xmrig | 4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9

Analysis

max time kernel
95s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
Size

1.6MB
MD5

127e899d5980660282ee54dc491e756c
SHA1

ed63433d12fea9c05277ccac7202176a9a0d79ce
SHA256

4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9
SHA512

0ea3a55862bfee98e5895e1e50dec0ff2fa520209339ec3e7a23b40cb6bccb71b990095860bef9e2c96e54c5a778e6263ad3a4fef760fc83c253b54de65b126a
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRR/1fKa:GemTLkNdfE0pZyP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c01-3.dat	xmrig
behavioral2/files/0x0007000000023c9f-7.dat	xmrig
behavioral2/files/0x0007000000023ca0-15.dat	xmrig
behavioral2/files/0x0007000000023c9e-19.dat	xmrig
behavioral2/files/0x0007000000023ca5-42.dat	xmrig
behavioral2/files/0x0007000000023ca6-53.dat	xmrig
behavioral2/files/0x0007000000023ca7-55.dat	xmrig
behavioral2/files/0x0007000000023ca4-49.dat	xmrig
behavioral2/files/0x0007000000023ca3-47.dat	xmrig
behavioral2/files/0x0007000000023ca2-45.dat	xmrig
behavioral2/files/0x0007000000023ca1-34.dat	xmrig
behavioral2/files/0x0007000000023ca8-61.dat	xmrig
behavioral2/files/0x0007000000023caa-66.dat	xmrig
behavioral2/files/0x0007000000023cab-71.dat	xmrig
behavioral2/files/0x0008000000023c9b-70.dat	xmrig
behavioral2/files/0x0007000000023cac-80.dat	xmrig
behavioral2/files/0x0007000000023cad-82.dat	xmrig
behavioral2/files/0x0007000000023cae-89.dat	xmrig
behavioral2/files/0x0007000000023caf-93.dat	xmrig
behavioral2/files/0x0007000000023cb0-98.dat	xmrig
behavioral2/files/0x0007000000023cb1-102.dat	xmrig
behavioral2/files/0x0007000000023cb3-118.dat	xmrig
behavioral2/files/0x0007000000023cb7-132.dat	xmrig
behavioral2/files/0x0007000000023cb8-133.dat	xmrig
behavioral2/files/0x0007000000023cb9-141.dat	xmrig
behavioral2/files/0x0007000000023cc2-174.dat	xmrig
behavioral2/files/0x0007000000023cc1-169.dat	xmrig
behavioral2/files/0x0007000000023cc0-166.dat	xmrig
behavioral2/files/0x0007000000023cbf-163.dat	xmrig
behavioral2/files/0x0007000000023cbe-158.dat	xmrig
behavioral2/files/0x0007000000023cbd-155.dat	xmrig
behavioral2/files/0x0007000000023cbc-152.dat	xmrig
behavioral2/files/0x0007000000023cbb-149.dat	xmrig
behavioral2/files/0x0007000000023cba-144.dat	xmrig
behavioral2/files/0x0007000000023cb6-138.dat	xmrig
behavioral2/files/0x0007000000023cb5-136.dat	xmrig
behavioral2/files/0x0007000000023cb4-120.dat	xmrig
behavioral2/files/0x0007000000023cb2-116.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2312	TczGPRV.exe
4476	OsCwElm.exe
1828	dutbLAR.exe
4488	CCQUcia.exe
4424	WiQFAsz.exe
3468	CIuQeNt.exe
2436	MmVUZeN.exe
4556	VgNEeZf.exe
2552	tAPSFKM.exe
3908	uiwvAmX.exe
3856	LzIemLF.exe
2572	FKIXkmW.exe
212	TdjUrUW.exe
3940	qZTcEVn.exe
532	vqwgjCx.exe
988	igggqfp.exe
1332	KbqkItA.exe
4160	LUWloDq.exe
4544	DJSAkxw.exe
1548	zBlWzNz.exe
4064	UEcuOKY.exe
1524	IcbYhHq.exe
1488	jGBhdBC.exe
4380	OuQKoVK.exe
1728	LxSDRiT.exe
2392	HmvcuqD.exe
5052	gyHMlQN.exe
3492	OanGmcz.exe
5064	sCnBsNR.exe
2656	lYTVtbj.exe
3560	NWDXTvt.exe
2116	iOzESAC.exe
3660	CJpntSo.exe
1648	dofIzYO.exe
2280	torTKUB.exe
5084	gryTtLE.exe
1536	cJJpghH.exe
1084	KaLIExT.exe
1208	mGrVtOn.exe
4508	nAvnCIC.exe
2784	KDXZylI.exe
876	tAFoCol.exe
3344	fhprpUh.exe
1928	xIibqft.exe
3192	wIWeUrV.exe
4420	cEtzaQd.exe
2124	YYqMYyK.exe
3584	NpHKiRq.exe
4408	JhKJgyC.exe
2132	lXSlkjX.exe
540	GcQWxIO.exe
384	YVyVoTO.exe
4884	pttYPWA.exe
5116	ngGgaXA.exe
3760	UzCtjnY.exe
2964	vSHehXW.exe
920	WmHOQWJ.exe
4392	fsHKwTA.exe
2764	MWeTsQI.exe
3108	XDymYWb.exe
5000	ohzkPqQ.exe
3804	arQTJtt.exe
5104	GqzYWrJ.exe
2040	DAeYTBr.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vxxUMms.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\xAYSyFf.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\aZtoUCf.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\JSSfXvD.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\ywzimBk.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\FqSqwdL.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\xDNigdq.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\uTQKdvj.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\KKTxxut.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\VdAZUcd.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\UzdUTTO.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\DiOdZAZ.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\fCnPeBa.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\HdhLRWL.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\HvbZWHJ.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\nbHzYed.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\hSreXJj.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\wpUbmYl.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\aXIECwq.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\fTxeiYK.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\rkQFiTG.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\ZzZIpLY.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\dGTLpSF.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\fVLDIUa.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\woHWHMr.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\VuMOJWg.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\pLQWXAv.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\JMWjxKS.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\MGSoTzU.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\UYTvHix.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\XIbsvYm.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\ncAwlMD.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\HOzKAaN.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\jdWkUQp.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\iDnupzJ.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\CCQUcia.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\OyhGhZR.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\IrUlYxx.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\uSgRmyx.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\Gupylzh.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\ytpmPfT.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\jpHcORT.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\aZMJFnR.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\GNpVLVX.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\gMQxBiR.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\pkUpFex.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\ySdVvIJ.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\qOGvPZn.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\rhJNPRw.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\CFxEVjU.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\DWUMbmA.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\XKcGQFf.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\IafoHOE.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\hCCfPMU.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\rzutQbr.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\XDymYWb.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\OnXUHXI.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\QLrbhJY.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\mgdqVFc.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\DwfpNVc.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\Gljtfqj.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\ILzMfwP.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\hkyCcSd.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
File created	C:\Windows\System\EiGedCZ.exe	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2312	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	83
PID 1996 wrote to memory of 2312	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	83
PID 1996 wrote to memory of 4476	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	84
PID 1996 wrote to memory of 4476	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	84
PID 1996 wrote to memory of 1828	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	85
PID 1996 wrote to memory of 1828	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	85
PID 1996 wrote to memory of 4488	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	86
PID 1996 wrote to memory of 4488	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	86
PID 1996 wrote to memory of 4424	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	87
PID 1996 wrote to memory of 4424	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	87
PID 1996 wrote to memory of 3468	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	88
PID 1996 wrote to memory of 3468	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	88
PID 1996 wrote to memory of 2436	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	89
PID 1996 wrote to memory of 2436	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	89
PID 1996 wrote to memory of 4556	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	90
PID 1996 wrote to memory of 4556	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	90
PID 1996 wrote to memory of 2552	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	91
PID 1996 wrote to memory of 2552	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	91
PID 1996 wrote to memory of 3908	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	92
PID 1996 wrote to memory of 3908	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	92
PID 1996 wrote to memory of 3856	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	93
PID 1996 wrote to memory of 3856	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	93
PID 1996 wrote to memory of 2572	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	94
PID 1996 wrote to memory of 2572	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	94
PID 1996 wrote to memory of 212	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	95
PID 1996 wrote to memory of 212	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	95
PID 1996 wrote to memory of 3940	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	96
PID 1996 wrote to memory of 3940	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	96
PID 1996 wrote to memory of 532	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	97
PID 1996 wrote to memory of 532	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	97
PID 1996 wrote to memory of 988	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	98
PID 1996 wrote to memory of 988	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	98
PID 1996 wrote to memory of 1332	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	99
PID 1996 wrote to memory of 1332	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	99
PID 1996 wrote to memory of 4160	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	100
PID 1996 wrote to memory of 4160	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	100
PID 1996 wrote to memory of 4544	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	101
PID 1996 wrote to memory of 4544	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	101
PID 1996 wrote to memory of 1548	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	102
PID 1996 wrote to memory of 1548	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	102
PID 1996 wrote to memory of 4064	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	103
PID 1996 wrote to memory of 4064	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	103
PID 1996 wrote to memory of 1524	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	104
PID 1996 wrote to memory of 1524	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	104
PID 1996 wrote to memory of 1488	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	105
PID 1996 wrote to memory of 1488	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	105
PID 1996 wrote to memory of 4380	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	106
PID 1996 wrote to memory of 4380	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	106
PID 1996 wrote to memory of 1728	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	107
PID 1996 wrote to memory of 1728	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	107
PID 1996 wrote to memory of 2392	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	108
PID 1996 wrote to memory of 2392	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	108
PID 1996 wrote to memory of 5052	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	109
PID 1996 wrote to memory of 5052	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	109
PID 1996 wrote to memory of 3492	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	110
PID 1996 wrote to memory of 3492	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	110
PID 1996 wrote to memory of 5064	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	111
PID 1996 wrote to memory of 5064	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	111
PID 1996 wrote to memory of 2656	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	112
PID 1996 wrote to memory of 2656	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	112
PID 1996 wrote to memory of 3560	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	113
PID 1996 wrote to memory of 3560	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	113
PID 1996 wrote to memory of 2116	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	114
PID 1996 wrote to memory of 2116	1996	4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe	114

C:\Users\Admin\AppData\Local\Temp\4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe
"C:\Users\Admin\AppData\Local\Temp\4d9f86c2a765b207af9de725198db29adbf41c37dd9fdfc22084a234d93fc3b9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\System\TczGPRV.exe
  C:\Windows\System\TczGPRV.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\OsCwElm.exe
  C:\Windows\System\OsCwElm.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\dutbLAR.exe
  C:\Windows\System\dutbLAR.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\CCQUcia.exe
  C:\Windows\System\CCQUcia.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\WiQFAsz.exe
  C:\Windows\System\WiQFAsz.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\CIuQeNt.exe
  C:\Windows\System\CIuQeNt.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\MmVUZeN.exe
  C:\Windows\System\MmVUZeN.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\VgNEeZf.exe
  C:\Windows\System\VgNEeZf.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\tAPSFKM.exe
  C:\Windows\System\tAPSFKM.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\uiwvAmX.exe
  C:\Windows\System\uiwvAmX.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\LzIemLF.exe
  C:\Windows\System\LzIemLF.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\FKIXkmW.exe
  C:\Windows\System\FKIXkmW.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\TdjUrUW.exe
  C:\Windows\System\TdjUrUW.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\qZTcEVn.exe
  C:\Windows\System\qZTcEVn.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\vqwgjCx.exe
  C:\Windows\System\vqwgjCx.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\igggqfp.exe
  C:\Windows\System\igggqfp.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\KbqkItA.exe
  C:\Windows\System\KbqkItA.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\LUWloDq.exe
  C:\Windows\System\LUWloDq.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\DJSAkxw.exe
  C:\Windows\System\DJSAkxw.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\zBlWzNz.exe
  C:\Windows\System\zBlWzNz.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\UEcuOKY.exe
  C:\Windows\System\UEcuOKY.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\IcbYhHq.exe
  C:\Windows\System\IcbYhHq.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\jGBhdBC.exe
  C:\Windows\System\jGBhdBC.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\OuQKoVK.exe
  C:\Windows\System\OuQKoVK.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\LxSDRiT.exe
  C:\Windows\System\LxSDRiT.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\HmvcuqD.exe
  C:\Windows\System\HmvcuqD.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\gyHMlQN.exe
  C:\Windows\System\gyHMlQN.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\OanGmcz.exe
  C:\Windows\System\OanGmcz.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\sCnBsNR.exe
  C:\Windows\System\sCnBsNR.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\lYTVtbj.exe
  C:\Windows\System\lYTVtbj.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\NWDXTvt.exe
  C:\Windows\System\NWDXTvt.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\iOzESAC.exe
  C:\Windows\System\iOzESAC.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\CJpntSo.exe
  C:\Windows\System\CJpntSo.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\dofIzYO.exe
  C:\Windows\System\dofIzYO.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\torTKUB.exe
  C:\Windows\System\torTKUB.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\gryTtLE.exe
  C:\Windows\System\gryTtLE.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\cJJpghH.exe
  C:\Windows\System\cJJpghH.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\KaLIExT.exe
  C:\Windows\System\KaLIExT.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\mGrVtOn.exe
  C:\Windows\System\mGrVtOn.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\nAvnCIC.exe
  C:\Windows\System\nAvnCIC.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\KDXZylI.exe
  C:\Windows\System\KDXZylI.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\tAFoCol.exe
  C:\Windows\System\tAFoCol.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\fhprpUh.exe
  C:\Windows\System\fhprpUh.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\xIibqft.exe
  C:\Windows\System\xIibqft.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\wIWeUrV.exe
  C:\Windows\System\wIWeUrV.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\cEtzaQd.exe
  C:\Windows\System\cEtzaQd.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\YYqMYyK.exe
  C:\Windows\System\YYqMYyK.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\NpHKiRq.exe
  C:\Windows\System\NpHKiRq.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\JhKJgyC.exe
  C:\Windows\System\JhKJgyC.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\lXSlkjX.exe
  C:\Windows\System\lXSlkjX.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\GcQWxIO.exe
  C:\Windows\System\GcQWxIO.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\YVyVoTO.exe
  C:\Windows\System\YVyVoTO.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\pttYPWA.exe
  C:\Windows\System\pttYPWA.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\ngGgaXA.exe
  C:\Windows\System\ngGgaXA.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\UzCtjnY.exe
  C:\Windows\System\UzCtjnY.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\vSHehXW.exe
  C:\Windows\System\vSHehXW.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\WmHOQWJ.exe
  C:\Windows\System\WmHOQWJ.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\fsHKwTA.exe
  C:\Windows\System\fsHKwTA.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\MWeTsQI.exe
  C:\Windows\System\MWeTsQI.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\XDymYWb.exe
  C:\Windows\System\XDymYWb.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\ohzkPqQ.exe
  C:\Windows\System\ohzkPqQ.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\arQTJtt.exe
  C:\Windows\System\arQTJtt.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\GqzYWrJ.exe
  C:\Windows\System\GqzYWrJ.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\DAeYTBr.exe
  C:\Windows\System\DAeYTBr.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\SqVJusv.exe
  C:\Windows\System\SqVJusv.exe
  2⤵
  PID:3028
- C:\Windows\System\nJkqaIl.exe
  C:\Windows\System\nJkqaIl.exe
  2⤵
  PID:4320
- C:\Windows\System\LYINSCA.exe
  C:\Windows\System\LYINSCA.exe
  2⤵
  PID:432
- C:\Windows\System\EJBvNVg.exe
  C:\Windows\System\EJBvNVg.exe
  2⤵
  PID:3520
- C:\Windows\System\kArPPOx.exe
  C:\Windows\System\kArPPOx.exe
  2⤵
  PID:3592
- C:\Windows\System\aBpphdq.exe
  C:\Windows\System\aBpphdq.exe
  2⤵
  PID:2636
- C:\Windows\System\OjGfNhM.exe
  C:\Windows\System\OjGfNhM.exe
  2⤵
  PID:5048
- C:\Windows\System\pLQWXAv.exe
  C:\Windows\System\pLQWXAv.exe
  2⤵
  PID:2220
- C:\Windows\System\MQaiDPl.exe
  C:\Windows\System\MQaiDPl.exe
  2⤵
  PID:5040
- C:\Windows\System\vpMNtJe.exe
  C:\Windows\System\vpMNtJe.exe
  2⤵
  PID:4864
- C:\Windows\System\AElWvWv.exe
  C:\Windows\System\AElWvWv.exe
  2⤵
  PID:5076
- C:\Windows\System\TiuLUIK.exe
  C:\Windows\System\TiuLUIK.exe
  2⤵
  PID:1532
- C:\Windows\System\fdrzqXm.exe
  C:\Windows\System\fdrzqXm.exe
  2⤵
  PID:3580
- C:\Windows\System\ZNeZalN.exe
  C:\Windows\System\ZNeZalN.exe
  2⤵
  PID:1048
- C:\Windows\System\HhwJIJt.exe
  C:\Windows\System\HhwJIJt.exe
  2⤵
  PID:3852
- C:\Windows\System\qkcqLBL.exe
  C:\Windows\System\qkcqLBL.exe
  2⤵
  PID:3668
- C:\Windows\System\SmiGFbb.exe
  C:\Windows\System\SmiGFbb.exe
  2⤵
  PID:1656
- C:\Windows\System\IiZyoQl.exe
  C:\Windows\System\IiZyoQl.exe
  2⤵
  PID:3864
- C:\Windows\System\eHAHKjE.exe
  C:\Windows\System\eHAHKjE.exe
  2⤵
  PID:4356
- C:\Windows\System\oYPddoM.exe
  C:\Windows\System\oYPddoM.exe
  2⤵
  PID:3100
- C:\Windows\System\JPYKORl.exe
  C:\Windows\System\JPYKORl.exe
  2⤵
  PID:3372
- C:\Windows\System\cDYYoBg.exe
  C:\Windows\System\cDYYoBg.exe
  2⤵
  PID:4280
- C:\Windows\System\qKiANko.exe
  C:\Windows\System\qKiANko.exe
  2⤵
  PID:4760
- C:\Windows\System\RnaQnyi.exe
  C:\Windows\System\RnaQnyi.exe
  2⤵
  PID:2432
- C:\Windows\System\YMEaLzu.exe
  C:\Windows\System\YMEaLzu.exe
  2⤵
  PID:2172
- C:\Windows\System\xvOGewz.exe
  C:\Windows\System\xvOGewz.exe
  2⤵
  PID:3900
- C:\Windows\System\UHzFRLo.exe
  C:\Windows\System\UHzFRLo.exe
  2⤵
  PID:1364
- C:\Windows\System\ppNCyOd.exe
  C:\Windows\System\ppNCyOd.exe
  2⤵
  PID:1212
- C:\Windows\System\gQZLdvh.exe
  C:\Windows\System\gQZLdvh.exe
  2⤵
  PID:3936
- C:\Windows\System\yTiWvzz.exe
  C:\Windows\System\yTiWvzz.exe
  2⤵
  PID:220
- C:\Windows\System\WrKHcMK.exe
  C:\Windows\System\WrKHcMK.exe
  2⤵
  PID:1444
- C:\Windows\System\pDoFELC.exe
  C:\Windows\System\pDoFELC.exe
  2⤵
  PID:3888
- C:\Windows\System\Rziakob.exe
  C:\Windows\System\Rziakob.exe
  2⤵
  PID:4236
- C:\Windows\System\wHlTOib.exe
  C:\Windows\System\wHlTOib.exe
  2⤵
  PID:4348
- C:\Windows\System\zEmKCZm.exe
  C:\Windows\System\zEmKCZm.exe
  2⤵
  PID:4464
- C:\Windows\System\VIPFngL.exe
  C:\Windows\System\VIPFngL.exe
  2⤵
  PID:1572
- C:\Windows\System\SPjuqsp.exe
  C:\Windows\System\SPjuqsp.exe
  2⤵
  PID:2776
- C:\Windows\System\FpaRYDp.exe
  C:\Windows\System\FpaRYDp.exe
  2⤵
  PID:4816
- C:\Windows\System\dTDGnxF.exe
  C:\Windows\System\dTDGnxF.exe
  2⤵
  PID:1012
- C:\Windows\System\zdkWkml.exe
  C:\Windows\System\zdkWkml.exe
  2⤵
  PID:3416
- C:\Windows\System\HfDiGjA.exe
  C:\Windows\System\HfDiGjA.exe
  2⤵
  PID:4876
- C:\Windows\System\EPsBKkw.exe
  C:\Windows\System\EPsBKkw.exe
  2⤵
  PID:3056
- C:\Windows\System\mnMGlZj.exe
  C:\Windows\System\mnMGlZj.exe
  2⤵
  PID:2564
- C:\Windows\System\wAusgCv.exe
  C:\Windows\System\wAusgCv.exe
  2⤵
  PID:1752
- C:\Windows\System\RPjKuJL.exe
  C:\Windows\System\RPjKuJL.exe
  2⤵
  PID:4632
- C:\Windows\System\wsematG.exe
  C:\Windows\System\wsematG.exe
  2⤵
  PID:3264
- C:\Windows\System\okiJBIi.exe
  C:\Windows\System\okiJBIi.exe
  2⤵
  PID:4660
- C:\Windows\System\gtWPTUX.exe
  C:\Windows\System\gtWPTUX.exe
  2⤵
  PID:1136
- C:\Windows\System\Mpavzqr.exe
  C:\Windows\System\Mpavzqr.exe
  2⤵
  PID:2068
- C:\Windows\System\rRaTiMk.exe
  C:\Windows\System\rRaTiMk.exe
  2⤵
  PID:2988
- C:\Windows\System\WtDyeew.exe
  C:\Windows\System\WtDyeew.exe
  2⤵
  PID:4436
- C:\Windows\System\ZeMQSUJ.exe
  C:\Windows\System\ZeMQSUJ.exe
  2⤵
  PID:3868
- C:\Windows\System\poYPGHN.exe
  C:\Windows\System\poYPGHN.exe
  2⤵
  PID:408
- C:\Windows\System\jQTwpzL.exe
  C:\Windows\System\jQTwpzL.exe
  2⤵
  PID:4588
- C:\Windows\System\peJmuSs.exe
  C:\Windows\System\peJmuSs.exe
  2⤵
  PID:5136
- C:\Windows\System\CFxEVjU.exe
  C:\Windows\System\CFxEVjU.exe
  2⤵
  PID:5172
- C:\Windows\System\ZBTrszP.exe
  C:\Windows\System\ZBTrszP.exe
  2⤵
  PID:5192
- C:\Windows\System\DWUMbmA.exe
  C:\Windows\System\DWUMbmA.exe
  2⤵
  PID:5216
- C:\Windows\System\MCpaAlM.exe
  C:\Windows\System\MCpaAlM.exe
  2⤵
  PID:5268
- C:\Windows\System\YBeQCkl.exe
  C:\Windows\System\YBeQCkl.exe
  2⤵
  PID:5284
- C:\Windows\System\NSRjGvO.exe
  C:\Windows\System\NSRjGvO.exe
  2⤵
  PID:5300
- C:\Windows\System\UqFlipp.exe
  C:\Windows\System\UqFlipp.exe
  2⤵
  PID:5328
- C:\Windows\System\SknAPHL.exe
  C:\Windows\System\SknAPHL.exe
  2⤵
  PID:5364
- C:\Windows\System\MNxDNKc.exe
  C:\Windows\System\MNxDNKc.exe
  2⤵
  PID:5384
- C:\Windows\System\YpucZMo.exe
  C:\Windows\System\YpucZMo.exe
  2⤵
  PID:5400
- C:\Windows\System\eyrFTtp.exe
  C:\Windows\System\eyrFTtp.exe
  2⤵
  PID:5428
- C:\Windows\System\JitRYuH.exe
  C:\Windows\System\JitRYuH.exe
  2⤵
  PID:5460
- C:\Windows\System\OzaVPFj.exe
  C:\Windows\System\OzaVPFj.exe
  2⤵
  PID:5488
- C:\Windows\System\MvsCdbn.exe
  C:\Windows\System\MvsCdbn.exe
  2⤵
  PID:5524
- C:\Windows\System\BFsmKxY.exe
  C:\Windows\System\BFsmKxY.exe
  2⤵
  PID:5552
- C:\Windows\System\bXoaaBZ.exe
  C:\Windows\System\bXoaaBZ.exe
  2⤵
  PID:5580
- C:\Windows\System\FqSqwdL.exe
  C:\Windows\System\FqSqwdL.exe
  2⤵
  PID:5608
- C:\Windows\System\CwgVtNc.exe
  C:\Windows\System\CwgVtNc.exe
  2⤵
  PID:5632
- C:\Windows\System\dQWxZiG.exe
  C:\Windows\System\dQWxZiG.exe
  2⤵
  PID:5652
- C:\Windows\System\ZyoHjwV.exe
  C:\Windows\System\ZyoHjwV.exe
  2⤵
  PID:5688
- C:\Windows\System\MNQfxvc.exe
  C:\Windows\System\MNQfxvc.exe
  2⤵
  PID:5720
- C:\Windows\System\tidXOFy.exe
  C:\Windows\System\tidXOFy.exe
  2⤵
  PID:5756
- C:\Windows\System\sIBNZCh.exe
  C:\Windows\System\sIBNZCh.exe
  2⤵
  PID:5776
- C:\Windows\System\aKFaDha.exe
  C:\Windows\System\aKFaDha.exe
  2⤵
  PID:5804
- C:\Windows\System\ksyiAmU.exe
  C:\Windows\System\ksyiAmU.exe
  2⤵
  PID:5832
- C:\Windows\System\lvWkIdN.exe
  C:\Windows\System\lvWkIdN.exe
  2⤵
  PID:5852
- C:\Windows\System\ySdVvIJ.exe
  C:\Windows\System\ySdVvIJ.exe
  2⤵
  PID:5876
- C:\Windows\System\WaFkwcd.exe
  C:\Windows\System\WaFkwcd.exe
  2⤵
  PID:5916
- C:\Windows\System\jmtzQkE.exe
  C:\Windows\System\jmtzQkE.exe
  2⤵
  PID:5940
- C:\Windows\System\vbNQtca.exe
  C:\Windows\System\vbNQtca.exe
  2⤵
  PID:5964
- C:\Windows\System\oZKQbXc.exe
  C:\Windows\System\oZKQbXc.exe
  2⤵
  PID:6000
- C:\Windows\System\lUDianz.exe
  C:\Windows\System\lUDianz.exe
  2⤵
  PID:6032
- C:\Windows\System\tQRTBWK.exe
  C:\Windows\System\tQRTBWK.exe
  2⤵
  PID:6056
- C:\Windows\System\wKPhHgo.exe
  C:\Windows\System\wKPhHgo.exe
  2⤵
  PID:6088
- C:\Windows\System\rqWPclQ.exe
  C:\Windows\System\rqWPclQ.exe
  2⤵
  PID:6116
- C:\Windows\System\ukgnodz.exe
  C:\Windows\System\ukgnodz.exe
  2⤵
  PID:6140
- C:\Windows\System\MPjxjMJ.exe
  C:\Windows\System\MPjxjMJ.exe
  2⤵
  PID:5184
- C:\Windows\System\lzMzKvF.exe
  C:\Windows\System\lzMzKvF.exe
  2⤵
  PID:5236
- C:\Windows\System\ysZeyra.exe
  C:\Windows\System\ysZeyra.exe
  2⤵
  PID:5316
- C:\Windows\System\WiKmtKx.exe
  C:\Windows\System\WiKmtKx.exe
  2⤵
  PID:5340
- C:\Windows\System\NEODVSn.exe
  C:\Windows\System\NEODVSn.exe
  2⤵
  PID:5416
- C:\Windows\System\XcLhUGV.exe
  C:\Windows\System\XcLhUGV.exe
  2⤵
  PID:5512
- C:\Windows\System\nXdLlOh.exe
  C:\Windows\System\nXdLlOh.exe
  2⤵
  PID:5564
- C:\Windows\System\uVZmKZH.exe
  C:\Windows\System\uVZmKZH.exe
  2⤵
  PID:5648
- C:\Windows\System\yvcipDA.exe
  C:\Windows\System\yvcipDA.exe
  2⤵
  PID:5676
- C:\Windows\System\kuTwgzH.exe
  C:\Windows\System\kuTwgzH.exe
  2⤵
  PID:5768
- C:\Windows\System\cPYOtlo.exe
  C:\Windows\System\cPYOtlo.exe
  2⤵
  PID:5820
- C:\Windows\System\smSrGmw.exe
  C:\Windows\System\smSrGmw.exe
  2⤵
  PID:5900
- C:\Windows\System\YfHueLT.exe
  C:\Windows\System\YfHueLT.exe
  2⤵
  PID:5980
- C:\Windows\System\TaADotG.exe
  C:\Windows\System\TaADotG.exe
  2⤵
  PID:6068
- C:\Windows\System\dftAGXn.exe
  C:\Windows\System\dftAGXn.exe
  2⤵
  PID:6100
- C:\Windows\System\mNHmFwV.exe
  C:\Windows\System\mNHmFwV.exe
  2⤵
  PID:5160
- C:\Windows\System\ebGqvdg.exe
  C:\Windows\System\ebGqvdg.exe
  2⤵
  PID:5292
- C:\Windows\System\YWCTyCF.exe
  C:\Windows\System\YWCTyCF.exe
  2⤵
  PID:5500
- C:\Windows\System\IOHMLqq.exe
  C:\Windows\System\IOHMLqq.exe
  2⤵
  PID:5592
- C:\Windows\System\yvTKwWQ.exe
  C:\Windows\System\yvTKwWQ.exe
  2⤵
  PID:5620
- C:\Windows\System\kyfdqCl.exe
  C:\Windows\System\kyfdqCl.exe
  2⤵
  PID:5892
- C:\Windows\System\HsWNyby.exe
  C:\Windows\System\HsWNyby.exe
  2⤵
  PID:6108
- C:\Windows\System\pjIPzfS.exe
  C:\Windows\System\pjIPzfS.exe
  2⤵
  PID:5480
- C:\Windows\System\qmJnJur.exe
  C:\Windows\System\qmJnJur.exe
  2⤵
  PID:5792
- C:\Windows\System\kxOHKDl.exe
  C:\Windows\System\kxOHKDl.exe
  2⤵
  PID:6044
- C:\Windows\System\CkAoVnm.exe
  C:\Windows\System\CkAoVnm.exe
  2⤵
  PID:5744
- C:\Windows\System\PAxIqrE.exe
  C:\Windows\System\PAxIqrE.exe
  2⤵
  PID:6176
- C:\Windows\System\pshaNdf.exe
  C:\Windows\System\pshaNdf.exe
  2⤵
  PID:6204
- C:\Windows\System\DRWQpyv.exe
  C:\Windows\System\DRWQpyv.exe
  2⤵
  PID:6228
- C:\Windows\System\OqzoSsI.exe
  C:\Windows\System\OqzoSsI.exe
  2⤵
  PID:6264
- C:\Windows\System\YhIrahx.exe
  C:\Windows\System\YhIrahx.exe
  2⤵
  PID:6284
- C:\Windows\System\sQKLCsX.exe
  C:\Windows\System\sQKLCsX.exe
  2⤵
  PID:6312
- C:\Windows\System\YqGxSPI.exe
  C:\Windows\System\YqGxSPI.exe
  2⤵
  PID:6340
- C:\Windows\System\OHewdmZ.exe
  C:\Windows\System\OHewdmZ.exe
  2⤵
  PID:6356
- C:\Windows\System\qOGvPZn.exe
  C:\Windows\System\qOGvPZn.exe
  2⤵
  PID:6376
- C:\Windows\System\NQvnRHr.exe
  C:\Windows\System\NQvnRHr.exe
  2⤵
  PID:6404
- C:\Windows\System\DnHYRKo.exe
  C:\Windows\System\DnHYRKo.exe
  2⤵
  PID:6436
- C:\Windows\System\pEDTeBW.exe
  C:\Windows\System\pEDTeBW.exe
  2⤵
  PID:6456
- C:\Windows\System\aEAuoZE.exe
  C:\Windows\System\aEAuoZE.exe
  2⤵
  PID:6476
- C:\Windows\System\tJkWRai.exe
  C:\Windows\System\tJkWRai.exe
  2⤵
  PID:6508
- C:\Windows\System\aUYmWpt.exe
  C:\Windows\System\aUYmWpt.exe
  2⤵
  PID:6532
- C:\Windows\System\iWDAmTR.exe
  C:\Windows\System\iWDAmTR.exe
  2⤵
  PID:6560
- C:\Windows\System\DQXzTaV.exe
  C:\Windows\System\DQXzTaV.exe
  2⤵
  PID:6588
- C:\Windows\System\LVRQsWk.exe
  C:\Windows\System\LVRQsWk.exe
  2⤵
  PID:6616
- C:\Windows\System\fCaTDwT.exe
  C:\Windows\System\fCaTDwT.exe
  2⤵
  PID:6648
- C:\Windows\System\ESTIFfl.exe
  C:\Windows\System\ESTIFfl.exe
  2⤵
  PID:6680
- C:\Windows\System\QsiWYKd.exe
  C:\Windows\System\QsiWYKd.exe
  2⤵
  PID:6708
- C:\Windows\System\kYZqHBf.exe
  C:\Windows\System\kYZqHBf.exe
  2⤵
  PID:6748
- C:\Windows\System\ATCaPvs.exe
  C:\Windows\System\ATCaPvs.exe
  2⤵
  PID:6764
- C:\Windows\System\cnZVkZj.exe
  C:\Windows\System\cnZVkZj.exe
  2⤵
  PID:6792
- C:\Windows\System\tqsVlUT.exe
  C:\Windows\System\tqsVlUT.exe
  2⤵
  PID:6812
- C:\Windows\System\sGtuCxl.exe
  C:\Windows\System\sGtuCxl.exe
  2⤵
  PID:6836
- C:\Windows\System\jVuYrJy.exe
  C:\Windows\System\jVuYrJy.exe
  2⤵
  PID:6868
- C:\Windows\System\rraCcoi.exe
  C:\Windows\System\rraCcoi.exe
  2⤵
  PID:6908
- C:\Windows\System\tWwBdPM.exe
  C:\Windows\System\tWwBdPM.exe
  2⤵
  PID:6924
- C:\Windows\System\jdXjRQm.exe
  C:\Windows\System\jdXjRQm.exe
  2⤵
  PID:6956
- C:\Windows\System\aKQKkpZ.exe
  C:\Windows\System\aKQKkpZ.exe
  2⤵
  PID:6976
- C:\Windows\System\fLBIaBj.exe
  C:\Windows\System\fLBIaBj.exe
  2⤵
  PID:7000
- C:\Windows\System\HdskwLe.exe
  C:\Windows\System\HdskwLe.exe
  2⤵
  PID:7020
- C:\Windows\System\vxxUMms.exe
  C:\Windows\System\vxxUMms.exe
  2⤵
  PID:7048
- C:\Windows\System\bKLoOcG.exe
  C:\Windows\System\bKLoOcG.exe
  2⤵
  PID:7080
- C:\Windows\System\jrhEnFr.exe
  C:\Windows\System\jrhEnFr.exe
  2⤵
  PID:7120
- C:\Windows\System\aBVISlw.exe
  C:\Windows\System\aBVISlw.exe
  2⤵
  PID:7156
- C:\Windows\System\ZhcySJn.exe
  C:\Windows\System\ZhcySJn.exe
  2⤵
  PID:5540
- C:\Windows\System\ZzZIpLY.exe
  C:\Windows\System\ZzZIpLY.exe
  2⤵
  PID:6188
- C:\Windows\System\oPmReVd.exe
  C:\Windows\System\oPmReVd.exe
  2⤵
  PID:6272
- C:\Windows\System\JkUmOQP.exe
  C:\Windows\System\JkUmOQP.exe
  2⤵
  PID:6396
- C:\Windows\System\xDNigdq.exe
  C:\Windows\System\xDNigdq.exe
  2⤵
  PID:6388
- C:\Windows\System\GvTzNPT.exe
  C:\Windows\System\GvTzNPT.exe
  2⤵
  PID:6464
- C:\Windows\System\UwlDVtM.exe
  C:\Windows\System\UwlDVtM.exe
  2⤵
  PID:6568
- C:\Windows\System\XjsJnmr.exe
  C:\Windows\System\XjsJnmr.exe
  2⤵
  PID:6632
- C:\Windows\System\vzVMlkc.exe
  C:\Windows\System\vzVMlkc.exe
  2⤵
  PID:6732
- C:\Windows\System\GVRMxlP.exe
  C:\Windows\System\GVRMxlP.exe
  2⤵
  PID:6780
- C:\Windows\System\wyNAYXJ.exe
  C:\Windows\System\wyNAYXJ.exe
  2⤵
  PID:6864
- C:\Windows\System\KLHyvNu.exe
  C:\Windows\System\KLHyvNu.exe
  2⤵
  PID:6920
- C:\Windows\System\RsdjPeW.exe
  C:\Windows\System\RsdjPeW.exe
  2⤵
  PID:6952
- C:\Windows\System\rFEdvql.exe
  C:\Windows\System\rFEdvql.exe
  2⤵
  PID:7008
- C:\Windows\System\aXIECwq.exe
  C:\Windows\System\aXIECwq.exe
  2⤵
  PID:7060
- C:\Windows\System\nXEwJsL.exe
  C:\Windows\System\nXEwJsL.exe
  2⤵
  PID:5396
- C:\Windows\System\PwjwwmA.exe
  C:\Windows\System\PwjwwmA.exe
  2⤵
  PID:6300
- C:\Windows\System\EELHsBr.exe
  C:\Windows\System\EELHsBr.exe
  2⤵
  PID:6384
- C:\Windows\System\bScyaJf.exe
  C:\Windows\System\bScyaJf.exe
  2⤵
  PID:6580
- C:\Windows\System\nTUFGYb.exe
  C:\Windows\System\nTUFGYb.exe
  2⤵
  PID:6720
- C:\Windows\System\sAIGkAd.exe
  C:\Windows\System\sAIGkAd.exe
  2⤵
  PID:6880
- C:\Windows\System\JHOFVfP.exe
  C:\Windows\System\JHOFVfP.exe
  2⤵
  PID:6992
- C:\Windows\System\RFbWikX.exe
  C:\Windows\System\RFbWikX.exe
  2⤵
  PID:7044
- C:\Windows\System\pBAQvFU.exe
  C:\Windows\System\pBAQvFU.exe
  2⤵
  PID:7148
- C:\Windows\System\QHgbDiO.exe
  C:\Windows\System\QHgbDiO.exe
  2⤵
  PID:6856
- C:\Windows\System\HOVxveQ.exe
  C:\Windows\System\HOVxveQ.exe
  2⤵
  PID:6156
- C:\Windows\System\ItfqyCb.exe
  C:\Windows\System\ItfqyCb.exe
  2⤵
  PID:7172
- C:\Windows\System\NtXTbdf.exe
  C:\Windows\System\NtXTbdf.exe
  2⤵
  PID:7188
- C:\Windows\System\xAYSyFf.exe
  C:\Windows\System\xAYSyFf.exe
  2⤵
  PID:7224
- C:\Windows\System\xpsCvUd.exe
  C:\Windows\System\xpsCvUd.exe
  2⤵
  PID:7244
- C:\Windows\System\Dectdqm.exe
  C:\Windows\System\Dectdqm.exe
  2⤵
  PID:7284
- C:\Windows\System\SIZnHOJ.exe
  C:\Windows\System\SIZnHOJ.exe
  2⤵
  PID:7312
- C:\Windows\System\ixgdgNS.exe
  C:\Windows\System\ixgdgNS.exe
  2⤵
  PID:7340
- C:\Windows\System\vGPqLSO.exe
  C:\Windows\System\vGPqLSO.exe
  2⤵
  PID:7364
- C:\Windows\System\lxRiSEP.exe
  C:\Windows\System\lxRiSEP.exe
  2⤵
  PID:7384
- C:\Windows\System\KmvVCGu.exe
  C:\Windows\System\KmvVCGu.exe
  2⤵
  PID:7400
- C:\Windows\System\UXWypAF.exe
  C:\Windows\System\UXWypAF.exe
  2⤵
  PID:7428
- C:\Windows\System\CqqXVgt.exe
  C:\Windows\System\CqqXVgt.exe
  2⤵
  PID:7448
- C:\Windows\System\qxYhDqr.exe
  C:\Windows\System\qxYhDqr.exe
  2⤵
  PID:7484
- C:\Windows\System\bjUtAgg.exe
  C:\Windows\System\bjUtAgg.exe
  2⤵
  PID:7512
- C:\Windows\System\KFCBVnN.exe
  C:\Windows\System\KFCBVnN.exe
  2⤵
  PID:7544
- C:\Windows\System\NTNreDe.exe
  C:\Windows\System\NTNreDe.exe
  2⤵
  PID:7572
- C:\Windows\System\ciAqqNL.exe
  C:\Windows\System\ciAqqNL.exe
  2⤵
  PID:7592
- C:\Windows\System\UiSLykQ.exe
  C:\Windows\System\UiSLykQ.exe
  2⤵
  PID:7616
- C:\Windows\System\WWrqrHh.exe
  C:\Windows\System\WWrqrHh.exe
  2⤵
  PID:7648
- C:\Windows\System\OecutPw.exe
  C:\Windows\System\OecutPw.exe
  2⤵
  PID:7676
- C:\Windows\System\wOtqzvI.exe
  C:\Windows\System\wOtqzvI.exe
  2⤵
  PID:7708
- C:\Windows\System\tIExjxU.exe
  C:\Windows\System\tIExjxU.exe
  2⤵
  PID:7736
- C:\Windows\System\AYortUq.exe
  C:\Windows\System\AYortUq.exe
  2⤵
  PID:7768
- C:\Windows\System\jMAdSUO.exe
  C:\Windows\System\jMAdSUO.exe
  2⤵
  PID:7792
- C:\Windows\System\MJjVFPD.exe
  C:\Windows\System\MJjVFPD.exe
  2⤵
  PID:7816
- C:\Windows\System\eufZmTY.exe
  C:\Windows\System\eufZmTY.exe
  2⤵
  PID:7844
- C:\Windows\System\aYeKzOH.exe
  C:\Windows\System\aYeKzOH.exe
  2⤵
  PID:7872
- C:\Windows\System\XTEnaTv.exe
  C:\Windows\System\XTEnaTv.exe
  2⤵
  PID:7896
- C:\Windows\System\UuDbRDo.exe
  C:\Windows\System\UuDbRDo.exe
  2⤵
  PID:7928
- C:\Windows\System\xzODjMQ.exe
  C:\Windows\System\xzODjMQ.exe
  2⤵
  PID:7964
- C:\Windows\System\FBcTFvI.exe
  C:\Windows\System\FBcTFvI.exe
  2⤵
  PID:7992
- C:\Windows\System\BdKACOp.exe
  C:\Windows\System\BdKACOp.exe
  2⤵
  PID:8012
- C:\Windows\System\HwrZPVk.exe
  C:\Windows\System\HwrZPVk.exe
  2⤵
  PID:8040
- C:\Windows\System\VcGrGif.exe
  C:\Windows\System\VcGrGif.exe
  2⤵
  PID:8068
- C:\Windows\System\URTWsrE.exe
  C:\Windows\System\URTWsrE.exe
  2⤵
  PID:8100
- C:\Windows\System\ZtiKGtf.exe
  C:\Windows\System\ZtiKGtf.exe
  2⤵
  PID:8128
- C:\Windows\System\yeozQXd.exe
  C:\Windows\System\yeozQXd.exe
  2⤵
  PID:8156
- C:\Windows\System\LIRAvHB.exe
  C:\Windows\System\LIRAvHB.exe
  2⤵
  PID:8188
- C:\Windows\System\hciHPAe.exe
  C:\Windows\System\hciHPAe.exe
  2⤵
  PID:7200
- C:\Windows\System\KuDLMnt.exe
  C:\Windows\System\KuDLMnt.exe
  2⤵
  PID:7256
- C:\Windows\System\nzGchre.exe
  C:\Windows\System\nzGchre.exe
  2⤵
  PID:7328
- C:\Windows\System\LnPprBO.exe
  C:\Windows\System\LnPprBO.exe
  2⤵
  PID:7416
- C:\Windows\System\fHRVIsJ.exe
  C:\Windows\System\fHRVIsJ.exe
  2⤵
  PID:7456
- C:\Windows\System\EGmwpCI.exe
  C:\Windows\System\EGmwpCI.exe
  2⤵
  PID:7528
- C:\Windows\System\USqNcIa.exe
  C:\Windows\System\USqNcIa.exe
  2⤵
  PID:7564
- C:\Windows\System\psBQBsQ.exe
  C:\Windows\System\psBQBsQ.exe
  2⤵
  PID:7496
- C:\Windows\System\cZbcORl.exe
  C:\Windows\System\cZbcORl.exe
  2⤵
  PID:7552
- C:\Windows\System\deDpxZk.exe
  C:\Windows\System\deDpxZk.exe
  2⤵
  PID:7604
- C:\Windows\System\tKWioXM.exe
  C:\Windows\System\tKWioXM.exe
  2⤵
  PID:7732
- C:\Windows\System\nlDyDYa.exe
  C:\Windows\System\nlDyDYa.exe
  2⤵
  PID:7812
- C:\Windows\System\uMNSNQH.exe
  C:\Windows\System\uMNSNQH.exe
  2⤵
  PID:7860
- C:\Windows\System\OnXUHXI.exe
  C:\Windows\System\OnXUHXI.exe
  2⤵
  PID:7908
- C:\Windows\System\gnlAeng.exe
  C:\Windows\System\gnlAeng.exe
  2⤵
  PID:7980
- C:\Windows\System\mcBaOge.exe
  C:\Windows\System\mcBaOge.exe
  2⤵
  PID:7948
- C:\Windows\System\SjBzevm.exe
  C:\Windows\System\SjBzevm.exe
  2⤵
  PID:8096
- C:\Windows\System\kjvzFKB.exe
  C:\Windows\System\kjvzFKB.exe
  2⤵
  PID:8108
- C:\Windows\System\UCzfpLq.exe
  C:\Windows\System\UCzfpLq.exe
  2⤵
  PID:6524
- C:\Windows\System\RCljFnC.exe
  C:\Windows\System\RCljFnC.exe
  2⤵
  PID:7352
- C:\Windows\System\xkpGhXk.exe
  C:\Windows\System\xkpGhXk.exe
  2⤵
  PID:7560
- C:\Windows\System\URozPew.exe
  C:\Windows\System\URozPew.exe
  2⤵
  PID:7624
- C:\Windows\System\OBTnQdL.exe
  C:\Windows\System\OBTnQdL.exe
  2⤵
  PID:7832
- C:\Windows\System\Kgefuad.exe
  C:\Windows\System\Kgefuad.exe
  2⤵
  PID:7924
- C:\Windows\System\fiSERjS.exe
  C:\Windows\System\fiSERjS.exe
  2⤵
  PID:8152
- C:\Windows\System\QLrbhJY.exe
  C:\Windows\System\QLrbhJY.exe
  2⤵
  PID:7356
- C:\Windows\System\LOAaGXt.exe
  C:\Windows\System\LOAaGXt.exe
  2⤵
  PID:7884
- C:\Windows\System\fyRyFTJ.exe
  C:\Windows\System\fyRyFTJ.exe
  2⤵
  PID:8220
- C:\Windows\System\TfoxYea.exe
  C:\Windows\System\TfoxYea.exe
  2⤵
  PID:8252
- C:\Windows\System\PKtBlsw.exe
  C:\Windows\System\PKtBlsw.exe
  2⤵
  PID:8284
- C:\Windows\System\DplxhhH.exe
  C:\Windows\System\DplxhhH.exe
  2⤵
  PID:8300
- C:\Windows\System\hkxGsJu.exe
  C:\Windows\System\hkxGsJu.exe
  2⤵
  PID:8324
- C:\Windows\System\ogxdISG.exe
  C:\Windows\System\ogxdISG.exe
  2⤵
  PID:8360
- C:\Windows\System\ecHHhSh.exe
  C:\Windows\System\ecHHhSh.exe
  2⤵
  PID:8388
- C:\Windows\System\FMROXFm.exe
  C:\Windows\System\FMROXFm.exe
  2⤵
  PID:8424
- C:\Windows\System\aMoSigY.exe
  C:\Windows\System\aMoSigY.exe
  2⤵
  PID:8444
- C:\Windows\System\ypuZhhV.exe
  C:\Windows\System\ypuZhhV.exe
  2⤵
  PID:8476
- C:\Windows\System\TZknUZq.exe
  C:\Windows\System\TZknUZq.exe
  2⤵
  PID:8508
- C:\Windows\System\yIOfGEG.exe
  C:\Windows\System\yIOfGEG.exe
  2⤵
  PID:8528
- C:\Windows\System\teOxKdI.exe
  C:\Windows\System\teOxKdI.exe
  2⤵
  PID:8556
- C:\Windows\System\YxRZkIE.exe
  C:\Windows\System\YxRZkIE.exe
  2⤵
  PID:8596
- C:\Windows\System\YpXQLAw.exe
  C:\Windows\System\YpXQLAw.exe
  2⤵
  PID:8628
- C:\Windows\System\LmDDllC.exe
  C:\Windows\System\LmDDllC.exe
  2⤵
  PID:8672
- C:\Windows\System\xWdHuep.exe
  C:\Windows\System\xWdHuep.exe
  2⤵
  PID:8700
- C:\Windows\System\tdIvrdY.exe
  C:\Windows\System\tdIvrdY.exe
  2⤵
  PID:8720
- C:\Windows\System\CkhPHIN.exe
  C:\Windows\System\CkhPHIN.exe
  2⤵
  PID:8736
- C:\Windows\System\UKkUBOW.exe
  C:\Windows\System\UKkUBOW.exe
  2⤵
  PID:8764
- C:\Windows\System\WdAqomw.exe
  C:\Windows\System\WdAqomw.exe
  2⤵
  PID:8800
- C:\Windows\System\RXeNKCg.exe
  C:\Windows\System\RXeNKCg.exe
  2⤵
  PID:8824
- C:\Windows\System\NHbHCBD.exe
  C:\Windows\System\NHbHCBD.exe
  2⤵
  PID:8856
- C:\Windows\System\SwvHdhE.exe
  C:\Windows\System\SwvHdhE.exe
  2⤵
  PID:8896
- C:\Windows\System\VUTUsaO.exe
  C:\Windows\System\VUTUsaO.exe
  2⤵
  PID:8928
- C:\Windows\System\mmXWIQT.exe
  C:\Windows\System\mmXWIQT.exe
  2⤵
  PID:8952
- C:\Windows\System\MxVfbkN.exe
  C:\Windows\System\MxVfbkN.exe
  2⤵
  PID:8984
- C:\Windows\System\pfrMPjE.exe
  C:\Windows\System\pfrMPjE.exe
  2⤵
  PID:9000
- C:\Windows\System\bkdTLMw.exe
  C:\Windows\System\bkdTLMw.exe
  2⤵
  PID:9032
- C:\Windows\System\sVHpYgp.exe
  C:\Windows\System\sVHpYgp.exe
  2⤵
  PID:9060
- C:\Windows\System\yPNyQcT.exe
  C:\Windows\System\yPNyQcT.exe
  2⤵
  PID:9092
- C:\Windows\System\xuXcDrN.exe
  C:\Windows\System\xuXcDrN.exe
  2⤵
  PID:9124
- C:\Windows\System\Gupylzh.exe
  C:\Windows\System\Gupylzh.exe
  2⤵
  PID:9156
- C:\Windows\System\QfgUsgm.exe
  C:\Windows\System\QfgUsgm.exe
  2⤵
  PID:9184
- C:\Windows\System\wcEyNNQ.exe
  C:\Windows\System\wcEyNNQ.exe
  2⤵
  PID:7660
- C:\Windows\System\zMTILaR.exe
  C:\Windows\System\zMTILaR.exe
  2⤵
  PID:6968
- C:\Windows\System\VdAZUcd.exe
  C:\Windows\System\VdAZUcd.exe
  2⤵
  PID:8196
- C:\Windows\System\rCCurmx.exe
  C:\Windows\System\rCCurmx.exe
  2⤵
  PID:8208
- C:\Windows\System\ioCZgTk.exe
  C:\Windows\System\ioCZgTk.exe
  2⤵
  PID:8296
- C:\Windows\System\QEwNDDz.exe
  C:\Windows\System\QEwNDDz.exe
  2⤵
  PID:8468
- C:\Windows\System\YQTYqLX.exe
  C:\Windows\System\YQTYqLX.exe
  2⤵
  PID:8412
- C:\Windows\System\sudbYji.exe
  C:\Windows\System\sudbYji.exe
  2⤵
  PID:8524
- C:\Windows\System\vtKjfZB.exe
  C:\Windows\System\vtKjfZB.exe
  2⤵
  PID:8684
- C:\Windows\System\zjQLvxe.exe
  C:\Windows\System\zjQLvxe.exe
  2⤵
  PID:8612
- C:\Windows\System\fZcxdky.exe
  C:\Windows\System\fZcxdky.exe
  2⤵
  PID:8728
- C:\Windows\System\fjXdfNv.exe
  C:\Windows\System\fjXdfNv.exe
  2⤵
  PID:8780
- C:\Windows\System\rhJNPRw.exe
  C:\Windows\System\rhJNPRw.exe
  2⤵
  PID:8920
- C:\Windows\System\jKctjBy.exe
  C:\Windows\System\jKctjBy.exe
  2⤵
  PID:8916
- C:\Windows\System\bvqGjJg.exe
  C:\Windows\System\bvqGjJg.exe
  2⤵
  PID:8968
- C:\Windows\System\CTBlvep.exe
  C:\Windows\System\CTBlvep.exe
  2⤵
  PID:9084
- C:\Windows\System\fTxeiYK.exe
  C:\Windows\System\fTxeiYK.exe
  2⤵
  PID:9140
- C:\Windows\System\teGAbfV.exe
  C:\Windows\System\teGAbfV.exe
  2⤵
  PID:9168
- C:\Windows\System\mFNJHvq.exe
  C:\Windows\System\mFNJHvq.exe
  2⤵
  PID:8264
- C:\Windows\System\Zzakryd.exe
  C:\Windows\System\Zzakryd.exe
  2⤵
  PID:8348
- C:\Windows\System\ISfgcbA.exe
  C:\Windows\System\ISfgcbA.exe
  2⤵
  PID:8384
- C:\Windows\System\GDwBbcp.exe
  C:\Windows\System\GDwBbcp.exe
  2⤵
  PID:8436
- C:\Windows\System\aIXMeyM.exe
  C:\Windows\System\aIXMeyM.exe
  2⤵
  PID:8708
- C:\Windows\System\xeOtvbs.exe
  C:\Windows\System\xeOtvbs.exe
  2⤵
  PID:8868
- C:\Windows\System\rMvDVwm.exe
  C:\Windows\System\rMvDVwm.exe
  2⤵
  PID:8964
- C:\Windows\System\VUUojcg.exe
  C:\Windows\System\VUUojcg.exe
  2⤵
  PID:8464
- C:\Windows\System\Msaroxb.exe
  C:\Windows\System\Msaroxb.exe
  2⤵
  PID:8756
- C:\Windows\System\yMyqCcN.exe
  C:\Windows\System\yMyqCcN.exe
  2⤵
  PID:9076
- C:\Windows\System\pWWkUdH.exe
  C:\Windows\System\pWWkUdH.exe
  2⤵
  PID:8268
- C:\Windows\System\LwHMWaa.exe
  C:\Windows\System\LwHMWaa.exe
  2⤵
  PID:9240
- C:\Windows\System\olIthyc.exe
  C:\Windows\System\olIthyc.exe
  2⤵
  PID:9268
- C:\Windows\System\lVMBjDr.exe
  C:\Windows\System\lVMBjDr.exe
  2⤵
  PID:9296
- C:\Windows\System\jngiSTO.exe
  C:\Windows\System\jngiSTO.exe
  2⤵
  PID:9332
- C:\Windows\System\CiWNusK.exe
  C:\Windows\System\CiWNusK.exe
  2⤵
  PID:9352
- C:\Windows\System\SRbijYL.exe
  C:\Windows\System\SRbijYL.exe
  2⤵
  PID:9376
- C:\Windows\System\EDoyEJB.exe
  C:\Windows\System\EDoyEJB.exe
  2⤵
  PID:9408
- C:\Windows\System\ftbzATT.exe
  C:\Windows\System\ftbzATT.exe
  2⤵
  PID:9436
- C:\Windows\System\WrkoGAA.exe
  C:\Windows\System\WrkoGAA.exe
  2⤵
  PID:9464
- C:\Windows\System\NomLrTU.exe
  C:\Windows\System\NomLrTU.exe
  2⤵
  PID:9492
- C:\Windows\System\qZCLmDn.exe
  C:\Windows\System\qZCLmDn.exe
  2⤵
  PID:9520
- C:\Windows\System\FtYhmBn.exe
  C:\Windows\System\FtYhmBn.exe
  2⤵
  PID:9548
- C:\Windows\System\kbklCDv.exe
  C:\Windows\System\kbklCDv.exe
  2⤵
  PID:9568
- C:\Windows\System\QSWjQpo.exe
  C:\Windows\System\QSWjQpo.exe
  2⤵
  PID:9592
- C:\Windows\System\TiKPHPY.exe
  C:\Windows\System\TiKPHPY.exe
  2⤵
  PID:9620
- C:\Windows\System\dOwkOrA.exe
  C:\Windows\System\dOwkOrA.exe
  2⤵
  PID:9636
- C:\Windows\System\QLhtktA.exe
  C:\Windows\System\QLhtktA.exe
  2⤵
  PID:9660
- C:\Windows\System\cRpXSBs.exe
  C:\Windows\System\cRpXSBs.exe
  2⤵
  PID:9688
- C:\Windows\System\akiMtbl.exe
  C:\Windows\System\akiMtbl.exe
  2⤵
  PID:9716
- C:\Windows\System\oFvNjPB.exe
  C:\Windows\System\oFvNjPB.exe
  2⤵
  PID:9744
- C:\Windows\System\ncrmILV.exe
  C:\Windows\System\ncrmILV.exe
  2⤵
  PID:9772
- C:\Windows\System\hbrEMyE.exe
  C:\Windows\System\hbrEMyE.exe
  2⤵
  PID:9792
- C:\Windows\System\bsVRbTz.exe
  C:\Windows\System\bsVRbTz.exe
  2⤵
  PID:9808
- C:\Windows\System\uURpziB.exe
  C:\Windows\System\uURpziB.exe
  2⤵
  PID:9832
- C:\Windows\System\QnqWpZw.exe
  C:\Windows\System\QnqWpZw.exe
  2⤵
  PID:9868
- C:\Windows\System\gCGjbNH.exe
  C:\Windows\System\gCGjbNH.exe
  2⤵
  PID:9892
- C:\Windows\System\qxEVDmh.exe
  C:\Windows\System\qxEVDmh.exe
  2⤵
  PID:9924
- C:\Windows\System\eoHBUfH.exe
  C:\Windows\System\eoHBUfH.exe
  2⤵
  PID:9952
- C:\Windows\System\MzsYTIj.exe
  C:\Windows\System\MzsYTIj.exe
  2⤵
  PID:9988
- C:\Windows\System\paWsvyM.exe
  C:\Windows\System\paWsvyM.exe
  2⤵
  PID:10020
- C:\Windows\System\ZnYUmLW.exe
  C:\Windows\System\ZnYUmLW.exe
  2⤵
  PID:10044
- C:\Windows\System\ibvTkmS.exe
  C:\Windows\System\ibvTkmS.exe
  2⤵
  PID:10076
- C:\Windows\System\oMhQncT.exe
  C:\Windows\System\oMhQncT.exe
  2⤵
  PID:10112
- C:\Windows\System\bqPsZcC.exe
  C:\Windows\System\bqPsZcC.exe
  2⤵
  PID:10136
- C:\Windows\System\PwesONO.exe
  C:\Windows\System\PwesONO.exe
  2⤵
  PID:10152
- C:\Windows\System\pYUUAzM.exe
  C:\Windows\System\pYUUAzM.exe
  2⤵
  PID:10188
- C:\Windows\System\cIeWauf.exe
  C:\Windows\System\cIeWauf.exe
  2⤵
  PID:10216
- C:\Windows\System\wZZUPsK.exe
  C:\Windows\System\wZZUPsK.exe
  2⤵
  PID:10236
- C:\Windows\System\VecGPOZ.exe
  C:\Windows\System\VecGPOZ.exe
  2⤵
  PID:9264
- C:\Windows\System\JUIPmME.exe
  C:\Windows\System\JUIPmME.exe
  2⤵
  PID:9312
- C:\Windows\System\pNAzYxz.exe
  C:\Windows\System\pNAzYxz.exe
  2⤵
  PID:9396
- C:\Windows\System\JMWjxKS.exe
  C:\Windows\System\JMWjxKS.exe
  2⤵
  PID:9452
- C:\Windows\System\wEhFfQF.exe
  C:\Windows\System\wEhFfQF.exe
  2⤵
  PID:9536
- C:\Windows\System\slJwVZC.exe
  C:\Windows\System\slJwVZC.exe
  2⤵
  PID:9580
- C:\Windows\System\VDlIsew.exe
  C:\Windows\System\VDlIsew.exe
  2⤵
  PID:9656
- C:\Windows\System\fogAojE.exe
  C:\Windows\System\fogAojE.exe
  2⤵
  PID:9728
- C:\Windows\System\iziIfzo.exe
  C:\Windows\System\iziIfzo.exe
  2⤵
  PID:9764
- C:\Windows\System\gPmNeCd.exe
  C:\Windows\System\gPmNeCd.exe
  2⤵
  PID:9824
- C:\Windows\System\mgdqVFc.exe
  C:\Windows\System\mgdqVFc.exe
  2⤵
  PID:9880
- C:\Windows\System\WnlhQOE.exe
  C:\Windows\System\WnlhQOE.exe
  2⤵
  PID:9980
- C:\Windows\System\FYBQbtl.exe
  C:\Windows\System\FYBQbtl.exe
  2⤵
  PID:9968
- C:\Windows\System\tLYlYLF.exe
  C:\Windows\System\tLYlYLF.exe
  2⤵
  PID:10108
- C:\Windows\System\mzvHBIb.exe
  C:\Windows\System\mzvHBIb.exe
  2⤵
  PID:10164
- C:\Windows\System\vjCjfwq.exe
  C:\Windows\System\vjCjfwq.exe
  2⤵
  PID:10228
- C:\Windows\System\eQcTjoj.exe
  C:\Windows\System\eQcTjoj.exe
  2⤵
  PID:10204
- C:\Windows\System\Xbwwkdx.exe
  C:\Windows\System\Xbwwkdx.exe
  2⤵
  PID:9220
- C:\Windows\System\NJEZsLP.exe
  C:\Windows\System\NJEZsLP.exe
  2⤵
  PID:9508
- C:\Windows\System\aZtoUCf.exe
  C:\Windows\System\aZtoUCf.exe
  2⤵
  PID:9604
- C:\Windows\System\ILzMfwP.exe
  C:\Windows\System\ILzMfwP.exe
  2⤵
  PID:9648
- C:\Windows\System\kTkQdEo.exe
  C:\Windows\System\kTkQdEo.exe
  2⤵
  PID:9908
- C:\Windows\System\NVskTPQ.exe
  C:\Windows\System\NVskTPQ.exe
  2⤵
  PID:10148
- C:\Windows\System\DoFBpnh.exe
  C:\Windows\System\DoFBpnh.exe
  2⤵
  PID:10224
- C:\Windows\System\EQAPKnU.exe
  C:\Windows\System\EQAPKnU.exe
  2⤵
  PID:10120
- C:\Windows\System\FPNlImA.exe
  C:\Windows\System\FPNlImA.exe
  2⤵
  PID:10124
- C:\Windows\System\UmwHJRM.exe
  C:\Windows\System\UmwHJRM.exe
  2⤵
  PID:10060
- C:\Windows\System\UHyPupm.exe
  C:\Windows\System\UHyPupm.exe
  2⤵
  PID:10252
- C:\Windows\System\WpkTrJq.exe
  C:\Windows\System\WpkTrJq.exe
  2⤵
  PID:10284
- C:\Windows\System\lOxomRB.exe
  C:\Windows\System\lOxomRB.exe
  2⤵
  PID:10312
- C:\Windows\System\EWjMYAj.exe
  C:\Windows\System\EWjMYAj.exe
  2⤵
  PID:10344
- C:\Windows\System\PWDPyZD.exe
  C:\Windows\System\PWDPyZD.exe
  2⤵
  PID:10376
- C:\Windows\System\pXdSXqt.exe
  C:\Windows\System\pXdSXqt.exe
  2⤵
  PID:10400
- C:\Windows\System\gBwTIYn.exe
  C:\Windows\System\gBwTIYn.exe
  2⤵
  PID:10428
- C:\Windows\System\ZzdfZCr.exe
  C:\Windows\System\ZzdfZCr.exe
  2⤵
  PID:10448
- C:\Windows\System\rIIrNWj.exe
  C:\Windows\System\rIIrNWj.exe
  2⤵
  PID:10472
- C:\Windows\System\enTdVKA.exe
  C:\Windows\System\enTdVKA.exe
  2⤵
  PID:10496
- C:\Windows\System\MGSoTzU.exe
  C:\Windows\System\MGSoTzU.exe
  2⤵
  PID:10576
- C:\Windows\System\CMdqPyK.exe
  C:\Windows\System\CMdqPyK.exe
  2⤵
  PID:10600
- C:\Windows\System\JyMTFfs.exe
  C:\Windows\System\JyMTFfs.exe
  2⤵
  PID:10644
- C:\Windows\System\kYWTRhr.exe
  C:\Windows\System\kYWTRhr.exe
  2⤵
  PID:10660
- C:\Windows\System\CVGctOb.exe
  C:\Windows\System\CVGctOb.exe
  2⤵
  PID:10688
- C:\Windows\System\hBolhHn.exe
  C:\Windows\System\hBolhHn.exe
  2⤵
  PID:10720
- C:\Windows\System\niYaMwB.exe
  C:\Windows\System\niYaMwB.exe
  2⤵
  PID:10752
- C:\Windows\System\zlQVLOh.exe
  C:\Windows\System\zlQVLOh.exe
  2⤵
  PID:10776
- C:\Windows\System\KkkJzJC.exe
  C:\Windows\System\KkkJzJC.exe
  2⤵
  PID:10804
- C:\Windows\System\ZUKfhgL.exe
  C:\Windows\System\ZUKfhgL.exe
  2⤵
  PID:10836
- C:\Windows\System\RJfgUYc.exe
  C:\Windows\System\RJfgUYc.exe
  2⤵
  PID:10860
- C:\Windows\System\eQHTfCe.exe
  C:\Windows\System\eQHTfCe.exe
  2⤵
  PID:10888
- C:\Windows\System\zhYjixF.exe
  C:\Windows\System\zhYjixF.exe
  2⤵
  PID:10908
- C:\Windows\System\EPrmrrN.exe
  C:\Windows\System\EPrmrrN.exe
  2⤵
  PID:10932
- C:\Windows\System\GaeNcCK.exe
  C:\Windows\System\GaeNcCK.exe
  2⤵
  PID:10960
- C:\Windows\System\EsqsvpI.exe
  C:\Windows\System\EsqsvpI.exe
  2⤵
  PID:10992
- C:\Windows\System\VAAZYMN.exe
  C:\Windows\System\VAAZYMN.exe
  2⤵
  PID:11024
- C:\Windows\System\zitMHZL.exe
  C:\Windows\System\zitMHZL.exe
  2⤵
  PID:11052
- C:\Windows\System\JhKvqLA.exe
  C:\Windows\System\JhKvqLA.exe
  2⤵
  PID:11084
- C:\Windows\System\eMvVwCc.exe
  C:\Windows\System\eMvVwCc.exe
  2⤵
  PID:11116
- C:\Windows\System\mSWcBBs.exe
  C:\Windows\System\mSWcBBs.exe
  2⤵
  PID:11144
- C:\Windows\System\srJiBYs.exe
  C:\Windows\System\srJiBYs.exe
  2⤵
  PID:11168
- C:\Windows\System\uZRezRo.exe
  C:\Windows\System\uZRezRo.exe
  2⤵
  PID:11188
- C:\Windows\System\VLQZkTc.exe
  C:\Windows\System\VLQZkTc.exe
  2⤵
  PID:11208
- C:\Windows\System\DwiTdcx.exe
  C:\Windows\System\DwiTdcx.exe
  2⤵
  PID:11228
- C:\Windows\System\cvhDXif.exe
  C:\Windows\System\cvhDXif.exe
  2⤵
  PID:11252
- C:\Windows\System\AXIktOr.exe
  C:\Windows\System\AXIktOr.exe
  2⤵
  PID:9940
- C:\Windows\System\IasABdx.exe
  C:\Windows\System\IasABdx.exe
  2⤵
  PID:10100
- C:\Windows\System\TPnRBqc.exe
  C:\Windows\System\TPnRBqc.exe
  2⤵
  PID:10292
- C:\Windows\System\kHerdTA.exe
  C:\Windows\System\kHerdTA.exe
  2⤵
  PID:10392
- C:\Windows\System\QbOZumn.exe
  C:\Windows\System\QbOZumn.exe
  2⤵
  PID:10464
- C:\Windows\System\EUSTOtD.exe
  C:\Windows\System\EUSTOtD.exe
  2⤵
  PID:10564
- C:\Windows\System\RWKKplz.exe
  C:\Windows\System\RWKKplz.exe
  2⤵
  PID:10620
- C:\Windows\System\vxjlhXY.exe
  C:\Windows\System\vxjlhXY.exe
  2⤵
  PID:10672
- C:\Windows\System\UmUYbtH.exe
  C:\Windows\System\UmUYbtH.exe
  2⤵
  PID:10732
- C:\Windows\System\HPbgGwu.exe
  C:\Windows\System\HPbgGwu.exe
  2⤵
  PID:10852
- C:\Windows\System\AUgpOTd.exe
  C:\Windows\System\AUgpOTd.exe
  2⤵
  PID:10856
- C:\Windows\System\KqrEqlT.exe
  C:\Windows\System\KqrEqlT.exe
  2⤵
  PID:10988
- C:\Windows\System\MCREjcO.exe
  C:\Windows\System\MCREjcO.exe
  2⤵
  PID:11008
- C:\Windows\System\rsprgko.exe
  C:\Windows\System\rsprgko.exe
  2⤵
  PID:11128
- C:\Windows\System\EzGuhow.exe
  C:\Windows\System\EzGuhow.exe
  2⤵
  PID:11156
- C:\Windows\System\ZvcKENc.exe
  C:\Windows\System\ZvcKENc.exe
  2⤵
  PID:11204
- C:\Windows\System\pKCNPUG.exe
  C:\Windows\System\pKCNPUG.exe
  2⤵
  PID:10328
- C:\Windows\System\rxVgidq.exe
  C:\Windows\System\rxVgidq.exe
  2⤵
  PID:10272
- C:\Windows\System\FOwDNcV.exe
  C:\Windows\System\FOwDNcV.exe
  2⤵
  PID:10624
- C:\Windows\System\dbGiAlW.exe
  C:\Windows\System\dbGiAlW.exe
  2⤵
  PID:10772
- C:\Windows\System\uMCQTTZ.exe
  C:\Windows\System\uMCQTTZ.exe
  2⤵
  PID:10900
- C:\Windows\System\CDknfpo.exe
  C:\Windows\System\CDknfpo.exe
  2⤵
  PID:11020
- C:\Windows\System\uTQKdvj.exe
  C:\Windows\System\uTQKdvj.exe
  2⤵
  PID:11076
- C:\Windows\System\XhBsAGq.exe
  C:\Windows\System\XhBsAGq.exe
  2⤵
  PID:10488
- C:\Windows\System\LZNVlDo.exe
  C:\Windows\System\LZNVlDo.exe
  2⤵
  PID:10740
- C:\Windows\System\GUQkhUE.exe
  C:\Windows\System\GUQkhUE.exe
  2⤵
  PID:11108
- C:\Windows\System\YHsipYb.exe
  C:\Windows\System\YHsipYb.exe
  2⤵
  PID:11292
- C:\Windows\System\PRjUfax.exe
  C:\Windows\System\PRjUfax.exe
  2⤵
  PID:11316
- C:\Windows\System\jbNlkdO.exe
  C:\Windows\System\jbNlkdO.exe
  2⤵
  PID:11340
- C:\Windows\System\CMgGZAv.exe
  C:\Windows\System\CMgGZAv.exe
  2⤵
  PID:11360
- C:\Windows\System\fkIUVZA.exe
  C:\Windows\System\fkIUVZA.exe
  2⤵
  PID:11392
- C:\Windows\System\qwwLEcO.exe
  C:\Windows\System\qwwLEcO.exe
  2⤵
  PID:11420
- C:\Windows\System\GMhSEsU.exe
  C:\Windows\System\GMhSEsU.exe
  2⤵
  PID:11448
- C:\Windows\System\bDkWdKB.exe
  C:\Windows\System\bDkWdKB.exe
  2⤵
  PID:11480
- C:\Windows\System\fjlqZal.exe
  C:\Windows\System\fjlqZal.exe
  2⤵
  PID:11504
- C:\Windows\System\UzdUTTO.exe
  C:\Windows\System\UzdUTTO.exe
  2⤵
  PID:11528
- C:\Windows\System\UaqMEuz.exe
  C:\Windows\System\UaqMEuz.exe
  2⤵
  PID:11556
- C:\Windows\System\VxTndVC.exe
  C:\Windows\System\VxTndVC.exe
  2⤵
  PID:11596
- C:\Windows\System\UfmJXcV.exe
  C:\Windows\System\UfmJXcV.exe
  2⤵
  PID:11624
- C:\Windows\System\HPzXmhX.exe
  C:\Windows\System\HPzXmhX.exe
  2⤵
  PID:11656
- C:\Windows\System\qcMcdsE.exe
  C:\Windows\System\qcMcdsE.exe
  2⤵
  PID:11684
- C:\Windows\System\tGcAFZf.exe
  C:\Windows\System\tGcAFZf.exe
  2⤵
  PID:11716
- C:\Windows\System\CXoQSVT.exe
  C:\Windows\System\CXoQSVT.exe
  2⤵
  PID:11748
- C:\Windows\System\cfmiyLt.exe
  C:\Windows\System\cfmiyLt.exe
  2⤵
  PID:11784
- C:\Windows\System\tiMVksw.exe
  C:\Windows\System\tiMVksw.exe
  2⤵
  PID:11804
- C:\Windows\System\uAKljiK.exe
  C:\Windows\System\uAKljiK.exe
  2⤵
  PID:11828
- C:\Windows\System\mrijWKr.exe
  C:\Windows\System\mrijWKr.exe
  2⤵
  PID:11856
- C:\Windows\System\mHpgSdX.exe
  C:\Windows\System\mHpgSdX.exe
  2⤵
  PID:11888
- C:\Windows\System\tkKSvac.exe
  C:\Windows\System\tkKSvac.exe
  2⤵
  PID:11920
- C:\Windows\System\yyKCeYp.exe
  C:\Windows\System\yyKCeYp.exe
  2⤵
  PID:11948
- C:\Windows\System\aEioZYI.exe
  C:\Windows\System\aEioZYI.exe
  2⤵
  PID:11972
- C:\Windows\System\wcdAFgy.exe
  C:\Windows\System\wcdAFgy.exe
  2⤵
  PID:11996
- C:\Windows\System\nIyvNyq.exe
  C:\Windows\System\nIyvNyq.exe
  2⤵
  PID:12020
- C:\Windows\System\yhrGoIX.exe
  C:\Windows\System\yhrGoIX.exe
  2⤵
  PID:12052
- C:\Windows\System\yAqPnBQ.exe
  C:\Windows\System\yAqPnBQ.exe
  2⤵
  PID:12076
- C:\Windows\System\FTegEHy.exe
  C:\Windows\System\FTegEHy.exe
  2⤵
  PID:12108
- C:\Windows\System\qsTXwLs.exe
  C:\Windows\System\qsTXwLs.exe
  2⤵
  PID:12128
- C:\Windows\System\ZPgIUTZ.exe
  C:\Windows\System\ZPgIUTZ.exe
  2⤵
  PID:12156
- C:\Windows\System\BAFsHJB.exe
  C:\Windows\System\BAFsHJB.exe
  2⤵
  PID:12184
- C:\Windows\System\ZCbKqeG.exe
  C:\Windows\System\ZCbKqeG.exe
  2⤵
  PID:12212
- C:\Windows\System\VrAwlPp.exe
  C:\Windows\System\VrAwlPp.exe
  2⤵
  PID:12236
- C:\Windows\System\LZedwag.exe
  C:\Windows\System\LZedwag.exe
  2⤵
  PID:12256
- C:\Windows\System\RZqQOAO.exe
  C:\Windows\System\RZqQOAO.exe
  2⤵
  PID:12272
- C:\Windows\System\XZsohLJ.exe
  C:\Windows\System\XZsohLJ.exe
  2⤵
  PID:11184
- C:\Windows\System\dFBePfc.exe
  C:\Windows\System\dFBePfc.exe
  2⤵
  PID:10572
- C:\Windows\System\dLWoPbt.exe
  C:\Windows\System\dLWoPbt.exe
  2⤵
  PID:11304
- C:\Windows\System\wtlywAN.exe
  C:\Windows\System\wtlywAN.exe
  2⤵
  PID:11440
- C:\Windows\System\UuKxQCV.exe
  C:\Windows\System\UuKxQCV.exe
  2⤵
  PID:11356
- C:\Windows\System\TcKrQyq.exe
  C:\Windows\System\TcKrQyq.exe
  2⤵
  PID:11584
- C:\Windows\System\OPGNeey.exe
  C:\Windows\System\OPGNeey.exe
  2⤵
  PID:11616
- C:\Windows\System\oQKyJjY.exe
  C:\Windows\System\oQKyJjY.exe
  2⤵
  PID:11568
- C:\Windows\System\bWNuAlb.exe
  C:\Windows\System\bWNuAlb.exe
  2⤵
  PID:11724
- C:\Windows\System\OyhGhZR.exe
  C:\Windows\System\OyhGhZR.exe
  2⤵
  PID:11744
- C:\Windows\System\FLWiJHr.exe
  C:\Windows\System\FLWiJHr.exe
  2⤵
  PID:11916
- C:\Windows\System\UbCxTdT.exe
  C:\Windows\System\UbCxTdT.exe
  2⤵
  PID:11868
- C:\Windows\System\rkQFiTG.exe
  C:\Windows\System\rkQFiTG.exe
  2⤵
  PID:11968
- C:\Windows\System\qfUjTub.exe
  C:\Windows\System\qfUjTub.exe
  2⤵
  PID:11960
- C:\Windows\System\IXNRvck.exe
  C:\Windows\System\IXNRvck.exe
  2⤵
  PID:12140
- C:\Windows\System\IxhYKQv.exe
  C:\Windows\System\IxhYKQv.exe
  2⤵
  PID:12096
- C:\Windows\System\YJdJcjb.exe
  C:\Windows\System\YJdJcjb.exe
  2⤵
  PID:12244
- C:\Windows\System\ZtAKRam.exe
  C:\Windows\System\ZtAKRam.exe
  2⤵
  PID:12204
- C:\Windows\System\uDYOtkh.exe
  C:\Windows\System\uDYOtkh.exe
  2⤵
  PID:11224
- C:\Windows\System\ytpmPfT.exe
  C:\Windows\System\ytpmPfT.exe
  2⤵
  PID:11572
- C:\Windows\System\WixVPlp.exe
  C:\Windows\System\WixVPlp.exe
  2⤵
  PID:11740
- C:\Windows\System\IKwkzAR.exe
  C:\Windows\System\IKwkzAR.exe
  2⤵
  PID:11676
- C:\Windows\System\URmxhjX.exe
  C:\Windows\System\URmxhjX.exe
  2⤵
  PID:11816
- C:\Windows\System\dMGTLRB.exe
  C:\Windows\System\dMGTLRB.exe
  2⤵
  PID:12200
- C:\Windows\System\YLCLKiN.exe
  C:\Windows\System\YLCLKiN.exe
  2⤵
  PID:12228
- C:\Windows\System\wncGVmu.exe
  C:\Windows\System\wncGVmu.exe
  2⤵
  PID:11444
- C:\Windows\System\BdnYzBY.exe
  C:\Windows\System\BdnYzBY.exe
  2⤵
  PID:11516
- C:\Windows\System\HOzKAaN.exe
  C:\Windows\System\HOzKAaN.exe
  2⤵
  PID:11064
- C:\Windows\System\qVsfklz.exe
  C:\Windows\System\qVsfklz.exe
  2⤵
  PID:12300
- C:\Windows\System\RWjKfVL.exe
  C:\Windows\System\RWjKfVL.exe
  2⤵
  PID:12328
- C:\Windows\System\FFgwnby.exe
  C:\Windows\System\FFgwnby.exe
  2⤵
  PID:12364
- C:\Windows\System\aYxyHAf.exe
  C:\Windows\System\aYxyHAf.exe
  2⤵
  PID:12392
- C:\Windows\System\yStWshY.exe
  C:\Windows\System\yStWshY.exe
  2⤵
  PID:12412
- C:\Windows\System\VaBnVau.exe
  C:\Windows\System\VaBnVau.exe
  2⤵
  PID:12444
- C:\Windows\System\GMeZONB.exe
  C:\Windows\System\GMeZONB.exe
  2⤵
  PID:12468
- C:\Windows\System\ecZFLQO.exe
  C:\Windows\System\ecZFLQO.exe
  2⤵
  PID:12488
- C:\Windows\System\hkyCcSd.exe
  C:\Windows\System\hkyCcSd.exe
  2⤵
  PID:12516
- C:\Windows\System\dGTLpSF.exe
  C:\Windows\System\dGTLpSF.exe
  2⤵
  PID:12544
- C:\Windows\System\jpHcORT.exe
  C:\Windows\System\jpHcORT.exe
  2⤵
  PID:12576
- C:\Windows\System\VcAQnDi.exe
  C:\Windows\System\VcAQnDi.exe
  2⤵
  PID:12592
- C:\Windows\System\HdhLRWL.exe
  C:\Windows\System\HdhLRWL.exe
  2⤵
  PID:12624
- C:\Windows\System\JdGTxkh.exe
  C:\Windows\System\JdGTxkh.exe
  2⤵
  PID:12660
- C:\Windows\System\gVErlIH.exe
  C:\Windows\System\gVErlIH.exe
  2⤵
  PID:12688
- C:\Windows\System\tvGjAqO.exe
  C:\Windows\System\tvGjAqO.exe
  2⤵
  PID:12712
- C:\Windows\System\kaGhibs.exe
  C:\Windows\System\kaGhibs.exe
  2⤵
  PID:12736
- C:\Windows\System\qZfbslC.exe
  C:\Windows\System\qZfbslC.exe
  2⤵
  PID:12760
- C:\Windows\System\hCEhQWW.exe
  C:\Windows\System\hCEhQWW.exe
  2⤵
  PID:12800
- C:\Windows\System\qOjCQeA.exe
  C:\Windows\System\qOjCQeA.exe
  2⤵
  PID:12824
- C:\Windows\System\aZMJFnR.exe
  C:\Windows\System\aZMJFnR.exe
  2⤵
  PID:12860
- C:\Windows\System\DwfpNVc.exe
  C:\Windows\System\DwfpNVc.exe
  2⤵
  PID:12900
- C:\Windows\System\QkEDIAE.exe
  C:\Windows\System\QkEDIAE.exe
  2⤵
  PID:12936
- C:\Windows\System\dxRJiXh.exe
  C:\Windows\System\dxRJiXh.exe
  2⤵
  PID:12956
- C:\Windows\System\idKIKQr.exe
  C:\Windows\System\idKIKQr.exe
  2⤵
  PID:12976
- C:\Windows\System\jdWkUQp.exe
  C:\Windows\System\jdWkUQp.exe
  2⤵
  PID:13004
- C:\Windows\System\vlUoqoz.exe
  C:\Windows\System\vlUoqoz.exe
  2⤵
  PID:13020
- C:\Windows\System\jVXSRAy.exe
  C:\Windows\System\jVXSRAy.exe
  2⤵
  PID:13044
- C:\Windows\System\ZLPLjtH.exe
  C:\Windows\System\ZLPLjtH.exe
  2⤵
  PID:13064
- C:\Windows\System\TMTeNBB.exe
  C:\Windows\System\TMTeNBB.exe
  2⤵
  PID:13084
- C:\Windows\System\tOosYKz.exe
  C:\Windows\System\tOosYKz.exe
  2⤵
  PID:13112
- C:\Windows\System\yIswmyf.exe
  C:\Windows\System\yIswmyf.exe
  2⤵
  PID:13132
- C:\Windows\System\vKzbLXk.exe
  C:\Windows\System\vKzbLXk.exe
  2⤵
  PID:13160
- C:\Windows\System\rjfRlOk.exe
  C:\Windows\System\rjfRlOk.exe
  2⤵
  PID:13184
- C:\Windows\System\DCwVtVG.exe
  C:\Windows\System\DCwVtVG.exe
  2⤵
  PID:13216
- C:\Windows\System\ZLpvCeP.exe
  C:\Windows\System\ZLpvCeP.exe
  2⤵
  PID:13248
- C:\Windows\System\BKrpAEW.exe
  C:\Windows\System\BKrpAEW.exe
  2⤵
  PID:13276
- C:\Windows\System\PgFmUmR.exe
  C:\Windows\System\PgFmUmR.exe
  2⤵
  PID:13308
- C:\Windows\System\HgvxUDx.exe
  C:\Windows\System\HgvxUDx.exe
  2⤵
  PID:12308
- C:\Windows\System\BVorhuA.exe
  C:\Windows\System\BVorhuA.exe
  2⤵
  PID:12232
- C:\Windows\System\tRMYHZG.exe
  C:\Windows\System\tRMYHZG.exe
  2⤵
  PID:12384
- C:\Windows\System\hYKIviU.exe
  C:\Windows\System\hYKIviU.exe
  2⤵
  PID:12436
- C:\Windows\System\cYiqXRQ.exe
  C:\Windows\System\cYiqXRQ.exe
  2⤵
  PID:12616
- C:\Windows\System\QCjkkgG.exe
  C:\Windows\System\QCjkkgG.exe
  2⤵
  PID:12568
- C:\Windows\System\DVvuwkr.exe
  C:\Windows\System\DVvuwkr.exe
  2⤵
  PID:12572
- C:\Windows\System\xyciJIn.exe
  C:\Windows\System\xyciJIn.exe
  2⤵
  PID:12648
- C:\Windows\System\QsSeamN.exe
  C:\Windows\System\QsSeamN.exe
  2⤵
  PID:12908
- C:\Windows\System\qJkQSHC.exe
  C:\Windows\System\qJkQSHC.exe
  2⤵
  PID:12964
- C:\Windows\System\iDnupzJ.exe
  C:\Windows\System\iDnupzJ.exe
  2⤵
  PID:12776
- C:\Windows\System\anUZjRh.exe
  C:\Windows\System\anUZjRh.exe
  2⤵
  PID:13076
- C:\Windows\System\RFdTqYH.exe
  C:\Windows\System\RFdTqYH.exe
  2⤵
  PID:13092
- C:\Windows\System\NLrIljq.exe
  C:\Windows\System\NLrIljq.exe
  2⤵
  PID:13212
- C:\Windows\System\SargyuA.exe
  C:\Windows\System\SargyuA.exe
  2⤵
  PID:13144
- C:\Windows\System\NRPgWrq.exe
  C:\Windows\System\NRPgWrq.exe
  2⤵
  PID:13268
- C:\Windows\System\eidpOeg.exe
  C:\Windows\System\eidpOeg.exe
  2⤵
  PID:13228
- C:\Windows\System\GxedCvD.exe
  C:\Windows\System\GxedCvD.exe
  2⤵
  PID:12508
- C:\Windows\System\IZHKSQs.exe
  C:\Windows\System\IZHKSQs.exe
  2⤵
  PID:12564
- C:\Windows\System\yeSgIKL.exe
  C:\Windows\System\yeSgIKL.exe
  2⤵
  PID:12880
- C:\Windows\System\kCXLjld.exe
  C:\Windows\System\kCXLjld.exe
  2⤵
  PID:12620
- C:\Windows\System\hZyJlxf.exe
  C:\Windows\System\hZyJlxf.exe
  2⤵
  PID:12924
- C:\Windows\System\tYbDFjv.exe
  C:\Windows\System\tYbDFjv.exe
  2⤵
  PID:13168
- C:\Windows\System\bhZpLwQ.exe
  C:\Windows\System\bhZpLwQ.exe
  2⤵
  PID:12168
- C:\Windows\System\NKDJckg.exe
  C:\Windows\System\NKDJckg.exe
  2⤵
  PID:13264
- C:\Windows\System\IgKKYxQ.exe
  C:\Windows\System\IgKKYxQ.exe
  2⤵
  PID:13056
- C:\Windows\System\TRwjUDp.exe
  C:\Windows\System\TRwjUDp.exe
  2⤵
  PID:13332
- C:\Windows\System\CzKMDuY.exe
  C:\Windows\System\CzKMDuY.exe
  2⤵
  PID:13352
- C:\Windows\System\PNEljiL.exe
  C:\Windows\System\PNEljiL.exe
  2⤵
  PID:13380
- C:\Windows\System\jIBORVK.exe
  C:\Windows\System\jIBORVK.exe
  2⤵
  PID:13408
- C:\Windows\System\mFjYKTf.exe
  C:\Windows\System\mFjYKTf.exe
  2⤵
  PID:13432
- C:\Windows\System\uZoSOTD.exe
  C:\Windows\System\uZoSOTD.exe
  2⤵
  PID:13456
- C:\Windows\System\GqRpjfd.exe
  C:\Windows\System\GqRpjfd.exe
  2⤵
  PID:13472
- C:\Windows\System\cwScfbA.exe
  C:\Windows\System\cwScfbA.exe
  2⤵
  PID:13496
- C:\Windows\System\mixOtMo.exe
  C:\Windows\System\mixOtMo.exe
  2⤵
  PID:13512
- C:\Windows\System\EdmbOva.exe
  C:\Windows\System\EdmbOva.exe
  2⤵
  PID:13540
- C:\Windows\System\hQAlMSi.exe
  C:\Windows\System\hQAlMSi.exe
  2⤵
  PID:13564
- C:\Windows\System\ozFgFRc.exe
  C:\Windows\System\ozFgFRc.exe
  2⤵
  PID:13596
- C:\Windows\System\naIHyfo.exe
  C:\Windows\System\naIHyfo.exe
  2⤵
  PID:13612
- C:\Windows\System\UYTvHix.exe
  C:\Windows\System\UYTvHix.exe
  2⤵
  PID:13640
- C:\Windows\System\HFCrERP.exe
  C:\Windows\System\HFCrERP.exe
  2⤵
  PID:13664
- C:\Windows\System\TqZKiGb.exe
  C:\Windows\System\TqZKiGb.exe
  2⤵
  PID:13700
- C:\Windows\System\NpAhFQH.exe
  C:\Windows\System\NpAhFQH.exe
  2⤵
  PID:13724
- C:\Windows\System\KKTxxut.exe
  C:\Windows\System\KKTxxut.exe
  2⤵
  PID:13756
- C:\Windows\System\XLjJSHU.exe
  C:\Windows\System\XLjJSHU.exe
  2⤵
  PID:13784
- C:\Windows\System\sCeTJYh.exe
  C:\Windows\System\sCeTJYh.exe
  2⤵
  PID:13808
- C:\Windows\System\ydUphCt.exe
  C:\Windows\System\ydUphCt.exe
  2⤵
  PID:13832
- C:\Windows\System\ekWmCYk.exe
  C:\Windows\System\ekWmCYk.exe
  2⤵
  PID:13848
- C:\Windows\System\GvkhNon.exe
  C:\Windows\System\GvkhNon.exe
  2⤵
  PID:13872
- C:\Windows\System\zNwqfHM.exe
  C:\Windows\System\zNwqfHM.exe
  2⤵
  PID:13896
- C:\Windows\System\FHtCavB.exe
  C:\Windows\System\FHtCavB.exe
  2⤵
  PID:13924
- C:\Windows\System\KZyyouG.exe
  C:\Windows\System\KZyyouG.exe
  2⤵
  PID:13952
- C:\Windows\System\LrSClJJ.exe
  C:\Windows\System\LrSClJJ.exe
  2⤵
  PID:13980
- C:\Windows\System\GbGTSCg.exe
  C:\Windows\System\GbGTSCg.exe
  2⤵
  PID:14012
- C:\Windows\System\NlUmLxq.exe
  C:\Windows\System\NlUmLxq.exe
  2⤵
  PID:14036
- C:\Windows\System\yNBtlGJ.exe
  C:\Windows\System\yNBtlGJ.exe
  2⤵
  PID:14052
- C:\Windows\System\aFFSPsl.exe
  C:\Windows\System\aFFSPsl.exe
  2⤵
  PID:14080
- C:\Windows\System\XikEKLP.exe
  C:\Windows\System\XikEKLP.exe
  2⤵
  PID:14108
- C:\Windows\System\OPuCyry.exe
  C:\Windows\System\OPuCyry.exe
  2⤵
  PID:14132
- C:\Windows\System\EiGedCZ.exe
  C:\Windows\System\EiGedCZ.exe
  2⤵
  PID:14164
- C:\Windows\System\XuvRUCC.exe
  C:\Windows\System\XuvRUCC.exe
  2⤵
  PID:14192
- C:\Windows\System\qmJHAWc.exe
  C:\Windows\System\qmJHAWc.exe
  2⤵
  PID:14216
- C:\Windows\System\ehnVIOI.exe
  C:\Windows\System\ehnVIOI.exe
  2⤵
  PID:14244
- C:\Windows\System\ujGPLIu.exe
  C:\Windows\System\ujGPLIu.exe
  2⤵
  PID:14264
- C:\Windows\System\piZgIZR.exe
  C:\Windows\System\piZgIZR.exe
  2⤵
  PID:14288
- C:\Windows\System\YMjgPSd.exe
  C:\Windows\System\YMjgPSd.exe
  2⤵
  PID:14316
- C:\Windows\System\LNZBRCD.exe
  C:\Windows\System\LNZBRCD.exe
  2⤵
  PID:11472
- C:\Windows\System\SCKebcD.exe
  C:\Windows\System\SCKebcD.exe
  2⤵
  PID:12528
- C:\Windows\System\pwDiCAQ.exe
  C:\Windows\System\pwDiCAQ.exe
  2⤵
  PID:12320
- C:\Windows\System\lUWXezL.exe
  C:\Windows\System\lUWXezL.exe
  2⤵
  PID:13344
- C:\Windows\System\WnWiVHO.exe
  C:\Windows\System\WnWiVHO.exe
  2⤵
  PID:13324
- C:\Windows\System\CjdbhqG.exe
  C:\Windows\System\CjdbhqG.exe
  2⤵
  PID:13468
- C:\Windows\System\JSSfXvD.exe
  C:\Windows\System\JSSfXvD.exe
  2⤵
  PID:13444
- C:\Windows\System\MdDulXY.exe
  C:\Windows\System\MdDulXY.exe
  2⤵
  PID:13576
- C:\Windows\System\VPwasmE.exe
  C:\Windows\System\VPwasmE.exe
  2⤵
  PID:13604
- C:\Windows\System\iJsXtpu.exe
  C:\Windows\System\iJsXtpu.exe
  2⤵
  PID:13656
- C:\Windows\System\Ildsyaw.exe
  C:\Windows\System\Ildsyaw.exe
  2⤵
  PID:13608
- C:\Windows\System\zhXGwwd.exe
  C:\Windows\System\zhXGwwd.exe
  2⤵
  PID:13712
- C:\Windows\System\XKcGQFf.exe
  C:\Windows\System\XKcGQFf.exe
  2⤵
  PID:13856
- C:\Windows\System\rhZfbHy.exe
  C:\Windows\System\rhZfbHy.exe
  2⤵
  PID:14096
- C:\Windows\System\XtsnnGb.exe
  C:\Windows\System\XtsnnGb.exe
  2⤵
  PID:13816
- C:\Windows\System\GVHzmUR.exe
  C:\Windows\System\GVHzmUR.exe
  2⤵
  PID:14232
- C:\Windows\System\IafoHOE.exe
  C:\Windows\System\IafoHOE.exe
  2⤵
  PID:14308
- C:\Windows\System\fVBnGcD.exe
  C:\Windows\System\fVBnGcD.exe
  2⤵
  PID:13288
- C:\Windows\System\UexhDAI.exe
  C:\Windows\System\UexhDAI.exe
  2⤵
  PID:14208
- C:\Windows\System\iDUAmYW.exe
  C:\Windows\System\iDUAmYW.exe
  2⤵
  PID:13240
- C:\Windows\System\gAhpBlf.exe
  C:\Windows\System\gAhpBlf.exe
  2⤵
  PID:13488
- C:\Windows\System\iQMOFAz.exe
  C:\Windows\System\iQMOFAz.exe
  2⤵
  PID:13804
- C:\Windows\System\TUuUQBQ.exe
  C:\Windows\System\TUuUQBQ.exe
  2⤵
  PID:14068
- C:\Windows\System\QUhOUYx.exe
  C:\Windows\System\QUhOUYx.exe
  2⤵
  PID:14028
- C:\Windows\System\leBRbQb.exe
  C:\Windows\System\leBRbQb.exe
  2⤵
  PID:14372
- C:\Windows\System\HglEkAq.exe
  C:\Windows\System\HglEkAq.exe
  2⤵
  PID:14404
- C:\Windows\System\MwwnYPX.exe
  C:\Windows\System\MwwnYPX.exe
  2⤵
  PID:14432
- C:\Windows\System\wEujVhK.exe
  C:\Windows\System\wEujVhK.exe
  2⤵
  PID:14464
- C:\Windows\System\tQAqwxt.exe
  C:\Windows\System\tQAqwxt.exe
  2⤵
  PID:14492
- C:\Windows\System\YZUuZmU.exe
  C:\Windows\System\YZUuZmU.exe
  2⤵
  PID:14524
- C:\Windows\System\AoznCrF.exe
  C:\Windows\System\AoznCrF.exe
  2⤵
  PID:14552
- C:\Windows\System\JeXyjno.exe
  C:\Windows\System\JeXyjno.exe
  2⤵
  PID:14584
- C:\Windows\System\RYbooQk.exe
  C:\Windows\System\RYbooQk.exe
  2⤵
  PID:14604
- C:\Windows\System\DXYqFtc.exe
  C:\Windows\System\DXYqFtc.exe
  2⤵
  PID:14640
- C:\Windows\System\xNoBHnP.exe
  C:\Windows\System\xNoBHnP.exe
  2⤵
  PID:14664
- C:\Windows\System\zmDiriV.exe
  C:\Windows\System\zmDiriV.exe
  2⤵
  PID:14688
- C:\Windows\System\hCCfPMU.exe
  C:\Windows\System\hCCfPMU.exe
  2⤵
  PID:14712
- C:\Windows\System\JzdJBnO.exe
  C:\Windows\System\JzdJBnO.exe
  2⤵
  PID:14744
- C:\Windows\System\wZCZuRT.exe
  C:\Windows\System\wZCZuRT.exe
  2⤵
  PID:14768
- C:\Windows\System\cQfhika.exe
  C:\Windows\System\cQfhika.exe
  2⤵
  PID:14792
- C:\Windows\System\XxsLPZC.exe
  C:\Windows\System\XxsLPZC.exe
  2⤵
  PID:14820
- C:\Windows\System\daHfwcL.exe
  C:\Windows\System\daHfwcL.exe
  2⤵
  PID:14840
- C:\Windows\System\gyRgxUM.exe
  C:\Windows\System\gyRgxUM.exe
  2⤵
  PID:14864
- C:\Windows\System\rjnlltL.exe
  C:\Windows\System\rjnlltL.exe
  2⤵
  PID:14880
- C:\Windows\System\gAjhOuz.exe
  C:\Windows\System\gAjhOuz.exe
  2⤵
  PID:14908
- C:\Windows\System\HtXcylw.exe
  C:\Windows\System\HtXcylw.exe
  2⤵
  PID:14932
- C:\Windows\System\SLWpBhu.exe
  C:\Windows\System\SLWpBhu.exe
  2⤵
  PID:14960
- C:\Windows\System\jQzSKsF.exe
  C:\Windows\System\jQzSKsF.exe
  2⤵
  PID:14988
- C:\Windows\System\tFmJJQy.exe
  C:\Windows\System\tFmJJQy.exe
  2⤵
  PID:15012
- C:\Windows\System\woiXtZS.exe
  C:\Windows\System\woiXtZS.exe
  2⤵
  PID:15044
- C:\Windows\System\iUcHOza.exe
  C:\Windows\System\iUcHOza.exe
  2⤵
  PID:15060
- C:\Windows\System\Gljtfqj.exe
  C:\Windows\System\Gljtfqj.exe
  2⤵
  PID:15080
- C:\Windows\System\luJcskD.exe
  C:\Windows\System\luJcskD.exe
  2⤵
  PID:15096
- C:\Windows\System\LipXgOS.exe
  C:\Windows\System\LipXgOS.exe
  2⤵
  PID:15116
- C:\Windows\System\AudmUBz.exe
  C:\Windows\System\AudmUBz.exe
  2⤵
  PID:15140
- C:\Windows\System\XIbsvYm.exe
  C:\Windows\System\XIbsvYm.exe
  2⤵
  PID:15168
- C:\Windows\System\LcTPBJI.exe
  C:\Windows\System\LcTPBJI.exe
  2⤵
  PID:15196
- C:\Windows\System\sYpzvyV.exe
  C:\Windows\System\sYpzvyV.exe
  2⤵
  PID:15228
- C:\Windows\System\yIxIPyp.exe
  C:\Windows\System\yIxIPyp.exe
  2⤵
  PID:15256
- C:\Windows\System\slQJryO.exe
  C:\Windows\System\slQJryO.exe
  2⤵
  PID:15284
- C:\Windows\System\eCCheNJ.exe
  C:\Windows\System\eCCheNJ.exe
  2⤵
  PID:15312
- C:\Windows\System\rHmSOZs.exe
  C:\Windows\System\rHmSOZs.exe
  2⤵
  PID:15340
- C:\Windows\System\JNeArnh.exe
  C:\Windows\System\JNeArnh.exe
  2⤵
  PID:13920
- C:\Windows\System\zFGAvCN.exe
  C:\Windows\System\zFGAvCN.exe
  2⤵
  PID:14328
- C:\Windows\System\HyIjaGR.exe
  C:\Windows\System\HyIjaGR.exe
  2⤵
  PID:14048
- C:\Windows\System\uHqKECZ.exe
  C:\Windows\System\uHqKECZ.exe
  2⤵
  PID:13532
- C:\Windows\System\ZuoWKPC.exe
  C:\Windows\System\ZuoWKPC.exe
  2⤵
  PID:13940
- C:\Windows\System\HAcPrxN.exe
  C:\Windows\System\HAcPrxN.exe
  2⤵
  PID:12872
- C:\Windows\System\EgERjHW.exe
  C:\Windows\System\EgERjHW.exe
  2⤵
  PID:14276
- C:\Windows\System\zIZykuk.exe
  C:\Windows\System\zIZykuk.exe
  2⤵
  PID:14364
- C:\Windows\System\CZPmqOh.exe
  C:\Windows\System\CZPmqOh.exe
  2⤵
  PID:14656
- C:\Windows\System\VMxNqmU.exe
  C:\Windows\System\VMxNqmU.exe
  2⤵
  PID:14704
- C:\Windows\System\qgXLBIv.exe
  C:\Windows\System\qgXLBIv.exe
  2⤵
  PID:14780
- C:\Windows\System\sDAgQNJ.exe
  C:\Windows\System\sDAgQNJ.exe
  2⤵
  PID:14428
- C:\Windows\System\rzutQbr.exe
  C:\Windows\System\rzutQbr.exe
  2⤵
  PID:14476
- C:\Windows\System\vYphWUh.exe
  C:\Windows\System\vYphWUh.exe
  2⤵
  PID:14916
- C:\Windows\System\HAuzstc.exe
  C:\Windows\System\HAuzstc.exe
  2⤵
  PID:14596
- C:\Windows\System\WOlJDhX.exe
  C:\Windows\System\WOlJDhX.exe
  2⤵
  PID:15076
- C:\Windows\System\GNpVLVX.exe
  C:\Windows\System\GNpVLVX.exe
  2⤵
  PID:15112
- C:\Windows\System\IrUlYxx.exe
  C:\Windows\System\IrUlYxx.exe
  2⤵
  PID:15184
- C:\Windows\System\UCWEYPn.exe
  C:\Windows\System\UCWEYPn.exe
  2⤵
  PID:15216
- C:\Windows\System\HvbZWHJ.exe
  C:\Windows\System\HvbZWHJ.exe
  2⤵
  PID:14816
- C:\Windows\System\ngTWUMW.exe
  C:\Windows\System\ngTWUMW.exe
  2⤵
  PID:15324
- C:\Windows\System\MxYtOWE.exe
  C:\Windows\System\MxYtOWE.exe
  2⤵
  PID:15204
- C:\Windows\System\PDigHXO.exe
  C:\Windows\System\PDigHXO.exe
  2⤵
  PID:14228
- C:\Windows\System\njNICjy.exe
  C:\Windows\System\njNICjy.exe
  2⤵
  PID:15092
- C:\Windows\System\NnXUwFM.exe
  C:\Windows\System\NnXUwFM.exe
  2⤵
  PID:15364
- C:\Windows\System\kytdaEJ.exe
  C:\Windows\System\kytdaEJ.exe
  2⤵
  PID:15388
- C:\Windows\System\wQJEtYp.exe
  C:\Windows\System\wQJEtYp.exe
  2⤵
  PID:15416
- C:\Windows\System\KGoNWjK.exe
  C:\Windows\System\KGoNWjK.exe
  2⤵
  PID:15444
- C:\Windows\System\cxhDlAY.exe
  C:\Windows\System\cxhDlAY.exe
  2⤵
  PID:15464
- C:\Windows\System\DiOdZAZ.exe
  C:\Windows\System\DiOdZAZ.exe
  2⤵
  PID:15480
- C:\Windows\System\SBmsYwh.exe
  C:\Windows\System\SBmsYwh.exe
  2⤵
  PID:15496
- C:\Windows\System\fVLDIUa.exe
  C:\Windows\System\fVLDIUa.exe
  2⤵
  PID:15520
- C:\Windows\System\uzHKVOW.exe
  C:\Windows\System\uzHKVOW.exe
  2⤵
  PID:15536
- C:\Windows\System\KXtIdTD.exe
  C:\Windows\System\KXtIdTD.exe
  2⤵
  PID:15564
- C:\Windows\System\pzjjiHD.exe
  C:\Windows\System\pzjjiHD.exe
  2⤵
  PID:15592
- C:\Windows\System\JjmIhzZ.exe
  C:\Windows\System\JjmIhzZ.exe
  2⤵
  PID:15620
- C:\Windows\System\pJlFXpm.exe
  C:\Windows\System\pJlFXpm.exe
  2⤵
  PID:15652
- C:\Windows\System\UtkindT.exe
  C:\Windows\System\UtkindT.exe
  2⤵
  PID:15688
- C:\Windows\System\iUoaunR.exe
  C:\Windows\System\iUoaunR.exe
  2⤵
  PID:15712
- C:\Windows\System\fSyxFbS.exe
  C:\Windows\System\fSyxFbS.exe
  2⤵
  PID:15752
- C:\Windows\System\qJAhjkr.exe
  C:\Windows\System\qJAhjkr.exe
  2⤵
  PID:15776
- C:\Windows\System\FJxrcGj.exe
  C:\Windows\System\FJxrcGj.exe
  2⤵
  PID:15800
- C:\Windows\System\OqOHAcl.exe
  C:\Windows\System\OqOHAcl.exe
  2⤵
  PID:15840
- C:\Windows\System\oYXMXDb.exe
  C:\Windows\System\oYXMXDb.exe
  2⤵
  PID:15860
- C:\Windows\System\IEkjFfO.exe
  C:\Windows\System\IEkjFfO.exe
  2⤵
  PID:15888
- C:\Windows\System\zFmxBkg.exe
  C:\Windows\System\zFmxBkg.exe
  2⤵
  PID:15912
- C:\Windows\System\aWLkouj.exe
  C:\Windows\System\aWLkouj.exe
  2⤵
  PID:15940
- C:\Windows\System\gymcpEZ.exe
  C:\Windows\System\gymcpEZ.exe
  2⤵
  PID:15968
- C:\Windows\System\nbHzYed.exe
  C:\Windows\System\nbHzYed.exe
  2⤵
  PID:15992
- C:\Windows\System\DejSOWg.exe
  C:\Windows\System\DejSOWg.exe
  2⤵
  PID:16028
- C:\Windows\System\asaKgXH.exe
  C:\Windows\System\asaKgXH.exe
  2⤵
  PID:16044
- C:\Windows\System\WlyfXwb.exe
  C:\Windows\System\WlyfXwb.exe
  2⤵
  PID:16064
- C:\Windows\System\hjtITNo.exe
  C:\Windows\System\hjtITNo.exe
  2⤵
  PID:16092
- C:\Windows\System\vECtWNK.exe
  C:\Windows\System\vECtWNK.exe
  2⤵
  PID:16124
- C:\Windows\System\fCnPeBa.exe
  C:\Windows\System\fCnPeBa.exe
  2⤵
  PID:16164
- C:\Windows\System\woHWHMr.exe
  C:\Windows\System\woHWHMr.exe
  2⤵
  PID:16180
- C:\Windows\System\nbbbOVl.exe
  C:\Windows\System\nbbbOVl.exe
  2⤵
  PID:16208
- C:\Windows\System\aUCzNvP.exe
  C:\Windows\System\aUCzNvP.exe
  2⤵
  PID:15460
- C:\Windows\System\cedNjBa.exe
  C:\Windows\System\cedNjBa.exe
  2⤵
  PID:15124
- C:\Windows\System\zkwrGjK.exe
  C:\Windows\System\zkwrGjK.exe
  2⤵
  PID:15380
- C:\Windows\System\EMUmnIp.exe
  C:\Windows\System\EMUmnIp.exe
  2⤵
  PID:14896
- C:\Windows\System\oUwMIUT.exe
  C:\Windows\System\oUwMIUT.exe
  2⤵
  PID:15512
- C:\Windows\System\uqeUsEk.exe
  C:\Windows\System\uqeUsEk.exe
  2⤵
  PID:15644
- C:\Windows\System\dUfKcIx.exe
  C:\Windows\System\dUfKcIx.exe
  2⤵
  PID:15700
- C:\Windows\System\qIBvBra.exe
  C:\Windows\System\qIBvBra.exe
  2⤵
  PID:15760
- C:\Windows\System\NVGXPWH.exe
  C:\Windows\System\NVGXPWH.exe
  2⤵
  PID:16072
- C:\Windows\System\jPIkqAa.exe
  C:\Windows\System\jPIkqAa.exe
  2⤵
  PID:16116
- C:\Windows\System\qbDbCkR.exe
  C:\Windows\System\qbDbCkR.exe
  2⤵
  PID:15848
- C:\Windows\System\Qcheaja.exe
  C:\Windows\System\Qcheaja.exe
  2⤵
  PID:16156
- C:\Windows\System\CcYGcWL.exe
  C:\Windows\System\CcYGcWL.exe
  2⤵
  PID:15560
- C:\Windows\System\xIaQfMB.exe
  C:\Windows\System\xIaQfMB.exe
  2⤵
  PID:15952
- C:\Windows\System\hSreXJj.exe
  C:\Windows\System\hSreXJj.exe
  2⤵
  PID:15988
- C:\Windows\System\ccGvdoz.exe
  C:\Windows\System\ccGvdoz.exe
  2⤵
  PID:16288
- C:\Windows\System\FuczHjj.exe
  C:\Windows\System\FuczHjj.exe
  2⤵
  PID:15900
- C:\Windows\System\IZhJyJe.exe
  C:\Windows\System\IZhJyJe.exe
  2⤵
  PID:16220
- C:\Windows\System\KeIZlKS.exe
  C:\Windows\System\KeIZlKS.exe
  2⤵
  PID:13820
- C:\Windows\System\hNPSLeo.exe
  C:\Windows\System\hNPSLeo.exe
  2⤵
  PID:16224
- C:\Windows\System\XIayXDg.exe
  C:\Windows\System\XIayXDg.exe
  2⤵
  PID:15108
- C:\Windows\System\OJQpwJP.exe
  C:\Windows\System\OJQpwJP.exe
  2⤵
  PID:15608
- C:\Windows\System\SAYneOP.exe
  C:\Windows\System\SAYneOP.exe
  2⤵
  PID:15032
- C:\Windows\System\lpYCyLm.exe
  C:\Windows\System\lpYCyLm.exe
  2⤵
  PID:15832
- C:\Windows\System\Ssurqzf.exe
  C:\Windows\System\Ssurqzf.exe
  2⤵
  PID:16104
- C:\Windows\System\qUSikeD.exe
  C:\Windows\System\qUSikeD.exe
  2⤵
  PID:15556
- C:\Windows\System\ywRMuPG.exe
  C:\Windows\System\ywRMuPG.exe
  2⤵
  PID:15796
- C:\Windows\System\wpUbmYl.exe
  C:\Windows\System\wpUbmYl.exe
  2⤵
  PID:15896
- C:\Windows\System\wAewdOf.exe
  C:\Windows\System\wAewdOf.exe
  2⤵
  PID:14700
- C:\Windows\System\NIYeNmu.exe
  C:\Windows\System\NIYeNmu.exe
  2⤵
  PID:14532
- C:\Windows\System\FDQAehx.exe
  C:\Windows\System\FDQAehx.exe
  2⤵
  PID:15348
- C:\Windows\System\VSdWOcU.exe
  C:\Windows\System\VSdWOcU.exe
  2⤵
  PID:16404
- C:\Windows\System\ncAwlMD.exe
  C:\Windows\System\ncAwlMD.exe
  2⤵
  PID:16428
- C:\Windows\System\YeTFreH.exe
  C:\Windows\System\YeTFreH.exe
  2⤵
  PID:16460
- C:\Windows\System\ZYvBiuw.exe
  C:\Windows\System\ZYvBiuw.exe
  2⤵
  PID:16484
- C:\Windows\System\IxuQQRs.exe
  C:\Windows\System\IxuQQRs.exe
  2⤵
  PID:16500
- C:\Windows\System\vwTFrJR.exe
  C:\Windows\System\vwTFrJR.exe
  2⤵
  PID:16536
- C:\Windows\System\bEwRJYe.exe
  C:\Windows\System\bEwRJYe.exe
  2⤵
  PID:16564
- C:\Windows\System\PejDBRP.exe
  C:\Windows\System\PejDBRP.exe
  2⤵
  PID:16592
- C:\Windows\System\SzIDrTW.exe
  C:\Windows\System\SzIDrTW.exe
  2⤵
  PID:16612
- C:\Windows\System\NuOesgE.exe
  C:\Windows\System\NuOesgE.exe
  2⤵
  PID:16644
- C:\Windows\System\GfVgsNr.exe
  C:\Windows\System\GfVgsNr.exe
  2⤵
  PID:16668
- C:\Windows\System\VuMOJWg.exe
  C:\Windows\System\VuMOJWg.exe
  2⤵
  PID:16688
- C:\Windows\System\njyNgPz.exe
  C:\Windows\System\njyNgPz.exe
  2⤵
  PID:16720
- C:\Windows\System\CmfXvHh.exe
  C:\Windows\System\CmfXvHh.exe
  2⤵
  PID:16748
- C:\Windows\System\DEnBGaV.exe
  C:\Windows\System\DEnBGaV.exe
  2⤵
  PID:16780
- C:\Windows\System\yTouZJT.exe
  C:\Windows\System\yTouZJT.exe
  2⤵
  PID:16800
- C:\Windows\System\BTkPMGv.exe
  C:\Windows\System\BTkPMGv.exe
  2⤵
  PID:16820
- C:\Windows\System\ksxLwpc.exe
  C:\Windows\System\ksxLwpc.exe
  2⤵
  PID:17068
- C:\Windows\System\zImRLtv.exe
  C:\Windows\System\zImRLtv.exe
  2⤵
  PID:17112
- C:\Windows\System\zWaiNYo.exe
  C:\Windows\System\zWaiNYo.exe
  2⤵
  PID:17140
- C:\Windows\System\MNSWhSa.exe
  C:\Windows\System\MNSWhSa.exe
  2⤵
  PID:17164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CCQUcia.exe

Filesize
1.6MB

MD5
ef9cd6c8678db0bc4e377b294db19577

SHA1
bc1b0179a06ba966d7a972c6cc6700733c1eab47

SHA256
2e82034e2aa8cb9ada9f895dce328b192248f1af82f4a86f09e56d7870232481

SHA512
796892603fedc0be10829404e66932f580a8d2369dc52ff9567b78e8f47342326ec0e9e2a1f2ffdd5876ab00f2a34780dce266861fad44ea7565019a5078e4d6

Download Submit
C:\Windows\System\CIuQeNt.exe

Filesize
1.6MB

MD5
05ba7d1adbed08c9e891071616625f70

SHA1
3ec5f3c50ef3fd9ef61d8e6683d614159fe66363

SHA256
08ac54acd164eb6b2def782773834a750bb5fd0637d4857db430b2373bb5a587

SHA512
62848624e67f5480dc2b7521d0da99d87fa8653340867db8cf9156727746f1d0938b4e6130b6bb34dfff34b55f972b402b437799ae7e9b4d006f86c29ce0da46

Download Submit
C:\Windows\System\CJpntSo.exe

Filesize
1.6MB

MD5
288b6033dc435203044f944e4b3c45db

SHA1
79f01821ec0f8dc453b6c8d07226572ba57208ac

SHA256
9f4bfaa5a4647e2b32791141430957067127a50c158a0bf0b99b2300ed9bd236

SHA512
3d527b47de27dabf298da5c8405f80c784e89600ca78754c7e017f78207a49a049f48bdf3115d195fc6d81ea387c86ce88ef8bc28f21331c28891823310a208b

Download Submit
C:\Windows\System\DJSAkxw.exe

Filesize
1.6MB

MD5
9eb820801d01e4fd69be21cc63159e43

SHA1
65e9a6cce5e73c62acfd2a7b4dfaf47797fa4109

SHA256
03e6cb2966865473ec01123ebf41bbf69f1d9eb72e29a9e96291b5953855a79a

SHA512
e60b92a9e796dc199e6b94827fecafa9e0867b3e98fbeea0e0ea3e79fa6dd8ea78101271b760eee7d0dcb66cecae3a2e3a820283717e97f891646de4dbb55d7a

Download Submit
C:\Windows\System\FKIXkmW.exe

Filesize
1.6MB

MD5
e46206e6c8eca6443fda1d316abfd2e0

SHA1
c70ab7e213aec61021d8772e6252f825764df9fc

SHA256
7d5be494e52221c0268584a61186ae15012e5dfaa6c4b067e763d614e0575e51

SHA512
6d6e98bcdc6921845bb47ae46b86279952cbcc9894d5b9ad4406f3eb2f7d6f7b6671d59e376c38b9f886df9026154a754dd8e63760127e8a1021bf3887659e42

Download Submit
C:\Windows\System\HmvcuqD.exe

Filesize
1.6MB

MD5
15133522fff717f3ae92affe80f28fd0

SHA1
cd68b19353d4bca7c92108276142202613de2d65

SHA256
0e5e258e8db7569ab9a331cd6c1196f6df9ced322e3d636498596f7b0751b555

SHA512
f0c413dc4282ea75d3af2d0c7a9acff8ddcb4e6d17304b3e7c7ae3f835b6910e25291c5e0e6567e75fbc80d905e1a2a7be9cf9053851b301f78771cdb19679d5

Download Submit
C:\Windows\System\IcbYhHq.exe

Filesize
1.6MB

MD5
fc5c8899ab201cc408d50e33d5de0e32

SHA1
85a4b9352a9ef6fff19f0df081aeca401308acf0

SHA256
fd3aa21aeba182d2f626f2e3d8ce111ec6ef94ebf9e0657d3821f0c0d6a60270

SHA512
340a6d318a27951fb7bda6f0ac8606a3163f2a855c83c658f9e1660916ebe82de82afd8f0ab61d2416e8889caf75f1cd09f3401679891c23de438d5966fe7673

Download Submit
C:\Windows\System\KaLIExT.exe

Filesize
1.6MB

MD5
2c4dcf41b7d2bc6a6080e6555577d97d

SHA1
aacd5efe8133e412bca66c354f898a19b7004cb7

SHA256
b10013ac4682aecce9bfb26c97c298ba18bf524cd63247f67a2624476c1d13b6

SHA512
6b3ea6291e45384b60d12ed887b50e2f6b2e47e5732a7c29b5cfd8dba5bb0ca77d4d9eff71b5967029605fb6b0202a6dd4cd7b7993b30935b5039fdcc80d42a6

Download Submit
C:\Windows\System\KbqkItA.exe

Filesize
1.6MB

MD5
00c3c77265fcf65192bba5aedff759c6

SHA1
24c34c811091960bed666642e05c6b86e73a9091

SHA256
c0461e1832a00fa5b065def00786d05adca9325a8fec426336b67311823a6c27

SHA512
f106655d029a84443b700b3f65fb7a071dcac214bffbcfd0b7812442f0228683ecb1bb020dfefba90552855c8da43312c488e5c1c1fb1ef655a9dbb5afc3b2d0

Download Submit
C:\Windows\System\LUWloDq.exe

Filesize
1.6MB

MD5
bd3099eb24aa47d66ceb533fb8badc0b

SHA1
4b38474e3cc2ffc5574552cb13a9ce26518e7b1b

SHA256
50149db578f85cb16fcf922a9234d30c454931d2fb811ce28323ad67fa9fc54a

SHA512
9e5894aac1e4820edb196100918f0b4ae93d8145833021f1782f53b1a28204e261c2c778758ef7585f416cc404de8fc401cf40e7756554727db0ae7045f3f089

Download Submit
C:\Windows\System\LxSDRiT.exe

Filesize
1.6MB

MD5
fd983754355e3149db4db43ca5d91e9f

SHA1
a8b34542d8773763ee67e295bb1a3c2d4ff73a37

SHA256
9e4ceea320dfdede45ceb42d824c9ccb10b608464c1030f5e7ae770d5e6fe313

SHA512
d015a4fae2ff187d443db81320f06a5d600eb506cfe3e190e9b429b12cac38b94a26872049dfbe7c99d74100743ee341d1ee7c267fc5bd9724e85f6df0c995d8

Download Submit
C:\Windows\System\LzIemLF.exe

Filesize
1.6MB

MD5
014c11558585ba42fd06c671b4c4809f

SHA1
deedf57547f14de6565b947f1771d0c75bd67b9e

SHA256
41a68ab010dc63e2bdab70f02667e2def9d02091d76613e02f25170c6b26627d

SHA512
8d79eeface97c16be7521e9debd3dd9615daaf82ebf6cd311fe56e92306d20be567f93c96c1258c8d083a10c3641206fd2a3d1f8c6cf2be6894835d12a92721e

Download Submit
C:\Windows\System\MmVUZeN.exe

Filesize
1.6MB

MD5
1d2af02210d3c92135011f2b549d4011

SHA1
7589c02a7fbaa417204f5e28ac27f925fa84d748

SHA256
c544fdaf20d423f3f9e478a0d364cf1ee72d0ed7f91648a00e593e55cc94b6c0

SHA512
009dddfd6c6aa742c75cf7d2c8a8c221bf4ec64d1118e01b5075c2cbc984e7f787d9608ce91303376722ec22d64eb377263553746e0fe28621da2dd634acc8e8

Download Submit
C:\Windows\System\NWDXTvt.exe

Filesize
1.6MB

MD5
a3089cf19b76ae248370801d9333f18f

SHA1
75302128ab83e1524b1b9a6e0c5529c3ddb93cbb

SHA256
996368687f2f401a288edec9de3a4b899db956a28126c11d149cff78e0861829

SHA512
a5e63b5e292b88ca44c48f65c4f8912960fcade9b760c878a8b3fc3b2892aaf15605b68168f7de91b40f9f6da8248f23571c73e20f79b856e588334368d629e2

Download Submit
C:\Windows\System\OanGmcz.exe

Filesize
1.6MB

MD5
129338353447fb0cc144f1570cac5a73

SHA1
de217c4d04261bf3963c1b6b0c2e92e087bcf98b

SHA256
5644c34fc79edc00a17d5101a612862d621bc7d7604ea472ea9aa0e73635b938

SHA512
000468b752c735225ca71fce7e4a334a8e0a62f738da7a1b9cd3e690ceffadea1172faacfd20ffb7d102731faec89fc0f4e0f57a522c52cca20f7fd8bcd288b3

Download Submit
C:\Windows\System\OsCwElm.exe

Filesize
1.6MB

MD5
27efe2b513ac44e18d1bbebde5ed044b

SHA1
6f11ad5cb96a9c9cf7ae1f6f96b30b2a65d67e0d

SHA256
7c1e270a0faac05ddb1ceb719aacbfec136455c79ca4004a43a74566298f085a

SHA512
08a1566c4e6a9b74583ae1adcfbfef9914a3921c51a1209a4a870ba08b4b744b68598af8b3b73f1e6d70da5d8cd000907cada44bab41ddfff040e01b19f3024e

Download Submit
C:\Windows\System\OuQKoVK.exe

Filesize
1.6MB

MD5
748bbcfce12b9f09d13485931a7dabb4

SHA1
07592ef5fa206bb49c6c7c98f44d25e044c8fb36

SHA256
726864675b512bbd78216d0168a9307b4cc64fdb7316c31ad45172c0dbead06b

SHA512
240d666eeb22441b68f417ceb17c3d4aac448e4be7f31156d1605dd784c59e9dcedfd151834a97411218c5f215bc6918f93ea6cc2a3b8f915b72e78db905f565

Download Submit
C:\Windows\System\TczGPRV.exe

Filesize
1.6MB

MD5
31abf2d0ee14a2bfb97d12429656b72a

SHA1
d0ed68328bcaa7ca8d93840071d03bee43a41e90

SHA256
3c4a78d4d243b898175ee1c0ca5ce261ac782465590b63976d71ebbf62470093

SHA512
41ae11f1778c4b5987971f53580938e9d8eb14eeaba87d72939adee930a055b84e3a5cfed8158cbc7a3a6cc4c9ae69e10a14cdadf1d689f8839a0fa6326d680b

Download Submit
C:\Windows\System\TdjUrUW.exe

Filesize
1.6MB

MD5
2f2b80fae95c5776b79e8fe660ca6208

SHA1
dd2ea683b47648aff16fdb031f36dcb7288cf3e1

SHA256
b7de4d18f177bbe086455f3480d82a73737c5661fa8d4f90f80a8e1b8612b295

SHA512
b11ace0b79e83cdf6937825c26b85fdb4a026f210987329285d0542cf6428a2d67bfb4b9bcc7f830984ee97a834995c390a3609f4be10675163cf4121b762bf2

Download Submit
C:\Windows\System\UEcuOKY.exe

Filesize
1.6MB

MD5
195a107d9281aba77e210ec8cb3b9089

SHA1
20126ac4d60b6e0904e21e9f122cdb330246c0cb

SHA256
144785077aaa97414858a97c36a0cc6a8aeda63ba12d2decbef7a9d51703cbfd

SHA512
4f90c86bda0905c135a7ab0db2ce46b72ee3fcc0ec74d131a1bd58fb285377eb39e0af943ea936e7fb74a99ff0168ff738d617d28202ad03a6644b364c942627

Download Submit
C:\Windows\System\VgNEeZf.exe

Filesize
1.6MB

MD5
46869e443e2537694ccdbda9cf4a1fc4

SHA1
64744ae79aeeee64ffb7bb1cec234dc30e769dc5

SHA256
7f7253281256f05597c9ba94d620491721b9f3bd46ab8a63efd6d24664bdfbf9

SHA512
151e15d8b80517268cd2caae916b1df8ea48f94b69cd24f4eca552cbd6004de524bf9545c63c8d89e2c48d885aef57c367aa0c88eb18d5e56d0a4ecfde3803ab

Download Submit
C:\Windows\System\WiQFAsz.exe

Filesize
1.6MB

MD5
b38b185414bb94d644d738e26e305665

SHA1
d3617eb1310f0d537344123e9a84df9fa450d67c

SHA256
3c330300efc437a5ecde8721ca2b8caff722e54c57165829db671eca09e1d9e2

SHA512
34a884c1ea50bef4c69434fbfb8e5b1e20a0ad900356e08c1b50e15653f38191968a74d6e65e6b57280528df8020286e4a55b17c30a3aaf44caf0b9331592e0b

Download Submit
C:\Windows\System\cJJpghH.exe

Filesize
1.6MB

MD5
d00a237825e56fec8bc78ee7fc32e853

SHA1
a0059677b091e7a93ba7e2526f5cc9eb64c7e098

SHA256
42d9c6b86bcc1188de142e287505064306d28acc2e9c87f8a705840fa9bc5424

SHA512
9f9c272213938e84b93fc6cf953c46fedf3505a373c0d8f23958cfb1ad818390f5cde56a38c70830a3d70511fefb5d7506b31df203ac3fa3d5415dd29cdf2f20

Download Submit
C:\Windows\System\dofIzYO.exe

Filesize
1.6MB

MD5
073a015a9082ecde40fd1f2d079faa3e

SHA1
88bcb23e889aea15171e5bcf1a2e0986c1f74047

SHA256
0d75b0a73b987131ad2dc00ebcd2cf33fe59c38ec7c4f2ba324ceb722919c65b

SHA512
9650c8db583cf7c9f6ca6533ecba3ce9644b1055bedeb387e95e32113834ad5a0fd76638a9dad75f798f4826afac8e6bc01c09a8eadc6afe369324f7db737fe7

Download Submit
C:\Windows\System\dutbLAR.exe

Filesize
1.6MB

MD5
ffe03451ae905ec443b0a5b5ae77506c

SHA1
c66ba97ca45fe074def625ad5bed96544d1b06b2

SHA256
13fd986ed71fa7544a86ac3c3c48d5c1af67772d2435803a7ffbaabf28a10f81

SHA512
e294c290b5a9e8c4dc608067a51c50d589b684d67e78985002ae8dd5e2a1fe72f62867f4f4ef4a7b86737bcd34ab04713b49f6a02e8b5894609d3905780e7a54

Download Submit
C:\Windows\System\gryTtLE.exe

Filesize
1.6MB

MD5
6f826762ba1ec41ea1a178e3008cefed

SHA1
5a33ded48af943fc53c6f8880d658ee5d5fafa3b

SHA256
e436188b8ebb324df42c2cafaf5ce6907b400e3d9855980554f938c374b0c3a8

SHA512
fb39018ac732a8f9921884c7d53a634433f607f9de8cfb0f6621e6d96fa900f907c975e3358c6f8e19e56c9a09565be9040be7b4f74d21b179c03443b3ec3dbb

Download Submit
C:\Windows\System\gyHMlQN.exe

Filesize
1.6MB

MD5
dcacb521988ecc12aba298782921faf2

SHA1
49a96e75d32eeee88e2e53c91b758870259b3200

SHA256
3a4905ed8e2d424a44e44687ccda8427a3b68b0fac07682211613c458d5685a1

SHA512
39f699cf8f3f5d28ecb3e99e13ae22633d861adf409149a160142f5a1817b4f1be8ae4cca42ce588ea9faa6ace83c4d6b63a58c35ee4ed4ed138b7af6d4063c4

Download Submit
C:\Windows\System\iOzESAC.exe

Filesize
1.6MB

MD5
6a2c3771cc20824c9d289d2d14aa7060

SHA1
8f88b04fae5d9418632524c82717c38f8f6f751b

SHA256
66812dd62d2e0843b3acf3505d42de1d0453a0c47bf92ee7746c269100e65405

SHA512
8980ba44eb0d6aad13393136a254b214a1fdadc9df1c7df86ac43ce6df8a2270ced8a29404166fec89df632589f3e4290557b909e947d66ed7b4a1a4a616f39f

Download Submit
C:\Windows\System\igggqfp.exe

Filesize
1.6MB

MD5
30b5cc9fec2f76dcbfce08930f55ab1c

SHA1
6cd539914564db75551a649aba49f4926342727f

SHA256
3d04d8c47eb4d0aa9052b49f3fdd494127f0832ef0b76b88b15a38b113e1a701

SHA512
92cc07667febf3951d4cb4fd035f3d8b9be8c2daf25005c86b8d8e9d66942c106f28813f135e6e1511640575d39b068be49722ffb871b50a96545e608521b5b1

Download Submit
C:\Windows\System\jGBhdBC.exe

Filesize
1.6MB

MD5
fbc9285e51c1b6fbea1c42a20039837a

SHA1
a1cf091447c9bd161379479705e25a5f17374026

SHA256
f5c77a3c7c7227d5083b50cfba53ca61fd856f4a9468e6b64761c281ebb40abe

SHA512
9eec9489128a5dd2b074226a34bd3850735745638fd5cacdedd0c5c572f7ec81e1ddcb9ccec37fadad1bc7e1e6372c8b59be1bf6d7c1f26e7e6e0960b00f3e50

Download Submit
C:\Windows\System\lYTVtbj.exe

Filesize
1.6MB

MD5
673f9250e98a4f42469981860e85874c

SHA1
8a07f4f35370892732876d99a365750747eb2cbe

SHA256
74419696db322740f18e3cee05c3e6a4b7cc46a07212522781f5c0bebd026833

SHA512
7509cd8e01f5b80406de79f298a12034307d6267033a3bec6e448c58ce9c2431d5455502c70d57c30d4d06de87597e5f8986073488beb0ddfa6b9df9b72cb7ca

Download Submit
C:\Windows\System\qZTcEVn.exe

Filesize
1.6MB

MD5
204e4516d13dc6e072af1cfef35f653a

SHA1
d18715e7454ca789d1ccc9fc3800147db96e8c01

SHA256
40ba39688bcd70f52b4e19b990f6682f8aaed83e728fdb97bb5ba426a34bf72f

SHA512
5840530c34d1170f129d3878271bd119bac137521db056d2afd6c489b2646800204042a6309840ec69b749a04318c37f3362c4cf5e42d5535d167701392508bc

Download Submit
C:\Windows\System\sCnBsNR.exe

Filesize
1.6MB

MD5
46ca92898efcfcc6a5c0ffea3d9b61dc

SHA1
04c76c0e735c370ef8758b51947db12296b6651f

SHA256
b1f1bb1ff50df90e2e45a2aeb7be7a6d0252c0bc9dcd3b22914cf4fbc3a1e07c

SHA512
7a347d67324fc365c7618cff8a38de27322b56248aa50a8a3322d8651024a1dd7f2a8b7a62c79c88f05d7c24d780842b5fe4a190528c8fa081d9eac30faabf35

Download Submit
C:\Windows\System\tAPSFKM.exe

Filesize
1.6MB

MD5
ea98448e1c0dd8cf011fd411335024a5

SHA1
1ffb69a4ebf0d5f44585ad088cea44284792d637

SHA256
a989ebdbb4d2b40d079fb87b9b0f897c25429d1eceb87dd2e836d44788eb72a4

SHA512
305f8e6e142c62174c777e3ac6a71aa58cc35642fdda4b27051851e32c5721fb659c93e7976f6c39b6e13ae3a12ef9b255c0078f604e71d9bbbabc7e99be8749

Download Submit
C:\Windows\System\torTKUB.exe

Filesize
1.6MB

MD5
b7061ec9f4f1ca4635e5c016d90e28b7

SHA1
1c7d625399e057c2ef5eedbbf8778cbfc9208766

SHA256
1ba4c77893a19c0ceccdc164aab5630e14e804b41deab18e8ed94aa836568e46

SHA512
f9b63712833bf80fb1df82ba1d102f207e4b5a3f5c50bf0ab3f07280ee3a8f9a3be310b57672a7080268ff5502fa50dbf7b5bb714687a242e726bd2bd2cd5faf

Download Submit
C:\Windows\System\uiwvAmX.exe

Filesize
1.6MB

MD5
24f959b054a3e34f121f0f0dbdb16d77

SHA1
99865d524bd8b874de3bf57a8a9cd859e4a54674

SHA256
3af5f74c0f1a1ec745caa096917b1e818d28a168939a627e2b63da2d22757754

SHA512
ee9a575abc594028f0fed4210010e1285ef2c4d18b4415f5418191481b6afef60d54db458022c8fbb31ff415a83c5206dc1a547b4a34dd020e2197e579c0bcf8

Download Submit
C:\Windows\System\vqwgjCx.exe

Filesize
1.6MB

MD5
712fca282a9f3e3dff662cc5fc980521

SHA1
9f0c7bf5918a222a36168f404f8ebda8527595e1

SHA256
0d91de746c0b537eb487237bbde13df894a34af0242ffdbc846f7cebe11a6b3e

SHA512
f27b7eef3a49672b32c7f2678922086c76fa989fa467fff834ab7e63d1199f01a35b7d8ae23f6cbe79bd9d7830a11721adb7192b40dd854fcf9c84b6b4b33373

Download Submit
C:\Windows\System\zBlWzNz.exe

Filesize
1.6MB

MD5
da9bd50b40d0362aaf2e556ea613549e

SHA1
c2eeecf95d06f8f822069cae0316a2edbfecacca

SHA256
67dadbdd9348ef4de66c1a49bc4c9b9fcb7dc546d037bf70cdcb3e6df8064a66

SHA512
14950a778bfe1d1222ebb80e503fcaa6fc6ff240191219f1a6a9a30c3a60f6bfab5e8cab74b0596b0e49896a5f3c19a59339f138dc4c823e3f764d60f494d515

Download Submit
memory/1996-0-0x000001DA6F540000-0x000001DA6F550000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads