xmrig | 3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044

Analysis

max time kernel
94s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
Size

1.1MB
MD5

14e10697b41493e0a4d6a4360f623f25
SHA1

24eeba229e0d14460815388f528297270df50f71
SHA256

3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044
SHA512

79f0b6e1f4fc1a6ab7d723d5dfb668f9853009b9c16f9d773f92dc95e282903f46991c3acdd5b8d0f77f046d36024bb7331da0c9a89dfc23bef17ace5d1dd5db
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensz8Zs0YrTuClzItjT:GezaTF8FcNkNdfE0pZ9ozttwIRbfsv

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c0f-4.dat	xmrig
behavioral2/files/0x0007000000023cb4-7.dat	xmrig
behavioral2/files/0x0007000000023cb6-23.dat	xmrig
behavioral2/files/0x0007000000023cb5-20.dat	xmrig
behavioral2/files/0x0008000000023cb0-16.dat	xmrig
behavioral2/files/0x0007000000023cb7-29.dat	xmrig
behavioral2/files/0x0007000000023cb8-32.dat	xmrig
behavioral2/files/0x0007000000023cb9-38.dat	xmrig
behavioral2/files/0x0007000000023cbb-47.dat	xmrig
behavioral2/files/0x0007000000023cba-52.dat	xmrig
behavioral2/files/0x0007000000023cbc-48.dat	xmrig
behavioral2/files/0x0007000000023cbf-70.dat	xmrig
behavioral2/files/0x0007000000023cc0-77.dat	xmrig
behavioral2/files/0x0007000000023cc3-90.dat	xmrig
behavioral2/files/0x0007000000023cc5-101.dat	xmrig
behavioral2/files/0x0007000000023cc8-112.dat	xmrig
behavioral2/files/0x0007000000023cc7-127.dat	xmrig
behavioral2/files/0x0007000000023cd0-155.dat	xmrig
behavioral2/files/0x0007000000023ccf-153.dat	xmrig
behavioral2/files/0x0007000000023cce-151.dat	xmrig
behavioral2/files/0x0007000000023ccb-149.dat	xmrig
behavioral2/files/0x0007000000023ccd-147.dat	xmrig
behavioral2/files/0x0007000000023ccc-145.dat	xmrig
behavioral2/files/0x0007000000023cc9-143.dat	xmrig
behavioral2/files/0x0007000000023cca-140.dat	xmrig
behavioral2/files/0x0007000000023cd1-159.dat	xmrig
behavioral2/files/0x0007000000023cd2-162.dat	xmrig
behavioral2/files/0x0007000000023cc6-121.dat	xmrig
behavioral2/files/0x0007000000023cc4-95.dat	xmrig
behavioral2/files/0x0007000000023cc2-88.dat	xmrig
behavioral2/files/0x0007000000023cc1-86.dat	xmrig
behavioral2/files/0x0007000000023cbe-72.dat	xmrig
behavioral2/files/0x0007000000023cbd-68.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4152	ZZFKAMI.exe
4752	JdmhexN.exe
4944	dmLSUCB.exe
812	aqxRPmp.exe
5016	DtRTTJA.exe
2740	iTkhtMh.exe
4476	ruqMJRm.exe
1968	lpSmPQL.exe
4544	iUOnDnR.exe
1460	qeaWPny.exe
3492	qZObenN.exe
3412	hGHxSoV.exe
1908	PLCBGOq.exe
3144	RFAbaxs.exe
232	hfgYFLM.exe
4980	OLwfKkO.exe
1312	Zipohtv.exe
3236	lidMQvu.exe
1528	cmtOAqW.exe
3528	ZOZQEKO.exe
1748	DvHgbnb.exe
4992	PaqhunA.exe
3284	FNKelNx.exe
4828	DClZODR.exe
1176	RADaDis.exe
2788	MNbWNoZ.exe
3180	VZpLpPV.exe
2648	xeMPGBr.exe
2472	cHLTZxr.exe
1076	qOldEgy.exe
3044	Ussppcx.exe
4480	YxgvgGC.exe
3200	fKsbfhR.exe
212	ZXNFQfH.exe
1688	SgcZAwS.exe
516	pcnSVRg.exe
2884	tBXQWjI.exe
1852	NOFESPm.exe
2592	PdgCXeN.exe
1616	rSLVIPY.exe
1612	CntcAcn.exe
3484	HoehJeA.exe
4704	jiEiplD.exe
3168	NiJpjoI.exe
1796	rdRLDGK.exe
528	Tlacrin.exe
2276	oubIqiR.exe
4508	SMnkjkg.exe
4136	zYGcdmy.exe
440	aVpBtfU.exe
1484	aNMmYid.exe
468	ddndAvf.exe
2204	BTtrkps.exe
4620	ixtCQrD.exe
4316	GjXZARd.exe
3256	iwmddQW.exe
544	iAluCIJ.exe
4892	kcqCQQi.exe
4032	hQiXVOm.exe
2812	KqyYHJX.exe
2504	CxmWlBM.exe
1408	mHLurkp.exe
2196	IJUZvWQ.exe
3644	qmcutFK.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IyCOMuT.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\QSbbpjD.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\xgouWVx.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\vEuMPoJ.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\mDxdPPy.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\gPavHYe.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\qkcogSC.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\hjLlMeh.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\kmoApDR.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\JXiUCUs.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\WmsObTn.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\cYtfnRy.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\zicAWdF.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\vGvLujf.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\FYrDHxj.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\qOldEgy.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\xJHrabC.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\gsSVNwl.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\YNiVIdT.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\KqyYHJX.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\AwmEYVI.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\UcfpRbe.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\ZPlYBOf.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\EAxjcOO.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\pmQGHXr.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\PujlmNU.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\rAREQkY.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\hWoetoj.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\hwyZobs.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\SqBAPMr.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\cVOaXLx.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\jHeGHiY.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\DtRTTJA.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\NAJNpRj.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\QbVTDdd.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\VTiqcqD.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\aIbNwUF.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\VGnpvlb.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\VKGxmWy.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\rrDCnax.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\HAiBRdr.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\wTMlliT.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\YxgvgGC.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\trQvhXf.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\WdrvinO.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\LlkwGSr.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\kizCtbc.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\HIbSiOb.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\QCVEZMg.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\hcfFRDd.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\UNGXPbx.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\aABEVtP.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\YXFWvzi.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\AvOLOBo.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\XkjEcLS.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\sVPSTQU.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\FJhrijR.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\TplvTBC.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\WJGsfWU.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\UQJiOUb.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\fOQgHPc.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\SjVDllt.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\IMozlHD.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
File created	C:\Windows\System\WoqnmlE.exe	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 4152	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	83
PID 884 wrote to memory of 4152	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	83
PID 884 wrote to memory of 4752	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	84
PID 884 wrote to memory of 4752	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	84
PID 884 wrote to memory of 4944	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	85
PID 884 wrote to memory of 4944	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	85
PID 884 wrote to memory of 812	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	86
PID 884 wrote to memory of 812	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	86
PID 884 wrote to memory of 5016	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	87
PID 884 wrote to memory of 5016	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	87
PID 884 wrote to memory of 2740	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	88
PID 884 wrote to memory of 2740	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	88
PID 884 wrote to memory of 4476	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	89
PID 884 wrote to memory of 4476	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	89
PID 884 wrote to memory of 1968	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	90
PID 884 wrote to memory of 1968	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	90
PID 884 wrote to memory of 4544	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	91
PID 884 wrote to memory of 4544	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	91
PID 884 wrote to memory of 1460	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	92
PID 884 wrote to memory of 1460	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	92
PID 884 wrote to memory of 3492	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	93
PID 884 wrote to memory of 3492	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	93
PID 884 wrote to memory of 3412	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	94
PID 884 wrote to memory of 3412	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	94
PID 884 wrote to memory of 3144	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	95
PID 884 wrote to memory of 3144	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	95
PID 884 wrote to memory of 1908	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	96
PID 884 wrote to memory of 1908	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	96
PID 884 wrote to memory of 232	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	97
PID 884 wrote to memory of 232	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	97
PID 884 wrote to memory of 4980	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	98
PID 884 wrote to memory of 4980	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	98
PID 884 wrote to memory of 1312	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	99
PID 884 wrote to memory of 1312	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	99
PID 884 wrote to memory of 3236	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	100
PID 884 wrote to memory of 3236	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	100
PID 884 wrote to memory of 1528	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	101
PID 884 wrote to memory of 1528	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	101
PID 884 wrote to memory of 3528	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	102
PID 884 wrote to memory of 3528	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	102
PID 884 wrote to memory of 1748	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	103
PID 884 wrote to memory of 1748	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	103
PID 884 wrote to memory of 4992	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	104
PID 884 wrote to memory of 4992	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	104
PID 884 wrote to memory of 3284	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	105
PID 884 wrote to memory of 3284	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	105
PID 884 wrote to memory of 4828	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	106
PID 884 wrote to memory of 4828	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	106
PID 884 wrote to memory of 1176	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	107
PID 884 wrote to memory of 1176	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	107
PID 884 wrote to memory of 2788	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	108
PID 884 wrote to memory of 2788	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	108
PID 884 wrote to memory of 3180	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	109
PID 884 wrote to memory of 3180	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	109
PID 884 wrote to memory of 2648	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	110
PID 884 wrote to memory of 2648	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	110
PID 884 wrote to memory of 2472	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	111
PID 884 wrote to memory of 2472	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	111
PID 884 wrote to memory of 1076	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	112
PID 884 wrote to memory of 1076	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	112
PID 884 wrote to memory of 3044	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	113
PID 884 wrote to memory of 3044	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	113
PID 884 wrote to memory of 4480	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	114
PID 884 wrote to memory of 4480	884	3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe	114

C:\Users\Admin\AppData\Local\Temp\3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe
"C:\Users\Admin\AppData\Local\Temp\3a31d5584dbcc475c40a9ef80ac4a5262495d34bf2ce1fb7e5aaf4181b01c044.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\System\ZZFKAMI.exe
  C:\Windows\System\ZZFKAMI.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\JdmhexN.exe
  C:\Windows\System\JdmhexN.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\dmLSUCB.exe
  C:\Windows\System\dmLSUCB.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\aqxRPmp.exe
  C:\Windows\System\aqxRPmp.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\DtRTTJA.exe
  C:\Windows\System\DtRTTJA.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\iTkhtMh.exe
  C:\Windows\System\iTkhtMh.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ruqMJRm.exe
  C:\Windows\System\ruqMJRm.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\lpSmPQL.exe
  C:\Windows\System\lpSmPQL.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\iUOnDnR.exe
  C:\Windows\System\iUOnDnR.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\qeaWPny.exe
  C:\Windows\System\qeaWPny.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\qZObenN.exe
  C:\Windows\System\qZObenN.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\hGHxSoV.exe
  C:\Windows\System\hGHxSoV.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\RFAbaxs.exe
  C:\Windows\System\RFAbaxs.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\PLCBGOq.exe
  C:\Windows\System\PLCBGOq.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\hfgYFLM.exe
  C:\Windows\System\hfgYFLM.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\OLwfKkO.exe
  C:\Windows\System\OLwfKkO.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\Zipohtv.exe
  C:\Windows\System\Zipohtv.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\lidMQvu.exe
  C:\Windows\System\lidMQvu.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\cmtOAqW.exe
  C:\Windows\System\cmtOAqW.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\ZOZQEKO.exe
  C:\Windows\System\ZOZQEKO.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\DvHgbnb.exe
  C:\Windows\System\DvHgbnb.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\PaqhunA.exe
  C:\Windows\System\PaqhunA.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\FNKelNx.exe
  C:\Windows\System\FNKelNx.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\DClZODR.exe
  C:\Windows\System\DClZODR.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\RADaDis.exe
  C:\Windows\System\RADaDis.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\MNbWNoZ.exe
  C:\Windows\System\MNbWNoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\VZpLpPV.exe
  C:\Windows\System\VZpLpPV.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\xeMPGBr.exe
  C:\Windows\System\xeMPGBr.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\cHLTZxr.exe
  C:\Windows\System\cHLTZxr.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\qOldEgy.exe
  C:\Windows\System\qOldEgy.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\Ussppcx.exe
  C:\Windows\System\Ussppcx.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\YxgvgGC.exe
  C:\Windows\System\YxgvgGC.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\fKsbfhR.exe
  C:\Windows\System\fKsbfhR.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\ZXNFQfH.exe
  C:\Windows\System\ZXNFQfH.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\SgcZAwS.exe
  C:\Windows\System\SgcZAwS.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\pcnSVRg.exe
  C:\Windows\System\pcnSVRg.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\tBXQWjI.exe
  C:\Windows\System\tBXQWjI.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\NOFESPm.exe
  C:\Windows\System\NOFESPm.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\PdgCXeN.exe
  C:\Windows\System\PdgCXeN.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\rSLVIPY.exe
  C:\Windows\System\rSLVIPY.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\CntcAcn.exe
  C:\Windows\System\CntcAcn.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\HoehJeA.exe
  C:\Windows\System\HoehJeA.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\jiEiplD.exe
  C:\Windows\System\jiEiplD.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\rdRLDGK.exe
  C:\Windows\System\rdRLDGK.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\NiJpjoI.exe
  C:\Windows\System\NiJpjoI.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\Tlacrin.exe
  C:\Windows\System\Tlacrin.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\oubIqiR.exe
  C:\Windows\System\oubIqiR.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\SMnkjkg.exe
  C:\Windows\System\SMnkjkg.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\zYGcdmy.exe
  C:\Windows\System\zYGcdmy.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\aVpBtfU.exe
  C:\Windows\System\aVpBtfU.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\aNMmYid.exe
  C:\Windows\System\aNMmYid.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\ddndAvf.exe
  C:\Windows\System\ddndAvf.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\BTtrkps.exe
  C:\Windows\System\BTtrkps.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ixtCQrD.exe
  C:\Windows\System\ixtCQrD.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\GjXZARd.exe
  C:\Windows\System\GjXZARd.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\iwmddQW.exe
  C:\Windows\System\iwmddQW.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\iAluCIJ.exe
  C:\Windows\System\iAluCIJ.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\kcqCQQi.exe
  C:\Windows\System\kcqCQQi.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\hQiXVOm.exe
  C:\Windows\System\hQiXVOm.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\KqyYHJX.exe
  C:\Windows\System\KqyYHJX.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\CxmWlBM.exe
  C:\Windows\System\CxmWlBM.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\mHLurkp.exe
  C:\Windows\System\mHLurkp.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\nnVPkQQ.exe
  C:\Windows\System\nnVPkQQ.exe
  2⤵
  PID:4676
- C:\Windows\System\IJUZvWQ.exe
  C:\Windows\System\IJUZvWQ.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\qmcutFK.exe
  C:\Windows\System\qmcutFK.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\AkMwXJC.exe
  C:\Windows\System\AkMwXJC.exe
  2⤵
  PID:2388
- C:\Windows\System\xgouWVx.exe
  C:\Windows\System\xgouWVx.exe
  2⤵
  PID:4128
- C:\Windows\System\UcfpRbe.exe
  C:\Windows\System\UcfpRbe.exe
  2⤵
  PID:3668
- C:\Windows\System\YIQOakZ.exe
  C:\Windows\System\YIQOakZ.exe
  2⤵
  PID:2456
- C:\Windows\System\RrAQSRS.exe
  C:\Windows\System\RrAQSRS.exe
  2⤵
  PID:4244
- C:\Windows\System\bRKZvVu.exe
  C:\Windows\System\bRKZvVu.exe
  2⤵
  PID:4192
- C:\Windows\System\qIpoIBI.exe
  C:\Windows\System\qIpoIBI.exe
  2⤵
  PID:4084
- C:\Windows\System\zKVDotR.exe
  C:\Windows\System\zKVDotR.exe
  2⤵
  PID:2960
- C:\Windows\System\QVGMNBR.exe
  C:\Windows\System\QVGMNBR.exe
  2⤵
  PID:4928
- C:\Windows\System\SpgiFBV.exe
  C:\Windows\System\SpgiFBV.exe
  2⤵
  PID:2316
- C:\Windows\System\NyLTrDI.exe
  C:\Windows\System\NyLTrDI.exe
  2⤵
  PID:5112
- C:\Windows\System\oufpJeJ.exe
  C:\Windows\System\oufpJeJ.exe
  2⤵
  PID:3596
- C:\Windows\System\cGLCBKJ.exe
  C:\Windows\System\cGLCBKJ.exe
  2⤵
  PID:2284
- C:\Windows\System\hENbQZH.exe
  C:\Windows\System\hENbQZH.exe
  2⤵
  PID:3708
- C:\Windows\System\VyGDmdd.exe
  C:\Windows\System\VyGDmdd.exe
  2⤵
  PID:752
- C:\Windows\System\obeXGlV.exe
  C:\Windows\System\obeXGlV.exe
  2⤵
  PID:4536
- C:\Windows\System\rhLvYkm.exe
  C:\Windows\System\rhLvYkm.exe
  2⤵
  PID:3660
- C:\Windows\System\qqAOHAL.exe
  C:\Windows\System\qqAOHAL.exe
  2⤵
  PID:1500
- C:\Windows\System\LBHRUFh.exe
  C:\Windows\System\LBHRUFh.exe
  2⤵
  PID:2480
- C:\Windows\System\nuRFQmj.exe
  C:\Windows\System\nuRFQmj.exe
  2⤵
  PID:1240
- C:\Windows\System\QpXmifP.exe
  C:\Windows\System\QpXmifP.exe
  2⤵
  PID:4020
- C:\Windows\System\EAxjcOO.exe
  C:\Windows\System\EAxjcOO.exe
  2⤵
  PID:1192
- C:\Windows\System\sVvCaUc.exe
  C:\Windows\System\sVvCaUc.exe
  2⤵
  PID:2184
- C:\Windows\System\LaLOgMx.exe
  C:\Windows\System\LaLOgMx.exe
  2⤵
  PID:1744
- C:\Windows\System\fOQgHPc.exe
  C:\Windows\System\fOQgHPc.exe
  2⤵
  PID:4352
- C:\Windows\System\hPASgGF.exe
  C:\Windows\System\hPASgGF.exe
  2⤵
  PID:4948
- C:\Windows\System\smfZANL.exe
  C:\Windows\System\smfZANL.exe
  2⤵
  PID:3904
- C:\Windows\System\EAyMHnQ.exe
  C:\Windows\System\EAyMHnQ.exe
  2⤵
  PID:1632
- C:\Windows\System\FeRGYyq.exe
  C:\Windows\System\FeRGYyq.exe
  2⤵
  PID:3404
- C:\Windows\System\ylvHRvZ.exe
  C:\Windows\System\ylvHRvZ.exe
  2⤵
  PID:1324
- C:\Windows\System\dLJpyXz.exe
  C:\Windows\System\dLJpyXz.exe
  2⤵
  PID:1448
- C:\Windows\System\GdBWaHm.exe
  C:\Windows\System\GdBWaHm.exe
  2⤵
  PID:740
- C:\Windows\System\hwyZobs.exe
  C:\Windows\System\hwyZobs.exe
  2⤵
  PID:4060
- C:\Windows\System\UInFSdl.exe
  C:\Windows\System\UInFSdl.exe
  2⤵
  PID:4328
- C:\Windows\System\IiDSYPA.exe
  C:\Windows\System\IiDSYPA.exe
  2⤵
  PID:1356
- C:\Windows\System\qcOhTUT.exe
  C:\Windows\System\qcOhTUT.exe
  2⤵
  PID:1260
- C:\Windows\System\ZPbFkWW.exe
  C:\Windows\System\ZPbFkWW.exe
  2⤵
  PID:1768
- C:\Windows\System\GaQIByd.exe
  C:\Windows\System\GaQIByd.exe
  2⤵
  PID:3112
- C:\Windows\System\uHYXIXk.exe
  C:\Windows\System\uHYXIXk.exe
  2⤵
  PID:1708
- C:\Windows\System\dQGpIdY.exe
  C:\Windows\System\dQGpIdY.exe
  2⤵
  PID:1084
- C:\Windows\System\VzSJhIM.exe
  C:\Windows\System\VzSJhIM.exe
  2⤵
  PID:4392
- C:\Windows\System\iDvcNPx.exe
  C:\Windows\System\iDvcNPx.exe
  2⤵
  PID:3268
- C:\Windows\System\rIlDkVp.exe
  C:\Windows\System\rIlDkVp.exe
  2⤵
  PID:1628
- C:\Windows\System\fwLrdYt.exe
  C:\Windows\System\fwLrdYt.exe
  2⤵
  PID:1100
- C:\Windows\System\TPbPfCf.exe
  C:\Windows\System\TPbPfCf.exe
  2⤵
  PID:1904
- C:\Windows\System\VTiqcqD.exe
  C:\Windows\System\VTiqcqD.exe
  2⤵
  PID:1400
- C:\Windows\System\UvCGYTl.exe
  C:\Windows\System\UvCGYTl.exe
  2⤵
  PID:1376
- C:\Windows\System\kihmsRu.exe
  C:\Windows\System\kihmsRu.exe
  2⤵
  PID:4372
- C:\Windows\System\OOucIvc.exe
  C:\Windows\System\OOucIvc.exe
  2⤵
  PID:968
- C:\Windows\System\asRrWfE.exe
  C:\Windows\System\asRrWfE.exe
  2⤵
  PID:5144
- C:\Windows\System\QZmlpQF.exe
  C:\Windows\System\QZmlpQF.exe
  2⤵
  PID:5172
- C:\Windows\System\RJsCOhF.exe
  C:\Windows\System\RJsCOhF.exe
  2⤵
  PID:5188
- C:\Windows\System\EFQWyxr.exe
  C:\Windows\System\EFQWyxr.exe
  2⤵
  PID:5216
- C:\Windows\System\jYNPrmv.exe
  C:\Windows\System\jYNPrmv.exe
  2⤵
  PID:5252
- C:\Windows\System\dlIGtQF.exe
  C:\Windows\System\dlIGtQF.exe
  2⤵
  PID:5284
- C:\Windows\System\YyibASH.exe
  C:\Windows\System\YyibASH.exe
  2⤵
  PID:5304
- C:\Windows\System\HhsqHIO.exe
  C:\Windows\System\HhsqHIO.exe
  2⤵
  PID:5324
- C:\Windows\System\RmbwlmT.exe
  C:\Windows\System\RmbwlmT.exe
  2⤵
  PID:5344
- C:\Windows\System\QdNfRhI.exe
  C:\Windows\System\QdNfRhI.exe
  2⤵
  PID:5368
- C:\Windows\System\fbULJtP.exe
  C:\Windows\System\fbULJtP.exe
  2⤵
  PID:5392
- C:\Windows\System\QyLcjJF.exe
  C:\Windows\System\QyLcjJF.exe
  2⤵
  PID:5420
- C:\Windows\System\KwWEKga.exe
  C:\Windows\System\KwWEKga.exe
  2⤵
  PID:5444
- C:\Windows\System\lnNipDb.exe
  C:\Windows\System\lnNipDb.exe
  2⤵
  PID:5480
- C:\Windows\System\Oercdpp.exe
  C:\Windows\System\Oercdpp.exe
  2⤵
  PID:5504
- C:\Windows\System\aXnErDz.exe
  C:\Windows\System\aXnErDz.exe
  2⤵
  PID:5532
- C:\Windows\System\FmCGXxc.exe
  C:\Windows\System\FmCGXxc.exe
  2⤵
  PID:5552
- C:\Windows\System\dnvcrnV.exe
  C:\Windows\System\dnvcrnV.exe
  2⤵
  PID:5584
- C:\Windows\System\GPbSsNm.exe
  C:\Windows\System\GPbSsNm.exe
  2⤵
  PID:5612
- C:\Windows\System\mNaxWhd.exe
  C:\Windows\System\mNaxWhd.exe
  2⤵
  PID:5636
- C:\Windows\System\RRaQldf.exe
  C:\Windows\System\RRaQldf.exe
  2⤵
  PID:5656
- C:\Windows\System\PWETIvU.exe
  C:\Windows\System\PWETIvU.exe
  2⤵
  PID:5672
- C:\Windows\System\FuCScmm.exe
  C:\Windows\System\FuCScmm.exe
  2⤵
  PID:5700
- C:\Windows\System\StLeyoW.exe
  C:\Windows\System\StLeyoW.exe
  2⤵
  PID:5728
- C:\Windows\System\NisGOMV.exe
  C:\Windows\System\NisGOMV.exe
  2⤵
  PID:5756
- C:\Windows\System\AwmEYVI.exe
  C:\Windows\System\AwmEYVI.exe
  2⤵
  PID:5792
- C:\Windows\System\EOrkyNi.exe
  C:\Windows\System\EOrkyNi.exe
  2⤵
  PID:5816
- C:\Windows\System\DbIyEed.exe
  C:\Windows\System\DbIyEed.exe
  2⤵
  PID:5848
- C:\Windows\System\AHlhwMg.exe
  C:\Windows\System\AHlhwMg.exe
  2⤵
  PID:5888
- C:\Windows\System\HdxMUQr.exe
  C:\Windows\System\HdxMUQr.exe
  2⤵
  PID:5908
- C:\Windows\System\iWjIHuZ.exe
  C:\Windows\System\iWjIHuZ.exe
  2⤵
  PID:5948
- C:\Windows\System\uMqeTju.exe
  C:\Windows\System\uMqeTju.exe
  2⤵
  PID:5980
- C:\Windows\System\EuAnEjW.exe
  C:\Windows\System\EuAnEjW.exe
  2⤵
  PID:6016
- C:\Windows\System\byTpYzC.exe
  C:\Windows\System\byTpYzC.exe
  2⤵
  PID:6048
- C:\Windows\System\DEzrDXB.exe
  C:\Windows\System\DEzrDXB.exe
  2⤵
  PID:6084
- C:\Windows\System\PmIujfG.exe
  C:\Windows\System\PmIujfG.exe
  2⤵
  PID:6112
- C:\Windows\System\cEoifnI.exe
  C:\Windows\System\cEoifnI.exe
  2⤵
  PID:6140
- C:\Windows\System\NPnAgjH.exe
  C:\Windows\System\NPnAgjH.exe
  2⤵
  PID:5156
- C:\Windows\System\syLMquD.exe
  C:\Windows\System\syLMquD.exe
  2⤵
  PID:5232
- C:\Windows\System\GWiqLLF.exe
  C:\Windows\System\GWiqLLF.exe
  2⤵
  PID:5332
- C:\Windows\System\ZMtiVyI.exe
  C:\Windows\System\ZMtiVyI.exe
  2⤵
  PID:5364
- C:\Windows\System\WAAdaEs.exe
  C:\Windows\System\WAAdaEs.exe
  2⤵
  PID:5436
- C:\Windows\System\TMyWHev.exe
  C:\Windows\System\TMyWHev.exe
  2⤵
  PID:5548
- C:\Windows\System\iLkecqX.exe
  C:\Windows\System\iLkecqX.exe
  2⤵
  PID:5544
- C:\Windows\System\WbFjBBG.exe
  C:\Windows\System\WbFjBBG.exe
  2⤵
  PID:5624
- C:\Windows\System\LlkwGSr.exe
  C:\Windows\System\LlkwGSr.exe
  2⤵
  PID:5768
- C:\Windows\System\vxRIYSr.exe
  C:\Windows\System\vxRIYSr.exe
  2⤵
  PID:5708
- C:\Windows\System\ZQwpDEA.exe
  C:\Windows\System\ZQwpDEA.exe
  2⤵
  PID:5856
- C:\Windows\System\uYANmhU.exe
  C:\Windows\System\uYANmhU.exe
  2⤵
  PID:5904
- C:\Windows\System\OPFxEmZ.exe
  C:\Windows\System\OPFxEmZ.exe
  2⤵
  PID:6040
- C:\Windows\System\brbjmaG.exe
  C:\Windows\System\brbjmaG.exe
  2⤵
  PID:6028
- C:\Windows\System\sVPSTQU.exe
  C:\Windows\System\sVPSTQU.exe
  2⤵
  PID:6132
- C:\Windows\System\fZEpHaH.exe
  C:\Windows\System\fZEpHaH.exe
  2⤵
  PID:5208
- C:\Windows\System\hryqnhL.exe
  C:\Windows\System\hryqnhL.exe
  2⤵
  PID:5180
- C:\Windows\System\KnPptWx.exe
  C:\Windows\System\KnPptWx.exe
  2⤵
  PID:5380
- C:\Windows\System\HPQOygs.exe
  C:\Windows\System\HPQOygs.exe
  2⤵
  PID:5464
- C:\Windows\System\azHmAnq.exe
  C:\Windows\System\azHmAnq.exe
  2⤵
  PID:5596
- C:\Windows\System\hIbpJMh.exe
  C:\Windows\System\hIbpJMh.exe
  2⤵
  PID:5692
- C:\Windows\System\oaGWdth.exe
  C:\Windows\System\oaGWdth.exe
  2⤵
  PID:5824
- C:\Windows\System\VXbQGyL.exe
  C:\Windows\System\VXbQGyL.exe
  2⤵
  PID:2508
- C:\Windows\System\RnQPazK.exe
  C:\Windows\System\RnQPazK.exe
  2⤵
  PID:6108
- C:\Windows\System\aWxhPLh.exe
  C:\Windows\System\aWxhPLh.exe
  2⤵
  PID:5184
- C:\Windows\System\iObeDro.exe
  C:\Windows\System\iObeDro.exe
  2⤵
  PID:5844
- C:\Windows\System\CzkkdUb.exe
  C:\Windows\System\CzkkdUb.exe
  2⤵
  PID:5740
- C:\Windows\System\nRgsakc.exe
  C:\Windows\System\nRgsakc.exe
  2⤵
  PID:5572
- C:\Windows\System\JTEgHII.exe
  C:\Windows\System\JTEgHII.exe
  2⤵
  PID:6148
- C:\Windows\System\pynSjWx.exe
  C:\Windows\System\pynSjWx.exe
  2⤵
  PID:6172
- C:\Windows\System\cPmlVPd.exe
  C:\Windows\System\cPmlVPd.exe
  2⤵
  PID:6200
- C:\Windows\System\vQnsXjp.exe
  C:\Windows\System\vQnsXjp.exe
  2⤵
  PID:6224
- C:\Windows\System\IdSICKj.exe
  C:\Windows\System\IdSICKj.exe
  2⤵
  PID:6260
- C:\Windows\System\gxJXFoS.exe
  C:\Windows\System\gxJXFoS.exe
  2⤵
  PID:6288
- C:\Windows\System\GNfXApZ.exe
  C:\Windows\System\GNfXApZ.exe
  2⤵
  PID:6320
- C:\Windows\System\WDQvnzs.exe
  C:\Windows\System\WDQvnzs.exe
  2⤵
  PID:6352
- C:\Windows\System\FiydngV.exe
  C:\Windows\System\FiydngV.exe
  2⤵
  PID:6376
- C:\Windows\System\dJONcbq.exe
  C:\Windows\System\dJONcbq.exe
  2⤵
  PID:6400
- C:\Windows\System\kOSlnGz.exe
  C:\Windows\System\kOSlnGz.exe
  2⤵
  PID:6420
- C:\Windows\System\HXuQwxm.exe
  C:\Windows\System\HXuQwxm.exe
  2⤵
  PID:6440
- C:\Windows\System\eUEDCWd.exe
  C:\Windows\System\eUEDCWd.exe
  2⤵
  PID:6456
- C:\Windows\System\wXAhmxN.exe
  C:\Windows\System\wXAhmxN.exe
  2⤵
  PID:6480
- C:\Windows\System\gtAwZXX.exe
  C:\Windows\System\gtAwZXX.exe
  2⤵
  PID:6512
- C:\Windows\System\JQRCmsN.exe
  C:\Windows\System\JQRCmsN.exe
  2⤵
  PID:6532
- C:\Windows\System\kRLaxjw.exe
  C:\Windows\System\kRLaxjw.exe
  2⤵
  PID:6560
- C:\Windows\System\PRAqwsK.exe
  C:\Windows\System\PRAqwsK.exe
  2⤵
  PID:6592
- C:\Windows\System\icIIvxx.exe
  C:\Windows\System\icIIvxx.exe
  2⤵
  PID:6620
- C:\Windows\System\djJOXRx.exe
  C:\Windows\System\djJOXRx.exe
  2⤵
  PID:6644
- C:\Windows\System\ohdyuvf.exe
  C:\Windows\System\ohdyuvf.exe
  2⤵
  PID:6676
- C:\Windows\System\FjOPtfB.exe
  C:\Windows\System\FjOPtfB.exe
  2⤵
  PID:6708
- C:\Windows\System\sYJhtNf.exe
  C:\Windows\System\sYJhtNf.exe
  2⤵
  PID:6736
- C:\Windows\System\hWoetoj.exe
  C:\Windows\System\hWoetoj.exe
  2⤵
  PID:6760
- C:\Windows\System\RDEDNIQ.exe
  C:\Windows\System\RDEDNIQ.exe
  2⤵
  PID:6788
- C:\Windows\System\rKwTKZF.exe
  C:\Windows\System\rKwTKZF.exe
  2⤵
  PID:6816
- C:\Windows\System\UiTJjmx.exe
  C:\Windows\System\UiTJjmx.exe
  2⤵
  PID:6844
- C:\Windows\System\BLpFEem.exe
  C:\Windows\System\BLpFEem.exe
  2⤵
  PID:6864
- C:\Windows\System\BXmxAlh.exe
  C:\Windows\System\BXmxAlh.exe
  2⤵
  PID:6952
- C:\Windows\System\RmesAup.exe
  C:\Windows\System\RmesAup.exe
  2⤵
  PID:7064
- C:\Windows\System\ceLWbXE.exe
  C:\Windows\System\ceLWbXE.exe
  2⤵
  PID:7092
- C:\Windows\System\iCiNsjt.exe
  C:\Windows\System\iCiNsjt.exe
  2⤵
  PID:7108
- C:\Windows\System\JdPcMFY.exe
  C:\Windows\System\JdPcMFY.exe
  2⤵
  PID:7132
- C:\Windows\System\ThLlQJL.exe
  C:\Windows\System\ThLlQJL.exe
  2⤵
  PID:6068
- C:\Windows\System\YpQAzra.exe
  C:\Windows\System\YpQAzra.exe
  2⤵
  PID:6216
- C:\Windows\System\XrZASPv.exe
  C:\Windows\System\XrZASPv.exe
  2⤵
  PID:6208
- C:\Windows\System\iKALxcR.exe
  C:\Windows\System\iKALxcR.exe
  2⤵
  PID:6252
- C:\Windows\System\jkLhfYP.exe
  C:\Windows\System\jkLhfYP.exe
  2⤵
  PID:6340
- C:\Windows\System\VKGxmWy.exe
  C:\Windows\System\VKGxmWy.exe
  2⤵
  PID:6396
- C:\Windows\System\mprvXcD.exe
  C:\Windows\System\mprvXcD.exe
  2⤵
  PID:6432
- C:\Windows\System\xMVUsIe.exe
  C:\Windows\System\xMVUsIe.exe
  2⤵
  PID:6388
- C:\Windows\System\Tcospih.exe
  C:\Windows\System\Tcospih.exe
  2⤵
  PID:6476
- C:\Windows\System\qqndJPh.exe
  C:\Windows\System\qqndJPh.exe
  2⤵
  PID:6556
- C:\Windows\System\kizCtbc.exe
  C:\Windows\System\kizCtbc.exe
  2⤵
  PID:6756
- C:\Windows\System\IyDPLKn.exe
  C:\Windows\System\IyDPLKn.exe
  2⤵
  PID:6608
- C:\Windows\System\mDxdPPy.exe
  C:\Windows\System\mDxdPPy.exe
  2⤵
  PID:6856
- C:\Windows\System\ShnWEyr.exe
  C:\Windows\System\ShnWEyr.exe
  2⤵
  PID:6796
- C:\Windows\System\cDKGoyx.exe
  C:\Windows\System\cDKGoyx.exe
  2⤵
  PID:6928
- C:\Windows\System\CpGqkvH.exe
  C:\Windows\System\CpGqkvH.exe
  2⤵
  PID:7044
- C:\Windows\System\FCUqvBL.exe
  C:\Windows\System\FCUqvBL.exe
  2⤵
  PID:7088
- C:\Windows\System\EpGdBdO.exe
  C:\Windows\System\EpGdBdO.exe
  2⤵
  PID:5716
- C:\Windows\System\yGSkihV.exe
  C:\Windows\System\yGSkihV.exe
  2⤵
  PID:6180
- C:\Windows\System\kPdqQcK.exe
  C:\Windows\System\kPdqQcK.exe
  2⤵
  PID:6472
- C:\Windows\System\inXMNLo.exe
  C:\Windows\System\inXMNLo.exe
  2⤵
  PID:6344
- C:\Windows\System\NVjbWqC.exe
  C:\Windows\System\NVjbWqC.exe
  2⤵
  PID:6552
- C:\Windows\System\NuYAIwm.exe
  C:\Windows\System\NuYAIwm.exe
  2⤵
  PID:6728
- C:\Windows\System\IORemOC.exe
  C:\Windows\System\IORemOC.exe
  2⤵
  PID:7004
- C:\Windows\System\qghdgIo.exe
  C:\Windows\System\qghdgIo.exe
  2⤵
  PID:7100
- C:\Windows\System\hcKcpBs.exe
  C:\Windows\System\hcKcpBs.exe
  2⤵
  PID:6188
- C:\Windows\System\TkRmQXX.exe
  C:\Windows\System\TkRmQXX.exe
  2⤵
  PID:7172
- C:\Windows\System\IsyskIg.exe
  C:\Windows\System\IsyskIg.exe
  2⤵
  PID:7192
- C:\Windows\System\qbwFyVQ.exe
  C:\Windows\System\qbwFyVQ.exe
  2⤵
  PID:7220
- C:\Windows\System\LPrgJwx.exe
  C:\Windows\System\LPrgJwx.exe
  2⤵
  PID:7244
- C:\Windows\System\DPRuRES.exe
  C:\Windows\System\DPRuRES.exe
  2⤵
  PID:7268
- C:\Windows\System\ILNCVXo.exe
  C:\Windows\System\ILNCVXo.exe
  2⤵
  PID:7292
- C:\Windows\System\eIQzdpU.exe
  C:\Windows\System\eIQzdpU.exe
  2⤵
  PID:7324
- C:\Windows\System\GnEXzEc.exe
  C:\Windows\System\GnEXzEc.exe
  2⤵
  PID:7352
- C:\Windows\System\FJhrijR.exe
  C:\Windows\System\FJhrijR.exe
  2⤵
  PID:7376
- C:\Windows\System\jVKLZNc.exe
  C:\Windows\System\jVKLZNc.exe
  2⤵
  PID:7404
- C:\Windows\System\KNIBLSO.exe
  C:\Windows\System\KNIBLSO.exe
  2⤵
  PID:7428
- C:\Windows\System\GdnhUcc.exe
  C:\Windows\System\GdnhUcc.exe
  2⤵
  PID:7464
- C:\Windows\System\aXDuvaM.exe
  C:\Windows\System\aXDuvaM.exe
  2⤵
  PID:7484
- C:\Windows\System\PdmCBfs.exe
  C:\Windows\System\PdmCBfs.exe
  2⤵
  PID:7508
- C:\Windows\System\inSXdnE.exe
  C:\Windows\System\inSXdnE.exe
  2⤵
  PID:7532
- C:\Windows\System\rQzNQKW.exe
  C:\Windows\System\rQzNQKW.exe
  2⤵
  PID:7560
- C:\Windows\System\CoACqBq.exe
  C:\Windows\System\CoACqBq.exe
  2⤵
  PID:7588
- C:\Windows\System\kmoApDR.exe
  C:\Windows\System\kmoApDR.exe
  2⤵
  PID:7612
- C:\Windows\System\wBRFfde.exe
  C:\Windows\System\wBRFfde.exe
  2⤵
  PID:7636
- C:\Windows\System\fPhJZla.exe
  C:\Windows\System\fPhJZla.exe
  2⤵
  PID:7652
- C:\Windows\System\yZuTLXO.exe
  C:\Windows\System\yZuTLXO.exe
  2⤵
  PID:7680
- C:\Windows\System\oPyfebc.exe
  C:\Windows\System\oPyfebc.exe
  2⤵
  PID:7708
- C:\Windows\System\QIGriZp.exe
  C:\Windows\System\QIGriZp.exe
  2⤵
  PID:7732
- C:\Windows\System\TplvTBC.exe
  C:\Windows\System\TplvTBC.exe
  2⤵
  PID:7752
- C:\Windows\System\LrbLqMY.exe
  C:\Windows\System\LrbLqMY.exe
  2⤵
  PID:7768
- C:\Windows\System\BvfWaNp.exe
  C:\Windows\System\BvfWaNp.exe
  2⤵
  PID:7796
- C:\Windows\System\kumnuLg.exe
  C:\Windows\System\kumnuLg.exe
  2⤵
  PID:7824
- C:\Windows\System\uTgEeYz.exe
  C:\Windows\System\uTgEeYz.exe
  2⤵
  PID:7852
- C:\Windows\System\UNGXPbx.exe
  C:\Windows\System\UNGXPbx.exe
  2⤵
  PID:7880
- C:\Windows\System\gjRpyFm.exe
  C:\Windows\System\gjRpyFm.exe
  2⤵
  PID:7908
- C:\Windows\System\DlCujzQ.exe
  C:\Windows\System\DlCujzQ.exe
  2⤵
  PID:7932
- C:\Windows\System\fumGfRs.exe
  C:\Windows\System\fumGfRs.exe
  2⤵
  PID:7968
- C:\Windows\System\kZTjBsJ.exe
  C:\Windows\System\kZTjBsJ.exe
  2⤵
  PID:8000
- C:\Windows\System\IhDvzrd.exe
  C:\Windows\System\IhDvzrd.exe
  2⤵
  PID:8020
- C:\Windows\System\HkNXZhv.exe
  C:\Windows\System\HkNXZhv.exe
  2⤵
  PID:8048
- C:\Windows\System\eQpmSxi.exe
  C:\Windows\System\eQpmSxi.exe
  2⤵
  PID:8076
- C:\Windows\System\RFFrBaz.exe
  C:\Windows\System\RFFrBaz.exe
  2⤵
  PID:8096
- C:\Windows\System\eJWdMDu.exe
  C:\Windows\System\eJWdMDu.exe
  2⤵
  PID:8124
- C:\Windows\System\oSJoEJY.exe
  C:\Windows\System\oSJoEJY.exe
  2⤵
  PID:8140
- C:\Windows\System\PhSFoqv.exe
  C:\Windows\System\PhSFoqv.exe
  2⤵
  PID:8172
- C:\Windows\System\sDeoqLI.exe
  C:\Windows\System\sDeoqLI.exe
  2⤵
  PID:7144
- C:\Windows\System\rrDCnax.exe
  C:\Windows\System\rrDCnax.exe
  2⤵
  PID:6980
- C:\Windows\System\UgZJFdH.exe
  C:\Windows\System\UgZJFdH.exe
  2⤵
  PID:6660
- C:\Windows\System\Mevxaia.exe
  C:\Windows\System\Mevxaia.exe
  2⤵
  PID:7228
- C:\Windows\System\zaekwwI.exe
  C:\Windows\System\zaekwwI.exe
  2⤵
  PID:7264
- C:\Windows\System\KZNynWV.exe
  C:\Windows\System\KZNynWV.exe
  2⤵
  PID:7384
- C:\Windows\System\rnqXpBy.exe
  C:\Windows\System\rnqXpBy.exe
  2⤵
  PID:7436
- C:\Windows\System\LfsuNHU.exe
  C:\Windows\System\LfsuNHU.exe
  2⤵
  PID:7420
- C:\Windows\System\xUzDqJM.exe
  C:\Windows\System\xUzDqJM.exe
  2⤵
  PID:7596
- C:\Windows\System\OLsHPrR.exe
  C:\Windows\System\OLsHPrR.exe
  2⤵
  PID:7644
- C:\Windows\System\zWroyhy.exe
  C:\Windows\System\zWroyhy.exe
  2⤵
  PID:7704
- C:\Windows\System\aQfLDjy.exe
  C:\Windows\System\aQfLDjy.exe
  2⤵
  PID:7820
- C:\Windows\System\DvZvjYy.exe
  C:\Windows\System\DvZvjYy.exe
  2⤵
  PID:7744
- C:\Windows\System\IFbGkFa.exe
  C:\Windows\System\IFbGkFa.exe
  2⤵
  PID:7840
- C:\Windows\System\mEONynI.exe
  C:\Windows\System\mEONynI.exe
  2⤵
  PID:7988
- C:\Windows\System\LXRGwzy.exe
  C:\Windows\System\LXRGwzy.exe
  2⤵
  PID:7896
- C:\Windows\System\klvWosB.exe
  C:\Windows\System\klvWosB.exe
  2⤵
  PID:8136
- C:\Windows\System\rHCyLwL.exe
  C:\Windows\System\rHCyLwL.exe
  2⤵
  PID:8040
- C:\Windows\System\vVCdmLI.exe
  C:\Windows\System\vVCdmLI.exe
  2⤵
  PID:7280
- C:\Windows\System\YMelAJQ.exe
  C:\Windows\System\YMelAJQ.exe
  2⤵
  PID:8152
- C:\Windows\System\ZiHkCIt.exe
  C:\Windows\System\ZiHkCIt.exe
  2⤵
  PID:7584
- C:\Windows\System\yeJljvt.exe
  C:\Windows\System\yeJljvt.exe
  2⤵
  PID:6784
- C:\Windows\System\HpaBwlS.exe
  C:\Windows\System\HpaBwlS.exe
  2⤵
  PID:7952
- C:\Windows\System\fzcrpQD.exe
  C:\Windows\System\fzcrpQD.exe
  2⤵
  PID:7576
- C:\Windows\System\LHlkGKY.exe
  C:\Windows\System\LHlkGKY.exe
  2⤵
  PID:7916
- C:\Windows\System\TuQwUfi.exe
  C:\Windows\System\TuQwUfi.exe
  2⤵
  PID:8088
- C:\Windows\System\BCkPxWk.exe
  C:\Windows\System\BCkPxWk.exe
  2⤵
  PID:7720
- C:\Windows\System\zOQQqwa.exe
  C:\Windows\System\zOQQqwa.exe
  2⤵
  PID:8212
- C:\Windows\System\HAiBRdr.exe
  C:\Windows\System\HAiBRdr.exe
  2⤵
  PID:8244
- C:\Windows\System\KEVDfXq.exe
  C:\Windows\System\KEVDfXq.exe
  2⤵
  PID:8272
- C:\Windows\System\itiAiyL.exe
  C:\Windows\System\itiAiyL.exe
  2⤵
  PID:8296
- C:\Windows\System\yMcvieM.exe
  C:\Windows\System\yMcvieM.exe
  2⤵
  PID:8328
- C:\Windows\System\YwZQKHi.exe
  C:\Windows\System\YwZQKHi.exe
  2⤵
  PID:8360
- C:\Windows\System\CBvKzrQ.exe
  C:\Windows\System\CBvKzrQ.exe
  2⤵
  PID:8392
- C:\Windows\System\SLuOZrD.exe
  C:\Windows\System\SLuOZrD.exe
  2⤵
  PID:8420
- C:\Windows\System\JgELRRl.exe
  C:\Windows\System\JgELRRl.exe
  2⤵
  PID:8440
- C:\Windows\System\zkONlTj.exe
  C:\Windows\System\zkONlTj.exe
  2⤵
  PID:8468
- C:\Windows\System\zFaRcyj.exe
  C:\Windows\System\zFaRcyj.exe
  2⤵
  PID:8492
- C:\Windows\System\UMYWYYB.exe
  C:\Windows\System\UMYWYYB.exe
  2⤵
  PID:8512
- C:\Windows\System\HbVTEGi.exe
  C:\Windows\System\HbVTEGi.exe
  2⤵
  PID:8540
- C:\Windows\System\wCKeUYM.exe
  C:\Windows\System\wCKeUYM.exe
  2⤵
  PID:8568
- C:\Windows\System\dCRiuqR.exe
  C:\Windows\System\dCRiuqR.exe
  2⤵
  PID:8596
- C:\Windows\System\KFVQQAp.exe
  C:\Windows\System\KFVQQAp.exe
  2⤵
  PID:8616
- C:\Windows\System\FpQDDUQ.exe
  C:\Windows\System\FpQDDUQ.exe
  2⤵
  PID:8644
- C:\Windows\System\aSXZGNr.exe
  C:\Windows\System\aSXZGNr.exe
  2⤵
  PID:8664
- C:\Windows\System\DQYCpOK.exe
  C:\Windows\System\DQYCpOK.exe
  2⤵
  PID:8684
- C:\Windows\System\CVJEWDj.exe
  C:\Windows\System\CVJEWDj.exe
  2⤵
  PID:8716
- C:\Windows\System\vvWPcgJ.exe
  C:\Windows\System\vvWPcgJ.exe
  2⤵
  PID:8744
- C:\Windows\System\cEoakbA.exe
  C:\Windows\System\cEoakbA.exe
  2⤵
  PID:8772
- C:\Windows\System\SkiGIhK.exe
  C:\Windows\System\SkiGIhK.exe
  2⤵
  PID:8808
- C:\Windows\System\gbsSKPc.exe
  C:\Windows\System\gbsSKPc.exe
  2⤵
  PID:8836
- C:\Windows\System\JFtYJQz.exe
  C:\Windows\System\JFtYJQz.exe
  2⤵
  PID:8864
- C:\Windows\System\cMZVKTO.exe
  C:\Windows\System\cMZVKTO.exe
  2⤵
  PID:8892
- C:\Windows\System\tKlCPDB.exe
  C:\Windows\System\tKlCPDB.exe
  2⤵
  PID:8916
- C:\Windows\System\LkdDfuG.exe
  C:\Windows\System\LkdDfuG.exe
  2⤵
  PID:8940
- C:\Windows\System\sgUCyMH.exe
  C:\Windows\System\sgUCyMH.exe
  2⤵
  PID:8976
- C:\Windows\System\VFBNRuF.exe
  C:\Windows\System\VFBNRuF.exe
  2⤵
  PID:9008
- C:\Windows\System\mDplzLt.exe
  C:\Windows\System\mDplzLt.exe
  2⤵
  PID:9040
- C:\Windows\System\egPIuIK.exe
  C:\Windows\System\egPIuIK.exe
  2⤵
  PID:9068
- C:\Windows\System\ZWILqhO.exe
  C:\Windows\System\ZWILqhO.exe
  2⤵
  PID:9108
- C:\Windows\System\HAAWViP.exe
  C:\Windows\System\HAAWViP.exe
  2⤵
  PID:9132
- C:\Windows\System\snAZUIC.exe
  C:\Windows\System\snAZUIC.exe
  2⤵
  PID:9160
- C:\Windows\System\QHfUmbw.exe
  C:\Windows\System\QHfUmbw.exe
  2⤵
  PID:9192
- C:\Windows\System\wPQwlRy.exe
  C:\Windows\System\wPQwlRy.exe
  2⤵
  PID:9208
- C:\Windows\System\fgKfCHp.exe
  C:\Windows\System\fgKfCHp.exe
  2⤵
  PID:7412
- C:\Windows\System\BRaFMGx.exe
  C:\Windows\System\BRaFMGx.exe
  2⤵
  PID:8164
- C:\Windows\System\XZurPil.exe
  C:\Windows\System\XZurPil.exe
  2⤵
  PID:8252
- C:\Windows\System\clYNdPN.exe
  C:\Windows\System\clYNdPN.exe
  2⤵
  PID:8308
- C:\Windows\System\faTSfhl.exe
  C:\Windows\System\faTSfhl.exe
  2⤵
  PID:8340
- C:\Windows\System\CMIWFZK.exe
  C:\Windows\System\CMIWFZK.exe
  2⤵
  PID:8200
- C:\Windows\System\SuauXhP.exe
  C:\Windows\System\SuauXhP.exe
  2⤵
  PID:8292
- C:\Windows\System\HtBlGzV.exe
  C:\Windows\System\HtBlGzV.exe
  2⤵
  PID:8524
- C:\Windows\System\zDODeGY.exe
  C:\Windows\System\zDODeGY.exe
  2⤵
  PID:8284
- C:\Windows\System\jQRLRPP.exe
  C:\Windows\System\jQRLRPP.exe
  2⤵
  PID:8500
- C:\Windows\System\Gjlyxab.exe
  C:\Windows\System\Gjlyxab.exe
  2⤵
  PID:8416
- C:\Windows\System\DwAdUVL.exe
  C:\Windows\System\DwAdUVL.exe
  2⤵
  PID:8460
- C:\Windows\System\dJNZudZ.exe
  C:\Windows\System\dJNZudZ.exe
  2⤵
  PID:8828
- C:\Windows\System\wiTQcii.exe
  C:\Windows\System\wiTQcii.exe
  2⤵
  PID:8656
- C:\Windows\System\UBqIzOP.exe
  C:\Windows\System\UBqIzOP.exe
  2⤵
  PID:8704
- C:\Windows\System\XCTqbAv.exe
  C:\Windows\System\XCTqbAv.exe
  2⤵
  PID:8960
- C:\Windows\System\XUAXHPu.exe
  C:\Windows\System\XUAXHPu.exe
  2⤵
  PID:8816
- C:\Windows\System\TyDLUXk.exe
  C:\Windows\System\TyDLUXk.exe
  2⤵
  PID:8900
- C:\Windows\System\LYcVXzR.exe
  C:\Windows\System\LYcVXzR.exe
  2⤵
  PID:9168
- C:\Windows\System\GiDXlqo.exe
  C:\Windows\System\GiDXlqo.exe
  2⤵
  PID:7392
- C:\Windows\System\ldmUnET.exe
  C:\Windows\System\ldmUnET.exe
  2⤵
  PID:8236
- C:\Windows\System\bDJfNFo.exe
  C:\Windows\System\bDJfNFo.exe
  2⤵
  PID:9144
- C:\Windows\System\pmQGHXr.exe
  C:\Windows\System\pmQGHXr.exe
  2⤵
  PID:9184
- C:\Windows\System\LsBwwXr.exe
  C:\Windows\System\LsBwwXr.exe
  2⤵
  PID:8604
- C:\Windows\System\xPMRRGn.exe
  C:\Windows\System\xPMRRGn.exe
  2⤵
  PID:9036
- C:\Windows\System\GUHVlMT.exe
  C:\Windows\System\GUHVlMT.exe
  2⤵
  PID:3624
- C:\Windows\System\mqkoYHJ.exe
  C:\Windows\System\mqkoYHJ.exe
  2⤵
  PID:8936
- C:\Windows\System\UORyqHn.exe
  C:\Windows\System\UORyqHn.exe
  2⤵
  PID:9220
- C:\Windows\System\QdwQgEE.exe
  C:\Windows\System\QdwQgEE.exe
  2⤵
  PID:9252
- C:\Windows\System\xmtiFCo.exe
  C:\Windows\System\xmtiFCo.exe
  2⤵
  PID:9272
- C:\Windows\System\DFJWYIw.exe
  C:\Windows\System\DFJWYIw.exe
  2⤵
  PID:9304
- C:\Windows\System\wicStil.exe
  C:\Windows\System\wicStil.exe
  2⤵
  PID:9332
- C:\Windows\System\iUEAFOg.exe
  C:\Windows\System\iUEAFOg.exe
  2⤵
  PID:9360
- C:\Windows\System\SoIeCpM.exe
  C:\Windows\System\SoIeCpM.exe
  2⤵
  PID:9388
- C:\Windows\System\svLJXMB.exe
  C:\Windows\System\svLJXMB.exe
  2⤵
  PID:9416
- C:\Windows\System\cXXdxYJ.exe
  C:\Windows\System\cXXdxYJ.exe
  2⤵
  PID:9444
- C:\Windows\System\wYDdBtt.exe
  C:\Windows\System\wYDdBtt.exe
  2⤵
  PID:9476
- C:\Windows\System\aSUueEk.exe
  C:\Windows\System\aSUueEk.exe
  2⤵
  PID:9508
- C:\Windows\System\SFSmBDZ.exe
  C:\Windows\System\SFSmBDZ.exe
  2⤵
  PID:9544
- C:\Windows\System\aABEVtP.exe
  C:\Windows\System\aABEVtP.exe
  2⤵
  PID:9560
- C:\Windows\System\zWrmvfD.exe
  C:\Windows\System\zWrmvfD.exe
  2⤵
  PID:9584
- C:\Windows\System\rnrNZOY.exe
  C:\Windows\System\rnrNZOY.exe
  2⤵
  PID:9604
- C:\Windows\System\mPRhFDd.exe
  C:\Windows\System\mPRhFDd.exe
  2⤵
  PID:9668
- C:\Windows\System\ISXWvdl.exe
  C:\Windows\System\ISXWvdl.exe
  2⤵
  PID:9696
- C:\Windows\System\vvSEHIi.exe
  C:\Windows\System\vvSEHIi.exe
  2⤵
  PID:9724
- C:\Windows\System\lamcPhV.exe
  C:\Windows\System\lamcPhV.exe
  2⤵
  PID:9748
- C:\Windows\System\YfxSIbg.exe
  C:\Windows\System\YfxSIbg.exe
  2⤵
  PID:9768
- C:\Windows\System\BrFXhCw.exe
  C:\Windows\System\BrFXhCw.exe
  2⤵
  PID:9792
- C:\Windows\System\GfIsHdC.exe
  C:\Windows\System\GfIsHdC.exe
  2⤵
  PID:9820
- C:\Windows\System\MFarkCq.exe
  C:\Windows\System\MFarkCq.exe
  2⤵
  PID:9836
- C:\Windows\System\fZGrTDy.exe
  C:\Windows\System\fZGrTDy.exe
  2⤵
  PID:9864
- C:\Windows\System\brGRChJ.exe
  C:\Windows\System\brGRChJ.exe
  2⤵
  PID:9888
- C:\Windows\System\wLRjgYV.exe
  C:\Windows\System\wLRjgYV.exe
  2⤵
  PID:9916
- C:\Windows\System\AqJtlgN.exe
  C:\Windows\System\AqJtlgN.exe
  2⤵
  PID:9940
- C:\Windows\System\zzKrhkH.exe
  C:\Windows\System\zzKrhkH.exe
  2⤵
  PID:9956
- C:\Windows\System\jnFNCqv.exe
  C:\Windows\System\jnFNCqv.exe
  2⤵
  PID:9988
- C:\Windows\System\gSWVJTy.exe
  C:\Windows\System\gSWVJTy.exe
  2⤵
  PID:10016
- C:\Windows\System\dwVsOtA.exe
  C:\Windows\System\dwVsOtA.exe
  2⤵
  PID:10032
- C:\Windows\System\UBorjPm.exe
  C:\Windows\System\UBorjPm.exe
  2⤵
  PID:10064
- C:\Windows\System\QbYANOC.exe
  C:\Windows\System\QbYANOC.exe
  2⤵
  PID:10080
- C:\Windows\System\aGhOKPE.exe
  C:\Windows\System\aGhOKPE.exe
  2⤵
  PID:10108
- C:\Windows\System\dmFnEhX.exe
  C:\Windows\System\dmFnEhX.exe
  2⤵
  PID:10140
- C:\Windows\System\hjKghuj.exe
  C:\Windows\System\hjKghuj.exe
  2⤵
  PID:10160
- C:\Windows\System\nWGLugu.exe
  C:\Windows\System\nWGLugu.exe
  2⤵
  PID:10196
- C:\Windows\System\MDdVhCE.exe
  C:\Windows\System\MDdVhCE.exe
  2⤵
  PID:10220
- C:\Windows\System\qaeWKkA.exe
  C:\Windows\System\qaeWKkA.exe
  2⤵
  PID:8852
- C:\Windows\System\FXXwxPM.exe
  C:\Windows\System\FXXwxPM.exe
  2⤵
  PID:7208
- C:\Windows\System\HIbSiOb.exe
  C:\Windows\System\HIbSiOb.exe
  2⤵
  PID:8928
- C:\Windows\System\ItoAtQk.exe
  C:\Windows\System\ItoAtQk.exe
  2⤵
  PID:8988
- C:\Windows\System\UYWdvDf.exe
  C:\Windows\System\UYWdvDf.exe
  2⤵
  PID:9292
- C:\Windows\System\OkruXOn.exe
  C:\Windows\System\OkruXOn.exe
  2⤵
  PID:9400
- C:\Windows\System\BdUnuey.exe
  C:\Windows\System\BdUnuey.exe
  2⤵
  PID:9076
- C:\Windows\System\YXFWvzi.exe
  C:\Windows\System\YXFWvzi.exe
  2⤵
  PID:9628
- C:\Windows\System\VcwUCIn.exe
  C:\Windows\System\VcwUCIn.exe
  2⤵
  PID:9348
- C:\Windows\System\bydKpXR.exe
  C:\Windows\System\bydKpXR.exe
  2⤵
  PID:9452
- C:\Windows\System\wnusMgA.exe
  C:\Windows\System\wnusMgA.exe
  2⤵
  PID:9488
- C:\Windows\System\cUeECrs.exe
  C:\Windows\System\cUeECrs.exe
  2⤵
  PID:9232
- C:\Windows\System\KtlZYXr.exe
  C:\Windows\System\KtlZYXr.exe
  2⤵
  PID:9352
- C:\Windows\System\qWbNmqG.exe
  C:\Windows\System\qWbNmqG.exe
  2⤵
  PID:9532
- C:\Windows\System\mXABaMt.exe
  C:\Windows\System\mXABaMt.exe
  2⤵
  PID:9712
- C:\Windows\System\xasyeVs.exe
  C:\Windows\System\xasyeVs.exe
  2⤵
  PID:9996
- C:\Windows\System\WJGsfWU.exe
  C:\Windows\System\WJGsfWU.exe
  2⤵
  PID:10048
- C:\Windows\System\dZOjQWT.exe
  C:\Windows\System\dZOjQWT.exe
  2⤵
  PID:10092
- C:\Windows\System\dECKXBs.exe
  C:\Windows\System\dECKXBs.exe
  2⤵
  PID:10156
- C:\Windows\System\dzzMSnR.exe
  C:\Windows\System\dzzMSnR.exe
  2⤵
  PID:9980
- C:\Windows\System\ZewIGqh.exe
  C:\Windows\System\ZewIGqh.exe
  2⤵
  PID:8880
- C:\Windows\System\fmPjQDs.exe
  C:\Windows\System\fmPjQDs.exe
  2⤵
  PID:8504
- C:\Windows\System\paWMYln.exe
  C:\Windows\System\paWMYln.exe
  2⤵
  PID:9324
- C:\Windows\System\tVikbAn.exe
  C:\Windows\System\tVikbAn.exe
  2⤵
  PID:9928
- C:\Windows\System\chjKFCY.exe
  C:\Windows\System\chjKFCY.exe
  2⤵
  PID:10248
- C:\Windows\System\hcWPvkI.exe
  C:\Windows\System\hcWPvkI.exe
  2⤵
  PID:10276
- C:\Windows\System\BZrDgzO.exe
  C:\Windows\System\BZrDgzO.exe
  2⤵
  PID:10300
- C:\Windows\System\BNkclYH.exe
  C:\Windows\System\BNkclYH.exe
  2⤵
  PID:10332
- C:\Windows\System\TDXcodM.exe
  C:\Windows\System\TDXcodM.exe
  2⤵
  PID:10364
- C:\Windows\System\PZJpVUB.exe
  C:\Windows\System\PZJpVUB.exe
  2⤵
  PID:10388
- C:\Windows\System\NjKnIXL.exe
  C:\Windows\System\NjKnIXL.exe
  2⤵
  PID:10416
- C:\Windows\System\zGTLNJI.exe
  C:\Windows\System\zGTLNJI.exe
  2⤵
  PID:10444
- C:\Windows\System\JbvvIeW.exe
  C:\Windows\System\JbvvIeW.exe
  2⤵
  PID:10472
- C:\Windows\System\cFzbVgA.exe
  C:\Windows\System\cFzbVgA.exe
  2⤵
  PID:10508
- C:\Windows\System\EyiMLkJ.exe
  C:\Windows\System\EyiMLkJ.exe
  2⤵
  PID:10536
- C:\Windows\System\RLVmHou.exe
  C:\Windows\System\RLVmHou.exe
  2⤵
  PID:10568
- C:\Windows\System\DxujVOK.exe
  C:\Windows\System\DxujVOK.exe
  2⤵
  PID:10588
- C:\Windows\System\AxlXBLE.exe
  C:\Windows\System\AxlXBLE.exe
  2⤵
  PID:10624
- C:\Windows\System\rvAQacJ.exe
  C:\Windows\System\rvAQacJ.exe
  2⤵
  PID:10648
- C:\Windows\System\tvEQxeL.exe
  C:\Windows\System\tvEQxeL.exe
  2⤵
  PID:10680
- C:\Windows\System\dDrdGEf.exe
  C:\Windows\System\dDrdGEf.exe
  2⤵
  PID:10704
- C:\Windows\System\ROjNrmN.exe
  C:\Windows\System\ROjNrmN.exe
  2⤵
  PID:10732
- C:\Windows\System\DfQRSnZ.exe
  C:\Windows\System\DfQRSnZ.exe
  2⤵
  PID:10760
- C:\Windows\System\AvOLOBo.exe
  C:\Windows\System\AvOLOBo.exe
  2⤵
  PID:10784
- C:\Windows\System\QyeUpjx.exe
  C:\Windows\System\QyeUpjx.exe
  2⤵
  PID:10816
- C:\Windows\System\NYONhUJ.exe
  C:\Windows\System\NYONhUJ.exe
  2⤵
  PID:10844
- C:\Windows\System\JtnBGpE.exe
  C:\Windows\System\JtnBGpE.exe
  2⤵
  PID:10872
- C:\Windows\System\rbbBGXs.exe
  C:\Windows\System\rbbBGXs.exe
  2⤵
  PID:10896
- C:\Windows\System\paPNGgV.exe
  C:\Windows\System\paPNGgV.exe
  2⤵
  PID:10920
- C:\Windows\System\EljXkWA.exe
  C:\Windows\System\EljXkWA.exe
  2⤵
  PID:10956
- C:\Windows\System\WZZTCxe.exe
  C:\Windows\System\WZZTCxe.exe
  2⤵
  PID:10984
- C:\Windows\System\AySSIPE.exe
  C:\Windows\System\AySSIPE.exe
  2⤵
  PID:11016
- C:\Windows\System\BAPzehv.exe
  C:\Windows\System\BAPzehv.exe
  2⤵
  PID:11040
- C:\Windows\System\btsppGf.exe
  C:\Windows\System\btsppGf.exe
  2⤵
  PID:11064
- C:\Windows\System\Jcpquos.exe
  C:\Windows\System\Jcpquos.exe
  2⤵
  PID:11088
- C:\Windows\System\RFmryPl.exe
  C:\Windows\System\RFmryPl.exe
  2⤵
  PID:11112
- C:\Windows\System\khVjLEC.exe
  C:\Windows\System\khVjLEC.exe
  2⤵
  PID:11140
- C:\Windows\System\gYIasqf.exe
  C:\Windows\System\gYIasqf.exe
  2⤵
  PID:11168
- C:\Windows\System\vIxjWtF.exe
  C:\Windows\System\vIxjWtF.exe
  2⤵
  PID:11196
- C:\Windows\System\NUIyGqf.exe
  C:\Windows\System\NUIyGqf.exe
  2⤵
  PID:11216
- C:\Windows\System\kjZwgdZ.exe
  C:\Windows\System\kjZwgdZ.exe
  2⤵
  PID:11244
- C:\Windows\System\ibXhbPt.exe
  C:\Windows\System\ibXhbPt.exe
  2⤵
  PID:9436
- C:\Windows\System\lfyTXOK.exe
  C:\Windows\System\lfyTXOK.exe
  2⤵
  PID:10072
- C:\Windows\System\TEDRhNA.exe
  C:\Windows\System\TEDRhNA.exe
  2⤵
  PID:9624
- C:\Windows\System\ACgKbbm.exe
  C:\Windows\System\ACgKbbm.exe
  2⤵
  PID:8908
- C:\Windows\System\gojbnTg.exe
  C:\Windows\System\gojbnTg.exe
  2⤵
  PID:9372
- C:\Windows\System\nKPkVbQ.exe
  C:\Windows\System\nKPkVbQ.exe
  2⤵
  PID:10292
- C:\Windows\System\hpqHwRH.exe
  C:\Windows\System\hpqHwRH.exe
  2⤵
  PID:10056
- C:\Windows\System\fOcfiIK.exe
  C:\Windows\System\fOcfiIK.exe
  2⤵
  PID:9460
- C:\Windows\System\vHBLaum.exe
  C:\Windows\System\vHBLaum.exe
  2⤵
  PID:9904
- C:\Windows\System\VHXATNt.exe
  C:\Windows\System\VHXATNt.exe
  2⤵
  PID:10584
- C:\Windows\System\GiTfzwI.exe
  C:\Windows\System\GiTfzwI.exe
  2⤵
  PID:10616
- C:\Windows\System\HcwKUKX.exe
  C:\Windows\System\HcwKUKX.exe
  2⤵
  PID:10312
- C:\Windows\System\TihlwDN.exe
  C:\Windows\System\TihlwDN.exe
  2⤵
  PID:10672
- C:\Windows\System\xCVPdOM.exe
  C:\Windows\System\xCVPdOM.exe
  2⤵
  PID:10772
- C:\Windows\System\DuZwgqu.exe
  C:\Windows\System\DuZwgqu.exe
  2⤵
  PID:10188
- C:\Windows\System\yxTtZXi.exe
  C:\Windows\System\yxTtZXi.exe
  2⤵
  PID:10828
- C:\Windows\System\fHceQMc.exe
  C:\Windows\System\fHceQMc.exe
  2⤵
  PID:10884
- C:\Windows\System\LKgvNso.exe
  C:\Windows\System\LKgvNso.exe
  2⤵
  PID:10700
- C:\Windows\System\ZBvgQDP.exe
  C:\Windows\System\ZBvgQDP.exe
  2⤵
  PID:10492
- C:\Windows\System\KAmuxIT.exe
  C:\Windows\System\KAmuxIT.exe
  2⤵
  PID:11128
- C:\Windows\System\BAaoRtK.exe
  C:\Windows\System\BAaoRtK.exe
  2⤵
  PID:10716
- C:\Windows\System\LNVOzBP.exe
  C:\Windows\System\LNVOzBP.exe
  2⤵
  PID:9776
- C:\Windows\System\ROUObTJ.exe
  C:\Windows\System\ROUObTJ.exe
  2⤵
  PID:11056
- C:\Windows\System\BTSTMez.exe
  C:\Windows\System\BTSTMez.exe
  2⤵
  PID:11080
- C:\Windows\System\VGnpvlb.exe
  C:\Windows\System\VGnpvlb.exe
  2⤵
  PID:9708
- C:\Windows\System\CWyjAvZ.exe
  C:\Windows\System\CWyjAvZ.exe
  2⤵
  PID:10132
- C:\Windows\System\bxkqufc.exe
  C:\Windows\System\bxkqufc.exe
  2⤵
  PID:10972
- C:\Windows\System\LWggfqb.exe
  C:\Windows\System\LWggfqb.exe
  2⤵
  PID:10664
- C:\Windows\System\CAoVGYb.exe
  C:\Windows\System\CAoVGYb.exe
  2⤵
  PID:11292
- C:\Windows\System\CnriIkF.exe
  C:\Windows\System\CnriIkF.exe
  2⤵
  PID:11312
- C:\Windows\System\aBIZHSm.exe
  C:\Windows\System\aBIZHSm.exe
  2⤵
  PID:11348
- C:\Windows\System\jdBISLc.exe
  C:\Windows\System\jdBISLc.exe
  2⤵
  PID:11376
- C:\Windows\System\UFWAcqA.exe
  C:\Windows\System\UFWAcqA.exe
  2⤵
  PID:11408
- C:\Windows\System\DssLnbX.exe
  C:\Windows\System\DssLnbX.exe
  2⤵
  PID:11440
- C:\Windows\System\xaJhpMs.exe
  C:\Windows\System\xaJhpMs.exe
  2⤵
  PID:11460
- C:\Windows\System\JNjMUrA.exe
  C:\Windows\System\JNjMUrA.exe
  2⤵
  PID:11484
- C:\Windows\System\vEuMPoJ.exe
  C:\Windows\System\vEuMPoJ.exe
  2⤵
  PID:11508
- C:\Windows\System\gkbgHtA.exe
  C:\Windows\System\gkbgHtA.exe
  2⤵
  PID:11540
- C:\Windows\System\SiIzzGL.exe
  C:\Windows\System\SiIzzGL.exe
  2⤵
  PID:11580
- C:\Windows\System\qmPKHTF.exe
  C:\Windows\System\qmPKHTF.exe
  2⤵
  PID:11600
- C:\Windows\System\iJCAKNj.exe
  C:\Windows\System\iJCAKNj.exe
  2⤵
  PID:11616
- C:\Windows\System\CrOWXzA.exe
  C:\Windows\System\CrOWXzA.exe
  2⤵
  PID:11640
- C:\Windows\System\tSbwccd.exe
  C:\Windows\System\tSbwccd.exe
  2⤵
  PID:11664
- C:\Windows\System\bjDtiHg.exe
  C:\Windows\System\bjDtiHg.exe
  2⤵
  PID:11692
- C:\Windows\System\ZPofUkn.exe
  C:\Windows\System\ZPofUkn.exe
  2⤵
  PID:11720
- C:\Windows\System\mLOsifM.exe
  C:\Windows\System\mLOsifM.exe
  2⤵
  PID:11744
- C:\Windows\System\xDrPAvm.exe
  C:\Windows\System\xDrPAvm.exe
  2⤵
  PID:11768
- C:\Windows\System\tXBDwme.exe
  C:\Windows\System\tXBDwme.exe
  2⤵
  PID:11792
- C:\Windows\System\HxFYfbM.exe
  C:\Windows\System\HxFYfbM.exe
  2⤵
  PID:11820
- C:\Windows\System\botizzu.exe
  C:\Windows\System\botizzu.exe
  2⤵
  PID:11836
- C:\Windows\System\CtusNFs.exe
  C:\Windows\System\CtusNFs.exe
  2⤵
  PID:11876
- C:\Windows\System\DeyMORI.exe
  C:\Windows\System\DeyMORI.exe
  2⤵
  PID:11900
- C:\Windows\System\PujlmNU.exe
  C:\Windows\System\PujlmNU.exe
  2⤵
  PID:11928
- C:\Windows\System\RCxZHmn.exe
  C:\Windows\System\RCxZHmn.exe
  2⤵
  PID:11976
- C:\Windows\System\UQJiOUb.exe
  C:\Windows\System\UQJiOUb.exe
  2⤵
  PID:12000
- C:\Windows\System\lHBMMJV.exe
  C:\Windows\System\lHBMMJV.exe
  2⤵
  PID:12024
- C:\Windows\System\TPSbPXy.exe
  C:\Windows\System\TPSbPXy.exe
  2⤵
  PID:12056
- C:\Windows\System\gnkeiar.exe
  C:\Windows\System\gnkeiar.exe
  2⤵
  PID:12080
- C:\Windows\System\EJVdXEE.exe
  C:\Windows\System\EJVdXEE.exe
  2⤵
  PID:12108
- C:\Windows\System\XCPQmRz.exe
  C:\Windows\System\XCPQmRz.exe
  2⤵
  PID:12136
- C:\Windows\System\OEDnmIt.exe
  C:\Windows\System\OEDnmIt.exe
  2⤵
  PID:12160
- C:\Windows\System\igbJNBY.exe
  C:\Windows\System\igbJNBY.exe
  2⤵
  PID:12176
- C:\Windows\System\bmTHALd.exe
  C:\Windows\System\bmTHALd.exe
  2⤵
  PID:12208
- C:\Windows\System\JiwcNxl.exe
  C:\Windows\System\JiwcNxl.exe
  2⤵
  PID:12228
- C:\Windows\System\zzByHBy.exe
  C:\Windows\System\zzByHBy.exe
  2⤵
  PID:12256
- C:\Windows\System\oaNrUEg.exe
  C:\Windows\System\oaNrUEg.exe
  2⤵
  PID:12276
- C:\Windows\System\YDMIVXd.exe
  C:\Windows\System\YDMIVXd.exe
  2⤵
  PID:10440
- C:\Windows\System\JXiUCUs.exe
  C:\Windows\System\JXiUCUs.exe
  2⤵
  PID:11032
- C:\Windows\System\FRNWBbh.exe
  C:\Windows\System\FRNWBbh.exe
  2⤵
  PID:11028
- C:\Windows\System\rEUeCaA.exe
  C:\Windows\System\rEUeCaA.exe
  2⤵
  PID:10932
- C:\Windows\System\bAenxrx.exe
  C:\Windows\System\bAenxrx.exe
  2⤵
  PID:10580
- C:\Windows\System\JOgDlSZ.exe
  C:\Windows\System\JOgDlSZ.exe
  2⤵
  PID:11076
- C:\Windows\System\jcEkGaM.exe
  C:\Windows\System\jcEkGaM.exe
  2⤵
  PID:11276
- C:\Windows\System\rmNAYPB.exe
  C:\Windows\System\rmNAYPB.exe
  2⤵
  PID:10556
- C:\Windows\System\TWwTgwc.exe
  C:\Windows\System\TWwTgwc.exe
  2⤵
  PID:11400
- C:\Windows\System\dLFcgqa.exe
  C:\Windows\System\dLFcgqa.exe
  2⤵
  PID:11436
- C:\Windows\System\ksgvXjZ.exe
  C:\Windows\System\ksgvXjZ.exe
  2⤵
  PID:11496
- C:\Windows\System\qwOzRRn.exe
  C:\Windows\System\qwOzRRn.exe
  2⤵
  PID:11560
- C:\Windows\System\SbgMxrr.exe
  C:\Windows\System\SbgMxrr.exe
  2⤵
  PID:11680
- C:\Windows\System\hTMPhnJ.exe
  C:\Windows\System\hTMPhnJ.exe
  2⤵
  PID:11336
- C:\Windows\System\dYPgHMl.exe
  C:\Windows\System\dYPgHMl.exe
  2⤵
  PID:11788
- C:\Windows\System\OifbMAI.exe
  C:\Windows\System\OifbMAI.exe
  2⤵
  PID:11004
- C:\Windows\System\SqBAPMr.exe
  C:\Windows\System\SqBAPMr.exe
  2⤵
  PID:11920
- C:\Windows\System\pWDFAvx.exe
  C:\Windows\System\pWDFAvx.exe
  2⤵
  PID:11564
- C:\Windows\System\XYOUGQX.exe
  C:\Windows\System\XYOUGQX.exe
  2⤵
  PID:10968
- C:\Windows\System\COtyebN.exe
  C:\Windows\System\COtyebN.exe
  2⤵
  PID:11652
- C:\Windows\System\xYfnWwF.exe
  C:\Windows\System\xYfnWwF.exe
  2⤵
  PID:11708
- C:\Windows\System\UdLVWKC.exe
  C:\Windows\System\UdLVWKC.exe
  2⤵
  PID:12188
- C:\Windows\System\wGFDcsi.exe
  C:\Windows\System\wGFDcsi.exe
  2⤵
  PID:11888
- C:\Windows\System\BsAQEBF.exe
  C:\Windows\System\BsAQEBF.exe
  2⤵
  PID:11520
- C:\Windows\System\QGlXpNS.exe
  C:\Windows\System\QGlXpNS.exe
  2⤵
  PID:9952
- C:\Windows\System\iquSPIG.exe
  C:\Windows\System\iquSPIG.exe
  2⤵
  PID:12016
- C:\Windows\System\RBEhKsM.exe
  C:\Windows\System\RBEhKsM.exe
  2⤵
  PID:11268
- C:\Windows\System\zCkxaYu.exe
  C:\Windows\System\zCkxaYu.exe
  2⤵
  PID:10868
- C:\Windows\System\GcquUFk.exe
  C:\Windows\System\GcquUFk.exe
  2⤵
  PID:11856
- C:\Windows\System\ZAWPdFy.exe
  C:\Windows\System\ZAWPdFy.exe
  2⤵
  PID:12312
- C:\Windows\System\lQEUNtD.exe
  C:\Windows\System\lQEUNtD.exe
  2⤵
  PID:12344
- C:\Windows\System\ccFWGab.exe
  C:\Windows\System\ccFWGab.exe
  2⤵
  PID:12368
- C:\Windows\System\RDBdRuF.exe
  C:\Windows\System\RDBdRuF.exe
  2⤵
  PID:12396
- C:\Windows\System\pfFCKfp.exe
  C:\Windows\System\pfFCKfp.exe
  2⤵
  PID:12424
- C:\Windows\System\gFRkNsD.exe
  C:\Windows\System\gFRkNsD.exe
  2⤵
  PID:12448
- C:\Windows\System\wOQptgq.exe
  C:\Windows\System\wOQptgq.exe
  2⤵
  PID:12480
- C:\Windows\System\XxEVaha.exe
  C:\Windows\System\XxEVaha.exe
  2⤵
  PID:12500
- C:\Windows\System\bFnrWoV.exe
  C:\Windows\System\bFnrWoV.exe
  2⤵
  PID:12528
- C:\Windows\System\QBrNuZc.exe
  C:\Windows\System\QBrNuZc.exe
  2⤵
  PID:12552
- C:\Windows\System\jxoTcyE.exe
  C:\Windows\System\jxoTcyE.exe
  2⤵
  PID:12588
- C:\Windows\System\DPxIDiv.exe
  C:\Windows\System\DPxIDiv.exe
  2⤵
  PID:12612
- C:\Windows\System\JCFdXAF.exe
  C:\Windows\System\JCFdXAF.exe
  2⤵
  PID:12632
- C:\Windows\System\kqNYaeO.exe
  C:\Windows\System\kqNYaeO.exe
  2⤵
  PID:12652
- C:\Windows\System\NAJNpRj.exe
  C:\Windows\System\NAJNpRj.exe
  2⤵
  PID:12684
- C:\Windows\System\KzZTDTW.exe
  C:\Windows\System\KzZTDTW.exe
  2⤵
  PID:12712
- C:\Windows\System\tOoRufM.exe
  C:\Windows\System\tOoRufM.exe
  2⤵
  PID:12736
- C:\Windows\System\hlwEkwD.exe
  C:\Windows\System\hlwEkwD.exe
  2⤵
  PID:12764
- C:\Windows\System\rtKBZwB.exe
  C:\Windows\System\rtKBZwB.exe
  2⤵
  PID:12796
- C:\Windows\System\jRjqIeN.exe
  C:\Windows\System\jRjqIeN.exe
  2⤵
  PID:12820
- C:\Windows\System\RSJKdLK.exe
  C:\Windows\System\RSJKdLK.exe
  2⤵
  PID:12840
- C:\Windows\System\cVOaXLx.exe
  C:\Windows\System\cVOaXLx.exe
  2⤵
  PID:12860
- C:\Windows\System\gPavHYe.exe
  C:\Windows\System\gPavHYe.exe
  2⤵
  PID:12896
- C:\Windows\System\YdUSaTQ.exe
  C:\Windows\System\YdUSaTQ.exe
  2⤵
  PID:12920
- C:\Windows\System\WoqnmlE.exe
  C:\Windows\System\WoqnmlE.exe
  2⤵
  PID:12944
- C:\Windows\System\DYKSrJQ.exe
  C:\Windows\System\DYKSrJQ.exe
  2⤵
  PID:12960
- C:\Windows\System\uIiQuvO.exe
  C:\Windows\System\uIiQuvO.exe
  2⤵
  PID:12980
- C:\Windows\System\aIbNwUF.exe
  C:\Windows\System\aIbNwUF.exe
  2⤵
  PID:13008
- C:\Windows\System\uWyADrf.exe
  C:\Windows\System\uWyADrf.exe
  2⤵
  PID:13032
- C:\Windows\System\qupKjuY.exe
  C:\Windows\System\qupKjuY.exe
  2⤵
  PID:13052
- C:\Windows\System\JIShWXB.exe
  C:\Windows\System\JIShWXB.exe
  2⤵
  PID:13084
- C:\Windows\System\zwjdQNS.exe
  C:\Windows\System\zwjdQNS.exe
  2⤵
  PID:13116
- C:\Windows\System\sHSWNhB.exe
  C:\Windows\System\sHSWNhB.exe
  2⤵
  PID:13136
- C:\Windows\System\waLduBr.exe
  C:\Windows\System\waLduBr.exe
  2⤵
  PID:13160
- C:\Windows\System\iSAtqqf.exe
  C:\Windows\System\iSAtqqf.exe
  2⤵
  PID:13188
- C:\Windows\System\wTMlliT.exe
  C:\Windows\System\wTMlliT.exe
  2⤵
  PID:13208
- C:\Windows\System\jHeGHiY.exe
  C:\Windows\System\jHeGHiY.exe
  2⤵
  PID:13232
- C:\Windows\System\NZnWXOD.exe
  C:\Windows\System\NZnWXOD.exe
  2⤵
  PID:13256
- C:\Windows\System\razBdOM.exe
  C:\Windows\System\razBdOM.exe
  2⤵
  PID:13276
- C:\Windows\System\UaHTFTu.exe
  C:\Windows\System\UaHTFTu.exe
  2⤵
  PID:13304
- C:\Windows\System\hXbqcbu.exe
  C:\Windows\System\hXbqcbu.exe
  2⤵
  PID:11428
- C:\Windows\System\fqoKlJB.exe
  C:\Windows\System\fqoKlJB.exe
  2⤵
  PID:10432
- C:\Windows\System\vjKWBuq.exe
  C:\Windows\System\vjKWBuq.exe
  2⤵
  PID:11732
- C:\Windows\System\WTgCpsN.exe
  C:\Windows\System\WTgCpsN.exe
  2⤵
  PID:9804
- C:\Windows\System\LynXfks.exe
  C:\Windows\System\LynXfks.exe
  2⤵
  PID:11060
- C:\Windows\System\UbunrrP.exe
  C:\Windows\System\UbunrrP.exe
  2⤵
  PID:11304
- C:\Windows\System\zicAWdF.exe
  C:\Windows\System\zicAWdF.exe
  2⤵
  PID:12376
- C:\Windows\System\xlxEDqz.exe
  C:\Windows\System\xlxEDqz.exe
  2⤵
  PID:12464
- C:\Windows\System\JjFYiju.exe
  C:\Windows\System\JjFYiju.exe
  2⤵
  PID:10552
- C:\Windows\System\HIgKtWd.exe
  C:\Windows\System\HIgKtWd.exe
  2⤵
  PID:12604
- C:\Windows\System\sLNBgrt.exe
  C:\Windows\System\sLNBgrt.exe
  2⤵
  PID:12072
- C:\Windows\System\qlyXTpp.exe
  C:\Windows\System\qlyXTpp.exe
  2⤵
  PID:12748
- C:\Windows\System\NwZMOkK.exe
  C:\Windows\System\NwZMOkK.exe
  2⤵
  PID:12792
- C:\Windows\System\HCUjUaA.exe
  C:\Windows\System\HCUjUaA.exe
  2⤵
  PID:1956
- C:\Windows\System\NXrXLWG.exe
  C:\Windows\System\NXrXLWG.exe
  2⤵
  PID:11996
- C:\Windows\System\GdfODTI.exe
  C:\Windows\System\GdfODTI.exe
  2⤵
  PID:12524
- C:\Windows\System\cQsWIyK.exe
  C:\Windows\System\cQsWIyK.exe
  2⤵
  PID:12564
- C:\Windows\System\iyHLbFo.exe
  C:\Windows\System\iyHLbFo.exe
  2⤵
  PID:12676
- C:\Windows\System\BLmQUSF.exe
  C:\Windows\System\BLmQUSF.exe
  2⤵
  PID:11780
- C:\Windows\System\SNsWIjJ.exe
  C:\Windows\System\SNsWIjJ.exe
  2⤵
  PID:13272
- C:\Windows\System\lKuSFXc.exe
  C:\Windows\System\lKuSFXc.exe
  2⤵
  PID:12380
- C:\Windows\System\aggIyIC.exe
  C:\Windows\System\aggIyIC.exe
  2⤵
  PID:11204
- C:\Windows\System\wrapiYP.exe
  C:\Windows\System\wrapiYP.exe
  2⤵
  PID:12908
- C:\Windows\System\YoRwnLp.exe
  C:\Windows\System\YoRwnLp.exe
  2⤵
  PID:12936
- C:\Windows\System\BNKRrSt.exe
  C:\Windows\System\BNKRrSt.exe
  2⤵
  PID:12988
- C:\Windows\System\jsnYYqN.exe
  C:\Windows\System\jsnYYqN.exe
  2⤵
  PID:12488
- C:\Windows\System\nJJXyCp.exe
  C:\Windows\System\nJJXyCp.exe
  2⤵
  PID:13324
- C:\Windows\System\QCVEZMg.exe
  C:\Windows\System\QCVEZMg.exe
  2⤵
  PID:13348
- C:\Windows\System\ZRbISIl.exe
  C:\Windows\System\ZRbISIl.exe
  2⤵
  PID:13376
- C:\Windows\System\yLyWwTR.exe
  C:\Windows\System\yLyWwTR.exe
  2⤵
  PID:13408
- C:\Windows\System\oMfqhhH.exe
  C:\Windows\System\oMfqhhH.exe
  2⤵
  PID:13436
- C:\Windows\System\dXpgKlB.exe
  C:\Windows\System\dXpgKlB.exe
  2⤵
  PID:13464
- C:\Windows\System\upyvVhn.exe
  C:\Windows\System\upyvVhn.exe
  2⤵
  PID:13496
- C:\Windows\System\HgGXcqx.exe
  C:\Windows\System\HgGXcqx.exe
  2⤵
  PID:13532
- C:\Windows\System\HdJSBsu.exe
  C:\Windows\System\HdJSBsu.exe
  2⤵
  PID:13552
- C:\Windows\System\TdPdyon.exe
  C:\Windows\System\TdPdyon.exe
  2⤵
  PID:13584
- C:\Windows\System\zZMXvTg.exe
  C:\Windows\System\zZMXvTg.exe
  2⤵
  PID:13620
- C:\Windows\System\QqUofrC.exe
  C:\Windows\System\QqUofrC.exe
  2⤵
  PID:13648
- C:\Windows\System\IHBOFMA.exe
  C:\Windows\System\IHBOFMA.exe
  2⤵
  PID:13672
- C:\Windows\System\bCEUVIu.exe
  C:\Windows\System\bCEUVIu.exe
  2⤵
  PID:13692
- C:\Windows\System\yjSVBNb.exe
  C:\Windows\System\yjSVBNb.exe
  2⤵
  PID:13724
- C:\Windows\System\ARVdbKx.exe
  C:\Windows\System\ARVdbKx.exe
  2⤵
  PID:13752
- C:\Windows\System\BYxfSRh.exe
  C:\Windows\System\BYxfSRh.exe
  2⤵
  PID:13772
- C:\Windows\System\WmsObTn.exe
  C:\Windows\System\WmsObTn.exe
  2⤵
  PID:13792
- C:\Windows\System\HOeiqqS.exe
  C:\Windows\System\HOeiqqS.exe
  2⤵
  PID:13812
- C:\Windows\System\vCQOEiT.exe
  C:\Windows\System\vCQOEiT.exe
  2⤵
  PID:13840
- C:\Windows\System\bDoupNF.exe
  C:\Windows\System\bDoupNF.exe
  2⤵
  PID:13868
- C:\Windows\System\pXlTMXg.exe
  C:\Windows\System\pXlTMXg.exe
  2⤵
  PID:13888
- C:\Windows\System\yKGRMVN.exe
  C:\Windows\System\yKGRMVN.exe
  2⤵
  PID:13916
- C:\Windows\System\YivphZy.exe
  C:\Windows\System\YivphZy.exe
  2⤵
  PID:13948
- C:\Windows\System\uSsuaUj.exe
  C:\Windows\System\uSsuaUj.exe
  2⤵
  PID:13964
- C:\Windows\System\trQvhXf.exe
  C:\Windows\System\trQvhXf.exe
  2⤵
  PID:13992
- C:\Windows\System\Beuaqzf.exe
  C:\Windows\System\Beuaqzf.exe
  2⤵
  PID:14024
- C:\Windows\System\EGiVRLt.exe
  C:\Windows\System\EGiVRLt.exe
  2⤵
  PID:14044
- C:\Windows\System\wMrlhnd.exe
  C:\Windows\System\wMrlhnd.exe
  2⤵
  PID:14068
- C:\Windows\System\alNTqxf.exe
  C:\Windows\System\alNTqxf.exe
  2⤵
  PID:13340
- C:\Windows\System\hxMDmMr.exe
  C:\Windows\System\hxMDmMr.exe
  2⤵
  PID:12972
- C:\Windows\System\xJHrabC.exe
  C:\Windows\System\xJHrabC.exe
  2⤵
  PID:13940
- C:\Windows\System\GUZmHff.exe
  C:\Windows\System\GUZmHff.exe
  2⤵
  PID:13428
- C:\Windows\System\hEUZWbu.exe
  C:\Windows\System\hEUZWbu.exe
  2⤵
  PID:12444
- C:\Windows\System\xaPpaus.exe
  C:\Windows\System\xaPpaus.exe
  2⤵
  PID:12756
- C:\Windows\System\PWcWKtS.exe
  C:\Windows\System\PWcWKtS.exe
  2⤵
  PID:13852
- C:\Windows\System\zkyAary.exe
  C:\Windows\System\zkyAary.exe
  2⤵
  PID:14016
- C:\Windows\System\ZgJIzga.exe
  C:\Windows\System\ZgJIzga.exe
  2⤵
  PID:13420
- C:\Windows\System\AKWITzQ.exe
  C:\Windows\System\AKWITzQ.exe
  2⤵
  PID:13600
- C:\Windows\System\knpZitF.exe
  C:\Windows\System\knpZitF.exe
  2⤵
  PID:14276
- C:\Windows\System\SNjTPHM.exe
  C:\Windows\System\SNjTPHM.exe
  2⤵
  PID:13960
- C:\Windows\System\vGvLujf.exe
  C:\Windows\System\vGvLujf.exe
  2⤵
  PID:14100
- C:\Windows\System\hZSfMcp.exe
  C:\Windows\System\hZSfMcp.exe
  2⤵
  PID:13044
- C:\Windows\System\KMjerWB.exe
  C:\Windows\System\KMjerWB.exe
  2⤵
  PID:12244
- C:\Windows\System\UoaFWrS.exe
  C:\Windows\System\UoaFWrS.exe
  2⤵
  PID:11524
- C:\Windows\System\IyCOMuT.exe
  C:\Windows\System\IyCOMuT.exe
  2⤵
  PID:13664
- C:\Windows\System\kNEIfCc.exe
  C:\Windows\System\kNEIfCc.exe
  2⤵
  PID:13980
- C:\Windows\System\aIddxVp.exe
  C:\Windows\System\aIddxVp.exe
  2⤵
  PID:13824
- C:\Windows\System\LHnTfKM.exe
  C:\Windows\System\LHnTfKM.exe
  2⤵
  PID:13184
- C:\Windows\System\pNytCOD.exe
  C:\Windows\System\pNytCOD.exe
  2⤵
  PID:13800
- C:\Windows\System\FpAAROG.exe
  C:\Windows\System\FpAAROG.exe
  2⤵
  PID:12720
- C:\Windows\System\xyuMlML.exe
  C:\Windows\System\xyuMlML.exe
  2⤵
  PID:12360
- C:\Windows\System\UztVtfH.exe
  C:\Windows\System\UztVtfH.exe
  2⤵
  PID:14268
- C:\Windows\System\KSopaUW.exe
  C:\Windows\System\KSopaUW.exe
  2⤵
  PID:14064
- C:\Windows\System\fmjZyej.exe
  C:\Windows\System\fmjZyej.exe
  2⤵
  PID:12704
- C:\Windows\System\JQzWRsZ.exe
  C:\Windows\System\JQzWRsZ.exe
  2⤵
  PID:13708
- C:\Windows\System\EIHCMua.exe
  C:\Windows\System\EIHCMua.exe
  2⤵
  PID:12548
- C:\Windows\System\byvMPwC.exe
  C:\Windows\System\byvMPwC.exe
  2⤵
  PID:12436
- C:\Windows\System\ZWatpEl.exe
  C:\Windows\System\ZWatpEl.exe
  2⤵
  PID:13712
- C:\Windows\System\hcfFRDd.exe
  C:\Windows\System\hcfFRDd.exe
  2⤵
  PID:14344
- C:\Windows\System\txNNQfX.exe
  C:\Windows\System\txNNQfX.exe
  2⤵
  PID:14364
- C:\Windows\System\pCNSRBJ.exe
  C:\Windows\System\pCNSRBJ.exe
  2⤵
  PID:14396
- C:\Windows\System\XIBRurB.exe
  C:\Windows\System\XIBRurB.exe
  2⤵
  PID:14424
- C:\Windows\System\oiIZyse.exe
  C:\Windows\System\oiIZyse.exe
  2⤵
  PID:14452
- C:\Windows\System\YoYbZdH.exe
  C:\Windows\System\YoYbZdH.exe
  2⤵
  PID:14476
- C:\Windows\System\lawZymU.exe
  C:\Windows\System\lawZymU.exe
  2⤵
  PID:14496
- C:\Windows\System\diGrAPY.exe
  C:\Windows\System\diGrAPY.exe
  2⤵
  PID:14532
- C:\Windows\System\LfDmOGd.exe
  C:\Windows\System\LfDmOGd.exe
  2⤵
  PID:14556
- C:\Windows\System\UlXXTMX.exe
  C:\Windows\System\UlXXTMX.exe
  2⤵
  PID:14580
- C:\Windows\System\KBAjpIS.exe
  C:\Windows\System\KBAjpIS.exe
  2⤵
  PID:14616
- C:\Windows\System\jjEmcNx.exe
  C:\Windows\System\jjEmcNx.exe
  2⤵
  PID:14632
- C:\Windows\System\FPGCQZZ.exe
  C:\Windows\System\FPGCQZZ.exe
  2⤵
  PID:14652
- C:\Windows\System\IaIsOlg.exe
  C:\Windows\System\IaIsOlg.exe
  2⤵
  PID:14676
- C:\Windows\System\FdTOddb.exe
  C:\Windows\System\FdTOddb.exe
  2⤵
  PID:14704
- C:\Windows\System\VvkoVjf.exe
  C:\Windows\System\VvkoVjf.exe
  2⤵
  PID:14736
- C:\Windows\System\bULKNIQ.exe
  C:\Windows\System\bULKNIQ.exe
  2⤵
  PID:14764
- C:\Windows\System\QHnrAll.exe
  C:\Windows\System\QHnrAll.exe
  2⤵
  PID:14780
- C:\Windows\System\QUUFkkp.exe
  C:\Windows\System\QUUFkkp.exe
  2⤵
  PID:14808
- C:\Windows\System\SlPAkOv.exe
  C:\Windows\System\SlPAkOv.exe
  2⤵
  PID:14840
- C:\Windows\System\eNfuDWO.exe
  C:\Windows\System\eNfuDWO.exe
  2⤵
  PID:14872
- C:\Windows\System\qkcogSC.exe
  C:\Windows\System\qkcogSC.exe
  2⤵
  PID:14896
- C:\Windows\System\HpodfLa.exe
  C:\Windows\System\HpodfLa.exe
  2⤵
  PID:14936
- C:\Windows\System\JNkqwAy.exe
  C:\Windows\System\JNkqwAy.exe
  2⤵
  PID:14960
- C:\Windows\System\VwagiHu.exe
  C:\Windows\System\VwagiHu.exe
  2⤵
  PID:14988
- C:\Windows\System\mbTKRaH.exe
  C:\Windows\System\mbTKRaH.exe
  2⤵
  PID:15016
- C:\Windows\System\BwKYYws.exe
  C:\Windows\System\BwKYYws.exe
  2⤵
  PID:15044
- C:\Windows\System\cWVBiQD.exe
  C:\Windows\System\cWVBiQD.exe
  2⤵
  PID:15080
- C:\Windows\System\gqypFiq.exe
  C:\Windows\System\gqypFiq.exe
  2⤵
  PID:15116
- C:\Windows\System\UxldzlN.exe
  C:\Windows\System\UxldzlN.exe
  2⤵
  PID:15136
- C:\Windows\System\fZRYqam.exe
  C:\Windows\System\fZRYqam.exe
  2⤵
  PID:15156
- C:\Windows\System\YNjAnZt.exe
  C:\Windows\System\YNjAnZt.exe
  2⤵
  PID:15172
- C:\Windows\System\VTjmXoy.exe
  C:\Windows\System\VTjmXoy.exe
  2⤵
  PID:15200
- C:\Windows\System\sXAiDAh.exe
  C:\Windows\System\sXAiDAh.exe
  2⤵
  PID:15232
- C:\Windows\System\ZVDBXDz.exe
  C:\Windows\System\ZVDBXDz.exe
  2⤵
  PID:15248
- C:\Windows\System\oItuLbt.exe
  C:\Windows\System\oItuLbt.exe
  2⤵
  PID:15264
- C:\Windows\System\TLwTwmB.exe
  C:\Windows\System\TLwTwmB.exe
  2⤵
  PID:15280
- C:\Windows\System\gsSVNwl.exe
  C:\Windows\System\gsSVNwl.exe
  2⤵
  PID:15308
- C:\Windows\System\FImIShq.exe
  C:\Windows\System\FImIShq.exe
  2⤵
  PID:15340
- C:\Windows\System\zhRQUEG.exe
  C:\Windows\System\zhRQUEG.exe
  2⤵
  PID:13372
- C:\Windows\System\fNtUZoH.exe
  C:\Windows\System\fNtUZoH.exe
  2⤵
  PID:13336
- C:\Windows\System\bJWchyo.exe
  C:\Windows\System\bJWchyo.exe
  2⤵
  PID:12916
- C:\Windows\System\LCUiijB.exe
  C:\Windows\System\LCUiijB.exe
  2⤵
  PID:14340
- C:\Windows\System\QXscaXz.exe
  C:\Windows\System\QXscaXz.exe
  2⤵
  PID:14408
- C:\Windows\System\gAgsBvw.exe
  C:\Windows\System\gAgsBvw.exe
  2⤵
  PID:14312
- C:\Windows\System\iBGSsxP.exe
  C:\Windows\System\iBGSsxP.exe
  2⤵
  PID:14360
- C:\Windows\System\bzdnjGa.exe
  C:\Windows\System\bzdnjGa.exe
  2⤵
  PID:14648
- C:\Windows\System\wvnvCFp.exe
  C:\Windows\System\wvnvCFp.exe
  2⤵
  PID:14484
- C:\Windows\System\yLwPfpp.exe
  C:\Windows\System\yLwPfpp.exe
  2⤵
  PID:14732
- C:\Windows\System\iBCDIfS.exe
  C:\Windows\System\iBCDIfS.exe
  2⤵
  PID:14804
- C:\Windows\System\HKZbPIR.exe
  C:\Windows\System\HKZbPIR.exe
  2⤵
  PID:14548
- C:\Windows\System\lUqqkxW.exe
  C:\Windows\System\lUqqkxW.exe
  2⤵
  PID:14856
- C:\Windows\System\orzAbNz.exe
  C:\Windows\System\orzAbNz.exe
  2⤵
  PID:15104
- C:\Windows\System\FYrDHxj.exe
  C:\Windows\System\FYrDHxj.exe
  2⤵
  PID:15168
- C:\Windows\System\FGNiNaL.exe
  C:\Windows\System\FGNiNaL.exe
  2⤵
  PID:14752
- C:\Windows\System\KWUhTua.exe
  C:\Windows\System\KWUhTua.exe
  2⤵
  PID:14792
- C:\Windows\System\CHXrTKq.exe
  C:\Windows\System\CHXrTKq.exe
  2⤵
  PID:14824
- C:\Windows\System\nnJrCaG.exe
  C:\Windows\System\nnJrCaG.exe
  2⤵
  PID:15092
- C:\Windows\System\TjvljnX.exe
  C:\Windows\System\TjvljnX.exe
  2⤵
  PID:13988
- C:\Windows\System\EVCrApV.exe
  C:\Windows\System\EVCrApV.exe
  2⤵
  PID:13656
- C:\Windows\System\bLQbwQB.exe
  C:\Windows\System\bLQbwQB.exe
  2⤵
  PID:14544
- C:\Windows\System\NGITxbZ.exe
  C:\Windows\System\NGITxbZ.exe
  2⤵
  PID:15380
- C:\Windows\System\KcRMuNT.exe
  C:\Windows\System\KcRMuNT.exe
  2⤵
  PID:15404
- C:\Windows\System\YhAyASF.exe
  C:\Windows\System\YhAyASF.exe
  2⤵
  PID:15448
- C:\Windows\System\fyxelqd.exe
  C:\Windows\System\fyxelqd.exe
  2⤵
  PID:15480
- C:\Windows\System\zmhexfC.exe
  C:\Windows\System\zmhexfC.exe
  2⤵
  PID:15504
- C:\Windows\System\mBmBIWk.exe
  C:\Windows\System\mBmBIWk.exe
  2⤵
  PID:15532
- C:\Windows\System\ARrgBYT.exe
  C:\Windows\System\ARrgBYT.exe
  2⤵
  PID:15560
- C:\Windows\System\pctvhcz.exe
  C:\Windows\System\pctvhcz.exe
  2⤵
  PID:15588
- C:\Windows\System\TYqORLj.exe
  C:\Windows\System\TYqORLj.exe
  2⤵
  PID:15616
- C:\Windows\System\PUiVGHB.exe
  C:\Windows\System\PUiVGHB.exe
  2⤵
  PID:15644
- C:\Windows\System\BPHjgLS.exe
  C:\Windows\System\BPHjgLS.exe
  2⤵
  PID:15668
- C:\Windows\System\aoayhEO.exe
  C:\Windows\System\aoayhEO.exe
  2⤵
  PID:15696
- C:\Windows\System\IGQyogC.exe
  C:\Windows\System\IGQyogC.exe
  2⤵
  PID:15712
- C:\Windows\System\wnnnmAL.exe
  C:\Windows\System\wnnnmAL.exe
  2⤵
  PID:15732
- C:\Windows\System\WOqMTBJ.exe
  C:\Windows\System\WOqMTBJ.exe
  2⤵
  PID:15764
- C:\Windows\System\ohzKaSv.exe
  C:\Windows\System\ohzKaSv.exe
  2⤵
  PID:15784
- C:\Windows\System\oxLxgSU.exe
  C:\Windows\System\oxLxgSU.exe
  2⤵
  PID:15800
- C:\Windows\System\hjLlMeh.exe
  C:\Windows\System\hjLlMeh.exe
  2⤵
  PID:15816
- C:\Windows\System\olZPBVR.exe
  C:\Windows\System\olZPBVR.exe
  2⤵
  PID:15836
- C:\Windows\System\cYtfnRy.exe
  C:\Windows\System\cYtfnRy.exe
  2⤵
  PID:15864
- C:\Windows\System\zCxdhYp.exe
  C:\Windows\System\zCxdhYp.exe
  2⤵
  PID:15900
- C:\Windows\System\FfCQiND.exe
  C:\Windows\System\FfCQiND.exe
  2⤵
  PID:15924
- C:\Windows\System\cVrFnjl.exe
  C:\Windows\System\cVrFnjl.exe
  2⤵
  PID:15944
- C:\Windows\System\YwGYyjK.exe
  C:\Windows\System\YwGYyjK.exe
  2⤵
  PID:15968
- C:\Windows\System\kePTZbA.exe
  C:\Windows\System\kePTZbA.exe
  2⤵
  PID:15988
- C:\Windows\System\WdrvinO.exe
  C:\Windows\System\WdrvinO.exe
  2⤵
  PID:16004
- C:\Windows\System\PcjnhCN.exe
  C:\Windows\System\PcjnhCN.exe
  2⤵
  PID:16024
- C:\Windows\System\oIaZoFL.exe
  C:\Windows\System\oIaZoFL.exe
  2⤵
  PID:16056
- C:\Windows\System\lbsfXKY.exe
  C:\Windows\System\lbsfXKY.exe
  2⤵
  PID:16076
- C:\Windows\System\aURGTwe.exe
  C:\Windows\System\aURGTwe.exe
  2⤵
  PID:16100
- C:\Windows\System\XkjEcLS.exe
  C:\Windows\System\XkjEcLS.exe
  2⤵
  PID:16136
- C:\Windows\System\xPViIRW.exe
  C:\Windows\System\xPViIRW.exe
  2⤵
  PID:16164
- C:\Windows\System\MOswzpc.exe
  C:\Windows\System\MOswzpc.exe
  2⤵
  PID:16184
- C:\Windows\System\fYkwfhO.exe
  C:\Windows\System\fYkwfhO.exe
  2⤵
  PID:16212
- C:\Windows\System\UAZjjgj.exe
  C:\Windows\System\UAZjjgj.exe
  2⤵
  PID:16240
- C:\Windows\System\zqzRZFF.exe
  C:\Windows\System\zqzRZFF.exe
  2⤵
  PID:16272
- C:\Windows\System\XGDbWrn.exe
  C:\Windows\System\XGDbWrn.exe
  2⤵
  PID:16296
- C:\Windows\System\gpjdtqt.exe
  C:\Windows\System\gpjdtqt.exe
  2⤵
  PID:16316
- C:\Windows\System\KdkRouF.exe
  C:\Windows\System\KdkRouF.exe
  2⤵
  PID:16336
- C:\Windows\System\QSbbpjD.exe
  C:\Windows\System\QSbbpjD.exe
  2⤵
  PID:16380
- C:\Windows\System\kharaEP.exe
  C:\Windows\System\kharaEP.exe
  2⤵
  PID:13364
- C:\Windows\System\rpUJyab.exe
  C:\Windows\System\rpUJyab.exe
  2⤵
  PID:15328
- C:\Windows\System\GcgAzTU.exe
  C:\Windows\System\GcgAzTU.exe
  2⤵
  PID:15144
- C:\Windows\System\pNgUHGk.exe
  C:\Windows\System\pNgUHGk.exe
  2⤵
  PID:13700
- C:\Windows\System\XlURfbV.exe
  C:\Windows\System\XlURfbV.exe
  2⤵
  PID:14920
- C:\Windows\System\dMcUcMU.exe
  C:\Windows\System\dMcUcMU.exe
  2⤵
  PID:14908
- C:\Windows\System\mtpCdjz.exe
  C:\Windows\System\mtpCdjz.exe
  2⤵
  PID:14748
- C:\Windows\System\FQvsCKT.exe
  C:\Windows\System\FQvsCKT.exe
  2⤵
  PID:10012
- C:\Windows\System\ZPlYBOf.exe
  C:\Windows\System\ZPlYBOf.exe
  2⤵
  PID:14952
- C:\Windows\System\YNiVIdT.exe
  C:\Windows\System\YNiVIdT.exe
  2⤵
  PID:15520
- C:\Windows\System\Wtkcrrl.exe
  C:\Windows\System\Wtkcrrl.exe
  2⤵
  PID:15068
- C:\Windows\System\AXjkfgS.exe
  C:\Windows\System\AXjkfgS.exe
  2⤵
  PID:15632
- C:\Windows\System\fODagUy.exe
  C:\Windows\System\fODagUy.exe
  2⤵
  PID:15148
- C:\Windows\System\ryZaMIT.exe
  C:\Windows\System\ryZaMIT.exe
  2⤵
  PID:15460
- C:\Windows\System\IMozlHD.exe
  C:\Windows\System\IMozlHD.exe
  2⤵
  PID:15556
- C:\Windows\System\Puasvkt.exe
  C:\Windows\System\Puasvkt.exe
  2⤵
  PID:15596
- C:\Windows\System\UGnlDnI.exe
  C:\Windows\System\UGnlDnI.exe
  2⤵
  PID:15920
- C:\Windows\System\nesktev.exe
  C:\Windows\System\nesktev.exe
  2⤵
  PID:15728
- C:\Windows\System\CvamboA.exe
  C:\Windows\System\CvamboA.exe
  2⤵
  PID:16048
- C:\Windows\System\wmflgfr.exe
  C:\Windows\System\wmflgfr.exe
  2⤵
  PID:15832
- C:\Windows\System\TjyehaF.exe
  C:\Windows\System\TjyehaF.exe
  2⤵
  PID:15856
- C:\Windows\System\DHOlPzL.exe
  C:\Windows\System\DHOlPzL.exe
  2⤵
  PID:15956
- C:\Windows\System\vJDziDR.exe
  C:\Windows\System\vJDziDR.exe
  2⤵
  PID:15776
- C:\Windows\System\OFlQSqk.exe
  C:\Windows\System\OFlQSqk.exe
  2⤵
  PID:16068
- C:\Windows\System\AWrLlDo.exe
  C:\Windows\System\AWrLlDo.exe
  2⤵
  PID:15424
- C:\Windows\System\zYaDlmG.exe
  C:\Windows\System\zYaDlmG.exe
  2⤵
  PID:16392
- C:\Windows\System\ggbjYOQ.exe
  C:\Windows\System\ggbjYOQ.exe
  2⤵
  PID:16428
- C:\Windows\System\OmvglsK.exe
  C:\Windows\System\OmvglsK.exe
  2⤵
  PID:16448
- C:\Windows\System\sjesXJA.exe
  C:\Windows\System\sjesXJA.exe
  2⤵
  PID:16468
- C:\Windows\System\wvFVOgy.exe
  C:\Windows\System\wvFVOgy.exe
  2⤵
  PID:16496
- C:\Windows\System\KDQRIkp.exe
  C:\Windows\System\KDQRIkp.exe
  2⤵
  PID:16532
- C:\Windows\System\HGIFHCO.exe
  C:\Windows\System\HGIFHCO.exe
  2⤵
  PID:16548
- C:\Windows\System\IGcDZJw.exe
  C:\Windows\System\IGcDZJw.exe
  2⤵
  PID:16564
- C:\Windows\System\kgAsPYH.exe
  C:\Windows\System\kgAsPYH.exe
  2⤵
  PID:16596
- C:\Windows\System\tUlULZE.exe
  C:\Windows\System\tUlULZE.exe
  2⤵
  PID:16612
- C:\Windows\System\nslHkGc.exe
  C:\Windows\System\nslHkGc.exe
  2⤵
  PID:16640
- C:\Windows\System\UWuhiFY.exe
  C:\Windows\System\UWuhiFY.exe
  2⤵
  PID:16672
- C:\Windows\System\lQcoRlH.exe
  C:\Windows\System\lQcoRlH.exe
  2⤵
  PID:16704
- C:\Windows\System\YTaYbNO.exe
  C:\Windows\System\YTaYbNO.exe
  2⤵
  PID:16740
- C:\Windows\System\rfZGqEV.exe
  C:\Windows\System\rfZGqEV.exe
  2⤵
  PID:16760
- C:\Windows\System\JexolbJ.exe
  C:\Windows\System\JexolbJ.exe
  2⤵
  PID:16796
- C:\Windows\System\EGqjvjY.exe
  C:\Windows\System\EGqjvjY.exe
  2⤵
  PID:16820
- C:\Windows\System\uXzujQC.exe
  C:\Windows\System\uXzujQC.exe
  2⤵
  PID:16848
- C:\Windows\System\TlSGZpx.exe
  C:\Windows\System\TlSGZpx.exe
  2⤵
  PID:16880
- C:\Windows\System\rAREQkY.exe
  C:\Windows\System\rAREQkY.exe
  2⤵
  PID:16900
- C:\Windows\System\nZkeuLI.exe
  C:\Windows\System\nZkeuLI.exe
  2⤵
  PID:16936
- C:\Windows\System\UWKuGbL.exe
  C:\Windows\System\UWKuGbL.exe
  2⤵
  PID:16960
- C:\Windows\System\nPmeEqR.exe
  C:\Windows\System\nPmeEqR.exe
  2⤵
  PID:16996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DClZODR.exe

Filesize
1.1MB

MD5
569bada49266c9c331581689508787aa

SHA1
e38845696ab599dd2619a9adb5236638aac82e4b

SHA256
b5871c6f40b73b90189e0f7901841d46f5e769b5f0efaabe5e95e1c76b29b797

SHA512
57e0fdac6f4a74f5aa5bb37f11332a978490f7ba47835bf019199903c3dad011846a062fe0f6e78f307e7b8bb0c8ed9e6112aecc77234de2c46b3b3d0cf47131

Download Submit
C:\Windows\System\DtRTTJA.exe

Filesize
1.1MB

MD5
908f8d46f1f5aacfa5b1ed5816077297

SHA1
d4b2e3ea240f305e73f1fd6830609a92452762ba

SHA256
e5ac93b5ee9b85b9bed31040b2a085b3932e7044544c9979af57a42d28454258

SHA512
74055958a24bc35bfabedd44e518fe4b9da13225f1910a9b57e9f628c9fef5a5f7474a60ae1610a07ef9da6535a8f2dd6dcf41862effef4538f84119a1398b44

Download Submit
C:\Windows\System\DvHgbnb.exe

Filesize
1.1MB

MD5
6e2e53085937ee732d198e42a612a969

SHA1
1d916482652d4f06ec7dc8749f57653570ba460a

SHA256
c82df3bc08b4c561c24263a70129ae35f4d6d07f8bb4383f029ac619a263725e

SHA512
037c2baca03a4fa9ec1a9bd541826bc85ba37f29f8adaa88269c22d723677adf8b5a5683e9ba1d386c3eb900c57b105845738fb8f0b1be5d0f7e0b76fccdd84b

Download Submit
C:\Windows\System\FNKelNx.exe

Filesize
1.1MB

MD5
2c9a779c0fd070376b80d83322f20b62

SHA1
c83d14ee3da8d614bd2af293be6e71866fbf80d0

SHA256
fa3c05edc48c98471b687102315d1d8ad681b70500a403f3b57d02b05bd1991f

SHA512
48ef15c0af913df8c21865f761538bba9552133773dd56c1a34bba1520d30c91bd8627e257108e9b1531aebea9433fc3ccc5190d8921a3ae540f1b6ecd258278

Download Submit
C:\Windows\System\JdmhexN.exe

Filesize
1.1MB

MD5
f0d0154ba763b335813b8b727ac922e4

SHA1
703f14046868a24f1e8a99f120554223da4a9150

SHA256
9e154f70e21c5a0b00fbf59dbd1a47f2c919e726c4a5bf4271f5f327ae3b5400

SHA512
57f6e63c850c18552ad8ce30e291cdaf579108e57566d372075fa770cc68bbd0c93da59b93afee07a89400a0ee8f8ecfcca50a84be4fb9505f348282bcc3ea42

Download Submit
C:\Windows\System\MNbWNoZ.exe

Filesize
1.1MB

MD5
6b5316c2384bb41a1f68a7c81433b1d0

SHA1
6c6dca0f9d7ece1d8293315eb183d5ee45b6927b

SHA256
ffb150ff69e9778068d7d37840a0455b5e11d3935d6aa07be2936c022749efed

SHA512
208d3e9e595067f613e247aa3d1a5bd4088ec65f949c099028fcfba5544bc640ca8569c12671c564dc89e0a8773b12bf07aae239b4c00b70a76fcf31280faad0

Download Submit
C:\Windows\System\OLwfKkO.exe

Filesize
1.1MB

MD5
60c4c3ad542123063a285f88de05be2d

SHA1
e2571b563e612b4994b32ccbbb726f8cd35abd80

SHA256
b59c7f44aa6471a5c80a0d52b8ccade7b139e8eb58c8be208504309c5a1ecf54

SHA512
7b3c6232ca3427b8038f13b53fdca015b61daaeec3e7133117951d5d1ac7f0420a98c5c8873f2335cdfc884106571614562d34c5238d899cbb82e6eb7090f31a

Download Submit
C:\Windows\System\PLCBGOq.exe

Filesize
1.1MB

MD5
44659a743f409e782572a183149bd379

SHA1
f785fd3fcaba168c81619d4bf15cb7cee281b525

SHA256
127103d06a3c31ed8bdc272c76e8e2f9b59fab0589132b8878a63392de3e4c4b

SHA512
c58ad710e9d552c6edac4c8a81b654595afe494bfc8953e28687e5d8bdd895a6b07fd5c1c294ba666f1f15bdd1eff1df8fb59df26e5428fd33834750846a6bb6

Download Submit
C:\Windows\System\PaqhunA.exe

Filesize
1.1MB

MD5
a1c1a3ae4e9ec0fd277ee9101280dc34

SHA1
3bb85e73425867d2fbecdee505e3af43ec216b65

SHA256
b49b1e6c6c751b17c7e5a6a444bfc98d8e92651958db7034e7fa97f05254fd7c

SHA512
d5004be4ce1bafca26276d74b20532a7c531685cbb14535abb760f1b81624cf0b8a4ec2a433dc54e09f9ca8146d6fd4e6d3a05afd3fd72a10897f4e70d2a6649

Download Submit
C:\Windows\System\RADaDis.exe

Filesize
1.1MB

MD5
b2c4b19f80baba0e90e53ff495ee7a03

SHA1
b7ffa14b1a424be359e8f48cbadb2d4e8dc59a22

SHA256
7a59077712b80adb9ca1c4e00090326352319a50dbded03d491b0c42372f58a6

SHA512
01278fe37eca84cbe4515906b518ed1952be90c5fbf2f79681867cf15ca183423c0bcca053005b6730e2ebb6c216f6661b3e7c725600c14a12d2c9262e712cf6

Download Submit
C:\Windows\System\RFAbaxs.exe

Filesize
1.1MB

MD5
9ce797eb4f44b86d0c549242b107198f

SHA1
caf3c3f609abd891067a85b64e0bae7277816f7e

SHA256
47ae46668dad243d3baf3e10b397390f915cf7633b763d177688f4d9ca9a2037

SHA512
33cc6ac46ee61aa10ddef18698b8ff23b4e53857229b08fd809c43aa4452ac4966f520b8a3438ec62fc8f8abbb5dff68f83bb2a578157fe8ea23bc7697972527

Download Submit
C:\Windows\System\Ussppcx.exe

Filesize
1.1MB

MD5
a2903a089c001075a50a2bdc2698a623

SHA1
824dd3b80337b1330ef5ddd9d1d36800e16b5f5f

SHA256
f7417126ace828afecfc6f69595000eef4bc9029fab50f034218acefe12db71b

SHA512
fa88dc9689d1457f38a9f266ff19d011757db38ee603f3aea91b9d1fcef7fc2c9bff58c7899752bd4cd91819d61730aef8491c5a5b09b39af26678a384a3f05a

Download Submit
C:\Windows\System\VZpLpPV.exe

Filesize
1.1MB

MD5
0ab1160929341a29e8141260682e6378

SHA1
bc09d14dbaaa47f27d7ef7c14493fbc24809075c

SHA256
7fa313830b311606e194fd266852fbf46539d153d520499b828ba66f9c4e0a32

SHA512
b1343caedf91e1314eb98839ecfdd8768047a307c1dfae98ff7f87d31cd85d397b6df77c0f2be1f2026b16454c72f3726b4a807a556aa2a7c2f9171fe273d0da

Download Submit
C:\Windows\System\YxgvgGC.exe

Filesize
1.1MB

MD5
4852d4eefd53f0f38628f9d6d44f9027

SHA1
0dc1fd0a75cea9078391a57833eaf5daca24f3ad

SHA256
456a0a2537483ea146513c5f63ac68dedc801dece707a932b0eea7aa0cb2e8a9

SHA512
9ee18a444f5901e1ca731e75c37d9cfb623b0c3c4d28f20909dbd206e62a65837cdd782d8c4ba673b9f0f995701b1c1bb139eca1cd87b7b36e0e49d1785b7aaa

Download Submit
C:\Windows\System\ZOZQEKO.exe

Filesize
1.1MB

MD5
8d94167f0c8bae25f68de6250035839c

SHA1
e4b7e45c67afd60c705427e48f96ed7e436f2589

SHA256
27007fddca6ef514f71486fd52468037fc7c52e6f231f69da30b7b1f4fd90593

SHA512
de88aa24416a52ad916287fd516dd3e1f04a30493e63a5d213cb89daf778a0dd1e9cf467b9b76f7fee2dd03edb60cace1e4f8d8a74bd8549a06cab13f79cc5ab

Download Submit
C:\Windows\System\ZZFKAMI.exe

Filesize
1.1MB

MD5
f5c45fda9c227b2fe8203f267439b476

SHA1
abb52cee3b31425d7c1be28d227318a382c8f1ff

SHA256
2e97972ec510a3ed74f37640e659cd1a07ced5946c957ed2d1a6cbfee0941d0f

SHA512
f5acef5fa75d659ea9659db2e97993518f5c479922fb7329735a9119e94623be98fce7b730ac5d41f5c625f4dc14b85fe51abefd02f3c549f67a361fe3001515

Download Submit
C:\Windows\System\Zipohtv.exe

Filesize
1.1MB

MD5
441c86caa15dd1e637bdafba11c68f1c

SHA1
1329b55c227280a793c55f7577f8768ff24a6ca5

SHA256
1efff2f25a6ff673ba8d90e85f59d144e6d26cea93051d47469937bbc610fa0d

SHA512
02b121299a80bbad0eab1260244f390a9676f14bfd5e49dab4b3190d5974d7431bf5777e030a2f8715a0db625a26e1d2420a55f9ccc52c3030e81c095b988b8e

Download Submit
C:\Windows\System\aqxRPmp.exe

Filesize
1.1MB

MD5
3fbaf668f0f034848d82ae5a0303c08d

SHA1
c5abe7c94fb909a188496a0c1cb195d0a8a41b9d

SHA256
bb9eeedca9af00b3902d051d90423861e36ad528baff9c135a034858b7c9b59e

SHA512
9274f37fcf7c91489ba809e8c37a1acaf2c3c1e26a468845e5cf31c5a373958c62605a5e471a3b63efc33a07877bcdc88b9300bfc67da09df7b0d308b762c95f

Download Submit
C:\Windows\System\cHLTZxr.exe

Filesize
1.1MB

MD5
b8afcd765586b5ac7fd39c98cb5f70fc

SHA1
e4c9fe102f7d38c7170158a50f4ba84acbbaf79e

SHA256
e9fff13e4e7115e1d8510957a986d0fa136b45f176b656e50ff9b85de0de3473

SHA512
030306186e2e23eb1667826e9aedc8eaa95fd38f50db8e569a5995a5737d08666822cd4f4dbf664e4460f98d0ee8e6c911377ccaca518d7c69e4b24f364bfe58

Download Submit
C:\Windows\System\cmtOAqW.exe

Filesize
1.1MB

MD5
53e866b5288dcb9989c75664e34238a8

SHA1
85b3405b207db6cda9935f5ac0822be9ba1be9d9

SHA256
1598c69b70b02895a26dd4d73df3ccd025a137f098df9d72a447cd97e0360d9c

SHA512
9bc573bdd622b7edaaac550a2747c4d3d2ffed5003ce41c8548f6203cb7c81374cc95850e32cb8b37c9d2d275be4f7ffdd76b5180405ce29eb49ae563602be3c

Download Submit
C:\Windows\System\dmLSUCB.exe

Filesize
1.1MB

MD5
1615aba6bf8132cd2828262a34913f4f

SHA1
b1fca6fcdc0116cee92d834701f692f7bef451b2

SHA256
38d7b00890a4582239fd3b7e038d087856c894ea040ab8998986e91cea92e3ed

SHA512
fdff05babfe484692a7c59875ce8334e953c33292bdb2571f8e320ed5d3c52bdabd1b8ed3e294b11a0ae93bb0925cffd7608aedf3a138af2f50495ada87647b0

Download Submit
C:\Windows\System\fKsbfhR.exe

Filesize
1.1MB

MD5
ec26c18e294a048202eaa16f0e2dddbd

SHA1
40855e5e51a5a564e372519db3b728ab318e0aad

SHA256
f0cd95171a33a694f4f1c3f8cfc1c6e8dbc579a0bed920cda9663c30e7296448

SHA512
438ce10ebf8913e7dd9dfe9ba5b74b14de4207fd2ea70182b941a9c9cec90e383aff634c8fcd4ae1aed8211689f7bd94fe7a6baf224f6acbad559831d25e1856

Download Submit
C:\Windows\System\hGHxSoV.exe

Filesize
1.1MB

MD5
894d6a93b95ba56b8360a37632cd20cb

SHA1
5f4fe059409475c45e1922672ff8b02f6a754ce5

SHA256
86deb976c18d539adc3c02477ee5ea5141bcb640c7ebeb0ebc4d62ae92ed60d0

SHA512
519d9644d4209ff157b0fe495bc47bce6a64214500127555b859e006a3aabbf7ece089053ba35e1126391d309a394a6e102e27a3141b7094d62cde7d85d0a501

Download Submit
C:\Windows\System\hfgYFLM.exe

Filesize
1.1MB

MD5
5cf11f08a36e4e63d3f012ba3bb3e3ec

SHA1
3107704c37978c92774d44bc17f262c8d9754372

SHA256
0179ce39238e76e991a552c8a12db80fa4da21a040d6def1dc411d2074d595a5

SHA512
b22e45c0fc4224caa68f803160681da7c85453826f0d38f3c3f9addb47296dca9258f321cebfe750135ba11b29822c51cbd3db7d659d06dc832a225730fba0d9

Download Submit
C:\Windows\System\iTkhtMh.exe

Filesize
1.1MB

MD5
7c28a25939b8ee60aa35e8342fe664f7

SHA1
d8ed208e76e4ebc392da55b9af06b355237d0a90

SHA256
96915623aadb1f2218325963e3617f39ebf1197bf7e0eb0945c841fbc562e0e8

SHA512
b6f291b3a7eec423316c5b1924ddbe30b595b3473b61f2c3a7336ba27b9a8ac63a4eeda1d94c8bbb7e0a284a4df56512ae2276a8ebd1406f7fb8d899408cb635

Download Submit
C:\Windows\System\iUOnDnR.exe

Filesize
1.1MB

MD5
ac0b111dfafbe5abad894fb3b20a54bb

SHA1
39b007af16404689a832b0b39d82ab96282fb4b0

SHA256
a679402a630598744468788af3275a23ea4fc6157203f0ce27e2e08436ec66ec

SHA512
333dc9e13842ef4e4cf9102b98133ba22e957f6277ca03f4370a342837a24aa0bd701bb8c14eac7e4e22855231aae691b841ec7fc1bfe262233cd1058504eb9b

Download Submit
C:\Windows\System\lidMQvu.exe

Filesize
1.1MB

MD5
4963a5f14a600bacb84f09a466de03cd

SHA1
e60403c4f6025e559d07c44bb5c3444462a06723

SHA256
66cb6d40c95a611bf211fdb3a4179f838a634fc8d4734420fe40a38b19f8b34e

SHA512
cfb9e0da424dd2fe525877d90f8ec1f9a29fb2ad01dec142a580a7cde73fd83b25566b37f3c7eb30ccc4c032d66c436cd030901d9c6b5b8b4b07a0519b6cd328

Download Submit
C:\Windows\System\lpSmPQL.exe

Filesize
1.1MB

MD5
08e3f37783af752e275113b2ac5bb5b8

SHA1
fe32e1df24b968adf6a3346af4b580df7e6d710c

SHA256
2754a792b205e1c9b7f4531414407022affe63042e972ff8448d3246960b7447

SHA512
5df0ad6143eef8e2153dfa60fad65eba6e7da33c48401e48045adbb5d713b56de7ebe0867c613d45d6f365588ce40f187bf4296f9f2932256a251c68d1721f3a

Download Submit
C:\Windows\System\qOldEgy.exe

Filesize
1.1MB

MD5
39015c27f86d1392f5178f28847423cd

SHA1
f7bf7ef2450e5f3f9c46f1eedfd19941d0e3423b

SHA256
13735b6d10ae38fc32e0cd947d5d42514bf7705d53ff4933b56088faa2919d53

SHA512
3ee92a6e6c65343d3e807a69acfc7398f1ab226c75ab4d334810b24768776f232203682e7bb943dafd24690817708ee8a28cac3fd016983b4c50cabcf1359983

Download Submit
C:\Windows\System\qZObenN.exe

Filesize
1.1MB

MD5
52c6f72eeafc243f888f5476c0aa56ea

SHA1
78bd0e64571ab5a003037191001a8d5523e1f357

SHA256
a9127244ce704965e1abfefebbb55d3aeafaf425450de95b3bace5574f9a2060

SHA512
9e09c5a10a1577c15ae8b18ad79097a5ff229dd1fec14cc9dda8cd4d177cdcf2d8ddcf23fa1c526527298965f539b729af6ab0803fa0bc9e68190eeed29f43fb

Download Submit
C:\Windows\System\qeaWPny.exe

Filesize
1.1MB

MD5
b72e90ece58080bff6e3db7b25b84309

SHA1
02a9877f055e6d850b85cac0f11ad2e93ab299e0

SHA256
b7f066b67350ce5347dd7bc6db3ffd671cba56eee9fab0af73bed61b969902df

SHA512
1cd80bada0617a9ff1aea745a620cee2d714a480d4f95d351c43faf3add4d12425c5d1f90d6f74e368b53d2d5554399a5db9052bd1cdd6e1dc4d0d6b3558f3bb

Download Submit
C:\Windows\System\ruqMJRm.exe

Filesize
1.1MB

MD5
02530dc7473d62f7169b7655e2a1670a

SHA1
f91236d93eaad77e1dd1fe94251c52075e3eaadc

SHA256
96fcc70a88bd716e0c0f8923cea06cba1e539e114896cc61dcdba29855c38d62

SHA512
6922422ab79e6c0f16c0b810cb843d4e892a83e78538fda9376c7deaf20aa2c3e8c3226d095c1e5e234b70d85ea17271d9d70e894ea37adabd1da7b3c21991a4

Download Submit
C:\Windows\System\xeMPGBr.exe

Filesize
1.1MB

MD5
95682ca89788d7ab7550ee36fd6099b9

SHA1
3d91f8fa607c67644d9a52557d4addc46500e790

SHA256
5953f21a72c2a4a0606411ca091b66fad8831553b380799c42012bce5a364d0f

SHA512
a37c9d68d7afbd77b90ddf40fd3283d51b4e1c70af3638306271b6841fd36b2b699940c641c43a51c9db1ca08bca2f7890cc81064e2c382c4de8f64433c10caa

Download Submit
memory/884-0-0x0000020C60D10000-0x0000020C60D20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads