xmrig | 93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
Size

1.3MB
MD5

1b8034866849c0fca594ddcbb26cd90a
SHA1

c29bd1e2f89243ad83beecfa113ea8ca3bcd36db
SHA256

93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95
SHA512

ad5589d4475a9ddf1e98406289ac7b1fb08c24f8c09a3351023cb2f5c955f9f1bc663476b59ab39845ae3370deb29231ecf9c2b6411181eb992849a736825e3b
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph7GW/0341:GezaTF8FcNkNdfE0pZ9ozttwIRxoW/xt

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000021649-4.dat	xmrig
behavioral2/files/0x000a000000023b68-12.dat	xmrig
behavioral2/files/0x000a000000023b6a-19.dat	xmrig
behavioral2/files/0x000a000000023b6b-31.dat	xmrig
behavioral2/files/0x000a000000023b73-56.dat	xmrig
behavioral2/files/0x000a000000023b6c-59.dat	xmrig
behavioral2/files/0x000a000000023b72-55.dat	xmrig
behavioral2/files/0x000a000000023b6d-54.dat	xmrig
behavioral2/files/0x000a000000023b70-70.dat	xmrig
behavioral2/files/0x000a000000023b76-85.dat	xmrig
behavioral2/files/0x000a000000023b75-83.dat	xmrig
behavioral2/files/0x000a000000023b74-79.dat	xmrig
behavioral2/files/0x000a000000023b71-73.dat	xmrig
behavioral2/files/0x000a000000023b6f-67.dat	xmrig
behavioral2/files/0x000a000000023b6e-64.dat	xmrig
behavioral2/files/0x000a000000023b7a-108.dat	xmrig
behavioral2/files/0x000a000000023b7b-121.dat	xmrig
behavioral2/files/0x000a000000023b7d-125.dat	xmrig
behavioral2/files/0x000a000000023b7c-123.dat	xmrig
behavioral2/files/0x000a000000023b79-105.dat	xmrig
behavioral2/files/0x000c000000023b63-100.dat	xmrig
behavioral2/files/0x000a000000023b78-95.dat	xmrig
behavioral2/files/0x000a000000023b77-93.dat	xmrig
behavioral2/files/0x000a000000023b82-138.dat	xmrig
behavioral2/files/0x000a000000023b81-162.dat	xmrig
behavioral2/files/0x000a000000023b83-160.dat	xmrig
behavioral2/files/0x000a000000023b8f-159.dat	xmrig
behavioral2/files/0x000b000000023b87-158.dat	xmrig
behavioral2/files/0x000b000000023b85-157.dat	xmrig
behavioral2/files/0x000a000000023b84-149.dat	xmrig
behavioral2/files/0x000a000000023b80-144.dat	xmrig
behavioral2/files/0x000a000000023b7e-139.dat	xmrig
behavioral2/files/0x000a000000023b69-22.dat	xmrig
behavioral2/files/0x000c000000023b50-16.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
864	DKplVwj.exe
4804	AiSRuEw.exe
3976	ALdfecl.exe
1964	zydrGmu.exe
1436	tBjoyHu.exe
2376	SDBANAP.exe
3556	qUcchTu.exe
4856	rRXYMXf.exe
4924	icsomXx.exe
2896	fzUxqSx.exe
4752	iBRfIKg.exe
1320	tLQmODR.exe
1740	ucPuSkl.exe
4888	spsllae.exe
2248	kPSGxJB.exe
2952	RFKdJkR.exe
1748	BYiSQOB.exe
3476	VhYsKfN.exe
1892	jnsUkNY.exe
2632	ECnDLwG.exe
4808	uZnnNEP.exe
2168	SYCpGbw.exe
2544	JfXFQfa.exe
2020	ruRuORe.exe
1956	UKQRNfj.exe
2764	dFIsZjP.exe
4088	kGOXVTw.exe
4828	XDizjeF.exe
868	BFeEpHK.exe
1680	CoiWDFj.exe
4080	hedcaOs.exe
1656	ZLhltmW.exe
448	JZlbRRC.exe
4904	kLNdUkd.exe
3256	TQVMrGF.exe
1152	eYWJNKb.exe
3116	YbnjfJA.exe
4160	SLrdZKE.exe
4588	fpLKrXw.exe
1128	dtVnjvU.exe
916	gXrLNFd.exe
2972	LIRyPyz.exe
2208	QYvdKmk.exe
1112	GPTwPhk.exe
1340	zWhteUL.exe
2708	TONZRNt.exe
4272	iKeWXLF.exe
1560	fBYTcEv.exe
3620	bQaxhJf.exe
2992	qYjmaJF.exe
2220	IXouYBc.exe
2648	vKFjYny.exe
4092	BuVrDZb.exe
1368	axrkDjP.exe
1192	xUGfoLv.exe
1096	MmoGMfH.exe
2136	vvPyxsn.exe
2352	GUltlAH.exe
1860	vVLwOOu.exe
1948	dMKZKEr.exe
4836	npUvMNz.exe
3236	dRLGZgN.exe
1684	XHWgDno.exe
3152	tzBZEaC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FDGEyHV.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\SUeFXzk.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\xZSeOxP.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\TONZRNt.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\clhvyiT.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\nreRpvs.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\XpqMQbX.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\EJuKkjj.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\wzrROYr.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\aHoNMRD.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\QoWhLdY.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\OsGFGnZ.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\vjQlRKM.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\hZlclPt.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\ILHXIAq.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\NvRPONo.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\ARnoMWT.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\gtaSVgY.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\XitArmy.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\wnJApsp.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\IzloakN.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\RbCSKAl.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\spsllae.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\PRzCIlw.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\CWqArPA.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\OyFaZxV.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\NuLsqXY.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\KvMivzf.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\VvCeaIX.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\OHBPJyl.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\DyTlYtP.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\zLhgLcN.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\SemkUvV.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\QvWCuRI.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\NqumRKo.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\PNDpBiU.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\SfAaxhn.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\DCmIszT.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\xhStrtT.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\AiSRuEw.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\LIRyPyz.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\aAwqwvu.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\eMSOKUg.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\GPTwPhk.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\bQaxhJf.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\cTXxVlr.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\SFckNrB.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\CDldyTb.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\rpGEBmZ.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\CjQPHhH.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\icsomXx.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\otnYVFr.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\DqBhlsy.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\JvZlnVc.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\APkMvqK.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\HEHGiiC.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\LYPZoXf.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\tlkjFNL.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\rumkreR.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\IcANvlp.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\AUlrgPI.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\vaBoehz.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\BmbcqPo.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
File created	C:\Windows\System\WnFzljD.exe	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 864	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	84
PID 1156 wrote to memory of 864	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	84
PID 1156 wrote to memory of 4804	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	85
PID 1156 wrote to memory of 4804	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	85
PID 1156 wrote to memory of 3976	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	86
PID 1156 wrote to memory of 3976	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	86
PID 1156 wrote to memory of 1964	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	87
PID 1156 wrote to memory of 1964	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	87
PID 1156 wrote to memory of 1436	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	88
PID 1156 wrote to memory of 1436	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	88
PID 1156 wrote to memory of 2376	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	89
PID 1156 wrote to memory of 2376	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	89
PID 1156 wrote to memory of 3556	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	90
PID 1156 wrote to memory of 3556	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	90
PID 1156 wrote to memory of 1320	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	91
PID 1156 wrote to memory of 1320	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	91
PID 1156 wrote to memory of 4856	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	92
PID 1156 wrote to memory of 4856	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	92
PID 1156 wrote to memory of 4924	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	93
PID 1156 wrote to memory of 4924	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	93
PID 1156 wrote to memory of 2896	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	94
PID 1156 wrote to memory of 2896	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	94
PID 1156 wrote to memory of 4752	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	95
PID 1156 wrote to memory of 4752	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	95
PID 1156 wrote to memory of 1740	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	96
PID 1156 wrote to memory of 1740	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	96
PID 1156 wrote to memory of 4888	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	97
PID 1156 wrote to memory of 4888	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	97
PID 1156 wrote to memory of 2248	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	98
PID 1156 wrote to memory of 2248	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	98
PID 1156 wrote to memory of 2952	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	99
PID 1156 wrote to memory of 2952	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	99
PID 1156 wrote to memory of 1748	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	100
PID 1156 wrote to memory of 1748	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	100
PID 1156 wrote to memory of 3476	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	101
PID 1156 wrote to memory of 3476	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	101
PID 1156 wrote to memory of 1892	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	102
PID 1156 wrote to memory of 1892	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	102
PID 1156 wrote to memory of 2632	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	103
PID 1156 wrote to memory of 2632	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	103
PID 1156 wrote to memory of 4808	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	104
PID 1156 wrote to memory of 4808	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	104
PID 1156 wrote to memory of 2168	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	105
PID 1156 wrote to memory of 2168	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	105
PID 1156 wrote to memory of 2544	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	106
PID 1156 wrote to memory of 2544	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	106
PID 1156 wrote to memory of 2020	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	107
PID 1156 wrote to memory of 2020	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	107
PID 1156 wrote to memory of 1956	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	108
PID 1156 wrote to memory of 1956	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	108
PID 1156 wrote to memory of 2764	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	109
PID 1156 wrote to memory of 2764	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	109
PID 1156 wrote to memory of 4088	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	110
PID 1156 wrote to memory of 4088	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	110
PID 1156 wrote to memory of 4828	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	111
PID 1156 wrote to memory of 4828	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	111
PID 1156 wrote to memory of 868	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	112
PID 1156 wrote to memory of 868	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	112
PID 1156 wrote to memory of 1680	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	113
PID 1156 wrote to memory of 1680	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	113
PID 1156 wrote to memory of 4080	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	114
PID 1156 wrote to memory of 4080	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	114
PID 1156 wrote to memory of 1656	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	115
PID 1156 wrote to memory of 1656	1156	93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe	115

C:\Users\Admin\AppData\Local\Temp\93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe
"C:\Users\Admin\AppData\Local\Temp\93d11a95495b18d682724fefc2d7d198a30fb86212a717da66fead88ec61de95.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\System\DKplVwj.exe
  C:\Windows\System\DKplVwj.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\AiSRuEw.exe
  C:\Windows\System\AiSRuEw.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\ALdfecl.exe
  C:\Windows\System\ALdfecl.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\zydrGmu.exe
  C:\Windows\System\zydrGmu.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\tBjoyHu.exe
  C:\Windows\System\tBjoyHu.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\SDBANAP.exe
  C:\Windows\System\SDBANAP.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\qUcchTu.exe
  C:\Windows\System\qUcchTu.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\tLQmODR.exe
  C:\Windows\System\tLQmODR.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\rRXYMXf.exe
  C:\Windows\System\rRXYMXf.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\icsomXx.exe
  C:\Windows\System\icsomXx.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\fzUxqSx.exe
  C:\Windows\System\fzUxqSx.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\iBRfIKg.exe
  C:\Windows\System\iBRfIKg.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\ucPuSkl.exe
  C:\Windows\System\ucPuSkl.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\spsllae.exe
  C:\Windows\System\spsllae.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\kPSGxJB.exe
  C:\Windows\System\kPSGxJB.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\RFKdJkR.exe
  C:\Windows\System\RFKdJkR.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\BYiSQOB.exe
  C:\Windows\System\BYiSQOB.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\VhYsKfN.exe
  C:\Windows\System\VhYsKfN.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\jnsUkNY.exe
  C:\Windows\System\jnsUkNY.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\ECnDLwG.exe
  C:\Windows\System\ECnDLwG.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\uZnnNEP.exe
  C:\Windows\System\uZnnNEP.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\SYCpGbw.exe
  C:\Windows\System\SYCpGbw.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\JfXFQfa.exe
  C:\Windows\System\JfXFQfa.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\ruRuORe.exe
  C:\Windows\System\ruRuORe.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\UKQRNfj.exe
  C:\Windows\System\UKQRNfj.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\dFIsZjP.exe
  C:\Windows\System\dFIsZjP.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\kGOXVTw.exe
  C:\Windows\System\kGOXVTw.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\XDizjeF.exe
  C:\Windows\System\XDizjeF.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\BFeEpHK.exe
  C:\Windows\System\BFeEpHK.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\CoiWDFj.exe
  C:\Windows\System\CoiWDFj.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\hedcaOs.exe
  C:\Windows\System\hedcaOs.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\ZLhltmW.exe
  C:\Windows\System\ZLhltmW.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\JZlbRRC.exe
  C:\Windows\System\JZlbRRC.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\kLNdUkd.exe
  C:\Windows\System\kLNdUkd.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\TQVMrGF.exe
  C:\Windows\System\TQVMrGF.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\eYWJNKb.exe
  C:\Windows\System\eYWJNKb.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\YbnjfJA.exe
  C:\Windows\System\YbnjfJA.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\SLrdZKE.exe
  C:\Windows\System\SLrdZKE.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\fpLKrXw.exe
  C:\Windows\System\fpLKrXw.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\dtVnjvU.exe
  C:\Windows\System\dtVnjvU.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\gXrLNFd.exe
  C:\Windows\System\gXrLNFd.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\QYvdKmk.exe
  C:\Windows\System\QYvdKmk.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\LIRyPyz.exe
  C:\Windows\System\LIRyPyz.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\GPTwPhk.exe
  C:\Windows\System\GPTwPhk.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\zWhteUL.exe
  C:\Windows\System\zWhteUL.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\TONZRNt.exe
  C:\Windows\System\TONZRNt.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\iKeWXLF.exe
  C:\Windows\System\iKeWXLF.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\fBYTcEv.exe
  C:\Windows\System\fBYTcEv.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\bQaxhJf.exe
  C:\Windows\System\bQaxhJf.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\qYjmaJF.exe
  C:\Windows\System\qYjmaJF.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\IXouYBc.exe
  C:\Windows\System\IXouYBc.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\vKFjYny.exe
  C:\Windows\System\vKFjYny.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\BuVrDZb.exe
  C:\Windows\System\BuVrDZb.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\axrkDjP.exe
  C:\Windows\System\axrkDjP.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\xUGfoLv.exe
  C:\Windows\System\xUGfoLv.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\MmoGMfH.exe
  C:\Windows\System\MmoGMfH.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\vvPyxsn.exe
  C:\Windows\System\vvPyxsn.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\GUltlAH.exe
  C:\Windows\System\GUltlAH.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\vVLwOOu.exe
  C:\Windows\System\vVLwOOu.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\dMKZKEr.exe
  C:\Windows\System\dMKZKEr.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\npUvMNz.exe
  C:\Windows\System\npUvMNz.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\dRLGZgN.exe
  C:\Windows\System\dRLGZgN.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\tzBZEaC.exe
  C:\Windows\System\tzBZEaC.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\rVmwxdp.exe
  C:\Windows\System\rVmwxdp.exe
  2⤵
  PID:4964
- C:\Windows\System\XHWgDno.exe
  C:\Windows\System\XHWgDno.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\DgMYuZM.exe
  C:\Windows\System\DgMYuZM.exe
  2⤵
  PID:4112
- C:\Windows\System\hVIlYZr.exe
  C:\Windows\System\hVIlYZr.exe
  2⤵
  PID:2812
- C:\Windows\System\pWnWbmu.exe
  C:\Windows\System\pWnWbmu.exe
  2⤵
  PID:1528
- C:\Windows\System\cEBQknT.exe
  C:\Windows\System\cEBQknT.exe
  2⤵
  PID:3380
- C:\Windows\System\STFqLMC.exe
  C:\Windows\System\STFqLMC.exe
  2⤵
  PID:2160
- C:\Windows\System\GhpenGc.exe
  C:\Windows\System\GhpenGc.exe
  2⤵
  PID:2128
- C:\Windows\System\iejXXmK.exe
  C:\Windows\System\iejXXmK.exe
  2⤵
  PID:2748
- C:\Windows\System\ezcbqNo.exe
  C:\Windows\System\ezcbqNo.exe
  2⤵
  PID:2060
- C:\Windows\System\pjiDDeZ.exe
  C:\Windows\System\pjiDDeZ.exe
  2⤵
  PID:856
- C:\Windows\System\wICyUqx.exe
  C:\Windows\System\wICyUqx.exe
  2⤵
  PID:5076
- C:\Windows\System\RofPhVb.exe
  C:\Windows\System\RofPhVb.exe
  2⤵
  PID:2296
- C:\Windows\System\yQTYcSz.exe
  C:\Windows\System\yQTYcSz.exe
  2⤵
  PID:2144
- C:\Windows\System\yRzxhSw.exe
  C:\Windows\System\yRzxhSw.exe
  2⤵
  PID:4584
- C:\Windows\System\FcMMtcx.exe
  C:\Windows\System\FcMMtcx.exe
  2⤵
  PID:2340
- C:\Windows\System\fhmmwFT.exe
  C:\Windows\System\fhmmwFT.exe
  2⤵
  PID:3164
- C:\Windows\System\rSkimzS.exe
  C:\Windows\System\rSkimzS.exe
  2⤵
  PID:2932
- C:\Windows\System\zhuzVWk.exe
  C:\Windows\System\zhuzVWk.exe
  2⤵
  PID:3048
- C:\Windows\System\CpFxCtT.exe
  C:\Windows\System\CpFxCtT.exe
  2⤵
  PID:224
- C:\Windows\System\tFBoGjf.exe
  C:\Windows\System\tFBoGjf.exe
  2⤵
  PID:2908
- C:\Windows\System\vcXPolh.exe
  C:\Windows\System\vcXPolh.exe
  2⤵
  PID:3676
- C:\Windows\System\fAHjQpz.exe
  C:\Windows\System\fAHjQpz.exe
  2⤵
  PID:4072
- C:\Windows\System\XKFxzNF.exe
  C:\Windows\System\XKFxzNF.exe
  2⤵
  PID:1744
- C:\Windows\System\cKfDgmu.exe
  C:\Windows\System\cKfDgmu.exe
  2⤵
  PID:852
- C:\Windows\System\xaoFDjB.exe
  C:\Windows\System\xaoFDjB.exe
  2⤵
  PID:3848
- C:\Windows\System\cTXxVlr.exe
  C:\Windows\System\cTXxVlr.exe
  2⤵
  PID:2008
- C:\Windows\System\xaxxOqP.exe
  C:\Windows\System\xaxxOqP.exe
  2⤵
  PID:1524
- C:\Windows\System\ldaMoMh.exe
  C:\Windows\System\ldaMoMh.exe
  2⤵
  PID:3212
- C:\Windows\System\tLOPlPC.exe
  C:\Windows\System\tLOPlPC.exe
  2⤵
  PID:2076
- C:\Windows\System\OmgTEwV.exe
  C:\Windows\System\OmgTEwV.exe
  2⤵
  PID:1888
- C:\Windows\System\icZnJjv.exe
  C:\Windows\System\icZnJjv.exe
  2⤵
  PID:860
- C:\Windows\System\ezsadYN.exe
  C:\Windows\System\ezsadYN.exe
  2⤵
  PID:3488
- C:\Windows\System\KeDkYyp.exe
  C:\Windows\System\KeDkYyp.exe
  2⤵
  PID:3088
- C:\Windows\System\EdpKaXp.exe
  C:\Windows\System\EdpKaXp.exe
  2⤵
  PID:5088
- C:\Windows\System\SXldrEi.exe
  C:\Windows\System\SXldrEi.exe
  2⤵
  PID:4944
- C:\Windows\System\MMBDcTs.exe
  C:\Windows\System\MMBDcTs.exe
  2⤵
  PID:412
- C:\Windows\System\tMcZNFh.exe
  C:\Windows\System\tMcZNFh.exe
  2⤵
  PID:1108
- C:\Windows\System\PvTRIHs.exe
  C:\Windows\System\PvTRIHs.exe
  2⤵
  PID:4192
- C:\Windows\System\FMaJVtC.exe
  C:\Windows\System\FMaJVtC.exe
  2⤵
  PID:3744
- C:\Windows\System\jZiUGBo.exe
  C:\Windows\System\jZiUGBo.exe
  2⤵
  PID:540
- C:\Windows\System\JoryKNu.exe
  C:\Windows\System\JoryKNu.exe
  2⤵
  PID:2028
- C:\Windows\System\JixirME.exe
  C:\Windows\System\JixirME.exe
  2⤵
  PID:5040
- C:\Windows\System\ufKMayE.exe
  C:\Windows\System\ufKMayE.exe
  2⤵
  PID:2072
- C:\Windows\System\XYfkjTP.exe
  C:\Windows\System\XYfkjTP.exe
  2⤵
  PID:4572
- C:\Windows\System\laXPCQk.exe
  C:\Windows\System\laXPCQk.exe
  2⤵
  PID:2056
- C:\Windows\System\DIblABv.exe
  C:\Windows\System\DIblABv.exe
  2⤵
  PID:2592
- C:\Windows\System\uDBQMTe.exe
  C:\Windows\System\uDBQMTe.exe
  2⤵
  PID:4616
- C:\Windows\System\APsCjMR.exe
  C:\Windows\System\APsCjMR.exe
  2⤵
  PID:1484
- C:\Windows\System\VmFfbXy.exe
  C:\Windows\System\VmFfbXy.exe
  2⤵
  PID:4444
- C:\Windows\System\ZQaJCKX.exe
  C:\Windows\System\ZQaJCKX.exe
  2⤵
  PID:4972
- C:\Windows\System\UJySoch.exe
  C:\Windows\System\UJySoch.exe
  2⤵
  PID:4832
- C:\Windows\System\YWLPJzd.exe
  C:\Windows\System\YWLPJzd.exe
  2⤵
  PID:5144
- C:\Windows\System\VrhVTyC.exe
  C:\Windows\System\VrhVTyC.exe
  2⤵
  PID:5172
- C:\Windows\System\rWVcdJs.exe
  C:\Windows\System\rWVcdJs.exe
  2⤵
  PID:5196
- C:\Windows\System\ydfuyom.exe
  C:\Windows\System\ydfuyom.exe
  2⤵
  PID:5228
- C:\Windows\System\OHBPJyl.exe
  C:\Windows\System\OHBPJyl.exe
  2⤵
  PID:5260
- C:\Windows\System\mFhuXOs.exe
  C:\Windows\System\mFhuXOs.exe
  2⤵
  PID:5288
- C:\Windows\System\otnYVFr.exe
  C:\Windows\System\otnYVFr.exe
  2⤵
  PID:5320
- C:\Windows\System\LfqLnYH.exe
  C:\Windows\System\LfqLnYH.exe
  2⤵
  PID:5348
- C:\Windows\System\BKdOGEj.exe
  C:\Windows\System\BKdOGEj.exe
  2⤵
  PID:5372
- C:\Windows\System\sDBhdbO.exe
  C:\Windows\System\sDBhdbO.exe
  2⤵
  PID:5400
- C:\Windows\System\ihzDBCT.exe
  C:\Windows\System\ihzDBCT.exe
  2⤵
  PID:5432
- C:\Windows\System\HEGbEDv.exe
  C:\Windows\System\HEGbEDv.exe
  2⤵
  PID:5456
- C:\Windows\System\aJoKZSg.exe
  C:\Windows\System\aJoKZSg.exe
  2⤵
  PID:5484
- C:\Windows\System\sQMAsdd.exe
  C:\Windows\System\sQMAsdd.exe
  2⤵
  PID:5512
- C:\Windows\System\UfpdPyW.exe
  C:\Windows\System\UfpdPyW.exe
  2⤵
  PID:5540
- C:\Windows\System\ttKiKNm.exe
  C:\Windows\System\ttKiKNm.exe
  2⤵
  PID:5568
- C:\Windows\System\KejCfgh.exe
  C:\Windows\System\KejCfgh.exe
  2⤵
  PID:5596
- C:\Windows\System\FDGEyHV.exe
  C:\Windows\System\FDGEyHV.exe
  2⤵
  PID:5620
- C:\Windows\System\rumkreR.exe
  C:\Windows\System\rumkreR.exe
  2⤵
  PID:5644
- C:\Windows\System\XeKdYXm.exe
  C:\Windows\System\XeKdYXm.exe
  2⤵
  PID:5668
- C:\Windows\System\RWpegaQ.exe
  C:\Windows\System\RWpegaQ.exe
  2⤵
  PID:5724
- C:\Windows\System\ZVjCevY.exe
  C:\Windows\System\ZVjCevY.exe
  2⤵
  PID:5740
- C:\Windows\System\FDbBgQG.exe
  C:\Windows\System\FDbBgQG.exe
  2⤵
  PID:5760
- C:\Windows\System\CqrlXqD.exe
  C:\Windows\System\CqrlXqD.exe
  2⤵
  PID:5784
- C:\Windows\System\NWuDgBo.exe
  C:\Windows\System\NWuDgBo.exe
  2⤵
  PID:5812
- C:\Windows\System\FSmddQa.exe
  C:\Windows\System\FSmddQa.exe
  2⤵
  PID:5840
- C:\Windows\System\IcANvlp.exe
  C:\Windows\System\IcANvlp.exe
  2⤵
  PID:5864
- C:\Windows\System\yIwwTAY.exe
  C:\Windows\System\yIwwTAY.exe
  2⤵
  PID:5896
- C:\Windows\System\fDliDpx.exe
  C:\Windows\System\fDliDpx.exe
  2⤵
  PID:5924
- C:\Windows\System\obECiey.exe
  C:\Windows\System\obECiey.exe
  2⤵
  PID:5952
- C:\Windows\System\cBXlrhJ.exe
  C:\Windows\System\cBXlrhJ.exe
  2⤵
  PID:5972
- C:\Windows\System\bEwtURS.exe
  C:\Windows\System\bEwtURS.exe
  2⤵
  PID:5996
- C:\Windows\System\uYXCQEQ.exe
  C:\Windows\System\uYXCQEQ.exe
  2⤵
  PID:6020
- C:\Windows\System\fALjXBJ.exe
  C:\Windows\System\fALjXBJ.exe
  2⤵
  PID:6040
- C:\Windows\System\ZNZqfsR.exe
  C:\Windows\System\ZNZqfsR.exe
  2⤵
  PID:6072
- C:\Windows\System\SVpgcgX.exe
  C:\Windows\System\SVpgcgX.exe
  2⤵
  PID:6104
- C:\Windows\System\aItHDPS.exe
  C:\Windows\System\aItHDPS.exe
  2⤵
  PID:6124
- C:\Windows\System\SShRgUe.exe
  C:\Windows\System\SShRgUe.exe
  2⤵
  PID:5132
- C:\Windows\System\FetBtmj.exe
  C:\Windows\System\FetBtmj.exe
  2⤵
  PID:5188
- C:\Windows\System\gSrWjRh.exe
  C:\Windows\System\gSrWjRh.exe
  2⤵
  PID:5220
- C:\Windows\System\alIBorc.exe
  C:\Windows\System\alIBorc.exe
  2⤵
  PID:5392
- C:\Windows\System\nyhNhqk.exe
  C:\Windows\System\nyhNhqk.exe
  2⤵
  PID:5448
- C:\Windows\System\SHmBfYb.exe
  C:\Windows\System\SHmBfYb.exe
  2⤵
  PID:5532
- C:\Windows\System\oBqKaFe.exe
  C:\Windows\System\oBqKaFe.exe
  2⤵
  PID:5592
- C:\Windows\System\ANGmxFF.exe
  C:\Windows\System\ANGmxFF.exe
  2⤵
  PID:5628
- C:\Windows\System\GSFjmgn.exe
  C:\Windows\System\GSFjmgn.exe
  2⤵
  PID:5704
- C:\Windows\System\KpIjwlF.exe
  C:\Windows\System\KpIjwlF.exe
  2⤵
  PID:5768
- C:\Windows\System\vvZFfnI.exe
  C:\Windows\System\vvZFfnI.exe
  2⤵
  PID:5828
- C:\Windows\System\hcpFNRp.exe
  C:\Windows\System\hcpFNRp.exe
  2⤵
  PID:5860
- C:\Windows\System\paJtQQQ.exe
  C:\Windows\System\paJtQQQ.exe
  2⤵
  PID:5944
- C:\Windows\System\HSpOZWI.exe
  C:\Windows\System\HSpOZWI.exe
  2⤵
  PID:6008
- C:\Windows\System\UzBgQpL.exe
  C:\Windows\System\UzBgQpL.exe
  2⤵
  PID:6056
- C:\Windows\System\zaBuhxI.exe
  C:\Windows\System\zaBuhxI.exe
  2⤵
  PID:6120
- C:\Windows\System\qbcBtnu.exe
  C:\Windows\System\qbcBtnu.exe
  2⤵
  PID:5368
- C:\Windows\System\wqJNwSy.exe
  C:\Windows\System\wqJNwSy.exe
  2⤵
  PID:5364
- C:\Windows\System\YxHtUuK.exe
  C:\Windows\System\YxHtUuK.exe
  2⤵
  PID:5560
- C:\Windows\System\lsRxxOA.exe
  C:\Windows\System\lsRxxOA.exe
  2⤵
  PID:5736
- C:\Windows\System\ZJMPCcC.exe
  C:\Windows\System\ZJMPCcC.exe
  2⤵
  PID:5856
- C:\Windows\System\vGaWiqv.exe
  C:\Windows\System\vGaWiqv.exe
  2⤵
  PID:5916
- C:\Windows\System\PPhFzcP.exe
  C:\Windows\System\PPhFzcP.exe
  2⤵
  PID:3764
- C:\Windows\System\zHrDysc.exe
  C:\Windows\System\zHrDysc.exe
  2⤵
  PID:5660
- C:\Windows\System\KTRikzb.exe
  C:\Windows\System\KTRikzb.exe
  2⤵
  PID:5992
- C:\Windows\System\vJFSPuy.exe
  C:\Windows\System\vJFSPuy.exe
  2⤵
  PID:6148
- C:\Windows\System\bxrlYKn.exe
  C:\Windows\System\bxrlYKn.exe
  2⤵
  PID:6168
- C:\Windows\System\xwqbDgz.exe
  C:\Windows\System\xwqbDgz.exe
  2⤵
  PID:6196
- C:\Windows\System\kStJumG.exe
  C:\Windows\System\kStJumG.exe
  2⤵
  PID:6224
- C:\Windows\System\BakpGVr.exe
  C:\Windows\System\BakpGVr.exe
  2⤵
  PID:6248
- C:\Windows\System\aatjSmD.exe
  C:\Windows\System\aatjSmD.exe
  2⤵
  PID:6280
- C:\Windows\System\xZcDGBo.exe
  C:\Windows\System\xZcDGBo.exe
  2⤵
  PID:6304
- C:\Windows\System\xjYiWKZ.exe
  C:\Windows\System\xjYiWKZ.exe
  2⤵
  PID:6332
- C:\Windows\System\UDFZpSv.exe
  C:\Windows\System\UDFZpSv.exe
  2⤵
  PID:6360
- C:\Windows\System\tvbGVHE.exe
  C:\Windows\System\tvbGVHE.exe
  2⤵
  PID:6384
- C:\Windows\System\JBsMtip.exe
  C:\Windows\System\JBsMtip.exe
  2⤵
  PID:6412
- C:\Windows\System\DDNeHNi.exe
  C:\Windows\System\DDNeHNi.exe
  2⤵
  PID:6436
- C:\Windows\System\JoZZTuk.exe
  C:\Windows\System\JoZZTuk.exe
  2⤵
  PID:6468
- C:\Windows\System\VxrNnWI.exe
  C:\Windows\System\VxrNnWI.exe
  2⤵
  PID:6492
- C:\Windows\System\cRKbtPR.exe
  C:\Windows\System\cRKbtPR.exe
  2⤵
  PID:6516
- C:\Windows\System\JELtSQc.exe
  C:\Windows\System\JELtSQc.exe
  2⤵
  PID:6540
- C:\Windows\System\GwaMLea.exe
  C:\Windows\System\GwaMLea.exe
  2⤵
  PID:6560
- C:\Windows\System\viDhMVP.exe
  C:\Windows\System\viDhMVP.exe
  2⤵
  PID:6588
- C:\Windows\System\EujDhbH.exe
  C:\Windows\System\EujDhbH.exe
  2⤵
  PID:6612
- C:\Windows\System\EVqCtuI.exe
  C:\Windows\System\EVqCtuI.exe
  2⤵
  PID:6644
- C:\Windows\System\shIPxqu.exe
  C:\Windows\System\shIPxqu.exe
  2⤵
  PID:6676
- C:\Windows\System\HvkUaSi.exe
  C:\Windows\System\HvkUaSi.exe
  2⤵
  PID:6700
- C:\Windows\System\WdmYNcM.exe
  C:\Windows\System\WdmYNcM.exe
  2⤵
  PID:6728
- C:\Windows\System\QHyRgYz.exe
  C:\Windows\System\QHyRgYz.exe
  2⤵
  PID:6756
- C:\Windows\System\rSTWpWo.exe
  C:\Windows\System\rSTWpWo.exe
  2⤵
  PID:6780
- C:\Windows\System\nvsHlxK.exe
  C:\Windows\System\nvsHlxK.exe
  2⤵
  PID:6804
- C:\Windows\System\oVjMxDW.exe
  C:\Windows\System\oVjMxDW.exe
  2⤵
  PID:6828
- C:\Windows\System\OhQhvZX.exe
  C:\Windows\System\OhQhvZX.exe
  2⤵
  PID:6856
- C:\Windows\System\iMNqMcZ.exe
  C:\Windows\System\iMNqMcZ.exe
  2⤵
  PID:6888
- C:\Windows\System\vARYzia.exe
  C:\Windows\System\vARYzia.exe
  2⤵
  PID:6912
- C:\Windows\System\pqwVnVd.exe
  C:\Windows\System\pqwVnVd.exe
  2⤵
  PID:6948
- C:\Windows\System\eNUHIeW.exe
  C:\Windows\System\eNUHIeW.exe
  2⤵
  PID:6972
- C:\Windows\System\WggdeLG.exe
  C:\Windows\System\WggdeLG.exe
  2⤵
  PID:7008
- C:\Windows\System\zkXLTRn.exe
  C:\Windows\System\zkXLTRn.exe
  2⤵
  PID:7028
- C:\Windows\System\bbrZHPP.exe
  C:\Windows\System\bbrZHPP.exe
  2⤵
  PID:7056
- C:\Windows\System\Qyygntx.exe
  C:\Windows\System\Qyygntx.exe
  2⤵
  PID:7088
- C:\Windows\System\HBARZNq.exe
  C:\Windows\System\HBARZNq.exe
  2⤵
  PID:7108
- C:\Windows\System\QoWhLdY.exe
  C:\Windows\System\QoWhLdY.exe
  2⤵
  PID:7136
- C:\Windows\System\DvGGiIk.exe
  C:\Windows\System\DvGGiIk.exe
  2⤵
  PID:5936
- C:\Windows\System\TiXRqTu.exe
  C:\Windows\System\TiXRqTu.exe
  2⤵
  PID:6060
- C:\Windows\System\YnGjRnE.exe
  C:\Windows\System\YnGjRnE.exe
  2⤵
  PID:6180
- C:\Windows\System\GJnKpnz.exe
  C:\Windows\System\GJnKpnz.exe
  2⤵
  PID:6216
- C:\Windows\System\wuKTZHS.exe
  C:\Windows\System\wuKTZHS.exe
  2⤵
  PID:6240
- C:\Windows\System\gPTFQuf.exe
  C:\Windows\System\gPTFQuf.exe
  2⤵
  PID:6356
- C:\Windows\System\mMWDwHr.exe
  C:\Windows\System\mMWDwHr.exe
  2⤵
  PID:6320
- C:\Windows\System\qOUfiMs.exe
  C:\Windows\System\qOUfiMs.exe
  2⤵
  PID:6424
- C:\Windows\System\ptvEdie.exe
  C:\Windows\System\ptvEdie.exe
  2⤵
  PID:6580
- C:\Windows\System\DGlmFIM.exe
  C:\Windows\System\DGlmFIM.exe
  2⤵
  PID:6636
- C:\Windows\System\azqqvDn.exe
  C:\Windows\System\azqqvDn.exe
  2⤵
  PID:6604
- C:\Windows\System\NtnsHoL.exe
  C:\Windows\System\NtnsHoL.exe
  2⤵
  PID:6572
- C:\Windows\System\PEqkwxM.exe
  C:\Windows\System\PEqkwxM.exe
  2⤵
  PID:6692
- C:\Windows\System\nDsBejo.exe
  C:\Windows\System\nDsBejo.exe
  2⤵
  PID:6872
- C:\Windows\System\wtzcsWj.exe
  C:\Windows\System\wtzcsWj.exe
  2⤵
  PID:6908
- C:\Windows\System\aiGniTH.exe
  C:\Windows\System\aiGniTH.exe
  2⤵
  PID:6944
- C:\Windows\System\dNMMYGq.exe
  C:\Windows\System\dNMMYGq.exe
  2⤵
  PID:7004
- C:\Windows\System\rHuxiud.exe
  C:\Windows\System\rHuxiud.exe
  2⤵
  PID:7084
- C:\Windows\System\KjZXloE.exe
  C:\Windows\System\KjZXloE.exe
  2⤵
  PID:7048
- C:\Windows\System\Ecaouly.exe
  C:\Windows\System\Ecaouly.exe
  2⤵
  PID:6968
- C:\Windows\System\jMMuOzV.exe
  C:\Windows\System\jMMuOzV.exe
  2⤵
  PID:7116
- C:\Windows\System\bhsOtfx.exe
  C:\Windows\System\bhsOtfx.exe
  2⤵
  PID:7160
- C:\Windows\System\jXaLWRj.exe
  C:\Windows\System\jXaLWRj.exe
  2⤵
  PID:2024
- C:\Windows\System\EfLMEfK.exe
  C:\Windows\System\EfLMEfK.exe
  2⤵
  PID:6480
- C:\Windows\System\sJdUpYA.exe
  C:\Windows\System\sJdUpYA.exe
  2⤵
  PID:6452
- C:\Windows\System\wEilIAo.exe
  C:\Windows\System\wEilIAo.exe
  2⤵
  PID:6668
- C:\Windows\System\eULVHmW.exe
  C:\Windows\System\eULVHmW.exe
  2⤵
  PID:6852
- C:\Windows\System\TSQOscG.exe
  C:\Windows\System\TSQOscG.exe
  2⤵
  PID:6960
- C:\Windows\System\KLyogcU.exe
  C:\Windows\System\KLyogcU.exe
  2⤵
  PID:6724
- C:\Windows\System\oLrgmmP.exe
  C:\Windows\System\oLrgmmP.exe
  2⤵
  PID:7180
- C:\Windows\System\PCXzUzu.exe
  C:\Windows\System\PCXzUzu.exe
  2⤵
  PID:7208
- C:\Windows\System\vbEPMSI.exe
  C:\Windows\System\vbEPMSI.exe
  2⤵
  PID:7244
- C:\Windows\System\rCqZXDl.exe
  C:\Windows\System\rCqZXDl.exe
  2⤵
  PID:7268
- C:\Windows\System\AUlrgPI.exe
  C:\Windows\System\AUlrgPI.exe
  2⤵
  PID:7292
- C:\Windows\System\NeRExzR.exe
  C:\Windows\System\NeRExzR.exe
  2⤵
  PID:7324
- C:\Windows\System\KUkLShL.exe
  C:\Windows\System\KUkLShL.exe
  2⤵
  PID:7344
- C:\Windows\System\griudaO.exe
  C:\Windows\System\griudaO.exe
  2⤵
  PID:7380
- C:\Windows\System\VdFhtOH.exe
  C:\Windows\System\VdFhtOH.exe
  2⤵
  PID:7400
- C:\Windows\System\nfHjnbN.exe
  C:\Windows\System\nfHjnbN.exe
  2⤵
  PID:7436
- C:\Windows\System\jqqXwSr.exe
  C:\Windows\System\jqqXwSr.exe
  2⤵
  PID:7452
- C:\Windows\System\ovazVIr.exe
  C:\Windows\System\ovazVIr.exe
  2⤵
  PID:7476
- C:\Windows\System\NMUSHkz.exe
  C:\Windows\System\NMUSHkz.exe
  2⤵
  PID:7492
- C:\Windows\System\fuCzgae.exe
  C:\Windows\System\fuCzgae.exe
  2⤵
  PID:7516
- C:\Windows\System\zBHXPNU.exe
  C:\Windows\System\zBHXPNU.exe
  2⤵
  PID:7548
- C:\Windows\System\uhYIOUc.exe
  C:\Windows\System\uhYIOUc.exe
  2⤵
  PID:7572
- C:\Windows\System\lwtuXFs.exe
  C:\Windows\System\lwtuXFs.exe
  2⤵
  PID:7600
- C:\Windows\System\JEvXhLK.exe
  C:\Windows\System\JEvXhLK.exe
  2⤵
  PID:7632
- C:\Windows\System\APkMvqK.exe
  C:\Windows\System\APkMvqK.exe
  2⤵
  PID:7664
- C:\Windows\System\hQjhWDU.exe
  C:\Windows\System\hQjhWDU.exe
  2⤵
  PID:7692
- C:\Windows\System\norBUGC.exe
  C:\Windows\System\norBUGC.exe
  2⤵
  PID:7716
- C:\Windows\System\cOrJzrf.exe
  C:\Windows\System\cOrJzrf.exe
  2⤵
  PID:7760
- C:\Windows\System\eUTgAQS.exe
  C:\Windows\System\eUTgAQS.exe
  2⤵
  PID:7776
- C:\Windows\System\gzsFcDO.exe
  C:\Windows\System\gzsFcDO.exe
  2⤵
  PID:7804
- C:\Windows\System\CyGjdul.exe
  C:\Windows\System\CyGjdul.exe
  2⤵
  PID:7828
- C:\Windows\System\gHQkDWo.exe
  C:\Windows\System\gHQkDWo.exe
  2⤵
  PID:7852
- C:\Windows\System\MvLhyOH.exe
  C:\Windows\System\MvLhyOH.exe
  2⤵
  PID:7880
- C:\Windows\System\qaRXWty.exe
  C:\Windows\System\qaRXWty.exe
  2⤵
  PID:7900
- C:\Windows\System\kyGkgww.exe
  C:\Windows\System\kyGkgww.exe
  2⤵
  PID:7928
- C:\Windows\System\qkrwYoF.exe
  C:\Windows\System\qkrwYoF.exe
  2⤵
  PID:7952
- C:\Windows\System\EixgZVV.exe
  C:\Windows\System\EixgZVV.exe
  2⤵
  PID:7976
- C:\Windows\System\MZMYpza.exe
  C:\Windows\System\MZMYpza.exe
  2⤵
  PID:8008
- C:\Windows\System\sakIaFj.exe
  C:\Windows\System\sakIaFj.exe
  2⤵
  PID:8028
- C:\Windows\System\FthBQTy.exe
  C:\Windows\System\FthBQTy.exe
  2⤵
  PID:8060
- C:\Windows\System\rykGogM.exe
  C:\Windows\System\rykGogM.exe
  2⤵
  PID:8080
- C:\Windows\System\GxGkpob.exe
  C:\Windows\System\GxGkpob.exe
  2⤵
  PID:8104
- C:\Windows\System\AVSnrnZ.exe
  C:\Windows\System\AVSnrnZ.exe
  2⤵
  PID:8128
- C:\Windows\System\ZhewKDL.exe
  C:\Windows\System\ZhewKDL.exe
  2⤵
  PID:8148
- C:\Windows\System\hhssCcq.exe
  C:\Windows\System\hhssCcq.exe
  2⤵
  PID:8176
- C:\Windows\System\yKOtlZP.exe
  C:\Windows\System\yKOtlZP.exe
  2⤵
  PID:6448
- C:\Windows\System\LRUsUQH.exe
  C:\Windows\System\LRUsUQH.exe
  2⤵
  PID:6936
- C:\Windows\System\OhbVfOr.exe
  C:\Windows\System\OhbVfOr.exe
  2⤵
  PID:6312
- C:\Windows\System\kiHnAVt.exe
  C:\Windows\System\kiHnAVt.exe
  2⤵
  PID:7240
- C:\Windows\System\oWrZpyU.exe
  C:\Windows\System\oWrZpyU.exe
  2⤵
  PID:7284
- C:\Windows\System\YqCtbxl.exe
  C:\Windows\System\YqCtbxl.exe
  2⤵
  PID:6768
- C:\Windows\System\QWArVFS.exe
  C:\Windows\System\QWArVFS.exe
  2⤵
  PID:7220
- C:\Windows\System\OlJiLyT.exe
  C:\Windows\System\OlJiLyT.exe
  2⤵
  PID:7532
- C:\Windows\System\qnozmPH.exe
  C:\Windows\System\qnozmPH.exe
  2⤵
  PID:7568
- C:\Windows\System\QkvPVKV.exe
  C:\Windows\System\QkvPVKV.exe
  2⤵
  PID:7408
- C:\Windows\System\dXjuRUd.exe
  C:\Windows\System\dXjuRUd.exe
  2⤵
  PID:7624
- C:\Windows\System\xkFMaea.exe
  C:\Windows\System\xkFMaea.exe
  2⤵
  PID:7712
- C:\Windows\System\WKuAvid.exe
  C:\Windows\System\WKuAvid.exe
  2⤵
  PID:7784
- C:\Windows\System\gmhNhzv.exe
  C:\Windows\System\gmhNhzv.exe
  2⤵
  PID:7432
- C:\Windows\System\liEkKdI.exe
  C:\Windows\System\liEkKdI.exe
  2⤵
  PID:7936
- C:\Windows\System\KsdCFDC.exe
  C:\Windows\System\KsdCFDC.exe
  2⤵
  PID:7984
- C:\Windows\System\VorDIyR.exe
  C:\Windows\System\VorDIyR.exe
  2⤵
  PID:8056
- C:\Windows\System\PvXclCB.exe
  C:\Windows\System\PvXclCB.exe
  2⤵
  PID:7652
- C:\Windows\System\bcnxbVx.exe
  C:\Windows\System\bcnxbVx.exe
  2⤵
  PID:8168
- C:\Windows\System\ZiFPIUh.exe
  C:\Windows\System\ZiFPIUh.exe
  2⤵
  PID:7176
- C:\Windows\System\DJVydTG.exe
  C:\Windows\System\DJVydTG.exe
  2⤵
  PID:6996
- C:\Windows\System\SFckNrB.exe
  C:\Windows\System\SFckNrB.exe
  2⤵
  PID:8124
- C:\Windows\System\AZcIcpX.exe
  C:\Windows\System\AZcIcpX.exe
  2⤵
  PID:7592
- C:\Windows\System\FRLmVBT.exe
  C:\Windows\System\FRLmVBT.exe
  2⤵
  PID:8164
- C:\Windows\System\rpfOjNp.exe
  C:\Windows\System\rpfOjNp.exe
  2⤵
  PID:7128
- C:\Windows\System\fFxOhJd.exe
  C:\Windows\System\fFxOhJd.exe
  2⤵
  PID:8216
- C:\Windows\System\ZVxNpKM.exe
  C:\Windows\System\ZVxNpKM.exe
  2⤵
  PID:8252
- C:\Windows\System\ITApsPU.exe
  C:\Windows\System\ITApsPU.exe
  2⤵
  PID:8276
- C:\Windows\System\nYMmUli.exe
  C:\Windows\System\nYMmUli.exe
  2⤵
  PID:8308
- C:\Windows\System\XpqMQbX.exe
  C:\Windows\System\XpqMQbX.exe
  2⤵
  PID:8332
- C:\Windows\System\ajZXOjE.exe
  C:\Windows\System\ajZXOjE.exe
  2⤵
  PID:8360
- C:\Windows\System\gDPyUqr.exe
  C:\Windows\System\gDPyUqr.exe
  2⤵
  PID:8388
- C:\Windows\System\wZIhIbb.exe
  C:\Windows\System\wZIhIbb.exe
  2⤵
  PID:8416
- C:\Windows\System\lQoYDCa.exe
  C:\Windows\System\lQoYDCa.exe
  2⤵
  PID:8432
- C:\Windows\System\NqumRKo.exe
  C:\Windows\System\NqumRKo.exe
  2⤵
  PID:8456
- C:\Windows\System\xehjrwK.exe
  C:\Windows\System\xehjrwK.exe
  2⤵
  PID:8488
- C:\Windows\System\JbaKNQV.exe
  C:\Windows\System\JbaKNQV.exe
  2⤵
  PID:8520
- C:\Windows\System\egVwSaV.exe
  C:\Windows\System\egVwSaV.exe
  2⤵
  PID:8540
- C:\Windows\System\vTpwEpn.exe
  C:\Windows\System\vTpwEpn.exe
  2⤵
  PID:8568
- C:\Windows\System\xtWkdAj.exe
  C:\Windows\System\xtWkdAj.exe
  2⤵
  PID:8588
- C:\Windows\System\BUHRQWU.exe
  C:\Windows\System\BUHRQWU.exe
  2⤵
  PID:8612
- C:\Windows\System\cZzuizS.exe
  C:\Windows\System\cZzuizS.exe
  2⤵
  PID:8632
- C:\Windows\System\iLcXjxq.exe
  C:\Windows\System\iLcXjxq.exe
  2⤵
  PID:8660
- C:\Windows\System\RzktmAQ.exe
  C:\Windows\System\RzktmAQ.exe
  2⤵
  PID:8688
- C:\Windows\System\LWahfBC.exe
  C:\Windows\System\LWahfBC.exe
  2⤵
  PID:8712
- C:\Windows\System\ehVuihv.exe
  C:\Windows\System\ehVuihv.exe
  2⤵
  PID:8732
- C:\Windows\System\SQVvQsz.exe
  C:\Windows\System\SQVvQsz.exe
  2⤵
  PID:8760
- C:\Windows\System\DEpnaKv.exe
  C:\Windows\System\DEpnaKv.exe
  2⤵
  PID:8780
- C:\Windows\System\cJePxYB.exe
  C:\Windows\System\cJePxYB.exe
  2⤵
  PID:8804
- C:\Windows\System\LVKEjSf.exe
  C:\Windows\System\LVKEjSf.exe
  2⤵
  PID:8828
- C:\Windows\System\vJAubJe.exe
  C:\Windows\System\vJAubJe.exe
  2⤵
  PID:8852
- C:\Windows\System\RWGeWvw.exe
  C:\Windows\System\RWGeWvw.exe
  2⤵
  PID:8880
- C:\Windows\System\gNWnNcI.exe
  C:\Windows\System\gNWnNcI.exe
  2⤵
  PID:8904
- C:\Windows\System\Sidqygm.exe
  C:\Windows\System\Sidqygm.exe
  2⤵
  PID:8924
- C:\Windows\System\BlaJrCI.exe
  C:\Windows\System\BlaJrCI.exe
  2⤵
  PID:8948
- C:\Windows\System\YmOHXos.exe
  C:\Windows\System\YmOHXos.exe
  2⤵
  PID:8972
- C:\Windows\System\FjWsBVc.exe
  C:\Windows\System\FjWsBVc.exe
  2⤵
  PID:9004
- C:\Windows\System\qXZjeIN.exe
  C:\Windows\System\qXZjeIN.exe
  2⤵
  PID:9024
- C:\Windows\System\zQnWKPW.exe
  C:\Windows\System\zQnWKPW.exe
  2⤵
  PID:9048
- C:\Windows\System\WMGMkAg.exe
  C:\Windows\System\WMGMkAg.exe
  2⤵
  PID:9064
- C:\Windows\System\qrdwUwi.exe
  C:\Windows\System\qrdwUwi.exe
  2⤵
  PID:9088
- C:\Windows\System\RAmwOFv.exe
  C:\Windows\System\RAmwOFv.exe
  2⤵
  PID:9112
- C:\Windows\System\ANlMyLK.exe
  C:\Windows\System\ANlMyLK.exe
  2⤵
  PID:9132
- C:\Windows\System\DLrBUGq.exe
  C:\Windows\System\DLrBUGq.exe
  2⤵
  PID:9160
- C:\Windows\System\kdTRbdX.exe
  C:\Windows\System\kdTRbdX.exe
  2⤵
  PID:9180
- C:\Windows\System\HxEdQvY.exe
  C:\Windows\System\HxEdQvY.exe
  2⤵
  PID:7204
- C:\Windows\System\DqBhlsy.exe
  C:\Windows\System\DqBhlsy.exe
  2⤵
  PID:7800
- C:\Windows\System\eykxIIV.exe
  C:\Windows\System\eykxIIV.exe
  2⤵
  PID:8140
- C:\Windows\System\pNKNeiH.exe
  C:\Windows\System\pNKNeiH.exe
  2⤵
  PID:7616
- C:\Windows\System\VagSrQY.exe
  C:\Windows\System\VagSrQY.exe
  2⤵
  PID:7824
- C:\Windows\System\kDoIgCW.exe
  C:\Windows\System\kDoIgCW.exe
  2⤵
  PID:8272
- C:\Windows\System\iGKCIzs.exe
  C:\Windows\System\iGKCIzs.exe
  2⤵
  PID:7872
- C:\Windows\System\YenHtiN.exe
  C:\Windows\System\YenHtiN.exe
  2⤵
  PID:7356
- C:\Windows\System\aodPQYj.exe
  C:\Windows\System\aodPQYj.exe
  2⤵
  PID:8448
- C:\Windows\System\yOIgMjy.exe
  C:\Windows\System\yOIgMjy.exe
  2⤵
  PID:3624
- C:\Windows\System\kdAMUWo.exe
  C:\Windows\System\kdAMUWo.exe
  2⤵
  PID:8532
- C:\Windows\System\QMDveCJ.exe
  C:\Windows\System\QMDveCJ.exe
  2⤵
  PID:8564
- C:\Windows\System\JRWWLFo.exe
  C:\Windows\System\JRWWLFo.exe
  2⤵
  PID:8656
- C:\Windows\System\fjGnMGN.exe
  C:\Windows\System\fjGnMGN.exe
  2⤵
  PID:8680
- C:\Windows\System\uGffMak.exe
  C:\Windows\System\uGffMak.exe
  2⤵
  PID:8720
- C:\Windows\System\vIdSoOg.exe
  C:\Windows\System\vIdSoOg.exe
  2⤵
  PID:8768
- C:\Windows\System\dzdUFQj.exe
  C:\Windows\System\dzdUFQj.exe
  2⤵
  PID:8508
- C:\Windows\System\zMBnDXH.exe
  C:\Windows\System\zMBnDXH.exe
  2⤵
  PID:8584
- C:\Windows\System\KBlTJmT.exe
  C:\Windows\System\KBlTJmT.exe
  2⤵
  PID:9060
- C:\Windows\System\xaecQCI.exe
  C:\Windows\System\xaecQCI.exe
  2⤵
  PID:8788
- C:\Windows\System\gBQBsfU.exe
  C:\Windows\System\gBQBsfU.exe
  2⤵
  PID:8840
- C:\Windows\System\fogVdNV.exe
  C:\Windows\System\fogVdNV.exe
  2⤵
  PID:8892
- C:\Windows\System\aSGhBCQ.exe
  C:\Windows\System\aSGhBCQ.exe
  2⤵
  PID:8624
- C:\Windows\System\lnSAUMc.exe
  C:\Windows\System\lnSAUMc.exe
  2⤵
  PID:9152
- C:\Windows\System\gtaSVgY.exe
  C:\Windows\System\gtaSVgY.exe
  2⤵
  PID:7072
- C:\Windows\System\zIzswvF.exe
  C:\Windows\System\zIzswvF.exe
  2⤵
  PID:9200
- C:\Windows\System\ZKWTXzn.exe
  C:\Windows\System\ZKWTXzn.exe
  2⤵
  PID:8752
- C:\Windows\System\hXhplvk.exe
  C:\Windows\System\hXhplvk.exe
  2⤵
  PID:8940
- C:\Windows\System\OydDdAd.exe
  C:\Windows\System\OydDdAd.exe
  2⤵
  PID:8964
- C:\Windows\System\QaYkGbs.exe
  C:\Windows\System\QaYkGbs.exe
  2⤵
  PID:9236
- C:\Windows\System\VAOlefY.exe
  C:\Windows\System\VAOlefY.exe
  2⤵
  PID:9264
- C:\Windows\System\Uenohtn.exe
  C:\Windows\System\Uenohtn.exe
  2⤵
  PID:9284
- C:\Windows\System\LlWARTO.exe
  C:\Windows\System\LlWARTO.exe
  2⤵
  PID:9312
- C:\Windows\System\HEHGiiC.exe
  C:\Windows\System\HEHGiiC.exe
  2⤵
  PID:9344
- C:\Windows\System\rSmiYgL.exe
  C:\Windows\System\rSmiYgL.exe
  2⤵
  PID:9376
- C:\Windows\System\ZNFHeYB.exe
  C:\Windows\System\ZNFHeYB.exe
  2⤵
  PID:9400
- C:\Windows\System\rnIaTKm.exe
  C:\Windows\System\rnIaTKm.exe
  2⤵
  PID:9420
- C:\Windows\System\ohTbRsa.exe
  C:\Windows\System\ohTbRsa.exe
  2⤵
  PID:9444
- C:\Windows\System\NPFXTjr.exe
  C:\Windows\System\NPFXTjr.exe
  2⤵
  PID:9460
- C:\Windows\System\DDvMVSk.exe
  C:\Windows\System\DDvMVSk.exe
  2⤵
  PID:9484
- C:\Windows\System\hrpQFNc.exe
  C:\Windows\System\hrpQFNc.exe
  2⤵
  PID:9520
- C:\Windows\System\rtZkwSx.exe
  C:\Windows\System\rtZkwSx.exe
  2⤵
  PID:9552
- C:\Windows\System\iLCOvoi.exe
  C:\Windows\System\iLCOvoi.exe
  2⤵
  PID:9568
- C:\Windows\System\itEfMKo.exe
  C:\Windows\System\itEfMKo.exe
  2⤵
  PID:9592
- C:\Windows\System\RxwfnDA.exe
  C:\Windows\System\RxwfnDA.exe
  2⤵
  PID:9612
- C:\Windows\System\XTLMGll.exe
  C:\Windows\System\XTLMGll.exe
  2⤵
  PID:9636
- C:\Windows\System\ahbRFlx.exe
  C:\Windows\System\ahbRFlx.exe
  2⤵
  PID:9664
- C:\Windows\System\wKKCFfM.exe
  C:\Windows\System\wKKCFfM.exe
  2⤵
  PID:9700
- C:\Windows\System\SJOfpTn.exe
  C:\Windows\System\SJOfpTn.exe
  2⤵
  PID:9728
- C:\Windows\System\tkERSSf.exe
  C:\Windows\System\tkERSSf.exe
  2⤵
  PID:9744
- C:\Windows\System\ypuoNCj.exe
  C:\Windows\System\ypuoNCj.exe
  2⤵
  PID:9772
- C:\Windows\System\dlBlVPn.exe
  C:\Windows\System\dlBlVPn.exe
  2⤵
  PID:9788
- C:\Windows\System\setBfZD.exe
  C:\Windows\System\setBfZD.exe
  2⤵
  PID:9820
- C:\Windows\System\qkkWqep.exe
  C:\Windows\System\qkkWqep.exe
  2⤵
  PID:9852
- C:\Windows\System\lQiNOHc.exe
  C:\Windows\System\lQiNOHc.exe
  2⤵
  PID:9880
- C:\Windows\System\OwBRrsR.exe
  C:\Windows\System\OwBRrsR.exe
  2⤵
  PID:9908
- C:\Windows\System\ypuhaHF.exe
  C:\Windows\System\ypuhaHF.exe
  2⤵
  PID:9928
- C:\Windows\System\NvRPONo.exe
  C:\Windows\System\NvRPONo.exe
  2⤵
  PID:9956
- C:\Windows\System\tyKqJWu.exe
  C:\Windows\System\tyKqJWu.exe
  2⤵
  PID:9984
- C:\Windows\System\aAvGUjP.exe
  C:\Windows\System\aAvGUjP.exe
  2⤵
  PID:10000
- C:\Windows\System\vKHzrRN.exe
  C:\Windows\System\vKHzrRN.exe
  2⤵
  PID:10032
- C:\Windows\System\hDkWbTH.exe
  C:\Windows\System\hDkWbTH.exe
  2⤵
  PID:10052
- C:\Windows\System\iGVlCfU.exe
  C:\Windows\System\iGVlCfU.exe
  2⤵
  PID:10072
- C:\Windows\System\ygFwbzu.exe
  C:\Windows\System\ygFwbzu.exe
  2⤵
  PID:10096
- C:\Windows\System\uvElMdi.exe
  C:\Windows\System\uvElMdi.exe
  2⤵
  PID:10116
- C:\Windows\System\biUZUnQ.exe
  C:\Windows\System\biUZUnQ.exe
  2⤵
  PID:10132
- C:\Windows\System\QGlPOQM.exe
  C:\Windows\System\QGlPOQM.exe
  2⤵
  PID:10152
- C:\Windows\System\clhvyiT.exe
  C:\Windows\System\clhvyiT.exe
  2⤵
  PID:10172
- C:\Windows\System\mJImZVb.exe
  C:\Windows\System\mJImZVb.exe
  2⤵
  PID:10192
- C:\Windows\System\KCQqHTb.exe
  C:\Windows\System\KCQqHTb.exe
  2⤵
  PID:10216
- C:\Windows\System\HBCsYQH.exe
  C:\Windows\System\HBCsYQH.exe
  2⤵
  PID:8116
- C:\Windows\System\ucrgbnJ.exe
  C:\Windows\System\ucrgbnJ.exe
  2⤵
  PID:8428
- C:\Windows\System\WtaLGeG.exe
  C:\Windows\System\WtaLGeG.exe
  2⤵
  PID:8696
- C:\Windows\System\QzWMyUi.exe
  C:\Windows\System\QzWMyUi.exe
  2⤵
  PID:8304
- C:\Windows\System\zXEOIhe.exe
  C:\Windows\System\zXEOIhe.exe
  2⤵
  PID:7304
- C:\Windows\System\NYbIFtT.exe
  C:\Windows\System\NYbIFtT.exe
  2⤵
  PID:7968
- C:\Windows\System\XrkoqRs.exe
  C:\Windows\System\XrkoqRs.exe
  2⤵
  PID:9304
- C:\Windows\System\TpnFeuH.exe
  C:\Windows\System\TpnFeuH.exe
  2⤵
  PID:9356
- C:\Windows\System\UKYuPfT.exe
  C:\Windows\System\UKYuPfT.exe
  2⤵
  PID:9428
- C:\Windows\System\dHXJvsa.exe
  C:\Windows\System\dHXJvsa.exe
  2⤵
  PID:9476
- C:\Windows\System\ioSLSuB.exe
  C:\Windows\System\ioSLSuB.exe
  2⤵
  PID:9712
- C:\Windows\System\kwJuBGo.exe
  C:\Windows\System\kwJuBGo.exe
  2⤵
  PID:9328
- C:\Windows\System\EvJntKg.exe
  C:\Windows\System\EvJntKg.exe
  2⤵
  PID:9816
- C:\Windows\System\QlpIIdU.exe
  C:\Windows\System\QlpIIdU.exe
  2⤵
  PID:9480
- C:\Windows\System\CtoSCdK.exe
  C:\Windows\System\CtoSCdK.exe
  2⤵
  PID:7796
- C:\Windows\System\RQogCzk.exe
  C:\Windows\System\RQogCzk.exe
  2⤵
  PID:9560
- C:\Windows\System\RYnqyfb.exe
  C:\Windows\System\RYnqyfb.exe
  2⤵
  PID:9948
- C:\Windows\System\GkhPHoj.exe
  C:\Windows\System\GkhPHoj.exe
  2⤵
  PID:10044
- C:\Windows\System\nreRpvs.exe
  C:\Windows\System\nreRpvs.exe
  2⤵
  PID:9648
- C:\Windows\System\BbWnhdh.exe
  C:\Windows\System\BbWnhdh.exe
  2⤵
  PID:9740
- C:\Windows\System\SSslrXd.exe
  C:\Windows\System\SSslrXd.exe
  2⤵
  PID:10260
- C:\Windows\System\BpNPTAc.exe
  C:\Windows\System\BpNPTAc.exe
  2⤵
  PID:10284
- C:\Windows\System\CiVBtWe.exe
  C:\Windows\System\CiVBtWe.exe
  2⤵
  PID:10304
- C:\Windows\System\MXSzzuO.exe
  C:\Windows\System\MXSzzuO.exe
  2⤵
  PID:10332
- C:\Windows\System\nCcdQUu.exe
  C:\Windows\System\nCcdQUu.exe
  2⤵
  PID:10360
- C:\Windows\System\MXshoVd.exe
  C:\Windows\System\MXshoVd.exe
  2⤵
  PID:10392
- C:\Windows\System\ffzMzeC.exe
  C:\Windows\System\ffzMzeC.exe
  2⤵
  PID:10416
- C:\Windows\System\uiNWwAQ.exe
  C:\Windows\System\uiNWwAQ.exe
  2⤵
  PID:10440
- C:\Windows\System\xuYjHJw.exe
  C:\Windows\System\xuYjHJw.exe
  2⤵
  PID:10472
- C:\Windows\System\MAvCLoa.exe
  C:\Windows\System\MAvCLoa.exe
  2⤵
  PID:10492
- C:\Windows\System\JeISaQK.exe
  C:\Windows\System\JeISaQK.exe
  2⤵
  PID:10608
- C:\Windows\System\DEohCuq.exe
  C:\Windows\System\DEohCuq.exe
  2⤵
  PID:10648
- C:\Windows\System\LnCBuJw.exe
  C:\Windows\System\LnCBuJw.exe
  2⤵
  PID:10680
- C:\Windows\System\FFsfDkq.exe
  C:\Windows\System\FFsfDkq.exe
  2⤵
  PID:10696
- C:\Windows\System\FnasUvQ.exe
  C:\Windows\System\FnasUvQ.exe
  2⤵
  PID:10712
- C:\Windows\System\IuMamMm.exe
  C:\Windows\System\IuMamMm.exe
  2⤵
  PID:10736
- C:\Windows\System\vaBoehz.exe
  C:\Windows\System\vaBoehz.exe
  2⤵
  PID:10752
- C:\Windows\System\wFKbiTU.exe
  C:\Windows\System\wFKbiTU.exe
  2⤵
  PID:10768
- C:\Windows\System\JhodVmI.exe
  C:\Windows\System\JhodVmI.exe
  2⤵
  PID:10788
- C:\Windows\System\eAIXsFL.exe
  C:\Windows\System\eAIXsFL.exe
  2⤵
  PID:10808
- C:\Windows\System\UbzNYaZ.exe
  C:\Windows\System\UbzNYaZ.exe
  2⤵
  PID:10824
- C:\Windows\System\UbztKAV.exe
  C:\Windows\System\UbztKAV.exe
  2⤵
  PID:10848
- C:\Windows\System\sPpGvaA.exe
  C:\Windows\System\sPpGvaA.exe
  2⤵
  PID:10876
- C:\Windows\System\sFCcHIk.exe
  C:\Windows\System\sFCcHIk.exe
  2⤵
  PID:10900
- C:\Windows\System\fMTvhXu.exe
  C:\Windows\System\fMTvhXu.exe
  2⤵
  PID:10920
- C:\Windows\System\neQrtFP.exe
  C:\Windows\System\neQrtFP.exe
  2⤵
  PID:10952
- C:\Windows\System\WauIhYr.exe
  C:\Windows\System\WauIhYr.exe
  2⤵
  PID:10984
- C:\Windows\System\dxccZrj.exe
  C:\Windows\System\dxccZrj.exe
  2⤵
  PID:11012
- C:\Windows\System\NHNeVFZ.exe
  C:\Windows\System\NHNeVFZ.exe
  2⤵
  PID:11044
- C:\Windows\System\kRhirKS.exe
  C:\Windows\System\kRhirKS.exe
  2⤵
  PID:11064
- C:\Windows\System\oKZhOpq.exe
  C:\Windows\System\oKZhOpq.exe
  2⤵
  PID:11084
- C:\Windows\System\XlVBMQq.exe
  C:\Windows\System\XlVBMQq.exe
  2⤵
  PID:11124
- C:\Windows\System\YLMtRiE.exe
  C:\Windows\System\YLMtRiE.exe
  2⤵
  PID:11152
- C:\Windows\System\XitArmy.exe
  C:\Windows\System\XitArmy.exe
  2⤵
  PID:11180
- C:\Windows\System\YYGuGmd.exe
  C:\Windows\System\YYGuGmd.exe
  2⤵
  PID:11200
- C:\Windows\System\JulTzeh.exe
  C:\Windows\System\JulTzeh.exe
  2⤵
  PID:11232
- C:\Windows\System\EzyLcLy.exe
  C:\Windows\System\EzyLcLy.exe
  2⤵
  PID:11252
- C:\Windows\System\MbgVpal.exe
  C:\Windows\System\MbgVpal.exe
  2⤵
  PID:9412
- C:\Windows\System\vquYhre.exe
  C:\Windows\System\vquYhre.exe
  2⤵
  PID:8552
- C:\Windows\System\cKkKaEe.exe
  C:\Windows\System\cKkKaEe.exe
  2⤵
  PID:9224
- C:\Windows\System\zBwOmOn.exe
  C:\Windows\System\zBwOmOn.exe
  2⤵
  PID:9300
- C:\Windows\System\NDqcLBN.exe
  C:\Windows\System\NDqcLBN.exe
  2⤵
  PID:10068
- C:\Windows\System\TUIoRXA.exe
  C:\Windows\System\TUIoRXA.exe
  2⤵
  PID:9780
- C:\Windows\System\bqWomzN.exe
  C:\Windows\System\bqWomzN.exe
  2⤵
  PID:10248
- C:\Windows\System\CFZZdYC.exe
  C:\Windows\System\CFZZdYC.exe
  2⤵
  PID:10280
- C:\Windows\System\xOEpeyd.exe
  C:\Windows\System\xOEpeyd.exe
  2⤵
  PID:10412
- C:\Windows\System\JwjcVXe.exe
  C:\Windows\System\JwjcVXe.exe
  2⤵
  PID:10512
- C:\Windows\System\hZlclPt.exe
  C:\Windows\System\hZlclPt.exe
  2⤵
  PID:10268
- C:\Windows\System\WYuEWty.exe
  C:\Windows\System\WYuEWty.exe
  2⤵
  PID:9544
- C:\Windows\System\bluUZcd.exe
  C:\Windows\System\bluUZcd.exe
  2⤵
  PID:9392
- C:\Windows\System\EJuKkjj.exe
  C:\Windows\System\EJuKkjj.exe
  2⤵
  PID:9976
- C:\Windows\System\BYEKrOa.exe
  C:\Windows\System\BYEKrOa.exe
  2⤵
  PID:9996
- C:\Windows\System\VQMkWpD.exe
  C:\Windows\System\VQMkWpD.exe
  2⤵
  PID:10024
- C:\Windows\System\DCmIszT.exe
  C:\Windows\System\DCmIszT.exe
  2⤵
  PID:9924
- C:\Windows\System\ACugikZ.exe
  C:\Windows\System\ACugikZ.exe
  2⤵
  PID:9684
- C:\Windows\System\EsBiFjA.exe
  C:\Windows\System\EsBiFjA.exe
  2⤵
  PID:10276
- C:\Windows\System\BmbcqPo.exe
  C:\Windows\System\BmbcqPo.exe
  2⤵
  PID:10432
- C:\Windows\System\SxLOrHp.exe
  C:\Windows\System\SxLOrHp.exe
  2⤵
  PID:10660
- C:\Windows\System\QtGjZZA.exe
  C:\Windows\System\QtGjZZA.exe
  2⤵
  PID:10800
- C:\Windows\System\VxGazup.exe
  C:\Windows\System\VxGazup.exe
  2⤵
  PID:9456
- C:\Windows\System\OcIinDX.exe
  C:\Windows\System\OcIinDX.exe
  2⤵
  PID:9944
- C:\Windows\System\gZOeMWV.exe
  C:\Windows\System\gZOeMWV.exe
  2⤵
  PID:11100
- C:\Windows\System\IeZmVpa.exe
  C:\Windows\System\IeZmVpa.exe
  2⤵
  PID:11216
- C:\Windows\System\otffQtA.exe
  C:\Windows\System\otffQtA.exe
  2⤵
  PID:11248
- C:\Windows\System\npApCGP.exe
  C:\Windows\System\npApCGP.exe
  2⤵
  PID:11376
- C:\Windows\System\rnfAMlN.exe
  C:\Windows\System\rnfAMlN.exe
  2⤵
  PID:11404
- C:\Windows\System\VeaFAem.exe
  C:\Windows\System\VeaFAem.exe
  2⤵
  PID:11468
- C:\Windows\System\PRzCIlw.exe
  C:\Windows\System\PRzCIlw.exe
  2⤵
  PID:11548
- C:\Windows\System\kixtOFV.exe
  C:\Windows\System\kixtOFV.exe
  2⤵
  PID:11572
- C:\Windows\System\hoRxFDL.exe
  C:\Windows\System\hoRxFDL.exe
  2⤵
  PID:11600
- C:\Windows\System\xkHCtyM.exe
  C:\Windows\System\xkHCtyM.exe
  2⤵
  PID:11620
- C:\Windows\System\twcrRzN.exe
  C:\Windows\System\twcrRzN.exe
  2⤵
  PID:11664
- C:\Windows\System\AxjsgME.exe
  C:\Windows\System\AxjsgME.exe
  2⤵
  PID:11684
- C:\Windows\System\ohskPTg.exe
  C:\Windows\System\ohskPTg.exe
  2⤵
  PID:11712
- C:\Windows\System\OFpVTvl.exe
  C:\Windows\System\OFpVTvl.exe
  2⤵
  PID:11744
- C:\Windows\System\ZtMWTBC.exe
  C:\Windows\System\ZtMWTBC.exe
  2⤵
  PID:11764
- C:\Windows\System\oYvulcm.exe
  C:\Windows\System\oYvulcm.exe
  2⤵
  PID:11780
- C:\Windows\System\QDCaobQ.exe
  C:\Windows\System\QDCaobQ.exe
  2⤵
  PID:11816
- C:\Windows\System\jQVnHkN.exe
  C:\Windows\System\jQVnHkN.exe
  2⤵
  PID:11852
- C:\Windows\System\Gzrovfb.exe
  C:\Windows\System\Gzrovfb.exe
  2⤵
  PID:11880
- C:\Windows\System\MZVCHQb.exe
  C:\Windows\System\MZVCHQb.exe
  2⤵
  PID:11908
- C:\Windows\System\TwLrPEt.exe
  C:\Windows\System\TwLrPEt.exe
  2⤵
  PID:11948
- C:\Windows\System\gJiESmv.exe
  C:\Windows\System\gJiESmv.exe
  2⤵
  PID:11984
- C:\Windows\System\zGnBtpD.exe
  C:\Windows\System\zGnBtpD.exe
  2⤵
  PID:12020
- C:\Windows\System\XzvtLkR.exe
  C:\Windows\System\XzvtLkR.exe
  2⤵
  PID:12060
- C:\Windows\System\RHphmeq.exe
  C:\Windows\System\RHphmeq.exe
  2⤵
  PID:12084
- C:\Windows\System\nufOlCz.exe
  C:\Windows\System\nufOlCz.exe
  2⤵
  PID:12108
- C:\Windows\System\ifGQTsz.exe
  C:\Windows\System\ifGQTsz.exe
  2⤵
  PID:12128
- C:\Windows\System\hOKWwVI.exe
  C:\Windows\System\hOKWwVI.exe
  2⤵
  PID:12160
- C:\Windows\System\wKiSQnV.exe
  C:\Windows\System\wKiSQnV.exe
  2⤵
  PID:12184
- C:\Windows\System\xGgcSAy.exe
  C:\Windows\System\xGgcSAy.exe
  2⤵
  PID:12216
- C:\Windows\System\aAwqwvu.exe
  C:\Windows\System\aAwqwvu.exe
  2⤵
  PID:12248
- C:\Windows\System\fXUVgLL.exe
  C:\Windows\System\fXUVgLL.exe
  2⤵
  PID:12264
- C:\Windows\System\BaWXtgB.exe
  C:\Windows\System\BaWXtgB.exe
  2⤵
  PID:12284
- C:\Windows\System\cUAoGHo.exe
  C:\Windows\System\cUAoGHo.exe
  2⤵
  PID:10796
- C:\Windows\System\SzevAFK.exe
  C:\Windows\System\SzevAFK.exe
  2⤵
  PID:9644
- C:\Windows\System\nDOEXDV.exe
  C:\Windows\System\nDOEXDV.exe
  2⤵
  PID:10888
- C:\Windows\System\ixVgDFp.exe
  C:\Windows\System\ixVgDFp.exe
  2⤵
  PID:9940
- C:\Windows\System\OKtirBF.exe
  C:\Windows\System\OKtirBF.exe
  2⤵
  PID:9248
- C:\Windows\System\ineDQBc.exe
  C:\Windows\System\ineDQBc.exe
  2⤵
  PID:11020
- C:\Windows\System\MWHMuIe.exe
  C:\Windows\System\MWHMuIe.exe
  2⤵
  PID:11052
- C:\Windows\System\SSgehqa.exe
  C:\Windows\System\SSgehqa.exe
  2⤵
  PID:11192
- C:\Windows\System\TDUBZMO.exe
  C:\Windows\System\TDUBZMO.exe
  2⤵
  PID:10232
- C:\Windows\System\YluDFOW.exe
  C:\Windows\System\YluDFOW.exe
  2⤵
  PID:9516
- C:\Windows\System\BAHtgew.exe
  C:\Windows\System\BAHtgew.exe
  2⤵
  PID:9876
- C:\Windows\System\oGDYoYs.exe
  C:\Windows\System\oGDYoYs.exe
  2⤵
  PID:8960
- C:\Windows\System\BuBWbTZ.exe
  C:\Windows\System\BuBWbTZ.exe
  2⤵
  PID:10704
- C:\Windows\System\hMMwFDZ.exe
  C:\Windows\System\hMMwFDZ.exe
  2⤵
  PID:11240
- C:\Windows\System\wzrROYr.exe
  C:\Windows\System\wzrROYr.exe
  2⤵
  PID:11196
- C:\Windows\System\nUXnwel.exe
  C:\Windows\System\nUXnwel.exe
  2⤵
  PID:11268
- C:\Windows\System\iouxdwP.exe
  C:\Windows\System\iouxdwP.exe
  2⤵
  PID:11592
- C:\Windows\System\CWqArPA.exe
  C:\Windows\System\CWqArPA.exe
  2⤵
  PID:11676
- C:\Windows\System\BgcjKiS.exe
  C:\Windows\System\BgcjKiS.exe
  2⤵
  PID:11424
- C:\Windows\System\AkgXsPZ.exe
  C:\Windows\System\AkgXsPZ.exe
  2⤵
  PID:11804
- C:\Windows\System\uuSFzaq.exe
  C:\Windows\System\uuSFzaq.exe
  2⤵
  PID:11876
- C:\Windows\System\lqbBdem.exe
  C:\Windows\System\lqbBdem.exe
  2⤵
  PID:11896
- C:\Windows\System\DHMYNKs.exe
  C:\Windows\System\DHMYNKs.exe
  2⤵
  PID:11324
- C:\Windows\System\JcaVKNn.exe
  C:\Windows\System\JcaVKNn.exe
  2⤵
  PID:12116
- C:\Windows\System\pLKwuFC.exe
  C:\Windows\System\pLKwuFC.exe
  2⤵
  PID:12212
- C:\Windows\System\dTDrDKP.exe
  C:\Windows\System\dTDrDKP.exe
  2⤵
  PID:12260
- C:\Windows\System\LUqdSWc.exe
  C:\Windows\System\LUqdSWc.exe
  2⤵
  PID:10344
- C:\Windows\System\CjQPHhH.exe
  C:\Windows\System\CjQPHhH.exe
  2⤵
  PID:10948
- C:\Windows\System\DwJazKw.exe
  C:\Windows\System\DwJazKw.exe
  2⤵
  PID:12308
- C:\Windows\System\zpEDssL.exe
  C:\Windows\System\zpEDssL.exe
  2⤵
  PID:12332
- C:\Windows\System\lZINbPM.exe
  C:\Windows\System\lZINbPM.exe
  2⤵
  PID:12356
- C:\Windows\System\RJMyXFO.exe
  C:\Windows\System\RJMyXFO.exe
  2⤵
  PID:12376
- C:\Windows\System\HLrGdfN.exe
  C:\Windows\System\HLrGdfN.exe
  2⤵
  PID:12392
- C:\Windows\System\mHUclji.exe
  C:\Windows\System\mHUclji.exe
  2⤵
  PID:12412
- C:\Windows\System\EbBErmH.exe
  C:\Windows\System\EbBErmH.exe
  2⤵
  PID:12436
- C:\Windows\System\zgqXySK.exe
  C:\Windows\System\zgqXySK.exe
  2⤵
  PID:12460
- C:\Windows\System\ZFQhowp.exe
  C:\Windows\System\ZFQhowp.exe
  2⤵
  PID:12484
- C:\Windows\System\vxvSdMU.exe
  C:\Windows\System\vxvSdMU.exe
  2⤵
  PID:12520
- C:\Windows\System\DTlHwFd.exe
  C:\Windows\System\DTlHwFd.exe
  2⤵
  PID:12544
- C:\Windows\System\hYIrNXI.exe
  C:\Windows\System\hYIrNXI.exe
  2⤵
  PID:12560
- C:\Windows\System\pliHQhz.exe
  C:\Windows\System\pliHQhz.exe
  2⤵
  PID:12580
- C:\Windows\System\HNQxrVt.exe
  C:\Windows\System\HNQxrVt.exe
  2⤵
  PID:12600
- C:\Windows\System\Dzsmjpf.exe
  C:\Windows\System\Dzsmjpf.exe
  2⤵
  PID:12624
- C:\Windows\System\aHoNMRD.exe
  C:\Windows\System\aHoNMRD.exe
  2⤵
  PID:12644
- C:\Windows\System\rzXOGQw.exe
  C:\Windows\System\rzXOGQw.exe
  2⤵
  PID:12676
- C:\Windows\System\gUbeozs.exe
  C:\Windows\System\gUbeozs.exe
  2⤵
  PID:12692
- C:\Windows\System\WPTJMRx.exe
  C:\Windows\System\WPTJMRx.exe
  2⤵
  PID:12708
- C:\Windows\System\fBFifkc.exe
  C:\Windows\System\fBFifkc.exe
  2⤵
  PID:12736
- C:\Windows\System\OUohqNe.exe
  C:\Windows\System\OUohqNe.exe
  2⤵
  PID:12752
- C:\Windows\System\vkkbOIv.exe
  C:\Windows\System\vkkbOIv.exe
  2⤵
  PID:12772
- C:\Windows\System\ibedTQq.exe
  C:\Windows\System\ibedTQq.exe
  2⤵
  PID:12796
- C:\Windows\System\pjvxBtP.exe
  C:\Windows\System\pjvxBtP.exe
  2⤵
  PID:12824
- C:\Windows\System\coQXBwh.exe
  C:\Windows\System\coQXBwh.exe
  2⤵
  PID:12840
- C:\Windows\System\CPOGXhI.exe
  C:\Windows\System\CPOGXhI.exe
  2⤵
  PID:12868
- C:\Windows\System\xZSeOxP.exe
  C:\Windows\System\xZSeOxP.exe
  2⤵
  PID:12884
- C:\Windows\System\tgoaEaa.exe
  C:\Windows\System\tgoaEaa.exe
  2⤵
  PID:12916
- C:\Windows\System\hXsmYZC.exe
  C:\Windows\System\hXsmYZC.exe
  2⤵
  PID:12944
- C:\Windows\System\tgytcqO.exe
  C:\Windows\System\tgytcqO.exe
  2⤵
  PID:12972
- C:\Windows\System\GbNuNVM.exe
  C:\Windows\System\GbNuNVM.exe
  2⤵
  PID:12996
- C:\Windows\System\DyTlYtP.exe
  C:\Windows\System\DyTlYtP.exe
  2⤵
  PID:13016
- C:\Windows\System\PNDpBiU.exe
  C:\Windows\System\PNDpBiU.exe
  2⤵
  PID:13040
- C:\Windows\System\hIwqzLK.exe
  C:\Windows\System\hIwqzLK.exe
  2⤵
  PID:13064
- C:\Windows\System\fWpDOFT.exe
  C:\Windows\System\fWpDOFT.exe
  2⤵
  PID:13092
- C:\Windows\System\LPsyGhk.exe
  C:\Windows\System\LPsyGhk.exe
  2⤵
  PID:13108
- C:\Windows\System\mfdNWlz.exe
  C:\Windows\System\mfdNWlz.exe
  2⤵
  PID:13132
- C:\Windows\System\MpwKTci.exe
  C:\Windows\System\MpwKTci.exe
  2⤵
  PID:13156
- C:\Windows\System\HYdJLOp.exe
  C:\Windows\System\HYdJLOp.exe
  2⤵
  PID:13172
- C:\Windows\System\rLpeynl.exe
  C:\Windows\System\rLpeynl.exe
  2⤵
  PID:13188
- C:\Windows\System\nXaKqOQ.exe
  C:\Windows\System\nXaKqOQ.exe
  2⤵
  PID:13212
- C:\Windows\System\qSWtVXU.exe
  C:\Windows\System\qSWtVXU.exe
  2⤵
  PID:13240
- C:\Windows\System\SuDDcAf.exe
  C:\Windows\System\SuDDcAf.exe
  2⤵
  PID:13272
- C:\Windows\System\ZsNwklD.exe
  C:\Windows\System\ZsNwklD.exe
  2⤵
  PID:13292
- C:\Windows\System\USxBpxQ.exe
  C:\Windows\System\USxBpxQ.exe
  2⤵
  PID:11928
- C:\Windows\System\pcoZbGJ.exe
  C:\Windows\System\pcoZbGJ.exe
  2⤵
  PID:12012
- C:\Windows\System\IzAdFPp.exe
  C:\Windows\System\IzAdFPp.exe
  2⤵
  PID:12076
- C:\Windows\System\uULiVrX.exe
  C:\Windows\System\uULiVrX.exe
  2⤵
  PID:12104
- C:\Windows\System\GIAdfAp.exe
  C:\Windows\System\GIAdfAp.exe
  2⤵
  PID:12172
- C:\Windows\System\KwtLhTl.exe
  C:\Windows\System\KwtLhTl.exe
  2⤵
  PID:11360
- C:\Windows\System\zLhgLcN.exe
  C:\Windows\System\zLhgLcN.exe
  2⤵
  PID:12208
- C:\Windows\System\KdjZIfD.exe
  C:\Windows\System\KdjZIfD.exe
  2⤵
  PID:11752
- C:\Windows\System\RqosEBO.exe
  C:\Windows\System\RqosEBO.exe
  2⤵
  PID:11936
- C:\Windows\System\kDTBHJB.exe
  C:\Windows\System\kDTBHJB.exe
  2⤵
  PID:12300
- C:\Windows\System\JpUGJWd.exe
  C:\Windows\System\JpUGJWd.exe
  2⤵
  PID:11964
- C:\Windows\System\jBSscVF.exe
  C:\Windows\System\jBSscVF.exe
  2⤵
  PID:12000
- C:\Windows\System\bbvBpvf.exe
  C:\Windows\System\bbvBpvf.exe
  2⤵
  PID:12120
- C:\Windows\System\LhODHtg.exe
  C:\Windows\System\LhODHtg.exe
  2⤵
  PID:12504
- C:\Windows\System\kXebsvq.exe
  C:\Windows\System\kXebsvq.exe
  2⤵
  PID:11612
- C:\Windows\System\guMVjbW.exe
  C:\Windows\System\guMVjbW.exe
  2⤵
  PID:12228
- C:\Windows\System\AFAbPqX.exe
  C:\Windows\System\AFAbPqX.exe
  2⤵
  PID:12620
- C:\Windows\System\SemkUvV.exe
  C:\Windows\System\SemkUvV.exe
  2⤵
  PID:12704
- C:\Windows\System\YxqoAzK.exe
  C:\Windows\System\YxqoAzK.exe
  2⤵
  PID:12780
- C:\Windows\System\ojxnrvW.exe
  C:\Windows\System\ojxnrvW.exe
  2⤵
  PID:12820
- C:\Windows\System\JvZlnVc.exe
  C:\Windows\System\JvZlnVc.exe
  2⤵
  PID:12856
- C:\Windows\System\fSUzNFZ.exe
  C:\Windows\System\fSUzNFZ.exe
  2⤵
  PID:10184
- C:\Windows\System\ytjOYKe.exe
  C:\Windows\System\ytjOYKe.exe
  2⤵
  PID:12992
- C:\Windows\System\bezjxqa.exe
  C:\Windows\System\bezjxqa.exe
  2⤵
  PID:13032
- C:\Windows\System\QFgxmlA.exe
  C:\Windows\System\QFgxmlA.exe
  2⤵
  PID:13328
- C:\Windows\System\tNntBqb.exe
  C:\Windows\System\tNntBqb.exe
  2⤵
  PID:13352
- C:\Windows\System\GdLViLT.exe
  C:\Windows\System\GdLViLT.exe
  2⤵
  PID:13372
- C:\Windows\System\euLBsKB.exe
  C:\Windows\System\euLBsKB.exe
  2⤵
  PID:13408
- C:\Windows\System\FsraOPs.exe
  C:\Windows\System\FsraOPs.exe
  2⤵
  PID:13424
- C:\Windows\System\uGmqWuU.exe
  C:\Windows\System\uGmqWuU.exe
  2⤵
  PID:13448
- C:\Windows\System\gqocecf.exe
  C:\Windows\System\gqocecf.exe
  2⤵
  PID:13464
- C:\Windows\System\yIUxewJ.exe
  C:\Windows\System\yIUxewJ.exe
  2⤵
  PID:13488
- C:\Windows\System\nZxKGoj.exe
  C:\Windows\System\nZxKGoj.exe
  2⤵
  PID:13512
- C:\Windows\System\uWZPcjY.exe
  C:\Windows\System\uWZPcjY.exe
  2⤵
  PID:13536
- C:\Windows\System\taVABPd.exe
  C:\Windows\System\taVABPd.exe
  2⤵
  PID:13560
- C:\Windows\System\jrnFBgY.exe
  C:\Windows\System\jrnFBgY.exe
  2⤵
  PID:13584
- C:\Windows\System\NJSrTSd.exe
  C:\Windows\System\NJSrTSd.exe
  2⤵
  PID:13600
- C:\Windows\System\yIioKsb.exe
  C:\Windows\System\yIioKsb.exe
  2⤵
  PID:13620
- C:\Windows\System\nQFTrzF.exe
  C:\Windows\System\nQFTrzF.exe
  2⤵
  PID:13656
- C:\Windows\System\pWhDsLg.exe
  C:\Windows\System\pWhDsLg.exe
  2⤵
  PID:13680
- C:\Windows\System\coeRmpG.exe
  C:\Windows\System\coeRmpG.exe
  2⤵
  PID:13696
- C:\Windows\System\ZVSjTny.exe
  C:\Windows\System\ZVSjTny.exe
  2⤵
  PID:13720
- C:\Windows\System\vFFVkmB.exe
  C:\Windows\System\vFFVkmB.exe
  2⤵
  PID:13748
- C:\Windows\System\xhStrtT.exe
  C:\Windows\System\xhStrtT.exe
  2⤵
  PID:13764
- C:\Windows\System\IrAnFQW.exe
  C:\Windows\System\IrAnFQW.exe
  2⤵
  PID:13780
- C:\Windows\System\XwhlVEy.exe
  C:\Windows\System\XwhlVEy.exe
  2⤵
  PID:13800
- C:\Windows\System\cFMnWVh.exe
  C:\Windows\System\cFMnWVh.exe
  2⤵
  PID:13816
- C:\Windows\System\GbYLEYt.exe
  C:\Windows\System\GbYLEYt.exe
  2⤵
  PID:13840
- C:\Windows\System\Fmowrci.exe
  C:\Windows\System\Fmowrci.exe
  2⤵
  PID:13860
- C:\Windows\System\wBHrfpI.exe
  C:\Windows\System\wBHrfpI.exe
  2⤵
  PID:13880
- C:\Windows\System\cNqWkXs.exe
  C:\Windows\System\cNqWkXs.exe
  2⤵
  PID:13904
- C:\Windows\System\sBTaAiP.exe
  C:\Windows\System\sBTaAiP.exe
  2⤵
  PID:13936
- C:\Windows\System\KTgqWqV.exe
  C:\Windows\System\KTgqWqV.exe
  2⤵
  PID:13952
- C:\Windows\System\OiyRaWY.exe
  C:\Windows\System\OiyRaWY.exe
  2⤵
  PID:13968
- C:\Windows\System\VeWjqiM.exe
  C:\Windows\System\VeWjqiM.exe
  2⤵
  PID:13996
- C:\Windows\System\hvMlMTR.exe
  C:\Windows\System\hvMlMTR.exe
  2⤵
  PID:14016
- C:\Windows\System\SUeFXzk.exe
  C:\Windows\System\SUeFXzk.exe
  2⤵
  PID:14032
- C:\Windows\System\HvcujMJ.exe
  C:\Windows\System\HvcujMJ.exe
  2⤵
  PID:14056
- C:\Windows\System\eIqJlaE.exe
  C:\Windows\System\eIqJlaE.exe
  2⤵
  PID:14076
- C:\Windows\System\HmHgmpD.exe
  C:\Windows\System\HmHgmpD.exe
  2⤵
  PID:14092
- C:\Windows\System\RUEzgoO.exe
  C:\Windows\System\RUEzgoO.exe
  2⤵
  PID:14112
- C:\Windows\System\fahajlh.exe
  C:\Windows\System\fahajlh.exe
  2⤵
  PID:14132
- C:\Windows\System\OsGFGnZ.exe
  C:\Windows\System\OsGFGnZ.exe
  2⤵
  PID:14152
- C:\Windows\System\AJLCEEq.exe
  C:\Windows\System\AJLCEEq.exe
  2⤵
  PID:14172
- C:\Windows\System\zaVYOWO.exe
  C:\Windows\System\zaVYOWO.exe
  2⤵
  PID:14188
- C:\Windows\System\ijMPvEI.exe
  C:\Windows\System\ijMPvEI.exe
  2⤵
  PID:14212
- C:\Windows\System\nFWujyp.exe
  C:\Windows\System\nFWujyp.exe
  2⤵
  PID:14228
- C:\Windows\System\FzGLmlA.exe
  C:\Windows\System\FzGLmlA.exe
  2⤵
  PID:14260
- C:\Windows\System\UdQMmEg.exe
  C:\Windows\System\UdQMmEg.exe
  2⤵
  PID:14284
- C:\Windows\System\pFJEYmf.exe
  C:\Windows\System\pFJEYmf.exe
  2⤵
  PID:14300
- C:\Windows\System\VExVcjA.exe
  C:\Windows\System\VExVcjA.exe
  2⤵
  PID:14316
- C:\Windows\System\NuLsqXY.exe
  C:\Windows\System\NuLsqXY.exe
  2⤵
  PID:13060
- C:\Windows\System\GaeqvJN.exe
  C:\Windows\System\GaeqvJN.exe
  2⤵
  PID:13152
- C:\Windows\System\yvWDddO.exe
  C:\Windows\System\yvWDddO.exe
  2⤵
  PID:12572
- C:\Windows\System\gpJqNTf.exe
  C:\Windows\System\gpJqNTf.exe
  2⤵
  PID:13288
- C:\Windows\System\MXmEMnr.exe
  C:\Windows\System\MXmEMnr.exe
  2⤵
  PID:9172
- C:\Windows\System\RkdFxCI.exe
  C:\Windows\System\RkdFxCI.exe
  2⤵
  PID:11616
- C:\Windows\System\XBbzmAy.exe
  C:\Windows\System\XBbzmAy.exe
  2⤵
  PID:12724
- C:\Windows\System\CicBPvZ.exe
  C:\Windows\System\CicBPvZ.exe
  2⤵
  PID:11892
- C:\Windows\System\zMznuIp.exe
  C:\Windows\System\zMznuIp.exe
  2⤵
  PID:12784
- C:\Windows\System\pcuYTim.exe
  C:\Windows\System\pcuYTim.exe
  2⤵
  PID:12496
- C:\Windows\System\XcOdedW.exe
  C:\Windows\System\XcOdedW.exe
  2⤵
  PID:12912
- C:\Windows\System\eKEiktc.exe
  C:\Windows\System\eKEiktc.exe
  2⤵
  PID:12936
- C:\Windows\System\cAlyUcG.exe
  C:\Windows\System\cAlyUcG.exe
  2⤵
  PID:12960
- C:\Windows\System\QauUVtb.exe
  C:\Windows\System\QauUVtb.exe
  2⤵
  PID:12984
- C:\Windows\System\CUMpnWN.exe
  C:\Windows\System\CUMpnWN.exe
  2⤵
  PID:13344
- C:\Windows\System\RNmSiRF.exe
  C:\Windows\System\RNmSiRF.exe
  2⤵
  PID:13088
- C:\Windows\System\JZbcQVB.exe
  C:\Windows\System\JZbcQVB.exe
  2⤵
  PID:13440
- C:\Windows\System\MxgCmat.exe
  C:\Windows\System\MxgCmat.exe
  2⤵
  PID:13524
- C:\Windows\System\wOTPebI.exe
  C:\Windows\System\wOTPebI.exe
  2⤵
  PID:13200
- C:\Windows\System\rPiyLTp.exe
  C:\Windows\System\rPiyLTp.exe
  2⤵
  PID:13248
- C:\Windows\System\CWXCSSF.exe
  C:\Windows\System\CWXCSSF.exe
  2⤵
  PID:13308
- C:\Windows\System\tjEjngJ.exe
  C:\Windows\System\tjEjngJ.exe
  2⤵
  PID:12068
- C:\Windows\System\PZxoPom.exe
  C:\Windows\System\PZxoPom.exe
  2⤵
  PID:14356
- C:\Windows\System\ILHXIAq.exe
  C:\Windows\System\ILHXIAq.exe
  2⤵
  PID:14372
- C:\Windows\System\aURHWKc.exe
  C:\Windows\System\aURHWKc.exe
  2⤵
  PID:14392
- C:\Windows\System\MCekJGB.exe
  C:\Windows\System\MCekJGB.exe
  2⤵
  PID:14412
- C:\Windows\System\paHaDIy.exe
  C:\Windows\System\paHaDIy.exe
  2⤵
  PID:14436
- C:\Windows\System\IwgfQuz.exe
  C:\Windows\System\IwgfQuz.exe
  2⤵
  PID:14456
- C:\Windows\System\RZSznut.exe
  C:\Windows\System\RZSznut.exe
  2⤵
  PID:14472
- C:\Windows\System\DyWcjOG.exe
  C:\Windows\System\DyWcjOG.exe
  2⤵
  PID:14496
- C:\Windows\System\eWPkrxH.exe
  C:\Windows\System\eWPkrxH.exe
  2⤵
  PID:14512
- C:\Windows\System\tCXPKEj.exe
  C:\Windows\System\tCXPKEj.exe
  2⤵
  PID:14536
- C:\Windows\System\kGeBXrn.exe
  C:\Windows\System\kGeBXrn.exe
  2⤵
  PID:14552
- C:\Windows\System\EzoEltm.exe
  C:\Windows\System\EzoEltm.exe
  2⤵
  PID:14572
- C:\Windows\System\zZxDGnF.exe
  C:\Windows\System\zZxDGnF.exe
  2⤵
  PID:14588
- C:\Windows\System\hzotUGW.exe
  C:\Windows\System\hzotUGW.exe
  2⤵
  PID:14620
- C:\Windows\System\XwsIddT.exe
  C:\Windows\System\XwsIddT.exe
  2⤵
  PID:14636
- C:\Windows\System\ISgvpZq.exe
  C:\Windows\System\ISgvpZq.exe
  2⤵
  PID:14656
- C:\Windows\System\jQqqwjJ.exe
  C:\Windows\System\jQqqwjJ.exe
  2⤵
  PID:14680
- C:\Windows\System\OyFaZxV.exe
  C:\Windows\System\OyFaZxV.exe
  2⤵
  PID:14704
- C:\Windows\System\CDldyTb.exe
  C:\Windows\System\CDldyTb.exe
  2⤵
  PID:14728
- C:\Windows\System\TPjMliw.exe
  C:\Windows\System\TPjMliw.exe
  2⤵
  PID:14744
- C:\Windows\System\rpGEBmZ.exe
  C:\Windows\System\rpGEBmZ.exe
  2⤵
  PID:14768
- C:\Windows\System\WCcIBis.exe
  C:\Windows\System\WCcIBis.exe
  2⤵
  PID:14788
- C:\Windows\System\jliKRHX.exe
  C:\Windows\System\jliKRHX.exe
  2⤵
  PID:14820
- C:\Windows\System\MixQVnq.exe
  C:\Windows\System\MixQVnq.exe
  2⤵
  PID:14836
- C:\Windows\System\BZfqypu.exe
  C:\Windows\System\BZfqypu.exe
  2⤵
  PID:14864
- C:\Windows\System\qXOOBTJ.exe
  C:\Windows\System\qXOOBTJ.exe
  2⤵
  PID:14888
- C:\Windows\System\vGMcFuO.exe
  C:\Windows\System\vGMcFuO.exe
  2⤵
  PID:14908
- C:\Windows\System\dfCATcl.exe
  C:\Windows\System\dfCATcl.exe
  2⤵
  PID:14936
- C:\Windows\System\qMMuahT.exe
  C:\Windows\System\qMMuahT.exe
  2⤵
  PID:14956
- C:\Windows\System\OnsHVEy.exe
  C:\Windows\System\OnsHVEy.exe
  2⤵
  PID:14988
- C:\Windows\System\xuVvqzN.exe
  C:\Windows\System\xuVvqzN.exe
  2⤵
  PID:15004
- C:\Windows\System\rlblLUf.exe
  C:\Windows\System\rlblLUf.exe
  2⤵
  PID:15028
- C:\Windows\System\LYPZoXf.exe
  C:\Windows\System\LYPZoXf.exe
  2⤵
  PID:15044
- C:\Windows\System\BYvKtuc.exe
  C:\Windows\System\BYvKtuc.exe
  2⤵
  PID:15068
- C:\Windows\System\KvDBXaN.exe
  C:\Windows\System\KvDBXaN.exe
  2⤵
  PID:15088
- C:\Windows\System\BAktveW.exe
  C:\Windows\System\BAktveW.exe
  2⤵
  PID:15108
- C:\Windows\System\PpdWJXe.exe
  C:\Windows\System\PpdWJXe.exe
  2⤵
  PID:15132
- C:\Windows\System\WbZHQLs.exe
  C:\Windows\System\WbZHQLs.exe
  2⤵
  PID:15148
- C:\Windows\System\LHQWLfK.exe
  C:\Windows\System\LHQWLfK.exe
  2⤵
  PID:15176
- C:\Windows\System\yLlErIS.exe
  C:\Windows\System\yLlErIS.exe
  2⤵
  PID:15196
- C:\Windows\System\xwcILhV.exe
  C:\Windows\System\xwcILhV.exe
  2⤵
  PID:15216
- C:\Windows\System\JrFppqo.exe
  C:\Windows\System\JrFppqo.exe
  2⤵
  PID:15240
- C:\Windows\System\IzloakN.exe
  C:\Windows\System\IzloakN.exe
  2⤵
  PID:15260
- C:\Windows\System\RHnuXBy.exe
  C:\Windows\System\RHnuXBy.exe
  2⤵
  PID:15280
- C:\Windows\System\wLFCtmC.exe
  C:\Windows\System\wLFCtmC.exe
  2⤵
  PID:15304
- C:\Windows\System\UAHTodM.exe
  C:\Windows\System\UAHTodM.exe
  2⤵
  PID:15328
- C:\Windows\System\TvmWoNa.exe
  C:\Windows\System\TvmWoNa.exe
  2⤵
  PID:15348
- C:\Windows\System\jNZiTek.exe
  C:\Windows\System\jNZiTek.exe
  2⤵
  PID:13796
- C:\Windows\System\ysEygDa.exe
  C:\Windows\System\ysEygDa.exe
  2⤵
  PID:13872
- C:\Windows\System\balNfHm.exe
  C:\Windows\System\balNfHm.exe
  2⤵
  PID:13900
- C:\Windows\System\RVStExP.exe
  C:\Windows\System\RVStExP.exe
  2⤵
  PID:13988
- C:\Windows\System\ARnoMWT.exe
  C:\Windows\System\ARnoMWT.exe
  2⤵
  PID:12864
- C:\Windows\System\smDYvMv.exe
  C:\Windows\System\smDYvMv.exe
  2⤵
  PID:11632
- C:\Windows\System\QvWCuRI.exe
  C:\Windows\System\QvWCuRI.exe
  2⤵
  PID:11824
- C:\Windows\System\eLjfEYv.exe
  C:\Windows\System\eLjfEYv.exe
  2⤵
  PID:14184
- C:\Windows\System\DQoEJgF.exe
  C:\Windows\System\DQoEJgF.exe
  2⤵
  PID:12988
- C:\Windows\System\KYzJcvK.exe
  C:\Windows\System\KYzJcvK.exe
  2⤵
  PID:14332
- C:\Windows\System\uEPkHYx.exe
  C:\Windows\System\uEPkHYx.exe
  2⤵
  PID:12540
- C:\Windows\System\DRkmWqD.exe
  C:\Windows\System\DRkmWqD.exe
  2⤵
  PID:12684
- C:\Windows\System\KvMivzf.exe
  C:\Windows\System\KvMivzf.exe
  2⤵
  PID:13164
- C:\Windows\System\OrwGSaE.exe
  C:\Windows\System\OrwGSaE.exe
  2⤵
  PID:13180
- C:\Windows\System\xdWEeof.exe
  C:\Windows\System\xdWEeof.exe
  2⤵
  PID:13636
- C:\Windows\System\JLuholn.exe
  C:\Windows\System\JLuholn.exe
  2⤵
  PID:12660
- C:\Windows\System\JFdhpbe.exe
  C:\Windows\System\JFdhpbe.exe
  2⤵
  PID:13756
- C:\Windows\System\iWmhACx.exe
  C:\Windows\System\iWmhACx.exe
  2⤵
  PID:15364
- C:\Windows\System\BdYlLHt.exe
  C:\Windows\System\BdYlLHt.exe
  2⤵
  PID:15384
- C:\Windows\System\rTnfsXm.exe
  C:\Windows\System\rTnfsXm.exe
  2⤵
  PID:15404
- C:\Windows\System\jwrwsgD.exe
  C:\Windows\System\jwrwsgD.exe
  2⤵
  PID:15424
- C:\Windows\System\EOqpNGP.exe
  C:\Windows\System\EOqpNGP.exe
  2⤵
  PID:15452
- C:\Windows\System\PNjbuYj.exe
  C:\Windows\System\PNjbuYj.exe
  2⤵
  PID:15472
- C:\Windows\System\eQHUEAo.exe
  C:\Windows\System\eQHUEAo.exe
  2⤵
  PID:15488
- C:\Windows\System\RvfjpbK.exe
  C:\Windows\System\RvfjpbK.exe
  2⤵
  PID:15504
- C:\Windows\System\AeModSh.exe
  C:\Windows\System\AeModSh.exe
  2⤵
  PID:15520
- C:\Windows\System\OWVGpsy.exe
  C:\Windows\System\OWVGpsy.exe
  2⤵
  PID:15548
- C:\Windows\System\zLxPMtt.exe
  C:\Windows\System\zLxPMtt.exe
  2⤵
  PID:15584
- C:\Windows\System\SfAaxhn.exe
  C:\Windows\System\SfAaxhn.exe
  2⤵
  PID:15608
- C:\Windows\System\FJGAjdG.exe
  C:\Windows\System\FJGAjdG.exe
  2⤵
  PID:15624
- C:\Windows\System\iwFuhTr.exe
  C:\Windows\System\iwFuhTr.exe
  2⤵
  PID:15648
- C:\Windows\System\MlZWDkI.exe
  C:\Windows\System\MlZWDkI.exe
  2⤵
  PID:15664
- C:\Windows\System\gQqpWwW.exe
  C:\Windows\System\gQqpWwW.exe
  2⤵
  PID:15692
- C:\Windows\System\ItuHeVt.exe
  C:\Windows\System\ItuHeVt.exe
  2⤵
  PID:15716
- C:\Windows\System\elirJla.exe
  C:\Windows\System\elirJla.exe
  2⤵
  PID:15736
- C:\Windows\System\XevLesc.exe
  C:\Windows\System\XevLesc.exe
  2⤵
  PID:15760
- C:\Windows\System\DhSncYH.exe
  C:\Windows\System\DhSncYH.exe
  2⤵
  PID:15788
- C:\Windows\System\GhZrYUZ.exe
  C:\Windows\System\GhZrYUZ.exe
  2⤵
  PID:15812
- C:\Windows\System\AiPJMLC.exe
  C:\Windows\System\AiPJMLC.exe
  2⤵
  PID:15828
- C:\Windows\System\wnJApsp.exe
  C:\Windows\System\wnJApsp.exe
  2⤵
  PID:15852
- C:\Windows\System\HwYimat.exe
  C:\Windows\System\HwYimat.exe
  2⤵
  PID:15872
- C:\Windows\System\zeUeyAG.exe
  C:\Windows\System\zeUeyAG.exe
  2⤵
  PID:15888
- C:\Windows\System\AGdscAI.exe
  C:\Windows\System\AGdscAI.exe
  2⤵
  PID:15904
- C:\Windows\System\FxuxMzS.exe
  C:\Windows\System\FxuxMzS.exe
  2⤵
  PID:15936
- C:\Windows\System\CkBBAgI.exe
  C:\Windows\System\CkBBAgI.exe
  2⤵
  PID:15960
- C:\Windows\System\BMCDGNR.exe
  C:\Windows\System\BMCDGNR.exe
  2⤵
  PID:15980
- C:\Windows\System\xnWhzgE.exe
  C:\Windows\System\xnWhzgE.exe
  2⤵
  PID:16008
- C:\Windows\System\owGOSsR.exe
  C:\Windows\System\owGOSsR.exe
  2⤵
  PID:16032
- C:\Windows\System\RpXvdJf.exe
  C:\Windows\System\RpXvdJf.exe
  2⤵
  PID:16052
- C:\Windows\System\dLUnBIb.exe
  C:\Windows\System\dLUnBIb.exe
  2⤵
  PID:16080
- C:\Windows\System\BtxlPFI.exe
  C:\Windows\System\BtxlPFI.exe
  2⤵
  PID:16104
- C:\Windows\System\BgYUQRj.exe
  C:\Windows\System\BgYUQRj.exe
  2⤵
  PID:16124
- C:\Windows\System\RniBwab.exe
  C:\Windows\System\RniBwab.exe
  2⤵
  PID:16152
- C:\Windows\System\YnjuFUj.exe
  C:\Windows\System\YnjuFUj.exe
  2⤵
  PID:16172
- C:\Windows\System\tcmdfNC.exe
  C:\Windows\System\tcmdfNC.exe
  2⤵
  PID:16204
- C:\Windows\System\PNZYtkp.exe
  C:\Windows\System\PNZYtkp.exe
  2⤵
  PID:16220
- C:\Windows\System\EcPhtnU.exe
  C:\Windows\System\EcPhtnU.exe
  2⤵
  PID:16244
- C:\Windows\System\MwPnjod.exe
  C:\Windows\System\MwPnjod.exe
  2⤵
  PID:16272
- C:\Windows\System\DgnbDYJ.exe
  C:\Windows\System\DgnbDYJ.exe
  2⤵
  PID:16300
- C:\Windows\System\vjQlRKM.exe
  C:\Windows\System\vjQlRKM.exe
  2⤵
  PID:16316
- C:\Windows\System\WqbFPxs.exe
  C:\Windows\System\WqbFPxs.exe
  2⤵
  PID:16336
- C:\Windows\System\mKCNnJd.exe
  C:\Windows\System\mKCNnJd.exe
  2⤵
  PID:16356
- C:\Windows\System\APiYNNU.exe
  C:\Windows\System\APiYNNU.exe
  2⤵
  PID:16372
- C:\Windows\System\ZFtAsqK.exe
  C:\Windows\System\ZFtAsqK.exe
  2⤵
  PID:13856
- C:\Windows\System\mBJXYgz.exe
  C:\Windows\System\mBJXYgz.exe
  2⤵
  PID:12384
- C:\Windows\System\ebocmlr.exe
  C:\Windows\System\ebocmlr.exe
  2⤵
  PID:14560
- C:\Windows\System\aDwweXH.exe
  C:\Windows\System\aDwweXH.exe
  2⤵
  PID:14024
- C:\Windows\System\YqjMrtH.exe
  C:\Windows\System\YqjMrtH.exe
  2⤵
  PID:14108
- C:\Windows\System\JEjOxmA.exe
  C:\Windows\System\JEjOxmA.exe
  2⤵
  PID:14148
- C:\Windows\System\ZUFriWr.exe
  C:\Windows\System\ZUFriWr.exe
  2⤵
  PID:14164
- C:\Windows\System\KrBGHzo.exe
  C:\Windows\System\KrBGHzo.exe
  2⤵
  PID:14828
- C:\Windows\System\OQJKUhO.exe
  C:\Windows\System\OQJKUhO.exe
  2⤵
  PID:14860
- C:\Windows\System\mpbxLPq.exe
  C:\Windows\System\mpbxLPq.exe
  2⤵
  PID:14968
- C:\Windows\System\BudMqAA.exe
  C:\Windows\System\BudMqAA.exe
  2⤵
  PID:14996
- C:\Windows\System\eoPFIyz.exe
  C:\Windows\System\eoPFIyz.exe
  2⤵
  PID:13416
- C:\Windows\System\BkbkeQV.exe
  C:\Windows\System\BkbkeQV.exe
  2⤵
  PID:12096
- C:\Windows\System\teutDPW.exe
  C:\Windows\System\teutDPW.exe
  2⤵
  PID:11412
- C:\Windows\System\JTulfqW.exe
  C:\Windows\System\JTulfqW.exe
  2⤵
  PID:15288
- C:\Windows\System\vmMGbuM.exe
  C:\Windows\System\vmMGbuM.exe
  2⤵
  PID:13592
- C:\Windows\System\WKdvOIB.exe
  C:\Windows\System\WKdvOIB.exe
  2⤵
  PID:7076
- C:\Windows\System\hvYQyra.exe
  C:\Windows\System\hvYQyra.exe
  2⤵
  PID:10168
- C:\Windows\System\rMTgKfN.exe
  C:\Windows\System\rMTgKfN.exe
  2⤵
  PID:13436
- C:\Windows\System\pNNmGJu.exe
  C:\Windows\System\pNNmGJu.exe
  2⤵
  PID:11328
- C:\Windows\System\UlGCrpE.exe
  C:\Windows\System\UlGCrpE.exe
  2⤵
  PID:12532
- C:\Windows\System\rRrQzib.exe
  C:\Windows\System\rRrQzib.exe
  2⤵
  PID:16412
- C:\Windows\System\EiThIuI.exe
  C:\Windows\System\EiThIuI.exe
  2⤵
  PID:16440
- C:\Windows\System\mrYLuzP.exe
  C:\Windows\System\mrYLuzP.exe
  2⤵
  PID:16456
- C:\Windows\System\tlkjFNL.exe
  C:\Windows\System\tlkjFNL.exe
  2⤵
  PID:16484
- C:\Windows\System\fMymgzp.exe
  C:\Windows\System\fMymgzp.exe
  2⤵
  PID:16508
- C:\Windows\System\wbgKLuX.exe
  C:\Windows\System\wbgKLuX.exe
  2⤵
  PID:16524
- C:\Windows\System\dzhMFhR.exe
  C:\Windows\System\dzhMFhR.exe
  2⤵
  PID:16540
- C:\Windows\System\rXQizAm.exe
  C:\Windows\System\rXQizAm.exe
  2⤵
  PID:16568
- C:\Windows\System\btDuUEF.exe
  C:\Windows\System\btDuUEF.exe
  2⤵
  PID:16588
- C:\Windows\System\vUXJeVL.exe
  C:\Windows\System\vUXJeVL.exe
  2⤵
  PID:16608
- C:\Windows\System\ExiQxWP.exe
  C:\Windows\System\ExiQxWP.exe
  2⤵
  PID:16628
- C:\Windows\System\WnFzljD.exe
  C:\Windows\System\WnFzljD.exe
  2⤵
  PID:16644
- C:\Windows\System\oihCJRQ.exe
  C:\Windows\System\oihCJRQ.exe
  2⤵
  PID:16676
- C:\Windows\System\ATyaZji.exe
  C:\Windows\System\ATyaZji.exe
  2⤵
  PID:16696
- C:\Windows\System\ERRowpc.exe
  C:\Windows\System\ERRowpc.exe
  2⤵
  PID:16728
- C:\Windows\System\AAfmdec.exe
  C:\Windows\System\AAfmdec.exe
  2⤵
  PID:16756
- C:\Windows\System\yoDpDtC.exe
  C:\Windows\System\yoDpDtC.exe
  2⤵
  PID:16784
- C:\Windows\System\eMSOKUg.exe
  C:\Windows\System\eMSOKUg.exe
  2⤵
  PID:16800
- C:\Windows\System\uebIehL.exe
  C:\Windows\System\uebIehL.exe
  2⤵
  PID:16824
- C:\Windows\System\IGWJZcE.exe
  C:\Windows\System\IGWJZcE.exe
  2⤵
  PID:16840
- C:\Windows\System\ChURxHo.exe
  C:\Windows\System\ChURxHo.exe
  2⤵
  PID:16856
- C:\Windows\System\TpnFlaO.exe
  C:\Windows\System\TpnFlaO.exe
  2⤵
  PID:16872
- C:\Windows\System\FPDwzkg.exe
  C:\Windows\System\FPDwzkg.exe
  2⤵
  PID:16900
- C:\Windows\System\joBZJiV.exe
  C:\Windows\System\joBZJiV.exe
  2⤵
  PID:16920
- C:\Windows\System\gWbZVYb.exe
  C:\Windows\System\gWbZVYb.exe
  2⤵
  PID:16952
- C:\Windows\System\IlcJdCF.exe
  C:\Windows\System\IlcJdCF.exe
  2⤵
  PID:16980
- C:\Windows\System\ddKMrlk.exe
  C:\Windows\System\ddKMrlk.exe
  2⤵
  PID:17004
- C:\Windows\System\CkTTaFe.exe
  C:\Windows\System\CkTTaFe.exe
  2⤵
  PID:17020
- C:\Windows\System\sgomRwe.exe
  C:\Windows\System\sgomRwe.exe
  2⤵
  PID:17036
- C:\Windows\System\WUosDRX.exe
  C:\Windows\System\WUosDRX.exe
  2⤵
  PID:17060
- C:\Windows\System\MwdLGjG.exe
  C:\Windows\System\MwdLGjG.exe
  2⤵
  PID:17080
- C:\Windows\System\YghBzKE.exe
  C:\Windows\System\YghBzKE.exe
  2⤵
  PID:17108
- C:\Windows\System\WcgEJtR.exe
  C:\Windows\System\WcgEJtR.exe
  2⤵
  PID:17136
- C:\Windows\System\aMiGkLz.exe
  C:\Windows\System\aMiGkLz.exe
  2⤵
  PID:17152

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:11616

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:12096

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:15288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ALdfecl.exe

Filesize
1.3MB

MD5
95c24fd4538d85e3e5af77348db88d8f

SHA1
f5c036a4ec0176ef890d4828868748336f166c5d

SHA256
6c76709ad58d4214ca64db23cea83991c50ee6e42af3a8bd79e875cdfc519956

SHA512
dd290e651f297b67cea07fefddf8bcc4730c5a34a4fc9e28482fb78482eaefe578713e69d2f36fec31c512beeea9978bdb785276e86b2e3f3feed6fa738ac664

Download Submit
C:\Windows\System\AiSRuEw.exe

Filesize
1.3MB

MD5
0e5bc828157e0d7715dfc49ce1b568ea

SHA1
bdcac9c0d2b671b61c31adc21047f6615bce3fbd

SHA256
07fb6b290fd98b9e00d4f0009adc7b6219af66deb9345496ace924ce18923d8f

SHA512
2ef8e119fa41f8b855b10a1fe5cf19004b19ccd3cece1c1cd12dd3eb5c7a473a3e57b314fb6b70e96713e4df89549b324722d0e74fe72fa0df80e32c910a1e9b

Download Submit
C:\Windows\System\BFeEpHK.exe

Filesize
1.3MB

MD5
f7fa40873be1bd607da0326010617ec1

SHA1
0a8faa73483b754ad25fb4279cd312012d96f0bd

SHA256
d3ead6c989e5296e32b21e7268f3bcb6a1b3df02165571358e7ba64f2f8625a6

SHA512
1eb4d6f94bd6289e59f160a909f0ab5e4f7a6369d9f7fb7ccbd007ee7864bc4a6712147a0aa054ee3d332184627de3d4fe7ddd69bde05e6da3e3c42b1f6391f2

Download Submit
C:\Windows\System\BYiSQOB.exe

Filesize
1.3MB

MD5
281c5433af378f5e7776a667cc16a703

SHA1
999d3f9ae31b303594f70521a366c04c2715596d

SHA256
d743163bc998ea68953e5f0be0a3e27d2e66ca811e981369b981e50ebfc50558

SHA512
4e66634a9105598be319f95007816ff28abea0ed6b2877e1c6f79706bf7b6e1e5158f5e3397e1f4c2ffa789939418e147db49f80eed53c28d18b6d9bbd325635

Download Submit
C:\Windows\System\CoiWDFj.exe

Filesize
1.3MB

MD5
6e4895d3b3104ad55dcafa27600fc163

SHA1
e7c897daca58f77a9c82bb134cb1e41d7c03605d

SHA256
a470506f89c90bb315e393e02a3dcbf4f7f684fcef2d0481ce6dcd58897db85c

SHA512
8d85edc2938f86745e9be4c0c0056bf7284135258fba39e29a40ff5e13ce878b521404bdab9c5528910a1662054444e99b6e68e24c717bf309d494e1ba4a28d8

Download Submit
C:\Windows\System\DKplVwj.exe

Filesize
1.3MB

MD5
98fb7e2e07fb060f5f1ed0ae0f08e9fb

SHA1
435d5cb0830265ac3aea03dc63ca97197c4ee1af

SHA256
62d723d405589ae749a7ce8e1c26c5d97379e448af6845bed1cb79f0f0bb184f

SHA512
f10cfa77339824f24784ea80fec399482eecd45abdd4f06551d5313d972f3cca6d97e2aca6eba2a87ee817411c5da2b1ac4accee1804fc5df1e57738d7681988

Download Submit
C:\Windows\System\ECnDLwG.exe

Filesize
1.3MB

MD5
9873cedaaf50f6a7480a24743c33456c

SHA1
d1aa02ad81dbe6d94585820ce49bee9a6a358445

SHA256
2b61cd5f4ce3fc3359bda1b0beb7f431e17eed6dbff1c9f6cf750ce6a439fe30

SHA512
4427fd7be299329b8e75aae21822f42f86c69f2b6734fe5ca1fa2eb4f042458d4c1c1ac498ca4cbdf5b1e9a04789ca5ca10da853666b622771c1b76b46e8453a

Download Submit
C:\Windows\System\JZlbRRC.exe

Filesize
1.3MB

MD5
2e978d8caa1be1c09ad32fab0f09b1a4

SHA1
fb59198b7911481f1fa313c43791f83d71121ed0

SHA256
7855a67450116093a155d56ce043dd44cd6c55d576df3a306e4fbeead8e7624a

SHA512
a572ca35e61ce221570065505cd4350c723ddb638eb1be55ba4ac0befa9e2fe59227ffd0c6ac96755813a7ffd0ac2c2617f7767442b81ae4ce61eb2e34b8e6dd

Download Submit
C:\Windows\System\JfXFQfa.exe

Filesize
1.3MB

MD5
49a58964cbf53da2cee4603b8a148955

SHA1
566734ae22487e3714c856dd7dbc078f166f0884

SHA256
6a21bcb597328a58d2c5c9c186d7c9155bb597e15936bf62a9669d22626bc961

SHA512
24e06ad3effa3f9a4397b31fa24347cde1d042d7d47df031ac2b6b2fa0b8e5c07a41457eeb1b6435b3967ed19970c20ec3ad53f8e480bbcb0600b8e576f26bc4

Download Submit
C:\Windows\System\RFKdJkR.exe

Filesize
1.3MB

MD5
fe2fad9079fdd259a54d954c3a135fb0

SHA1
c9b195ed7722e891a2e00a07c81f5a7b777800c5

SHA256
8024c22fd84babfa60f4d087d2026e06a0dfdf937e99e391966e59d57d37d392

SHA512
4e7113fac38252787b160f9794e9947c37c0ab9160ef3cd128327d9cdabadf618527bdc5ad2ab43807af821a1cadf62a5c55b95dcd54934716009523683b207e

Download Submit
C:\Windows\System\SDBANAP.exe

Filesize
1.3MB

MD5
d443fb551de293e899e804160e917916

SHA1
f4a52db93418c7ea4936c86fa7d90e5818c5b3fe

SHA256
338649dd3434fe7368681dfaa87e37d51c8266b0f2aef2c3314cf1bf6db361de

SHA512
fe3fb42d0cc44eec6f09b0eef40b0c2ee65af509a4b931eab35f13d0064117feaa1ab96747fcdc7596c2ba0ea47a4d19bf7ed0c4132f7eb872ade5d30675140d

Download Submit
C:\Windows\System\SYCpGbw.exe

Filesize
1.3MB

MD5
4d09ab51b2b49d48fdecfc365a6c3bb4

SHA1
52070dfa5cc644ea68ec9dddeacaf03e8ad21be6

SHA256
f0d785a6a8d8cf02c76e145d4b52de33c47d2cb4ee91a1bf7c49caba2e0dd3a4

SHA512
2324adf5a259d3c3eff48225b8b3f5ca6b05991cf9c4c8557cce61f1c905b13b1ef78296a3fc7bf1ec1f31d397d8a20497185cb8fbe33554e7ff5f2570981a86

Download Submit
C:\Windows\System\UKQRNfj.exe

Filesize
1.3MB

MD5
9b0ae3d15519cbc7b070cb0bcc36e1ee

SHA1
69cb6d52d9105bf1385937b3b5a215b6165dbbc6

SHA256
25d9d6a49985b3f44a8cb39649218f457091b83be97abad007a21718b5474e13

SHA512
079568d1ac34eff9c734baf4e4b33b87c1214c6f1d33888ab690ba07d9bae4260ec00d9fc77f60023dc796c6bfdb088357740c011ffb6cbb258a275dd5c30dd6

Download Submit
C:\Windows\System\VhYsKfN.exe

Filesize
1.3MB

MD5
765f25088984718224e4654fa41fd951

SHA1
b6359764ec043d7746f6f0c9f19aeac93b9a246a

SHA256
e9e3080b846b994fbdbe299cabb112dd280aec37805851e8a22d7d26fdd3e6cb

SHA512
4a7b66e786de6f6a341847983330f250d04f1e13aa6ba7c39213d36166fa9e0fad610a4160bb16182f175bb4daef0738c9d30cae772ac4210a533b93de9eb274

Download Submit
C:\Windows\System\XDizjeF.exe

Filesize
1.3MB

MD5
f543314d0b84a1e74cb7472d1fb6ed01

SHA1
1d8fb144603f7c3c2d809a6c81c3279657615814

SHA256
cdec18613540e5a10eb18628334b22b7043b0cde764c0f02e13a6b9c137ea187

SHA512
2d1c3f423dd4f5a55a3ecb1572df6ac1ab8b4f3eec83d1a33dbcf0f4fab2cd60ea17f103ec9c00b8c6fa319aa320a7294595cdda70a74023247625bb4269e64c

Download Submit
C:\Windows\System\ZLhltmW.exe

Filesize
1.3MB

MD5
b423a9b1dca2464427760750996b0e9c

SHA1
7253fb483ee2046f2614f246b547c83fb2429bb2

SHA256
2faa0ab298778961f2e9bb12ffbcf67b282cd9cff9c26bf417a01aeb0740972d

SHA512
f50cc5cb3a77296fd84db946fde613b3c2a96f572de56cc303ff300a5cc3bba3f7e4a9728dd8a67e55b92b88064486ef0697ff2c6dc72e11969972aa07003c43

Download Submit
C:\Windows\System\dFIsZjP.exe

Filesize
1.3MB

MD5
4e2286511ff44b084c7f1c3b316d6f05

SHA1
450aed14a0cea02f6489c0183029f514ab094b76

SHA256
55d4a4102f1fa4486407f64a2ef1003630aaec0b44010e999f142c1adf7dd795

SHA512
22adb594070ecd437d694492e35a483c944799e0b100efcbd63851e1b2c953ecdc621d9cfd473d624171294ac130e552320658e67d86e00bf9bcb12fc41e4120

Download Submit
C:\Windows\System\fzUxqSx.exe

Filesize
1.3MB

MD5
9b3f53a98a504fa1a6772a738aaf894b

SHA1
dec7c52496665321deb08a8ae3918ea1b9e8aee0

SHA256
0229d9002ea3a9693903ad23ca399695adb196c74645e97c594d182356c11c89

SHA512
f9ccbe19aa861b919e03f329d1708ae4b1592a3337e1d38cffe6a4c6d6529648d288f5b27ca100b150b944c70eee7b3d96cf5e73fc8f427c0bad29a783de77bd

Download Submit
C:\Windows\System\hedcaOs.exe

Filesize
1.3MB

MD5
4d8198083448743a56f4c4d4a23c10e9

SHA1
4e0179bee98808aee672c69f22140b3e2b8fe962

SHA256
29e9ef6299ff643eabc47f7eb9144333663fad1fa155f23020420ff5967e5c19

SHA512
15cacbc41bd83c2a1c570b112df2c2292e0550ffafd093eb0b2ce69e12b61673d8c1a8ab14eae27a983a28b144dbea77a44e554f20fc0c63f134118730a2134d

Download Submit
C:\Windows\System\iBRfIKg.exe

Filesize
1.3MB

MD5
da809441be90e7ed71dbc5f7c87badf7

SHA1
0d772d86f02b041ceda696d5bd6de69eea96786f

SHA256
c78852d26a5c22e72d6bea3c28e3bc2e0ea936fb49eba54ff2eef6c2e21b51fb

SHA512
a883b0ecc6c456485b5e56f78ffa034decb23055c8f01506976c881bbd694b5d2612faa89e8435f43ab2108925a9d6a66b7ec56afa7c873317b85f684c980a9e

Download Submit
C:\Windows\System\icsomXx.exe

Filesize
1.3MB

MD5
6d36f8ad0b1726f2811204575f11a5ae

SHA1
ed3483ba83009b8a9a4d2528dde1322bb919d849

SHA256
e2901f6445c5e5ce6639ca2c7729ebf3937056fb70647edc090fd7a276da1933

SHA512
6f67d7c986e8a9806fb1f93131dc9ca4d41d880425e988df35d3838e3a95880454b13ae7939991a40650bab042bdff7a8c00e21faa4eeb4357dcea85f1cfa4dc

Download Submit
C:\Windows\System\jnsUkNY.exe

Filesize
1.3MB

MD5
ee7b012efc76ce05dcabf6f89120b984

SHA1
6827e05f743a03abc341fcc2bf3a05459fa77c39

SHA256
97f361c83cf64990c4209062a50f4f3b5a90d3502b267591b4b1a0123160668c

SHA512
f82bc48d75a3e8f996b2f4450178a5d4c0f3ed520ab38ed69bbba8e2b071bf759301d4bc4f764ea394872057b7c2374c220484eae0f9408abdf9a1bf7985cbfc

Download Submit
C:\Windows\System\kGOXVTw.exe

Filesize
1.3MB

MD5
4b202c718501468807939835a745ac39

SHA1
b202e75b14dbfdc34202ce8ab177ba1d9f84c422

SHA256
71b8ddc27b0c681eff1a5b1de079d0b0b75391ca20d1cdb833600df426db4d60

SHA512
40a0cda03d3710aff5d69647eb4cc614858dc47183f63ddd99baba3e3fc50d03faaefcf2168d90e4c9ff0e7ca219b05c2fbb45e6ce6e75e88326874ef7a74efc

Download Submit
C:\Windows\System\kLNdUkd.exe

Filesize
1.3MB

MD5
6d3c686676465d316945c221685c0e49

SHA1
5640f38e6057c523d68dbb6c19ac1a3707b8bba9

SHA256
67ca30e7aeca989325323ab4088af73217f4644b665808b9d010da780bef6a98

SHA512
3d0f756283a2ecdd6273877440d8dc7a937784f6afcc57ad4339692f173ad7514aebd8b8b776533e1ff6ca5c8cd442f32645d7e5114eb5ca1284971f21d44772

Download Submit
C:\Windows\System\kPSGxJB.exe

Filesize
1.3MB

MD5
286687540d0b8557e47457c3d1d366c7

SHA1
e61421b80b449b759c5e31d4557b4773f390aecd

SHA256
46fbce736f58645c974c6c42965251dc12b6e4b7035197af4279fdeea3bedb59

SHA512
34a514ff692fc6aa0365fb342830bb9c8d018f6b0bad7949770dfe9f949a1b39832ca1ecd4136b31de84b169892554fddfbdfc7261301eaf5be92c3d796b4cad

Download Submit
C:\Windows\System\qUcchTu.exe

Filesize
1.3MB

MD5
e08d3e78afaf5c573fce03f521482888

SHA1
edf27f64c66a555298c22a07d0e879ed818ffa22

SHA256
602ef71e13866456194624f781a5dc43a1f33c3edc7397b10f239145cd247897

SHA512
dc601acd4d340d17852191dcbbba0c04a9c785346064e6fc98548e61cd4f6c6a425043368a7623a6dfa86ae284b7ee94e61007a120e47ad6e49644ce45a7ed56

Download Submit
C:\Windows\System\rRXYMXf.exe

Filesize
1.3MB

MD5
ea3eb53d56f360944418e49da1521b97

SHA1
b5f85fc984d09c69c91d93c498a90b24e8492256

SHA256
0df23c28d078d21957320b38860d6b5582e3d0966e05214adde9d15bf8af9bbd

SHA512
41eacb03c7c32dc3712299739db07506eab2e382e04aaaac3590fb4649eb61f530754441416bbd61550ce23ddc454f2cd9de04083699d0535be2f3f5a729d9c5

Download Submit
C:\Windows\System\ruRuORe.exe

Filesize
1.3MB

MD5
59625a314507262b2e188b8d2e5b5cf8

SHA1
858927583cd1d3f96badbbe9317134c3aba1d749

SHA256
6f9326d287fe1825be238dfede2d6eb196577a8df9d540ec6d7cb826f2282425

SHA512
5d849a3675463098e48b16655edb3e1bd789c82096063702f4ad42d2686324a298570ce7f17d627534f2f6f49aa909afb37f1253f77ec3e92f01739b9b7eafd3

Download Submit
C:\Windows\System\spsllae.exe

Filesize
1.3MB

MD5
528c920263f52ec23d37a4ad2eb9adb3

SHA1
91228a5007403f1abc529cf11c837352331343e8

SHA256
d9f4df902e3fa7f55e5b01c40f3722bfa65581a0c3ed545b0f59508a49fc4912

SHA512
9771480026e7462f23bc1b74e958ae963dd096cea0b636b7d6cc9c294660da869446431a090d4f68ed3e93b138ee30e000d6058dd5ea41a3165e894e172557fd

Download Submit
C:\Windows\System\tBjoyHu.exe

Filesize
1.3MB

MD5
84564f020b95b941352ecfd2cef7b04e

SHA1
0be6ccd1a80e0bdb15d9f75faf232f8e00803176

SHA256
b1167e000afd13171066191b19fe531f6089e0010b5fb73e6eb99132075a6ce1

SHA512
8a63ab39dbc45491f1a47351d673e903231a3d7ff8f01da7191db6a0c6f04dc26f225ba8805d42b8cfc0719c501553b97e5ad9e851b46347c6202dd91f3df493

Download Submit
C:\Windows\System\tLQmODR.exe

Filesize
1.3MB

MD5
6d4ee884336962a147d6fe3871307036

SHA1
4ce41150ce2181e6b2496a1e9607ad78873785bd

SHA256
4aafbebc6143736e5519a995ef0f76c3677ec85d4454966bd90fa17ee6bf542c

SHA512
7f6b4e2cd68cc47691d4d773c5995b86f054527cb57a0624b25f3a47c3d92eaf7416b1f229db00c5a202f1afcf81fac73f2b787b493a202e7bee086a9cc1ae65

Download Submit
C:\Windows\System\uZnnNEP.exe

Filesize
1.3MB

MD5
5845d8f1ed9f552611a49c9e626b1f5e

SHA1
79efd49f60b2bd762644fe92ee1d7c8c4ab2dbe4

SHA256
9ea63af87e742442d7426b57df16ce823c81754a203312fc591b71c1c56d33bd

SHA512
c887feb54051b80e839933b359ff865ab922bd7d1dc38d0ba284ba34d8eda9b34772a0fe8b9b229fb9d2a4aed796a78123128936011fb2fe44abdde0d4ffcac8

Download Submit
C:\Windows\System\ucPuSkl.exe

Filesize
1.3MB

MD5
2392fb31168cb16586f4afaff08a47a4

SHA1
dddbf8fa908404c8f54d9c9c78d8ebf0fd16aef8

SHA256
1de708d014b898b2bcd311799893a8ef415012cf29826f2ee928efc7252e5c3c

SHA512
c36755516982b9d6486b2de8150de550be0e6820cc8e6a20d5d5f014872f50d22d5c149b7c64908fc965d24669fc8378611797f611ac73a5d51f4d0aeef93208

Download Submit
C:\Windows\System\zydrGmu.exe

Filesize
1.3MB

MD5
c55d64bedc172101a8243e668dedaa0f

SHA1
cd1a631061ca9bade20600bf260a32e493674fa0

SHA256
2b82de4b689d5fc4c227a04deeb3800654329ac48277205e0ebe835e849c033c

SHA512
364600998721f33cd0104da9c97e5b2980b695f540bdac9e5e5c6bac2f5020ca35edc8634714fa13834d37e5ec25589f984474ee79282aca211c2d82e37d904b

Download Submit
memory/1156-0-0x000001D056B70000-0x000001D056B80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads