHA1
76c0f66ef52797d4115ebf5f875781ed69ebc84a

SHA256
3c1ef4ca46d282deced0311141c670d53bf98f4394e58a880072c7de2c918c9c

SHA512
d1c5d6d4b67d2407a77c09a72417101cec755611cdab9cd186fa343c6305eeba60996f359a985fbf38d89bcd5908dfab64957ce8ad5cb371d27bff5ce5870706

Download Submit
C:\Windows\System\mRZhueD.exe

Filesize
1004KB

MD5
e75506868015b902a0d6e9d0de61c79a

SHA1
e956e03faacd7282caec2be9bbc2aa2764082481

SHA256
9e11aa6e85b4d18e12e4486832626845a189f76017970676e70a33b4b6d27973

SHA512
9a35608ba76ece3465b2db78193e5d9345004af77a46196a06f6f85981e886f38b78803805c518412e827d0ee76639c7f1ae85c28a859164b9bdab75e5eeeb13

Download Submit
C:\Windows\System\mwRkyln.exe

Filesize
1007KB

MD5
0cdf52d0fec021873d28c0bf3372e7fc

SHA1
d961c0eac8dbf58061a767276935832263bc8baa

SHA256
ef36e64805b5e262aea3b8c38be6b4613a4c7c670908317c977b8bec00cdaec3

SHA512
46dca0ff49b9071033a60d7525693a519598152ab882a8197aad5e696e44d5ad0aa5647593ae1ca140d932a58bd734b5b69c2fe97461209553d3c29e69757792

Download Submit
C:\Windows\System\qjooGzI.exe

Filesize
1009KB

MD5
a0447501fb60bb545b1f2ba08e87ecb0

SHA1
19138cb542f6356c267b6c8a03fc8c4f610fcdda

SHA256
33deb0062367318ada2bf86da34af08ed8faa72c9d8588ec0d6eb6e6108eb110

SHA512
785fa86418e660f0ba9d4aea5c2d814aaa55f6255c973296cf7ce4c53f4b9914e726304d5b07bd553c168d91ca505ba7e07a571d373e8128f7bb521d9fc8cdd3

Download Submit
C:\Windows\System\qmPedGW.exe

Filesize
1003KB

MD5
a89a3475a010719897f3680b73c12e38

SHA1
ce6a49475a2d821b611df9d567d9479bbf988e2f

SHA256
6ead56fac6ab4070ff27b9d221e0c824bd8cee45ae19bf7f5b9f77f96d7a5ed3

SHA512
b6fba6bef8b5f35116b75bfb21cfdf06e90e34e628f7658338708b0ed992368d2b8312e7aeb74b509aca2e42d736b7fa17a54ecac716e2ee79a216271c741ebe

Download Submit
C:\Windows\System\sTzQiWA.exe

Filesize
1009KB

MD5
1ce823d50f620cd9d5977a8d330676fe

SHA1
545973dbf5c02c5b005be23ffe479bc67bdae9ff

SHA256
2ab74820b7c254f51ece3d9fcdc7548f943cb34dbb3c03f4909745de0f9229b8

SHA512
f47d63a7f4b7adc3c62d6ecb41f1e900950cae00a09615307bc96b66631423bab338322d036c2d6b76f23c8b64582f8a6daa5c08c9cf55b0613a6e72cf4f8f4f

Download Submit
memory/4900-0-0x000002117FDD0000-0x000002117FDE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads