xmrig | b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0

Analysis

max time kernel
109s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
Size

1.5MB
MD5

08a55f436cee12e861a59fd62416eeb2
SHA1

07a4ed45a59e1984fb1f7a5e59b314dbb6aeb4ab
SHA256

b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0
SHA512

6bb66bc9ad7260012c295e7cfca408b189b32fd784c9eb2c6e7fa1b1c6f7fb8817882a36dffab524167ee1d8db1995fc18b9f4f09d7af3a58648bd4003295da2
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6PbWjRPa:GezaTF8FcNkNdfE0pZ9ozttwIRx3QjFa

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c8b-4.dat	xmrig
behavioral2/files/0x0007000000023c94-7.dat	xmrig
behavioral2/files/0x0008000000023c90-8.dat	xmrig
behavioral2/files/0x0007000000023c95-20.dat	xmrig
behavioral2/files/0x0007000000023c96-23.dat	xmrig
behavioral2/files/0x0007000000023c97-29.dat	xmrig
behavioral2/files/0x0007000000023c98-33.dat	xmrig
behavioral2/files/0x0007000000023c9a-41.dat	xmrig
behavioral2/files/0x0007000000023c9c-50.dat	xmrig
behavioral2/files/0x0007000000023c9b-56.dat	xmrig
behavioral2/files/0x0007000000023c9d-60.dat	xmrig
behavioral2/files/0x0007000000023c99-38.dat	xmrig
behavioral2/files/0x0007000000023c9e-64.dat	xmrig
behavioral2/files/0x0008000000023c91-67.dat	xmrig
behavioral2/files/0x0007000000023ca2-82.dat	xmrig
behavioral2/files/0x0007000000023ca3-92.dat	xmrig
behavioral2/files/0x0007000000023ca4-93.dat	xmrig
behavioral2/files/0x0007000000023ca1-99.dat	xmrig
behavioral2/files/0x0007000000023ca5-98.dat	xmrig
behavioral2/files/0x0007000000023ca0-87.dat	xmrig
behavioral2/files/0x0007000000023c9f-84.dat	xmrig
behavioral2/files/0x0007000000023ca7-111.dat	xmrig
behavioral2/files/0x0007000000023ca6-108.dat	xmrig
behavioral2/files/0x0007000000023ca8-117.dat	xmrig
behavioral2/files/0x0007000000023ca9-131.dat	xmrig
behavioral2/files/0x0007000000023cac-140.dat	xmrig
behavioral2/files/0x0007000000023cae-149.dat	xmrig
behavioral2/files/0x0007000000023cad-147.dat	xmrig
behavioral2/files/0x0007000000023cab-135.dat	xmrig
behavioral2/files/0x0007000000023caa-133.dat	xmrig
behavioral2/files/0x0007000000023caf-154.dat	xmrig
behavioral2/files/0x0007000000023cb2-157.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4124	BIdnpvx.exe
2144	CEfPGtc.exe
4528	IJZgYpH.exe
4172	ziKacui.exe
4592	yxkRKMB.exe
3532	XaqECiQ.exe
3912	uiquRbI.exe
2920	CgRxLWD.exe
2460	oOmpJLF.exe
4240	EJrpQgr.exe
2952	sTwztVV.exe
3208	gjnppFn.exe
4792	LPLlvdf.exe
3996	EPMclqD.exe
3216	BvSkcTk.exe
2924	yqDALeH.exe
3228	ygwZmHr.exe
4000	nYtfNOk.exe
4692	SxdJJOY.exe
2408	DzokGzS.exe
4260	cHwYWuk.exe
1892	NLDrzWh.exe
368	ulUEFPL.exe
2896	buwVPwx.exe
4228	BkXheGz.exe
3648	BABBCre.exe
1120	FBAwyaf.exe
1464	FjRmubj.exe
4632	QHagFAF.exe
3828	UTfltCo.exe
4224	QtEvAxk.exe
1356	DSahjeu.exe
4696	sznuIxa.exe
3200	gDQdwAQ.exe
440	XPQFEtY.exe
764	EBInvZe.exe
3408	LEmskhb.exe
4036	TLbRwzS.exe
952	RqWTtIq.exe
3288	lBLGGsG.exe
3504	ewPRoiA.exe
2708	HZpCUcC.exe
3672	zTcZWKD.exe
5092	WGGXCRS.exe
2168	EjRNxpi.exe
2720	tiJJhbQ.exe
3496	theXzSS.exe
1032	OOJYAiQ.exe
2448	QhPGYOL.exe
2132	EFxYjXh.exe
3300	tKDnxNK.exe
3128	heRKQAe.exe
2692	JucCdcA.exe
1960	bfDFcfd.exe
4232	nQzjEyK.exe
5068	FpEhKfy.exe
4612	vPKNtdp.exe
1232	RIvPWqu.exe
404	ZILUyXC.exe
2440	RPUJCgt.exe
3952	qUoNLhx.exe
3108	bhQXDkf.exe
3064	XxxnLbR.exe
3240	kDoeiGG.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LSFKsKm.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\CPkNGlx.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\lfkVFHU.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\skmtjHn.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\OKVgXvI.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\oXFxEqu.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\aBqBpos.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\mCwBMOO.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\oyXrGAX.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\oBvhXGI.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\Hobgeob.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\zcAIRlC.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\WSXWYEw.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\TGSLlPj.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\HKjEMTs.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\TLbRwzS.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\lBLGGsG.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\kXoVqgy.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\aPFzvww.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\UCmYFTl.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\CQXPJMe.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\VhvEIjr.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\pJdHKln.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\xCKSneX.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\MoBWgdZ.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\OHCpyzR.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\McVYcud.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\sdNppoj.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\EypchHE.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\IrrBEZa.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\KAanAgN.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\ugOqHxb.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\IKFWHhD.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\jtSvbTG.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\RejMWLS.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\NwLbObr.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\LPLlvdf.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\lpswOUM.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\rSvLXkr.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\GbozMkU.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\RKSfSQu.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\RlKNBtf.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\wFyoaFM.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\nWEddtA.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\gmnGbKN.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\UTENWPg.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\NqaBKJr.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\LjOztqL.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\mEdjneO.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\iDSUtVb.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\RqWTtIq.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\ToVpaIC.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\zEbLUux.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\tpIXbqF.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\EFxYjXh.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\XkZmxCk.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\FtEzkHe.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\DblHqyD.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\zLgoEQJ.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\WsHDBGQ.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\DQaqkKi.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\HUBkgDr.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\eqJDDVZ.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
File created	C:\Windows\System\QcTmRDX.exe	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 4124	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	84
PID 532 wrote to memory of 4124	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	84
PID 532 wrote to memory of 2144	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	85
PID 532 wrote to memory of 2144	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	85
PID 532 wrote to memory of 4528	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	86
PID 532 wrote to memory of 4528	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	86
PID 532 wrote to memory of 4172	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	87
PID 532 wrote to memory of 4172	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	87
PID 532 wrote to memory of 4592	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	88
PID 532 wrote to memory of 4592	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	88
PID 532 wrote to memory of 3532	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	89
PID 532 wrote to memory of 3532	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	89
PID 532 wrote to memory of 3912	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	90
PID 532 wrote to memory of 3912	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	90
PID 532 wrote to memory of 2920	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	91
PID 532 wrote to memory of 2920	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	91
PID 532 wrote to memory of 2460	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	92
PID 532 wrote to memory of 2460	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	92
PID 532 wrote to memory of 4240	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	93
PID 532 wrote to memory of 4240	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	93
PID 532 wrote to memory of 2952	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	94
PID 532 wrote to memory of 2952	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	94
PID 532 wrote to memory of 3208	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	95
PID 532 wrote to memory of 3208	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	95
PID 532 wrote to memory of 4792	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	96
PID 532 wrote to memory of 4792	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	96
PID 532 wrote to memory of 3996	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	97
PID 532 wrote to memory of 3996	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	97
PID 532 wrote to memory of 3216	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	98
PID 532 wrote to memory of 3216	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	98
PID 532 wrote to memory of 2924	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	99
PID 532 wrote to memory of 2924	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	99
PID 532 wrote to memory of 3228	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	100
PID 532 wrote to memory of 3228	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	100
PID 532 wrote to memory of 4000	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	101
PID 532 wrote to memory of 4000	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	101
PID 532 wrote to memory of 4692	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	102
PID 532 wrote to memory of 4692	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	102
PID 532 wrote to memory of 2408	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	103
PID 532 wrote to memory of 2408	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	103
PID 532 wrote to memory of 4260	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	104
PID 532 wrote to memory of 4260	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	104
PID 532 wrote to memory of 1892	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	105
PID 532 wrote to memory of 1892	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	105
PID 532 wrote to memory of 368	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	106
PID 532 wrote to memory of 368	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	106
PID 532 wrote to memory of 2896	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	107
PID 532 wrote to memory of 2896	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	107
PID 532 wrote to memory of 4228	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	108
PID 532 wrote to memory of 4228	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	108
PID 532 wrote to memory of 3648	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	109
PID 532 wrote to memory of 3648	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	109
PID 532 wrote to memory of 1120	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	110
PID 532 wrote to memory of 1120	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	110
PID 532 wrote to memory of 1464	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	111
PID 532 wrote to memory of 1464	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	111
PID 532 wrote to memory of 4632	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	112
PID 532 wrote to memory of 4632	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	112
PID 532 wrote to memory of 3828	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	113
PID 532 wrote to memory of 3828	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	113
PID 532 wrote to memory of 4224	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	114
PID 532 wrote to memory of 4224	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	114
PID 532 wrote to memory of 1356	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	115
PID 532 wrote to memory of 1356	532	b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe	115

C:\Users\Admin\AppData\Local\Temp\b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe
"C:\Users\Admin\AppData\Local\Temp\b23ffded261863a5b79b0b7011f40db30d5ab718d51b7cec13cd6fa87f8c1cd0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\System\BIdnpvx.exe
  C:\Windows\System\BIdnpvx.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\CEfPGtc.exe
  C:\Windows\System\CEfPGtc.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\IJZgYpH.exe
  C:\Windows\System\IJZgYpH.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\ziKacui.exe
  C:\Windows\System\ziKacui.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\yxkRKMB.exe
  C:\Windows\System\yxkRKMB.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\XaqECiQ.exe
  C:\Windows\System\XaqECiQ.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\uiquRbI.exe
  C:\Windows\System\uiquRbI.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\CgRxLWD.exe
  C:\Windows\System\CgRxLWD.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\oOmpJLF.exe
  C:\Windows\System\oOmpJLF.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\EJrpQgr.exe
  C:\Windows\System\EJrpQgr.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\sTwztVV.exe
  C:\Windows\System\sTwztVV.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\gjnppFn.exe
  C:\Windows\System\gjnppFn.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\LPLlvdf.exe
  C:\Windows\System\LPLlvdf.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\EPMclqD.exe
  C:\Windows\System\EPMclqD.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\BvSkcTk.exe
  C:\Windows\System\BvSkcTk.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\yqDALeH.exe
  C:\Windows\System\yqDALeH.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ygwZmHr.exe
  C:\Windows\System\ygwZmHr.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\nYtfNOk.exe
  C:\Windows\System\nYtfNOk.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\SxdJJOY.exe
  C:\Windows\System\SxdJJOY.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\DzokGzS.exe
  C:\Windows\System\DzokGzS.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\cHwYWuk.exe
  C:\Windows\System\cHwYWuk.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\NLDrzWh.exe
  C:\Windows\System\NLDrzWh.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\ulUEFPL.exe
  C:\Windows\System\ulUEFPL.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\buwVPwx.exe
  C:\Windows\System\buwVPwx.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\BkXheGz.exe
  C:\Windows\System\BkXheGz.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\BABBCre.exe
  C:\Windows\System\BABBCre.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\FBAwyaf.exe
  C:\Windows\System\FBAwyaf.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\FjRmubj.exe
  C:\Windows\System\FjRmubj.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\QHagFAF.exe
  C:\Windows\System\QHagFAF.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\UTfltCo.exe
  C:\Windows\System\UTfltCo.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\QtEvAxk.exe
  C:\Windows\System\QtEvAxk.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\DSahjeu.exe
  C:\Windows\System\DSahjeu.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\sznuIxa.exe
  C:\Windows\System\sznuIxa.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\gDQdwAQ.exe
  C:\Windows\System\gDQdwAQ.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\XPQFEtY.exe
  C:\Windows\System\XPQFEtY.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\EBInvZe.exe
  C:\Windows\System\EBInvZe.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\LEmskhb.exe
  C:\Windows\System\LEmskhb.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\TLbRwzS.exe
  C:\Windows\System\TLbRwzS.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\RqWTtIq.exe
  C:\Windows\System\RqWTtIq.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\lBLGGsG.exe
  C:\Windows\System\lBLGGsG.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\ewPRoiA.exe
  C:\Windows\System\ewPRoiA.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\HZpCUcC.exe
  C:\Windows\System\HZpCUcC.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\zTcZWKD.exe
  C:\Windows\System\zTcZWKD.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\EjRNxpi.exe
  C:\Windows\System\EjRNxpi.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\WGGXCRS.exe
  C:\Windows\System\WGGXCRS.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\tiJJhbQ.exe
  C:\Windows\System\tiJJhbQ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\theXzSS.exe
  C:\Windows\System\theXzSS.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\OOJYAiQ.exe
  C:\Windows\System\OOJYAiQ.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\QhPGYOL.exe
  C:\Windows\System\QhPGYOL.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\EFxYjXh.exe
  C:\Windows\System\EFxYjXh.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\JucCdcA.exe
  C:\Windows\System\JucCdcA.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\tKDnxNK.exe
  C:\Windows\System\tKDnxNK.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\bfDFcfd.exe
  C:\Windows\System\bfDFcfd.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\heRKQAe.exe
  C:\Windows\System\heRKQAe.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\nQzjEyK.exe
  C:\Windows\System\nQzjEyK.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\FpEhKfy.exe
  C:\Windows\System\FpEhKfy.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\vPKNtdp.exe
  C:\Windows\System\vPKNtdp.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\RIvPWqu.exe
  C:\Windows\System\RIvPWqu.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\ZILUyXC.exe
  C:\Windows\System\ZILUyXC.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\RPUJCgt.exe
  C:\Windows\System\RPUJCgt.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\qUoNLhx.exe
  C:\Windows\System\qUoNLhx.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\bhQXDkf.exe
  C:\Windows\System\bhQXDkf.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\XxxnLbR.exe
  C:\Windows\System\XxxnLbR.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\kDoeiGG.exe
  C:\Windows\System\kDoeiGG.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\KnoaRPq.exe
  C:\Windows\System\KnoaRPq.exe
  2⤵
  PID:1156
- C:\Windows\System\WHIiinX.exe
  C:\Windows\System\WHIiinX.exe
  2⤵
  PID:3392
- C:\Windows\System\mNHlTEt.exe
  C:\Windows\System\mNHlTEt.exe
  2⤵
  PID:1208
- C:\Windows\System\RrkMuBs.exe
  C:\Windows\System\RrkMuBs.exe
  2⤵
  PID:3068
- C:\Windows\System\MefsUPk.exe
  C:\Windows\System\MefsUPk.exe
  2⤵
  PID:3720
- C:\Windows\System\PNjShfb.exe
  C:\Windows\System\PNjShfb.exe
  2⤵
  PID:4132
- C:\Windows\System\LTzHYBP.exe
  C:\Windows\System\LTzHYBP.exe
  2⤵
  PID:3164
- C:\Windows\System\dEpXgCY.exe
  C:\Windows\System\dEpXgCY.exe
  2⤵
  PID:2956
- C:\Windows\System\pNnRAan.exe
  C:\Windows\System\pNnRAan.exe
  2⤵
  PID:1020
- C:\Windows\System\kDoaEYB.exe
  C:\Windows\System\kDoaEYB.exe
  2⤵
  PID:3988
- C:\Windows\System\WpVxhtD.exe
  C:\Windows\System\WpVxhtD.exe
  2⤵
  PID:3712
- C:\Windows\System\yvAPHNT.exe
  C:\Windows\System\yvAPHNT.exe
  2⤵
  PID:1692
- C:\Windows\System\ZBIEdDC.exe
  C:\Windows\System\ZBIEdDC.exe
  2⤵
  PID:4552
- C:\Windows\System\aUOSHcO.exe
  C:\Windows\System\aUOSHcO.exe
  2⤵
  PID:2452
- C:\Windows\System\zqAspsR.exe
  C:\Windows\System\zqAspsR.exe
  2⤵
  PID:3244
- C:\Windows\System\rzLKvSS.exe
  C:\Windows\System\rzLKvSS.exe
  2⤵
  PID:4904
- C:\Windows\System\cSDuLUU.exe
  C:\Windows\System\cSDuLUU.exe
  2⤵
  PID:4664
- C:\Windows\System\YZyFrgQ.exe
  C:\Windows\System\YZyFrgQ.exe
  2⤵
  PID:1492
- C:\Windows\System\CIZQAyt.exe
  C:\Windows\System\CIZQAyt.exe
  2⤵
  PID:2696
- C:\Windows\System\EVjVnJr.exe
  C:\Windows\System\EVjVnJr.exe
  2⤵
  PID:4160
- C:\Windows\System\rFKpMby.exe
  C:\Windows\System\rFKpMby.exe
  2⤵
  PID:1500
- C:\Windows\System\mpAiQgM.exe
  C:\Windows\System\mpAiQgM.exe
  2⤵
  PID:1440
- C:\Windows\System\AaezbKz.exe
  C:\Windows\System\AaezbKz.exe
  2⤵
  PID:2972
- C:\Windows\System\rYwzWAv.exe
  C:\Windows\System\rYwzWAv.exe
  2⤵
  PID:3640
- C:\Windows\System\PbyHXLS.exe
  C:\Windows\System\PbyHXLS.exe
  2⤵
  PID:4472
- C:\Windows\System\PszSpHN.exe
  C:\Windows\System\PszSpHN.exe
  2⤵
  PID:852
- C:\Windows\System\ZtafQfr.exe
  C:\Windows\System\ZtafQfr.exe
  2⤵
  PID:320
- C:\Windows\System\NfDaeKw.exe
  C:\Windows\System\NfDaeKw.exe
  2⤵
  PID:3976
- C:\Windows\System\rKLzwCc.exe
  C:\Windows\System\rKLzwCc.exe
  2⤵
  PID:3944
- C:\Windows\System\QMGIQug.exe
  C:\Windows\System\QMGIQug.exe
  2⤵
  PID:2008
- C:\Windows\System\yqlLuoq.exe
  C:\Windows\System\yqlLuoq.exe
  2⤵
  PID:4976
- C:\Windows\System\EbBJcsN.exe
  C:\Windows\System\EbBJcsN.exe
  2⤵
  PID:1796
- C:\Windows\System\gmnGbKN.exe
  C:\Windows\System\gmnGbKN.exe
  2⤵
  PID:4684
- C:\Windows\System\YfaGlcO.exe
  C:\Windows\System\YfaGlcO.exe
  2⤵
  PID:1544
- C:\Windows\System\MLJjImJ.exe
  C:\Windows\System\MLJjImJ.exe
  2⤵
  PID:1148
- C:\Windows\System\NmbWdFa.exe
  C:\Windows\System\NmbWdFa.exe
  2⤵
  PID:1776
- C:\Windows\System\IMmqAXo.exe
  C:\Windows\System\IMmqAXo.exe
  2⤵
  PID:2888
- C:\Windows\System\CRhrjgj.exe
  C:\Windows\System\CRhrjgj.exe
  2⤵
  PID:2124
- C:\Windows\System\jdqCDUZ.exe
  C:\Windows\System\jdqCDUZ.exe
  2⤵
  PID:704
- C:\Windows\System\LSFKsKm.exe
  C:\Windows\System\LSFKsKm.exe
  2⤵
  PID:2516
- C:\Windows\System\jpnjZcS.exe
  C:\Windows\System\jpnjZcS.exe
  2⤵
  PID:2664
- C:\Windows\System\llWZmAF.exe
  C:\Windows\System\llWZmAF.exe
  2⤵
  PID:4972
- C:\Windows\System\bjtCJJH.exe
  C:\Windows\System\bjtCJJH.exe
  2⤵
  PID:2456
- C:\Windows\System\jYmJxEy.exe
  C:\Windows\System\jYmJxEy.exe
  2⤵
  PID:1540
- C:\Windows\System\AptLxtw.exe
  C:\Windows\System\AptLxtw.exe
  2⤵
  PID:4272
- C:\Windows\System\kBuEtnv.exe
  C:\Windows\System\kBuEtnv.exe
  2⤵
  PID:4448
- C:\Windows\System\OrOeEEK.exe
  C:\Windows\System\OrOeEEK.exe
  2⤵
  PID:3044
- C:\Windows\System\lxGYTRp.exe
  C:\Windows\System\lxGYTRp.exe
  2⤵
  PID:2336
- C:\Windows\System\dzPHEpW.exe
  C:\Windows\System\dzPHEpW.exe
  2⤵
  PID:4192
- C:\Windows\System\BGUHOrQ.exe
  C:\Windows\System\BGUHOrQ.exe
  2⤵
  PID:5132
- C:\Windows\System\xVvOpWI.exe
  C:\Windows\System\xVvOpWI.exe
  2⤵
  PID:5160
- C:\Windows\System\UTENWPg.exe
  C:\Windows\System\UTENWPg.exe
  2⤵
  PID:5184
- C:\Windows\System\jryFtQJ.exe
  C:\Windows\System\jryFtQJ.exe
  2⤵
  PID:5208
- C:\Windows\System\MkvBhyQ.exe
  C:\Windows\System\MkvBhyQ.exe
  2⤵
  PID:5236
- C:\Windows\System\ibsMzYz.exe
  C:\Windows\System\ibsMzYz.exe
  2⤵
  PID:5276
- C:\Windows\System\QbXcqQT.exe
  C:\Windows\System\QbXcqQT.exe
  2⤵
  PID:5300
- C:\Windows\System\hrvgQlk.exe
  C:\Windows\System\hrvgQlk.exe
  2⤵
  PID:5328
- C:\Windows\System\AHdLjKz.exe
  C:\Windows\System\AHdLjKz.exe
  2⤵
  PID:5356
- C:\Windows\System\bHWWgXM.exe
  C:\Windows\System\bHWWgXM.exe
  2⤵
  PID:5384
- C:\Windows\System\GxeYcpv.exe
  C:\Windows\System\GxeYcpv.exe
  2⤵
  PID:5404
- C:\Windows\System\lrXBHFo.exe
  C:\Windows\System\lrXBHFo.exe
  2⤵
  PID:5444
- C:\Windows\System\Twuwkrg.exe
  C:\Windows\System\Twuwkrg.exe
  2⤵
  PID:5472
- C:\Windows\System\wGozRid.exe
  C:\Windows\System\wGozRid.exe
  2⤵
  PID:5504
- C:\Windows\System\iipiFwu.exe
  C:\Windows\System\iipiFwu.exe
  2⤵
  PID:5556
- C:\Windows\System\NWBulxH.exe
  C:\Windows\System\NWBulxH.exe
  2⤵
  PID:5572
- C:\Windows\System\GbozMkU.exe
  C:\Windows\System\GbozMkU.exe
  2⤵
  PID:5600
- C:\Windows\System\TaqkIiF.exe
  C:\Windows\System\TaqkIiF.exe
  2⤵
  PID:5624
- C:\Windows\System\QXorrcT.exe
  C:\Windows\System\QXorrcT.exe
  2⤵
  PID:5652
- C:\Windows\System\yBLVQAm.exe
  C:\Windows\System\yBLVQAm.exe
  2⤵
  PID:5676
- C:\Windows\System\pDCItda.exe
  C:\Windows\System\pDCItda.exe
  2⤵
  PID:5712
- C:\Windows\System\RYHgkPO.exe
  C:\Windows\System\RYHgkPO.exe
  2⤵
  PID:5744
- C:\Windows\System\jSaUaKD.exe
  C:\Windows\System\jSaUaKD.exe
  2⤵
  PID:5772
- C:\Windows\System\DvHZraB.exe
  C:\Windows\System\DvHZraB.exe
  2⤵
  PID:5800
- C:\Windows\System\HFNwmLF.exe
  C:\Windows\System\HFNwmLF.exe
  2⤵
  PID:5840
- C:\Windows\System\oUClbcQ.exe
  C:\Windows\System\oUClbcQ.exe
  2⤵
  PID:5856
- C:\Windows\System\iWFatzM.exe
  C:\Windows\System\iWFatzM.exe
  2⤵
  PID:5876
- C:\Windows\System\bFdZlJj.exe
  C:\Windows\System\bFdZlJj.exe
  2⤵
  PID:5904
- C:\Windows\System\KAanAgN.exe
  C:\Windows\System\KAanAgN.exe
  2⤵
  PID:5928
- C:\Windows\System\eYADFfs.exe
  C:\Windows\System\eYADFfs.exe
  2⤵
  PID:5964
- C:\Windows\System\UsxaNQE.exe
  C:\Windows\System\UsxaNQE.exe
  2⤵
  PID:6000
- C:\Windows\System\nUoicvK.exe
  C:\Windows\System\nUoicvK.exe
  2⤵
  PID:6020
- C:\Windows\System\wGHibGq.exe
  C:\Windows\System\wGHibGq.exe
  2⤵
  PID:6060
- C:\Windows\System\OhDNEWA.exe
  C:\Windows\System\OhDNEWA.exe
  2⤵
  PID:6088
- C:\Windows\System\mWZLvIn.exe
  C:\Windows\System\mWZLvIn.exe
  2⤵
  PID:6104
- C:\Windows\System\NHxNgkI.exe
  C:\Windows\System\NHxNgkI.exe
  2⤵
  PID:6132
- C:\Windows\System\cqGiUDs.exe
  C:\Windows\System\cqGiUDs.exe
  2⤵
  PID:5180
- C:\Windows\System\ATWmAjn.exe
  C:\Windows\System\ATWmAjn.exe
  2⤵
  PID:5256
- C:\Windows\System\yPZkenu.exe
  C:\Windows\System\yPZkenu.exe
  2⤵
  PID:5288
- C:\Windows\System\uZipUqB.exe
  C:\Windows\System\uZipUqB.exe
  2⤵
  PID:5344
- C:\Windows\System\QNGltvv.exe
  C:\Windows\System\QNGltvv.exe
  2⤵
  PID:5452
- C:\Windows\System\dWtwUjO.exe
  C:\Windows\System\dWtwUjO.exe
  2⤵
  PID:5500
- C:\Windows\System\nZAHOqu.exe
  C:\Windows\System\nZAHOqu.exe
  2⤵
  PID:2260
- C:\Windows\System\avsDlQe.exe
  C:\Windows\System\avsDlQe.exe
  2⤵
  PID:5552
- C:\Windows\System\dgkrMgJ.exe
  C:\Windows\System\dgkrMgJ.exe
  2⤵
  PID:5596
- C:\Windows\System\ajhLYYk.exe
  C:\Windows\System\ajhLYYk.exe
  2⤵
  PID:5668
- C:\Windows\System\MZSQGVC.exe
  C:\Windows\System\MZSQGVC.exe
  2⤵
  PID:5736
- C:\Windows\System\OhCmrII.exe
  C:\Windows\System\OhCmrII.exe
  2⤵
  PID:5812
- C:\Windows\System\TEVEkTq.exe
  C:\Windows\System\TEVEkTq.exe
  2⤵
  PID:5892
- C:\Windows\System\VBGHlpN.exe
  C:\Windows\System\VBGHlpN.exe
  2⤵
  PID:5972
- C:\Windows\System\fysMiZb.exe
  C:\Windows\System\fysMiZb.exe
  2⤵
  PID:6040
- C:\Windows\System\sJGybgj.exe
  C:\Windows\System\sJGybgj.exe
  2⤵
  PID:6080
- C:\Windows\System\Prllenx.exe
  C:\Windows\System\Prllenx.exe
  2⤵
  PID:5128
- C:\Windows\System\OURNAFV.exe
  C:\Windows\System\OURNAFV.exe
  2⤵
  PID:5268
- C:\Windows\System\YMcATvB.exe
  C:\Windows\System\YMcATvB.exe
  2⤵
  PID:5376
- C:\Windows\System\aJbgNqY.exe
  C:\Windows\System\aJbgNqY.exe
  2⤵
  PID:5480
- C:\Windows\System\dqQPmiT.exe
  C:\Windows\System\dqQPmiT.exe
  2⤵
  PID:5648
- C:\Windows\System\HBGdBYF.exe
  C:\Windows\System\HBGdBYF.exe
  2⤵
  PID:5792
- C:\Windows\System\wddeElY.exe
  C:\Windows\System\wddeElY.exe
  2⤵
  PID:5940
- C:\Windows\System\SxwZlUp.exe
  C:\Windows\System\SxwZlUp.exe
  2⤵
  PID:6056
- C:\Windows\System\RLOzIVr.exe
  C:\Windows\System\RLOzIVr.exe
  2⤵
  PID:5536
- C:\Windows\System\YpjyUAT.exe
  C:\Windows\System\YpjyUAT.exe
  2⤵
  PID:5728
- C:\Windows\System\PlHvDnI.exe
  C:\Windows\System\PlHvDnI.exe
  2⤵
  PID:6128
- C:\Windows\System\LlOIpoe.exe
  C:\Windows\System\LlOIpoe.exe
  2⤵
  PID:6016
- C:\Windows\System\hYDZuRN.exe
  C:\Windows\System\hYDZuRN.exe
  2⤵
  PID:6156
- C:\Windows\System\RejMWLS.exe
  C:\Windows\System\RejMWLS.exe
  2⤵
  PID:6180
- C:\Windows\System\NwLbObr.exe
  C:\Windows\System\NwLbObr.exe
  2⤵
  PID:6196
- C:\Windows\System\HUBkgDr.exe
  C:\Windows\System\HUBkgDr.exe
  2⤵
  PID:6220
- C:\Windows\System\NAXYZGy.exe
  C:\Windows\System\NAXYZGy.exe
  2⤵
  PID:6252
- C:\Windows\System\bJQNKfs.exe
  C:\Windows\System\bJQNKfs.exe
  2⤵
  PID:6276
- C:\Windows\System\nuLqrZq.exe
  C:\Windows\System\nuLqrZq.exe
  2⤵
  PID:6304
- C:\Windows\System\aHngKOo.exe
  C:\Windows\System\aHngKOo.exe
  2⤵
  PID:6348
- C:\Windows\System\CqQZeCi.exe
  C:\Windows\System\CqQZeCi.exe
  2⤵
  PID:6368
- C:\Windows\System\IzYFTKM.exe
  C:\Windows\System\IzYFTKM.exe
  2⤵
  PID:6400
- C:\Windows\System\sRezxTF.exe
  C:\Windows\System\sRezxTF.exe
  2⤵
  PID:6436
- C:\Windows\System\YMmuRwp.exe
  C:\Windows\System\YMmuRwp.exe
  2⤵
  PID:6468
- C:\Windows\System\tuXCqnF.exe
  C:\Windows\System\tuXCqnF.exe
  2⤵
  PID:6488
- C:\Windows\System\LKdzanG.exe
  C:\Windows\System\LKdzanG.exe
  2⤵
  PID:6516
- C:\Windows\System\xaFvKsR.exe
  C:\Windows\System\xaFvKsR.exe
  2⤵
  PID:6540
- C:\Windows\System\qAayMUd.exe
  C:\Windows\System\qAayMUd.exe
  2⤵
  PID:6572
- C:\Windows\System\lxyPgtg.exe
  C:\Windows\System\lxyPgtg.exe
  2⤵
  PID:6604
- C:\Windows\System\nEWpbLt.exe
  C:\Windows\System\nEWpbLt.exe
  2⤵
  PID:6628
- C:\Windows\System\STLWctG.exe
  C:\Windows\System\STLWctG.exe
  2⤵
  PID:6660
- C:\Windows\System\cEPQBBi.exe
  C:\Windows\System\cEPQBBi.exe
  2⤵
  PID:6680
- C:\Windows\System\gMMarUD.exe
  C:\Windows\System\gMMarUD.exe
  2⤵
  PID:6708
- C:\Windows\System\FMRxzia.exe
  C:\Windows\System\FMRxzia.exe
  2⤵
  PID:6732
- C:\Windows\System\gswjzIR.exe
  C:\Windows\System\gswjzIR.exe
  2⤵
  PID:6756
- C:\Windows\System\aBqBpos.exe
  C:\Windows\System\aBqBpos.exe
  2⤵
  PID:6792
- C:\Windows\System\BhoBJpg.exe
  C:\Windows\System\BhoBJpg.exe
  2⤵
  PID:6828
- C:\Windows\System\FlBbrao.exe
  C:\Windows\System\FlBbrao.exe
  2⤵
  PID:6844
- C:\Windows\System\AVUZfSd.exe
  C:\Windows\System\AVUZfSd.exe
  2⤵
  PID:6876
- C:\Windows\System\gZTMiuj.exe
  C:\Windows\System\gZTMiuj.exe
  2⤵
  PID:6904
- C:\Windows\System\UguRxAR.exe
  C:\Windows\System\UguRxAR.exe
  2⤵
  PID:6936
- C:\Windows\System\nBnChXr.exe
  C:\Windows\System\nBnChXr.exe
  2⤵
  PID:6968
- C:\Windows\System\UHeosaN.exe
  C:\Windows\System\UHeosaN.exe
  2⤵
  PID:6992
- C:\Windows\System\lhgDUQg.exe
  C:\Windows\System\lhgDUQg.exe
  2⤵
  PID:7024
- C:\Windows\System\RRkZkSS.exe
  C:\Windows\System\RRkZkSS.exe
  2⤵
  PID:7052
- C:\Windows\System\SiYAedu.exe
  C:\Windows\System\SiYAedu.exe
  2⤵
  PID:7084
- C:\Windows\System\GeGpjsZ.exe
  C:\Windows\System\GeGpjsZ.exe
  2⤵
  PID:7108
- C:\Windows\System\ardiKLk.exe
  C:\Windows\System\ardiKLk.exe
  2⤵
  PID:7136
- C:\Windows\System\oWYVfXR.exe
  C:\Windows\System\oWYVfXR.exe
  2⤵
  PID:7152
- C:\Windows\System\CTRpVtw.exe
  C:\Windows\System\CTRpVtw.exe
  2⤵
  PID:6164
- C:\Windows\System\kbTawOV.exe
  C:\Windows\System\kbTawOV.exe
  2⤵
  PID:6176
- C:\Windows\System\fqObgVN.exe
  C:\Windows\System\fqObgVN.exe
  2⤵
  PID:6300
- C:\Windows\System\UTlLKqo.exe
  C:\Windows\System\UTlLKqo.exe
  2⤵
  PID:6324
- C:\Windows\System\sFwPKev.exe
  C:\Windows\System\sFwPKev.exe
  2⤵
  PID:6384
- C:\Windows\System\GrQziXN.exe
  C:\Windows\System\GrQziXN.exe
  2⤵
  PID:6480
- C:\Windows\System\gYqOcVS.exe
  C:\Windows\System\gYqOcVS.exe
  2⤵
  PID:6564
- C:\Windows\System\AXEbLKW.exe
  C:\Windows\System\AXEbLKW.exe
  2⤵
  PID:6652
- C:\Windows\System\QXYcVNv.exe
  C:\Windows\System\QXYcVNv.exe
  2⤵
  PID:6668
- C:\Windows\System\QXnUdiq.exe
  C:\Windows\System\QXnUdiq.exe
  2⤵
  PID:6724
- C:\Windows\System\GmQFacJ.exe
  C:\Windows\System\GmQFacJ.exe
  2⤵
  PID:6768
- C:\Windows\System\XGxYkBy.exe
  C:\Windows\System\XGxYkBy.exe
  2⤵
  PID:6836
- C:\Windows\System\GwwCBYo.exe
  C:\Windows\System\GwwCBYo.exe
  2⤵
  PID:6924
- C:\Windows\System\vhJzyKk.exe
  C:\Windows\System\vhJzyKk.exe
  2⤵
  PID:6980
- C:\Windows\System\DvzQXsw.exe
  C:\Windows\System\DvzQXsw.exe
  2⤵
  PID:7092
- C:\Windows\System\doUnpKs.exe
  C:\Windows\System\doUnpKs.exe
  2⤵
  PID:7148
- C:\Windows\System\rlPQpze.exe
  C:\Windows\System\rlPQpze.exe
  2⤵
  PID:6392
- C:\Windows\System\ezkMBLS.exe
  C:\Windows\System\ezkMBLS.exe
  2⤵
  PID:6212
- C:\Windows\System\fzpTGyj.exe
  C:\Windows\System\fzpTGyj.exe
  2⤵
  PID:6616
- C:\Windows\System\eFTvowT.exe
  C:\Windows\System\eFTvowT.exe
  2⤵
  PID:6640
- C:\Windows\System\mEdjneO.exe
  C:\Windows\System\mEdjneO.exe
  2⤵
  PID:6744
- C:\Windows\System\vFkCcqV.exe
  C:\Windows\System\vFkCcqV.exe
  2⤵
  PID:6912
- C:\Windows\System\LNUqXCk.exe
  C:\Windows\System\LNUqXCk.exe
  2⤵
  PID:7048
- C:\Windows\System\zkhXLkc.exe
  C:\Windows\System\zkhXLkc.exe
  2⤵
  PID:6316
- C:\Windows\System\gdAJwwk.exe
  C:\Windows\System\gdAJwwk.exe
  2⤵
  PID:6716
- C:\Windows\System\SOOhCpq.exe
  C:\Windows\System\SOOhCpq.exe
  2⤵
  PID:6920
- C:\Windows\System\nxHBtdC.exe
  C:\Windows\System\nxHBtdC.exe
  2⤵
  PID:6432
- C:\Windows\System\ucHJoHl.exe
  C:\Windows\System\ucHJoHl.exe
  2⤵
  PID:7196
- C:\Windows\System\VhvEIjr.exe
  C:\Windows\System\VhvEIjr.exe
  2⤵
  PID:7228
- C:\Windows\System\wIZlJXH.exe
  C:\Windows\System\wIZlJXH.exe
  2⤵
  PID:7248
- C:\Windows\System\TyNUlXt.exe
  C:\Windows\System\TyNUlXt.exe
  2⤵
  PID:7276
- C:\Windows\System\QoOUEHx.exe
  C:\Windows\System\QoOUEHx.exe
  2⤵
  PID:7300
- C:\Windows\System\ZTyeZTZ.exe
  C:\Windows\System\ZTyeZTZ.exe
  2⤵
  PID:7340
- C:\Windows\System\JryJZFk.exe
  C:\Windows\System\JryJZFk.exe
  2⤵
  PID:7364
- C:\Windows\System\AmWlRsI.exe
  C:\Windows\System\AmWlRsI.exe
  2⤵
  PID:7392
- C:\Windows\System\pvUGSoI.exe
  C:\Windows\System\pvUGSoI.exe
  2⤵
  PID:7440
- C:\Windows\System\ZgovrRf.exe
  C:\Windows\System\ZgovrRf.exe
  2⤵
  PID:7468
- C:\Windows\System\sEdRjvE.exe
  C:\Windows\System\sEdRjvE.exe
  2⤵
  PID:7500
- C:\Windows\System\aavixSh.exe
  C:\Windows\System\aavixSh.exe
  2⤵
  PID:7528
- C:\Windows\System\tOOjCVS.exe
  C:\Windows\System\tOOjCVS.exe
  2⤵
  PID:7544
- C:\Windows\System\YClYPYE.exe
  C:\Windows\System\YClYPYE.exe
  2⤵
  PID:7572
- C:\Windows\System\jYqfcly.exe
  C:\Windows\System\jYqfcly.exe
  2⤵
  PID:7604
- C:\Windows\System\BSMpHgI.exe
  C:\Windows\System\BSMpHgI.exe
  2⤵
  PID:7628
- C:\Windows\System\wngcJpT.exe
  C:\Windows\System\wngcJpT.exe
  2⤵
  PID:7656
- C:\Windows\System\skmtjHn.exe
  C:\Windows\System\skmtjHn.exe
  2⤵
  PID:7696
- C:\Windows\System\ROphVzm.exe
  C:\Windows\System\ROphVzm.exe
  2⤵
  PID:7724
- C:\Windows\System\pUceoBR.exe
  C:\Windows\System\pUceoBR.exe
  2⤵
  PID:7744
- C:\Windows\System\lpswOUM.exe
  C:\Windows\System\lpswOUM.exe
  2⤵
  PID:7776
- C:\Windows\System\TnWGKfH.exe
  C:\Windows\System\TnWGKfH.exe
  2⤵
  PID:7804
- C:\Windows\System\hAuNlSF.exe
  C:\Windows\System\hAuNlSF.exe
  2⤵
  PID:7820
- C:\Windows\System\ohQRPGv.exe
  C:\Windows\System\ohQRPGv.exe
  2⤵
  PID:7852
- C:\Windows\System\nieQVLO.exe
  C:\Windows\System\nieQVLO.exe
  2⤵
  PID:7880
- C:\Windows\System\mWfwgLn.exe
  C:\Windows\System\mWfwgLn.exe
  2⤵
  PID:7908
- C:\Windows\System\LiBbAFE.exe
  C:\Windows\System\LiBbAFE.exe
  2⤵
  PID:7944
- C:\Windows\System\lmJFVit.exe
  C:\Windows\System\lmJFVit.exe
  2⤵
  PID:7976
- C:\Windows\System\zyoWeuO.exe
  C:\Windows\System\zyoWeuO.exe
  2⤵
  PID:8004
- C:\Windows\System\uNVSNca.exe
  C:\Windows\System\uNVSNca.exe
  2⤵
  PID:8040
- C:\Windows\System\EypchHE.exe
  C:\Windows\System\EypchHE.exe
  2⤵
  PID:8060
- C:\Windows\System\btXcIVK.exe
  C:\Windows\System\btXcIVK.exe
  2⤵
  PID:8084
- C:\Windows\System\ApiWORF.exe
  C:\Windows\System\ApiWORF.exe
  2⤵
  PID:8104
- C:\Windows\System\xpztVHz.exe
  C:\Windows\System\xpztVHz.exe
  2⤵
  PID:8128
- C:\Windows\System\LupfKpe.exe
  C:\Windows\System\LupfKpe.exe
  2⤵
  PID:8160
- C:\Windows\System\QfxWJCO.exe
  C:\Windows\System\QfxWJCO.exe
  2⤵
  PID:8188
- C:\Windows\System\pFQUThG.exe
  C:\Windows\System\pFQUThG.exe
  2⤵
  PID:7188
- C:\Windows\System\VVXFWcS.exe
  C:\Windows\System\VVXFWcS.exe
  2⤵
  PID:7272
- C:\Windows\System\GgdzDjW.exe
  C:\Windows\System\GgdzDjW.exe
  2⤵
  PID:7328
- C:\Windows\System\mCwBMOO.exe
  C:\Windows\System\mCwBMOO.exe
  2⤵
  PID:7388
- C:\Windows\System\MWhCRYn.exe
  C:\Windows\System\MWhCRYn.exe
  2⤵
  PID:7484
- C:\Windows\System\rIAUqkP.exe
  C:\Windows\System\rIAUqkP.exe
  2⤵
  PID:7540
- C:\Windows\System\fEeMhdU.exe
  C:\Windows\System\fEeMhdU.exe
  2⤵
  PID:7624
- C:\Windows\System\yjIPokm.exe
  C:\Windows\System\yjIPokm.exe
  2⤵
  PID:7640
- C:\Windows\System\IOGrtGk.exe
  C:\Windows\System\IOGrtGk.exe
  2⤵
  PID:7740
- C:\Windows\System\XuJYyID.exe
  C:\Windows\System\XuJYyID.exe
  2⤵
  PID:7784
- C:\Windows\System\sfwTrBx.exe
  C:\Windows\System\sfwTrBx.exe
  2⤵
  PID:7816
- C:\Windows\System\rTcxAsK.exe
  C:\Windows\System\rTcxAsK.exe
  2⤵
  PID:7960
- C:\Windows\System\hVWXiLr.exe
  C:\Windows\System\hVWXiLr.exe
  2⤵
  PID:8000
- C:\Windows\System\mULShyx.exe
  C:\Windows\System\mULShyx.exe
  2⤵
  PID:8080
- C:\Windows\System\pUfejpy.exe
  C:\Windows\System\pUfejpy.exe
  2⤵
  PID:8124
- C:\Windows\System\eiMAZUh.exe
  C:\Windows\System\eiMAZUh.exe
  2⤵
  PID:8172
- C:\Windows\System\BAuqzXH.exe
  C:\Windows\System\BAuqzXH.exe
  2⤵
  PID:7264
- C:\Windows\System\SibLBen.exe
  C:\Windows\System\SibLBen.exe
  2⤵
  PID:7464
- C:\Windows\System\TDoubqS.exe
  C:\Windows\System\TDoubqS.exe
  2⤵
  PID:7536
- C:\Windows\System\JJOhxXf.exe
  C:\Windows\System\JJOhxXf.exe
  2⤵
  PID:7664
- C:\Windows\System\iEyZYdi.exe
  C:\Windows\System\iEyZYdi.exe
  2⤵
  PID:7732
- C:\Windows\System\lnUGvnG.exe
  C:\Windows\System\lnUGvnG.exe
  2⤵
  PID:7928
- C:\Windows\System\PwFHrgg.exe
  C:\Windows\System\PwFHrgg.exe
  2⤵
  PID:7120
- C:\Windows\System\sbNczMO.exe
  C:\Windows\System\sbNczMO.exe
  2⤵
  PID:7212
- C:\Windows\System\nUCLVQN.exe
  C:\Windows\System\nUCLVQN.exe
  2⤵
  PID:7904
- C:\Windows\System\BJjVMaq.exe
  C:\Windows\System\BJjVMaq.exe
  2⤵
  PID:7872
- C:\Windows\System\zcAIRlC.exe
  C:\Windows\System\zcAIRlC.exe
  2⤵
  PID:7812
- C:\Windows\System\RxrKgPU.exe
  C:\Windows\System\RxrKgPU.exe
  2⤵
  PID:7324
- C:\Windows\System\dEnnvwn.exe
  C:\Windows\System\dEnnvwn.exe
  2⤵
  PID:8212
- C:\Windows\System\AcsWZHr.exe
  C:\Windows\System\AcsWZHr.exe
  2⤵
  PID:8244
- C:\Windows\System\ErBvFtz.exe
  C:\Windows\System\ErBvFtz.exe
  2⤵
  PID:8276
- C:\Windows\System\eqJDDVZ.exe
  C:\Windows\System\eqJDDVZ.exe
  2⤵
  PID:8304
- C:\Windows\System\MjXbHlM.exe
  C:\Windows\System\MjXbHlM.exe
  2⤵
  PID:8324
- C:\Windows\System\JXjYfJM.exe
  C:\Windows\System\JXjYfJM.exe
  2⤵
  PID:8356
- C:\Windows\System\HhPXhQQ.exe
  C:\Windows\System\HhPXhQQ.exe
  2⤵
  PID:8376
- C:\Windows\System\nbUxevZ.exe
  C:\Windows\System\nbUxevZ.exe
  2⤵
  PID:8396
- C:\Windows\System\HRkAQyN.exe
  C:\Windows\System\HRkAQyN.exe
  2⤵
  PID:8432
- C:\Windows\System\SaUnGrI.exe
  C:\Windows\System\SaUnGrI.exe
  2⤵
  PID:8460
- C:\Windows\System\GTfcYEo.exe
  C:\Windows\System\GTfcYEo.exe
  2⤵
  PID:8488
- C:\Windows\System\YabYeDw.exe
  C:\Windows\System\YabYeDw.exe
  2⤵
  PID:8524
- C:\Windows\System\eywBzfR.exe
  C:\Windows\System\eywBzfR.exe
  2⤵
  PID:8548
- C:\Windows\System\xIkBgrG.exe
  C:\Windows\System\xIkBgrG.exe
  2⤵
  PID:8576
- C:\Windows\System\RywxwQn.exe
  C:\Windows\System\RywxwQn.exe
  2⤵
  PID:8592
- C:\Windows\System\NqaBKJr.exe
  C:\Windows\System\NqaBKJr.exe
  2⤵
  PID:8616
- C:\Windows\System\THuUMbs.exe
  C:\Windows\System\THuUMbs.exe
  2⤵
  PID:8640
- C:\Windows\System\QcTmRDX.exe
  C:\Windows\System\QcTmRDX.exe
  2⤵
  PID:8668
- C:\Windows\System\NjBYBOm.exe
  C:\Windows\System\NjBYBOm.exe
  2⤵
  PID:8692
- C:\Windows\System\mqSJtQL.exe
  C:\Windows\System\mqSJtQL.exe
  2⤵
  PID:8728
- C:\Windows\System\QgvnQCR.exe
  C:\Windows\System\QgvnQCR.exe
  2⤵
  PID:8756
- C:\Windows\System\jiSksJM.exe
  C:\Windows\System\jiSksJM.exe
  2⤵
  PID:8776
- C:\Windows\System\uNIccDE.exe
  C:\Windows\System\uNIccDE.exe
  2⤵
  PID:8808
- C:\Windows\System\TMYtVqX.exe
  C:\Windows\System\TMYtVqX.exe
  2⤵
  PID:8840
- C:\Windows\System\RceREzO.exe
  C:\Windows\System\RceREzO.exe
  2⤵
  PID:8864
- C:\Windows\System\vAjuCAM.exe
  C:\Windows\System\vAjuCAM.exe
  2⤵
  PID:8888
- C:\Windows\System\wKJeJue.exe
  C:\Windows\System\wKJeJue.exe
  2⤵
  PID:8916
- C:\Windows\System\SlsdJZS.exe
  C:\Windows\System\SlsdJZS.exe
  2⤵
  PID:8948
- C:\Windows\System\LIocSQY.exe
  C:\Windows\System\LIocSQY.exe
  2⤵
  PID:8980
- C:\Windows\System\mFBeham.exe
  C:\Windows\System\mFBeham.exe
  2⤵
  PID:9020
- C:\Windows\System\InAbzDd.exe
  C:\Windows\System\InAbzDd.exe
  2⤵
  PID:9044
- C:\Windows\System\UUcJXTi.exe
  C:\Windows\System\UUcJXTi.exe
  2⤵
  PID:9072
- C:\Windows\System\YCBhzQL.exe
  C:\Windows\System\YCBhzQL.exe
  2⤵
  PID:9104
- C:\Windows\System\UFqYmIO.exe
  C:\Windows\System\UFqYmIO.exe
  2⤵
  PID:9124
- C:\Windows\System\ecnRJnt.exe
  C:\Windows\System\ecnRJnt.exe
  2⤵
  PID:9156
- C:\Windows\System\xdOUqkA.exe
  C:\Windows\System\xdOUqkA.exe
  2⤵
  PID:9196
- C:\Windows\System\cYbsCnn.exe
  C:\Windows\System\cYbsCnn.exe
  2⤵
  PID:7384
- C:\Windows\System\WMHkCwp.exe
  C:\Windows\System\WMHkCwp.exe
  2⤵
  PID:8232
- C:\Windows\System\gyoqEoC.exe
  C:\Windows\System\gyoqEoC.exe
  2⤵
  PID:8288
- C:\Windows\System\jFFvMLv.exe
  C:\Windows\System\jFFvMLv.exe
  2⤵
  PID:8384
- C:\Windows\System\QCSUChx.exe
  C:\Windows\System\QCSUChx.exe
  2⤵
  PID:8452
- C:\Windows\System\uxwTfpG.exe
  C:\Windows\System\uxwTfpG.exe
  2⤵
  PID:8512
- C:\Windows\System\htnFswY.exe
  C:\Windows\System\htnFswY.exe
  2⤵
  PID:8564
- C:\Windows\System\AXoZWrX.exe
  C:\Windows\System\AXoZWrX.exe
  2⤵
  PID:8628
- C:\Windows\System\OffmbPb.exe
  C:\Windows\System\OffmbPb.exe
  2⤵
  PID:8736
- C:\Windows\System\sEtVSPb.exe
  C:\Windows\System\sEtVSPb.exe
  2⤵
  PID:8800
- C:\Windows\System\cArQRQn.exe
  C:\Windows\System\cArQRQn.exe
  2⤵
  PID:8768
- C:\Windows\System\iPLJfav.exe
  C:\Windows\System\iPLJfav.exe
  2⤵
  PID:8856
- C:\Windows\System\EJWDWLo.exe
  C:\Windows\System\EJWDWLo.exe
  2⤵
  PID:8944
- C:\Windows\System\OFeNket.exe
  C:\Windows\System\OFeNket.exe
  2⤵
  PID:8972
- C:\Windows\System\EhxSPwB.exe
  C:\Windows\System\EhxSPwB.exe
  2⤵
  PID:9096
- C:\Windows\System\xOeTouc.exe
  C:\Windows\System\xOeTouc.exe
  2⤵
  PID:9112
- C:\Windows\System\iDSUtVb.exe
  C:\Windows\System\iDSUtVb.exe
  2⤵
  PID:9212
- C:\Windows\System\KGuvZDI.exe
  C:\Windows\System\KGuvZDI.exe
  2⤵
  PID:7596
- C:\Windows\System\ARmSAII.exe
  C:\Windows\System\ARmSAII.exe
  2⤵
  PID:8476
- C:\Windows\System\VCxXVlr.exe
  C:\Windows\System\VCxXVlr.exe
  2⤵
  PID:8536
- C:\Windows\System\RlKNBtf.exe
  C:\Windows\System\RlKNBtf.exe
  2⤵
  PID:8652
- C:\Windows\System\kcTAFDY.exe
  C:\Windows\System\kcTAFDY.exe
  2⤵
  PID:9056
- C:\Windows\System\ZuUQeQX.exe
  C:\Windows\System\ZuUQeQX.exe
  2⤵
  PID:8936
- C:\Windows\System\gGKUAxD.exe
  C:\Windows\System\gGKUAxD.exe
  2⤵
  PID:9176
- C:\Windows\System\UrKWHGz.exe
  C:\Windows\System\UrKWHGz.exe
  2⤵
  PID:8508
- C:\Windows\System\dgEAXYU.exe
  C:\Windows\System\dgEAXYU.exe
  2⤵
  PID:9008
- C:\Windows\System\BMIBbEl.exe
  C:\Windows\System\BMIBbEl.exe
  2⤵
  PID:8540
- C:\Windows\System\YbtTPql.exe
  C:\Windows\System\YbtTPql.exe
  2⤵
  PID:9248
- C:\Windows\System\JxgzMhI.exe
  C:\Windows\System\JxgzMhI.exe
  2⤵
  PID:9280
- C:\Windows\System\mAVuvOy.exe
  C:\Windows\System\mAVuvOy.exe
  2⤵
  PID:9296
- C:\Windows\System\GVhxHso.exe
  C:\Windows\System\GVhxHso.exe
  2⤵
  PID:9316
- C:\Windows\System\AOXwjCf.exe
  C:\Windows\System\AOXwjCf.exe
  2⤵
  PID:9332
- C:\Windows\System\SkrDegg.exe
  C:\Windows\System\SkrDegg.exe
  2⤵
  PID:9356
- C:\Windows\System\PXvJJXO.exe
  C:\Windows\System\PXvJJXO.exe
  2⤵
  PID:9384
- C:\Windows\System\JDcDfar.exe
  C:\Windows\System\JDcDfar.exe
  2⤵
  PID:9412
- C:\Windows\System\cEEZcnj.exe
  C:\Windows\System\cEEZcnj.exe
  2⤵
  PID:9444
- C:\Windows\System\ELRFMjs.exe
  C:\Windows\System\ELRFMjs.exe
  2⤵
  PID:9472
- C:\Windows\System\aJxuaUg.exe
  C:\Windows\System\aJxuaUg.exe
  2⤵
  PID:9500
- C:\Windows\System\tpfvQdM.exe
  C:\Windows\System\tpfvQdM.exe
  2⤵
  PID:9536
- C:\Windows\System\VyRwgAt.exe
  C:\Windows\System\VyRwgAt.exe
  2⤵
  PID:9560
- C:\Windows\System\lxcXjTr.exe
  C:\Windows\System\lxcXjTr.exe
  2⤵
  PID:9584
- C:\Windows\System\NKlxIHA.exe
  C:\Windows\System\NKlxIHA.exe
  2⤵
  PID:9608
- C:\Windows\System\iWXdWOp.exe
  C:\Windows\System\iWXdWOp.exe
  2⤵
  PID:9640
- C:\Windows\System\eGausPf.exe
  C:\Windows\System\eGausPf.exe
  2⤵
  PID:9664
- C:\Windows\System\FMWdINs.exe
  C:\Windows\System\FMWdINs.exe
  2⤵
  PID:9700
- C:\Windows\System\PGxCEFy.exe
  C:\Windows\System\PGxCEFy.exe
  2⤵
  PID:9732
- C:\Windows\System\rsvLtOr.exe
  C:\Windows\System\rsvLtOr.exe
  2⤵
  PID:9764
- C:\Windows\System\HRYGHGf.exe
  C:\Windows\System\HRYGHGf.exe
  2⤵
  PID:9788
- C:\Windows\System\QztdSUg.exe
  C:\Windows\System\QztdSUg.exe
  2⤵
  PID:9816
- C:\Windows\System\kXoVqgy.exe
  C:\Windows\System\kXoVqgy.exe
  2⤵
  PID:9836
- C:\Windows\System\jbcRpLu.exe
  C:\Windows\System\jbcRpLu.exe
  2⤵
  PID:9872
- C:\Windows\System\bXmuGCE.exe
  C:\Windows\System\bXmuGCE.exe
  2⤵
  PID:9908
- C:\Windows\System\zDuMIvR.exe
  C:\Windows\System\zDuMIvR.exe
  2⤵
  PID:9940
- C:\Windows\System\fgCvvvM.exe
  C:\Windows\System\fgCvvvM.exe
  2⤵
  PID:9964
- C:\Windows\System\HmoRVQm.exe
  C:\Windows\System\HmoRVQm.exe
  2⤵
  PID:9992
- C:\Windows\System\KIgevjW.exe
  C:\Windows\System\KIgevjW.exe
  2⤵
  PID:10012
- C:\Windows\System\lBPaeUq.exe
  C:\Windows\System\lBPaeUq.exe
  2⤵
  PID:10036
- C:\Windows\System\UnoBgVn.exe
  C:\Windows\System\UnoBgVn.exe
  2⤵
  PID:10068
- C:\Windows\System\PpYDnCO.exe
  C:\Windows\System\PpYDnCO.exe
  2⤵
  PID:10092
- C:\Windows\System\SyjqODO.exe
  C:\Windows\System\SyjqODO.exe
  2⤵
  PID:10120
- C:\Windows\System\XkZmxCk.exe
  C:\Windows\System\XkZmxCk.exe
  2⤵
  PID:10140
- C:\Windows\System\vuutZAX.exe
  C:\Windows\System\vuutZAX.exe
  2⤵
  PID:10172
- C:\Windows\System\zqzHkrk.exe
  C:\Windows\System\zqzHkrk.exe
  2⤵
  PID:10200
- C:\Windows\System\BAvwFgX.exe
  C:\Windows\System\BAvwFgX.exe
  2⤵
  PID:10236
- C:\Windows\System\FtEzkHe.exe
  C:\Windows\System\FtEzkHe.exe
  2⤵
  PID:8828
- C:\Windows\System\wFyoaFM.exe
  C:\Windows\System\wFyoaFM.exe
  2⤵
  PID:9304
- C:\Windows\System\RRYraTs.exe
  C:\Windows\System\RRYraTs.exe
  2⤵
  PID:9352
- C:\Windows\System\hUUePKR.exe
  C:\Windows\System\hUUePKR.exe
  2⤵
  PID:9368
- C:\Windows\System\zEbLUux.exe
  C:\Windows\System\zEbLUux.exe
  2⤵
  PID:9528
- C:\Windows\System\QjmkaKD.exe
  C:\Windows\System\QjmkaKD.exe
  2⤵
  PID:9468
- C:\Windows\System\VICeyIF.exe
  C:\Windows\System\VICeyIF.exe
  2⤵
  PID:7620
- C:\Windows\System\VEXqplk.exe
  C:\Windows\System\VEXqplk.exe
  2⤵
  PID:9696
- C:\Windows\System\mwLSZFK.exe
  C:\Windows\System\mwLSZFK.exe
  2⤵
  PID:9724
- C:\Windows\System\WeEeqIQ.exe
  C:\Windows\System\WeEeqIQ.exe
  2⤵
  PID:9804
- C:\Windows\System\DblHqyD.exe
  C:\Windows\System\DblHqyD.exe
  2⤵
  PID:9864
- C:\Windows\System\KyEaRJB.exe
  C:\Windows\System\KyEaRJB.exe
  2⤵
  PID:9900
- C:\Windows\System\WKIGfSX.exe
  C:\Windows\System\WKIGfSX.exe
  2⤵
  PID:10008
- C:\Windows\System\hPaSICP.exe
  C:\Windows\System\hPaSICP.exe
  2⤵
  PID:10032
- C:\Windows\System\udFRWlU.exe
  C:\Windows\System\udFRWlU.exe
  2⤵
  PID:10192
- C:\Windows\System\kzlvhIJ.exe
  C:\Windows\System\kzlvhIJ.exe
  2⤵
  PID:10196
- C:\Windows\System\ZdtPOIn.exe
  C:\Windows\System\ZdtPOIn.exe
  2⤵
  PID:10220
- C:\Windows\System\wxoyZAn.exe
  C:\Windows\System\wxoyZAn.exe
  2⤵
  PID:9308
- C:\Windows\System\obrRGyS.exe
  C:\Windows\System\obrRGyS.exe
  2⤵
  PID:9572
- C:\Windows\System\WSXWYEw.exe
  C:\Windows\System\WSXWYEw.exe
  2⤵
  PID:9624
- C:\Windows\System\NeqHYUX.exe
  C:\Windows\System\NeqHYUX.exe
  2⤵
  PID:9580
- C:\Windows\System\SGYIUCZ.exe
  C:\Windows\System\SGYIUCZ.exe
  2⤵
  PID:10164
- C:\Windows\System\cjihEoP.exe
  C:\Windows\System\cjihEoP.exe
  2⤵
  PID:10112
- C:\Windows\System\cSAHzEO.exe
  C:\Windows\System\cSAHzEO.exe
  2⤵
  PID:9268
- C:\Windows\System\jlQiZUx.exe
  C:\Windows\System\jlQiZUx.exe
  2⤵
  PID:9660
- C:\Windows\System\tiAoqwf.exe
  C:\Windows\System\tiAoqwf.exe
  2⤵
  PID:9984
- C:\Windows\System\iwAhevT.exe
  C:\Windows\System\iwAhevT.exe
  2⤵
  PID:10248
- C:\Windows\System\FpGsayc.exe
  C:\Windows\System\FpGsayc.exe
  2⤵
  PID:10268
- C:\Windows\System\UkeJvcI.exe
  C:\Windows\System\UkeJvcI.exe
  2⤵
  PID:10292
- C:\Windows\System\hGjkePX.exe
  C:\Windows\System\hGjkePX.exe
  2⤵
  PID:10316
- C:\Windows\System\RKSfSQu.exe
  C:\Windows\System\RKSfSQu.exe
  2⤵
  PID:10340
- C:\Windows\System\jQQbUTc.exe
  C:\Windows\System\jQQbUTc.exe
  2⤵
  PID:10368
- C:\Windows\System\KJJiYQx.exe
  C:\Windows\System\KJJiYQx.exe
  2⤵
  PID:10388
- C:\Windows\System\qRtfjrq.exe
  C:\Windows\System\qRtfjrq.exe
  2⤵
  PID:10412
- C:\Windows\System\OHCpyzR.exe
  C:\Windows\System\OHCpyzR.exe
  2⤵
  PID:10444
- C:\Windows\System\fAmOdVN.exe
  C:\Windows\System\fAmOdVN.exe
  2⤵
  PID:10476
- C:\Windows\System\NfLgFTm.exe
  C:\Windows\System\NfLgFTm.exe
  2⤵
  PID:10496
- C:\Windows\System\buaqvnD.exe
  C:\Windows\System\buaqvnD.exe
  2⤵
  PID:10528
- C:\Windows\System\mKyGpoZ.exe
  C:\Windows\System\mKyGpoZ.exe
  2⤵
  PID:10548
- C:\Windows\System\mPrCJrk.exe
  C:\Windows\System\mPrCJrk.exe
  2⤵
  PID:10564
- C:\Windows\System\JTwJaHj.exe
  C:\Windows\System\JTwJaHj.exe
  2⤵
  PID:10596
- C:\Windows\System\SXpykQg.exe
  C:\Windows\System\SXpykQg.exe
  2⤵
  PID:10628
- C:\Windows\System\vHGbVzj.exe
  C:\Windows\System\vHGbVzj.exe
  2⤵
  PID:10660
- C:\Windows\System\CYdiRTX.exe
  C:\Windows\System\CYdiRTX.exe
  2⤵
  PID:10688
- C:\Windows\System\XNShrqO.exe
  C:\Windows\System\XNShrqO.exe
  2⤵
  PID:10708
- C:\Windows\System\jVnURTI.exe
  C:\Windows\System\jVnURTI.exe
  2⤵
  PID:10728
- C:\Windows\System\zQRfQEB.exe
  C:\Windows\System\zQRfQEB.exe
  2⤵
  PID:10756
- C:\Windows\System\fhvWafC.exe
  C:\Windows\System\fhvWafC.exe
  2⤵
  PID:10776
- C:\Windows\System\aFNYLkm.exe
  C:\Windows\System\aFNYLkm.exe
  2⤵
  PID:10812
- C:\Windows\System\qAZXHgN.exe
  C:\Windows\System\qAZXHgN.exe
  2⤵
  PID:10836
- C:\Windows\System\XGsxMyj.exe
  C:\Windows\System\XGsxMyj.exe
  2⤵
  PID:10868
- C:\Windows\System\ulYaHMp.exe
  C:\Windows\System\ulYaHMp.exe
  2⤵
  PID:10892
- C:\Windows\System\kvLaxdK.exe
  C:\Windows\System\kvLaxdK.exe
  2⤵
  PID:10932
- C:\Windows\System\XgfmJeu.exe
  C:\Windows\System\XgfmJeu.exe
  2⤵
  PID:10968
- C:\Windows\System\bwmcljG.exe
  C:\Windows\System\bwmcljG.exe
  2⤵
  PID:11012
- C:\Windows\System\GNwiHhF.exe
  C:\Windows\System\GNwiHhF.exe
  2⤵
  PID:11040
- C:\Windows\System\NEZkNZk.exe
  C:\Windows\System\NEZkNZk.exe
  2⤵
  PID:11080
- C:\Windows\System\gxNxehV.exe
  C:\Windows\System\gxNxehV.exe
  2⤵
  PID:11116
- C:\Windows\System\yAUWxwF.exe
  C:\Windows\System\yAUWxwF.exe
  2⤵
  PID:11140
- C:\Windows\System\ugyUBXi.exe
  C:\Windows\System\ugyUBXi.exe
  2⤵
  PID:11168
- C:\Windows\System\GvBRcjD.exe
  C:\Windows\System\GvBRcjD.exe
  2⤵
  PID:11196
- C:\Windows\System\RkqYSQU.exe
  C:\Windows\System\RkqYSQU.exe
  2⤵
  PID:11228
- C:\Windows\System\tLqOCXo.exe
  C:\Windows\System\tLqOCXo.exe
  2⤵
  PID:11256
- C:\Windows\System\ZAqyBMS.exe
  C:\Windows\System\ZAqyBMS.exe
  2⤵
  PID:9896
- C:\Windows\System\vCMHWIh.exe
  C:\Windows\System\vCMHWIh.exe
  2⤵
  PID:10276
- C:\Windows\System\gBAjJLA.exe
  C:\Windows\System\gBAjJLA.exe
  2⤵
  PID:10336
- C:\Windows\System\OiEGvOt.exe
  C:\Windows\System\OiEGvOt.exe
  2⤵
  PID:10464
- C:\Windows\System\wZSYKeH.exe
  C:\Windows\System\wZSYKeH.exe
  2⤵
  PID:10560
- C:\Windows\System\OKBJANU.exe
  C:\Windows\System\OKBJANU.exe
  2⤵
  PID:10484
- C:\Windows\System\uGvPmNT.exe
  C:\Windows\System\uGvPmNT.exe
  2⤵
  PID:10680
- C:\Windows\System\HyQnUWC.exe
  C:\Windows\System\HyQnUWC.exe
  2⤵
  PID:10724
- C:\Windows\System\maIqaqX.exe
  C:\Windows\System\maIqaqX.exe
  2⤵
  PID:10644
- C:\Windows\System\nTOWmpq.exe
  C:\Windows\System\nTOWmpq.exe
  2⤵
  PID:10876
- C:\Windows\System\iKNHWFa.exe
  C:\Windows\System\iKNHWFa.exe
  2⤵
  PID:10764
- C:\Windows\System\KmhgofV.exe
  C:\Windows\System\KmhgofV.exe
  2⤵
  PID:11028
- C:\Windows\System\QcEaSxs.exe
  C:\Windows\System\QcEaSxs.exe
  2⤵
  PID:10924
- C:\Windows\System\YJCPmBd.exe
  C:\Windows\System\YJCPmBd.exe
  2⤵
  PID:10956
- C:\Windows\System\cWXdOOA.exe
  C:\Windows\System\cWXdOOA.exe
  2⤵
  PID:11184
- C:\Windows\System\EZQUmjk.exe
  C:\Windows\System\EZQUmjk.exe
  2⤵
  PID:11240
- C:\Windows\System\GJESztp.exe
  C:\Windows\System\GJESztp.exe
  2⤵
  PID:10264
- C:\Windows\System\CGXifMx.exe
  C:\Windows\System\CGXifMx.exe
  2⤵
  PID:10308
- C:\Windows\System\vHQGQSW.exe
  C:\Windows\System\vHQGQSW.exe
  2⤵
  PID:10584
- C:\Windows\System\gDRtVaZ.exe
  C:\Windows\System\gDRtVaZ.exe
  2⤵
  PID:10672
- C:\Windows\System\JeUMbdW.exe
  C:\Windows\System\JeUMbdW.exe
  2⤵
  PID:10916
- C:\Windows\System\oNfPsKW.exe
  C:\Windows\System\oNfPsKW.exe
  2⤵
  PID:11000
- C:\Windows\System\kWMGNMt.exe
  C:\Windows\System\kWMGNMt.exe
  2⤵
  PID:11136
- C:\Windows\System\JrzWuuH.exe
  C:\Windows\System\JrzWuuH.exe
  2⤵
  PID:10656
- C:\Windows\System\ogHzbjT.exe
  C:\Windows\System\ogHzbjT.exe
  2⤵
  PID:11204
- C:\Windows\System\MDiGqEA.exe
  C:\Windows\System\MDiGqEA.exe
  2⤵
  PID:11132
- C:\Windows\System\swTsBdH.exe
  C:\Windows\System\swTsBdH.exe
  2⤵
  PID:10792
- C:\Windows\System\WKEKilP.exe
  C:\Windows\System\WKEKilP.exe
  2⤵
  PID:10284
- C:\Windows\System\MGuJVff.exe
  C:\Windows\System\MGuJVff.exe
  2⤵
  PID:11288
- C:\Windows\System\awRuUiL.exe
  C:\Windows\System\awRuUiL.exe
  2⤵
  PID:11312
- C:\Windows\System\rQWlvUf.exe
  C:\Windows\System\rQWlvUf.exe
  2⤵
  PID:11348
- C:\Windows\System\uTnWglI.exe
  C:\Windows\System\uTnWglI.exe
  2⤵
  PID:11380
- C:\Windows\System\dyjojGk.exe
  C:\Windows\System\dyjojGk.exe
  2⤵
  PID:11412
- C:\Windows\System\fJDWuui.exe
  C:\Windows\System\fJDWuui.exe
  2⤵
  PID:11432
- C:\Windows\System\fvCxMUC.exe
  C:\Windows\System\fvCxMUC.exe
  2⤵
  PID:11456
- C:\Windows\System\vYppjsd.exe
  C:\Windows\System\vYppjsd.exe
  2⤵
  PID:11472
- C:\Windows\System\ILgyVPw.exe
  C:\Windows\System\ILgyVPw.exe
  2⤵
  PID:11504
- C:\Windows\System\SVFUcuS.exe
  C:\Windows\System\SVFUcuS.exe
  2⤵
  PID:11548
- C:\Windows\System\yDksSHI.exe
  C:\Windows\System\yDksSHI.exe
  2⤵
  PID:11572
- C:\Windows\System\cmrZoEK.exe
  C:\Windows\System\cmrZoEK.exe
  2⤵
  PID:11600
- C:\Windows\System\fGiqTCn.exe
  C:\Windows\System\fGiqTCn.exe
  2⤵
  PID:11632
- C:\Windows\System\LAJTelT.exe
  C:\Windows\System\LAJTelT.exe
  2⤵
  PID:11660
- C:\Windows\System\xzIPHWU.exe
  C:\Windows\System\xzIPHWU.exe
  2⤵
  PID:11696
- C:\Windows\System\nZeXCoW.exe
  C:\Windows\System\nZeXCoW.exe
  2⤵
  PID:11716
- C:\Windows\System\OGyGvnc.exe
  C:\Windows\System\OGyGvnc.exe
  2⤵
  PID:11732
- C:\Windows\System\okiPWWv.exe
  C:\Windows\System\okiPWWv.exe
  2⤵
  PID:11760
- C:\Windows\System\OQyQrDk.exe
  C:\Windows\System\OQyQrDk.exe
  2⤵
  PID:11784
- C:\Windows\System\tIBuXKv.exe
  C:\Windows\System\tIBuXKv.exe
  2⤵
  PID:11812
- C:\Windows\System\jmLYosP.exe
  C:\Windows\System\jmLYosP.exe
  2⤵
  PID:11840
- C:\Windows\System\iGUTAoq.exe
  C:\Windows\System\iGUTAoq.exe
  2⤵
  PID:11880
- C:\Windows\System\HflRURo.exe
  C:\Windows\System\HflRURo.exe
  2⤵
  PID:11896
- C:\Windows\System\XzIjpwy.exe
  C:\Windows\System\XzIjpwy.exe
  2⤵
  PID:11932
- C:\Windows\System\GakjcHj.exe
  C:\Windows\System\GakjcHj.exe
  2⤵
  PID:11956
- C:\Windows\System\UxUBJTG.exe
  C:\Windows\System\UxUBJTG.exe
  2⤵
  PID:11992
- C:\Windows\System\PiAPIQn.exe
  C:\Windows\System\PiAPIQn.exe
  2⤵
  PID:12020
- C:\Windows\System\tSewZQq.exe
  C:\Windows\System\tSewZQq.exe
  2⤵
  PID:12048
- C:\Windows\System\eXxgkhe.exe
  C:\Windows\System\eXxgkhe.exe
  2⤵
  PID:12104
- C:\Windows\System\PzemcXY.exe
  C:\Windows\System\PzemcXY.exe
  2⤵
  PID:12128
- C:\Windows\System\tySVFvX.exe
  C:\Windows\System\tySVFvX.exe
  2⤵
  PID:12148
- C:\Windows\System\wMhjBJS.exe
  C:\Windows\System\wMhjBJS.exe
  2⤵
  PID:12180
- C:\Windows\System\zoflnxE.exe
  C:\Windows\System\zoflnxE.exe
  2⤵
  PID:12204
- C:\Windows\System\UDBzFPI.exe
  C:\Windows\System\UDBzFPI.exe
  2⤵
  PID:12220
- C:\Windows\System\DnjywSn.exe
  C:\Windows\System\DnjywSn.exe
  2⤵
  PID:12248
- C:\Windows\System\hrssElE.exe
  C:\Windows\System\hrssElE.exe
  2⤵
  PID:12276
- C:\Windows\System\lOUCbsL.exe
  C:\Windows\System\lOUCbsL.exe
  2⤵
  PID:11280
- C:\Windows\System\DpOrAmM.exe
  C:\Windows\System\DpOrAmM.exe
  2⤵
  PID:11372
- C:\Windows\System\iEoTgGo.exe
  C:\Windows\System\iEoTgGo.exe
  2⤵
  PID:11440
- C:\Windows\System\LDADVAh.exe
  C:\Windows\System\LDADVAh.exe
  2⤵
  PID:11464
- C:\Windows\System\OabrcHW.exe
  C:\Windows\System\OabrcHW.exe
  2⤵
  PID:11484
- C:\Windows\System\dKjJyUC.exe
  C:\Windows\System\dKjJyUC.exe
  2⤵
  PID:11616
- C:\Windows\System\neSFoMG.exe
  C:\Windows\System\neSFoMG.exe
  2⤵
  PID:11656
- C:\Windows\System\OgdZWIb.exe
  C:\Windows\System\OgdZWIb.exe
  2⤵
  PID:11704
- C:\Windows\System\qlJLRnY.exe
  C:\Windows\System\qlJLRnY.exe
  2⤵
  PID:11864
- C:\Windows\System\WKzqYhi.exe
  C:\Windows\System\WKzqYhi.exe
  2⤵
  PID:11908
- C:\Windows\System\gqpopEU.exe
  C:\Windows\System\gqpopEU.exe
  2⤵
  PID:11892
- C:\Windows\System\cTRTMDW.exe
  C:\Windows\System\cTRTMDW.exe
  2⤵
  PID:11972
- C:\Windows\System\MRDmLur.exe
  C:\Windows\System\MRDmLur.exe
  2⤵
  PID:12084
- C:\Windows\System\lYpWPrx.exe
  C:\Windows\System\lYpWPrx.exe
  2⤵
  PID:12116
- C:\Windows\System\vjUedsY.exe
  C:\Windows\System\vjUedsY.exe
  2⤵
  PID:12140
- C:\Windows\System\McVYcud.exe
  C:\Windows\System\McVYcud.exe
  2⤵
  PID:12216
- C:\Windows\System\ThIboQI.exe
  C:\Windows\System\ThIboQI.exe
  2⤵
  PID:12268
- C:\Windows\System\IrrBEZa.exe
  C:\Windows\System\IrrBEZa.exe
  2⤵
  PID:11340
- C:\Windows\System\MAHuXSZ.exe
  C:\Windows\System\MAHuXSZ.exe
  2⤵
  PID:11512
- C:\Windows\System\nMQkTCo.exe
  C:\Windows\System\nMQkTCo.exe
  2⤵
  PID:11568
- C:\Windows\System\WsHDBGQ.exe
  C:\Windows\System\WsHDBGQ.exe
  2⤵
  PID:11800
- C:\Windows\System\KxROKYX.exe
  C:\Windows\System\KxROKYX.exe
  2⤵
  PID:12056
- C:\Windows\System\xCKSneX.exe
  C:\Windows\System\xCKSneX.exe
  2⤵
  PID:12064
- C:\Windows\System\UCKovdQ.exe
  C:\Windows\System\UCKovdQ.exe
  2⤵
  PID:12212
- C:\Windows\System\EuOKCJU.exe
  C:\Windows\System\EuOKCJU.exe
  2⤵
  PID:11492
- C:\Windows\System\aPFzvww.exe
  C:\Windows\System\aPFzvww.exe
  2⤵
  PID:12176
- C:\Windows\System\swZwPTs.exe
  C:\Windows\System\swZwPTs.exe
  2⤵
  PID:10332
- C:\Windows\System\DQaqkKi.exe
  C:\Windows\System\DQaqkKi.exe
  2⤵
  PID:12292
- C:\Windows\System\smgTTNO.exe
  C:\Windows\System\smgTTNO.exe
  2⤵
  PID:12324
- C:\Windows\System\wxMIaEv.exe
  C:\Windows\System\wxMIaEv.exe
  2⤵
  PID:12344
- C:\Windows\System\AIVfuUR.exe
  C:\Windows\System\AIVfuUR.exe
  2⤵
  PID:12376
- C:\Windows\System\tuaJezm.exe
  C:\Windows\System\tuaJezm.exe
  2⤵
  PID:12404
- C:\Windows\System\OuOwQBz.exe
  C:\Windows\System\OuOwQBz.exe
  2⤵
  PID:12440
- C:\Windows\System\NZLigIY.exe
  C:\Windows\System\NZLigIY.exe
  2⤵
  PID:12460
- C:\Windows\System\RwarZSj.exe
  C:\Windows\System\RwarZSj.exe
  2⤵
  PID:12484
- C:\Windows\System\zeITyLc.exe
  C:\Windows\System\zeITyLc.exe
  2⤵
  PID:12516
- C:\Windows\System\qhcLyHj.exe
  C:\Windows\System\qhcLyHj.exe
  2⤵
  PID:12552
- C:\Windows\System\zLgoEQJ.exe
  C:\Windows\System\zLgoEQJ.exe
  2⤵
  PID:12580
- C:\Windows\System\NOrRfRs.exe
  C:\Windows\System\NOrRfRs.exe
  2⤵
  PID:12616
- C:\Windows\System\sdLNodB.exe
  C:\Windows\System\sdLNodB.exe
  2⤵
  PID:12636
- C:\Windows\System\zihMKAk.exe
  C:\Windows\System\zihMKAk.exe
  2⤵
  PID:12664
- C:\Windows\System\npqlgIk.exe
  C:\Windows\System\npqlgIk.exe
  2⤵
  PID:12688
- C:\Windows\System\WKZweCk.exe
  C:\Windows\System\WKZweCk.exe
  2⤵
  PID:12720
- C:\Windows\System\LYaxZsN.exe
  C:\Windows\System\LYaxZsN.exe
  2⤵
  PID:12756
- C:\Windows\System\VHKPkVG.exe
  C:\Windows\System\VHKPkVG.exe
  2⤵
  PID:12784
- C:\Windows\System\xtbTcWD.exe
  C:\Windows\System\xtbTcWD.exe
  2⤵
  PID:12812
- C:\Windows\System\QqtCcvH.exe
  C:\Windows\System\QqtCcvH.exe
  2⤵
  PID:12832
- C:\Windows\System\AGnSeWG.exe
  C:\Windows\System\AGnSeWG.exe
  2⤵
  PID:12848
- C:\Windows\System\msznXjz.exe
  C:\Windows\System\msznXjz.exe
  2⤵
  PID:12868
- C:\Windows\System\TCpmMaa.exe
  C:\Windows\System\TCpmMaa.exe
  2⤵
  PID:12892
- C:\Windows\System\sevGpLA.exe
  C:\Windows\System\sevGpLA.exe
  2⤵
  PID:12912
- C:\Windows\System\ugOqHxb.exe
  C:\Windows\System\ugOqHxb.exe
  2⤵
  PID:12948
- C:\Windows\System\fyyUYzy.exe
  C:\Windows\System\fyyUYzy.exe
  2⤵
  PID:12968
- C:\Windows\System\pfGCFMJ.exe
  C:\Windows\System\pfGCFMJ.exe
  2⤵
  PID:12992
- C:\Windows\System\uJiOlRi.exe
  C:\Windows\System\uJiOlRi.exe
  2⤵
  PID:13016
- C:\Windows\System\RLJvJZT.exe
  C:\Windows\System\RLJvJZT.exe
  2⤵
  PID:13036
- C:\Windows\System\hODPDpR.exe
  C:\Windows\System\hODPDpR.exe
  2⤵
  PID:13060
- C:\Windows\System\OKVgXvI.exe
  C:\Windows\System\OKVgXvI.exe
  2⤵
  PID:13084
- C:\Windows\System\wyYVTaV.exe
  C:\Windows\System\wyYVTaV.exe
  2⤵
  PID:13112
- C:\Windows\System\OOKBuSv.exe
  C:\Windows\System\OOKBuSv.exe
  2⤵
  PID:13136
- C:\Windows\System\CQXPJMe.exe
  C:\Windows\System\CQXPJMe.exe
  2⤵
  PID:13164
- C:\Windows\System\qEvKcGc.exe
  C:\Windows\System\qEvKcGc.exe
  2⤵
  PID:13196
- C:\Windows\System\gbFpfcF.exe
  C:\Windows\System\gbFpfcF.exe
  2⤵
  PID:13220
- C:\Windows\System\SeQjCoy.exe
  C:\Windows\System\SeQjCoy.exe
  2⤵
  PID:13252
- C:\Windows\System\csMpSST.exe
  C:\Windows\System\csMpSST.exe
  2⤵
  PID:13280
- C:\Windows\System\tYHPSlB.exe
  C:\Windows\System\tYHPSlB.exe
  2⤵
  PID:11752
- C:\Windows\System\NTDPnnt.exe
  C:\Windows\System\NTDPnnt.exe
  2⤵
  PID:12256
- C:\Windows\System\DqSugtX.exe
  C:\Windows\System\DqSugtX.exe
  2⤵
  PID:12392
- C:\Windows\System\klequyG.exe
  C:\Windows\System\klequyG.exe
  2⤵
  PID:12416
- C:\Windows\System\bvmfNFC.exe
  C:\Windows\System\bvmfNFC.exe
  2⤵
  PID:12476
- C:\Windows\System\sXMFzyj.exe
  C:\Windows\System\sXMFzyj.exe
  2⤵
  PID:12536
- C:\Windows\System\HhMKTcG.exe
  C:\Windows\System\HhMKTcG.exe
  2⤵
  PID:12560
- C:\Windows\System\OZTyyiV.exe
  C:\Windows\System\OZTyyiV.exe
  2⤵
  PID:12704
- C:\Windows\System\TQrDQyT.exe
  C:\Windows\System\TQrDQyT.exe
  2⤵
  PID:12772
- C:\Windows\System\PYPlAwX.exe
  C:\Windows\System\PYPlAwX.exe
  2⤵
  PID:12824
- C:\Windows\System\SAeBpyy.exe
  C:\Windows\System\SAeBpyy.exe
  2⤵
  PID:12924
- C:\Windows\System\dKkTAEM.exe
  C:\Windows\System\dKkTAEM.exe
  2⤵
  PID:12932
- C:\Windows\System\ilVrZEs.exe
  C:\Windows\System\ilVrZEs.exe
  2⤵
  PID:13076
- C:\Windows\System\FMaxGhO.exe
  C:\Windows\System\FMaxGhO.exe
  2⤵
  PID:13160
- C:\Windows\System\CedEzOm.exe
  C:\Windows\System\CedEzOm.exe
  2⤵
  PID:13248
- C:\Windows\System\duIqpDF.exe
  C:\Windows\System\duIqpDF.exe
  2⤵
  PID:13276
- C:\Windows\System\UCmYFTl.exe
  C:\Windows\System\UCmYFTl.exe
  2⤵
  PID:12332
- C:\Windows\System\zJNeCbJ.exe
  C:\Windows\System\zJNeCbJ.exe
  2⤵
  PID:13300
- C:\Windows\System\nWEddtA.exe
  C:\Windows\System\nWEddtA.exe
  2⤵
  PID:12012
- C:\Windows\System\IKFWHhD.exe
  C:\Windows\System\IKFWHhD.exe
  2⤵
  PID:12604
- C:\Windows\System\oyXrGAX.exe
  C:\Windows\System\oyXrGAX.exe
  2⤵
  PID:12864
- C:\Windows\System\OzEofuo.exe
  C:\Windows\System\OzEofuo.exe
  2⤵
  PID:12628
- C:\Windows\System\gNIZRBd.exe
  C:\Windows\System\gNIZRBd.exe
  2⤵
  PID:12956
- C:\Windows\System\TGSLlPj.exe
  C:\Windows\System\TGSLlPj.exe
  2⤵
  PID:13272
- C:\Windows\System\GTwDkaU.exe
  C:\Windows\System\GTwDkaU.exe
  2⤵
  PID:12368
- C:\Windows\System\eDNpBap.exe
  C:\Windows\System\eDNpBap.exe
  2⤵
  PID:12676
- C:\Windows\System\ycLcYOk.exe
  C:\Windows\System\ycLcYOk.exe
  2⤵
  PID:13328
- C:\Windows\System\mdVYYRq.exe
  C:\Windows\System\mdVYYRq.exe
  2⤵
  PID:13352
- C:\Windows\System\qPjBdED.exe
  C:\Windows\System\qPjBdED.exe
  2⤵
  PID:13388
- C:\Windows\System\RBxAXkq.exe
  C:\Windows\System\RBxAXkq.exe
  2⤵
  PID:13420
- C:\Windows\System\RhvvvPe.exe
  C:\Windows\System\RhvvvPe.exe
  2⤵
  PID:13440
- C:\Windows\System\vHWBSjs.exe
  C:\Windows\System\vHWBSjs.exe
  2⤵
  PID:13464
- C:\Windows\System\evBCdkj.exe
  C:\Windows\System\evBCdkj.exe
  2⤵
  PID:13492
- C:\Windows\System\dwMVGVg.exe
  C:\Windows\System\dwMVGVg.exe
  2⤵
  PID:13512
- C:\Windows\System\nGXUimi.exe
  C:\Windows\System\nGXUimi.exe
  2⤵
  PID:13540
- C:\Windows\System\yvqkdwP.exe
  C:\Windows\System\yvqkdwP.exe
  2⤵
  PID:13556
- C:\Windows\System\TeDtaVj.exe
  C:\Windows\System\TeDtaVj.exe
  2⤵
  PID:13584
- C:\Windows\System\kCisRyL.exe
  C:\Windows\System\kCisRyL.exe
  2⤵
  PID:13616
- C:\Windows\System\WDCkHQb.exe
  C:\Windows\System\WDCkHQb.exe
  2⤵
  PID:13648
- C:\Windows\System\bLRJHJf.exe
  C:\Windows\System\bLRJHJf.exe
  2⤵
  PID:13684
- C:\Windows\System\tcpPfIl.exe
  C:\Windows\System\tcpPfIl.exe
  2⤵
  PID:13704
- C:\Windows\System\QwcuRyl.exe
  C:\Windows\System\QwcuRyl.exe
  2⤵
  PID:13728
- C:\Windows\System\XsPZJSG.exe
  C:\Windows\System\XsPZJSG.exe
  2⤵
  PID:13752
- C:\Windows\System\VfZvULw.exe
  C:\Windows\System\VfZvULw.exe
  2⤵
  PID:13784
- C:\Windows\System\mipRDgZ.exe
  C:\Windows\System\mipRDgZ.exe
  2⤵
  PID:13808
- C:\Windows\System\ysZmtel.exe
  C:\Windows\System\ysZmtel.exe
  2⤵
  PID:13836
- C:\Windows\System\oXFxEqu.exe
  C:\Windows\System\oXFxEqu.exe
  2⤵
  PID:13864
- C:\Windows\System\yjkBDuS.exe
  C:\Windows\System\yjkBDuS.exe
  2⤵
  PID:13892
- C:\Windows\System\GhJxJhP.exe
  C:\Windows\System\GhJxJhP.exe
  2⤵
  PID:13912
- C:\Windows\System\MAQIFCp.exe
  C:\Windows\System\MAQIFCp.exe
  2⤵
  PID:13928
- C:\Windows\System\hyzUiar.exe
  C:\Windows\System\hyzUiar.exe
  2⤵
  PID:13948
- C:\Windows\System\yFsNoUJ.exe
  C:\Windows\System\yFsNoUJ.exe
  2⤵
  PID:13972
- C:\Windows\System\RThykwy.exe
  C:\Windows\System\RThykwy.exe
  2⤵
  PID:13992
- C:\Windows\System\ZVwTslB.exe
  C:\Windows\System\ZVwTslB.exe
  2⤵
  PID:14008
- C:\Windows\System\OvqnfMp.exe
  C:\Windows\System\OvqnfMp.exe
  2⤵
  PID:14032
- C:\Windows\System\MCBlsLM.exe
  C:\Windows\System\MCBlsLM.exe
  2⤵
  PID:14064
- C:\Windows\System\jnunazE.exe
  C:\Windows\System\jnunazE.exe
  2⤵
  PID:14092
- C:\Windows\System\xJKyYdp.exe
  C:\Windows\System\xJKyYdp.exe
  2⤵
  PID:14112
- C:\Windows\System\MoBWgdZ.exe
  C:\Windows\System\MoBWgdZ.exe
  2⤵
  PID:14132
- C:\Windows\System\jKpoGkI.exe
  C:\Windows\System\jKpoGkI.exe
  2⤵
  PID:14172
- C:\Windows\System\APJAtIf.exe
  C:\Windows\System\APJAtIf.exe
  2⤵
  PID:14200
- C:\Windows\System\ptLHAoh.exe
  C:\Windows\System\ptLHAoh.exe
  2⤵
  PID:14224
- C:\Windows\System\hMHeTMX.exe
  C:\Windows\System\hMHeTMX.exe
  2⤵
  PID:14260
- C:\Windows\System\zIUVvDF.exe
  C:\Windows\System\zIUVvDF.exe
  2⤵
  PID:14292
- C:\Windows\System\wqjzDFG.exe
  C:\Windows\System\wqjzDFG.exe
  2⤵
  PID:14320
- C:\Windows\System\ONErhcT.exe
  C:\Windows\System\ONErhcT.exe
  2⤵
  PID:13324
- C:\Windows\System\DeUchNo.exe
  C:\Windows\System\DeUchNo.exe
  2⤵
  PID:13436
- C:\Windows\System\tEQJQpS.exe
  C:\Windows\System\tEQJQpS.exe
  2⤵
  PID:13380
- C:\Windows\System\NBCAqat.exe
  C:\Windows\System\NBCAqat.exe
  2⤵
  PID:13488
- C:\Windows\System\lZIqNWz.exe
  C:\Windows\System\lZIqNWz.exe
  2⤵
  PID:13604
- C:\Windows\System\GtygQVp.exe
  C:\Windows\System\GtygQVp.exe
  2⤵
  PID:13500
- C:\Windows\System\CSZswJo.exe
  C:\Windows\System\CSZswJo.exe
  2⤵
  PID:13716
- C:\Windows\System\pdlvQNx.exe
  C:\Windows\System\pdlvQNx.exe
  2⤵
  PID:13632
- C:\Windows\System\YikOaxb.exe
  C:\Windows\System\YikOaxb.exe
  2⤵
  PID:13768
- C:\Windows\System\HvLsMAV.exe
  C:\Windows\System\HvLsMAV.exe
  2⤵
  PID:13904
- C:\Windows\System\YFQgAXM.exe
  C:\Windows\System\YFQgAXM.exe
  2⤵
  PID:14004
- C:\Windows\System\aLlyZQx.exe
  C:\Windows\System\aLlyZQx.exe
  2⤵
  PID:14084
- C:\Windows\System\ffoqJuv.exe
  C:\Windows\System\ffoqJuv.exe
  2⤵
  PID:14144
- C:\Windows\System\GfDrRfw.exe
  C:\Windows\System\GfDrRfw.exe
  2⤵
  PID:14168
- C:\Windows\System\lLCfxGB.exe
  C:\Windows\System\lLCfxGB.exe
  2⤵
  PID:14212
- C:\Windows\System\yZnzlLU.exe
  C:\Windows\System\yZnzlLU.exe
  2⤵
  PID:13004
- C:\Windows\System\TsVaoBK.exe
  C:\Windows\System\TsVaoBK.exe
  2⤵
  PID:14240
- C:\Windows\System\dZQcynA.exe
  C:\Windows\System\dZQcynA.exe
  2⤵
  PID:13576
- C:\Windows\System\YuOhNwX.exe
  C:\Windows\System\YuOhNwX.exe
  2⤵
  PID:13692
- C:\Windows\System\aYWdPwC.exe
  C:\Windows\System\aYWdPwC.exe
  2⤵
  PID:13212
- C:\Windows\System\fKvAluM.exe
  C:\Windows\System\fKvAluM.exe
  2⤵
  PID:13600
- C:\Windows\System\ayRLxCr.exe
  C:\Windows\System\ayRLxCr.exe
  2⤵
  PID:14156
- C:\Windows\System\BGryfXc.exe
  C:\Windows\System\BGryfXc.exe
  2⤵
  PID:14044
- C:\Windows\System\EiVHopl.exe
  C:\Windows\System\EiVHopl.exe
  2⤵
  PID:14280
- C:\Windows\System\FijlGnG.exe
  C:\Windows\System\FijlGnG.exe
  2⤵
  PID:13876
- C:\Windows\System\itWIapQ.exe
  C:\Windows\System\itWIapQ.exe
  2⤵
  PID:14340
- C:\Windows\System\RThamJb.exe
  C:\Windows\System\RThamJb.exe
  2⤵
  PID:14368
- C:\Windows\System\wuDgGkh.exe
  C:\Windows\System\wuDgGkh.exe
  2⤵
  PID:14408
- C:\Windows\System\CTibNmi.exe
  C:\Windows\System\CTibNmi.exe
  2⤵
  PID:14444
- C:\Windows\System\znfyALO.exe
  C:\Windows\System\znfyALO.exe
  2⤵
  PID:14476
- C:\Windows\System\ctqlaYz.exe
  C:\Windows\System\ctqlaYz.exe
  2⤵
  PID:14496
- C:\Windows\System\wQiyuxa.exe
  C:\Windows\System\wQiyuxa.exe
  2⤵
  PID:14520
- C:\Windows\System\jYBfOle.exe
  C:\Windows\System\jYBfOle.exe
  2⤵
  PID:14540
- C:\Windows\System\XOsGoMq.exe
  C:\Windows\System\XOsGoMq.exe
  2⤵
  PID:14564
- C:\Windows\System\HHnlJKU.exe
  C:\Windows\System\HHnlJKU.exe
  2⤵
  PID:14588
- C:\Windows\System\qvDoulH.exe
  C:\Windows\System\qvDoulH.exe
  2⤵
  PID:14624
- C:\Windows\System\TqKpJjY.exe
  C:\Windows\System\TqKpJjY.exe
  2⤵
  PID:14652
- C:\Windows\System\FNvYGbH.exe
  C:\Windows\System\FNvYGbH.exe
  2⤵
  PID:14692
- C:\Windows\System\OkSXWhO.exe
  C:\Windows\System\OkSXWhO.exe
  2⤵
  PID:14716
- C:\Windows\System\rjXWNdn.exe
  C:\Windows\System\rjXWNdn.exe
  2⤵
  PID:14752
- C:\Windows\System\rSvLXkr.exe
  C:\Windows\System\rSvLXkr.exe
  2⤵
  PID:14788
- C:\Windows\System\bZNUTMq.exe
  C:\Windows\System\bZNUTMq.exe
  2⤵
  PID:14808
- C:\Windows\System\PGKkxzj.exe
  C:\Windows\System\PGKkxzj.exe
  2⤵
  PID:14836
- C:\Windows\System\zQzFbOK.exe
  C:\Windows\System\zQzFbOK.exe
  2⤵
  PID:14860
- C:\Windows\System\IbidhIF.exe
  C:\Windows\System\IbidhIF.exe
  2⤵
  PID:14880
- C:\Windows\System\ToVpaIC.exe
  C:\Windows\System\ToVpaIC.exe
  2⤵
  PID:14912
- C:\Windows\System\oHlRyPn.exe
  C:\Windows\System\oHlRyPn.exe
  2⤵
  PID:14944
- C:\Windows\System\CrwEcxs.exe
  C:\Windows\System\CrwEcxs.exe
  2⤵
  PID:14972
- C:\Windows\System\tFDzdvO.exe
  C:\Windows\System\tFDzdvO.exe
  2⤵
  PID:15004
- C:\Windows\System\kWeUAFW.exe
  C:\Windows\System\kWeUAFW.exe
  2⤵
  PID:15044
- C:\Windows\System\LDfGjGJ.exe
  C:\Windows\System\LDfGjGJ.exe
  2⤵
  PID:15068
- C:\Windows\System\kgQEMrO.exe
  C:\Windows\System\kgQEMrO.exe
  2⤵
  PID:15092
- C:\Windows\System\jeDDMYJ.exe
  C:\Windows\System\jeDDMYJ.exe
  2⤵
  PID:15112
- C:\Windows\System\FiymSTE.exe
  C:\Windows\System\FiymSTE.exe
  2⤵
  PID:15140
- C:\Windows\System\CPkNGlx.exe
  C:\Windows\System\CPkNGlx.exe
  2⤵
  PID:15160
- C:\Windows\System\ZLvtcEJ.exe
  C:\Windows\System\ZLvtcEJ.exe
  2⤵
  PID:15204
- C:\Windows\System\LbqiiSx.exe
  C:\Windows\System\LbqiiSx.exe
  2⤵
  PID:15224
- C:\Windows\System\pcbhEMn.exe
  C:\Windows\System\pcbhEMn.exe
  2⤵
  PID:15240
- C:\Windows\System\tYGKTdr.exe
  C:\Windows\System\tYGKTdr.exe
  2⤵
  PID:15260
- C:\Windows\System\ZDvszxd.exe
  C:\Windows\System\ZDvszxd.exe
  2⤵
  PID:15284
- C:\Windows\System\OzqLTMw.exe
  C:\Windows\System\OzqLTMw.exe
  2⤵
  PID:15312
- C:\Windows\System\ulgZEVi.exe
  C:\Windows\System\ulgZEVi.exe
  2⤵
  PID:15332
- C:\Windows\System\aoQcmoi.exe
  C:\Windows\System\aoQcmoi.exe
  2⤵
  PID:15356
- C:\Windows\System\NDaXgbz.exe
  C:\Windows\System\NDaXgbz.exe
  2⤵
  PID:14272
- C:\Windows\System\hlQLLLd.exe
  C:\Windows\System\hlQLLLd.exe
  2⤵
  PID:14356
- C:\Windows\System\TPrvUJI.exe
  C:\Windows\System\TPrvUJI.exe
  2⤵
  PID:14380
- C:\Windows\System\PuAwNOr.exe
  C:\Windows\System\PuAwNOr.exe
  2⤵
  PID:14492
- C:\Windows\System\GYjaRSb.exe
  C:\Windows\System\GYjaRSb.exe
  2⤵
  PID:14640
- C:\Windows\System\yJIufey.exe
  C:\Windows\System\yJIufey.exe
  2⤵
  PID:14672
- C:\Windows\System\qAPJAns.exe
  C:\Windows\System\qAPJAns.exe
  2⤵
  PID:14600
- C:\Windows\System\tpIXbqF.exe
  C:\Windows\System\tpIXbqF.exe
  2⤵
  PID:14708
- C:\Windows\System\BxiMABz.exe
  C:\Windows\System\BxiMABz.exe
  2⤵
  PID:14868
- C:\Windows\System\yvAQoPL.exe
  C:\Windows\System\yvAQoPL.exe
  2⤵
  PID:14872
- C:\Windows\System\xTRCpii.exe
  C:\Windows\System\xTRCpii.exe
  2⤵
  PID:14964
- C:\Windows\System\RoTpNgd.exe
  C:\Windows\System\RoTpNgd.exe
  2⤵
  PID:15080
- C:\Windows\System\fKdvSPS.exe
  C:\Windows\System\fKdvSPS.exe
  2⤵
  PID:15148
- C:\Windows\System\xDDiRBb.exe
  C:\Windows\System\xDDiRBb.exe
  2⤵
  PID:15232
- C:\Windows\System\XHBzXpj.exe
  C:\Windows\System\XHBzXpj.exe
  2⤵
  PID:15152
- C:\Windows\System\eCDyajk.exe
  C:\Windows\System\eCDyajk.exe
  2⤵
  PID:15344
- C:\Windows\System\FfXeAUf.exe
  C:\Windows\System\FfXeAUf.exe
  2⤵
  PID:15340
- C:\Windows\System\tXsmqIg.exe
  C:\Windows\System\tXsmqIg.exe
  2⤵
  PID:14456
- C:\Windows\System\UhxdwAC.exe
  C:\Windows\System\UhxdwAC.exe
  2⤵
  PID:14636
- C:\Windows\System\OixYGVb.exe
  C:\Windows\System\OixYGVb.exe
  2⤵
  PID:14484
- C:\Windows\System\PUWeKbr.exe
  C:\Windows\System\PUWeKbr.exe
  2⤵
  PID:14360
- C:\Windows\System\nWyvEZS.exe
  C:\Windows\System\nWyvEZS.exe
  2⤵
  PID:14776
- C:\Windows\System\WHYousi.exe
  C:\Windows\System\WHYousi.exe
  2⤵
  PID:14504
- C:\Windows\System\nsUDqCQ.exe
  C:\Windows\System\nsUDqCQ.exe
  2⤵
  PID:15252
- C:\Windows\System\bcgIwpe.exe
  C:\Windows\System\bcgIwpe.exe
  2⤵
  PID:15180
- C:\Windows\System\yAldrAY.exe
  C:\Windows\System\yAldrAY.exe
  2⤵
  PID:14848
- C:\Windows\System\RTtOZLb.exe
  C:\Windows\System\RTtOZLb.exe
  2⤵
  PID:14764
- C:\Windows\System\KFzMrLl.exe
  C:\Windows\System\KFzMrLl.exe
  2⤵
  PID:15384
- C:\Windows\System\dugdRPy.exe
  C:\Windows\System\dugdRPy.exe
  2⤵
  PID:15412
- C:\Windows\System\HKjEMTs.exe
  C:\Windows\System\HKjEMTs.exe
  2⤵
  PID:15436
- C:\Windows\System\TYalJpS.exe
  C:\Windows\System\TYalJpS.exe
  2⤵
  PID:15456
- C:\Windows\System\BArmXkS.exe
  C:\Windows\System\BArmXkS.exe
  2⤵
  PID:15484
- C:\Windows\System\jtSvbTG.exe
  C:\Windows\System\jtSvbTG.exe
  2⤵
  PID:15508
- C:\Windows\System\DqkZhms.exe
  C:\Windows\System\DqkZhms.exe
  2⤵
  PID:15536
- C:\Windows\System\SMtPwRJ.exe
  C:\Windows\System\SMtPwRJ.exe
  2⤵
  PID:15572
- C:\Windows\System\iHPaohJ.exe
  C:\Windows\System\iHPaohJ.exe
  2⤵
  PID:15592
- C:\Windows\System\ewotbxO.exe
  C:\Windows\System\ewotbxO.exe
  2⤵
  PID:15624
- C:\Windows\System\VYfbTGE.exe
  C:\Windows\System\VYfbTGE.exe
  2⤵
  PID:15652
- C:\Windows\System\mZbsskL.exe
  C:\Windows\System\mZbsskL.exe
  2⤵
  PID:15676
- C:\Windows\System\aQzQPUD.exe
  C:\Windows\System\aQzQPUD.exe
  2⤵
  PID:15712
- C:\Windows\System\ghHMDju.exe
  C:\Windows\System\ghHMDju.exe
  2⤵
  PID:15736
- C:\Windows\System\NmQdxrl.exe
  C:\Windows\System\NmQdxrl.exe
  2⤵
  PID:15768
- C:\Windows\System\KQbpPZw.exe
  C:\Windows\System\KQbpPZw.exe
  2⤵
  PID:15796
- C:\Windows\System\yoSFEgT.exe
  C:\Windows\System\yoSFEgT.exe
  2⤵
  PID:15824
- C:\Windows\System\Pkroeyp.exe
  C:\Windows\System\Pkroeyp.exe
  2⤵
  PID:15860
- C:\Windows\System\NvLVqpE.exe
  C:\Windows\System\NvLVqpE.exe
  2⤵
  PID:15900
- C:\Windows\System\frztzLH.exe
  C:\Windows\System\frztzLH.exe
  2⤵
  PID:15936
- C:\Windows\System\rpzweMb.exe
  C:\Windows\System\rpzweMb.exe
  2⤵
  PID:15956
- C:\Windows\System\gIlYYaa.exe
  C:\Windows\System\gIlYYaa.exe
  2⤵
  PID:15976
- C:\Windows\System\sdNppoj.exe
  C:\Windows\System\sdNppoj.exe
  2⤵
  PID:16008
- C:\Windows\System\yXFbXME.exe
  C:\Windows\System\yXFbXME.exe
  2⤵
  PID:16028
- C:\Windows\System\tUePShd.exe
  C:\Windows\System\tUePShd.exe
  2⤵
  PID:16048
- C:\Windows\System\DNcUiad.exe
  C:\Windows\System\DNcUiad.exe
  2⤵
  PID:16064
- C:\Windows\System\dlPonHl.exe
  C:\Windows\System\dlPonHl.exe
  2⤵
  PID:16088
- C:\Windows\System\pNkqIgH.exe
  C:\Windows\System\pNkqIgH.exe
  2⤵
  PID:16112
- C:\Windows\System\EJngGyw.exe
  C:\Windows\System\EJngGyw.exe
  2⤵
  PID:16140
- C:\Windows\System\BPuQFXz.exe
  C:\Windows\System\BPuQFXz.exe
  2⤵
  PID:16180
- C:\Windows\System\uskziwJ.exe
  C:\Windows\System\uskziwJ.exe
  2⤵
  PID:16216
- C:\Windows\System\ygPPyKb.exe
  C:\Windows\System\ygPPyKb.exe
  2⤵
  PID:16248
- C:\Windows\System\JhJMMLL.exe
  C:\Windows\System\JhJMMLL.exe
  2⤵
  PID:16264
- C:\Windows\System\efCaWeh.exe
  C:\Windows\System\efCaWeh.exe
  2⤵
  PID:16292
- C:\Windows\System\STlFcft.exe
  C:\Windows\System\STlFcft.exe
  2⤵
  PID:16328
- C:\Windows\System\YaZoMHw.exe
  C:\Windows\System\YaZoMHw.exe
  2⤵
  PID:16360
- C:\Windows\System\AOmwGHq.exe
  C:\Windows\System\AOmwGHq.exe
  2⤵
  PID:16376
- C:\Windows\System\PPPUYdR.exe
  C:\Windows\System\PPPUYdR.exe
  2⤵
  PID:14900
- C:\Windows\System\BFzwNPM.exe
  C:\Windows\System\BFzwNPM.exe
  2⤵
  PID:15432
- C:\Windows\System\ihmxkzC.exe
  C:\Windows\System\ihmxkzC.exe
  2⤵
  PID:15372
- C:\Windows\System\jQDjerR.exe
  C:\Windows\System\jQDjerR.exe
  2⤵
  PID:15524
- C:\Windows\System\EckmlhH.exe
  C:\Windows\System\EckmlhH.exe
  2⤵
  PID:15568
- C:\Windows\System\GtRwEmL.exe
  C:\Windows\System\GtRwEmL.exe
  2⤵
  PID:15472
- C:\Windows\System\beWHYOF.exe
  C:\Windows\System\beWHYOF.exe
  2⤵
  PID:15744
- C:\Windows\System\gRUNELl.exe
  C:\Windows\System\gRUNELl.exe
  2⤵
  PID:15664
- C:\Windows\System\ixekoaC.exe
  C:\Windows\System\ixekoaC.exe
  2⤵
  PID:15700
- C:\Windows\System\ODWBWCD.exe
  C:\Windows\System\ODWBWCD.exe
  2⤵
  PID:15788
- C:\Windows\System\mgkBrqu.exe
  C:\Windows\System\mgkBrqu.exe
  2⤵
  PID:15852
- C:\Windows\System\vCMZYZT.exe
  C:\Windows\System\vCMZYZT.exe
  2⤵
  PID:15920
- C:\Windows\System\qeLvxZM.exe
  C:\Windows\System\qeLvxZM.exe
  2⤵
  PID:16108
- C:\Windows\System\yADbzMF.exe
  C:\Windows\System\yADbzMF.exe
  2⤵
  PID:16036
- C:\Windows\System\eCYHcZG.exe
  C:\Windows\System\eCYHcZG.exe
  2⤵
  PID:16212
- C:\Windows\System\yKyHxfN.exe
  C:\Windows\System\yKyHxfN.exe
  2⤵
  PID:16176
- C:\Windows\System\KsqBgxE.exe
  C:\Windows\System\KsqBgxE.exe
  2⤵
  PID:16340
- C:\Windows\System\VwJTjky.exe
  C:\Windows\System\VwJTjky.exe
  2⤵
  PID:16368
- C:\Windows\System\OnecQwr.exe
  C:\Windows\System\OnecQwr.exe
  2⤵
  PID:16352
- C:\Windows\System\dRmvDvz.exe
  C:\Windows\System\dRmvDvz.exe
  2⤵
  PID:16320
- C:\Windows\System\sgmlTpf.exe
  C:\Windows\System\sgmlTpf.exe
  2⤵
  PID:15528
- C:\Windows\System\LjOztqL.exe
  C:\Windows\System\LjOztqL.exe
  2⤵
  PID:15564
- C:\Windows\System\XjqiWwu.exe
  C:\Windows\System\XjqiWwu.exe
  2⤵
  PID:16056
- C:\Windows\System\lrVzqFT.exe
  C:\Windows\System\lrVzqFT.exe
  2⤵
  PID:16020
- C:\Windows\System\oBvhXGI.exe
  C:\Windows\System\oBvhXGI.exe
  2⤵
  PID:16080
- C:\Windows\System\osdGozj.exe
  C:\Windows\System\osdGozj.exe
  2⤵
  PID:16404
- C:\Windows\System\MvBqlMs.exe
  C:\Windows\System\MvBqlMs.exe
  2⤵
  PID:16428
- C:\Windows\System\tRYKjSr.exe
  C:\Windows\System\tRYKjSr.exe
  2⤵
  PID:16460
- C:\Windows\System\KHGwORS.exe
  C:\Windows\System\KHGwORS.exe
  2⤵
  PID:16496
- C:\Windows\System\bWRbqAd.exe
  C:\Windows\System\bWRbqAd.exe
  2⤵
  PID:16520
- C:\Windows\System\UgsslIk.exe
  C:\Windows\System\UgsslIk.exe
  2⤵
  PID:16548
- C:\Windows\System\JdgeaXa.exe
  C:\Windows\System\JdgeaXa.exe
  2⤵
  PID:16572
- C:\Windows\System\pJEbXCe.exe
  C:\Windows\System\pJEbXCe.exe
  2⤵
  PID:16600
- C:\Windows\System\wIuDFVQ.exe
  C:\Windows\System\wIuDFVQ.exe
  2⤵
  PID:16624
- C:\Windows\System\ZCyetVH.exe
  C:\Windows\System\ZCyetVH.exe
  2⤵
  PID:16652
- C:\Windows\System\itpTvhb.exe
  C:\Windows\System\itpTvhb.exe
  2⤵
  PID:16680
- C:\Windows\System\gLRdiUb.exe
  C:\Windows\System\gLRdiUb.exe
  2⤵
  PID:16704
- C:\Windows\System\XUIxaNy.exe
  C:\Windows\System\XUIxaNy.exe
  2⤵
  PID:16728
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16728 -s 256
    3⤵
    PID:16748
- C:\Windows\System\pJdHKln.exe
  C:\Windows\System\pJdHKln.exe
  2⤵
  PID:16756
- C:\Windows\System\sghPNTi.exe
  C:\Windows\System\sghPNTi.exe
  2⤵
  PID:16776
- C:\Windows\System\atSbYHF.exe
  C:\Windows\System\atSbYHF.exe
  2⤵
  PID:16796
- C:\Windows\System\YKrmPOg.exe
  C:\Windows\System\YKrmPOg.exe
  2⤵
  PID:16828
- C:\Windows\System\IjKrodR.exe
  C:\Windows\System\IjKrodR.exe
  2⤵
  PID:16848
- C:\Windows\System\MtoaUWH.exe
  C:\Windows\System\MtoaUWH.exe
  2⤵
  PID:16884
- C:\Windows\System\KQyAOuz.exe
  C:\Windows\System\KQyAOuz.exe
  2⤵
  PID:16912
- C:\Windows\System\KtlMRCC.exe
  C:\Windows\System\KtlMRCC.exe
  2⤵
  PID:16940
- C:\Windows\System\kyAZVPw.exe
  C:\Windows\System\kyAZVPw.exe
  2⤵
  PID:16964
- C:\Windows\System\RbqkbMS.exe
  C:\Windows\System\RbqkbMS.exe
  2⤵
  PID:17004
- C:\Windows\System\sJZnrBJ.exe
  C:\Windows\System\sJZnrBJ.exe
  2⤵
  PID:17040
- C:\Windows\System\YUWvcLS.exe
  C:\Windows\System\YUWvcLS.exe
  2⤵
  PID:17068
- C:\Windows\System\wVVfvqc.exe
  C:\Windows\System\wVVfvqc.exe
  2⤵
  PID:17092
- C:\Windows\System\VFrIFeq.exe
  C:\Windows\System\VFrIFeq.exe
  2⤵
  PID:17120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BABBCre.exe

Filesize
1.5MB

MD5
df934e7f1b57e8838e21c7d76ac59ac8

SHA1
e5373226e39d76f1a89ac9d3a19580c08a1956b4

SHA256
027d4dad5cc56c652c8edbed7e9f3aced557b606fac85eff4ca2a1d1284cf61f

SHA512
854e3b7d2f47f61fe3c7bc30ab9af6f9836a91b78c79d6d0b67f1a974ca1d1adc134f5a42eafc283ea3fd89e6f32b36bc3e03e48cee19dd5daa37fc508201b90

Download Submit
C:\Windows\System\BIdnpvx.exe

Filesize
1.5MB

MD5
bf71137a735da2717149a444627ae6e6

SHA1
6def6c5bf0e95daf1875eba4853e9a2d88161982

SHA256
0d6fef1902be2a262320b8a51baf01e1b9f777e394f749a8d89309e2a6026ebd

SHA512
af74837caeb36f70445227f79806a3bcce275e76df0a2ff62ae69147ee961e05b8241bf1ffbb73ceaf5b3d6745d769f994ee8a01051b771fb091fec3b5886bd2

Download Submit
C:\Windows\System\BkXheGz.exe

Filesize
1.5MB

MD5
63b72a31c059fa9927fb3acf5ae92651

SHA1
21b93e7c089739b2c13d5c1aaff3fe8db83a0074

SHA256
714b792488045fa4d8bdd55ac9317ab53c140a4c4c1c3e39b9b1f5176b9a4577

SHA512
e8a37b5e6d07fd43d95a243fb6add36900d9dcd3e658fd1cf86c4785ffe9cc684a10601144eeb8f06e70b13cf0744913bfd6ebb5be3eed822e0e013cb6280a61

Download Submit
C:\Windows\System\BvSkcTk.exe

Filesize
1.5MB

MD5
fa35ea14038edf1dba1f233a1ca744eb

SHA1
6be9181bb94f6a05057db30b6282b6c532dbe610

SHA256
3f02c1e8455a76bc0aa61be7cb98ce6f4db98f6d43a1eab37853fdb83c6c3b32

SHA512
952b6d7ec19a754bb73eb75591c780f679e8b6d5944ff90eab2f5bb29eb580be353dbcb4ddde596cac24ca95614353b45eb651d30da045c263a90fa5d013f6d2

Download Submit
C:\Windows\System\CEfPGtc.exe

Filesize
1.5MB

MD5
b3036ee223dcfbdaa6dc5c10272c176a

SHA1
2cb8484fd17967b2fb11de21f9e9cab4944272b7

SHA256
db0651433a70c260e5d1c5d5db0d782d162bc05ab6f59bbf06ade8184e7afa2a

SHA512
4a68a9f1090130bc26835051b6aa8bcb45e819895e7f52646636034b8b7f822682ad6209a70a9f5ea8d5c990fadd5f9e71ab5a387c4173095161ed96348d9538

Download Submit
C:\Windows\System\CgRxLWD.exe

Filesize
1.5MB

MD5
f98bedf2f4eddfb3b52bf74e225e442b

SHA1
9f1ca4f17bf2a24903dc83b8e780ec236c6bc17d

SHA256
e6c218c35fcbd5c09229c36a95be1e5b162d0be96c1e03fb28550e49c0def36e

SHA512
0d9fca6ba806248a35c2c62b74749cbc7cdb781a4bd469cef11a75b28ba7c3a1f716744c1a07acdd1de48b09e0e32e9703006f7ea07a097f131142041a6a96d2

Download Submit
C:\Windows\System\DSahjeu.exe

Filesize
1.5MB

MD5
f29a41e307b1361534db0d5079315d81

SHA1
84b6eccd61b5de19747a414e1ef71c62013db628

SHA256
57f457b37ad789cf50cd360783c7166c83847af6b4d388f3a77025d9703149c9

SHA512
6397097e7599257143d9e4659bc1fa97cf6da8255af46835f4ef0ee144f8161f6b2f801f6ffe378615baeedba9d084e3461569a4db2472fb68d69d4d1fb9f37e

Download Submit
C:\Windows\System\DzokGzS.exe

Filesize
1.5MB

MD5
59173fc58e144ccc99120f202b61f8bc

SHA1
7acf9fbd8cf5217d1206cc0c1dcd289720d75f7e

SHA256
10570589e57bb3b739e862fe228e3504147d2342b7df50de365fca6f23306ced

SHA512
53b1d67db1b79eb89eff7c91432ac215b3070278aa080941c7e692414e4e8dbf4ed27207579c76a22b2c8c11a3f9dcb13c16ff9e6c6084340426b509cb74a6d2

Download Submit
C:\Windows\System\EJrpQgr.exe

Filesize
1.5MB

MD5
cdc27fd7a0c1c0109075e9577829f191

SHA1
10c8e236ae26af734efb5f3ea03bb98c26ba9dd0

SHA256
321048fec9b8c7f55849c5a5f485a996228b4b26ae2a24d34e5d64a2fdfa6fff

SHA512
8901da73a80391e9bc692ef3872c1b8c0fe7e449fc0d0a2e232d2dfa26a211073db2ebf1e08e0cf49a1db0182232cfced54c9a82ebbbe97c0a22ed2ab8e6bb4c

Download Submit
C:\Windows\System\EPMclqD.exe

Filesize
1.5MB

MD5
15822392613465476d3e7d754c2e3921

SHA1
66ef336c75308c7a9b5070fc3624a44d06b29ba9

SHA256
6ed4f0b8f96c98291dfea0b6bb9724e0486cef66945447da854900431d1b06d3

SHA512
5114a1b5c65dc4e941843fb01879fe27fd582ce63c24991db0b2498164a1c1bee0c2d04baebacc638fb80d16e230afa13a1037a89a4ce06c502d01b4d5f4e6ca

Download Submit
C:\Windows\System\FBAwyaf.exe

Filesize
1.5MB

MD5
8e9642f6a227c937f46fbc5e72a661fe

SHA1
636d9dc5fa0ce3494703330b54d626431079aaea

SHA256
46b76f9b1a753ac14b91e466a1fb8f86e5724cfc2e37c1c04ac4cb694516df6b

SHA512
0a0ee5381743b4113310cb86c3f733e79e37d342e18ed6668e2d8c2ffc0950900877d4c0a4634fdffb72ea8558a87b97704f0164c55b8edc9a6ad657995fd857

Download Submit
C:\Windows\System\FjRmubj.exe

Filesize
1.5MB

MD5
0cab10ee7648f47c2b47c88587438243

SHA1
aeee87a82c327a1055d2fd2ab3fecb0da4a9eb98

SHA256
de09d064eceddd702d13ac9a374ac5e8a4d2ae9c9dba10b7f38565e01b3cd261

SHA512
85b46c015a946769051178d07413c983f805adb56d6bb24dfad680412103ceb1d697cd1084cbd541654b25b6cf5a1eafb92d7507bd15e4e32c4068dafee09061

Download Submit
C:\Windows\System\IJZgYpH.exe

Filesize
1.5MB

MD5
a34d83ca8b02deda23a06e21d551da3b

SHA1
26a83a83710909c0ea02ee378974af47a0c687f5

SHA256
19a0c7e3f29d7e7434ca365de89d154374ffca4366fde0e3b466a1edd0773f3b

SHA512
0a0d4697ed5ab575cba18c9124085e2e61513d0fdb2b5745487e811ca5173676ed992b0c7887a56f0231ad5c4a2ba6c6f4de7c3ad48e8be774f787eb5495d5b3

Download Submit
C:\Windows\System\LPLlvdf.exe

Filesize
1.5MB

MD5
d2af2d73d09771d40947b09b0bfb8edd

SHA1
eb1061afaef93ec9347f7df09f65cb95f0fa919b

SHA256
09150d139e06fd74aea9998b10329dccef41fefbe34bff608ab9e5a8a33597bc

SHA512
ccea3ba6f622adac06b2c2fb1e3e731bf17dc8546d33137ade0b7cb6377d8ccc835d10a9adb30e40631698adc46d68479f26da7feefd2bb41612cb7bec389d37

Download Submit
C:\Windows\System\NLDrzWh.exe

Filesize
1.5MB

MD5
71983aea5c6d5b4b60e3abe3bff799be

SHA1
a349d78033add807798df3d0036d1599d6ecea5a

SHA256
d7ce365446921cda7be43e79b2dd0e000cc775f0f1ab2d220a0521d1494103f7

SHA512
918aa6b5985407ff9d061e974b409c696243ab077eb55aa76f47b674ae90b745a498ab40780d8f14be22289167a7f24cfc6b275e73f1e20f31658c7e7de52600

Download Submit
C:\Windows\System\QHagFAF.exe

Filesize
1.5MB

MD5
49f27b719957ae5b50f07c56b54a0f76

SHA1
07fc2345a0e2dee9884571235a7cffe387c830d0

SHA256
f6c35f0fa7e284803879de625782679e722be868101ec32e240bfb7f4de60d3f

SHA512
9d83a05b27e3f8374a55c8dc921e705ab45abed0dbef7f2a42d8360370c6ca8d720600b91f8e3c24bac61ad7f58cf7422eeecd29c3502bb0c04777251d1ec849

Download Submit
C:\Windows\System\QtEvAxk.exe

Filesize
1.5MB

MD5
4ed1e49f5cb9b0ab2fab1656c564418e

SHA1
b32c64c5b52ebb4fae1b8e2bf398f56653e0bee8

SHA256
64022a382e2f922afa6cbfe0a1932827da79d04d13a3b912a0856e8b3bfadb05

SHA512
6b685e5eba4c1187a6da3e2de4aca795a58b8a01aff2d930b67e54a4563c994ac645adad53e7d8d0ef4525e52d09f047b3984e6726e4beefc60fa7b1c4db9293

Download Submit
C:\Windows\System\SxdJJOY.exe

Filesize
1.5MB

MD5
47807c7615e7affb12ff3277ba121225

SHA1
06c059c798994133b638947bf9c026eb2aff98fd

SHA256
e2790539e4276dc7a9fb6f7919b9bc121b5474f8481255adc2637811560d57c2

SHA512
6fc2a8f768f952ee81e4dfc08dc1a8a55a061801fbf39a5618fc85adbf488ff37a5dbea255f30151fd9f9ab57029d18cbcef5e3c683063932fbe6eb1ca98bd05

Download Submit
C:\Windows\System\UTfltCo.exe

Filesize
1.5MB

MD5
0c5491476d600d6579091b867809541b

SHA1
6c114bee1bd8715d1900daa58ba4d10179923f23

SHA256
26089250838595edd79ccc536f4cd78c1075e64930a6c8a98d1a7bb74a9c73b8

SHA512
dde29a26908ad8660cfbc3b2b199aa9957847e92095655fcedbd7c90c6ef12dbf5363d42c03a42a56c27454e093e6ff4c399dbde1ce6c0e52cc402b634d969a9

Download Submit
C:\Windows\System\XaqECiQ.exe

Filesize
1.5MB

MD5
78cd2fcb098f920680972b60b6e36b63

SHA1
d50d792ffc0c6c882a24ac104a760fd06849dfc7

SHA256
b9671bb7be54ef53084ecd09098a67c0f109533c5a1546ad4b34a79d78109973

SHA512
777b47497dd3e776c03b66798b072ed41f1de974cb9e9ed00dae647a527068b032825ef8fc495a56d2bf0ad11260ff43d1ee6e0ce6edbfb38555815c90048ffd

Download Submit
C:\Windows\System\buwVPwx.exe

Filesize
1.5MB

MD5
40674746c48ef955e8d733230b688f90

SHA1
2d1de7826b58d516c83c16c8e3e83bc317bc8fcb

SHA256
ee5323f6b288a7156472ad79ec23eed5454fb2ea4fe35da10d29b071b9098ba4

SHA512
9dda3bd9e765ade991c9994760d3dcd1ce374f0b594d9066274c84ca4d1c7bd10dbe78cd3f1df2e00922235bc8294d1432d9ea96068e64046e3a0bce886bb8e9

Download Submit
C:\Windows\System\cHwYWuk.exe

Filesize
1.5MB

MD5
82503534f08e5c2f65652f78c57c27f6

SHA1
ac842d82a05bf90d662262e9b0c8d0703da643b2

SHA256
9926c2e79f71b0ea7b458a55f646b99f39caa79d17c06b79c5ba458a70420560

SHA512
8ae01cde68db01231d7c574068272285df3a566ff7516803081bcb4e621b443fddf5d0579f0922bc0ca28f122a4e4564112476e52ae6d6e938470b558e398631

Download Submit
C:\Windows\System\gjnppFn.exe

Filesize
1.5MB

MD5
b8b83b921eb2ccee52bbc139b893365b

SHA1
082ef1f0a4961059dffa1f03c4b0f548a146ef7e

SHA256
401a0c0245e86db42bec1111f56c161d9b1ace8f23dfa4fcba0a859bb87d2772

SHA512
c4e03c59094376e5743a0488314c66583d94d4e24217cc4e9b8fe36ceed3e88092acd9fd078d9d01cda5ad7b46fef5a1f3fd3e3f19c421987060e15334b90e4b

Download Submit
C:\Windows\System\nYtfNOk.exe

Filesize
1.5MB

MD5
2c0aa82871feb66722b5830ede5dad06

SHA1
8d2de4e895f9cd766797b01d0d29827d74ff9bde

SHA256
b783092e1da52c661b209d4c809b92d9707f3bbd77805b99f6342ad633bafbcb

SHA512
ecaa08256f726ad532fdb13861774c76ad159952b431ea172d42b2086c247edfbc643d289f5373f612c6b5abfc6ddb795da8dc983b2d0979a01a1593f199a596

Download Submit
C:\Windows\System\oOmpJLF.exe

Filesize
1.5MB

MD5
3dba30bdea4c31cd9fce7578e0070cf0

SHA1
45884e9f8d13b70a1be99a91152d2e6b4820bc66

SHA256
8310e9e84d452129256677a0f1ba0aac3d44e1b1b9b8fd6c3f1b495dc40a62e9

SHA512
f28b60c855380cb075aaa3d39f32beb918b5b8cbc9d9a3199598864546f00e6fda9efa860af04db6e66570c744c29a3aa32eda8dbdf9061cf77c36e7c72d2d97

Download Submit
C:\Windows\System\sTwztVV.exe

Filesize
1.5MB

MD5
47514042e7c194dbda3492a22ab77c01

SHA1
7a0b2d1f11c32dbe8ecdb3a7b6ca44921f145194

SHA256
2c9f785c57ae7f70494723806383b47dae433d4665fba79dead79429e4e56051

SHA512
7168c0733a9044a3925d4467cb90324169a7261468f44199fdbc72f5b29b69911d470d8c9d08efabaab7058002ed109376eab928660cfb3487fcd068919a6de8

Download Submit
C:\Windows\System\uiquRbI.exe

Filesize
1.5MB

MD5
3aa9cc1e600ac538ed87f9fe62f9a596

SHA1
6d632133b19825eaa2a713ff62f16dde72f6158f

SHA256
687e446c3fa3df47d96c94afb980319fafb486236ec4554c5b7ead4c192acf4f

SHA512
cc2c71c598915aa98e3eeb631d53d6c37cd2e4811bc685ef473eab6d7b92df6d66c15625e9a7dd0b195be1f9e641689d473df410b9e80e3c7fda8e6097916268

Download Submit
C:\Windows\System\ulUEFPL.exe

Filesize
1.5MB

MD5
ae991220543bdd124b43056565f58634

SHA1
b6402a6720b34922aae5fc37e96f84407e40b84c

SHA256
8f5a03fbb5fe1607dff326bdb64ebd3218f40894f63bb7d90e90a13534fa5b52

SHA512
99587f518883966b44d6660575cff5b7806fdfcd3613bfc1ed2b2083e88d64ec068703a7a6dbb94743cb6a3a92fc28be04e2c6213324393c676a03175c95ecfa

Download Submit
C:\Windows\System\ygwZmHr.exe

Filesize
1.5MB

MD5
92ad249522aa8f9bd720006be9250cef

SHA1
ea12ecc128c33ca8497d2a50d7f27d9643c1db6b

SHA256
cc5767db775a0c59d9c1988ee3db3b6fc69cb1126b29170338cf54948d1b2cf5

SHA512
f2b6c3938c92d0bbbab5ab69bc608a3d429e12decc64021c5ec6fbf14f8ad8d5740ea2d9150de524192bd5a5c9025cf15603e05d349d15503bcc5570f32b8152

Download Submit
C:\Windows\System\yqDALeH.exe

Filesize
1.5MB

MD5
5f34ca1ada3355e6ac792700b0107e70

SHA1
da3bdf272587a4b7642f6320dc00a78babc39bea

SHA256
d877bc4a61c7cd7c496ea10b1ec6fcf9ef57f8fe4a5db9d23b8d15007a8c4e98

SHA512
a0cda70263c5459987f635ed2050ba9f06770fd21294320959305328890d012b21af58ba805407031b6a8ca9ca192cd65f1fd5eb6a1777998a84448ee72f24b3

Download Submit
C:\Windows\System\yxkRKMB.exe

Filesize
1.5MB

MD5
a6a4bf02f13740a7504cf2e23b095fc6

SHA1
9d3537f9347cb00d8c074729ce8cb88becf9a881

SHA256
599162c355ecfeb6dc590f1a43ac135b0f48a89cb20c39f22041f392b9532445

SHA512
731dbb3a71ddfc7990235dfa781f8a0c253a69b8d848e97aee4423b1b944e7386376efd31fdc2caa617765f741cf05ed0321e545e3ad1bbb01f30b886ce43644

Download Submit
C:\Windows\System\ziKacui.exe

Filesize
1.5MB

MD5
99e84d5047114f2eb4799bd5bbbb65b7

SHA1
d187a5db4b51646ecabc56cee34b66bb50c7ff78

SHA256
2f2830149a7e96cb3cd71bde72988f6539a6dd6515e9db6f445e31bea941b28e

SHA512
ab9ae9c1d02c4f27f37cbc9730977b45cb7f6f37fb15a0e61963fe145c208c5c03fa90816a350300f176ac6bfcc492aa59dcf324104fdf692df7dfddf2820908

Download Submit
memory/532-0-0x000001E965B60000-0x000001E965B70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads