xmrig | 1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
Size

1.1MB
MD5

04bddcf53e003ba4ff1b5e464db608c1
SHA1

456cde188d0bd312a95f6228ee34f1ee78370e06
SHA256

1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de
SHA512

02bbcc3d14223ac037b80a8d89b99a33c719c2544c151a834845408fab6999f5e4460f7967e782539cbc20a1f40b190822757c326edd7bed72b8d9afaf076f1f
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensz8Zs0YrTdkut9l:GezaTF8FcNkNdfE0pZ9ozttwIRbf5D

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0018000000023c3b-4.dat	xmrig
behavioral2/files/0x0007000000023cb9-7.dat	xmrig
behavioral2/files/0x0009000000023cb5-8.dat	xmrig
behavioral2/files/0x0007000000023cba-19.dat	xmrig
behavioral2/files/0x0007000000023cbb-25.dat	xmrig
behavioral2/files/0x0007000000023cbc-27.dat	xmrig
behavioral2/files/0x0007000000023cc1-46.dat	xmrig
behavioral2/files/0x0007000000023cc2-56.dat	xmrig
behavioral2/files/0x0007000000023cc6-77.dat	xmrig
behavioral2/files/0x0007000000023ccb-102.dat	xmrig
behavioral2/files/0x0007000000023ccf-122.dat	xmrig
behavioral2/files/0x0007000000023cd7-162.dat	xmrig
behavioral2/files/0x0007000000023cd5-160.dat	xmrig
behavioral2/files/0x0007000000023cd6-157.dat	xmrig
behavioral2/files/0x0007000000023cd4-155.dat	xmrig
behavioral2/files/0x0007000000023cd3-150.dat	xmrig
behavioral2/files/0x0007000000023cd2-145.dat	xmrig
behavioral2/files/0x0007000000023cd1-140.dat	xmrig
behavioral2/files/0x0007000000023cd0-135.dat	xmrig
behavioral2/files/0x0007000000023cce-125.dat	xmrig
behavioral2/files/0x0007000000023ccd-120.dat	xmrig
behavioral2/files/0x0007000000023ccc-115.dat	xmrig
behavioral2/files/0x0007000000023cca-105.dat	xmrig
behavioral2/files/0x0007000000023cc9-100.dat	xmrig
behavioral2/files/0x0007000000023cc8-95.dat	xmrig
behavioral2/files/0x0007000000023cc7-90.dat	xmrig
behavioral2/files/0x0007000000023cc5-80.dat	xmrig
behavioral2/files/0x0007000000023cc4-75.dat	xmrig
behavioral2/files/0x0007000000023cc3-70.dat	xmrig
behavioral2/files/0x0007000000023cbf-59.dat	xmrig
behavioral2/files/0x0007000000023cbd-53.dat	xmrig
behavioral2/files/0x0007000000023cc0-47.dat	xmrig
behavioral2/files/0x0007000000023cbe-49.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2176	sUdqgHP.exe
2260	nqbYwYn.exe
4136	pZWbPAk.exe
4824	OwrDhQM.exe
2820	XSmWGqC.exe
4900	ndygXhp.exe
4964	yPGeZZy.exe
1164	KFPcAnw.exe
740	vinkoZm.exe
3692	UrOCAJW.exe
2808	jHQxDAn.exe
3328	Wihfhfq.exe
3388	hLCtpTZ.exe
4456	nsfsNWw.exe
596	keQqKlF.exe
3812	umOsigS.exe
928	xXJzXbI.exe
552	UURITwp.exe
3596	GdlsWjj.exe
2788	GxGxtNg.exe
208	jnhpWLs.exe
4024	EELnuxS.exe
4052	hExmjWn.exe
4592	dIDdpaU.exe
3396	ehitrkg.exe
3592	lapYpNw.exe
1040	FblMDAJ.exe
4540	kURAeHA.exe
1072	gJpWZuU.exe
4524	bIpEdhx.exe
3968	HKeGGxO.exe
2100	JtQrRwt.exe
3664	WKHpiTA.exe
2780	GZauuvO.exe
1120	cTzfgRp.exe
2548	eRdDZOe.exe
3468	HxbDonR.exe
4536	wUxCFaK.exe
1916	ojwGivG.exe
1472	YqBieaD.exe
3684	nOeShKB.exe
1792	lHCHZaq.exe
5084	fdmwhxP.exe
3772	kQvzGIS.exe
4292	hsBblbP.exe
2816	aZpYLjN.exe
4508	HFSTXSo.exe
884	OsPCbbB.exe
1260	YgoBtSm.exe
4764	LTgHXgh.exe
4864	bIETrVC.exe
432	CRdBWPD.exe
3672	ZpYTXpp.exe
2968	YqSThVl.exe
2016	viWxmVW.exe
4940	YlylKFQ.exe
4408	dneoIXE.exe
3948	DIucFhN.exe
4440	xzgMkpv.exe
4976	sTFFTCd.exe
1724	EBpbnvk.exe
368	ygeYlHB.exe
1780	rfwCnSO.exe
540	LqDrZof.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VigYLuN.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\ItvfLpR.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\BERLdSk.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\OnCIwSX.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\XIwfhlI.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\wGHSrzb.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\BwoLgBc.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\JeEaEoe.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\JukKAGd.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\NNHWyOh.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\bUOiWkA.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\FxJODAo.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\GsQfVUM.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\jzQbYXw.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\ECSfFyJ.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\EKjGOpM.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\FogJCEz.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\vdrvqhV.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\FtQeBiS.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\IQVaaCQ.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\JAQCxbU.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\ygeYlHB.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\PezySWp.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\yDPVtXm.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\fEuWwfP.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\JczYgPp.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\tmQEMTp.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\XNeKPLu.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\SZyldlT.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\aYXGkpi.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\IRzYTtG.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\paebSmo.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\cURfZNW.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\RriGUGB.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\jjxDpAD.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\EFaXdUW.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\NuWXDwb.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\nwYCvyf.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\PkwCPHu.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\pRvsGki.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\hNbuZSw.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\dpGaTAm.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\BtfaKza.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\MHtBLTO.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\jEmFJeL.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\pavnZoW.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\YEZZZTe.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\XzfVPbE.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\CbOInvW.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\lTsVVIw.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\cmalhYP.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\uTEAXyK.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\Vgopsua.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\etShUxB.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\KhoMgOE.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\qLQohgL.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\rWODZGq.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\OklHxLh.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\SMYMxII.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\MMxdQEe.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\qUrxhkw.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\yLSWIsw.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\mxUVIRU.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
File created	C:\Windows\System\rUiGVFE.exe	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2176	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	84
PID 1096 wrote to memory of 2176	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	84
PID 1096 wrote to memory of 2260	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	85
PID 1096 wrote to memory of 2260	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	85
PID 1096 wrote to memory of 4136	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	86
PID 1096 wrote to memory of 4136	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	86
PID 1096 wrote to memory of 4824	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	87
PID 1096 wrote to memory of 4824	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	87
PID 1096 wrote to memory of 2820	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	88
PID 1096 wrote to memory of 2820	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	88
PID 1096 wrote to memory of 4900	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	89
PID 1096 wrote to memory of 4900	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	89
PID 1096 wrote to memory of 4964	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	90
PID 1096 wrote to memory of 4964	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	90
PID 1096 wrote to memory of 1164	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	91
PID 1096 wrote to memory of 1164	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	91
PID 1096 wrote to memory of 740	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	92
PID 1096 wrote to memory of 740	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	92
PID 1096 wrote to memory of 3692	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	93
PID 1096 wrote to memory of 3692	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	93
PID 1096 wrote to memory of 2808	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	94
PID 1096 wrote to memory of 2808	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	94
PID 1096 wrote to memory of 3328	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	95
PID 1096 wrote to memory of 3328	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	95
PID 1096 wrote to memory of 3388	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	96
PID 1096 wrote to memory of 3388	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	96
PID 1096 wrote to memory of 4456	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	97
PID 1096 wrote to memory of 4456	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	97
PID 1096 wrote to memory of 596	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	98
PID 1096 wrote to memory of 596	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	98
PID 1096 wrote to memory of 3812	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	99
PID 1096 wrote to memory of 3812	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	99
PID 1096 wrote to memory of 928	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	100
PID 1096 wrote to memory of 928	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	100
PID 1096 wrote to memory of 552	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	101
PID 1096 wrote to memory of 552	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	101
PID 1096 wrote to memory of 3596	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	102
PID 1096 wrote to memory of 3596	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	102
PID 1096 wrote to memory of 2788	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	103
PID 1096 wrote to memory of 2788	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	103
PID 1096 wrote to memory of 208	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	104
PID 1096 wrote to memory of 208	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	104
PID 1096 wrote to memory of 4024	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	105
PID 1096 wrote to memory of 4024	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	105
PID 1096 wrote to memory of 4052	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	106
PID 1096 wrote to memory of 4052	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	106
PID 1096 wrote to memory of 4592	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	107
PID 1096 wrote to memory of 4592	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	107
PID 1096 wrote to memory of 3396	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	108
PID 1096 wrote to memory of 3396	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	108
PID 1096 wrote to memory of 3592	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	109
PID 1096 wrote to memory of 3592	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	109
PID 1096 wrote to memory of 1040	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	110
PID 1096 wrote to memory of 1040	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	110
PID 1096 wrote to memory of 4540	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	111
PID 1096 wrote to memory of 4540	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	111
PID 1096 wrote to memory of 1072	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	112
PID 1096 wrote to memory of 1072	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	112
PID 1096 wrote to memory of 4524	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	113
PID 1096 wrote to memory of 4524	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	113
PID 1096 wrote to memory of 3968	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	114
PID 1096 wrote to memory of 3968	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	114
PID 1096 wrote to memory of 2100	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	115
PID 1096 wrote to memory of 2100	1096	1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe	115

C:\Users\Admin\AppData\Local\Temp\1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe
"C:\Users\Admin\AppData\Local\Temp\1b2b39b02d5cd4468381db3c411c34aa8efa9be34a30029f987435d18acec2de.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System\sUdqgHP.exe
  C:\Windows\System\sUdqgHP.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\nqbYwYn.exe
  C:\Windows\System\nqbYwYn.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\pZWbPAk.exe
  C:\Windows\System\pZWbPAk.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\OwrDhQM.exe
  C:\Windows\System\OwrDhQM.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\XSmWGqC.exe
  C:\Windows\System\XSmWGqC.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ndygXhp.exe
  C:\Windows\System\ndygXhp.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\yPGeZZy.exe
  C:\Windows\System\yPGeZZy.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\KFPcAnw.exe
  C:\Windows\System\KFPcAnw.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\vinkoZm.exe
  C:\Windows\System\vinkoZm.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\UrOCAJW.exe
  C:\Windows\System\UrOCAJW.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\jHQxDAn.exe
  C:\Windows\System\jHQxDAn.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\Wihfhfq.exe
  C:\Windows\System\Wihfhfq.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\hLCtpTZ.exe
  C:\Windows\System\hLCtpTZ.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\nsfsNWw.exe
  C:\Windows\System\nsfsNWw.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\keQqKlF.exe
  C:\Windows\System\keQqKlF.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\umOsigS.exe
  C:\Windows\System\umOsigS.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\xXJzXbI.exe
  C:\Windows\System\xXJzXbI.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\UURITwp.exe
  C:\Windows\System\UURITwp.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\GdlsWjj.exe
  C:\Windows\System\GdlsWjj.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\GxGxtNg.exe
  C:\Windows\System\GxGxtNg.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\jnhpWLs.exe
  C:\Windows\System\jnhpWLs.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\EELnuxS.exe
  C:\Windows\System\EELnuxS.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\hExmjWn.exe
  C:\Windows\System\hExmjWn.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\dIDdpaU.exe
  C:\Windows\System\dIDdpaU.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\ehitrkg.exe
  C:\Windows\System\ehitrkg.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\lapYpNw.exe
  C:\Windows\System\lapYpNw.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\FblMDAJ.exe
  C:\Windows\System\FblMDAJ.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\kURAeHA.exe
  C:\Windows\System\kURAeHA.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\gJpWZuU.exe
  C:\Windows\System\gJpWZuU.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\bIpEdhx.exe
  C:\Windows\System\bIpEdhx.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\HKeGGxO.exe
  C:\Windows\System\HKeGGxO.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\JtQrRwt.exe
  C:\Windows\System\JtQrRwt.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\WKHpiTA.exe
  C:\Windows\System\WKHpiTA.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\GZauuvO.exe
  C:\Windows\System\GZauuvO.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\cTzfgRp.exe
  C:\Windows\System\cTzfgRp.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\eRdDZOe.exe
  C:\Windows\System\eRdDZOe.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\HxbDonR.exe
  C:\Windows\System\HxbDonR.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\wUxCFaK.exe
  C:\Windows\System\wUxCFaK.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\ojwGivG.exe
  C:\Windows\System\ojwGivG.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\YqBieaD.exe
  C:\Windows\System\YqBieaD.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\nOeShKB.exe
  C:\Windows\System\nOeShKB.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\lHCHZaq.exe
  C:\Windows\System\lHCHZaq.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\fdmwhxP.exe
  C:\Windows\System\fdmwhxP.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\kQvzGIS.exe
  C:\Windows\System\kQvzGIS.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\hsBblbP.exe
  C:\Windows\System\hsBblbP.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\aZpYLjN.exe
  C:\Windows\System\aZpYLjN.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\HFSTXSo.exe
  C:\Windows\System\HFSTXSo.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\OsPCbbB.exe
  C:\Windows\System\OsPCbbB.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\YgoBtSm.exe
  C:\Windows\System\YgoBtSm.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\LTgHXgh.exe
  C:\Windows\System\LTgHXgh.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\bIETrVC.exe
  C:\Windows\System\bIETrVC.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\CRdBWPD.exe
  C:\Windows\System\CRdBWPD.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\ZpYTXpp.exe
  C:\Windows\System\ZpYTXpp.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\YqSThVl.exe
  C:\Windows\System\YqSThVl.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\viWxmVW.exe
  C:\Windows\System\viWxmVW.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\YlylKFQ.exe
  C:\Windows\System\YlylKFQ.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\dneoIXE.exe
  C:\Windows\System\dneoIXE.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\DIucFhN.exe
  C:\Windows\System\DIucFhN.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\xzgMkpv.exe
  C:\Windows\System\xzgMkpv.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\sTFFTCd.exe
  C:\Windows\System\sTFFTCd.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\EBpbnvk.exe
  C:\Windows\System\EBpbnvk.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ygeYlHB.exe
  C:\Windows\System\ygeYlHB.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\rfwCnSO.exe
  C:\Windows\System\rfwCnSO.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\LqDrZof.exe
  C:\Windows\System\LqDrZof.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\kvWvlwE.exe
  C:\Windows\System\kvWvlwE.exe
  2⤵
  PID:2412
- C:\Windows\System\iNnsJNg.exe
  C:\Windows\System\iNnsJNg.exe
  2⤵
  PID:3412
- C:\Windows\System\ZJGofgI.exe
  C:\Windows\System\ZJGofgI.exe
  2⤵
  PID:1628
- C:\Windows\System\zLYiScW.exe
  C:\Windows\System\zLYiScW.exe
  2⤵
  PID:4336
- C:\Windows\System\rvWfGeV.exe
  C:\Windows\System\rvWfGeV.exe
  2⤵
  PID:1700
- C:\Windows\System\nRdxRvD.exe
  C:\Windows\System\nRdxRvD.exe
  2⤵
  PID:2756
- C:\Windows\System\tLHgKxv.exe
  C:\Windows\System\tLHgKxv.exe
  2⤵
  PID:1756
- C:\Windows\System\qDjLMlT.exe
  C:\Windows\System\qDjLMlT.exe
  2⤵
  PID:1224
- C:\Windows\System\SaUcwkc.exe
  C:\Windows\System\SaUcwkc.exe
  2⤵
  PID:1036
- C:\Windows\System\UVGlcCt.exe
  C:\Windows\System\UVGlcCt.exe
  2⤵
  PID:1136
- C:\Windows\System\yCpQgkh.exe
  C:\Windows\System\yCpQgkh.exe
  2⤵
  PID:1468
- C:\Windows\System\ZanZGMT.exe
  C:\Windows\System\ZanZGMT.exe
  2⤵
  PID:3508
- C:\Windows\System\vdrvqhV.exe
  C:\Windows\System\vdrvqhV.exe
  2⤵
  PID:2744
- C:\Windows\System\RlSAoGe.exe
  C:\Windows\System\RlSAoGe.exe
  2⤵
  PID:824
- C:\Windows\System\QhzFDKw.exe
  C:\Windows\System\QhzFDKw.exe
  2⤵
  PID:2584
- C:\Windows\System\kwrnaLZ.exe
  C:\Windows\System\kwrnaLZ.exe
  2⤵
  PID:3680
- C:\Windows\System\KRyrqUd.exe
  C:\Windows\System\KRyrqUd.exe
  2⤵
  PID:1936
- C:\Windows\System\NRcmfRq.exe
  C:\Windows\System\NRcmfRq.exe
  2⤵
  PID:1776
- C:\Windows\System\zavVTxV.exe
  C:\Windows\System\zavVTxV.exe
  2⤵
  PID:4316
- C:\Windows\System\wRTFPIT.exe
  C:\Windows\System\wRTFPIT.exe
  2⤵
  PID:4616
- C:\Windows\System\QNrfcOe.exe
  C:\Windows\System\QNrfcOe.exe
  2⤵
  PID:4172
- C:\Windows\System\KsdTiRk.exe
  C:\Windows\System\KsdTiRk.exe
  2⤵
  PID:760
- C:\Windows\System\rXacHiI.exe
  C:\Windows\System\rXacHiI.exe
  2⤵
  PID:4072
- C:\Windows\System\sTnKQMj.exe
  C:\Windows\System\sTnKQMj.exe
  2⤵
  PID:4576
- C:\Windows\System\IdrRBxG.exe
  C:\Windows\System\IdrRBxG.exe
  2⤵
  PID:2592
- C:\Windows\System\xOBRCLv.exe
  C:\Windows\System\xOBRCLv.exe
  2⤵
  PID:5140
- C:\Windows\System\bhPKEhg.exe
  C:\Windows\System\bhPKEhg.exe
  2⤵
  PID:5168
- C:\Windows\System\pYvaVjV.exe
  C:\Windows\System\pYvaVjV.exe
  2⤵
  PID:5196
- C:\Windows\System\YIqyMsw.exe
  C:\Windows\System\YIqyMsw.exe
  2⤵
  PID:5228
- C:\Windows\System\YdowWMr.exe
  C:\Windows\System\YdowWMr.exe
  2⤵
  PID:5256
- C:\Windows\System\lTsVVIw.exe
  C:\Windows\System\lTsVVIw.exe
  2⤵
  PID:5280
- C:\Windows\System\ILPvWCH.exe
  C:\Windows\System\ILPvWCH.exe
  2⤵
  PID:5312
- C:\Windows\System\GNYOiNG.exe
  C:\Windows\System\GNYOiNG.exe
  2⤵
  PID:5336
- C:\Windows\System\DNiwmnF.exe
  C:\Windows\System\DNiwmnF.exe
  2⤵
  PID:5364
- C:\Windows\System\GlDKkXD.exe
  C:\Windows\System\GlDKkXD.exe
  2⤵
  PID:5396
- C:\Windows\System\hIBjBTZ.exe
  C:\Windows\System\hIBjBTZ.exe
  2⤵
  PID:5420
- C:\Windows\System\npCTBXc.exe
  C:\Windows\System\npCTBXc.exe
  2⤵
  PID:5448
- C:\Windows\System\hhkjxFB.exe
  C:\Windows\System\hhkjxFB.exe
  2⤵
  PID:5480
- C:\Windows\System\mgimnDp.exe
  C:\Windows\System\mgimnDp.exe
  2⤵
  PID:5504
- C:\Windows\System\PNGHqak.exe
  C:\Windows\System\PNGHqak.exe
  2⤵
  PID:5536
- C:\Windows\System\FBNxIQG.exe
  C:\Windows\System\FBNxIQG.exe
  2⤵
  PID:5560
- C:\Windows\System\WkhNvXr.exe
  C:\Windows\System\WkhNvXr.exe
  2⤵
  PID:5592
- C:\Windows\System\SrmPUFt.exe
  C:\Windows\System\SrmPUFt.exe
  2⤵
  PID:5620
- C:\Windows\System\uBjYKVF.exe
  C:\Windows\System\uBjYKVF.exe
  2⤵
  PID:5644
- C:\Windows\System\CzPzlvi.exe
  C:\Windows\System\CzPzlvi.exe
  2⤵
  PID:5676
- C:\Windows\System\vQRnaqx.exe
  C:\Windows\System\vQRnaqx.exe
  2⤵
  PID:5700
- C:\Windows\System\lIxzXJw.exe
  C:\Windows\System\lIxzXJw.exe
  2⤵
  PID:5728
- C:\Windows\System\YZeVMbR.exe
  C:\Windows\System\YZeVMbR.exe
  2⤵
  PID:5756
- C:\Windows\System\uyUBjNo.exe
  C:\Windows\System\uyUBjNo.exe
  2⤵
  PID:5780
- C:\Windows\System\uRgbmvM.exe
  C:\Windows\System\uRgbmvM.exe
  2⤵
  PID:5812
- C:\Windows\System\pyutDmS.exe
  C:\Windows\System\pyutDmS.exe
  2⤵
  PID:5840
- C:\Windows\System\wVWGOoU.exe
  C:\Windows\System\wVWGOoU.exe
  2⤵
  PID:5868
- C:\Windows\System\SKJQjrT.exe
  C:\Windows\System\SKJQjrT.exe
  2⤵
  PID:5896
- C:\Windows\System\quAUHzX.exe
  C:\Windows\System\quAUHzX.exe
  2⤵
  PID:5924
- C:\Windows\System\IHgiibR.exe
  C:\Windows\System\IHgiibR.exe
  2⤵
  PID:5952
- C:\Windows\System\hWSwExB.exe
  C:\Windows\System\hWSwExB.exe
  2⤵
  PID:5980
- C:\Windows\System\mtFbTne.exe
  C:\Windows\System\mtFbTne.exe
  2⤵
  PID:6008
- C:\Windows\System\zIaevnU.exe
  C:\Windows\System\zIaevnU.exe
  2⤵
  PID:6040
- C:\Windows\System\UkZCXGG.exe
  C:\Windows\System\UkZCXGG.exe
  2⤵
  PID:6068
- C:\Windows\System\YRQaPVs.exe
  C:\Windows\System\YRQaPVs.exe
  2⤵
  PID:6092
- C:\Windows\System\PdqslLi.exe
  C:\Windows\System\PdqslLi.exe
  2⤵
  PID:6124
- C:\Windows\System\mDPCbgO.exe
  C:\Windows\System\mDPCbgO.exe
  2⤵
  PID:3868
- C:\Windows\System\LZqtIGB.exe
  C:\Windows\System\LZqtIGB.exe
  2⤵
  PID:2140
- C:\Windows\System\GMcPkil.exe
  C:\Windows\System\GMcPkil.exe
  2⤵
  PID:4260
- C:\Windows\System\lqrAjmD.exe
  C:\Windows\System\lqrAjmD.exe
  2⤵
  PID:3064
- C:\Windows\System\tmQEMTp.exe
  C:\Windows\System\tmQEMTp.exe
  2⤵
  PID:3504
- C:\Windows\System\xIvMWps.exe
  C:\Windows\System\xIvMWps.exe
  2⤵
  PID:4452
- C:\Windows\System\rPQeIWe.exe
  C:\Windows\System\rPQeIWe.exe
  2⤵
  PID:984
- C:\Windows\System\jeLLdSw.exe
  C:\Windows\System\jeLLdSw.exe
  2⤵
  PID:5092
- C:\Windows\System\dekwXYT.exe
  C:\Windows\System\dekwXYT.exe
  2⤵
  PID:5128
- C:\Windows\System\HGPugQZ.exe
  C:\Windows\System\HGPugQZ.exe
  2⤵
  PID:5272
- C:\Windows\System\faBJLEC.exe
  C:\Windows\System\faBJLEC.exe
  2⤵
  PID:5300
- C:\Windows\System\fbpJHBX.exe
  C:\Windows\System\fbpJHBX.exe
  2⤵
  PID:5332
- C:\Windows\System\CxAfoYS.exe
  C:\Windows\System\CxAfoYS.exe
  2⤵
  PID:5384
- C:\Windows\System\GDBWFMb.exe
  C:\Windows\System\GDBWFMb.exe
  2⤵
  PID:5460
- C:\Windows\System\SWoIzME.exe
  C:\Windows\System\SWoIzME.exe
  2⤵
  PID:5520
- C:\Windows\System\WtNEGLJ.exe
  C:\Windows\System\WtNEGLJ.exe
  2⤵
  PID:5576
- C:\Windows\System\eCUpjQt.exe
  C:\Windows\System\eCUpjQt.exe
  2⤵
  PID:5636
- C:\Windows\System\YzipNGA.exe
  C:\Windows\System\YzipNGA.exe
  2⤵
  PID:5692
- C:\Windows\System\aEkRFCc.exe
  C:\Windows\System\aEkRFCc.exe
  2⤵
  PID:5744
- C:\Windows\System\BPOouJn.exe
  C:\Windows\System\BPOouJn.exe
  2⤵
  PID:5804
- C:\Windows\System\qIdzxSX.exe
  C:\Windows\System\qIdzxSX.exe
  2⤵
  PID:5880
- C:\Windows\System\TUNlqgr.exe
  C:\Windows\System\TUNlqgr.exe
  2⤵
  PID:5932
- C:\Windows\System\HtQWFaw.exe
  C:\Windows\System\HtQWFaw.exe
  2⤵
  PID:4460
- C:\Windows\System\CEzXYlw.exe
  C:\Windows\System\CEzXYlw.exe
  2⤵
  PID:6048
- C:\Windows\System\hUXpHTP.exe
  C:\Windows\System\hUXpHTP.exe
  2⤵
  PID:6104
- C:\Windows\System\jqizMre.exe
  C:\Windows\System\jqizMre.exe
  2⤵
  PID:4532
- C:\Windows\System\rxIaWWO.exe
  C:\Windows\System\rxIaWWO.exe
  2⤵
  PID:3532
- C:\Windows\System\oCsCwRG.exe
  C:\Windows\System\oCsCwRG.exe
  2⤵
  PID:1568
- C:\Windows\System\pZjyVdi.exe
  C:\Windows\System\pZjyVdi.exe
  2⤵
  PID:1712
- C:\Windows\System\WIjfYWL.exe
  C:\Windows\System\WIjfYWL.exe
  2⤵
  PID:5160
- C:\Windows\System\hspVedj.exe
  C:\Windows\System\hspVedj.exe
  2⤵
  PID:5292
- C:\Windows\System\llIhCDg.exe
  C:\Windows\System\llIhCDg.exe
  2⤵
  PID:5432
- C:\Windows\System\cmalhYP.exe
  C:\Windows\System\cmalhYP.exe
  2⤵
  PID:5556
- C:\Windows\System\aVVsZRs.exe
  C:\Windows\System\aVVsZRs.exe
  2⤵
  PID:5660
- C:\Windows\System\Ywvuvth.exe
  C:\Windows\System\Ywvuvth.exe
  2⤵
  PID:5740
- C:\Windows\System\JZNYmwC.exe
  C:\Windows\System\JZNYmwC.exe
  2⤵
  PID:5852
- C:\Windows\System\xQERVaY.exe
  C:\Windows\System\xQERVaY.exe
  2⤵
  PID:6020
- C:\Windows\System\dVqfhiQ.exe
  C:\Windows\System\dVqfhiQ.exe
  2⤵
  PID:6132
- C:\Windows\System\mTcfVit.exe
  C:\Windows\System\mTcfVit.exe
  2⤵
  PID:2020
- C:\Windows\System\ofKnprG.exe
  C:\Windows\System\ofKnprG.exe
  2⤵
  PID:2960
- C:\Windows\System\BtfaKza.exe
  C:\Windows\System\BtfaKza.exe
  2⤵
  PID:1428
- C:\Windows\System\TttoBZy.exe
  C:\Windows\System\TttoBZy.exe
  2⤵
  PID:5376
- C:\Windows\System\XKpDQmp.exe
  C:\Windows\System\XKpDQmp.exe
  2⤵
  PID:4280
- C:\Windows\System\aXggJIg.exe
  C:\Windows\System\aXggJIg.exe
  2⤵
  PID:2524
- C:\Windows\System\LHyngQl.exe
  C:\Windows\System\LHyngQl.exe
  2⤵
  PID:2832
- C:\Windows\System\mrpVyxT.exe
  C:\Windows\System\mrpVyxT.exe
  2⤵
  PID:1624
- C:\Windows\System\eQaRQEt.exe
  C:\Windows\System\eQaRQEt.exe
  2⤵
  PID:5908
- C:\Windows\System\fEuWwfP.exe
  C:\Windows\System\fEuWwfP.exe
  2⤵
  PID:3404
- C:\Windows\System\bUOiWkA.exe
  C:\Windows\System\bUOiWkA.exe
  2⤵
  PID:5180
- C:\Windows\System\lTzgjBZ.exe
  C:\Windows\System\lTzgjBZ.exe
  2⤵
  PID:4928
- C:\Windows\System\vwuHAWv.exe
  C:\Windows\System\vwuHAWv.exe
  2⤵
  PID:5972
- C:\Windows\System\zMPqRKX.exe
  C:\Windows\System\zMPqRKX.exe
  2⤵
  PID:4360
- C:\Windows\System\CZiiTrf.exe
  C:\Windows\System\CZiiTrf.exe
  2⤵
  PID:5516
- C:\Windows\System\gpBvdTh.exe
  C:\Windows\System\gpBvdTh.exe
  2⤵
  PID:2236
- C:\Windows\System\plOfuua.exe
  C:\Windows\System\plOfuua.exe
  2⤵
  PID:6160
- C:\Windows\System\YIcAMGE.exe
  C:\Windows\System\YIcAMGE.exe
  2⤵
  PID:6184
- C:\Windows\System\vWiqyuP.exe
  C:\Windows\System\vWiqyuP.exe
  2⤵
  PID:6204
- C:\Windows\System\EALnYoS.exe
  C:\Windows\System\EALnYoS.exe
  2⤵
  PID:6232
- C:\Windows\System\WYUFdmW.exe
  C:\Windows\System\WYUFdmW.exe
  2⤵
  PID:6276
- C:\Windows\System\NgQPyWE.exe
  C:\Windows\System\NgQPyWE.exe
  2⤵
  PID:6300
- C:\Windows\System\nNbWjxO.exe
  C:\Windows\System\nNbWjxO.exe
  2⤵
  PID:6344
- C:\Windows\System\baoKsvp.exe
  C:\Windows\System\baoKsvp.exe
  2⤵
  PID:6360
- C:\Windows\System\XPETfjx.exe
  C:\Windows\System\XPETfjx.exe
  2⤵
  PID:6408
- C:\Windows\System\mUJQzjv.exe
  C:\Windows\System\mUJQzjv.exe
  2⤵
  PID:6428
- C:\Windows\System\dGHCSoI.exe
  C:\Windows\System\dGHCSoI.exe
  2⤵
  PID:6452
- C:\Windows\System\FnHBOAG.exe
  C:\Windows\System\FnHBOAG.exe
  2⤵
  PID:6496
- C:\Windows\System\aDjdSNX.exe
  C:\Windows\System\aDjdSNX.exe
  2⤵
  PID:6512
- C:\Windows\System\qlMnSvg.exe
  C:\Windows\System\qlMnSvg.exe
  2⤵
  PID:6536
- C:\Windows\System\dGHSmxe.exe
  C:\Windows\System\dGHSmxe.exe
  2⤵
  PID:6560
- C:\Windows\System\mqiHbmn.exe
  C:\Windows\System\mqiHbmn.exe
  2⤵
  PID:6584
- C:\Windows\System\COTXzGX.exe
  C:\Windows\System\COTXzGX.exe
  2⤵
  PID:6600
- C:\Windows\System\ULKSSKm.exe
  C:\Windows\System\ULKSSKm.exe
  2⤵
  PID:6656
- C:\Windows\System\GbbTuOk.exe
  C:\Windows\System\GbbTuOk.exe
  2⤵
  PID:6680
- C:\Windows\System\HZjazVU.exe
  C:\Windows\System\HZjazVU.exe
  2⤵
  PID:6720
- C:\Windows\System\BERLdSk.exe
  C:\Windows\System\BERLdSk.exe
  2⤵
  PID:6748
- C:\Windows\System\LLizkYh.exe
  C:\Windows\System\LLizkYh.exe
  2⤵
  PID:6768
- C:\Windows\System\fzkQqFc.exe
  C:\Windows\System\fzkQqFc.exe
  2⤵
  PID:6788
- C:\Windows\System\zaurnod.exe
  C:\Windows\System\zaurnod.exe
  2⤵
  PID:6820
- C:\Windows\System\OeqjJqk.exe
  C:\Windows\System\OeqjJqk.exe
  2⤵
  PID:6848
- C:\Windows\System\xTNYkSw.exe
  C:\Windows\System\xTNYkSw.exe
  2⤵
  PID:6884
- C:\Windows\System\WAyfToy.exe
  C:\Windows\System\WAyfToy.exe
  2⤵
  PID:6908
- C:\Windows\System\WWgffPu.exe
  C:\Windows\System\WWgffPu.exe
  2⤵
  PID:6932
- C:\Windows\System\xicfCGv.exe
  C:\Windows\System\xicfCGv.exe
  2⤵
  PID:6956
- C:\Windows\System\DtduHPT.exe
  C:\Windows\System\DtduHPT.exe
  2⤵
  PID:6980
- C:\Windows\System\pxrHFMw.exe
  C:\Windows\System\pxrHFMw.exe
  2⤵
  PID:7004
- C:\Windows\System\YNiEkDo.exe
  C:\Windows\System\YNiEkDo.exe
  2⤵
  PID:7044
- C:\Windows\System\KdUVLFL.exe
  C:\Windows\System\KdUVLFL.exe
  2⤵
  PID:7072
- C:\Windows\System\YqdrHAN.exe
  C:\Windows\System\YqdrHAN.exe
  2⤵
  PID:7096
- C:\Windows\System\UQFkwTw.exe
  C:\Windows\System\UQFkwTw.exe
  2⤵
  PID:7116
- C:\Windows\System\WuarSWO.exe
  C:\Windows\System\WuarSWO.exe
  2⤵
  PID:7144
- C:\Windows\System\PMrJWEs.exe
  C:\Windows\System\PMrJWEs.exe
  2⤵
  PID:6192
- C:\Windows\System\mKpVobc.exe
  C:\Windows\System\mKpVobc.exe
  2⤵
  PID:6224
- C:\Windows\System\KFDueks.exe
  C:\Windows\System\KFDueks.exe
  2⤵
  PID:6284
- C:\Windows\System\imYXOoS.exe
  C:\Windows\System\imYXOoS.exe
  2⤵
  PID:6296
- C:\Windows\System\TkWZrKX.exe
  C:\Windows\System\TkWZrKX.exe
  2⤵
  PID:6352
- C:\Windows\System\vBrnvZv.exe
  C:\Windows\System\vBrnvZv.exe
  2⤵
  PID:6424
- C:\Windows\System\aTUrkvQ.exe
  C:\Windows\System\aTUrkvQ.exe
  2⤵
  PID:6524
- C:\Windows\System\aqbdFQq.exe
  C:\Windows\System\aqbdFQq.exe
  2⤵
  PID:6556
- C:\Windows\System\gyYIaDb.exe
  C:\Windows\System\gyYIaDb.exe
  2⤵
  PID:6708
- C:\Windows\System\bglHLGI.exe
  C:\Windows\System\bglHLGI.exe
  2⤵
  PID:6760
- C:\Windows\System\vgcJmWr.exe
  C:\Windows\System\vgcJmWr.exe
  2⤵
  PID:6840
- C:\Windows\System\cHWouxa.exe
  C:\Windows\System\cHWouxa.exe
  2⤵
  PID:6900
- C:\Windows\System\KHghSXM.exe
  C:\Windows\System\KHghSXM.exe
  2⤵
  PID:6928
- C:\Windows\System\hLMhULY.exe
  C:\Windows\System\hLMhULY.exe
  2⤵
  PID:6996
- C:\Windows\System\XHhifqs.exe
  C:\Windows\System\XHhifqs.exe
  2⤵
  PID:7040
- C:\Windows\System\XPTSQJI.exe
  C:\Windows\System\XPTSQJI.exe
  2⤵
  PID:7104
- C:\Windows\System\TJlypnV.exe
  C:\Windows\System\TJlypnV.exe
  2⤵
  PID:6256
- C:\Windows\System\havJxaY.exe
  C:\Windows\System\havJxaY.exe
  2⤵
  PID:6320
- C:\Windows\System\icwsfye.exe
  C:\Windows\System\icwsfye.exe
  2⤵
  PID:6548
- C:\Windows\System\TdNVixp.exe
  C:\Windows\System\TdNVixp.exe
  2⤵
  PID:6576
- C:\Windows\System\taBvmtI.exe
  C:\Windows\System\taBvmtI.exe
  2⤵
  PID:6732
- C:\Windows\System\ErrjFHN.exe
  C:\Windows\System\ErrjFHN.exe
  2⤵
  PID:6816
- C:\Windows\System\aLliGbj.exe
  C:\Windows\System\aLliGbj.exe
  2⤵
  PID:6976
- C:\Windows\System\FxJODAo.exe
  C:\Windows\System\FxJODAo.exe
  2⤵
  PID:544
- C:\Windows\System\ahIQPiy.exe
  C:\Windows\System\ahIQPiy.exe
  2⤵
  PID:6396
- C:\Windows\System\eqHZgSM.exe
  C:\Windows\System\eqHZgSM.exe
  2⤵
  PID:6740
- C:\Windows\System\SbdnrSx.exe
  C:\Windows\System\SbdnrSx.exe
  2⤵
  PID:6168
- C:\Windows\System\IjfXSoU.exe
  C:\Windows\System\IjfXSoU.exe
  2⤵
  PID:7092
- C:\Windows\System\xOiqbPR.exe
  C:\Windows\System\xOiqbPR.exe
  2⤵
  PID:7192
- C:\Windows\System\nxJYFKN.exe
  C:\Windows\System\nxJYFKN.exe
  2⤵
  PID:7252
- C:\Windows\System\rKkyxHx.exe
  C:\Windows\System\rKkyxHx.exe
  2⤵
  PID:7284
- C:\Windows\System\GiJyiCl.exe
  C:\Windows\System\GiJyiCl.exe
  2⤵
  PID:7320
- C:\Windows\System\RRkOBeu.exe
  C:\Windows\System\RRkOBeu.exe
  2⤵
  PID:7336
- C:\Windows\System\HSzkeXt.exe
  C:\Windows\System\HSzkeXt.exe
  2⤵
  PID:7376
- C:\Windows\System\xldWqoQ.exe
  C:\Windows\System\xldWqoQ.exe
  2⤵
  PID:7404
- C:\Windows\System\HrcSzcr.exe
  C:\Windows\System\HrcSzcr.exe
  2⤵
  PID:7424
- C:\Windows\System\hNbuZSw.exe
  C:\Windows\System\hNbuZSw.exe
  2⤵
  PID:7448
- C:\Windows\System\SlhUXIF.exe
  C:\Windows\System\SlhUXIF.exe
  2⤵
  PID:7476
- C:\Windows\System\CBeuBul.exe
  C:\Windows\System\CBeuBul.exe
  2⤵
  PID:7500
- C:\Windows\System\GsQfVUM.exe
  C:\Windows\System\GsQfVUM.exe
  2⤵
  PID:7524
- C:\Windows\System\TBLzurs.exe
  C:\Windows\System\TBLzurs.exe
  2⤵
  PID:7544
- C:\Windows\System\FtQeBiS.exe
  C:\Windows\System\FtQeBiS.exe
  2⤵
  PID:7572
- C:\Windows\System\uTEAXyK.exe
  C:\Windows\System\uTEAXyK.exe
  2⤵
  PID:7612
- C:\Windows\System\EpjhrrH.exe
  C:\Windows\System\EpjhrrH.exe
  2⤵
  PID:7628
- C:\Windows\System\PNmRiIa.exe
  C:\Windows\System\PNmRiIa.exe
  2⤵
  PID:7648
- C:\Windows\System\mSnkiaQ.exe
  C:\Windows\System\mSnkiaQ.exe
  2⤵
  PID:7684
- C:\Windows\System\FwlMynD.exe
  C:\Windows\System\FwlMynD.exe
  2⤵
  PID:7716
- C:\Windows\System\mlLcust.exe
  C:\Windows\System\mlLcust.exe
  2⤵
  PID:7744
- C:\Windows\System\EFaXdUW.exe
  C:\Windows\System\EFaXdUW.exe
  2⤵
  PID:7772
- C:\Windows\System\CMfiNxX.exe
  C:\Windows\System\CMfiNxX.exe
  2⤵
  PID:7816
- C:\Windows\System\KrFtTHZ.exe
  C:\Windows\System\KrFtTHZ.exe
  2⤵
  PID:7840
- C:\Windows\System\cIFzRYq.exe
  C:\Windows\System\cIFzRYq.exe
  2⤵
  PID:7880
- C:\Windows\System\gSGsDHl.exe
  C:\Windows\System\gSGsDHl.exe
  2⤵
  PID:7904
- C:\Windows\System\xkDbMUk.exe
  C:\Windows\System\xkDbMUk.exe
  2⤵
  PID:7924
- C:\Windows\System\wFnWvTY.exe
  C:\Windows\System\wFnWvTY.exe
  2⤵
  PID:7944
- C:\Windows\System\exuRybq.exe
  C:\Windows\System\exuRybq.exe
  2⤵
  PID:7968
- C:\Windows\System\tGVHSCh.exe
  C:\Windows\System\tGVHSCh.exe
  2⤵
  PID:7992
- C:\Windows\System\kEUVhzV.exe
  C:\Windows\System\kEUVhzV.exe
  2⤵
  PID:8024
- C:\Windows\System\TUPHoKE.exe
  C:\Windows\System\TUPHoKE.exe
  2⤵
  PID:8052
- C:\Windows\System\GksawyZ.exe
  C:\Windows\System\GksawyZ.exe
  2⤵
  PID:8096
- C:\Windows\System\vCYInPs.exe
  C:\Windows\System\vCYInPs.exe
  2⤵
  PID:8120
- C:\Windows\System\zKQiZHG.exe
  C:\Windows\System\zKQiZHG.exe
  2⤵
  PID:8148
- C:\Windows\System\hsmUdBz.exe
  C:\Windows\System\hsmUdBz.exe
  2⤵
  PID:8188
- C:\Windows\System\cliYQIA.exe
  C:\Windows\System\cliYQIA.exe
  2⤵
  PID:6812
- C:\Windows\System\cyPzhbG.exe
  C:\Windows\System\cyPzhbG.exe
  2⤵
  PID:7180
- C:\Windows\System\cLZgMGj.exe
  C:\Windows\System\cLZgMGj.exe
  2⤵
  PID:7248
- C:\Windows\System\YYxBzWO.exe
  C:\Windows\System\YYxBzWO.exe
  2⤵
  PID:7328
- C:\Windows\System\CGDOLZg.exe
  C:\Windows\System\CGDOLZg.exe
  2⤵
  PID:7372
- C:\Windows\System\slKykVA.exe
  C:\Windows\System\slKykVA.exe
  2⤵
  PID:7444
- C:\Windows\System\RnIwKjf.exe
  C:\Windows\System\RnIwKjf.exe
  2⤵
  PID:7552
- C:\Windows\System\TFhzDQn.exe
  C:\Windows\System\TFhzDQn.exe
  2⤵
  PID:7588
- C:\Windows\System\gcALqhx.exe
  C:\Windows\System\gcALqhx.exe
  2⤵
  PID:7644
- C:\Windows\System\NLwOrWE.exe
  C:\Windows\System\NLwOrWE.exe
  2⤵
  PID:7708
- C:\Windows\System\bjZgVeP.exe
  C:\Windows\System\bjZgVeP.exe
  2⤵
  PID:7804
- C:\Windows\System\qjyYyCB.exe
  C:\Windows\System\qjyYyCB.exe
  2⤵
  PID:7920
- C:\Windows\System\ZnfcdNy.exe
  C:\Windows\System\ZnfcdNy.exe
  2⤵
  PID:7956
- C:\Windows\System\FOvTTCb.exe
  C:\Windows\System\FOvTTCb.exe
  2⤵
  PID:8008
- C:\Windows\System\fBcXFnW.exe
  C:\Windows\System\fBcXFnW.exe
  2⤵
  PID:8104
- C:\Windows\System\EgLEtks.exe
  C:\Windows\System\EgLEtks.exe
  2⤵
  PID:8112
- C:\Windows\System\RUIykjg.exe
  C:\Windows\System\RUIykjg.exe
  2⤵
  PID:8176
- C:\Windows\System\QXXPtLx.exe
  C:\Windows\System\QXXPtLx.exe
  2⤵
  PID:7220
- C:\Windows\System\btVufeq.exe
  C:\Windows\System\btVufeq.exe
  2⤵
  PID:7368
- C:\Windows\System\cPMPlrL.exe
  C:\Windows\System\cPMPlrL.exe
  2⤵
  PID:7432
- C:\Windows\System\IlOdQOm.exe
  C:\Windows\System\IlOdQOm.exe
  2⤵
  PID:7672
- C:\Windows\System\fcUnpcv.exe
  C:\Windows\System\fcUnpcv.exe
  2⤵
  PID:7824
- C:\Windows\System\TNmMdgO.exe
  C:\Windows\System\TNmMdgO.exe
  2⤵
  PID:7952
- C:\Windows\System\faQAioR.exe
  C:\Windows\System\faQAioR.exe
  2⤵
  PID:8116
- C:\Windows\System\qUrxhkw.exe
  C:\Windows\System\qUrxhkw.exe
  2⤵
  PID:7400
- C:\Windows\System\KhoMgOE.exe
  C:\Windows\System\KhoMgOE.exe
  2⤵
  PID:7756
- C:\Windows\System\YZaooXa.exe
  C:\Windows\System\YZaooXa.exe
  2⤵
  PID:6780
- C:\Windows\System\EIqYmyn.exe
  C:\Windows\System\EIqYmyn.exe
  2⤵
  PID:8212
- C:\Windows\System\EbKDyCH.exe
  C:\Windows\System\EbKDyCH.exe
  2⤵
  PID:8236
- C:\Windows\System\XOCCFND.exe
  C:\Windows\System\XOCCFND.exe
  2⤵
  PID:8256
- C:\Windows\System\aYXGkpi.exe
  C:\Windows\System\aYXGkpi.exe
  2⤵
  PID:8288
- C:\Windows\System\OaZGtOk.exe
  C:\Windows\System\OaZGtOk.exe
  2⤵
  PID:8344
- C:\Windows\System\XsKCcjC.exe
  C:\Windows\System\XsKCcjC.exe
  2⤵
  PID:8360
- C:\Windows\System\YQJxDje.exe
  C:\Windows\System\YQJxDje.exe
  2⤵
  PID:8380
- C:\Windows\System\IxxCPKz.exe
  C:\Windows\System\IxxCPKz.exe
  2⤵
  PID:8416
- C:\Windows\System\LCKwsCK.exe
  C:\Windows\System\LCKwsCK.exe
  2⤵
  PID:8448
- C:\Windows\System\AyqoOCV.exe
  C:\Windows\System\AyqoOCV.exe
  2⤵
  PID:8484
- C:\Windows\System\aHtmaEk.exe
  C:\Windows\System\aHtmaEk.exe
  2⤵
  PID:8504
- C:\Windows\System\fIvXFYV.exe
  C:\Windows\System\fIvXFYV.exe
  2⤵
  PID:8524
- C:\Windows\System\yVxsZKW.exe
  C:\Windows\System\yVxsZKW.exe
  2⤵
  PID:8548
- C:\Windows\System\quBVZaQ.exe
  C:\Windows\System\quBVZaQ.exe
  2⤵
  PID:8584
- C:\Windows\System\ExywZeh.exe
  C:\Windows\System\ExywZeh.exe
  2⤵
  PID:8620
- C:\Windows\System\KsQHJrO.exe
  C:\Windows\System\KsQHJrO.exe
  2⤵
  PID:8644
- C:\Windows\System\jruBaMq.exe
  C:\Windows\System\jruBaMq.exe
  2⤵
  PID:8684
- C:\Windows\System\aeinxdF.exe
  C:\Windows\System\aeinxdF.exe
  2⤵
  PID:8704
- C:\Windows\System\fpdsuUH.exe
  C:\Windows\System\fpdsuUH.exe
  2⤵
  PID:8728
- C:\Windows\System\IUlSJCu.exe
  C:\Windows\System\IUlSJCu.exe
  2⤵
  PID:8748
- C:\Windows\System\XxzOmSQ.exe
  C:\Windows\System\XxzOmSQ.exe
  2⤵
  PID:8772
- C:\Windows\System\QBbaWxY.exe
  C:\Windows\System\QBbaWxY.exe
  2⤵
  PID:8816
- C:\Windows\System\jzQbYXw.exe
  C:\Windows\System\jzQbYXw.exe
  2⤵
  PID:8844
- C:\Windows\System\TZvOztk.exe
  C:\Windows\System\TZvOztk.exe
  2⤵
  PID:8872
- C:\Windows\System\xFrYeIp.exe
  C:\Windows\System\xFrYeIp.exe
  2⤵
  PID:8896
- C:\Windows\System\BDVLZFX.exe
  C:\Windows\System\BDVLZFX.exe
  2⤵
  PID:8920
- C:\Windows\System\dnXfLlo.exe
  C:\Windows\System\dnXfLlo.exe
  2⤵
  PID:8952
- C:\Windows\System\OuSusPK.exe
  C:\Windows\System\OuSusPK.exe
  2⤵
  PID:8976
- C:\Windows\System\sHsGkHc.exe
  C:\Windows\System\sHsGkHc.exe
  2⤵
  PID:9024
- C:\Windows\System\FogJCEz.exe
  C:\Windows\System\FogJCEz.exe
  2⤵
  PID:9048
- C:\Windows\System\ZZrbNaX.exe
  C:\Windows\System\ZZrbNaX.exe
  2⤵
  PID:9068
- C:\Windows\System\nirFPdE.exe
  C:\Windows\System\nirFPdE.exe
  2⤵
  PID:9092
- C:\Windows\System\HapNKMk.exe
  C:\Windows\System\HapNKMk.exe
  2⤵
  PID:9124
- C:\Windows\System\tRknzia.exe
  C:\Windows\System\tRknzia.exe
  2⤵
  PID:9144
- C:\Windows\System\WqwBKXq.exe
  C:\Windows\System\WqwBKXq.exe
  2⤵
  PID:9208
- C:\Windows\System\jHxESPi.exe
  C:\Windows\System\jHxESPi.exe
  2⤵
  PID:8088
- C:\Windows\System\tEfZEWD.exe
  C:\Windows\System\tEfZEWD.exe
  2⤵
  PID:8208
- C:\Windows\System\UhJfbEz.exe
  C:\Windows\System\UhJfbEz.exe
  2⤵
  PID:8248
- C:\Windows\System\FKtgPVE.exe
  C:\Windows\System\FKtgPVE.exe
  2⤵
  PID:8352
- C:\Windows\System\vwhMpcU.exe
  C:\Windows\System\vwhMpcU.exe
  2⤵
  PID:8428
- C:\Windows\System\KZYbqpQ.exe
  C:\Windows\System\KZYbqpQ.exe
  2⤵
  PID:8500
- C:\Windows\System\HkwAbnO.exe
  C:\Windows\System\HkwAbnO.exe
  2⤵
  PID:8520
- C:\Windows\System\ABTZvFn.exe
  C:\Windows\System\ABTZvFn.exe
  2⤵
  PID:8640
- C:\Windows\System\YfDAkaB.exe
  C:\Windows\System\YfDAkaB.exe
  2⤵
  PID:8696
- C:\Windows\System\WKqfzbX.exe
  C:\Windows\System\WKqfzbX.exe
  2⤵
  PID:8736
- C:\Windows\System\JeEaEoe.exe
  C:\Windows\System\JeEaEoe.exe
  2⤵
  PID:8768
- C:\Windows\System\jCBOPRV.exe
  C:\Windows\System\jCBOPRV.exe
  2⤵
  PID:8856
- C:\Windows\System\KXNZLcf.exe
  C:\Windows\System\KXNZLcf.exe
  2⤵
  PID:8940
- C:\Windows\System\RgpeoCa.exe
  C:\Windows\System\RgpeoCa.exe
  2⤵
  PID:9020
- C:\Windows\System\NuWXDwb.exe
  C:\Windows\System\NuWXDwb.exe
  2⤵
  PID:9084
- C:\Windows\System\SqhXpzB.exe
  C:\Windows\System\SqhXpzB.exe
  2⤵
  PID:9080
- C:\Windows\System\eOVYCYA.exe
  C:\Windows\System\eOVYCYA.exe
  2⤵
  PID:7356
- C:\Windows\System\zNRyYwe.exe
  C:\Windows\System\zNRyYwe.exe
  2⤵
  PID:8328
- C:\Windows\System\aqyTkDu.exe
  C:\Windows\System\aqyTkDu.exe
  2⤵
  PID:8444
- C:\Windows\System\ZaeRjcM.exe
  C:\Windows\System\ZaeRjcM.exe
  2⤵
  PID:8616
- C:\Windows\System\gYHxZdt.exe
  C:\Windows\System\gYHxZdt.exe
  2⤵
  PID:8668
- C:\Windows\System\ANiOqdP.exe
  C:\Windows\System\ANiOqdP.exe
  2⤵
  PID:8936
- C:\Windows\System\fYxwSyf.exe
  C:\Windows\System\fYxwSyf.exe
  2⤵
  PID:9004
- C:\Windows\System\DyqkMZV.exe
  C:\Windows\System\DyqkMZV.exe
  2⤵
  PID:9116
- C:\Windows\System\GAKgAFq.exe
  C:\Windows\System\GAKgAFq.exe
  2⤵
  PID:8636
- C:\Windows\System\rWLfEgE.exe
  C:\Windows\System\rWLfEgE.exe
  2⤵
  PID:8908
- C:\Windows\System\LzpxyPO.exe
  C:\Windows\System\LzpxyPO.exe
  2⤵
  PID:9056
- C:\Windows\System\jKWrESK.exe
  C:\Windows\System\jKWrESK.exe
  2⤵
  PID:8712
- C:\Windows\System\Vgopsua.exe
  C:\Windows\System\Vgopsua.exe
  2⤵
  PID:9240
- C:\Windows\System\VigYLuN.exe
  C:\Windows\System\VigYLuN.exe
  2⤵
  PID:9260
- C:\Windows\System\xFWawTu.exe
  C:\Windows\System\xFWawTu.exe
  2⤵
  PID:9280
- C:\Windows\System\cfWPnWS.exe
  C:\Windows\System\cfWPnWS.exe
  2⤵
  PID:9300
- C:\Windows\System\eReMWAq.exe
  C:\Windows\System\eReMWAq.exe
  2⤵
  PID:9328
- C:\Windows\System\PCFEmwx.exe
  C:\Windows\System\PCFEmwx.exe
  2⤵
  PID:9368
- C:\Windows\System\TlHvAiM.exe
  C:\Windows\System\TlHvAiM.exe
  2⤵
  PID:9392
- C:\Windows\System\vtEkkjp.exe
  C:\Windows\System\vtEkkjp.exe
  2⤵
  PID:9440
- C:\Windows\System\TYXRYKC.exe
  C:\Windows\System\TYXRYKC.exe
  2⤵
  PID:9460
- C:\Windows\System\hybCAVP.exe
  C:\Windows\System\hybCAVP.exe
  2⤵
  PID:9488
- C:\Windows\System\VDKKDHr.exe
  C:\Windows\System\VDKKDHr.exe
  2⤵
  PID:9512
- C:\Windows\System\pavnZoW.exe
  C:\Windows\System\pavnZoW.exe
  2⤵
  PID:9536
- C:\Windows\System\IRzYTtG.exe
  C:\Windows\System\IRzYTtG.exe
  2⤵
  PID:9556
- C:\Windows\System\hEUHeYC.exe
  C:\Windows\System\hEUHeYC.exe
  2⤵
  PID:9600
- C:\Windows\System\YEZZZTe.exe
  C:\Windows\System\YEZZZTe.exe
  2⤵
  PID:9640
- C:\Windows\System\ebFkaZy.exe
  C:\Windows\System\ebFkaZy.exe
  2⤵
  PID:9664
- C:\Windows\System\DYsdKan.exe
  C:\Windows\System\DYsdKan.exe
  2⤵
  PID:9680
- C:\Windows\System\ZVOZciK.exe
  C:\Windows\System\ZVOZciK.exe
  2⤵
  PID:9708
- C:\Windows\System\paebSmo.exe
  C:\Windows\System\paebSmo.exe
  2⤵
  PID:9736
- C:\Windows\System\exrZODV.exe
  C:\Windows\System\exrZODV.exe
  2⤵
  PID:9764
- C:\Windows\System\DbFiHvb.exe
  C:\Windows\System\DbFiHvb.exe
  2⤵
  PID:9800
- C:\Windows\System\MHtBLTO.exe
  C:\Windows\System\MHtBLTO.exe
  2⤵
  PID:9828
- C:\Windows\System\MtadmVV.exe
  C:\Windows\System\MtadmVV.exe
  2⤵
  PID:9876
- C:\Windows\System\fnZNauJ.exe
  C:\Windows\System\fnZNauJ.exe
  2⤵
  PID:9896
- C:\Windows\System\rWODZGq.exe
  C:\Windows\System\rWODZGq.exe
  2⤵
  PID:9916
- C:\Windows\System\JukKAGd.exe
  C:\Windows\System\JukKAGd.exe
  2⤵
  PID:9956
- C:\Windows\System\IoTuLWU.exe
  C:\Windows\System\IoTuLWU.exe
  2⤵
  PID:9976
- C:\Windows\System\drHaWFk.exe
  C:\Windows\System\drHaWFk.exe
  2⤵
  PID:9996
- C:\Windows\System\rXHjiFd.exe
  C:\Windows\System\rXHjiFd.exe
  2⤵
  PID:10036
- C:\Windows\System\IkhXSuS.exe
  C:\Windows\System\IkhXSuS.exe
  2⤵
  PID:10064
- C:\Windows\System\DjRuqci.exe
  C:\Windows\System\DjRuqci.exe
  2⤵
  PID:10096
- C:\Windows\System\WtsKSip.exe
  C:\Windows\System\WtsKSip.exe
  2⤵
  PID:10116
- C:\Windows\System\NxSuFyR.exe
  C:\Windows\System\NxSuFyR.exe
  2⤵
  PID:10136
- C:\Windows\System\HlMvfCP.exe
  C:\Windows\System\HlMvfCP.exe
  2⤵
  PID:10160
- C:\Windows\System\cURfZNW.exe
  C:\Windows\System\cURfZNW.exe
  2⤵
  PID:10212
- C:\Windows\System\FTTyftS.exe
  C:\Windows\System\FTTyftS.exe
  2⤵
  PID:10236
- C:\Windows\System\zPrtNGa.exe
  C:\Windows\System\zPrtNGa.exe
  2⤵
  PID:9248
- C:\Windows\System\PYnnzAw.exe
  C:\Windows\System\PYnnzAw.exe
  2⤵
  PID:9292
- C:\Windows\System\jRkDSiU.exe
  C:\Windows\System\jRkDSiU.exe
  2⤵
  PID:9356
- C:\Windows\System\nIBFzoh.exe
  C:\Windows\System\nIBFzoh.exe
  2⤵
  PID:9416
- C:\Windows\System\yZRKnEW.exe
  C:\Windows\System\yZRKnEW.exe
  2⤵
  PID:9508
- C:\Windows\System\dnNEHcV.exe
  C:\Windows\System\dnNEHcV.exe
  2⤵
  PID:9480
- C:\Windows\System\ZsHGNYQ.exe
  C:\Windows\System\ZsHGNYQ.exe
  2⤵
  PID:9624
- C:\Windows\System\XCbgNsg.exe
  C:\Windows\System\XCbgNsg.exe
  2⤵
  PID:9648
- C:\Windows\System\jVfflJo.exe
  C:\Windows\System\jVfflJo.exe
  2⤵
  PID:9724
- C:\Windows\System\McrRgEp.exe
  C:\Windows\System\McrRgEp.exe
  2⤵
  PID:9676
- C:\Windows\System\ggAeGec.exe
  C:\Windows\System\ggAeGec.exe
  2⤵
  PID:9848
- C:\Windows\System\FPPuGUl.exe
  C:\Windows\System\FPPuGUl.exe
  2⤵
  PID:9912
- C:\Windows\System\UPUwuYu.exe
  C:\Windows\System\UPUwuYu.exe
  2⤵
  PID:9992
- C:\Windows\System\arxoNmk.exe
  C:\Windows\System\arxoNmk.exe
  2⤵
  PID:10056
- C:\Windows\System\PGXVvLL.exe
  C:\Windows\System\PGXVvLL.exe
  2⤵
  PID:10152
- C:\Windows\System\qGHYwDQ.exe
  C:\Windows\System\qGHYwDQ.exe
  2⤵
  PID:10232
- C:\Windows\System\tQkgEsp.exe
  C:\Windows\System\tQkgEsp.exe
  2⤵
  PID:10204
- C:\Windows\System\JKKlvKh.exe
  C:\Windows\System\JKKlvKh.exe
  2⤵
  PID:9408
- C:\Windows\System\SkWZoat.exe
  C:\Windows\System\SkWZoat.exe
  2⤵
  PID:9532
- C:\Windows\System\DXXJExQ.exe
  C:\Windows\System\DXXJExQ.exe
  2⤵
  PID:9720
- C:\Windows\System\rbhhzRu.exe
  C:\Windows\System\rbhhzRu.exe
  2⤵
  PID:9788
- C:\Windows\System\UUlANbX.exe
  C:\Windows\System\UUlANbX.exe
  2⤵
  PID:10088
- C:\Windows\System\FsWTmHr.exe
  C:\Windows\System\FsWTmHr.exe
  2⤵
  PID:10156
- C:\Windows\System\mxUVIRU.exe
  C:\Windows\System\mxUVIRU.exe
  2⤵
  PID:10228
- C:\Windows\System\yqYPRRO.exe
  C:\Windows\System\yqYPRRO.exe
  2⤵
  PID:9704
- C:\Windows\System\ixWXOxM.exe
  C:\Windows\System\ixWXOxM.exe
  2⤵
  PID:10084
- C:\Windows\System\GyWKhki.exe
  C:\Windows\System\GyWKhki.exe
  2⤵
  PID:9336
- C:\Windows\System\YJFGrqb.exe
  C:\Windows\System\YJFGrqb.exe
  2⤵
  PID:10244
- C:\Windows\System\gKbHBYk.exe
  C:\Windows\System\gKbHBYk.exe
  2⤵
  PID:10276
- C:\Windows\System\gaQInKe.exe
  C:\Windows\System\gaQInKe.exe
  2⤵
  PID:10304
- C:\Windows\System\WphvpIs.exe
  C:\Windows\System\WphvpIs.exe
  2⤵
  PID:10340
- C:\Windows\System\MYJeSZG.exe
  C:\Windows\System\MYJeSZG.exe
  2⤵
  PID:10380
- C:\Windows\System\uYfUigG.exe
  C:\Windows\System\uYfUigG.exe
  2⤵
  PID:10400
- C:\Windows\System\WvRmzEs.exe
  C:\Windows\System\WvRmzEs.exe
  2⤵
  PID:10432
- C:\Windows\System\lTcZrvw.exe
  C:\Windows\System\lTcZrvw.exe
  2⤵
  PID:10452
- C:\Windows\System\PkUeQYY.exe
  C:\Windows\System\PkUeQYY.exe
  2⤵
  PID:10468
- C:\Windows\System\BfEBqWf.exe
  C:\Windows\System\BfEBqWf.exe
  2⤵
  PID:10496
- C:\Windows\System\owzDLYA.exe
  C:\Windows\System\owzDLYA.exe
  2⤵
  PID:10524
- C:\Windows\System\HCjbGZw.exe
  C:\Windows\System\HCjbGZw.exe
  2⤵
  PID:10552
- C:\Windows\System\WMpRouh.exe
  C:\Windows\System\WMpRouh.exe
  2⤵
  PID:10572
- C:\Windows\System\OsIdPuC.exe
  C:\Windows\System\OsIdPuC.exe
  2⤵
  PID:10616
- C:\Windows\System\yYDfvsT.exe
  C:\Windows\System\yYDfvsT.exe
  2⤵
  PID:10648
- C:\Windows\System\RXxFBhx.exe
  C:\Windows\System\RXxFBhx.exe
  2⤵
  PID:10664
- C:\Windows\System\ArTLXUO.exe
  C:\Windows\System\ArTLXUO.exe
  2⤵
  PID:10704
- C:\Windows\System\usvIPDn.exe
  C:\Windows\System\usvIPDn.exe
  2⤵
  PID:10728
- C:\Windows\System\zRTAlwR.exe
  C:\Windows\System\zRTAlwR.exe
  2⤵
  PID:10776
- C:\Windows\System\RXjfiYi.exe
  C:\Windows\System\RXjfiYi.exe
  2⤵
  PID:10800
- C:\Windows\System\rFpiPHh.exe
  C:\Windows\System\rFpiPHh.exe
  2⤵
  PID:10816
- C:\Windows\System\bJTNjjw.exe
  C:\Windows\System\bJTNjjw.exe
  2⤵
  PID:10868
- C:\Windows\System\LEuBICi.exe
  C:\Windows\System\LEuBICi.exe
  2⤵
  PID:10888
- C:\Windows\System\nwYCvyf.exe
  C:\Windows\System\nwYCvyf.exe
  2⤵
  PID:10916
- C:\Windows\System\rejPiFa.exe
  C:\Windows\System\rejPiFa.exe
  2⤵
  PID:10952
- C:\Windows\System\RriGUGB.exe
  C:\Windows\System\RriGUGB.exe
  2⤵
  PID:10972
- C:\Windows\System\RUiEIcx.exe
  C:\Windows\System\RUiEIcx.exe
  2⤵
  PID:10996
- C:\Windows\System\XIPnpGY.exe
  C:\Windows\System\XIPnpGY.exe
  2⤵
  PID:11016
- C:\Windows\System\vYTKTUC.exe
  C:\Windows\System\vYTKTUC.exe
  2⤵
  PID:11040
- C:\Windows\System\Vpmcawr.exe
  C:\Windows\System\Vpmcawr.exe
  2⤵
  PID:11060
- C:\Windows\System\GKCCwXB.exe
  C:\Windows\System\GKCCwXB.exe
  2⤵
  PID:11084
- C:\Windows\System\gimTDGX.exe
  C:\Windows\System\gimTDGX.exe
  2⤵
  PID:11120
- C:\Windows\System\sHdTySy.exe
  C:\Windows\System\sHdTySy.exe
  2⤵
  PID:11148
- C:\Windows\System\SMYMxII.exe
  C:\Windows\System\SMYMxII.exe
  2⤵
  PID:11172
- C:\Windows\System\gqRAaUi.exe
  C:\Windows\System\gqRAaUi.exe
  2⤵
  PID:11224
- C:\Windows\System\cVQutdG.exe
  C:\Windows\System\cVQutdG.exe
  2⤵
  PID:11240
- C:\Windows\System\xwilMZL.exe
  C:\Windows\System\xwilMZL.exe
  2⤵
  PID:10180
- C:\Windows\System\omPtiaG.exe
  C:\Windows\System\omPtiaG.exe
  2⤵
  PID:9628
- C:\Windows\System\wVHeOZM.exe
  C:\Windows\System\wVHeOZM.exe
  2⤵
  PID:10360
- C:\Windows\System\gJbXveH.exe
  C:\Windows\System\gJbXveH.exe
  2⤵
  PID:10372
- C:\Windows\System\FoiEuHO.exe
  C:\Windows\System\FoiEuHO.exe
  2⤵
  PID:10504
- C:\Windows\System\bGklJGW.exe
  C:\Windows\System\bGklJGW.exe
  2⤵
  PID:10564
- C:\Windows\System\sJHhLPp.exe
  C:\Windows\System\sJHhLPp.exe
  2⤵
  PID:10592
- C:\Windows\System\PezySWp.exe
  C:\Windows\System\PezySWp.exe
  2⤵
  PID:10636
- C:\Windows\System\jeStdNm.exe
  C:\Windows\System\jeStdNm.exe
  2⤵
  PID:10716
- C:\Windows\System\glRGoEh.exe
  C:\Windows\System\glRGoEh.exe
  2⤵
  PID:10792
- C:\Windows\System\ElvvKvZ.exe
  C:\Windows\System\ElvvKvZ.exe
  2⤵
  PID:10860
- C:\Windows\System\ifsLNdk.exe
  C:\Windows\System\ifsLNdk.exe
  2⤵
  PID:10924
- C:\Windows\System\gCoMYjV.exe
  C:\Windows\System\gCoMYjV.exe
  2⤵
  PID:10988
- C:\Windows\System\krTvFOm.exe
  C:\Windows\System\krTvFOm.exe
  2⤵
  PID:11036
- C:\Windows\System\icQAhel.exe
  C:\Windows\System\icQAhel.exe
  2⤵
  PID:11112
- C:\Windows\System\IdWmSPj.exe
  C:\Windows\System\IdWmSPj.exe
  2⤵
  PID:11140
- C:\Windows\System\RCVmrYd.exe
  C:\Windows\System\RCVmrYd.exe
  2⤵
  PID:11236
- C:\Windows\System\BNYvNxl.exe
  C:\Windows\System\BNYvNxl.exe
  2⤵
  PID:10296
- C:\Windows\System\WILSKnZ.exe
  C:\Windows\System\WILSKnZ.exe
  2⤵
  PID:10520
- C:\Windows\System\AezAiaq.exe
  C:\Windows\System\AezAiaq.exe
  2⤵
  PID:10840
- C:\Windows\System\eDGwkZu.exe
  C:\Windows\System\eDGwkZu.exe
  2⤵
  PID:10940
- C:\Windows\System\NqSiPoA.exe
  C:\Windows\System\NqSiPoA.exe
  2⤵
  PID:11024
- C:\Windows\System\wSmenxT.exe
  C:\Windows\System\wSmenxT.exe
  2⤵
  PID:10256
- C:\Windows\System\AbIckYb.exe
  C:\Windows\System\AbIckYb.exe
  2⤵
  PID:10644
- C:\Windows\System\cAGQVOB.exe
  C:\Windows\System\cAGQVOB.exe
  2⤵
  PID:10812
- C:\Windows\System\KtTJJWK.exe
  C:\Windows\System\KtTJJWK.exe
  2⤵
  PID:10448
- C:\Windows\System\fpwUMta.exe
  C:\Windows\System\fpwUMta.exe
  2⤵
  PID:11096
- C:\Windows\System\kOmxwzw.exe
  C:\Windows\System\kOmxwzw.exe
  2⤵
  PID:11288
- C:\Windows\System\KXFjkOw.exe
  C:\Windows\System\KXFjkOw.exe
  2⤵
  PID:11304
- C:\Windows\System\qxkWPUn.exe
  C:\Windows\System\qxkWPUn.exe
  2⤵
  PID:11352
- C:\Windows\System\fxGORfb.exe
  C:\Windows\System\fxGORfb.exe
  2⤵
  PID:11372
- C:\Windows\System\wPUAxmt.exe
  C:\Windows\System\wPUAxmt.exe
  2⤵
  PID:11404
- C:\Windows\System\SNwdRCs.exe
  C:\Windows\System\SNwdRCs.exe
  2⤵
  PID:11424
- C:\Windows\System\DJqclTe.exe
  C:\Windows\System\DJqclTe.exe
  2⤵
  PID:11444
- C:\Windows\System\JLFqJNg.exe
  C:\Windows\System\JLFqJNg.exe
  2⤵
  PID:11476
- C:\Windows\System\aJohgCd.exe
  C:\Windows\System\aJohgCd.exe
  2⤵
  PID:11520
- C:\Windows\System\gFyXilb.exe
  C:\Windows\System\gFyXilb.exe
  2⤵
  PID:11540
- C:\Windows\System\FGtiQTm.exe
  C:\Windows\System\FGtiQTm.exe
  2⤵
  PID:11556
- C:\Windows\System\kckbUHV.exe
  C:\Windows\System\kckbUHV.exe
  2⤵
  PID:11596
- C:\Windows\System\BzWLkHJ.exe
  C:\Windows\System\BzWLkHJ.exe
  2⤵
  PID:11620
- C:\Windows\System\OnCIwSX.exe
  C:\Windows\System\OnCIwSX.exe
  2⤵
  PID:11664
- C:\Windows\System\cJDtBnS.exe
  C:\Windows\System\cJDtBnS.exe
  2⤵
  PID:11688
- C:\Windows\System\aApVsuZ.exe
  C:\Windows\System\aApVsuZ.exe
  2⤵
  PID:11720
- C:\Windows\System\kpRLreK.exe
  C:\Windows\System\kpRLreK.exe
  2⤵
  PID:11736
- C:\Windows\System\vdehVAC.exe
  C:\Windows\System\vdehVAC.exe
  2⤵
  PID:11776
- C:\Windows\System\jEmFJeL.exe
  C:\Windows\System\jEmFJeL.exe
  2⤵
  PID:11792
- C:\Windows\System\nzumsXr.exe
  C:\Windows\System\nzumsXr.exe
  2⤵
  PID:11820
- C:\Windows\System\lzGiAhb.exe
  C:\Windows\System\lzGiAhb.exe
  2⤵
  PID:11860
- C:\Windows\System\XlDtIGb.exe
  C:\Windows\System\XlDtIGb.exe
  2⤵
  PID:11880
- C:\Windows\System\bFekhIU.exe
  C:\Windows\System\bFekhIU.exe
  2⤵
  PID:11908
- C:\Windows\System\ZOHeeYr.exe
  C:\Windows\System\ZOHeeYr.exe
  2⤵
  PID:11928
- C:\Windows\System\FhLThGz.exe
  C:\Windows\System\FhLThGz.exe
  2⤵
  PID:11956
- C:\Windows\System\gXCAhHj.exe
  C:\Windows\System\gXCAhHj.exe
  2⤵
  PID:11980
- C:\Windows\System\OcRaDQf.exe
  C:\Windows\System\OcRaDQf.exe
  2⤵
  PID:12016
- C:\Windows\System\WRpZgqd.exe
  C:\Windows\System\WRpZgqd.exe
  2⤵
  PID:12044
- C:\Windows\System\qSMIsnQ.exe
  C:\Windows\System\qSMIsnQ.exe
  2⤵
  PID:12060
- C:\Windows\System\IMGAfMd.exe
  C:\Windows\System\IMGAfMd.exe
  2⤵
  PID:12096
- C:\Windows\System\cmKQRLB.exe
  C:\Windows\System\cmKQRLB.exe
  2⤵
  PID:12124
- C:\Windows\System\icyNvRH.exe
  C:\Windows\System\icyNvRH.exe
  2⤵
  PID:12144
- C:\Windows\System\TdbCwqd.exe
  C:\Windows\System\TdbCwqd.exe
  2⤵
  PID:12164
- C:\Windows\System\GIZUIGv.exe
  C:\Windows\System\GIZUIGv.exe
  2⤵
  PID:12188
- C:\Windows\System\FTdoEFE.exe
  C:\Windows\System\FTdoEFE.exe
  2⤵
  PID:12212
- C:\Windows\System\RCbzcKB.exe
  C:\Windows\System\RCbzcKB.exe
  2⤵
  PID:12256
- C:\Windows\System\MMxdQEe.exe
  C:\Windows\System\MMxdQEe.exe
  2⤵
  PID:12280
- C:\Windows\System\FxhNmXW.exe
  C:\Windows\System\FxhNmXW.exe
  2⤵
  PID:11272
- C:\Windows\System\xWpdCpt.exe
  C:\Windows\System\xWpdCpt.exe
  2⤵
  PID:11368
- C:\Windows\System\sOTjmEd.exe
  C:\Windows\System\sOTjmEd.exe
  2⤵
  PID:11400
- C:\Windows\System\FZVdjEb.exe
  C:\Windows\System\FZVdjEb.exe
  2⤵
  PID:11460
- C:\Windows\System\kGBncKr.exe
  C:\Windows\System\kGBncKr.exe
  2⤵
  PID:11516
- C:\Windows\System\XzfVPbE.exe
  C:\Windows\System\XzfVPbE.exe
  2⤵
  PID:11576
- C:\Windows\System\EUnYieq.exe
  C:\Windows\System\EUnYieq.exe
  2⤵
  PID:11712
- C:\Windows\System\qSUymIl.exe
  C:\Windows\System\qSUymIl.exe
  2⤵
  PID:11748
- C:\Windows\System\PnGjdBy.exe
  C:\Windows\System\PnGjdBy.exe
  2⤵
  PID:11772
- C:\Windows\System\kfFzqfP.exe
  C:\Windows\System\kfFzqfP.exe
  2⤵
  PID:11868
- C:\Windows\System\MbjvURn.exe
  C:\Windows\System\MbjvURn.exe
  2⤵
  PID:11896
- C:\Windows\System\LprRlTK.exe
  C:\Windows\System\LprRlTK.exe
  2⤵
  PID:12000
- C:\Windows\System\LjOKQqZ.exe
  C:\Windows\System\LjOKQqZ.exe
  2⤵
  PID:12080
- C:\Windows\System\DPSolWz.exe
  C:\Windows\System\DPSolWz.exe
  2⤵
  PID:12156
- C:\Windows\System\EXgIAih.exe
  C:\Windows\System\EXgIAih.exe
  2⤵
  PID:12196
- C:\Windows\System\HuuiwPi.exe
  C:\Windows\System\HuuiwPi.exe
  2⤵
  PID:11276
- C:\Windows\System\SajdnMH.exe
  C:\Windows\System\SajdnMH.exe
  2⤵
  PID:11348
- C:\Windows\System\OIaFFGB.exe
  C:\Windows\System\OIaFFGB.exe
  2⤵
  PID:11436
- C:\Windows\System\dloAvJg.exe
  C:\Windows\System\dloAvJg.exe
  2⤵
  PID:11548
- C:\Windows\System\VUHoYRR.exe
  C:\Windows\System\VUHoYRR.exe
  2⤵
  PID:11684
- C:\Windows\System\NNHWyOh.exe
  C:\Windows\System\NNHWyOh.exe
  2⤵
  PID:11784
- C:\Windows\System\VdOIrxo.exe
  C:\Windows\System\VdOIrxo.exe
  2⤵
  PID:11916
- C:\Windows\System\mJwybrC.exe
  C:\Windows\System\mJwybrC.exe
  2⤵
  PID:12176
- C:\Windows\System\gQQEppz.exe
  C:\Windows\System\gQQEppz.exe
  2⤵
  PID:11364
- C:\Windows\System\kGboqaj.exe
  C:\Windows\System\kGboqaj.exe
  2⤵
  PID:11728
- C:\Windows\System\TnofDre.exe
  C:\Windows\System\TnofDre.exe
  2⤵
  PID:12312
- C:\Windows\System\XNeKPLu.exe
  C:\Windows\System\XNeKPLu.exe
  2⤵
  PID:12332
- C:\Windows\System\QBzkMID.exe
  C:\Windows\System\QBzkMID.exe
  2⤵
  PID:12372
- C:\Windows\System\BrUMviV.exe
  C:\Windows\System\BrUMviV.exe
  2⤵
  PID:12404
- C:\Windows\System\rUiGVFE.exe
  C:\Windows\System\rUiGVFE.exe
  2⤵
  PID:12452
- C:\Windows\System\WutcyLD.exe
  C:\Windows\System\WutcyLD.exe
  2⤵
  PID:12472
- C:\Windows\System\rvOUXMv.exe
  C:\Windows\System\rvOUXMv.exe
  2⤵
  PID:12492
- C:\Windows\System\TuqFpSM.exe
  C:\Windows\System\TuqFpSM.exe
  2⤵
  PID:12512
- C:\Windows\System\pMrzffh.exe
  C:\Windows\System\pMrzffh.exe
  2⤵
  PID:12532
- C:\Windows\System\CAJHndi.exe
  C:\Windows\System\CAJHndi.exe
  2⤵
  PID:12568
- C:\Windows\System\NsUJJnY.exe
  C:\Windows\System\NsUJJnY.exe
  2⤵
  PID:12624
- C:\Windows\System\WoWoDiZ.exe
  C:\Windows\System\WoWoDiZ.exe
  2⤵
  PID:12644
- C:\Windows\System\oNSVniv.exe
  C:\Windows\System\oNSVniv.exe
  2⤵
  PID:12664
- C:\Windows\System\JffahOt.exe
  C:\Windows\System\JffahOt.exe
  2⤵
  PID:12708
- C:\Windows\System\kfOrVxq.exe
  C:\Windows\System\kfOrVxq.exe
  2⤵
  PID:12724
- C:\Windows\System\BKgRMAp.exe
  C:\Windows\System\BKgRMAp.exe
  2⤵
  PID:12740
- C:\Windows\System\boosGsZ.exe
  C:\Windows\System\boosGsZ.exe
  2⤵
  PID:12768
- C:\Windows\System\BAeHnjp.exe
  C:\Windows\System\BAeHnjp.exe
  2⤵
  PID:12796
- C:\Windows\System\SLkmZgM.exe
  C:\Windows\System\SLkmZgM.exe
  2⤵
  PID:12812
- C:\Windows\System\DpbvHrq.exe
  C:\Windows\System\DpbvHrq.exe
  2⤵
  PID:12876
- C:\Windows\System\PkwCPHu.exe
  C:\Windows\System\PkwCPHu.exe
  2⤵
  PID:12896
- C:\Windows\System\yTrnFhG.exe
  C:\Windows\System\yTrnFhG.exe
  2⤵
  PID:12948
- C:\Windows\System\CpjDdrw.exe
  C:\Windows\System\CpjDdrw.exe
  2⤵
  PID:12972
- C:\Windows\System\NRQEPjO.exe
  C:\Windows\System\NRQEPjO.exe
  2⤵
  PID:13000
- C:\Windows\System\EKjGOpM.exe
  C:\Windows\System\EKjGOpM.exe
  2⤵
  PID:13048
- C:\Windows\System\KLzshfT.exe
  C:\Windows\System\KLzshfT.exe
  2⤵
  PID:13064
- C:\Windows\System\lNkqzUg.exe
  C:\Windows\System\lNkqzUg.exe
  2⤵
  PID:13092
- C:\Windows\System\tJLkarf.exe
  C:\Windows\System\tJLkarf.exe
  2⤵
  PID:13120
- C:\Windows\System\SZHiwfh.exe
  C:\Windows\System\SZHiwfh.exe
  2⤵
  PID:13144
- C:\Windows\System\PASZVEc.exe
  C:\Windows\System\PASZVEc.exe
  2⤵
  PID:13172
- C:\Windows\System\iOrYTgP.exe
  C:\Windows\System\iOrYTgP.exe
  2⤵
  PID:13208
- C:\Windows\System\clpKVXW.exe
  C:\Windows\System\clpKVXW.exe
  2⤵
  PID:13228
- C:\Windows\System\fFQOnmO.exe
  C:\Windows\System\fFQOnmO.exe
  2⤵
  PID:13252
- C:\Windows\System\haJyKKp.exe
  C:\Windows\System\haJyKKp.exe
  2⤵
  PID:13292
- C:\Windows\System\ItvfLpR.exe
  C:\Windows\System\ItvfLpR.exe
  2⤵
  PID:11844
- C:\Windows\System\BfaRJqj.exe
  C:\Windows\System\BfaRJqj.exe
  2⤵
  PID:12108
- C:\Windows\System\nqHxZYC.exe
  C:\Windows\System\nqHxZYC.exe
  2⤵
  PID:11420
- C:\Windows\System\DgUewVj.exe
  C:\Windows\System\DgUewVj.exe
  2⤵
  PID:12388
- C:\Windows\System\lRPjyEZ.exe
  C:\Windows\System\lRPjyEZ.exe
  2⤵
  PID:12424
- C:\Windows\System\TSfGITb.exe
  C:\Windows\System\TSfGITb.exe
  2⤵
  PID:12488
- C:\Windows\System\XIwfhlI.exe
  C:\Windows\System\XIwfhlI.exe
  2⤵
  PID:12560
- C:\Windows\System\uaCATND.exe
  C:\Windows\System\uaCATND.exe
  2⤵
  PID:12620
- C:\Windows\System\bVLYBgt.exe
  C:\Windows\System\bVLYBgt.exe
  2⤵
  PID:12692
- C:\Windows\System\gqqtsZb.exe
  C:\Windows\System\gqqtsZb.exe
  2⤵
  PID:12720
- C:\Windows\System\BBFSzJX.exe
  C:\Windows\System\BBFSzJX.exe
  2⤵
  PID:12792
- C:\Windows\System\NdJXcFK.exe
  C:\Windows\System\NdJXcFK.exe
  2⤵
  PID:12912
- C:\Windows\System\FxLNICu.exe
  C:\Windows\System\FxLNICu.exe
  2⤵
  PID:12960
- C:\Windows\System\NMMSSGw.exe
  C:\Windows\System\NMMSSGw.exe
  2⤵
  PID:13016
- C:\Windows\System\SYCYyiI.exe
  C:\Windows\System\SYCYyiI.exe
  2⤵
  PID:13128
- C:\Windows\System\pRvsGki.exe
  C:\Windows\System\pRvsGki.exe
  2⤵
  PID:13156
- C:\Windows\System\SEfJJGN.exe
  C:\Windows\System\SEfJJGN.exe
  2⤵
  PID:13248
- C:\Windows\System\vWlnmGU.exe
  C:\Windows\System\vWlnmGU.exe
  2⤵
  PID:13288
- C:\Windows\System\kzcCCVv.exe
  C:\Windows\System\kzcCCVv.exe
  2⤵
  PID:12036
- C:\Windows\System\OklHxLh.exe
  C:\Windows\System\OklHxLh.exe
  2⤵
  PID:12400
- C:\Windows\System\aprdUqZ.exe
  C:\Windows\System\aprdUqZ.exe
  2⤵
  PID:12528
- C:\Windows\System\hacGUer.exe
  C:\Windows\System\hacGUer.exe
  2⤵
  PID:12752
- C:\Windows\System\nhSKcuV.exe
  C:\Windows\System\nhSKcuV.exe
  2⤵
  PID:12936
- C:\Windows\System\vbwXkSg.exe
  C:\Windows\System\vbwXkSg.exe
  2⤵
  PID:12892
- C:\Windows\System\cOzFWOZ.exe
  C:\Windows\System\cOzFWOZ.exe
  2⤵
  PID:11508
- C:\Windows\System\NEAYnUv.exe
  C:\Windows\System\NEAYnUv.exe
  2⤵
  PID:12396
- C:\Windows\System\QwzkTUO.exe
  C:\Windows\System\QwzkTUO.exe
  2⤵
  PID:12732
- C:\Windows\System\czYtyZB.exe
  C:\Windows\System\czYtyZB.exe
  2⤵
  PID:12172
- C:\Windows\System\pnKgxeG.exe
  C:\Windows\System\pnKgxeG.exe
  2⤵
  PID:12888
- C:\Windows\System\DVkCcMP.exe
  C:\Windows\System\DVkCcMP.exe
  2⤵
  PID:13320
- C:\Windows\System\MbzPMQd.exe
  C:\Windows\System\MbzPMQd.exe
  2⤵
  PID:13356
- C:\Windows\System\FpLRHbw.exe
  C:\Windows\System\FpLRHbw.exe
  2⤵
  PID:13388
- C:\Windows\System\HhjRsXX.exe
  C:\Windows\System\HhjRsXX.exe
  2⤵
  PID:13408
- C:\Windows\System\IBADqGV.exe
  C:\Windows\System\IBADqGV.exe
  2⤵
  PID:13448
- C:\Windows\System\yvHjIdz.exe
  C:\Windows\System\yvHjIdz.exe
  2⤵
  PID:13468
- C:\Windows\System\mZaYaTr.exe
  C:\Windows\System\mZaYaTr.exe
  2⤵
  PID:13488
- C:\Windows\System\DqJkceo.exe
  C:\Windows\System\DqJkceo.exe
  2⤵
  PID:13520
- C:\Windows\System\KnMvqra.exe
  C:\Windows\System\KnMvqra.exe
  2⤵
  PID:13536
- C:\Windows\System\YylRDnE.exe
  C:\Windows\System\YylRDnE.exe
  2⤵
  PID:13556
- C:\Windows\System\JJABqzZ.exe
  C:\Windows\System\JJABqzZ.exe
  2⤵
  PID:13588
- C:\Windows\System\HSQnXeF.exe
  C:\Windows\System\HSQnXeF.exe
  2⤵
  PID:13608
- C:\Windows\System\QVTDCzL.exe
  C:\Windows\System\QVTDCzL.exe
  2⤵
  PID:13624
- C:\Windows\System\SpGwvcF.exe
  C:\Windows\System\SpGwvcF.exe
  2⤵
  PID:13656
- C:\Windows\System\GnbgbNt.exe
  C:\Windows\System\GnbgbNt.exe
  2⤵
  PID:13692
- C:\Windows\System\sUEVBXy.exe
  C:\Windows\System\sUEVBXy.exe
  2⤵
  PID:13708
- C:\Windows\System\rFgKlpm.exe
  C:\Windows\System\rFgKlpm.exe
  2⤵
  PID:13764
- C:\Windows\System\vaySapc.exe
  C:\Windows\System\vaySapc.exe
  2⤵
  PID:13792
- C:\Windows\System\KssnyJb.exe
  C:\Windows\System\KssnyJb.exe
  2⤵
  PID:13816
- C:\Windows\System\PuraTRk.exe
  C:\Windows\System\PuraTRk.exe
  2⤵
  PID:13856
- C:\Windows\System\DfZTDex.exe
  C:\Windows\System\DfZTDex.exe
  2⤵
  PID:13884
- C:\Windows\System\KQityTS.exe
  C:\Windows\System\KQityTS.exe
  2⤵
  PID:13928
- C:\Windows\System\LqOzSro.exe
  C:\Windows\System\LqOzSro.exe
  2⤵
  PID:13952
- C:\Windows\System\glKghtZ.exe
  C:\Windows\System\glKghtZ.exe
  2⤵
  PID:13992
- C:\Windows\System\yFxZaWD.exe
  C:\Windows\System\yFxZaWD.exe
  2⤵
  PID:14008
- C:\Windows\System\OeafCuU.exe
  C:\Windows\System\OeafCuU.exe
  2⤵
  PID:14024
- C:\Windows\System\NBbvQJX.exe
  C:\Windows\System\NBbvQJX.exe
  2⤵
  PID:14044
- C:\Windows\System\PxOuaHH.exe
  C:\Windows\System\PxOuaHH.exe
  2⤵
  PID:14072
- C:\Windows\System\gKGfeKr.exe
  C:\Windows\System\gKGfeKr.exe
  2⤵
  PID:14092
- C:\Windows\System\sKJkFRC.exe
  C:\Windows\System\sKJkFRC.exe
  2⤵
  PID:14116
- C:\Windows\System\qcVUyyL.exe
  C:\Windows\System\qcVUyyL.exe
  2⤵
  PID:14132
- C:\Windows\System\vcbnkBC.exe
  C:\Windows\System\vcbnkBC.exe
  2⤵
  PID:14152
- C:\Windows\System\uajyHMB.exe
  C:\Windows\System\uajyHMB.exe
  2⤵
  PID:14180
- C:\Windows\System\LSEtgpv.exe
  C:\Windows\System\LSEtgpv.exe
  2⤵
  PID:14236
- C:\Windows\System\rgQsyRV.exe
  C:\Windows\System\rgQsyRV.exe
  2⤵
  PID:14280
- C:\Windows\System\ZAPINFa.exe
  C:\Windows\System\ZAPINFa.exe
  2⤵
  PID:14312
- C:\Windows\System\dARAtjP.exe
  C:\Windows\System\dARAtjP.exe
  2⤵
  PID:14332
- C:\Windows\System\bxHCKtJ.exe
  C:\Windows\System\bxHCKtJ.exe
  2⤵
  PID:13280
- C:\Windows\System\lkBtPzl.exe
  C:\Windows\System\lkBtPzl.exe
  2⤵
  PID:13404
- C:\Windows\System\TJLvysc.exe
  C:\Windows\System\TJLvysc.exe
  2⤵
  PID:13512
- C:\Windows\System\ozBsvNN.exe
  C:\Windows\System\ozBsvNN.exe
  2⤵
  PID:13528
- C:\Windows\System\qxFJbhH.exe
  C:\Windows\System\qxFJbhH.exe
  2⤵
  PID:13636
- C:\Windows\System\jjxDpAD.exe
  C:\Windows\System\jjxDpAD.exe
  2⤵
  PID:13680
- C:\Windows\System\hCUsXaQ.exe
  C:\Windows\System\hCUsXaQ.exe
  2⤵
  PID:13704
- C:\Windows\System\QhIeqwb.exe
  C:\Windows\System\QhIeqwb.exe
  2⤵
  PID:13812
- C:\Windows\System\CCcADGY.exe
  C:\Windows\System\CCcADGY.exe
  2⤵
  PID:13880
- C:\Windows\System\KQApYkx.exe
  C:\Windows\System\KQApYkx.exe
  2⤵
  PID:13936
- C:\Windows\System\NFMjUki.exe
  C:\Windows\System\NFMjUki.exe
  2⤵
  PID:14016
- C:\Windows\System\SpvufxL.exe
  C:\Windows\System\SpvufxL.exe
  2⤵
  PID:14068
- C:\Windows\System\gaxcFJZ.exe
  C:\Windows\System\gaxcFJZ.exe
  2⤵
  PID:14148
- C:\Windows\System\mbaCGGe.exe
  C:\Windows\System\mbaCGGe.exe
  2⤵
  PID:14176
- C:\Windows\System\USJdmUm.exe
  C:\Windows\System\USJdmUm.exe
  2⤵
  PID:14276
- C:\Windows\System\QMuHMRv.exe
  C:\Windows\System\QMuHMRv.exe
  2⤵
  PID:14324
- C:\Windows\System\QrulzRv.exe
  C:\Windows\System\QrulzRv.exe
  2⤵
  PID:13380
- C:\Windows\System\RowdcDh.exe
  C:\Windows\System\RowdcDh.exe
  2⤵
  PID:13508
- C:\Windows\System\KmrYzGw.exe
  C:\Windows\System\KmrYzGw.exe
  2⤵
  PID:13664
- C:\Windows\System\QaADdSh.exe
  C:\Windows\System\QaADdSh.exe
  2⤵
  PID:13808
- C:\Windows\System\Rorbdjt.exe
  C:\Windows\System\Rorbdjt.exe
  2⤵
  PID:14004
- C:\Windows\System\AxonpQR.exe
  C:\Windows\System\AxonpQR.exe
  2⤵
  PID:14084
- C:\Windows\System\KxeglJn.exe
  C:\Windows\System\KxeglJn.exe
  2⤵
  PID:14216
- C:\Windows\System\lmEdqVV.exe
  C:\Windows\System\lmEdqVV.exe
  2⤵
  PID:14208
- C:\Windows\System\OADwAdx.exe
  C:\Windows\System\OADwAdx.exe
  2⤵
  PID:13384
- C:\Windows\System\GXeUITQ.exe
  C:\Windows\System\GXeUITQ.exe
  2⤵
  PID:13780
- C:\Windows\System\aIJbcPh.exe
  C:\Windows\System\aIJbcPh.exe
  2⤵
  PID:14356
- C:\Windows\System\RkoIbIt.exe
  C:\Windows\System\RkoIbIt.exe
  2⤵
  PID:14380
- C:\Windows\System\WVnHQCw.exe
  C:\Windows\System\WVnHQCw.exe
  2⤵
  PID:14428
- C:\Windows\System\vhUREVP.exe
  C:\Windows\System\vhUREVP.exe
  2⤵
  PID:14472
- C:\Windows\System\FQuHlxq.exe
  C:\Windows\System\FQuHlxq.exe
  2⤵
  PID:14504
- C:\Windows\System\kNhuTXl.exe
  C:\Windows\System\kNhuTXl.exe
  2⤵
  PID:14520
- C:\Windows\System\IvEOvvf.exe
  C:\Windows\System\IvEOvvf.exe
  2⤵
  PID:14544
- C:\Windows\System\HWtsgAT.exe
  C:\Windows\System\HWtsgAT.exe
  2⤵
  PID:14572
- C:\Windows\System\yLSWIsw.exe
  C:\Windows\System\yLSWIsw.exe
  2⤵
  PID:14592
- C:\Windows\System\EINSEeF.exe
  C:\Windows\System\EINSEeF.exe
  2⤵
  PID:14608
- C:\Windows\System\iRtnCXy.exe
  C:\Windows\System\iRtnCXy.exe
  2⤵
  PID:14632
- C:\Windows\System\rSLxiDC.exe
  C:\Windows\System\rSLxiDC.exe
  2⤵
  PID:14668
- C:\Windows\System\EgvpVAP.exe
  C:\Windows\System\EgvpVAP.exe
  2⤵
  PID:14720
- C:\Windows\System\etShUxB.exe
  C:\Windows\System\etShUxB.exe
  2⤵
  PID:14772
- C:\Windows\System\uoShrXU.exe
  C:\Windows\System\uoShrXU.exe
  2⤵
  PID:14788
- C:\Windows\System\fdNWllw.exe
  C:\Windows\System\fdNWllw.exe
  2⤵
  PID:14832
- C:\Windows\System\YIUeHVm.exe
  C:\Windows\System\YIUeHVm.exe
  2⤵
  PID:14856
- C:\Windows\System\XYxdfDA.exe
  C:\Windows\System\XYxdfDA.exe
  2⤵
  PID:14880
- C:\Windows\System\zhBAwyn.exe
  C:\Windows\System\zhBAwyn.exe
  2⤵
  PID:14900
- C:\Windows\System\CQVXhOf.exe
  C:\Windows\System\CQVXhOf.exe
  2⤵
  PID:14944
- C:\Windows\System\GghLqEu.exe
  C:\Windows\System\GghLqEu.exe
  2⤵
  PID:14960
- C:\Windows\System\YwtzpaY.exe
  C:\Windows\System\YwtzpaY.exe
  2⤵
  PID:14976
- C:\Windows\System\HgQcGQL.exe
  C:\Windows\System\HgQcGQL.exe
  2⤵
  PID:15000
- C:\Windows\System\ECSfFyJ.exe
  C:\Windows\System\ECSfFyJ.exe
  2⤵
  PID:15016
- C:\Windows\System\CbOInvW.exe
  C:\Windows\System\CbOInvW.exe
  2⤵
  PID:15040
- C:\Windows\System\CxuDxnB.exe
  C:\Windows\System\CxuDxnB.exe
  2⤵
  PID:15060
- C:\Windows\System\UkuXxnw.exe
  C:\Windows\System\UkuXxnw.exe
  2⤵
  PID:15084
- C:\Windows\System\jrbsYwK.exe
  C:\Windows\System\jrbsYwK.exe
  2⤵
  PID:15108
- C:\Windows\System\lxDPZlI.exe
  C:\Windows\System\lxDPZlI.exe
  2⤵
  PID:15124
- C:\Windows\System\SZyldlT.exe
  C:\Windows\System\SZyldlT.exe
  2⤵
  PID:15140
- C:\Windows\System\NQnvuek.exe
  C:\Windows\System\NQnvuek.exe
  2⤵
  PID:15160
- C:\Windows\System\pMCmRFV.exe
  C:\Windows\System\pMCmRFV.exe
  2⤵
  PID:15176
- C:\Windows\System\RshKwLx.exe
  C:\Windows\System\RshKwLx.exe
  2⤵
  PID:15196
- C:\Windows\System\bryXqLO.exe
  C:\Windows\System\bryXqLO.exe
  2⤵
  PID:15216
- C:\Windows\System\TRtazJz.exe
  C:\Windows\System\TRtazJz.exe
  2⤵
  PID:15236
- C:\Windows\System\wGHSrzb.exe
  C:\Windows\System\wGHSrzb.exe
  2⤵
  PID:15264
- C:\Windows\System\scuKdDd.exe
  C:\Windows\System\scuKdDd.exe
  2⤵
  PID:15280
- C:\Windows\System\VnZKvDX.exe
  C:\Windows\System\VnZKvDX.exe
  2⤵
  PID:15296
- C:\Windows\System\ewkNokK.exe
  C:\Windows\System\ewkNokK.exe
  2⤵
  PID:15320
- C:\Windows\System\oetGVqO.exe
  C:\Windows\System\oetGVqO.exe
  2⤵
  PID:15340
- C:\Windows\System\xzxjBUO.exe
  C:\Windows\System\xzxjBUO.exe
  2⤵
  PID:14260
- C:\Windows\System\npWszmx.exe
  C:\Windows\System\npWszmx.exe
  2⤵
  PID:14388
- C:\Windows\System\VDsqzhx.exe
  C:\Windows\System\VDsqzhx.exe
  2⤵
  PID:13652
- C:\Windows\System\DIMnbdt.exe
  C:\Windows\System\DIMnbdt.exe
  2⤵
  PID:14364
- C:\Windows\System\BypeGjB.exe
  C:\Windows\System\BypeGjB.exe
  2⤵
  PID:14456
- C:\Windows\System\ZBMaQEW.exe
  C:\Windows\System\ZBMaQEW.exe
  2⤵
  PID:14488
- C:\Windows\System\eslrHwi.exe
  C:\Windows\System\eslrHwi.exe
  2⤵
  PID:14564
- C:\Windows\System\YeJimjt.exe
  C:\Windows\System\YeJimjt.exe
  2⤵
  PID:14584
- C:\Windows\System\JczYgPp.exe
  C:\Windows\System\JczYgPp.exe
  2⤵
  PID:14688
- C:\Windows\System\CyRPRjU.exe
  C:\Windows\System\CyRPRjU.exe
  2⤵
  PID:14624
- C:\Windows\System\ybmHPMp.exe
  C:\Windows\System\ybmHPMp.exe
  2⤵
  PID:14744
- C:\Windows\System\lehxpuZ.exe
  C:\Windows\System\lehxpuZ.exe
  2⤵
  PID:14740
- C:\Windows\System\lNvbEwA.exe
  C:\Windows\System\lNvbEwA.exe
  2⤵
  PID:14804
- C:\Windows\System\JzJaohG.exe
  C:\Windows\System\JzJaohG.exe
  2⤵
  PID:14920
- C:\Windows\System\vzTRZkK.exe
  C:\Windows\System\vzTRZkK.exe
  2⤵
  PID:14924
- C:\Windows\System\QdpqHMJ.exe
  C:\Windows\System\QdpqHMJ.exe
  2⤵
  PID:14968
- C:\Windows\System\SJkKYea.exe
  C:\Windows\System\SJkKYea.exe
  2⤵
  PID:15100
- C:\Windows\System\lKZmnYU.exe
  C:\Windows\System\lKZmnYU.exe
  2⤵
  PID:14996
- C:\Windows\System\DlGetdk.exe
  C:\Windows\System\DlGetdk.exe
  2⤵
  PID:15068
- C:\Windows\System\HLvIotF.exe
  C:\Windows\System\HLvIotF.exe
  2⤵
  PID:15212
- C:\Windows\System\DPBLFOm.exe
  C:\Windows\System\DPBLFOm.exe
  2⤵
  PID:15152
- C:\Windows\System\fHZRwyG.exe
  C:\Windows\System\fHZRwyG.exe
  2⤵
  PID:15184
- C:\Windows\System\ufzWWsa.exe
  C:\Windows\System\ufzWWsa.exe
  2⤵
  PID:15232
- C:\Windows\System\FdpaAmq.exe
  C:\Windows\System\FdpaAmq.exe
  2⤵
  PID:14644
- C:\Windows\System\gzusRQX.exe
  C:\Windows\System\gzusRQX.exe
  2⤵
  PID:15372
- C:\Windows\System\FnYLiCE.exe
  C:\Windows\System\FnYLiCE.exe
  2⤵
  PID:15392
- C:\Windows\System\JJJBzfm.exe
  C:\Windows\System\JJJBzfm.exe
  2⤵
  PID:15408
- C:\Windows\System\CeZXZRL.exe
  C:\Windows\System\CeZXZRL.exe
  2⤵
  PID:15428
- C:\Windows\System\RMlCroS.exe
  C:\Windows\System\RMlCroS.exe
  2⤵
  PID:15444
- C:\Windows\System\wDAsqgd.exe
  C:\Windows\System\wDAsqgd.exe
  2⤵
  PID:15464
- C:\Windows\System\YWQlUEB.exe
  C:\Windows\System\YWQlUEB.exe
  2⤵
  PID:15496
- C:\Windows\System\NZdjBJX.exe
  C:\Windows\System\NZdjBJX.exe
  2⤵
  PID:15512
- C:\Windows\System\TBMruep.exe
  C:\Windows\System\TBMruep.exe
  2⤵
  PID:15528
- C:\Windows\System\VZviegl.exe
  C:\Windows\System\VZviegl.exe
  2⤵
  PID:15544
- C:\Windows\System\OTyrTTk.exe
  C:\Windows\System\OTyrTTk.exe
  2⤵
  PID:15568
- C:\Windows\System\AbFxLCl.exe
  C:\Windows\System\AbFxLCl.exe
  2⤵
  PID:15588
- C:\Windows\System\nryVUrD.exe
  C:\Windows\System\nryVUrD.exe
  2⤵
  PID:15616
- C:\Windows\System\aKfnVWa.exe
  C:\Windows\System\aKfnVWa.exe
  2⤵
  PID:15640
- C:\Windows\System\ZcmDURe.exe
  C:\Windows\System\ZcmDURe.exe
  2⤵
  PID:15656
- C:\Windows\System\ySROhEv.exe
  C:\Windows\System\ySROhEv.exe
  2⤵
  PID:15680
- C:\Windows\System\NCBTEIN.exe
  C:\Windows\System\NCBTEIN.exe
  2⤵
  PID:15696
- C:\Windows\System\qLQohgL.exe
  C:\Windows\System\qLQohgL.exe
  2⤵
  PID:15724
- C:\Windows\System\ELfAhjp.exe
  C:\Windows\System\ELfAhjp.exe
  2⤵
  PID:15740
- C:\Windows\System\MchxetE.exe
  C:\Windows\System\MchxetE.exe
  2⤵
  PID:15756
- C:\Windows\System\cjPRmRN.exe
  C:\Windows\System\cjPRmRN.exe
  2⤵
  PID:15780
- C:\Windows\System\KaLGfqa.exe
  C:\Windows\System\KaLGfqa.exe
  2⤵
  PID:15804
- C:\Windows\System\bFpRGQD.exe
  C:\Windows\System\bFpRGQD.exe
  2⤵
  PID:15820
- C:\Windows\System\xBrpCVT.exe
  C:\Windows\System\xBrpCVT.exe
  2⤵
  PID:15844
- C:\Windows\System\wjgMDlu.exe
  C:\Windows\System\wjgMDlu.exe
  2⤵
  PID:15868
- C:\Windows\System\EKySVyW.exe
  C:\Windows\System\EKySVyW.exe
  2⤵
  PID:15896
- C:\Windows\System\HBYOKca.exe
  C:\Windows\System\HBYOKca.exe
  2⤵
  PID:15912
- C:\Windows\System\LZmagaq.exe
  C:\Windows\System\LZmagaq.exe
  2⤵
  PID:15940
- C:\Windows\System\RCoRZFy.exe
  C:\Windows\System\RCoRZFy.exe
  2⤵
  PID:15956
- C:\Windows\System\uOhPqRK.exe
  C:\Windows\System\uOhPqRK.exe
  2⤵
  PID:15976
- C:\Windows\System\RCBnwAE.exe
  C:\Windows\System\RCBnwAE.exe
  2⤵
  PID:15992
- C:\Windows\System\wxsXOjX.exe
  C:\Windows\System\wxsXOjX.exe
  2⤵
  PID:16016
- C:\Windows\System\rmxnqMz.exe
  C:\Windows\System\rmxnqMz.exe
  2⤵
  PID:16032
- C:\Windows\System\CtzReYY.exe
  C:\Windows\System\CtzReYY.exe
  2⤵
  PID:16060
- C:\Windows\System\YCXOgkn.exe
  C:\Windows\System\YCXOgkn.exe
  2⤵
  PID:16076
- C:\Windows\System\LYqWZKb.exe
  C:\Windows\System\LYqWZKb.exe
  2⤵
  PID:16092
- C:\Windows\System\lUZqpsq.exe
  C:\Windows\System\lUZqpsq.exe
  2⤵
  PID:16116
- C:\Windows\System\aMzoEMm.exe
  C:\Windows\System\aMzoEMm.exe
  2⤵
  PID:16144
- C:\Windows\System\MAcduOB.exe
  C:\Windows\System\MAcduOB.exe
  2⤵
  PID:16164
- C:\Windows\System\kmuSlBQ.exe
  C:\Windows\System\kmuSlBQ.exe
  2⤵
  PID:16196
- C:\Windows\System\cGsmyYM.exe
  C:\Windows\System\cGsmyYM.exe
  2⤵
  PID:16212
- C:\Windows\System\pWXYLBq.exe
  C:\Windows\System\pWXYLBq.exe
  2⤵
  PID:16228
- C:\Windows\System\BcISWxT.exe
  C:\Windows\System\BcISWxT.exe
  2⤵
  PID:16248
- C:\Windows\System\JVSIClR.exe
  C:\Windows\System\JVSIClR.exe
  2⤵
  PID:16272
- C:\Windows\System\nbWEFBs.exe
  C:\Windows\System\nbWEFBs.exe
  2⤵
  PID:16288
- C:\Windows\System\jgxhEzB.exe
  C:\Windows\System\jgxhEzB.exe
  2⤵
  PID:16312
- C:\Windows\System\IxDYtJX.exe
  C:\Windows\System\IxDYtJX.exe
  2⤵
  PID:16336
- C:\Windows\System\nezKAPY.exe
  C:\Windows\System\nezKAPY.exe
  2⤵
  PID:16364
- C:\Windows\System\TFDwelc.exe
  C:\Windows\System\TFDwelc.exe
  2⤵
  PID:14760
- C:\Windows\System\kDHdALq.exe
  C:\Windows\System\kDHdALq.exe
  2⤵
  PID:13580
- C:\Windows\System\peoVjQi.exe
  C:\Windows\System\peoVjQi.exe
  2⤵
  PID:14988
- C:\Windows\System\jQvSujx.exe
  C:\Windows\System\jQvSujx.exe
  2⤵
  PID:15208
- C:\Windows\System\IQVaaCQ.exe
  C:\Windows\System\IQVaaCQ.exe
  2⤵
  PID:14128
- C:\Windows\System\nZOhWAU.exe
  C:\Windows\System\nZOhWAU.exe
  2⤵
  PID:14800
- C:\Windows\System\oEcXMJy.exe
  C:\Windows\System\oEcXMJy.exe
  2⤵
  PID:15436
- C:\Windows\System\ARYefBA.exe
  C:\Windows\System\ARYefBA.exe
  2⤵
  PID:14972
- C:\Windows\System\gKizgnI.exe
  C:\Windows\System\gKizgnI.exe
  2⤵
  PID:14484
- C:\Windows\System\lntZlgl.exe
  C:\Windows\System\lntZlgl.exe
  2⤵
  PID:15012
- C:\Windows\System\eUjtbej.exe
  C:\Windows\System\eUjtbej.exe
  2⤵
  PID:15148
- C:\Windows\System\dpGaTAm.exe
  C:\Windows\System\dpGaTAm.exe
  2⤵
  PID:15308
- C:\Windows\System\eiUYetn.exe
  C:\Windows\System\eiUYetn.exe
  2⤵
  PID:15652
- C:\Windows\System\YNYIhsT.exe
  C:\Windows\System\YNYIhsT.exe
  2⤵
  PID:15116
- C:\Windows\System\VryUQlJ.exe
  C:\Windows\System\VryUQlJ.exe
  2⤵
  PID:14712
- C:\Windows\System\NyCTfoU.exe
  C:\Windows\System\NyCTfoU.exe
  2⤵
  PID:14780
- C:\Windows\System\qJNFMCN.exe
  C:\Windows\System\qJNFMCN.exe
  2⤵
  PID:16324
- C:\Windows\System\PXssRuB.exe
  C:\Windows\System\PXssRuB.exe
  2⤵
  PID:15400
- C:\Windows\System\BwoLgBc.exe
  C:\Windows\System\BwoLgBc.exe
  2⤵
  PID:15796
- C:\Windows\System\NCBxakW.exe
  C:\Windows\System\NCBxakW.exe
  2⤵
  PID:16360
- C:\Windows\System\QwMypSX.exe
  C:\Windows\System\QwMypSX.exe
  2⤵
  PID:15864
- C:\Windows\System\FjdBpog.exe
  C:\Windows\System\FjdBpog.exe
  2⤵
  PID:15952
- C:\Windows\System\PlEakmJ.exe
  C:\Windows\System\PlEakmJ.exe
  2⤵
  PID:15560
- C:\Windows\System\TOzhFWG.exe
  C:\Windows\System\TOzhFWG.exe
  2⤵
  PID:16180
- C:\Windows\System\AyoEjgo.exe
  C:\Windows\System\AyoEjgo.exe
  2⤵
  PID:15776
- C:\Windows\System\QnsDgAw.exe
  C:\Windows\System\QnsDgAw.exe
  2⤵
  PID:16400
- C:\Windows\System\iTJqXAG.exe
  C:\Windows\System\iTJqXAG.exe
  2⤵
  PID:16416
- C:\Windows\System\oojXQKF.exe
  C:\Windows\System\oojXQKF.exe
  2⤵
  PID:16432
- C:\Windows\System\NpVWEpc.exe
  C:\Windows\System\NpVWEpc.exe
  2⤵
  PID:16448
- C:\Windows\System\FGNcocf.exe
  C:\Windows\System\FGNcocf.exe
  2⤵
  PID:16464
- C:\Windows\System\HAtmeRZ.exe
  C:\Windows\System\HAtmeRZ.exe
  2⤵
  PID:16480
- C:\Windows\System\gVKaXQC.exe
  C:\Windows\System\gVKaXQC.exe
  2⤵
  PID:16500
- C:\Windows\System\LVwjHmQ.exe
  C:\Windows\System\LVwjHmQ.exe
  2⤵
  PID:16516
- C:\Windows\System\PaURcrN.exe
  C:\Windows\System\PaURcrN.exe
  2⤵
  PID:16536
- C:\Windows\System\WnysBBj.exe
  C:\Windows\System\WnysBBj.exe
  2⤵
  PID:16584
- C:\Windows\System\hFqUvWf.exe
  C:\Windows\System\hFqUvWf.exe
  2⤵
  PID:16600
- C:\Windows\System\JadQXEy.exe
  C:\Windows\System\JadQXEy.exe
  2⤵
  PID:16616
- C:\Windows\System\sPKvjlk.exe
  C:\Windows\System\sPKvjlk.exe
  2⤵
  PID:16632
- C:\Windows\System\uhGvjGo.exe
  C:\Windows\System\uhGvjGo.exe
  2⤵
  PID:16648
- C:\Windows\System\gOOjmsU.exe
  C:\Windows\System\gOOjmsU.exe
  2⤵
  PID:16668
- C:\Windows\System\QeTWzLq.exe
  C:\Windows\System\QeTWzLq.exe
  2⤵
  PID:16684
- C:\Windows\System\BWlLazb.exe
  C:\Windows\System\BWlLazb.exe
  2⤵
  PID:16700
- C:\Windows\System\CHbweVB.exe
  C:\Windows\System\CHbweVB.exe
  2⤵
  PID:16728
- C:\Windows\System\WDFcqWw.exe
  C:\Windows\System\WDFcqWw.exe
  2⤵
  PID:16744
- C:\Windows\System\zDUYqMC.exe
  C:\Windows\System\zDUYqMC.exe
  2⤵
  PID:16772
- C:\Windows\System\SqEriIx.exe
  C:\Windows\System\SqEriIx.exe
  2⤵
  PID:16800
- C:\Windows\System\PkCdXMJ.exe
  C:\Windows\System\PkCdXMJ.exe
  2⤵
  PID:16816
- C:\Windows\System\QUnInOk.exe
  C:\Windows\System\QUnInOk.exe
  2⤵
  PID:16832
- C:\Windows\System\CTqTPqN.exe
  C:\Windows\System\CTqTPqN.exe
  2⤵
  PID:16848
- C:\Windows\System\MqdoCIP.exe
  C:\Windows\System\MqdoCIP.exe
  2⤵
  PID:16864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\EELnuxS.exe

Filesize
1.1MB

MD5
d3dab8387dfcf715358d83bf590b2305

SHA1
7a04f59b57b52b259c0c81dc1468058f5d18f748

SHA256
bf52f29d86c65fd568057976620fffaf92d2b828822e6cb821eb89dae8cbab28

SHA512
21927891f2b1750967ed3e288ff898b9c3328d5e9b24a154fcfa8016a0a103191fe7e7663ff3abd5ec9ade87ee01ec21404ff928adcf88af18d650b8394d3977

Download Submit
C:\Windows\System\FblMDAJ.exe

Filesize
1.1MB

MD5
ef80ec1e6acff5cc0639db14ed197f5e

SHA1
218e57436ea59ba2320aab628d01b3b28976f574

SHA256
8f16b6b5160e1efe84d5fd3abe1d113501cc494473bd7f90a464e49415d27500

SHA512
cf410c23dd397533c00e76cb3685f8c4c02cedf303291c687857322f67b6c33ef0969d4ac91f6aea7e2bc411724522a64d5dcbb96612c00f091835bd089c0146

Download Submit
C:\Windows\System\GdlsWjj.exe

Filesize
1.1MB

MD5
f8b5443e1ff1b612f038bd79a5996a62

SHA1
ebd5cee9edd8ff9e8f3d2e8e8d65472baed6900d

SHA256
79b0579e42312dd63f1e6c483e7573d513ccfbcf69d7693158e0a7484f5448a1

SHA512
32d06bb2f1640d1879dd70eb8a7ebff477b28bcfd579c0cac3f4a969aa9c05772cd6200eda557e5cd98caedc5c575322521a5d0d92c524f29f8e91afc41d5a46

Download Submit
C:\Windows\System\GxGxtNg.exe

Filesize
1.1MB

MD5
7ba393b98d7ba250b907b7f704442503

SHA1
8224e64e164e77199b8fe1702f23d0e63afaf14a

SHA256
19fca8679c085672113359868078b76bc61d951371531b1e22fb29434b269930

SHA512
6a6d4b4225177dda99ca2fa79f7aabeb747edd8536e0448a87cd47b9f8334f7613949ea1b14feace64ad3a224b87bbabf69d15cba23dc68475fec2723cef309d

Download Submit
C:\Windows\System\HKeGGxO.exe

Filesize
1.1MB

MD5
50e8974b1686641841feb746a2d719a3

SHA1
dd7d5ffe53e914b236ce7e33d9d4a949189817d0

SHA256
6b90e4e1fb8ad52323af6027d43076c3a2bfb1bd68c09ceaa3d449bcb71418a3

SHA512
b92e8b3a771828ed1cc80cb078c82533b6fd675952d361a6f5f01174be892fd27edc720bf1b079f46929e6826aad242d8d4df75e76ec0e0ae873922aee5f3372

Download Submit
C:\Windows\System\JtQrRwt.exe

Filesize
1.1MB

MD5
4ee7ffae0f80f4a846a0fc4200b51b1b

SHA1
df861bafd0fdd3179946e5323bc7e9693f21df15

SHA256
94472fbd84e97da461e59d9aa4f671d761b62303f0332a0623224c9f729d349b

SHA512
dee5c4b324197df4dd065a53e4430ba75e699eeed211d9e516f3d22026047db4dae158eb27aad1bc26d9cdad3fe2775ba2604c02fe7aac77de0fc5d6229f501d

Download Submit
C:\Windows\System\KFPcAnw.exe

Filesize
1.1MB

MD5
3fc85e4bbb8e69656c64f33b149763de

SHA1
ed143b5d74ee9ebd97033ad522bf7436c7d8d478

SHA256
1dcce7c2d04a80ed5c1d09314b3a8a493c4326ce48aa2aa063b5582eb9373608

SHA512
a4424de1c98d4660d3cf1a147b91ca4b7c3934a6511af1a10547d20b41ba31acdef8c6a985040912e82028f9753d2cef4ab58b6e76d1f1a4049f8b8e165dff56

Download Submit
C:\Windows\System\OwrDhQM.exe

Filesize
1.1MB

MD5
9776091f5f6bf40d961b7d8144882292

SHA1
da3fba962f1aa63c8e06f13fd35a79152a2e6f92

SHA256
5cf1d633423d4896cdb8e5aa61b2326b0d46e787334fa4a03cbd996cdf4539c6

SHA512
bdf7c3c0e604fffc0bc3cdf10e11d3ec85f560082d90bff3aa06342daede7ba3223728a3571b5869a104fe2cace050017749ca9ee154a3fc7d78d400b033a57f

Download Submit
C:\Windows\System\UURITwp.exe

Filesize
1.1MB

MD5
74b56e009d163bf876025482927afed4

SHA1
1d65a13bcf91dbd0e0ab1bc0e2d792cec8fef725

SHA256
a92a09b0a20944fb29fde96de494daec3cdafa30c598e477d837fc01becc2c21

SHA512
90d62814a2f7f4d7b75638839a55f76ae2e94e3d7aeafd2137ba89d8695afc30d9726c6f9dcefa976942364a7c1739319c2d9f76d67e34b2ad3b9dfc0f91a5c2

Download Submit
C:\Windows\System\UrOCAJW.exe

Filesize
1.1MB

MD5
41193d7c0f2000b67feef58959647a5d

SHA1
8877bde8ffb90ec1f507d11262cb0b9a0c4fd531

SHA256
0b0b8f40220de040852012d606de293b526197b87f1772c1d546ac87996fd7ab

SHA512
257d9320778c2c7b6ad676034e9a39f359b8996e00111de1cdd2cd466e39a64e737ca4eac894f6e53dedbee219dc0e59a361b91faa46eff2e4bc8808779b046c

Download Submit
C:\Windows\System\WKHpiTA.exe

Filesize
1.1MB

MD5
c06f4be4fe4151b7e20d478fb9c692ae

SHA1
4eb7c1e2f9521062519bde37a53925cce1e7778a

SHA256
67b8fde5e204287717fd0e571afc1f9574207d62ec89a41c57b5e686ad63cbe5

SHA512
ecd6a4b57ac08356e984576f35b13c5799b6edd3b4aae2478d80416f628431df254bc0177b56ea13b17d9f26205b22bbafc37a3dd2f929d39bfb9e1e85b8fa29

Download Submit
C:\Windows\System\Wihfhfq.exe

Filesize
1.1MB

MD5
3a720a00801973f268ba182dbcecea30

SHA1
255defc1d7c1e9cd5abb9ba9e0bfc4026a9156bc

SHA256
1dc9bd9273db71f87f767e1572160e3e15e557cf4b565d4eb7cb425a472d1912

SHA512
f54c2e390dd7ec0af6294ea1d6a4d7f8e0d9a7a1c9428cf832048bb5600e9f0196b8cc4767fae782eff6338e99f6cc06a63a8795bf7bc6533c08b868215f3948

Download Submit
C:\Windows\System\XSmWGqC.exe

Filesize
1.1MB

MD5
fd4e9204f8d9c206ec95f4a06287e76d

SHA1
1c29f511a8db50392f8b226b67c3ffefa7a6d285

SHA256
7d2ae434f675c1443b39b7f5a4d4e016afc29d36d24e21219ebcaa3f7b9e708c

SHA512
034b84ba4fad240a6f522561ec23f88258b11f02d186724cd7e0c9c7b85d193e16e1d215371e1d8bf6c5c418b98a7e4e90ba14a9ef3fef507a42370b221c1b5c

Download Submit
C:\Windows\System\bIpEdhx.exe

Filesize
1.1MB

MD5
be00cfd5d9a6a35b435f2e9fdb60944c

SHA1
d20c31f616b06e32cc10dc3b7930a8860d853752

SHA256
334a433c4ddd4b2880c05ca1328e4e8adda7e3ed8a4d576276a5ae360a313ca3

SHA512
9a16cf2cb9dddbaa84cefcb8f4a448d994b63c523eccb930c7f6c333ab375e3d5a365406a13aef07a9e59e58ffbe0390faab0d1daaa8d5a79aacaf49b9e659f2

Download Submit
C:\Windows\System\dIDdpaU.exe

Filesize
1.1MB

MD5
bc533f1113953cd9f5481767fe32fa3f

SHA1
85b38828c14179d0ac5ba253676f9936179eada5

SHA256
2c0d43d289ca3b011a7ae7877f3f3bd7eee47f3178c31979a021608d852accbd

SHA512
24b6f307f1bcdd4a1643d825b6ded4db3e6845981ebd9faee7664a9e45c1ea049ccbf7ec630da874e988998eaaa87a2e14117d1d77af7582598909243ce33d24

Download Submit
C:\Windows\System\ehitrkg.exe

Filesize
1.1MB

MD5
9fbcbada692984f6e8c31216bfe32cc4

SHA1
7df5207d07476ea1126dae45756d730c364f7218

SHA256
cd05904f6db48dc30fc90d7c1b569effe71d64e9335360d32202a054deebf7e8

SHA512
86774c6bba40454bf61a820b1546666d5a0af3703b8931ba320917b876de5f2bca53dc42a77904af9f0dff211b54ef5f0a2acdfa4e7c64e54f94f2cc8bb561ed

Download Submit
C:\Windows\System\gJpWZuU.exe

Filesize
1.1MB

MD5
28847f6d9d770fb2788c6e2376a4c703

SHA1
721f85b75e39fe827f79fc1e2c67c19e43cbe2a2

SHA256
3b7ec403a94597c492cb2855313e32f0dd5fc3c69985095551586fbf32aea0b8

SHA512
8a9fbc8ca91893da9a442c6baaaa341f034dfd184ff58cedf35edc199fd6ab7fba9bd951d004a4ce4074e27a3a6c8e5c2837591cd11444a7c45a31142d30af4a

Download Submit
C:\Windows\System\hExmjWn.exe

Filesize
1.1MB

MD5
14c592c21e0142a54b477a4ad717a625

SHA1
c8e28507b05ed29c070a04643f96d7c7d1079efb

SHA256
aef695125eb67c67fd3a9791b12ba7144b0e862504154c6a1df29accfe5ffefd

SHA512
21b5e57860dbb846e2e3d25643bb0a4575bbb0f02877f654504a6119d608f0f580d2acdcbefb29a7d4f98dbec6e27d0aa3652b7ba9390abd44bd51674e369b28

Download Submit
C:\Windows\System\hLCtpTZ.exe

Filesize
1.1MB

MD5
3f741c6369d68d41816105c9d5959010

SHA1
35a3a3e94529b8e0613fffdcdcab1dc1dc047365

SHA256
995c3957ad97b1bd5fd4e1a8bfa2e25209892d937605a3e760f4127f32e594e4

SHA512
8ee224963e18339f28dbcb12c0f0fe280a7b25ea38c31735bb25d984c5ef7bf94420b960c8c0ae9a86c52c2aa2e70a0991a5eb4ec8520eedf8c601f6406b1ba8

Download Submit
C:\Windows\System\jHQxDAn.exe

Filesize
1.1MB

MD5
2e7d444b8e2e15a8628bcb96035d78ba

SHA1
e08c97607beb6a90a57ab2a1f6b4604ef4103299

SHA256
3935eaab39c9e5dcbc1b90d40259c805cc4b25a9d0c2dc9dfb724b81aa0cf7bb

SHA512
49202c991b9279f64b9486937d109c240ce1c008d21fae64d1a926c2ee5b1afd99b287192388fb08a68478ccf36ac6f5f75e7a6f544f2135caa1f0264495c46b

Download Submit
C:\Windows\System\jnhpWLs.exe

Filesize
1.1MB

MD5
bf0d245688f35597f9421e6d6a77502d

SHA1
8fc78cf6d08b8f373094b7df19956d1186d88fd5

SHA256
e3f019f70e695521d2d333c60cdadf032f3209e8f0e1334aebd26dce54cf7498

SHA512
65c3360ac042b056b0c6c063e72360f101f74bcd20a075e84e7831026a664b4673758dd00234bd6150ce5f47184dc102edbbdfd366523e8c4e9fcdca7831a4d3

Download Submit
C:\Windows\System\kURAeHA.exe

Filesize
1.1MB

MD5
b42f2fe49cfc40880b939e093cf294b2

SHA1
0e7c9becf957efc04b62f773766b746fc07fc707

SHA256
d4b0b36dcfc1fab9a55c6607329443375d44737bd9f8c1f2b070b879f0f4cbfe

SHA512
a189860e4079d8dc070256049cae2bcb80aad57413611015f7b402eaac5b081ed306519200e171057026de1a0c3654515cfa4bf5c7d1d074203696e275853e5c

Download Submit
C:\Windows\System\keQqKlF.exe

Filesize
1.1MB

MD5
e8cec9ea3e17fa55e52f518c7d5d40e5

SHA1
2e404c175dfe6157cd1b57fd4b501a060baec675

SHA256
2bc1fd01ebdc2446cf47a90add3c20b26dacb064ba63f2c15038052007401ee5

SHA512
6c394074c893eabc16b9b31eaaed5d0b6687bda419c8dd61baf15aa0b62d94c37d5470be6702e760266a0d78f8a1e738600c797935e8e51f4d69e576bb68a2b4

Download Submit
C:\Windows\System\lapYpNw.exe

Filesize
1.1MB

MD5
59cb8c4c2131ecbbe8e5cbef24777ebc

SHA1
3c53ada92be87bbb560850f7095599fe53e83962

SHA256
26af58bc81d3d1588deea6af6f18bdab34324db556a855ffaa1c3ae43254aa74

SHA512
fa6bf17a51c36397b30b2a33112f96eff3da2bfee233be35c52cfb65ea9ae0850d997a90d2c520e225fc9d9e720bd3e7062f28841e35ef4ac2c06451b413ae1e

Download Submit
C:\Windows\System\ndygXhp.exe

Filesize
1.1MB

MD5
d62bbeefb9efad55140dea1b34e0931c

SHA1
d6c12ea45efb3bcf3414f28b7cb69bad3fc7c6b3

SHA256
6a6342d5a402b28ed2bb0c58da1f09cfaf44e35dbc02a90bb21ae4a04dabdd61

SHA512
d68c5f6d9c5b0854ddab90cd0ca29420da364a826e800b89abd0ad044650fc5f335f31e86bb53cf532c35b6b296dc57ec52df8f79968365f161c037e19af27ff

Download Submit
C:\Windows\System\nqbYwYn.exe

Filesize
1.1MB

MD5
87fef685472b0c7eae9fcb3bc93b8d0a

SHA1
33108933ee6345adaba8e0e603566c6ea4a2b5f6

SHA256
d24468017683b2392aa8ebda94a7ef84c19bdea872b62bd2d87f4f54aa9dfb99

SHA512
2ef8f3663742b37c0d68023f321ce0c7a850008dc16c056ca4e96860df155605d98f6a5da1f3f97c5bbdeef01838f0db14ae44d1e7ba2719b5fb85aa7ea69741

Download Submit
C:\Windows\System\nsfsNWw.exe

Filesize
1.1MB

MD5
6af59d0bd7b5b5fbd26ca55fb6bb9017

SHA1
f5aca81b99a7420e9b5cccde0df7f00f24a05c41

SHA256
1173dd78dacb349de94b65d62d8561e8bbfe3941e8203bf620af49cc0a68913f

SHA512
4a85b4ba430b05ea41a43f565ca5dbafc2dc82a7ee604465f98fd65a50fa901c4ed6604c6bd4b0b572d93d3e219efd4062401a2a20d1b52c6adaa690919ac7ac

Download Submit
C:\Windows\System\pZWbPAk.exe

Filesize
1.1MB

MD5
59d4a71c4ba2066852cf97b893b3c3f4

SHA1
7a8718d0b364f2bdaaa5ae52a23836f3e3d671a3

SHA256
2bfaf78c5069eccf89aa937146e52ab0c3ea289ecb20b662e2e1bfb058b272c7

SHA512
9ee172a731c6d464d64b8cb106e561de922ec2765eb963c8f89a394ffb8eb60e375fbcf8433cdfb04ce672952dfe4f782dbdf7d8b3218a7f7998166faf2f07ed

Download Submit
C:\Windows\System\sUdqgHP.exe

Filesize
1.1MB

MD5
f9dbed6bfc7605023e4f76f8f47a6f36

SHA1
7c514975b3e097a863c22d0b166f0fa08979667d

SHA256
6c948a6be9d891db4c8377ded420a94080c0007b22f3254573a17e726f0ca3a1

SHA512
f6981fef56a591bf69f27154d22e24e43c7c494e9bd0a8d6b0b0905e1a3bd4f50260fb933ad4ddb3a140c06292cfdf53041f64ec2689934c4c3f05c4391f4a21

Download Submit
C:\Windows\System\umOsigS.exe

Filesize
1.1MB

MD5
efbcd3d9ea998ae57169bd473323c8a5

SHA1
258dd5765218e601ceb023c5aa1a3775001e06f6

SHA256
15cb952960ab3aa4b1701c48c372b02ceb251c9ecf4354da6a6fd32b38af9769

SHA512
4f88600fa7096eea64cea33e34b4318d7026ebc40dad641d92f820deae39db818f4ee8e61f7f035aae9f96a3a120fe6660579deb531de9f855a5d754b708777f

Download Submit
C:\Windows\System\vinkoZm.exe

Filesize
1.1MB

MD5
441927b311893da138c2d3fd9ca517e0

SHA1
49c8aef7ca45c892fea87dd4bc0a3ecf0e86db7c

SHA256
2496d55e698afe5aaa1a38c5901767befa68ff3e4827522bfd529128721c5dd6

SHA512
a07c0d9335d25843e07995732214c8363ac19bc7e5fc253cc330534ca5999f4875a58788e0cc98a3618169b99c46626192eed4f85d15cef5a0315afd75861ff6

Download Submit
C:\Windows\System\xXJzXbI.exe

Filesize
1.1MB

MD5
e46f7897859769faf748126045d8b28a

SHA1
b2c9d214c3bcfe26cc11658281406980680790b9

SHA256
1f39ae46f23992efc9c3dacc5a72dc5675dd6f76287dfd0bd83c7f5fa9a068ed

SHA512
630111b9c59debc681c1dc5f474a0738a1b9a48ac1c690fc77dd636930327d62e3e24a5bffaf7e04736937cebdb8819eeb5061b1d534ab772413ffa26811d38d

Download Submit
C:\Windows\System\yPGeZZy.exe

Filesize
1.1MB

MD5
7f3b668b0f3954c34e2164f4d2121ee1

SHA1
45f2dbbf2b43062f61ca7d937fa97096b2d7e1d2

SHA256
cc43ca28c2f26628dc0fdd406ca278143f4639756a69a6ed15815e0848c8d8e8

SHA512
1a66cc1ab28bf9150c37a96a2c24a28110b3e42b977a392d0423ab8f8024948e4054f162bb88d0ec703615a42dce2f343a0d05248d0b3ddd0bd7c7c2d1b740f6

Download Submit
memory/1096-0-0x0000010177A50000-0x0000010177A60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads