xmrig | fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
Size 1.8MB
Sample240522-xp6ncsch7z
SHA256 fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d
MD5 562496200b4e1344ba972d075887f132
SHA1 21a36acefebbbeccb92c217b717e352d8838ea3b
SHA512 88362d9013e81cca4b1e031ed9ca99b61ba37959cf3ca7d4a05de967f353e94139efe112ef25fa28a57da4d2f69a2efc7a3dea6027f8e7dd704b94d840070420
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAI:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 59 IoCs

miner

resource	yara_rule
behavioral2/memory/1608-437-0x00007FF7B2D80000-0x00007FF7B30D1000-memory.dmp	xmrig
behavioral2/memory/5052-438-0x00007FF6E93B0000-0x00007FF6E9701000-memory.dmp	xmrig
behavioral2/memory/2128-436-0x00007FF6F1DA0000-0x00007FF6F20F1000-memory.dmp	xmrig
behavioral2/memory/1224-439-0x00007FF6D9D30000-0x00007FF6DA081000-memory.dmp	xmrig
behavioral2/memory/2176-440-0x00007FF6FD980000-0x00007FF6FDCD1000-memory.dmp	xmrig
behavioral2/memory/2924-441-0x00007FF77F320000-0x00007FF77F671000-memory.dmp	xmrig
behavioral2/memory/1864-443-0x00007FF7E7770000-0x00007FF7E7AC1000-memory.dmp	xmrig
behavioral2/memory/2556-442-0x00007FF75E510000-0x00007FF75E861000-memory.dmp	xmrig
behavioral2/memory/4792-445-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp	xmrig
behavioral2/memory/2088-444-0x00007FF77BF80000-0x00007FF77C2D1000-memory.dmp	xmrig
behavioral2/memory/1696-448-0x00007FF69C200000-0x00007FF69C551000-memory.dmp	xmrig
behavioral2/memory/3124-450-0x00007FF705400000-0x00007FF705751000-memory.dmp	xmrig
behavioral2/memory/1940-455-0x00007FF7FDEF0000-0x00007FF7FE241000-memory.dmp	xmrig
behavioral2/memory/2136-449-0x00007FF7D7320000-0x00007FF7D7671000-memory.dmp	xmrig
behavioral2/memory/4732-446-0x00007FF773350000-0x00007FF7736A1000-memory.dmp	xmrig
behavioral2/memory/1796-447-0x00007FF7B5B30000-0x00007FF7B5E81000-memory.dmp	xmrig
behavioral2/memory/3048-84-0x00007FF7D5C90000-0x00007FF7D5FE1000-memory.dmp	xmrig
behavioral2/memory/4484-83-0x00007FF6CF2A0000-0x00007FF6CF5F1000-memory.dmp	xmrig
behavioral2/memory/4584-75-0x00007FF69E740000-0x00007FF69EA91000-memory.dmp	xmrig
behavioral2/memory/1180-67-0x00007FF7C3C40000-0x00007FF7C3F91000-memory.dmp	xmrig
behavioral2/memory/3556-66-0x00007FF7E2BD0000-0x00007FF7E2F21000-memory.dmp	xmrig
behavioral2/memory/392-63-0x00007FF69B8A0000-0x00007FF69BBF1000-memory.dmp	xmrig
behavioral2/memory/2308-35-0x00007FF69AB40000-0x00007FF69AE91000-memory.dmp	xmrig
behavioral2/memory/2028-24-0x00007FF60B1F0000-0x00007FF60B541000-memory.dmp	xmrig
behavioral2/memory/4932-23-0x00007FF64C0E0000-0x00007FF64C431000-memory.dmp	xmrig
behavioral2/memory/440-2208-0x00007FF654430000-0x00007FF654781000-memory.dmp	xmrig
behavioral2/memory/3196-2209-0x00007FF661210000-0x00007FF661561000-memory.dmp	xmrig
behavioral2/memory/392-2210-0x00007FF69B8A0000-0x00007FF69BBF1000-memory.dmp	xmrig
behavioral2/memory/4360-2211-0x00007FF798E50000-0x00007FF7991A1000-memory.dmp	xmrig
behavioral2/memory/3656-2235-0x00007FF7CB560000-0x00007FF7CB8B1000-memory.dmp	xmrig
behavioral2/memory/440-2265-0x00007FF654430000-0x00007FF654781000-memory.dmp	xmrig
behavioral2/memory/4932-2267-0x00007FF64C0E0000-0x00007FF64C431000-memory.dmp	xmrig
behavioral2/memory/2028-2269-0x00007FF60B1F0000-0x00007FF60B541000-memory.dmp	xmrig
behavioral2/memory/2308-2271-0x00007FF69AB40000-0x00007FF69AE91000-memory.dmp	xmrig
behavioral2/memory/4584-2275-0x00007FF69E740000-0x00007FF69EA91000-memory.dmp	xmrig
behavioral2/memory/392-2277-0x00007FF69B8A0000-0x00007FF69BBF1000-memory.dmp	xmrig
behavioral2/memory/3556-2280-0x00007FF7E2BD0000-0x00007FF7E2F21000-memory.dmp	xmrig
behavioral2/memory/4484-2281-0x00007FF6CF2A0000-0x00007FF6CF5F1000-memory.dmp	xmrig
behavioral2/memory/1180-2283-0x00007FF7C3C40000-0x00007FF7C3F91000-memory.dmp	xmrig
behavioral2/memory/3196-2273-0x00007FF661210000-0x00007FF661561000-memory.dmp	xmrig
behavioral2/memory/1864-2308-0x00007FF7E7770000-0x00007FF7E7AC1000-memory.dmp	xmrig
behavioral2/memory/4732-2311-0x00007FF773350000-0x00007FF7736A1000-memory.dmp	xmrig
behavioral2/memory/1696-2317-0x00007FF69C200000-0x00007FF69C551000-memory.dmp	xmrig
behavioral2/memory/2136-2322-0x00007FF7D7320000-0x00007FF7D7671000-memory.dmp	xmrig
behavioral2/memory/1940-2320-0x00007FF7FDEF0000-0x00007FF7FE241000-memory.dmp	xmrig
behavioral2/memory/3124-2315-0x00007FF705400000-0x00007FF705751000-memory.dmp	xmrig
behavioral2/memory/4792-2309-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp	xmrig
behavioral2/memory/4360-2306-0x00007FF798E50000-0x00007FF7991A1000-memory.dmp	xmrig
behavioral2/memory/3656-2302-0x00007FF7CB560000-0x00007FF7CB8B1000-memory.dmp	xmrig
behavioral2/memory/5052-2299-0x00007FF6E93B0000-0x00007FF6E9701000-memory.dmp	xmrig
behavioral2/memory/1608-2298-0x00007FF7B2D80000-0x00007FF7B30D1000-memory.dmp	xmrig
behavioral2/memory/1796-2313-0x00007FF7B5B30000-0x00007FF7B5E81000-memory.dmp	xmrig
behavioral2/memory/2088-2294-0x00007FF77BF80000-0x00007FF77C2D1000-memory.dmp	xmrig
behavioral2/memory/3048-2304-0x00007FF7D5C90000-0x00007FF7D5FE1000-memory.dmp	xmrig
behavioral2/memory/1224-2290-0x00007FF6D9D30000-0x00007FF6DA081000-memory.dmp	xmrig
behavioral2/memory/2176-2287-0x00007FF6FD980000-0x00007FF6FDCD1000-memory.dmp	xmrig
behavioral2/memory/2924-2286-0x00007FF77F320000-0x00007FF77F671000-memory.dmp	xmrig
behavioral2/memory/2556-2295-0x00007FF75E510000-0x00007FF75E861000-memory.dmp	xmrig
behavioral2/memory/2128-2292-0x00007FF6F1DA0000-0x00007FF6F20F1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
440	hdyBIet.exe
4932	jFGtvMD.exe
2028	fcahTwg.exe
2308	zxCWMGB.exe
3196	HgKhtai.exe
392	QkkYZpA.exe
4584	ceWiyEp.exe
4484	NEPGhLu.exe
3556	nvNYDxO.exe
1180	ZDYzCId.exe
4360	tRITljC.exe
3048	axWIQND.exe
3656	fbygHsw.exe
2128	uHJycYa.exe
1608	hCONWyA.exe
5052	SxMPaGF.exe
1224	eSFUVjq.exe
2176	oxVueVY.exe
2924	KgYPayT.exe
2556	rvCLyxh.exe
1864	PPVDLmm.exe
2088	ZmhQGtD.exe
4792	bCgMXXc.exe
4732	BSIAqGl.exe
1796	KTnGDPN.exe
1696	MXihVhd.exe
2136	NeLvBCp.exe
3124	tezTfQp.exe
1940	HTYSECQ.exe
5108	CAFsJku.exe
4024	JyKJezA.exe
1688	PFzEciI.exe
4900	ZvLgxJe.exe
5096	UOrrgze.exe
1420	exnLYUe.exe
4128	kRYNalC.exe
3520	ZlldChq.exe
2592	kEIqUSr.exe
3168	XayihIX.exe
4568	waqyENi.exe
4996	aOIbtkl.exe
4924	RznXnIK.exe
2400	JERvaNd.exe
4840	joGRasx.exe
1920	IQxGdQP.exe
2652	gEnsDBR.exe
524	sIHBEvi.exe
2216	sqYPebP.exe
4340	IXGODct.exe
4256	qLAyLJp.exe
2040	zQrcPvs.exe
1376	qgGGqXd.exe
3860	VkhvYAF.exe
1240	SCNVOnL.exe
1432	wUVsnXU.exe
4536	RPUjIgg.exe
4456	oeSIUMg.exe
1900	YaRANdP.exe
4612	wzYSMJh.exe
812	hUPodCX.exe
3392	NQUwsAa.exe
1536	iwMfVaM.exe
316	KsjoAaE.exe
3292	pFoYDJx.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2008-0-0x00007FF603020000-0x00007FF603371000-memory.dmp	upx
behavioral2/files/0x0008000000023288-5.dat	upx
behavioral2/memory/440-12-0x00007FF654430000-0x00007FF654781000-memory.dmp	upx
behavioral2/files/0x00080000000233f4-15.dat	upx
behavioral2/files/0x00070000000233fa-26.dat	upx
behavioral2/files/0x00070000000233fb-29.dat	upx
behavioral2/files/0x00070000000233fc-37.dat	upx
behavioral2/files/0x00070000000233fd-51.dat	upx
behavioral2/files/0x0007000000023401-70.dat	upx
behavioral2/memory/3656-72-0x00007FF7CB560000-0x00007FF7CB8B1000-memory.dmp	upx
behavioral2/files/0x0007000000023404-92.dat	upx
behavioral2/files/0x0007000000023408-112.dat	upx
behavioral2/files/0x000700000002340b-121.dat	upx
behavioral2/files/0x0007000000023415-171.dat	upx
behavioral2/memory/1608-437-0x00007FF7B2D80000-0x00007FF7B30D1000-memory.dmp	upx
behavioral2/memory/5052-438-0x00007FF6E93B0000-0x00007FF6E9701000-memory.dmp	upx
behavioral2/memory/2128-436-0x00007FF6F1DA0000-0x00007FF6F20F1000-memory.dmp	upx
behavioral2/memory/1224-439-0x00007FF6D9D30000-0x00007FF6DA081000-memory.dmp	upx
behavioral2/memory/2176-440-0x00007FF6FD980000-0x00007FF6FDCD1000-memory.dmp	upx
behavioral2/memory/2924-441-0x00007FF77F320000-0x00007FF77F671000-memory.dmp	upx
behavioral2/memory/1864-443-0x00007FF7E7770000-0x00007FF7E7AC1000-memory.dmp	upx
behavioral2/memory/2556-442-0x00007FF75E510000-0x00007FF75E861000-memory.dmp	upx
behavioral2/memory/4792-445-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp	upx
behavioral2/memory/2088-444-0x00007FF77BF80000-0x00007FF77C2D1000-memory.dmp	upx
behavioral2/memory/1696-448-0x00007FF69C200000-0x00007FF69C551000-memory.dmp	upx
behavioral2/memory/3124-450-0x00007FF705400000-0x00007FF705751000-memory.dmp	upx
behavioral2/memory/1940-455-0x00007FF7FDEF0000-0x00007FF7FE241000-memory.dmp	upx
behavioral2/memory/2136-449-0x00007FF7D7320000-0x00007FF7D7671000-memory.dmp	upx
behavioral2/memory/4732-446-0x00007FF773350000-0x00007FF7736A1000-memory.dmp	upx
behavioral2/memory/1796-447-0x00007FF7B5B30000-0x00007FF7B5E81000-memory.dmp	upx
behavioral2/files/0x0007000000023416-176.dat	upx
behavioral2/files/0x0007000000023414-174.dat	upx
behavioral2/files/0x0007000000023413-169.dat	upx
behavioral2/files/0x0007000000023412-164.dat	upx
behavioral2/files/0x0007000000023411-159.dat	upx
behavioral2/files/0x0007000000023410-154.dat	upx
behavioral2/files/0x000700000002340f-149.dat	upx
behavioral2/files/0x000700000002340e-144.dat	upx
behavioral2/files/0x000700000002340d-139.dat	upx
behavioral2/files/0x000700000002340c-134.dat	upx
behavioral2/files/0x000700000002340a-124.dat	upx
behavioral2/files/0x0007000000023409-116.dat	upx
behavioral2/files/0x0007000000023407-107.dat	upx
behavioral2/files/0x0007000000023406-102.dat	upx
behavioral2/files/0x0007000000023405-97.dat	upx
behavioral2/files/0x0007000000023403-90.dat	upx
behavioral2/memory/3048-84-0x00007FF7D5C90000-0x00007FF7D5FE1000-memory.dmp	upx
behavioral2/memory/4484-83-0x00007FF6CF2A0000-0x00007FF6CF5F1000-memory.dmp	upx
behavioral2/files/0x0007000000023402-77.dat	upx
behavioral2/memory/4584-75-0x00007FF69E740000-0x00007FF69EA91000-memory.dmp	upx
behavioral2/memory/4360-71-0x00007FF798E50000-0x00007FF7991A1000-memory.dmp	upx
behavioral2/files/0x0007000000023400-68.dat	upx
behavioral2/memory/1180-67-0x00007FF7C3C40000-0x00007FF7C3F91000-memory.dmp	upx
behavioral2/memory/3556-66-0x00007FF7E2BD0000-0x00007FF7E2F21000-memory.dmp	upx
behavioral2/memory/392-63-0x00007FF69B8A0000-0x00007FF69BBF1000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-61.dat	upx
behavioral2/files/0x00070000000233fe-57.dat	upx
behavioral2/memory/3196-41-0x00007FF661210000-0x00007FF661561000-memory.dmp	upx
behavioral2/memory/2308-35-0x00007FF69AB40000-0x00007FF69AE91000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-25.dat	upx
behavioral2/memory/2028-24-0x00007FF60B1F0000-0x00007FF60B541000-memory.dmp	upx
behavioral2/memory/4932-23-0x00007FF64C0E0000-0x00007FF64C431000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-16.dat	upx
behavioral2/memory/440-2208-0x00007FF654430000-0x00007FF654781000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iqdtLzS.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\JQLeDsj.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\sqYPebP.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\vNVjhjt.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\TVRCcVl.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\qdWxvLL.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\TSAinLB.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\MSmyPCh.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\HeoabAB.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\OymQfZE.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\ksPDNzh.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\LljVhGi.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\vAdmyqT.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\ltVGecL.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\JyKJezA.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\kEIqUSr.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\RPUjIgg.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\cDzptzE.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\TIqIcSb.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\fFQusqJ.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\zKbwIdr.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\ZiGgRNU.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\zPlzsix.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\VXiyGRU.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\SeOSQSF.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\AGqfRHS.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\MXihVhd.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\PFzEciI.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\SdmNgcV.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\nMjKTBZ.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\gonsdqv.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\UMixIrA.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\RAYsdRA.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\NtOsJHT.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\DLWBnyX.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\hnGQVnr.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\MCOovfl.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\ZOEshaU.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\cISlbyi.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\SjMvybr.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\pRFdZyR.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\opTKjuZ.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\SdGYFeF.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\vBabwBz.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\GxpBkTU.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\wmAzscC.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\uVXTGOE.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\mIsJXed.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\KOOedhu.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\dADseiE.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\USMFfBd.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\lJyBVTY.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\PPVDLmm.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\jeCtFfD.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\YmoTqjw.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\rXvEBZR.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\pLBMxHF.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\MicnsHM.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\gvNwNYm.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\LDGOoBD.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\FGdqBKj.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\EUazfEp.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\AoJhYCN.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
File created	C:\Windows\System\DiDwuJM.exe	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 440	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	83
PID 2008 wrote to memory of 440	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	83
PID 2008 wrote to memory of 4932	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	84
PID 2008 wrote to memory of 4932	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	84
PID 2008 wrote to memory of 2028	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	85
PID 2008 wrote to memory of 2028	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	85
PID 2008 wrote to memory of 2308	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	86
PID 2008 wrote to memory of 2308	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	86
PID 2008 wrote to memory of 3196	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	87
PID 2008 wrote to memory of 3196	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	87
PID 2008 wrote to memory of 392	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	88
PID 2008 wrote to memory of 392	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	88
PID 2008 wrote to memory of 4584	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	89
PID 2008 wrote to memory of 4584	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	89
PID 2008 wrote to memory of 4484	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	90
PID 2008 wrote to memory of 4484	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	90
PID 2008 wrote to memory of 3556	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	91
PID 2008 wrote to memory of 3556	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	91
PID 2008 wrote to memory of 1180	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	92
PID 2008 wrote to memory of 1180	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	92
PID 2008 wrote to memory of 4360	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	93
PID 2008 wrote to memory of 4360	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	93
PID 2008 wrote to memory of 3656	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	94
PID 2008 wrote to memory of 3656	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	94
PID 2008 wrote to memory of 3048	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	95
PID 2008 wrote to memory of 3048	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	95
PID 2008 wrote to memory of 2128	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	96
PID 2008 wrote to memory of 2128	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	96
PID 2008 wrote to memory of 1608	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	97
PID 2008 wrote to memory of 1608	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	97
PID 2008 wrote to memory of 5052	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	98
PID 2008 wrote to memory of 5052	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	98
PID 2008 wrote to memory of 1224	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	99
PID 2008 wrote to memory of 1224	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	99
PID 2008 wrote to memory of 2176	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	100
PID 2008 wrote to memory of 2176	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	100
PID 2008 wrote to memory of 2924	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	101
PID 2008 wrote to memory of 2924	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	101
PID 2008 wrote to memory of 2556	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	102
PID 2008 wrote to memory of 2556	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	102
PID 2008 wrote to memory of 1864	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	103
PID 2008 wrote to memory of 1864	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	103
PID 2008 wrote to memory of 2088	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	104
PID 2008 wrote to memory of 2088	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	104
PID 2008 wrote to memory of 4792	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	105
PID 2008 wrote to memory of 4792	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	105
PID 2008 wrote to memory of 4732	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	106
PID 2008 wrote to memory of 4732	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	106
PID 2008 wrote to memory of 1796	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	107
PID 2008 wrote to memory of 1796	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	107
PID 2008 wrote to memory of 1696	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	108
PID 2008 wrote to memory of 1696	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	108
PID 2008 wrote to memory of 2136	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	109
PID 2008 wrote to memory of 2136	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	109
PID 2008 wrote to memory of 3124	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	110
PID 2008 wrote to memory of 3124	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	110
PID 2008 wrote to memory of 1940	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	111
PID 2008 wrote to memory of 1940	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	111
PID 2008 wrote to memory of 5108	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	112
PID 2008 wrote to memory of 5108	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	112
PID 2008 wrote to memory of 4024	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	113
PID 2008 wrote to memory of 4024	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	113
PID 2008 wrote to memory of 1688	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	114
PID 2008 wrote to memory of 1688	2008	fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe	114

C:\Users\Admin\AppData\Local\Temp\fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe
"C:\Users\Admin\AppData\Local\Temp\fcffcfed7e55745994bd9b4896c79007d12e863de3e5d69bfd3a983f9c3d154d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\System\hdyBIet.exe
  C:\Windows\System\hdyBIet.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\jFGtvMD.exe
  C:\Windows\System\jFGtvMD.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\fcahTwg.exe
  C:\Windows\System\fcahTwg.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\zxCWMGB.exe
  C:\Windows\System\zxCWMGB.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\HgKhtai.exe
  C:\Windows\System\HgKhtai.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\QkkYZpA.exe
  C:\Windows\System\QkkYZpA.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\ceWiyEp.exe
  C:\Windows\System\ceWiyEp.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\NEPGhLu.exe
  C:\Windows\System\NEPGhLu.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\nvNYDxO.exe
  C:\Windows\System\nvNYDxO.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\ZDYzCId.exe
  C:\Windows\System\ZDYzCId.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\tRITljC.exe
  C:\Windows\System\tRITljC.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\fbygHsw.exe
  C:\Windows\System\fbygHsw.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\axWIQND.exe
  C:\Windows\System\axWIQND.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\uHJycYa.exe
  C:\Windows\System\uHJycYa.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\hCONWyA.exe
  C:\Windows\System\hCONWyA.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\SxMPaGF.exe
  C:\Windows\System\SxMPaGF.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\eSFUVjq.exe
  C:\Windows\System\eSFUVjq.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\oxVueVY.exe
  C:\Windows\System\oxVueVY.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\KgYPayT.exe
  C:\Windows\System\KgYPayT.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\rvCLyxh.exe
  C:\Windows\System\rvCLyxh.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\PPVDLmm.exe
  C:\Windows\System\PPVDLmm.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\ZmhQGtD.exe
  C:\Windows\System\ZmhQGtD.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\bCgMXXc.exe
  C:\Windows\System\bCgMXXc.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\BSIAqGl.exe
  C:\Windows\System\BSIAqGl.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\KTnGDPN.exe
  C:\Windows\System\KTnGDPN.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\MXihVhd.exe
  C:\Windows\System\MXihVhd.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\NeLvBCp.exe
  C:\Windows\System\NeLvBCp.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\tezTfQp.exe
  C:\Windows\System\tezTfQp.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\HTYSECQ.exe
  C:\Windows\System\HTYSECQ.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\CAFsJku.exe
  C:\Windows\System\CAFsJku.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\JyKJezA.exe
  C:\Windows\System\JyKJezA.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\PFzEciI.exe
  C:\Windows\System\PFzEciI.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\ZvLgxJe.exe
  C:\Windows\System\ZvLgxJe.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\UOrrgze.exe
  C:\Windows\System\UOrrgze.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\exnLYUe.exe
  C:\Windows\System\exnLYUe.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\kRYNalC.exe
  C:\Windows\System\kRYNalC.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\ZlldChq.exe
  C:\Windows\System\ZlldChq.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\kEIqUSr.exe
  C:\Windows\System\kEIqUSr.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\XayihIX.exe
  C:\Windows\System\XayihIX.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\waqyENi.exe
  C:\Windows\System\waqyENi.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\aOIbtkl.exe
  C:\Windows\System\aOIbtkl.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\RznXnIK.exe
  C:\Windows\System\RznXnIK.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\JERvaNd.exe
  C:\Windows\System\JERvaNd.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\joGRasx.exe
  C:\Windows\System\joGRasx.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\IQxGdQP.exe
  C:\Windows\System\IQxGdQP.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\gEnsDBR.exe
  C:\Windows\System\gEnsDBR.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\sIHBEvi.exe
  C:\Windows\System\sIHBEvi.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\sqYPebP.exe
  C:\Windows\System\sqYPebP.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\IXGODct.exe
  C:\Windows\System\IXGODct.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\qLAyLJp.exe
  C:\Windows\System\qLAyLJp.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\zQrcPvs.exe
  C:\Windows\System\zQrcPvs.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\qgGGqXd.exe
  C:\Windows\System\qgGGqXd.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\VkhvYAF.exe
  C:\Windows\System\VkhvYAF.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\SCNVOnL.exe
  C:\Windows\System\SCNVOnL.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\wUVsnXU.exe
  C:\Windows\System\wUVsnXU.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\RPUjIgg.exe
  C:\Windows\System\RPUjIgg.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\oeSIUMg.exe
  C:\Windows\System\oeSIUMg.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\YaRANdP.exe
  C:\Windows\System\YaRANdP.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\wzYSMJh.exe
  C:\Windows\System\wzYSMJh.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\hUPodCX.exe
  C:\Windows\System\hUPodCX.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\NQUwsAa.exe
  C:\Windows\System\NQUwsAa.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\iwMfVaM.exe
  C:\Windows\System\iwMfVaM.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\KsjoAaE.exe
  C:\Windows\System\KsjoAaE.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\pFoYDJx.exe
  C:\Windows\System\pFoYDJx.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\FGdqBKj.exe
  C:\Windows\System\FGdqBKj.exe
  2⤵
  PID:3872
- C:\Windows\System\LwRTuED.exe
  C:\Windows\System\LwRTuED.exe
  2⤵
  PID:3096
- C:\Windows\System\TLokxpq.exe
  C:\Windows\System\TLokxpq.exe
  2⤵
  PID:564
- C:\Windows\System\ExBvSxo.exe
  C:\Windows\System\ExBvSxo.exe
  2⤵
  PID:3920
- C:\Windows\System\cLsmfdQ.exe
  C:\Windows\System\cLsmfdQ.exe
  2⤵
  PID:1256
- C:\Windows\System\XppGqTi.exe
  C:\Windows\System\XppGqTi.exe
  2⤵
  PID:1088
- C:\Windows\System\xWvvebs.exe
  C:\Windows\System\xWvvebs.exe
  2⤵
  PID:4028
- C:\Windows\System\oYCTROM.exe
  C:\Windows\System\oYCTROM.exe
  2⤵
  PID:868
- C:\Windows\System\WZHkJds.exe
  C:\Windows\System\WZHkJds.exe
  2⤵
  PID:3184
- C:\Windows\System\aegjKuj.exe
  C:\Windows\System\aegjKuj.exe
  2⤵
  PID:4636
- C:\Windows\System\iqdtLzS.exe
  C:\Windows\System\iqdtLzS.exe
  2⤵
  PID:1248
- C:\Windows\System\xGckiIG.exe
  C:\Windows\System\xGckiIG.exe
  2⤵
  PID:3964
- C:\Windows\System\XsrzCgZ.exe
  C:\Windows\System\XsrzCgZ.exe
  2⤵
  PID:956
- C:\Windows\System\GkxVJoX.exe
  C:\Windows\System\GkxVJoX.exe
  2⤵
  PID:3128
- C:\Windows\System\iBoZNXC.exe
  C:\Windows\System\iBoZNXC.exe
  2⤵
  PID:2328
- C:\Windows\System\oFlnIny.exe
  C:\Windows\System\oFlnIny.exe
  2⤵
  PID:2044
- C:\Windows\System\XgDodBF.exe
  C:\Windows\System\XgDodBF.exe
  2⤵
  PID:5140
- C:\Windows\System\biGDvYk.exe
  C:\Windows\System\biGDvYk.exe
  2⤵
  PID:5176
- C:\Windows\System\XsluETv.exe
  C:\Windows\System\XsluETv.exe
  2⤵
  PID:5196
- C:\Windows\System\ivGBGof.exe
  C:\Windows\System\ivGBGof.exe
  2⤵
  PID:5224
- C:\Windows\System\OSvmKff.exe
  C:\Windows\System\OSvmKff.exe
  2⤵
  PID:5248
- C:\Windows\System\NxlxHlG.exe
  C:\Windows\System\NxlxHlG.exe
  2⤵
  PID:5276
- C:\Windows\System\tIRUnBC.exe
  C:\Windows\System\tIRUnBC.exe
  2⤵
  PID:5304
- C:\Windows\System\rdZZrbT.exe
  C:\Windows\System\rdZZrbT.exe
  2⤵
  PID:5336
- C:\Windows\System\CcFmKNC.exe
  C:\Windows\System\CcFmKNC.exe
  2⤵
  PID:5360
- C:\Windows\System\eVYlUOr.exe
  C:\Windows\System\eVYlUOr.exe
  2⤵
  PID:5392
- C:\Windows\System\WyzdSOS.exe
  C:\Windows\System\WyzdSOS.exe
  2⤵
  PID:5420
- C:\Windows\System\BYVbifj.exe
  C:\Windows\System\BYVbifj.exe
  2⤵
  PID:5448
- C:\Windows\System\cISlbyi.exe
  C:\Windows\System\cISlbyi.exe
  2⤵
  PID:5476
- C:\Windows\System\wIwTCgZ.exe
  C:\Windows\System\wIwTCgZ.exe
  2⤵
  PID:5504
- C:\Windows\System\rHfNNCU.exe
  C:\Windows\System\rHfNNCU.exe
  2⤵
  PID:5528
- C:\Windows\System\XdQWWAE.exe
  C:\Windows\System\XdQWWAE.exe
  2⤵
  PID:5560
- C:\Windows\System\NtediTw.exe
  C:\Windows\System\NtediTw.exe
  2⤵
  PID:5588
- C:\Windows\System\cDzptzE.exe
  C:\Windows\System\cDzptzE.exe
  2⤵
  PID:5612
- C:\Windows\System\WTJqfkK.exe
  C:\Windows\System\WTJqfkK.exe
  2⤵
  PID:5644
- C:\Windows\System\IKbqEyC.exe
  C:\Windows\System\IKbqEyC.exe
  2⤵
  PID:5668
- C:\Windows\System\ZIKEMOE.exe
  C:\Windows\System\ZIKEMOE.exe
  2⤵
  PID:5696
- C:\Windows\System\CqRYaCW.exe
  C:\Windows\System\CqRYaCW.exe
  2⤵
  PID:5724
- C:\Windows\System\mmVcIfV.exe
  C:\Windows\System\mmVcIfV.exe
  2⤵
  PID:5756
- C:\Windows\System\sZhQJDO.exe
  C:\Windows\System\sZhQJDO.exe
  2⤵
  PID:5784
- C:\Windows\System\WfNkaYy.exe
  C:\Windows\System\WfNkaYy.exe
  2⤵
  PID:5808
- C:\Windows\System\ReWiHro.exe
  C:\Windows\System\ReWiHro.exe
  2⤵
  PID:5836
- C:\Windows\System\MZNUUGl.exe
  C:\Windows\System\MZNUUGl.exe
  2⤵
  PID:5864
- C:\Windows\System\zrKTUlb.exe
  C:\Windows\System\zrKTUlb.exe
  2⤵
  PID:5892
- C:\Windows\System\ZtvPkBT.exe
  C:\Windows\System\ZtvPkBT.exe
  2⤵
  PID:5920
- C:\Windows\System\xtRVHWK.exe
  C:\Windows\System\xtRVHWK.exe
  2⤵
  PID:5948
- C:\Windows\System\VJZBbil.exe
  C:\Windows\System\VJZBbil.exe
  2⤵
  PID:5976
- C:\Windows\System\oOgpHRR.exe
  C:\Windows\System\oOgpHRR.exe
  2⤵
  PID:6004
- C:\Windows\System\NrRaMEN.exe
  C:\Windows\System\NrRaMEN.exe
  2⤵
  PID:6032
- C:\Windows\System\hnGQVnr.exe
  C:\Windows\System\hnGQVnr.exe
  2⤵
  PID:6060
- C:\Windows\System\wKZdDHj.exe
  C:\Windows\System\wKZdDHj.exe
  2⤵
  PID:6088
- C:\Windows\System\YBrXetQ.exe
  C:\Windows\System\YBrXetQ.exe
  2⤵
  PID:6116
- C:\Windows\System\jfvFiya.exe
  C:\Windows\System\jfvFiya.exe
  2⤵
  PID:3440
- C:\Windows\System\umeenCg.exe
  C:\Windows\System\umeenCg.exe
  2⤵
  PID:2112
- C:\Windows\System\gGQOaNh.exe
  C:\Windows\System\gGQOaNh.exe
  2⤵
  PID:1584
- C:\Windows\System\sEuBzFA.exe
  C:\Windows\System\sEuBzFA.exe
  2⤵
  PID:3908
- C:\Windows\System\jeCtFfD.exe
  C:\Windows\System\jeCtFfD.exe
  2⤵
  PID:5268
- C:\Windows\System\EUazfEp.exe
  C:\Windows\System\EUazfEp.exe
  2⤵
  PID:5352
- C:\Windows\System\LsjYhGW.exe
  C:\Windows\System\LsjYhGW.exe
  2⤵
  PID:5408
- C:\Windows\System\eBvtXWU.exe
  C:\Windows\System\eBvtXWU.exe
  2⤵
  PID:5544
- C:\Windows\System\rrLspgD.exe
  C:\Windows\System\rrLspgD.exe
  2⤵
  PID:1924
- C:\Windows\System\lohgFqf.exe
  C:\Windows\System\lohgFqf.exe
  2⤵
  PID:5744
- C:\Windows\System\ovhHDPA.exe
  C:\Windows\System\ovhHDPA.exe
  2⤵
  PID:5804
- C:\Windows\System\IWUxBdl.exe
  C:\Windows\System\IWUxBdl.exe
  2⤵
  PID:2076
- C:\Windows\System\JNAbTeS.exe
  C:\Windows\System\JNAbTeS.exe
  2⤵
  PID:5912
- C:\Windows\System\HfuiUfX.exe
  C:\Windows\System\HfuiUfX.exe
  2⤵
  PID:1916
- C:\Windows\System\IsnnuYF.exe
  C:\Windows\System\IsnnuYF.exe
  2⤵
  PID:6020
- C:\Windows\System\DMkvtVB.exe
  C:\Windows\System\DMkvtVB.exe
  2⤵
  PID:6080
- C:\Windows\System\LlkwYYO.exe
  C:\Windows\System\LlkwYYO.exe
  2⤵
  PID:6132
- C:\Windows\System\REGnYqe.exe
  C:\Windows\System\REGnYqe.exe
  2⤵
  PID:1068
- C:\Windows\System\pVwCLHC.exe
  C:\Windows\System\pVwCLHC.exe
  2⤵
  PID:2264
- C:\Windows\System\kNbyPkC.exe
  C:\Windows\System\kNbyPkC.exe
  2⤵
  PID:4804
- C:\Windows\System\MeKLlBA.exe
  C:\Windows\System\MeKLlBA.exe
  2⤵
  PID:552
- C:\Windows\System\oVxsFHJ.exe
  C:\Windows\System\oVxsFHJ.exe
  2⤵
  PID:452
- C:\Windows\System\AoJhYCN.exe
  C:\Windows\System\AoJhYCN.exe
  2⤵
  PID:2084
- C:\Windows\System\fwiciVb.exe
  C:\Windows\System\fwiciVb.exe
  2⤵
  PID:744
- C:\Windows\System\eziYikY.exe
  C:\Windows\System\eziYikY.exe
  2⤵
  PID:2552
- C:\Windows\System\hgwMsqO.exe
  C:\Windows\System\hgwMsqO.exe
  2⤵
  PID:404
- C:\Windows\System\KUqNWAC.exe
  C:\Windows\System\KUqNWAC.exe
  2⤵
  PID:5520
- C:\Windows\System\fRkPMSv.exe
  C:\Windows\System\fRkPMSv.exe
  2⤵
  PID:1948
- C:\Windows\System\ctOvbLW.exe
  C:\Windows\System\ctOvbLW.exe
  2⤵
  PID:3644
- C:\Windows\System\HrQFXxI.exe
  C:\Windows\System\HrQFXxI.exe
  2⤵
  PID:2976
- C:\Windows\System\dYIwhbD.exe
  C:\Windows\System\dYIwhbD.exe
  2⤵
  PID:5796
- C:\Windows\System\YOHeicg.exe
  C:\Windows\System\YOHeicg.exe
  2⤵
  PID:5888
- C:\Windows\System\nKMLkjw.exe
  C:\Windows\System\nKMLkjw.exe
  2⤵
  PID:6000
- C:\Windows\System\MGCmcCI.exe
  C:\Windows\System\MGCmcCI.exe
  2⤵
  PID:2980
- C:\Windows\System\zxqoIgK.exe
  C:\Windows\System\zxqoIgK.exe
  2⤵
  PID:4432
- C:\Windows\System\iMfTcgd.exe
  C:\Windows\System\iMfTcgd.exe
  2⤵
  PID:640
- C:\Windows\System\KPExaJd.exe
  C:\Windows\System\KPExaJd.exe
  2⤵
  PID:1176
- C:\Windows\System\wnLrafW.exe
  C:\Windows\System\wnLrafW.exe
  2⤵
  PID:4040
- C:\Windows\System\crNeVde.exe
  C:\Windows\System\crNeVde.exe
  2⤵
  PID:4672
- C:\Windows\System\kETnTHK.exe
  C:\Windows\System\kETnTHK.exe
  2⤵
  PID:5208
- C:\Windows\System\ixveSqQ.exe
  C:\Windows\System\ixveSqQ.exe
  2⤵
  PID:1892
- C:\Windows\System\NHoedss.exe
  C:\Windows\System\NHoedss.exe
  2⤵
  PID:5212
- C:\Windows\System\APAMUZx.exe
  C:\Windows\System\APAMUZx.exe
  2⤵
  PID:5188
- C:\Windows\System\NrYtTxV.exe
  C:\Windows\System\NrYtTxV.exe
  2⤵
  PID:4980
- C:\Windows\System\FpdqhGp.exe
  C:\Windows\System\FpdqhGp.exe
  2⤵
  PID:6056
- C:\Windows\System\JlVFFQm.exe
  C:\Windows\System\JlVFFQm.exe
  2⤵
  PID:5244
- C:\Windows\System\keujyiO.exe
  C:\Windows\System\keujyiO.exe
  2⤵
  PID:5172
- C:\Windows\System\LfmGAUs.exe
  C:\Windows\System\LfmGAUs.exe
  2⤵
  PID:4984
- C:\Windows\System\ubNphuC.exe
  C:\Windows\System\ubNphuC.exe
  2⤵
  PID:6168
- C:\Windows\System\EbiNxzr.exe
  C:\Windows\System\EbiNxzr.exe
  2⤵
  PID:6188
- C:\Windows\System\rLEuXzO.exe
  C:\Windows\System\rLEuXzO.exe
  2⤵
  PID:6212
- C:\Windows\System\EYvIhwn.exe
  C:\Windows\System\EYvIhwn.exe
  2⤵
  PID:6256
- C:\Windows\System\izpJIwh.exe
  C:\Windows\System\izpJIwh.exe
  2⤵
  PID:6308
- C:\Windows\System\KOOedhu.exe
  C:\Windows\System\KOOedhu.exe
  2⤵
  PID:6336
- C:\Windows\System\AbUTALc.exe
  C:\Windows\System\AbUTALc.exe
  2⤵
  PID:6360
- C:\Windows\System\FQKxaqf.exe
  C:\Windows\System\FQKxaqf.exe
  2⤵
  PID:6380
- C:\Windows\System\FmPdyNP.exe
  C:\Windows\System\FmPdyNP.exe
  2⤵
  PID:6400
- C:\Windows\System\GECaonY.exe
  C:\Windows\System\GECaonY.exe
  2⤵
  PID:6424
- C:\Windows\System\glrtoKq.exe
  C:\Windows\System\glrtoKq.exe
  2⤵
  PID:6448
- C:\Windows\System\qyeNLim.exe
  C:\Windows\System\qyeNLim.exe
  2⤵
  PID:6468
- C:\Windows\System\FpzVaJr.exe
  C:\Windows\System\FpzVaJr.exe
  2⤵
  PID:6488
- C:\Windows\System\FvtLrvp.exe
  C:\Windows\System\FvtLrvp.exe
  2⤵
  PID:6508
- C:\Windows\System\vNVjhjt.exe
  C:\Windows\System\vNVjhjt.exe
  2⤵
  PID:6560
- C:\Windows\System\WhLALDa.exe
  C:\Windows\System\WhLALDa.exe
  2⤵
  PID:6612
- C:\Windows\System\LEWokfX.exe
  C:\Windows\System\LEWokfX.exe
  2⤵
  PID:6632
- C:\Windows\System\wMmaBRK.exe
  C:\Windows\System\wMmaBRK.exe
  2⤵
  PID:6660
- C:\Windows\System\DiDwuJM.exe
  C:\Windows\System\DiDwuJM.exe
  2⤵
  PID:6680
- C:\Windows\System\MltoVUN.exe
  C:\Windows\System\MltoVUN.exe
  2⤵
  PID:6696
- C:\Windows\System\UgLVDbN.exe
  C:\Windows\System\UgLVDbN.exe
  2⤵
  PID:6748
- C:\Windows\System\dDFMsGM.exe
  C:\Windows\System\dDFMsGM.exe
  2⤵
  PID:6780
- C:\Windows\System\sFIHsyH.exe
  C:\Windows\System\sFIHsyH.exe
  2⤵
  PID:6828
- C:\Windows\System\zNHfiqe.exe
  C:\Windows\System\zNHfiqe.exe
  2⤵
  PID:6860
- C:\Windows\System\dCtlJbH.exe
  C:\Windows\System\dCtlJbH.exe
  2⤵
  PID:6880
- C:\Windows\System\bhTgzzI.exe
  C:\Windows\System\bhTgzzI.exe
  2⤵
  PID:6900
- C:\Windows\System\kguCzZv.exe
  C:\Windows\System\kguCzZv.exe
  2⤵
  PID:6928
- C:\Windows\System\roDrKba.exe
  C:\Windows\System\roDrKba.exe
  2⤵
  PID:6952
- C:\Windows\System\YmoTqjw.exe
  C:\Windows\System\YmoTqjw.exe
  2⤵
  PID:6972
- C:\Windows\System\FUBXSYD.exe
  C:\Windows\System\FUBXSYD.exe
  2⤵
  PID:7000
- C:\Windows\System\SBRFmWz.exe
  C:\Windows\System\SBRFmWz.exe
  2⤵
  PID:7028
- C:\Windows\System\KybCmps.exe
  C:\Windows\System\KybCmps.exe
  2⤵
  PID:7044
- C:\Windows\System\DlKkZwk.exe
  C:\Windows\System\DlKkZwk.exe
  2⤵
  PID:7068
- C:\Windows\System\KSAFkhk.exe
  C:\Windows\System\KSAFkhk.exe
  2⤵
  PID:7108
- C:\Windows\System\EetKRfF.exe
  C:\Windows\System\EetKRfF.exe
  2⤵
  PID:7140
- C:\Windows\System\ZKWblMM.exe
  C:\Windows\System\ZKWblMM.exe
  2⤵
  PID:7160
- C:\Windows\System\FZgBCaf.exe
  C:\Windows\System\FZgBCaf.exe
  2⤵
  PID:4060
- C:\Windows\System\fxQvTie.exe
  C:\Windows\System\fxQvTie.exe
  2⤵
  PID:6184
- C:\Windows\System\COeGsop.exe
  C:\Windows\System\COeGsop.exe
  2⤵
  PID:6252
- C:\Windows\System\XcwXcDy.exe
  C:\Windows\System\XcwXcDy.exe
  2⤵
  PID:6352
- C:\Windows\System\BOgTKkq.exe
  C:\Windows\System\BOgTKkq.exe
  2⤵
  PID:6356
- C:\Windows\System\EvwiALM.exe
  C:\Windows\System\EvwiALM.exe
  2⤵
  PID:6416
- C:\Windows\System\ZcNtjLw.exe
  C:\Windows\System\ZcNtjLw.exe
  2⤵
  PID:6444
- C:\Windows\System\HmluskJ.exe
  C:\Windows\System\HmluskJ.exe
  2⤵
  PID:6476
- C:\Windows\System\bEYnBqy.exe
  C:\Windows\System\bEYnBqy.exe
  2⤵
  PID:6552
- C:\Windows\System\sywGWBo.exe
  C:\Windows\System\sywGWBo.exe
  2⤵
  PID:6624
- C:\Windows\System\EBFfouU.exe
  C:\Windows\System\EBFfouU.exe
  2⤵
  PID:6772
- C:\Windows\System\SXvuEEy.exe
  C:\Windows\System\SXvuEEy.exe
  2⤵
  PID:6788
- C:\Windows\System\ZrKFyuR.exe
  C:\Windows\System\ZrKFyuR.exe
  2⤵
  PID:6892
- C:\Windows\System\adKmzXD.exe
  C:\Windows\System\adKmzXD.exe
  2⤵
  PID:6948
- C:\Windows\System\YNzvrXU.exe
  C:\Windows\System\YNzvrXU.exe
  2⤵
  PID:7036
- C:\Windows\System\DfIbjXz.exe
  C:\Windows\System\DfIbjXz.exe
  2⤵
  PID:7152
- C:\Windows\System\BVuzSZB.exe
  C:\Windows\System\BVuzSZB.exe
  2⤵
  PID:5604
- C:\Windows\System\HfhnquN.exe
  C:\Windows\System\HfhnquN.exe
  2⤵
  PID:7156
- C:\Windows\System\PNFnlaL.exe
  C:\Windows\System\PNFnlaL.exe
  2⤵
  PID:6440
- C:\Windows\System\qbpOEwn.exe
  C:\Windows\System\qbpOEwn.exe
  2⤵
  PID:6392
- C:\Windows\System\BzuQHkn.exe
  C:\Windows\System\BzuQHkn.exe
  2⤵
  PID:6652
- C:\Windows\System\dADseiE.exe
  C:\Windows\System\dADseiE.exe
  2⤵
  PID:6796
- C:\Windows\System\wBBGJOx.exe
  C:\Windows\System\wBBGJOx.exe
  2⤵
  PID:6980
- C:\Windows\System\TVRCcVl.exe
  C:\Windows\System\TVRCcVl.exe
  2⤵
  PID:7128
- C:\Windows\System\bshKRZc.exe
  C:\Windows\System\bshKRZc.exe
  2⤵
  PID:6180
- C:\Windows\System\bPFrEJI.exe
  C:\Windows\System\bPFrEJI.exe
  2⤵
  PID:6744
- C:\Windows\System\yJkxfcn.exe
  C:\Windows\System\yJkxfcn.exe
  2⤵
  PID:6316
- C:\Windows\System\JRSlZfQ.exe
  C:\Windows\System\JRSlZfQ.exe
  2⤵
  PID:7196
- C:\Windows\System\MrSghYp.exe
  C:\Windows\System\MrSghYp.exe
  2⤵
  PID:7216
- C:\Windows\System\xOwKxoS.exe
  C:\Windows\System\xOwKxoS.exe
  2⤵
  PID:7256
- C:\Windows\System\MELjEYU.exe
  C:\Windows\System\MELjEYU.exe
  2⤵
  PID:7276
- C:\Windows\System\ioDCEkz.exe
  C:\Windows\System\ioDCEkz.exe
  2⤵
  PID:7292
- C:\Windows\System\QuWFrRu.exe
  C:\Windows\System\QuWFrRu.exe
  2⤵
  PID:7316
- C:\Windows\System\DiMYziL.exe
  C:\Windows\System\DiMYziL.exe
  2⤵
  PID:7340
- C:\Windows\System\ahUPkmM.exe
  C:\Windows\System\ahUPkmM.exe
  2⤵
  PID:7368
- C:\Windows\System\bsGmakR.exe
  C:\Windows\System\bsGmakR.exe
  2⤵
  PID:7388
- C:\Windows\System\xUBwHoU.exe
  C:\Windows\System\xUBwHoU.exe
  2⤵
  PID:7416
- C:\Windows\System\WmcyLKJ.exe
  C:\Windows\System\WmcyLKJ.exe
  2⤵
  PID:7484
- C:\Windows\System\HzilmuN.exe
  C:\Windows\System\HzilmuN.exe
  2⤵
  PID:7504
- C:\Windows\System\dnuCXhI.exe
  C:\Windows\System\dnuCXhI.exe
  2⤵
  PID:7524
- C:\Windows\System\QWhkhTP.exe
  C:\Windows\System\QWhkhTP.exe
  2⤵
  PID:7564
- C:\Windows\System\TIqIcSb.exe
  C:\Windows\System\TIqIcSb.exe
  2⤵
  PID:7584
- C:\Windows\System\ClTbbVk.exe
  C:\Windows\System\ClTbbVk.exe
  2⤵
  PID:7604
- C:\Windows\System\rXvEBZR.exe
  C:\Windows\System\rXvEBZR.exe
  2⤵
  PID:7624
- C:\Windows\System\DBEmtjw.exe
  C:\Windows\System\DBEmtjw.exe
  2⤵
  PID:7660
- C:\Windows\System\iZWOlQf.exe
  C:\Windows\System\iZWOlQf.exe
  2⤵
  PID:7684
- C:\Windows\System\SGyFrsB.exe
  C:\Windows\System\SGyFrsB.exe
  2⤵
  PID:7704
- C:\Windows\System\djDtqLB.exe
  C:\Windows\System\djDtqLB.exe
  2⤵
  PID:7720
- C:\Windows\System\IhfKXvt.exe
  C:\Windows\System\IhfKXvt.exe
  2⤵
  PID:7740
- C:\Windows\System\PyCOIOr.exe
  C:\Windows\System\PyCOIOr.exe
  2⤵
  PID:7764
- C:\Windows\System\JmojrQw.exe
  C:\Windows\System\JmojrQw.exe
  2⤵
  PID:7784
- C:\Windows\System\CfPQCfu.exe
  C:\Windows\System\CfPQCfu.exe
  2⤵
  PID:7812
- C:\Windows\System\cnBQcIM.exe
  C:\Windows\System\cnBQcIM.exe
  2⤵
  PID:7868
- C:\Windows\System\RWNFmsj.exe
  C:\Windows\System\RWNFmsj.exe
  2⤵
  PID:7884
- C:\Windows\System\QwbIdcT.exe
  C:\Windows\System\QwbIdcT.exe
  2⤵
  PID:7912
- C:\Windows\System\ZGHfeIr.exe
  C:\Windows\System\ZGHfeIr.exe
  2⤵
  PID:7940
- C:\Windows\System\GbvzaNI.exe
  C:\Windows\System\GbvzaNI.exe
  2⤵
  PID:7964
- C:\Windows\System\gcmJvov.exe
  C:\Windows\System\gcmJvov.exe
  2⤵
  PID:7988
- C:\Windows\System\ZahExTa.exe
  C:\Windows\System\ZahExTa.exe
  2⤵
  PID:8068
- C:\Windows\System\MSmyPCh.exe
  C:\Windows\System\MSmyPCh.exe
  2⤵
  PID:8100
- C:\Windows\System\wZyOFAf.exe
  C:\Windows\System\wZyOFAf.exe
  2⤵
  PID:8120
- C:\Windows\System\frhikVt.exe
  C:\Windows\System\frhikVt.exe
  2⤵
  PID:8144
- C:\Windows\System\XmitEkL.exe
  C:\Windows\System\XmitEkL.exe
  2⤵
  PID:8172
- C:\Windows\System\kYPFqjX.exe
  C:\Windows\System\kYPFqjX.exe
  2⤵
  PID:7212
- C:\Windows\System\JzfATXD.exe
  C:\Windows\System\JzfATXD.exe
  2⤵
  PID:7252
- C:\Windows\System\beeksEw.exe
  C:\Windows\System\beeksEw.exe
  2⤵
  PID:7284
- C:\Windows\System\SdmNgcV.exe
  C:\Windows\System\SdmNgcV.exe
  2⤵
  PID:7412
- C:\Windows\System\qfeqSVv.exe
  C:\Windows\System\qfeqSVv.exe
  2⤵
  PID:7444
- C:\Windows\System\SvTgVat.exe
  C:\Windows\System\SvTgVat.exe
  2⤵
  PID:7492
- C:\Windows\System\ZMDxxSE.exe
  C:\Windows\System\ZMDxxSE.exe
  2⤵
  PID:7536
- C:\Windows\System\DcXwGpk.exe
  C:\Windows\System\DcXwGpk.exe
  2⤵
  PID:7572
- C:\Windows\System\pPYmrpf.exe
  C:\Windows\System\pPYmrpf.exe
  2⤵
  PID:7600
- C:\Windows\System\iGruBSf.exe
  C:\Windows\System\iGruBSf.exe
  2⤵
  PID:7668
- C:\Windows\System\OBLDQPY.exe
  C:\Windows\System\OBLDQPY.exe
  2⤵
  PID:7696
- C:\Windows\System\xXIncHB.exe
  C:\Windows\System\xXIncHB.exe
  2⤵
  PID:7748
- C:\Windows\System\SibuHBz.exe
  C:\Windows\System\SibuHBz.exe
  2⤵
  PID:7892
- C:\Windows\System\kojtqbv.exe
  C:\Windows\System\kojtqbv.exe
  2⤵
  PID:7908
- C:\Windows\System\nMjKTBZ.exe
  C:\Windows\System\nMjKTBZ.exe
  2⤵
  PID:7980
- C:\Windows\System\MUIuSIc.exe
  C:\Windows\System\MUIuSIc.exe
  2⤵
  PID:8048
- C:\Windows\System\hAuhetC.exe
  C:\Windows\System\hAuhetC.exe
  2⤵
  PID:8088
- C:\Windows\System\POJNsRw.exe
  C:\Windows\System\POJNsRw.exe
  2⤵
  PID:6868
- C:\Windows\System\seugqHI.exe
  C:\Windows\System\seugqHI.exe
  2⤵
  PID:7228
- C:\Windows\System\fHYnvmM.exe
  C:\Windows\System\fHYnvmM.exe
  2⤵
  PID:7336
- C:\Windows\System\XJLJvtj.exe
  C:\Windows\System\XJLJvtj.exe
  2⤵
  PID:7732
- C:\Windows\System\MlmcYUV.exe
  C:\Windows\System\MlmcYUV.exe
  2⤵
  PID:7972
- C:\Windows\System\EsLOHPe.exe
  C:\Windows\System\EsLOHPe.exe
  2⤵
  PID:8116
- C:\Windows\System\HWroTLq.exe
  C:\Windows\System\HWroTLq.exe
  2⤵
  PID:8180
- C:\Windows\System\vLJdQPi.exe
  C:\Windows\System\vLJdQPi.exe
  2⤵
  PID:7452
- C:\Windows\System\puYOCVZ.exe
  C:\Windows\System\puYOCVZ.exe
  2⤵
  PID:7716
- C:\Windows\System\nPnyaAm.exe
  C:\Windows\System\nPnyaAm.exe
  2⤵
  PID:7796
- C:\Windows\System\GxpBkTU.exe
  C:\Windows\System\GxpBkTU.exe
  2⤵
  PID:7332
- C:\Windows\System\uXdcXqa.exe
  C:\Windows\System\uXdcXqa.exe
  2⤵
  PID:8240
- C:\Windows\System\sPaFEAv.exe
  C:\Windows\System\sPaFEAv.exe
  2⤵
  PID:8260
- C:\Windows\System\VEVbKik.exe
  C:\Windows\System\VEVbKik.exe
  2⤵
  PID:8280
- C:\Windows\System\czeEeNd.exe
  C:\Windows\System\czeEeNd.exe
  2⤵
  PID:8304
- C:\Windows\System\JEBNKWv.exe
  C:\Windows\System\JEBNKWv.exe
  2⤵
  PID:8340
- C:\Windows\System\CLjljDp.exe
  C:\Windows\System\CLjljDp.exe
  2⤵
  PID:8372
- C:\Windows\System\CLdMrJN.exe
  C:\Windows\System\CLdMrJN.exe
  2⤵
  PID:8392
- C:\Windows\System\oVnlHnc.exe
  C:\Windows\System\oVnlHnc.exe
  2⤵
  PID:8420
- C:\Windows\System\UivPLCZ.exe
  C:\Windows\System\UivPLCZ.exe
  2⤵
  PID:8444
- C:\Windows\System\yTVeIdg.exe
  C:\Windows\System\yTVeIdg.exe
  2⤵
  PID:8460
- C:\Windows\System\VXiyGRU.exe
  C:\Windows\System\VXiyGRU.exe
  2⤵
  PID:8496
- C:\Windows\System\VrgAZvu.exe
  C:\Windows\System\VrgAZvu.exe
  2⤵
  PID:8536
- C:\Windows\System\sNMVJXC.exe
  C:\Windows\System\sNMVJXC.exe
  2⤵
  PID:8568
- C:\Windows\System\uhgXdRx.exe
  C:\Windows\System\uhgXdRx.exe
  2⤵
  PID:8588
- C:\Windows\System\iZSTsIS.exe
  C:\Windows\System\iZSTsIS.exe
  2⤵
  PID:8612
- C:\Windows\System\DhsYLVv.exe
  C:\Windows\System\DhsYLVv.exe
  2⤵
  PID:8636
- C:\Windows\System\TYIchZr.exe
  C:\Windows\System\TYIchZr.exe
  2⤵
  PID:8676
- C:\Windows\System\NOcclJZ.exe
  C:\Windows\System\NOcclJZ.exe
  2⤵
  PID:8720
- C:\Windows\System\yBXqtpq.exe
  C:\Windows\System\yBXqtpq.exe
  2⤵
  PID:8740
- C:\Windows\System\zHRqRVs.exe
  C:\Windows\System\zHRqRVs.exe
  2⤵
  PID:8768
- C:\Windows\System\zGqbaYN.exe
  C:\Windows\System\zGqbaYN.exe
  2⤵
  PID:8800
- C:\Windows\System\otMiLwz.exe
  C:\Windows\System\otMiLwz.exe
  2⤵
  PID:8828
- C:\Windows\System\mzlOYVO.exe
  C:\Windows\System\mzlOYVO.exe
  2⤵
  PID:8880
- C:\Windows\System\khxSJyp.exe
  C:\Windows\System\khxSJyp.exe
  2⤵
  PID:8896
- C:\Windows\System\FQXpnZp.exe
  C:\Windows\System\FQXpnZp.exe
  2⤵
  PID:8920
- C:\Windows\System\ZDDRWUw.exe
  C:\Windows\System\ZDDRWUw.exe
  2⤵
  PID:8940
- C:\Windows\System\qJrBtmI.exe
  C:\Windows\System\qJrBtmI.exe
  2⤵
  PID:8960
- C:\Windows\System\LSZabrm.exe
  C:\Windows\System\LSZabrm.exe
  2⤵
  PID:8988
- C:\Windows\System\XJWgZPD.exe
  C:\Windows\System\XJWgZPD.exe
  2⤵
  PID:9012
- C:\Windows\System\XqXToru.exe
  C:\Windows\System\XqXToru.exe
  2⤵
  PID:9032
- C:\Windows\System\wKRdmmQ.exe
  C:\Windows\System\wKRdmmQ.exe
  2⤵
  PID:9060
- C:\Windows\System\lorhkOZ.exe
  C:\Windows\System\lorhkOZ.exe
  2⤵
  PID:9116
- C:\Windows\System\NgiJKLc.exe
  C:\Windows\System\NgiJKLc.exe
  2⤵
  PID:9136
- C:\Windows\System\NCtJzuZ.exe
  C:\Windows\System\NCtJzuZ.exe
  2⤵
  PID:9164
- C:\Windows\System\COzqSJf.exe
  C:\Windows\System\COzqSJf.exe
  2⤵
  PID:9192
- C:\Windows\System\gonsdqv.exe
  C:\Windows\System\gonsdqv.exe
  2⤵
  PID:9208
- C:\Windows\System\HXypmdl.exe
  C:\Windows\System\HXypmdl.exe
  2⤵
  PID:8232
- C:\Windows\System\wsCKiZx.exe
  C:\Windows\System\wsCKiZx.exe
  2⤵
  PID:8364
- C:\Windows\System\YjCXRta.exe
  C:\Windows\System\YjCXRta.exe
  2⤵
  PID:8560
- C:\Windows\System\HNAmuHR.exe
  C:\Windows\System\HNAmuHR.exe
  2⤵
  PID:8596
- C:\Windows\System\lhEtKTn.exe
  C:\Windows\System\lhEtKTn.exe
  2⤵
  PID:8648
- C:\Windows\System\cEYePKP.exe
  C:\Windows\System\cEYePKP.exe
  2⤵
  PID:8696
- C:\Windows\System\yYLyflq.exe
  C:\Windows\System\yYLyflq.exe
  2⤵
  PID:8688
- C:\Windows\System\haCPVJv.exe
  C:\Windows\System\haCPVJv.exe
  2⤵
  PID:8748
- C:\Windows\System\jVZsxQM.exe
  C:\Windows\System\jVZsxQM.exe
  2⤵
  PID:8792
- C:\Windows\System\APxAyia.exe
  C:\Windows\System\APxAyia.exe
  2⤵
  PID:7808
- C:\Windows\System\OQIXygw.exe
  C:\Windows\System\OQIXygw.exe
  2⤵
  PID:5296
- C:\Windows\System\eheROXG.exe
  C:\Windows\System\eheROXG.exe
  2⤵
  PID:8888
- C:\Windows\System\OBsSPHi.exe
  C:\Windows\System\OBsSPHi.exe
  2⤵
  PID:9000
- C:\Windows\System\IiKvCWU.exe
  C:\Windows\System\IiKvCWU.exe
  2⤵
  PID:9200
- C:\Windows\System\jdPuwnN.exe
  C:\Windows\System\jdPuwnN.exe
  2⤵
  PID:8532
- C:\Windows\System\HBthjgy.exe
  C:\Windows\System\HBthjgy.exe
  2⤵
  PID:8436
- C:\Windows\System\oNXQjlg.exe
  C:\Windows\System\oNXQjlg.exe
  2⤵
  PID:8248
- C:\Windows\System\gVAnEGR.exe
  C:\Windows\System\gVAnEGR.exe
  2⤵
  PID:8456
- C:\Windows\System\SjMvybr.exe
  C:\Windows\System\SjMvybr.exe
  2⤵
  PID:8780
- C:\Windows\System\odsUEsV.exe
  C:\Windows\System\odsUEsV.exe
  2⤵
  PID:8520
- C:\Windows\System\MCOovfl.exe
  C:\Windows\System\MCOovfl.exe
  2⤵
  PID:8848
- C:\Windows\System\etFWEkw.exe
  C:\Windows\System\etFWEkw.exe
  2⤵
  PID:8292
- C:\Windows\System\iGXotmO.exe
  C:\Windows\System\iGXotmO.exe
  2⤵
  PID:8272
- C:\Windows\System\iqomCEO.exe
  C:\Windows\System\iqomCEO.exe
  2⤵
  PID:8912
- C:\Windows\System\AnfFbAT.exe
  C:\Windows\System\AnfFbAT.exe
  2⤵
  PID:8488
- C:\Windows\System\Gikagmk.exe
  C:\Windows\System\Gikagmk.exe
  2⤵
  PID:9080
- C:\Windows\System\zOrWfqs.exe
  C:\Windows\System\zOrWfqs.exe
  2⤵
  PID:9108
- C:\Windows\System\SJoDEqt.exe
  C:\Windows\System\SJoDEqt.exe
  2⤵
  PID:8440
- C:\Windows\System\DbRDzOP.exe
  C:\Windows\System\DbRDzOP.exe
  2⤵
  PID:9232
- C:\Windows\System\ocrfLYR.exe
  C:\Windows\System\ocrfLYR.exe
  2⤵
  PID:9260
- C:\Windows\System\cdbgUxL.exe
  C:\Windows\System\cdbgUxL.exe
  2⤵
  PID:9288
- C:\Windows\System\rdBFxLE.exe
  C:\Windows\System\rdBFxLE.exe
  2⤵
  PID:9308
- C:\Windows\System\KhyFYXs.exe
  C:\Windows\System\KhyFYXs.exe
  2⤵
  PID:9360
- C:\Windows\System\HDAhsdL.exe
  C:\Windows\System\HDAhsdL.exe
  2⤵
  PID:9396
- C:\Windows\System\mhgFzzQ.exe
  C:\Windows\System\mhgFzzQ.exe
  2⤵
  PID:9436
- C:\Windows\System\wxgwVDU.exe
  C:\Windows\System\wxgwVDU.exe
  2⤵
  PID:9460
- C:\Windows\System\IzLDplL.exe
  C:\Windows\System\IzLDplL.exe
  2⤵
  PID:9508
- C:\Windows\System\USMFfBd.exe
  C:\Windows\System\USMFfBd.exe
  2⤵
  PID:9528
- C:\Windows\System\HeoabAB.exe
  C:\Windows\System\HeoabAB.exe
  2⤵
  PID:9548
- C:\Windows\System\abXnuJG.exe
  C:\Windows\System\abXnuJG.exe
  2⤵
  PID:9568
- C:\Windows\System\JgsSfQb.exe
  C:\Windows\System\JgsSfQb.exe
  2⤵
  PID:9604
- C:\Windows\System\APzyuTa.exe
  C:\Windows\System\APzyuTa.exe
  2⤵
  PID:9648
- C:\Windows\System\WvYzHUI.exe
  C:\Windows\System\WvYzHUI.exe
  2⤵
  PID:9680
- C:\Windows\System\tpKzzgS.exe
  C:\Windows\System\tpKzzgS.exe
  2⤵
  PID:9704
- C:\Windows\System\DYUgRMT.exe
  C:\Windows\System\DYUgRMT.exe
  2⤵
  PID:9720
- C:\Windows\System\UcapUaH.exe
  C:\Windows\System\UcapUaH.exe
  2⤵
  PID:9740
- C:\Windows\System\GfcBDxT.exe
  C:\Windows\System\GfcBDxT.exe
  2⤵
  PID:9764
- C:\Windows\System\UIVCcSi.exe
  C:\Windows\System\UIVCcSi.exe
  2⤵
  PID:9792
- C:\Windows\System\GlsIlXS.exe
  C:\Windows\System\GlsIlXS.exe
  2⤵
  PID:9832
- C:\Windows\System\rYdxNVH.exe
  C:\Windows\System\rYdxNVH.exe
  2⤵
  PID:9864
- C:\Windows\System\CbqQjid.exe
  C:\Windows\System\CbqQjid.exe
  2⤵
  PID:9888
- C:\Windows\System\sYJFmBa.exe
  C:\Windows\System\sYJFmBa.exe
  2⤵
  PID:9912
- C:\Windows\System\LsXtynq.exe
  C:\Windows\System\LsXtynq.exe
  2⤵
  PID:9932
- C:\Windows\System\XlbHEXN.exe
  C:\Windows\System\XlbHEXN.exe
  2⤵
  PID:9952
- C:\Windows\System\yfdMmZQ.exe
  C:\Windows\System\yfdMmZQ.exe
  2⤵
  PID:9992
- C:\Windows\System\wjuQHTb.exe
  C:\Windows\System\wjuQHTb.exe
  2⤵
  PID:10056
- C:\Windows\System\uQzPYqY.exe
  C:\Windows\System\uQzPYqY.exe
  2⤵
  PID:10084
- C:\Windows\System\oXPeeOe.exe
  C:\Windows\System\oXPeeOe.exe
  2⤵
  PID:10108
- C:\Windows\System\ZYyupfA.exe
  C:\Windows\System\ZYyupfA.exe
  2⤵
  PID:10128
- C:\Windows\System\KPHHJIs.exe
  C:\Windows\System\KPHHJIs.exe
  2⤵
  PID:10152
- C:\Windows\System\tSunaJF.exe
  C:\Windows\System\tSunaJF.exe
  2⤵
  PID:10176
- C:\Windows\System\xnBGZiM.exe
  C:\Windows\System\xnBGZiM.exe
  2⤵
  PID:10204
- C:\Windows\System\JgRzZak.exe
  C:\Windows\System\JgRzZak.exe
  2⤵
  PID:10236
- C:\Windows\System\IBkCiUp.exe
  C:\Windows\System\IBkCiUp.exe
  2⤵
  PID:9244
- C:\Windows\System\MDkOdxc.exe
  C:\Windows\System\MDkOdxc.exe
  2⤵
  PID:8852
- C:\Windows\System\bXpnyAm.exe
  C:\Windows\System\bXpnyAm.exe
  2⤵
  PID:9332
- C:\Windows\System\fBYjkYx.exe
  C:\Windows\System\fBYjkYx.exe
  2⤵
  PID:9284
- C:\Windows\System\lNMgUoa.exe
  C:\Windows\System\lNMgUoa.exe
  2⤵
  PID:9456
- C:\Windows\System\XBbnGLg.exe
  C:\Windows\System\XBbnGLg.exe
  2⤵
  PID:9524
- C:\Windows\System\juQGIqy.exe
  C:\Windows\System\juQGIqy.exe
  2⤵
  PID:9588
- C:\Windows\System\JiHsKRa.exe
  C:\Windows\System\JiHsKRa.exe
  2⤵
  PID:9700
- C:\Windows\System\SysGOpX.exe
  C:\Windows\System\SysGOpX.exe
  2⤵
  PID:9732
- C:\Windows\System\nQkLKKS.exe
  C:\Windows\System\nQkLKKS.exe
  2⤵
  PID:9772
- C:\Windows\System\picLXTY.exe
  C:\Windows\System\picLXTY.exe
  2⤵
  PID:9848
- C:\Windows\System\KcvwCQt.exe
  C:\Windows\System\KcvwCQt.exe
  2⤵
  PID:9960
- C:\Windows\System\kklJnRX.exe
  C:\Windows\System\kklJnRX.exe
  2⤵
  PID:9928
- C:\Windows\System\taZGchG.exe
  C:\Windows\System\taZGchG.exe
  2⤵
  PID:10096
- C:\Windows\System\qpXWBlO.exe
  C:\Windows\System\qpXWBlO.exe
  2⤵
  PID:10172
- C:\Windows\System\CQAlinH.exe
  C:\Windows\System\CQAlinH.exe
  2⤵
  PID:10168
- C:\Windows\System\uQLDASb.exe
  C:\Windows\System\uQLDASb.exe
  2⤵
  PID:8504
- C:\Windows\System\oeGJsoH.exe
  C:\Windows\System\oeGJsoH.exe
  2⤵
  PID:8980
- C:\Windows\System\wjTQwoU.exe
  C:\Windows\System\wjTQwoU.exe
  2⤵
  PID:9280
- C:\Windows\System\YwgzImm.exe
  C:\Windows\System\YwgzImm.exe
  2⤵
  PID:9672
- C:\Windows\System\rBzqBJT.exe
  C:\Windows\System\rBzqBJT.exe
  2⤵
  PID:9872
- C:\Windows\System\fFQusqJ.exe
  C:\Windows\System\fFQusqJ.exe
  2⤵
  PID:9944
- C:\Windows\System\QgWtDWH.exe
  C:\Windows\System\QgWtDWH.exe
  2⤵
  PID:10052
- C:\Windows\System\oEDVRxR.exe
  C:\Windows\System\oEDVRxR.exe
  2⤵
  PID:10160
- C:\Windows\System\fMicuWs.exe
  C:\Windows\System\fMicuWs.exe
  2⤵
  PID:10224
- C:\Windows\System\GiTDNMA.exe
  C:\Windows\System\GiTDNMA.exe
  2⤵
  PID:9756
- C:\Windows\System\VpUlTXZ.exe
  C:\Windows\System\VpUlTXZ.exe
  2⤵
  PID:9736
- C:\Windows\System\JfOFQmj.exe
  C:\Windows\System\JfOFQmj.exe
  2⤵
  PID:9884
- C:\Windows\System\AKlyrfm.exe
  C:\Windows\System\AKlyrfm.exe
  2⤵
  PID:10256
- C:\Windows\System\jJtFbqV.exe
  C:\Windows\System\jJtFbqV.exe
  2⤵
  PID:10312
- C:\Windows\System\CmbWkOU.exe
  C:\Windows\System\CmbWkOU.exe
  2⤵
  PID:10352
- C:\Windows\System\ekJsssN.exe
  C:\Windows\System\ekJsssN.exe
  2⤵
  PID:10416
- C:\Windows\System\pRFdZyR.exe
  C:\Windows\System\pRFdZyR.exe
  2⤵
  PID:10432
- C:\Windows\System\XDgcVfl.exe
  C:\Windows\System\XDgcVfl.exe
  2⤵
  PID:10460
- C:\Windows\System\fFpALsm.exe
  C:\Windows\System\fFpALsm.exe
  2⤵
  PID:10476
- C:\Windows\System\zTVMqTO.exe
  C:\Windows\System\zTVMqTO.exe
  2⤵
  PID:10524
- C:\Windows\System\opTKjuZ.exe
  C:\Windows\System\opTKjuZ.exe
  2⤵
  PID:10540
- C:\Windows\System\kjjLxRs.exe
  C:\Windows\System\kjjLxRs.exe
  2⤵
  PID:10564
- C:\Windows\System\AShVOwC.exe
  C:\Windows\System\AShVOwC.exe
  2⤵
  PID:10600
- C:\Windows\System\gwadBIw.exe
  C:\Windows\System\gwadBIw.exe
  2⤵
  PID:10620
- C:\Windows\System\qdWxvLL.exe
  C:\Windows\System\qdWxvLL.exe
  2⤵
  PID:10664
- C:\Windows\System\EjqQwjh.exe
  C:\Windows\System\EjqQwjh.exe
  2⤵
  PID:10688
- C:\Windows\System\pLBMxHF.exe
  C:\Windows\System\pLBMxHF.exe
  2⤵
  PID:10704
- C:\Windows\System\zNYFhHn.exe
  C:\Windows\System\zNYFhHn.exe
  2⤵
  PID:10720
- C:\Windows\System\EHHHyad.exe
  C:\Windows\System\EHHHyad.exe
  2⤵
  PID:10740
- C:\Windows\System\dKdvXBZ.exe
  C:\Windows\System\dKdvXBZ.exe
  2⤵
  PID:10764
- C:\Windows\System\XfKrjeE.exe
  C:\Windows\System\XfKrjeE.exe
  2⤵
  PID:10792
- C:\Windows\System\ZQNkNXK.exe
  C:\Windows\System\ZQNkNXK.exe
  2⤵
  PID:10808
- C:\Windows\System\sTojoIl.exe
  C:\Windows\System\sTojoIl.exe
  2⤵
  PID:10864
- C:\Windows\System\rVctomD.exe
  C:\Windows\System\rVctomD.exe
  2⤵
  PID:10888
- C:\Windows\System\MVGRkzh.exe
  C:\Windows\System\MVGRkzh.exe
  2⤵
  PID:10912
- C:\Windows\System\ghCbpmR.exe
  C:\Windows\System\ghCbpmR.exe
  2⤵
  PID:10964
- C:\Windows\System\lvavmAP.exe
  C:\Windows\System\lvavmAP.exe
  2⤵
  PID:10988
- C:\Windows\System\sTcxJud.exe
  C:\Windows\System\sTcxJud.exe
  2⤵
  PID:11012
- C:\Windows\System\FHpvQEi.exe
  C:\Windows\System\FHpvQEi.exe
  2⤵
  PID:11036
- C:\Windows\System\NQffwMC.exe
  C:\Windows\System\NQffwMC.exe
  2⤵
  PID:11084
- C:\Windows\System\dWIFLTi.exe
  C:\Windows\System\dWIFLTi.exe
  2⤵
  PID:11108
- C:\Windows\System\SdGYFeF.exe
  C:\Windows\System\SdGYFeF.exe
  2⤵
  PID:11140
- C:\Windows\System\nPGdydw.exe
  C:\Windows\System\nPGdydw.exe
  2⤵
  PID:11160
- C:\Windows\System\HrCOLPV.exe
  C:\Windows\System\HrCOLPV.exe
  2⤵
  PID:11188
- C:\Windows\System\ALZvSUb.exe
  C:\Windows\System\ALZvSUb.exe
  2⤵
  PID:11212
- C:\Windows\System\AhVJrgR.exe
  C:\Windows\System\AhVJrgR.exe
  2⤵
  PID:11232
- C:\Windows\System\NNQkyaC.exe
  C:\Windows\System\NNQkyaC.exe
  2⤵
  PID:11252
- C:\Windows\System\WJLKlQW.exe
  C:\Windows\System\WJLKlQW.exe
  2⤵
  PID:8428
- C:\Windows\System\gNmcEjR.exe
  C:\Windows\System\gNmcEjR.exe
  2⤵
  PID:10284
- C:\Windows\System\iXzlrgL.exe
  C:\Windows\System\iXzlrgL.exe
  2⤵
  PID:10388
- C:\Windows\System\whoUvjZ.exe
  C:\Windows\System\whoUvjZ.exe
  2⤵
  PID:10452
- C:\Windows\System\nrnQrRX.exe
  C:\Windows\System\nrnQrRX.exe
  2⤵
  PID:10496
- C:\Windows\System\EJOYJEm.exe
  C:\Windows\System\EJOYJEm.exe
  2⤵
  PID:10532
- C:\Windows\System\IwRRoXf.exe
  C:\Windows\System\IwRRoXf.exe
  2⤵
  PID:10596
- C:\Windows\System\ngyTsrV.exe
  C:\Windows\System\ngyTsrV.exe
  2⤵
  PID:10684
- C:\Windows\System\YjgJWWU.exe
  C:\Windows\System\YjgJWWU.exe
  2⤵
  PID:10732
- C:\Windows\System\xyPMsta.exe
  C:\Windows\System\xyPMsta.exe
  2⤵
  PID:10836
- C:\Windows\System\sziIvmA.exe
  C:\Windows\System\sziIvmA.exe
  2⤵
  PID:10852
- C:\Windows\System\qIvEqFI.exe
  C:\Windows\System\qIvEqFI.exe
  2⤵
  PID:11028
- C:\Windows\System\stoquKl.exe
  C:\Windows\System\stoquKl.exe
  2⤵
  PID:11032
- C:\Windows\System\MMPuAjw.exe
  C:\Windows\System\MMPuAjw.exe
  2⤵
  PID:11060
- C:\Windows\System\nFxNCwx.exe
  C:\Windows\System\nFxNCwx.exe
  2⤵
  PID:11132
- C:\Windows\System\EcjPayz.exe
  C:\Windows\System\EcjPayz.exe
  2⤵
  PID:11180
- C:\Windows\System\RSNzNqD.exe
  C:\Windows\System\RSNzNqD.exe
  2⤵
  PID:9624
- C:\Windows\System\vjYxLEx.exe
  C:\Windows\System\vjYxLEx.exe
  2⤵
  PID:10292
- C:\Windows\System\lgLgcpK.exe
  C:\Windows\System\lgLgcpK.exe
  2⤵
  PID:10560
- C:\Windows\System\jbaCJHB.exe
  C:\Windows\System\jbaCJHB.exe
  2⤵
  PID:10716
- C:\Windows\System\IWHhRvR.exe
  C:\Windows\System\IWHhRvR.exe
  2⤵
  PID:10780
- C:\Windows\System\iMHnUBY.exe
  C:\Windows\System\iMHnUBY.exe
  2⤵
  PID:10884
- C:\Windows\System\KqrYatj.exe
  C:\Windows\System\KqrYatj.exe
  2⤵
  PID:10972
- C:\Windows\System\rpmOtyK.exe
  C:\Windows\System\rpmOtyK.exe
  2⤵
  PID:9420
- C:\Windows\System\srnqBsW.exe
  C:\Windows\System\srnqBsW.exe
  2⤵
  PID:10660
- C:\Windows\System\olwdXlA.exe
  C:\Windows\System\olwdXlA.exe
  2⤵
  PID:10956
- C:\Windows\System\xDVmKed.exe
  C:\Windows\System\xDVmKed.exe
  2⤵
  PID:10612
- C:\Windows\System\orrgztg.exe
  C:\Windows\System\orrgztg.exe
  2⤵
  PID:10800
- C:\Windows\System\wkqdPZZ.exe
  C:\Windows\System\wkqdPZZ.exe
  2⤵
  PID:11276
- C:\Windows\System\TIBWObP.exe
  C:\Windows\System\TIBWObP.exe
  2⤵
  PID:11320
- C:\Windows\System\FyYnsfN.exe
  C:\Windows\System\FyYnsfN.exe
  2⤵
  PID:11344
- C:\Windows\System\dwNwRWi.exe
  C:\Windows\System\dwNwRWi.exe
  2⤵
  PID:11364
- C:\Windows\System\birPQUo.exe
  C:\Windows\System\birPQUo.exe
  2⤵
  PID:11388
- C:\Windows\System\GwUQGZM.exe
  C:\Windows\System\GwUQGZM.exe
  2⤵
  PID:11412
- C:\Windows\System\BJtoINi.exe
  C:\Windows\System\BJtoINi.exe
  2⤵
  PID:11436
- C:\Windows\System\WKCDPAU.exe
  C:\Windows\System\WKCDPAU.exe
  2⤵
  PID:11480
- C:\Windows\System\ZOEshaU.exe
  C:\Windows\System\ZOEshaU.exe
  2⤵
  PID:11508
- C:\Windows\System\uixYvbh.exe
  C:\Windows\System\uixYvbh.exe
  2⤵
  PID:11528
- C:\Windows\System\GtAPZZC.exe
  C:\Windows\System\GtAPZZC.exe
  2⤵
  PID:11556
- C:\Windows\System\IjnEPVf.exe
  C:\Windows\System\IjnEPVf.exe
  2⤵
  PID:11584
- C:\Windows\System\RcIkMtp.exe
  C:\Windows\System\RcIkMtp.exe
  2⤵
  PID:11604
- C:\Windows\System\KdkPKyT.exe
  C:\Windows\System\KdkPKyT.exe
  2⤵
  PID:11624
- C:\Windows\System\zKbwIdr.exe
  C:\Windows\System\zKbwIdr.exe
  2⤵
  PID:11676
- C:\Windows\System\EvUZISp.exe
  C:\Windows\System\EvUZISp.exe
  2⤵
  PID:11696
- C:\Windows\System\dUOUiRZ.exe
  C:\Windows\System\dUOUiRZ.exe
  2⤵
  PID:11720
- C:\Windows\System\UMixIrA.exe
  C:\Windows\System\UMixIrA.exe
  2⤵
  PID:11736
- C:\Windows\System\PLyeyiN.exe
  C:\Windows\System\PLyeyiN.exe
  2⤵
  PID:11776
- C:\Windows\System\wmAzscC.exe
  C:\Windows\System\wmAzscC.exe
  2⤵
  PID:11808
- C:\Windows\System\DfqHhRX.exe
  C:\Windows\System\DfqHhRX.exe
  2⤵
  PID:11828
- C:\Windows\System\jsoSyaD.exe
  C:\Windows\System\jsoSyaD.exe
  2⤵
  PID:11860
- C:\Windows\System\lJyBVTY.exe
  C:\Windows\System\lJyBVTY.exe
  2⤵
  PID:11904
- C:\Windows\System\RBbjEWB.exe
  C:\Windows\System\RBbjEWB.exe
  2⤵
  PID:11932
- C:\Windows\System\mzzcRZY.exe
  C:\Windows\System\mzzcRZY.exe
  2⤵
  PID:11956
- C:\Windows\System\LkSmhBV.exe
  C:\Windows\System\LkSmhBV.exe
  2⤵
  PID:11972
- C:\Windows\System\QXFpGqG.exe
  C:\Windows\System\QXFpGqG.exe
  2⤵
  PID:12000
- C:\Windows\System\xGFFgAr.exe
  C:\Windows\System\xGFFgAr.exe
  2⤵
  PID:12032
- C:\Windows\System\fzZqMMR.exe
  C:\Windows\System\fzZqMMR.exe
  2⤵
  PID:12056
- C:\Windows\System\NxSOpkX.exe
  C:\Windows\System\NxSOpkX.exe
  2⤵
  PID:12076
- C:\Windows\System\cBnWKGu.exe
  C:\Windows\System\cBnWKGu.exe
  2⤵
  PID:12096
- C:\Windows\System\OymQfZE.exe
  C:\Windows\System\OymQfZE.exe
  2⤵
  PID:12120
- C:\Windows\System\PWXyAdd.exe
  C:\Windows\System\PWXyAdd.exe
  2⤵
  PID:12140
- C:\Windows\System\ojVgSru.exe
  C:\Windows\System\ojVgSru.exe
  2⤵
  PID:12172
- C:\Windows\System\qABPhzP.exe
  C:\Windows\System\qABPhzP.exe
  2⤵
  PID:12196
- C:\Windows\System\erdEXgh.exe
  C:\Windows\System\erdEXgh.exe
  2⤵
  PID:12216
- C:\Windows\System\vAdmyqT.exe
  C:\Windows\System\vAdmyqT.exe
  2⤵
  PID:12240
- C:\Windows\System\HfIqAqv.exe
  C:\Windows\System\HfIqAqv.exe
  2⤵
  PID:12272
- C:\Windows\System\RPpeYGK.exe
  C:\Windows\System\RPpeYGK.exe
  2⤵
  PID:11284
- C:\Windows\System\ZVbRVTR.exe
  C:\Windows\System\ZVbRVTR.exe
  2⤵
  PID:11396
- C:\Windows\System\rmqnoaN.exe
  C:\Windows\System\rmqnoaN.exe
  2⤵
  PID:10588
- C:\Windows\System\BTDmlju.exe
  C:\Windows\System\BTDmlju.exe
  2⤵
  PID:11544
- C:\Windows\System\TSAinLB.exe
  C:\Windows\System\TSAinLB.exe
  2⤵
  PID:11592
- C:\Windows\System\cjxykwI.exe
  C:\Windows\System\cjxykwI.exe
  2⤵
  PID:11688
- C:\Windows\System\qHItQrI.exe
  C:\Windows\System\qHItQrI.exe
  2⤵
  PID:11660
- C:\Windows\System\UjGiDXu.exe
  C:\Windows\System\UjGiDXu.exe
  2⤵
  PID:11728
- C:\Windows\System\BHGnWhH.exe
  C:\Windows\System\BHGnWhH.exe
  2⤵
  PID:11788
- C:\Windows\System\xYeijDK.exe
  C:\Windows\System\xYeijDK.exe
  2⤵
  PID:11852
- C:\Windows\System\Sjrapzq.exe
  C:\Windows\System\Sjrapzq.exe
  2⤵
  PID:11900
- C:\Windows\System\pAXBjqN.exe
  C:\Windows\System\pAXBjqN.exe
  2⤵
  PID:11968
- C:\Windows\System\cfCkFHO.exe
  C:\Windows\System\cfCkFHO.exe
  2⤵
  PID:12048
- C:\Windows\System\wzMqntB.exe
  C:\Windows\System\wzMqntB.exe
  2⤵
  PID:12204
- C:\Windows\System\WfuaJXu.exe
  C:\Windows\System\WfuaJXu.exe
  2⤵
  PID:12264
- C:\Windows\System\bwiKHaC.exe
  C:\Windows\System\bwiKHaC.exe
  2⤵
  PID:11332
- C:\Windows\System\fTusPCt.exe
  C:\Windows\System\fTusPCt.exe
  2⤵
  PID:11468
- C:\Windows\System\SeOSQSF.exe
  C:\Windows\System\SeOSQSF.exe
  2⤵
  PID:11640
- C:\Windows\System\lwXxiPt.exe
  C:\Windows\System\lwXxiPt.exe
  2⤵
  PID:11752
- C:\Windows\System\ndyRnbN.exe
  C:\Windows\System\ndyRnbN.exe
  2⤵
  PID:11964
- C:\Windows\System\PWtxhED.exe
  C:\Windows\System\PWtxhED.exe
  2⤵
  PID:12188
- C:\Windows\System\kKPIOxV.exe
  C:\Windows\System\kKPIOxV.exe
  2⤵
  PID:11312
- C:\Windows\System\AKgfXtQ.exe
  C:\Windows\System\AKgfXtQ.exe
  2⤵
  PID:11856
- C:\Windows\System\LtqCJRe.exe
  C:\Windows\System\LtqCJRe.exe
  2⤵
  PID:12092
- C:\Windows\System\FcBfynC.exe
  C:\Windows\System\FcBfynC.exe
  2⤵
  PID:11576
- C:\Windows\System\rHHiQnx.exe
  C:\Windows\System\rHHiQnx.exe
  2⤵
  PID:12148
- C:\Windows\System\MlRKODw.exe
  C:\Windows\System\MlRKODw.exe
  2⤵
  PID:12304
- C:\Windows\System\TSaVTBA.exe
  C:\Windows\System\TSaVTBA.exe
  2⤵
  PID:12328
- C:\Windows\System\vOMRXFY.exe
  C:\Windows\System\vOMRXFY.exe
  2⤵
  PID:12360
- C:\Windows\System\tLszoKZ.exe
  C:\Windows\System\tLszoKZ.exe
  2⤵
  PID:12392
- C:\Windows\System\bOtvuhC.exe
  C:\Windows\System\bOtvuhC.exe
  2⤵
  PID:12408
- C:\Windows\System\yWEwwMF.exe
  C:\Windows\System\yWEwwMF.exe
  2⤵
  PID:12436
- C:\Windows\System\NMHhruz.exe
  C:\Windows\System\NMHhruz.exe
  2⤵
  PID:12464
- C:\Windows\System\gqHmvEY.exe
  C:\Windows\System\gqHmvEY.exe
  2⤵
  PID:12484
- C:\Windows\System\ltVGecL.exe
  C:\Windows\System\ltVGecL.exe
  2⤵
  PID:12548
- C:\Windows\System\JoItCvu.exe
  C:\Windows\System\JoItCvu.exe
  2⤵
  PID:12568
- C:\Windows\System\IKhmzmP.exe
  C:\Windows\System\IKhmzmP.exe
  2⤵
  PID:12612
- C:\Windows\System\mcwYQtg.exe
  C:\Windows\System\mcwYQtg.exe
  2⤵
  PID:12628
- C:\Windows\System\cnHecuN.exe
  C:\Windows\System\cnHecuN.exe
  2⤵
  PID:12652
- C:\Windows\System\oMrpRyw.exe
  C:\Windows\System\oMrpRyw.exe
  2⤵
  PID:12672
- C:\Windows\System\zbuGvZa.exe
  C:\Windows\System\zbuGvZa.exe
  2⤵
  PID:12716
- C:\Windows\System\fELKtfg.exe
  C:\Windows\System\fELKtfg.exe
  2⤵
  PID:12740
- C:\Windows\System\EAipDdc.exe
  C:\Windows\System\EAipDdc.exe
  2⤵
  PID:12756
- C:\Windows\System\unvZpuP.exe
  C:\Windows\System\unvZpuP.exe
  2⤵
  PID:12788
- C:\Windows\System\nCDdlIL.exe
  C:\Windows\System\nCDdlIL.exe
  2⤵
  PID:12824
- C:\Windows\System\TSJUdxE.exe
  C:\Windows\System\TSJUdxE.exe
  2⤵
  PID:12848
- C:\Windows\System\AmbFqwr.exe
  C:\Windows\System\AmbFqwr.exe
  2⤵
  PID:12904
- C:\Windows\System\ptfqYNe.exe
  C:\Windows\System\ptfqYNe.exe
  2⤵
  PID:12932
- C:\Windows\System\ImKRaqR.exe
  C:\Windows\System\ImKRaqR.exe
  2⤵
  PID:12952
- C:\Windows\System\NbtKxFg.exe
  C:\Windows\System\NbtKxFg.exe
  2⤵
  PID:12976
- C:\Windows\System\uVXTGOE.exe
  C:\Windows\System\uVXTGOE.exe
  2⤵
  PID:13004
- C:\Windows\System\qBkvnEi.exe
  C:\Windows\System\qBkvnEi.exe
  2⤵
  PID:13024
- C:\Windows\System\Eblcgmp.exe
  C:\Windows\System\Eblcgmp.exe
  2⤵
  PID:13048
- C:\Windows\System\aBLYauw.exe
  C:\Windows\System\aBLYauw.exe
  2⤵
  PID:13072
- C:\Windows\System\MorUAhL.exe
  C:\Windows\System\MorUAhL.exe
  2⤵
  PID:13096
- C:\Windows\System\JVgDAye.exe
  C:\Windows\System\JVgDAye.exe
  2⤵
  PID:13160
- C:\Windows\System\jjKyKow.exe
  C:\Windows\System\jjKyKow.exe
  2⤵
  PID:13184
- C:\Windows\System\PMbCRqX.exe
  C:\Windows\System\PMbCRqX.exe
  2⤵
  PID:13204
- C:\Windows\System\TWDhMCq.exe
  C:\Windows\System\TWDhMCq.exe
  2⤵
  PID:13224
- C:\Windows\System\YjEAdlZ.exe
  C:\Windows\System\YjEAdlZ.exe
  2⤵
  PID:13252
- C:\Windows\System\EJVRUvq.exe
  C:\Windows\System\EJVRUvq.exe
  2⤵
  PID:13288
- C:\Windows\System\wfgiyME.exe
  C:\Windows\System\wfgiyME.exe
  2⤵
  PID:13304
- C:\Windows\System\zizRQRO.exe
  C:\Windows\System\zizRQRO.exe
  2⤵
  PID:12296
- C:\Windows\System\BcpXVvf.exe
  C:\Windows\System\BcpXVvf.exe
  2⤵
  PID:12376
- C:\Windows\System\pcIYByp.exe
  C:\Windows\System\pcIYByp.exe
  2⤵
  PID:12456
- C:\Windows\System\lcbBpUM.exe
  C:\Windows\System\lcbBpUM.exe
  2⤵
  PID:12512
- C:\Windows\System\ZiGgRNU.exe
  C:\Windows\System\ZiGgRNU.exe
  2⤵
  PID:12588
- C:\Windows\System\WVJxsIf.exe
  C:\Windows\System\WVJxsIf.exe
  2⤵
  PID:12648
- C:\Windows\System\PSrLrtR.exe
  C:\Windows\System\PSrLrtR.exe
  2⤵
  PID:12664
- C:\Windows\System\nGDjmTf.exe
  C:\Windows\System\nGDjmTf.exe
  2⤵
  PID:12732
- C:\Windows\System\PtsGHYb.exe
  C:\Windows\System\PtsGHYb.exe
  2⤵
  PID:12840
- C:\Windows\System\uIRvrlV.exe
  C:\Windows\System\uIRvrlV.exe
  2⤵
  PID:12928
- C:\Windows\System\ksPDNzh.exe
  C:\Windows\System\ksPDNzh.exe
  2⤵
  PID:13032
- C:\Windows\System\zPlzsix.exe
  C:\Windows\System\zPlzsix.exe
  2⤵
  PID:13068
- C:\Windows\System\GhQIzbT.exe
  C:\Windows\System\GhQIzbT.exe
  2⤵
  PID:13152
- C:\Windows\System\DJpmeJy.exe
  C:\Windows\System\DJpmeJy.exe
  2⤵
  PID:13212
- C:\Windows\System\UgjOeQK.exe
  C:\Windows\System\UgjOeQK.exe
  2⤵
  PID:13272
- C:\Windows\System\JQLeDsj.exe
  C:\Windows\System\JQLeDsj.exe
  2⤵
  PID:12072
- C:\Windows\System\LXHkbYq.exe
  C:\Windows\System\LXHkbYq.exe
  2⤵
  PID:12316
- C:\Windows\System\HHkAMlZ.exe
  C:\Windows\System\HHkAMlZ.exe
  2⤵
  PID:12556
- C:\Windows\System\SvHCNsg.exe
  C:\Windows\System\SvHCNsg.exe
  2⤵
  PID:12772
- C:\Windows\System\LEFHvlK.exe
  C:\Windows\System\LEFHvlK.exe
  2⤵
  PID:12924
- C:\Windows\System\ADWuZmk.exe
  C:\Windows\System\ADWuZmk.exe
  2⤵
  PID:13080
- C:\Windows\System\NeTYdcn.exe
  C:\Windows\System\NeTYdcn.exe
  2⤵
  PID:13192
- C:\Windows\System\UBYKdxx.exe
  C:\Windows\System\UBYKdxx.exe
  2⤵
  PID:13248
- C:\Windows\System\NEGdebI.exe
  C:\Windows\System\NEGdebI.exe
  2⤵
  PID:12432
- C:\Windows\System\fHMLmlh.exe
  C:\Windows\System\fHMLmlh.exe
  2⤵
  PID:4464
- C:\Windows\System\aTcKddH.exe
  C:\Windows\System\aTcKddH.exe
  2⤵
  PID:12900
- C:\Windows\System\yqjOFWX.exe
  C:\Windows\System\yqjOFWX.exe
  2⤵
  PID:12988
- C:\Windows\System\QuIIDCx.exe
  C:\Windows\System\QuIIDCx.exe
  2⤵
  PID:4660
- C:\Windows\System\ZkaqAzL.exe
  C:\Windows\System\ZkaqAzL.exe
  2⤵
  PID:13144
- C:\Windows\System\whCVLWp.exe
  C:\Windows\System\whCVLWp.exe
  2⤵
  PID:13336
- C:\Windows\System\QNYynDN.exe
  C:\Windows\System\QNYynDN.exe
  2⤵
  PID:13360
- C:\Windows\System\uembLAI.exe
  C:\Windows\System\uembLAI.exe
  2⤵
  PID:13380
- C:\Windows\System\LljVhGi.exe
  C:\Windows\System\LljVhGi.exe
  2⤵
  PID:13400
- C:\Windows\System\OykvXhY.exe
  C:\Windows\System\OykvXhY.exe
  2⤵
  PID:13420
- C:\Windows\System\RAYsdRA.exe
  C:\Windows\System\RAYsdRA.exe
  2⤵
  PID:13440
- C:\Windows\System\CUhQZZS.exe
  C:\Windows\System\CUhQZZS.exe
  2⤵
  PID:13488
- C:\Windows\System\pBYiugt.exe
  C:\Windows\System\pBYiugt.exe
  2⤵
  PID:13516
- C:\Windows\System\xaKDtSy.exe
  C:\Windows\System\xaKDtSy.exe
  2⤵
  PID:13560
- C:\Windows\System\YWaJxQy.exe
  C:\Windows\System\YWaJxQy.exe
  2⤵
  PID:13580
- C:\Windows\System\NezBITZ.exe
  C:\Windows\System\NezBITZ.exe
  2⤵
  PID:13632
- C:\Windows\System\TRJoZYe.exe
  C:\Windows\System\TRJoZYe.exe
  2⤵
  PID:13648
- C:\Windows\System\CCeqeac.exe
  C:\Windows\System\CCeqeac.exe
  2⤵
  PID:13680
- C:\Windows\System\NYiNREo.exe
  C:\Windows\System\NYiNREo.exe
  2⤵
  PID:13704
- C:\Windows\System\BlrbvUh.exe
  C:\Windows\System\BlrbvUh.exe
  2⤵
  PID:13732
- C:\Windows\System\kZQsmQn.exe
  C:\Windows\System\kZQsmQn.exe
  2⤵
  PID:13752
- C:\Windows\System\AGqfRHS.exe
  C:\Windows\System\AGqfRHS.exe
  2⤵
  PID:13772
- C:\Windows\System\TtAvmyz.exe
  C:\Windows\System\TtAvmyz.exe
  2⤵
  PID:13796
- C:\Windows\System\ubvrgtW.exe
  C:\Windows\System\ubvrgtW.exe
  2⤵
  PID:13816
- C:\Windows\System\MicnsHM.exe
  C:\Windows\System\MicnsHM.exe
  2⤵
  PID:13844
- C:\Windows\System\OATNkww.exe
  C:\Windows\System\OATNkww.exe
  2⤵
  PID:13868
- C:\Windows\System\XQJoywG.exe
  C:\Windows\System\XQJoywG.exe
  2⤵
  PID:13892
- C:\Windows\System\gIWMrdY.exe
  C:\Windows\System\gIWMrdY.exe
  2⤵
  PID:13920
- C:\Windows\System\XgRPFqj.exe
  C:\Windows\System\XgRPFqj.exe
  2⤵
  PID:13968
- C:\Windows\System\nOMNATM.exe
  C:\Windows\System\nOMNATM.exe
  2⤵
  PID:13988
- C:\Windows\System\yxOvvaS.exe
  C:\Windows\System\yxOvvaS.exe
  2⤵
  PID:14012
- C:\Windows\System\FxUNgLp.exe
  C:\Windows\System\FxUNgLp.exe
  2⤵
  PID:14040
- C:\Windows\System\dNyCpaX.exe
  C:\Windows\System\dNyCpaX.exe
  2⤵
  PID:14056
- C:\Windows\System\vBabwBz.exe
  C:\Windows\System\vBabwBz.exe
  2⤵
  PID:14088
- C:\Windows\System\XNnrtxh.exe
  C:\Windows\System\XNnrtxh.exe
  2⤵
  PID:14116
- C:\Windows\System\EQvsknz.exe
  C:\Windows\System\EQvsknz.exe
  2⤵
  PID:14136
- C:\Windows\System\dytdMZH.exe
  C:\Windows\System\dytdMZH.exe
  2⤵
  PID:14156
- C:\Windows\System\aVgUDVh.exe
  C:\Windows\System\aVgUDVh.exe
  2⤵
  PID:14196
- C:\Windows\System\wNtecgk.exe
  C:\Windows\System\wNtecgk.exe
  2⤵
  PID:14256
- C:\Windows\System\celZcTf.exe
  C:\Windows\System\celZcTf.exe
  2⤵
  PID:14280
- C:\Windows\System\KStwQMn.exe
  C:\Windows\System\KStwQMn.exe
  2⤵
  PID:14308
- C:\Windows\System\CwvoLft.exe
  C:\Windows\System\CwvoLft.exe
  2⤵
  PID:14328
- C:\Windows\System\iiSoohs.exe
  C:\Windows\System\iiSoohs.exe
  2⤵
  PID:13332
- C:\Windows\System\QiGRZZB.exe
  C:\Windows\System\QiGRZZB.exe
  2⤵
  PID:13392
- C:\Windows\System\MLAHROz.exe
  C:\Windows\System\MLAHROz.exe
  2⤵
  PID:13396
- C:\Windows\System\BXmGqsY.exe
  C:\Windows\System\BXmGqsY.exe
  2⤵
  PID:13436
- C:\Windows\System\NtOsJHT.exe
  C:\Windows\System\NtOsJHT.exe
  2⤵
  PID:13604
- C:\Windows\System\qWLtQty.exe
  C:\Windows\System\qWLtQty.exe
  2⤵
  PID:13644
- C:\Windows\System\HKZiqDT.exe
  C:\Windows\System\HKZiqDT.exe
  2⤵
  PID:13668
- C:\Windows\System\XHoUNLi.exe
  C:\Windows\System\XHoUNLi.exe
  2⤵
  PID:13724
- C:\Windows\System\ZdjpfMP.exe
  C:\Windows\System\ZdjpfMP.exe
  2⤵
  PID:13768
- C:\Windows\System\VNcsauo.exe
  C:\Windows\System\VNcsauo.exe
  2⤵
  PID:13840
- C:\Windows\System\DInAcJo.exe
  C:\Windows\System\DInAcJo.exe
  2⤵
  PID:13880
- C:\Windows\System\WSNcsGc.exe
  C:\Windows\System\WSNcsGc.exe
  2⤵
  PID:14000
- C:\Windows\System\ocJczQr.exe
  C:\Windows\System\ocJczQr.exe
  2⤵
  PID:14144
- C:\Windows\System\mJdbbQx.exe
  C:\Windows\System\mJdbbQx.exe
  2⤵
  PID:14112
- C:\Windows\System\TRZlSBh.exe
  C:\Windows\System\TRZlSBh.exe
  2⤵
  PID:14276
- C:\Windows\System\qBSoONR.exe
  C:\Windows\System\qBSoONR.exe
  2⤵
  PID:12508
- C:\Windows\System\jHzZrmL.exe
  C:\Windows\System\jHzZrmL.exe
  2⤵
  PID:13432
- C:\Windows\System\QUlWgCC.exe
  C:\Windows\System\QUlWgCC.exe
  2⤵
  PID:13480
- C:\Windows\System\LWbBoXc.exe
  C:\Windows\System\LWbBoXc.exe
  2⤵
  PID:13696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BSIAqGl.exe

Path C:\Windows\System\BSIAqGl.exe
Size 1.8MB
SHA256 548a2e1322845bd58927cb6cc53756094404ce668d5191bc9e719654143e1a97
MD5 1421321f53c242124c0ce8341c362620
SHA1 9543c0c8f9395231d539cb731d1fb7ed1526d0a7
SHA512 960cd29a00b5021407e6b5da03bdf980cdbc624dc90faa0554bc72519a14b38f938772d17217cab5c58e61356d45d1b62e8f5d45bbffceb1399f8877a7e6ba70
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAj:RWWBibay
MD5 SHA1 SHA512 SSDEEP

Submit Download

CAFsJku.exe

Path C:\Windows\System\CAFsJku.exe
Size 1.8MB
SHA256 f808e6a9e42d2f1057ab8ae81584cfb1848063ce554720becba2ae0172ddef37
MD5 f2c62d6196f33f39a8a6a118d0c07779
SHA1 67b75fc7eea97c32e72f3e51698986da376ffaf0
SHA512 53339c7b3bd2b11a1075fc53f9fa75309b759628b4afba6deef16092f9fe80443bd0f639cbf36f227fa70fc4251776e81e350a9b589a7e665f8f0183eb8458e4
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAK:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

HTYSECQ.exe

Path C:\Windows\System\HTYSECQ.exe
Size 1.8MB
SHA256 87659c942b4e1c11593c1c0dcd3346db1a1b35e21c62f7b63021a3f89f071137
MD5 48bdd07ca5249a07aa931a42bdd89aa7
SHA1 637a8f514ab8b596132172c405b6f21715718df7
SHA512 4ffb9a0baca9a8a087aa876e25786b6acb61d9e0b080d0517ef34dfce262604603c75b6331c6145d4cb3ae927298548ec60027edc6d01f311ab2bf6292194bbe
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAE:RWWBibab
MD5 SHA1 SHA512 SSDEEP

Submit Download

HgKhtai.exe

Path C:\Windows\System\HgKhtai.exe
Size 1.8MB
SHA256 1d291c333a0408718c9234ccf28d7fbe4270135aec6dd4ab96fbdf12cd508948
MD5 7452c1fe8289ae1cf7b6cd509bbd1935
SHA1 8fd606f212222fe6bf2bffd72ac10a95351e48cc
SHA512 2d60352251533d2f0073346f3b77538ab521aeac9b025c00ce845abe20486b7361f3a470eaca469279af5cde5dacc65fd8c0d202c93c2271c042dbcdbe9197da
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBA0:RWWBibaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

JyKJezA.exe

Path C:\Windows\System\JyKJezA.exe
Size 1.8MB
SHA256 96b6258f90a38ed9acd54a9c329fe1f30bdd91c20d3560d370242ccd3d63b44b
MD5 76d2b4c3d03a8409a0cbf15cc42626a9
SHA1 6638c27f41259b04a2210c5f9e928c0d450d6c53
SHA512 69114ab87bcdff39cfefb2bed68eae5363632ad39f06f564e224eb901a11858ebe234ee26142934297815a9b239f9c8b9c5c0bb34461a412b23f8413127dc5ec
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBA4:RWWBibab
MD5 SHA1 SHA512 SSDEEP

Submit Download

KTnGDPN.exe

Path C:\Windows\System\KTnGDPN.exe
Size 1.8MB
SHA256 ab737565af2ed19e8ff91d268c40e460e9e38cef9e71a28d09c4c37f51202185
MD5 4da0c34241cdd8f44866082ee69fd00d
SHA1 3b0770186fa3676507b98214dec90fadc2cdfe65
SHA512 893f579ad754c870a6505f64a807b7a280794e5702ab957daba53f72a1b56d2c4a250a916afdad546432b8d90231f3655a3b7342d25bc1e9d518b859af9676bb
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBA7:RWWBibaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

KgYPayT.exe

Path C:\Windows\System\KgYPayT.exe
Size 1.8MB
SHA256 f8540a953fe4a3904442c46fcfdd002eb7b9dead6ce87cfc322f1aa6affcc8c2
MD5 e6b1d2a16c5ded90c3ffecc3199793f1
SHA1 fb716aeda1219a3cc47248a385fc54ab8953d189
SHA512 841faab14dea0fb965448e14487958173b8b35c0df704a5c485be3cc899dc3f348fa8b1a6ccd6f740192d7a084244fb2becd08d83a10dac7226fe31acc35ed8f
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAR:RWWBibaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

MXihVhd.exe

Path C:\Windows\System\MXihVhd.exe
Size 1.8MB
SHA256 94a205ba85f90ccaa32df160b42d016ced498bf0bf7970f30085a3b67cbe0b19
MD5 982327c6f1d5b26e55e6a46adf100984
SHA1 81875780f43c3f8c63f28a96981d55026cdd56f6
SHA512 33297b8edb53404f2bda9995aff068bf644a04852390dfbccb1ef8050280d0ba4f09d7e525998803ad94ed6a0ec9a2aba2166aa5bdb95edc1aa6cd36b57bb57a
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAf:RWWBibaa
MD5 SHA1 SHA512 SSDEEP

Submit Download

NEPGhLu.exe

Path C:\Windows\System\NEPGhLu.exe
Size 1.8MB
SHA256 01039c2d6349e009c1add792de9fd4684c526c8a0b0107c739a311507a096b95
MD5 dc7c037f561ca6a79b463afc0c8a1aed
SHA1 21c80ab7ccbe267eef92c37146ebb1807f5f3869
SHA512 f7732047a4708eb6eed3d05fc2af0852c0b8c3abd777df83a1cfff19e4223bba9268b2964a324cd2851d0874664bffdbc45f0319cc566b7c0aed74ef539dd7a9
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAE:RWWBibaR
MD5 SHA1 SHA512 SSDEEP

Submit Download

NeLvBCp.exe

Path C:\Windows\System\NeLvBCp.exe
Size 1.8MB
SHA256 fbf2459558bf6e355d78a97b997fbfc936d531ccca2d7085ad99f1209961d117
MD5 53c85dd642be70b4e03ae770f439518a
SHA1 e3339112fd12521ad87f11c1b01320673d6f6e7d
SHA512 4c3ff074c7ce49cbad280e6cef31a231701c5f3a2aa9d61d659e9943eb1fba1b3f90ac6f7e712e766ff22cca2c27f55b4c98523a0a7d1eaa3b8db05d7f7548eb
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBA6:RWWBibaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

PFzEciI.exe

Path C:\Windows\System\PFzEciI.exe
Size 1.8MB
SHA256 c2949d8431a8936d89a1a9441ccbc5892a199ce077e888ff00843c3ffa0e7242
MD5 5b681d4ba979e7130fa5b6d744a24911
SHA1 92026352b5fe528591b2b98f3f6070515a17d318
SHA512 f397ff1995c1828a69587d18fb5072be2d68f35677e4a189cd745040f55a0510a04536789c0c4813f2df98e66fb32eff5512cf2526f3c9039ecc6b9553a39574
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAG:RWWBibaT
MD5 SHA1 SHA512 SSDEEP

Submit Download

PPVDLmm.exe

Path C:\Windows\System\PPVDLmm.exe
Size 1.8MB
SHA256 1b30b5f16f5a25a5ea521892ed3d1b995754f001b3b18afaa6a80c0cc64fe80a
MD5 82f33c30b43ec5d9fb5951d831186471
SHA1 b1098d12a3109950e3391cb7ee2573dfb406c918
SHA512 5e9be8af3cc4250a933bc3bda58390de4b7ac0ca70f800c6e6c980867e24f6b0803568d48157435b266966f5af5d4f3048e00be0e352dc148df18f86fc6fdc6c
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAh:RWWBibae
MD5 SHA1 SHA512 SSDEEP

Submit Download

QkkYZpA.exe

Path C:\Windows\System\QkkYZpA.exe
Size 1.8MB
SHA256 9bc7c8c2e5fadb65db2049eb825ed135aa29b88b270f20eb5821e737b43664c8
MD5 8973d603c0e94861a666a5c94ef96eb6
SHA1 9888a077ac2257d5d7d8c6858b7a2d9b2372ecfe
SHA512 94417e02e5beebbaf48d05d0e226513f7f09df280c37fe0eff04f8066be7c63bb07a861a7e0c98877aa5f962e61781eaee15bf9accb4abffed36f3089b81c32c
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAJ:RWWBibaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

SxMPaGF.exe

Path C:\Windows\System\SxMPaGF.exe
Size 1.8MB
SHA256 f9c5ecd519c948a3002bb471e39dfccf8f357194d747b4788cb3f85eeceaed71
MD5 a41611b686f8c985ef7ef644b9e11c1d
SHA1 7b6e9e386f472a8a5a30b40bb73175797d3d62bf
SHA512 35b2ebe5794b97aca19ea85a030a166edd818e6427aed8e99ed9c061854357314efa31386d6fe44a4ce05ce8d13cdeed8a0c1d9f910a59c9739fb911d7c518f1
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAk:RWWBibaB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZDYzCId.exe

Path C:\Windows\System\ZDYzCId.exe
Size 1.8MB
SHA256 e9b93209187ee9723ccd49cacb063b36586bf21278117f4958f6b8c71e4723d1
MD5 22fa3475195056d8c42fcd7f812e6e2a
SHA1 0cdd5eab32d5eb5a07ed42b67e35c70ae76987b4
SHA512 f54b9a0405ec0f5ff81c30c6efabae294a76a3a4e1aeddc564b920e3737dc2f6ea604d47b8ce2b5c447513f8038b15701a09d2f5f049b95fc9ba28ffed9d8dc5
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAw:RWWBiba1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZmhQGtD.exe

Path C:\Windows\System\ZmhQGtD.exe
Size 1.8MB
SHA256 9e4aaa9c87204f66f428f49b3248d95b803503a64129a14f5ac0c2eec67ecc98
MD5 1b1a4833d44337a3d931f32aa0a9972f
SHA1 f09dfd8658ede4d1796484f92f384a37d0ed7e11
SHA512 6d0b703282ba32b7f6dfa1e97c740d9b59294c2ef9619678bd925fd75c06243bb8eac19f10ee7a3d352745c0b7a6bc28caf34fb16637f18de51d33385f4951da
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAx:RWWBibaY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZvLgxJe.exe

Path C:\Windows\System\ZvLgxJe.exe
Size 1.8MB
SHA256 645b936a8029f8cf7feaca9c0c0362636ea7af911539963272ce6330e827fe82
MD5 9e4661afad0bcfd91eaa33fb79b97503
SHA1 0530fc2f63da5f5df5d9e820b11f0f663a17ced1
SHA512 9816699913cdceba24e4a167ac46af81d0f731fccec6214c10860a907408776fb071b3ef55b2d392f958fad8a56fb452718d9ce5ec771bede794586df9605ab9
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAK+:RWWBibaq
MD5 SHA1 SHA512 SSDEEP

Submit Download

axWIQND.exe

Path C:\Windows\System\axWIQND.exe
Size 1.8MB
SHA256 34f9cb2ed0d50f8f5a533005d2096420474823fae5eae8a9d47fde16a2f51ab8
MD5 fcb9ddbcfac93064fc6aa117193e088d
SHA1 14a9e1d64db26e27ec75abe75eec03c7a33a6c99
SHA512 ae304e08c7ae93ddfce521f3513b0853dd924bd14cab111348a1d4737d69c1fed25b4879053caad538dc6b8dbc0f82bb0262b17d4ff72b0173b63aca2be9f5ff
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAX:RWWBibag
MD5 SHA1 SHA512 SSDEEP

Submit Download

bCgMXXc.exe

Path C:\Windows\System\bCgMXXc.exe
Size 1.8MB
SHA256 5f2a887b7746af31dde9803a120124fa0e75f71f5f3f8cea232628dcb1ada81f
MD5 810c30bc2e346a59a8c397c7f61b4323
SHA1 12a5823207d22189023366d6124e5b8f162849f8
SHA512 26e170cd557f03eba5b88ed33a6228767bf4b28c38c767b94e7f43b77bdaefd92079859f495b6dc403692e6ce5b092ce74e617335cbb7ed3e7bcb97485e8b39b
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAd:RWWBibam
MD5 SHA1 SHA512 SSDEEP

Submit Download

ceWiyEp.exe

Path C:\Windows\System\ceWiyEp.exe
Size 1.8MB
SHA256 65112ca310c0420dca576e63618120947a26aa7c8de7d853f7f7176cf6c3b54b
MD5 fcbb0340e567b057047979b080ae1915
SHA1 42cd14fdbca7d0da71a19299c35e04ce96b07cdf
SHA512 78e79c9a21a27513737424925a7371657c93060ffcf3449d49a2f7cc80d73220a3f3040c14ed8755ca0254227f7ebe761e1c9162b8154ddc54c805ee2a73a165
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAh:RWWBibai
MD5 SHA1 SHA512 SSDEEP

Submit Download

eSFUVjq.exe

Path C:\Windows\System\eSFUVjq.exe
Size 1.8MB
SHA256 65709249a9c8708a478aeab4d148f6df351004bddbd03b97090a2e11c8c984dd
MD5 a21b7c80a903c8d0e285d3baadee8bfb
SHA1 602b0059ebec6202ad1995787277909ecd0de2cc
SHA512 0d4f3effe4e528cfdda80b25ad0e05e9c84afbdd409cc7f81dda0be0f396695469b19998f9ad30ea18c658210513de9301365aefdf5ec98f0660d195dcee3f64
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAB:RWWBibae
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbygHsw.exe

Path C:\Windows\System\fbygHsw.exe
Size 1.8MB
SHA256 5cd21964cfadc9685a721252f4775ba9d3e562a43f25ea298749e22a2fbad109
MD5 efce6ac109ee4bdedc88c415a04a71e4
SHA1 eda85fc120679a6a709af1dfd8efb837c6b18beb
SHA512 3fd6f5dac6b73085956459fb2a65dd74e7dc497c8bd325fce58295848edc8c99b04194779238293c164858dff9dc5f294b49f0c6c3ce88f677dfa0e6f8a96703
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAk:RWWBibaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

fcahTwg.exe

Path C:\Windows\System\fcahTwg.exe
Size 1.8MB
SHA256 220f25fa0e19dfa9cd096d76d0309748ccd9a6be6c3f0254cc826cec7d02922b
MD5 f2fae99f6fa1a80a1ca0172538fa6525
SHA1 698c88c71ae1eb67cb04bb9bf861b37d3180dc6a
SHA512 7e1571242b55f3f2e8b911394b51d043c280616f6b0ea481c8acd3c96c491f02715cbf7552ad833c67d069ffba930f5acf294a9e56a4cfb7ba4cb42f541597cf
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAK:RWWBibaV
MD5 SHA1 SHA512 SSDEEP

Submit Download

hCONWyA.exe

Path C:\Windows\System\hCONWyA.exe
Size 1.8MB
SHA256 345076fd9f695648fc37afb1b9d503f1fe619cbe4585001d06b09c7ab748a091
MD5 aba37a2bbc8b72456d32b393dc8f9c50
SHA1 d3418c5193ccb0ec232ee35d5f4b216cf7408a7e
SHA512 2bb108732ad28e582620215a8e95638b9fc9acd585f62a45651c78dc60e38bb3a430b4e7c6cc16d904b88da0268a87038dae6583138a9e84d5a31ad3f7d24e9a
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAt:RWWBiba2
MD5 SHA1 SHA512 SSDEEP

Submit Download

hdyBIet.exe

Path C:\Windows\System\hdyBIet.exe
Size 1.8MB
SHA256 7bd8091b3d0c9a7231a2ed592077d91ea6dee032c61d06f3cfb7705827b7170c
MD5 f4f885cf4752bd362268eee6080da13a
SHA1 19f2ee7c5756f5325bb51cedf1a4b4e7628579e0
SHA512 f447025adc1fd67cd4d13fd1f636507caf6535905af98b3189dfa2368a80143e847da02b93ad22fb98ee29798f357c858573887a4b62ef984d9392d359bde2bc
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAf:RWWBiba4
MD5 SHA1 SHA512 SSDEEP

Submit Download

jFGtvMD.exe

Path C:\Windows\System\jFGtvMD.exe
Size 1.8MB
SHA256 207f3596d7d9f39b307c55f606b7589787d55feac61b12ab9df655f048664f63
MD5 c3dc5d6e8be6cd018c63afa3553a2195
SHA1 df7718c2dba759668fbb6da5aeebedd7a5ae8e26
SHA512 0bb25ea467cb1b2e8fa71a9cfd054d3c9e9cf6303fe39292c2c62389138b833ff99e232cecb01bc002c83be9e95f5033932d9126e26828cabe3865ca19507b43
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAT:RWWBiba6
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvNYDxO.exe

Path C:\Windows\System\nvNYDxO.exe
Size 1.8MB
SHA256 9fa4200d49b65d53dbf4ea2f8ec138555ee891ff47e8fac9091d061d7441ef6f
MD5 87f9c9d23c7e73d4b30e6d29ca3a2fa2
SHA1 ff4d306617b1411663a7238e5fdfb107ce7b81f1
SHA512 24a4b1bfcc6201e4a4e024fe7a06366d887695aeff086e1892f3c8fa4215a2bfc3a9d05a09808ada6f023e65a10ce11f49a250b39e543b675b2b0b8ffc96a17d
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAz:RWWBibag
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxVueVY.exe

Path C:\Windows\System\oxVueVY.exe
Size 1.8MB
SHA256 da973afdd948286bea6ac7d00e2fd610e9aa2fb66d536baf39960b535de0f5de
MD5 6d5b711d308c71c589e4290fa77724d9
SHA1 715254b97f2ba573b1f952f7df2cc2d22605bc36
SHA512 f579a55a9998c4d8685e5d0befbebe84c444cf0fa40a55e45b4c37f89611c6f43a284f6e9e15e45bdefb1d1562906e8e3957dd3d9e0bb4b74fa825b386e8052f
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAT:RWWBiba+
MD5 SHA1 SHA512 SSDEEP

Submit Download

rvCLyxh.exe

Path C:\Windows\System\rvCLyxh.exe
Size 1.8MB
SHA256 eb4a4c4d9409791f1c42a00b5596f2e73d0557cd922f5387d4c418f5061fd8b0
MD5 add08c81a0a2c248df1d22a87caf6fdf
SHA1 333e6d6893a557331453044437647ab830b8765f
SHA512 b686011393aee00d3c7c02cf236884321b7c60c414d605ce2eb7d2b79eb39c17635b07c33a2200e3760a804a4af416c2a8e5dae46c8f916c5a0e43a9e2a0666f
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAU:RWWBibat
MD5 SHA1 SHA512 SSDEEP

Submit Download

tRITljC.exe

Path C:\Windows\System\tRITljC.exe
Size 1.8MB
SHA256 444d0a788372946890bebc4619df69edaf8cb3d48e4286d0ff94716675f9a8fd
MD5 a2567f94e7dde900c5551422e0a41dc0
SHA1 f490a34139dc5c37107c1a8a67da9d370646d314
SHA512 78ccb1b18028e94180fdf8a32849a70ff63a7f8bf6654cad36b29b6ab94cc2caf071828cce948bfecccbba9be8396f43689f3edcce80d5c09719fbcd1c67e1c9
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAn:RWWBibaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

tezTfQp.exe

Path C:\Windows\System\tezTfQp.exe
Size 1.8MB
SHA256 928b37290c3f3be206817c6b2076166a393384088fed8e3e565cabc5947f592c
MD5 62e81db2f6ccb28d04869603953e1abd
SHA1 5f604950b8194cc63bee2ec7752ec76d32535f48
SHA512 c55f2fdfbe94c5e746ca74c087b70e851280c6d646a50331efdfb72981ba03bcf39371d16080001b0a8842c8098d374e1a0b9008410353a2670ba555e80d8f26
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAX:RWWBibaC
MD5 SHA1 SHA512 SSDEEP

Submit Download

uHJycYa.exe

Path C:\Windows\System\uHJycYa.exe
Size 1.8MB
SHA256 2d240fb59be0adb932a0c4982bc5369165f124c8b9eda6164b424a9e3afcf08d
MD5 30a44e9c432abf56369b99acdcd7f8ca
SHA1 e02d99408c769f52500803fb436d37bbd27c72d0
SHA512 a3e469d814253e73766f73ba9090c57079a040858b5887f9f92c9f142e307e02a9a98ff42b096a5a028cf596b5366c3a9de9457ad58edf41c616844457d148bb
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBA3:RWWBibae
MD5 SHA1 SHA512 SSDEEP

Submit Download

zxCWMGB.exe

Path C:\Windows\System\zxCWMGB.exe
Size 1.8MB
SHA256 f10786105ed1ddd704e9d57803a284621bbb2ed082536ee44325addabfd64db1
MD5 3ead88eb426e5b2603159d6ca7eb4329
SHA1 38c495b545aefbde0b7ddce9148183f13abeee5e
SHA512 8f04a587633a3a9b45d679d631c7d12ddb1cd37c6f7ee802c4512eeda0f9502e91a0db3dd59cd9ec58ab11f45da6411af2160cb34e6ca8136b716595d192958d
SSDEEP 49152:ROdWCCi7/rahUUvXjVTXptRmKWXkO1t7XSXRBAQ:RWWBiba9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/392-2210-0x00007FF69B8A0000-0x00007FF69BBF1000-memory.dmp

Download

memory/392-63-0x00007FF69B8A0000-0x00007FF69BBF1000-memory.dmp

Download

memory/392-2277-0x00007FF69B8A0000-0x00007FF69BBF1000-memory.dmp

Download

memory/440-2265-0x00007FF654430000-0x00007FF654781000-memory.dmp

Download

memory/440-12-0x00007FF654430000-0x00007FF654781000-memory.dmp

Download

memory/440-2208-0x00007FF654430000-0x00007FF654781000-memory.dmp

Download

memory/1180-67-0x00007FF7C3C40000-0x00007FF7C3F91000-memory.dmp

Download

memory/1180-2283-0x00007FF7C3C40000-0x00007FF7C3F91000-memory.dmp

Download

memory/1224-439-0x00007FF6D9D30000-0x00007FF6DA081000-memory.dmp

Download

memory/1224-2290-0x00007FF6D9D30000-0x00007FF6DA081000-memory.dmp

Download

memory/1608-437-0x00007FF7B2D80000-0x00007FF7B30D1000-memory.dmp

Download

memory/1608-2298-0x00007FF7B2D80000-0x00007FF7B30D1000-memory.dmp

Download

memory/1696-2317-0x00007FF69C200000-0x00007FF69C551000-memory.dmp

Download

memory/1696-448-0x00007FF69C200000-0x00007FF69C551000-memory.dmp

Download

memory/1796-447-0x00007FF7B5B30000-0x00007FF7B5E81000-memory.dmp

Download

memory/1796-2313-0x00007FF7B5B30000-0x00007FF7B5E81000-memory.dmp

Download

memory/1864-2308-0x00007FF7E7770000-0x00007FF7E7AC1000-memory.dmp

Download

memory/1864-443-0x00007FF7E7770000-0x00007FF7E7AC1000-memory.dmp

Download

memory/1940-455-0x00007FF7FDEF0000-0x00007FF7FE241000-memory.dmp

Download

memory/1940-2320-0x00007FF7FDEF0000-0x00007FF7FE241000-memory.dmp

Download

memory/2008-1-0x000002352B9B0000-0x000002352B9C0000-memory.dmp

Download

memory/2008-0-0x00007FF603020000-0x00007FF603371000-memory.dmp

Download

memory/2028-2269-0x00007FF60B1F0000-0x00007FF60B541000-memory.dmp

Download

memory/2028-24-0x00007FF60B1F0000-0x00007FF60B541000-memory.dmp

Download

memory/2088-2294-0x00007FF77BF80000-0x00007FF77C2D1000-memory.dmp

Download

memory/2088-444-0x00007FF77BF80000-0x00007FF77C2D1000-memory.dmp

Download

memory/2128-436-0x00007FF6F1DA0000-0x00007FF6F20F1000-memory.dmp

Download

memory/2128-2292-0x00007FF6F1DA0000-0x00007FF6F20F1000-memory.dmp

Download

memory/2136-2322-0x00007FF7D7320000-0x00007FF7D7671000-memory.dmp

Download

memory/2136-449-0x00007FF7D7320000-0x00007FF7D7671000-memory.dmp

Download

memory/2176-440-0x00007FF6FD980000-0x00007FF6FDCD1000-memory.dmp

Download

memory/2176-2287-0x00007FF6FD980000-0x00007FF6FDCD1000-memory.dmp

Download

memory/2308-2271-0x00007FF69AB40000-0x00007FF69AE91000-memory.dmp

Download

memory/2308-35-0x00007FF69AB40000-0x00007FF69AE91000-memory.dmp

Download

memory/2556-2295-0x00007FF75E510000-0x00007FF75E861000-memory.dmp

Download

memory/2556-442-0x00007FF75E510000-0x00007FF75E861000-memory.dmp

Download

memory/2924-2286-0x00007FF77F320000-0x00007FF77F671000-memory.dmp

Download

memory/2924-441-0x00007FF77F320000-0x00007FF77F671000-memory.dmp

Download

memory/3048-2304-0x00007FF7D5C90000-0x00007FF7D5FE1000-memory.dmp

Download

memory/3048-84-0x00007FF7D5C90000-0x00007FF7D5FE1000-memory.dmp

Download

memory/3124-450-0x00007FF705400000-0x00007FF705751000-memory.dmp

Download

memory/3124-2315-0x00007FF705400000-0x00007FF705751000-memory.dmp

Download

memory/3196-2273-0x00007FF661210000-0x00007FF661561000-memory.dmp

Download

memory/3196-41-0x00007FF661210000-0x00007FF661561000-memory.dmp

Download

memory/3196-2209-0x00007FF661210000-0x00007FF661561000-memory.dmp

Download

memory/3556-66-0x00007FF7E2BD0000-0x00007FF7E2F21000-memory.dmp

Download

memory/3556-2280-0x00007FF7E2BD0000-0x00007FF7E2F21000-memory.dmp

Download

memory/3656-72-0x00007FF7CB560000-0x00007FF7CB8B1000-memory.dmp

Download

memory/3656-2235-0x00007FF7CB560000-0x00007FF7CB8B1000-memory.dmp

Download

memory/3656-2302-0x00007FF7CB560000-0x00007FF7CB8B1000-memory.dmp

Download

memory/4360-71-0x00007FF798E50000-0x00007FF7991A1000-memory.dmp

Download

memory/4360-2211-0x00007FF798E50000-0x00007FF7991A1000-memory.dmp

Download

memory/4360-2306-0x00007FF798E50000-0x00007FF7991A1000-memory.dmp

Download

memory/4484-83-0x00007FF6CF2A0000-0x00007FF6CF5F1000-memory.dmp

Download

memory/4484-2281-0x00007FF6CF2A0000-0x00007FF6CF5F1000-memory.dmp

Download

memory/4584-2275-0x00007FF69E740000-0x00007FF69EA91000-memory.dmp

Download

memory/4584-75-0x00007FF69E740000-0x00007FF69EA91000-memory.dmp

Download

memory/4732-446-0x00007FF773350000-0x00007FF7736A1000-memory.dmp

Download

memory/4732-2311-0x00007FF773350000-0x00007FF7736A1000-memory.dmp

Download

memory/4792-445-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp

Download

memory/4792-2309-0x00007FF7799B0000-0x00007FF779D01000-memory.dmp

Download

memory/4932-2267-0x00007FF64C0E0000-0x00007FF64C431000-memory.dmp

Download

memory/4932-23-0x00007FF64C0E0000-0x00007FF64C431000-memory.dmp

Download

memory/5052-2299-0x00007FF6E93B0000-0x00007FF6E9701000-memory.dmp

Download

memory/5052-438-0x00007FF6E93B0000-0x00007FF6E9701000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads