xmrig | 1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2024, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
Size

1.6MB
MD5

0955daed2b958bd73f884eb39d16df13
SHA1

6808685e356510e11f9bacd6f202e331d21e0103
SHA256

1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3
SHA512

5e246122eaacfa5a9e420e302c54ba98db777d7b550fa5342af5d9ff38be4f445da4c401a31f212c9cab9aa5ffc68365aedf3adb5f122371e9d4a3351d719480
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZrzIC:GemTLkNdfE0pZyL

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023bb4-4.dat	xmrig
behavioral2/files/0x0008000000023ca8-7.dat	xmrig
behavioral2/files/0x0008000000023ca7-9.dat	xmrig
behavioral2/files/0x0007000000023ca9-20.dat	xmrig
behavioral2/files/0x0007000000023caa-23.dat	xmrig
behavioral2/files/0x0007000000023cac-31.dat	xmrig
behavioral2/files/0x0007000000023cae-43.dat	xmrig
behavioral2/files/0x0007000000023caf-45.dat	xmrig
behavioral2/files/0x0007000000023cb1-56.dat	xmrig
behavioral2/files/0x0007000000023cb3-63.dat	xmrig
behavioral2/files/0x0007000000023cb2-62.dat	xmrig
behavioral2/files/0x0007000000023cb0-60.dat	xmrig
behavioral2/files/0x0007000000023cad-50.dat	xmrig
behavioral2/files/0x0007000000023cab-32.dat	xmrig
behavioral2/files/0x0009000000023c9b-78.dat	xmrig
behavioral2/files/0x0007000000023cb4-77.dat	xmrig
behavioral2/files/0x0007000000023cb5-82.dat	xmrig
behavioral2/files/0x0007000000023cb7-88.dat	xmrig
behavioral2/files/0x0007000000023cb9-101.dat	xmrig
behavioral2/files/0x0007000000023cbb-115.dat	xmrig
behavioral2/files/0x0007000000023cbc-140.dat	xmrig
behavioral2/files/0x0007000000023cc7-172.dat	xmrig
behavioral2/files/0x0007000000023cc6-167.dat	xmrig
behavioral2/files/0x0007000000023cbf-166.dat	xmrig
behavioral2/files/0x0007000000023cc1-160.dat	xmrig
behavioral2/files/0x0007000000023cc3-159.dat	xmrig
behavioral2/files/0x0007000000023cc5-154.dat	xmrig
behavioral2/files/0x0007000000023cc4-152.dat	xmrig
behavioral2/files/0x0007000000023cbe-148.dat	xmrig
behavioral2/files/0x0007000000023cbd-145.dat	xmrig
behavioral2/files/0x0007000000023cba-142.dat	xmrig
behavioral2/files/0x0007000000023cc0-141.dat	xmrig
behavioral2/files/0x0007000000023cc2-132.dat	xmrig
behavioral2/files/0x0007000000023cb8-110.dat	xmrig
behavioral2/files/0x0007000000023cb6-105.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2588	UiTmeYe.exe
3608	AAmoZvh.exe
1584	YASljJM.exe
1048	tiTarPM.exe
1204	VbxuTpW.exe
4248	fshUZpt.exe
4008	nBlRoZY.exe
2140	WrNyUcX.exe
1424	YphWXic.exe
3172	qfONxPS.exe
2888	RdjTEDo.exe
220	gQkgGdx.exe
3108	OqBJKAJ.exe
1776	LTBECHj.exe
3752	WsvwXWu.exe
1452	buyswgK.exe
3472	Mngwjfs.exe
4740	zdIevox.exe
4032	garWIKF.exe
2624	lEpNwug.exe
2176	HQKWkTr.exe
3212	WfXjrhl.exe
2252	tyfBkfQ.exe
2676	CruXSGY.exe
2272	yblFSzr.exe
4568	NrQsKDW.exe
2720	kIpaFlG.exe
3928	tvSeBhk.exe
2692	BKtvzTZ.exe
620	seFPknZ.exe
1324	zgKjHuo.exe
1148	GyYFvqX.exe
1728	HnLgnOp.exe
1848	wnEFDIO.exe
4476	EfmQJFO.exe
2912	BsodxnV.exe
1400	appSAcM.exe
1432	xbOfsfc.exe
2200	XNLKvQu.exe
1600	uUvuzdi.exe
4512	FeNTWDy.exe
1028	cedxvJu.exe
5032	XhmjDtc.exe
3604	jnakjud.exe
1044	OwcNQwh.exe
4936	RxrQxvh.exe
3600	jefRETr.exe
652	GwrqwAA.exe
4264	dQPhGZi.exe
1396	mdxmdac.exe
3592	qMiZpPn.exe
4896	QctiTTP.exe
4104	YuLpwMF.exe
1668	WTDcJKI.exe
4404	FbyFtfZ.exe
4108	gPwKrKW.exe
4544	mbQltzq.exe
2760	WMUtYfx.exe
1064	JSoAzhB.exe
3532	aIWuYut.exe
1356	eRKbnFk.exe
216	YXhRWGh.exe
1328	TcLyuAW.exe
4796	yKdcfgR.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LdBAifN.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\zgKjHuo.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\CrLZsti.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\LnHrEkK.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\GSHdecC.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\jefRETr.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\NuRbhAU.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\sQatDGt.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\OQUkUBo.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\aYssFcr.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\LhiFTxA.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\FpVNCAX.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\MQEwaZk.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\MhEDPkn.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\VzeYpVQ.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\YXGomJi.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\ScErQfi.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\wnEFDIO.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\ZYBCpla.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\ihRUDvQ.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\gqpiYhe.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\TeBadlv.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\kNTtmMw.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\eRbBBAP.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\SafGfzM.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\tAxzunR.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\sGpCwtv.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\zegPKzR.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\TquzAiN.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\GSqAoTH.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\feAsaos.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\HaMeGXh.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\YvfRlYU.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\arLVjEb.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\SlJWqTf.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\IjMXQIq.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\pyywASM.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\FNQBJVQ.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\emHonua.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\RTPkGbs.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\IfBGnOt.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\TOsRLRO.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\gPeBrdu.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\NyhAEYv.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\XcpXCGS.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\rtrsKaM.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\Mtyzabh.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\FywcDdX.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\tlpSTUu.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\fmJaSRy.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\DlIYNST.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\EfmQJFO.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\cZmDyPZ.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\SWUoHBr.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\yKdcfgR.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\ftURRDo.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\rZqBsEu.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\KvSOKNU.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\pKQplTD.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\HkFNDdl.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\LExQoEP.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\VZODumb.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\bcZsxXb.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
File created	C:\Windows\System\SEcFzOa.exe	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2588	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	83
PID 2824 wrote to memory of 2588	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	83
PID 2824 wrote to memory of 3608	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	84
PID 2824 wrote to memory of 3608	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	84
PID 2824 wrote to memory of 1584	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	85
PID 2824 wrote to memory of 1584	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	85
PID 2824 wrote to memory of 1048	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	86
PID 2824 wrote to memory of 1048	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	86
PID 2824 wrote to memory of 1204	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	87
PID 2824 wrote to memory of 1204	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	87
PID 2824 wrote to memory of 4248	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	88
PID 2824 wrote to memory of 4248	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	88
PID 2824 wrote to memory of 4008	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	89
PID 2824 wrote to memory of 4008	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	89
PID 2824 wrote to memory of 2140	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	90
PID 2824 wrote to memory of 2140	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	90
PID 2824 wrote to memory of 1424	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	91
PID 2824 wrote to memory of 1424	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	91
PID 2824 wrote to memory of 3172	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	92
PID 2824 wrote to memory of 3172	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	92
PID 2824 wrote to memory of 2888	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	93
PID 2824 wrote to memory of 2888	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	93
PID 2824 wrote to memory of 220	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	94
PID 2824 wrote to memory of 220	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	94
PID 2824 wrote to memory of 3108	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	95
PID 2824 wrote to memory of 3108	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	95
PID 2824 wrote to memory of 1776	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	96
PID 2824 wrote to memory of 1776	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	96
PID 2824 wrote to memory of 3752	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	97
PID 2824 wrote to memory of 3752	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	97
PID 2824 wrote to memory of 1452	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	98
PID 2824 wrote to memory of 1452	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	98
PID 2824 wrote to memory of 3472	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	99
PID 2824 wrote to memory of 3472	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	99
PID 2824 wrote to memory of 4032	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	100
PID 2824 wrote to memory of 4032	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	100
PID 2824 wrote to memory of 4740	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	101
PID 2824 wrote to memory of 4740	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	101
PID 2824 wrote to memory of 2624	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	102
PID 2824 wrote to memory of 2624	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	102
PID 2824 wrote to memory of 2176	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	103
PID 2824 wrote to memory of 2176	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	103
PID 2824 wrote to memory of 3212	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	104
PID 2824 wrote to memory of 3212	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	104
PID 2824 wrote to memory of 2252	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	105
PID 2824 wrote to memory of 2252	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	105
PID 2824 wrote to memory of 2676	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	106
PID 2824 wrote to memory of 2676	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	106
PID 2824 wrote to memory of 2272	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	107
PID 2824 wrote to memory of 2272	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	107
PID 2824 wrote to memory of 4568	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	108
PID 2824 wrote to memory of 4568	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	108
PID 2824 wrote to memory of 2720	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	109
PID 2824 wrote to memory of 2720	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	109
PID 2824 wrote to memory of 620	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	110
PID 2824 wrote to memory of 620	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	110
PID 2824 wrote to memory of 1728	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	111
PID 2824 wrote to memory of 1728	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	111
PID 2824 wrote to memory of 3928	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	112
PID 2824 wrote to memory of 3928	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	112
PID 2824 wrote to memory of 2692	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	113
PID 2824 wrote to memory of 2692	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	113
PID 2824 wrote to memory of 1324	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	114
PID 2824 wrote to memory of 1324	2824	1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe	114

C:\Users\Admin\AppData\Local\Temp\1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe
"C:\Users\Admin\AppData\Local\Temp\1609909d1b1f0f3bbe9739619a76ce29649935af0fe8459dca69f15fac1fb4b3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\System\UiTmeYe.exe
  C:\Windows\System\UiTmeYe.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\AAmoZvh.exe
  C:\Windows\System\AAmoZvh.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\YASljJM.exe
  C:\Windows\System\YASljJM.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\tiTarPM.exe
  C:\Windows\System\tiTarPM.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\VbxuTpW.exe
  C:\Windows\System\VbxuTpW.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\fshUZpt.exe
  C:\Windows\System\fshUZpt.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\nBlRoZY.exe
  C:\Windows\System\nBlRoZY.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\WrNyUcX.exe
  C:\Windows\System\WrNyUcX.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\YphWXic.exe
  C:\Windows\System\YphWXic.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\qfONxPS.exe
  C:\Windows\System\qfONxPS.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\RdjTEDo.exe
  C:\Windows\System\RdjTEDo.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\gQkgGdx.exe
  C:\Windows\System\gQkgGdx.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\OqBJKAJ.exe
  C:\Windows\System\OqBJKAJ.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\LTBECHj.exe
  C:\Windows\System\LTBECHj.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\WsvwXWu.exe
  C:\Windows\System\WsvwXWu.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\buyswgK.exe
  C:\Windows\System\buyswgK.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\Mngwjfs.exe
  C:\Windows\System\Mngwjfs.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\garWIKF.exe
  C:\Windows\System\garWIKF.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\zdIevox.exe
  C:\Windows\System\zdIevox.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\lEpNwug.exe
  C:\Windows\System\lEpNwug.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\HQKWkTr.exe
  C:\Windows\System\HQKWkTr.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\WfXjrhl.exe
  C:\Windows\System\WfXjrhl.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\tyfBkfQ.exe
  C:\Windows\System\tyfBkfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\CruXSGY.exe
  C:\Windows\System\CruXSGY.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\yblFSzr.exe
  C:\Windows\System\yblFSzr.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\NrQsKDW.exe
  C:\Windows\System\NrQsKDW.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\kIpaFlG.exe
  C:\Windows\System\kIpaFlG.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\seFPknZ.exe
  C:\Windows\System\seFPknZ.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\HnLgnOp.exe
  C:\Windows\System\HnLgnOp.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\tvSeBhk.exe
  C:\Windows\System\tvSeBhk.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\BKtvzTZ.exe
  C:\Windows\System\BKtvzTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\zgKjHuo.exe
  C:\Windows\System\zgKjHuo.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\GyYFvqX.exe
  C:\Windows\System\GyYFvqX.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\wnEFDIO.exe
  C:\Windows\System\wnEFDIO.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\EfmQJFO.exe
  C:\Windows\System\EfmQJFO.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\BsodxnV.exe
  C:\Windows\System\BsodxnV.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\appSAcM.exe
  C:\Windows\System\appSAcM.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\xbOfsfc.exe
  C:\Windows\System\xbOfsfc.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\XNLKvQu.exe
  C:\Windows\System\XNLKvQu.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\uUvuzdi.exe
  C:\Windows\System\uUvuzdi.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\FeNTWDy.exe
  C:\Windows\System\FeNTWDy.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\cedxvJu.exe
  C:\Windows\System\cedxvJu.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\XhmjDtc.exe
  C:\Windows\System\XhmjDtc.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\jnakjud.exe
  C:\Windows\System\jnakjud.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\OwcNQwh.exe
  C:\Windows\System\OwcNQwh.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\RxrQxvh.exe
  C:\Windows\System\RxrQxvh.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\jefRETr.exe
  C:\Windows\System\jefRETr.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\GwrqwAA.exe
  C:\Windows\System\GwrqwAA.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\dQPhGZi.exe
  C:\Windows\System\dQPhGZi.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\mdxmdac.exe
  C:\Windows\System\mdxmdac.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\qMiZpPn.exe
  C:\Windows\System\qMiZpPn.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\QctiTTP.exe
  C:\Windows\System\QctiTTP.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\YuLpwMF.exe
  C:\Windows\System\YuLpwMF.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\WTDcJKI.exe
  C:\Windows\System\WTDcJKI.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\FbyFtfZ.exe
  C:\Windows\System\FbyFtfZ.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\gPwKrKW.exe
  C:\Windows\System\gPwKrKW.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\mbQltzq.exe
  C:\Windows\System\mbQltzq.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\WMUtYfx.exe
  C:\Windows\System\WMUtYfx.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\JSoAzhB.exe
  C:\Windows\System\JSoAzhB.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\aIWuYut.exe
  C:\Windows\System\aIWuYut.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\eRKbnFk.exe
  C:\Windows\System\eRKbnFk.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\YXhRWGh.exe
  C:\Windows\System\YXhRWGh.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\TcLyuAW.exe
  C:\Windows\System\TcLyuAW.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\yKdcfgR.exe
  C:\Windows\System\yKdcfgR.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\ORyFGZv.exe
  C:\Windows\System\ORyFGZv.exe
  2⤵
  PID:212
- C:\Windows\System\KTMZbsp.exe
  C:\Windows\System\KTMZbsp.exe
  2⤵
  PID:764
- C:\Windows\System\urUabAv.exe
  C:\Windows\System\urUabAv.exe
  2⤵
  PID:4136
- C:\Windows\System\cJiAiwU.exe
  C:\Windows\System\cJiAiwU.exe
  2⤵
  PID:4224
- C:\Windows\System\HgBVGuv.exe
  C:\Windows\System\HgBVGuv.exe
  2⤵
  PID:4616
- C:\Windows\System\WRRThhl.exe
  C:\Windows\System\WRRThhl.exe
  2⤵
  PID:3040
- C:\Windows\System\DmSzcAR.exe
  C:\Windows\System\DmSzcAR.exe
  2⤵
  PID:1596
- C:\Windows\System\CDsXCWN.exe
  C:\Windows\System\CDsXCWN.exe
  2⤵
  PID:2324
- C:\Windows\System\pKQplTD.exe
  C:\Windows\System\pKQplTD.exe
  2⤵
  PID:940
- C:\Windows\System\mjTMmge.exe
  C:\Windows\System\mjTMmge.exe
  2⤵
  PID:1612
- C:\Windows\System\HkFNDdl.exe
  C:\Windows\System\HkFNDdl.exe
  2⤵
  PID:3336
- C:\Windows\System\LwdiNyJ.exe
  C:\Windows\System\LwdiNyJ.exe
  2⤵
  PID:980
- C:\Windows\System\YXTgkHf.exe
  C:\Windows\System\YXTgkHf.exe
  2⤵
  PID:1436
- C:\Windows\System\qXYOfJt.exe
  C:\Windows\System\qXYOfJt.exe
  2⤵
  PID:1420
- C:\Windows\System\LExQoEP.exe
  C:\Windows\System\LExQoEP.exe
  2⤵
  PID:4236
- C:\Windows\System\wMHZUow.exe
  C:\Windows\System\wMHZUow.exe
  2⤵
  PID:4012
- C:\Windows\System\WWysilE.exe
  C:\Windows\System\WWysilE.exe
  2⤵
  PID:1880
- C:\Windows\System\hajPiTo.exe
  C:\Windows\System\hajPiTo.exe
  2⤵
  PID:1540
- C:\Windows\System\WLXdIdF.exe
  C:\Windows\System\WLXdIdF.exe
  2⤵
  PID:3124
- C:\Windows\System\ghsuViV.exe
  C:\Windows\System\ghsuViV.exe
  2⤵
  PID:1888
- C:\Windows\System\YGvIhry.exe
  C:\Windows\System\YGvIhry.exe
  2⤵
  PID:4272
- C:\Windows\System\PnhXeyb.exe
  C:\Windows\System\PnhXeyb.exe
  2⤵
  PID:1560
- C:\Windows\System\xfvKVVh.exe
  C:\Windows\System\xfvKVVh.exe
  2⤵
  PID:3240
- C:\Windows\System\ZhMsHhx.exe
  C:\Windows\System\ZhMsHhx.exe
  2⤵
  PID:676
- C:\Windows\System\jBHmdXu.exe
  C:\Windows\System\jBHmdXu.exe
  2⤵
  PID:4652
- C:\Windows\System\FhgcIhi.exe
  C:\Windows\System\FhgcIhi.exe
  2⤵
  PID:4352
- C:\Windows\System\yCHeZMP.exe
  C:\Windows\System\yCHeZMP.exe
  2⤵
  PID:2480
- C:\Windows\System\GOJzkek.exe
  C:\Windows\System\GOJzkek.exe
  2⤵
  PID:4804
- C:\Windows\System\MlcDMNG.exe
  C:\Windows\System\MlcDMNG.exe
  2⤵
  PID:3020
- C:\Windows\System\YAgjPXx.exe
  C:\Windows\System\YAgjPXx.exe
  2⤵
  PID:4920
- C:\Windows\System\sxihLnx.exe
  C:\Windows\System\sxihLnx.exe
  2⤵
  PID:3132
- C:\Windows\System\nMsbOlM.exe
  C:\Windows\System\nMsbOlM.exe
  2⤵
  PID:1816
- C:\Windows\System\NyhAEYv.exe
  C:\Windows\System\NyhAEYv.exe
  2⤵
  PID:2444
- C:\Windows\System\iXywTnL.exe
  C:\Windows\System\iXywTnL.exe
  2⤵
  PID:3456
- C:\Windows\System\LUkPXSN.exe
  C:\Windows\System\LUkPXSN.exe
  2⤵
  PID:1568
- C:\Windows\System\EgtYaJo.exe
  C:\Windows\System\EgtYaJo.exe
  2⤵
  PID:888
- C:\Windows\System\juNFuND.exe
  C:\Windows\System\juNFuND.exe
  2⤵
  PID:1592
- C:\Windows\System\gMBLVnE.exe
  C:\Windows\System\gMBLVnE.exe
  2⤵
  PID:1192
- C:\Windows\System\tAxzunR.exe
  C:\Windows\System\tAxzunR.exe
  2⤵
  PID:3436
- C:\Windows\System\WaJVCah.exe
  C:\Windows\System\WaJVCah.exe
  2⤵
  PID:4996
- C:\Windows\System\MiZlQUO.exe
  C:\Windows\System\MiZlQUO.exe
  2⤵
  PID:968
- C:\Windows\System\zZnsIyp.exe
  C:\Windows\System\zZnsIyp.exe
  2⤵
  PID:2748
- C:\Windows\System\cHNpyPT.exe
  C:\Windows\System\cHNpyPT.exe
  2⤵
  PID:180
- C:\Windows\System\LmblVeF.exe
  C:\Windows\System\LmblVeF.exe
  2⤵
  PID:3588
- C:\Windows\System\sGpCwtv.exe
  C:\Windows\System\sGpCwtv.exe
  2⤵
  PID:4944
- C:\Windows\System\KxmWNxD.exe
  C:\Windows\System\KxmWNxD.exe
  2⤵
  PID:3548
- C:\Windows\System\nGIeNjT.exe
  C:\Windows\System\nGIeNjT.exe
  2⤵
  PID:2800
- C:\Windows\System\WihDExA.exe
  C:\Windows\System\WihDExA.exe
  2⤵
  PID:4792
- C:\Windows\System\yAvOCJJ.exe
  C:\Windows\System\yAvOCJJ.exe
  2⤵
  PID:3036
- C:\Windows\System\AuZZRtQ.exe
  C:\Windows\System\AuZZRtQ.exe
  2⤵
  PID:3464
- C:\Windows\System\qgImQzf.exe
  C:\Windows\System\qgImQzf.exe
  2⤵
  PID:5064
- C:\Windows\System\MOaxBRb.exe
  C:\Windows\System\MOaxBRb.exe
  2⤵
  PID:5144
- C:\Windows\System\MfVXCxy.exe
  C:\Windows\System\MfVXCxy.exe
  2⤵
  PID:5160
- C:\Windows\System\IfPeREi.exe
  C:\Windows\System\IfPeREi.exe
  2⤵
  PID:5188
- C:\Windows\System\LyqFAsL.exe
  C:\Windows\System\LyqFAsL.exe
  2⤵
  PID:5216
- C:\Windows\System\EHhNzjP.exe
  C:\Windows\System\EHhNzjP.exe
  2⤵
  PID:5256
- C:\Windows\System\hjjezLO.exe
  C:\Windows\System\hjjezLO.exe
  2⤵
  PID:5272
- C:\Windows\System\yitNpds.exe
  C:\Windows\System\yitNpds.exe
  2⤵
  PID:5300
- C:\Windows\System\arTrPMk.exe
  C:\Windows\System\arTrPMk.exe
  2⤵
  PID:5316
- C:\Windows\System\avuurNO.exe
  C:\Windows\System\avuurNO.exe
  2⤵
  PID:5340
- C:\Windows\System\HISIrzx.exe
  C:\Windows\System\HISIrzx.exe
  2⤵
  PID:5380
- C:\Windows\System\xXPROjT.exe
  C:\Windows\System\xXPROjT.exe
  2⤵
  PID:5412
- C:\Windows\System\OweJfqa.exe
  C:\Windows\System\OweJfqa.exe
  2⤵
  PID:5432
- C:\Windows\System\xJJnGwQ.exe
  C:\Windows\System\xJJnGwQ.exe
  2⤵
  PID:5460
- C:\Windows\System\dyidAEO.exe
  C:\Windows\System\dyidAEO.exe
  2⤵
  PID:5488
- C:\Windows\System\ZYBCpla.exe
  C:\Windows\System\ZYBCpla.exe
  2⤵
  PID:5512
- C:\Windows\System\qVBjhLm.exe
  C:\Windows\System\qVBjhLm.exe
  2⤵
  PID:5532
- C:\Windows\System\KeuUDQi.exe
  C:\Windows\System\KeuUDQi.exe
  2⤵
  PID:5560
- C:\Windows\System\cErfsbM.exe
  C:\Windows\System\cErfsbM.exe
  2⤵
  PID:5584
- C:\Windows\System\HSqYDns.exe
  C:\Windows\System\HSqYDns.exe
  2⤵
  PID:5612
- C:\Windows\System\rEvvSOd.exe
  C:\Windows\System\rEvvSOd.exe
  2⤵
  PID:5644
- C:\Windows\System\XvexrGY.exe
  C:\Windows\System\XvexrGY.exe
  2⤵
  PID:5684
- C:\Windows\System\OloOhHI.exe
  C:\Windows\System\OloOhHI.exe
  2⤵
  PID:5708
- C:\Windows\System\QxuDWVv.exe
  C:\Windows\System\QxuDWVv.exe
  2⤵
  PID:5748
- C:\Windows\System\KSCAuMa.exe
  C:\Windows\System\KSCAuMa.exe
  2⤵
  PID:5780
- C:\Windows\System\VZODumb.exe
  C:\Windows\System\VZODumb.exe
  2⤵
  PID:5804
- C:\Windows\System\zegPKzR.exe
  C:\Windows\System\zegPKzR.exe
  2⤵
  PID:5832
- C:\Windows\System\BRfjrXM.exe
  C:\Windows\System\BRfjrXM.exe
  2⤵
  PID:5848
- C:\Windows\System\SdZTrBn.exe
  C:\Windows\System\SdZTrBn.exe
  2⤵
  PID:5876
- C:\Windows\System\vqqxkVn.exe
  C:\Windows\System\vqqxkVn.exe
  2⤵
  PID:5904
- C:\Windows\System\HeoOjbK.exe
  C:\Windows\System\HeoOjbK.exe
  2⤵
  PID:5932
- C:\Windows\System\IKfwcxs.exe
  C:\Windows\System\IKfwcxs.exe
  2⤵
  PID:5964
- C:\Windows\System\PlxMNPV.exe
  C:\Windows\System\PlxMNPV.exe
  2⤵
  PID:5992
- C:\Windows\System\nzkmYmg.exe
  C:\Windows\System\nzkmYmg.exe
  2⤵
  PID:6028
- C:\Windows\System\jrqWqTV.exe
  C:\Windows\System\jrqWqTV.exe
  2⤵
  PID:6044
- C:\Windows\System\YkgKgex.exe
  C:\Windows\System\YkgKgex.exe
  2⤵
  PID:6080
- C:\Windows\System\sZYdTmd.exe
  C:\Windows\System\sZYdTmd.exe
  2⤵
  PID:6108
- C:\Windows\System\eHwRRID.exe
  C:\Windows\System\eHwRRID.exe
  2⤵
  PID:6140
- C:\Windows\System\HfedGGn.exe
  C:\Windows\System\HfedGGn.exe
  2⤵
  PID:5152
- C:\Windows\System\AGHMFkb.exe
  C:\Windows\System\AGHMFkb.exe
  2⤵
  PID:5228
- C:\Windows\System\qbHBhxE.exe
  C:\Windows\System\qbHBhxE.exe
  2⤵
  PID:5288
- C:\Windows\System\sspOVda.exe
  C:\Windows\System\sspOVda.exe
  2⤵
  PID:5360
- C:\Windows\System\vqHqCVD.exe
  C:\Windows\System\vqHqCVD.exe
  2⤵
  PID:5468
- C:\Windows\System\DTPHPkR.exe
  C:\Windows\System\DTPHPkR.exe
  2⤵
  PID:5496
- C:\Windows\System\DiPxdVM.exe
  C:\Windows\System\DiPxdVM.exe
  2⤵
  PID:5552
- C:\Windows\System\tblagRN.exe
  C:\Windows\System\tblagRN.exe
  2⤵
  PID:5600
- C:\Windows\System\fYIGOlm.exe
  C:\Windows\System\fYIGOlm.exe
  2⤵
  PID:5696
- C:\Windows\System\TiGcnbL.exe
  C:\Windows\System\TiGcnbL.exe
  2⤵
  PID:5824
- C:\Windows\System\XzYmPQx.exe
  C:\Windows\System\XzYmPQx.exe
  2⤵
  PID:5840
- C:\Windows\System\uBrxUXq.exe
  C:\Windows\System\uBrxUXq.exe
  2⤵
  PID:5900
- C:\Windows\System\SmFMYUy.exe
  C:\Windows\System\SmFMYUy.exe
  2⤵
  PID:1860
- C:\Windows\System\xzEyvfa.exe
  C:\Windows\System\xzEyvfa.exe
  2⤵
  PID:5984
- C:\Windows\System\yseTTpO.exe
  C:\Windows\System\yseTTpO.exe
  2⤵
  PID:6104
- C:\Windows\System\QjzBVII.exe
  C:\Windows\System\QjzBVII.exe
  2⤵
  PID:5212
- C:\Windows\System\XvpIyMZ.exe
  C:\Windows\System\XvpIyMZ.exe
  2⤵
  PID:5352
- C:\Windows\System\QLDTMls.exe
  C:\Windows\System\QLDTMls.exe
  2⤵
  PID:5504
- C:\Windows\System\CJPMFbi.exe
  C:\Windows\System\CJPMFbi.exe
  2⤵
  PID:5528
- C:\Windows\System\byxwRJB.exe
  C:\Windows\System\byxwRJB.exe
  2⤵
  PID:5800
- C:\Windows\System\ArIHLUJ.exe
  C:\Windows\System\ArIHLUJ.exe
  2⤵
  PID:5892
- C:\Windows\System\rVuuHfA.exe
  C:\Windows\System\rVuuHfA.exe
  2⤵
  PID:6012
- C:\Windows\System\uodylVv.exe
  C:\Windows\System\uodylVv.exe
  2⤵
  PID:5400
- C:\Windows\System\kMCIrqp.exe
  C:\Windows\System\kMCIrqp.exe
  2⤵
  PID:5864
- C:\Windows\System\IMIBoAi.exe
  C:\Windows\System\IMIBoAi.exe
  2⤵
  PID:5312
- C:\Windows\System\EbAQUOU.exe
  C:\Windows\System\EbAQUOU.exe
  2⤵
  PID:5576
- C:\Windows\System\YUhITEY.exe
  C:\Windows\System\YUhITEY.exe
  2⤵
  PID:6152
- C:\Windows\System\vYhBYal.exe
  C:\Windows\System\vYhBYal.exe
  2⤵
  PID:6184
- C:\Windows\System\BkugDeA.exe
  C:\Windows\System\BkugDeA.exe
  2⤵
  PID:6204
- C:\Windows\System\cZsNDmP.exe
  C:\Windows\System\cZsNDmP.exe
  2⤵
  PID:6244
- C:\Windows\System\sPTaGhY.exe
  C:\Windows\System\sPTaGhY.exe
  2⤵
  PID:6260
- C:\Windows\System\mHVxStp.exe
  C:\Windows\System\mHVxStp.exe
  2⤵
  PID:6284
- C:\Windows\System\HQyMiBB.exe
  C:\Windows\System\HQyMiBB.exe
  2⤵
  PID:6304
- C:\Windows\System\byJdzEQ.exe
  C:\Windows\System\byJdzEQ.exe
  2⤵
  PID:6320
- C:\Windows\System\ZMtzrVv.exe
  C:\Windows\System\ZMtzrVv.exe
  2⤵
  PID:6344
- C:\Windows\System\SYCQzTp.exe
  C:\Windows\System\SYCQzTp.exe
  2⤵
  PID:6364
- C:\Windows\System\DrYpmRi.exe
  C:\Windows\System\DrYpmRi.exe
  2⤵
  PID:6396
- C:\Windows\System\aQSnRcf.exe
  C:\Windows\System\aQSnRcf.exe
  2⤵
  PID:6424
- C:\Windows\System\tZCqRqv.exe
  C:\Windows\System\tZCqRqv.exe
  2⤵
  PID:6452
- C:\Windows\System\ykTHwRj.exe
  C:\Windows\System\ykTHwRj.exe
  2⤵
  PID:6484
- C:\Windows\System\bMPLPvw.exe
  C:\Windows\System\bMPLPvw.exe
  2⤵
  PID:6516
- C:\Windows\System\aBkEPMb.exe
  C:\Windows\System\aBkEPMb.exe
  2⤵
  PID:6552
- C:\Windows\System\vuJscIq.exe
  C:\Windows\System\vuJscIq.exe
  2⤵
  PID:6580
- C:\Windows\System\cHOSWCv.exe
  C:\Windows\System\cHOSWCv.exe
  2⤵
  PID:6604
- C:\Windows\System\FbDWaqS.exe
  C:\Windows\System\FbDWaqS.exe
  2⤵
  PID:6636
- C:\Windows\System\dFTUGsF.exe
  C:\Windows\System\dFTUGsF.exe
  2⤵
  PID:6668
- C:\Windows\System\iGtxyPH.exe
  C:\Windows\System\iGtxyPH.exe
  2⤵
  PID:6692
- C:\Windows\System\SmPWEPA.exe
  C:\Windows\System\SmPWEPA.exe
  2⤵
  PID:6720
- C:\Windows\System\fgwZvnI.exe
  C:\Windows\System\fgwZvnI.exe
  2⤵
  PID:6736
- C:\Windows\System\TqrKTgo.exe
  C:\Windows\System\TqrKTgo.exe
  2⤵
  PID:6764
- C:\Windows\System\XXpiBUM.exe
  C:\Windows\System\XXpiBUM.exe
  2⤵
  PID:6784
- C:\Windows\System\WYodRlT.exe
  C:\Windows\System\WYodRlT.exe
  2⤵
  PID:6816
- C:\Windows\System\jQrWHcw.exe
  C:\Windows\System\jQrWHcw.exe
  2⤵
  PID:6852
- C:\Windows\System\sMwefoD.exe
  C:\Windows\System\sMwefoD.exe
  2⤵
  PID:6880
- C:\Windows\System\GHFgTxC.exe
  C:\Windows\System\GHFgTxC.exe
  2⤵
  PID:6900
- C:\Windows\System\QfAmHnW.exe
  C:\Windows\System\QfAmHnW.exe
  2⤵
  PID:6932
- C:\Windows\System\UDTWuou.exe
  C:\Windows\System\UDTWuou.exe
  2⤵
  PID:6956
- C:\Windows\System\QcFKdgc.exe
  C:\Windows\System\QcFKdgc.exe
  2⤵
  PID:6984
- C:\Windows\System\ullEZui.exe
  C:\Windows\System\ullEZui.exe
  2⤵
  PID:7012
- C:\Windows\System\eqdsIYS.exe
  C:\Windows\System\eqdsIYS.exe
  2⤵
  PID:7028
- C:\Windows\System\HfMTTCx.exe
  C:\Windows\System\HfMTTCx.exe
  2⤵
  PID:7056
- C:\Windows\System\EyYvupd.exe
  C:\Windows\System\EyYvupd.exe
  2⤵
  PID:7084
- C:\Windows\System\vslBDaH.exe
  C:\Windows\System\vslBDaH.exe
  2⤵
  PID:7108
- C:\Windows\System\EXkLpVq.exe
  C:\Windows\System\EXkLpVq.exe
  2⤵
  PID:7144
- C:\Windows\System\AneDYAn.exe
  C:\Windows\System\AneDYAn.exe
  2⤵
  PID:6096
- C:\Windows\System\DOoEeQd.exe
  C:\Windows\System\DOoEeQd.exe
  2⤵
  PID:6180
- C:\Windows\System\PraxFWi.exe
  C:\Windows\System\PraxFWi.exe
  2⤵
  PID:6224
- C:\Windows\System\aXCXFnG.exe
  C:\Windows\System\aXCXFnG.exe
  2⤵
  PID:6312
- C:\Windows\System\XuxdLDd.exe
  C:\Windows\System\XuxdLDd.exe
  2⤵
  PID:6376
- C:\Windows\System\GSqAoTH.exe
  C:\Windows\System\GSqAoTH.exe
  2⤵
  PID:6476
- C:\Windows\System\lbRssPN.exe
  C:\Windows\System\lbRssPN.exe
  2⤵
  PID:6512
- C:\Windows\System\cVZKeXy.exe
  C:\Windows\System\cVZKeXy.exe
  2⤵
  PID:6592
- C:\Windows\System\NiztOWU.exe
  C:\Windows\System\NiztOWU.exe
  2⤵
  PID:6664
- C:\Windows\System\QFwvqoh.exe
  C:\Windows\System\QFwvqoh.exe
  2⤵
  PID:6728
- C:\Windows\System\BVDCcMV.exe
  C:\Windows\System\BVDCcMV.exe
  2⤵
  PID:6808
- C:\Windows\System\wvSwTLe.exe
  C:\Windows\System\wvSwTLe.exe
  2⤵
  PID:6924
- C:\Windows\System\SZSnmXb.exe
  C:\Windows\System\SZSnmXb.exe
  2⤵
  PID:6892
- C:\Windows\System\nuPCouW.exe
  C:\Windows\System\nuPCouW.exe
  2⤵
  PID:7020
- C:\Windows\System\rqlYGOh.exe
  C:\Windows\System\rqlYGOh.exe
  2⤵
  PID:7076
- C:\Windows\System\YovUUnc.exe
  C:\Windows\System\YovUUnc.exe
  2⤵
  PID:7072
- C:\Windows\System\ZVKGnDm.exe
  C:\Windows\System\ZVKGnDm.exe
  2⤵
  PID:6216
- C:\Windows\System\OnuGdIg.exe
  C:\Windows\System\OnuGdIg.exe
  2⤵
  PID:6356
- C:\Windows\System\qhQDPsm.exe
  C:\Windows\System\qhQDPsm.exe
  2⤵
  PID:6500
- C:\Windows\System\arLVjEb.exe
  C:\Windows\System\arLVjEb.exe
  2⤵
  PID:6448
- C:\Windows\System\ZPThqkA.exe
  C:\Windows\System\ZPThqkA.exe
  2⤵
  PID:6940
- C:\Windows\System\gzTYHHw.exe
  C:\Windows\System\gzTYHHw.exe
  2⤵
  PID:6756
- C:\Windows\System\RTPkGbs.exe
  C:\Windows\System\RTPkGbs.exe
  2⤵
  PID:6200
- C:\Windows\System\EJWheZX.exe
  C:\Windows\System\EJWheZX.exe
  2⤵
  PID:7156
- C:\Windows\System\tuZiIGe.exe
  C:\Windows\System\tuZiIGe.exe
  2⤵
  PID:6828
- C:\Windows\System\JPFssPA.exe
  C:\Windows\System\JPFssPA.exe
  2⤵
  PID:6172
- C:\Windows\System\PmNddFx.exe
  C:\Windows\System\PmNddFx.exe
  2⤵
  PID:7188
- C:\Windows\System\lsQEhaS.exe
  C:\Windows\System\lsQEhaS.exe
  2⤵
  PID:7208
- C:\Windows\System\UsZOThG.exe
  C:\Windows\System\UsZOThG.exe
  2⤵
  PID:7224
- C:\Windows\System\RbiHGTW.exe
  C:\Windows\System\RbiHGTW.exe
  2⤵
  PID:7252
- C:\Windows\System\xNBehIs.exe
  C:\Windows\System\xNBehIs.exe
  2⤵
  PID:7280
- C:\Windows\System\dlkAsto.exe
  C:\Windows\System\dlkAsto.exe
  2⤵
  PID:7312
- C:\Windows\System\dqapHfa.exe
  C:\Windows\System\dqapHfa.exe
  2⤵
  PID:7328
- C:\Windows\System\dGTFEVE.exe
  C:\Windows\System\dGTFEVE.exe
  2⤵
  PID:7352
- C:\Windows\System\JrNbjQX.exe
  C:\Windows\System\JrNbjQX.exe
  2⤵
  PID:7384
- C:\Windows\System\JJkDRIS.exe
  C:\Windows\System\JJkDRIS.exe
  2⤵
  PID:7404
- C:\Windows\System\XhFGtmp.exe
  C:\Windows\System\XhFGtmp.exe
  2⤵
  PID:7440
- C:\Windows\System\LKmARrT.exe
  C:\Windows\System\LKmARrT.exe
  2⤵
  PID:7472
- C:\Windows\System\ffOCOho.exe
  C:\Windows\System\ffOCOho.exe
  2⤵
  PID:7496
- C:\Windows\System\kBAPKPT.exe
  C:\Windows\System\kBAPKPT.exe
  2⤵
  PID:7528
- C:\Windows\System\lbcggtd.exe
  C:\Windows\System\lbcggtd.exe
  2⤵
  PID:7564
- C:\Windows\System\xVWZoYJ.exe
  C:\Windows\System\xVWZoYJ.exe
  2⤵
  PID:7588
- C:\Windows\System\OqDquSD.exe
  C:\Windows\System\OqDquSD.exe
  2⤵
  PID:7620
- C:\Windows\System\xurbvwX.exe
  C:\Windows\System\xurbvwX.exe
  2⤵
  PID:7648
- C:\Windows\System\RqqpYeN.exe
  C:\Windows\System\RqqpYeN.exe
  2⤵
  PID:7664
- C:\Windows\System\GdhJHJd.exe
  C:\Windows\System\GdhJHJd.exe
  2⤵
  PID:7692
- C:\Windows\System\lOMCHYM.exe
  C:\Windows\System\lOMCHYM.exe
  2⤵
  PID:7728
- C:\Windows\System\mciYNdA.exe
  C:\Windows\System\mciYNdA.exe
  2⤵
  PID:7756
- C:\Windows\System\vMayehz.exe
  C:\Windows\System\vMayehz.exe
  2⤵
  PID:7796
- C:\Windows\System\QDvlekz.exe
  C:\Windows\System\QDvlekz.exe
  2⤵
  PID:7812
- C:\Windows\System\CrLZsti.exe
  C:\Windows\System\CrLZsti.exe
  2⤵
  PID:7832
- C:\Windows\System\nAmdqHX.exe
  C:\Windows\System\nAmdqHX.exe
  2⤵
  PID:7856
- C:\Windows\System\WaBqgDP.exe
  C:\Windows\System\WaBqgDP.exe
  2⤵
  PID:7884
- C:\Windows\System\ntojaEY.exe
  C:\Windows\System\ntojaEY.exe
  2⤵
  PID:7916
- C:\Windows\System\lapPtQv.exe
  C:\Windows\System\lapPtQv.exe
  2⤵
  PID:7952
- C:\Windows\System\XcpXCGS.exe
  C:\Windows\System\XcpXCGS.exe
  2⤵
  PID:7980
- C:\Windows\System\dtKIGTe.exe
  C:\Windows\System\dtKIGTe.exe
  2⤵
  PID:7996
- C:\Windows\System\mOeLfYh.exe
  C:\Windows\System\mOeLfYh.exe
  2⤵
  PID:8028
- C:\Windows\System\yRAPNyQ.exe
  C:\Windows\System\yRAPNyQ.exe
  2⤵
  PID:8056
- C:\Windows\System\dSqnemi.exe
  C:\Windows\System\dSqnemi.exe
  2⤵
  PID:8088
- C:\Windows\System\VCFBgVG.exe
  C:\Windows\System\VCFBgVG.exe
  2⤵
  PID:8108
- C:\Windows\System\ZVYyPLv.exe
  C:\Windows\System\ZVYyPLv.exe
  2⤵
  PID:8140
- C:\Windows\System\eMLQhNn.exe
  C:\Windows\System\eMLQhNn.exe
  2⤵
  PID:8172
- C:\Windows\System\wTmwSYd.exe
  C:\Windows\System\wTmwSYd.exe
  2⤵
  PID:6384
- C:\Windows\System\MfSewyJ.exe
  C:\Windows\System\MfSewyJ.exe
  2⤵
  PID:7196
- C:\Windows\System\FywcDdX.exe
  C:\Windows\System\FywcDdX.exe
  2⤵
  PID:7276
- C:\Windows\System\HmDNYlc.exe
  C:\Windows\System\HmDNYlc.exe
  2⤵
  PID:7364
- C:\Windows\System\LboelvZ.exe
  C:\Windows\System\LboelvZ.exe
  2⤵
  PID:7340
- C:\Windows\System\cWxdXNE.exe
  C:\Windows\System\cWxdXNE.exe
  2⤵
  PID:7516
- C:\Windows\System\grGojiD.exe
  C:\Windows\System\grGojiD.exe
  2⤵
  PID:7576
- C:\Windows\System\feAsaos.exe
  C:\Windows\System\feAsaos.exe
  2⤵
  PID:7548
- C:\Windows\System\xaAGsxo.exe
  C:\Windows\System\xaAGsxo.exe
  2⤵
  PID:7724
- C:\Windows\System\TqObEdw.exe
  C:\Windows\System\TqObEdw.exe
  2⤵
  PID:7744
- C:\Windows\System\gqqChjv.exe
  C:\Windows\System\gqqChjv.exe
  2⤵
  PID:7820
- C:\Windows\System\NDhhIUW.exe
  C:\Windows\System\NDhhIUW.exe
  2⤵
  PID:7868
- C:\Windows\System\RflWhDZ.exe
  C:\Windows\System\RflWhDZ.exe
  2⤵
  PID:7928
- C:\Windows\System\AbzSfEI.exe
  C:\Windows\System\AbzSfEI.exe
  2⤵
  PID:7964
- C:\Windows\System\YWsNxMW.exe
  C:\Windows\System\YWsNxMW.exe
  2⤵
  PID:8044
- C:\Windows\System\sgAPmKY.exe
  C:\Windows\System\sgAPmKY.exe
  2⤵
  PID:8120
- C:\Windows\System\xTFcnPw.exe
  C:\Windows\System\xTFcnPw.exe
  2⤵
  PID:8152
- C:\Windows\System\zUffhBX.exe
  C:\Windows\System\zUffhBX.exe
  2⤵
  PID:6772
- C:\Windows\System\ObLZsgY.exe
  C:\Windows\System\ObLZsgY.exe
  2⤵
  PID:7456
- C:\Windows\System\IRHNiaz.exe
  C:\Windows\System\IRHNiaz.exe
  2⤵
  PID:7468
- C:\Windows\System\heGBein.exe
  C:\Windows\System\heGBein.exe
  2⤵
  PID:7804
- C:\Windows\System\cyQWEVA.exe
  C:\Windows\System\cyQWEVA.exe
  2⤵
  PID:7912
- C:\Windows\System\gGAgsbi.exe
  C:\Windows\System\gGAgsbi.exe
  2⤵
  PID:8036
- C:\Windows\System\QCGkAbx.exe
  C:\Windows\System\QCGkAbx.exe
  2⤵
  PID:7324
- C:\Windows\System\BwsuRUN.exe
  C:\Windows\System\BwsuRUN.exe
  2⤵
  PID:7604
- C:\Windows\System\VZbdtDt.exe
  C:\Windows\System\VZbdtDt.exe
  2⤵
  PID:8104
- C:\Windows\System\YXpniSy.exe
  C:\Windows\System\YXpniSy.exe
  2⤵
  PID:8012
- C:\Windows\System\xPzzfYT.exe
  C:\Windows\System\xPzzfYT.exe
  2⤵
  PID:8212
- C:\Windows\System\ooLhIxm.exe
  C:\Windows\System\ooLhIxm.exe
  2⤵
  PID:8248
- C:\Windows\System\BSQtcJx.exe
  C:\Windows\System\BSQtcJx.exe
  2⤵
  PID:8276
- C:\Windows\System\ovVPYGE.exe
  C:\Windows\System\ovVPYGE.exe
  2⤵
  PID:8308
- C:\Windows\System\mXHEdzG.exe
  C:\Windows\System\mXHEdzG.exe
  2⤵
  PID:8336
- C:\Windows\System\dOZQexY.exe
  C:\Windows\System\dOZQexY.exe
  2⤵
  PID:8372
- C:\Windows\System\fGLfKgJ.exe
  C:\Windows\System\fGLfKgJ.exe
  2⤵
  PID:8400
- C:\Windows\System\KdcpEzg.exe
  C:\Windows\System\KdcpEzg.exe
  2⤵
  PID:8436
- C:\Windows\System\vKwjyDw.exe
  C:\Windows\System\vKwjyDw.exe
  2⤵
  PID:8460
- C:\Windows\System\ssOBFVj.exe
  C:\Windows\System\ssOBFVj.exe
  2⤵
  PID:8476
- C:\Windows\System\ihRUDvQ.exe
  C:\Windows\System\ihRUDvQ.exe
  2⤵
  PID:8508
- C:\Windows\System\PJyfmtN.exe
  C:\Windows\System\PJyfmtN.exe
  2⤵
  PID:8556
- C:\Windows\System\VOXnQYj.exe
  C:\Windows\System\VOXnQYj.exe
  2⤵
  PID:8576
- C:\Windows\System\PKQbQmb.exe
  C:\Windows\System\PKQbQmb.exe
  2⤵
  PID:8604
- C:\Windows\System\unKqieQ.exe
  C:\Windows\System\unKqieQ.exe
  2⤵
  PID:8632
- C:\Windows\System\NETzVRo.exe
  C:\Windows\System\NETzVRo.exe
  2⤵
  PID:8664
- C:\Windows\System\OVYnkBU.exe
  C:\Windows\System\OVYnkBU.exe
  2⤵
  PID:8700
- C:\Windows\System\TilNhVd.exe
  C:\Windows\System\TilNhVd.exe
  2⤵
  PID:8716
- C:\Windows\System\SLcQVvA.exe
  C:\Windows\System\SLcQVvA.exe
  2⤵
  PID:8740
- C:\Windows\System\PigJCAo.exe
  C:\Windows\System\PigJCAo.exe
  2⤵
  PID:8760
- C:\Windows\System\AjHoaTE.exe
  C:\Windows\System\AjHoaTE.exe
  2⤵
  PID:8784
- C:\Windows\System\olQBFXI.exe
  C:\Windows\System\olQBFXI.exe
  2⤵
  PID:8816
- C:\Windows\System\aePRPjl.exe
  C:\Windows\System\aePRPjl.exe
  2⤵
  PID:8848
- C:\Windows\System\rqitGhh.exe
  C:\Windows\System\rqitGhh.exe
  2⤵
  PID:8868
- C:\Windows\System\nnooqoV.exe
  C:\Windows\System\nnooqoV.exe
  2⤵
  PID:8896
- C:\Windows\System\kxtkcMd.exe
  C:\Windows\System\kxtkcMd.exe
  2⤵
  PID:8924
- C:\Windows\System\qnJZsCL.exe
  C:\Windows\System\qnJZsCL.exe
  2⤵
  PID:8960
- C:\Windows\System\VmqCOIT.exe
  C:\Windows\System\VmqCOIT.exe
  2⤵
  PID:8984
- C:\Windows\System\kfmAomi.exe
  C:\Windows\System\kfmAomi.exe
  2⤵
  PID:9000
- C:\Windows\System\LfhUoPn.exe
  C:\Windows\System\LfhUoPn.exe
  2⤵
  PID:9020
- C:\Windows\System\VdikYik.exe
  C:\Windows\System\VdikYik.exe
  2⤵
  PID:9040
- C:\Windows\System\GOxZDpn.exe
  C:\Windows\System\GOxZDpn.exe
  2⤵
  PID:9060
- C:\Windows\System\ckWzdbS.exe
  C:\Windows\System\ckWzdbS.exe
  2⤵
  PID:9080
- C:\Windows\System\DPIxund.exe
  C:\Windows\System\DPIxund.exe
  2⤵
  PID:9104
- C:\Windows\System\oIZoYJQ.exe
  C:\Windows\System\oIZoYJQ.exe
  2⤵
  PID:9136
- C:\Windows\System\IhlPJMp.exe
  C:\Windows\System\IhlPJMp.exe
  2⤵
  PID:9160
- C:\Windows\System\cixhEzC.exe
  C:\Windows\System\cixhEzC.exe
  2⤵
  PID:9192
- C:\Windows\System\huqiard.exe
  C:\Windows\System\huqiard.exe
  2⤵
  PID:7216
- C:\Windows\System\LBvQtqi.exe
  C:\Windows\System\LBvQtqi.exe
  2⤵
  PID:8208
- C:\Windows\System\gwiUofW.exe
  C:\Windows\System\gwiUofW.exe
  2⤵
  PID:8256
- C:\Windows\System\nkEYfRf.exe
  C:\Windows\System\nkEYfRf.exe
  2⤵
  PID:8292
- C:\Windows\System\MoqzYHP.exe
  C:\Windows\System\MoqzYHP.exe
  2⤵
  PID:8364
- C:\Windows\System\IEAIoJP.exe
  C:\Windows\System\IEAIoJP.exe
  2⤵
  PID:8456
- C:\Windows\System\eQbVHAH.exe
  C:\Windows\System\eQbVHAH.exe
  2⤵
  PID:8488
- C:\Windows\System\IpjnAcz.exe
  C:\Windows\System\IpjnAcz.exe
  2⤵
  PID:8596
- C:\Windows\System\TeBadlv.exe
  C:\Windows\System\TeBadlv.exe
  2⤵
  PID:8616
- C:\Windows\System\gPjLLUG.exe
  C:\Windows\System\gPjLLUG.exe
  2⤵
  PID:8712
- C:\Windows\System\xrqmkGK.exe
  C:\Windows\System\xrqmkGK.exe
  2⤵
  PID:8856
- C:\Windows\System\Cctdnao.exe
  C:\Windows\System\Cctdnao.exe
  2⤵
  PID:8912
- C:\Windows\System\SnxJsRb.exe
  C:\Windows\System\SnxJsRb.exe
  2⤵
  PID:8892
- C:\Windows\System\EcytcRJ.exe
  C:\Windows\System\EcytcRJ.exe
  2⤵
  PID:8968
- C:\Windows\System\ckNttBg.exe
  C:\Windows\System\ckNttBg.exe
  2⤵
  PID:9068
- C:\Windows\System\gMbFktR.exe
  C:\Windows\System\gMbFktR.exe
  2⤵
  PID:9148
- C:\Windows\System\AKzkNlN.exe
  C:\Windows\System\AKzkNlN.exe
  2⤵
  PID:8296
- C:\Windows\System\IwpRtep.exe
  C:\Windows\System\IwpRtep.exe
  2⤵
  PID:9128
- C:\Windows\System\vPXkkay.exe
  C:\Windows\System\vPXkkay.exe
  2⤵
  PID:8528
- C:\Windows\System\XUxsjdE.exe
  C:\Windows\System\XUxsjdE.exe
  2⤵
  PID:8660
- C:\Windows\System\QFVaXGf.exe
  C:\Windows\System\QFVaXGf.exe
  2⤵
  PID:8504
- C:\Windows\System\lEYXfnR.exe
  C:\Windows\System\lEYXfnR.exe
  2⤵
  PID:9008
- C:\Windows\System\oKmCbyj.exe
  C:\Windows\System\oKmCbyj.exe
  2⤵
  PID:8832
- C:\Windows\System\DvKGwPo.exe
  C:\Windows\System\DvKGwPo.exe
  2⤵
  PID:9180
- C:\Windows\System\gnQPLFw.exe
  C:\Windows\System\gnQPLFw.exe
  2⤵
  PID:8020
- C:\Windows\System\tlpSTUu.exe
  C:\Windows\System\tlpSTUu.exe
  2⤵
  PID:9120
- C:\Windows\System\QdUXFis.exe
  C:\Windows\System\QdUXFis.exe
  2⤵
  PID:8748
- C:\Windows\System\XMcIwoB.exe
  C:\Windows\System\XMcIwoB.exe
  2⤵
  PID:9228
- C:\Windows\System\KiTUsIo.exe
  C:\Windows\System\KiTUsIo.exe
  2⤵
  PID:9264
- C:\Windows\System\bYgXbCZ.exe
  C:\Windows\System\bYgXbCZ.exe
  2⤵
  PID:9288
- C:\Windows\System\gMcaKZJ.exe
  C:\Windows\System\gMcaKZJ.exe
  2⤵
  PID:9312
- C:\Windows\System\GzasvNW.exe
  C:\Windows\System\GzasvNW.exe
  2⤵
  PID:9344
- C:\Windows\System\czBIUbY.exe
  C:\Windows\System\czBIUbY.exe
  2⤵
  PID:9380
- C:\Windows\System\QWIgywI.exe
  C:\Windows\System\QWIgywI.exe
  2⤵
  PID:9400
- C:\Windows\System\bromRpG.exe
  C:\Windows\System\bromRpG.exe
  2⤵
  PID:9432
- C:\Windows\System\nnWOgfG.exe
  C:\Windows\System\nnWOgfG.exe
  2⤵
  PID:9456
- C:\Windows\System\HbAZesV.exe
  C:\Windows\System\HbAZesV.exe
  2⤵
  PID:9476
- C:\Windows\System\GmzxRVf.exe
  C:\Windows\System\GmzxRVf.exe
  2⤵
  PID:9504
- C:\Windows\System\bRTrCfx.exe
  C:\Windows\System\bRTrCfx.exe
  2⤵
  PID:9528
- C:\Windows\System\mrhnXRl.exe
  C:\Windows\System\mrhnXRl.exe
  2⤵
  PID:9560
- C:\Windows\System\EZvzJyA.exe
  C:\Windows\System\EZvzJyA.exe
  2⤵
  PID:9596
- C:\Windows\System\kJtLbiS.exe
  C:\Windows\System\kJtLbiS.exe
  2⤵
  PID:9628
- C:\Windows\System\jKqwabf.exe
  C:\Windows\System\jKqwabf.exe
  2⤵
  PID:9660
- C:\Windows\System\kHQNRiN.exe
  C:\Windows\System\kHQNRiN.exe
  2⤵
  PID:9680
- C:\Windows\System\XPTmdii.exe
  C:\Windows\System\XPTmdii.exe
  2⤵
  PID:9708
- C:\Windows\System\MQEwaZk.exe
  C:\Windows\System\MQEwaZk.exe
  2⤵
  PID:9732
- C:\Windows\System\cgDTGrp.exe
  C:\Windows\System\cgDTGrp.exe
  2⤵
  PID:9764
- C:\Windows\System\aKHtbaG.exe
  C:\Windows\System\aKHtbaG.exe
  2⤵
  PID:9788
- C:\Windows\System\MyVjBQG.exe
  C:\Windows\System\MyVjBQG.exe
  2⤵
  PID:9820
- C:\Windows\System\hhKiCYt.exe
  C:\Windows\System\hhKiCYt.exe
  2⤵
  PID:9848
- C:\Windows\System\zhPYJbN.exe
  C:\Windows\System\zhPYJbN.exe
  2⤵
  PID:9876
- C:\Windows\System\VxHbrcN.exe
  C:\Windows\System\VxHbrcN.exe
  2⤵
  PID:9896
- C:\Windows\System\JPZAccR.exe
  C:\Windows\System\JPZAccR.exe
  2⤵
  PID:9916
- C:\Windows\System\fvEFkfE.exe
  C:\Windows\System\fvEFkfE.exe
  2⤵
  PID:9932
- C:\Windows\System\yRwzsSG.exe
  C:\Windows\System\yRwzsSG.exe
  2⤵
  PID:9948
- C:\Windows\System\iIQPdHx.exe
  C:\Windows\System\iIQPdHx.exe
  2⤵
  PID:9984
- C:\Windows\System\kNTtmMw.exe
  C:\Windows\System\kNTtmMw.exe
  2⤵
  PID:10008
- C:\Windows\System\FarfjcU.exe
  C:\Windows\System\FarfjcU.exe
  2⤵
  PID:10024
- C:\Windows\System\LuXuMgp.exe
  C:\Windows\System\LuXuMgp.exe
  2⤵
  PID:10052
- C:\Windows\System\TquzAiN.exe
  C:\Windows\System\TquzAiN.exe
  2⤵
  PID:10080
- C:\Windows\System\AlmOfvv.exe
  C:\Windows\System\AlmOfvv.exe
  2⤵
  PID:10104
- C:\Windows\System\lWbWzjG.exe
  C:\Windows\System\lWbWzjG.exe
  2⤵
  PID:10124
- C:\Windows\System\IHKvVFd.exe
  C:\Windows\System\IHKvVFd.exe
  2⤵
  PID:10152
- C:\Windows\System\qUAFVlM.exe
  C:\Windows\System\qUAFVlM.exe
  2⤵
  PID:10188
- C:\Windows\System\oYpcGPp.exe
  C:\Windows\System\oYpcGPp.exe
  2⤵
  PID:10220
- C:\Windows\System\eAlIwyW.exe
  C:\Windows\System\eAlIwyW.exe
  2⤵
  PID:8540
- C:\Windows\System\MhnJsGm.exe
  C:\Windows\System\MhnJsGm.exe
  2⤵
  PID:8992
- C:\Windows\System\uxvYaCL.exe
  C:\Windows\System\uxvYaCL.exe
  2⤵
  PID:9308
- C:\Windows\System\QSZeEvj.exe
  C:\Windows\System\QSZeEvj.exe
  2⤵
  PID:9388
- C:\Windows\System\lCmoPeP.exe
  C:\Windows\System\lCmoPeP.exe
  2⤵
  PID:9448
- C:\Windows\System\AfgBZad.exe
  C:\Windows\System\AfgBZad.exe
  2⤵
  PID:9444
- C:\Windows\System\CaHrpnI.exe
  C:\Windows\System\CaHrpnI.exe
  2⤵
  PID:9520
- C:\Windows\System\fhtWKCa.exe
  C:\Windows\System\fhtWKCa.exe
  2⤵
  PID:9488
- C:\Windows\System\xlMIgez.exe
  C:\Windows\System\xlMIgez.exe
  2⤵
  PID:9580
- C:\Windows\System\LysuCDh.exe
  C:\Windows\System\LysuCDh.exe
  2⤵
  PID:9696
- C:\Windows\System\dAosKhS.exe
  C:\Windows\System\dAosKhS.exe
  2⤵
  PID:9756
- C:\Windows\System\nFGvgXj.exe
  C:\Windows\System\nFGvgXj.exe
  2⤵
  PID:9840
- C:\Windows\System\aYssFcr.exe
  C:\Windows\System\aYssFcr.exe
  2⤵
  PID:9908
- C:\Windows\System\JmSQCqE.exe
  C:\Windows\System\JmSQCqE.exe
  2⤵
  PID:9968
- C:\Windows\System\UBQJfTo.exe
  C:\Windows\System\UBQJfTo.exe
  2⤵
  PID:9960
- C:\Windows\System\oUOsWzP.exe
  C:\Windows\System\oUOsWzP.exe
  2⤵
  PID:9996
- C:\Windows\System\dhYJKnj.exe
  C:\Windows\System\dhYJKnj.exe
  2⤵
  PID:10200
- C:\Windows\System\OZqgbsz.exe
  C:\Windows\System\OZqgbsz.exe
  2⤵
  PID:10172
- C:\Windows\System\ACeHJlm.exe
  C:\Windows\System\ACeHJlm.exe
  2⤵
  PID:9220
- C:\Windows\System\mBpmSeE.exe
  C:\Windows\System\mBpmSeE.exe
  2⤵
  PID:9672
- C:\Windows\System\AiiJICa.exe
  C:\Windows\System\AiiJICa.exe
  2⤵
  PID:9300
- C:\Windows\System\zPEawsT.exe
  C:\Windows\System\zPEawsT.exe
  2⤵
  PID:9992
- C:\Windows\System\ZmOiqyV.exe
  C:\Windows\System\ZmOiqyV.exe
  2⤵
  PID:10184
- C:\Windows\System\wZkwlfz.exe
  C:\Windows\System\wZkwlfz.exe
  2⤵
  PID:10016
- C:\Windows\System\ZGcyQXS.exe
  C:\Windows\System\ZGcyQXS.exe
  2⤵
  PID:10072
- C:\Windows\System\mqtvzrO.exe
  C:\Windows\System\mqtvzrO.exe
  2⤵
  PID:10248
- C:\Windows\System\PDomxtx.exe
  C:\Windows\System\PDomxtx.exe
  2⤵
  PID:10280
- C:\Windows\System\blwVyVl.exe
  C:\Windows\System\blwVyVl.exe
  2⤵
  PID:10316
- C:\Windows\System\LJQRjQp.exe
  C:\Windows\System\LJQRjQp.exe
  2⤵
  PID:10352
- C:\Windows\System\TOQOHvk.exe
  C:\Windows\System\TOQOHvk.exe
  2⤵
  PID:10380
- C:\Windows\System\CMhWTOV.exe
  C:\Windows\System\CMhWTOV.exe
  2⤵
  PID:10412
- C:\Windows\System\MDvkGWh.exe
  C:\Windows\System\MDvkGWh.exe
  2⤵
  PID:10436
- C:\Windows\System\JUmLjnZ.exe
  C:\Windows\System\JUmLjnZ.exe
  2⤵
  PID:10472
- C:\Windows\System\jIiGhxk.exe
  C:\Windows\System\jIiGhxk.exe
  2⤵
  PID:10500
- C:\Windows\System\UIqDbVQ.exe
  C:\Windows\System\UIqDbVQ.exe
  2⤵
  PID:10528
- C:\Windows\System\hAfspHf.exe
  C:\Windows\System\hAfspHf.exe
  2⤵
  PID:10556
- C:\Windows\System\MhEDPkn.exe
  C:\Windows\System\MhEDPkn.exe
  2⤵
  PID:10588
- C:\Windows\System\iKhmbwV.exe
  C:\Windows\System\iKhmbwV.exe
  2⤵
  PID:10608
- C:\Windows\System\DkzlJqt.exe
  C:\Windows\System\DkzlJqt.exe
  2⤵
  PID:10640
- C:\Windows\System\HIgziDW.exe
  C:\Windows\System\HIgziDW.exe
  2⤵
  PID:10668
- C:\Windows\System\YjoWoWe.exe
  C:\Windows\System\YjoWoWe.exe
  2⤵
  PID:10696
- C:\Windows\System\SrYqmWa.exe
  C:\Windows\System\SrYqmWa.exe
  2⤵
  PID:10716
- C:\Windows\System\gdKPyng.exe
  C:\Windows\System\gdKPyng.exe
  2⤵
  PID:10732
- C:\Windows\System\wZuJWxq.exe
  C:\Windows\System\wZuJWxq.exe
  2⤵
  PID:10764
- C:\Windows\System\MUUvKxQ.exe
  C:\Windows\System\MUUvKxQ.exe
  2⤵
  PID:10784
- C:\Windows\System\sbbyAVB.exe
  C:\Windows\System\sbbyAVB.exe
  2⤵
  PID:10808
- C:\Windows\System\vVUkZoH.exe
  C:\Windows\System\vVUkZoH.exe
  2⤵
  PID:10824
- C:\Windows\System\JJQpMJY.exe
  C:\Windows\System\JJQpMJY.exe
  2⤵
  PID:10848
- C:\Windows\System\wxNeKkX.exe
  C:\Windows\System\wxNeKkX.exe
  2⤵
  PID:10880
- C:\Windows\System\RPbMIGx.exe
  C:\Windows\System\RPbMIGx.exe
  2⤵
  PID:10916
- C:\Windows\System\oXBSMAR.exe
  C:\Windows\System\oXBSMAR.exe
  2⤵
  PID:10948
- C:\Windows\System\NuRbhAU.exe
  C:\Windows\System\NuRbhAU.exe
  2⤵
  PID:10976
- C:\Windows\System\mNaUYwV.exe
  C:\Windows\System\mNaUYwV.exe
  2⤵
  PID:11004
- C:\Windows\System\IMPDzcH.exe
  C:\Windows\System\IMPDzcH.exe
  2⤵
  PID:11040
- C:\Windows\System\sPrsMEm.exe
  C:\Windows\System\sPrsMEm.exe
  2⤵
  PID:11064
- C:\Windows\System\ILknYXB.exe
  C:\Windows\System\ILknYXB.exe
  2⤵
  PID:11092
- C:\Windows\System\JTdvJBn.exe
  C:\Windows\System\JTdvJBn.exe
  2⤵
  PID:11124
- C:\Windows\System\Oprccjw.exe
  C:\Windows\System\Oprccjw.exe
  2⤵
  PID:11148
- C:\Windows\System\IfBGnOt.exe
  C:\Windows\System\IfBGnOt.exe
  2⤵
  PID:11168
- C:\Windows\System\mtRsqWP.exe
  C:\Windows\System\mtRsqWP.exe
  2⤵
  PID:11196
- C:\Windows\System\saXUnVc.exe
  C:\Windows\System\saXUnVc.exe
  2⤵
  PID:11220
- C:\Windows\System\zpcguFL.exe
  C:\Windows\System\zpcguFL.exe
  2⤵
  PID:11244
- C:\Windows\System\MEkKYCp.exe
  C:\Windows\System\MEkKYCp.exe
  2⤵
  PID:9904
- C:\Windows\System\pqvORFy.exe
  C:\Windows\System\pqvORFy.exe
  2⤵
  PID:10064
- C:\Windows\System\RUTOcNI.exe
  C:\Windows\System\RUTOcNI.exe
  2⤵
  PID:9836
- C:\Windows\System\bqzdTve.exe
  C:\Windows\System\bqzdTve.exe
  2⤵
  PID:10328
- C:\Windows\System\qdwdsIv.exe
  C:\Windows\System\qdwdsIv.exe
  2⤵
  PID:10392
- C:\Windows\System\YpkLKhq.exe
  C:\Windows\System\YpkLKhq.exe
  2⤵
  PID:10496
- C:\Windows\System\vieXHgk.exe
  C:\Windows\System\vieXHgk.exe
  2⤵
  PID:10520
- C:\Windows\System\VPeLJSZ.exe
  C:\Windows\System\VPeLJSZ.exe
  2⤵
  PID:10488
- C:\Windows\System\igwqnur.exe
  C:\Windows\System\igwqnur.exe
  2⤵
  PID:10548
- C:\Windows\System\dPDHrfO.exe
  C:\Windows\System\dPDHrfO.exe
  2⤵
  PID:10636
- C:\Windows\System\pQJMXSL.exe
  C:\Windows\System\pQJMXSL.exe
  2⤵
  PID:10728
- C:\Windows\System\AJumkRN.exe
  C:\Windows\System\AJumkRN.exe
  2⤵
  PID:10876
- C:\Windows\System\VzeYpVQ.exe
  C:\Windows\System\VzeYpVQ.exe
  2⤵
  PID:10908
- C:\Windows\System\jQHLXQe.exe
  C:\Windows\System\jQHLXQe.exe
  2⤵
  PID:10972
- C:\Windows\System\hHccpou.exe
  C:\Windows\System\hHccpou.exe
  2⤵
  PID:11036
- C:\Windows\System\RWcRBdr.exe
  C:\Windows\System\RWcRBdr.exe
  2⤵
  PID:10860
- C:\Windows\System\gqpiYhe.exe
  C:\Windows\System\gqpiYhe.exe
  2⤵
  PID:10956
- C:\Windows\System\XRREHXt.exe
  C:\Windows\System\XRREHXt.exe
  2⤵
  PID:11056
- C:\Windows\System\KXQwhau.exe
  C:\Windows\System\KXQwhau.exe
  2⤵
  PID:11188
- C:\Windows\System\bajsNAy.exe
  C:\Windows\System\bajsNAy.exe
  2⤵
  PID:10336
- C:\Windows\System\eDdKSyJ.exe
  C:\Windows\System\eDdKSyJ.exe
  2⤵
  PID:10304
- C:\Windows\System\MXxIWNt.exe
  C:\Windows\System\MXxIWNt.exe
  2⤵
  PID:10424
- C:\Windows\System\seHTOCP.exe
  C:\Windows\System\seHTOCP.exe
  2⤵
  PID:10536
- C:\Windows\System\vdjpqBt.exe
  C:\Windows\System\vdjpqBt.exe
  2⤵
  PID:10900
- C:\Windows\System\TtvFCQK.exe
  C:\Windows\System\TtvFCQK.exe
  2⤵
  PID:10844
- C:\Windows\System\qamluPf.exe
  C:\Windows\System\qamluPf.exe
  2⤵
  PID:9692
- C:\Windows\System\EFErmqM.exe
  C:\Windows\System\EFErmqM.exe
  2⤵
  PID:11268
- C:\Windows\System\SXpvpVm.exe
  C:\Windows\System\SXpvpVm.exe
  2⤵
  PID:11288
- C:\Windows\System\NOKwqzF.exe
  C:\Windows\System\NOKwqzF.exe
  2⤵
  PID:11324
- C:\Windows\System\sBxdOeU.exe
  C:\Windows\System\sBxdOeU.exe
  2⤵
  PID:11348
- C:\Windows\System\QNeImjq.exe
  C:\Windows\System\QNeImjq.exe
  2⤵
  PID:11380
- C:\Windows\System\uVIIVhO.exe
  C:\Windows\System\uVIIVhO.exe
  2⤵
  PID:11396
- C:\Windows\System\FSJXEzD.exe
  C:\Windows\System\FSJXEzD.exe
  2⤵
  PID:11424
- C:\Windows\System\RZRYLeS.exe
  C:\Windows\System\RZRYLeS.exe
  2⤵
  PID:11452
- C:\Windows\System\emwkfqI.exe
  C:\Windows\System\emwkfqI.exe
  2⤵
  PID:11476
- C:\Windows\System\QsHzYKi.exe
  C:\Windows\System\QsHzYKi.exe
  2⤵
  PID:11512
- C:\Windows\System\vwZnNPy.exe
  C:\Windows\System\vwZnNPy.exe
  2⤵
  PID:11548
- C:\Windows\System\DCncitH.exe
  C:\Windows\System\DCncitH.exe
  2⤵
  PID:11576
- C:\Windows\System\LLUhkto.exe
  C:\Windows\System\LLUhkto.exe
  2⤵
  PID:11612
- C:\Windows\System\hhnTJcr.exe
  C:\Windows\System\hhnTJcr.exe
  2⤵
  PID:11632
- C:\Windows\System\kPWAYOM.exe
  C:\Windows\System\kPWAYOM.exe
  2⤵
  PID:11648
- C:\Windows\System\kirMmuc.exe
  C:\Windows\System\kirMmuc.exe
  2⤵
  PID:11684
- C:\Windows\System\hLYrQQG.exe
  C:\Windows\System\hLYrQQG.exe
  2⤵
  PID:11712
- C:\Windows\System\jERwljb.exe
  C:\Windows\System\jERwljb.exe
  2⤵
  PID:11736
- C:\Windows\System\htnRLlf.exe
  C:\Windows\System\htnRLlf.exe
  2⤵
  PID:11752
- C:\Windows\System\cpidNfs.exe
  C:\Windows\System\cpidNfs.exe
  2⤵
  PID:11780
- C:\Windows\System\CbBeGpN.exe
  C:\Windows\System\CbBeGpN.exe
  2⤵
  PID:11812
- C:\Windows\System\LbXQAqn.exe
  C:\Windows\System\LbXQAqn.exe
  2⤵
  PID:11836
- C:\Windows\System\xdNlldH.exe
  C:\Windows\System\xdNlldH.exe
  2⤵
  PID:11864
- C:\Windows\System\AEGoDbe.exe
  C:\Windows\System\AEGoDbe.exe
  2⤵
  PID:11884
- C:\Windows\System\jaErMbw.exe
  C:\Windows\System\jaErMbw.exe
  2⤵
  PID:11912
- C:\Windows\System\YEGDyWm.exe
  C:\Windows\System\YEGDyWm.exe
  2⤵
  PID:11948
- C:\Windows\System\GnNZpWG.exe
  C:\Windows\System\GnNZpWG.exe
  2⤵
  PID:11976
- C:\Windows\System\xWKYoSy.exe
  C:\Windows\System\xWKYoSy.exe
  2⤵
  PID:12000
- C:\Windows\System\DcOkPrb.exe
  C:\Windows\System\DcOkPrb.exe
  2⤵
  PID:12028
- C:\Windows\System\gdGgQsG.exe
  C:\Windows\System\gdGgQsG.exe
  2⤵
  PID:12056
- C:\Windows\System\trazwUh.exe
  C:\Windows\System\trazwUh.exe
  2⤵
  PID:12080
- C:\Windows\System\dwvAFnA.exe
  C:\Windows\System\dwvAFnA.exe
  2⤵
  PID:12096
- C:\Windows\System\cWzuflt.exe
  C:\Windows\System\cWzuflt.exe
  2⤵
  PID:12124
- C:\Windows\System\eDLODwv.exe
  C:\Windows\System\eDLODwv.exe
  2⤵
  PID:12144
- C:\Windows\System\LcPKOCR.exe
  C:\Windows\System\LcPKOCR.exe
  2⤵
  PID:12168
- C:\Windows\System\vqlwaES.exe
  C:\Windows\System\vqlwaES.exe
  2⤵
  PID:12196
- C:\Windows\System\cebLmdk.exe
  C:\Windows\System\cebLmdk.exe
  2⤵
  PID:12224
- C:\Windows\System\RRnwJLQ.exe
  C:\Windows\System\RRnwJLQ.exe
  2⤵
  PID:12248
- C:\Windows\System\RgYpoBo.exe
  C:\Windows\System\RgYpoBo.exe
  2⤵
  PID:12272
- C:\Windows\System\ASMsojQ.exe
  C:\Windows\System\ASMsojQ.exe
  2⤵
  PID:10868
- C:\Windows\System\IeqWzed.exe
  C:\Windows\System\IeqWzed.exe
  2⤵
  PID:11100
- C:\Windows\System\fiFODUn.exe
  C:\Windows\System\fiFODUn.exe
  2⤵
  PID:11300
- C:\Windows\System\ftURRDo.exe
  C:\Windows\System\ftURRDo.exe
  2⤵
  PID:9240
- C:\Windows\System\EyMSpyf.exe
  C:\Windows\System\EyMSpyf.exe
  2⤵
  PID:10652
- C:\Windows\System\syNzCnZ.exe
  C:\Windows\System\syNzCnZ.exe
  2⤵
  PID:11440
- C:\Windows\System\iQArLVl.exe
  C:\Windows\System\iQArLVl.exe
  2⤵
  PID:11280
- C:\Windows\System\LbJfzzW.exe
  C:\Windows\System\LbJfzzW.exe
  2⤵
  PID:11344
- C:\Windows\System\wVsTLeP.exe
  C:\Windows\System\wVsTLeP.exe
  2⤵
  PID:11472
- C:\Windows\System\ucLLLGG.exe
  C:\Windows\System\ucLLLGG.exe
  2⤵
  PID:11700
- C:\Windows\System\BDpGWQu.exe
  C:\Windows\System\BDpGWQu.exe
  2⤵
  PID:11600
- C:\Windows\System\gFGMEiI.exe
  C:\Windows\System\gFGMEiI.exe
  2⤵
  PID:11640
- C:\Windows\System\rolhqQH.exe
  C:\Windows\System\rolhqQH.exe
  2⤵
  PID:11676
- C:\Windows\System\ZuDfhBq.exe
  C:\Windows\System\ZuDfhBq.exe
  2⤵
  PID:12076
- C:\Windows\System\IfTUlop.exe
  C:\Windows\System\IfTUlop.exe
  2⤵
  PID:12164
- C:\Windows\System\LpianJr.exe
  C:\Windows\System\LpianJr.exe
  2⤵
  PID:12068
- C:\Windows\System\eJiwUwc.exe
  C:\Windows\System\eJiwUwc.exe
  2⤵
  PID:11028
- C:\Windows\System\KrPwOVV.exe
  C:\Windows\System\KrPwOVV.exe
  2⤵
  PID:11240
- C:\Windows\System\lPPjLZp.exe
  C:\Windows\System\lPPjLZp.exe
  2⤵
  PID:11016
- C:\Windows\System\affGrxg.exe
  C:\Windows\System\affGrxg.exe
  2⤵
  PID:12260
- C:\Windows\System\qiDPkvQ.exe
  C:\Windows\System\qiDPkvQ.exe
  2⤵
  PID:12112
- C:\Windows\System\lmCIbwB.exe
  C:\Windows\System\lmCIbwB.exe
  2⤵
  PID:12176
- C:\Windows\System\FAndaFW.exe
  C:\Windows\System\FAndaFW.exe
  2⤵
  PID:11464
- C:\Windows\System\YZstTOQ.exe
  C:\Windows\System\YZstTOQ.exe
  2⤵
  PID:11992
- C:\Windows\System\ObvnzHo.exe
  C:\Windows\System\ObvnzHo.exe
  2⤵
  PID:11852
- C:\Windows\System\ckUvtUu.exe
  C:\Windows\System\ckUvtUu.exe
  2⤵
  PID:12308
- C:\Windows\System\zLQDKwZ.exe
  C:\Windows\System\zLQDKwZ.exe
  2⤵
  PID:12324
- C:\Windows\System\hQLmeLR.exe
  C:\Windows\System\hQLmeLR.exe
  2⤵
  PID:12344
- C:\Windows\System\RaLWnxj.exe
  C:\Windows\System\RaLWnxj.exe
  2⤵
  PID:12372
- C:\Windows\System\LlCuxvU.exe
  C:\Windows\System\LlCuxvU.exe
  2⤵
  PID:12400
- C:\Windows\System\cBBZRBe.exe
  C:\Windows\System\cBBZRBe.exe
  2⤵
  PID:12432
- C:\Windows\System\wKKBQOk.exe
  C:\Windows\System\wKKBQOk.exe
  2⤵
  PID:12464
- C:\Windows\System\EDgYQjU.exe
  C:\Windows\System\EDgYQjU.exe
  2⤵
  PID:12492
- C:\Windows\System\CyofkPL.exe
  C:\Windows\System\CyofkPL.exe
  2⤵
  PID:12512
- C:\Windows\System\LfrYDct.exe
  C:\Windows\System\LfrYDct.exe
  2⤵
  PID:12544
- C:\Windows\System\zrizirO.exe
  C:\Windows\System\zrizirO.exe
  2⤵
  PID:12580
- C:\Windows\System\YNvawJq.exe
  C:\Windows\System\YNvawJq.exe
  2⤵
  PID:12608
- C:\Windows\System\EoSmNDS.exe
  C:\Windows\System\EoSmNDS.exe
  2⤵
  PID:12636
- C:\Windows\System\owyiRPb.exe
  C:\Windows\System\owyiRPb.exe
  2⤵
  PID:12760
- C:\Windows\System\waZWQtR.exe
  C:\Windows\System\waZWQtR.exe
  2⤵
  PID:12804
- C:\Windows\System\OnasmBn.exe
  C:\Windows\System\OnasmBn.exe
  2⤵
  PID:12836
- C:\Windows\System\ILoeRaX.exe
  C:\Windows\System\ILoeRaX.exe
  2⤵
  PID:12860
- C:\Windows\System\anEKdUY.exe
  C:\Windows\System\anEKdUY.exe
  2⤵
  PID:12884
- C:\Windows\System\sdXzLJr.exe
  C:\Windows\System\sdXzLJr.exe
  2⤵
  PID:12916
- C:\Windows\System\YlKkWJx.exe
  C:\Windows\System\YlKkWJx.exe
  2⤵
  PID:12960
- C:\Windows\System\SlJWqTf.exe
  C:\Windows\System\SlJWqTf.exe
  2⤵
  PID:12984
- C:\Windows\System\jpMdxmc.exe
  C:\Windows\System\jpMdxmc.exe
  2⤵
  PID:13016
- C:\Windows\System\OnXEKlt.exe
  C:\Windows\System\OnXEKlt.exe
  2⤵
  PID:13040
- C:\Windows\System\VNyyqGl.exe
  C:\Windows\System\VNyyqGl.exe
  2⤵
  PID:13064
- C:\Windows\System\NsNXfZo.exe
  C:\Windows\System\NsNXfZo.exe
  2⤵
  PID:13100
- C:\Windows\System\ysXXIjX.exe
  C:\Windows\System\ysXXIjX.exe
  2⤵
  PID:13128
- C:\Windows\System\AjMQSVn.exe
  C:\Windows\System\AjMQSVn.exe
  2⤵
  PID:13168
- C:\Windows\System\oPfbNkW.exe
  C:\Windows\System\oPfbNkW.exe
  2⤵
  PID:13192
- C:\Windows\System\OlRgWbe.exe
  C:\Windows\System\OlRgWbe.exe
  2⤵
  PID:13220
- C:\Windows\System\xbqIXYs.exe
  C:\Windows\System\xbqIXYs.exe
  2⤵
  PID:13248
- C:\Windows\System\bgJBiCL.exe
  C:\Windows\System\bgJBiCL.exe
  2⤵
  PID:13264
- C:\Windows\System\LgRhOfX.exe
  C:\Windows\System\LgRhOfX.exe
  2⤵
  PID:13284
- C:\Windows\System\belGYZe.exe
  C:\Windows\System\belGYZe.exe
  2⤵
  PID:13308
- C:\Windows\System\UJsorKo.exe
  C:\Windows\System\UJsorKo.exe
  2⤵
  PID:10816
- C:\Windows\System\LnHrEkK.exe
  C:\Windows\System\LnHrEkK.exe
  2⤵
  PID:11804
- C:\Windows\System\XXNbcOf.exe
  C:\Windows\System\XXNbcOf.exe
  2⤵
  PID:10376
- C:\Windows\System\StdpMCg.exe
  C:\Windows\System\StdpMCg.exe
  2⤵
  PID:11900
- C:\Windows\System\QdGdRNk.exe
  C:\Windows\System\QdGdRNk.exe
  2⤵
  PID:12412
- C:\Windows\System\qmZjCoC.exe
  C:\Windows\System\qmZjCoC.exe
  2⤵
  PID:12296
- C:\Windows\System\QJXzLPr.exe
  C:\Windows\System\QJXzLPr.exe
  2⤵
  PID:12352
- C:\Windows\System\iUlQOjF.exe
  C:\Windows\System\iUlQOjF.exe
  2⤵
  PID:12592
- C:\Windows\System\cZmDyPZ.exe
  C:\Windows\System\cZmDyPZ.exe
  2⤵
  PID:12716
- C:\Windows\System\fTDlTzS.exe
  C:\Windows\System\fTDlTzS.exe
  2⤵
  PID:12444
- C:\Windows\System\LEpAyLH.exe
  C:\Windows\System\LEpAyLH.exe
  2⤵
  PID:12480
- C:\Windows\System\NtjPdbn.exe
  C:\Windows\System\NtjPdbn.exe
  2⤵
  PID:12812
- C:\Windows\System\GSHdecC.exe
  C:\Windows\System\GSHdecC.exe
  2⤵
  PID:12880
- C:\Windows\System\rgHakAL.exe
  C:\Windows\System\rgHakAL.exe
  2⤵
  PID:12904
- C:\Windows\System\FdcwTCA.exe
  C:\Windows\System\FdcwTCA.exe
  2⤵
  PID:12848
- C:\Windows\System\VRivBqf.exe
  C:\Windows\System\VRivBqf.exe
  2⤵
  PID:13096
- C:\Windows\System\dIwCDwT.exe
  C:\Windows\System\dIwCDwT.exe
  2⤵
  PID:13120
- C:\Windows\System\XihsCYQ.exe
  C:\Windows\System\XihsCYQ.exe
  2⤵
  PID:13160
- C:\Windows\System\iBcRAvg.exe
  C:\Windows\System\iBcRAvg.exe
  2⤵
  PID:13052
- C:\Windows\System\McFHEvy.exe
  C:\Windows\System\McFHEvy.exe
  2⤵
  PID:12232
- C:\Windows\System\blDBLJp.exe
  C:\Windows\System\blDBLJp.exe
  2⤵
  PID:13260
- C:\Windows\System\SWUoHBr.exe
  C:\Windows\System\SWUoHBr.exe
  2⤵
  PID:13232
- C:\Windows\System\QsKQpuD.exe
  C:\Windows\System\QsKQpuD.exe
  2⤵
  PID:13300
- C:\Windows\System\ScErQfi.exe
  C:\Windows\System\ScErQfi.exe
  2⤵
  PID:12332
- C:\Windows\System\lWWLZbE.exe
  C:\Windows\System\lWWLZbE.exe
  2⤵
  PID:12092
- C:\Windows\System\cLLVrEI.exe
  C:\Windows\System\cLLVrEI.exe
  2⤵
  PID:12828
- C:\Windows\System\TOsRLRO.exe
  C:\Windows\System\TOsRLRO.exe
  2⤵
  PID:13136
- C:\Windows\System\ItlSzOM.exe
  C:\Windows\System\ItlSzOM.exe
  2⤵
  PID:12948
- C:\Windows\System\MNfEndt.exe
  C:\Windows\System\MNfEndt.exe
  2⤵
  PID:12500
- C:\Windows\System\VXScCCi.exe
  C:\Windows\System\VXScCCi.exe
  2⤵
  PID:13336
- C:\Windows\System\gOCgkEt.exe
  C:\Windows\System\gOCgkEt.exe
  2⤵
  PID:13380
- C:\Windows\System\mAVACdJ.exe
  C:\Windows\System\mAVACdJ.exe
  2⤵
  PID:13400
- C:\Windows\System\WVhXrsm.exe
  C:\Windows\System\WVhXrsm.exe
  2⤵
  PID:13420
- C:\Windows\System\udSkOLa.exe
  C:\Windows\System\udSkOLa.exe
  2⤵
  PID:13452
- C:\Windows\System\qFeWaMz.exe
  C:\Windows\System\qFeWaMz.exe
  2⤵
  PID:13480
- C:\Windows\System\gPeBrdu.exe
  C:\Windows\System\gPeBrdu.exe
  2⤵
  PID:13504
- C:\Windows\System\fWCUmFF.exe
  C:\Windows\System\fWCUmFF.exe
  2⤵
  PID:13524
- C:\Windows\System\zirukkj.exe
  C:\Windows\System\zirukkj.exe
  2⤵
  PID:13564
- C:\Windows\System\xgfUoan.exe
  C:\Windows\System\xgfUoan.exe
  2⤵
  PID:13584
- C:\Windows\System\urHpaQD.exe
  C:\Windows\System\urHpaQD.exe
  2⤵
  PID:13608
- C:\Windows\System\LqBQmUB.exe
  C:\Windows\System\LqBQmUB.exe
  2⤵
  PID:13636
- C:\Windows\System\yZqHvQS.exe
  C:\Windows\System\yZqHvQS.exe
  2⤵
  PID:13660
- C:\Windows\System\ZFkvYVr.exe
  C:\Windows\System\ZFkvYVr.exe
  2⤵
  PID:13688
- C:\Windows\System\rtrsKaM.exe
  C:\Windows\System\rtrsKaM.exe
  2⤵
  PID:13712
- C:\Windows\System\itFYbRm.exe
  C:\Windows\System\itFYbRm.exe
  2⤵
  PID:13744
- C:\Windows\System\gjGzeDF.exe
  C:\Windows\System\gjGzeDF.exe
  2⤵
  PID:13768
- C:\Windows\System\CnXdlKe.exe
  C:\Windows\System\CnXdlKe.exe
  2⤵
  PID:13804
- C:\Windows\System\UZJofqg.exe
  C:\Windows\System\UZJofqg.exe
  2⤵
  PID:13828
- C:\Windows\System\WWOIczB.exe
  C:\Windows\System\WWOIczB.exe
  2⤵
  PID:13848
- C:\Windows\System\FgVRXyH.exe
  C:\Windows\System\FgVRXyH.exe
  2⤵
  PID:13880
- C:\Windows\System\TTjdUqc.exe
  C:\Windows\System\TTjdUqc.exe
  2⤵
  PID:13904
- C:\Windows\System\nuoeZui.exe
  C:\Windows\System\nuoeZui.exe
  2⤵
  PID:13940
- C:\Windows\System\KoKDHJc.exe
  C:\Windows\System\KoKDHJc.exe
  2⤵
  PID:13964
- C:\Windows\System\OiJtpMB.exe
  C:\Windows\System\OiJtpMB.exe
  2⤵
  PID:13984
- C:\Windows\System\rGdIwrJ.exe
  C:\Windows\System\rGdIwrJ.exe
  2⤵
  PID:14016
- C:\Windows\System\fDOZUWD.exe
  C:\Windows\System\fDOZUWD.exe
  2⤵
  PID:14036
- C:\Windows\System\wTXnCqp.exe
  C:\Windows\System\wTXnCqp.exe
  2⤵
  PID:14060
- C:\Windows\System\lSaUapN.exe
  C:\Windows\System\lSaUapN.exe
  2⤵
  PID:14096
- C:\Windows\System\jCOYvZy.exe
  C:\Windows\System\jCOYvZy.exe
  2⤵
  PID:14132
- C:\Windows\System\qBWIoQh.exe
  C:\Windows\System\qBWIoQh.exe
  2⤵
  PID:14168
- C:\Windows\System\hGWabfd.exe
  C:\Windows\System\hGWabfd.exe
  2⤵
  PID:14200
- C:\Windows\System\LOqJGco.exe
  C:\Windows\System\LOqJGco.exe
  2⤵
  PID:14236
- C:\Windows\System\nfKLuNb.exe
  C:\Windows\System\nfKLuNb.exe
  2⤵
  PID:14260
- C:\Windows\System\pLUBePd.exe
  C:\Windows\System\pLUBePd.exe
  2⤵
  PID:14288
- C:\Windows\System\Axdjlco.exe
  C:\Windows\System\Axdjlco.exe
  2⤵
  PID:14328
- C:\Windows\System\BKtLirP.exe
  C:\Windows\System\BKtLirP.exe
  2⤵
  PID:11940
- C:\Windows\System\sWarIWX.exe
  C:\Windows\System\sWarIWX.exe
  2⤵
  PID:12304
- C:\Windows\System\FjdcCAQ.exe
  C:\Windows\System\FjdcCAQ.exe
  2⤵
  PID:12672
- C:\Windows\System\dTSpPGO.exe
  C:\Windows\System\dTSpPGO.exe
  2⤵
  PID:13112
- C:\Windows\System\vFvriOq.exe
  C:\Windows\System\vFvriOq.exe
  2⤵
  PID:9980
- C:\Windows\System\xoUJBwZ.exe
  C:\Windows\System\xoUJBwZ.exe
  2⤵
  PID:12872
- C:\Windows\System\zDhUoQT.exe
  C:\Windows\System\zDhUoQT.exe
  2⤵
  PID:13396
- C:\Windows\System\jPtUQjL.exe
  C:\Windows\System\jPtUQjL.exe
  2⤵
  PID:14120
- C:\Windows\System\kJsGgxM.exe
  C:\Windows\System\kJsGgxM.exe
  2⤵
  PID:13900
- C:\Windows\System\uqKIRSq.exe
  C:\Windows\System\uqKIRSq.exe
  2⤵
  PID:14184
- C:\Windows\System\lTXHjlN.exe
  C:\Windows\System\lTXHjlN.exe
  2⤵
  PID:14116
- C:\Windows\System\SFnlGaz.exe
  C:\Windows\System\SFnlGaz.exe
  2⤵
  PID:14004
- C:\Windows\System\btxLLnG.exe
  C:\Windows\System\btxLLnG.exe
  2⤵
  PID:14228
- C:\Windows\System\ktqkGQG.exe
  C:\Windows\System\ktqkGQG.exe
  2⤵
  PID:13464
- C:\Windows\System\lzpZAYf.exe
  C:\Windows\System\lzpZAYf.exe
  2⤵
  PID:13348
- C:\Windows\System\msJyTBF.exe
  C:\Windows\System\msJyTBF.exe
  2⤵
  PID:14296
- C:\Windows\System\hSSpMfo.exe
  C:\Windows\System\hSSpMfo.exe
  2⤵
  PID:13032
- C:\Windows\System\pPDjHJi.exe
  C:\Windows\System\pPDjHJi.exe
  2⤵
  PID:13448
- C:\Windows\System\QElDvOW.exe
  C:\Windows\System\QElDvOW.exe
  2⤵
  PID:13328
- C:\Windows\System\OkrJmuQ.exe
  C:\Windows\System\OkrJmuQ.exe
  2⤵
  PID:13756
- C:\Windows\System\gXLJpgh.exe
  C:\Windows\System\gXLJpgh.exe
  2⤵
  PID:14072
- C:\Windows\System\rTMZNNP.exe
  C:\Windows\System\rTMZNNP.exe
  2⤵
  PID:14056
- C:\Windows\System\edlkYQC.exe
  C:\Windows\System\edlkYQC.exe
  2⤵
  PID:14000
- C:\Windows\System\PRzrfWp.exe
  C:\Windows\System\PRzrfWp.exe
  2⤵
  PID:12796
- C:\Windows\System\LhiFTxA.exe
  C:\Windows\System\LhiFTxA.exe
  2⤵
  PID:13620
- C:\Windows\System\knHaIFm.exe
  C:\Windows\System\knHaIFm.exe
  2⤵
  PID:11720
- C:\Windows\System\NaBgEyA.exe
  C:\Windows\System\NaBgEyA.exe
  2⤵
  PID:13672
- C:\Windows\System\WKgpePQ.exe
  C:\Windows\System\WKgpePQ.exe
  2⤵
  PID:10236
- C:\Windows\System\iZkYaZy.exe
  C:\Windows\System\iZkYaZy.exe
  2⤵
  PID:13840
- C:\Windows\System\nREGIrT.exe
  C:\Windows\System\nREGIrT.exe
  2⤵
  PID:14364
- C:\Windows\System\sODwxxM.exe
  C:\Windows\System\sODwxxM.exe
  2⤵
  PID:14392
- C:\Windows\System\vPYnoKn.exe
  C:\Windows\System\vPYnoKn.exe
  2⤵
  PID:14436
- C:\Windows\System\tNceqlI.exe
  C:\Windows\System\tNceqlI.exe
  2⤵
  PID:14460
- C:\Windows\System\aUdHeOz.exe
  C:\Windows\System\aUdHeOz.exe
  2⤵
  PID:14488
- C:\Windows\System\iVcUxvN.exe
  C:\Windows\System\iVcUxvN.exe
  2⤵
  PID:14508
- C:\Windows\System\UpJNhzD.exe
  C:\Windows\System\UpJNhzD.exe
  2⤵
  PID:14536
- C:\Windows\System\dcJZbWg.exe
  C:\Windows\System\dcJZbWg.exe
  2⤵
  PID:14572
- C:\Windows\System\UgUZkVq.exe
  C:\Windows\System\UgUZkVq.exe
  2⤵
  PID:14600
- C:\Windows\System\FRAQPDj.exe
  C:\Windows\System\FRAQPDj.exe
  2⤵
  PID:14624
- C:\Windows\System\ZvKaUgp.exe
  C:\Windows\System\ZvKaUgp.exe
  2⤵
  PID:14660
- C:\Windows\System\RXJYcCK.exe
  C:\Windows\System\RXJYcCK.exe
  2⤵
  PID:14680
- C:\Windows\System\ynCiRlv.exe
  C:\Windows\System\ynCiRlv.exe
  2⤵
  PID:14712
- C:\Windows\System\DhevqlC.exe
  C:\Windows\System\DhevqlC.exe
  2⤵
  PID:14732
- C:\Windows\System\gTNPvOo.exe
  C:\Windows\System\gTNPvOo.exe
  2⤵
  PID:14760
- C:\Windows\System\DZiByoE.exe
  C:\Windows\System\DZiByoE.exe
  2⤵
  PID:14780
- C:\Windows\System\PXCmhAC.exe
  C:\Windows\System\PXCmhAC.exe
  2⤵
  PID:14796
- C:\Windows\System\DYHbHGf.exe
  C:\Windows\System\DYHbHGf.exe
  2⤵
  PID:14816
- C:\Windows\System\YrODeTg.exe
  C:\Windows\System\YrODeTg.exe
  2⤵
  PID:14848
- C:\Windows\System\fWpDfQA.exe
  C:\Windows\System\fWpDfQA.exe
  2⤵
  PID:14864
- C:\Windows\System\uFkZYJW.exe
  C:\Windows\System\uFkZYJW.exe
  2⤵
  PID:14896
- C:\Windows\System\uumuYZp.exe
  C:\Windows\System\uumuYZp.exe
  2⤵
  PID:14928
- C:\Windows\System\IjMXQIq.exe
  C:\Windows\System\IjMXQIq.exe
  2⤵
  PID:14968
- C:\Windows\System\LdBAifN.exe
  C:\Windows\System\LdBAifN.exe
  2⤵
  PID:14988
- C:\Windows\System\fGrfiVq.exe
  C:\Windows\System\fGrfiVq.exe
  2⤵
  PID:15020
- C:\Windows\System\srXhjfQ.exe
  C:\Windows\System\srXhjfQ.exe
  2⤵
  PID:15048
- C:\Windows\System\pNlbzqn.exe
  C:\Windows\System\pNlbzqn.exe
  2⤵
  PID:15076
- C:\Windows\System\LYOHqHo.exe
  C:\Windows\System\LYOHqHo.exe
  2⤵
  PID:15104
- C:\Windows\System\itQzrZr.exe
  C:\Windows\System\itQzrZr.exe
  2⤵
  PID:15124
- C:\Windows\System\PRegSOZ.exe
  C:\Windows\System\PRegSOZ.exe
  2⤵
  PID:15156
- C:\Windows\System\pKUuBRl.exe
  C:\Windows\System\pKUuBRl.exe
  2⤵
  PID:15180
- C:\Windows\System\YNKKHFc.exe
  C:\Windows\System\YNKKHFc.exe
  2⤵
  PID:15212
- C:\Windows\System\FpVNCAX.exe
  C:\Windows\System\FpVNCAX.exe
  2⤵
  PID:15236
- C:\Windows\System\HxcmhRW.exe
  C:\Windows\System\HxcmhRW.exe
  2⤵
  PID:15272
- C:\Windows\System\tYodgoy.exe
  C:\Windows\System\tYodgoy.exe
  2⤵
  PID:15292
- C:\Windows\System\BnbvLnJ.exe
  C:\Windows\System\BnbvLnJ.exe
  2⤵
  PID:15312
- C:\Windows\System\vSYeZam.exe
  C:\Windows\System\vSYeZam.exe
  2⤵
  PID:15336
- C:\Windows\System\WwYTwLJ.exe
  C:\Windows\System\WwYTwLJ.exe
  2⤵
  PID:15352
- C:\Windows\System\viXzrTv.exe
  C:\Windows\System\viXzrTv.exe
  2⤵
  PID:14372
- C:\Windows\System\rlVwrTZ.exe
  C:\Windows\System\rlVwrTZ.exe
  2⤵
  PID:14320
- C:\Windows\System\oulsDaV.exe
  C:\Windows\System\oulsDaV.exe
  2⤵
  PID:14404
- C:\Windows\System\BsuDzjI.exe
  C:\Windows\System\BsuDzjI.exe
  2⤵
  PID:14620
- C:\Windows\System\oQPpCrt.exe
  C:\Windows\System\oQPpCrt.exe
  2⤵
  PID:14528
- C:\Windows\System\mukKtnj.exe
  C:\Windows\System\mukKtnj.exe
  2⤵
  PID:14752
- C:\Windows\System\hGghtVn.exe
  C:\Windows\System\hGghtVn.exe
  2⤵
  PID:14724
- C:\Windows\System\mNOHdLA.exe
  C:\Windows\System\mNOHdLA.exe
  2⤵
  PID:14708
- C:\Windows\System\WCEgUmS.exe
  C:\Windows\System\WCEgUmS.exe
  2⤵
  PID:14956
- C:\Windows\System\GnkzfWQ.exe
  C:\Windows\System\GnkzfWQ.exe
  2⤵
  PID:15016
- C:\Windows\System\IwvBpGs.exe
  C:\Windows\System\IwvBpGs.exe
  2⤵
  PID:15068
- C:\Windows\System\ozdqJth.exe
  C:\Windows\System\ozdqJth.exe
  2⤵
  PID:15000
- C:\Windows\System\xXlqgYo.exe
  C:\Windows\System\xXlqgYo.exe
  2⤵
  PID:15072
- C:\Windows\System\YGSZJMd.exe
  C:\Windows\System\YGSZJMd.exe
  2⤵
  PID:15208
- C:\Windows\System\oiubMmY.exe
  C:\Windows\System\oiubMmY.exe
  2⤵
  PID:15232
- C:\Windows\System\ZwMXKfU.exe
  C:\Windows\System\ZwMXKfU.exe
  2⤵
  PID:15248
- C:\Windows\System\hZXWoOu.exe
  C:\Windows\System\hZXWoOu.exe
  2⤵
  PID:15280
- C:\Windows\System\KVOTUWN.exe
  C:\Windows\System\KVOTUWN.exe
  2⤵
  PID:15320
- C:\Windows\System\AQhKBho.exe
  C:\Windows\System\AQhKBho.exe
  2⤵
  PID:14496
- C:\Windows\System\dcPrdMM.exe
  C:\Windows\System\dcPrdMM.exe
  2⤵
  PID:14360
- C:\Windows\System\GLnTgCZ.exe
  C:\Windows\System\GLnTgCZ.exe
  2⤵
  PID:14792
- C:\Windows\System\ITQganx.exe
  C:\Windows\System\ITQganx.exe
  2⤵
  PID:14516
- C:\Windows\System\YFOobkJ.exe
  C:\Windows\System\YFOobkJ.exe
  2⤵
  PID:14584
- C:\Windows\System\sPxXoXg.exe
  C:\Windows\System\sPxXoXg.exe
  2⤵
  PID:15368
- C:\Windows\System\zVZkXBE.exe
  C:\Windows\System\zVZkXBE.exe
  2⤵
  PID:15404
- C:\Windows\System\iVQrkgF.exe
  C:\Windows\System\iVQrkgF.exe
  2⤵
  PID:15436
- C:\Windows\System\nOocsye.exe
  C:\Windows\System\nOocsye.exe
  2⤵
  PID:15456
- C:\Windows\System\uFtaagl.exe
  C:\Windows\System\uFtaagl.exe
  2⤵
  PID:15488
- C:\Windows\System\BwLsYIN.exe
  C:\Windows\System\BwLsYIN.exe
  2⤵
  PID:15516
- C:\Windows\System\JNBtlfq.exe
  C:\Windows\System\JNBtlfq.exe
  2⤵
  PID:15544
- C:\Windows\System\dAZrBgB.exe
  C:\Windows\System\dAZrBgB.exe
  2⤵
  PID:15568
- C:\Windows\System\yZcznLh.exe
  C:\Windows\System\yZcznLh.exe
  2⤵
  PID:15596
- C:\Windows\System\uswcuJn.exe
  C:\Windows\System\uswcuJn.exe
  2⤵
  PID:15612
- C:\Windows\System\HaMeGXh.exe
  C:\Windows\System\HaMeGXh.exe
  2⤵
  PID:15644
- C:\Windows\System\sgjOUuS.exe
  C:\Windows\System\sgjOUuS.exe
  2⤵
  PID:15672
- C:\Windows\System\xolJJaF.exe
  C:\Windows\System\xolJJaF.exe
  2⤵
  PID:15692
- C:\Windows\System\doZDCNu.exe
  C:\Windows\System\doZDCNu.exe
  2⤵
  PID:15728
- C:\Windows\System\XvSNlFb.exe
  C:\Windows\System\XvSNlFb.exe
  2⤵
  PID:15756
- C:\Windows\System\GZQWgvS.exe
  C:\Windows\System\GZQWgvS.exe
  2⤵
  PID:15780
- C:\Windows\System\lfVJOrS.exe
  C:\Windows\System\lfVJOrS.exe
  2⤵
  PID:15808
- C:\Windows\System\pyywASM.exe
  C:\Windows\System\pyywASM.exe
  2⤵
  PID:15832
- C:\Windows\System\jsgRHxe.exe
  C:\Windows\System\jsgRHxe.exe
  2⤵
  PID:15856
- C:\Windows\System\qRcDAjX.exe
  C:\Windows\System\qRcDAjX.exe
  2⤵
  PID:15876
- C:\Windows\System\yQlhRdJ.exe
  C:\Windows\System\yQlhRdJ.exe
  2⤵
  PID:15900
- C:\Windows\System\MYhJskm.exe
  C:\Windows\System\MYhJskm.exe
  2⤵
  PID:15924
- C:\Windows\System\vXxmyHF.exe
  C:\Windows\System\vXxmyHF.exe
  2⤵
  PID:15964
- C:\Windows\System\gBuOCsr.exe
  C:\Windows\System\gBuOCsr.exe
  2⤵
  PID:15984
- C:\Windows\System\qSuSmGM.exe
  C:\Windows\System\qSuSmGM.exe
  2⤵
  PID:16008
- C:\Windows\System\PgbmOlL.exe
  C:\Windows\System\PgbmOlL.exe
  2⤵
  PID:16032
- C:\Windows\System\GqchIsv.exe
  C:\Windows\System\GqchIsv.exe
  2⤵
  PID:16056
- C:\Windows\System\wZLBcUj.exe
  C:\Windows\System\wZLBcUj.exe
  2⤵
  PID:16080
- C:\Windows\System\lNxLfiM.exe
  C:\Windows\System\lNxLfiM.exe
  2⤵
  PID:16108
- C:\Windows\System\TDCfICX.exe
  C:\Windows\System\TDCfICX.exe
  2⤵
  PID:16128
- C:\Windows\System\nxhvtJz.exe
  C:\Windows\System\nxhvtJz.exe
  2⤵
  PID:16160
- C:\Windows\System\UCMcgAb.exe
  C:\Windows\System\UCMcgAb.exe
  2⤵
  PID:16176
- C:\Windows\System\jrBssWF.exe
  C:\Windows\System\jrBssWF.exe
  2⤵
  PID:16192
- C:\Windows\System\YbFowKL.exe
  C:\Windows\System\YbFowKL.exe
  2⤵
  PID:16220
- C:\Windows\System\UpsGFhq.exe
  C:\Windows\System\UpsGFhq.exe
  2⤵
  PID:16260
- C:\Windows\System\ZKHXexs.exe
  C:\Windows\System\ZKHXexs.exe
  2⤵
  PID:16284
- C:\Windows\System\RllRHGj.exe
  C:\Windows\System\RllRHGj.exe
  2⤵
  PID:16304
- C:\Windows\System\QTZjGCA.exe
  C:\Windows\System\QTZjGCA.exe
  2⤵
  PID:16324
- C:\Windows\System\KITwwlM.exe
  C:\Windows\System\KITwwlM.exe
  2⤵
  PID:16344
- C:\Windows\System\vzubcov.exe
  C:\Windows\System\vzubcov.exe
  2⤵
  PID:16364
- C:\Windows\System\hYeCdbH.exe
  C:\Windows\System\hYeCdbH.exe
  2⤵
  PID:14856
- C:\Windows\System\cKwXtaL.exe
  C:\Windows\System\cKwXtaL.exe
  2⤵
  PID:14384
- C:\Windows\System\zTYwqkz.exe
  C:\Windows\System\zTYwqkz.exe
  2⤵
  PID:15448
- C:\Windows\System\pbkSIBB.exe
  C:\Windows\System\pbkSIBB.exe
  2⤵
  PID:13656
- C:\Windows\System\aqDwIVP.exe
  C:\Windows\System\aqDwIVP.exe
  2⤵
  PID:15380
- C:\Windows\System\jIsaMyZ.exe
  C:\Windows\System\jIsaMyZ.exe
  2⤵
  PID:14748
- C:\Windows\System\SuDPpjH.exe
  C:\Windows\System\SuDPpjH.exe
  2⤵
  PID:15472
- C:\Windows\System\bbiJzbr.exe
  C:\Windows\System\bbiJzbr.exe
  2⤵
  PID:15088
- C:\Windows\System\htTnrbU.exe
  C:\Windows\System\htTnrbU.exe
  2⤵
  PID:15668
- C:\Windows\System\VfNgUiI.exe
  C:\Windows\System\VfNgUiI.exe
  2⤵
  PID:15748
- C:\Windows\System\hDwMKAl.exe
  C:\Windows\System\hDwMKAl.exe
  2⤵
  PID:15604
- C:\Windows\System\OiXaIar.exe
  C:\Windows\System\OiXaIar.exe
  2⤵
  PID:15716
- C:\Windows\System\qXKsQqW.exe
  C:\Windows\System\qXKsQqW.exe
  2⤵
  PID:15944
- C:\Windows\System\JyrjMrX.exe
  C:\Windows\System\JyrjMrX.exe
  2⤵
  PID:15892
- C:\Windows\System\IFlCGVj.exe
  C:\Windows\System\IFlCGVj.exe
  2⤵
  PID:3008
- C:\Windows\System\aCzxSDQ.exe
  C:\Windows\System\aCzxSDQ.exe
  2⤵
  PID:16140
- C:\Windows\System\YDRDYUa.exe
  C:\Windows\System\YDRDYUa.exe
  2⤵
  PID:16068
- C:\Windows\System\fmJaSRy.exe
  C:\Windows\System\fmJaSRy.exe
  2⤵
  PID:16316
- C:\Windows\System\Mtyzabh.exe
  C:\Windows\System\Mtyzabh.exe
  2⤵
  PID:16000
- C:\Windows\System\qdJSorV.exe
  C:\Windows\System\qdJSorV.exe
  2⤵
  PID:16024
- C:\Windows\System\kQaIVfO.exe
  C:\Windows\System\kQaIVfO.exe
  2⤵
  PID:14980
- C:\Windows\System\bcZsxXb.exe
  C:\Windows\System\bcZsxXb.exe
  2⤵
  PID:15200
- C:\Windows\System\vwEgyif.exe
  C:\Windows\System\vwEgyif.exe
  2⤵
  PID:15444
- C:\Windows\System\NYyMbfb.exe
  C:\Windows\System\NYyMbfb.exe
  2⤵
  PID:16172
- C:\Windows\System\cIXZvEx.exe
  C:\Windows\System\cIXZvEx.exe
  2⤵
  PID:16240
- C:\Windows\System\FNQBJVQ.exe
  C:\Windows\System\FNQBJVQ.exe
  2⤵
  PID:15652
- C:\Windows\System\emHonua.exe
  C:\Windows\System\emHonua.exe
  2⤵
  PID:16044
- C:\Windows\System\JbkaUTd.exe
  C:\Windows\System\JbkaUTd.exe
  2⤵
  PID:4340
- C:\Windows\System\wNcuQCY.exe
  C:\Windows\System\wNcuQCY.exe
  2⤵
  PID:16020
- C:\Windows\System\BYEAAkD.exe
  C:\Windows\System\BYEAAkD.exe
  2⤵
  PID:16408
- C:\Windows\System\Djkvonl.exe
  C:\Windows\System\Djkvonl.exe
  2⤵
  PID:16428
- C:\Windows\System\JeGhQoS.exe
  C:\Windows\System\JeGhQoS.exe
  2⤵
  PID:16456
- C:\Windows\System\YxvasoV.exe
  C:\Windows\System\YxvasoV.exe
  2⤵
  PID:16492
- C:\Windows\System\HtLlImO.exe
  C:\Windows\System\HtLlImO.exe
  2⤵
  PID:16520
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16520 -s 252
    3⤵
    PID:16252
- C:\Windows\System\VqnVgbk.exe
  C:\Windows\System\VqnVgbk.exe
  2⤵
  PID:16544
- C:\Windows\System\BCGyrPr.exe
  C:\Windows\System\BCGyrPr.exe
  2⤵
  PID:16568
- C:\Windows\System\rZqBsEu.exe
  C:\Windows\System\rZqBsEu.exe
  2⤵
  PID:16608
- C:\Windows\System\ewEIgkk.exe
  C:\Windows\System\ewEIgkk.exe
  2⤵
  PID:16628
- C:\Windows\System\SKqZRdJ.exe
  C:\Windows\System\SKqZRdJ.exe
  2⤵
  PID:16656
- C:\Windows\System\eRbBBAP.exe
  C:\Windows\System\eRbBBAP.exe
  2⤵
  PID:16680
- C:\Windows\System\JZFPhRK.exe
  C:\Windows\System\JZFPhRK.exe
  2⤵
  PID:16712
- C:\Windows\System\SSzUKqH.exe
  C:\Windows\System\SSzUKqH.exe
  2⤵
  PID:16744
- C:\Windows\System\VUSMaUy.exe
  C:\Windows\System\VUSMaUy.exe
  2⤵
  PID:16776
- C:\Windows\System\rLpwqbk.exe
  C:\Windows\System\rLpwqbk.exe
  2⤵
  PID:16800
- C:\Windows\System\wJYwxbV.exe
  C:\Windows\System\wJYwxbV.exe
  2⤵
  PID:16824
- C:\Windows\System\xcPAySq.exe
  C:\Windows\System\xcPAySq.exe
  2⤵
  PID:16848
- C:\Windows\System\QovJDSB.exe
  C:\Windows\System\QovJDSB.exe
  2⤵
  PID:17200
- C:\Windows\System\HGCYQhQ.exe
  C:\Windows\System\HGCYQhQ.exe
  2⤵
  PID:17228
- C:\Windows\System\YvfRlYU.exe
  C:\Windows\System\YvfRlYU.exe
  2⤵
  PID:17248
- C:\Windows\System\lOwgwVj.exe
  C:\Windows\System\lOwgwVj.exe
  2⤵
  PID:17264
- C:\Windows\System\ngOzgsi.exe
  C:\Windows\System\ngOzgsi.exe
  2⤵
  PID:17280
- C:\Windows\System\JinAOAY.exe
  C:\Windows\System\JinAOAY.exe
  2⤵
  PID:17304
- C:\Windows\System\OVAVFPD.exe
  C:\Windows\System\OVAVFPD.exe
  2⤵
  PID:17328
- C:\Windows\System\zhDMdfe.exe
  C:\Windows\System\zhDMdfe.exe
  2⤵
  PID:17356
- C:\Windows\System\cpYGrwd.exe
  C:\Windows\System\cpYGrwd.exe
  2⤵
  PID:17384
- C:\Windows\System\LLizEkW.exe
  C:\Windows\System\LLizEkW.exe
  2⤵
  PID:15476
- C:\Windows\System\YnCxtsV.exe
  C:\Windows\System\YnCxtsV.exe
  2⤵
  PID:16292
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16292 -s 252
    3⤵
    PID:14424
- C:\Windows\System\WbYqkDQ.exe
  C:\Windows\System\WbYqkDQ.exe
  2⤵
  PID:16280
- C:\Windows\System\CChUtXa.exe
  C:\Windows\System\CChUtXa.exe
  2⤵
  PID:16704
- C:\Windows\System\GmBgYvp.exe
  C:\Windows\System\GmBgYvp.exe
  2⤵
  PID:16452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AAmoZvh.exe

Filesize
1.6MB

MD5
accd5be54254521369e4d71dd66bc9e3

SHA1
e5f376187fe9f4fd68bce0b56e9dbc2290f8a07b

SHA256
37bca7fada57941545d37603baccc84f2c8ae3cec1c2f4f804567cb614966dd1

SHA512
bd0a62dda2714441aff8cf2923a41d0a1f03b28dda254a8f67630fd9941044613daf2eed36bb7fd5617cc9b4c92c0e47bb31c3d38eda50acbf1de1a9b1617b2a

Download Submit
C:\Windows\System\BKtvzTZ.exe

Filesize
1.6MB

MD5
0fe0bd5682fe94a89a646a4228692ed6

SHA1
8f6db880b8927b1acbecaef082c0992557d80b33

SHA256
b9f5e7d3fe1b2ba8fc8be1c62c9ca0816c65f71d23e6b76796a86dcc358f19db

SHA512
4fbde3572ccd6d61c6e1e422edd63afafbd26d7e48a9451c7a5571d18db93d0e2977db49fbedc1152dc1d95014b5ceffb651d7435bd1a24fd925c64d1986e656

Download Submit
C:\Windows\System\CruXSGY.exe

Filesize
1.6MB

MD5
3c740adda7474d823df3e2ff3f9f5b82

SHA1
aba4e2ab823a9834ea062d6fb8893fd320752541

SHA256
1e7bcdda637d667c311fadf097d9dcc56313326813c792fa273c1e1150baff82

SHA512
c98260cc1b9056bf15bbe43c14761b4f33172ed8d888bc275f523d4752e85963def18e0fa1e60b505a11b9a34527dc6a5bfee977ba585e6f02e577850c4b005a

Download Submit
C:\Windows\System\EfmQJFO.exe

Filesize
1.6MB

MD5
1656679f6fb94a207ff0054c0444896a

SHA1
561cafb7dcd8b8d8ecb6618138e306d75ef9df50

SHA256
c15d33e790f998596baa44fe134b1ce19f349570c5395f6e5a4c4ab953eec80d

SHA512
04173f77a0cbe71082ebe3d2a8284ff6c0ec418ecc13b1a0d63c6acf78fcb8591ba4fa20cca8399795b62fec57db81c92605c00dd6819aaea2382b7fd2e52a50

Download Submit
C:\Windows\System\GyYFvqX.exe

Filesize
1.6MB

MD5
29a263413a9f2aad96487f43ff731f39

SHA1
504db21b3a1253a99d562362c302a4dba1d01717

SHA256
20be75b71cd6500a1e227544c5c6a1075d943bbea54bc68ee08a53f206fdec46

SHA512
b028c352bf072354e9bb1ecb836bea04fbbc3dc55744bec416463ce68443f8dbc8594e1765751053f6c056d3f378729865d775b426fa33a35165f1571ab0d6bb

Download Submit
C:\Windows\System\HQKWkTr.exe

Filesize
1.6MB

MD5
bbbeb5d1e85a6df03fb982f84d0ae68e

SHA1
52a31007557a283ebb0ddb93d06b78a680c9d26a

SHA256
03d63f1b490d1b728d426885d279114665cf32fe2cb28d3d28050ece2e844179

SHA512
afe43cd6daf4a78dbfa6dde02aa3774e5b6b46b891af4bf51341062dae931a07fc3865033ef12277f33c2c33f9b238348cea9bd74cb9e940d9fbc0ffa2c5739d

Download Submit
C:\Windows\System\HnLgnOp.exe

Filesize
1.6MB

MD5
88c1e78d9904f53ee3fb358de8968355

SHA1
945aa57aa95db16c068584366f027bd26a99ab12

SHA256
82cf4a40bc33c031d8b252ffae086f98f2aa1b431d95bfb962cb7f0d9c100288

SHA512
adec0e0be1ed697f207bed53d047d0a8a221f4f944fc36cf41cc0a0d79f15012f605b286251a6ab6d195a422a17bd794e757bea8b318b4cc085a79cd7be1b2e9

Download Submit
C:\Windows\System\LTBECHj.exe

Filesize
1.6MB

MD5
34c98cbf5b75b7f79406f0a75e6e9677

SHA1
574cb522ae4abc27695c834d63a80ab5c9ca7105

SHA256
6f1fdeb6a7718a411adf2dd77e4433489718f40f2246c392723521c31108fae9

SHA512
4a9018170e88486fce5bf7290106a7d5550edc26044185cda02549c30f8addcf72a16faae2b5d57c2ce3ff1629e5bdf5960f58bb9689f4f42bf2526531dd31e6

Download Submit
C:\Windows\System\Mngwjfs.exe

Filesize
1.6MB

MD5
9840f45d7f7c25acbad6986b9c8408e2

SHA1
daaee3acc0f53934ec5bcb582980b0579da0497f

SHA256
1cf573d9dba3f31922fbb5b9f86e37df6f818e7624ea3522d65b161d5d7fdb2f

SHA512
14f0fc650ab4cfbcf6079b1ca9013c4499373af0a899f1ec41f47b05c21f70b65587b7e5069c8fe3ca7bedb642dcf27255bad5be6a8c0d6fff5e712275394110

Download Submit
C:\Windows\System\NrQsKDW.exe

Filesize
1.6MB

MD5
c98ee159e46dbe3498b55ce54385568f

SHA1
d781f734983f9a9db181360e00594b460dbbb936

SHA256
c422f67f88dd1fb889949275602cfaf8812cd5380d057225276fd11d1329c6fe

SHA512
547a8a888dc8610157cc0b745c51f3b1fa682874ae696fcaf74229594bb169351bbc149f561d70e15d074332bbf77b5389d641a4d1933d3e737f351edf83a5aa

Download Submit
C:\Windows\System\OqBJKAJ.exe

Filesize
1.6MB

MD5
122fcef495860f5394a6463ea0cbda6a

SHA1
5429a5ba6ad2720fe6b8e08b65fa44dcb5203e16

SHA256
d98d1eb1157841414ba6552faf7e4a1c04d19ac1c2e935077697136aede53997

SHA512
28ba2852bef66e42708c1eb896bc71bf756268701c32cdd43edd968f2b3d241d1ebfe00508167a4b620706065cdada10e5d2947c82a5f4d035c09e93625b05e0

Download Submit
C:\Windows\System\RdjTEDo.exe

Filesize
1.6MB

MD5
416627289799903297c84618b3ba163e

SHA1
0a7dd3ac6acd798aab5155295dada7140c233994

SHA256
fe16bea2a6e95fd284b374da8172bfd03ad2fd2e13e6c21311eb2f4d76118893

SHA512
6a31fb74892064ae178643e475fb2f8cb7727725ee3949edc5eca38410ec60a5de54921350ab5cf815d6c0f0d8558e77e732bb620afd2e44ad1b4a947cf04b95

Download Submit
C:\Windows\System\UiTmeYe.exe

Filesize
1.6MB

MD5
66a82857cf65da47dc0cd4f66db261f4

SHA1
2843173ed9a7a4b71808b3f2cdd18f857950a371

SHA256
93cec6f3b2cecfc897a4d91eb8443e027ad7113dd7ff1d2a5a17f39be3fa8a4f

SHA512
7a6f17b75e3b253e81b67ed6dd8483655ee9ece51656eed0ac8ed69c56d278329f76e5f391fd178cdd09fc7fc31e2c264fd9f4a0b1b0ebb3f2bf9979428e1e80

Download Submit
C:\Windows\System\VbxuTpW.exe

Filesize
1.6MB

MD5
921b3b79fd2aafffddac0213ada331dd

SHA1
e46143c13bc77467365c9cfe37cf5e80a1768131

SHA256
5408520963552c60999265d64368dccfd0f8803f2be985bca638b13bb2071af5

SHA512
3e430f4ecdb1060a6c302021e02682fed05593df49cc7b43c431949509be63d560f8e2eb38d9e67c8340fa6c1e7ad4c9692c67bf13665028fd933f9b26dc5c72

Download Submit
C:\Windows\System\WfXjrhl.exe

Filesize
1.6MB

MD5
1b133b354197b460ad96ead667d8dbdf

SHA1
016486519ad89c4fef4a8ea8d5d993aa86885c19

SHA256
dbedefbb768c2ab1dc218f26921462a4dbbc10308e9373375f3ec1a167d8a571

SHA512
b0608f1b4db102948685421a68a21eaeffbf12bbb2a4dc173f6406861056857fe996411b4a20f9915689568365ce39f34a49c97b92e5180b632a5ee37b209b57

Download Submit
C:\Windows\System\WrNyUcX.exe

Filesize
1.6MB

MD5
192a9c4c20df9e3064895b02c793e5d3

SHA1
107be41a5a9159524f314eff220c46809373ea1f

SHA256
263def1c85820721091289be788042b0ba094746001f578a1bd495acd24f9633

SHA512
abcfcc09401ed3885797709e52957829d39d8e94233d16deabfbe90c4cefba75acccc34d6c99651adecf04d0692a2132ba9c54996f75c79320ea922998f46596

Download Submit
C:\Windows\System\WsvwXWu.exe

Filesize
1.6MB

MD5
3d60aa4ed32b32fbc6d157144794df2f

SHA1
d2de36feefd2d8bcd063553a27f9e86c61e72af8

SHA256
79aab48c024ba325766da0c6789d2480f2547c0167688feacd693f63019526fb

SHA512
27f669f161099dc246a6805674cf98e460f05985e2f1b1ee4b3823d78b5fdeacd7ebf9d392296b57559df228f9ee107391252d63b9e3274974d0d3c020d7e9f0

Download Submit
C:\Windows\System\YASljJM.exe

Filesize
1.6MB

MD5
419269d51cdfb784c6ec1ba87998caaf

SHA1
16831e0d02807abf0d3be5e3d3d47aee724500a2

SHA256
6ff1400bf6bceb9a8cec7e533fdfab28aa051e589461d1fd344b2b67211254cd

SHA512
3786fe60e19b0c3d395d384527bfe05c58752c8fa58d96db1a885dd7cf26749c8f9ac6d469e30701318a76ef161457a068db999e66900a54bc7d93a0b7b6d56c

Download Submit
C:\Windows\System\YphWXic.exe

Filesize
1.6MB

MD5
6a24ae47b2bc6115a10cbd4385be63b2

SHA1
8bce072cdd5960ca135954cac91a6dad3cd32ae3

SHA256
191243581803b3940f70d19678219b536048b680b4a672175186ed8a4cd09170

SHA512
ed76457ad0b362696d2049c1bb91bdf9d10fb44d1c1134a62a51b5f4b3c77cf5e574156972bba56b6f5b576b1c6229e9af78f14e7e4c3c12bd8dc519d9c462b0

Download Submit
C:\Windows\System\buyswgK.exe

Filesize
1.6MB

MD5
e9af206fe4d7b5dbb9aa940543849887

SHA1
ba10f4292d9f69dd54cb3e62a0a30984ea53ffd8

SHA256
c4a4c7df36c02fb73d9c4a43a534f06722f1e02afd35c24ac4c304eb21b60faa

SHA512
892bba98260e35bbb8defc4b28e3c2b1475aabf9a37cf0058af0f17cafee6f764243f4a9cfda8d1b2ae254ad3e1b0d3be84f517c7c36620473d5ecdcb4a64cf5

Download Submit
C:\Windows\System\fshUZpt.exe

Filesize
1.6MB

MD5
a1cf069cbe0f2e65c471aaf198750a8c

SHA1
0e4b05a1eb46c38367a7380b78023558de75e57a

SHA256
6f00a2faad2f4315a6ddb7236964d4835b84dccc354d5a8b18001987987ee0c1

SHA512
58d5dd6a5e7081ce9108d7430ac89913fbc7287869f4e25dd3e644ab5ccd378405b23b0eeb48823669e8faf513401df9389388f4d84baa7d3e5849302a2e40aa

Download Submit
C:\Windows\System\gQkgGdx.exe

Filesize
1.6MB

MD5
d6549a9837686f7f2d63258d43a733c1

SHA1
f5fa6577b7df922944a5a908adf35e961c69c10b

SHA256
a7affd78a53c7036ccceaa50d77078c1b7a3c8839b14fc08b41a7a4a03e52e4e

SHA512
503dcecd24ab6e3ed9c0a7cf269f5e57fde7d58f74bcaf8c11d6b5b6e320de208cc3e8a2dcf401ece630fcb6edb9a0db8f34317cb3da1824d6aec192601201c2

Download Submit
C:\Windows\System\garWIKF.exe

Filesize
1.6MB

MD5
aed4d84a07d396745e7f130fd2b395c9

SHA1
0920cc500d1139b46adbaaaa100c02c00b10b75d

SHA256
bd4a584baf4984a1f3cc29a43cf9b096c6bf8c851dd37e18adccb000528ae0a5

SHA512
4f4ccf026f089b8f04abec88ea6043147b983149942a92f00731b235c3c6367b5e6d5cd541af77a949041231d0a55e46007b23377f8c46cf59dad24cd10802b7

Download Submit
C:\Windows\System\kIpaFlG.exe

Filesize
1.6MB

MD5
a9ceed991a14991e0b918b9ffde81626

SHA1
f6fb01e4019fe398f4cafb350f8ea4a3b27835eb

SHA256
b45f766cf6f14d03cfefe9bf4ec9992db312d6810795bec926ce0c4df5dc50ec

SHA512
793d9ff75fa1bdd257490ee323338c121a31feb9033a61ea27f8c3d419fe76c96a9864cc9b18cc27452ca56fd671e2366d34e4ba1661fce1b64e2bff4b8eb33d

Download Submit
C:\Windows\System\lEpNwug.exe

Filesize
1.6MB

MD5
de42ab545b7b8c9be9853ce8135763c4

SHA1
274c3e3f701d2f4e761997c14edc3ae85291115a

SHA256
0bdbfeca20e4da9f4dfdad35acd007ef8783edb48677678fde83b05001385b88

SHA512
6ce738ccebda11c2b552da000fa8428adaf2018542712e243acc9c8fc78009a2cf5af52788623d951cf628e901a1b8f73d30ae06081326d435070eb29701a70c

Download Submit
C:\Windows\System\nBlRoZY.exe

Filesize
1.6MB

MD5
5177364acb6c4776a5db341ef7c5e739

SHA1
bc004ce20e67e5adf2f0857b78852704f3d4a0ef

SHA256
503f75c4327f85d5dd67c134e4ae957feacf607775a5334df4b03e4260897fe4

SHA512
268a8c9d81abc791c3da5a6a42a3d5cd213e7999b38f53c69ecd4bcafe97a913c4bb733b9d65e62d286f146a3f7527e692c4f8183d03fe3498cee44edcb3b7f0

Download Submit
C:\Windows\System\qfONxPS.exe

Filesize
1.6MB

MD5
a18e771c995a2d721f5ddad386dbecc7

SHA1
80854cca83cb819d5ca10364af7984cccbf1456b

SHA256
394113cd61df97de380fa3e315b36c97af0a466549cb6eebdfa08aa995ada616

SHA512
20c639fbfcc71cc9e0835f84249c07b7f8f1509270c15d5ae55d5077e2fa37cbad16d8304917acd3fa7e2e8d77010641ecb1a168259d1f0b133d697539f6a954

Download Submit
C:\Windows\System\seFPknZ.exe

Filesize
1.6MB

MD5
dd498bfbaba33eaf75bb29dcdd8b17cf

SHA1
3c3d0d5f742cd1a2a740917212d410c3241d437d

SHA256
f4c5618a8eb4ef91b173488eeeb9bc86726e63d5debfdb93a4f2489c5fbe2807

SHA512
1dc011d5b5416c083d3eff0c96cb4897b3484fe7366efbcc8138571c935e40307efca9ee951f7026f3a3eba473674287678fefba38b511383c63adf98870f1ef

Download Submit
C:\Windows\System\tiTarPM.exe

Filesize
1.6MB

MD5
fdf0645dd5ab587bae4e44fb0bc09ec7

SHA1
bc175e5ee9c22991c3163d563fd2f8d59aea700f

SHA256
e80067e7d6cffa1a7b0d68b30e1e2987b5ce942685df70c35d5f581d849b7caf

SHA512
0fabc6b20cd5387a9b27cfa473be293d9f13394ef17053ebf598a7667f8964b43b92b49709dd427d72261f92efbf0258f7ff136c5df2177d984aa9c52509f475

Download Submit
C:\Windows\System\tvSeBhk.exe

Filesize
1.6MB

MD5
486463dbf80989b0d1136d8009cd7145

SHA1
4ffec614b0a70a1d92266c0118856c1d870b3a1f

SHA256
1b38f4f7623be5e1c778029eb00c85fea6a9089bbc99f7e9bbb4806a2234e71c

SHA512
f800619cd34981495fdd8b9a9acbc265ec1d76fc6866fc68713b613c988b0f621f6822a2842a6659b35fe3d2371a0c846710f2a2925b49778d74d51c40a6cf37

Download Submit
C:\Windows\System\tyfBkfQ.exe

Filesize
1.6MB

MD5
ef32541056fec872103465581c5576e7

SHA1
f29328ea5bbdc252bf216141e97eb5a51cf8899e

SHA256
808c5da46adfd58d4d2752490c579d5b84fa5dddbf2b69b3d71f52b3c535b53f

SHA512
4d996c2cd2a20c23db26affe4f6a17329a4dd6e4d9f7de2620c800edb71645226ec3a0c6a6bfbe096ec49ffb0332efc299c49ba18d1ee831172963a1ebd08fc8

Download Submit
C:\Windows\System\wnEFDIO.exe

Filesize
1.6MB

MD5
0ad67eec63087a1a42f758f52c3af480

SHA1
b288691f67030880a10d147003537699453bb016

SHA256
8f181a62e0372f5a1a18ee746401012330542f57bed31922d2f07c0f05b6b176

SHA512
abbd8e549eb0b03f24b282203b93bb4e5777c1243e5d928eec0910c6f9e1ef7405e3b39800a19270748930e02be6515c5255af3c9b11e3b274bc7038679aa8f5

Download Submit
C:\Windows\System\yblFSzr.exe

Filesize
1.6MB

MD5
d381be811a84b0d83f20c43397f139a2

SHA1
d66f03eb981c2dd10150838bd784d110ddb26bed

SHA256
eae6a2d0425604045e0ba08fa2291796fb16ecbeee0c42b5b2e7009ded929713

SHA512
31ef6b26b3dd8f1c579adf93a3017ef88d844f1bc3c7c0659611be9525916b5e928a2901e96aadb6c7a9063b8f92f9540339d0365b4bb4ae2cb786f793639daa

Download Submit
C:\Windows\System\zdIevox.exe

Filesize
1.6MB

MD5
93e638f4bbe92384003ef89970499e9a

SHA1
197c302e7d8383ef8ae09f400a95e1515f7b1443

SHA256
360ed24729258fcee643ddd677f1fbb943d44e3ce1bbde9284fc7037609ff2fc

SHA512
08fa8e4e6bd20b42baee0b04ddcfe900c49b1b07187cd895a94ad97fbfd6cb6bb95f308c0397ad18aaad07a507d9963d40c99e53a85427299c4728baf262719f

Download Submit
C:\Windows\System\zgKjHuo.exe

Filesize
1.6MB

MD5
efd7d6b0e559701b9a3af8431d7f31d0

SHA1
5c1327e1154ca3ebcbb9a1f41d5c6445dd15bc3f

SHA256
00428b23de9527ce68d6a99eb4482fef323d475e4d001243768f1e68a2805858

SHA512
cb061e6f7db307fc888ccec436bffba9ed066ae02ec0b0f89854963e0503ae29fb4c3d79aabae86fb495ec7ae38088107ba99ba911cdb745091555b3d7fe2d11

Download Submit
memory/2824-0-0x000001ED51FF0000-0x000001ED52000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads