xmrig | 197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc

Analysis

max time kernel
93s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2025, 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
Size

1.6MB
MD5

51be3690950757d48570c0f27eb54721
SHA1

ab551e3d10163b0870a38013a3424fdfdb9711c1
SHA256

197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc
SHA512

e7af7e18d6215240d096bc5c02741df0729a112de775ab5b9488f7a3e87b5950e6f9f4fa254cab5f665b761b194988ae7f9873d5d7a748bc1aa61f88f2574632
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yUT39nFbZM:GemTLkNdfE0pZyO

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c4f-4.dat	xmrig
behavioral2/files/0x0008000000023c52-9.dat	xmrig
behavioral2/files/0x0007000000023c54-20.dat	xmrig
behavioral2/files/0x0007000000023c57-34.dat	xmrig
behavioral2/files/0x0007000000023c59-43.dat	xmrig
behavioral2/files/0x0007000000023c5b-55.dat	xmrig
behavioral2/files/0x0007000000023c5a-53.dat	xmrig
behavioral2/files/0x0007000000023c58-40.dat	xmrig
behavioral2/files/0x0007000000023c55-36.dat	xmrig
behavioral2/files/0x0007000000023c56-28.dat	xmrig
behavioral2/files/0x0007000000023c53-13.dat	xmrig
behavioral2/files/0x0007000000023c5c-59.dat	xmrig
behavioral2/files/0x0011000000023b04-65.dat	xmrig
behavioral2/files/0x0011000000023b07-70.dat	xmrig
behavioral2/files/0x0008000000023c50-74.dat	xmrig
behavioral2/files/0x0007000000023c5e-86.dat	xmrig
behavioral2/files/0x0007000000023c5f-96.dat	xmrig
behavioral2/files/0x0007000000023c61-98.dat	xmrig
behavioral2/files/0x0007000000023c63-110.dat	xmrig
behavioral2/files/0x0007000000023c62-105.dat	xmrig
behavioral2/files/0x0007000000023c60-100.dat	xmrig
behavioral2/files/0x0007000000023c5d-82.dat	xmrig
behavioral2/files/0x0007000000023c68-125.dat	xmrig
behavioral2/files/0x0007000000023c6a-135.dat	xmrig
behavioral2/files/0x0007000000023c6c-142.dat	xmrig
behavioral2/files/0x0007000000023c6f-154.dat	xmrig
behavioral2/files/0x0007000000023c6d-158.dat	xmrig
behavioral2/files/0x0007000000023c6e-156.dat	xmrig
behavioral2/files/0x0007000000023c6b-151.dat	xmrig
behavioral2/files/0x0007000000023c69-130.dat	xmrig
behavioral2/files/0x0007000000023c67-119.dat	xmrig
behavioral2/files/0x0007000000023c64-115.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4848	iFtVTBd.exe
4988	KqYpIxF.exe
4732	iUVlBPX.exe
1848	TQAzqpg.exe
4984	CqIVbWR.exe
1768	ASANRrq.exe
2708	agKVTMk.exe
232	NbvENMM.exe
3888	QFflQCa.exe
1852	omdXYmt.exe
3496	qGrXxXZ.exe
1600	ApSwYFk.exe
440	uJZVUrC.exe
4784	MmKWfpI.exe
3620	CtBcVtD.exe
4940	vhNRAaw.exe
4896	lzUTJNf.exe
4800	nbsrJaH.exe
1072	BZEQulf.exe
2160	UlexAnt.exe
2004	CUbIYTf.exe
4680	gojdFzf.exe
1356	erWydhq.exe
2560	sTJMyiW.exe
3428	KPxocdu.exe
668	PbDHHup.exe
64	ZIvYhNp.exe
456	trAIXhH.exe
4052	GaNrjFI.exe
3968	wuMiWhL.exe
4468	YtBwXLl.exe
4728	fvtXoUj.exe
3592	IMTriVW.exe
2124	kkgDjtg.exe
4428	lBaUwQR.exe
1180	LBenFkx.exe
4424	ROyAtjM.exe
4760	BRGOPJr.exe
4388	stqisSs.exe
1724	mpmMPHQ.exe
732	LoNSiPF.exe
4192	GCEujHk.exe
2944	kVHyjKE.exe
2072	RHhdaiB.exe
4308	JXUrmZH.exe
2092	gpcRZxV.exe
3024	fcKmuHc.exe
3812	MyNCWAa.exe
4792	HGAaYVT.exe
4188	SyQSdRA.exe
5080	BXBdDyk.exe
3952	dkCCAjq.exe
3284	awDgwMO.exe
1636	dAXamdk.exe
3524	OoVLLjw.exe
4120	dVrWcUQ.exe
4752	pOJQfZl.exe
4968	OxayHif.exe
3264	syMjQur.exe
3624	qAJAKxP.exe
1056	YDMuVSq.exe
2984	qOPKrZS.exe
3000	RtrqBoB.exe
4960	JAiVzhJ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MyNCWAa.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\rkzBOwK.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\ZGgWqfJ.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\iqXpjvb.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\iFtVTBd.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\gBNTCyP.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\sWQERvd.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\EXcKLzg.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\ZoBGlsC.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\cgpYQUo.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\VlDbFTW.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\mmzgxrM.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\yZrJStb.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\fvtXoUj.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\GUADovI.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\dBtsQAB.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\HUOawDj.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\VXYIFKE.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\HbUaAWq.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\NIpqsaD.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\sTJMyiW.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\lBHmLzT.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\wsfoCDe.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\uhTSmQh.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\BnkzUIM.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\TXFBTXa.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\VsWqUjr.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\mVEdepX.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\QqJakJf.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\PQNVEPX.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\motbLlw.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\aGURcxz.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\bwzYLah.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\fnuJUpo.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\qeOYEIZ.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\FFuJsDl.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\SbGUwHS.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\IvpNlmG.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\ecNCFng.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\oAFPBcv.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\EECPRBA.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\XeQZLKo.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\vHhISRD.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\ZWygSan.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\OCKTqVa.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\ZvynyHm.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\bEACmLT.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\CFvPGFy.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\XWTBvmv.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\wepRKaU.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\AhmGgKK.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\YdyUrIi.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\EYZpjxx.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\WNANJpj.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\Einiyzg.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\NxcQqUZ.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\MgUBKjq.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\PBjnnjZ.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\CpBRGzg.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\VhauZdQ.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\VOAZDbS.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\GJmMdor.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\fcKmuHc.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
File created	C:\Windows\System\glpnRze.exe	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4848	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	84
PID 4176 wrote to memory of 4848	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	84
PID 4176 wrote to memory of 4988	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	85
PID 4176 wrote to memory of 4988	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	85
PID 4176 wrote to memory of 4732	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	86
PID 4176 wrote to memory of 4732	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	86
PID 4176 wrote to memory of 1848	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	87
PID 4176 wrote to memory of 1848	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	87
PID 4176 wrote to memory of 4984	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	88
PID 4176 wrote to memory of 4984	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	88
PID 4176 wrote to memory of 1768	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	90
PID 4176 wrote to memory of 1768	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	90
PID 4176 wrote to memory of 2708	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	91
PID 4176 wrote to memory of 2708	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	91
PID 4176 wrote to memory of 232	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	92
PID 4176 wrote to memory of 232	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	92
PID 4176 wrote to memory of 3888	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	93
PID 4176 wrote to memory of 3888	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	93
PID 4176 wrote to memory of 1852	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	94
PID 4176 wrote to memory of 1852	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	94
PID 4176 wrote to memory of 3496	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	95
PID 4176 wrote to memory of 3496	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	95
PID 4176 wrote to memory of 1600	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	96
PID 4176 wrote to memory of 1600	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	96
PID 4176 wrote to memory of 440	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	99
PID 4176 wrote to memory of 440	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	99
PID 4176 wrote to memory of 4784	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	100
PID 4176 wrote to memory of 4784	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	100
PID 4176 wrote to memory of 3620	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	101
PID 4176 wrote to memory of 3620	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	101
PID 4176 wrote to memory of 4940	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	102
PID 4176 wrote to memory of 4940	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	102
PID 4176 wrote to memory of 4896	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	103
PID 4176 wrote to memory of 4896	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	103
PID 4176 wrote to memory of 4800	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	104
PID 4176 wrote to memory of 4800	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	104
PID 4176 wrote to memory of 1072	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	105
PID 4176 wrote to memory of 1072	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	105
PID 4176 wrote to memory of 2160	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	106
PID 4176 wrote to memory of 2160	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	106
PID 4176 wrote to memory of 2004	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	107
PID 4176 wrote to memory of 2004	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	107
PID 4176 wrote to memory of 4680	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	108
PID 4176 wrote to memory of 4680	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	108
PID 4176 wrote to memory of 1356	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	109
PID 4176 wrote to memory of 1356	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	109
PID 4176 wrote to memory of 2560	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	110
PID 4176 wrote to memory of 2560	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	110
PID 4176 wrote to memory of 3428	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	111
PID 4176 wrote to memory of 3428	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	111
PID 4176 wrote to memory of 668	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	112
PID 4176 wrote to memory of 668	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	112
PID 4176 wrote to memory of 64	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	113
PID 4176 wrote to memory of 64	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	113
PID 4176 wrote to memory of 456	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	114
PID 4176 wrote to memory of 456	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	114
PID 4176 wrote to memory of 4052	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	115
PID 4176 wrote to memory of 4052	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	115
PID 4176 wrote to memory of 3968	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	116
PID 4176 wrote to memory of 3968	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	116
PID 4176 wrote to memory of 4468	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	117
PID 4176 wrote to memory of 4468	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	117
PID 4176 wrote to memory of 4728	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	118
PID 4176 wrote to memory of 4728	4176	197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe	118

C:\Users\Admin\AppData\Local\Temp\197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe
"C:\Users\Admin\AppData\Local\Temp\197b617650d3cf99d2bf66bbec6cb2f6d8b5cec8b067c236ca15aa839d497bcc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\System\iFtVTBd.exe
  C:\Windows\System\iFtVTBd.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\KqYpIxF.exe
  C:\Windows\System\KqYpIxF.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\iUVlBPX.exe
  C:\Windows\System\iUVlBPX.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\TQAzqpg.exe
  C:\Windows\System\TQAzqpg.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\CqIVbWR.exe
  C:\Windows\System\CqIVbWR.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\ASANRrq.exe
  C:\Windows\System\ASANRrq.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\agKVTMk.exe
  C:\Windows\System\agKVTMk.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\NbvENMM.exe
  C:\Windows\System\NbvENMM.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\QFflQCa.exe
  C:\Windows\System\QFflQCa.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\omdXYmt.exe
  C:\Windows\System\omdXYmt.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\qGrXxXZ.exe
  C:\Windows\System\qGrXxXZ.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\ApSwYFk.exe
  C:\Windows\System\ApSwYFk.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\uJZVUrC.exe
  C:\Windows\System\uJZVUrC.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\MmKWfpI.exe
  C:\Windows\System\MmKWfpI.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\CtBcVtD.exe
  C:\Windows\System\CtBcVtD.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\vhNRAaw.exe
  C:\Windows\System\vhNRAaw.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\lzUTJNf.exe
  C:\Windows\System\lzUTJNf.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\nbsrJaH.exe
  C:\Windows\System\nbsrJaH.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\BZEQulf.exe
  C:\Windows\System\BZEQulf.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\UlexAnt.exe
  C:\Windows\System\UlexAnt.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\CUbIYTf.exe
  C:\Windows\System\CUbIYTf.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\gojdFzf.exe
  C:\Windows\System\gojdFzf.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\erWydhq.exe
  C:\Windows\System\erWydhq.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\sTJMyiW.exe
  C:\Windows\System\sTJMyiW.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\KPxocdu.exe
  C:\Windows\System\KPxocdu.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\PbDHHup.exe
  C:\Windows\System\PbDHHup.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\ZIvYhNp.exe
  C:\Windows\System\ZIvYhNp.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\trAIXhH.exe
  C:\Windows\System\trAIXhH.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\GaNrjFI.exe
  C:\Windows\System\GaNrjFI.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\wuMiWhL.exe
  C:\Windows\System\wuMiWhL.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\YtBwXLl.exe
  C:\Windows\System\YtBwXLl.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\fvtXoUj.exe
  C:\Windows\System\fvtXoUj.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\IMTriVW.exe
  C:\Windows\System\IMTriVW.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\kkgDjtg.exe
  C:\Windows\System\kkgDjtg.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\lBaUwQR.exe
  C:\Windows\System\lBaUwQR.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\LBenFkx.exe
  C:\Windows\System\LBenFkx.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\ROyAtjM.exe
  C:\Windows\System\ROyAtjM.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\BRGOPJr.exe
  C:\Windows\System\BRGOPJr.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\stqisSs.exe
  C:\Windows\System\stqisSs.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\mpmMPHQ.exe
  C:\Windows\System\mpmMPHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\LoNSiPF.exe
  C:\Windows\System\LoNSiPF.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\GCEujHk.exe
  C:\Windows\System\GCEujHk.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\kVHyjKE.exe
  C:\Windows\System\kVHyjKE.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\RHhdaiB.exe
  C:\Windows\System\RHhdaiB.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\JXUrmZH.exe
  C:\Windows\System\JXUrmZH.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\gpcRZxV.exe
  C:\Windows\System\gpcRZxV.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\fcKmuHc.exe
  C:\Windows\System\fcKmuHc.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\MyNCWAa.exe
  C:\Windows\System\MyNCWAa.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\HGAaYVT.exe
  C:\Windows\System\HGAaYVT.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\SyQSdRA.exe
  C:\Windows\System\SyQSdRA.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\BXBdDyk.exe
  C:\Windows\System\BXBdDyk.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\dkCCAjq.exe
  C:\Windows\System\dkCCAjq.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\awDgwMO.exe
  C:\Windows\System\awDgwMO.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\dAXamdk.exe
  C:\Windows\System\dAXamdk.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\OoVLLjw.exe
  C:\Windows\System\OoVLLjw.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\dVrWcUQ.exe
  C:\Windows\System\dVrWcUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\pOJQfZl.exe
  C:\Windows\System\pOJQfZl.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\OxayHif.exe
  C:\Windows\System\OxayHif.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\syMjQur.exe
  C:\Windows\System\syMjQur.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\qAJAKxP.exe
  C:\Windows\System\qAJAKxP.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\YDMuVSq.exe
  C:\Windows\System\YDMuVSq.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\qOPKrZS.exe
  C:\Windows\System\qOPKrZS.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\RtrqBoB.exe
  C:\Windows\System\RtrqBoB.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\JAiVzhJ.exe
  C:\Windows\System\JAiVzhJ.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\OCKTqVa.exe
  C:\Windows\System\OCKTqVa.exe
  2⤵
  PID:1808
- C:\Windows\System\cgpYQUo.exe
  C:\Windows\System\cgpYQUo.exe
  2⤵
  PID:5084
- C:\Windows\System\CSeSYhA.exe
  C:\Windows\System\CSeSYhA.exe
  2⤵
  PID:3312
- C:\Windows\System\HxfElAq.exe
  C:\Windows\System\HxfElAq.exe
  2⤵
  PID:3108
- C:\Windows\System\fjLbEra.exe
  C:\Windows\System\fjLbEra.exe
  2⤵
  PID:4812
- C:\Windows\System\XzYMRIQ.exe
  C:\Windows\System\XzYMRIQ.exe
  2⤵
  PID:4056
- C:\Windows\System\BnkzUIM.exe
  C:\Windows\System\BnkzUIM.exe
  2⤵
  PID:3824
- C:\Windows\System\linmoTq.exe
  C:\Windows\System\linmoTq.exe
  2⤵
  PID:820
- C:\Windows\System\THHRrnZ.exe
  C:\Windows\System\THHRrnZ.exe
  2⤵
  PID:1168
- C:\Windows\System\WMAOwlA.exe
  C:\Windows\System\WMAOwlA.exe
  2⤵
  PID:3440
- C:\Windows\System\qYPUOhj.exe
  C:\Windows\System\qYPUOhj.exe
  2⤵
  PID:892
- C:\Windows\System\BeCHUMh.exe
  C:\Windows\System\BeCHUMh.exe
  2⤵
  PID:4648
- C:\Windows\System\IOepOXw.exe
  C:\Windows\System\IOepOXw.exe
  2⤵
  PID:4412
- C:\Windows\System\dbUThST.exe
  C:\Windows\System\dbUThST.exe
  2⤵
  PID:3908
- C:\Windows\System\ygRGzkf.exe
  C:\Windows\System\ygRGzkf.exe
  2⤵
  PID:2624
- C:\Windows\System\bSeJCzu.exe
  C:\Windows\System\bSeJCzu.exe
  2⤵
  PID:2028
- C:\Windows\System\jzqHOgx.exe
  C:\Windows\System\jzqHOgx.exe
  2⤵
  PID:1880
- C:\Windows\System\bTWqQCM.exe
  C:\Windows\System\bTWqQCM.exe
  2⤵
  PID:3272
- C:\Windows\System\ILwTmmA.exe
  C:\Windows\System\ILwTmmA.exe
  2⤵
  PID:4604
- C:\Windows\System\nLMSPya.exe
  C:\Windows\System\nLMSPya.exe
  2⤵
  PID:4472
- C:\Windows\System\oWjFqBe.exe
  C:\Windows\System\oWjFqBe.exe
  2⤵
  PID:5064
- C:\Windows\System\QYIzGqm.exe
  C:\Windows\System\QYIzGqm.exe
  2⤵
  PID:1604
- C:\Windows\System\YahzwEo.exe
  C:\Windows\System\YahzwEo.exe
  2⤵
  PID:5020
- C:\Windows\System\rsOvTaa.exe
  C:\Windows\System\rsOvTaa.exe
  2⤵
  PID:2184
- C:\Windows\System\wWfXlOH.exe
  C:\Windows\System\wWfXlOH.exe
  2⤵
  PID:3292
- C:\Windows\System\gAwYyYz.exe
  C:\Windows\System\gAwYyYz.exe
  2⤵
  PID:936
- C:\Windows\System\dmKSakC.exe
  C:\Windows\System\dmKSakC.exe
  2⤵
  PID:5124
- C:\Windows\System\ElCmqTt.exe
  C:\Windows\System\ElCmqTt.exe
  2⤵
  PID:5152
- C:\Windows\System\JsYTCez.exe
  C:\Windows\System\JsYTCez.exe
  2⤵
  PID:5184
- C:\Windows\System\gkIqDeQ.exe
  C:\Windows\System\gkIqDeQ.exe
  2⤵
  PID:5212
- C:\Windows\System\SflRbzN.exe
  C:\Windows\System\SflRbzN.exe
  2⤵
  PID:5240
- C:\Windows\System\DWiqfRC.exe
  C:\Windows\System\DWiqfRC.exe
  2⤵
  PID:5272
- C:\Windows\System\UakPrwT.exe
  C:\Windows\System\UakPrwT.exe
  2⤵
  PID:5304
- C:\Windows\System\YEWtikR.exe
  C:\Windows\System\YEWtikR.exe
  2⤵
  PID:5328
- C:\Windows\System\TlrQiVo.exe
  C:\Windows\System\TlrQiVo.exe
  2⤵
  PID:5356
- C:\Windows\System\DnFeelX.exe
  C:\Windows\System\DnFeelX.exe
  2⤵
  PID:5384
- C:\Windows\System\mMwjfuh.exe
  C:\Windows\System\mMwjfuh.exe
  2⤵
  PID:5412
- C:\Windows\System\orpcsEW.exe
  C:\Windows\System\orpcsEW.exe
  2⤵
  PID:5428
- C:\Windows\System\SHhwoGT.exe
  C:\Windows\System\SHhwoGT.exe
  2⤵
  PID:5464
- C:\Windows\System\AybidSr.exe
  C:\Windows\System\AybidSr.exe
  2⤵
  PID:5496
- C:\Windows\System\JmuattS.exe
  C:\Windows\System\JmuattS.exe
  2⤵
  PID:5524
- C:\Windows\System\nhpPAEe.exe
  C:\Windows\System\nhpPAEe.exe
  2⤵
  PID:5568
- C:\Windows\System\lPOAtdx.exe
  C:\Windows\System\lPOAtdx.exe
  2⤵
  PID:5584
- C:\Windows\System\YIiVCSf.exe
  C:\Windows\System\YIiVCSf.exe
  2⤵
  PID:5616
- C:\Windows\System\oaRHLda.exe
  C:\Windows\System\oaRHLda.exe
  2⤵
  PID:5640
- C:\Windows\System\vewWTKO.exe
  C:\Windows\System\vewWTKO.exe
  2⤵
  PID:5672
- C:\Windows\System\kUdqaUo.exe
  C:\Windows\System\kUdqaUo.exe
  2⤵
  PID:5700
- C:\Windows\System\vARLtbj.exe
  C:\Windows\System\vARLtbj.exe
  2⤵
  PID:5728
- C:\Windows\System\hMNbKOq.exe
  C:\Windows\System\hMNbKOq.exe
  2⤵
  PID:5756
- C:\Windows\System\wEbFqJf.exe
  C:\Windows\System\wEbFqJf.exe
  2⤵
  PID:5784
- C:\Windows\System\Lfdvlbu.exe
  C:\Windows\System\Lfdvlbu.exe
  2⤵
  PID:5812
- C:\Windows\System\pkjNtsz.exe
  C:\Windows\System\pkjNtsz.exe
  2⤵
  PID:5840
- C:\Windows\System\EjxLvvf.exe
  C:\Windows\System\EjxLvvf.exe
  2⤵
  PID:5868
- C:\Windows\System\difWJCT.exe
  C:\Windows\System\difWJCT.exe
  2⤵
  PID:5896
- C:\Windows\System\fwSJGvp.exe
  C:\Windows\System\fwSJGvp.exe
  2⤵
  PID:5924
- C:\Windows\System\lJtQoIh.exe
  C:\Windows\System\lJtQoIh.exe
  2⤵
  PID:5952
- C:\Windows\System\GUADovI.exe
  C:\Windows\System\GUADovI.exe
  2⤵
  PID:5980
- C:\Windows\System\undYfME.exe
  C:\Windows\System\undYfME.exe
  2⤵
  PID:6016
- C:\Windows\System\bEACmLT.exe
  C:\Windows\System\bEACmLT.exe
  2⤵
  PID:6036
- C:\Windows\System\HOgmNHY.exe
  C:\Windows\System\HOgmNHY.exe
  2⤵
  PID:6064
- C:\Windows\System\lBHmLzT.exe
  C:\Windows\System\lBHmLzT.exe
  2⤵
  PID:6092
- C:\Windows\System\UvoSQKZ.exe
  C:\Windows\System\UvoSQKZ.exe
  2⤵
  PID:6120
- C:\Windows\System\IonFXHq.exe
  C:\Windows\System\IonFXHq.exe
  2⤵
  PID:1544
- C:\Windows\System\lkyKAbe.exe
  C:\Windows\System\lkyKAbe.exe
  2⤵
  PID:5176
- C:\Windows\System\TpFgwfk.exe
  C:\Windows\System\TpFgwfk.exe
  2⤵
  PID:5252
- C:\Windows\System\tyDRGHT.exe
  C:\Windows\System\tyDRGHT.exe
  2⤵
  PID:5320
- C:\Windows\System\xtQBmSo.exe
  C:\Windows\System\xtQBmSo.exe
  2⤵
  PID:5380
- C:\Windows\System\EpKhjAo.exe
  C:\Windows\System\EpKhjAo.exe
  2⤵
  PID:5456
- C:\Windows\System\YVnnbEG.exe
  C:\Windows\System\YVnnbEG.exe
  2⤵
  PID:540
- C:\Windows\System\bmKEUuA.exe
  C:\Windows\System\bmKEUuA.exe
  2⤵
  PID:5508
- C:\Windows\System\ylZBsgh.exe
  C:\Windows\System\ylZBsgh.exe
  2⤵
  PID:1488
- C:\Windows\System\FCYvUyn.exe
  C:\Windows\System\FCYvUyn.exe
  2⤵
  PID:5648
- C:\Windows\System\hlCaVGY.exe
  C:\Windows\System\hlCaVGY.exe
  2⤵
  PID:5688
- C:\Windows\System\TAXwucG.exe
  C:\Windows\System\TAXwucG.exe
  2⤵
  PID:5752
- C:\Windows\System\vTsjZhf.exe
  C:\Windows\System\vTsjZhf.exe
  2⤵
  PID:5836
- C:\Windows\System\jHFeYsu.exe
  C:\Windows\System\jHFeYsu.exe
  2⤵
  PID:5892
- C:\Windows\System\VXYIFKE.exe
  C:\Windows\System\VXYIFKE.exe
  2⤵
  PID:5964
- C:\Windows\System\TYpsvcq.exe
  C:\Windows\System\TYpsvcq.exe
  2⤵
  PID:6028
- C:\Windows\System\xpeVJLX.exe
  C:\Windows\System\xpeVJLX.exe
  2⤵
  PID:6088
- C:\Windows\System\apwjqoS.exe
  C:\Windows\System\apwjqoS.exe
  2⤵
  PID:5140
- C:\Windows\System\GeOKGbE.exe
  C:\Windows\System\GeOKGbE.exe
  2⤵
  PID:5312
- C:\Windows\System\noqQkVY.exe
  C:\Windows\System\noqQkVY.exe
  2⤵
  PID:5376
- C:\Windows\System\ouJBkND.exe
  C:\Windows\System\ouJBkND.exe
  2⤵
  PID:4744
- C:\Windows\System\gBNTCyP.exe
  C:\Windows\System\gBNTCyP.exe
  2⤵
  PID:5596
- C:\Windows\System\mVEdepX.exe
  C:\Windows\System\mVEdepX.exe
  2⤵
  PID:1200
- C:\Windows\System\RMcwHyr.exe
  C:\Windows\System\RMcwHyr.exe
  2⤵
  PID:5824
- C:\Windows\System\rVIEHkP.exe
  C:\Windows\System\rVIEHkP.exe
  2⤵
  PID:6024
- C:\Windows\System\MjAwGeF.exe
  C:\Windows\System\MjAwGeF.exe
  2⤵
  PID:5368
- C:\Windows\System\DgvLKwc.exe
  C:\Windows\System\DgvLKwc.exe
  2⤵
  PID:5536
- C:\Windows\System\gfJGEQs.exe
  C:\Windows\System\gfJGEQs.exe
  2⤵
  PID:5796
- C:\Windows\System\cwkuELN.exe
  C:\Windows\System\cwkuELN.exe
  2⤵
  PID:6140
- C:\Windows\System\kjmMRip.exe
  C:\Windows\System\kjmMRip.exe
  2⤵
  PID:5660
- C:\Windows\System\sszGceR.exe
  C:\Windows\System\sszGceR.exe
  2⤵
  PID:4080
- C:\Windows\System\dBCqMLd.exe
  C:\Windows\System\dBCqMLd.exe
  2⤵
  PID:6180
- C:\Windows\System\SogiXFm.exe
  C:\Windows\System\SogiXFm.exe
  2⤵
  PID:6200
- C:\Windows\System\rSUcEtD.exe
  C:\Windows\System\rSUcEtD.exe
  2⤵
  PID:6224
- C:\Windows\System\nrbqfcB.exe
  C:\Windows\System\nrbqfcB.exe
  2⤵
  PID:6256
- C:\Windows\System\LdoZnSt.exe
  C:\Windows\System\LdoZnSt.exe
  2⤵
  PID:6280
- C:\Windows\System\sHlueuo.exe
  C:\Windows\System\sHlueuo.exe
  2⤵
  PID:6308
- C:\Windows\System\aliNuXi.exe
  C:\Windows\System\aliNuXi.exe
  2⤵
  PID:6340
- C:\Windows\System\CmWUDBA.exe
  C:\Windows\System\CmWUDBA.exe
  2⤵
  PID:6376
- C:\Windows\System\BsHZhhR.exe
  C:\Windows\System\BsHZhhR.exe
  2⤵
  PID:6404
- C:\Windows\System\hpHDEPq.exe
  C:\Windows\System\hpHDEPq.exe
  2⤵
  PID:6432
- C:\Windows\System\xtUhYIu.exe
  C:\Windows\System\xtUhYIu.exe
  2⤵
  PID:6460
- C:\Windows\System\FHmjawL.exe
  C:\Windows\System\FHmjawL.exe
  2⤵
  PID:6488
- C:\Windows\System\IpjdyAv.exe
  C:\Windows\System\IpjdyAv.exe
  2⤵
  PID:6516
- C:\Windows\System\tvVIQIB.exe
  C:\Windows\System\tvVIQIB.exe
  2⤵
  PID:6544
- C:\Windows\System\doSUGWf.exe
  C:\Windows\System\doSUGWf.exe
  2⤵
  PID:6584
- C:\Windows\System\DCocFgH.exe
  C:\Windows\System\DCocFgH.exe
  2⤵
  PID:6600
- C:\Windows\System\FVSAIxr.exe
  C:\Windows\System\FVSAIxr.exe
  2⤵
  PID:6628
- C:\Windows\System\rDWbmyE.exe
  C:\Windows\System\rDWbmyE.exe
  2⤵
  PID:6660
- C:\Windows\System\KQdKqxn.exe
  C:\Windows\System\KQdKqxn.exe
  2⤵
  PID:6688
- C:\Windows\System\dBtsQAB.exe
  C:\Windows\System\dBtsQAB.exe
  2⤵
  PID:6716
- C:\Windows\System\pXCxdUg.exe
  C:\Windows\System\pXCxdUg.exe
  2⤵
  PID:6744
- C:\Windows\System\XFfoiCe.exe
  C:\Windows\System\XFfoiCe.exe
  2⤵
  PID:6760
- C:\Windows\System\uvAcZPt.exe
  C:\Windows\System\uvAcZPt.exe
  2⤵
  PID:6792
- C:\Windows\System\WzbvMRw.exe
  C:\Windows\System\WzbvMRw.exe
  2⤵
  PID:6820
- C:\Windows\System\fnuJUpo.exe
  C:\Windows\System\fnuJUpo.exe
  2⤵
  PID:6856
- C:\Windows\System\xCGGlTK.exe
  C:\Windows\System\xCGGlTK.exe
  2⤵
  PID:6888
- C:\Windows\System\sWQERvd.exe
  C:\Windows\System\sWQERvd.exe
  2⤵
  PID:6912
- C:\Windows\System\QqJakJf.exe
  C:\Windows\System\QqJakJf.exe
  2⤵
  PID:6948
- C:\Windows\System\aiNQdic.exe
  C:\Windows\System\aiNQdic.exe
  2⤵
  PID:6976
- C:\Windows\System\TLmfsTJ.exe
  C:\Windows\System\TLmfsTJ.exe
  2⤵
  PID:7004
- C:\Windows\System\TXFBTXa.exe
  C:\Windows\System\TXFBTXa.exe
  2⤵
  PID:7032
- C:\Windows\System\SbGUwHS.exe
  C:\Windows\System\SbGUwHS.exe
  2⤵
  PID:7060
- C:\Windows\System\wccGMEB.exe
  C:\Windows\System\wccGMEB.exe
  2⤵
  PID:7088
- C:\Windows\System\wDwkYYn.exe
  C:\Windows\System\wDwkYYn.exe
  2⤵
  PID:7116
- C:\Windows\System\dMmQSBr.exe
  C:\Windows\System\dMmQSBr.exe
  2⤵
  PID:7144
- C:\Windows\System\vgEVGua.exe
  C:\Windows\System\vgEVGua.exe
  2⤵
  PID:5632
- C:\Windows\System\LCiFZcL.exe
  C:\Windows\System\LCiFZcL.exe
  2⤵
  PID:6188
- C:\Windows\System\AhmGgKK.exe
  C:\Windows\System\AhmGgKK.exe
  2⤵
  PID:6276
- C:\Windows\System\HPieZYj.exe
  C:\Windows\System\HPieZYj.exe
  2⤵
  PID:6336
- C:\Windows\System\FEUBnEd.exe
  C:\Windows\System\FEUBnEd.exe
  2⤵
  PID:6400
- C:\Windows\System\ctsjbRj.exe
  C:\Windows\System\ctsjbRj.exe
  2⤵
  PID:6472
- C:\Windows\System\wOkMXCW.exe
  C:\Windows\System\wOkMXCW.exe
  2⤵
  PID:5612
- C:\Windows\System\pPeNuAH.exe
  C:\Windows\System\pPeNuAH.exe
  2⤵
  PID:1696
- C:\Windows\System\rhXGORj.exe
  C:\Windows\System\rhXGORj.exe
  2⤵
  PID:1608
- C:\Windows\System\AQrrxuz.exe
  C:\Windows\System\AQrrxuz.exe
  2⤵
  PID:1572
- C:\Windows\System\vvlTNdH.exe
  C:\Windows\System\vvlTNdH.exe
  2⤵
  PID:6592
- C:\Windows\System\DDuWXFv.exe
  C:\Windows\System\DDuWXFv.exe
  2⤵
  PID:4980
- C:\Windows\System\NyTVWhv.exe
  C:\Windows\System\NyTVWhv.exe
  2⤵
  PID:6656
- C:\Windows\System\bnIlULW.exe
  C:\Windows\System\bnIlULW.exe
  2⤵
  PID:6740
- C:\Windows\System\ZWjluEf.exe
  C:\Windows\System\ZWjluEf.exe
  2⤵
  PID:6784
- C:\Windows\System\oAPrPnl.exe
  C:\Windows\System\oAPrPnl.exe
  2⤵
  PID:6828
- C:\Windows\System\iJFyeko.exe
  C:\Windows\System\iJFyeko.exe
  2⤵
  PID:6872
- C:\Windows\System\KmZQeUu.exe
  C:\Windows\System\KmZQeUu.exe
  2⤵
  PID:6932
- C:\Windows\System\GPKArEh.exe
  C:\Windows\System\GPKArEh.exe
  2⤵
  PID:7000
- C:\Windows\System\aioAAXl.exe
  C:\Windows\System\aioAAXl.exe
  2⤵
  PID:7076
- C:\Windows\System\HuImopG.exe
  C:\Windows\System\HuImopG.exe
  2⤵
  PID:7128
- C:\Windows\System\wSRuYMP.exe
  C:\Windows\System\wSRuYMP.exe
  2⤵
  PID:6176
- C:\Windows\System\sHZyRFa.exe
  C:\Windows\System\sHZyRFa.exe
  2⤵
  PID:6332
- C:\Windows\System\WmPrqcf.exe
  C:\Windows\System\WmPrqcf.exe
  2⤵
  PID:6512
- C:\Windows\System\RNCCLyG.exe
  C:\Windows\System\RNCCLyG.exe
  2⤵
  PID:868
- C:\Windows\System\gKcbGHv.exe
  C:\Windows\System\gKcbGHv.exe
  2⤵
  PID:5560
- C:\Windows\System\TkgwbcD.exe
  C:\Windows\System\TkgwbcD.exe
  2⤵
  PID:6700
- C:\Windows\System\nMJfnXw.exe
  C:\Windows\System\nMJfnXw.exe
  2⤵
  PID:6752
- C:\Windows\System\idPsbZS.exe
  C:\Windows\System\idPsbZS.exe
  2⤵
  PID:6848
- C:\Windows\System\zpLHsJc.exe
  C:\Windows\System\zpLHsJc.exe
  2⤵
  PID:7112
- C:\Windows\System\fJRnmoQ.exe
  C:\Windows\System\fJRnmoQ.exe
  2⤵
  PID:6164
- C:\Windows\System\nrfTbEu.exe
  C:\Windows\System\nrfTbEu.exe
  2⤵
  PID:6560
- C:\Windows\System\rcMyqNE.exe
  C:\Windows\System\rcMyqNE.exe
  2⤵
  PID:1680
- C:\Windows\System\HDDEVnT.exe
  C:\Windows\System\HDDEVnT.exe
  2⤵
  PID:6852
- C:\Windows\System\FtYiYlw.exe
  C:\Windows\System\FtYiYlw.exe
  2⤵
  PID:4132
- C:\Windows\System\dFeIWHt.exe
  C:\Windows\System\dFeIWHt.exe
  2⤵
  PID:7172
- C:\Windows\System\TiJLoau.exe
  C:\Windows\System\TiJLoau.exe
  2⤵
  PID:7208
- C:\Windows\System\PloTRrp.exe
  C:\Windows\System\PloTRrp.exe
  2⤵
  PID:7228
- C:\Windows\System\DVkVbhB.exe
  C:\Windows\System\DVkVbhB.exe
  2⤵
  PID:7260
- C:\Windows\System\PpeHsKH.exe
  C:\Windows\System\PpeHsKH.exe
  2⤵
  PID:7292
- C:\Windows\System\TjdfwFR.exe
  C:\Windows\System\TjdfwFR.exe
  2⤵
  PID:7324
- C:\Windows\System\xaNFiMP.exe
  C:\Windows\System\xaNFiMP.exe
  2⤵
  PID:7352
- C:\Windows\System\FsUNexY.exe
  C:\Windows\System\FsUNexY.exe
  2⤵
  PID:7380
- C:\Windows\System\oAFPBcv.exe
  C:\Windows\System\oAFPBcv.exe
  2⤵
  PID:7412
- C:\Windows\System\NTWwASw.exe
  C:\Windows\System\NTWwASw.exe
  2⤵
  PID:7452
- C:\Windows\System\rkzBOwK.exe
  C:\Windows\System\rkzBOwK.exe
  2⤵
  PID:7476
- C:\Windows\System\QZyFhxl.exe
  C:\Windows\System\QZyFhxl.exe
  2⤵
  PID:7516
- C:\Windows\System\wUurUmB.exe
  C:\Windows\System\wUurUmB.exe
  2⤵
  PID:7540
- C:\Windows\System\uhTSmQh.exe
  C:\Windows\System\uhTSmQh.exe
  2⤵
  PID:7564
- C:\Windows\System\CAPMGdw.exe
  C:\Windows\System\CAPMGdw.exe
  2⤵
  PID:7588
- C:\Windows\System\UQoDQsG.exe
  C:\Windows\System\UQoDQsG.exe
  2⤵
  PID:7628
- C:\Windows\System\FhCnFbT.exe
  C:\Windows\System\FhCnFbT.exe
  2⤵
  PID:7656
- C:\Windows\System\zAbGuGi.exe
  C:\Windows\System\zAbGuGi.exe
  2⤵
  PID:7684
- C:\Windows\System\Hrrdred.exe
  C:\Windows\System\Hrrdred.exe
  2⤵
  PID:7708
- C:\Windows\System\IfInbxo.exe
  C:\Windows\System\IfInbxo.exe
  2⤵
  PID:7732
- C:\Windows\System\YoXSUZM.exe
  C:\Windows\System\YoXSUZM.exe
  2⤵
  PID:7756
- C:\Windows\System\AmeahIX.exe
  C:\Windows\System\AmeahIX.exe
  2⤵
  PID:7784
- C:\Windows\System\yPBGsLK.exe
  C:\Windows\System\yPBGsLK.exe
  2⤵
  PID:7816
- C:\Windows\System\hfXeRun.exe
  C:\Windows\System\hfXeRun.exe
  2⤵
  PID:7840
- C:\Windows\System\EECPRBA.exe
  C:\Windows\System\EECPRBA.exe
  2⤵
  PID:7880
- C:\Windows\System\CuScWaU.exe
  C:\Windows\System\CuScWaU.exe
  2⤵
  PID:7908
- C:\Windows\System\JwyjIHx.exe
  C:\Windows\System\JwyjIHx.exe
  2⤵
  PID:7932
- C:\Windows\System\vRhDhFV.exe
  C:\Windows\System\vRhDhFV.exe
  2⤵
  PID:7964
- C:\Windows\System\oxfVRCt.exe
  C:\Windows\System\oxfVRCt.exe
  2⤵
  PID:7992
- C:\Windows\System\HeNbcWZ.exe
  C:\Windows\System\HeNbcWZ.exe
  2⤵
  PID:8020
- C:\Windows\System\YihmqBz.exe
  C:\Windows\System\YihmqBz.exe
  2⤵
  PID:8048
- C:\Windows\System\eCBaxtv.exe
  C:\Windows\System\eCBaxtv.exe
  2⤵
  PID:8076
- C:\Windows\System\EpWvHab.exe
  C:\Windows\System\EpWvHab.exe
  2⤵
  PID:8104
- C:\Windows\System\FdtNRTn.exe
  C:\Windows\System\FdtNRTn.exe
  2⤵
  PID:8132
- C:\Windows\System\rvovVqH.exe
  C:\Windows\System\rvovVqH.exe
  2⤵
  PID:8160
- C:\Windows\System\MaeaWNg.exe
  C:\Windows\System\MaeaWNg.exe
  2⤵
  PID:8188
- C:\Windows\System\wWsaCxi.exe
  C:\Windows\System\wWsaCxi.exe
  2⤵
  PID:6964
- C:\Windows\System\AprSXWb.exe
  C:\Windows\System\AprSXWb.exe
  2⤵
  PID:7320
- C:\Windows\System\RCQoqqS.exe
  C:\Windows\System\RCQoqqS.exe
  2⤵
  PID:7336
- C:\Windows\System\OVrOnQd.exe
  C:\Windows\System\OVrOnQd.exe
  2⤵
  PID:7396
- C:\Windows\System\wCOxKct.exe
  C:\Windows\System\wCOxKct.exe
  2⤵
  PID:7460
- C:\Windows\System\eimHELt.exe
  C:\Windows\System\eimHELt.exe
  2⤵
  PID:7548
- C:\Windows\System\dpmjVUv.exe
  C:\Windows\System\dpmjVUv.exe
  2⤵
  PID:7580
- C:\Windows\System\iyikTKB.exe
  C:\Windows\System\iyikTKB.exe
  2⤵
  PID:7648
- C:\Windows\System\WRmhKqz.exe
  C:\Windows\System\WRmhKqz.exe
  2⤵
  PID:7740
- C:\Windows\System\lyDdJrE.exe
  C:\Windows\System\lyDdJrE.exe
  2⤵
  PID:7800
- C:\Windows\System\VhauZdQ.exe
  C:\Windows\System\VhauZdQ.exe
  2⤵
  PID:6864
- C:\Windows\System\ZklmASF.exe
  C:\Windows\System\ZklmASF.exe
  2⤵
  PID:7900
- C:\Windows\System\StOdKGs.exe
  C:\Windows\System\StOdKGs.exe
  2⤵
  PID:7988
- C:\Windows\System\IYWCDAg.exe
  C:\Windows\System\IYWCDAg.exe
  2⤵
  PID:8032
- C:\Windows\System\BgOjcbp.exe
  C:\Windows\System\BgOjcbp.exe
  2⤵
  PID:8100
- C:\Windows\System\CAhzHja.exe
  C:\Windows\System\CAhzHja.exe
  2⤵
  PID:8176
- C:\Windows\System\GTWQsuv.exe
  C:\Windows\System\GTWQsuv.exe
  2⤵
  PID:7272
- C:\Windows\System\XeQZLKo.exe
  C:\Windows\System\XeQZLKo.exe
  2⤵
  PID:7368
- C:\Windows\System\szSiHmV.exe
  C:\Windows\System\szSiHmV.exe
  2⤵
  PID:7508
- C:\Windows\System\CxgxNRw.exe
  C:\Windows\System\CxgxNRw.exe
  2⤵
  PID:7560
- C:\Windows\System\vwfxdRB.exe
  C:\Windows\System\vwfxdRB.exe
  2⤵
  PID:7704
- C:\Windows\System\ZPDHAYV.exe
  C:\Windows\System\ZPDHAYV.exe
  2⤵
  PID:7808
- C:\Windows\System\rEHXIly.exe
  C:\Windows\System\rEHXIly.exe
  2⤵
  PID:8044
- C:\Windows\System\OYNYxcv.exe
  C:\Windows\System\OYNYxcv.exe
  2⤵
  PID:8144
- C:\Windows\System\OhqxbzM.exe
  C:\Windows\System\OhqxbzM.exe
  2⤵
  PID:7252
- C:\Windows\System\ZnVFuLD.exe
  C:\Windows\System\ZnVFuLD.exe
  2⤵
  PID:7640
- C:\Windows\System\lnboVzU.exe
  C:\Windows\System\lnboVzU.exe
  2⤵
  PID:8196
- C:\Windows\System\FpDovgm.exe
  C:\Windows\System\FpDovgm.exe
  2⤵
  PID:8216
- C:\Windows\System\eRZnGzU.exe
  C:\Windows\System\eRZnGzU.exe
  2⤵
  PID:8240
- C:\Windows\System\zHNxyHn.exe
  C:\Windows\System\zHNxyHn.exe
  2⤵
  PID:8272
- C:\Windows\System\UIjEpWy.exe
  C:\Windows\System\UIjEpWy.exe
  2⤵
  PID:8300
- C:\Windows\System\CFvPGFy.exe
  C:\Windows\System\CFvPGFy.exe
  2⤵
  PID:8324
- C:\Windows\System\HqdOLKD.exe
  C:\Windows\System\HqdOLKD.exe
  2⤵
  PID:8368
- C:\Windows\System\eSqcxyH.exe
  C:\Windows\System\eSqcxyH.exe
  2⤵
  PID:8400
- C:\Windows\System\SQwoUmi.exe
  C:\Windows\System\SQwoUmi.exe
  2⤵
  PID:8436
- C:\Windows\System\cGUpARF.exe
  C:\Windows\System\cGUpARF.exe
  2⤵
  PID:8464
- C:\Windows\System\IzufofT.exe
  C:\Windows\System\IzufofT.exe
  2⤵
  PID:8492
- C:\Windows\System\DtayJrS.exe
  C:\Windows\System\DtayJrS.exe
  2⤵
  PID:8520
- C:\Windows\System\kGCHPNp.exe
  C:\Windows\System\kGCHPNp.exe
  2⤵
  PID:8548
- C:\Windows\System\HbUaAWq.exe
  C:\Windows\System\HbUaAWq.exe
  2⤵
  PID:8572
- C:\Windows\System\etzHgGy.exe
  C:\Windows\System\etzHgGy.exe
  2⤵
  PID:8604
- C:\Windows\System\lEgYXlR.exe
  C:\Windows\System\lEgYXlR.exe
  2⤵
  PID:8632
- C:\Windows\System\btLCsmS.exe
  C:\Windows\System\btLCsmS.exe
  2⤵
  PID:8656
- C:\Windows\System\IIrYwGv.exe
  C:\Windows\System\IIrYwGv.exe
  2⤵
  PID:8688
- C:\Windows\System\CDkWhUe.exe
  C:\Windows\System\CDkWhUe.exe
  2⤵
  PID:8708
- C:\Windows\System\kqjLmik.exe
  C:\Windows\System\kqjLmik.exe
  2⤵
  PID:8732
- C:\Windows\System\tmvZZXL.exe
  C:\Windows\System\tmvZZXL.exe
  2⤵
  PID:8760
- C:\Windows\System\GMhlhnC.exe
  C:\Windows\System\GMhlhnC.exe
  2⤵
  PID:8792
- C:\Windows\System\eXGeFzK.exe
  C:\Windows\System\eXGeFzK.exe
  2⤵
  PID:8816
- C:\Windows\System\eexZVxU.exe
  C:\Windows\System\eexZVxU.exe
  2⤵
  PID:8844
- C:\Windows\System\tQvyNnP.exe
  C:\Windows\System\tQvyNnP.exe
  2⤵
  PID:8872
- C:\Windows\System\YdyUrIi.exe
  C:\Windows\System\YdyUrIi.exe
  2⤵
  PID:8904
- C:\Windows\System\XbpyPLX.exe
  C:\Windows\System\XbpyPLX.exe
  2⤵
  PID:8928
- C:\Windows\System\yrLvpzx.exe
  C:\Windows\System\yrLvpzx.exe
  2⤵
  PID:8960
- C:\Windows\System\UeDLUja.exe
  C:\Windows\System\UeDLUja.exe
  2⤵
  PID:8984
- C:\Windows\System\OukqSwU.exe
  C:\Windows\System\OukqSwU.exe
  2⤵
  PID:9016
- C:\Windows\System\TcUgmyH.exe
  C:\Windows\System\TcUgmyH.exe
  2⤵
  PID:9040
- C:\Windows\System\qnkJhDZ.exe
  C:\Windows\System\qnkJhDZ.exe
  2⤵
  PID:9068
- C:\Windows\System\AYdullV.exe
  C:\Windows\System\AYdullV.exe
  2⤵
  PID:9096
- C:\Windows\System\YlJzTXC.exe
  C:\Windows\System\YlJzTXC.exe
  2⤵
  PID:9124
- C:\Windows\System\mHQNhSD.exe
  C:\Windows\System\mHQNhSD.exe
  2⤵
  PID:9152
- C:\Windows\System\cWgLElr.exe
  C:\Windows\System\cWgLElr.exe
  2⤵
  PID:9184
- C:\Windows\System\UkyXDvM.exe
  C:\Windows\System\UkyXDvM.exe
  2⤵
  PID:9212
- C:\Windows\System\CZrBBdn.exe
  C:\Windows\System\CZrBBdn.exe
  2⤵
  PID:8156
- C:\Windows\System\GlPJjRz.exe
  C:\Windows\System\GlPJjRz.exe
  2⤵
  PID:8288
- C:\Windows\System\abmzYQA.exe
  C:\Windows\System\abmzYQA.exe
  2⤵
  PID:8280
- C:\Windows\System\NVJkpqz.exe
  C:\Windows\System\NVJkpqz.exe
  2⤵
  PID:8376
- C:\Windows\System\WkpTaet.exe
  C:\Windows\System\WkpTaet.exe
  2⤵
  PID:8420
- C:\Windows\System\PFVtNHc.exe
  C:\Windows\System\PFVtNHc.exe
  2⤵
  PID:8480
- C:\Windows\System\ePGAUPF.exe
  C:\Windows\System\ePGAUPF.exe
  2⤵
  PID:8560
- C:\Windows\System\kXHAahA.exe
  C:\Windows\System\kXHAahA.exe
  2⤵
  PID:8616
- C:\Windows\System\dJwPLNC.exe
  C:\Windows\System\dJwPLNC.exe
  2⤵
  PID:8672
- C:\Windows\System\IrCFPkH.exe
  C:\Windows\System\IrCFPkH.exe
  2⤵
  PID:8748
- C:\Windows\System\ZvvxkGk.exe
  C:\Windows\System\ZvvxkGk.exe
  2⤵
  PID:8812
- C:\Windows\System\sVTySSX.exe
  C:\Windows\System\sVTySSX.exe
  2⤵
  PID:8892
- C:\Windows\System\PbLCGfk.exe
  C:\Windows\System\PbLCGfk.exe
  2⤵
  PID:8968
- C:\Windows\System\gETuXhf.exe
  C:\Windows\System\gETuXhf.exe
  2⤵
  PID:9024
- C:\Windows\System\piUkwCp.exe
  C:\Windows\System\piUkwCp.exe
  2⤵
  PID:9080
- C:\Windows\System\rxdtcCf.exe
  C:\Windows\System\rxdtcCf.exe
  2⤵
  PID:9136
- C:\Windows\System\OwzplSP.exe
  C:\Windows\System\OwzplSP.exe
  2⤵
  PID:9208
- C:\Windows\System\PBjnnjZ.exe
  C:\Windows\System\PBjnnjZ.exe
  2⤵
  PID:7500
- C:\Windows\System\EpIVCwX.exe
  C:\Windows\System\EpIVCwX.exe
  2⤵
  PID:8412
- C:\Windows\System\XhukocF.exe
  C:\Windows\System\XhukocF.exe
  2⤵
  PID:8448
- C:\Windows\System\ArkTEdP.exe
  C:\Windows\System\ArkTEdP.exe
  2⤵
  PID:8588
- C:\Windows\System\oPzgfLu.exe
  C:\Windows\System\oPzgfLu.exe
  2⤵
  PID:8784
- C:\Windows\System\mycoWVX.exe
  C:\Windows\System\mycoWVX.exe
  2⤵
  PID:8980
- C:\Windows\System\tHhkgSO.exe
  C:\Windows\System\tHhkgSO.exe
  2⤵
  PID:9028
- C:\Windows\System\bbrNPdi.exe
  C:\Windows\System\bbrNPdi.exe
  2⤵
  PID:9168
- C:\Windows\System\toKNBgJ.exe
  C:\Windows\System\toKNBgJ.exe
  2⤵
  PID:8236
- C:\Windows\System\ESPhdPX.exe
  C:\Windows\System\ESPhdPX.exe
  2⤵
  PID:8772
- C:\Windows\System\sHLLuuf.exe
  C:\Windows\System\sHLLuuf.exe
  2⤵
  PID:8808
- C:\Windows\System\peTNkSf.exe
  C:\Windows\System\peTNkSf.exe
  2⤵
  PID:6884
- C:\Windows\System\FHGHVFt.exe
  C:\Windows\System\FHGHVFt.exe
  2⤵
  PID:9240
- C:\Windows\System\uNNIzKP.exe
  C:\Windows\System\uNNIzKP.exe
  2⤵
  PID:9272
- C:\Windows\System\RPRqlKL.exe
  C:\Windows\System\RPRqlKL.exe
  2⤵
  PID:9292
- C:\Windows\System\mkBuJBz.exe
  C:\Windows\System\mkBuJBz.exe
  2⤵
  PID:9320
- C:\Windows\System\YEIsySF.exe
  C:\Windows\System\YEIsySF.exe
  2⤵
  PID:9352
- C:\Windows\System\DcKwqcD.exe
  C:\Windows\System\DcKwqcD.exe
  2⤵
  PID:9380
- C:\Windows\System\yHnJvgX.exe
  C:\Windows\System\yHnJvgX.exe
  2⤵
  PID:9404
- C:\Windows\System\HNpbBpF.exe
  C:\Windows\System\HNpbBpF.exe
  2⤵
  PID:9428
- C:\Windows\System\idKDOLB.exe
  C:\Windows\System\idKDOLB.exe
  2⤵
  PID:9452
- C:\Windows\System\RdSCsnE.exe
  C:\Windows\System\RdSCsnE.exe
  2⤵
  PID:9480
- C:\Windows\System\mkEwznU.exe
  C:\Windows\System\mkEwznU.exe
  2⤵
  PID:9508
- C:\Windows\System\fztfmLp.exe
  C:\Windows\System\fztfmLp.exe
  2⤵
  PID:9536
- C:\Windows\System\EgVwNOp.exe
  C:\Windows\System\EgVwNOp.exe
  2⤵
  PID:9564
- C:\Windows\System\yTouIeq.exe
  C:\Windows\System\yTouIeq.exe
  2⤵
  PID:9596
- C:\Windows\System\PQNVEPX.exe
  C:\Windows\System\PQNVEPX.exe
  2⤵
  PID:9620
- C:\Windows\System\whqzFvQ.exe
  C:\Windows\System\whqzFvQ.exe
  2⤵
  PID:9644
- C:\Windows\System\sHwGUOm.exe
  C:\Windows\System\sHwGUOm.exe
  2⤵
  PID:9668
- C:\Windows\System\EVXGkGM.exe
  C:\Windows\System\EVXGkGM.exe
  2⤵
  PID:9696
- C:\Windows\System\EYZpjxx.exe
  C:\Windows\System\EYZpjxx.exe
  2⤵
  PID:9720
- C:\Windows\System\RPlWXfR.exe
  C:\Windows\System\RPlWXfR.exe
  2⤵
  PID:9748
- C:\Windows\System\ZoXUTva.exe
  C:\Windows\System\ZoXUTva.exe
  2⤵
  PID:9776
- C:\Windows\System\FFuJsDl.exe
  C:\Windows\System\FFuJsDl.exe
  2⤵
  PID:9804
- C:\Windows\System\oXYMgDv.exe
  C:\Windows\System\oXYMgDv.exe
  2⤵
  PID:9824
- C:\Windows\System\GvJzziN.exe
  C:\Windows\System\GvJzziN.exe
  2⤵
  PID:9848
- C:\Windows\System\HSaIYCC.exe
  C:\Windows\System\HSaIYCC.exe
  2⤵
  PID:9880
- C:\Windows\System\epgzelU.exe
  C:\Windows\System\epgzelU.exe
  2⤵
  PID:9912
- C:\Windows\System\RoLcggE.exe
  C:\Windows\System\RoLcggE.exe
  2⤵
  PID:9936
- C:\Windows\System\sPCKqEv.exe
  C:\Windows\System\sPCKqEv.exe
  2⤵
  PID:9956
- C:\Windows\System\mILUxNL.exe
  C:\Windows\System\mILUxNL.exe
  2⤵
  PID:9976
- C:\Windows\System\qDibipF.exe
  C:\Windows\System\qDibipF.exe
  2⤵
  PID:10004
- C:\Windows\System\oDKQlYO.exe
  C:\Windows\System\oDKQlYO.exe
  2⤵
  PID:10032
- C:\Windows\System\motbLlw.exe
  C:\Windows\System\motbLlw.exe
  2⤵
  PID:10052
- C:\Windows\System\iXZWumL.exe
  C:\Windows\System\iXZWumL.exe
  2⤵
  PID:10072
- C:\Windows\System\AdycBSa.exe
  C:\Windows\System\AdycBSa.exe
  2⤵
  PID:10100
- C:\Windows\System\vkjnBCO.exe
  C:\Windows\System\vkjnBCO.exe
  2⤵
  PID:10136
- C:\Windows\System\iMKPYei.exe
  C:\Windows\System\iMKPYei.exe
  2⤵
  PID:10160
- C:\Windows\System\JufZihm.exe
  C:\Windows\System\JufZihm.exe
  2⤵
  PID:10184
- C:\Windows\System\VlDbFTW.exe
  C:\Windows\System\VlDbFTW.exe
  2⤵
  PID:10212
- C:\Windows\System\hIfWdtM.exe
  C:\Windows\System\hIfWdtM.exe
  2⤵
  PID:10236
- C:\Windows\System\hjUSjDo.exe
  C:\Windows\System\hjUSjDo.exe
  2⤵
  PID:9256
- C:\Windows\System\kKuYbYY.exe
  C:\Windows\System\kKuYbYY.exe
  2⤵
  PID:9248
- C:\Windows\System\tNvXhDA.exe
  C:\Windows\System\tNvXhDA.exe
  2⤵
  PID:9372
- C:\Windows\System\RsuCSgG.exe
  C:\Windows\System\RsuCSgG.exe
  2⤵
  PID:9368
- C:\Windows\System\GHMGLpZ.exe
  C:\Windows\System\GHMGLpZ.exe
  2⤵
  PID:9396
- C:\Windows\System\yaawBFF.exe
  C:\Windows\System\yaawBFF.exe
  2⤵
  PID:9492
- C:\Windows\System\yvKNXGi.exe
  C:\Windows\System\yvKNXGi.exe
  2⤵
  PID:9608
- C:\Windows\System\mKpxtFq.exe
  C:\Windows\System\mKpxtFq.exe
  2⤵
  PID:9576
- C:\Windows\System\QqrEnwa.exe
  C:\Windows\System\QqrEnwa.exe
  2⤵
  PID:9688
- C:\Windows\System\zKWAEer.exe
  C:\Windows\System\zKWAEer.exe
  2⤵
  PID:9764
- C:\Windows\System\hyzwPvN.exe
  C:\Windows\System\hyzwPvN.exe
  2⤵
  PID:9744
- C:\Windows\System\zdnvgrK.exe
  C:\Windows\System\zdnvgrK.exe
  2⤵
  PID:9840
- C:\Windows\System\EXcKLzg.exe
  C:\Windows\System\EXcKLzg.exe
  2⤵
  PID:9872
- C:\Windows\System\XcDddDv.exe
  C:\Windows\System\XcDddDv.exe
  2⤵
  PID:9820
- C:\Windows\System\WrjlGyT.exe
  C:\Windows\System\WrjlGyT.exe
  2⤵
  PID:9900
- C:\Windows\System\axKToMU.exe
  C:\Windows\System\axKToMU.exe
  2⤵
  PID:10012
- C:\Windows\System\qeOYEIZ.exe
  C:\Windows\System\qeOYEIZ.exe
  2⤵
  PID:9928
- C:\Windows\System\rdSfwXr.exe
  C:\Windows\System\rdSfwXr.exe
  2⤵
  PID:10044
- C:\Windows\System\MPCwWSo.exe
  C:\Windows\System\MPCwWSo.exe
  2⤵
  PID:10148
- C:\Windows\System\soKZzwO.exe
  C:\Windows\System\soKZzwO.exe
  2⤵
  PID:10200
- C:\Windows\System\RhYnuXR.exe
  C:\Windows\System\RhYnuXR.exe
  2⤵
  PID:10228
- C:\Windows\System\DkunVBQ.exe
  C:\Windows\System\DkunVBQ.exe
  2⤵
  PID:9424
- C:\Windows\System\VPFRrYj.exe
  C:\Windows\System\VPFRrYj.exe
  2⤵
  PID:9472
- C:\Windows\System\eZMghJt.exe
  C:\Windows\System\eZMghJt.exe
  2⤵
  PID:9532
- C:\Windows\System\AkMAqTW.exe
  C:\Windows\System\AkMAqTW.exe
  2⤵
  PID:9660
- C:\Windows\System\KZCesUq.exe
  C:\Windows\System\KZCesUq.exe
  2⤵
  PID:9876
- C:\Windows\System\BQuSwZB.exe
  C:\Windows\System\BQuSwZB.exe
  2⤵
  PID:10024
- C:\Windows\System\EgVgpjN.exe
  C:\Windows\System\EgVgpjN.exe
  2⤵
  PID:10244
- C:\Windows\System\suaVrfk.exe
  C:\Windows\System\suaVrfk.exe
  2⤵
  PID:10272
- C:\Windows\System\IbgAMVa.exe
  C:\Windows\System\IbgAMVa.exe
  2⤵
  PID:10300
- C:\Windows\System\JxxdOQO.exe
  C:\Windows\System\JxxdOQO.exe
  2⤵
  PID:10332
- C:\Windows\System\tYIwEIy.exe
  C:\Windows\System\tYIwEIy.exe
  2⤵
  PID:10356
- C:\Windows\System\WufcTgH.exe
  C:\Windows\System\WufcTgH.exe
  2⤵
  PID:10384
- C:\Windows\System\OOpaAJG.exe
  C:\Windows\System\OOpaAJG.exe
  2⤵
  PID:10416
- C:\Windows\System\ShDksnM.exe
  C:\Windows\System\ShDksnM.exe
  2⤵
  PID:10444
- C:\Windows\System\SsAOPWQ.exe
  C:\Windows\System\SsAOPWQ.exe
  2⤵
  PID:10464
- C:\Windows\System\MLZhgBP.exe
  C:\Windows\System\MLZhgBP.exe
  2⤵
  PID:10488
- C:\Windows\System\hnEoMUX.exe
  C:\Windows\System\hnEoMUX.exe
  2⤵
  PID:10516
- C:\Windows\System\hYOwhRE.exe
  C:\Windows\System\hYOwhRE.exe
  2⤵
  PID:10544
- C:\Windows\System\vUvKlOD.exe
  C:\Windows\System\vUvKlOD.exe
  2⤵
  PID:10572
- C:\Windows\System\TXyogrP.exe
  C:\Windows\System\TXyogrP.exe
  2⤵
  PID:10600
- C:\Windows\System\gfCtfli.exe
  C:\Windows\System\gfCtfli.exe
  2⤵
  PID:10660
- C:\Windows\System\kOMvbcD.exe
  C:\Windows\System\kOMvbcD.exe
  2⤵
  PID:10684
- C:\Windows\System\IynlUNE.exe
  C:\Windows\System\IynlUNE.exe
  2⤵
  PID:10716
- C:\Windows\System\RCDgkEt.exe
  C:\Windows\System\RCDgkEt.exe
  2⤵
  PID:10736
- C:\Windows\System\jxIpXnY.exe
  C:\Windows\System\jxIpXnY.exe
  2⤵
  PID:10756
- C:\Windows\System\ubjtndv.exe
  C:\Windows\System\ubjtndv.exe
  2⤵
  PID:10772
- C:\Windows\System\HzXoUdh.exe
  C:\Windows\System\HzXoUdh.exe
  2⤵
  PID:10796
- C:\Windows\System\TfUdAKy.exe
  C:\Windows\System\TfUdAKy.exe
  2⤵
  PID:10820
- C:\Windows\System\FgTrxnK.exe
  C:\Windows\System\FgTrxnK.exe
  2⤵
  PID:10844
- C:\Windows\System\xsmKhNi.exe
  C:\Windows\System\xsmKhNi.exe
  2⤵
  PID:10868
- C:\Windows\System\XqNxLvm.exe
  C:\Windows\System\XqNxLvm.exe
  2⤵
  PID:10892
- C:\Windows\System\TWCVOQH.exe
  C:\Windows\System\TWCVOQH.exe
  2⤵
  PID:10920
- C:\Windows\System\glpnRze.exe
  C:\Windows\System\glpnRze.exe
  2⤵
  PID:10944
- C:\Windows\System\oOrhKYq.exe
  C:\Windows\System\oOrhKYq.exe
  2⤵
  PID:10976
- C:\Windows\System\szXMzit.exe
  C:\Windows\System\szXMzit.exe
  2⤵
  PID:11008
- C:\Windows\System\jpycAhl.exe
  C:\Windows\System\jpycAhl.exe
  2⤵
  PID:11036
- C:\Windows\System\XWEEDfd.exe
  C:\Windows\System\XWEEDfd.exe
  2⤵
  PID:11056
- C:\Windows\System\HUOawDj.exe
  C:\Windows\System\HUOawDj.exe
  2⤵
  PID:11080
- C:\Windows\System\LbvPqWo.exe
  C:\Windows\System\LbvPqWo.exe
  2⤵
  PID:11108
- C:\Windows\System\vlcWaMO.exe
  C:\Windows\System\vlcWaMO.exe
  2⤵
  PID:11132
- C:\Windows\System\GMbtyDN.exe
  C:\Windows\System\GMbtyDN.exe
  2⤵
  PID:11164
- C:\Windows\System\mmzgxrM.exe
  C:\Windows\System\mmzgxrM.exe
  2⤵
  PID:11184
- C:\Windows\System\EJmqHwb.exe
  C:\Windows\System\EJmqHwb.exe
  2⤵
  PID:11212
- C:\Windows\System\zsMcaTy.exe
  C:\Windows\System\zsMcaTy.exe
  2⤵
  PID:11236
- C:\Windows\System\eDaIBus.exe
  C:\Windows\System\eDaIBus.exe
  2⤵
  PID:9784
- C:\Windows\System\gIkwNWR.exe
  C:\Windows\System\gIkwNWR.exe
  2⤵
  PID:9640
- C:\Windows\System\UokIqjk.exe
  C:\Windows\System\UokIqjk.exe
  2⤵
  PID:10264
- C:\Windows\System\NcjmHWk.exe
  C:\Windows\System\NcjmHWk.exe
  2⤵
  PID:9816
- C:\Windows\System\PGbYphb.exe
  C:\Windows\System\PGbYphb.exe
  2⤵
  PID:10092
- C:\Windows\System\ReXFxEM.exe
  C:\Windows\System\ReXFxEM.exe
  2⤵
  PID:9584
- C:\Windows\System\DUrhRYH.exe
  C:\Windows\System\DUrhRYH.exe
  2⤵
  PID:9592
- C:\Windows\System\VfnJYPu.exe
  C:\Windows\System\VfnJYPu.exe
  2⤵
  PID:10208
- C:\Windows\System\MsIVlzT.exe
  C:\Windows\System\MsIVlzT.exe
  2⤵
  PID:10608
- C:\Windows\System\ZPbaLnf.exe
  C:\Windows\System\ZPbaLnf.exe
  2⤵
  PID:10404
- C:\Windows\System\UgghntN.exe
  C:\Windows\System\UgghntN.exe
  2⤵
  PID:9332
- C:\Windows\System\sNvoQsC.exe
  C:\Windows\System\sNvoQsC.exe
  2⤵
  PID:10764
- C:\Windows\System\PkpFbyL.exe
  C:\Windows\System\PkpFbyL.exe
  2⤵
  PID:10396
- C:\Windows\System\tZVEtpT.exe
  C:\Windows\System\tZVEtpT.exe
  2⤵
  PID:10972
- C:\Windows\System\ARLgRom.exe
  C:\Windows\System\ARLgRom.exe
  2⤵
  PID:11076
- C:\Windows\System\nGIPyup.exe
  C:\Windows\System\nGIPyup.exe
  2⤵
  PID:11128
- C:\Windows\System\YqASJoa.exe
  C:\Windows\System\YqASJoa.exe
  2⤵
  PID:11156
- C:\Windows\System\BssBvCv.exe
  C:\Windows\System\BssBvCv.exe
  2⤵
  PID:10564
- C:\Windows\System\dZKZCua.exe
  C:\Windows\System\dZKZCua.exe
  2⤵
  PID:11256
- C:\Windows\System\VOAZDbS.exe
  C:\Windows\System\VOAZDbS.exe
  2⤵
  PID:10292
- C:\Windows\System\xGIPahS.exe
  C:\Windows\System\xGIPahS.exe
  2⤵
  PID:11280
- C:\Windows\System\fItlyNc.exe
  C:\Windows\System\fItlyNc.exe
  2⤵
  PID:11304
- C:\Windows\System\vDSTaWW.exe
  C:\Windows\System\vDSTaWW.exe
  2⤵
  PID:11340
- C:\Windows\System\LXJFvLQ.exe
  C:\Windows\System\LXJFvLQ.exe
  2⤵
  PID:11368
- C:\Windows\System\YOhuago.exe
  C:\Windows\System\YOhuago.exe
  2⤵
  PID:11388
- C:\Windows\System\IxMFgrV.exe
  C:\Windows\System\IxMFgrV.exe
  2⤵
  PID:11404
- C:\Windows\System\NBEvMWz.exe
  C:\Windows\System\NBEvMWz.exe
  2⤵
  PID:11436
- C:\Windows\System\kzNgxia.exe
  C:\Windows\System\kzNgxia.exe
  2⤵
  PID:11456
- C:\Windows\System\gsUCbDS.exe
  C:\Windows\System\gsUCbDS.exe
  2⤵
  PID:11480
- C:\Windows\System\laKmCxr.exe
  C:\Windows\System\laKmCxr.exe
  2⤵
  PID:11504
- C:\Windows\System\VxlFjkt.exe
  C:\Windows\System\VxlFjkt.exe
  2⤵
  PID:11524
- C:\Windows\System\IXtSmJp.exe
  C:\Windows\System\IXtSmJp.exe
  2⤵
  PID:11552
- C:\Windows\System\TGeeqfh.exe
  C:\Windows\System\TGeeqfh.exe
  2⤵
  PID:11580
- C:\Windows\System\vHhISRD.exe
  C:\Windows\System\vHhISRD.exe
  2⤵
  PID:11616
- C:\Windows\System\XbUMbXJ.exe
  C:\Windows\System\XbUMbXJ.exe
  2⤵
  PID:11644
- C:\Windows\System\DynCxZX.exe
  C:\Windows\System\DynCxZX.exe
  2⤵
  PID:11676
- C:\Windows\System\qcrRxKw.exe
  C:\Windows\System\qcrRxKw.exe
  2⤵
  PID:11704
- C:\Windows\System\FpDqJBm.exe
  C:\Windows\System\FpDqJBm.exe
  2⤵
  PID:11720
- C:\Windows\System\HNVWgcN.exe
  C:\Windows\System\HNVWgcN.exe
  2⤵
  PID:11756
- C:\Windows\System\qbiXgtB.exe
  C:\Windows\System\qbiXgtB.exe
  2⤵
  PID:11784
- C:\Windows\System\WNANJpj.exe
  C:\Windows\System\WNANJpj.exe
  2⤵
  PID:11808
- C:\Windows\System\sTOigGI.exe
  C:\Windows\System\sTOigGI.exe
  2⤵
  PID:11828
- C:\Windows\System\PqmBZRc.exe
  C:\Windows\System\PqmBZRc.exe
  2⤵
  PID:11856
- C:\Windows\System\TYsSZeh.exe
  C:\Windows\System\TYsSZeh.exe
  2⤵
  PID:11884
- C:\Windows\System\AAFMlCq.exe
  C:\Windows\System\AAFMlCq.exe
  2⤵
  PID:11908
- C:\Windows\System\oZyYmVC.exe
  C:\Windows\System\oZyYmVC.exe
  2⤵
  PID:11936
- C:\Windows\System\ZvynyHm.exe
  C:\Windows\System\ZvynyHm.exe
  2⤵
  PID:11972
- C:\Windows\System\NMUdLSi.exe
  C:\Windows\System\NMUdLSi.exe
  2⤵
  PID:12004
- C:\Windows\System\YVxymsv.exe
  C:\Windows\System\YVxymsv.exe
  2⤵
  PID:12032
- C:\Windows\System\QQFfNsC.exe
  C:\Windows\System\QQFfNsC.exe
  2⤵
  PID:12056
- C:\Windows\System\TGyitul.exe
  C:\Windows\System\TGyitul.exe
  2⤵
  PID:12084
- C:\Windows\System\vhhhZeQ.exe
  C:\Windows\System\vhhhZeQ.exe
  2⤵
  PID:12104
- C:\Windows\System\STJtvhX.exe
  C:\Windows\System\STJtvhX.exe
  2⤵
  PID:12128
- C:\Windows\System\LBLjegz.exe
  C:\Windows\System\LBLjegz.exe
  2⤵
  PID:12152
- C:\Windows\System\jRNSmXz.exe
  C:\Windows\System\jRNSmXz.exe
  2⤵
  PID:12184
- C:\Windows\System\USsgnZU.exe
  C:\Windows\System\USsgnZU.exe
  2⤵
  PID:12208
- C:\Windows\System\GxSVHCn.exe
  C:\Windows\System\GxSVHCn.exe
  2⤵
  PID:12240
- C:\Windows\System\VJhncej.exe
  C:\Windows\System\VJhncej.exe
  2⤵
  PID:12264
- C:\Windows\System\AOOPjTv.exe
  C:\Windows\System\AOOPjTv.exe
  2⤵
  PID:11104
- C:\Windows\System\ZORtMDe.exe
  C:\Windows\System\ZORtMDe.exe
  2⤵
  PID:11196
- C:\Windows\System\kzcScoK.exe
  C:\Windows\System\kzcScoK.exe
  2⤵
  PID:10916
- C:\Windows\System\BiixVgj.exe
  C:\Windows\System\BiixVgj.exe
  2⤵
  PID:9716
- C:\Windows\System\zzVAulI.exe
  C:\Windows\System\zzVAulI.exe
  2⤵
  PID:11032
- C:\Windows\System\hKojiiP.exe
  C:\Windows\System\hKojiiP.exe
  2⤵
  PID:11180
- C:\Windows\System\WuYwPgl.exe
  C:\Windows\System\WuYwPgl.exe
  2⤵
  PID:11204
- C:\Windows\System\vcJfFcN.exe
  C:\Windows\System\vcJfFcN.exe
  2⤵
  PID:10936
- C:\Windows\System\EHEOOUz.exe
  C:\Windows\System\EHEOOUz.exe
  2⤵
  PID:9656
- C:\Windows\System\dMlaPIA.exe
  C:\Windows\System\dMlaPIA.exe
  2⤵
  PID:11176
- C:\Windows\System\wcsfyUL.exe
  C:\Windows\System\wcsfyUL.exe
  2⤵
  PID:10712
- C:\Windows\System\aksJPCC.exe
  C:\Windows\System\aksJPCC.exe
  2⤵
  PID:11576
- C:\Windows\System\FwCcPyf.exe
  C:\Windows\System\FwCcPyf.exe
  2⤵
  PID:11636
- C:\Windows\System\itMDseh.exe
  C:\Windows\System\itMDseh.exe
  2⤵
  PID:10196
- C:\Windows\System\GoNPtWc.exe
  C:\Windows\System\GoNPtWc.exe
  2⤵
  PID:11364
- C:\Windows\System\kxrLMWb.exe
  C:\Windows\System\kxrLMWb.exe
  2⤵
  PID:11376
- C:\Windows\System\byboihN.exe
  C:\Windows\System\byboihN.exe
  2⤵
  PID:11420
- C:\Windows\System\pTOyIPR.exe
  C:\Windows\System\pTOyIPR.exe
  2⤵
  PID:11448
- C:\Windows\System\GlaOQVl.exe
  C:\Windows\System\GlaOQVl.exe
  2⤵
  PID:10804
- C:\Windows\System\fiJYYGY.exe
  C:\Windows\System\fiJYYGY.exe
  2⤵
  PID:11500
- C:\Windows\System\WaskIfK.exe
  C:\Windows\System\WaskIfK.exe
  2⤵
  PID:11668
- C:\Windows\System\MfeASfM.exe
  C:\Windows\System\MfeASfM.exe
  2⤵
  PID:12164
- C:\Windows\System\mPIxJLx.exe
  C:\Windows\System\mPIxJLx.exe
  2⤵
  PID:12204
- C:\Windows\System\hbvNXRp.exe
  C:\Windows\System\hbvNXRp.exe
  2⤵
  PID:11824
- C:\Windows\System\Iloywnk.exe
  C:\Windows\System\Iloywnk.exe
  2⤵
  PID:10816
- C:\Windows\System\OiaSZPO.exe
  C:\Windows\System\OiaSZPO.exe
  2⤵
  PID:11968
- C:\Windows\System\bYlBZIb.exe
  C:\Windows\System\bYlBZIb.exe
  2⤵
  PID:11604
- C:\Windows\System\wgkGHUW.exe
  C:\Windows\System\wgkGHUW.exe
  2⤵
  PID:11628
- C:\Windows\System\ZfQIozp.exe
  C:\Windows\System\ZfQIozp.exe
  2⤵
  PID:10708
- C:\Windows\System\yDnvwzR.exe
  C:\Windows\System\yDnvwzR.exe
  2⤵
  PID:12116
- C:\Windows\System\QGCCsVW.exe
  C:\Windows\System\QGCCsVW.exe
  2⤵
  PID:12236
- C:\Windows\System\qOCXNsp.exe
  C:\Windows\System\qOCXNsp.exe
  2⤵
  PID:12296
- C:\Windows\System\YhmZelG.exe
  C:\Windows\System\YhmZelG.exe
  2⤵
  PID:12328
- C:\Windows\System\yfHbKyl.exe
  C:\Windows\System\yfHbKyl.exe
  2⤵
  PID:12356
- C:\Windows\System\jppzkoo.exe
  C:\Windows\System\jppzkoo.exe
  2⤵
  PID:12372
- C:\Windows\System\PleTpms.exe
  C:\Windows\System\PleTpms.exe
  2⤵
  PID:12400
- C:\Windows\System\QUaMLzy.exe
  C:\Windows\System\QUaMLzy.exe
  2⤵
  PID:12424
- C:\Windows\System\uKXqPOs.exe
  C:\Windows\System\uKXqPOs.exe
  2⤵
  PID:12456
- C:\Windows\System\tRGGDyQ.exe
  C:\Windows\System\tRGGDyQ.exe
  2⤵
  PID:12484
- C:\Windows\System\Einiyzg.exe
  C:\Windows\System\Einiyzg.exe
  2⤵
  PID:12512
- C:\Windows\System\GipOOsj.exe
  C:\Windows\System\GipOOsj.exe
  2⤵
  PID:12536
- C:\Windows\System\oXgkLSv.exe
  C:\Windows\System\oXgkLSv.exe
  2⤵
  PID:12560
- C:\Windows\System\XWTBvmv.exe
  C:\Windows\System\XWTBvmv.exe
  2⤵
  PID:12596
- C:\Windows\System\OAacZfl.exe
  C:\Windows\System\OAacZfl.exe
  2⤵
  PID:12616
- C:\Windows\System\KXJLtye.exe
  C:\Windows\System\KXJLtye.exe
  2⤵
  PID:12648
- C:\Windows\System\RPjVCYR.exe
  C:\Windows\System\RPjVCYR.exe
  2⤵
  PID:12668
- C:\Windows\System\FrkBnuM.exe
  C:\Windows\System\FrkBnuM.exe
  2⤵
  PID:12708
- C:\Windows\System\zCArjfo.exe
  C:\Windows\System\zCArjfo.exe
  2⤵
  PID:12732
- C:\Windows\System\behtpPQ.exe
  C:\Windows\System\behtpPQ.exe
  2⤵
  PID:12764
- C:\Windows\System\rBYoVpu.exe
  C:\Windows\System\rBYoVpu.exe
  2⤵
  PID:12792
- C:\Windows\System\GskkIDt.exe
  C:\Windows\System\GskkIDt.exe
  2⤵
  PID:12820
- C:\Windows\System\klnYJbJ.exe
  C:\Windows\System\klnYJbJ.exe
  2⤵
  PID:12844
- C:\Windows\System\jptoabS.exe
  C:\Windows\System\jptoabS.exe
  2⤵
  PID:12860
- C:\Windows\System\JpJDccY.exe
  C:\Windows\System\JpJDccY.exe
  2⤵
  PID:12888
- C:\Windows\System\FxjRafI.exe
  C:\Windows\System\FxjRafI.exe
  2⤵
  PID:12908
- C:\Windows\System\KFoVDbV.exe
  C:\Windows\System\KFoVDbV.exe
  2⤵
  PID:12932
- C:\Windows\System\cJJnAnh.exe
  C:\Windows\System\cJJnAnh.exe
  2⤵
  PID:12956
- C:\Windows\System\ymCdlFN.exe
  C:\Windows\System\ymCdlFN.exe
  2⤵
  PID:12992
- C:\Windows\System\zClUzxv.exe
  C:\Windows\System\zClUzxv.exe
  2⤵
  PID:13008
- C:\Windows\System\UuFNKit.exe
  C:\Windows\System\UuFNKit.exe
  2⤵
  PID:13032
- C:\Windows\System\bjLqrzY.exe
  C:\Windows\System\bjLqrzY.exe
  2⤵
  PID:13052
- C:\Windows\System\lhKWjsi.exe
  C:\Windows\System\lhKWjsi.exe
  2⤵
  PID:13068
- C:\Windows\System\KaSnDJx.exe
  C:\Windows\System\KaSnDJx.exe
  2⤵
  PID:13096
- C:\Windows\System\HTKOONS.exe
  C:\Windows\System\HTKOONS.exe
  2⤵
  PID:13124
- C:\Windows\System\sXXArtC.exe
  C:\Windows\System\sXXArtC.exe
  2⤵
  PID:13152
- C:\Windows\System\NGEQVwL.exe
  C:\Windows\System\NGEQVwL.exe
  2⤵
  PID:13176
- C:\Windows\System\tPRtIlR.exe
  C:\Windows\System\tPRtIlR.exe
  2⤵
  PID:13200
- C:\Windows\System\albakjG.exe
  C:\Windows\System\albakjG.exe
  2⤵
  PID:13232
- C:\Windows\System\yDIgbFJ.exe
  C:\Windows\System\yDIgbFJ.exe
  2⤵
  PID:13256
- C:\Windows\System\jyRkERy.exe
  C:\Windows\System\jyRkERy.exe
  2⤵
  PID:13284
- C:\Windows\System\YdpAUMa.exe
  C:\Windows\System\YdpAUMa.exe
  2⤵
  PID:13300
- C:\Windows\System\xNwRMSQ.exe
  C:\Windows\System\xNwRMSQ.exe
  2⤵
  PID:11416
- C:\Windows\System\KJfcxeH.exe
  C:\Windows\System\KJfcxeH.exe
  2⤵
  PID:11492
- C:\Windows\System\acVCGTg.exe
  C:\Windows\System\acVCGTg.exe
  2⤵
  PID:10956
- C:\Windows\System\wKjUeqd.exe
  C:\Windows\System\wKjUeqd.exe
  2⤵
  PID:12160
- C:\Windows\System\xlyGhyK.exe
  C:\Windows\System\xlyGhyK.exe
  2⤵
  PID:12200
- C:\Windows\System\iNSwuHR.exe
  C:\Windows\System\iNSwuHR.exe
  2⤵
  PID:11844
- C:\Windows\System\XMtQBrj.exe
  C:\Windows\System\XMtQBrj.exe
  2⤵
  PID:10296
- C:\Windows\System\SfIdRiW.exe
  C:\Windows\System\SfIdRiW.exe
  2⤵
  PID:11324
- C:\Windows\System\IlHpMwr.exe
  C:\Windows\System\IlHpMwr.exe
  2⤵
  PID:11716
- C:\Windows\System\ITMuIBl.exe
  C:\Windows\System\ITMuIBl.exe
  2⤵
  PID:11292
- C:\Windows\System\PDuwQKc.exe
  C:\Windows\System\PDuwQKc.exe
  2⤵
  PID:11044
- C:\Windows\System\evRCGGW.exe
  C:\Windows\System\evRCGGW.exe
  2⤵
  PID:12272
- C:\Windows\System\dqsFODV.exe
  C:\Windows\System\dqsFODV.exe
  2⤵
  PID:12640
- C:\Windows\System\YlCeImF.exe
  C:\Windows\System\YlCeImF.exe
  2⤵
  PID:12692
- C:\Windows\System\VmpXDzi.exe
  C:\Windows\System\VmpXDzi.exe
  2⤵
  PID:12180
- C:\Windows\System\GmvsJKU.exe
  C:\Windows\System\GmvsJKU.exe
  2⤵
  PID:12852
- C:\Windows\System\qernzTt.exe
  C:\Windows\System\qernzTt.exe
  2⤵
  PID:12352
- C:\Windows\System\MLRUPst.exe
  C:\Windows\System\MLRUPst.exe
  2⤵
  PID:12952
- C:\Windows\System\htzsKJk.exe
  C:\Windows\System\htzsKJk.exe
  2⤵
  PID:11744
- C:\Windows\System\wIgpiCe.exe
  C:\Windows\System\wIgpiCe.exe
  2⤵
  PID:13064
- C:\Windows\System\VTFCFEA.exe
  C:\Windows\System\VTFCFEA.exe
  2⤵
  PID:13136
- C:\Windows\System\pInXQjv.exe
  C:\Windows\System\pInXQjv.exe
  2⤵
  PID:11464
- C:\Windows\System\koRQExM.exe
  C:\Windows\System\koRQExM.exe
  2⤵
  PID:13244
- C:\Windows\System\NZmimTV.exe
  C:\Windows\System\NZmimTV.exe
  2⤵
  PID:12664
- C:\Windows\System\chJzMML.exe
  C:\Windows\System\chJzMML.exe
  2⤵
  PID:13296
- C:\Windows\System\AUbDpuW.exe
  C:\Windows\System\AUbDpuW.exe
  2⤵
  PID:12720
- C:\Windows\System\ByLaXXc.exe
  C:\Windows\System\ByLaXXc.exe
  2⤵
  PID:11852
- C:\Windows\System\SwvhuMZ.exe
  C:\Windows\System\SwvhuMZ.exe
  2⤵
  PID:13336
- C:\Windows\System\OkUABVy.exe
  C:\Windows\System\OkUABVy.exe
  2⤵
  PID:13360
- C:\Windows\System\WUIBJFd.exe
  C:\Windows\System\WUIBJFd.exe
  2⤵
  PID:13388
- C:\Windows\System\oSPNWKX.exe
  C:\Windows\System\oSPNWKX.exe
  2⤵
  PID:13408
- C:\Windows\System\yXEXMXA.exe
  C:\Windows\System\yXEXMXA.exe
  2⤵
  PID:13436
- C:\Windows\System\EmRHXww.exe
  C:\Windows\System\EmRHXww.exe
  2⤵
  PID:13460
- C:\Windows\System\HwaUdmd.exe
  C:\Windows\System\HwaUdmd.exe
  2⤵
  PID:13480
- C:\Windows\System\fwYiscQ.exe
  C:\Windows\System\fwYiscQ.exe
  2⤵
  PID:13508
- C:\Windows\System\rJoDXeR.exe
  C:\Windows\System\rJoDXeR.exe
  2⤵
  PID:13528
- C:\Windows\System\RjQSgNE.exe
  C:\Windows\System\RjQSgNE.exe
  2⤵
  PID:13552
- C:\Windows\System\cCFjzOO.exe
  C:\Windows\System\cCFjzOO.exe
  2⤵
  PID:13572
- C:\Windows\System\TRFceRE.exe
  C:\Windows\System\TRFceRE.exe
  2⤵
  PID:13600
- C:\Windows\System\SsiVdpG.exe
  C:\Windows\System\SsiVdpG.exe
  2⤵
  PID:13616
- C:\Windows\System\uqzTrrr.exe
  C:\Windows\System\uqzTrrr.exe
  2⤵
  PID:13640
- C:\Windows\System\kxCaCmJ.exe
  C:\Windows\System\kxCaCmJ.exe
  2⤵
  PID:13664
- C:\Windows\System\pBuuVuH.exe
  C:\Windows\System\pBuuVuH.exe
  2⤵
  PID:13696
- C:\Windows\System\mJbvxws.exe
  C:\Windows\System\mJbvxws.exe
  2⤵
  PID:13720
- C:\Windows\System\OcLpHpR.exe
  C:\Windows\System\OcLpHpR.exe
  2⤵
  PID:13748
- C:\Windows\System\EUembbU.exe
  C:\Windows\System\EUembbU.exe
  2⤵
  PID:13768
- C:\Windows\System\CUTXOqN.exe
  C:\Windows\System\CUTXOqN.exe
  2⤵
  PID:13804
- C:\Windows\System\wsfoCDe.exe
  C:\Windows\System\wsfoCDe.exe
  2⤵
  PID:13824
- C:\Windows\System\wDwmzQb.exe
  C:\Windows\System\wDwmzQb.exe
  2⤵
  PID:13864
- C:\Windows\System\PMLMqZl.exe
  C:\Windows\System\PMLMqZl.exe
  2⤵
  PID:13888
- C:\Windows\System\qTfVTev.exe
  C:\Windows\System\qTfVTev.exe
  2⤵
  PID:13908
- C:\Windows\System\MWCZQFG.exe
  C:\Windows\System\MWCZQFG.exe
  2⤵
  PID:13936
- C:\Windows\System\vTVExEQ.exe
  C:\Windows\System\vTVExEQ.exe
  2⤵
  PID:13952
- C:\Windows\System\ZWygSan.exe
  C:\Windows\System\ZWygSan.exe
  2⤵
  PID:13976
- C:\Windows\System\VRFipCb.exe
  C:\Windows\System\VRFipCb.exe
  2⤵
  PID:14004
- C:\Windows\System\pbiRWqg.exe
  C:\Windows\System\pbiRWqg.exe
  2⤵
  PID:14040
- C:\Windows\System\VuTTqyf.exe
  C:\Windows\System\VuTTqyf.exe
  2⤵
  PID:14064
- C:\Windows\System\NgKcbcC.exe
  C:\Windows\System\NgKcbcC.exe
  2⤵
  PID:14092
- C:\Windows\System\vJprSit.exe
  C:\Windows\System\vJprSit.exe
  2⤵
  PID:14124
- C:\Windows\System\yEjSJBH.exe
  C:\Windows\System\yEjSJBH.exe
  2⤵
  PID:14144
- C:\Windows\System\IrbbPeW.exe
  C:\Windows\System\IrbbPeW.exe
  2⤵
  PID:14172
- C:\Windows\System\UrBCOhc.exe
  C:\Windows\System\UrBCOhc.exe
  2⤵
  PID:14200
- C:\Windows\System\ZeDQgXb.exe
  C:\Windows\System\ZeDQgXb.exe
  2⤵
  PID:14224
- C:\Windows\System\nPBFZqk.exe
  C:\Windows\System\nPBFZqk.exe
  2⤵
  PID:14252
- C:\Windows\System\PsbUoKN.exe
  C:\Windows\System\PsbUoKN.exe
  2⤵
  PID:14268
- C:\Windows\System\ZmRaMdL.exe
  C:\Windows\System\ZmRaMdL.exe
  2⤵
  PID:14300
- C:\Windows\System\muwBoQV.exe
  C:\Windows\System\muwBoQV.exe
  2⤵
  PID:14328
- C:\Windows\System\sqiLuzv.exe
  C:\Windows\System\sqiLuzv.exe
  2⤵
  PID:11996
- C:\Windows\System\ZGgWqfJ.exe
  C:\Windows\System\ZGgWqfJ.exe
  2⤵
  PID:12920
- C:\Windows\System\SuqvTfi.exe
  C:\Windows\System\SuqvTfi.exe
  2⤵
  PID:11496
- C:\Windows\System\bYnWLcf.exe
  C:\Windows\System\bYnWLcf.exe
  2⤵
  PID:12636
- C:\Windows\System\Iiavkvg.exe
  C:\Windows\System\Iiavkvg.exe
  2⤵
  PID:11276
- C:\Windows\System\ilhBRiN.exe
  C:\Windows\System\ilhBRiN.exe
  2⤵
  PID:13116
- C:\Windows\System\OXlIiOq.exe
  C:\Windows\System\OXlIiOq.exe
  2⤵
  PID:12572
- C:\Windows\System\QXaKQrQ.exe
  C:\Windows\System\QXaKQrQ.exe
  2⤵
  PID:12576
- C:\Windows\System\MjUQZbW.exe
  C:\Windows\System\MjUQZbW.exe
  2⤵
  PID:10748
- C:\Windows\System\uVBlwCs.exe
  C:\Windows\System\uVBlwCs.exe
  2⤵
  PID:12800
- C:\Windows\System\tEENnvD.exe
  C:\Windows\System\tEENnvD.exe
  2⤵
  PID:10268
- C:\Windows\System\JNBUPSu.exe
  C:\Windows\System\JNBUPSu.exe
  2⤵
  PID:12252
- C:\Windows\System\QxoHpeA.exe
  C:\Windows\System\QxoHpeA.exe
  2⤵
  PID:13000
- C:\Windows\System\iXvTeAs.exe
  C:\Windows\System\iXvTeAs.exe
  2⤵
  PID:13636
- C:\Windows\System\qdktEGo.exe
  C:\Windows\System\qdktEGo.exe
  2⤵
  PID:13760
- C:\Windows\System\uvKqqIm.exe
  C:\Windows\System\uvKqqIm.exe
  2⤵
  PID:13816
- C:\Windows\System\xJLIEjM.exe
  C:\Windows\System\xJLIEjM.exe
  2⤵
  PID:12556
- C:\Windows\System\NRFSquX.exe
  C:\Windows\System\NRFSquX.exe
  2⤵
  PID:13988
- C:\Windows\System\iaGVFGs.exe
  C:\Windows\System\iaGVFGs.exe
  2⤵
  PID:14344
- C:\Windows\System\ifJYBri.exe
  C:\Windows\System\ifJYBri.exe
  2⤵
  PID:14368
- C:\Windows\System\YsZWUzQ.exe
  C:\Windows\System\YsZWUzQ.exe
  2⤵
  PID:14408
- C:\Windows\System\qAsVcIn.exe
  C:\Windows\System\qAsVcIn.exe
  2⤵
  PID:14436
- C:\Windows\System\auSmvjG.exe
  C:\Windows\System\auSmvjG.exe
  2⤵
  PID:14460
- C:\Windows\System\lZSRMZk.exe
  C:\Windows\System\lZSRMZk.exe
  2⤵
  PID:14488
- C:\Windows\System\NjZBefc.exe
  C:\Windows\System\NjZBefc.exe
  2⤵
  PID:14512
- C:\Windows\System\vKCNzZE.exe
  C:\Windows\System\vKCNzZE.exe
  2⤵
  PID:14532
- C:\Windows\System\kpPwpub.exe
  C:\Windows\System\kpPwpub.exe
  2⤵
  PID:14552
- C:\Windows\System\JmfGHRw.exe
  C:\Windows\System\JmfGHRw.exe
  2⤵
  PID:14580
- C:\Windows\System\IlFnZtU.exe
  C:\Windows\System\IlFnZtU.exe
  2⤵
  PID:14612
- C:\Windows\System\EPBZKIr.exe
  C:\Windows\System\EPBZKIr.exe
  2⤵
  PID:14628
- C:\Windows\System\NIpqsaD.exe
  C:\Windows\System\NIpqsaD.exe
  2⤵
  PID:14668
- C:\Windows\System\DVCksnJ.exe
  C:\Windows\System\DVCksnJ.exe
  2⤵
  PID:14684
- C:\Windows\System\vptjARa.exe
  C:\Windows\System\vptjARa.exe
  2⤵
  PID:14700
- C:\Windows\System\iBRpvYt.exe
  C:\Windows\System\iBRpvYt.exe
  2⤵
  PID:14716
- C:\Windows\System\XSNlXyE.exe
  C:\Windows\System\XSNlXyE.exe
  2⤵
  PID:14736
- C:\Windows\System\drTKshh.exe
  C:\Windows\System\drTKshh.exe
  2⤵
  PID:14768
- C:\Windows\System\wUvtykt.exe
  C:\Windows\System\wUvtykt.exe
  2⤵
  PID:14800
- C:\Windows\System\wrncdOI.exe
  C:\Windows\System\wrncdOI.exe
  2⤵
  PID:14824
- C:\Windows\System\nDxyday.exe
  C:\Windows\System\nDxyday.exe
  2⤵
  PID:14848
- C:\Windows\System\QkDxpHS.exe
  C:\Windows\System\QkDxpHS.exe
  2⤵
  PID:14872
- C:\Windows\System\jXekrpd.exe
  C:\Windows\System\jXekrpd.exe
  2⤵
  PID:14896
- C:\Windows\System\RnOFNkJ.exe
  C:\Windows\System\RnOFNkJ.exe
  2⤵
  PID:14916
- C:\Windows\System\dtuDmyJ.exe
  C:\Windows\System\dtuDmyJ.exe
  2⤵
  PID:14932
- C:\Windows\System\yppNCjl.exe
  C:\Windows\System\yppNCjl.exe
  2⤵
  PID:14948
- C:\Windows\System\VmmoyIU.exe
  C:\Windows\System\VmmoyIU.exe
  2⤵
  PID:14972
- C:\Windows\System\aGURcxz.exe
  C:\Windows\System\aGURcxz.exe
  2⤵
  PID:14992
- C:\Windows\System\gxwFbkO.exe
  C:\Windows\System\gxwFbkO.exe
  2⤵
  PID:15012
- C:\Windows\System\vfSZOPp.exe
  C:\Windows\System\vfSZOPp.exe
  2⤵
  PID:15044
- C:\Windows\System\hIXVzcn.exe
  C:\Windows\System\hIXVzcn.exe
  2⤵
  PID:15064
- C:\Windows\System\fWFuAIv.exe
  C:\Windows\System\fWFuAIv.exe
  2⤵
  PID:15096
- C:\Windows\System\LPqlGpd.exe
  C:\Windows\System\LPqlGpd.exe
  2⤵
  PID:15124
- C:\Windows\System\RSEFtXa.exe
  C:\Windows\System\RSEFtXa.exe
  2⤵
  PID:15144
- C:\Windows\System\lTTHGMk.exe
  C:\Windows\System\lTTHGMk.exe
  2⤵
  PID:15160
- C:\Windows\System\fnhuHfD.exe
  C:\Windows\System\fnhuHfD.exe
  2⤵
  PID:15184
- C:\Windows\System\HDppjgr.exe
  C:\Windows\System\HDppjgr.exe
  2⤵
  PID:15204
- C:\Windows\System\jPuvzAj.exe
  C:\Windows\System\jPuvzAj.exe
  2⤵
  PID:15236
- C:\Windows\System\mSSmgII.exe
  C:\Windows\System\mSSmgII.exe
  2⤵
  PID:15256
- C:\Windows\System\rEtRmzX.exe
  C:\Windows\System\rEtRmzX.exe
  2⤵
  PID:15276
- C:\Windows\System\OVSTioN.exe
  C:\Windows\System\OVSTioN.exe
  2⤵
  PID:15296
- C:\Windows\System\GLxClPE.exe
  C:\Windows\System\GLxClPE.exe
  2⤵
  PID:15332
- C:\Windows\System\YIwFVEj.exe
  C:\Windows\System\YIwFVEj.exe
  2⤵
  PID:12760
- C:\Windows\System\FrqituV.exe
  C:\Windows\System\FrqituV.exe
  2⤵
  PID:14060
- C:\Windows\System\mGqVKNE.exe
  C:\Windows\System\mGqVKNE.exe
  2⤵
  PID:13380
- C:\Windows\System\bkJuXZf.exe
  C:\Windows\System\bkJuXZf.exe
  2⤵
  PID:14208
- C:\Windows\System\catIlwb.exe
  C:\Windows\System\catIlwb.exe
  2⤵
  PID:13488
- C:\Windows\System\iBAHvtm.exe
  C:\Windows\System\iBAHvtm.exe
  2⤵
  PID:13548
- C:\Windows\System\KxbkeLV.exe
  C:\Windows\System\KxbkeLV.exe
  2⤵
  PID:11512
- C:\Windows\System\HGSHncK.exe
  C:\Windows\System\HGSHncK.exe
  2⤵
  PID:13684
- C:\Windows\System\zUaVbpH.exe
  C:\Windows\System\zUaVbpH.exe
  2⤵
  PID:12612
- C:\Windows\System\tXPEXfR.exe
  C:\Windows\System\tXPEXfR.exe
  2⤵
  PID:10668
- C:\Windows\System\anMHsFg.exe
  C:\Windows\System\anMHsFg.exe
  2⤵
  PID:13836
- C:\Windows\System\leUlslk.exe
  C:\Windows\System\leUlslk.exe
  2⤵
  PID:13896
- C:\Windows\System\rrkszKJ.exe
  C:\Windows\System\rrkszKJ.exe
  2⤵
  PID:13948
- C:\Windows\System\IvpNlmG.exe
  C:\Windows\System\IvpNlmG.exe
  2⤵
  PID:14664
- C:\Windows\System\uhoTaDT.exe
  C:\Windows\System\uhoTaDT.exe
  2⤵
  PID:12724
- C:\Windows\System\diSfLJp.exe
  C:\Windows\System\diSfLJp.exe
  2⤵
  PID:14728
- C:\Windows\System\TjwyIkZ.exe
  C:\Windows\System\TjwyIkZ.exe
  2⤵
  PID:15228
- C:\Windows\System\FNUxiMy.exe
  C:\Windows\System\FNUxiMy.exe
  2⤵
  PID:15060
- C:\Windows\System\JXqaaur.exe
  C:\Windows\System\JXqaaur.exe
  2⤵
  PID:15088
- C:\Windows\System\NxcQqUZ.exe
  C:\Windows\System\NxcQqUZ.exe
  2⤵
  PID:14572
- C:\Windows\System\ZnWozTt.exe
  C:\Windows\System\ZnWozTt.exe
  2⤵
  PID:15172
- C:\Windows\System\qCIHDsv.exe
  C:\Windows\System\qCIHDsv.exe
  2⤵
  PID:15316
- C:\Windows\System\GJmMdor.exe
  C:\Windows\System\GJmMdor.exe
  2⤵
  PID:13820
- C:\Windows\System\ACgpvHL.exe
  C:\Windows\System\ACgpvHL.exe
  2⤵
  PID:14168
- C:\Windows\System\NRSqNbM.exe
  C:\Windows\System\NRSqNbM.exe
  2⤵
  PID:14712
- C:\Windows\System\DVBlSyX.exe
  C:\Windows\System\DVBlSyX.exe
  2⤵
  PID:14980
- C:\Windows\System\xsDoAar.exe
  C:\Windows\System\xsDoAar.exe
  2⤵
  PID:13196
- C:\Windows\System\IrkYxgV.exe
  C:\Windows\System\IrkYxgV.exe
  2⤵
  PID:15376
- C:\Windows\System\PQkksGG.exe
  C:\Windows\System\PQkksGG.exe
  2⤵
  PID:15392
- C:\Windows\System\JHByyjf.exe
  C:\Windows\System\JHByyjf.exe
  2⤵
  PID:15412
- C:\Windows\System\irSWamc.exe
  C:\Windows\System\irSWamc.exe
  2⤵
  PID:15436
- C:\Windows\System\GcXQhob.exe
  C:\Windows\System\GcXQhob.exe
  2⤵
  PID:15464
- C:\Windows\System\bJRbBTp.exe
  C:\Windows\System\bJRbBTp.exe
  2⤵
  PID:15492
- C:\Windows\System\vVRauvE.exe
  C:\Windows\System\vVRauvE.exe
  2⤵
  PID:15516
- C:\Windows\System\pkvRqzj.exe
  C:\Windows\System\pkvRqzj.exe
  2⤵
  PID:15548
- C:\Windows\System\VsWqUjr.exe
  C:\Windows\System\VsWqUjr.exe
  2⤵
  PID:15572
- C:\Windows\System\eCrxTbF.exe
  C:\Windows\System\eCrxTbF.exe
  2⤵
  PID:15600
- C:\Windows\System\ROIwKJl.exe
  C:\Windows\System\ROIwKJl.exe
  2⤵
  PID:15616
- C:\Windows\System\BEWBodF.exe
  C:\Windows\System\BEWBodF.exe
  2⤵
  PID:15648
- C:\Windows\System\vHOCTot.exe
  C:\Windows\System\vHOCTot.exe
  2⤵
  PID:15680
- C:\Windows\System\IAnhPFI.exe
  C:\Windows\System\IAnhPFI.exe
  2⤵
  PID:15708
- C:\Windows\System\jRXsYYg.exe
  C:\Windows\System\jRXsYYg.exe
  2⤵
  PID:15728
- C:\Windows\System\MMkXxHI.exe
  C:\Windows\System\MMkXxHI.exe
  2⤵
  PID:15744
- C:\Windows\System\BXiLAaA.exe
  C:\Windows\System\BXiLAaA.exe
  2⤵
  PID:15772
- C:\Windows\System\nievvUd.exe
  C:\Windows\System\nievvUd.exe
  2⤵
  PID:15796
- C:\Windows\System\yZrJStb.exe
  C:\Windows\System\yZrJStb.exe
  2⤵
  PID:15812
- C:\Windows\System\umMOLEs.exe
  C:\Windows\System\umMOLEs.exe
  2⤵
  PID:15828
- C:\Windows\System\iqXpjvb.exe
  C:\Windows\System\iqXpjvb.exe
  2⤵
  PID:15876
- C:\Windows\System\TbLjpGj.exe
  C:\Windows\System\TbLjpGj.exe
  2⤵
  PID:15892
- C:\Windows\System\HjNzXRa.exe
  C:\Windows\System\HjNzXRa.exe
  2⤵
  PID:15912
- C:\Windows\System\qKPzwgD.exe
  C:\Windows\System\qKPzwgD.exe
  2⤵
  PID:15932
- C:\Windows\System\eifhsdt.exe
  C:\Windows\System\eifhsdt.exe
  2⤵
  PID:15956
- C:\Windows\System\SmJrUOv.exe
  C:\Windows\System\SmJrUOv.exe
  2⤵
  PID:15988
- C:\Windows\System\tljFCFr.exe
  C:\Windows\System\tljFCFr.exe
  2⤵
  PID:16004
- C:\Windows\System\tdKPgjK.exe
  C:\Windows\System\tdKPgjK.exe
  2⤵
  PID:16020
- C:\Windows\System\wAwBfrA.exe
  C:\Windows\System\wAwBfrA.exe
  2⤵
  PID:16036
- C:\Windows\System\iWkGYnV.exe
  C:\Windows\System\iWkGYnV.exe
  2⤵
  PID:16052
- C:\Windows\System\Msvjmve.exe
  C:\Windows\System\Msvjmve.exe
  2⤵
  PID:16068
- C:\Windows\System\wepRKaU.exe
  C:\Windows\System\wepRKaU.exe
  2⤵
  PID:16084
- C:\Windows\System\EIRaXwK.exe
  C:\Windows\System\EIRaXwK.exe
  2⤵
  PID:16124
- C:\Windows\System\GdtYIqX.exe
  C:\Windows\System\GdtYIqX.exe
  2⤵
  PID:16148
- C:\Windows\System\hNeaUZE.exe
  C:\Windows\System\hNeaUZE.exe
  2⤵
  PID:16168
- C:\Windows\System\czcVYht.exe
  C:\Windows\System\czcVYht.exe
  2⤵
  PID:16208
- C:\Windows\System\yGICoPq.exe
  C:\Windows\System\yGICoPq.exe
  2⤵
  PID:16244
- C:\Windows\System\OMNexza.exe
  C:\Windows\System\OMNexza.exe
  2⤵
  PID:16268
- C:\Windows\System\iYbapog.exe
  C:\Windows\System\iYbapog.exe
  2⤵
  PID:16284
- C:\Windows\System\NShLgfa.exe
  C:\Windows\System\NShLgfa.exe
  2⤵
  PID:16300
- C:\Windows\System\JBlSFEt.exe
  C:\Windows\System\JBlSFEt.exe
  2⤵
  PID:16324
- C:\Windows\System\HURPocZ.exe
  C:\Windows\System\HURPocZ.exe
  2⤵
  PID:16348
- C:\Windows\System\qYinTMP.exe
  C:\Windows\System\qYinTMP.exe
  2⤵
  PID:16364
- C:\Windows\System\StEHWRg.exe
  C:\Windows\System\StEHWRg.exe
  2⤵
  PID:14192
- C:\Windows\System\ecNCFng.exe
  C:\Windows\System\ecNCFng.exe
  2⤵
  PID:13448
- C:\Windows\System\kwdfuET.exe
  C:\Windows\System\kwdfuET.exe
  2⤵
  PID:15364
- C:\Windows\System\LdRVcag.exe
  C:\Windows\System\LdRVcag.exe
  2⤵
  PID:13416
- C:\Windows\System\cqtepZP.exe
  C:\Windows\System\cqtepZP.exe
  2⤵
  PID:15472
- C:\Windows\System\RIxfztl.exe
  C:\Windows\System\RIxfztl.exe
  2⤵
  PID:15500
- C:\Windows\System\khQOCVa.exe
  C:\Windows\System\khQOCVa.exe
  2⤵
  PID:13784
- C:\Windows\System\MgUBKjq.exe
  C:\Windows\System\MgUBKjq.exe
  2⤵
  PID:15724
- C:\Windows\System\ifTjsvJ.exe
  C:\Windows\System\ifTjsvJ.exe
  2⤵
  PID:15784
- C:\Windows\System\RgjQRjn.exe
  C:\Windows\System\RgjQRjn.exe
  2⤵
  PID:15900
- C:\Windows\System\oUjybvn.exe
  C:\Windows\System\oUjybvn.exe
  2⤵
  PID:15564
- C:\Windows\System\wEBCYXi.exe
  C:\Windows\System\wEBCYXi.exe
  2⤵
  PID:15372
- C:\Windows\System\SjbEbyn.exe
  C:\Windows\System\SjbEbyn.exe
  2⤵
  PID:15996
- C:\Windows\System\xOhqqhM.exe
  C:\Windows\System\xOhqqhM.exe
  2⤵
  PID:16064
- C:\Windows\System\ymPDFDM.exe
  C:\Windows\System\ymPDFDM.exe
  2⤵
  PID:16412
- C:\Windows\System\ZXlUzDP.exe
  C:\Windows\System\ZXlUzDP.exe
  2⤵
  PID:16456
- C:\Windows\System\idvCpZh.exe
  C:\Windows\System\idvCpZh.exe
  2⤵
  PID:16472
- C:\Windows\System\ZTZcAvK.exe
  C:\Windows\System\ZTZcAvK.exe
  2⤵
  PID:16492
- C:\Windows\System\jOJCRJV.exe
  C:\Windows\System\jOJCRJV.exe
  2⤵
  PID:16520
- C:\Windows\System\EbZoGro.exe
  C:\Windows\System\EbZoGro.exe
  2⤵
  PID:16540
- C:\Windows\System\iofvtCZ.exe
  C:\Windows\System\iofvtCZ.exe
  2⤵
  PID:16580
- C:\Windows\System\zPMIpIC.exe
  C:\Windows\System\zPMIpIC.exe
  2⤵
  PID:16600
- C:\Windows\System\lyERnvD.exe
  C:\Windows\System\lyERnvD.exe
  2⤵
  PID:16620
- C:\Windows\System\OPEIAJK.exe
  C:\Windows\System\OPEIAJK.exe
  2⤵
  PID:16656
- C:\Windows\System\oqqVEVg.exe
  C:\Windows\System\oqqVEVg.exe
  2⤵
  PID:16676
- C:\Windows\System\icgdgpJ.exe
  C:\Windows\System\icgdgpJ.exe
  2⤵
  PID:16696
- C:\Windows\System\VxHkhjz.exe
  C:\Windows\System\VxHkhjz.exe
  2⤵
  PID:16720
- C:\Windows\System\akRxctI.exe
  C:\Windows\System\akRxctI.exe
  2⤵
  PID:16748
- C:\Windows\System\aPbnohe.exe
  C:\Windows\System\aPbnohe.exe
  2⤵
  PID:16772
- C:\Windows\System\sKGUIoa.exe
  C:\Windows\System\sKGUIoa.exe
  2⤵
  PID:16792
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16792 -s 248
    3⤵
    PID:16260
- C:\Windows\System\NhNpwJD.exe
  C:\Windows\System\NhNpwJD.exe
  2⤵
  PID:16808
- C:\Windows\System\hSeGcjH.exe
  C:\Windows\System\hSeGcjH.exe
  2⤵
  PID:16828
- C:\Windows\System\COMXYPx.exe
  C:\Windows\System\COMXYPx.exe
  2⤵
  PID:16864
- C:\Windows\System\AUGsXjs.exe
  C:\Windows\System\AUGsXjs.exe
  2⤵
  PID:16880
- C:\Windows\System\mmpdMns.exe
  C:\Windows\System\mmpdMns.exe
  2⤵
  PID:16896
- C:\Windows\System\wQMeFBy.exe
  C:\Windows\System\wQMeFBy.exe
  2⤵
  PID:16912
- C:\Windows\System\uUxQMxH.exe
  C:\Windows\System\uUxQMxH.exe
  2⤵
  PID:16936
- C:\Windows\System\zEolLCo.exe
  C:\Windows\System\zEolLCo.exe
  2⤵
  PID:16960
- C:\Windows\System\riHpVmH.exe
  C:\Windows\System\riHpVmH.exe
  2⤵
  PID:16988
- C:\Windows\System\FuXmbew.exe
  C:\Windows\System\FuXmbew.exe
  2⤵
  PID:17012
- C:\Windows\System\ngyjpRe.exe
  C:\Windows\System\ngyjpRe.exe
  2⤵
  PID:17044
- C:\Windows\System\FILUijM.exe
  C:\Windows\System\FILUijM.exe
  2⤵
  PID:17064
- C:\Windows\System\ukjzgVX.exe
  C:\Windows\System\ukjzgVX.exe
  2⤵
  PID:17096
- C:\Windows\System\oYzOkAQ.exe
  C:\Windows\System\oYzOkAQ.exe
  2⤵
  PID:17116
- C:\Windows\System\eGlZFRV.exe
  C:\Windows\System\eGlZFRV.exe
  2⤵
  PID:17140
- C:\Windows\System\rMPNdJI.exe
  C:\Windows\System\rMPNdJI.exe
  2⤵
  PID:17168
- C:\Windows\System\FaYGKft.exe
  C:\Windows\System\FaYGKft.exe
  2⤵
  PID:17184
- C:\Windows\System\JvPsJjQ.exe
  C:\Windows\System\JvPsJjQ.exe
  2⤵
  PID:17204
- C:\Windows\System\vEzgcbB.exe
  C:\Windows\System\vEzgcbB.exe
  2⤵
  PID:17220
- C:\Windows\System\nrlzmTU.exe
  C:\Windows\System\nrlzmTU.exe
  2⤵
  PID:17236
- C:\Windows\System\tYbEzTW.exe
  C:\Windows\System\tYbEzTW.exe
  2⤵
  PID:17272
- C:\Windows\System\gCGeSWL.exe
  C:\Windows\System\gCGeSWL.exe
  2⤵
  PID:17288
- C:\Windows\System\ZoBGlsC.exe
  C:\Windows\System\ZoBGlsC.exe
  2⤵
  PID:17332
- C:\Windows\System\LcDCvZe.exe
  C:\Windows\System\LcDCvZe.exe
  2⤵
  PID:17356
- C:\Windows\System\qeZzmni.exe
  C:\Windows\System\qeZzmni.exe
  2⤵
  PID:17372
- C:\Windows\System\ApaMeLy.exe
  C:\Windows\System\ApaMeLy.exe
  2⤵
  PID:17388
- C:\Windows\System\ZfyaLyM.exe
  C:\Windows\System\ZfyaLyM.exe
  2⤵
  PID:15760

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ASANRrq.exe

Filesize
1.6MB

MD5
a81d8f98d142d746e987b981fcaceb2e

SHA1
5845ce8f255ce0fe23f7a83a477d61a04abf0a49

SHA256
9943f89004739814a5800d2331227ec038b81d9be2222bf7b9dab4dd518455bd

SHA512
97896cf310c35664b756831bb99004b492340edf4b3bde6b5d6f41a70092b500179279e0cccfae90c6d77cdf54dc31139ee973b87482bcc6d81c20333e8ef3e5

Download Submit
C:\Windows\System\ApSwYFk.exe

Filesize
1.6MB

MD5
5bfb8fc253c8dfa807e4afe977f77022

SHA1
9bf1091d7f748ab80bb168d8974f6e5451d3967e

SHA256
41022958aa32577bb602b382b628f6eb058cbaff683603a7451bdc13ba6b1d57

SHA512
38776ae14289a4afae11cc596286220e2898aeb0790f62f0d4976bfe007e2adac5bd5ba04718966f5ff03ca7c1a42d48d17c58c301a8c4896badc4d9e36d73bb

Download Submit
C:\Windows\System\BZEQulf.exe

Filesize
1.6MB

MD5
ede2d2bf3a5a7f21c5f5809e3ec444bd

SHA1
891052d925c8172850027b69f8c3d446d411f348

SHA256
6ab8c59a1150fc14fcae3567d12b55b9d78c35773357187f4febd5d831dd8ab9

SHA512
f4e8125491f745db6ac6800dafe7f7487d2e13a43e99a43fe59f68cfee72c1a978992d9b0134679efedb07b41dd0c4e43e85ccdc92f41f5df5388ca001211105

Download Submit
C:\Windows\System\CUbIYTf.exe

Filesize
1.6MB

MD5
c217400f037e23a698338c166f212562

SHA1
fb69544b1414883e15dbf608575f543ec6129f5b

SHA256
1e5a961b6955528208c976feea1921ff6d33da3ccd2d90b4818352a60f55a294

SHA512
94775ff384c5827ddc00a5854f7d0683b1a606b7944ba5b70433f7769f06ca0ec2d63c8ebc891f63fdcf1f864e6b69f06ec96c61acab3742b14d9aa93bde72b0

Download Submit
C:\Windows\System\CqIVbWR.exe

Filesize
1.6MB

MD5
d26292253c16a2848f3c4e6902a7377b

SHA1
ffb13181e0aaa2db664ae015d8eee0889272e524

SHA256
9773ac2cccd3ed0a7fbf138cdd93f3f28f5c81f5c3bc0dd1dfb0be20fc04796e

SHA512
3a4d41d2fdf774dcd2c3de43c540e025da10ce0a06668a5787ed8a0c7df2425509713c6fdbe917962aa554134e7f05c032a3463a68ff7e09f31aafbe15a2acdb

Download Submit
C:\Windows\System\CtBcVtD.exe

Filesize
1.6MB

MD5
26bc99e471e1826eb66599d5671b8778

SHA1
d44ef3e3af38795c16a15de476319d39eebfee83

SHA256
b362a4be7b426203d2ac4c565eff68906ce13920bd97b83f49203a6bc877e4c4

SHA512
cc531b773aff9ead76abfd4e978b4f0fb163400960847e22ece696ca30b2b28d4889d4d1b6e44c596c6674ad4f40549a31a7f66ebb4f507c934066cc0c93d060

Download Submit
C:\Windows\System\GaNrjFI.exe

Filesize
1.6MB

MD5
4be7c27fb619ecc653b3de3f881e26e9

SHA1
f69697ff0e84462c0e82ea5c3b1e427cc57f657a

SHA256
cdf4cf987ecd35c7f8f9bab6b39ffc4fce1d089bfb5bee831c6344ed0265fe8e

SHA512
a37a6a68fadfa884ed6051ba11c58b04fd1641d9c4d69e717bf184f3e2b31a129c32500ebac428043a2da6e642da7b83b214686289e25e9fe79cdc5980ddbbfb

Download Submit
C:\Windows\System\KPxocdu.exe

Filesize
1.6MB

MD5
d85c69b6f3979128c98b90098133d549

SHA1
d7b9337150d4984ebc6118593fb0f2415cb87edc

SHA256
8df9956f56f4e9c20df906790a5713f1f23b2dda3d2f9d1d0b74919b9cca1e0d

SHA512
912a2e1b593e5f92a28082644755cf238671897e2a640d022b9d272a3b5203845b8ee7ea9908be23e3297e7414c7328c12793436b4fe3bd09b047b51cd83934f

Download Submit
C:\Windows\System\KqYpIxF.exe

Filesize
1.6MB

MD5
4ab99821acaf08946705d6abaa78150d

SHA1
f5ea8b37a4967970397a96c5aba9dd73c30fb3b8

SHA256
16cb6d404da101f96929540382a001cabdfc9e5dd3ef89f9db6934cb085bf324

SHA512
14424776ab6a436e08d2b090c3304a146b81b0db31328a51f37d6dfed1547942f11e41418be6ba1a440055c7592bca5bf897aab10e7a8cfa75a41a849eb4ab4a

Download Submit
C:\Windows\System\MmKWfpI.exe

Filesize
1.6MB

MD5
7af73053bfe44f3f2807e39e208ba187

SHA1
49d535be7a00d53afbd58790ce3659d9453fcadc

SHA256
f59cd8f416e855d05f0f24a35055ee5f746c7e57d105b7941df698dae1e2658a

SHA512
7f2807a81e9194719d4fce5acfa36ff70a7884b7246cd18a1edf3f1c1e967112d2f3ab7b11f5e0914c3c6d38b3d525606054391ca994d4e4461d3d6e211037b9

Download Submit
C:\Windows\System\NbvENMM.exe

Filesize
1.6MB

MD5
13fd62219954b7402f436bc7bfb15d79

SHA1
7f1f5b6c6d164455ab758361a655c9935a1ddfc1

SHA256
2e325640db2ccaa7d0dfeb37497d4411a53fc1947f1b83c0d5a443c5806f6726

SHA512
ac3de39479d949fe11f82ca8817f966fc6e8b6f2357b33fd10ac2ddd8de245c10043fe83901980579fb424571e5f773fa375282d366f22c6a90dac78bc55eb0d

Download Submit
C:\Windows\System\PbDHHup.exe

Filesize
1.6MB

MD5
afba9a2f780a9afa9295f136237d1c66

SHA1
eefb1544781a47277000c78762a9914d7feddcac

SHA256
60feb98cab9e20b529d46d1a818de67a7fa922f313c2f328ea6b43a6cd74ba93

SHA512
a1fb0984c18c3c3bada5591790bfc56bd07f93744882de585d8c3905d83352763c2aefb5a49ffa00ccb08a0fa36aedae8b8875d6867cc70683b1cae8b2a355be

Download Submit
C:\Windows\System\QFflQCa.exe

Filesize
1.6MB

MD5
3a06b08b44b6367b1f3237867a00698c

SHA1
7dd148cd4e56329b4c22242245fd2a7adeaf4b41

SHA256
6a181494edb02ec72cfd0c2b5340cbb670aa6a6818b84ded6d4bdcbda063d149

SHA512
e7c1ee39878f2c48da6fda168f14b169a539dae33105e9dcf8c5b32b01d3690098f1fae92fcbc88ced1cad39c13cde773ba022327bf79513536232659c3db1c9

Download Submit
C:\Windows\System\TQAzqpg.exe

Filesize
1.6MB

MD5
f2bc290e33b9ef8e06e6adde1bd44add

SHA1
8ae8b6105c4b91aaf11d5ced87074b50dcc4a56d

SHA256
2f6bd5c0c63a51144d94264047073a9450670acbca0cf84aa28b260413e80990

SHA512
117fecd6b4d91876cf9d72c8349e048e500d6e435181d787410819e4467bc6262b30717f873a9535182e0db9819d7a34a53b4eea5ed4e7c2d627d8892b48cfb6

Download Submit
C:\Windows\System\UlexAnt.exe

Filesize
1.6MB

MD5
9e83d469fd8a5c8a6d7df7ee54c724f6

SHA1
36dbf16fdff1492298d106e4e2f8de2a3a16ad32

SHA256
7dbcf8724d2253627da18350986a52ef29ba537009f69372fd111130f41e0420

SHA512
169e4c4fe656326a300a41e893beeeb5db7c5bdfd23798bf3d66708f83c55a123ed8b25e97cc9ee9f316519ae7cfb80bc78207923d619abfcbeb46f777f66858

Download Submit
C:\Windows\System\YtBwXLl.exe

Filesize
1.6MB

MD5
17fa2567cba9f96abd155b6a4b4eb17f

SHA1
792fe40aa8795b4b3f010f3db615e39ef06d526f

SHA256
2f2487425c13fb90e6bd05e4e960d60afd69f2ff84e5c0c7d69af1dd778206d2

SHA512
f555f0af125f139ce88524fabe90f215bc90d649a744a8a09f27f371ec6ec8f23aef881289d02008128bf415489e7446a939c6d40af2787edc79e25200773902

Download Submit
C:\Windows\System\ZIvYhNp.exe

Filesize
1.6MB

MD5
3edac4659a69e20f22df9b498b409ee1

SHA1
3794f4ca9bf893f5a7091e5b80985bcc9cc663d7

SHA256
7a8f5308111258d96461a6f4c9e7e7a1d56f3356ffe1879941d49e3b885dcf47

SHA512
7aff199721d3f52ad35eba374eb1cb8b0942a0912c79ef17b914e706ae69a8129fd0e73ceeea28827c21cc02aab6ee4e8e5d1a8a7fa53e539880e466e1f4e808

Download Submit
C:\Windows\System\agKVTMk.exe

Filesize
1.6MB

MD5
1fcb40e36279f3233993b3420343156e

SHA1
e477f1d7f6559706d2af7c9901391c154003461b

SHA256
054c84abb67cb6d6c6b463c69d35d77206ac272fa906d88cc239fa1556ff59c1

SHA512
acad3c63bc19d9efde11499dcd2f4e0e6a2522aa6f0eae9c48663b9c0b8f8ee7af9f0621e8d7a29787a703fa243cf34236ed7ef6e86c664621172827ecb5413e

Download Submit
C:\Windows\System\erWydhq.exe

Filesize
1.6MB

MD5
bec94a63563fe6812ac590cb582302f6

SHA1
bfabfa1d8f7435d31cbce5320cb58b2d24f79ae0

SHA256
1527998fb532737918d2aba016c1839a432e627996c89d3255fe5dcec2ee46a9

SHA512
4b2fbad513f5b6739914ba9d38ca9962dc9c83593388b693b626eb8bfd7ba60e4ac46deb6a1f9cd69b5ac6276e11d0fa37e6e17e2d8deda9b146e0fc688fd3fb

Download Submit
C:\Windows\System\fvtXoUj.exe

Filesize
1.6MB

MD5
4646cd432cead03209ce13b3ec227623

SHA1
0e865b9ed9c27ab30585747abada12f86f3e04cd

SHA256
ca3d027ce1cc564a78c422a6489a35af0c23bdc80455758aec32fb8ec36b6235

SHA512
c7c561e3c59dd245a294a08500edd354bf564d7e9753ad456c0cb660e5842b10e82efb109ab96ffe41ffb92e447be10b72b4f246a8b38cfff644cafead77fcca

Download Submit
C:\Windows\System\gojdFzf.exe

Filesize
1.6MB

MD5
d7070b3532d48bd6f9c8f67be8ce2c87

SHA1
947aed1bf08b087abcabd6cab830731d5743072e

SHA256
844c49f479551320897dfc2d928bbc64d23742c20cf4a02bc97c5af1e782ec7b

SHA512
dc814883dd274681ee4519cce74464a8cb089c37db01d36f3c29ced3e3da037b91c2faf73123eb8fc9a9891119d054b0e08afdc95446aeb78ba45a898f992e4c

Download Submit
C:\Windows\System\iFtVTBd.exe

Filesize
1.6MB

MD5
eec41e3cadc7f67cbf6e767bed5b707c

SHA1
7f252b57f4916e412573ede6a1b1837b1b233973

SHA256
b39b3eda9694ad79965cd6faf818433ce565702af234548e334f02231b737904

SHA512
fb0c449b3855489cbcd58101e50b8083facee3772becbc112e405b6910d918855e7a97407144eb989f7439d3d0124e9d92886a8747cea55e1765eb08acbbe4c7

Download Submit
C:\Windows\System\iUVlBPX.exe

Filesize
1.6MB

MD5
bfcbbb478302c3040ed2451d567e592b

SHA1
22c325c6b81cd199ddb61d8bbc5bd1f921a6f372

SHA256
967f59a39908d1b78d4ff4fd995493a81521cd99c17297be54e9d0b3bbc6db56

SHA512
5b6de8034c7501d97d4f78d060fe7b6d2bcd53c24fd3dcc7dfbe6e4dafd5dafce3f79484f531504080874e05c4e23552ff92a7717883321d82c5743477e88345

Download Submit
C:\Windows\System\lzUTJNf.exe

Filesize
1.6MB

MD5
335d559730b271ed658b5d2627241045

SHA1
13545470380b7d4de7425bc5f86ff9086cd406e7

SHA256
d917d06850eb19d9da26a1596c22dbecab7810f8b4af63afe9cf9422fc02556b

SHA512
0470a4f83d6597addceae6a9af84e29077e82992c5812b76d4adaedd2695cfb1ce7e135534370b092754d8903b5243b713ed6f7b23c60bdf22d079fc78927a86

Download Submit
C:\Windows\System\nbsrJaH.exe

Filesize
1.6MB

MD5
e9d75f80e9e5e97c591846dbbc94f9bd

SHA1
59871e61c6878763a7c1213d480b95165071c5f6

SHA256
c10d116e93f8aee70e35be9fd188b9eba31398f96c72832ed8371bfb9855b957

SHA512
901e841b68051ae9fa851b3029a487500055ca76d609f5ef43fc0e7b358a49918bbf4f04ca0ad7eae2d105ad8fbb9575a4bb782107876ac3b16614b63590e958

Download Submit
C:\Windows\System\omdXYmt.exe

Filesize
1.6MB

MD5
2e020f5c928a9e7ab39957c8d38cb7b3

SHA1
8281d25e3041bd16bd2c90444001cba7b6e054ef

SHA256
8318c0b023d3d5c8d33087343914dd0ba7e498d53aaff1614c1273f0628c2ab6

SHA512
7bcecd8f7850369964ea84e3271d43ff301dd2869318e3eae72a664b263c5b3d071ee7aa406ce8447e9a66d57f94b778319835c3829ccc15a34bf46441c98773

Download Submit
C:\Windows\System\qGrXxXZ.exe

Filesize
1.6MB

MD5
142a50cf6a6e402171ea0810c731c5d1

SHA1
318cf12ff04902d5d17ed09c67eda0528878f6f7

SHA256
9d51678e230775310b178b24f941c5866e235aecd48759acf7aa82c1695b6b75

SHA512
9be014229bc4b4e576b7d91c349ee0a577f8eb6a9c6bf188e09f769f402b19c40cac0d139956dfe7b58c22d7883f7386b6d16adb5da64b0e4458408b0da2bfe3

Download Submit
C:\Windows\System\sTJMyiW.exe

Filesize
1.6MB

MD5
ae41877c0ee6ceecfbf6b5e8acd30ad7

SHA1
f3ca49d05e2b15a9bdc88343aa3d8ee02a0185ea

SHA256
f5db135b1f8cb9a975c58a741f21a7314e778b3578ea0b0b9b159a798e31c53c

SHA512
16fa07f7162420222900f8bcdec0bfa216d723226e6c38b1a5c2755721f4f313b10abdef269b21bbc4c4a7dace47114b05d29d704b2e5415c3ec9988a2140f9e

Download Submit
C:\Windows\System\trAIXhH.exe

Filesize
1.6MB

MD5
6d3d513c5133a83a604ad34332144edb

SHA1
5373485b66cca74668a81041af04ef7f09c450af

SHA256
e7e65c0d70d2129c13561ebcdac0eb8dd261b737c91ef030de92dc75cbe3e5fc

SHA512
d15e2ff4a18739a87f7b8ed711b376a8b265e504c77ec3afebabc5a7aabb3440ffb4c5aa27458eba1de5b8f60787b9ce4a5e45d6e1a07e4802d98459a6b84826

Download Submit
C:\Windows\System\uJZVUrC.exe

Filesize
1.6MB

MD5
dcca6159ad86a86060ff8b7aee8b176a

SHA1
2dfeadc8fca072c8c28bdcc63342f503ebd3df06

SHA256
938ffc14df0a789a0aeeb8abb01ccd24e009a7a0b4ee9b4fdc65b49456dadcc4

SHA512
8a7826261ed3ca0e208889d9adcd54e2e3036aeca98390ae4a41574f14c960f3d9c04ee45c13bb77ffe3a3eca082fcb81caed52db46c36a5c32a7641f5d18ace

Download Submit
C:\Windows\System\vhNRAaw.exe

Filesize
1.6MB

MD5
c01421b08a058002881aaae752ca75f2

SHA1
55cb9945db7ad4ddafa322597ce111035d8dc64a

SHA256
d735e65817e6b1a909212f092831dd99ad7411ae597f0114f5f1cac2e6f26d81

SHA512
405d7527e5a723822e48cc4652b2eb8db84c91b03209c70f7c91de2faa3f75e0f8997d15873441062281aafa2a446b1976a5c008beb5d779f5b03244eb317033

Download Submit
C:\Windows\System\wuMiWhL.exe

Filesize
1.6MB

MD5
fbb77451fdc8a85b015a132a5022e4b6

SHA1
7b49152e48e1263d5ebe90fbbdf0b0e2ea0e6c20

SHA256
b9200cd7c9055e63ae296b1dfe33088e43509ffeb7d46a5ca32138a143e25bd3

SHA512
fe7ac462e8ce24b132a44e10f7647b3e7e1f2b7ac49b49d3170719d6859eb2fcabe42238d99c7212ec34191cfc81274794c444001e654bf882f179694f427e90

Download Submit
memory/4176-0-0x000001DEE7220000-0x000001DEE7230000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads