xmrig | 41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3

Analysis

max time kernel
94s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2025, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
Size

1.7MB
MD5

2c8c6870c2527433e64366fbf1807213
SHA1

dbc9f4bd3e36a5d67e7ae38e56f8e7e72b0237bb
SHA256

41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3
SHA512

8fcda96ac404752a114c99ad9dfcb5c7e450c34a449fdef2a7dc6a4bfb9d13fb5c399bb6bf939321d674d1730278d9154fd951f2f37be8ac977589a06cd8b98f
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRakGngOAiq2:GemTLkNdfE0pZyK

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b88-3.dat	xmrig
behavioral2/files/0x000a000000023b8d-9.dat	xmrig
behavioral2/files/0x000a000000023b8c-10.dat	xmrig
behavioral2/files/0x000a000000023b8e-20.dat	xmrig
behavioral2/files/0x000a000000023b8f-23.dat	xmrig
behavioral2/files/0x000a000000023b90-33.dat	xmrig
behavioral2/files/0x000a000000023b91-32.dat	xmrig
behavioral2/files/0x000a000000023b92-40.dat	xmrig
behavioral2/files/0x000a000000023b94-49.dat	xmrig
behavioral2/files/0x000a000000023b95-54.dat	xmrig
behavioral2/files/0x000a000000023b97-62.dat	xmrig
behavioral2/files/0x000a000000023b99-75.dat	xmrig
behavioral2/files/0x000a000000023b9a-83.dat	xmrig
behavioral2/files/0x000a000000023b9b-88.dat	xmrig
behavioral2/files/0x000a000000023b9c-93.dat	xmrig
behavioral2/files/0x000a000000023b9d-98.dat	xmrig
behavioral2/files/0x000a000000023b9f-104.dat	xmrig
behavioral2/files/0x000a000000023ba2-117.dat	xmrig
behavioral2/files/0x000a000000023ba3-122.dat	xmrig
behavioral2/files/0x000a000000023ba4-127.dat	xmrig
behavioral2/files/0x000a000000023ba8-152.dat	xmrig
behavioral2/files/0x000b000000023baa-162.dat	xmrig
behavioral2/files/0x000b000000023ba9-157.dat	xmrig
behavioral2/files/0x000a000000023ba7-155.dat	xmrig
behavioral2/files/0x000a000000023ba6-150.dat	xmrig
behavioral2/files/0x000b000000023b89-145.dat	xmrig
behavioral2/files/0x000a000000023ba5-140.dat	xmrig
behavioral2/files/0x000a000000023ba1-120.dat	xmrig
behavioral2/files/0x000a000000023ba0-115.dat	xmrig
behavioral2/files/0x000a000000023b9e-102.dat	xmrig
behavioral2/files/0x000a000000023b98-73.dat	xmrig
behavioral2/files/0x000a000000023b96-63.dat	xmrig
behavioral2/files/0x000a000000023b93-47.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5092	alzJzuZ.exe
3612	zGLllYr.exe
2876	ORyJnZR.exe
3652	NygKcio.exe
4680	xCAthcs.exe
2984	BUtxwZF.exe
2996	SKzrABW.exe
868	jJJyGAC.exe
4012	gcxtYfN.exe
4244	FTvHUzl.exe
2084	dRLZAEZ.exe
2532	yhzTbWa.exe
1924	mZKuNTp.exe
2836	KqzijBr.exe
3588	vPqTtZg.exe
3404	nyPDgdD.exe
4464	FLeeTdx.exe
2756	sUnPuOA.exe
4260	GAFOIrD.exe
3604	FjfdZga.exe
508	cLSczPq.exe
1668	beCQFLK.exe
2040	TIJwTlE.exe
8	VVKEsco.exe
2788	cBGEjdW.exe
3644	xxnCGUS.exe
2384	hksyafE.exe
3532	WatMzgD.exe
2052	PbpivJS.exe
4948	PTKGxUZ.exe
1568	dEEIHek.exe
3600	tvHxDed.exe
452	NWmAvqN.exe
5036	cNqwprF.exe
5100	sFWaDWW.exe
4216	NQmZjYX.exe
1384	JXWjQOb.exe
4364	EZmENet.exe
4528	EblMZEm.exe
3836	CjXzAoy.exe
3104	UVjpNeB.exe
4372	cthHTHK.exe
5088	tMwSAyX.exe
2032	wnudPLy.exe
1840	UItDBqJ.exe
832	klhlGYs.exe
1576	NZMCKRK.exe
4480	EEYajjp.exe
2528	sKapUST.exe
1372	epoLiia.exe
1988	WGchmiG.exe
664	XUbMydZ.exe
2452	WljDpfz.exe
1916	OFPTqWA.exe
4880	kYNRUTB.exe
3472	JZDaXZd.exe
4264	ZmBCekI.exe
3432	BnwqbzI.exe
2576	SEoWDFT.exe
4892	VxYQJaG.exe
4776	GjXkjIb.exe
1536	clLJwlS.exe
1584	uFObdAw.exe
4604	dTMsYBZ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\polhFFU.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\WGchmiG.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\jnAkCOF.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\VGVkJfA.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\JYZwdsH.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\NZMCKRK.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\dpmRQVT.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\ZLycetx.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\cQCmdmS.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\JCXQKdd.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\zQJsFfw.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\caPyvYK.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\pbBeXcp.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\DumRtcA.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\tZZnClH.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\KqkufhI.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\zPYGWfK.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\EblMZEm.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\WwArFqP.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\vnIMuyp.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\zYCRsDS.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\PBYHYot.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\bYeLtlC.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\QEtLWoj.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\wmCZBhT.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\uFObdAw.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\fvurujl.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\uJLCrjM.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\aTOAaVg.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\CTlFvWZ.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\faretwz.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\DxtmJxC.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\ZfiJVdy.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\wIYWIrd.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\cuuXvfK.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\TiJmvoP.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\pKRKguh.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\KKFKIdu.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\JZDaXZd.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\lYNdZRY.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\LZruwMN.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\HaFNPXD.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\ZyQhquC.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\NygKcio.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\RhbKevp.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\uppNsRn.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\KpxnvtV.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\wnudPLy.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\xWXVpvO.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\yhzTbWa.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\TrhnxeY.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\YSrOUoa.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\BwgYSYz.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\YiRaXAi.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\VnnpobF.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\EZmENet.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\KqfwDpd.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\ckQkZUL.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\IRXeolf.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\eHMoQup.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\PROeIQD.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\qRKlciv.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\MsJXQmR.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
File created	C:\Windows\System\uJvvGEk.exe	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 5092	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	83
PID 3628 wrote to memory of 5092	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	83
PID 3628 wrote to memory of 3612	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	84
PID 3628 wrote to memory of 3612	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	84
PID 3628 wrote to memory of 2876	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	85
PID 3628 wrote to memory of 2876	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	85
PID 3628 wrote to memory of 3652	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	86
PID 3628 wrote to memory of 3652	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	86
PID 3628 wrote to memory of 4680	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	87
PID 3628 wrote to memory of 4680	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	87
PID 3628 wrote to memory of 2984	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	88
PID 3628 wrote to memory of 2984	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	88
PID 3628 wrote to memory of 2996	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	89
PID 3628 wrote to memory of 2996	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	89
PID 3628 wrote to memory of 868	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	90
PID 3628 wrote to memory of 868	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	90
PID 3628 wrote to memory of 4012	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	91
PID 3628 wrote to memory of 4012	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	91
PID 3628 wrote to memory of 4244	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	92
PID 3628 wrote to memory of 4244	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	92
PID 3628 wrote to memory of 2084	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	93
PID 3628 wrote to memory of 2084	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	93
PID 3628 wrote to memory of 2532	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	94
PID 3628 wrote to memory of 2532	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	94
PID 3628 wrote to memory of 1924	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	95
PID 3628 wrote to memory of 1924	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	95
PID 3628 wrote to memory of 2836	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	96
PID 3628 wrote to memory of 2836	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	96
PID 3628 wrote to memory of 3588	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	97
PID 3628 wrote to memory of 3588	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	97
PID 3628 wrote to memory of 3404	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	98
PID 3628 wrote to memory of 3404	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	98
PID 3628 wrote to memory of 4464	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	99
PID 3628 wrote to memory of 4464	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	99
PID 3628 wrote to memory of 2756	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	100
PID 3628 wrote to memory of 2756	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	100
PID 3628 wrote to memory of 4260	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	101
PID 3628 wrote to memory of 4260	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	101
PID 3628 wrote to memory of 3604	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	102
PID 3628 wrote to memory of 3604	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	102
PID 3628 wrote to memory of 508	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	103
PID 3628 wrote to memory of 508	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	103
PID 3628 wrote to memory of 1668	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	104
PID 3628 wrote to memory of 1668	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	104
PID 3628 wrote to memory of 2040	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	105
PID 3628 wrote to memory of 2040	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	105
PID 3628 wrote to memory of 8	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	106
PID 3628 wrote to memory of 8	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	106
PID 3628 wrote to memory of 2788	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	107
PID 3628 wrote to memory of 2788	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	107
PID 3628 wrote to memory of 3644	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	108
PID 3628 wrote to memory of 3644	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	108
PID 3628 wrote to memory of 2384	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	109
PID 3628 wrote to memory of 2384	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	109
PID 3628 wrote to memory of 3532	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	110
PID 3628 wrote to memory of 3532	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	110
PID 3628 wrote to memory of 2052	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	111
PID 3628 wrote to memory of 2052	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	111
PID 3628 wrote to memory of 4948	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	112
PID 3628 wrote to memory of 4948	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	112
PID 3628 wrote to memory of 1568	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	113
PID 3628 wrote to memory of 1568	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	113
PID 3628 wrote to memory of 3600	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	114
PID 3628 wrote to memory of 3600	3628	41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe	114

C:\Users\Admin\AppData\Local\Temp\41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe
"C:\Users\Admin\AppData\Local\Temp\41c69d1016d2a0ddf6288ff448f317a47f1d6c4bc816f5dab50a0913bc2ce2b3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\System\alzJzuZ.exe
  C:\Windows\System\alzJzuZ.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\zGLllYr.exe
  C:\Windows\System\zGLllYr.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ORyJnZR.exe
  C:\Windows\System\ORyJnZR.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\NygKcio.exe
  C:\Windows\System\NygKcio.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\xCAthcs.exe
  C:\Windows\System\xCAthcs.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\BUtxwZF.exe
  C:\Windows\System\BUtxwZF.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\SKzrABW.exe
  C:\Windows\System\SKzrABW.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\jJJyGAC.exe
  C:\Windows\System\jJJyGAC.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\gcxtYfN.exe
  C:\Windows\System\gcxtYfN.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\FTvHUzl.exe
  C:\Windows\System\FTvHUzl.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\dRLZAEZ.exe
  C:\Windows\System\dRLZAEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\yhzTbWa.exe
  C:\Windows\System\yhzTbWa.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\mZKuNTp.exe
  C:\Windows\System\mZKuNTp.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\KqzijBr.exe
  C:\Windows\System\KqzijBr.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\vPqTtZg.exe
  C:\Windows\System\vPqTtZg.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\nyPDgdD.exe
  C:\Windows\System\nyPDgdD.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\FLeeTdx.exe
  C:\Windows\System\FLeeTdx.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\sUnPuOA.exe
  C:\Windows\System\sUnPuOA.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\GAFOIrD.exe
  C:\Windows\System\GAFOIrD.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\FjfdZga.exe
  C:\Windows\System\FjfdZga.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\cLSczPq.exe
  C:\Windows\System\cLSczPq.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\beCQFLK.exe
  C:\Windows\System\beCQFLK.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\TIJwTlE.exe
  C:\Windows\System\TIJwTlE.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\VVKEsco.exe
  C:\Windows\System\VVKEsco.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\cBGEjdW.exe
  C:\Windows\System\cBGEjdW.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\xxnCGUS.exe
  C:\Windows\System\xxnCGUS.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\hksyafE.exe
  C:\Windows\System\hksyafE.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\WatMzgD.exe
  C:\Windows\System\WatMzgD.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\PbpivJS.exe
  C:\Windows\System\PbpivJS.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\PTKGxUZ.exe
  C:\Windows\System\PTKGxUZ.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\dEEIHek.exe
  C:\Windows\System\dEEIHek.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\tvHxDed.exe
  C:\Windows\System\tvHxDed.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\NWmAvqN.exe
  C:\Windows\System\NWmAvqN.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\cNqwprF.exe
  C:\Windows\System\cNqwprF.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\sFWaDWW.exe
  C:\Windows\System\sFWaDWW.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\NQmZjYX.exe
  C:\Windows\System\NQmZjYX.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\JXWjQOb.exe
  C:\Windows\System\JXWjQOb.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\EZmENet.exe
  C:\Windows\System\EZmENet.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\EblMZEm.exe
  C:\Windows\System\EblMZEm.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\CjXzAoy.exe
  C:\Windows\System\CjXzAoy.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\UVjpNeB.exe
  C:\Windows\System\UVjpNeB.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\cthHTHK.exe
  C:\Windows\System\cthHTHK.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\tMwSAyX.exe
  C:\Windows\System\tMwSAyX.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\wnudPLy.exe
  C:\Windows\System\wnudPLy.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\UItDBqJ.exe
  C:\Windows\System\UItDBqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\klhlGYs.exe
  C:\Windows\System\klhlGYs.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\NZMCKRK.exe
  C:\Windows\System\NZMCKRK.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\EEYajjp.exe
  C:\Windows\System\EEYajjp.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\sKapUST.exe
  C:\Windows\System\sKapUST.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\epoLiia.exe
  C:\Windows\System\epoLiia.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\WGchmiG.exe
  C:\Windows\System\WGchmiG.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\XUbMydZ.exe
  C:\Windows\System\XUbMydZ.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\WljDpfz.exe
  C:\Windows\System\WljDpfz.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\OFPTqWA.exe
  C:\Windows\System\OFPTqWA.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\kYNRUTB.exe
  C:\Windows\System\kYNRUTB.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\JZDaXZd.exe
  C:\Windows\System\JZDaXZd.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\ZmBCekI.exe
  C:\Windows\System\ZmBCekI.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\BnwqbzI.exe
  C:\Windows\System\BnwqbzI.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\SEoWDFT.exe
  C:\Windows\System\SEoWDFT.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\VxYQJaG.exe
  C:\Windows\System\VxYQJaG.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\GjXkjIb.exe
  C:\Windows\System\GjXkjIb.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\clLJwlS.exe
  C:\Windows\System\clLJwlS.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\uFObdAw.exe
  C:\Windows\System\uFObdAw.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\dTMsYBZ.exe
  C:\Windows\System\dTMsYBZ.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\hdvwqLm.exe
  C:\Windows\System\hdvwqLm.exe
  2⤵
  PID:4076
- C:\Windows\System\XYTyURp.exe
  C:\Windows\System\XYTyURp.exe
  2⤵
  PID:4856
- C:\Windows\System\RhbKevp.exe
  C:\Windows\System\RhbKevp.exe
  2⤵
  PID:676
- C:\Windows\System\oIiIJnQ.exe
  C:\Windows\System\oIiIJnQ.exe
  2⤵
  PID:4152
- C:\Windows\System\qTUfRDX.exe
  C:\Windows\System\qTUfRDX.exe
  2⤵
  PID:116
- C:\Windows\System\lnFUvMb.exe
  C:\Windows\System\lnFUvMb.exe
  2⤵
  PID:2208
- C:\Windows\System\buaskrv.exe
  C:\Windows\System\buaskrv.exe
  2⤵
  PID:4984
- C:\Windows\System\dHGWktj.exe
  C:\Windows\System\dHGWktj.exe
  2⤵
  PID:1712
- C:\Windows\System\fJfiPCG.exe
  C:\Windows\System\fJfiPCG.exe
  2⤵
  PID:4232
- C:\Windows\System\uQyIjCS.exe
  C:\Windows\System\uQyIjCS.exe
  2⤵
  PID:4924
- C:\Windows\System\CHGWWjl.exe
  C:\Windows\System\CHGWWjl.exe
  2⤵
  PID:4092
- C:\Windows\System\XeNnuoD.exe
  C:\Windows\System\XeNnuoD.exe
  2⤵
  PID:1152
- C:\Windows\System\UnmvvXz.exe
  C:\Windows\System\UnmvvXz.exe
  2⤵
  PID:760
- C:\Windows\System\ZzESlxs.exe
  C:\Windows\System\ZzESlxs.exe
  2⤵
  PID:2508
- C:\Windows\System\qEhIbTE.exe
  C:\Windows\System\qEhIbTE.exe
  2⤵
  PID:4932
- C:\Windows\System\ZIgMCiW.exe
  C:\Windows\System\ZIgMCiW.exe
  2⤵
  PID:2640
- C:\Windows\System\LLFGdTV.exe
  C:\Windows\System\LLFGdTV.exe
  2⤵
  PID:4676
- C:\Windows\System\QsBQsgx.exe
  C:\Windows\System\QsBQsgx.exe
  2⤵
  PID:3160
- C:\Windows\System\OraBpjp.exe
  C:\Windows\System\OraBpjp.exe
  2⤵
  PID:808
- C:\Windows\System\JKpevNH.exe
  C:\Windows\System\JKpevNH.exe
  2⤵
  PID:3476
- C:\Windows\System\HRPNeaQ.exe
  C:\Windows\System\HRPNeaQ.exe
  2⤵
  PID:1052
- C:\Windows\System\CdQIQjK.exe
  C:\Windows\System\CdQIQjK.exe
  2⤵
  PID:4112
- C:\Windows\System\jsHcweh.exe
  C:\Windows\System\jsHcweh.exe
  2⤵
  PID:1972
- C:\Windows\System\jmuQaOA.exe
  C:\Windows\System\jmuQaOA.exe
  2⤵
  PID:4268
- C:\Windows\System\qZcfmvz.exe
  C:\Windows\System\qZcfmvz.exe
  2⤵
  PID:5076
- C:\Windows\System\mgqkxZr.exe
  C:\Windows\System\mgqkxZr.exe
  2⤵
  PID:4912
- C:\Windows\System\rEnvRYI.exe
  C:\Windows\System\rEnvRYI.exe
  2⤵
  PID:3784
- C:\Windows\System\zYNmeSr.exe
  C:\Windows\System\zYNmeSr.exe
  2⤵
  PID:4332
- C:\Windows\System\tzEGAxs.exe
  C:\Windows\System\tzEGAxs.exe
  2⤵
  PID:3388
- C:\Windows\System\KhngMDd.exe
  C:\Windows\System\KhngMDd.exe
  2⤵
  PID:4488
- C:\Windows\System\WwArFqP.exe
  C:\Windows\System\WwArFqP.exe
  2⤵
  PID:948
- C:\Windows\System\OLWJYKC.exe
  C:\Windows\System\OLWJYKC.exe
  2⤵
  PID:4024
- C:\Windows\System\nXhIqIp.exe
  C:\Windows\System\nXhIqIp.exe
  2⤵
  PID:3152
- C:\Windows\System\ZBFHZaI.exe
  C:\Windows\System\ZBFHZaI.exe
  2⤵
  PID:1388
- C:\Windows\System\sNGBQDv.exe
  C:\Windows\System\sNGBQDv.exe
  2⤵
  PID:4568
- C:\Windows\System\cLaTheq.exe
  C:\Windows\System\cLaTheq.exe
  2⤵
  PID:4064
- C:\Windows\System\VvnFUat.exe
  C:\Windows\System\VvnFUat.exe
  2⤵
  PID:408
- C:\Windows\System\IYRbUqq.exe
  C:\Windows\System\IYRbUqq.exe
  2⤵
  PID:2792
- C:\Windows\System\KqfwDpd.exe
  C:\Windows\System\KqfwDpd.exe
  2⤵
  PID:2676
- C:\Windows\System\yDghIkE.exe
  C:\Windows\System\yDghIkE.exe
  2⤵
  PID:1284
- C:\Windows\System\xHqxjMf.exe
  C:\Windows\System\xHqxjMf.exe
  2⤵
  PID:2304
- C:\Windows\System\MpGQWuV.exe
  C:\Windows\System\MpGQWuV.exe
  2⤵
  PID:3684
- C:\Windows\System\ZRwjlqZ.exe
  C:\Windows\System\ZRwjlqZ.exe
  2⤵
  PID:1040
- C:\Windows\System\vfTIZRN.exe
  C:\Windows\System\vfTIZRN.exe
  2⤵
  PID:4896
- C:\Windows\System\zQBposE.exe
  C:\Windows\System\zQBposE.exe
  2⤵
  PID:3924
- C:\Windows\System\RlWgUQa.exe
  C:\Windows\System\RlWgUQa.exe
  2⤵
  PID:396
- C:\Windows\System\bzVRBpF.exe
  C:\Windows\System\bzVRBpF.exe
  2⤵
  PID:648
- C:\Windows\System\mHKHlMq.exe
  C:\Windows\System\mHKHlMq.exe
  2⤵
  PID:4572
- C:\Windows\System\RTDaPmy.exe
  C:\Windows\System\RTDaPmy.exe
  2⤵
  PID:4584
- C:\Windows\System\yeKKmek.exe
  C:\Windows\System\yeKKmek.exe
  2⤵
  PID:5148
- C:\Windows\System\PbVONhg.exe
  C:\Windows\System\PbVONhg.exe
  2⤵
  PID:5176
- C:\Windows\System\PhrDxLA.exe
  C:\Windows\System\PhrDxLA.exe
  2⤵
  PID:5204
- C:\Windows\System\gWSwgGw.exe
  C:\Windows\System\gWSwgGw.exe
  2⤵
  PID:5232
- C:\Windows\System\BwgYSYz.exe
  C:\Windows\System\BwgYSYz.exe
  2⤵
  PID:5260
- C:\Windows\System\yrrcjTE.exe
  C:\Windows\System\yrrcjTE.exe
  2⤵
  PID:5288
- C:\Windows\System\knbcHFt.exe
  C:\Windows\System\knbcHFt.exe
  2⤵
  PID:5316
- C:\Windows\System\llrIQOm.exe
  C:\Windows\System\llrIQOm.exe
  2⤵
  PID:5344
- C:\Windows\System\lycgSMX.exe
  C:\Windows\System\lycgSMX.exe
  2⤵
  PID:5372
- C:\Windows\System\vnIMuyp.exe
  C:\Windows\System\vnIMuyp.exe
  2⤵
  PID:5400
- C:\Windows\System\EOxJDDg.exe
  C:\Windows\System\EOxJDDg.exe
  2⤵
  PID:5428
- C:\Windows\System\MpVeqvF.exe
  C:\Windows\System\MpVeqvF.exe
  2⤵
  PID:5456
- C:\Windows\System\RpfjhMs.exe
  C:\Windows\System\RpfjhMs.exe
  2⤵
  PID:5484
- C:\Windows\System\jmobnVy.exe
  C:\Windows\System\jmobnVy.exe
  2⤵
  PID:5512
- C:\Windows\System\pOUkRyc.exe
  C:\Windows\System\pOUkRyc.exe
  2⤵
  PID:5544
- C:\Windows\System\DzpROuS.exe
  C:\Windows\System\DzpROuS.exe
  2⤵
  PID:5568
- C:\Windows\System\VCRUFLk.exe
  C:\Windows\System\VCRUFLk.exe
  2⤵
  PID:5596
- C:\Windows\System\yTffFSC.exe
  C:\Windows\System\yTffFSC.exe
  2⤵
  PID:5624
- C:\Windows\System\eEsLELi.exe
  C:\Windows\System\eEsLELi.exe
  2⤵
  PID:5652
- C:\Windows\System\NvWhxYw.exe
  C:\Windows\System\NvWhxYw.exe
  2⤵
  PID:5680
- C:\Windows\System\VruUQuP.exe
  C:\Windows\System\VruUQuP.exe
  2⤵
  PID:5712
- C:\Windows\System\mLtHRrk.exe
  C:\Windows\System\mLtHRrk.exe
  2⤵
  PID:5736
- C:\Windows\System\SJeitst.exe
  C:\Windows\System\SJeitst.exe
  2⤵
  PID:5764
- C:\Windows\System\KSGiXUm.exe
  C:\Windows\System\KSGiXUm.exe
  2⤵
  PID:5792
- C:\Windows\System\xMcddWz.exe
  C:\Windows\System\xMcddWz.exe
  2⤵
  PID:5820
- C:\Windows\System\tfPiXwa.exe
  C:\Windows\System\tfPiXwa.exe
  2⤵
  PID:5848
- C:\Windows\System\nUScueX.exe
  C:\Windows\System\nUScueX.exe
  2⤵
  PID:5876
- C:\Windows\System\YtJToYv.exe
  C:\Windows\System\YtJToYv.exe
  2⤵
  PID:5904
- C:\Windows\System\kGGjNtL.exe
  C:\Windows\System\kGGjNtL.exe
  2⤵
  PID:5932
- C:\Windows\System\YmkwPtC.exe
  C:\Windows\System\YmkwPtC.exe
  2⤵
  PID:5960
- C:\Windows\System\KKDSYUp.exe
  C:\Windows\System\KKDSYUp.exe
  2⤵
  PID:5992
- C:\Windows\System\ckQkZUL.exe
  C:\Windows\System\ckQkZUL.exe
  2⤵
  PID:6016
- C:\Windows\System\hvShxOn.exe
  C:\Windows\System\hvShxOn.exe
  2⤵
  PID:6044
- C:\Windows\System\JxjQGgH.exe
  C:\Windows\System\JxjQGgH.exe
  2⤵
  PID:6076
- C:\Windows\System\ovsxbEa.exe
  C:\Windows\System\ovsxbEa.exe
  2⤵
  PID:6104
- C:\Windows\System\cSzeVCb.exe
  C:\Windows\System\cSzeVCb.exe
  2⤵
  PID:6132
- C:\Windows\System\wIYWIrd.exe
  C:\Windows\System\wIYWIrd.exe
  2⤵
  PID:5172
- C:\Windows\System\jiRdFdd.exe
  C:\Windows\System\jiRdFdd.exe
  2⤵
  PID:5200
- C:\Windows\System\vuFYHod.exe
  C:\Windows\System\vuFYHod.exe
  2⤵
  PID:5256
- C:\Windows\System\ViSBIMO.exe
  C:\Windows\System\ViSBIMO.exe
  2⤵
  PID:5328
- C:\Windows\System\pTwetCs.exe
  C:\Windows\System\pTwetCs.exe
  2⤵
  PID:5368
- C:\Windows\System\KsIhHht.exe
  C:\Windows\System\KsIhHht.exe
  2⤵
  PID:5452
- C:\Windows\System\zLKGnSX.exe
  C:\Windows\System\zLKGnSX.exe
  2⤵
  PID:5504
- C:\Windows\System\MKtDRCS.exe
  C:\Windows\System\MKtDRCS.exe
  2⤵
  PID:5588
- C:\Windows\System\JfYlwZM.exe
  C:\Windows\System\JfYlwZM.exe
  2⤵
  PID:5620
- C:\Windows\System\TiqEolI.exe
  C:\Windows\System\TiqEolI.exe
  2⤵
  PID:5704
- C:\Windows\System\NFnRZkQ.exe
  C:\Windows\System\NFnRZkQ.exe
  2⤵
  PID:5756
- C:\Windows\System\JVVWcJc.exe
  C:\Windows\System\JVVWcJc.exe
  2⤵
  PID:5840
- C:\Windows\System\sDurlfv.exe
  C:\Windows\System\sDurlfv.exe
  2⤵
  PID:5928
- C:\Windows\System\OxKghQA.exe
  C:\Windows\System\OxKghQA.exe
  2⤵
  PID:5972
- C:\Windows\System\OfzklIs.exe
  C:\Windows\System\OfzklIs.exe
  2⤵
  PID:6040
- C:\Windows\System\yDKDIEI.exe
  C:\Windows\System\yDKDIEI.exe
  2⤵
  PID:6068
- C:\Windows\System\MFRxmyB.exe
  C:\Windows\System\MFRxmyB.exe
  2⤵
  PID:5252
- C:\Windows\System\IRXeolf.exe
  C:\Windows\System\IRXeolf.exe
  2⤵
  PID:5340
- C:\Windows\System\zWfbwNa.exe
  C:\Windows\System\zWfbwNa.exe
  2⤵
  PID:5476
- C:\Windows\System\NnlYHKk.exe
  C:\Windows\System\NnlYHKk.exe
  2⤵
  PID:5580
- C:\Windows\System\NMVFcjY.exe
  C:\Windows\System\NMVFcjY.exe
  2⤵
  PID:5700
- C:\Windows\System\DlnvfHU.exe
  C:\Windows\System\DlnvfHU.exe
  2⤵
  PID:5896
- C:\Windows\System\RkilgLG.exe
  C:\Windows\System\RkilgLG.exe
  2⤵
  PID:6012
- C:\Windows\System\MqLkfMg.exe
  C:\Windows\System\MqLkfMg.exe
  2⤵
  PID:6116
- C:\Windows\System\aCVhSLu.exe
  C:\Windows\System\aCVhSLu.exe
  2⤵
  PID:5616
- C:\Windows\System\tmSamMr.exe
  C:\Windows\System\tmSamMr.exe
  2⤵
  PID:6004
- C:\Windows\System\ZQHAXXU.exe
  C:\Windows\System\ZQHAXXU.exe
  2⤵
  PID:5872
- C:\Windows\System\uFBNQNU.exe
  C:\Windows\System\uFBNQNU.exe
  2⤵
  PID:6172
- C:\Windows\System\BvOlKfa.exe
  C:\Windows\System\BvOlKfa.exe
  2⤵
  PID:6212
- C:\Windows\System\aWVzMBm.exe
  C:\Windows\System\aWVzMBm.exe
  2⤵
  PID:6228
- C:\Windows\System\CmsnmIW.exe
  C:\Windows\System\CmsnmIW.exe
  2⤵
  PID:6264
- C:\Windows\System\AHjpfXV.exe
  C:\Windows\System\AHjpfXV.exe
  2⤵
  PID:6292
- C:\Windows\System\QkGLmFB.exe
  C:\Windows\System\QkGLmFB.exe
  2⤵
  PID:6316
- C:\Windows\System\XLKgHGR.exe
  C:\Windows\System\XLKgHGR.exe
  2⤵
  PID:6344
- C:\Windows\System\dpEmibW.exe
  C:\Windows\System\dpEmibW.exe
  2⤵
  PID:6372
- C:\Windows\System\pBOxQeP.exe
  C:\Windows\System\pBOxQeP.exe
  2⤵
  PID:6408
- C:\Windows\System\LsQuhGG.exe
  C:\Windows\System\LsQuhGG.exe
  2⤵
  PID:6428
- C:\Windows\System\BSidoZt.exe
  C:\Windows\System\BSidoZt.exe
  2⤵
  PID:6464
- C:\Windows\System\uLywfPl.exe
  C:\Windows\System\uLywfPl.exe
  2⤵
  PID:6484
- C:\Windows\System\UBSVlPE.exe
  C:\Windows\System\UBSVlPE.exe
  2⤵
  PID:6508
- C:\Windows\System\OXVGUCU.exe
  C:\Windows\System\OXVGUCU.exe
  2⤵
  PID:6540
- C:\Windows\System\IskeDGj.exe
  C:\Windows\System\IskeDGj.exe
  2⤵
  PID:6568
- C:\Windows\System\KsHoaYE.exe
  C:\Windows\System\KsHoaYE.exe
  2⤵
  PID:6604
- C:\Windows\System\JiaoUJY.exe
  C:\Windows\System\JiaoUJY.exe
  2⤵
  PID:6636
- C:\Windows\System\BqqBHWE.exe
  C:\Windows\System\BqqBHWE.exe
  2⤵
  PID:6664
- C:\Windows\System\YsCccOw.exe
  C:\Windows\System\YsCccOw.exe
  2⤵
  PID:6692
- C:\Windows\System\RtUpESP.exe
  C:\Windows\System\RtUpESP.exe
  2⤵
  PID:6724
- C:\Windows\System\VzzPlKB.exe
  C:\Windows\System\VzzPlKB.exe
  2⤵
  PID:6752
- C:\Windows\System\slkeiLe.exe
  C:\Windows\System\slkeiLe.exe
  2⤵
  PID:6768
- C:\Windows\System\CBdJkDP.exe
  C:\Windows\System\CBdJkDP.exe
  2⤵
  PID:6804
- C:\Windows\System\EOMeTbn.exe
  C:\Windows\System\EOMeTbn.exe
  2⤵
  PID:6848
- C:\Windows\System\ksGXuWg.exe
  C:\Windows\System\ksGXuWg.exe
  2⤵
  PID:6876
- C:\Windows\System\pbBeXcp.exe
  C:\Windows\System\pbBeXcp.exe
  2⤵
  PID:6904
- C:\Windows\System\WSjOQps.exe
  C:\Windows\System\WSjOQps.exe
  2⤵
  PID:6932
- C:\Windows\System\vMtUQTx.exe
  C:\Windows\System\vMtUQTx.exe
  2⤵
  PID:6960
- C:\Windows\System\iFegZiL.exe
  C:\Windows\System\iFegZiL.exe
  2⤵
  PID:6988
- C:\Windows\System\PJRLrzh.exe
  C:\Windows\System\PJRLrzh.exe
  2⤵
  PID:7004
- C:\Windows\System\pmnGxdT.exe
  C:\Windows\System\pmnGxdT.exe
  2⤵
  PID:7040
- C:\Windows\System\UIRPCvR.exe
  C:\Windows\System\UIRPCvR.exe
  2⤵
  PID:7060
- C:\Windows\System\QygBidI.exe
  C:\Windows\System\QygBidI.exe
  2⤵
  PID:7100
- C:\Windows\System\MBJWTGm.exe
  C:\Windows\System\MBJWTGm.exe
  2⤵
  PID:7116
- C:\Windows\System\cuuXvfK.exe
  C:\Windows\System\cuuXvfK.exe
  2⤵
  PID:7156
- C:\Windows\System\otnHRTP.exe
  C:\Windows\System\otnHRTP.exe
  2⤵
  PID:5676
- C:\Windows\System\fSVwgHK.exe
  C:\Windows\System\fSVwgHK.exe
  2⤵
  PID:2388
- C:\Windows\System\jJXiZCC.exe
  C:\Windows\System\jJXiZCC.exe
  2⤵
  PID:6240
- C:\Windows\System\aUodNkY.exe
  C:\Windows\System\aUodNkY.exe
  2⤵
  PID:6324
- C:\Windows\System\doSMUAW.exe
  C:\Windows\System\doSMUAW.exe
  2⤵
  PID:6368
- C:\Windows\System\zJlFCkk.exe
  C:\Windows\System\zJlFCkk.exe
  2⤵
  PID:6420
- C:\Windows\System\KxUIggK.exe
  C:\Windows\System\KxUIggK.exe
  2⤵
  PID:6492
- C:\Windows\System\faretwz.exe
  C:\Windows\System\faretwz.exe
  2⤵
  PID:6576
- C:\Windows\System\jnAkCOF.exe
  C:\Windows\System\jnAkCOF.exe
  2⤵
  PID:6620
- C:\Windows\System\ZMxLyZN.exe
  C:\Windows\System\ZMxLyZN.exe
  2⤵
  PID:6676
- C:\Windows\System\jfijGmx.exe
  C:\Windows\System\jfijGmx.exe
  2⤵
  PID:6764
- C:\Windows\System\rNPrlzE.exe
  C:\Windows\System\rNPrlzE.exe
  2⤵
  PID:6788
- C:\Windows\System\JXHWBqC.exe
  C:\Windows\System\JXHWBqC.exe
  2⤵
  PID:6840
- C:\Windows\System\bBFWuJC.exe
  C:\Windows\System\bBFWuJC.exe
  2⤵
  PID:6896
- C:\Windows\System\dNjqQBD.exe
  C:\Windows\System\dNjqQBD.exe
  2⤵
  PID:6980
- C:\Windows\System\FQTjCre.exe
  C:\Windows\System\FQTjCre.exe
  2⤵
  PID:7048
- C:\Windows\System\lARbeMU.exe
  C:\Windows\System\lARbeMU.exe
  2⤵
  PID:2692
- C:\Windows\System\SyYFEuM.exe
  C:\Windows\System\SyYFEuM.exe
  2⤵
  PID:7080
- C:\Windows\System\LvdoxAX.exe
  C:\Windows\System\LvdoxAX.exe
  2⤵
  PID:5608
- C:\Windows\System\BSHPZJX.exe
  C:\Windows\System\BSHPZJX.exe
  2⤵
  PID:6280
- C:\Windows\System\eVdNzHU.exe
  C:\Windows\System\eVdNzHU.exe
  2⤵
  PID:6520
- C:\Windows\System\hgFAYLI.exe
  C:\Windows\System\hgFAYLI.exe
  2⤵
  PID:6588
- C:\Windows\System\gbPOidI.exe
  C:\Windows\System\gbPOidI.exe
  2⤵
  PID:6748
- C:\Windows\System\mQQArSg.exe
  C:\Windows\System\mQQArSg.exe
  2⤵
  PID:6872
- C:\Windows\System\vGxHFDV.exe
  C:\Windows\System\vGxHFDV.exe
  2⤵
  PID:412
- C:\Windows\System\uQfKVkY.exe
  C:\Windows\System\uQfKVkY.exe
  2⤵
  PID:7132
- C:\Windows\System\XwXEfBN.exe
  C:\Windows\System\XwXEfBN.exe
  2⤵
  PID:6436
- C:\Windows\System\qCwckij.exe
  C:\Windows\System\qCwckij.exe
  2⤵
  PID:6812
- C:\Windows\System\ahSOEfy.exe
  C:\Windows\System\ahSOEfy.exe
  2⤵
  PID:6224
- C:\Windows\System\jbvzqng.exe
  C:\Windows\System\jbvzqng.exe
  2⤵
  PID:6928
- C:\Windows\System\JmUBpRx.exe
  C:\Windows\System\JmUBpRx.exe
  2⤵
  PID:6832
- C:\Windows\System\LFPACSt.exe
  C:\Windows\System\LFPACSt.exe
  2⤵
  PID:7200
- C:\Windows\System\dpmRQVT.exe
  C:\Windows\System\dpmRQVT.exe
  2⤵
  PID:7228
- C:\Windows\System\WmrGFEi.exe
  C:\Windows\System\WmrGFEi.exe
  2⤵
  PID:7256
- C:\Windows\System\mZckxNi.exe
  C:\Windows\System\mZckxNi.exe
  2⤵
  PID:7276
- C:\Windows\System\wAxnFYx.exe
  C:\Windows\System\wAxnFYx.exe
  2⤵
  PID:7304
- C:\Windows\System\PpFQZJw.exe
  C:\Windows\System\PpFQZJw.exe
  2⤵
  PID:7320
- C:\Windows\System\FKJQCaS.exe
  C:\Windows\System\FKJQCaS.exe
  2⤵
  PID:7348
- C:\Windows\System\uppNsRn.exe
  C:\Windows\System\uppNsRn.exe
  2⤵
  PID:7376
- C:\Windows\System\kkLDlwU.exe
  C:\Windows\System\kkLDlwU.exe
  2⤵
  PID:7392
- C:\Windows\System\DlQKMzw.exe
  C:\Windows\System\DlQKMzw.exe
  2⤵
  PID:7428
- C:\Windows\System\mFVnEEL.exe
  C:\Windows\System\mFVnEEL.exe
  2⤵
  PID:7452
- C:\Windows\System\mJTgxTH.exe
  C:\Windows\System\mJTgxTH.exe
  2⤵
  PID:7496
- C:\Windows\System\xYEWxuG.exe
  C:\Windows\System\xYEWxuG.exe
  2⤵
  PID:7536
- C:\Windows\System\SiIROvl.exe
  C:\Windows\System\SiIROvl.exe
  2⤵
  PID:7568
- C:\Windows\System\nGJNzHB.exe
  C:\Windows\System\nGJNzHB.exe
  2⤵
  PID:7596
- C:\Windows\System\vRZqgTg.exe
  C:\Windows\System\vRZqgTg.exe
  2⤵
  PID:7628
- C:\Windows\System\kZriKoq.exe
  C:\Windows\System\kZriKoq.exe
  2⤵
  PID:7644
- C:\Windows\System\yKjROYz.exe
  C:\Windows\System\yKjROYz.exe
  2⤵
  PID:7672
- C:\Windows\System\PROeIQD.exe
  C:\Windows\System\PROeIQD.exe
  2⤵
  PID:7700
- C:\Windows\System\HDuPeHf.exe
  C:\Windows\System\HDuPeHf.exe
  2⤵
  PID:7732
- C:\Windows\System\NgxowOd.exe
  C:\Windows\System\NgxowOd.exe
  2⤵
  PID:7768
- C:\Windows\System\YiRaXAi.exe
  C:\Windows\System\YiRaXAi.exe
  2⤵
  PID:7796
- C:\Windows\System\xHLSKmp.exe
  C:\Windows\System\xHLSKmp.exe
  2⤵
  PID:7824
- C:\Windows\System\fNAzxGP.exe
  C:\Windows\System\fNAzxGP.exe
  2⤵
  PID:7840
- C:\Windows\System\vpSbRsy.exe
  C:\Windows\System\vpSbRsy.exe
  2⤵
  PID:7868
- C:\Windows\System\XFUKQTm.exe
  C:\Windows\System\XFUKQTm.exe
  2⤵
  PID:7900
- C:\Windows\System\VleEdSX.exe
  C:\Windows\System\VleEdSX.exe
  2⤵
  PID:7924
- C:\Windows\System\lGMlyZd.exe
  C:\Windows\System\lGMlyZd.exe
  2⤵
  PID:7952
- C:\Windows\System\DHvufVz.exe
  C:\Windows\System\DHvufVz.exe
  2⤵
  PID:7980
- C:\Windows\System\MUahDjO.exe
  C:\Windows\System\MUahDjO.exe
  2⤵
  PID:8008
- C:\Windows\System\JltLREA.exe
  C:\Windows\System\JltLREA.exe
  2⤵
  PID:8040
- C:\Windows\System\pKPkkaB.exe
  C:\Windows\System\pKPkkaB.exe
  2⤵
  PID:8068
- C:\Windows\System\OHcDPnZ.exe
  C:\Windows\System\OHcDPnZ.exe
  2⤵
  PID:8092
- C:\Windows\System\mpLyARb.exe
  C:\Windows\System\mpLyARb.exe
  2⤵
  PID:8120
- C:\Windows\System\AZORGpa.exe
  C:\Windows\System\AZORGpa.exe
  2⤵
  PID:8148
- C:\Windows\System\dqgQpfa.exe
  C:\Windows\System\dqgQpfa.exe
  2⤵
  PID:8180
- C:\Windows\System\BUsHJGl.exe
  C:\Windows\System\BUsHJGl.exe
  2⤵
  PID:7196
- C:\Windows\System\MOmMtik.exe
  C:\Windows\System\MOmMtik.exe
  2⤵
  PID:7264
- C:\Windows\System\EYlLTYx.exe
  C:\Windows\System\EYlLTYx.exe
  2⤵
  PID:7316
- C:\Windows\System\MKjTmIp.exe
  C:\Windows\System\MKjTmIp.exe
  2⤵
  PID:7312
- C:\Windows\System\ZLycetx.exe
  C:\Windows\System\ZLycetx.exe
  2⤵
  PID:7412
- C:\Windows\System\zEqNqtO.exe
  C:\Windows\System\zEqNqtO.exe
  2⤵
  PID:7532
- C:\Windows\System\rxoMKcB.exe
  C:\Windows\System\rxoMKcB.exe
  2⤵
  PID:7588
- C:\Windows\System\JUAMeLd.exe
  C:\Windows\System\JUAMeLd.exe
  2⤵
  PID:7660
- C:\Windows\System\IRyVzxu.exe
  C:\Windows\System\IRyVzxu.exe
  2⤵
  PID:7684
- C:\Windows\System\gQpupOp.exe
  C:\Windows\System\gQpupOp.exe
  2⤵
  PID:7748
- C:\Windows\System\QZGcHBW.exe
  C:\Windows\System\QZGcHBW.exe
  2⤵
  PID:7836
- C:\Windows\System\TiJmvoP.exe
  C:\Windows\System\TiJmvoP.exe
  2⤵
  PID:7880
- C:\Windows\System\WGQLynI.exe
  C:\Windows\System\WGQLynI.exe
  2⤵
  PID:7972
- C:\Windows\System\mPfMAMf.exe
  C:\Windows\System\mPfMAMf.exe
  2⤵
  PID:8036
- C:\Windows\System\zUJInpA.exe
  C:\Windows\System\zUJInpA.exe
  2⤵
  PID:8112
- C:\Windows\System\eepKJqY.exe
  C:\Windows\System\eepKJqY.exe
  2⤵
  PID:8168
- C:\Windows\System\WwcZVDq.exe
  C:\Windows\System\WwcZVDq.exe
  2⤵
  PID:7236
- C:\Windows\System\ibhQxHP.exe
  C:\Windows\System\ibhQxHP.exe
  2⤵
  PID:7344
- C:\Windows\System\hGqfvfy.exe
  C:\Windows\System\hGqfvfy.exe
  2⤵
  PID:7580
- C:\Windows\System\FIsMgAN.exe
  C:\Windows\System\FIsMgAN.exe
  2⤵
  PID:7692
- C:\Windows\System\DmUYkpw.exe
  C:\Windows\System\DmUYkpw.exe
  2⤵
  PID:7860
- C:\Windows\System\khYIszE.exe
  C:\Windows\System\khYIszE.exe
  2⤵
  PID:8000
- C:\Windows\System\iiXRoid.exe
  C:\Windows\System\iiXRoid.exe
  2⤵
  PID:8144
- C:\Windows\System\bTDZZfH.exe
  C:\Windows\System\bTDZZfH.exe
  2⤵
  PID:7524
- C:\Windows\System\zYCRsDS.exe
  C:\Windows\System\zYCRsDS.exe
  2⤵
  PID:7816
- C:\Windows\System\pRgDZwt.exe
  C:\Windows\System\pRgDZwt.exe
  2⤵
  PID:7288
- C:\Windows\System\vbuSNMr.exe
  C:\Windows\System\vbuSNMr.exe
  2⤵
  PID:7820
- C:\Windows\System\OhOYnpJ.exe
  C:\Windows\System\OhOYnpJ.exe
  2⤵
  PID:8228
- C:\Windows\System\prsSQcF.exe
  C:\Windows\System\prsSQcF.exe
  2⤵
  PID:8248
- C:\Windows\System\kRYegML.exe
  C:\Windows\System\kRYegML.exe
  2⤵
  PID:8284
- C:\Windows\System\lhBgzbh.exe
  C:\Windows\System\lhBgzbh.exe
  2⤵
  PID:8312
- C:\Windows\System\XkvLJBJ.exe
  C:\Windows\System\XkvLJBJ.exe
  2⤵
  PID:8328
- C:\Windows\System\BfhYFlk.exe
  C:\Windows\System\BfhYFlk.exe
  2⤵
  PID:8356
- C:\Windows\System\DxMTkBX.exe
  C:\Windows\System\DxMTkBX.exe
  2⤵
  PID:8384
- C:\Windows\System\lYNdZRY.exe
  C:\Windows\System\lYNdZRY.exe
  2⤵
  PID:8424
- C:\Windows\System\jOSfvRI.exe
  C:\Windows\System\jOSfvRI.exe
  2⤵
  PID:8452
- C:\Windows\System\tBjhjth.exe
  C:\Windows\System\tBjhjth.exe
  2⤵
  PID:8472
- C:\Windows\System\hdzRrVm.exe
  C:\Windows\System\hdzRrVm.exe
  2⤵
  PID:8508
- C:\Windows\System\BATOuWz.exe
  C:\Windows\System\BATOuWz.exe
  2⤵
  PID:8524
- C:\Windows\System\GRRfMnI.exe
  C:\Windows\System\GRRfMnI.exe
  2⤵
  PID:8556
- C:\Windows\System\QYNokNY.exe
  C:\Windows\System\QYNokNY.exe
  2⤵
  PID:8580
- C:\Windows\System\vrTVGHW.exe
  C:\Windows\System\vrTVGHW.exe
  2⤵
  PID:8620
- C:\Windows\System\MvosAcd.exe
  C:\Windows\System\MvosAcd.exe
  2⤵
  PID:8648
- C:\Windows\System\ucngooB.exe
  C:\Windows\System\ucngooB.exe
  2⤵
  PID:8672
- C:\Windows\System\qsSrIml.exe
  C:\Windows\System\qsSrIml.exe
  2⤵
  PID:8700
- C:\Windows\System\wpAnVtV.exe
  C:\Windows\System\wpAnVtV.exe
  2⤵
  PID:8724
- C:\Windows\System\HjwoHRe.exe
  C:\Windows\System\HjwoHRe.exe
  2⤵
  PID:8760
- C:\Windows\System\mnRaPub.exe
  C:\Windows\System\mnRaPub.exe
  2⤵
  PID:8780
- C:\Windows\System\TRSRiUt.exe
  C:\Windows\System\TRSRiUt.exe
  2⤵
  PID:8808
- C:\Windows\System\pKRKguh.exe
  C:\Windows\System\pKRKguh.exe
  2⤵
  PID:8832
- C:\Windows\System\TUXkDql.exe
  C:\Windows\System\TUXkDql.exe
  2⤵
  PID:8872
- C:\Windows\System\mCWoOJS.exe
  C:\Windows\System\mCWoOJS.exe
  2⤵
  PID:8900
- C:\Windows\System\nPvwdAk.exe
  C:\Windows\System\nPvwdAk.exe
  2⤵
  PID:8920
- C:\Windows\System\yrUOlTm.exe
  C:\Windows\System\yrUOlTm.exe
  2⤵
  PID:8944
- C:\Windows\System\ZbBhdeN.exe
  C:\Windows\System\ZbBhdeN.exe
  2⤵
  PID:8968
- C:\Windows\System\HAYanaE.exe
  C:\Windows\System\HAYanaE.exe
  2⤵
  PID:8996
- C:\Windows\System\PBYHYot.exe
  C:\Windows\System\PBYHYot.exe
  2⤵
  PID:9044
- C:\Windows\System\ZrlOXsr.exe
  C:\Windows\System\ZrlOXsr.exe
  2⤵
  PID:9072
- C:\Windows\System\FFSkinO.exe
  C:\Windows\System\FFSkinO.exe
  2⤵
  PID:9088
- C:\Windows\System\cTAawwZ.exe
  C:\Windows\System\cTAawwZ.exe
  2⤵
  PID:9120
- C:\Windows\System\pyYSvoh.exe
  C:\Windows\System\pyYSvoh.exe
  2⤵
  PID:9156
- C:\Windows\System\BVIYZai.exe
  C:\Windows\System\BVIYZai.exe
  2⤵
  PID:9184
- C:\Windows\System\Kzinkhz.exe
  C:\Windows\System\Kzinkhz.exe
  2⤵
  PID:7448
- C:\Windows\System\mhJcVsA.exe
  C:\Windows\System\mhJcVsA.exe
  2⤵
  PID:8200
- C:\Windows\System\wNcPgOZ.exe
  C:\Windows\System\wNcPgOZ.exe
  2⤵
  PID:8256
- C:\Windows\System\RbkkpsH.exe
  C:\Windows\System\RbkkpsH.exe
  2⤵
  PID:8304
- C:\Windows\System\ClNrBSA.exe
  C:\Windows\System\ClNrBSA.exe
  2⤵
  PID:8380
- C:\Windows\System\kJNxtVM.exe
  C:\Windows\System\kJNxtVM.exe
  2⤵
  PID:8448
- C:\Windows\System\NArmniM.exe
  C:\Windows\System\NArmniM.exe
  2⤵
  PID:8520
- C:\Windows\System\muVfMfx.exe
  C:\Windows\System\muVfMfx.exe
  2⤵
  PID:8568
- C:\Windows\System\PGRluZq.exe
  C:\Windows\System\PGRluZq.exe
  2⤵
  PID:8664
- C:\Windows\System\rbjOvnk.exe
  C:\Windows\System\rbjOvnk.exe
  2⤵
  PID:8720
- C:\Windows\System\DqRQrtn.exe
  C:\Windows\System\DqRQrtn.exe
  2⤵
  PID:8772
- C:\Windows\System\jVSfZKA.exe
  C:\Windows\System\jVSfZKA.exe
  2⤵
  PID:8824
- C:\Windows\System\ZbXURbJ.exe
  C:\Windows\System\ZbXURbJ.exe
  2⤵
  PID:8892
- C:\Windows\System\DumRtcA.exe
  C:\Windows\System\DumRtcA.exe
  2⤵
  PID:8992
- C:\Windows\System\ErnCGgY.exe
  C:\Windows\System\ErnCGgY.exe
  2⤵
  PID:9060
- C:\Windows\System\UOufYSw.exe
  C:\Windows\System\UOufYSw.exe
  2⤵
  PID:9080
- C:\Windows\System\pNEyVGh.exe
  C:\Windows\System\pNEyVGh.exe
  2⤵
  PID:9196
- C:\Windows\System\MGemQHj.exe
  C:\Windows\System\MGemQHj.exe
  2⤵
  PID:8220
- C:\Windows\System\OvNJqZI.exe
  C:\Windows\System\OvNJqZI.exe
  2⤵
  PID:8368
- C:\Windows\System\ZnoWYLP.exe
  C:\Windows\System\ZnoWYLP.exe
  2⤵
  PID:8536
- C:\Windows\System\AZHXnGv.exe
  C:\Windows\System\AZHXnGv.exe
  2⤵
  PID:8468
- C:\Windows\System\DdjxBsL.exe
  C:\Windows\System\DdjxBsL.exe
  2⤵
  PID:8800
- C:\Windows\System\tbnBwpZ.exe
  C:\Windows\System\tbnBwpZ.exe
  2⤵
  PID:8852
- C:\Windows\System\JCUUQKB.exe
  C:\Windows\System\JCUUQKB.exe
  2⤵
  PID:9136
- C:\Windows\System\TyJMitL.exe
  C:\Windows\System\TyJMitL.exe
  2⤵
  PID:9204
- C:\Windows\System\GszoNTn.exe
  C:\Windows\System\GszoNTn.exe
  2⤵
  PID:8492
- C:\Windows\System\YCFglDs.exe
  C:\Windows\System\YCFglDs.exe
  2⤵
  PID:8816
- C:\Windows\System\NcxdRmh.exe
  C:\Windows\System\NcxdRmh.exe
  2⤵
  PID:8632
- C:\Windows\System\LEWAHdQ.exe
  C:\Windows\System\LEWAHdQ.exe
  2⤵
  PID:8420
- C:\Windows\System\RTOEOJJ.exe
  C:\Windows\System\RTOEOJJ.exe
  2⤵
  PID:9232
- C:\Windows\System\FYkHywR.exe
  C:\Windows\System\FYkHywR.exe
  2⤵
  PID:9260
- C:\Windows\System\aNHYeyh.exe
  C:\Windows\System\aNHYeyh.exe
  2⤵
  PID:9288
- C:\Windows\System\qPCWczY.exe
  C:\Windows\System\qPCWczY.exe
  2⤵
  PID:9304
- C:\Windows\System\RzygKLr.exe
  C:\Windows\System\RzygKLr.exe
  2⤵
  PID:9328
- C:\Windows\System\qqlLGxF.exe
  C:\Windows\System\qqlLGxF.exe
  2⤵
  PID:9364
- C:\Windows\System\JHehiuF.exe
  C:\Windows\System\JHehiuF.exe
  2⤵
  PID:9400
- C:\Windows\System\oEFRCnM.exe
  C:\Windows\System\oEFRCnM.exe
  2⤵
  PID:9416
- C:\Windows\System\aNFJpXt.exe
  C:\Windows\System\aNFJpXt.exe
  2⤵
  PID:9456
- C:\Windows\System\UxhjAvO.exe
  C:\Windows\System\UxhjAvO.exe
  2⤵
  PID:9472
- C:\Windows\System\miabYLX.exe
  C:\Windows\System\miabYLX.exe
  2⤵
  PID:9488
- C:\Windows\System\uyrdYpw.exe
  C:\Windows\System\uyrdYpw.exe
  2⤵
  PID:9504
- C:\Windows\System\RuFpsKQ.exe
  C:\Windows\System\RuFpsKQ.exe
  2⤵
  PID:9552
- C:\Windows\System\oqiJJng.exe
  C:\Windows\System\oqiJJng.exe
  2⤵
  PID:9576
- C:\Windows\System\JmxyNEY.exe
  C:\Windows\System\JmxyNEY.exe
  2⤵
  PID:9612
- C:\Windows\System\ANIdvQX.exe
  C:\Windows\System\ANIdvQX.exe
  2⤵
  PID:9652
- C:\Windows\System\edseZri.exe
  C:\Windows\System\edseZri.exe
  2⤵
  PID:9680
- C:\Windows\System\RHZROSs.exe
  C:\Windows\System\RHZROSs.exe
  2⤵
  PID:9708
- C:\Windows\System\NCNLKdG.exe
  C:\Windows\System\NCNLKdG.exe
  2⤵
  PID:9736
- C:\Windows\System\cvFXFqp.exe
  C:\Windows\System\cvFXFqp.exe
  2⤵
  PID:9752
- C:\Windows\System\MDFGWAN.exe
  C:\Windows\System\MDFGWAN.exe
  2⤵
  PID:9792
- C:\Windows\System\yTkRCpo.exe
  C:\Windows\System\yTkRCpo.exe
  2⤵
  PID:9820
- C:\Windows\System\MIDrExZ.exe
  C:\Windows\System\MIDrExZ.exe
  2⤵
  PID:9840
- C:\Windows\System\ctNQnFH.exe
  C:\Windows\System\ctNQnFH.exe
  2⤵
  PID:9868
- C:\Windows\System\DODafOK.exe
  C:\Windows\System\DODafOK.exe
  2⤵
  PID:9904
- C:\Windows\System\cAzZtVA.exe
  C:\Windows\System\cAzZtVA.exe
  2⤵
  PID:9920
- C:\Windows\System\hqpcYdA.exe
  C:\Windows\System\hqpcYdA.exe
  2⤵
  PID:9960
- C:\Windows\System\jZOeRUf.exe
  C:\Windows\System\jZOeRUf.exe
  2⤵
  PID:9976
- C:\Windows\System\tTUMOai.exe
  C:\Windows\System\tTUMOai.exe
  2⤵
  PID:10004
- C:\Windows\System\AEikqhS.exe
  C:\Windows\System\AEikqhS.exe
  2⤵
  PID:10028
- C:\Windows\System\gmbQInt.exe
  C:\Windows\System\gmbQInt.exe
  2⤵
  PID:10064
- C:\Windows\System\hzsPYZa.exe
  C:\Windows\System\hzsPYZa.exe
  2⤵
  PID:10092
- C:\Windows\System\IGnnkjO.exe
  C:\Windows\System\IGnnkjO.exe
  2⤵
  PID:10120
- C:\Windows\System\yoDmWmu.exe
  C:\Windows\System\yoDmWmu.exe
  2⤵
  PID:10160
- C:\Windows\System\XyZzDaf.exe
  C:\Windows\System\XyZzDaf.exe
  2⤵
  PID:10180
- C:\Windows\System\xVAEBhU.exe
  C:\Windows\System\xVAEBhU.exe
  2⤵
  PID:10204
- C:\Windows\System\DhXfcVG.exe
  C:\Windows\System\DhXfcVG.exe
  2⤵
  PID:10224
- C:\Windows\System\uDZVUWI.exe
  C:\Windows\System\uDZVUWI.exe
  2⤵
  PID:9252
- C:\Windows\System\LMpNBHe.exe
  C:\Windows\System\LMpNBHe.exe
  2⤵
  PID:9316
- C:\Windows\System\jLKZAcK.exe
  C:\Windows\System\jLKZAcK.exe
  2⤵
  PID:9384
- C:\Windows\System\NkFoTDs.exe
  C:\Windows\System\NkFoTDs.exe
  2⤵
  PID:9484
- C:\Windows\System\DUWAQwH.exe
  C:\Windows\System\DUWAQwH.exe
  2⤵
  PID:9496
- C:\Windows\System\gttkXoL.exe
  C:\Windows\System\gttkXoL.exe
  2⤵
  PID:9592
- C:\Windows\System\tNdGqXz.exe
  C:\Windows\System\tNdGqXz.exe
  2⤵
  PID:9672
- C:\Windows\System\pKufCZV.exe
  C:\Windows\System\pKufCZV.exe
  2⤵
  PID:9744
- C:\Windows\System\XgkiRtL.exe
  C:\Windows\System\XgkiRtL.exe
  2⤵
  PID:9836
- C:\Windows\System\lYqcMIs.exe
  C:\Windows\System\lYqcMIs.exe
  2⤵
  PID:9828
- C:\Windows\System\KKFKIdu.exe
  C:\Windows\System\KKFKIdu.exe
  2⤵
  PID:9900
- C:\Windows\System\wpitbFW.exe
  C:\Windows\System\wpitbFW.exe
  2⤵
  PID:9936
- C:\Windows\System\kYAGhLb.exe
  C:\Windows\System\kYAGhLb.exe
  2⤵
  PID:10020
- C:\Windows\System\IDdAScQ.exe
  C:\Windows\System\IDdAScQ.exe
  2⤵
  PID:10084
- C:\Windows\System\Blmpgcq.exe
  C:\Windows\System\Blmpgcq.exe
  2⤵
  PID:10116
- C:\Windows\System\aPEsrfh.exe
  C:\Windows\System\aPEsrfh.exe
  2⤵
  PID:10196
- C:\Windows\System\KXzosGk.exe
  C:\Windows\System\KXzosGk.exe
  2⤵
  PID:9412
- C:\Windows\System\dTeZulk.exe
  C:\Windows\System\dTeZulk.exe
  2⤵
  PID:9500
- C:\Windows\System\DxtmJxC.exe
  C:\Windows\System\DxtmJxC.exe
  2⤵
  PID:9676
- C:\Windows\System\PBVPmBp.exe
  C:\Windows\System\PBVPmBp.exe
  2⤵
  PID:9788
- C:\Windows\System\FwAGnjf.exe
  C:\Windows\System\FwAGnjf.exe
  2⤵
  PID:10056
- C:\Windows\System\CndBKQZ.exe
  C:\Windows\System\CndBKQZ.exe
  2⤵
  PID:10156
- C:\Windows\System\KpxnvtV.exe
  C:\Windows\System\KpxnvtV.exe
  2⤵
  PID:8460
- C:\Windows\System\KxUNqHK.exe
  C:\Windows\System\KxUNqHK.exe
  2⤵
  PID:9728
- C:\Windows\System\AqBlEuE.exe
  C:\Windows\System\AqBlEuE.exe
  2⤵
  PID:10168
- C:\Windows\System\jucfGxJ.exe
  C:\Windows\System\jucfGxJ.exe
  2⤵
  PID:9664
- C:\Windows\System\umOgaUI.exe
  C:\Windows\System\umOgaUI.exe
  2⤵
  PID:9912
- C:\Windows\System\ucYIUPq.exe
  C:\Windows\System\ucYIUPq.exe
  2⤵
  PID:10252
- C:\Windows\System\KEOBPQi.exe
  C:\Windows\System\KEOBPQi.exe
  2⤵
  PID:10284
- C:\Windows\System\AbbZtYi.exe
  C:\Windows\System\AbbZtYi.exe
  2⤵
  PID:10308
- C:\Windows\System\QEtLWoj.exe
  C:\Windows\System\QEtLWoj.exe
  2⤵
  PID:10336
- C:\Windows\System\aTOAaVg.exe
  C:\Windows\System\aTOAaVg.exe
  2⤵
  PID:10368
- C:\Windows\System\mqOQlxx.exe
  C:\Windows\System\mqOQlxx.exe
  2⤵
  PID:10392
- C:\Windows\System\ENewEUh.exe
  C:\Windows\System\ENewEUh.exe
  2⤵
  PID:10432
- C:\Windows\System\qMSWgoA.exe
  C:\Windows\System\qMSWgoA.exe
  2⤵
  PID:10452
- C:\Windows\System\qAKAGJP.exe
  C:\Windows\System\qAKAGJP.exe
  2⤵
  PID:10488
- C:\Windows\System\BYqRgiM.exe
  C:\Windows\System\BYqRgiM.exe
  2⤵
  PID:10512
- C:\Windows\System\WIayukG.exe
  C:\Windows\System\WIayukG.exe
  2⤵
  PID:10548
- C:\Windows\System\sPqElCN.exe
  C:\Windows\System\sPqElCN.exe
  2⤵
  PID:10576
- C:\Windows\System\pEYVOQa.exe
  C:\Windows\System\pEYVOQa.exe
  2⤵
  PID:10604
- C:\Windows\System\ftgMjkP.exe
  C:\Windows\System\ftgMjkP.exe
  2⤵
  PID:10632
- C:\Windows\System\GVuvEWm.exe
  C:\Windows\System\GVuvEWm.exe
  2⤵
  PID:10660
- C:\Windows\System\BNgkUDr.exe
  C:\Windows\System\BNgkUDr.exe
  2⤵
  PID:10688
- C:\Windows\System\cyHsRLg.exe
  C:\Windows\System\cyHsRLg.exe
  2⤵
  PID:10708
- C:\Windows\System\OBNOXPg.exe
  C:\Windows\System\OBNOXPg.exe
  2⤵
  PID:10732
- C:\Windows\System\yfXRRkN.exe
  C:\Windows\System\yfXRRkN.exe
  2⤵
  PID:10748
- C:\Windows\System\TPQejoA.exe
  C:\Windows\System\TPQejoA.exe
  2⤵
  PID:10780
- C:\Windows\System\yxJhfyi.exe
  C:\Windows\System\yxJhfyi.exe
  2⤵
  PID:10812
- C:\Windows\System\kxGnDKZ.exe
  C:\Windows\System\kxGnDKZ.exe
  2⤵
  PID:10844
- C:\Windows\System\leojwSK.exe
  C:\Windows\System\leojwSK.exe
  2⤵
  PID:10876
- C:\Windows\System\QgfisnY.exe
  C:\Windows\System\QgfisnY.exe
  2⤵
  PID:10908
- C:\Windows\System\qZSosIj.exe
  C:\Windows\System\qZSosIj.exe
  2⤵
  PID:10932
- C:\Windows\System\jwJqAnL.exe
  C:\Windows\System\jwJqAnL.exe
  2⤵
  PID:10960
- C:\Windows\System\juGttfN.exe
  C:\Windows\System\juGttfN.exe
  2⤵
  PID:10996
- C:\Windows\System\bWOfYit.exe
  C:\Windows\System\bWOfYit.exe
  2⤵
  PID:11024
- C:\Windows\System\uLZkmdC.exe
  C:\Windows\System\uLZkmdC.exe
  2⤵
  PID:11048
- C:\Windows\System\EQQaSuO.exe
  C:\Windows\System\EQQaSuO.exe
  2⤵
  PID:11080
- C:\Windows\System\JLQasvE.exe
  C:\Windows\System\JLQasvE.exe
  2⤵
  PID:11096
- C:\Windows\System\UmHMseC.exe
  C:\Windows\System\UmHMseC.exe
  2⤵
  PID:11128
- C:\Windows\System\VhdJczn.exe
  C:\Windows\System\VhdJczn.exe
  2⤵
  PID:11160
- C:\Windows\System\oisuZFz.exe
  C:\Windows\System\oisuZFz.exe
  2⤵
  PID:11196
- C:\Windows\System\oVPlXdg.exe
  C:\Windows\System\oVPlXdg.exe
  2⤵
  PID:11216
- C:\Windows\System\TpByqHu.exe
  C:\Windows\System\TpByqHu.exe
  2⤵
  PID:11240
- C:\Windows\System\kGRbcoN.exe
  C:\Windows\System\kGRbcoN.exe
  2⤵
  PID:10244
- C:\Windows\System\YSaduhV.exe
  C:\Windows\System\YSaduhV.exe
  2⤵
  PID:10304
- C:\Windows\System\vjNpFkm.exe
  C:\Windows\System\vjNpFkm.exe
  2⤵
  PID:10364
- C:\Windows\System\jyTCukW.exe
  C:\Windows\System\jyTCukW.exe
  2⤵
  PID:10444
- C:\Windows\System\sfMiUSE.exe
  C:\Windows\System\sfMiUSE.exe
  2⤵
  PID:10520
- C:\Windows\System\yqEKUcr.exe
  C:\Windows\System\yqEKUcr.exe
  2⤵
  PID:10600
- C:\Windows\System\XdlvcBs.exe
  C:\Windows\System\XdlvcBs.exe
  2⤵
  PID:10628
- C:\Windows\System\AAMvtqQ.exe
  C:\Windows\System\AAMvtqQ.exe
  2⤵
  PID:10724
- C:\Windows\System\KmbmHLR.exe
  C:\Windows\System\KmbmHLR.exe
  2⤵
  PID:10760
- C:\Windows\System\mgZeUAd.exe
  C:\Windows\System\mgZeUAd.exe
  2⤵
  PID:10860
- C:\Windows\System\oukcrPt.exe
  C:\Windows\System\oukcrPt.exe
  2⤵
  PID:10896
- C:\Windows\System\OmAHRaG.exe
  C:\Windows\System\OmAHRaG.exe
  2⤵
  PID:10924
- C:\Windows\System\fgxtVoF.exe
  C:\Windows\System\fgxtVoF.exe
  2⤵
  PID:11056
- C:\Windows\System\yDkCEqw.exe
  C:\Windows\System\yDkCEqw.exe
  2⤵
  PID:11108
- C:\Windows\System\tZZnClH.exe
  C:\Windows\System\tZZnClH.exe
  2⤵
  PID:11188
- C:\Windows\System\btKwBKg.exe
  C:\Windows\System\btKwBKg.exe
  2⤵
  PID:11232
- C:\Windows\System\stzsheR.exe
  C:\Windows\System\stzsheR.exe
  2⤵
  PID:10292
- C:\Windows\System\qRKlciv.exe
  C:\Windows\System\qRKlciv.exe
  2⤵
  PID:10496
- C:\Windows\System\CSKnXAR.exe
  C:\Windows\System\CSKnXAR.exe
  2⤵
  PID:10656
- C:\Windows\System\hPoLNSg.exe
  C:\Windows\System\hPoLNSg.exe
  2⤵
  PID:10808
- C:\Windows\System\IMituXz.exe
  C:\Windows\System\IMituXz.exe
  2⤵
  PID:10952
- C:\Windows\System\vTgLTSd.exe
  C:\Windows\System\vTgLTSd.exe
  2⤵
  PID:11088
- C:\Windows\System\aemUWNH.exe
  C:\Windows\System\aemUWNH.exe
  2⤵
  PID:11208
- C:\Windows\System\nQQuIiw.exe
  C:\Windows\System\nQQuIiw.exe
  2⤵
  PID:10404
- C:\Windows\System\polhFFU.exe
  C:\Windows\System\polhFFU.exe
  2⤵
  PID:10704
- C:\Windows\System\wmCZBhT.exe
  C:\Windows\System\wmCZBhT.exe
  2⤵
  PID:10864
- C:\Windows\System\mLKtVVi.exe
  C:\Windows\System\mLKtVVi.exe
  2⤵
  PID:11280
- C:\Windows\System\JRjaPPn.exe
  C:\Windows\System\JRjaPPn.exe
  2⤵
  PID:11296
- C:\Windows\System\xUFYNNY.exe
  C:\Windows\System\xUFYNNY.exe
  2⤵
  PID:11324
- C:\Windows\System\yPvLEiU.exe
  C:\Windows\System\yPvLEiU.exe
  2⤵
  PID:11360
- C:\Windows\System\JCXQKdd.exe
  C:\Windows\System\JCXQKdd.exe
  2⤵
  PID:11380
- C:\Windows\System\gIwlaiL.exe
  C:\Windows\System\gIwlaiL.exe
  2⤵
  PID:11408
- C:\Windows\System\ihfpjSf.exe
  C:\Windows\System\ihfpjSf.exe
  2⤵
  PID:11436
- C:\Windows\System\NcoIWcg.exe
  C:\Windows\System\NcoIWcg.exe
  2⤵
  PID:11468
- C:\Windows\System\JCxyFTF.exe
  C:\Windows\System\JCxyFTF.exe
  2⤵
  PID:11492
- C:\Windows\System\FmEZEEh.exe
  C:\Windows\System\FmEZEEh.exe
  2⤵
  PID:11520
- C:\Windows\System\kFbvwZi.exe
  C:\Windows\System\kFbvwZi.exe
  2⤵
  PID:11572
- C:\Windows\System\HyZXoau.exe
  C:\Windows\System\HyZXoau.exe
  2⤵
  PID:11600
- C:\Windows\System\CzPsiPA.exe
  C:\Windows\System\CzPsiPA.exe
  2⤵
  PID:11616
- C:\Windows\System\gfUzmfP.exe
  C:\Windows\System\gfUzmfP.exe
  2⤵
  PID:11636
- C:\Windows\System\TrhnxeY.exe
  C:\Windows\System\TrhnxeY.exe
  2⤵
  PID:11660
- C:\Windows\System\iZOwnMN.exe
  C:\Windows\System\iZOwnMN.exe
  2⤵
  PID:11688
- C:\Windows\System\PDGAXqV.exe
  C:\Windows\System\PDGAXqV.exe
  2⤵
  PID:11712
- C:\Windows\System\dFVWiOv.exe
  C:\Windows\System\dFVWiOv.exe
  2⤵
  PID:11760
- C:\Windows\System\oilSQkX.exe
  C:\Windows\System\oilSQkX.exe
  2⤵
  PID:11792
- C:\Windows\System\kOVMMRF.exe
  C:\Windows\System\kOVMMRF.exe
  2⤵
  PID:11824
- C:\Windows\System\mllOVzX.exe
  C:\Windows\System\mllOVzX.exe
  2⤵
  PID:11840
- C:\Windows\System\QOClxHx.exe
  C:\Windows\System\QOClxHx.exe
  2⤵
  PID:11880
- C:\Windows\System\cQCmdmS.exe
  C:\Windows\System\cQCmdmS.exe
  2⤵
  PID:11908
- C:\Windows\System\pxdzntO.exe
  C:\Windows\System\pxdzntO.exe
  2⤵
  PID:11936
- C:\Windows\System\XmMozzH.exe
  C:\Windows\System\XmMozzH.exe
  2⤵
  PID:11964
- C:\Windows\System\FgqGSED.exe
  C:\Windows\System\FgqGSED.exe
  2⤵
  PID:11992
- C:\Windows\System\aAoJIPc.exe
  C:\Windows\System\aAoJIPc.exe
  2⤵
  PID:12020
- C:\Windows\System\QPzjjrY.exe
  C:\Windows\System\QPzjjrY.exe
  2⤵
  PID:12064
- C:\Windows\System\RPDznTJ.exe
  C:\Windows\System\RPDznTJ.exe
  2⤵
  PID:12084
- C:\Windows\System\tysUfGI.exe
  C:\Windows\System\tysUfGI.exe
  2⤵
  PID:12112
- C:\Windows\System\CkrTDDV.exe
  C:\Windows\System\CkrTDDV.exe
  2⤵
  PID:12128
- C:\Windows\System\sBTGwOw.exe
  C:\Windows\System\sBTGwOw.exe
  2⤵
  PID:12184
- C:\Windows\System\bsLYLnb.exe
  C:\Windows\System\bsLYLnb.exe
  2⤵
  PID:12208
- C:\Windows\System\rJuDNqQ.exe
  C:\Windows\System\rJuDNqQ.exe
  2⤵
  PID:12232
- C:\Windows\System\tyVPoox.exe
  C:\Windows\System\tyVPoox.exe
  2⤵
  PID:12268
- C:\Windows\System\ofFFQVV.exe
  C:\Windows\System\ofFFQVV.exe
  2⤵
  PID:10624
- C:\Windows\System\iYWddXC.exe
  C:\Windows\System\iYWddXC.exe
  2⤵
  PID:11344
- C:\Windows\System\qlpITpI.exe
  C:\Windows\System\qlpITpI.exe
  2⤵
  PID:11428
- C:\Windows\System\RcAaqCs.exe
  C:\Windows\System\RcAaqCs.exe
  2⤵
  PID:11452
- C:\Windows\System\JiUnpgJ.exe
  C:\Windows\System\JiUnpgJ.exe
  2⤵
  PID:11568
- C:\Windows\System\dxbiYdD.exe
  C:\Windows\System\dxbiYdD.exe
  2⤵
  PID:11628
- C:\Windows\System\bixsFMp.exe
  C:\Windows\System\bixsFMp.exe
  2⤵
  PID:11708
- C:\Windows\System\tMaxRuN.exe
  C:\Windows\System\tMaxRuN.exe
  2⤵
  PID:11748
- C:\Windows\System\HQRgwAQ.exe
  C:\Windows\System\HQRgwAQ.exe
  2⤵
  PID:11772
- C:\Windows\System\JLisPIj.exe
  C:\Windows\System\JLisPIj.exe
  2⤵
  PID:11836
- C:\Windows\System\heBMYOr.exe
  C:\Windows\System\heBMYOr.exe
  2⤵
  PID:11900
- C:\Windows\System\mQnLpsT.exe
  C:\Windows\System\mQnLpsT.exe
  2⤵
  PID:11988
- C:\Windows\System\wgREpxu.exe
  C:\Windows\System\wgREpxu.exe
  2⤵
  PID:12052
- C:\Windows\System\wIhJJji.exe
  C:\Windows\System\wIhJJji.exe
  2⤵
  PID:12144
- C:\Windows\System\avvFguN.exe
  C:\Windows\System\avvFguN.exe
  2⤵
  PID:12200
- C:\Windows\System\ENmRaDv.exe
  C:\Windows\System\ENmRaDv.exe
  2⤵
  PID:12256
- C:\Windows\System\ROrKPGd.exe
  C:\Windows\System\ROrKPGd.exe
  2⤵
  PID:11392
- C:\Windows\System\FQGFjhw.exe
  C:\Windows\System\FQGFjhw.exe
  2⤵
  PID:11508
- C:\Windows\System\OTGHPSj.exe
  C:\Windows\System\OTGHPSj.exe
  2⤵
  PID:11704
- C:\Windows\System\NNGOwoI.exe
  C:\Windows\System\NNGOwoI.exe
  2⤵
  PID:11816
- C:\Windows\System\FzFAudt.exe
  C:\Windows\System\FzFAudt.exe
  2⤵
  PID:11948
- C:\Windows\System\FhlWQcy.exe
  C:\Windows\System\FhlWQcy.exe
  2⤵
  PID:12120
- C:\Windows\System\bVTmeTZ.exe
  C:\Windows\System\bVTmeTZ.exe
  2⤵
  PID:10620
- C:\Windows\System\jmlWKqP.exe
  C:\Windows\System\jmlWKqP.exe
  2⤵
  PID:11476
- C:\Windows\System\euuNxmE.exe
  C:\Windows\System\euuNxmE.exe
  2⤵
  PID:12100
- C:\Windows\System\KqkufhI.exe
  C:\Windows\System\KqkufhI.exe
  2⤵
  PID:11292
- C:\Windows\System\FdmKhZT.exe
  C:\Windows\System\FdmKhZT.exe
  2⤵
  PID:12004
- C:\Windows\System\rsrrJrU.exe
  C:\Windows\System\rsrrJrU.exe
  2⤵
  PID:12296
- C:\Windows\System\AgXqHHZ.exe
  C:\Windows\System\AgXqHHZ.exe
  2⤵
  PID:12324
- C:\Windows\System\HPCvRCv.exe
  C:\Windows\System\HPCvRCv.exe
  2⤵
  PID:12356
- C:\Windows\System\IOImhpg.exe
  C:\Windows\System\IOImhpg.exe
  2⤵
  PID:12380
- C:\Windows\System\dHxobhG.exe
  C:\Windows\System\dHxobhG.exe
  2⤵
  PID:12412
- C:\Windows\System\yFmxRlW.exe
  C:\Windows\System\yFmxRlW.exe
  2⤵
  PID:12436
- C:\Windows\System\yXgVRFP.exe
  C:\Windows\System\yXgVRFP.exe
  2⤵
  PID:12464
- C:\Windows\System\WfNXLpM.exe
  C:\Windows\System\WfNXLpM.exe
  2⤵
  PID:12492
- C:\Windows\System\rcAtRZh.exe
  C:\Windows\System\rcAtRZh.exe
  2⤵
  PID:12512
- C:\Windows\System\dfypYNV.exe
  C:\Windows\System\dfypYNV.exe
  2⤵
  PID:12548
- C:\Windows\System\rKmFSXG.exe
  C:\Windows\System\rKmFSXG.exe
  2⤵
  PID:12588
- C:\Windows\System\nYyLyEu.exe
  C:\Windows\System\nYyLyEu.exe
  2⤵
  PID:12612
- C:\Windows\System\IuJShZS.exe
  C:\Windows\System\IuJShZS.exe
  2⤵
  PID:12644
- C:\Windows\System\KMLhwbt.exe
  C:\Windows\System\KMLhwbt.exe
  2⤵
  PID:12672
- C:\Windows\System\eHMoQup.exe
  C:\Windows\System\eHMoQup.exe
  2⤵
  PID:12700
- C:\Windows\System\KnBWDuC.exe
  C:\Windows\System\KnBWDuC.exe
  2⤵
  PID:12728
- C:\Windows\System\ejGHKSv.exe
  C:\Windows\System\ejGHKSv.exe
  2⤵
  PID:12756
- C:\Windows\System\xqajVQB.exe
  C:\Windows\System\xqajVQB.exe
  2⤵
  PID:12788
- C:\Windows\System\XEEtZmt.exe
  C:\Windows\System\XEEtZmt.exe
  2⤵
  PID:12828
- C:\Windows\System\QvHlJbl.exe
  C:\Windows\System\QvHlJbl.exe
  2⤵
  PID:12856
- C:\Windows\System\yNRQvmm.exe
  C:\Windows\System\yNRQvmm.exe
  2⤵
  PID:12876
- C:\Windows\System\YSrOUoa.exe
  C:\Windows\System\YSrOUoa.exe
  2⤵
  PID:12900
- C:\Windows\System\SZMQXEQ.exe
  C:\Windows\System\SZMQXEQ.exe
  2⤵
  PID:12928
- C:\Windows\System\iMeUfQq.exe
  C:\Windows\System\iMeUfQq.exe
  2⤵
  PID:12956
- C:\Windows\System\xsbyRWt.exe
  C:\Windows\System\xsbyRWt.exe
  2⤵
  PID:12980
- C:\Windows\System\qCthDAs.exe
  C:\Windows\System\qCthDAs.exe
  2⤵
  PID:13012
- C:\Windows\System\zCWNWWF.exe
  C:\Windows\System\zCWNWWF.exe
  2⤵
  PID:13040
- C:\Windows\System\gdKkSEx.exe
  C:\Windows\System\gdKkSEx.exe
  2⤵
  PID:13072
- C:\Windows\System\EqpjIDR.exe
  C:\Windows\System\EqpjIDR.exe
  2⤵
  PID:13100
- C:\Windows\System\iViASLh.exe
  C:\Windows\System\iViASLh.exe
  2⤵
  PID:13128
- C:\Windows\System\nWqgTTL.exe
  C:\Windows\System\nWqgTTL.exe
  2⤵
  PID:13156
- C:\Windows\System\khViyLQ.exe
  C:\Windows\System\khViyLQ.exe
  2⤵
  PID:13184
- C:\Windows\System\LXdMnta.exe
  C:\Windows\System\LXdMnta.exe
  2⤵
  PID:13224
- C:\Windows\System\vzaJTmV.exe
  C:\Windows\System\vzaJTmV.exe
  2⤵
  PID:13252
- C:\Windows\System\jYNqmVb.exe
  C:\Windows\System\jYNqmVb.exe
  2⤵
  PID:13268
- C:\Windows\System\BeaktiE.exe
  C:\Windows\System\BeaktiE.exe
  2⤵
  PID:13292
- C:\Windows\System\pvYlnDD.exe
  C:\Windows\System\pvYlnDD.exe
  2⤵
  PID:12320
- C:\Windows\System\xPsuTKD.exe
  C:\Windows\System\xPsuTKD.exe
  2⤵
  PID:12336
- C:\Windows\System\vhtTIpw.exe
  C:\Windows\System\vhtTIpw.exe
  2⤵
  PID:12456
- C:\Windows\System\GXnyzpH.exe
  C:\Windows\System\GXnyzpH.exe
  2⤵
  PID:12476
- C:\Windows\System\ZQEmBcR.exe
  C:\Windows\System\ZQEmBcR.exe
  2⤵
  PID:12532
- C:\Windows\System\HXTcKhX.exe
  C:\Windows\System\HXTcKhX.exe
  2⤵
  PID:12596
- C:\Windows\System\oLYXnos.exe
  C:\Windows\System\oLYXnos.exe
  2⤵
  PID:12640
- C:\Windows\System\TQshFrr.exe
  C:\Windows\System\TQshFrr.exe
  2⤵
  PID:12744
- C:\Windows\System\fcuMubT.exe
  C:\Windows\System\fcuMubT.exe
  2⤵
  PID:12816
- C:\Windows\System\RVICoyV.exe
  C:\Windows\System\RVICoyV.exe
  2⤵
  PID:12892
- C:\Windows\System\iKAfTbV.exe
  C:\Windows\System\iKAfTbV.exe
  2⤵
  PID:12952
- C:\Windows\System\zPYGWfK.exe
  C:\Windows\System\zPYGWfK.exe
  2⤵
  PID:12976
- C:\Windows\System\OrRTBYk.exe
  C:\Windows\System\OrRTBYk.exe
  2⤵
  PID:13064
- C:\Windows\System\fGjEIeB.exe
  C:\Windows\System\fGjEIeB.exe
  2⤵
  PID:13152
- C:\Windows\System\ngwzjIk.exe
  C:\Windows\System\ngwzjIk.exe
  2⤵
  PID:13288
- C:\Windows\System\RxTWJFO.exe
  C:\Windows\System\RxTWJFO.exe
  2⤵
  PID:12292
- C:\Windows\System\yWmlfEz.exe
  C:\Windows\System\yWmlfEz.exe
  2⤵
  PID:12428
- C:\Windows\System\CDdORwi.exe
  C:\Windows\System\CDdORwi.exe
  2⤵
  PID:12560
- C:\Windows\System\FEDAGEs.exe
  C:\Windows\System\FEDAGEs.exe
  2⤵
  PID:12712
- C:\Windows\System\fBzusza.exe
  C:\Windows\System\fBzusza.exe
  2⤵
  PID:12852
- C:\Windows\System\KxmuFBy.exe
  C:\Windows\System\KxmuFBy.exe
  2⤵
  PID:12888
- C:\Windows\System\kHBRmXN.exe
  C:\Windows\System\kHBRmXN.exe
  2⤵
  PID:13032
- C:\Windows\System\iCDRZVd.exe
  C:\Windows\System\iCDRZVd.exe
  2⤵
  PID:12340
- C:\Windows\System\ZNbDRzg.exe
  C:\Windows\System\ZNbDRzg.exe
  2⤵
  PID:12668
- C:\Windows\System\Urvcibj.exe
  C:\Windows\System\Urvcibj.exe
  2⤵
  PID:13084
- C:\Windows\System\rkHWcrH.exe
  C:\Windows\System\rkHWcrH.exe
  2⤵
  PID:12508
- C:\Windows\System\pPzZVxz.exe
  C:\Windows\System\pPzZVxz.exe
  2⤵
  PID:13020
- C:\Windows\System\ZWaJVgv.exe
  C:\Windows\System\ZWaJVgv.exe
  2⤵
  PID:13340
- C:\Windows\System\ptRecQj.exe
  C:\Windows\System\ptRecQj.exe
  2⤵
  PID:13360
- C:\Windows\System\TTQSDTp.exe
  C:\Windows\System\TTQSDTp.exe
  2⤵
  PID:13396
- C:\Windows\System\CbidMVl.exe
  C:\Windows\System\CbidMVl.exe
  2⤵
  PID:13424
- C:\Windows\System\qnuoNGo.exe
  C:\Windows\System\qnuoNGo.exe
  2⤵
  PID:13444
- C:\Windows\System\WGLwzCB.exe
  C:\Windows\System\WGLwzCB.exe
  2⤵
  PID:13472
- C:\Windows\System\pnwvptN.exe
  C:\Windows\System\pnwvptN.exe
  2⤵
  PID:13512
- C:\Windows\System\zQJsFfw.exe
  C:\Windows\System\zQJsFfw.exe
  2⤵
  PID:13540
- C:\Windows\System\eOkpLpW.exe
  C:\Windows\System\eOkpLpW.exe
  2⤵
  PID:13572
- C:\Windows\System\LIyXhwZ.exe
  C:\Windows\System\LIyXhwZ.exe
  2⤵
  PID:13596
- C:\Windows\System\DbBMMmc.exe
  C:\Windows\System\DbBMMmc.exe
  2⤵
  PID:13620
- C:\Windows\System\oBnoXlM.exe
  C:\Windows\System\oBnoXlM.exe
  2⤵
  PID:13644
- C:\Windows\System\oEtnJOF.exe
  C:\Windows\System\oEtnJOF.exe
  2⤵
  PID:13696
- C:\Windows\System\xWXVpvO.exe
  C:\Windows\System\xWXVpvO.exe
  2⤵
  PID:13712
- C:\Windows\System\YEszHBN.exe
  C:\Windows\System\YEszHBN.exe
  2⤵
  PID:13776
- C:\Windows\System\WwWmfYo.exe
  C:\Windows\System\WwWmfYo.exe
  2⤵
  PID:13792
- C:\Windows\System\JZIWjBd.exe
  C:\Windows\System\JZIWjBd.exe
  2⤵
  PID:13844
- C:\Windows\System\ggESJKG.exe
  C:\Windows\System\ggESJKG.exe
  2⤵
  PID:13876
- C:\Windows\System\XYdMAyE.exe
  C:\Windows\System\XYdMAyE.exe
  2⤵
  PID:13908
- C:\Windows\System\Ecpybkt.exe
  C:\Windows\System\Ecpybkt.exe
  2⤵
  PID:13940
- C:\Windows\System\UFpPzAR.exe
  C:\Windows\System\UFpPzAR.exe
  2⤵
  PID:13968
- C:\Windows\System\pPEyaBu.exe
  C:\Windows\System\pPEyaBu.exe
  2⤵
  PID:14012
- C:\Windows\System\aholIQo.exe
  C:\Windows\System\aholIQo.exe
  2⤵
  PID:14048
- C:\Windows\System\OFEJrlL.exe
  C:\Windows\System\OFEJrlL.exe
  2⤵
  PID:14080
- C:\Windows\System\uRZzHtv.exe
  C:\Windows\System\uRZzHtv.exe
  2⤵
  PID:14108
- C:\Windows\System\CFxXbFq.exe
  C:\Windows\System\CFxXbFq.exe
  2⤵
  PID:14148
- C:\Windows\System\jIRtVhi.exe
  C:\Windows\System\jIRtVhi.exe
  2⤵
  PID:14204
- C:\Windows\System\BZfiVdU.exe
  C:\Windows\System\BZfiVdU.exe
  2⤵
  PID:14220
- C:\Windows\System\EHqoofW.exe
  C:\Windows\System\EHqoofW.exe
  2⤵
  PID:14248
- C:\Windows\System\EyMxjcz.exe
  C:\Windows\System\EyMxjcz.exe
  2⤵
  PID:14280
- C:\Windows\System\teNSkZb.exe
  C:\Windows\System\teNSkZb.exe
  2⤵
  PID:14312
- C:\Windows\System\QRpKBus.exe
  C:\Windows\System\QRpKBus.exe
  2⤵
  PID:13324
- C:\Windows\System\hnBvwhB.exe
  C:\Windows\System\hnBvwhB.exe
  2⤵
  PID:13408
- C:\Windows\System\DaoDcpu.exe
  C:\Windows\System\DaoDcpu.exe
  2⤵
  PID:13492
- C:\Windows\System\eXaxLQJ.exe
  C:\Windows\System\eXaxLQJ.exe
  2⤵
  PID:13536
- C:\Windows\System\EHZItsn.exe
  C:\Windows\System\EHZItsn.exe
  2⤵
  PID:13704
- C:\Windows\System\LQWjVEg.exe
  C:\Windows\System\LQWjVEg.exe
  2⤵
  PID:13764
- C:\Windows\System\gfOohaq.exe
  C:\Windows\System\gfOohaq.exe
  2⤵
  PID:13868
- C:\Windows\System\MqRWthy.exe
  C:\Windows\System\MqRWthy.exe
  2⤵
  PID:13952
- C:\Windows\System\XjFvpBj.exe
  C:\Windows\System\XjFvpBj.exe
  2⤵
  PID:14000
- C:\Windows\System\YdwBfaH.exe
  C:\Windows\System\YdwBfaH.exe
  2⤵
  PID:14104
- C:\Windows\System\kgUZOMh.exe
  C:\Windows\System\kgUZOMh.exe
  2⤵
  PID:14172
- C:\Windows\System\TJurRtk.exe
  C:\Windows\System\TJurRtk.exe
  2⤵
  PID:14256
- C:\Windows\System\pMHQKEa.exe
  C:\Windows\System\pMHQKEa.exe
  2⤵
  PID:14324
- C:\Windows\System\eWzYPlb.exe
  C:\Windows\System\eWzYPlb.exe
  2⤵
  PID:13388
- C:\Windows\System\fUxfOpe.exe
  C:\Windows\System\fUxfOpe.exe
  2⤵
  PID:13616
- C:\Windows\System\NlGsLVz.exe
  C:\Windows\System\NlGsLVz.exe
  2⤵
  PID:13928
- C:\Windows\System\keSgZgR.exe
  C:\Windows\System\keSgZgR.exe
  2⤵
  PID:13992
- C:\Windows\System\oTLbgpR.exe
  C:\Windows\System\oTLbgpR.exe
  2⤵
  PID:12500
- C:\Windows\System\SKzQywE.exe
  C:\Windows\System\SKzQywE.exe
  2⤵
  PID:13732
- C:\Windows\System\tlBCMiE.exe
  C:\Windows\System\tlBCMiE.exe
  2⤵
  PID:14268
- C:\Windows\System\DQygBiL.exe
  C:\Windows\System\DQygBiL.exe
  2⤵
  PID:14240
- C:\Windows\System\YQwdrba.exe
  C:\Windows\System\YQwdrba.exe
  2⤵
  PID:14364
- C:\Windows\System\qpwasGv.exe
  C:\Windows\System\qpwasGv.exe
  2⤵
  PID:14392
- C:\Windows\System\VstOLrJ.exe
  C:\Windows\System\VstOLrJ.exe
  2⤵
  PID:14420
- C:\Windows\System\wVNeebT.exe
  C:\Windows\System\wVNeebT.exe
  2⤵
  PID:14448
- C:\Windows\System\WZcZpCi.exe
  C:\Windows\System\WZcZpCi.exe
  2⤵
  PID:14476
- C:\Windows\System\bzaIbpb.exe
  C:\Windows\System\bzaIbpb.exe
  2⤵
  PID:14504
- C:\Windows\System\fztIXcP.exe
  C:\Windows\System\fztIXcP.exe
  2⤵
  PID:14536
- C:\Windows\System\oKDIung.exe
  C:\Windows\System\oKDIung.exe
  2⤵
  PID:14560
- C:\Windows\System\CNTfmBi.exe
  C:\Windows\System\CNTfmBi.exe
  2⤵
  PID:14588
- C:\Windows\System\zjEeZRz.exe
  C:\Windows\System\zjEeZRz.exe
  2⤵
  PID:14616
- C:\Windows\System\NNTnuto.exe
  C:\Windows\System\NNTnuto.exe
  2⤵
  PID:14632
- C:\Windows\System\shGHOfd.exe
  C:\Windows\System\shGHOfd.exe
  2⤵
  PID:14668
- C:\Windows\System\fqJMRlQ.exe
  C:\Windows\System\fqJMRlQ.exe
  2⤵
  PID:14700
- C:\Windows\System\fzRYncI.exe
  C:\Windows\System\fzRYncI.exe
  2⤵
  PID:14720
- C:\Windows\System\aLznMzU.exe
  C:\Windows\System\aLznMzU.exe
  2⤵
  PID:14752
- C:\Windows\System\uJvvGEk.exe
  C:\Windows\System\uJvvGEk.exe
  2⤵
  PID:14776
- C:\Windows\System\sCtduZr.exe
  C:\Windows\System\sCtduZr.exe
  2⤵
  PID:14800
- C:\Windows\System\izVYIwc.exe
  C:\Windows\System\izVYIwc.exe
  2⤵
  PID:14828
- C:\Windows\System\tzZVtqQ.exe
  C:\Windows\System\tzZVtqQ.exe
  2⤵
  PID:14856
- C:\Windows\System\DOvFDir.exe
  C:\Windows\System\DOvFDir.exe
  2⤵
  PID:14884
- C:\Windows\System\bDGIibA.exe
  C:\Windows\System\bDGIibA.exe
  2⤵
  PID:14912
- C:\Windows\System\aRVOnTk.exe
  C:\Windows\System\aRVOnTk.exe
  2⤵
  PID:14940
- C:\Windows\System\qzdSqWD.exe
  C:\Windows\System\qzdSqWD.exe
  2⤵
  PID:14968
- C:\Windows\System\NviPnfy.exe
  C:\Windows\System\NviPnfy.exe
  2⤵
  PID:15000
- C:\Windows\System\NRpRuwW.exe
  C:\Windows\System\NRpRuwW.exe
  2⤵
  PID:15028
- C:\Windows\System\wpPIVib.exe
  C:\Windows\System\wpPIVib.exe
  2⤵
  PID:15064
- C:\Windows\System\TMnefth.exe
  C:\Windows\System\TMnefth.exe
  2⤵
  PID:15080
- C:\Windows\System\JSsTTCG.exe
  C:\Windows\System\JSsTTCG.exe
  2⤵
  PID:15108
- C:\Windows\System\CTlFvWZ.exe
  C:\Windows\System\CTlFvWZ.exe
  2⤵
  PID:15148
- C:\Windows\System\aymWthT.exe
  C:\Windows\System\aymWthT.exe
  2⤵
  PID:15176
- C:\Windows\System\cEmENEh.exe
  C:\Windows\System\cEmENEh.exe
  2⤵
  PID:15204
- C:\Windows\System\bAIfpvu.exe
  C:\Windows\System\bAIfpvu.exe
  2⤵
  PID:15220
- C:\Windows\System\LhEPWjJ.exe
  C:\Windows\System\LhEPWjJ.exe
  2⤵
  PID:15248
- C:\Windows\System\SsOYUhT.exe
  C:\Windows\System\SsOYUhT.exe
  2⤵
  PID:15288
- C:\Windows\System\SMrDsJj.exe
  C:\Windows\System\SMrDsJj.exe
  2⤵
  PID:15312
- C:\Windows\System\JTIAgFl.exe
  C:\Windows\System\JTIAgFl.exe
  2⤵
  PID:15332
- C:\Windows\System\LZruwMN.exe
  C:\Windows\System\LZruwMN.exe
  2⤵
  PID:13728
- C:\Windows\System\GTkSGXV.exe
  C:\Windows\System\GTkSGXV.exe
  2⤵
  PID:14412
- C:\Windows\System\gopLhCy.exe
  C:\Windows\System\gopLhCy.exe
  2⤵
  PID:14440
- C:\Windows\System\QPaHHaT.exe
  C:\Windows\System\QPaHHaT.exe
  2⤵
  PID:14544
- C:\Windows\System\rDKCnRF.exe
  C:\Windows\System\rDKCnRF.exe
  2⤵
  PID:14612
- C:\Windows\System\pWebCKW.exe
  C:\Windows\System\pWebCKW.exe
  2⤵
  PID:14684
- C:\Windows\System\fvurujl.exe
  C:\Windows\System\fvurujl.exe
  2⤵
  PID:14736
- C:\Windows\System\NGozsUQ.exe
  C:\Windows\System\NGozsUQ.exe
  2⤵
  PID:14792
- C:\Windows\System\ndrdRkC.exe
  C:\Windows\System\ndrdRkC.exe
  2⤵
  PID:14896
- C:\Windows\System\yPIYCZR.exe
  C:\Windows\System\yPIYCZR.exe
  2⤵
  PID:14932
- C:\Windows\System\twukmtz.exe
  C:\Windows\System\twukmtz.exe
  2⤵
  PID:15008
- C:\Windows\System\TdUisYI.exe
  C:\Windows\System\TdUisYI.exe
  2⤵
  PID:15060
- C:\Windows\System\lYHYAOe.exe
  C:\Windows\System\lYHYAOe.exe
  2⤵
  PID:15096
- C:\Windows\System\gOjaUvO.exe
  C:\Windows\System\gOjaUvO.exe
  2⤵
  PID:15188
- C:\Windows\System\hYBqakm.exe
  C:\Windows\System\hYBqakm.exe
  2⤵
  PID:15240
- C:\Windows\System\vmtmkxG.exe
  C:\Windows\System\vmtmkxG.exe
  2⤵
  PID:15328
- C:\Windows\System\gKbPmwH.exe
  C:\Windows\System\gKbPmwH.exe
  2⤵
  PID:15356
- C:\Windows\System\cRVCZwD.exe
  C:\Windows\System\cRVCZwD.exe
  2⤵
  PID:14520
- C:\Windows\System\QpCDNdY.exe
  C:\Windows\System\QpCDNdY.exe
  2⤵
  PID:14708
- C:\Windows\System\kzRlIJw.exe
  C:\Windows\System\kzRlIJw.exe
  2⤵
  PID:14784
- C:\Windows\System\xentnGC.exe
  C:\Windows\System\xentnGC.exe
  2⤵
  PID:14996
- C:\Windows\System\BXKWuJl.exe
  C:\Windows\System\BXKWuJl.exe
  2⤵
  PID:15164
- C:\Windows\System\blnHGlm.exe
  C:\Windows\System\blnHGlm.exe
  2⤵
  PID:15324
- C:\Windows\System\kOgzFhx.exe
  C:\Windows\System\kOgzFhx.exe
  2⤵
  PID:14500
- C:\Windows\System\xaEZiJV.exe
  C:\Windows\System\xaEZiJV.exe
  2⤵
  PID:14924
- C:\Windows\System\irxPhaS.exe
  C:\Windows\System\irxPhaS.exe
  2⤵
  PID:15260
- C:\Windows\System\OhQGJac.exe
  C:\Windows\System\OhQGJac.exe
  2⤵
  PID:14848
- C:\Windows\System\QPjBKuO.exe
  C:\Windows\System\QPjBKuO.exe
  2⤵
  PID:15344
- C:\Windows\System\HxlSLFd.exe
  C:\Windows\System\HxlSLFd.exe
  2⤵
  PID:15388
- C:\Windows\System\wAtuABo.exe
  C:\Windows\System\wAtuABo.exe
  2⤵
  PID:15416
- C:\Windows\System\hUoiUbb.exe
  C:\Windows\System\hUoiUbb.exe
  2⤵
  PID:15444
- C:\Windows\System\LbMacMM.exe
  C:\Windows\System\LbMacMM.exe
  2⤵
  PID:15472
- C:\Windows\System\qFvFZZW.exe
  C:\Windows\System\qFvFZZW.exe
  2⤵
  PID:15500
- C:\Windows\System\DybZztp.exe
  C:\Windows\System\DybZztp.exe
  2⤵
  PID:15528
- C:\Windows\System\htixlwV.exe
  C:\Windows\System\htixlwV.exe
  2⤵
  PID:15556
- C:\Windows\System\AaWnWSb.exe
  C:\Windows\System\AaWnWSb.exe
  2⤵
  PID:15584
- C:\Windows\System\XDUgkLb.exe
  C:\Windows\System\XDUgkLb.exe
  2⤵
  PID:15612
- C:\Windows\System\bTblkDU.exe
  C:\Windows\System\bTblkDU.exe
  2⤵
  PID:15640
- C:\Windows\System\FldNsoI.exe
  C:\Windows\System\FldNsoI.exe
  2⤵
  PID:15668
- C:\Windows\System\zUGbgpy.exe
  C:\Windows\System\zUGbgpy.exe
  2⤵
  PID:15696
- C:\Windows\System\eVjwNfZ.exe
  C:\Windows\System\eVjwNfZ.exe
  2⤵
  PID:15720
- C:\Windows\System\VGVkJfA.exe
  C:\Windows\System\VGVkJfA.exe
  2⤵
  PID:15752
- C:\Windows\System\MsJXQmR.exe
  C:\Windows\System\MsJXQmR.exe
  2⤵
  PID:15780
- C:\Windows\System\ojASJhj.exe
  C:\Windows\System\ojASJhj.exe
  2⤵
  PID:15804
- C:\Windows\System\KaAvBtU.exe
  C:\Windows\System\KaAvBtU.exe
  2⤵
  PID:15828
- C:\Windows\System\XAEdkrw.exe
  C:\Windows\System\XAEdkrw.exe
  2⤵
  PID:15852
- C:\Windows\System\erFwQkY.exe
  C:\Windows\System\erFwQkY.exe
  2⤵
  PID:15892
- C:\Windows\System\PamxOXB.exe
  C:\Windows\System\PamxOXB.exe
  2⤵
  PID:15920
- C:\Windows\System\JkPeKOO.exe
  C:\Windows\System\JkPeKOO.exe
  2⤵
  PID:15948
- C:\Windows\System\xvgFqQm.exe
  C:\Windows\System\xvgFqQm.exe
  2⤵
  PID:15976
- C:\Windows\System\oCNCFWA.exe
  C:\Windows\System\oCNCFWA.exe
  2⤵
  PID:16040
- C:\Windows\System\xQzirTg.exe
  C:\Windows\System\xQzirTg.exe
  2⤵
  PID:16080
- C:\Windows\System\abhNpNT.exe
  C:\Windows\System\abhNpNT.exe
  2⤵
  PID:16100
- C:\Windows\System\cAGPBSk.exe
  C:\Windows\System\cAGPBSk.exe
  2⤵
  PID:16128
- C:\Windows\System\jfhURNq.exe
  C:\Windows\System\jfhURNq.exe
  2⤵
  PID:16156
- C:\Windows\System\jWjJKOe.exe
  C:\Windows\System\jWjJKOe.exe
  2⤵
  PID:16184
- C:\Windows\System\RsitSwy.exe
  C:\Windows\System\RsitSwy.exe
  2⤵
  PID:16212
- C:\Windows\System\HaFNPXD.exe
  C:\Windows\System\HaFNPXD.exe
  2⤵
  PID:16240
- C:\Windows\System\GIHNMRB.exe
  C:\Windows\System\GIHNMRB.exe
  2⤵
  PID:16268
- C:\Windows\System\LuyxaTQ.exe
  C:\Windows\System\LuyxaTQ.exe
  2⤵
  PID:16296
- C:\Windows\System\ZyQhquC.exe
  C:\Windows\System\ZyQhquC.exe
  2⤵
  PID:16324
- C:\Windows\System\gdyrqvw.exe
  C:\Windows\System\gdyrqvw.exe
  2⤵
  PID:16352
- C:\Windows\System\flFtskG.exe
  C:\Windows\System\flFtskG.exe
  2⤵
  PID:16380
- C:\Windows\System\ACZZzwx.exe
  C:\Windows\System\ACZZzwx.exe
  2⤵
  PID:15408
- C:\Windows\System\ClfCccM.exe
  C:\Windows\System\ClfCccM.exe
  2⤵
  PID:15436
- C:\Windows\System\mPvMHQr.exe
  C:\Windows\System\mPvMHQr.exe
  2⤵
  PID:15540
- C:\Windows\System\kMXXHmB.exe
  C:\Windows\System\kMXXHmB.exe
  2⤵
  PID:15604
- C:\Windows\System\JYZwdsH.exe
  C:\Windows\System\JYZwdsH.exe
  2⤵
  PID:15664
- C:\Windows\System\ibofcHD.exe
  C:\Windows\System\ibofcHD.exe
  2⤵
  PID:15740
- C:\Windows\System\oBauplO.exe
  C:\Windows\System\oBauplO.exe
  2⤵
  PID:15796
- C:\Windows\System\qHVZAfA.exe
  C:\Windows\System\qHVZAfA.exe
  2⤵
  PID:15868
- C:\Windows\System\ujIWxBy.exe
  C:\Windows\System\ujIWxBy.exe
  2⤵
  PID:15932
- C:\Windows\System\HRUqjgz.exe
  C:\Windows\System\HRUqjgz.exe
  2⤵
  PID:15992
- C:\Windows\System\iZQXXjC.exe
  C:\Windows\System\iZQXXjC.exe
  2⤵
  PID:16064
- C:\Windows\System\vxkZeOA.exe
  C:\Windows\System\vxkZeOA.exe
  2⤵
  PID:16116
- C:\Windows\System\wTGhmia.exe
  C:\Windows\System\wTGhmia.exe
  2⤵
  PID:16208
- C:\Windows\System\vwNQXaq.exe
  C:\Windows\System\vwNQXaq.exe
  2⤵
  PID:16256
- C:\Windows\System\mACRxla.exe
  C:\Windows\System\mACRxla.exe
  2⤵
  PID:16320
- C:\Windows\System\wFImbpT.exe
  C:\Windows\System\wFImbpT.exe
  2⤵
  PID:16376
- C:\Windows\System\PWOOgUz.exe
  C:\Windows\System\PWOOgUz.exe
  2⤵
  PID:15432
- C:\Windows\System\SfJxxHo.exe
  C:\Windows\System\SfJxxHo.exe
  2⤵
  PID:15636
- C:\Windows\System\LgipBjM.exe
  C:\Windows\System\LgipBjM.exe
  2⤵
  PID:15792
- C:\Windows\System\caPyvYK.exe
  C:\Windows\System\caPyvYK.exe
  2⤵
  PID:15964
- C:\Windows\System\gyCSSjf.exe
  C:\Windows\System\gyCSSjf.exe
  2⤵
  PID:16180
- C:\Windows\System\wOzQgXA.exe
  C:\Windows\System\wOzQgXA.exe
  2⤵
  PID:16236
- C:\Windows\System\ggCWqpY.exe
  C:\Windows\System\ggCWqpY.exe
  2⤵
  PID:15580
- C:\Windows\System\anWCoyB.exe
  C:\Windows\System\anWCoyB.exe
  2⤵
  PID:14556
- C:\Windows\System\VUMdaNW.exe
  C:\Windows\System\VUMdaNW.exe
  2⤵
  PID:16232
- C:\Windows\System\tgnaXNG.exe
  C:\Windows\System\tgnaXNG.exe
  2⤵
  PID:15568
- C:\Windows\System\VtBxCLH.exe
  C:\Windows\System\VtBxCLH.exe
  2⤵
  PID:16392
- C:\Windows\System\LGvMRYM.exe
  C:\Windows\System\LGvMRYM.exe
  2⤵
  PID:16420
- C:\Windows\System\PdSnrGK.exe
  C:\Windows\System\PdSnrGK.exe
  2⤵
  PID:16448
- C:\Windows\System\pyTNwli.exe
  C:\Windows\System\pyTNwli.exe
  2⤵
  PID:16476
- C:\Windows\System\jKxXYBC.exe
  C:\Windows\System\jKxXYBC.exe
  2⤵
  PID:16504
- C:\Windows\System\XbpLuwj.exe
  C:\Windows\System\XbpLuwj.exe
  2⤵
  PID:16532
- C:\Windows\System\avbcAdk.exe
  C:\Windows\System\avbcAdk.exe
  2⤵
  PID:16548
- C:\Windows\System\YMMshpr.exe
  C:\Windows\System\YMMshpr.exe
  2⤵
  PID:16576
- C:\Windows\System\baJDlPX.exe
  C:\Windows\System\baJDlPX.exe
  2⤵
  PID:16616
- C:\Windows\System\rMQxygZ.exe
  C:\Windows\System\rMQxygZ.exe
  2⤵
  PID:16640
- C:\Windows\System\CVfSZDv.exe
  C:\Windows\System\CVfSZDv.exe
  2⤵
  PID:16676
- C:\Windows\System\HqSsMMO.exe
  C:\Windows\System\HqSsMMO.exe
  2⤵
  PID:16704
- C:\Windows\System\cqEDuPO.exe
  C:\Windows\System\cqEDuPO.exe
  2⤵
  PID:16740
- C:\Windows\System\bYeLtlC.exe
  C:\Windows\System\bYeLtlC.exe
  2⤵
  PID:16756
- C:\Windows\System\KkfVPpu.exe
  C:\Windows\System\KkfVPpu.exe
  2⤵
  PID:16784
- C:\Windows\System\DrHQoJP.exe
  C:\Windows\System\DrHQoJP.exe
  2⤵
  PID:16820
- C:\Windows\System\qnZuUNr.exe
  C:\Windows\System\qnZuUNr.exe
  2⤵
  PID:16852
- C:\Windows\System\mPplUsF.exe
  C:\Windows\System\mPplUsF.exe
  2⤵
  PID:16880
- C:\Windows\System\wIXwjDY.exe
  C:\Windows\System\wIXwjDY.exe
  2⤵
  PID:16896
- C:\Windows\System\PmUgSXk.exe
  C:\Windows\System\PmUgSXk.exe
  2⤵
  PID:16936
- C:\Windows\System\VnnpobF.exe
  C:\Windows\System\VnnpobF.exe
  2⤵
  PID:16964
- C:\Windows\System\FiXKDrR.exe
  C:\Windows\System\FiXKDrR.exe
  2⤵
  PID:16992
- C:\Windows\System\PHtSvbp.exe
  C:\Windows\System\PHtSvbp.exe
  2⤵
  PID:17008
- C:\Windows\System\ZfiJVdy.exe
  C:\Windows\System\ZfiJVdy.exe
  2⤵
  PID:17048
- C:\Windows\System\oaMVbUy.exe
  C:\Windows\System\oaMVbUy.exe
  2⤵
  PID:17076
- C:\Windows\System\iVmYBEw.exe
  C:\Windows\System\iVmYBEw.exe
  2⤵
  PID:17104
- C:\Windows\System\uJLCrjM.exe
  C:\Windows\System\uJLCrjM.exe
  2⤵
  PID:17132
- C:\Windows\System\iHKfxRy.exe
  C:\Windows\System\iHKfxRy.exe
  2⤵
  PID:17160
- C:\Windows\System\alzihje.exe
  C:\Windows\System\alzihje.exe
  2⤵
  PID:17188
- C:\Windows\System\VJePvbD.exe
  C:\Windows\System\VJePvbD.exe
  2⤵
  PID:17216
- C:\Windows\System\SGTaiel.exe
  C:\Windows\System\SGTaiel.exe
  2⤵
  PID:17244
- C:\Windows\System\VzFlxXv.exe
  C:\Windows\System\VzFlxXv.exe
  2⤵
  PID:17272
- C:\Windows\System\cyxJGoJ.exe
  C:\Windows\System\cyxJGoJ.exe
  2⤵
  PID:17300
- C:\Windows\System\bOtIYII.exe
  C:\Windows\System\bOtIYII.exe
  2⤵
  PID:17328
- C:\Windows\System\xYLXLQS.exe
  C:\Windows\System\xYLXLQS.exe
  2⤵
  PID:17356
- C:\Windows\System\fkMhYYX.exe
  C:\Windows\System\fkMhYYX.exe
  2⤵
  PID:17384
- C:\Windows\System\EEJFoqC.exe
  C:\Windows\System\EEJFoqC.exe
  2⤵
  PID:4308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BUtxwZF.exe

Filesize
1.7MB

MD5
66d7f8d3c6972e475aa76168e07367c9

SHA1
0231aa5c988984b6fdab3016bd672fb1f2e4d137

SHA256
b27684106d0734cb85f73780b5a09bad7b165ccffb8b4167754165a6e0b44537

SHA512
3aac46fb521c081e3ef00dac5c62c6c7a087c08a233f996f91e8259df6940c2096ca673183cde4fe63d0d4c7beeae5968318a18ee315f73e8f7b6d1801a0b726

Download Submit
C:\Windows\System\FLeeTdx.exe

Filesize
1.7MB

MD5
3bed7b7716e1306d20bbc560085d8904

SHA1
220a2992920c3ad726092f9744a260e10bea202b

SHA256
264cf45d467e95861ea4f7a6e959b1c43295142cfcaf515952f7536569d1e2a1

SHA512
2f95e0dfcb2b533c4e137d597faa16899f9b8349c35d29637b432fcb303ac722f9e0bd9232a78143e240d9ec0e2767124bdc3a04878191cd4f9a9eeda03d4102

Download Submit
C:\Windows\System\FTvHUzl.exe

Filesize
1.7MB

MD5
c82ac51471d3b483bb6381eacbb250a2

SHA1
ad854b90ae245a7fd1711aa7475978a43a7bf233

SHA256
5913f3b99c2442750309ecb1db10ccbbc1892dc996e72a03d050990e2d198837

SHA512
e4274382a596d1455cda8aacc70f0717436e76ad145697210717cd717394cc914ad02189a9d178fba662f8ce5a621be7ade093c7f1706b285c7b0bd06670c323

Download Submit
C:\Windows\System\FjfdZga.exe

Filesize
1.7MB

MD5
5eabdce9af4c4519382bd8c4952ae370

SHA1
6ba61f7993aa77e6d76ec01a58d4ca726e6fdea6

SHA256
66c7dc05b561c0b6860ce866c34e140f8e14998f25088cb02a17e6da5096fa71

SHA512
d2c470b6de16e94f5cab71af662f50e7940969f29a49d59f99e49b973dcbcc280a515c06c4ad833d7d5309fa5c0fc68383a48a8409720ac18e0912455a40b84f

Download Submit
C:\Windows\System\GAFOIrD.exe

Filesize
1.7MB

MD5
3d209b85655a40c3d86eab4571dab3cb

SHA1
d1b2bcfaf98351ea165244eea9c16206926303b6

SHA256
6302061e7ad7d3be4b9059621d68a837744d9254adf405422ff3107c368deefd

SHA512
73f1c2fd3c449fba4b1e73be374aeef6f54fff30a9b9802bca88c41f3361757d69b57c44ef389cca832fb6597467f2147b3dc7ba315cfc0606f98052f857ab8e

Download Submit
C:\Windows\System\KqzijBr.exe

Filesize
1.7MB

MD5
ab6d77689d0d2a0609059f9248027808

SHA1
c4aaefc60a488c0cb1a5bc872c4e650df5e6c9a0

SHA256
c1509b966413217fac5b90808edd298ab4d4dd37be5926080cbef9c9bc36fc48

SHA512
4c734e3b7d355d6c048ca5122ba4230570c8dbb5ec087fb3ceb554a55b37b74fb0b3a5a848767a99479f3b60d83647cae5b9d2e741975757cf16486f1bfd503e

Download Submit
C:\Windows\System\NWmAvqN.exe

Filesize
1.7MB

MD5
54dc92306fe9c741dbf4cd7ec9e1b2d4

SHA1
81424d9a6522ac3e1e3673ddb95d0ca9088b36f3

SHA256
475f744bcc90320f2257f1c0a07fc475a228cdfdd695c91dbadaeac2f4d4baa3

SHA512
67df5e2b5e97767c05224c0ab0c928ef9b29903ba4ed4e44ab055cedd656f45a8a3effae17612fe767250aa0b38e60616118cb6a839923c05c646d168f659b82

Download Submit
C:\Windows\System\NygKcio.exe

Filesize
1.7MB

MD5
64a69e376f802152773720bb4db1f4ec

SHA1
38717e3f5999ad747ff3d0279cba278273c2615e

SHA256
95c9d9f672a00612844097efce06e7ea8664422229c015303929532462c605a0

SHA512
159bec4411dffc7835cfc3b6fa7e14260508aa1dc2fba2dfdafa68e44416a54d710d3f90c5b9e0ac2846bc78e7ec706339024672df996a718757627baf08cf70

Download Submit
C:\Windows\System\ORyJnZR.exe

Filesize
1.7MB

MD5
d6a7b29007e5692960ba4dac983c18c3

SHA1
1913904b8758b9cd94f2b3da1a34aff6fb74e82a

SHA256
80ad5de7aba871df534ff6f838c50a1c3f04debd276214fde21116b1792b74c0

SHA512
8a82e0a3902127b15d7fbca560a8af75e975b8662ea4becdbdfa5c260a34ab192631bff81185d9ee6267f5c3eb1754b80a06c3f8f9f6d6c851c64a04c73ed357

Download Submit
C:\Windows\System\PTKGxUZ.exe

Filesize
1.7MB

MD5
ba19c3b95eaeb010887e3bd7df8d04cc

SHA1
19301f9ac08ca84d79a9a7e6e454e81bc82f6a3d

SHA256
c5cd72f32928bb7181a9b766f88dbe27c20aae9809eca81401eff8e0c4c3c218

SHA512
660fc6ab9c5731db7fbe661c51bb4cd937f02452f191e81c2e97a0cd6e07ec80040d7ab061366e47fc16d36ce3ea5c4766fdb5a7aa8d4282472eb3c351ca8881

Download Submit
C:\Windows\System\PbpivJS.exe

Filesize
1.7MB

MD5
ecb4b3ce1db1f2221ec28050b8af167e

SHA1
12fa8b5eaa824d53ac149e5c4112a9e44cb70515

SHA256
0fc10685aa59cad31ad2f766ac25ebcaad1f6bfd894912bbbff3613816d5e4f1

SHA512
de714584117ed407e36edf6e8e6ee2a55c780a0a9a65b0f7d55d3b05102505dd26818421d740cdaddae38b9f8bd462bf69ebc3f49b20e7011d85c5160450e130

Download Submit
C:\Windows\System\SKzrABW.exe

Filesize
1.7MB

MD5
54d2f30c636b0b0a5eb70608e774b0e5

SHA1
6574f1f6f427fbfb0b96e139bcf6c18b3370a152

SHA256
2bab5115994867ae43abcd3cf5c333d7e1f0c63a8a94d1f2fa22f1fb5e0ebf7a

SHA512
8808a11606a5727f2fa3584416ae15dbed161e4f0542f0a52830e538907d7761da08fefa6f2d05d1646d0185bcb978f5381f73d5bf26070cb402624d5d896acc

Download Submit
C:\Windows\System\TIJwTlE.exe

Filesize
1.7MB

MD5
1fd356e56a4684e159dbcf8669f9f9b3

SHA1
5f6bb79a2940e69f63f5206924c9a1c0080679d4

SHA256
0d6bc0e45019c151a96528f2bc667d20ae0a8a0c1944c2438fe8bffaee28ca87

SHA512
5aef27f9e1d85aca885bc3dc0a5961ce88ea60c6cea0178685a8d0ba0bd5509b1cad2d570eb700bcc79e08d866f2bc9c34cb1a7d9176f69a22ae2d4cb58a7237

Download Submit
C:\Windows\System\VVKEsco.exe

Filesize
1.7MB

MD5
6444401a843103d5c0a48df70b6f3aaa

SHA1
7cb7a2629510a0dd69c4b7e2770cea1dddbed172

SHA256
4fc1a3c7dd060da22a64c90f1a5c8ea450b1e3f55763acd27dd8864208cc8f3e

SHA512
9c1648c2fb5e37308e783531d0b2c3fea89b769c89c4fb039ac36021a4a94671c800d0d425397c0a2b250b207e865e02a691c63ac81adc25d090387618aca76b

Download Submit
C:\Windows\System\WatMzgD.exe

Filesize
1.7MB

MD5
de79bbe7b5788b452b9bc31d8f1999ee

SHA1
bc6c67e1864c683c94929298c7024927ad933c8e

SHA256
2db26fbd115e4379be7deedfe0023157ac9b52fe50bb8a243775d96c7211ae64

SHA512
5f288c12b9a654031cadcc038bb1164a626d299bdff1e6e3359a79fe9eb09bd6e1eba27e206891a2d1133a6be3724259e0c6da999cebe9485352550e924aa3ae

Download Submit
C:\Windows\System\alzJzuZ.exe

Filesize
1.7MB

MD5
85ab998d0ef5f49b4922e4ae6d2b1b70

SHA1
bde72fe583fc8012141bdc3646f7fb28a1d3a856

SHA256
1cf6f3ff587089208aa480240353221f1c0a34d9f47aff7d99adbd076797749c

SHA512
6c56fba1f4417b4e2ac467ccd5d04e713bfbc65b2db60f51d0ec655761947f7e0f87c288f02911d8506c3ba7cccd1e1c5bfbc48593886970c2021c84b8965005

Download Submit
C:\Windows\System\beCQFLK.exe

Filesize
1.7MB

MD5
d6eaa87536e00b4f8bdd5da8fe4f23ac

SHA1
e058cbdea33fe19f4e468ba108f13be332cacd5a

SHA256
7eb5891f6bb9192bfd93b76af77011194291584caa94eec5e102b904ef210dd1

SHA512
f9fe5b7984be16e63055a06ad3fc9025f0c4a847a3f627fb202125a5a06314f83fabaff565031c2ef9b9c7a7b3051a42b23680fd44ad42688e59b2c3f5810fce

Download Submit
C:\Windows\System\cBGEjdW.exe

Filesize
1.7MB

MD5
834669f69cca6f8122c17b6207d15d81

SHA1
97090251ecd2424e1d1a1e4890841c2ac847ccec

SHA256
1a86a20cf3f5407b1c5e37f29dfd633324f0e726b0a16212ac8fdfbe6f275254

SHA512
05fe747b7954e69d6933bbe4b201b68e695aa1fcbd38fa5518c525e3f9914c12b2097da1b03fe3a9c8d91b84a647d7ae5387ef7add8350530945ab03ff30de4a

Download Submit
C:\Windows\System\cLSczPq.exe

Filesize
1.7MB

MD5
bd0701c21ac5565bbeb68f65a1ab9a75

SHA1
cb06f83c71a776795fc60653ee4181f59e490e2f

SHA256
c9d5479e5640133357892f08cc1e968334cea68d5fcde1fcf5a02d03010ca2de

SHA512
f3c2bcaa14c714c63d1be361d7a9ae665b088693263977cfb23e27ea3a55cde9b8b2527ea64123769aa2ed9b6240b5d3edcfecec3cec1a022b8228c5acfcddaf

Download Submit
C:\Windows\System\dEEIHek.exe

Filesize
1.7MB

MD5
9c5b2470883c75e8d021a5e5d40316fb

SHA1
0e874450ad960ee7396578069021cdb7b9527a85

SHA256
46e74eff787335cb51a37787bfd42a52846d0ba7c269f01cbae65b3a5ca5baf2

SHA512
95af02f66ffe2b2f35fd69e682087a0e51889c1f926cf788439c2390e4a706017623db7fdf26cb8a309a63d5ddf3a04ff9e06d2ad10c60f2c1b64dedbcadd77b

Download Submit
C:\Windows\System\dRLZAEZ.exe

Filesize
1.7MB

MD5
a157658c47f50d14a9371332854d300f

SHA1
2a688316170261378d4a5be624132ec979a53924

SHA256
a7381da6fac72f94c881258462512637c769e843f7d47bde0eb17c29d79af162

SHA512
2a96bd4bbb80803bd0e439fb8398dad53f332df76dca816cd0a4b7f805fbe70432781fc782bbf775c3e0fe135d92510291ce9d33d2bc3b040d57957838c1d29f

Download Submit
C:\Windows\System\gcxtYfN.exe

Filesize
1.7MB

MD5
37c74592b2d7a84994a2f3a2c45b2ee3

SHA1
4e2f51c4ba86d4481c37ba1057b6d954223caa46

SHA256
c67b4394847b5dc62022d7ee5bf7813569a84e551ccc6d9ca8c3c60f227291ed

SHA512
a4aa5c303dc75475378022f8d1c4e0a3c85a77b360ad038aacbfa25aac1e8d90fc81d785b8610c924ed1e9e84ffcf065fbb0b6d268fe45cf6076f71c45226f71

Download Submit
C:\Windows\System\hksyafE.exe

Filesize
1.7MB

MD5
49111f9ee62fa07e9cbe098bc6ad5ef0

SHA1
9d70898c34e43058728a96fc7d474207efb1dd3d

SHA256
cead62139a40e9a4f9842710afe2d5a2b939de6261636aeb609828780766fa7b

SHA512
dbf631589a965462011d270276aed4ba214dc602a5b73faf9053cac1dacca0a46ace8de2bd4179ac0ec4f8afcde9f226c3bd9a4dd02983be142f3039e3868dd9

Download Submit
C:\Windows\System\jJJyGAC.exe

Filesize
1.7MB

MD5
f828e77909ff9964c2bb9970c44cb460

SHA1
0f2f70a8107295dd4970b6c41316efdea25cdc83

SHA256
e8213a9b5c5e5e3e4d51be1c47fe234a4a12864a7b7dc00067bb7806bfc93d57

SHA512
6a9550e8eb6cd34334ad63d77e5d0a0b227370c82457c0ae319e07863384a9d355e5691e9ee5658c01a136870a62dfd03307e8ea766940bc9fabf43a7f92cc60

Download Submit
C:\Windows\System\mZKuNTp.exe

Filesize
1.7MB

MD5
681b17b8e3a33002fc3898ac01fc92e2

SHA1
93c9cd1c106e4fde12c241d1dd857e7ae797a9ef

SHA256
e59e6af20347882cc4f6d6f2eda0b1b17fab87e52566c5ea84526565a10e3499

SHA512
01e4988c88df3c4a43fd94f60c3ac67ba10aaa46c7e8c0a68ec1dd0680c23c1912b57c0327cb30bb5b485d7e86c797735dafe40eabe4d6dd21372def45d3c783

Download Submit
C:\Windows\System\nyPDgdD.exe

Filesize
1.7MB

MD5
31b705fabf3977155316404b05b873af

SHA1
58ea31ff76b2b3c974e99e30cda3d53570345d59

SHA256
8bdd5188e9c113d3168479e0e604f8df8a62eafcacdc661b08e1d3214f8da52e

SHA512
527cf5ab6947cd82ff5221a39c4714217f6be027cbfc95a66e782e384ba16b2f92bb2f4a640bc9e013c8c62f4d2d74d8b9d4ee94a4cb586d9b66a1796f458198

Download Submit
C:\Windows\System\sUnPuOA.exe

Filesize
1.7MB

MD5
bbda47a686886aadefa1e7f1bc828d97

SHA1
e8b88f6d14021c0cea7791c84e9c622388b5521f

SHA256
e38cf239f47af92cf7f22a20db58f28eb6048f15a673ae36efaad0b1f686bb54

SHA512
a5e1a27397f2e92b7b1bd0810973d3c9e512c85b986e867d568bec10841d7bc9e73d4e4225881304d3f8c1e6a0b98746a197a5b57645847e29295a83b1da629e

Download Submit
C:\Windows\System\tvHxDed.exe

Filesize
1.7MB

MD5
f19b19520a5cfaab336f81dadd4f752c

SHA1
4b1964f75630eed7347f82879f2c4d382600e8c3

SHA256
4c118f7a3ef7acefaad94553ab69ac53b4dda5f805e3e84e48f9ca48d7f2c108

SHA512
3bb0ad3a5c304dbc965717e1bbda5375e70773bad72a02a9010a4d2ca1208cc70a326e0f8b2a3245406497390377f7e32cedefeb5b427f3badb23610524c5d00

Download Submit
C:\Windows\System\vPqTtZg.exe

Filesize
1.7MB

MD5
857e99d9cc7821cd35be665b1621e019

SHA1
0c8ff7535fe0ff7a9a48693dd13c6f2828851e47

SHA256
5dddb5ee70da66bdd24910fa2717356bfb64572fc7356f19cc3c4b4c6bec5c46

SHA512
4d5937e867b1b8fa4a14ae7c0c2fb80290adeb02f8b14c3100fbe357004acffae12cdc4b3cfbe009f89fb3576333fc7d340f14a2200ec7968d7fc37a7a6095e2

Download Submit
C:\Windows\System\xCAthcs.exe

Filesize
1.7MB

MD5
54793a462b019137272206b8e64ea240

SHA1
f37e532f9bcfc04939eddf744af29a431a5f3614

SHA256
20934a4956dd917814380189630854f57a6b1622644e178ae71cc2e41e445d29

SHA512
246f60aa16b341155278ba9a409218a0d0f350e141f4e40c039511590ec2ca8e5a52f5f4ea01e3ea3e01c263476fc55a7e9f11661cd4b9f26a9cc6a0a3b7c9a8

Download Submit
C:\Windows\System\xxnCGUS.exe

Filesize
1.7MB

MD5
b59e0afe1eda77e590716038c229f1a7

SHA1
7c1a7f932c79ac76fafc7a1c0c93a1b610d33574

SHA256
bc2446980266b78494d5c894f3a38493bc6709a935dfb06e32e74060950dcf54

SHA512
dd857f19c450525e696baedf4027fcabfb4d8a7216d21b215eec207e6643fdde7fc139285ce3587778167a0c67fc05b41d405499fc3f8b44fc42953aa245c44c

Download Submit
C:\Windows\System\yhzTbWa.exe

Filesize
1.7MB

MD5
61b61775f4deaaa3fbac97d3c92de26b

SHA1
5108e4eb9e921c94297e6831c6735951ad9bb541

SHA256
36ce735389f0c687c843d3496694aa5bfaa29627facae3387b55ea0efc21a46e

SHA512
64d3184c89ac44a61782d022715a374bd6e16f050c17793806d2a52be30d6a4b7ae691b90ce25a682c221111faa8112bd0ee185d30e9d8faaa77265941b8a5f4

Download Submit
C:\Windows\System\zGLllYr.exe

Filesize
1.7MB

MD5
c6d9205c2ee570c31323cbf8d6481698

SHA1
974306b5ddaffee5fca2f0c44baf0c6aa3f3a8ec

SHA256
1784b675c09f8a140d7e729c5663dda24eae7a4331303f0a3038647e2471160b

SHA512
eae92c93ca93338b0b81add6c1689d099d69bb2893b48fa441178e61062e3c255832cc4088e14ce9a5fcb1df65992531787b3678d0b56acf2c747a043d783cf9

Download Submit
memory/3628-0-0x00000282B6ED0000-0x00000282B6EE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads