xmrig | 2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec

Analysis

max time kernel
97s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
Size

1.2MB
MD5

001c8cb1891c23414b13e42814f91b49
SHA1

159ba8ccb4573b78a4e884825eec4f3d22172b74
SHA256

2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec
SHA512

0401c9aded5ccf44b20bbbda786108d1ab0202316536ec7be6ca71e80ac0e4a66f2a25323051dc5b1b67dd5d92f18992aa929fa9ba37026383d771a435329ee9
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph7GW/034A:GezaTF8FcNkNdfE0pZ9ozttwIRxoW/Oz

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023b64-3.dat	xmrig
behavioral2/files/0x000a000000023b69-7.dat	xmrig
behavioral2/files/0x000a000000023b6c-30.dat	xmrig
behavioral2/files/0x000a000000023b6b-28.dat	xmrig
behavioral2/files/0x000a000000023b6a-26.dat	xmrig
behavioral2/files/0x000a000000023b68-16.dat	xmrig
behavioral2/files/0x000a000000023b6d-35.dat	xmrig
behavioral2/files/0x0032000000023b65-42.dat	xmrig
behavioral2/files/0x000a000000023b71-60.dat	xmrig
behavioral2/files/0x000a000000023b72-63.dat	xmrig
behavioral2/files/0x000a000000023b70-58.dat	xmrig
behavioral2/files/0x000a000000023b6e-56.dat	xmrig
behavioral2/files/0x000a000000023b6f-54.dat	xmrig
behavioral2/files/0x000a000000023b73-69.dat	xmrig
behavioral2/files/0x000a000000023b74-76.dat	xmrig
behavioral2/files/0x000a000000023b77-92.dat	xmrig
behavioral2/files/0x000a000000023b7b-104.dat	xmrig
behavioral2/files/0x000a000000023b7e-115.dat	xmrig
behavioral2/files/0x000a000000023b79-125.dat	xmrig
behavioral2/files/0x000a000000023b80-135.dat	xmrig
behavioral2/files/0x000a000000023b7f-133.dat	xmrig
behavioral2/files/0x000a000000023b7d-127.dat	xmrig
behavioral2/files/0x000a000000023b7c-123.dat	xmrig
behavioral2/files/0x000a000000023b7a-119.dat	xmrig
behavioral2/files/0x000a000000023b78-110.dat	xmrig
behavioral2/files/0x000a000000023b75-98.dat	xmrig
behavioral2/files/0x000a000000023b76-86.dat	xmrig
behavioral2/files/0x000a000000023b82-142.dat	xmrig
behavioral2/files/0x000a000000023b81-143.dat	xmrig
behavioral2/files/0x000a000000023b83-148.dat	xmrig
behavioral2/files/0x000a000000023b84-163.dat	xmrig
behavioral2/files/0x000a000000023b87-167.dat	xmrig
behavioral2/files/0x000a000000023b85-155.dat	xmrig
behavioral2/files/0x000a000000023b86-156.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3368	zwqeZLW.exe
932	thLyQer.exe
4656	StzWuCx.exe
4840	azdqpbd.exe
2628	QHdCbvL.exe
4284	VdWufeu.exe
3104	GXWoVsX.exe
4008	pWWYNbX.exe
2756	NkdXxXq.exe
1060	htihUcB.exe
2180	LjGQANg.exe
4132	MqUIGSZ.exe
4884	tNTCuzF.exe
928	svgkFIp.exe
1508	PNIXYuy.exe
2744	hapRyRu.exe
2852	yPtDKQn.exe
3012	dahjMrB.exe
1452	nMHBtOv.exe
3860	qeEIbtE.exe
2912	dtvgqjt.exe
3704	TjbtiVK.exe
5004	MkyselF.exe
2800	hMdxfhJ.exe
4388	fIGJISR.exe
3220	GpOerGC.exe
1732	HZdNjzr.exe
3560	aTWKijk.exe
2332	tYwiMcQ.exe
3304	lPjMCHr.exe
3076	PtJVNkn.exe
3420	UOvwHpI.exe
564	kwJOBrw.exe
1492	OUKeqIV.exe
4556	CYhdqwb.exe
60	BWFCaQs.exe
2236	bIgzpjB.exe
1512	EakOPhy.exe
216	maXxqQC.exe
1908	dIOqyfl.exe
1056	hfPQEkP.exe
5060	SiZUjQK.exe
2152	DaOMETX.exe
2324	lQMKKbe.exe
1820	hWxWJSf.exe
5076	KlOyTPL.exe
4528	NBpEoep.exe
3624	DURYTYI.exe
3168	tXTPDFq.exe
4564	EwccnwP.exe
3064	RTmaocq.exe
4888	SUTFWbG.exe
1040	gPttFYv.exe
880	pfkLcKO.exe
3228	GvFiTOx.exe
1444	udSMusX.exe
2768	EtaeSot.exe
2828	SobiVmO.exe
3080	vHuuAeS.exe
1116	oFFKJKC.exe
2092	RBzmDxC.exe
4524	VyOENnd.exe
2544	BzxKFaX.exe
4156	rAJLwuo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DaOMETX.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\SobiVmO.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\eqMyugi.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\tZTrKmz.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\KZFVQPz.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\BlIHqVy.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\WYAtwkg.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\gWSypdM.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\HWLZauw.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\mDrBYxd.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\xZfahmw.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\uPEkSsj.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\QeTOrcC.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\QycqltT.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\hGKQRSI.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\VdWufeu.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\mrJgUZP.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\xGnkMOF.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\hMdxfhJ.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\gKIbmdY.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\qQzYuJn.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\PtJVNkn.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\udSMusX.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\EtaeSot.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\piBoerM.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\KQLqMRP.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\JiVwVVd.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\maoXIiF.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\YEWmwhx.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\GswQchU.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\ScCHPwI.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\HZdNjzr.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\vQDXyWn.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\XJkHqFV.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\EhWlCpq.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\tHCobTA.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\NCeZula.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\ONNmnkJ.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\qiYBEhn.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\RYkyTKi.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\OoVvMwh.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\EQTkars.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\EYQcuwL.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\aRzGqoO.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\djPNsYz.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\odVIdxv.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\eJQBCEz.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\AyeFUGa.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\IWmIlBf.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\VjqpgYc.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\fxdNAUd.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\XGBEXdT.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\cGEEENq.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\UDktVKp.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\oabASFL.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\mzxpmiH.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\ezdwKxb.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\BJvRZqH.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\oFFKJKC.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\WWMXyxx.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\bOVAilm.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\CYhdqwb.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\xaHmLyg.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
File created	C:\Windows\System\BhiFuVq.exe	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 3368	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	84
PID 3636 wrote to memory of 3368	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	84
PID 3636 wrote to memory of 932	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	85
PID 3636 wrote to memory of 932	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	85
PID 3636 wrote to memory of 4656	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	86
PID 3636 wrote to memory of 4656	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	86
PID 3636 wrote to memory of 4840	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	87
PID 3636 wrote to memory of 4840	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	87
PID 3636 wrote to memory of 2628	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	88
PID 3636 wrote to memory of 2628	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	88
PID 3636 wrote to memory of 4284	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	89
PID 3636 wrote to memory of 4284	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	89
PID 3636 wrote to memory of 3104	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	90
PID 3636 wrote to memory of 3104	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	90
PID 3636 wrote to memory of 4008	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	91
PID 3636 wrote to memory of 4008	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	91
PID 3636 wrote to memory of 1060	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	92
PID 3636 wrote to memory of 1060	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	92
PID 3636 wrote to memory of 2756	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	93
PID 3636 wrote to memory of 2756	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	93
PID 3636 wrote to memory of 2180	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	94
PID 3636 wrote to memory of 2180	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	94
PID 3636 wrote to memory of 4132	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	95
PID 3636 wrote to memory of 4132	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	95
PID 3636 wrote to memory of 4884	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	96
PID 3636 wrote to memory of 4884	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	96
PID 3636 wrote to memory of 928	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	97
PID 3636 wrote to memory of 928	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	97
PID 3636 wrote to memory of 1508	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	98
PID 3636 wrote to memory of 1508	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	98
PID 3636 wrote to memory of 2744	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	99
PID 3636 wrote to memory of 2744	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	99
PID 3636 wrote to memory of 2852	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	100
PID 3636 wrote to memory of 2852	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	100
PID 3636 wrote to memory of 3012	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	101
PID 3636 wrote to memory of 3012	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	101
PID 3636 wrote to memory of 1452	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	102
PID 3636 wrote to memory of 1452	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	102
PID 3636 wrote to memory of 5004	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	103
PID 3636 wrote to memory of 5004	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	103
PID 3636 wrote to memory of 3860	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	104
PID 3636 wrote to memory of 3860	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	104
PID 3636 wrote to memory of 2912	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	105
PID 3636 wrote to memory of 2912	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	105
PID 3636 wrote to memory of 3704	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	106
PID 3636 wrote to memory of 3704	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	106
PID 3636 wrote to memory of 2800	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	107
PID 3636 wrote to memory of 2800	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	107
PID 3636 wrote to memory of 4388	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	108
PID 3636 wrote to memory of 4388	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	108
PID 3636 wrote to memory of 3220	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	109
PID 3636 wrote to memory of 3220	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	109
PID 3636 wrote to memory of 1732	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	110
PID 3636 wrote to memory of 1732	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	110
PID 3636 wrote to memory of 3560	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	111
PID 3636 wrote to memory of 3560	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	111
PID 3636 wrote to memory of 2332	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	112
PID 3636 wrote to memory of 2332	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	112
PID 3636 wrote to memory of 3304	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	113
PID 3636 wrote to memory of 3304	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	113
PID 3636 wrote to memory of 3076	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	114
PID 3636 wrote to memory of 3076	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	114
PID 3636 wrote to memory of 3420	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	115
PID 3636 wrote to memory of 3420	3636	2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe	115

C:\Users\Admin\AppData\Local\Temp\2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe
"C:\Users\Admin\AppData\Local\Temp\2db1c73a2d0a413cb58388ac4f5e5f34ec56ab71934ab79896f738d8211dcbec.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\System\zwqeZLW.exe
  C:\Windows\System\zwqeZLW.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\thLyQer.exe
  C:\Windows\System\thLyQer.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\StzWuCx.exe
  C:\Windows\System\StzWuCx.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\azdqpbd.exe
  C:\Windows\System\azdqpbd.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\QHdCbvL.exe
  C:\Windows\System\QHdCbvL.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\VdWufeu.exe
  C:\Windows\System\VdWufeu.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\GXWoVsX.exe
  C:\Windows\System\GXWoVsX.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\pWWYNbX.exe
  C:\Windows\System\pWWYNbX.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\htihUcB.exe
  C:\Windows\System\htihUcB.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\NkdXxXq.exe
  C:\Windows\System\NkdXxXq.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\LjGQANg.exe
  C:\Windows\System\LjGQANg.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\MqUIGSZ.exe
  C:\Windows\System\MqUIGSZ.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\tNTCuzF.exe
  C:\Windows\System\tNTCuzF.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\svgkFIp.exe
  C:\Windows\System\svgkFIp.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\PNIXYuy.exe
  C:\Windows\System\PNIXYuy.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\hapRyRu.exe
  C:\Windows\System\hapRyRu.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\yPtDKQn.exe
  C:\Windows\System\yPtDKQn.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\dahjMrB.exe
  C:\Windows\System\dahjMrB.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\nMHBtOv.exe
  C:\Windows\System\nMHBtOv.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\MkyselF.exe
  C:\Windows\System\MkyselF.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\qeEIbtE.exe
  C:\Windows\System\qeEIbtE.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\dtvgqjt.exe
  C:\Windows\System\dtvgqjt.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\TjbtiVK.exe
  C:\Windows\System\TjbtiVK.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\hMdxfhJ.exe
  C:\Windows\System\hMdxfhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\fIGJISR.exe
  C:\Windows\System\fIGJISR.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\GpOerGC.exe
  C:\Windows\System\GpOerGC.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\HZdNjzr.exe
  C:\Windows\System\HZdNjzr.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\aTWKijk.exe
  C:\Windows\System\aTWKijk.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\tYwiMcQ.exe
  C:\Windows\System\tYwiMcQ.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\lPjMCHr.exe
  C:\Windows\System\lPjMCHr.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\PtJVNkn.exe
  C:\Windows\System\PtJVNkn.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\UOvwHpI.exe
  C:\Windows\System\UOvwHpI.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\kwJOBrw.exe
  C:\Windows\System\kwJOBrw.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\OUKeqIV.exe
  C:\Windows\System\OUKeqIV.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\CYhdqwb.exe
  C:\Windows\System\CYhdqwb.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\BWFCaQs.exe
  C:\Windows\System\BWFCaQs.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\bIgzpjB.exe
  C:\Windows\System\bIgzpjB.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\EakOPhy.exe
  C:\Windows\System\EakOPhy.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\maXxqQC.exe
  C:\Windows\System\maXxqQC.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\dIOqyfl.exe
  C:\Windows\System\dIOqyfl.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\hfPQEkP.exe
  C:\Windows\System\hfPQEkP.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\SiZUjQK.exe
  C:\Windows\System\SiZUjQK.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\DaOMETX.exe
  C:\Windows\System\DaOMETX.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\lQMKKbe.exe
  C:\Windows\System\lQMKKbe.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\hWxWJSf.exe
  C:\Windows\System\hWxWJSf.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\KlOyTPL.exe
  C:\Windows\System\KlOyTPL.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\DURYTYI.exe
  C:\Windows\System\DURYTYI.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\NBpEoep.exe
  C:\Windows\System\NBpEoep.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\tXTPDFq.exe
  C:\Windows\System\tXTPDFq.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\EwccnwP.exe
  C:\Windows\System\EwccnwP.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\RTmaocq.exe
  C:\Windows\System\RTmaocq.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\SUTFWbG.exe
  C:\Windows\System\SUTFWbG.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\gPttFYv.exe
  C:\Windows\System\gPttFYv.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\pfkLcKO.exe
  C:\Windows\System\pfkLcKO.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\GvFiTOx.exe
  C:\Windows\System\GvFiTOx.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\udSMusX.exe
  C:\Windows\System\udSMusX.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\EtaeSot.exe
  C:\Windows\System\EtaeSot.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\RBzmDxC.exe
  C:\Windows\System\RBzmDxC.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\VyOENnd.exe
  C:\Windows\System\VyOENnd.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\BzxKFaX.exe
  C:\Windows\System\BzxKFaX.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\SobiVmO.exe
  C:\Windows\System\SobiVmO.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\vHuuAeS.exe
  C:\Windows\System\vHuuAeS.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\oFFKJKC.exe
  C:\Windows\System\oFFKJKC.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\rAJLwuo.exe
  C:\Windows\System\rAJLwuo.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\xdbnxcc.exe
  C:\Windows\System\xdbnxcc.exe
  2⤵
  PID:4588
- C:\Windows\System\aTzIEkv.exe
  C:\Windows\System\aTzIEkv.exe
  2⤵
  PID:1952
- C:\Windows\System\qvNUGVp.exe
  C:\Windows\System\qvNUGVp.exe
  2⤵
  PID:2072
- C:\Windows\System\TSgHzpi.exe
  C:\Windows\System\TSgHzpi.exe
  2⤵
  PID:3824
- C:\Windows\System\WFltXRK.exe
  C:\Windows\System\WFltXRK.exe
  2⤵
  PID:4344
- C:\Windows\System\CtmyoZZ.exe
  C:\Windows\System\CtmyoZZ.exe
  2⤵
  PID:4804
- C:\Windows\System\IBhRpgf.exe
  C:\Windows\System\IBhRpgf.exe
  2⤵
  PID:4504
- C:\Windows\System\GwzVhVp.exe
  C:\Windows\System\GwzVhVp.exe
  2⤵
  PID:3408
- C:\Windows\System\tIrIJOW.exe
  C:\Windows\System\tIrIJOW.exe
  2⤵
  PID:824
- C:\Windows\System\kyMdCVj.exe
  C:\Windows\System\kyMdCVj.exe
  2⤵
  PID:4584
- C:\Windows\System\GMQRgXY.exe
  C:\Windows\System\GMQRgXY.exe
  2⤵
  PID:640
- C:\Windows\System\ISibuoC.exe
  C:\Windows\System\ISibuoC.exe
  2⤵
  PID:1932
- C:\Windows\System\BWiLlMO.exe
  C:\Windows\System\BWiLlMO.exe
  2⤵
  PID:1668
- C:\Windows\System\drnqqXG.exe
  C:\Windows\System\drnqqXG.exe
  2⤵
  PID:1700
- C:\Windows\System\ECvsYpg.exe
  C:\Windows\System\ECvsYpg.exe
  2⤵
  PID:4084
- C:\Windows\System\eCIXvkB.exe
  C:\Windows\System\eCIXvkB.exe
  2⤵
  PID:5068
- C:\Windows\System\Fntpyfh.exe
  C:\Windows\System\Fntpyfh.exe
  2⤵
  PID:780
- C:\Windows\System\gJZRtda.exe
  C:\Windows\System\gJZRtda.exe
  2⤵
  PID:1660
- C:\Windows\System\hJTRdjf.exe
  C:\Windows\System\hJTRdjf.exe
  2⤵
  PID:3424
- C:\Windows\System\IcjAzKA.exe
  C:\Windows\System\IcjAzKA.exe
  2⤵
  PID:2136
- C:\Windows\System\QxrCwOj.exe
  C:\Windows\System\QxrCwOj.exe
  2⤵
  PID:4480
- C:\Windows\System\fUWhQcY.exe
  C:\Windows\System\fUWhQcY.exe
  2⤵
  PID:2024
- C:\Windows\System\WhXQgIE.exe
  C:\Windows\System\WhXQgIE.exe
  2⤵
  PID:2856
- C:\Windows\System\Lmmppfc.exe
  C:\Windows\System\Lmmppfc.exe
  2⤵
  PID:3384
- C:\Windows\System\cjIWzGT.exe
  C:\Windows\System\cjIWzGT.exe
  2⤵
  PID:876
- C:\Windows\System\HpjwuhZ.exe
  C:\Windows\System\HpjwuhZ.exe
  2⤵
  PID:680
- C:\Windows\System\HoILBvo.exe
  C:\Windows\System\HoILBvo.exe
  2⤵
  PID:4676
- C:\Windows\System\rzArUPW.exe
  C:\Windows\System\rzArUPW.exe
  2⤵
  PID:2624
- C:\Windows\System\ZXgvglC.exe
  C:\Windows\System\ZXgvglC.exe
  2⤵
  PID:3156
- C:\Windows\System\jgvbhEC.exe
  C:\Windows\System\jgvbhEC.exe
  2⤵
  PID:1968
- C:\Windows\System\EWPrpdJ.exe
  C:\Windows\System\EWPrpdJ.exe
  2⤵
  PID:1144
- C:\Windows\System\lCyUlsH.exe
  C:\Windows\System\lCyUlsH.exe
  2⤵
  PID:1416
- C:\Windows\System\KBgHFiU.exe
  C:\Windows\System\KBgHFiU.exe
  2⤵
  PID:3056
- C:\Windows\System\nukdufN.exe
  C:\Windows\System\nukdufN.exe
  2⤵
  PID:2512
- C:\Windows\System\ROBsPNL.exe
  C:\Windows\System\ROBsPNL.exe
  2⤵
  PID:3572
- C:\Windows\System\hoeAkWz.exe
  C:\Windows\System\hoeAkWz.exe
  2⤵
  PID:4672
- C:\Windows\System\TVsVVtS.exe
  C:\Windows\System\TVsVVtS.exe
  2⤵
  PID:1536
- C:\Windows\System\gWSypdM.exe
  C:\Windows\System\gWSypdM.exe
  2⤵
  PID:1288
- C:\Windows\System\JdqAHMD.exe
  C:\Windows\System\JdqAHMD.exe
  2⤵
  PID:1412
- C:\Windows\System\VmmcXLP.exe
  C:\Windows\System\VmmcXLP.exe
  2⤵
  PID:4644
- C:\Windows\System\lgMJnZg.exe
  C:\Windows\System\lgMJnZg.exe
  2⤵
  PID:2892
- C:\Windows\System\PPgtaNx.exe
  C:\Windows\System\PPgtaNx.exe
  2⤵
  PID:5016
- C:\Windows\System\XGBEXdT.exe
  C:\Windows\System\XGBEXdT.exe
  2⤵
  PID:2440
- C:\Windows\System\xJhfdvL.exe
  C:\Windows\System\xJhfdvL.exe
  2⤵
  PID:2540
- C:\Windows\System\drHwZMM.exe
  C:\Windows\System\drHwZMM.exe
  2⤵
  PID:1584
- C:\Windows\System\kctKasZ.exe
  C:\Windows\System\kctKasZ.exe
  2⤵
  PID:1352
- C:\Windows\System\zUNJeEE.exe
  C:\Windows\System\zUNJeEE.exe
  2⤵
  PID:1304
- C:\Windows\System\obANIla.exe
  C:\Windows\System\obANIla.exe
  2⤵
  PID:2492
- C:\Windows\System\qbxBXcC.exe
  C:\Windows\System\qbxBXcC.exe
  2⤵
  PID:1996
- C:\Windows\System\eULWpHD.exe
  C:\Windows\System\eULWpHD.exe
  2⤵
  PID:3212
- C:\Windows\System\PxpjBXF.exe
  C:\Windows\System\PxpjBXF.exe
  2⤵
  PID:1488
- C:\Windows\System\sAhFvYn.exe
  C:\Windows\System\sAhFvYn.exe
  2⤵
  PID:4020
- C:\Windows\System\QgpuNJf.exe
  C:\Windows\System\QgpuNJf.exe
  2⤵
  PID:5144
- C:\Windows\System\piBoerM.exe
  C:\Windows\System\piBoerM.exe
  2⤵
  PID:5160
- C:\Windows\System\vTZTOQT.exe
  C:\Windows\System\vTZTOQT.exe
  2⤵
  PID:5184
- C:\Windows\System\AghFYsN.exe
  C:\Windows\System\AghFYsN.exe
  2⤵
  PID:5212
- C:\Windows\System\GRIZDfw.exe
  C:\Windows\System\GRIZDfw.exe
  2⤵
  PID:5240
- C:\Windows\System\MoIMZyq.exe
  C:\Windows\System\MoIMZyq.exe
  2⤵
  PID:5268
- C:\Windows\System\TEiBGiL.exe
  C:\Windows\System\TEiBGiL.exe
  2⤵
  PID:5296
- C:\Windows\System\bJKddxq.exe
  C:\Windows\System\bJKddxq.exe
  2⤵
  PID:5324
- C:\Windows\System\bfpoqsr.exe
  C:\Windows\System\bfpoqsr.exe
  2⤵
  PID:5360
- C:\Windows\System\adVcKeQ.exe
  C:\Windows\System\adVcKeQ.exe
  2⤵
  PID:5384
- C:\Windows\System\QkAkpXy.exe
  C:\Windows\System\QkAkpXy.exe
  2⤵
  PID:5412
- C:\Windows\System\KnkOJLg.exe
  C:\Windows\System\KnkOJLg.exe
  2⤵
  PID:5440
- C:\Windows\System\dKHooXH.exe
  C:\Windows\System\dKHooXH.exe
  2⤵
  PID:5476
- C:\Windows\System\cGEEENq.exe
  C:\Windows\System\cGEEENq.exe
  2⤵
  PID:5500
- C:\Windows\System\xJYUszJ.exe
  C:\Windows\System\xJYUszJ.exe
  2⤵
  PID:5536
- C:\Windows\System\CpqMtAn.exe
  C:\Windows\System\CpqMtAn.exe
  2⤵
  PID:5564
- C:\Windows\System\wkqzejU.exe
  C:\Windows\System\wkqzejU.exe
  2⤵
  PID:5592
- C:\Windows\System\VBwWNVF.exe
  C:\Windows\System\VBwWNVF.exe
  2⤵
  PID:5620
- C:\Windows\System\oCMGJKt.exe
  C:\Windows\System\oCMGJKt.exe
  2⤵
  PID:5636
- C:\Windows\System\GyFnrKi.exe
  C:\Windows\System\GyFnrKi.exe
  2⤵
  PID:5652
- C:\Windows\System\deIfuJH.exe
  C:\Windows\System\deIfuJH.exe
  2⤵
  PID:5680
- C:\Windows\System\rpMpQpn.exe
  C:\Windows\System\rpMpQpn.exe
  2⤵
  PID:5696
- C:\Windows\System\srvcFpB.exe
  C:\Windows\System\srvcFpB.exe
  2⤵
  PID:5724
- C:\Windows\System\FJaaSqH.exe
  C:\Windows\System\FJaaSqH.exe
  2⤵
  PID:5760
- C:\Windows\System\EQHjhPl.exe
  C:\Windows\System\EQHjhPl.exe
  2⤵
  PID:5784
- C:\Windows\System\THRnDnE.exe
  C:\Windows\System\THRnDnE.exe
  2⤵
  PID:5820
- C:\Windows\System\bvIFiVK.exe
  C:\Windows\System\bvIFiVK.exe
  2⤵
  PID:5848
- C:\Windows\System\jyEOmzL.exe
  C:\Windows\System\jyEOmzL.exe
  2⤵
  PID:5868
- C:\Windows\System\JDhDuHA.exe
  C:\Windows\System\JDhDuHA.exe
  2⤵
  PID:5904
- C:\Windows\System\HJKgTWx.exe
  C:\Windows\System\HJKgTWx.exe
  2⤵
  PID:5952
- C:\Windows\System\jHsSTDp.exe
  C:\Windows\System\jHsSTDp.exe
  2⤵
  PID:5972
- C:\Windows\System\OvPsIco.exe
  C:\Windows\System\OvPsIco.exe
  2⤵
  PID:6028
- C:\Windows\System\GArqjHo.exe
  C:\Windows\System\GArqjHo.exe
  2⤵
  PID:6044
- C:\Windows\System\iDwmGpg.exe
  C:\Windows\System\iDwmGpg.exe
  2⤵
  PID:6072
- C:\Windows\System\PTuvOIP.exe
  C:\Windows\System\PTuvOIP.exe
  2⤵
  PID:6100
- C:\Windows\System\gSovkIa.exe
  C:\Windows\System\gSovkIa.exe
  2⤵
  PID:6128
- C:\Windows\System\aINbCrG.exe
  C:\Windows\System\aINbCrG.exe
  2⤵
  PID:5132
- C:\Windows\System\rDcQDKG.exe
  C:\Windows\System\rDcQDKG.exe
  2⤵
  PID:5168
- C:\Windows\System\jptucZz.exe
  C:\Windows\System\jptucZz.exe
  2⤵
  PID:5232
- C:\Windows\System\mihcvoZ.exe
  C:\Windows\System\mihcvoZ.exe
  2⤵
  PID:5284
- C:\Windows\System\eqMyugi.exe
  C:\Windows\System\eqMyugi.exe
  2⤵
  PID:5316
- C:\Windows\System\bbOrVuB.exe
  C:\Windows\System\bbOrVuB.exe
  2⤵
  PID:5424
- C:\Windows\System\HNkZBur.exe
  C:\Windows\System\HNkZBur.exe
  2⤵
  PID:5436
- C:\Windows\System\mTViEJo.exe
  C:\Windows\System\mTViEJo.exe
  2⤵
  PID:5520
- C:\Windows\System\ohtswpl.exe
  C:\Windows\System\ohtswpl.exe
  2⤵
  PID:5560
- C:\Windows\System\BSQijej.exe
  C:\Windows\System\BSQijej.exe
  2⤵
  PID:5632
- C:\Windows\System\kRmyGlm.exe
  C:\Windows\System\kRmyGlm.exe
  2⤵
  PID:5692
- C:\Windows\System\rHBphtC.exe
  C:\Windows\System\rHBphtC.exe
  2⤵
  PID:5744
- C:\Windows\System\PvmyuqZ.exe
  C:\Windows\System\PvmyuqZ.exe
  2⤵
  PID:5780
- C:\Windows\System\lpReJea.exe
  C:\Windows\System\lpReJea.exe
  2⤵
  PID:5864
- C:\Windows\System\ZMoHRwY.exe
  C:\Windows\System\ZMoHRwY.exe
  2⤵
  PID:5920
- C:\Windows\System\NVyTCSv.exe
  C:\Windows\System\NVyTCSv.exe
  2⤵
  PID:6012
- C:\Windows\System\fIAyxKC.exe
  C:\Windows\System\fIAyxKC.exe
  2⤵
  PID:6088
- C:\Windows\System\wNFUHJq.exe
  C:\Windows\System\wNFUHJq.exe
  2⤵
  PID:4184
- C:\Windows\System\PrQOyee.exe
  C:\Windows\System\PrQOyee.exe
  2⤵
  PID:5260
- C:\Windows\System\IOgMbgd.exe
  C:\Windows\System\IOgMbgd.exe
  2⤵
  PID:5368
- C:\Windows\System\kGeEOBO.exe
  C:\Windows\System\kGeEOBO.exe
  2⤵
  PID:5400
- C:\Windows\System\rlWVxTH.exe
  C:\Windows\System\rlWVxTH.exe
  2⤵
  PID:5548
- C:\Windows\System\xknbpkM.exe
  C:\Windows\System\xknbpkM.exe
  2⤵
  PID:5708
- C:\Windows\System\rCJnKAx.exe
  C:\Windows\System\rCJnKAx.exe
  2⤵
  PID:6036
- C:\Windows\System\Fyazrgz.exe
  C:\Windows\System\Fyazrgz.exe
  2⤵
  PID:5380
- C:\Windows\System\NknjMZl.exe
  C:\Windows\System\NknjMZl.exe
  2⤵
  PID:5892
- C:\Windows\System\tDAenQq.exe
  C:\Windows\System\tDAenQq.exe
  2⤵
  PID:5772
- C:\Windows\System\QeSWbrd.exe
  C:\Windows\System\QeSWbrd.exe
  2⤵
  PID:6152
- C:\Windows\System\USixagy.exe
  C:\Windows\System\USixagy.exe
  2⤵
  PID:6180
- C:\Windows\System\fMUmwyy.exe
  C:\Windows\System\fMUmwyy.exe
  2⤵
  PID:6200
- C:\Windows\System\kdnUqGy.exe
  C:\Windows\System\kdnUqGy.exe
  2⤵
  PID:6228
- C:\Windows\System\tBmAAzm.exe
  C:\Windows\System\tBmAAzm.exe
  2⤵
  PID:6260
- C:\Windows\System\RQEtnTG.exe
  C:\Windows\System\RQEtnTG.exe
  2⤵
  PID:6288
- C:\Windows\System\WsKLIPB.exe
  C:\Windows\System\WsKLIPB.exe
  2⤵
  PID:6308
- C:\Windows\System\ErzTsMs.exe
  C:\Windows\System\ErzTsMs.exe
  2⤵
  PID:6332
- C:\Windows\System\ixLNtQJ.exe
  C:\Windows\System\ixLNtQJ.exe
  2⤵
  PID:6364
- C:\Windows\System\bHosddr.exe
  C:\Windows\System\bHosddr.exe
  2⤵
  PID:6396
- C:\Windows\System\HWLZauw.exe
  C:\Windows\System\HWLZauw.exe
  2⤵
  PID:6416
- C:\Windows\System\qHCyNpT.exe
  C:\Windows\System\qHCyNpT.exe
  2⤵
  PID:6440
- C:\Windows\System\BCsLTob.exe
  C:\Windows\System\BCsLTob.exe
  2⤵
  PID:6472
- C:\Windows\System\jOKdbvC.exe
  C:\Windows\System\jOKdbvC.exe
  2⤵
  PID:6504
- C:\Windows\System\pKinblH.exe
  C:\Windows\System\pKinblH.exe
  2⤵
  PID:6532
- C:\Windows\System\MBPSkJH.exe
  C:\Windows\System\MBPSkJH.exe
  2⤵
  PID:6556
- C:\Windows\System\rqTaKrF.exe
  C:\Windows\System\rqTaKrF.exe
  2⤵
  PID:6592
- C:\Windows\System\hAoKeYo.exe
  C:\Windows\System\hAoKeYo.exe
  2⤵
  PID:6616
- C:\Windows\System\tMJaaXS.exe
  C:\Windows\System\tMJaaXS.exe
  2⤵
  PID:6644
- C:\Windows\System\ZvVbURG.exe
  C:\Windows\System\ZvVbURG.exe
  2⤵
  PID:6680
- C:\Windows\System\KGDcDHa.exe
  C:\Windows\System\KGDcDHa.exe
  2⤵
  PID:6700
- C:\Windows\System\UbLXmNJ.exe
  C:\Windows\System\UbLXmNJ.exe
  2⤵
  PID:6728
- C:\Windows\System\hypaMtp.exe
  C:\Windows\System\hypaMtp.exe
  2⤵
  PID:6752
- C:\Windows\System\VGrCTJW.exe
  C:\Windows\System\VGrCTJW.exe
  2⤵
  PID:6776
- C:\Windows\System\sPxJWGi.exe
  C:\Windows\System\sPxJWGi.exe
  2⤵
  PID:6808
- C:\Windows\System\rwQUzWv.exe
  C:\Windows\System\rwQUzWv.exe
  2⤵
  PID:6832
- C:\Windows\System\TqOZoIH.exe
  C:\Windows\System\TqOZoIH.exe
  2⤵
  PID:6860
- C:\Windows\System\jusypaA.exe
  C:\Windows\System\jusypaA.exe
  2⤵
  PID:6880
- C:\Windows\System\cgpYfwr.exe
  C:\Windows\System\cgpYfwr.exe
  2⤵
  PID:6900
- C:\Windows\System\rODeCUf.exe
  C:\Windows\System\rODeCUf.exe
  2⤵
  PID:6920
- C:\Windows\System\pGYGzSn.exe
  C:\Windows\System\pGYGzSn.exe
  2⤵
  PID:6940
- C:\Windows\System\FOdGKal.exe
  C:\Windows\System\FOdGKal.exe
  2⤵
  PID:6960
- C:\Windows\System\FJqpwzA.exe
  C:\Windows\System\FJqpwzA.exe
  2⤵
  PID:6988
- C:\Windows\System\Ddocjas.exe
  C:\Windows\System\Ddocjas.exe
  2⤵
  PID:7020
- C:\Windows\System\OoVvMwh.exe
  C:\Windows\System\OoVvMwh.exe
  2⤵
  PID:7044
- C:\Windows\System\GbgezJl.exe
  C:\Windows\System\GbgezJl.exe
  2⤵
  PID:7072
- C:\Windows\System\BbGEZgK.exe
  C:\Windows\System\BbGEZgK.exe
  2⤵
  PID:7100
- C:\Windows\System\iBRdoSl.exe
  C:\Windows\System\iBRdoSl.exe
  2⤵
  PID:7124
- C:\Windows\System\MtNPRiG.exe
  C:\Windows\System\MtNPRiG.exe
  2⤵
  PID:7152
- C:\Windows\System\nPVMBeF.exe
  C:\Windows\System\nPVMBeF.exe
  2⤵
  PID:5552
- C:\Windows\System\bcUmYml.exe
  C:\Windows\System\bcUmYml.exe
  2⤵
  PID:6164
- C:\Windows\System\GiRndXh.exe
  C:\Windows\System\GiRndXh.exe
  2⤵
  PID:6252
- C:\Windows\System\xaHmLyg.exe
  C:\Windows\System\xaHmLyg.exe
  2⤵
  PID:6284
- C:\Windows\System\MXfoQJF.exe
  C:\Windows\System\MXfoQJF.exe
  2⤵
  PID:6408
- C:\Windows\System\nVNCFpY.exe
  C:\Windows\System\nVNCFpY.exe
  2⤵
  PID:6412
- C:\Windows\System\sdBiqpu.exe
  C:\Windows\System\sdBiqpu.exe
  2⤵
  PID:6468
- C:\Windows\System\SakKvbb.exe
  C:\Windows\System\SakKvbb.exe
  2⤵
  PID:6552
- C:\Windows\System\TdYVmUT.exe
  C:\Windows\System\TdYVmUT.exe
  2⤵
  PID:6584
- C:\Windows\System\OwvXCKn.exe
  C:\Windows\System\OwvXCKn.exe
  2⤵
  PID:6636
- C:\Windows\System\CBwIpvX.exe
  C:\Windows\System\CBwIpvX.exe
  2⤵
  PID:6712
- C:\Windows\System\AUQzqox.exe
  C:\Windows\System\AUQzqox.exe
  2⤵
  PID:6764
- C:\Windows\System\DugOqlr.exe
  C:\Windows\System\DugOqlr.exe
  2⤵
  PID:6772
- C:\Windows\System\BhiFuVq.exe
  C:\Windows\System\BhiFuVq.exe
  2⤵
  PID:6856
- C:\Windows\System\uyCsnpg.exe
  C:\Windows\System\uyCsnpg.exe
  2⤵
  PID:7000
- C:\Windows\System\YYJVKgV.exe
  C:\Windows\System\YYJVKgV.exe
  2⤵
  PID:6952
- C:\Windows\System\ydIzMGA.exe
  C:\Windows\System\ydIzMGA.exe
  2⤵
  PID:7056
- C:\Windows\System\bWadBDc.exe
  C:\Windows\System\bWadBDc.exe
  2⤵
  PID:7108
- C:\Windows\System\PKhjFOA.exe
  C:\Windows\System\PKhjFOA.exe
  2⤵
  PID:7096
- C:\Windows\System\AyeFUGa.exe
  C:\Windows\System\AyeFUGa.exe
  2⤵
  PID:7140
- C:\Windows\System\oQkkzOJ.exe
  C:\Windows\System\oQkkzOJ.exe
  2⤵
  PID:6360
- C:\Windows\System\NKOUtdC.exe
  C:\Windows\System\NKOUtdC.exe
  2⤵
  PID:6248
- C:\Windows\System\ehtSDid.exe
  C:\Windows\System\ehtSDid.exe
  2⤵
  PID:6628
- C:\Windows\System\LeLGtfm.exe
  C:\Windows\System\LeLGtfm.exe
  2⤵
  PID:6608
- C:\Windows\System\DLUvnxy.exe
  C:\Windows\System\DLUvnxy.exe
  2⤵
  PID:7180
- C:\Windows\System\yoemXiX.exe
  C:\Windows\System\yoemXiX.exe
  2⤵
  PID:7204
- C:\Windows\System\vBnqGHX.exe
  C:\Windows\System\vBnqGHX.exe
  2⤵
  PID:7232
- C:\Windows\System\TZqzNZJ.exe
  C:\Windows\System\TZqzNZJ.exe
  2⤵
  PID:7256
- C:\Windows\System\UDktVKp.exe
  C:\Windows\System\UDktVKp.exe
  2⤵
  PID:7280
- C:\Windows\System\NCeZula.exe
  C:\Windows\System\NCeZula.exe
  2⤵
  PID:7300
- C:\Windows\System\yjjQvIm.exe
  C:\Windows\System\yjjQvIm.exe
  2⤵
  PID:7328
- C:\Windows\System\IWkANTi.exe
  C:\Windows\System\IWkANTi.exe
  2⤵
  PID:7352
- C:\Windows\System\GswQchU.exe
  C:\Windows\System\GswQchU.exe
  2⤵
  PID:7372
- C:\Windows\System\cpZARJp.exe
  C:\Windows\System\cpZARJp.exe
  2⤵
  PID:7396
- C:\Windows\System\PUAmVJR.exe
  C:\Windows\System\PUAmVJR.exe
  2⤵
  PID:7428
- C:\Windows\System\xDMDHsY.exe
  C:\Windows\System\xDMDHsY.exe
  2⤵
  PID:7452
- C:\Windows\System\GBfRwkQ.exe
  C:\Windows\System\GBfRwkQ.exe
  2⤵
  PID:7484
- C:\Windows\System\XKUDTUc.exe
  C:\Windows\System\XKUDTUc.exe
  2⤵
  PID:7512
- C:\Windows\System\aRzGqoO.exe
  C:\Windows\System\aRzGqoO.exe
  2⤵
  PID:7532
- C:\Windows\System\CjdXjoL.exe
  C:\Windows\System\CjdXjoL.exe
  2⤵
  PID:7560
- C:\Windows\System\CqXrZKv.exe
  C:\Windows\System\CqXrZKv.exe
  2⤵
  PID:7596
- C:\Windows\System\FrGjHkc.exe
  C:\Windows\System\FrGjHkc.exe
  2⤵
  PID:7628
- C:\Windows\System\WSegrfD.exe
  C:\Windows\System\WSegrfD.exe
  2⤵
  PID:7652
- C:\Windows\System\rKVjSGv.exe
  C:\Windows\System\rKVjSGv.exe
  2⤵
  PID:7676
- C:\Windows\System\kqlIHdd.exe
  C:\Windows\System\kqlIHdd.exe
  2⤵
  PID:7700
- C:\Windows\System\OLGzcTI.exe
  C:\Windows\System\OLGzcTI.exe
  2⤵
  PID:7724
- C:\Windows\System\kwRqaKQ.exe
  C:\Windows\System\kwRqaKQ.exe
  2⤵
  PID:7748
- C:\Windows\System\PfmOmoe.exe
  C:\Windows\System\PfmOmoe.exe
  2⤵
  PID:7780
- C:\Windows\System\mDrBYxd.exe
  C:\Windows\System\mDrBYxd.exe
  2⤵
  PID:7800
- C:\Windows\System\lVuNeXs.exe
  C:\Windows\System\lVuNeXs.exe
  2⤵
  PID:7820
- C:\Windows\System\qMhMTgA.exe
  C:\Windows\System\qMhMTgA.exe
  2⤵
  PID:7844
- C:\Windows\System\NcletiC.exe
  C:\Windows\System\NcletiC.exe
  2⤵
  PID:7872
- C:\Windows\System\ZFyYjAA.exe
  C:\Windows\System\ZFyYjAA.exe
  2⤵
  PID:7896
- C:\Windows\System\wuuQNdK.exe
  C:\Windows\System\wuuQNdK.exe
  2⤵
  PID:7928
- C:\Windows\System\WgUouyv.exe
  C:\Windows\System\WgUouyv.exe
  2⤵
  PID:7952
- C:\Windows\System\KQLqMRP.exe
  C:\Windows\System\KQLqMRP.exe
  2⤵
  PID:7980
- C:\Windows\System\LicYnBI.exe
  C:\Windows\System\LicYnBI.exe
  2⤵
  PID:8016
- C:\Windows\System\dnnGMIU.exe
  C:\Windows\System\dnnGMIU.exe
  2⤵
  PID:8040
- C:\Windows\System\AemIBVD.exe
  C:\Windows\System\AemIBVD.exe
  2⤵
  PID:8068
- C:\Windows\System\BdgBBAH.exe
  C:\Windows\System\BdgBBAH.exe
  2⤵
  PID:8100
- C:\Windows\System\uOpRYEx.exe
  C:\Windows\System\uOpRYEx.exe
  2⤵
  PID:8132
- C:\Windows\System\ZhZCgYR.exe
  C:\Windows\System\ZhZCgYR.exe
  2⤵
  PID:8160
- C:\Windows\System\UxfaZRF.exe
  C:\Windows\System\UxfaZRF.exe
  2⤵
  PID:8188
- C:\Windows\System\whULxGw.exe
  C:\Windows\System\whULxGw.exe
  2⤵
  PID:6916
- C:\Windows\System\uuvgsXu.exe
  C:\Windows\System\uuvgsXu.exe
  2⤵
  PID:6980
- C:\Windows\System\RxKLyht.exe
  C:\Windows\System\RxKLyht.exe
  2⤵
  PID:7164
- C:\Windows\System\RUHCSZi.exe
  C:\Windows\System\RUHCSZi.exe
  2⤵
  PID:6548
- C:\Windows\System\oIbymyh.exe
  C:\Windows\System\oIbymyh.exe
  2⤵
  PID:7196
- C:\Windows\System\ONNmnkJ.exe
  C:\Windows\System\ONNmnkJ.exe
  2⤵
  PID:7252
- C:\Windows\System\HwtEUhP.exe
  C:\Windows\System\HwtEUhP.exe
  2⤵
  PID:7296
- C:\Windows\System\yAPjJrM.exe
  C:\Windows\System\yAPjJrM.exe
  2⤵
  PID:3940
- C:\Windows\System\yUkfMsK.exe
  C:\Windows\System\yUkfMsK.exe
  2⤵
  PID:7268
- C:\Windows\System\RzWfwCb.exe
  C:\Windows\System\RzWfwCb.exe
  2⤵
  PID:7476
- C:\Windows\System\UoQIrnE.exe
  C:\Windows\System\UoQIrnE.exe
  2⤵
  PID:7420
- C:\Windows\System\tNCVNWP.exe
  C:\Windows\System\tNCVNWP.exe
  2⤵
  PID:7660
- C:\Windows\System\xphLqAh.exe
  C:\Windows\System\xphLqAh.exe
  2⤵
  PID:7492
- C:\Windows\System\XnftLEl.exe
  C:\Windows\System\XnftLEl.exe
  2⤵
  PID:7732
- C:\Windows\System\MPDJgGQ.exe
  C:\Windows\System\MPDJgGQ.exe
  2⤵
  PID:7576
- C:\Windows\System\LYXCptj.exe
  C:\Windows\System\LYXCptj.exe
  2⤵
  PID:7592
- C:\Windows\System\EQTkars.exe
  C:\Windows\System\EQTkars.exe
  2⤵
  PID:7648
- C:\Windows\System\NUVxbOt.exe
  C:\Windows\System\NUVxbOt.exe
  2⤵
  PID:7972
- C:\Windows\System\tZTrKmz.exe
  C:\Windows\System\tZTrKmz.exe
  2⤵
  PID:7892
- C:\Windows\System\luhQpNA.exe
  C:\Windows\System\luhQpNA.exe
  2⤵
  PID:7068
- C:\Windows\System\fVdlqvN.exe
  C:\Windows\System\fVdlqvN.exe
  2⤵
  PID:7940
- C:\Windows\System\QycqltT.exe
  C:\Windows\System\QycqltT.exe
  2⤵
  PID:7968
- C:\Windows\System\LcbPehy.exe
  C:\Windows\System\LcbPehy.exe
  2⤵
  PID:7520
- C:\Windows\System\oabASFL.exe
  C:\Windows\System\oabASFL.exe
  2⤵
  PID:8032
- C:\Windows\System\kpADDPe.exe
  C:\Windows\System\kpADDPe.exe
  2⤵
  PID:8092
- C:\Windows\System\ITNGwJE.exe
  C:\Windows\System\ITNGwJE.exe
  2⤵
  PID:8148
- C:\Windows\System\WdEHafO.exe
  C:\Windows\System\WdEHafO.exe
  2⤵
  PID:8212
- C:\Windows\System\qhpVeOw.exe
  C:\Windows\System\qhpVeOw.exe
  2⤵
  PID:8232
- C:\Windows\System\kRzdOql.exe
  C:\Windows\System\kRzdOql.exe
  2⤵
  PID:8260
- C:\Windows\System\xQcyrzR.exe
  C:\Windows\System\xQcyrzR.exe
  2⤵
  PID:8280
- C:\Windows\System\OJgFqyA.exe
  C:\Windows\System\OJgFqyA.exe
  2⤵
  PID:8300
- C:\Windows\System\spZMSem.exe
  C:\Windows\System\spZMSem.exe
  2⤵
  PID:8336
- C:\Windows\System\CUysYTS.exe
  C:\Windows\System\CUysYTS.exe
  2⤵
  PID:8360
- C:\Windows\System\TVKfRlG.exe
  C:\Windows\System\TVKfRlG.exe
  2⤵
  PID:8384
- C:\Windows\System\nkPLQCR.exe
  C:\Windows\System\nkPLQCR.exe
  2⤵
  PID:8416
- C:\Windows\System\WWMXyxx.exe
  C:\Windows\System\WWMXyxx.exe
  2⤵
  PID:8452
- C:\Windows\System\ZKzZfbI.exe
  C:\Windows\System\ZKzZfbI.exe
  2⤵
  PID:8480
- C:\Windows\System\viyYnxJ.exe
  C:\Windows\System\viyYnxJ.exe
  2⤵
  PID:8504
- C:\Windows\System\ZggYocQ.exe
  C:\Windows\System\ZggYocQ.exe
  2⤵
  PID:8532
- C:\Windows\System\yUqwYCm.exe
  C:\Windows\System\yUqwYCm.exe
  2⤵
  PID:8560
- C:\Windows\System\WhXyNrR.exe
  C:\Windows\System\WhXyNrR.exe
  2⤵
  PID:8592
- C:\Windows\System\JYAhcZy.exe
  C:\Windows\System\JYAhcZy.exe
  2⤵
  PID:8608
- C:\Windows\System\xLMJTrv.exe
  C:\Windows\System\xLMJTrv.exe
  2⤵
  PID:8636
- C:\Windows\System\vIxniyZ.exe
  C:\Windows\System\vIxniyZ.exe
  2⤵
  PID:8656
- C:\Windows\System\yfnDOGN.exe
  C:\Windows\System\yfnDOGN.exe
  2⤵
  PID:8688
- C:\Windows\System\xZfahmw.exe
  C:\Windows\System\xZfahmw.exe
  2⤵
  PID:8704
- C:\Windows\System\JhKvril.exe
  C:\Windows\System\JhKvril.exe
  2⤵
  PID:8724
- C:\Windows\System\mzBKRlP.exe
  C:\Windows\System\mzBKRlP.exe
  2⤵
  PID:8752
- C:\Windows\System\hWINFaC.exe
  C:\Windows\System\hWINFaC.exe
  2⤵
  PID:8776
- C:\Windows\System\rFsTxwb.exe
  C:\Windows\System\rFsTxwb.exe
  2⤵
  PID:8796
- C:\Windows\System\vBOYppk.exe
  C:\Windows\System\vBOYppk.exe
  2⤵
  PID:8820
- C:\Windows\System\MpYmAhD.exe
  C:\Windows\System\MpYmAhD.exe
  2⤵
  PID:8844
- C:\Windows\System\EpHgpxx.exe
  C:\Windows\System\EpHgpxx.exe
  2⤵
  PID:8876
- C:\Windows\System\djPNsYz.exe
  C:\Windows\System\djPNsYz.exe
  2⤵
  PID:8900
- C:\Windows\System\UGENxRX.exe
  C:\Windows\System\UGENxRX.exe
  2⤵
  PID:8928
- C:\Windows\System\EdrCVKI.exe
  C:\Windows\System\EdrCVKI.exe
  2⤵
  PID:8964
- C:\Windows\System\oYGQULG.exe
  C:\Windows\System\oYGQULG.exe
  2⤵
  PID:8992
- C:\Windows\System\ELmsxmu.exe
  C:\Windows\System\ELmsxmu.exe
  2⤵
  PID:9012
- C:\Windows\System\sIWKTxS.exe
  C:\Windows\System\sIWKTxS.exe
  2⤵
  PID:9040
- C:\Windows\System\kVAGleh.exe
  C:\Windows\System\kVAGleh.exe
  2⤵
  PID:9056
- C:\Windows\System\MNOaJex.exe
  C:\Windows\System\MNOaJex.exe
  2⤵
  PID:9076
- C:\Windows\System\YxIlELl.exe
  C:\Windows\System\YxIlELl.exe
  2⤵
  PID:9112
- C:\Windows\System\GtNysjr.exe
  C:\Windows\System\GtNysjr.exe
  2⤵
  PID:9140
- C:\Windows\System\fRwIfaB.exe
  C:\Windows\System\fRwIfaB.exe
  2⤵
  PID:9160
- C:\Windows\System\nOHOXZe.exe
  C:\Windows\System\nOHOXZe.exe
  2⤵
  PID:9184
- C:\Windows\System\xGpKgjS.exe
  C:\Windows\System\xGpKgjS.exe
  2⤵
  PID:9204
- C:\Windows\System\VBLwfxV.exe
  C:\Windows\System\VBLwfxV.exe
  2⤵
  PID:7468
- C:\Windows\System\JfxgVly.exe
  C:\Windows\System\JfxgVly.exe
  2⤵
  PID:7116
- C:\Windows\System\dVJekDm.exe
  C:\Windows\System\dVJekDm.exe
  2⤵
  PID:8128
- C:\Windows\System\ChWtWlN.exe
  C:\Windows\System\ChWtWlN.exe
  2⤵
  PID:7588
- C:\Windows\System\OgChUAU.exe
  C:\Windows\System\OgChUAU.exe
  2⤵
  PID:8052
- C:\Windows\System\GeMRXdb.exe
  C:\Windows\System\GeMRXdb.exe
  2⤵
  PID:7440
- C:\Windows\System\LiCzCgg.exe
  C:\Windows\System\LiCzCgg.exe
  2⤵
  PID:7720
- C:\Windows\System\TFJiAzR.exe
  C:\Windows\System\TFJiAzR.exe
  2⤵
  PID:7772
- C:\Windows\System\ebfyziB.exe
  C:\Windows\System\ebfyziB.exe
  2⤵
  PID:7672
- C:\Windows\System\PqewPQG.exe
  C:\Windows\System\PqewPQG.exe
  2⤵
  PID:8520
- C:\Windows\System\rWEMKMN.exe
  C:\Windows\System\rWEMKMN.exe
  2⤵
  PID:8576
- C:\Windows\System\IIlxzEV.exe
  C:\Windows\System\IIlxzEV.exe
  2⤵
  PID:8396
- C:\Windows\System\fhhvsuM.exe
  C:\Windows\System\fhhvsuM.exe
  2⤵
  PID:8676
- C:\Windows\System\NVejeCv.exe
  C:\Windows\System\NVejeCv.exe
  2⤵
  PID:8256
- C:\Windows\System\bZxZUwk.exe
  C:\Windows\System\bZxZUwk.exe
  2⤵
  PID:8328
- C:\Windows\System\EReGvgw.exe
  C:\Windows\System\EReGvgw.exe
  2⤵
  PID:8356
- C:\Windows\System\YzXQXLn.exe
  C:\Windows\System\YzXQXLn.exe
  2⤵
  PID:8668
- C:\Windows\System\bIWmbkG.exe
  C:\Windows\System\bIWmbkG.exe
  2⤵
  PID:8460
- C:\Windows\System\bAiRoNt.exe
  C:\Windows\System\bAiRoNt.exe
  2⤵
  PID:9096
- C:\Windows\System\PXKrSJB.exe
  C:\Windows\System\PXKrSJB.exe
  2⤵
  PID:8552
- C:\Windows\System\JiVwVVd.exe
  C:\Windows\System\JiVwVVd.exe
  2⤵
  PID:8836
- C:\Windows\System\YHMrJFq.exe
  C:\Windows\System\YHMrJFq.exe
  2⤵
  PID:8948
- C:\Windows\System\NpRGrrM.exe
  C:\Windows\System\NpRGrrM.exe
  2⤵
  PID:8984
- C:\Windows\System\JFyjokK.exe
  C:\Windows\System\JFyjokK.exe
  2⤵
  PID:8700
- C:\Windows\System\bOVAilm.exe
  C:\Windows\System\bOVAilm.exe
  2⤵
  PID:8168
- C:\Windows\System\MHzTpPG.exe
  C:\Windows\System\MHzTpPG.exe
  2⤵
  PID:9232
- C:\Windows\System\eQmOLQy.exe
  C:\Windows\System\eQmOLQy.exe
  2⤵
  PID:9252
- C:\Windows\System\MongFVa.exe
  C:\Windows\System\MongFVa.exe
  2⤵
  PID:9268
- C:\Windows\System\NNuKXKp.exe
  C:\Windows\System\NNuKXKp.exe
  2⤵
  PID:9284
- C:\Windows\System\kBJwCNP.exe
  C:\Windows\System\kBJwCNP.exe
  2⤵
  PID:9308
- C:\Windows\System\rbRipRw.exe
  C:\Windows\System\rbRipRw.exe
  2⤵
  PID:9332
- C:\Windows\System\TwoIRAS.exe
  C:\Windows\System\TwoIRAS.exe
  2⤵
  PID:9356
- C:\Windows\System\XhfTvRi.exe
  C:\Windows\System\XhfTvRi.exe
  2⤵
  PID:9384
- C:\Windows\System\hVQJyrV.exe
  C:\Windows\System\hVQJyrV.exe
  2⤵
  PID:9408
- C:\Windows\System\PFhaXPB.exe
  C:\Windows\System\PFhaXPB.exe
  2⤵
  PID:9428
- C:\Windows\System\CGoOpeg.exe
  C:\Windows\System\CGoOpeg.exe
  2⤵
  PID:9456
- C:\Windows\System\nfiXTWr.exe
  C:\Windows\System\nfiXTWr.exe
  2⤵
  PID:9480
- C:\Windows\System\FNhZSVv.exe
  C:\Windows\System\FNhZSVv.exe
  2⤵
  PID:9500
- C:\Windows\System\HEvjsYq.exe
  C:\Windows\System\HEvjsYq.exe
  2⤵
  PID:9524
- C:\Windows\System\SHZqdgE.exe
  C:\Windows\System\SHZqdgE.exe
  2⤵
  PID:9548
- C:\Windows\System\TuRXjer.exe
  C:\Windows\System\TuRXjer.exe
  2⤵
  PID:9576
- C:\Windows\System\jIolbkS.exe
  C:\Windows\System\jIolbkS.exe
  2⤵
  PID:9600
- C:\Windows\System\LLQwpno.exe
  C:\Windows\System\LLQwpno.exe
  2⤵
  PID:9624
- C:\Windows\System\PToDPcE.exe
  C:\Windows\System\PToDPcE.exe
  2⤵
  PID:9644
- C:\Windows\System\wweOMAh.exe
  C:\Windows\System\wweOMAh.exe
  2⤵
  PID:9668
- C:\Windows\System\pKkGgYj.exe
  C:\Windows\System\pKkGgYj.exe
  2⤵
  PID:9692
- C:\Windows\System\qJOVGzY.exe
  C:\Windows\System\qJOVGzY.exe
  2⤵
  PID:9712
- C:\Windows\System\QwaKlCD.exe
  C:\Windows\System\QwaKlCD.exe
  2⤵
  PID:9740
- C:\Windows\System\bthcIoM.exe
  C:\Windows\System\bthcIoM.exe
  2⤵
  PID:9760
- C:\Windows\System\OoHWOZB.exe
  C:\Windows\System\OoHWOZB.exe
  2⤵
  PID:9788
- C:\Windows\System\qaMyJhq.exe
  C:\Windows\System\qaMyJhq.exe
  2⤵
  PID:9812
- C:\Windows\System\aQjHeVg.exe
  C:\Windows\System\aQjHeVg.exe
  2⤵
  PID:9828
- C:\Windows\System\XDvRCEs.exe
  C:\Windows\System\XDvRCEs.exe
  2⤵
  PID:9860
- C:\Windows\System\SJldzuB.exe
  C:\Windows\System\SJldzuB.exe
  2⤵
  PID:9884
- C:\Windows\System\xYyNwoI.exe
  C:\Windows\System\xYyNwoI.exe
  2⤵
  PID:9904
- C:\Windows\System\sGmKRfb.exe
  C:\Windows\System\sGmKRfb.exe
  2⤵
  PID:9928
- C:\Windows\System\XHgvSzA.exe
  C:\Windows\System\XHgvSzA.exe
  2⤵
  PID:9964
- C:\Windows\System\xNWbmDR.exe
  C:\Windows\System\xNWbmDR.exe
  2⤵
  PID:9988
- C:\Windows\System\uYHcGYb.exe
  C:\Windows\System\uYHcGYb.exe
  2⤵
  PID:10012
- C:\Windows\System\kGdgwEW.exe
  C:\Windows\System\kGdgwEW.exe
  2⤵
  PID:10040
- C:\Windows\System\lltROUH.exe
  C:\Windows\System\lltROUH.exe
  2⤵
  PID:10060
- C:\Windows\System\XTQSrUK.exe
  C:\Windows\System\XTQSrUK.exe
  2⤵
  PID:10088
- C:\Windows\System\KwmDefR.exe
  C:\Windows\System\KwmDefR.exe
  2⤵
  PID:10112
- C:\Windows\System\zLAqmxE.exe
  C:\Windows\System\zLAqmxE.exe
  2⤵
  PID:10140
- C:\Windows\System\SoGuszv.exe
  C:\Windows\System\SoGuszv.exe
  2⤵
  PID:10164
- C:\Windows\System\QignRZB.exe
  C:\Windows\System\QignRZB.exe
  2⤵
  PID:10184
- C:\Windows\System\HpOCdeb.exe
  C:\Windows\System\HpOCdeb.exe
  2⤵
  PID:10208
- C:\Windows\System\IphkMPK.exe
  C:\Windows\System\IphkMPK.exe
  2⤵
  PID:10232
- C:\Windows\System\mNwTKSQ.exe
  C:\Windows\System\mNwTKSQ.exe
  2⤵
  PID:9068
- C:\Windows\System\HvAGEdq.exe
  C:\Windows\System\HvAGEdq.exe
  2⤵
  PID:9172
- C:\Windows\System\GqMdCrQ.exe
  C:\Windows\System\GqMdCrQ.exe
  2⤵
  PID:9180
- C:\Windows\System\RtxomQT.exe
  C:\Windows\System\RtxomQT.exe
  2⤵
  PID:8524
- C:\Windows\System\DaZQTGT.exe
  C:\Windows\System\DaZQTGT.exe
  2⤵
  PID:8872
- C:\Windows\System\StBpreo.exe
  C:\Windows\System\StBpreo.exe
  2⤵
  PID:8916
- C:\Windows\System\banspiu.exe
  C:\Windows\System\banspiu.exe
  2⤵
  PID:8940
- C:\Windows\System\ATtsHgB.exe
  C:\Windows\System\ATtsHgB.exe
  2⤵
  PID:9028
- C:\Windows\System\WFcXGur.exe
  C:\Windows\System\WFcXGur.exe
  2⤵
  PID:8000
- C:\Windows\System\xVBlToD.exe
  C:\Windows\System\xVBlToD.exe
  2⤵
  PID:8716
- C:\Windows\System\iPMIUFI.exe
  C:\Windows\System\iPMIUFI.exe
  2⤵
  PID:9452
- C:\Windows\System\uuccmWx.exe
  C:\Windows\System\uuccmWx.exe
  2⤵
  PID:9536
- C:\Windows\System\lQcqAcH.exe
  C:\Windows\System\lQcqAcH.exe
  2⤵
  PID:7920
- C:\Windows\System\BUDXuOE.exe
  C:\Windows\System\BUDXuOE.exe
  2⤵
  PID:8208
- C:\Windows\System\BaqJiUW.exe
  C:\Windows\System\BaqJiUW.exe
  2⤵
  PID:9280
- C:\Windows\System\LIHRHKY.exe
  C:\Windows\System\LIHRHKY.exe
  2⤵
  PID:9304
- C:\Windows\System\CqwHBwn.exe
  C:\Windows\System\CqwHBwn.exe
  2⤵
  PID:9376
- C:\Windows\System\iTDNjye.exe
  C:\Windows\System\iTDNjye.exe
  2⤵
  PID:8976
- C:\Windows\System\yGHwUiB.exe
  C:\Windows\System\yGHwUiB.exe
  2⤵
  PID:9560
- C:\Windows\System\GITiIOp.exe
  C:\Windows\System\GITiIOp.exe
  2⤵
  PID:8792
- C:\Windows\System\pBcFYQy.exe
  C:\Windows\System\pBcFYQy.exe
  2⤵
  PID:10080
- C:\Windows\System\mZiWBfk.exe
  C:\Windows\System\mZiWBfk.exe
  2⤵
  PID:9632
- C:\Windows\System\bzQgnGD.exe
  C:\Windows\System\bzQgnGD.exe
  2⤵
  PID:9688
- C:\Windows\System\xTEdjAH.exe
  C:\Windows\System\xTEdjAH.exe
  2⤵
  PID:9344
- C:\Windows\System\NucCGJF.exe
  C:\Windows\System\NucCGJF.exe
  2⤵
  PID:10248
- C:\Windows\System\NhMYkaI.exe
  C:\Windows\System\NhMYkaI.exe
  2⤵
  PID:10276
- C:\Windows\System\kcpNXCV.exe
  C:\Windows\System\kcpNXCV.exe
  2⤵
  PID:10300
- C:\Windows\System\IIwUtyO.exe
  C:\Windows\System\IIwUtyO.exe
  2⤵
  PID:10324
- C:\Windows\System\tilaNxU.exe
  C:\Windows\System\tilaNxU.exe
  2⤵
  PID:10340
- C:\Windows\System\QyOanxv.exe
  C:\Windows\System\QyOanxv.exe
  2⤵
  PID:10372
- C:\Windows\System\CWegKkP.exe
  C:\Windows\System\CWegKkP.exe
  2⤵
  PID:10392
- C:\Windows\System\uqBFrYz.exe
  C:\Windows\System\uqBFrYz.exe
  2⤵
  PID:10416
- C:\Windows\System\QDUNcLY.exe
  C:\Windows\System\QDUNcLY.exe
  2⤵
  PID:10440
- C:\Windows\System\NaaHnNZ.exe
  C:\Windows\System\NaaHnNZ.exe
  2⤵
  PID:10460
- C:\Windows\System\ydXFtdi.exe
  C:\Windows\System\ydXFtdi.exe
  2⤵
  PID:10484
- C:\Windows\System\ETrwbqt.exe
  C:\Windows\System\ETrwbqt.exe
  2⤵
  PID:10508
- C:\Windows\System\SwQlbmD.exe
  C:\Windows\System\SwQlbmD.exe
  2⤵
  PID:10524
- C:\Windows\System\rFNVKZZ.exe
  C:\Windows\System\rFNVKZZ.exe
  2⤵
  PID:10548
- C:\Windows\System\qiYBEhn.exe
  C:\Windows\System\qiYBEhn.exe
  2⤵
  PID:10568
- C:\Windows\System\PochJgg.exe
  C:\Windows\System\PochJgg.exe
  2⤵
  PID:10596
- C:\Windows\System\qQzYuJn.exe
  C:\Windows\System\qQzYuJn.exe
  2⤵
  PID:10620
- C:\Windows\System\eXBuWlH.exe
  C:\Windows\System\eXBuWlH.exe
  2⤵
  PID:10644
- C:\Windows\System\LSRrorY.exe
  C:\Windows\System\LSRrorY.exe
  2⤵
  PID:10660
- C:\Windows\System\AwEACvy.exe
  C:\Windows\System\AwEACvy.exe
  2⤵
  PID:10676
- C:\Windows\System\VIyvWUt.exe
  C:\Windows\System\VIyvWUt.exe
  2⤵
  PID:10696
- C:\Windows\System\MMeknhu.exe
  C:\Windows\System\MMeknhu.exe
  2⤵
  PID:10724
- C:\Windows\System\Ytfwgbz.exe
  C:\Windows\System\Ytfwgbz.exe
  2⤵
  PID:10752
- C:\Windows\System\xglNLGl.exe
  C:\Windows\System\xglNLGl.exe
  2⤵
  PID:10772
- C:\Windows\System\GdqcdHy.exe
  C:\Windows\System\GdqcdHy.exe
  2⤵
  PID:10804
- C:\Windows\System\zgCcyUL.exe
  C:\Windows\System\zgCcyUL.exe
  2⤵
  PID:10832
- C:\Windows\System\xairLQY.exe
  C:\Windows\System\xairLQY.exe
  2⤵
  PID:10856
- C:\Windows\System\JdKOaDa.exe
  C:\Windows\System\JdKOaDa.exe
  2⤵
  PID:10880
- C:\Windows\System\hqNINvq.exe
  C:\Windows\System\hqNINvq.exe
  2⤵
  PID:10908
- C:\Windows\System\omGZdPX.exe
  C:\Windows\System\omGZdPX.exe
  2⤵
  PID:10932
- C:\Windows\System\BGeGKjP.exe
  C:\Windows\System\BGeGKjP.exe
  2⤵
  PID:11136
- C:\Windows\System\FLSUTxc.exe
  C:\Windows\System\FLSUTxc.exe
  2⤵
  PID:11152
- C:\Windows\System\JvKFWRi.exe
  C:\Windows\System\JvKFWRi.exe
  2⤵
  PID:11172
- C:\Windows\System\iYScUTQ.exe
  C:\Windows\System\iYScUTQ.exe
  2⤵
  PID:11188
- C:\Windows\System\xXOKDko.exe
  C:\Windows\System\xXOKDko.exe
  2⤵
  PID:11212
- C:\Windows\System\lirVajw.exe
  C:\Windows\System\lirVajw.exe
  2⤵
  PID:11228
- C:\Windows\System\Rvkkslt.exe
  C:\Windows\System\Rvkkslt.exe
  2⤵
  PID:11248
- C:\Windows\System\WncpvAy.exe
  C:\Windows\System\WncpvAy.exe
  2⤵
  PID:9404
- C:\Windows\System\fsWSjeN.exe
  C:\Windows\System\fsWSjeN.exe
  2⤵
  PID:9876
- C:\Windows\System\vQDXyWn.exe
  C:\Windows\System\vQDXyWn.exe
  2⤵
  PID:9476
- C:\Windows\System\xTCARTW.exe
  C:\Windows\System\xTCARTW.exe
  2⤵
  PID:9512
- C:\Windows\System\OfmQSaq.exe
  C:\Windows\System\OfmQSaq.exe
  2⤵
  PID:9260
- C:\Windows\System\eXqRIRD.exe
  C:\Windows\System\eXqRIRD.exe
  2⤵
  PID:9608
- C:\Windows\System\SmZAoLq.exe
  C:\Windows\System\SmZAoLq.exe
  2⤵
  PID:10068
- C:\Windows\System\skGKvDK.exe
  C:\Windows\System\skGKvDK.exe
  2⤵
  PID:10108
- C:\Windows\System\PQSEoPo.exe
  C:\Windows\System\PQSEoPo.exe
  2⤵
  PID:10156
- C:\Windows\System\QJwpQYD.exe
  C:\Windows\System\QJwpQYD.exe
  2⤵
  PID:9732
- C:\Windows\System\YCwwqmh.exe
  C:\Windows\System\YCwwqmh.exe
  2⤵
  PID:10388
- C:\Windows\System\QqjNgId.exe
  C:\Windows\System\QqjNgId.exe
  2⤵
  PID:8896
- C:\Windows\System\vUlrvjw.exe
  C:\Windows\System\vUlrvjw.exe
  2⤵
  PID:9940
- C:\Windows\System\xnDupdy.exe
  C:\Windows\System\xnDupdy.exe
  2⤵
  PID:7812
- C:\Windows\System\olSxmSW.exe
  C:\Windows\System\olSxmSW.exe
  2⤵
  PID:10584
- C:\Windows\System\TkVYsrx.exe
  C:\Windows\System\TkVYsrx.exe
  2⤵
  PID:10672
- C:\Windows\System\rIAXsaY.exe
  C:\Windows\System\rIAXsaY.exe
  2⤵
  PID:8652
- C:\Windows\System\APsFjQL.exe
  C:\Windows\System\APsFjQL.exe
  2⤵
  PID:10160
- C:\Windows\System\gfPLgFf.exe
  C:\Windows\System\gfPLgFf.exe
  2⤵
  PID:10892
- C:\Windows\System\LGgMXBj.exe
  C:\Windows\System\LGgMXBj.exe
  2⤵
  PID:8696
- C:\Windows\System\llVAGUq.exe
  C:\Windows\System\llVAGUq.exe
  2⤵
  PID:9316
- C:\Windows\System\asKHnEx.exe
  C:\Windows\System\asKHnEx.exe
  2⤵
  PID:10256
- C:\Windows\System\ScCHPwI.exe
  C:\Windows\System\ScCHPwI.exe
  2⤵
  PID:10292
- C:\Windows\System\mrTarsn.exe
  C:\Windows\System\mrTarsn.exe
  2⤵
  PID:8240
- C:\Windows\System\MJqonvY.exe
  C:\Windows\System\MJqonvY.exe
  2⤵
  PID:8980
- C:\Windows\System\BJVCjmY.exe
  C:\Windows\System\BJVCjmY.exe
  2⤵
  PID:7816
- C:\Windows\System\fZrrdQI.exe
  C:\Windows\System\fZrrdQI.exe
  2⤵
  PID:10748
- C:\Windows\System\EYQcuwL.exe
  C:\Windows\System\EYQcuwL.exe
  2⤵
  PID:9400
- C:\Windows\System\AkGAvvO.exe
  C:\Windows\System\AkGAvvO.exe
  2⤵
  PID:8352
- C:\Windows\System\VFSbObh.exe
  C:\Windows\System\VFSbObh.exe
  2⤵
  PID:10864
- C:\Windows\System\UFHNEYs.exe
  C:\Windows\System\UFHNEYs.exe
  2⤵
  PID:11280
- C:\Windows\System\xeHywGO.exe
  C:\Windows\System\xeHywGO.exe
  2⤵
  PID:11312
- C:\Windows\System\mvcohxL.exe
  C:\Windows\System\mvcohxL.exe
  2⤵
  PID:11328
- C:\Windows\System\zDxDxva.exe
  C:\Windows\System\zDxDxva.exe
  2⤵
  PID:11356
- C:\Windows\System\AcgwZIe.exe
  C:\Windows\System\AcgwZIe.exe
  2⤵
  PID:11376
- C:\Windows\System\VAGdyQr.exe
  C:\Windows\System\VAGdyQr.exe
  2⤵
  PID:11392
- C:\Windows\System\KZFVQPz.exe
  C:\Windows\System\KZFVQPz.exe
  2⤵
  PID:11428
- C:\Windows\System\GiYyIZs.exe
  C:\Windows\System\GiYyIZs.exe
  2⤵
  PID:11448
- C:\Windows\System\NUOFrjo.exe
  C:\Windows\System\NUOFrjo.exe
  2⤵
  PID:11472
- C:\Windows\System\jVWzecs.exe
  C:\Windows\System\jVWzecs.exe
  2⤵
  PID:11496
- C:\Windows\System\CTRECay.exe
  C:\Windows\System\CTRECay.exe
  2⤵
  PID:11516
- C:\Windows\System\aBGabkz.exe
  C:\Windows\System\aBGabkz.exe
  2⤵
  PID:11540
- C:\Windows\System\coGaaAN.exe
  C:\Windows\System\coGaaAN.exe
  2⤵
  PID:11576
- C:\Windows\System\gKIbmdY.exe
  C:\Windows\System\gKIbmdY.exe
  2⤵
  PID:11604
- C:\Windows\System\JUZmpzk.exe
  C:\Windows\System\JUZmpzk.exe
  2⤵
  PID:11632
- C:\Windows\System\sQFYsvM.exe
  C:\Windows\System\sQFYsvM.exe
  2⤵
  PID:11648
- C:\Windows\System\EdLcZDc.exe
  C:\Windows\System\EdLcZDc.exe
  2⤵
  PID:11676
- C:\Windows\System\UNWrgqm.exe
  C:\Windows\System\UNWrgqm.exe
  2⤵
  PID:11700
- C:\Windows\System\lsywlfB.exe
  C:\Windows\System\lsywlfB.exe
  2⤵
  PID:11720
- C:\Windows\System\BQZizaU.exe
  C:\Windows\System\BQZizaU.exe
  2⤵
  PID:11760
- C:\Windows\System\RbiXrFn.exe
  C:\Windows\System\RbiXrFn.exe
  2⤵
  PID:11792
- C:\Windows\System\JVyASkA.exe
  C:\Windows\System\JVyASkA.exe
  2⤵
  PID:11820
- C:\Windows\System\Jjdzoat.exe
  C:\Windows\System\Jjdzoat.exe
  2⤵
  PID:11852
- C:\Windows\System\idHPDcz.exe
  C:\Windows\System\idHPDcz.exe
  2⤵
  PID:11872
- C:\Windows\System\lijFuGX.exe
  C:\Windows\System\lijFuGX.exe
  2⤵
  PID:11896
- C:\Windows\System\kMtxbIe.exe
  C:\Windows\System\kMtxbIe.exe
  2⤵
  PID:11924
- C:\Windows\System\EoiiyiV.exe
  C:\Windows\System\EoiiyiV.exe
  2⤵
  PID:11948
- C:\Windows\System\uPEkSsj.exe
  C:\Windows\System\uPEkSsj.exe
  2⤵
  PID:11980
- C:\Windows\System\EfAjbEG.exe
  C:\Windows\System\EfAjbEG.exe
  2⤵
  PID:12004
- C:\Windows\System\oRoQHpv.exe
  C:\Windows\System\oRoQHpv.exe
  2⤵
  PID:12020
- C:\Windows\System\GdrWEri.exe
  C:\Windows\System\GdrWEri.exe
  2⤵
  PID:12044
- C:\Windows\System\AvjvtkB.exe
  C:\Windows\System\AvjvtkB.exe
  2⤵
  PID:12064
- C:\Windows\System\DVflrgE.exe
  C:\Windows\System\DVflrgE.exe
  2⤵
  PID:12084
- C:\Windows\System\eNVukRP.exe
  C:\Windows\System\eNVukRP.exe
  2⤵
  PID:12112
- C:\Windows\System\ANIQSnu.exe
  C:\Windows\System\ANIQSnu.exe
  2⤵
  PID:12128
- C:\Windows\System\ZvJeXHc.exe
  C:\Windows\System\ZvJeXHc.exe
  2⤵
  PID:12156
- C:\Windows\System\wyvODyp.exe
  C:\Windows\System\wyvODyp.exe
  2⤵
  PID:12180
- C:\Windows\System\MzBfijv.exe
  C:\Windows\System\MzBfijv.exe
  2⤵
  PID:12196
- C:\Windows\System\GyTOOYD.exe
  C:\Windows\System\GyTOOYD.exe
  2⤵
  PID:12212
- C:\Windows\System\ZhtPvDx.exe
  C:\Windows\System\ZhtPvDx.exe
  2⤵
  PID:12236
- C:\Windows\System\PLCOhmN.exe
  C:\Windows\System\PLCOhmN.exe
  2⤵
  PID:12252
- C:\Windows\System\EwxwuVl.exe
  C:\Windows\System\EwxwuVl.exe
  2⤵
  PID:12284
- C:\Windows\System\xAHVjrD.exe
  C:\Windows\System\xAHVjrD.exe
  2⤵
  PID:10924
- C:\Windows\System\EnbaOYN.exe
  C:\Windows\System\EnbaOYN.exe
  2⤵
  PID:10956
- C:\Windows\System\KTSYJOO.exe
  C:\Windows\System\KTSYJOO.exe
  2⤵
  PID:10312
- C:\Windows\System\KIHBtud.exe
  C:\Windows\System\KIHBtud.exe
  2⤵
  PID:10360
- C:\Windows\System\qjRpnot.exe
  C:\Windows\System\qjRpnot.exe
  2⤵
  PID:8884
- C:\Windows\System\TTPhcgH.exe
  C:\Windows\System\TTPhcgH.exe
  2⤵
  PID:7548
- C:\Windows\System\WNegvex.exe
  C:\Windows\System\WNegvex.exe
  2⤵
  PID:10608
- C:\Windows\System\DcgBszC.exe
  C:\Windows\System\DcgBszC.exe
  2⤵
  PID:11148
- C:\Windows\System\clfQmGO.exe
  C:\Windows\System\clfQmGO.exe
  2⤵
  PID:11208
- C:\Windows\System\xDtFUZR.exe
  C:\Windows\System\xDtFUZR.exe
  2⤵
  PID:10480
- C:\Windows\System\oyZxkYX.exe
  C:\Windows\System\oyZxkYX.exe
  2⤵
  PID:9436
- C:\Windows\System\EsonPSR.exe
  C:\Windows\System\EsonPSR.exe
  2⤵
  PID:9896
- C:\Windows\System\uPFTLTG.exe
  C:\Windows\System\uPFTLTG.exe
  2⤵
  PID:10876
- C:\Windows\System\DQdZkRj.exe
  C:\Windows\System\DQdZkRj.exe
  2⤵
  PID:11300
- C:\Windows\System\KxRPfQp.exe
  C:\Windows\System\KxRPfQp.exe
  2⤵
  PID:9492
- C:\Windows\System\YNnbpqB.exe
  C:\Windows\System\YNnbpqB.exe
  2⤵
  PID:11384
- C:\Windows\System\JtazSNa.exe
  C:\Windows\System\JtazSNa.exe
  2⤵
  PID:11556
- C:\Windows\System\UZEMafK.exe
  C:\Windows\System\UZEMafK.exe
  2⤵
  PID:11588
- C:\Windows\System\mzxpmiH.exe
  C:\Windows\System\mzxpmiH.exe
  2⤵
  PID:11788
- C:\Windows\System\TXDncBs.exe
  C:\Windows\System\TXDncBs.exe
  2⤵
  PID:10180
- C:\Windows\System\hGKQRSI.exe
  C:\Windows\System\hGKQRSI.exe
  2⤵
  PID:11936
- C:\Windows\System\xczwTPP.exe
  C:\Windows\System\xczwTPP.exe
  2⤵
  PID:12312
- C:\Windows\System\vnkhQBM.exe
  C:\Windows\System\vnkhQBM.exe
  2⤵
  PID:12336
- C:\Windows\System\bGuixoV.exe
  C:\Windows\System\bGuixoV.exe
  2⤵
  PID:12356
- C:\Windows\System\UmmFqRK.exe
  C:\Windows\System\UmmFqRK.exe
  2⤵
  PID:12376
- C:\Windows\System\SXqBMCl.exe
  C:\Windows\System\SXqBMCl.exe
  2⤵
  PID:12400
- C:\Windows\System\gSyjaFa.exe
  C:\Windows\System\gSyjaFa.exe
  2⤵
  PID:12420
- C:\Windows\System\tKOfSUG.exe
  C:\Windows\System\tKOfSUG.exe
  2⤵
  PID:12448
- C:\Windows\System\WgXHVdO.exe
  C:\Windows\System\WgXHVdO.exe
  2⤵
  PID:12468
- C:\Windows\System\wBKlMzN.exe
  C:\Windows\System\wBKlMzN.exe
  2⤵
  PID:12484
- C:\Windows\System\mbVkYwx.exe
  C:\Windows\System\mbVkYwx.exe
  2⤵
  PID:12504
- C:\Windows\System\pxaRpWu.exe
  C:\Windows\System\pxaRpWu.exe
  2⤵
  PID:12524
- C:\Windows\System\CGzIfxW.exe
  C:\Windows\System\CGzIfxW.exe
  2⤵
  PID:12548
- C:\Windows\System\UibnqQn.exe
  C:\Windows\System\UibnqQn.exe
  2⤵
  PID:12568
- C:\Windows\System\PfjcLay.exe
  C:\Windows\System\PfjcLay.exe
  2⤵
  PID:12604
- C:\Windows\System\mAWMzgL.exe
  C:\Windows\System\mAWMzgL.exe
  2⤵
  PID:12624
- C:\Windows\System\RYkyTKi.exe
  C:\Windows\System\RYkyTKi.exe
  2⤵
  PID:12648
- C:\Windows\System\oXhqelC.exe
  C:\Windows\System\oXhqelC.exe
  2⤵
  PID:12672
- C:\Windows\System\LjCCJDM.exe
  C:\Windows\System\LjCCJDM.exe
  2⤵
  PID:12696
- C:\Windows\System\NOYfysk.exe
  C:\Windows\System\NOYfysk.exe
  2⤵
  PID:12720
- C:\Windows\System\qmHKptT.exe
  C:\Windows\System\qmHKptT.exe
  2⤵
  PID:12744
- C:\Windows\System\uhJNtNP.exe
  C:\Windows\System\uhJNtNP.exe
  2⤵
  PID:12768
- C:\Windows\System\rFFRjFp.exe
  C:\Windows\System\rFFRjFp.exe
  2⤵
  PID:12784
- C:\Windows\System\DpeOYFQ.exe
  C:\Windows\System\DpeOYFQ.exe
  2⤵
  PID:12808
- C:\Windows\System\cYTiZGx.exe
  C:\Windows\System\cYTiZGx.exe
  2⤵
  PID:12844
- C:\Windows\System\NlJygbh.exe
  C:\Windows\System\NlJygbh.exe
  2⤵
  PID:12860
- C:\Windows\System\MTUResU.exe
  C:\Windows\System\MTUResU.exe
  2⤵
  PID:12888
- C:\Windows\System\RtzCJmR.exe
  C:\Windows\System\RtzCJmR.exe
  2⤵
  PID:12916
- C:\Windows\System\rcCJIoE.exe
  C:\Windows\System\rcCJIoE.exe
  2⤵
  PID:12940
- C:\Windows\System\wjcuhtn.exe
  C:\Windows\System\wjcuhtn.exe
  2⤵
  PID:12956
- C:\Windows\System\JOCfycQ.exe
  C:\Windows\System\JOCfycQ.exe
  2⤵
  PID:12980
- C:\Windows\System\WlKFukL.exe
  C:\Windows\System\WlKFukL.exe
  2⤵
  PID:12996
- C:\Windows\System\PdqAckd.exe
  C:\Windows\System\PdqAckd.exe
  2⤵
  PID:13020
- C:\Windows\System\uZlulfZ.exe
  C:\Windows\System\uZlulfZ.exe
  2⤵
  PID:13036
- C:\Windows\System\UmYImhS.exe
  C:\Windows\System\UmYImhS.exe
  2⤵
  PID:13064
- C:\Windows\System\IRooQhT.exe
  C:\Windows\System\IRooQhT.exe
  2⤵
  PID:13084
- C:\Windows\System\qBZCTgc.exe
  C:\Windows\System\qBZCTgc.exe
  2⤵
  PID:13112
- C:\Windows\System\sUyboFP.exe
  C:\Windows\System\sUyboFP.exe
  2⤵
  PID:13136
- C:\Windows\System\LHLRIkv.exe
  C:\Windows\System\LHLRIkv.exe
  2⤵
  PID:11200
- C:\Windows\System\aoQkRaX.exe
  C:\Windows\System\aoQkRaX.exe
  2⤵
  PID:11684
- C:\Windows\System\UYGwDHs.exe
  C:\Windows\System\UYGwDHs.exe
  2⤵
  PID:11716
- C:\Windows\System\cppnwfd.exe
  C:\Windows\System\cppnwfd.exe
  2⤵
  PID:9572
- C:\Windows\System\QeTOrcC.exe
  C:\Windows\System\QeTOrcC.exe
  2⤵
  PID:11800
- C:\Windows\System\VouCJwp.exe
  C:\Windows\System\VouCJwp.exe
  2⤵
  PID:11864
- C:\Windows\System\KuxkLyp.exe
  C:\Windows\System\KuxkLyp.exe
  2⤵
  PID:11944
- C:\Windows\System\YslPVRA.exe
  C:\Windows\System\YslPVRA.exe
  2⤵
  PID:12304
- C:\Windows\System\OoqcEik.exe
  C:\Windows\System\OoqcEik.exe
  2⤵
  PID:12324
- C:\Windows\System\Xrforzw.exe
  C:\Windows\System\Xrforzw.exe
  2⤵
  PID:12012
- C:\Windows\System\vkXIfJf.exe
  C:\Windows\System\vkXIfJf.exe
  2⤵
  PID:12108
- C:\Windows\System\xxwLpOq.exe
  C:\Windows\System\xxwLpOq.exe
  2⤵
  PID:12144
- C:\Windows\System\fBNtmFi.exe
  C:\Windows\System\fBNtmFi.exe
  2⤵
  PID:12172
- C:\Windows\System\JmyvvEt.exe
  C:\Windows\System\JmyvvEt.exe
  2⤵
  PID:12544
- C:\Windows\System\cUmDXCT.exe
  C:\Windows\System\cUmDXCT.exe
  2⤵
  PID:12580
- C:\Windows\System\gyVpkbY.exe
  C:\Windows\System\gyVpkbY.exe
  2⤵
  PID:12612
- C:\Windows\System\sciDQlo.exe
  C:\Windows\System\sciDQlo.exe
  2⤵
  PID:12644
- C:\Windows\System\grsdAmr.exe
  C:\Windows\System\grsdAmr.exe
  2⤵
  PID:12708
- C:\Windows\System\IhhuBfA.exe
  C:\Windows\System\IhhuBfA.exe
  2⤵
  PID:11416
- C:\Windows\System\WQloLBE.exe
  C:\Windows\System\WQloLBE.exe
  2⤵
  PID:12872
- C:\Windows\System\dQgxEUx.exe
  C:\Windows\System\dQgxEUx.exe
  2⤵
  PID:12912
- C:\Windows\System\bGbcHQz.exe
  C:\Windows\System\bGbcHQz.exe
  2⤵
  PID:11180
- C:\Windows\System\qDbFvjf.exe
  C:\Windows\System\qDbFvjf.exe
  2⤵
  PID:10816
- C:\Windows\System\KduGtyB.exe
  C:\Windows\System\KduGtyB.exe
  2⤵
  PID:13132
- C:\Windows\System\YbqvCQi.exe
  C:\Windows\System\YbqvCQi.exe
  2⤵
  PID:11916
- C:\Windows\System\RvQhgKT.exe
  C:\Windows\System\RvQhgKT.exe
  2⤵
  PID:12564
- C:\Windows\System\EAUMOFM.exe
  C:\Windows\System\EAUMOFM.exe
  2⤵
  PID:12712
- C:\Windows\System\xQVKOGM.exe
  C:\Windows\System\xQVKOGM.exe
  2⤵
  PID:11032
- C:\Windows\System\yepGBUI.exe
  C:\Windows\System\yepGBUI.exe
  2⤵
  PID:10604
- C:\Windows\System\OYNWrsY.exe
  C:\Windows\System\OYNWrsY.exe
  2⤵
  PID:13008
- C:\Windows\System\KqNcYwM.exe
  C:\Windows\System\KqNcYwM.exe
  2⤵
  PID:13100
- C:\Windows\System\CCDjyLQ.exe
  C:\Windows\System\CCDjyLQ.exe
  2⤵
  PID:11364
- C:\Windows\System\xiqGLnv.exe
  C:\Windows\System\xiqGLnv.exe
  2⤵
  PID:10652
- C:\Windows\System\lJtnYbj.exe
  C:\Windows\System\lJtnYbj.exe
  2⤵
  PID:10100
- C:\Windows\System\XOkdxRG.exe
  C:\Windows\System\XOkdxRG.exe
  2⤵
  PID:13316
- C:\Windows\System\XJkHqFV.exe
  C:\Windows\System\XJkHqFV.exe
  2⤵
  PID:13344
- C:\Windows\System\OWRGLDm.exe
  C:\Windows\System\OWRGLDm.exe
  2⤵
  PID:13372
- C:\Windows\System\dRNXgaA.exe
  C:\Windows\System\dRNXgaA.exe
  2⤵
  PID:13396
- C:\Windows\System\UeZevsd.exe
  C:\Windows\System\UeZevsd.exe
  2⤵
  PID:13412
- C:\Windows\System\EfWkQKs.exe
  C:\Windows\System\EfWkQKs.exe
  2⤵
  PID:13428
- C:\Windows\System\IyyqwFQ.exe
  C:\Windows\System\IyyqwFQ.exe
  2⤵
  PID:13452
- C:\Windows\System\TYpkKnR.exe
  C:\Windows\System\TYpkKnR.exe
  2⤵
  PID:13468
- C:\Windows\System\nrdaEeN.exe
  C:\Windows\System\nrdaEeN.exe
  2⤵
  PID:13488
- C:\Windows\System\kDWnlfv.exe
  C:\Windows\System\kDWnlfv.exe
  2⤵
  PID:13508
- C:\Windows\System\WjnSLJT.exe
  C:\Windows\System\WjnSLJT.exe
  2⤵
  PID:13524
- C:\Windows\System\fPCHLUr.exe
  C:\Windows\System\fPCHLUr.exe
  2⤵
  PID:13556
- C:\Windows\System\vVsfuhD.exe
  C:\Windows\System\vVsfuhD.exe
  2⤵
  PID:13584
- C:\Windows\System\maoXIiF.exe
  C:\Windows\System\maoXIiF.exe
  2⤵
  PID:13608
- C:\Windows\System\fLHjjbY.exe
  C:\Windows\System\fLHjjbY.exe
  2⤵
  PID:13644
- C:\Windows\System\RTfTcUq.exe
  C:\Windows\System\RTfTcUq.exe
  2⤵
  PID:13672
- C:\Windows\System\qRzNunQ.exe
  C:\Windows\System\qRzNunQ.exe
  2⤵
  PID:13708
- C:\Windows\System\ZOLrAsB.exe
  C:\Windows\System\ZOLrAsB.exe
  2⤵
  PID:13740
- C:\Windows\System\IWmIlBf.exe
  C:\Windows\System\IWmIlBf.exe
  2⤵
  PID:13764
- C:\Windows\System\favkWxq.exe
  C:\Windows\System\favkWxq.exe
  2⤵
  PID:13800
- C:\Windows\System\KwbSruj.exe
  C:\Windows\System\KwbSruj.exe
  2⤵
  PID:13836
- C:\Windows\System\EHXUAQk.exe
  C:\Windows\System\EHXUAQk.exe
  2⤵
  PID:13856
- C:\Windows\System\fUaPgtM.exe
  C:\Windows\System\fUaPgtM.exe
  2⤵
  PID:13892
- C:\Windows\System\MyZAGbO.exe
  C:\Windows\System\MyZAGbO.exe
  2⤵
  PID:13916
- C:\Windows\System\vLIrLKF.exe
  C:\Windows\System\vLIrLKF.exe
  2⤵
  PID:13940
- C:\Windows\System\XzHzfGj.exe
  C:\Windows\System\XzHzfGj.exe
  2⤵
  PID:13968
- C:\Windows\System\RMlMOUe.exe
  C:\Windows\System\RMlMOUe.exe
  2⤵
  PID:13996
- C:\Windows\System\wlKmjLq.exe
  C:\Windows\System\wlKmjLq.exe
  2⤵
  PID:14036
- C:\Windows\System\XxvOyoy.exe
  C:\Windows\System\XxvOyoy.exe
  2⤵
  PID:14060
- C:\Windows\System\hFBzoIb.exe
  C:\Windows\System\hFBzoIb.exe
  2⤵
  PID:14096
- C:\Windows\System\DjAklKa.exe
  C:\Windows\System\DjAklKa.exe
  2⤵
  PID:14128
- C:\Windows\System\QlZLqZV.exe
  C:\Windows\System\QlZLqZV.exe
  2⤵
  PID:14148
- C:\Windows\System\YGMSLPy.exe
  C:\Windows\System\YGMSLPy.exe
  2⤵
  PID:14164
- C:\Windows\System\CtRxXjc.exe
  C:\Windows\System\CtRxXjc.exe
  2⤵
  PID:14196
- C:\Windows\System\gHNcrVF.exe
  C:\Windows\System\gHNcrVF.exe
  2⤵
  PID:14220
- C:\Windows\System\kvDkrMe.exe
  C:\Windows\System\kvDkrMe.exe
  2⤵
  PID:14256
- C:\Windows\System\mRredEh.exe
  C:\Windows\System\mRredEh.exe
  2⤵
  PID:14276
- C:\Windows\System\LcGluvf.exe
  C:\Windows\System\LcGluvf.exe
  2⤵
  PID:14304
- C:\Windows\System\QMpMKbn.exe
  C:\Windows\System\QMpMKbn.exe
  2⤵
  PID:14320
- C:\Windows\System\pvoQXHd.exe
  C:\Windows\System\pvoQXHd.exe
  2⤵
  PID:13160
- C:\Windows\System\qpYamwG.exe
  C:\Windows\System\qpYamwG.exe
  2⤵
  PID:12140
- C:\Windows\System\LPZjPDI.exe
  C:\Windows\System\LPZjPDI.exe
  2⤵
  PID:13204
- C:\Windows\System\QziRvHD.exe
  C:\Windows\System\QziRvHD.exe
  2⤵
  PID:12480
- C:\Windows\System\oUbuamc.exe
  C:\Windows\System\oUbuamc.exe
  2⤵
  PID:12776
- C:\Windows\System\dTSdxwb.exe
  C:\Windows\System\dTSdxwb.exe
  2⤵
  PID:13284
- C:\Windows\System\gZvicbb.exe
  C:\Windows\System\gZvicbb.exe
  2⤵
  PID:12904
- C:\Windows\System\zNRiUvN.exe
  C:\Windows\System\zNRiUvN.exe
  2⤵
  PID:12976
- C:\Windows\System\YHGQziX.exe
  C:\Windows\System\YHGQziX.exe
  2⤵
  PID:13016
- C:\Windows\System\EhWlCpq.exe
  C:\Windows\System\EhWlCpq.exe
  2⤵
  PID:13052
- C:\Windows\System\ZGyinYk.exe
  C:\Windows\System\ZGyinYk.exe
  2⤵
  PID:13124
- C:\Windows\System\QfBcMXb.exe
  C:\Windows\System\QfBcMXb.exe
  2⤵
  PID:10456
- C:\Windows\System\dpBVkca.exe
  C:\Windows\System\dpBVkca.exe
  2⤵
  PID:11324
- C:\Windows\System\qOsVNgX.exe
  C:\Windows\System\qOsVNgX.exe
  2⤵
  PID:11912
- C:\Windows\System\woOIkZJ.exe
  C:\Windows\System\woOIkZJ.exe
  2⤵
  PID:11960
- C:\Windows\System\zDaZDMG.exe
  C:\Windows\System\zDaZDMG.exe
  2⤵
  PID:13192
- C:\Windows\System\DBlxFuN.exe
  C:\Windows\System\DBlxFuN.exe
  2⤵
  PID:12512
- C:\Windows\System\oECdvKw.exe
  C:\Windows\System\oECdvKw.exe
  2⤵
  PID:12560
- C:\Windows\System\hhHWfAc.exe
  C:\Windows\System\hhHWfAc.exe
  2⤵
  PID:14364
- C:\Windows\System\VSaqYXO.exe
  C:\Windows\System\VSaqYXO.exe
  2⤵
  PID:14384
- C:\Windows\System\qZSCUoA.exe
  C:\Windows\System\qZSCUoA.exe
  2⤵
  PID:14408
- C:\Windows\System\DnRJTCN.exe
  C:\Windows\System\DnRJTCN.exe
  2⤵
  PID:14428
- C:\Windows\System\YEWmwhx.exe
  C:\Windows\System\YEWmwhx.exe
  2⤵
  PID:14456
- C:\Windows\System\weFqvad.exe
  C:\Windows\System\weFqvad.exe
  2⤵
  PID:14476
- C:\Windows\System\VtGpvNO.exe
  C:\Windows\System\VtGpvNO.exe
  2⤵
  PID:14496
- C:\Windows\System\JTgTNqy.exe
  C:\Windows\System\JTgTNqy.exe
  2⤵
  PID:14520
- C:\Windows\System\lCCypaH.exe
  C:\Windows\System\lCCypaH.exe
  2⤵
  PID:14536
- C:\Windows\System\eLZpEmx.exe
  C:\Windows\System\eLZpEmx.exe
  2⤵
  PID:14564
- C:\Windows\System\DsXOCDT.exe
  C:\Windows\System\DsXOCDT.exe
  2⤵
  PID:14588
- C:\Windows\System\PvrjUFD.exe
  C:\Windows\System\PvrjUFD.exe
  2⤵
  PID:14612
- C:\Windows\System\BHghVQy.exe
  C:\Windows\System\BHghVQy.exe
  2⤵
  PID:14636
- C:\Windows\System\mrJgUZP.exe
  C:\Windows\System\mrJgUZP.exe
  2⤵
  PID:14656
- C:\Windows\System\ctIRLMu.exe
  C:\Windows\System\ctIRLMu.exe
  2⤵
  PID:14680
- C:\Windows\System\qpRLVvU.exe
  C:\Windows\System\qpRLVvU.exe
  2⤵
  PID:14720
- C:\Windows\System\btUOajq.exe
  C:\Windows\System\btUOajq.exe
  2⤵
  PID:14744
- C:\Windows\System\pzPQvXF.exe
  C:\Windows\System\pzPQvXF.exe
  2⤵
  PID:14760
- C:\Windows\System\rupfUwm.exe
  C:\Windows\System\rupfUwm.exe
  2⤵
  PID:14788
- C:\Windows\System\zRWBFxq.exe
  C:\Windows\System\zRWBFxq.exe
  2⤵
  PID:14804
- C:\Windows\System\HKWGhAF.exe
  C:\Windows\System\HKWGhAF.exe
  2⤵
  PID:14828
- C:\Windows\System\gbouWts.exe
  C:\Windows\System\gbouWts.exe
  2⤵
  PID:14848
- C:\Windows\System\LRJZyXc.exe
  C:\Windows\System\LRJZyXc.exe
  2⤵
  PID:14876
- C:\Windows\System\ZNycXFN.exe
  C:\Windows\System\ZNycXFN.exe
  2⤵
  PID:14900
- C:\Windows\System\MMmiQNg.exe
  C:\Windows\System\MMmiQNg.exe
  2⤵
  PID:14920
- C:\Windows\System\muoZVZE.exe
  C:\Windows\System\muoZVZE.exe
  2⤵
  PID:14936
- C:\Windows\System\HdHhDpj.exe
  C:\Windows\System\HdHhDpj.exe
  2⤵
  PID:14952
- C:\Windows\System\Eidtlqs.exe
  C:\Windows\System\Eidtlqs.exe
  2⤵
  PID:14980
- C:\Windows\System\iGVGScW.exe
  C:\Windows\System\iGVGScW.exe
  2⤵
  PID:15000
- C:\Windows\System\XdVvObk.exe
  C:\Windows\System\XdVvObk.exe
  2⤵
  PID:15032
- C:\Windows\System\WYAtwkg.exe
  C:\Windows\System\WYAtwkg.exe
  2⤵
  PID:15052
- C:\Windows\System\rRllyGh.exe
  C:\Windows\System\rRllyGh.exe
  2⤵
  PID:15068
- C:\Windows\System\pbWbejI.exe
  C:\Windows\System\pbWbejI.exe
  2⤵
  PID:15096
- C:\Windows\System\GuLXAaJ.exe
  C:\Windows\System\GuLXAaJ.exe
  2⤵
  PID:15116
- C:\Windows\System\loaESCD.exe
  C:\Windows\System\loaESCD.exe
  2⤵
  PID:15140
- C:\Windows\System\outkWAh.exe
  C:\Windows\System\outkWAh.exe
  2⤵
  PID:15164
- C:\Windows\System\wdscQoY.exe
  C:\Windows\System\wdscQoY.exe
  2⤵
  PID:15180
- C:\Windows\System\IXtztmC.exe
  C:\Windows\System\IXtztmC.exe
  2⤵
  PID:15212
- C:\Windows\System\BgdMISO.exe
  C:\Windows\System\BgdMISO.exe
  2⤵
  PID:15232
- C:\Windows\System\FCtIrAJ.exe
  C:\Windows\System\FCtIrAJ.exe
  2⤵
  PID:15248
- C:\Windows\System\knnqDJa.exe
  C:\Windows\System\knnqDJa.exe
  2⤵
  PID:15268
- C:\Windows\System\McIklxU.exe
  C:\Windows\System\McIklxU.exe
  2⤵
  PID:15300
- C:\Windows\System\VlGPZqj.exe
  C:\Windows\System\VlGPZqj.exe
  2⤵
  PID:15316
- C:\Windows\System\OFeZZZc.exe
  C:\Windows\System\OFeZZZc.exe
  2⤵
  PID:15340
- C:\Windows\System\rTlqIaH.exe
  C:\Windows\System\rTlqIaH.exe
  2⤵
  PID:12592
- C:\Windows\System\nvaUEOu.exe
  C:\Windows\System\nvaUEOu.exe
  2⤵
  PID:12232
- C:\Windows\System\JwNDgyZ.exe
  C:\Windows\System\JwNDgyZ.exe
  2⤵
  PID:12664
- C:\Windows\System\SFvFZzd.exe
  C:\Windows\System\SFvFZzd.exe
  2⤵
  PID:13240
- C:\Windows\System\IHbVCfs.exe
  C:\Windows\System\IHbVCfs.exe
  2⤵
  PID:13728
- C:\Windows\System\sfbaCRx.exe
  C:\Windows\System\sfbaCRx.exe
  2⤵
  PID:11528
- C:\Windows\System\RFyQhWv.exe
  C:\Windows\System\RFyQhWv.exe
  2⤵
  PID:13960
- C:\Windows\System\VcOodNu.exe
  C:\Windows\System\VcOodNu.exe
  2⤵
  PID:13976
- C:\Windows\System\GaoSszD.exe
  C:\Windows\System\GaoSszD.exe
  2⤵
  PID:14052
- C:\Windows\System\DBzAjJb.exe
  C:\Windows\System\DBzAjJb.exe
  2⤵
  PID:14084
- C:\Windows\System\TIgenQR.exe
  C:\Windows\System\TIgenQR.exe
  2⤵
  PID:14144
- C:\Windows\System\ucXhCQE.exe
  C:\Windows\System\ucXhCQE.exe
  2⤵
  PID:14188
- C:\Windows\System\oJDusLK.exe
  C:\Windows\System\oJDusLK.exe
  2⤵
  PID:11692
- C:\Windows\System\TsmCVBg.exe
  C:\Windows\System\TsmCVBg.exe
  2⤵
  PID:14312
- C:\Windows\System\rAxvBQl.exe
  C:\Windows\System\rAxvBQl.exe
  2⤵
  PID:12476
- C:\Windows\System\DSeXloe.exe
  C:\Windows\System\DSeXloe.exe
  2⤵
  PID:12988
- C:\Windows\System\RShDutF.exe
  C:\Windows\System\RShDutF.exe
  2⤵
  PID:13032
- C:\Windows\System\bCMDfoq.exe
  C:\Windows\System\bCMDfoq.exe
  2⤵
  PID:13404
- C:\Windows\System\NjbAAZS.exe
  C:\Windows\System\NjbAAZS.exe
  2⤵
  PID:15364
- C:\Windows\System\VjqpgYc.exe
  C:\Windows\System\VjqpgYc.exe
  2⤵
  PID:15380
- C:\Windows\System\oXuJtpm.exe
  C:\Windows\System\oXuJtpm.exe
  2⤵
  PID:15408
- C:\Windows\System\rYYoxlG.exe
  C:\Windows\System\rYYoxlG.exe
  2⤵
  PID:15424
- C:\Windows\System\pGuDcSp.exe
  C:\Windows\System\pGuDcSp.exe
  2⤵
  PID:15444
- C:\Windows\System\sZGgUDE.exe
  C:\Windows\System\sZGgUDE.exe
  2⤵
  PID:15460
- C:\Windows\System\DyfMKbq.exe
  C:\Windows\System\DyfMKbq.exe
  2⤵
  PID:15488
- C:\Windows\System\YJfVneP.exe
  C:\Windows\System\YJfVneP.exe
  2⤵
  PID:15524
- C:\Windows\System\AbrpoKV.exe
  C:\Windows\System\AbrpoKV.exe
  2⤵
  PID:15540
- C:\Windows\System\prOhIvL.exe
  C:\Windows\System\prOhIvL.exe
  2⤵
  PID:15568
- C:\Windows\System\fwCwurk.exe
  C:\Windows\System\fwCwurk.exe
  2⤵
  PID:15584
- C:\Windows\System\xZauSnm.exe
  C:\Windows\System\xZauSnm.exe
  2⤵
  PID:15600
- C:\Windows\System\CFrQIVD.exe
  C:\Windows\System\CFrQIVD.exe
  2⤵
  PID:15624
- C:\Windows\System\NBHJaWL.exe
  C:\Windows\System\NBHJaWL.exe
  2⤵
  PID:15644
- C:\Windows\System\sulHKQc.exe
  C:\Windows\System\sulHKQc.exe
  2⤵
  PID:15664
- C:\Windows\System\iklrUyH.exe
  C:\Windows\System\iklrUyH.exe
  2⤵
  PID:15688
- C:\Windows\System\lGAxRBh.exe
  C:\Windows\System\lGAxRBh.exe
  2⤵
  PID:15704
- C:\Windows\System\HbArKFv.exe
  C:\Windows\System\HbArKFv.exe
  2⤵
  PID:15720
- C:\Windows\System\iLaPETY.exe
  C:\Windows\System\iLaPETY.exe
  2⤵
  PID:15736
- C:\Windows\System\fxdNAUd.exe
  C:\Windows\System\fxdNAUd.exe
  2⤵
  PID:15752
- C:\Windows\System\RQIoRKy.exe
  C:\Windows\System\RQIoRKy.exe
  2⤵
  PID:15776
- C:\Windows\System\CLtGNAU.exe
  C:\Windows\System\CLtGNAU.exe
  2⤵
  PID:15792
- C:\Windows\System\OFewDnF.exe
  C:\Windows\System\OFewDnF.exe
  2⤵
  PID:15812
- C:\Windows\System\nbDIdIg.exe
  C:\Windows\System\nbDIdIg.exe
  2⤵
  PID:15832
- C:\Windows\System\sBjSlBA.exe
  C:\Windows\System\sBjSlBA.exe
  2⤵
  PID:15848
- C:\Windows\System\REgvUUl.exe
  C:\Windows\System\REgvUUl.exe
  2⤵
  PID:15884
- C:\Windows\System\vkJbTpt.exe
  C:\Windows\System\vkJbTpt.exe
  2⤵
  PID:15900
- C:\Windows\System\VnYUXpl.exe
  C:\Windows\System\VnYUXpl.exe
  2⤵
  PID:15916
- C:\Windows\System\pcdzwOd.exe
  C:\Windows\System\pcdzwOd.exe
  2⤵
  PID:15932
- C:\Windows\System\WQYucyk.exe
  C:\Windows\System\WQYucyk.exe
  2⤵
  PID:15952
- C:\Windows\System\NLelItp.exe
  C:\Windows\System\NLelItp.exe
  2⤵
  PID:15968
- C:\Windows\System\gtqMMbI.exe
  C:\Windows\System\gtqMMbI.exe
  2⤵
  PID:15984
- C:\Windows\System\QbsFsVb.exe
  C:\Windows\System\QbsFsVb.exe
  2⤵
  PID:16008
- C:\Windows\System\uSowdKt.exe
  C:\Windows\System\uSowdKt.exe
  2⤵
  PID:16024
- C:\Windows\System\erJMbwH.exe
  C:\Windows\System\erJMbwH.exe
  2⤵
  PID:16040
- C:\Windows\System\uyqwcAr.exe
  C:\Windows\System\uyqwcAr.exe
  2⤵
  PID:16068
- C:\Windows\System\QnJmwTI.exe
  C:\Windows\System\QnJmwTI.exe
  2⤵
  PID:16088
- C:\Windows\System\ZRkIkzM.exe
  C:\Windows\System\ZRkIkzM.exe
  2⤵
  PID:16112
- C:\Windows\System\QHRwLmp.exe
  C:\Windows\System\QHRwLmp.exe
  2⤵
  PID:16128
- C:\Windows\System\kBsLpqX.exe
  C:\Windows\System\kBsLpqX.exe
  2⤵
  PID:16144
- C:\Windows\System\yovrffu.exe
  C:\Windows\System\yovrffu.exe
  2⤵
  PID:16160
- C:\Windows\System\IGRXSLA.exe
  C:\Windows\System\IGRXSLA.exe
  2⤵
  PID:16188
- C:\Windows\System\qZgAdDu.exe
  C:\Windows\System\qZgAdDu.exe
  2⤵
  PID:16208
- C:\Windows\System\DKbToko.exe
  C:\Windows\System\DKbToko.exe
  2⤵
  PID:16224
- C:\Windows\System\HnLizEt.exe
  C:\Windows\System\HnLizEt.exe
  2⤵
  PID:16256
- C:\Windows\System\GOCfflp.exe
  C:\Windows\System\GOCfflp.exe
  2⤵
  PID:16276
- C:\Windows\System\lujnFug.exe
  C:\Windows\System\lujnFug.exe
  2⤵
  PID:16296
- C:\Windows\System\UVykOFa.exe
  C:\Windows\System\UVykOFa.exe
  2⤵
  PID:16320
- C:\Windows\System\OjMkMBM.exe
  C:\Windows\System\OjMkMBM.exe
  2⤵
  PID:16356
- C:\Windows\System\EXZvEoJ.exe
  C:\Windows\System\EXZvEoJ.exe
  2⤵
  PID:16376
- C:\Windows\System\BMNNcDg.exe
  C:\Windows\System\BMNNcDg.exe
  2⤵
  PID:14508
- C:\Windows\System\hbphKhb.exe
  C:\Windows\System\hbphKhb.exe
  2⤵
  PID:13692
- C:\Windows\System\UpHSDmn.exe
  C:\Windows\System\UpHSDmn.exe
  2⤵
  PID:14580
- C:\Windows\System\cqLOamH.exe
  C:\Windows\System\cqLOamH.exe
  2⤵
  PID:13784
- C:\Windows\System\eHgHLhj.exe
  C:\Windows\System\eHgHLhj.exe
  2⤵
  PID:13852
- C:\Windows\System\BlIHqVy.exe
  C:\Windows\System\BlIHqVy.exe
  2⤵
  PID:13952
- C:\Windows\System\GrKWJBX.exe
  C:\Windows\System\GrKWJBX.exe
  2⤵
  PID:14916
- C:\Windows\System\tHCobTA.exe
  C:\Windows\System\tHCobTA.exe
  2⤵
  PID:15028
- C:\Windows\System\HZBksAj.exe
  C:\Windows\System\HZBksAj.exe
  2⤵
  PID:14264
- C:\Windows\System\VpTivZr.exe
  C:\Windows\System\VpTivZr.exe
  2⤵
  PID:15176
- C:\Windows\System\wyRBdaF.exe
  C:\Windows\System\wyRBdaF.exe
  2⤵
  PID:15208
- C:\Windows\System\qkhcfXX.exe
  C:\Windows\System\qkhcfXX.exe
  2⤵
  PID:12540
- C:\Windows\System\XgXBoPC.exe
  C:\Windows\System\XgXBoPC.exe
  2⤵
  PID:11412
- C:\Windows\System\tsZNuSz.exe
  C:\Windows\System\tsZNuSz.exe
  2⤵
  PID:13652
- C:\Windows\System\unJUwHt.exe
  C:\Windows\System\unJUwHt.exe
  2⤵
  PID:12948
- C:\Windows\System\VWYGBXB.exe
  C:\Windows\System\VWYGBXB.exe
  2⤵
  PID:16392
- C:\Windows\System\ODuVdFD.exe
  C:\Windows\System\ODuVdFD.exe
  2⤵
  PID:16416
- C:\Windows\System\xGnkMOF.exe
  C:\Windows\System\xGnkMOF.exe
  2⤵
  PID:16432
- C:\Windows\System\VugDxBH.exe
  C:\Windows\System\VugDxBH.exe
  2⤵
  PID:16456
- C:\Windows\System\cIfpLzN.exe
  C:\Windows\System\cIfpLzN.exe
  2⤵
  PID:16472
- C:\Windows\System\oiEjTDT.exe
  C:\Windows\System\oiEjTDT.exe
  2⤵
  PID:16504
- C:\Windows\System\aHDNvjm.exe
  C:\Windows\System\aHDNvjm.exe
  2⤵
  PID:16520
- C:\Windows\System\fVxjeud.exe
  C:\Windows\System\fVxjeud.exe
  2⤵
  PID:16544
- C:\Windows\System\PeKoYOM.exe
  C:\Windows\System\PeKoYOM.exe
  2⤵
  PID:16560
- C:\Windows\System\srOjlSX.exe
  C:\Windows\System\srOjlSX.exe
  2⤵
  PID:16588
- C:\Windows\System\FwkSukq.exe
  C:\Windows\System\FwkSukq.exe
  2⤵
  PID:16604
- C:\Windows\System\DOSDWIr.exe
  C:\Windows\System\DOSDWIr.exe
  2⤵
  PID:16620
- C:\Windows\System\TpzyieK.exe
  C:\Windows\System\TpzyieK.exe
  2⤵
  PID:16636
- C:\Windows\System\loQEnxX.exe
  C:\Windows\System\loQEnxX.exe
  2⤵
  PID:16652
- C:\Windows\System\MPRpvYT.exe
  C:\Windows\System\MPRpvYT.exe
  2⤵
  PID:16668
- C:\Windows\System\JVRjZND.exe
  C:\Windows\System\JVRjZND.exe
  2⤵
  PID:16700
- C:\Windows\System\ezdwKxb.exe
  C:\Windows\System\ezdwKxb.exe
  2⤵
  PID:16732
- C:\Windows\System\tXdmdWk.exe
  C:\Windows\System\tXdmdWk.exe
  2⤵
  PID:16748
- C:\Windows\System\RoLvDQY.exe
  C:\Windows\System\RoLvDQY.exe
  2⤵
  PID:16764
- C:\Windows\System\NmNIZdT.exe
  C:\Windows\System\NmNIZdT.exe
  2⤵
  PID:16780
- C:\Windows\System\mBEhTaV.exe
  C:\Windows\System\mBEhTaV.exe
  2⤵
  PID:16796
- C:\Windows\System\WPVbUIS.exe
  C:\Windows\System\WPVbUIS.exe
  2⤵
  PID:16812
- C:\Windows\System\sqtHstt.exe
  C:\Windows\System\sqtHstt.exe
  2⤵
  PID:16828
- C:\Windows\System\dKKBiyO.exe
  C:\Windows\System\dKKBiyO.exe
  2⤵
  PID:16852
- C:\Windows\System\DiUrotn.exe
  C:\Windows\System\DiUrotn.exe
  2⤵
  PID:16872
- C:\Windows\System\xMdaPMG.exe
  C:\Windows\System\xMdaPMG.exe
  2⤵
  PID:16892
- C:\Windows\System\HJjxajI.exe
  C:\Windows\System\HJjxajI.exe
  2⤵
  PID:16912
- C:\Windows\System\odVIdxv.exe
  C:\Windows\System\odVIdxv.exe
  2⤵
  PID:16936
- C:\Windows\System\vYXFgsa.exe
  C:\Windows\System\vYXFgsa.exe
  2⤵
  PID:16960
- C:\Windows\System\KkdrufM.exe
  C:\Windows\System\KkdrufM.exe
  2⤵
  PID:16988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\GXWoVsX.exe

Filesize
1.2MB

MD5
2533cd568cff34f6d56bea3bb5da9fc9

SHA1
a2bde4c85e542a38fa57f5cb42b5193ec95106e0

SHA256
18119bfb4ec63d28a90a9e4c31a802ba1cd3e4f7f4bbf9fd010acb365513095c

SHA512
cbecaac368461163f5eaf8cbbd4d1d2aad08f0aad755686f97d934cc4d44d9af824f788a72b6c632a60e69c5b2b0cfce77649caac4316c36891ceea9310fd5e2

Download Submit
C:\Windows\System\GpOerGC.exe

Filesize
1.2MB

MD5
c4846d1d38946af0e6df7e4624e67702

SHA1
d3e6d7c99241d662e72914f31ce500dcfeb1749f

SHA256
6438022d43b370ca577fa460ba395de81dcb201d4499dfaf3bb8c233e89d3081

SHA512
2486901b7d312a4561e4cfa5e0e8b8c902d9f52bf028a6aa72e6380b6efdfbe7fc5a5ac292265e701ea76770f584c078f18cdeede853196301848ce4f718e6ac

Download Submit
C:\Windows\System\HZdNjzr.exe

Filesize
1.2MB

MD5
bcab469003f9ac708c0246b990edd3c3

SHA1
96e83eadd90d974b9974442bb3b13d5d9b057faf

SHA256
d9333b6d78961cc1f045affae59c744b0bf41aa9802bdc9e7026061354776631

SHA512
773095f23c83505a82a553f87bd0782c8e9de52035537a6537aa2720d1cff8cb4ae464ea50f8915d0285a9062e067c43248843b6e96faffad095317a2cafcd1e

Download Submit
C:\Windows\System\LjGQANg.exe

Filesize
1.2MB

MD5
4e2766f80053534171542e9b22b0a22b

SHA1
57f4fd4ade4d89b3917ce15b68d2e892519dd815

SHA256
5bd6ce34e0f73fe48ead1fcf5be7e7c2b11728ccb5822483b5c8184c7695dcb5

SHA512
b1e047ddcedfb1e6478cd5fabbf6e1ea16d64e2600bb5eaed70f7c9a7745b011d7a0603095c1a8ee3f2d13957ace61a48e3c26bcdef088999ba75bbae31e876c

Download Submit
C:\Windows\System\MkyselF.exe

Filesize
1.2MB

MD5
e1ccc8b5c5d47f445cdfac21623623c4

SHA1
546812c204f1c6d2660b548919e3c576c7bd4b83

SHA256
72f3746bb4e864e4d7ed6670d88767b5863198bb4432fb30fe8f4e7499a2c531

SHA512
0caa7cdb088eb03386db2da461939b02983460222558a3355355a4e20af7d5e77ce0ec24c925829d2907262cb1cc8289d515b1be8d965fdfc2033be760a67b58

Download Submit
C:\Windows\System\MqUIGSZ.exe

Filesize
1.2MB

MD5
3537ae688ace9ff0b53c590de3484e66

SHA1
26f41a4f9f0f3e09911efe709e79e86b396af334

SHA256
86d03598e741a6a2cd8aedbf07e03d90049801a3c6258675112ad5fbb67c2be2

SHA512
26e8dffcae69091bcb251e742b07c45871b839f8725167a68fc3789186dd706f2971d1464116af8496500f1adafb9f515f137460deab7c5d757bfcab90658100

Download Submit
C:\Windows\System\NkdXxXq.exe

Filesize
1.2MB

MD5
cf7d8c9cde0914bb0dc113c8a65aaa6f

SHA1
7ccb53260bd0ef11534ece89767cfe40b9cc2c94

SHA256
62ed2aa699773647d89f3551e70eb7cdad3a73f514d5fd51db6bcfb9378c7520

SHA512
284c27083b15e4a6c2dc31f715b0bbd2de143dba305857b0b7ab71bb36627fe1bc3d34290cf284d0e03a647b2d66ec1cc187a5890bdcb2ca4a16b0e93ab704a9

Download Submit
C:\Windows\System\OUKeqIV.exe

Filesize
1.2MB

MD5
ca6bac380e4bdbf79bd406f8057f02c4

SHA1
6f70217e6f90eb57157fb177434671aca1539044

SHA256
beccb83c2327e4bfa5cbbc8fda122d6f197d049ec9c36778c334d5687bec4926

SHA512
6705d2ff3185170c6b33064fb20d7b591c89f8221484b6360f9f8e45587923cd78f0038607ad3391048c244e900aa37ee1217640749b5922df38e9f4f6e1368d

Download Submit
C:\Windows\System\PNIXYuy.exe

Filesize
1.2MB

MD5
58322723aca47bc25cf71b5c6439c245

SHA1
dd676102f6a0025ccb84c2517533221b5f0de38f

SHA256
55329d2ca818096f7b44f476d690376dde92b4d6fd8e59ee368f5f05ec960270

SHA512
800b81b09b3b4c15f0f2e60bf455d157435a9fd7ce79f352d045a51db5c6953dabd538c41f333d302c292ef39fdfd45cfb20c617dcd0de264dcafc9e678fc329

Download Submit
C:\Windows\System\PtJVNkn.exe

Filesize
1.2MB

MD5
708aee26faa677fbb13c928d7fb613d0

SHA1
67bd12e5575b772711e8d9fb1525306f71aa5c23

SHA256
75dbfb7bf9aadaf3dba7e4312b133856ec7e5c97030273416ccf6271f2658600

SHA512
bfe188390bc9c20156116a388801b772222bf714eae6b71ab4c771ef1f0cc0f311e177bf5a7074dce3fd029cc4ab312b27e872946ebe5bd499c9fcd4005f1634

Download Submit
C:\Windows\System\QHdCbvL.exe

Filesize
1.2MB

MD5
32c51e6bd0bcf527f75720af8772fd7d

SHA1
f99bdc2b435f8e9c9ebef47268f9848fb22c73cc

SHA256
67dd63ad214d4b3bca9df878f4e2ae99dbacbf1bc0e7a46700a4d02ded03f4b2

SHA512
dafa6431cf2b199e653b7637902fe00405180be71dced3e7084066817206378c8278d4aef45539b58d1974ac42afc9be75c0cb6e7dd741b51a5f58e9f697f5dd

Download Submit
C:\Windows\System\StzWuCx.exe

Filesize
1.2MB

MD5
0f52fc21e41caecece6f0be48e634d8f

SHA1
bfe9c312cbc8fd7ea9612441b5922f7a162d740e

SHA256
826892fc68c667878e3bc04d2e20cafbb0262838c9e19c3c4d554a4db5888a02

SHA512
b39d21140c7fea2833d972ea087d5db9fa727751b47fa5a2150f533d8255d908dc981352386891665e4f91caf3198b0111fee553ed748f02c51b87b8db2a0ea1

Download Submit
C:\Windows\System\TjbtiVK.exe

Filesize
1.2MB

MD5
7b8a63ed95c5d86be218f44870a7a713

SHA1
56dda00bcca71c7c6b7604cdcbe57bf99bed9342

SHA256
4d63a397459e2d19364870e4be2617711748818e9b46b56314c865c9c775637e

SHA512
d1f3b7691350c4e0de0a96f6c0b983f82af2439b173055821cb2da91f533342bf7cd1540c176ee8df49f363b0dfd0e9a7fba8300a068475fcbc9ff125eda382e

Download Submit
C:\Windows\System\UOvwHpI.exe

Filesize
1.2MB

MD5
612c4631e3e8ea78a9f5edb37645229c

SHA1
72d8301f67775536e4cbeabb23be268abba13f56

SHA256
d471928097047e391eab612707838ca26293581c15ee453d9fb8388366b80c62

SHA512
e5633a15bd9ac688adc60132520b034cbd5db1c7d613c01030ea1869e5d8e3862be594eb3cb44aa6cccef1d315e4e04577757a2fbbf13a62fb69206bf8552f12

Download Submit
C:\Windows\System\VdWufeu.exe

Filesize
1.2MB

MD5
d17a7ee18429cf5a54f99c59b06b774c

SHA1
baaf9be76c1b3daeeaee0062bd60feee1b2f187b

SHA256
44b74c0d453baa443e3ab4ffcfc8008707efe8382ef8a068f26058630e90171d

SHA512
7db9baf5aaa8b58a9b54299f0effe9e6ee06857bd21a12d37200d8d0b0f48aeaf5cbbec96418b0efafd14233ae4f94195338d08e1737f2d46b42be8faf9cd452

Download Submit
C:\Windows\System\aTWKijk.exe

Filesize
1.2MB

MD5
76cafe781074b266cf904a2b027b6741

SHA1
326ddf2ed4f680cd6b3156bef2f4e65956643c5e

SHA256
f9535f9528f0db74723466251d4dc9a638c32773f4553b8dd60f8b647c6b181d

SHA512
7d472ca55ac8598b1b7c3aa38c4c7d12dc54e43f7f4633327223245c32d7dfc7ab2875ccaa264da879d3fe9dd6c88427ebd1d3a29e09730739dc18e3aaf8616b

Download Submit
C:\Windows\System\azdqpbd.exe

Filesize
1.2MB

MD5
2c10f583246406859d5e051778baa91b

SHA1
55af2f34aafc89be4e138809a2a6b6e1e00b3d2b

SHA256
90d84cda6222209303ddafcc7844454dec1eb59565d5c04be347a38114a02c28

SHA512
ca248a549e6ede13e51c6f4be80eaf39d4dbc3e5a406c4c16d52b01202c911f7f30c04086e8b49952a6c3a858599b370985285b981e9a6b48e1a09e3587a7e82

Download Submit
C:\Windows\System\dahjMrB.exe

Filesize
1.2MB

MD5
8c31e82fd1990138b6f9571c0b50ed9c

SHA1
fd4a91767e1f557298400a3fe1a9591a0dce4eb2

SHA256
27e5b6760d7b0de7ce7b396b251656f49285e5c830834827de25d5712921da85

SHA512
2e235e0d5903fa5f20f3b9ead681af19ec5f075dc45d5e8de4d2088d1369f8101f2b22b6f02d58d2ee28742446e8919998208056217a68f8b496930e942cefd8

Download Submit
C:\Windows\System\dtvgqjt.exe

Filesize
1.2MB

MD5
6fa305e7f0a15e0e2f5cabb46ade768d

SHA1
4587fd8f4c419458f1971ab9d11e2a80aaeeed94

SHA256
111443f53d2815f85fb76fd1b9c187cfac2a9db3d50c558d4db7c20a4ede2347

SHA512
df6bbbf25eb6040bbeeaa28da41275243d046bbae4aeb5c298df6440606948607a5f9e8519b55efabecbd68c83b415954728cc67ff56a82912e40e671ac7ec8b

Download Submit
C:\Windows\System\fIGJISR.exe

Filesize
1.2MB

MD5
da95bb1ecf8e4e7e11bd4d0dee09dcf9

SHA1
ca91e6cfe1801211044c7b36cbaa57432a7d49ba

SHA256
fea3b8f53e60c5d953b1bc438b4220662705016c3fd7bb39da12e9a28b42e6b2

SHA512
f830036fa9c841de6b450806c24e0c35d011158bd840e8eb8d2d5b31496bbe90f1b9c8366fa2c2e8952fb8aa160c1465e6e347aa63673c2e281aa5c4f7a9ee11

Download Submit
C:\Windows\System\hMdxfhJ.exe

Filesize
1.2MB

MD5
707c9f106e2e27860d25dd7575734f17

SHA1
df53430dc4fbd841be5edf5105a3434e26809a6b

SHA256
f8f08837a522e52ec9b20d7a4d18330be7926c3528e4af8993c51a8a891b993a

SHA512
275458a34286136f3a36d315fa08a76346c20f409d53c28201e712092ff25babbb5a62dbee0fb65e78b0be6414a0c085ada9ad936afaed92954e578430dcad9e

Download Submit
C:\Windows\System\hapRyRu.exe

Filesize
1.2MB

MD5
7ceb97694c9fc4c16b2d4afcc80ec5ff

SHA1
508b90ddf961b06ec235f9d0b4d569395d01ae97

SHA256
e5d71f0728be2a76a5527932657784cfbb934770b15f15654d59a72c369203b0

SHA512
e9bd05946b579bf4ae9e62bc1d784678bde5eb03ed6ee44c56926bdb18f097d7958ce2ada20704513f488741633df506ad6c9021c8fabf6c9e8fb6c4dc9702ea

Download Submit
C:\Windows\System\htihUcB.exe

Filesize
1.2MB

MD5
318ea7b7b89a4316bac50ba92d29f057

SHA1
8cf8029f397363425ac6055b1e2276f2779ae5bb

SHA256
09e2a0a388ffb12a06347365ea8ec8fd6406c9e93e6143e193943460155d07ad

SHA512
e2943d2dd82a66e1aa680d9299caf07d583affc40ef2084063df55d20f13d255d70a9bb7a54c7e33dc153bea4c506510bf7bde0c4349849c6a07b16f7d1280ce

Download Submit
C:\Windows\System\kwJOBrw.exe

Filesize
1.2MB

MD5
9b18f0f89c63d56df275e674fac14fe7

SHA1
f7b93d91d93874c9929498816d225af3f5b12996

SHA256
79a304fa3a370904bd0821a9f9c964ffbf67a821dbd7df34a4a4ee8e74b966ab

SHA512
94dd292912da186a07842ea4d8efea0c7d181e1d61a5e20f76ed03543089007ab63ca29a5e5046bba54e96da77af0dd80c77d757cb80ae3a0d990de9be0f95be

Download Submit
C:\Windows\System\lPjMCHr.exe

Filesize
1.2MB

MD5
ddaba7cdc260fa8a77ed8feeeef1277c

SHA1
8fe5655e1748e1fec7b382ed0e44b9bd531e3f9c

SHA256
03e8e0c54d0c85e041c24c31a68f9430c808c4770f1acfffaff27d86cf66d394

SHA512
ec247b36a765ba1d2494a5a97f86c8ec2d12a5aa9bb8f85e9178e4cb34e7135c1adc0b196bb91d04709689ad84622a6e4c99878f45e5817cf502c374d72b2c24

Download Submit
C:\Windows\System\nMHBtOv.exe

Filesize
1.2MB

MD5
fa2466a91eea644df8f09ddadf7b3ec1

SHA1
09148dd8f7ffdb6ace744f24722cbadfa4d47c24

SHA256
4e3614927395a5b956dde45b8a2379ae098099f50ca5040b68d2a5d434e94e71

SHA512
02cea87f2fe9dcbc0fe258a4488cd1c5ff0cac1e669f09db9ba94f1cea8eb514404d24011612f074d153d31506c41da1790167c967501344b7073b9af2c4e359

Download Submit
C:\Windows\System\pWWYNbX.exe

Filesize
1.2MB

MD5
46da4e7f828b388762c250a36cf65883

SHA1
91993a974623bf9a49c285455e1b3e8af9967a9d

SHA256
f80a3e6e02ba37fc8c28753f1a3003ff101fd4cf7db433e05fc6cce0350941e5

SHA512
1b8cd1501d3bf7cf0ecd5605ccf5572cd89de7194b5998b0d23111056696dec9510d5fb8249a4eff917608a788efddf1de65d6cdf34b637b429e9ca3ad4529a6

Download Submit
C:\Windows\System\qeEIbtE.exe

Filesize
1.2MB

MD5
03c26aece0c4dfc15f0fd5a98d4f31d5

SHA1
dcfa27ef7823a85a9aa97d5941c9a30c87052f34

SHA256
949dbebe9cd16182be4e2821ebb78b692bad2eb990af8284d9059cf6dab66534

SHA512
57e4ac627ce02534d5b419ee74f52e2016c39beb919ad138ac44e16e4b61ecf9ed940ec8184a159819d04c8b9b9dd05633366d318e8835bc6eb0441f05bc078c

Download Submit
C:\Windows\System\svgkFIp.exe

Filesize
1.2MB

MD5
b3c5e72e6da96e14b8dee7ad62898929

SHA1
2ceed3caf0cd20aea1c2db550401633efa508405

SHA256
96993fdcff4549dddfd420d0fceb546ef64966a2ea8c5409e25cd5491ed4a422

SHA512
fc98b6d41e179317910bbff01ac4cf7e819abef4dc1923507a650fef75cb591dfbd78f5d9fa16d7ffa7f2f01096061c7336710fdfa6486ab522ac26334b2189e

Download Submit
C:\Windows\System\tNTCuzF.exe

Filesize
1.2MB

MD5
c9787592ca108e15c04b1c559837fd1d

SHA1
ef49400e57682dac885ae5cecf0e100b7cfec9ad

SHA256
eea43546713a6c756c40d918dc4a2c7fa98b4c9e4d421d86e957cd80e1dd7498

SHA512
f913e7671bd194eb27180837daa094fac145f361fc8ace34d1eb1d745fd0d9ffcf5a116ac2367b9a1b12a3a87f03316ba5e48626f1c3473019eb9b473982273e

Download Submit
C:\Windows\System\tYwiMcQ.exe

Filesize
1.2MB

MD5
fd5604ab3ec786315dc9c0010efc3d09

SHA1
179d0cf41f98a92a47ec70fa69d55ac6151ea58c

SHA256
dc6ac9dcc7c31efeb98a0d128a72f3ca4f9dce3a14767dda44a9b456674d321d

SHA512
85645608538326f36756c6f84791928e2bb0188cb1b0f1980fff03b4d6336b6b47c8c41e7fea7248447ba30f024e32d740cb6fcf2435d8a40b1dac0126b45f91

Download Submit
C:\Windows\System\thLyQer.exe

Filesize
1.2MB

MD5
20b017f510895d30c31b1fad5f5b230f

SHA1
a802319789ead06044b7d3cf40d6871988bd093b

SHA256
ba58611329b3e375f3b045093e448d7b00508083fbfa8579ee8c2864d0b43d5f

SHA512
0c239ff567ad749112d7420df2ea29ed5459fd6799b002f2ce77a8f6c3627c0d2d8472bd9703c23a8e5e7492695065b659e6b5a6a51bf7b77e170d7ff7b15986

Download Submit
C:\Windows\System\yPtDKQn.exe

Filesize
1.2MB

MD5
0795826e37cbcd446a191c50f6169ef2

SHA1
4eb697eead6b56b648e5305e7df228423447b4bc

SHA256
7cc2353cfd04afe331fc979aa9856a343023a16a17c4989b0fc92f13924efd89

SHA512
b5b9c49d8d2f706ba5be68660ae5465012757ad38c799c15aad2e281680211f17f30e9d56d187bddaba57d573f3b985d11af5a5e6959053d6e7b8d981a905ffd

Download Submit
C:\Windows\System\zwqeZLW.exe

Filesize
1.2MB

MD5
dff6353f14c9bd59c3695939a053acf2

SHA1
b35dee51feaa8184998d0a97fb3571b302dc973c

SHA256
8580eb0429774fc4fbf61bb2084273f3440e1a0222a6a1fefa79b175f949e2d4

SHA512
23b54baf2736cac7280ed6f2b2309dd4ec5e9936263ba14b9febff30b71d58d0c43757600a0261c2a42ce81353c4404899442838b2286f7273a40a4b01f9d6b2

Download Submit
memory/3636-0-0x0000023159290000-0x00000231592A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads