xmrig | 1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
Size

1019KB
MD5

a978b5859473eebdedd987768fa2369d
SHA1

445d522f460ad2d0908c2ccce0e0e36806678c01
SHA256

1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8
SHA512

83ff34f50f4916980e6190e1e2de5a9edad725701be94b31fe2be2d39bc5104097a207e3add0eab7715e20c5046df0a995417eb010f40829c08d1059099c9f1c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrcE:GezaTF8FcNkNdfE0pZ9ozttwIRQv

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023baa-3.dat	xmrig
behavioral2/files/0x0007000000023ca2-16.dat	xmrig
behavioral2/files/0x0007000000023ca1-17.dat	xmrig
behavioral2/files/0x0008000000023c9d-9.dat	xmrig
behavioral2/files/0x0007000000023ca3-23.dat	xmrig
behavioral2/files/0x0007000000023ca5-28.dat	xmrig
behavioral2/files/0x0007000000023cb3-104.dat	xmrig
behavioral2/files/0x0007000000023cba-127.dat	xmrig
behavioral2/files/0x0007000000023cb8-125.dat	xmrig
behavioral2/files/0x0007000000023caf-121.dat	xmrig
behavioral2/files/0x0007000000023cc7-191.dat	xmrig
behavioral2/files/0x0007000000023cc6-190.dat	xmrig
behavioral2/files/0x0007000000023cb7-188.dat	xmrig
behavioral2/files/0x0007000000023cc5-187.dat	xmrig
behavioral2/files/0x0007000000023cc4-183.dat	xmrig
behavioral2/files/0x0007000000023cb5-180.dat	xmrig
behavioral2/files/0x0007000000023cc3-174.dat	xmrig
behavioral2/files/0x0007000000023cb0-169.dat	xmrig
behavioral2/files/0x0007000000023cc2-154.dat	xmrig
behavioral2/files/0x0007000000023cc1-147.dat	xmrig
behavioral2/files/0x0007000000023cb2-142.dat	xmrig
behavioral2/files/0x0007000000023cb6-139.dat	xmrig
behavioral2/files/0x0007000000023cb4-178.dat	xmrig
behavioral2/files/0x0007000000023cbe-135.dat	xmrig
behavioral2/files/0x0007000000023cbd-134.dat	xmrig
behavioral2/files/0x0007000000023cb1-132.dat	xmrig
behavioral2/files/0x0007000000023cbc-131.dat	xmrig
behavioral2/files/0x0007000000023cbb-130.dat	xmrig
behavioral2/files/0x0007000000023cc0-140.dat	xmrig
behavioral2/files/0x0007000000023cbf-138.dat	xmrig
behavioral2/files/0x0007000000023cb9-126.dat	xmrig
behavioral2/files/0x0007000000023cab-92.dat	xmrig
behavioral2/files/0x0007000000023caa-79.dat	xmrig
behavioral2/files/0x0007000000023cac-96.dat	xmrig
behavioral2/files/0x0007000000023ca8-75.dat	xmrig
behavioral2/files/0x0007000000023cae-70.dat	xmrig
behavioral2/files/0x0007000000023cad-67.dat	xmrig
behavioral2/files/0x0007000000023ca9-60.dat	xmrig
behavioral2/files/0x0007000000023ca7-48.dat	xmrig
behavioral2/files/0x0007000000023ca6-41.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1824	MbzbJYL.exe
724	zSskbjQ.exe
2648	GYWHVvW.exe
1268	NmzNokU.exe
2268	XeZvrHs.exe
3468	HgQTDBn.exe
2004	zKMhMkn.exe
392	PcZUKgA.exe
4584	DklAbbi.exe
3152	jdZkmzF.exe
244	ZPhtgHP.exe
5036	IyvqHJZ.exe
2620	gadGAAn.exe
4112	mQUAkGe.exe
636	UMTPCID.exe
5056	cJEYdKm.exe
3596	gDeXJsr.exe
3008	MkqzCbD.exe
2064	NJnFBcS.exe
1900	newbKND.exe
956	iZfOLOH.exe
764	JDDdkOw.exe
5116	miMOJbh.exe
4896	SSdGSZW.exe
808	jBJNZNO.exe
3208	PQvKjDX.exe
1400	VYnatRX.exe
4916	Szjjhos.exe
4608	hFNnoKL.exe
2316	VbczLiq.exe
4456	oXHzLet.exe
2116	OLGKpoU.exe
4512	XJRPwZj.exe
3128	prLHqlv.exe
2856	oOuPzuK.exe
1968	afyFRRq.exe
2624	rulbSws.exe
1072	MAZMYFM.exe
4468	XqawuQw.exe
4156	NMBjhne.exe
1452	hJqFpFM.exe
872	plkqCrF.exe
4296	RzNhHrb.exe
224	GufMLwW.exe
2080	fweZsdk.exe
4764	vvpXTpd.exe
1676	hVKIKqL.exe
4868	VMlgmwQ.exe
3632	rNtyRJN.exe
5096	lCuwCpT.exe
4400	KgVuqmy.exe
3304	ZUtMPnq.exe
5064	LTvYtLP.exe
2576	ULOGFIH.exe
2024	RRlUgqu.exe
3952	jYGIKtM.exe
4448	qjYxBPh.exe
3084	FySnFPY.exe
1912	jAJOsRy.exe
2336	JHKNNAT.exe
3176	hblfbRP.exe
4308	qNChUnn.exe
3036	fJRcaBU.exe
4864	NawaHko.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VxFWYSF.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\uqBSXOZ.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\JIUhRRT.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\abWvnQB.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\VqsewvS.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\YVFjhfJ.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\reXMBUs.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\eFQglnc.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\CuFamQF.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\iaXredc.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\YRUzVQo.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\pSeAYEZ.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\yFhWFGS.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\VxPPVrT.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\wuNJqFS.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\kHRCgig.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\duPzMpW.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\GNwfmAP.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\IeCsxVW.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\dnHfwSB.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\dGZXZAF.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\awxCBwB.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\qOCNKke.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\VyjldJy.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\ZqPxERK.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\dbSVwxw.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\CgKoRWJ.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\srNuEuG.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\dcSeReu.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\HPWpSPx.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\MwDPQex.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\yEzqymw.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\mvKZxZi.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\zwOsyJR.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\WJhdxfx.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\chuWrAc.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\ypcSXJM.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\hyddann.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\JNrHEcN.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\ZNaJCeJ.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\sxPpoXa.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\jqjvfDc.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\HcTcNan.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\NRekCOJ.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\HkIdGqv.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\ymNppKL.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\jULhRTK.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\xkxyhTT.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\cTRkxHR.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\BqpqdZy.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\iQgfCTi.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\gnRkWbl.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\RxPylMx.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\jREjeVQ.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\wpHeMBq.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\djwILAK.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\XBQOFwo.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\LqKOsnr.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\npWTRCE.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\iGnfHXD.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\jgrYCJv.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\LJGQBIY.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\GMmmxBU.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
File created	C:\Windows\System\sjFlmGk.exe	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1824	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	84
PID 2896 wrote to memory of 1824	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	84
PID 2896 wrote to memory of 724	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	85
PID 2896 wrote to memory of 724	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	85
PID 2896 wrote to memory of 2648	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	86
PID 2896 wrote to memory of 2648	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	86
PID 2896 wrote to memory of 1268	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	87
PID 2896 wrote to memory of 1268	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	87
PID 2896 wrote to memory of 2268	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	88
PID 2896 wrote to memory of 2268	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	88
PID 2896 wrote to memory of 3468	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	89
PID 2896 wrote to memory of 3468	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	89
PID 2896 wrote to memory of 2004	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	90
PID 2896 wrote to memory of 2004	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	90
PID 2896 wrote to memory of 3152	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	91
PID 2896 wrote to memory of 3152	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	91
PID 2896 wrote to memory of 392	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	92
PID 2896 wrote to memory of 392	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	92
PID 2896 wrote to memory of 4584	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	93
PID 2896 wrote to memory of 4584	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	93
PID 2896 wrote to memory of 244	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	94
PID 2896 wrote to memory of 244	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	94
PID 2896 wrote to memory of 5036	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	95
PID 2896 wrote to memory of 5036	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	95
PID 2896 wrote to memory of 2620	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	96
PID 2896 wrote to memory of 2620	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	96
PID 2896 wrote to memory of 4112	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	97
PID 2896 wrote to memory of 4112	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	97
PID 2896 wrote to memory of 636	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	98
PID 2896 wrote to memory of 636	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	98
PID 2896 wrote to memory of 5056	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	99
PID 2896 wrote to memory of 5056	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	99
PID 2896 wrote to memory of 1900	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	100
PID 2896 wrote to memory of 1900	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	100
PID 2896 wrote to memory of 3596	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	101
PID 2896 wrote to memory of 3596	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	101
PID 2896 wrote to memory of 3008	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	102
PID 2896 wrote to memory of 3008	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	102
PID 2896 wrote to memory of 2064	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	103
PID 2896 wrote to memory of 2064	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	103
PID 2896 wrote to memory of 956	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	104
PID 2896 wrote to memory of 956	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	104
PID 2896 wrote to memory of 764	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	105
PID 2896 wrote to memory of 764	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	105
PID 2896 wrote to memory of 2116	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	106
PID 2896 wrote to memory of 2116	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	106
PID 2896 wrote to memory of 5116	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	107
PID 2896 wrote to memory of 5116	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	107
PID 2896 wrote to memory of 4896	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	108
PID 2896 wrote to memory of 4896	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	108
PID 2896 wrote to memory of 808	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	109
PID 2896 wrote to memory of 808	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	109
PID 2896 wrote to memory of 3208	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	110
PID 2896 wrote to memory of 3208	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	110
PID 2896 wrote to memory of 1400	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	111
PID 2896 wrote to memory of 1400	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	111
PID 2896 wrote to memory of 4916	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	112
PID 2896 wrote to memory of 4916	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	112
PID 2896 wrote to memory of 4608	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	113
PID 2896 wrote to memory of 4608	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	113
PID 2896 wrote to memory of 2316	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	114
PID 2896 wrote to memory of 2316	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	114
PID 2896 wrote to memory of 4456	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	115
PID 2896 wrote to memory of 4456	2896	1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe	115

C:\Users\Admin\AppData\Local\Temp\1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe
"C:\Users\Admin\AppData\Local\Temp\1b93b0783da73cdc1ab5d90d42f0cfb8e083b5825fede350859ce630af9411f8.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System\MbzbJYL.exe
  C:\Windows\System\MbzbJYL.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\zSskbjQ.exe
  C:\Windows\System\zSskbjQ.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\GYWHVvW.exe
  C:\Windows\System\GYWHVvW.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\NmzNokU.exe
  C:\Windows\System\NmzNokU.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\XeZvrHs.exe
  C:\Windows\System\XeZvrHs.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\HgQTDBn.exe
  C:\Windows\System\HgQTDBn.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\zKMhMkn.exe
  C:\Windows\System\zKMhMkn.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\jdZkmzF.exe
  C:\Windows\System\jdZkmzF.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\PcZUKgA.exe
  C:\Windows\System\PcZUKgA.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\DklAbbi.exe
  C:\Windows\System\DklAbbi.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\ZPhtgHP.exe
  C:\Windows\System\ZPhtgHP.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\IyvqHJZ.exe
  C:\Windows\System\IyvqHJZ.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\gadGAAn.exe
  C:\Windows\System\gadGAAn.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\mQUAkGe.exe
  C:\Windows\System\mQUAkGe.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\UMTPCID.exe
  C:\Windows\System\UMTPCID.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\cJEYdKm.exe
  C:\Windows\System\cJEYdKm.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\newbKND.exe
  C:\Windows\System\newbKND.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\gDeXJsr.exe
  C:\Windows\System\gDeXJsr.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\MkqzCbD.exe
  C:\Windows\System\MkqzCbD.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\NJnFBcS.exe
  C:\Windows\System\NJnFBcS.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\iZfOLOH.exe
  C:\Windows\System\iZfOLOH.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\JDDdkOw.exe
  C:\Windows\System\JDDdkOw.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\OLGKpoU.exe
  C:\Windows\System\OLGKpoU.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\miMOJbh.exe
  C:\Windows\System\miMOJbh.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\SSdGSZW.exe
  C:\Windows\System\SSdGSZW.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\jBJNZNO.exe
  C:\Windows\System\jBJNZNO.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\PQvKjDX.exe
  C:\Windows\System\PQvKjDX.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\VYnatRX.exe
  C:\Windows\System\VYnatRX.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\Szjjhos.exe
  C:\Windows\System\Szjjhos.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\hFNnoKL.exe
  C:\Windows\System\hFNnoKL.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\VbczLiq.exe
  C:\Windows\System\VbczLiq.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\oXHzLet.exe
  C:\Windows\System\oXHzLet.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\XJRPwZj.exe
  C:\Windows\System\XJRPwZj.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\prLHqlv.exe
  C:\Windows\System\prLHqlv.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\oOuPzuK.exe
  C:\Windows\System\oOuPzuK.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\afyFRRq.exe
  C:\Windows\System\afyFRRq.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\rulbSws.exe
  C:\Windows\System\rulbSws.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\MAZMYFM.exe
  C:\Windows\System\MAZMYFM.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\XqawuQw.exe
  C:\Windows\System\XqawuQw.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\NMBjhne.exe
  C:\Windows\System\NMBjhne.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\hJqFpFM.exe
  C:\Windows\System\hJqFpFM.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\plkqCrF.exe
  C:\Windows\System\plkqCrF.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\RzNhHrb.exe
  C:\Windows\System\RzNhHrb.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\GufMLwW.exe
  C:\Windows\System\GufMLwW.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\fweZsdk.exe
  C:\Windows\System\fweZsdk.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\vvpXTpd.exe
  C:\Windows\System\vvpXTpd.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\hVKIKqL.exe
  C:\Windows\System\hVKIKqL.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\VMlgmwQ.exe
  C:\Windows\System\VMlgmwQ.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\rNtyRJN.exe
  C:\Windows\System\rNtyRJN.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\lCuwCpT.exe
  C:\Windows\System\lCuwCpT.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\KgVuqmy.exe
  C:\Windows\System\KgVuqmy.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\ZUtMPnq.exe
  C:\Windows\System\ZUtMPnq.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\LTvYtLP.exe
  C:\Windows\System\LTvYtLP.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\ULOGFIH.exe
  C:\Windows\System\ULOGFIH.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\RRlUgqu.exe
  C:\Windows\System\RRlUgqu.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\jYGIKtM.exe
  C:\Windows\System\jYGIKtM.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\qjYxBPh.exe
  C:\Windows\System\qjYxBPh.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\FySnFPY.exe
  C:\Windows\System\FySnFPY.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\jAJOsRy.exe
  C:\Windows\System\jAJOsRy.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\JHKNNAT.exe
  C:\Windows\System\JHKNNAT.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\hblfbRP.exe
  C:\Windows\System\hblfbRP.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\qNChUnn.exe
  C:\Windows\System\qNChUnn.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\fJRcaBU.exe
  C:\Windows\System\fJRcaBU.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\GwEJnif.exe
  C:\Windows\System\GwEJnif.exe
  2⤵
  PID:348
- C:\Windows\System\NawaHko.exe
  C:\Windows\System\NawaHko.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\HByGRar.exe
  C:\Windows\System\HByGRar.exe
  2⤵
  PID:3680
- C:\Windows\System\aYiINIX.exe
  C:\Windows\System\aYiINIX.exe
  2⤵
  PID:4564
- C:\Windows\System\TTdHfeQ.exe
  C:\Windows\System\TTdHfeQ.exe
  2⤵
  PID:1880
- C:\Windows\System\HrhPshE.exe
  C:\Windows\System\HrhPshE.exe
  2⤵
  PID:1012
- C:\Windows\System\VyjldJy.exe
  C:\Windows\System\VyjldJy.exe
  2⤵
  PID:4724
- C:\Windows\System\VcwQWTp.exe
  C:\Windows\System\VcwQWTp.exe
  2⤵
  PID:1956
- C:\Windows\System\kzwxjgq.exe
  C:\Windows\System\kzwxjgq.exe
  2⤵
  PID:2368
- C:\Windows\System\reIGZtf.exe
  C:\Windows\System\reIGZtf.exe
  2⤵
  PID:3552
- C:\Windows\System\sAFdVkm.exe
  C:\Windows\System\sAFdVkm.exe
  2⤵
  PID:2224
- C:\Windows\System\kbUxVdr.exe
  C:\Windows\System\kbUxVdr.exe
  2⤵
  PID:1420
- C:\Windows\System\bDXXlnM.exe
  C:\Windows\System\bDXXlnM.exe
  2⤵
  PID:4672
- C:\Windows\System\lmLcNeK.exe
  C:\Windows\System\lmLcNeK.exe
  2⤵
  PID:2324
- C:\Windows\System\hpctqzS.exe
  C:\Windows\System\hpctqzS.exe
  2⤵
  PID:888
- C:\Windows\System\fbPDfSV.exe
  C:\Windows\System\fbPDfSV.exe
  2⤵
  PID:4532
- C:\Windows\System\yVYepqp.exe
  C:\Windows\System\yVYepqp.exe
  2⤵
  PID:456
- C:\Windows\System\sxPpoXa.exe
  C:\Windows\System\sxPpoXa.exe
  2⤵
  PID:1984
- C:\Windows\System\NMdsJkg.exe
  C:\Windows\System\NMdsJkg.exe
  2⤵
  PID:4256
- C:\Windows\System\XkKYtaV.exe
  C:\Windows\System\XkKYtaV.exe
  2⤵
  PID:5088
- C:\Windows\System\mfVdzmK.exe
  C:\Windows\System\mfVdzmK.exe
  2⤵
  PID:3116
- C:\Windows\System\lngIksZ.exe
  C:\Windows\System\lngIksZ.exe
  2⤵
  PID:540
- C:\Windows\System\XwXEbNt.exe
  C:\Windows\System\XwXEbNt.exe
  2⤵
  PID:4920
- C:\Windows\System\BKRBcpO.exe
  C:\Windows\System\BKRBcpO.exe
  2⤵
  PID:2044
- C:\Windows\System\YOFGvbg.exe
  C:\Windows\System\YOFGvbg.exe
  2⤵
  PID:3720
- C:\Windows\System\DRTCvRo.exe
  C:\Windows\System\DRTCvRo.exe
  2⤵
  PID:1732
- C:\Windows\System\yLbZpMC.exe
  C:\Windows\System\yLbZpMC.exe
  2⤵
  PID:4720
- C:\Windows\System\YytsWnr.exe
  C:\Windows\System\YytsWnr.exe
  2⤵
  PID:3004
- C:\Windows\System\ZpiMpaF.exe
  C:\Windows\System\ZpiMpaF.exe
  2⤵
  PID:3172
- C:\Windows\System\BBbbTzO.exe
  C:\Windows\System\BBbbTzO.exe
  2⤵
  PID:4008
- C:\Windows\System\ZqPxERK.exe
  C:\Windows\System\ZqPxERK.exe
  2⤵
  PID:3916
- C:\Windows\System\kGqbJVi.exe
  C:\Windows\System\kGqbJVi.exe
  2⤵
  PID:3056
- C:\Windows\System\qxtejBh.exe
  C:\Windows\System\qxtejBh.exe
  2⤵
  PID:3080
- C:\Windows\System\ONAEJIu.exe
  C:\Windows\System\ONAEJIu.exe
  2⤵
  PID:312
- C:\Windows\System\tMCvRnw.exe
  C:\Windows\System\tMCvRnw.exe
  2⤵
  PID:936
- C:\Windows\System\YbHWTxl.exe
  C:\Windows\System\YbHWTxl.exe
  2⤵
  PID:2948
- C:\Windows\System\rdFMQxk.exe
  C:\Windows\System\rdFMQxk.exe
  2⤵
  PID:3976
- C:\Windows\System\cTRkxHR.exe
  C:\Windows\System\cTRkxHR.exe
  2⤵
  PID:3192
- C:\Windows\System\cnNoyfJ.exe
  C:\Windows\System\cnNoyfJ.exe
  2⤵
  PID:4576
- C:\Windows\System\dcSeReu.exe
  C:\Windows\System\dcSeReu.exe
  2⤵
  PID:2200
- C:\Windows\System\KkSzDux.exe
  C:\Windows\System\KkSzDux.exe
  2⤵
  PID:4716
- C:\Windows\System\BLQrBeD.exe
  C:\Windows\System\BLQrBeD.exe
  2⤵
  PID:3496
- C:\Windows\System\UELrGCK.exe
  C:\Windows\System\UELrGCK.exe
  2⤵
  PID:2512
- C:\Windows\System\lrgJKuc.exe
  C:\Windows\System\lrgJKuc.exe
  2⤵
  PID:992
- C:\Windows\System\dxTNKCR.exe
  C:\Windows\System\dxTNKCR.exe
  2⤵
  PID:5124
- C:\Windows\System\zWuJCLa.exe
  C:\Windows\System\zWuJCLa.exe
  2⤵
  PID:5152
- C:\Windows\System\nzMwuSM.exe
  C:\Windows\System\nzMwuSM.exe
  2⤵
  PID:5176
- C:\Windows\System\yqPWSdD.exe
  C:\Windows\System\yqPWSdD.exe
  2⤵
  PID:5200
- C:\Windows\System\NUtHIBP.exe
  C:\Windows\System\NUtHIBP.exe
  2⤵
  PID:5224
- C:\Windows\System\itFqCxK.exe
  C:\Windows\System\itFqCxK.exe
  2⤵
  PID:5260
- C:\Windows\System\GNwfmAP.exe
  C:\Windows\System\GNwfmAP.exe
  2⤵
  PID:5284
- C:\Windows\System\MmOWawK.exe
  C:\Windows\System\MmOWawK.exe
  2⤵
  PID:5312
- C:\Windows\System\bADqobY.exe
  C:\Windows\System\bADqobY.exe
  2⤵
  PID:5336
- C:\Windows\System\wpHeMBq.exe
  C:\Windows\System\wpHeMBq.exe
  2⤵
  PID:5364
- C:\Windows\System\USbmHYy.exe
  C:\Windows\System\USbmHYy.exe
  2⤵
  PID:5396
- C:\Windows\System\FGyjhbb.exe
  C:\Windows\System\FGyjhbb.exe
  2⤵
  PID:5428
- C:\Windows\System\BqpqdZy.exe
  C:\Windows\System\BqpqdZy.exe
  2⤵
  PID:5452
- C:\Windows\System\Lxlkfbz.exe
  C:\Windows\System\Lxlkfbz.exe
  2⤵
  PID:5484
- C:\Windows\System\hQkwHzF.exe
  C:\Windows\System\hQkwHzF.exe
  2⤵
  PID:5508
- C:\Windows\System\FbPBFFH.exe
  C:\Windows\System\FbPBFFH.exe
  2⤵
  PID:5536
- C:\Windows\System\VrUmhhR.exe
  C:\Windows\System\VrUmhhR.exe
  2⤵
  PID:5568
- C:\Windows\System\SPjqRTo.exe
  C:\Windows\System\SPjqRTo.exe
  2⤵
  PID:5596
- C:\Windows\System\rhjzund.exe
  C:\Windows\System\rhjzund.exe
  2⤵
  PID:5616
- C:\Windows\System\MVvanzu.exe
  C:\Windows\System\MVvanzu.exe
  2⤵
  PID:5648
- C:\Windows\System\RJZAlCw.exe
  C:\Windows\System\RJZAlCw.exe
  2⤵
  PID:5672
- C:\Windows\System\mLkgrkN.exe
  C:\Windows\System\mLkgrkN.exe
  2⤵
  PID:5692
- C:\Windows\System\GUwqZAT.exe
  C:\Windows\System\GUwqZAT.exe
  2⤵
  PID:5720
- C:\Windows\System\pcVuibN.exe
  C:\Windows\System\pcVuibN.exe
  2⤵
  PID:5740
- C:\Windows\System\WSFIJAs.exe
  C:\Windows\System\WSFIJAs.exe
  2⤵
  PID:5776
- C:\Windows\System\JIUhRRT.exe
  C:\Windows\System\JIUhRRT.exe
  2⤵
  PID:5804
- C:\Windows\System\LPnvSGV.exe
  C:\Windows\System\LPnvSGV.exe
  2⤵
  PID:5836
- C:\Windows\System\gYqabWX.exe
  C:\Windows\System\gYqabWX.exe
  2⤵
  PID:5868
- C:\Windows\System\pxvghCI.exe
  C:\Windows\System\pxvghCI.exe
  2⤵
  PID:5900
- C:\Windows\System\jjNguqG.exe
  C:\Windows\System\jjNguqG.exe
  2⤵
  PID:5924
- C:\Windows\System\QbkIgAJ.exe
  C:\Windows\System\QbkIgAJ.exe
  2⤵
  PID:5960
- C:\Windows\System\hnDhOFd.exe
  C:\Windows\System\hnDhOFd.exe
  2⤵
  PID:5988
- C:\Windows\System\GRKQZlT.exe
  C:\Windows\System\GRKQZlT.exe
  2⤵
  PID:6016
- C:\Windows\System\ZaxHenj.exe
  C:\Windows\System\ZaxHenj.exe
  2⤵
  PID:6040
- C:\Windows\System\BIVCnft.exe
  C:\Windows\System\BIVCnft.exe
  2⤵
  PID:6068
- C:\Windows\System\ixdnjjb.exe
  C:\Windows\System\ixdnjjb.exe
  2⤵
  PID:3832
- C:\Windows\System\jZQNdUB.exe
  C:\Windows\System\jZQNdUB.exe
  2⤵
  PID:5140
- C:\Windows\System\tBQDhud.exe
  C:\Windows\System\tBQDhud.exe
  2⤵
  PID:5164
- C:\Windows\System\IVhZauC.exe
  C:\Windows\System\IVhZauC.exe
  2⤵
  PID:5216
- C:\Windows\System\EniXlkD.exe
  C:\Windows\System\EniXlkD.exe
  2⤵
  PID:5300
- C:\Windows\System\akbMnMh.exe
  C:\Windows\System\akbMnMh.exe
  2⤵
  PID:5360
- C:\Windows\System\QlIbFzN.exe
  C:\Windows\System\QlIbFzN.exe
  2⤵
  PID:5388
- C:\Windows\System\ycVFdrS.exe
  C:\Windows\System\ycVFdrS.exe
  2⤵
  PID:5352
- C:\Windows\System\JjpgyPD.exe
  C:\Windows\System\JjpgyPD.exe
  2⤵
  PID:5556
- C:\Windows\System\NeaXSad.exe
  C:\Windows\System\NeaXSad.exe
  2⤵
  PID:5548
- C:\Windows\System\IeCsxVW.exe
  C:\Windows\System\IeCsxVW.exe
  2⤵
  PID:5660
- C:\Windows\System\QuZPhxQ.exe
  C:\Windows\System\QuZPhxQ.exe
  2⤵
  PID:5708
- C:\Windows\System\jJmceNs.exe
  C:\Windows\System\jJmceNs.exe
  2⤵
  PID:5820
- C:\Windows\System\ZgXtPfb.exe
  C:\Windows\System\ZgXtPfb.exe
  2⤵
  PID:5748
- C:\Windows\System\drLMFkh.exe
  C:\Windows\System\drLMFkh.exe
  2⤵
  PID:5892
- C:\Windows\System\fZiGaVA.exe
  C:\Windows\System\fZiGaVA.exe
  2⤵
  PID:5932
- C:\Windows\System\ITtDBFG.exe
  C:\Windows\System\ITtDBFG.exe
  2⤵
  PID:6028
- C:\Windows\System\vCarnyy.exe
  C:\Windows\System\vCarnyy.exe
  2⤵
  PID:6084
- C:\Windows\System\VzUAQCN.exe
  C:\Windows\System\VzUAQCN.exe
  2⤵
  PID:5136
- C:\Windows\System\fACVQEo.exe
  C:\Windows\System\fACVQEo.exe
  2⤵
  PID:5192
- C:\Windows\System\WZpbEnr.exe
  C:\Windows\System\WZpbEnr.exe
  2⤵
  PID:5384
- C:\Windows\System\MCNflhh.exe
  C:\Windows\System\MCNflhh.exe
  2⤵
  PID:5436
- C:\Windows\System\wQkOBst.exe
  C:\Windows\System\wQkOBst.exe
  2⤵
  PID:5628
- C:\Windows\System\NRekCOJ.exe
  C:\Windows\System\NRekCOJ.exe
  2⤵
  PID:5796
- C:\Windows\System\EXjXDZo.exe
  C:\Windows\System\EXjXDZo.exe
  2⤵
  PID:5848
- C:\Windows\System\tcToton.exe
  C:\Windows\System\tcToton.exe
  2⤵
  PID:5936
- C:\Windows\System\NuDNbgW.exe
  C:\Windows\System\NuDNbgW.exe
  2⤵
  PID:6092
- C:\Windows\System\ZcaKzLC.exe
  C:\Windows\System\ZcaKzLC.exe
  2⤵
  PID:5460
- C:\Windows\System\wHmiqLX.exe
  C:\Windows\System\wHmiqLX.exe
  2⤵
  PID:5864
- C:\Windows\System\wjMREEQ.exe
  C:\Windows\System\wjMREEQ.exe
  2⤵
  PID:6164
- C:\Windows\System\nsBbjCm.exe
  C:\Windows\System\nsBbjCm.exe
  2⤵
  PID:6188
- C:\Windows\System\UUbHwDQ.exe
  C:\Windows\System\UUbHwDQ.exe
  2⤵
  PID:6216
- C:\Windows\System\gAlkZtr.exe
  C:\Windows\System\gAlkZtr.exe
  2⤵
  PID:6244
- C:\Windows\System\bpdGbcc.exe
  C:\Windows\System\bpdGbcc.exe
  2⤵
  PID:6268
- C:\Windows\System\VeKamOr.exe
  C:\Windows\System\VeKamOr.exe
  2⤵
  PID:6288
- C:\Windows\System\ZsBXjuN.exe
  C:\Windows\System\ZsBXjuN.exe
  2⤵
  PID:6324
- C:\Windows\System\VcUnCFg.exe
  C:\Windows\System\VcUnCFg.exe
  2⤵
  PID:6344
- C:\Windows\System\XWieADV.exe
  C:\Windows\System\XWieADV.exe
  2⤵
  PID:6364
- C:\Windows\System\AbIWEeL.exe
  C:\Windows\System\AbIWEeL.exe
  2⤵
  PID:6388
- C:\Windows\System\dbSVwxw.exe
  C:\Windows\System\dbSVwxw.exe
  2⤵
  PID:6412
- C:\Windows\System\FSyxtJI.exe
  C:\Windows\System\FSyxtJI.exe
  2⤵
  PID:6440
- C:\Windows\System\hcndwPB.exe
  C:\Windows\System\hcndwPB.exe
  2⤵
  PID:6480
- C:\Windows\System\EBrWTjg.exe
  C:\Windows\System\EBrWTjg.exe
  2⤵
  PID:6524
- C:\Windows\System\ELKizCk.exe
  C:\Windows\System\ELKizCk.exe
  2⤵
  PID:6544
- C:\Windows\System\qOshXYl.exe
  C:\Windows\System\qOshXYl.exe
  2⤵
  PID:6572
- C:\Windows\System\RBLPdvv.exe
  C:\Windows\System\RBLPdvv.exe
  2⤵
  PID:6600
- C:\Windows\System\KnJCgrK.exe
  C:\Windows\System\KnJCgrK.exe
  2⤵
  PID:6632
- C:\Windows\System\pPFzann.exe
  C:\Windows\System\pPFzann.exe
  2⤵
  PID:6660
- C:\Windows\System\eXPbCsw.exe
  C:\Windows\System\eXPbCsw.exe
  2⤵
  PID:6696
- C:\Windows\System\HTyZwVa.exe
  C:\Windows\System\HTyZwVa.exe
  2⤵
  PID:6728
- C:\Windows\System\wypiRla.exe
  C:\Windows\System\wypiRla.exe
  2⤵
  PID:6752
- C:\Windows\System\EWRCEUh.exe
  C:\Windows\System\EWRCEUh.exe
  2⤵
  PID:6776
- C:\Windows\System\TDthHbF.exe
  C:\Windows\System\TDthHbF.exe
  2⤵
  PID:6800
- C:\Windows\System\xQmxhKH.exe
  C:\Windows\System\xQmxhKH.exe
  2⤵
  PID:6816
- C:\Windows\System\GBYYnff.exe
  C:\Windows\System\GBYYnff.exe
  2⤵
  PID:6844
- C:\Windows\System\uFunujn.exe
  C:\Windows\System\uFunujn.exe
  2⤵
  PID:6872
- C:\Windows\System\XnSvyxN.exe
  C:\Windows\System\XnSvyxN.exe
  2⤵
  PID:6900
- C:\Windows\System\szesXbE.exe
  C:\Windows\System\szesXbE.exe
  2⤵
  PID:6924
- C:\Windows\System\zuHlSjM.exe
  C:\Windows\System\zuHlSjM.exe
  2⤵
  PID:6948
- C:\Windows\System\vvKvbeR.exe
  C:\Windows\System\vvKvbeR.exe
  2⤵
  PID:6976
- C:\Windows\System\BLtLkQN.exe
  C:\Windows\System\BLtLkQN.exe
  2⤵
  PID:7008
- C:\Windows\System\lGOzoDV.exe
  C:\Windows\System\lGOzoDV.exe
  2⤵
  PID:7032
- C:\Windows\System\oriogJW.exe
  C:\Windows\System\oriogJW.exe
  2⤵
  PID:7056
- C:\Windows\System\ehLZros.exe
  C:\Windows\System\ehLZros.exe
  2⤵
  PID:7080
- C:\Windows\System\DZklVVh.exe
  C:\Windows\System\DZklVVh.exe
  2⤵
  PID:7108
- C:\Windows\System\bKkpCIO.exe
  C:\Windows\System\bKkpCIO.exe
  2⤵
  PID:7136
- C:\Windows\System\bAvUIxs.exe
  C:\Windows\System\bAvUIxs.exe
  2⤵
  PID:4976
- C:\Windows\System\XKIMnXb.exe
  C:\Windows\System\XKIMnXb.exe
  2⤵
  PID:5940
- C:\Windows\System\UzdqZzM.exe
  C:\Windows\System\UzdqZzM.exe
  2⤵
  PID:6180
- C:\Windows\System\sPwimKd.exe
  C:\Windows\System\sPwimKd.exe
  2⤵
  PID:5240
- C:\Windows\System\UvhrEla.exe
  C:\Windows\System\UvhrEla.exe
  2⤵
  PID:6316
- C:\Windows\System\FORVVXa.exe
  C:\Windows\System\FORVVXa.exe
  2⤵
  PID:6300
- C:\Windows\System\ypcSXJM.exe
  C:\Windows\System\ypcSXJM.exe
  2⤵
  PID:6376
- C:\Windows\System\tnuVObT.exe
  C:\Windows\System\tnuVObT.exe
  2⤵
  PID:6532
- C:\Windows\System\SdDiztD.exe
  C:\Windows\System\SdDiztD.exe
  2⤵
  PID:6628
- C:\Windows\System\kYHODQL.exe
  C:\Windows\System\kYHODQL.exe
  2⤵
  PID:6748
- C:\Windows\System\JlkhiUL.exe
  C:\Windows\System\JlkhiUL.exe
  2⤵
  PID:6556
- C:\Windows\System\mxJVkAB.exe
  C:\Windows\System\mxJVkAB.exe
  2⤵
  PID:6644
- C:\Windows\System\RWGbtXS.exe
  C:\Windows\System\RWGbtXS.exe
  2⤵
  PID:6832
- C:\Windows\System\hzziwRW.exe
  C:\Windows\System\hzziwRW.exe
  2⤵
  PID:6796
- C:\Windows\System\YWRBcFu.exe
  C:\Windows\System\YWRBcFu.exe
  2⤵
  PID:6856
- C:\Windows\System\CgKoRWJ.exe
  C:\Windows\System\CgKoRWJ.exe
  2⤵
  PID:6892
- C:\Windows\System\lgmKiBc.exe
  C:\Windows\System\lgmKiBc.exe
  2⤵
  PID:6996
- C:\Windows\System\wxwVxbo.exe
  C:\Windows\System\wxwVxbo.exe
  2⤵
  PID:7144
- C:\Windows\System\HPWpSPx.exe
  C:\Windows\System\HPWpSPx.exe
  2⤵
  PID:7028
- C:\Windows\System\tkfdFFW.exe
  C:\Windows\System\tkfdFFW.exe
  2⤵
  PID:6308
- C:\Windows\System\bdvyFgS.exe
  C:\Windows\System\bdvyFgS.exe
  2⤵
  PID:6436
- C:\Windows\System\CodSBxy.exe
  C:\Windows\System\CodSBxy.exe
  2⤵
  PID:7124
- C:\Windows\System\YkFkwQu.exe
  C:\Windows\System\YkFkwQu.exe
  2⤵
  PID:6428
- C:\Windows\System\AtwnfLy.exe
  C:\Windows\System\AtwnfLy.exe
  2⤵
  PID:6888
- C:\Windows\System\eQdBARU.exe
  C:\Windows\System\eQdBARU.exe
  2⤵
  PID:6608
- C:\Windows\System\NApewem.exe
  C:\Windows\System\NApewem.exe
  2⤵
  PID:6592
- C:\Windows\System\SHwsKif.exe
  C:\Windows\System\SHwsKif.exe
  2⤵
  PID:6160
- C:\Windows\System\gGXwYmD.exe
  C:\Windows\System\gGXwYmD.exe
  2⤵
  PID:7184
- C:\Windows\System\pDMuVkr.exe
  C:\Windows\System\pDMuVkr.exe
  2⤵
  PID:7220
- C:\Windows\System\xkxyhTT.exe
  C:\Windows\System\xkxyhTT.exe
  2⤵
  PID:7248
- C:\Windows\System\XlFEbIu.exe
  C:\Windows\System\XlFEbIu.exe
  2⤵
  PID:7268
- C:\Windows\System\YFNrvBm.exe
  C:\Windows\System\YFNrvBm.exe
  2⤵
  PID:7292
- C:\Windows\System\yGisBKc.exe
  C:\Windows\System\yGisBKc.exe
  2⤵
  PID:7320
- C:\Windows\System\GyJoJBQ.exe
  C:\Windows\System\GyJoJBQ.exe
  2⤵
  PID:7344
- C:\Windows\System\hyddann.exe
  C:\Windows\System\hyddann.exe
  2⤵
  PID:7360
- C:\Windows\System\ueQKWrX.exe
  C:\Windows\System\ueQKWrX.exe
  2⤵
  PID:7388
- C:\Windows\System\mBjvxtJ.exe
  C:\Windows\System\mBjvxtJ.exe
  2⤵
  PID:7416
- C:\Windows\System\iGnfHXD.exe
  C:\Windows\System\iGnfHXD.exe
  2⤵
  PID:7440
- C:\Windows\System\aYrnDjZ.exe
  C:\Windows\System\aYrnDjZ.exe
  2⤵
  PID:7468
- C:\Windows\System\ELaOMXX.exe
  C:\Windows\System\ELaOMXX.exe
  2⤵
  PID:7500
- C:\Windows\System\aznTFYy.exe
  C:\Windows\System\aznTFYy.exe
  2⤵
  PID:7524
- C:\Windows\System\OWfxqCs.exe
  C:\Windows\System\OWfxqCs.exe
  2⤵
  PID:7552
- C:\Windows\System\dZVbuZl.exe
  C:\Windows\System\dZVbuZl.exe
  2⤵
  PID:7576
- C:\Windows\System\rJsfvkE.exe
  C:\Windows\System\rJsfvkE.exe
  2⤵
  PID:7596
- C:\Windows\System\FMebTZt.exe
  C:\Windows\System\FMebTZt.exe
  2⤵
  PID:7624
- C:\Windows\System\bkxTYbR.exe
  C:\Windows\System\bkxTYbR.exe
  2⤵
  PID:7652
- C:\Windows\System\BXArpiB.exe
  C:\Windows\System\BXArpiB.exe
  2⤵
  PID:7684
- C:\Windows\System\MwDPQex.exe
  C:\Windows\System\MwDPQex.exe
  2⤵
  PID:7716
- C:\Windows\System\ScQqnCC.exe
  C:\Windows\System\ScQqnCC.exe
  2⤵
  PID:7744
- C:\Windows\System\sBdERyx.exe
  C:\Windows\System\sBdERyx.exe
  2⤵
  PID:7772
- C:\Windows\System\fnfpxSj.exe
  C:\Windows\System\fnfpxSj.exe
  2⤵
  PID:7792
- C:\Windows\System\dnYoYQm.exe
  C:\Windows\System\dnYoYQm.exe
  2⤵
  PID:7812
- C:\Windows\System\KKWkWXt.exe
  C:\Windows\System\KKWkWXt.exe
  2⤵
  PID:7836
- C:\Windows\System\aCdnERl.exe
  C:\Windows\System\aCdnERl.exe
  2⤵
  PID:7872
- C:\Windows\System\LHQrQwD.exe
  C:\Windows\System\LHQrQwD.exe
  2⤵
  PID:7900
- C:\Windows\System\CSEVuhG.exe
  C:\Windows\System\CSEVuhG.exe
  2⤵
  PID:7928
- C:\Windows\System\ZmwpUtu.exe
  C:\Windows\System\ZmwpUtu.exe
  2⤵
  PID:7960
- C:\Windows\System\gTlcLCi.exe
  C:\Windows\System\gTlcLCi.exe
  2⤵
  PID:7984
- C:\Windows\System\czbNjMe.exe
  C:\Windows\System\czbNjMe.exe
  2⤵
  PID:8008
- C:\Windows\System\yEzqymw.exe
  C:\Windows\System\yEzqymw.exe
  2⤵
  PID:8028
- C:\Windows\System\NDPBjOO.exe
  C:\Windows\System\NDPBjOO.exe
  2⤵
  PID:8056
- C:\Windows\System\wUMDdRH.exe
  C:\Windows\System\wUMDdRH.exe
  2⤵
  PID:8080
- C:\Windows\System\YyNbCnG.exe
  C:\Windows\System\YyNbCnG.exe
  2⤵
  PID:8112
- C:\Windows\System\dnHfwSB.exe
  C:\Windows\System\dnHfwSB.exe
  2⤵
  PID:8136
- C:\Windows\System\VNTVWPi.exe
  C:\Windows\System\VNTVWPi.exe
  2⤵
  PID:8168
- C:\Windows\System\rzGQUpx.exe
  C:\Windows\System\rzGQUpx.exe
  2⤵
  PID:7040
- C:\Windows\System\DTjDGMO.exe
  C:\Windows\System\DTjDGMO.exe
  2⤵
  PID:6580
- C:\Windows\System\eBCLYMX.exe
  C:\Windows\System\eBCLYMX.exe
  2⤵
  PID:7096
- C:\Windows\System\cBUYfJN.exe
  C:\Windows\System\cBUYfJN.exe
  2⤵
  PID:7172
- C:\Windows\System\ZaylDia.exe
  C:\Windows\System\ZaylDia.exe
  2⤵
  PID:7196
- C:\Windows\System\jqjvfDc.exe
  C:\Windows\System\jqjvfDc.exe
  2⤵
  PID:6156
- C:\Windows\System\XPKUGSv.exe
  C:\Windows\System\XPKUGSv.exe
  2⤵
  PID:7236
- C:\Windows\System\wiqTDiM.exe
  C:\Windows\System\wiqTDiM.exe
  2⤵
  PID:6912
- C:\Windows\System\bnQFZSs.exe
  C:\Windows\System\bnQFZSs.exe
  2⤵
  PID:7488
- C:\Windows\System\tYYTvyM.exe
  C:\Windows\System\tYYTvyM.exe
  2⤵
  PID:7544
- C:\Windows\System\PIpknmO.exe
  C:\Windows\System\PIpknmO.exe
  2⤵
  PID:7428
- C:\Windows\System\LwpWIhE.exe
  C:\Windows\System\LwpWIhE.exe
  2⤵
  PID:7568
- C:\Windows\System\fSKendM.exe
  C:\Windows\System\fSKendM.exe
  2⤵
  PID:7800
- C:\Windows\System\lXUDVsp.exe
  C:\Windows\System\lXUDVsp.exe
  2⤵
  PID:7512
- C:\Windows\System\gRXnnwS.exe
  C:\Windows\System\gRXnnwS.exe
  2⤵
  PID:7704
- C:\Windows\System\muqcbsm.exe
  C:\Windows\System\muqcbsm.exe
  2⤵
  PID:7944
- C:\Windows\System\vmDlBwT.exe
  C:\Windows\System\vmDlBwT.exe
  2⤵
  PID:8016
- C:\Windows\System\vJGTcdi.exe
  C:\Windows\System\vJGTcdi.exe
  2⤵
  PID:8068
- C:\Windows\System\EhqizpT.exe
  C:\Windows\System\EhqizpT.exe
  2⤵
  PID:7912
- C:\Windows\System\wTiOyxA.exe
  C:\Windows\System\wTiOyxA.exe
  2⤵
  PID:8176
- C:\Windows\System\MeyHmRC.exe
  C:\Windows\System\MeyHmRC.exe
  2⤵
  PID:6024
- C:\Windows\System\RDFgjvs.exe
  C:\Windows\System\RDFgjvs.exe
  2⤵
  PID:8088
- C:\Windows\System\RBoSnNS.exe
  C:\Windows\System\RBoSnNS.exe
  2⤵
  PID:8164
- C:\Windows\System\MgQdkzW.exe
  C:\Windows\System\MgQdkzW.exe
  2⤵
  PID:7284
- C:\Windows\System\AbbbGzN.exe
  C:\Windows\System\AbbbGzN.exe
  2⤵
  PID:7616
- C:\Windows\System\abWvnQB.exe
  C:\Windows\System\abWvnQB.exe
  2⤵
  PID:7316
- C:\Windows\System\FInSvJh.exe
  C:\Windows\System\FInSvJh.exe
  2⤵
  PID:7880
- C:\Windows\System\FVfGwQW.exe
  C:\Windows\System\FVfGwQW.exe
  2⤵
  PID:8200
- C:\Windows\System\TykshsZ.exe
  C:\Windows\System\TykshsZ.exe
  2⤵
  PID:8224
- C:\Windows\System\aQnbbkJ.exe
  C:\Windows\System\aQnbbkJ.exe
  2⤵
  PID:8244
- C:\Windows\System\rCcpPUq.exe
  C:\Windows\System\rCcpPUq.exe
  2⤵
  PID:8268
- C:\Windows\System\uweeCLk.exe
  C:\Windows\System\uweeCLk.exe
  2⤵
  PID:8296
- C:\Windows\System\WGmXqnZ.exe
  C:\Windows\System\WGmXqnZ.exe
  2⤵
  PID:8324
- C:\Windows\System\noJwcvU.exe
  C:\Windows\System\noJwcvU.exe
  2⤵
  PID:8352
- C:\Windows\System\vorprDb.exe
  C:\Windows\System\vorprDb.exe
  2⤵
  PID:8376
- C:\Windows\System\vwDcOud.exe
  C:\Windows\System\vwDcOud.exe
  2⤵
  PID:8404
- C:\Windows\System\cnVohYY.exe
  C:\Windows\System\cnVohYY.exe
  2⤵
  PID:8428
- C:\Windows\System\goVDUBl.exe
  C:\Windows\System\goVDUBl.exe
  2⤵
  PID:8456
- C:\Windows\System\GhUkYZG.exe
  C:\Windows\System\GhUkYZG.exe
  2⤵
  PID:8480
- C:\Windows\System\djwILAK.exe
  C:\Windows\System\djwILAK.exe
  2⤵
  PID:8512
- C:\Windows\System\CkIivpO.exe
  C:\Windows\System\CkIivpO.exe
  2⤵
  PID:8532
- C:\Windows\System\nEmxlIu.exe
  C:\Windows\System\nEmxlIu.exe
  2⤵
  PID:8556
- C:\Windows\System\IzjaIWx.exe
  C:\Windows\System\IzjaIWx.exe
  2⤵
  PID:8588
- C:\Windows\System\CUvdjSv.exe
  C:\Windows\System\CUvdjSv.exe
  2⤵
  PID:8616
- C:\Windows\System\yarypDj.exe
  C:\Windows\System\yarypDj.exe
  2⤵
  PID:8640
- C:\Windows\System\UyPmOwK.exe
  C:\Windows\System\UyPmOwK.exe
  2⤵
  PID:8668
- C:\Windows\System\jyfCsET.exe
  C:\Windows\System\jyfCsET.exe
  2⤵
  PID:8696
- C:\Windows\System\JDseuni.exe
  C:\Windows\System\JDseuni.exe
  2⤵
  PID:8724
- C:\Windows\System\XwVTCma.exe
  C:\Windows\System\XwVTCma.exe
  2⤵
  PID:8748
- C:\Windows\System\mvaPHHC.exe
  C:\Windows\System\mvaPHHC.exe
  2⤵
  PID:8784
- C:\Windows\System\VldHmPd.exe
  C:\Windows\System\VldHmPd.exe
  2⤵
  PID:8812
- C:\Windows\System\sjFlmGk.exe
  C:\Windows\System\sjFlmGk.exe
  2⤵
  PID:8844
- C:\Windows\System\CMzaxKb.exe
  C:\Windows\System\CMzaxKb.exe
  2⤵
  PID:8868
- C:\Windows\System\YZPmMnM.exe
  C:\Windows\System\YZPmMnM.exe
  2⤵
  PID:8900
- C:\Windows\System\CwKXmap.exe
  C:\Windows\System\CwKXmap.exe
  2⤵
  PID:8928
- C:\Windows\System\nBVMlHM.exe
  C:\Windows\System\nBVMlHM.exe
  2⤵
  PID:8952
- C:\Windows\System\EGfFvQW.exe
  C:\Windows\System\EGfFvQW.exe
  2⤵
  PID:8972
- C:\Windows\System\WLhpavB.exe
  C:\Windows\System\WLhpavB.exe
  2⤵
  PID:8996
- C:\Windows\System\TFfEOcZ.exe
  C:\Windows\System\TFfEOcZ.exe
  2⤵
  PID:9032
- C:\Windows\System\docPOVo.exe
  C:\Windows\System\docPOVo.exe
  2⤵
  PID:9056
- C:\Windows\System\mxitqyN.exe
  C:\Windows\System\mxitqyN.exe
  2⤵
  PID:9080
- C:\Windows\System\BCQIVlv.exe
  C:\Windows\System\BCQIVlv.exe
  2⤵
  PID:9108
- C:\Windows\System\GXbNHCm.exe
  C:\Windows\System\GXbNHCm.exe
  2⤵
  PID:9132
- C:\Windows\System\twtIPmk.exe
  C:\Windows\System\twtIPmk.exe
  2⤵
  PID:9152
- C:\Windows\System\XYERvCd.exe
  C:\Windows\System\XYERvCd.exe
  2⤵
  PID:9176
- C:\Windows\System\JLWsEYS.exe
  C:\Windows\System\JLWsEYS.exe
  2⤵
  PID:9196
- C:\Windows\System\BMOHNSq.exe
  C:\Windows\System\BMOHNSq.exe
  2⤵
  PID:7604
- C:\Windows\System\iQgfCTi.exe
  C:\Windows\System\iQgfCTi.exe
  2⤵
  PID:8132
- C:\Windows\System\tcpsBRK.exe
  C:\Windows\System\tcpsBRK.exe
  2⤵
  PID:8004
- C:\Windows\System\VRNnxhY.exe
  C:\Windows\System\VRNnxhY.exe
  2⤵
  PID:5604
- C:\Windows\System\coiMngd.exe
  C:\Windows\System\coiMngd.exe
  2⤵
  PID:7740
- C:\Windows\System\TSiLleN.exe
  C:\Windows\System\TSiLleN.exe
  2⤵
  PID:8264
- C:\Windows\System\oaFaXmT.exe
  C:\Windows\System\oaFaXmT.exe
  2⤵
  PID:8336
- C:\Windows\System\srNuEuG.exe
  C:\Windows\System\srNuEuG.exe
  2⤵
  PID:6204
- C:\Windows\System\VxPPVrT.exe
  C:\Windows\System\VxPPVrT.exe
  2⤵
  PID:8452
- C:\Windows\System\HLcjpgB.exe
  C:\Windows\System\HLcjpgB.exe
  2⤵
  PID:8000
- C:\Windows\System\DEmsWxt.exe
  C:\Windows\System\DEmsWxt.exe
  2⤵
  PID:8316
- C:\Windows\System\zTfUWAM.exe
  C:\Windows\System\zTfUWAM.exe
  2⤵
  PID:8384
- C:\Windows\System\VvPyxHc.exe
  C:\Windows\System\VvPyxHc.exe
  2⤵
  PID:8652
- C:\Windows\System\nuvmqnU.exe
  C:\Windows\System\nuvmqnU.exe
  2⤵
  PID:8712
- C:\Windows\System\JoBufvf.exe
  C:\Windows\System\JoBufvf.exe
  2⤵
  PID:8800
- C:\Windows\System\BTCrvRw.exe
  C:\Windows\System\BTCrvRw.exe
  2⤵
  PID:8852
- C:\Windows\System\mUbykVs.exe
  C:\Windows\System\mUbykVs.exe
  2⤵
  PID:8320
- C:\Windows\System\gEwooVs.exe
  C:\Windows\System\gEwooVs.exe
  2⤵
  PID:8988
- C:\Windows\System\bOUoSIp.exe
  C:\Windows\System\bOUoSIp.exe
  2⤵
  PID:8716
- C:\Windows\System\qJHHBiM.exe
  C:\Windows\System\qJHHBiM.exe
  2⤵
  PID:8740
- C:\Windows\System\ZGjjnNk.exe
  C:\Windows\System\ZGjjnNk.exe
  2⤵
  PID:9140
- C:\Windows\System\euoEucr.exe
  C:\Windows\System\euoEucr.exe
  2⤵
  PID:8540
- C:\Windows\System\trhaNeF.exe
  C:\Windows\System\trhaNeF.exe
  2⤵
  PID:8980
- C:\Windows\System\oPUrFoh.exe
  C:\Windows\System\oPUrFoh.exe
  2⤵
  PID:9052
- C:\Windows\System\SUtfpna.exe
  C:\Windows\System\SUtfpna.exe
  2⤵
  PID:9160
- C:\Windows\System\NgyPgSu.exe
  C:\Windows\System\NgyPgSu.exe
  2⤵
  PID:9232
- C:\Windows\System\hTtlPCr.exe
  C:\Windows\System\hTtlPCr.exe
  2⤵
  PID:9260
- C:\Windows\System\iNyOGkw.exe
  C:\Windows\System\iNyOGkw.exe
  2⤵
  PID:9280
- C:\Windows\System\qXjMctM.exe
  C:\Windows\System\qXjMctM.exe
  2⤵
  PID:9308
- C:\Windows\System\AkVjukz.exe
  C:\Windows\System\AkVjukz.exe
  2⤵
  PID:9332
- C:\Windows\System\dBiqxWA.exe
  C:\Windows\System\dBiqxWA.exe
  2⤵
  PID:9356
- C:\Windows\System\UapQuWL.exe
  C:\Windows\System\UapQuWL.exe
  2⤵
  PID:9384
- C:\Windows\System\oofrnEw.exe
  C:\Windows\System\oofrnEw.exe
  2⤵
  PID:9412
- C:\Windows\System\OKqPMZi.exe
  C:\Windows\System\OKqPMZi.exe
  2⤵
  PID:9440
- C:\Windows\System\zmAsqhK.exe
  C:\Windows\System\zmAsqhK.exe
  2⤵
  PID:9464
- C:\Windows\System\OSuTfvd.exe
  C:\Windows\System\OSuTfvd.exe
  2⤵
  PID:9480
- C:\Windows\System\mMpKBGq.exe
  C:\Windows\System\mMpKBGq.exe
  2⤵
  PID:9508
- C:\Windows\System\MuDjDlT.exe
  C:\Windows\System\MuDjDlT.exe
  2⤵
  PID:9532
- C:\Windows\System\xHRbrRN.exe
  C:\Windows\System\xHRbrRN.exe
  2⤵
  PID:9548
- C:\Windows\System\rYuFpJx.exe
  C:\Windows\System\rYuFpJx.exe
  2⤵
  PID:9568
- C:\Windows\System\bnYUjjW.exe
  C:\Windows\System\bnYUjjW.exe
  2⤵
  PID:9592
- C:\Windows\System\OdXUIAa.exe
  C:\Windows\System\OdXUIAa.exe
  2⤵
  PID:9620
- C:\Windows\System\azSUFnY.exe
  C:\Windows\System\azSUFnY.exe
  2⤵
  PID:9636
- C:\Windows\System\EvcMVWi.exe
  C:\Windows\System\EvcMVWi.exe
  2⤵
  PID:9668
- C:\Windows\System\FofPFZO.exe
  C:\Windows\System\FofPFZO.exe
  2⤵
  PID:9692
- C:\Windows\System\tsyspsK.exe
  C:\Windows\System\tsyspsK.exe
  2⤵
  PID:9724
- C:\Windows\System\MwxLwIZ.exe
  C:\Windows\System\MwxLwIZ.exe
  2⤵
  PID:9756
- C:\Windows\System\HkIdGqv.exe
  C:\Windows\System\HkIdGqv.exe
  2⤵
  PID:9784
- C:\Windows\System\ndWIqNn.exe
  C:\Windows\System\ndWIqNn.exe
  2⤵
  PID:9808
- C:\Windows\System\NFrreyF.exe
  C:\Windows\System\NFrreyF.exe
  2⤵
  PID:9840
- C:\Windows\System\PFaEUHk.exe
  C:\Windows\System\PFaEUHk.exe
  2⤵
  PID:9860
- C:\Windows\System\ZuPtPiB.exe
  C:\Windows\System\ZuPtPiB.exe
  2⤵
  PID:9880
- C:\Windows\System\przeadW.exe
  C:\Windows\System\przeadW.exe
  2⤵
  PID:9904
- C:\Windows\System\dGZXZAF.exe
  C:\Windows\System\dGZXZAF.exe
  2⤵
  PID:9928
- C:\Windows\System\HKowUYm.exe
  C:\Windows\System\HKowUYm.exe
  2⤵
  PID:9948
- C:\Windows\System\CouuCPN.exe
  C:\Windows\System\CouuCPN.exe
  2⤵
  PID:9972
- C:\Windows\System\IcThVHH.exe
  C:\Windows\System\IcThVHH.exe
  2⤵
  PID:10000
- C:\Windows\System\AZMDSij.exe
  C:\Windows\System\AZMDSij.exe
  2⤵
  PID:10024
- C:\Windows\System\BUdapXf.exe
  C:\Windows\System\BUdapXf.exe
  2⤵
  PID:10060
- C:\Windows\System\zJMMIzD.exe
  C:\Windows\System\zJMMIzD.exe
  2⤵
  PID:10076
- C:\Windows\System\CEFBqJg.exe
  C:\Windows\System\CEFBqJg.exe
  2⤵
  PID:10096
- C:\Windows\System\EpAGmxm.exe
  C:\Windows\System\EpAGmxm.exe
  2⤵
  PID:10116
- C:\Windows\System\lZmreEy.exe
  C:\Windows\System\lZmreEy.exe
  2⤵
  PID:10140
- C:\Windows\System\xzwXGqD.exe
  C:\Windows\System\xzwXGqD.exe
  2⤵
  PID:10172
- C:\Windows\System\oNTzUJw.exe
  C:\Windows\System\oNTzUJw.exe
  2⤵
  PID:10192
- C:\Windows\System\DGPWCHA.exe
  C:\Windows\System\DGPWCHA.exe
  2⤵
  PID:10212
- C:\Windows\System\mFmiFIV.exe
  C:\Windows\System\mFmiFIV.exe
  2⤵
  PID:8184
- C:\Windows\System\PaoaiHQ.exe
  C:\Windows\System\PaoaiHQ.exe
  2⤵
  PID:7340
- C:\Windows\System\wdNKMLw.exe
  C:\Windows\System\wdNKMLw.exe
  2⤵
  PID:8992
- C:\Windows\System\frgabPV.exe
  C:\Windows\System\frgabPV.exe
  2⤵
  PID:8544
- C:\Windows\System\tVBwPDT.exe
  C:\Windows\System\tVBwPDT.exe
  2⤵
  PID:8416
- C:\Windows\System\ejhuONS.exe
  C:\Windows\System\ejhuONS.exe
  2⤵
  PID:8232
- C:\Windows\System\ENKltJX.exe
  C:\Windows\System\ENKltJX.exe
  2⤵
  PID:8912
- C:\Windows\System\HOqlSiW.exe
  C:\Windows\System\HOqlSiW.exe
  2⤵
  PID:8692
- C:\Windows\System\jIMFLdy.exe
  C:\Windows\System\jIMFLdy.exe
  2⤵
  PID:6992
- C:\Windows\System\JFtkogm.exe
  C:\Windows\System\JFtkogm.exe
  2⤵
  PID:9316
- C:\Windows\System\cBOHEZg.exe
  C:\Windows\System\cBOHEZg.exe
  2⤵
  PID:8284
- C:\Windows\System\VxFWYSF.exe
  C:\Windows\System\VxFWYSF.exe
  2⤵
  PID:9068
- C:\Windows\System\SRrdJEB.exe
  C:\Windows\System\SRrdJEB.exe
  2⤵
  PID:9544
- C:\Windows\System\idWESTI.exe
  C:\Windows\System\idWESTI.exe
  2⤵
  PID:9676
- C:\Windows\System\qVSBsOo.exe
  C:\Windows\System\qVSBsOo.exe
  2⤵
  PID:9712
- C:\Windows\System\OpKbCKm.exe
  C:\Windows\System\OpKbCKm.exe
  2⤵
  PID:9736
- C:\Windows\System\CLgrFfg.exe
  C:\Windows\System\CLgrFfg.exe
  2⤵
  PID:9248
- C:\Windows\System\TJTRVuN.exe
  C:\Windows\System\TJTRVuN.exe
  2⤵
  PID:9792
- C:\Windows\System\zvDIrCc.exe
  C:\Windows\System\zvDIrCc.exe
  2⤵
  PID:9832
- C:\Windows\System\wGnxvql.exe
  C:\Windows\System\wGnxvql.exe
  2⤵
  PID:9472
- C:\Windows\System\lDOpZju.exe
  C:\Windows\System\lDOpZju.exe
  2⤵
  PID:9520
- C:\Windows\System\OglVXde.exe
  C:\Windows\System\OglVXde.exe
  2⤵
  PID:9048
- C:\Windows\System\YSJkFSM.exe
  C:\Windows\System\YSJkFSM.exe
  2⤵
  PID:10048
- C:\Windows\System\PnQFwyZ.exe
  C:\Windows\System\PnQFwyZ.exe
  2⤵
  PID:9256
- C:\Windows\System\clTqUDt.exe
  C:\Windows\System\clTqUDt.exe
  2⤵
  PID:6332
- C:\Windows\System\ScnALYC.exe
  C:\Windows\System\ScnALYC.exe
  2⤵
  PID:8776
- C:\Windows\System\mkBUdVb.exe
  C:\Windows\System\mkBUdVb.exe
  2⤵
  PID:10260
- C:\Windows\System\autbopf.exe
  C:\Windows\System\autbopf.exe
  2⤵
  PID:10280
- C:\Windows\System\CwNTsIU.exe
  C:\Windows\System\CwNTsIU.exe
  2⤵
  PID:10308
- C:\Windows\System\LkJdAvL.exe
  C:\Windows\System\LkJdAvL.exe
  2⤵
  PID:10328
- C:\Windows\System\GXFQeok.exe
  C:\Windows\System\GXFQeok.exe
  2⤵
  PID:10360
- C:\Windows\System\kRBTKaN.exe
  C:\Windows\System\kRBTKaN.exe
  2⤵
  PID:10380
- C:\Windows\System\DYOMZzn.exe
  C:\Windows\System\DYOMZzn.exe
  2⤵
  PID:10396
- C:\Windows\System\pGoWVGE.exe
  C:\Windows\System\pGoWVGE.exe
  2⤵
  PID:10416
- C:\Windows\System\haeOjsE.exe
  C:\Windows\System\haeOjsE.exe
  2⤵
  PID:10440
- C:\Windows\System\kPMmheX.exe
  C:\Windows\System\kPMmheX.exe
  2⤵
  PID:10460
- C:\Windows\System\TWJSdMK.exe
  C:\Windows\System\TWJSdMK.exe
  2⤵
  PID:10484
- C:\Windows\System\mvKZxZi.exe
  C:\Windows\System\mvKZxZi.exe
  2⤵
  PID:10512
- C:\Windows\System\GmaFtda.exe
  C:\Windows\System\GmaFtda.exe
  2⤵
  PID:10536
- C:\Windows\System\dOrtxRS.exe
  C:\Windows\System\dOrtxRS.exe
  2⤵
  PID:10560
- C:\Windows\System\mezFMrF.exe
  C:\Windows\System\mezFMrF.exe
  2⤵
  PID:10584
- C:\Windows\System\pdqODQz.exe
  C:\Windows\System\pdqODQz.exe
  2⤵
  PID:10608
- C:\Windows\System\JGaQrQK.exe
  C:\Windows\System\JGaQrQK.exe
  2⤵
  PID:10628
- C:\Windows\System\JwtyeFZ.exe
  C:\Windows\System\JwtyeFZ.exe
  2⤵
  PID:10656
- C:\Windows\System\MTRIygG.exe
  C:\Windows\System\MTRIygG.exe
  2⤵
  PID:10676
- C:\Windows\System\nQxRaQm.exe
  C:\Windows\System\nQxRaQm.exe
  2⤵
  PID:10704
- C:\Windows\System\oHGBdAt.exe
  C:\Windows\System\oHGBdAt.exe
  2⤵
  PID:10724
- C:\Windows\System\ZWBWONT.exe
  C:\Windows\System\ZWBWONT.exe
  2⤵
  PID:10748
- C:\Windows\System\Ecrtqph.exe
  C:\Windows\System\Ecrtqph.exe
  2⤵
  PID:10776
- C:\Windows\System\LxiXBZx.exe
  C:\Windows\System\LxiXBZx.exe
  2⤵
  PID:10796
- C:\Windows\System\uqBSXOZ.exe
  C:\Windows\System\uqBSXOZ.exe
  2⤵
  PID:10828
- C:\Windows\System\QRugXaW.exe
  C:\Windows\System\QRugXaW.exe
  2⤵
  PID:10852
- C:\Windows\System\gnRkWbl.exe
  C:\Windows\System\gnRkWbl.exe
  2⤵
  PID:10876
- C:\Windows\System\gUngHKX.exe
  C:\Windows\System\gUngHKX.exe
  2⤵
  PID:10908
- C:\Windows\System\iNqYruU.exe
  C:\Windows\System\iNqYruU.exe
  2⤵
  PID:10936
- C:\Windows\System\NFkcKVY.exe
  C:\Windows\System\NFkcKVY.exe
  2⤵
  PID:10964
- C:\Windows\System\IKfZbwl.exe
  C:\Windows\System\IKfZbwl.exe
  2⤵
  PID:10980
- C:\Windows\System\itFUEpT.exe
  C:\Windows\System\itFUEpT.exe
  2⤵
  PID:11008
- C:\Windows\System\cxTdxxw.exe
  C:\Windows\System\cxTdxxw.exe
  2⤵
  PID:11032
- C:\Windows\System\ZsdwMkT.exe
  C:\Windows\System\ZsdwMkT.exe
  2⤵
  PID:11056
- C:\Windows\System\WSPbNhN.exe
  C:\Windows\System\WSPbNhN.exe
  2⤵
  PID:11080
- C:\Windows\System\QYVXdCe.exe
  C:\Windows\System\QYVXdCe.exe
  2⤵
  PID:11104
- C:\Windows\System\YRGRpDK.exe
  C:\Windows\System\YRGRpDK.exe
  2⤵
  PID:11132
- C:\Windows\System\ONRrvJU.exe
  C:\Windows\System\ONRrvJU.exe
  2⤵
  PID:11164
- C:\Windows\System\kTMmQoA.exe
  C:\Windows\System\kTMmQoA.exe
  2⤵
  PID:11180
- C:\Windows\System\ymNppKL.exe
  C:\Windows\System\ymNppKL.exe
  2⤵
  PID:11204
- C:\Windows\System\uBkwCRR.exe
  C:\Windows\System\uBkwCRR.exe
  2⤵
  PID:11232
- C:\Windows\System\zzrIuQp.exe
  C:\Windows\System\zzrIuQp.exe
  2⤵
  PID:11260
- C:\Windows\System\HABcbzt.exe
  C:\Windows\System\HABcbzt.exe
  2⤵
  PID:9964
- C:\Windows\System\qGZfNlk.exe
  C:\Windows\System\qGZfNlk.exe
  2⤵
  PID:9632
- C:\Windows\System\HmPhBbb.exe
  C:\Windows\System\HmPhBbb.exe
  2⤵
  PID:8660
- C:\Windows\System\cpUELaO.exe
  C:\Windows\System\cpUELaO.exe
  2⤵
  PID:8792
- C:\Windows\System\basWDJj.exe
  C:\Windows\System\basWDJj.exe
  2⤵
  PID:9580
- C:\Windows\System\UYYbOws.exe
  C:\Windows\System\UYYbOws.exe
  2⤵
  PID:10168
- C:\Windows\System\mvpBkJd.exe
  C:\Windows\System\mvpBkJd.exe
  2⤵
  PID:8448
- C:\Windows\System\oqiBQtS.exe
  C:\Windows\System\oqiBQtS.exe
  2⤵
  PID:10296
- C:\Windows\System\CmwAYkw.exe
  C:\Windows\System\CmwAYkw.exe
  2⤵
  PID:8260
- C:\Windows\System\hfqnqMR.exe
  C:\Windows\System\hfqnqMR.exe
  2⤵
  PID:10368
- C:\Windows\System\yciYSWn.exe
  C:\Windows\System\yciYSWn.exe
  2⤵
  PID:10020
- C:\Windows\System\bvDKteN.exe
  C:\Windows\System\bvDKteN.exe
  2⤵
  PID:10548
- C:\Windows\System\uvyiGTf.exe
  C:\Windows\System\uvyiGTf.exe
  2⤵
  PID:10180
- C:\Windows\System\dGMuElB.exe
  C:\Windows\System\dGMuElB.exe
  2⤵
  PID:9776
- C:\Windows\System\oIdnwCV.exe
  C:\Windows\System\oIdnwCV.exe
  2⤵
  PID:9368
- C:\Windows\System\gEeOTgp.exe
  C:\Windows\System\gEeOTgp.exe
  2⤵
  PID:10716
- C:\Windows\System\jULhRTK.exe
  C:\Windows\System\jULhRTK.exe
  2⤵
  PID:10744
- C:\Windows\System\KVVDWVZ.exe
  C:\Windows\System\KVVDWVZ.exe
  2⤵
  PID:9400
- C:\Windows\System\jSefQJs.exe
  C:\Windows\System\jSefQJs.exe
  2⤵
  PID:8604
- C:\Windows\System\LJGQBIY.exe
  C:\Windows\System\LJGQBIY.exe
  2⤵
  PID:10976
- C:\Windows\System\gyzZPED.exe
  C:\Windows\System\gyzZPED.exe
  2⤵
  PID:9324
- C:\Windows\System\XeOcPkI.exe
  C:\Windows\System\XeOcPkI.exe
  2⤵
  PID:11300
- C:\Windows\System\mJPBrmE.exe
  C:\Windows\System\mJPBrmE.exe
  2⤵
  PID:11328
- C:\Windows\System\xePadOO.exe
  C:\Windows\System\xePadOO.exe
  2⤵
  PID:11360
- C:\Windows\System\OToFUoV.exe
  C:\Windows\System\OToFUoV.exe
  2⤵
  PID:11388
- C:\Windows\System\diAoEWx.exe
  C:\Windows\System\diAoEWx.exe
  2⤵
  PID:11412
- C:\Windows\System\QbZMWJz.exe
  C:\Windows\System\QbZMWJz.exe
  2⤵
  PID:11432
- C:\Windows\System\kHscxhW.exe
  C:\Windows\System\kHscxhW.exe
  2⤵
  PID:11452
- C:\Windows\System\jjNeXAr.exe
  C:\Windows\System\jjNeXAr.exe
  2⤵
  PID:11480
- C:\Windows\System\UNnIOwk.exe
  C:\Windows\System\UNnIOwk.exe
  2⤵
  PID:11504
- C:\Windows\System\nVDzlFg.exe
  C:\Windows\System\nVDzlFg.exe
  2⤵
  PID:11528
- C:\Windows\System\NJuoWjS.exe
  C:\Windows\System\NJuoWjS.exe
  2⤵
  PID:11548
- C:\Windows\System\jmtazhF.exe
  C:\Windows\System\jmtazhF.exe
  2⤵
  PID:11576
- C:\Windows\System\ofmnCaU.exe
  C:\Windows\System\ofmnCaU.exe
  2⤵
  PID:11600
- C:\Windows\System\JKKdtTe.exe
  C:\Windows\System\JKKdtTe.exe
  2⤵
  PID:11624
- C:\Windows\System\CDHuzQR.exe
  C:\Windows\System\CDHuzQR.exe
  2⤵
  PID:11644
- C:\Windows\System\DHBZpIp.exe
  C:\Windows\System\DHBZpIp.exe
  2⤵
  PID:11672
- C:\Windows\System\WiumIOK.exe
  C:\Windows\System\WiumIOK.exe
  2⤵
  PID:11696
- C:\Windows\System\IQdaRho.exe
  C:\Windows\System\IQdaRho.exe
  2⤵
  PID:11720
- C:\Windows\System\KeLbKCI.exe
  C:\Windows\System\KeLbKCI.exe
  2⤵
  PID:11748
- C:\Windows\System\bqoiNLw.exe
  C:\Windows\System\bqoiNLw.exe
  2⤵
  PID:11768
- C:\Windows\System\akDaaXK.exe
  C:\Windows\System\akDaaXK.exe
  2⤵
  PID:11792
- C:\Windows\System\LTHdruH.exe
  C:\Windows\System\LTHdruH.exe
  2⤵
  PID:11820
- C:\Windows\System\HkqTbBH.exe
  C:\Windows\System\HkqTbBH.exe
  2⤵
  PID:11840
- C:\Windows\System\vdJlHmO.exe
  C:\Windows\System\vdJlHmO.exe
  2⤵
  PID:11864
- C:\Windows\System\qiaHSFF.exe
  C:\Windows\System\qiaHSFF.exe
  2⤵
  PID:11884
- C:\Windows\System\DoFTAxt.exe
  C:\Windows\System\DoFTAxt.exe
  2⤵
  PID:11908
- C:\Windows\System\UDEdcAj.exe
  C:\Windows\System\UDEdcAj.exe
  2⤵
  PID:11928
- C:\Windows\System\cTmZoHB.exe
  C:\Windows\System\cTmZoHB.exe
  2⤵
  PID:11948
- C:\Windows\System\ylPzYTr.exe
  C:\Windows\System\ylPzYTr.exe
  2⤵
  PID:11976
- C:\Windows\System\JQqgjUB.exe
  C:\Windows\System\JQqgjUB.exe
  2⤵
  PID:11996
- C:\Windows\System\NKUlbPS.exe
  C:\Windows\System\NKUlbPS.exe
  2⤵
  PID:12024
- C:\Windows\System\Ilicoyq.exe
  C:\Windows\System\Ilicoyq.exe
  2⤵
  PID:12048
- C:\Windows\System\xDtqcfn.exe
  C:\Windows\System\xDtqcfn.exe
  2⤵
  PID:12076
- C:\Windows\System\NjdPaka.exe
  C:\Windows\System\NjdPaka.exe
  2⤵
  PID:12100
- C:\Windows\System\mdTlsMz.exe
  C:\Windows\System\mdTlsMz.exe
  2⤵
  PID:12124
- C:\Windows\System\lAQrVkl.exe
  C:\Windows\System\lAQrVkl.exe
  2⤵
  PID:12148
- C:\Windows\System\JQuUkUT.exe
  C:\Windows\System\JQuUkUT.exe
  2⤵
  PID:12168
- C:\Windows\System\hmnXdaT.exe
  C:\Windows\System\hmnXdaT.exe
  2⤵
  PID:12192
- C:\Windows\System\MEsksCC.exe
  C:\Windows\System\MEsksCC.exe
  2⤵
  PID:12228
- C:\Windows\System\mAgLRIS.exe
  C:\Windows\System\mAgLRIS.exe
  2⤵
  PID:12244
- C:\Windows\System\OnvGbwS.exe
  C:\Windows\System\OnvGbwS.exe
  2⤵
  PID:12264
- C:\Windows\System\reXMBUs.exe
  C:\Windows\System\reXMBUs.exe
  2⤵
  PID:11076
- C:\Windows\System\EtMRBFY.exe
  C:\Windows\System\EtMRBFY.exe
  2⤵
  PID:9120
- C:\Windows\System\BfZsrlR.exe
  C:\Windows\System\BfZsrlR.exe
  2⤵
  PID:10452
- C:\Windows\System\JSwJgYP.exe
  C:\Windows\System\JSwJgYP.exe
  2⤵
  PID:10508
- C:\Windows\System\LKBBHVj.exe
  C:\Windows\System\LKBBHVj.exe
  2⤵
  PID:8864
- C:\Windows\System\JIZEZbn.exe
  C:\Windows\System\JIZEZbn.exe
  2⤵
  PID:8940
- C:\Windows\System\YutCNaP.exe
  C:\Windows\System\YutCNaP.exe
  2⤵
  PID:9452
- C:\Windows\System\wuNJqFS.exe
  C:\Windows\System\wuNJqFS.exe
  2⤵
  PID:10288
- C:\Windows\System\eFQglnc.exe
  C:\Windows\System\eFQglnc.exe
  2⤵
  PID:10764
- C:\Windows\System\DpUoTQT.exe
  C:\Windows\System\DpUoTQT.exe
  2⤵
  PID:10572
- C:\Windows\System\cwBZHVt.exe
  C:\Windows\System\cwBZHVt.exe
  2⤵
  PID:10840
- C:\Windows\System\HyNSDOM.exe
  C:\Windows\System\HyNSDOM.exe
  2⤵
  PID:10248
- C:\Windows\System\vhkRPDD.exe
  C:\Windows\System\vhkRPDD.exe
  2⤵
  PID:8548
- C:\Windows\System\yJxHVYK.exe
  C:\Windows\System\yJxHVYK.exe
  2⤵
  PID:11040
- C:\Windows\System\KBtQiTp.exe
  C:\Windows\System\KBtQiTp.exe
  2⤵
  PID:11372
- C:\Windows\System\AiXaSNt.exe
  C:\Windows\System\AiXaSNt.exe
  2⤵
  PID:11428
- C:\Windows\System\fYEPSRI.exe
  C:\Windows\System\fYEPSRI.exe
  2⤵
  PID:11196
- C:\Windows\System\cRMrZeW.exe
  C:\Windows\System\cRMrZeW.exe
  2⤵
  PID:11536
- C:\Windows\System\IcArRcP.exe
  C:\Windows\System\IcArRcP.exe
  2⤵
  PID:11572
- C:\Windows\System\YVFjhfJ.exe
  C:\Windows\System\YVFjhfJ.exe
  2⤵
  PID:11636
- C:\Windows\System\awxCBwB.exe
  C:\Windows\System\awxCBwB.exe
  2⤵
  PID:10696
- C:\Windows\System\utPYGxu.exe
  C:\Windows\System\utPYGxu.exe
  2⤵
  PID:10016
- C:\Windows\System\YcZfBSc.exe
  C:\Windows\System\YcZfBSc.exe
  2⤵
  PID:10200
- C:\Windows\System\FxKUyZB.exe
  C:\Windows\System\FxKUyZB.exe
  2⤵
  PID:12312
- C:\Windows\System\wGxbCSC.exe
  C:\Windows\System\wGxbCSC.exe
  2⤵
  PID:12340
- C:\Windows\System\IFKAFAY.exe
  C:\Windows\System\IFKAFAY.exe
  2⤵
  PID:12384
- C:\Windows\System\ZLbMdeh.exe
  C:\Windows\System\ZLbMdeh.exe
  2⤵
  PID:12408
- C:\Windows\System\ytnjbLU.exe
  C:\Windows\System\ytnjbLU.exe
  2⤵
  PID:12424
- C:\Windows\System\fOGXqKC.exe
  C:\Windows\System\fOGXqKC.exe
  2⤵
  PID:12448
- C:\Windows\System\gievhOk.exe
  C:\Windows\System\gievhOk.exe
  2⤵
  PID:12468
- C:\Windows\System\fthEcaA.exe
  C:\Windows\System\fthEcaA.exe
  2⤵
  PID:12492
- C:\Windows\System\MFUNlDG.exe
  C:\Windows\System\MFUNlDG.exe
  2⤵
  PID:12516
- C:\Windows\System\LQkqsLl.exe
  C:\Windows\System\LQkqsLl.exe
  2⤵
  PID:12540
- C:\Windows\System\qOCNKke.exe
  C:\Windows\System\qOCNKke.exe
  2⤵
  PID:12564
- C:\Windows\System\FBRTWkB.exe
  C:\Windows\System\FBRTWkB.exe
  2⤵
  PID:12592
- C:\Windows\System\kHRCgig.exe
  C:\Windows\System\kHRCgig.exe
  2⤵
  PID:12616
- C:\Windows\System\OFXZsJl.exe
  C:\Windows\System\OFXZsJl.exe
  2⤵
  PID:12648
- C:\Windows\System\OomRSFs.exe
  C:\Windows\System\OomRSFs.exe
  2⤵
  PID:12668
- C:\Windows\System\gCZwAkh.exe
  C:\Windows\System\gCZwAkh.exe
  2⤵
  PID:12700
- C:\Windows\System\UNAKbMe.exe
  C:\Windows\System\UNAKbMe.exe
  2⤵
  PID:12728
- C:\Windows\System\ibsmQsQ.exe
  C:\Windows\System\ibsmQsQ.exe
  2⤵
  PID:12752
- C:\Windows\System\fShjsfa.exe
  C:\Windows\System\fShjsfa.exe
  2⤵
  PID:12780
- C:\Windows\System\YOHJhfH.exe
  C:\Windows\System\YOHJhfH.exe
  2⤵
  PID:12804
- C:\Windows\System\HlsbXxY.exe
  C:\Windows\System\HlsbXxY.exe
  2⤵
  PID:12824
- C:\Windows\System\CFGoLts.exe
  C:\Windows\System\CFGoLts.exe
  2⤵
  PID:12848
- C:\Windows\System\cuLAFcZ.exe
  C:\Windows\System\cuLAFcZ.exe
  2⤵
  PID:12864
- C:\Windows\System\NsppWMa.exe
  C:\Windows\System\NsppWMa.exe
  2⤵
  PID:12892
- C:\Windows\System\JNrHEcN.exe
  C:\Windows\System\JNrHEcN.exe
  2⤵
  PID:12908
- C:\Windows\System\JEWCKCj.exe
  C:\Windows\System\JEWCKCj.exe
  2⤵
  PID:12928
- C:\Windows\System\wOhIraj.exe
  C:\Windows\System\wOhIraj.exe
  2⤵
  PID:12952
- C:\Windows\System\WrDDnGn.exe
  C:\Windows\System\WrDDnGn.exe
  2⤵
  PID:12984
- C:\Windows\System\GOjTWKU.exe
  C:\Windows\System\GOjTWKU.exe
  2⤵
  PID:13008
- C:\Windows\System\QNgeKoB.exe
  C:\Windows\System\QNgeKoB.exe
  2⤵
  PID:13040
- C:\Windows\System\HcTcNan.exe
  C:\Windows\System\HcTcNan.exe
  2⤵
  PID:13060
- C:\Windows\System\xbaiDnr.exe
  C:\Windows\System\xbaiDnr.exe
  2⤵
  PID:13076
- C:\Windows\System\lUWvKxb.exe
  C:\Windows\System\lUWvKxb.exe
  2⤵
  PID:13104
- C:\Windows\System\AEvuDIh.exe
  C:\Windows\System\AEvuDIh.exe
  2⤵
  PID:13128
- C:\Windows\System\spkEjrA.exe
  C:\Windows\System\spkEjrA.exe
  2⤵
  PID:13156
- C:\Windows\System\DZVxedI.exe
  C:\Windows\System\DZVxedI.exe
  2⤵
  PID:13180
- C:\Windows\System\RxPylMx.exe
  C:\Windows\System\RxPylMx.exe
  2⤵
  PID:13208
- C:\Windows\System\qWhEUto.exe
  C:\Windows\System\qWhEUto.exe
  2⤵
  PID:13228
- C:\Windows\System\cDCnyEZ.exe
  C:\Windows\System\cDCnyEZ.exe
  2⤵
  PID:13252
- C:\Windows\System\ZiBGBHA.exe
  C:\Windows\System\ZiBGBHA.exe
  2⤵
  PID:13280
- C:\Windows\System\qvXLgXd.exe
  C:\Windows\System\qvXLgXd.exe
  2⤵
  PID:13296
- C:\Windows\System\yzdZkes.exe
  C:\Windows\System\yzdZkes.exe
  2⤵
  PID:10892
- C:\Windows\System\KRfqGuX.exe
  C:\Windows\System\KRfqGuX.exe
  2⤵
  PID:12020
- C:\Windows\System\djkhohG.exe
  C:\Windows\System\djkhohG.exe
  2⤵
  PID:10960
- C:\Windows\System\rejpsgn.exe
  C:\Windows\System\rejpsgn.exe
  2⤵
  PID:12136
- C:\Windows\System\EsqMbXS.exe
  C:\Windows\System\EsqMbXS.exe
  2⤵
  PID:12212
- C:\Windows\System\QLixgLN.exe
  C:\Windows\System\QLixgLN.exe
  2⤵
  PID:11448
- C:\Windows\System\OQYheCz.exe
  C:\Windows\System\OQYheCz.exe
  2⤵
  PID:9940
- C:\Windows\System\syvWlhf.exe
  C:\Windows\System\syvWlhf.exe
  2⤵
  PID:9744
- C:\Windows\System\VczMeAh.exe
  C:\Windows\System\VczMeAh.exe
  2⤵
  PID:9660
- C:\Windows\System\HZHJpDT.exe
  C:\Windows\System\HZHJpDT.exe
  2⤵
  PID:11660
- C:\Windows\System\IxFLPxr.exe
  C:\Windows\System\IxFLPxr.exe
  2⤵
  PID:9244
- C:\Windows\System\clHykzt.exe
  C:\Windows\System\clHykzt.exe
  2⤵
  PID:11352
- C:\Windows\System\EMoWjMK.exe
  C:\Windows\System\EMoWjMK.exe
  2⤵
  PID:10156
- C:\Windows\System\RTBCZwF.exe
  C:\Windows\System\RTBCZwF.exe
  2⤵
  PID:11832
- C:\Windows\System\wyaJNDH.exe
  C:\Windows\System\wyaJNDH.exe
  2⤵
  PID:9352
- C:\Windows\System\EwziOMR.exe
  C:\Windows\System\EwziOMR.exe
  2⤵
  PID:12004
- C:\Windows\System\BiCkZVd.exe
  C:\Windows\System\BiCkZVd.exe
  2⤵
  PID:12060
- C:\Windows\System\hXPiiMq.exe
  C:\Windows\System\hXPiiMq.exe
  2⤵
  PID:12180
- C:\Windows\System\IwcqLwF.exe
  C:\Windows\System\IwcqLwF.exe
  2⤵
  PID:12216
- C:\Windows\System\BaZQdPr.exe
  C:\Windows\System\BaZQdPr.exe
  2⤵
  PID:12576
- C:\Windows\System\hMqkRTd.exe
  C:\Windows\System\hMqkRTd.exe
  2⤵
  PID:12280
- C:\Windows\System\MkouArZ.exe
  C:\Windows\System\MkouArZ.exe
  2⤵
  PID:12720
- C:\Windows\System\ZRQpqXI.exe
  C:\Windows\System\ZRQpqXI.exe
  2⤵
  PID:12740
- C:\Windows\System\rrcHLdH.exe
  C:\Windows\System\rrcHLdH.exe
  2⤵
  PID:12800
- C:\Windows\System\lwPDVIn.exe
  C:\Windows\System\lwPDVIn.exe
  2⤵
  PID:13340
- C:\Windows\System\gZTOrBC.exe
  C:\Windows\System\gZTOrBC.exe
  2⤵
  PID:13368
- C:\Windows\System\CvmkSui.exe
  C:\Windows\System\CvmkSui.exe
  2⤵
  PID:13392
- C:\Windows\System\VMiQUqh.exe
  C:\Windows\System\VMiQUqh.exe
  2⤵
  PID:13416
- C:\Windows\System\yPZiQTx.exe
  C:\Windows\System\yPZiQTx.exe
  2⤵
  PID:13452
- C:\Windows\System\ulbWpyo.exe
  C:\Windows\System\ulbWpyo.exe
  2⤵
  PID:13468
- C:\Windows\System\QVcJToo.exe
  C:\Windows\System\QVcJToo.exe
  2⤵
  PID:13496
- C:\Windows\System\dgvlDdR.exe
  C:\Windows\System\dgvlDdR.exe
  2⤵
  PID:13520
- C:\Windows\System\uIkhsYk.exe
  C:\Windows\System\uIkhsYk.exe
  2⤵
  PID:13536
- C:\Windows\System\gdnRlVx.exe
  C:\Windows\System\gdnRlVx.exe
  2⤵
  PID:13568
- C:\Windows\System\nUUVRJz.exe
  C:\Windows\System\nUUVRJz.exe
  2⤵
  PID:13588
- C:\Windows\System\bfEuCXd.exe
  C:\Windows\System\bfEuCXd.exe
  2⤵
  PID:13620
- C:\Windows\System\SWmfezo.exe
  C:\Windows\System\SWmfezo.exe
  2⤵
  PID:13636
- C:\Windows\System\AhRptMe.exe
  C:\Windows\System\AhRptMe.exe
  2⤵
  PID:13656
- C:\Windows\System\awbXbNl.exe
  C:\Windows\System\awbXbNl.exe
  2⤵
  PID:13684
- C:\Windows\System\fiXRZTJ.exe
  C:\Windows\System\fiXRZTJ.exe
  2⤵
  PID:13712
- C:\Windows\System\jlCTbmm.exe
  C:\Windows\System\jlCTbmm.exe
  2⤵
  PID:13732
- C:\Windows\System\GMmmxBU.exe
  C:\Windows\System\GMmmxBU.exe
  2⤵
  PID:13756
- C:\Windows\System\YKROJGB.exe
  C:\Windows\System\YKROJGB.exe
  2⤵
  PID:13788
- C:\Windows\System\XBQOFwo.exe
  C:\Windows\System\XBQOFwo.exe
  2⤵
  PID:13804
- C:\Windows\System\CqCLiAd.exe
  C:\Windows\System\CqCLiAd.exe
  2⤵
  PID:13828
- C:\Windows\System\ocQvgNp.exe
  C:\Windows\System\ocQvgNp.exe
  2⤵
  PID:13852
- C:\Windows\System\ZaDjQqW.exe
  C:\Windows\System\ZaDjQqW.exe
  2⤵
  PID:13872
- C:\Windows\System\BqaueAQ.exe
  C:\Windows\System\BqaueAQ.exe
  2⤵
  PID:13896
- C:\Windows\System\vPeRVde.exe
  C:\Windows\System\vPeRVde.exe
  2⤵
  PID:13916
- C:\Windows\System\NwvbJEb.exe
  C:\Windows\System\NwvbJEb.exe
  2⤵
  PID:13944
- C:\Windows\System\zcXzzuO.exe
  C:\Windows\System\zcXzzuO.exe
  2⤵
  PID:13972
- C:\Windows\System\AXPskTT.exe
  C:\Windows\System\AXPskTT.exe
  2⤵
  PID:13988
- C:\Windows\System\ZlDvXPF.exe
  C:\Windows\System\ZlDvXPF.exe
  2⤵
  PID:14004
- C:\Windows\System\otKIHUZ.exe
  C:\Windows\System\otKIHUZ.exe
  2⤵
  PID:14020
- C:\Windows\System\avQgJZs.exe
  C:\Windows\System\avQgJZs.exe
  2⤵
  PID:14048
- C:\Windows\System\maMkCMW.exe
  C:\Windows\System\maMkCMW.exe
  2⤵
  PID:14072
- C:\Windows\System\ChMGIzi.exe
  C:\Windows\System\ChMGIzi.exe
  2⤵
  PID:14100
- C:\Windows\System\eyOnVec.exe
  C:\Windows\System\eyOnVec.exe
  2⤵
  PID:14128
- C:\Windows\System\XLNDgtb.exe
  C:\Windows\System\XLNDgtb.exe
  2⤵
  PID:14152
- C:\Windows\System\bZXhdWx.exe
  C:\Windows\System\bZXhdWx.exe
  2⤵
  PID:14172
- C:\Windows\System\IwxkGAF.exe
  C:\Windows\System\IwxkGAF.exe
  2⤵
  PID:14204
- C:\Windows\System\nOnXNtC.exe
  C:\Windows\System\nOnXNtC.exe
  2⤵
  PID:14228
- C:\Windows\System\hDoIfTS.exe
  C:\Windows\System\hDoIfTS.exe
  2⤵
  PID:14248
- C:\Windows\System\zkELvir.exe
  C:\Windows\System\zkELvir.exe
  2⤵
  PID:14268
- C:\Windows\System\gJzXUKu.exe
  C:\Windows\System\gJzXUKu.exe
  2⤵
  PID:14292
- C:\Windows\System\gzfdOjO.exe
  C:\Windows\System\gzfdOjO.exe
  2⤵
  PID:14312
- C:\Windows\System\rGDMegl.exe
  C:\Windows\System\rGDMegl.exe
  2⤵
  PID:10692
- C:\Windows\System\LCuSdPq.exe
  C:\Windows\System\LCuSdPq.exe
  2⤵
  PID:10468
- C:\Windows\System\xAjKGtd.exe
  C:\Windows\System\xAjKGtd.exe
  2⤵
  PID:12844
- C:\Windows\System\auvcQRy.exe
  C:\Windows\System\auvcQRy.exe
  2⤵
  PID:12916
- C:\Windows\System\QshKmXW.exe
  C:\Windows\System\QshKmXW.exe
  2⤵
  PID:12968
- C:\Windows\System\JAHSuic.exe
  C:\Windows\System\JAHSuic.exe
  2⤵
  PID:11764
- C:\Windows\System\DWtVjyf.exe
  C:\Windows\System\DWtVjyf.exe
  2⤵
  PID:13112
- C:\Windows\System\HhtKJbT.exe
  C:\Windows\System\HhtKJbT.exe
  2⤵
  PID:3380
- C:\Windows\System\DjtCQnE.exe
  C:\Windows\System\DjtCQnE.exe
  2⤵
  PID:11852
- C:\Windows\System\bfGUSSj.exe
  C:\Windows\System\bfGUSSj.exe
  2⤵
  PID:8128
- C:\Windows\System\GSlaJpQ.exe
  C:\Windows\System\GSlaJpQ.exe
  2⤵
  PID:13168
- C:\Windows\System\ZNaJCeJ.exe
  C:\Windows\System\ZNaJCeJ.exe
  2⤵
  PID:12296
- C:\Windows\System\tYsFyHV.exe
  C:\Windows\System\tYsFyHV.exe
  2⤵
  PID:11936
- C:\Windows\System\gRtEtsc.exe
  C:\Windows\System\gRtEtsc.exe
  2⤵
  PID:12036
- C:\Windows\System\WrMacLT.exe
  C:\Windows\System\WrMacLT.exe
  2⤵
  PID:12084
- C:\Windows\System\WsYUtnt.exe
  C:\Windows\System\WsYUtnt.exe
  2⤵
  PID:11216
- C:\Windows\System\vpMqJiF.exe
  C:\Windows\System\vpMqJiF.exe
  2⤵
  PID:9824
- C:\Windows\System\ZLtlimH.exe
  C:\Windows\System\ZLtlimH.exe
  2⤵
  PID:12552
- C:\Windows\System\mLwxoul.exe
  C:\Windows\System\mLwxoul.exe
  2⤵
  PID:10012
- C:\Windows\System\lfVErsK.exe
  C:\Windows\System\lfVErsK.exe
  2⤵
  PID:12656
- C:\Windows\System\HcFShVx.exe
  C:\Windows\System\HcFShVx.exe
  2⤵
  PID:12532
- C:\Windows\System\imrujSD.exe
  C:\Windows\System\imrujSD.exe
  2⤵
  PID:10472
- C:\Windows\System\YRUzVQo.exe
  C:\Windows\System\YRUzVQo.exe
  2⤵
  PID:13464
- C:\Windows\System\FYOSkfE.exe
  C:\Windows\System\FYOSkfE.exe
  2⤵
  PID:12860
- C:\Windows\System\KDMaYpU.exe
  C:\Windows\System\KDMaYpU.exe
  2⤵
  PID:10932
- C:\Windows\System\PysmhTc.exe
  C:\Windows\System\PysmhTc.exe
  2⤵
  PID:14344
- C:\Windows\System\nyCjBYA.exe
  C:\Windows\System\nyCjBYA.exe
  2⤵
  PID:14360
- C:\Windows\System\mspbSoy.exe
  C:\Windows\System\mspbSoy.exe
  2⤵
  PID:14384
- C:\Windows\System\mKsgZST.exe
  C:\Windows\System\mKsgZST.exe
  2⤵
  PID:14416
- C:\Windows\System\CEjcbgL.exe
  C:\Windows\System\CEjcbgL.exe
  2⤵
  PID:14448
- C:\Windows\System\jrPJAfh.exe
  C:\Windows\System\jrPJAfh.exe
  2⤵
  PID:14464
- C:\Windows\System\aOiYiab.exe
  C:\Windows\System\aOiYiab.exe
  2⤵
  PID:14488
- C:\Windows\System\jgrYCJv.exe
  C:\Windows\System\jgrYCJv.exe
  2⤵
  PID:14504
- C:\Windows\System\cbSDlDN.exe
  C:\Windows\System\cbSDlDN.exe
  2⤵
  PID:14536
- C:\Windows\System\EpeBzVf.exe
  C:\Windows\System\EpeBzVf.exe
  2⤵
  PID:14556
- C:\Windows\System\VuMqFNt.exe
  C:\Windows\System\VuMqFNt.exe
  2⤵
  PID:14576
- C:\Windows\System\BnyITFw.exe
  C:\Windows\System\BnyITFw.exe
  2⤵
  PID:14916
- C:\Windows\System\ytIXWio.exe
  C:\Windows\System\ytIXWio.exe
  2⤵
  PID:14944
- C:\Windows\System\eMIwfJd.exe
  C:\Windows\System\eMIwfJd.exe
  2⤵
  PID:14972
- C:\Windows\System\IYwcRmW.exe
  C:\Windows\System\IYwcRmW.exe
  2⤵
  PID:14988
- C:\Windows\System\fSvjGLQ.exe
  C:\Windows\System\fSvjGLQ.exe
  2⤵
  PID:15004
- C:\Windows\System\uOMqvSN.exe
  C:\Windows\System\uOMqvSN.exe
  2⤵
  PID:15020
- C:\Windows\System\iIZkUvh.exe
  C:\Windows\System\iIZkUvh.exe
  2⤵
  PID:15036
- C:\Windows\System\uaAHnNC.exe
  C:\Windows\System\uaAHnNC.exe
  2⤵
  PID:15052
- C:\Windows\System\xhuRAYh.exe
  C:\Windows\System\xhuRAYh.exe
  2⤵
  PID:15072
- C:\Windows\System\FBDQKYL.exe
  C:\Windows\System\FBDQKYL.exe
  2⤵
  PID:15092
- C:\Windows\System\LuRaEbf.exe
  C:\Windows\System\LuRaEbf.exe
  2⤵
  PID:15108
- C:\Windows\System\zzuxePi.exe
  C:\Windows\System\zzuxePi.exe
  2⤵
  PID:15124
- C:\Windows\System\fQifflL.exe
  C:\Windows\System\fQifflL.exe
  2⤵
  PID:15144
- C:\Windows\System\xcjPTvQ.exe
  C:\Windows\System\xcjPTvQ.exe
  2⤵
  PID:15160
- C:\Windows\System\tSkQPuJ.exe
  C:\Windows\System\tSkQPuJ.exe
  2⤵
  PID:15180
- C:\Windows\System\MGUCers.exe
  C:\Windows\System\MGUCers.exe
  2⤵
  PID:15196
- C:\Windows\System\YksASro.exe
  C:\Windows\System\YksASro.exe
  2⤵
  PID:15224
- C:\Windows\System\bTFgang.exe
  C:\Windows\System\bTFgang.exe
  2⤵
  PID:15248
- C:\Windows\System\HvdbSQp.exe
  C:\Windows\System\HvdbSQp.exe
  2⤵
  PID:15272
- C:\Windows\System\lKpCtqn.exe
  C:\Windows\System\lKpCtqn.exe
  2⤵
  PID:15300
- C:\Windows\System\LJRHKqh.exe
  C:\Windows\System\LJRHKqh.exe
  2⤵
  PID:15340
- C:\Windows\System\NeAVXOn.exe
  C:\Windows\System\NeAVXOn.exe
  2⤵
  PID:15356
- C:\Windows\System\GYqLCzF.exe
  C:\Windows\System\GYqLCzF.exe
  2⤵
  PID:11228
- C:\Windows\System\NBQYUPk.exe
  C:\Windows\System\NBQYUPk.exe
  2⤵
  PID:13752
- C:\Windows\System\ZSdawHf.exe
  C:\Windows\System\ZSdawHf.exe
  2⤵
  PID:13860
- C:\Windows\System\NEwetdk.exe
  C:\Windows\System\NEwetdk.exe
  2⤵
  PID:12328
- C:\Windows\System\ZKVKEwO.exe
  C:\Windows\System\ZKVKEwO.exe
  2⤵
  PID:12400
- C:\Windows\System\HTpoQts.exe
  C:\Windows\System\HTpoQts.exe
  2⤵
  PID:12436
- C:\Windows\System\pSeAYEZ.exe
  C:\Windows\System\pSeAYEZ.exe
  2⤵
  PID:11668
- C:\Windows\System\SGoXmcC.exe
  C:\Windows\System\SGoXmcC.exe
  2⤵
  PID:11872
- C:\Windows\System\bKzAAAb.exe
  C:\Windows\System\bKzAAAb.exe
  2⤵
  PID:12044
- C:\Windows\System\alrLgaz.exe
  C:\Windows\System\alrLgaz.exe
  2⤵
  PID:13332
- C:\Windows\System\vfLcgkh.exe
  C:\Windows\System\vfLcgkh.exe
  2⤵
  PID:12240
- C:\Windows\System\iVhCCeo.exe
  C:\Windows\System\iVhCCeo.exe
  2⤵
  PID:13532
- C:\Windows\System\XdLYWXP.exe
  C:\Windows\System\XdLYWXP.exe
  2⤵
  PID:11028
- C:\Windows\System\VqsewvS.exe
  C:\Windows\System\VqsewvS.exe
  2⤵
  PID:13696
- C:\Windows\System\NpJyNfd.exe
  C:\Windows\System\NpJyNfd.exe
  2⤵
  PID:14584
- C:\Windows\System\hacGJeT.exe
  C:\Windows\System\hacGJeT.exe
  2⤵
  PID:14476
- C:\Windows\System\FlgleaP.exe
  C:\Windows\System\FlgleaP.exe
  2⤵
  PID:13492
- C:\Windows\System\NXaZjKf.exe
  C:\Windows\System\NXaZjKf.exe
  2⤵
  PID:12484
- C:\Windows\System\cUFwKjS.exe
  C:\Windows\System\cUFwKjS.exe
  2⤵
  PID:13956
- C:\Windows\System\BfReugC.exe
  C:\Windows\System\BfReugC.exe
  2⤵
  PID:13092
- C:\Windows\System\NYtRrcb.exe
  C:\Windows\System\NYtRrcb.exe
  2⤵
  PID:13248
- C:\Windows\System\EqqaXpF.exe
  C:\Windows\System\EqqaXpF.exe
  2⤵
  PID:13288
- C:\Windows\System\nGTvPtD.exe
  C:\Windows\System\nGTvPtD.exe
  2⤵
  PID:11320
- C:\Windows\System\gAoZDqE.exe
  C:\Windows\System\gAoZDqE.exe
  2⤵
  PID:14096
- C:\Windows\System\TrgRJOE.exe
  C:\Windows\System\TrgRJOE.exe
  2⤵
  PID:8372
- C:\Windows\System\IKBwGKc.exe
  C:\Windows\System\IKBwGKc.exe
  2⤵
  PID:10236
- C:\Windows\System\JhAaXnt.exe
  C:\Windows\System\JhAaXnt.exe
  2⤵
  PID:14260
- C:\Windows\System\qIYHKaA.exe
  C:\Windows\System\qIYHKaA.exe
  2⤵
  PID:11620
- C:\Windows\System\SXYJBOM.exe
  C:\Windows\System\SXYJBOM.exe
  2⤵
  PID:13096
- C:\Windows\System\aoeKoQC.exe
  C:\Windows\System\aoeKoQC.exe
  2⤵
  PID:10552
- C:\Windows\System\leqIORZ.exe
  C:\Windows\System\leqIORZ.exe
  2⤵
  PID:13412
- C:\Windows\System\AhmtHTt.exe
  C:\Windows\System\AhmtHTt.exe
  2⤵
  PID:14356
- C:\Windows\System\LPIwptu.exe
  C:\Windows\System\LPIwptu.exe
  2⤵
  PID:14404
- C:\Windows\System\FnukoDl.exe
  C:\Windows\System\FnukoDl.exe
  2⤵
  PID:14440
- C:\Windows\System\duZjBAm.exe
  C:\Windows\System\duZjBAm.exe
  2⤵
  PID:14460
- C:\Windows\System\YDpjHTU.exe
  C:\Windows\System\YDpjHTU.exe
  2⤵
  PID:13776
- C:\Windows\System\DGLTBkn.exe
  C:\Windows\System\DGLTBkn.exe
  2⤵
  PID:13840
- C:\Windows\System\RWvatQN.exe
  C:\Windows\System\RWvatQN.exe
  2⤵
  PID:13888
- C:\Windows\System\ZUBwqCI.exe
  C:\Windows\System\ZUBwqCI.exe
  2⤵
  PID:10736
- C:\Windows\System\wXwCtZl.exe
  C:\Windows\System\wXwCtZl.exe
  2⤵
  PID:14240
- C:\Windows\System\CuFamQF.exe
  C:\Windows\System\CuFamQF.exe
  2⤵
  PID:14092
- C:\Windows\System\RoukxsG.exe
  C:\Windows\System\RoukxsG.exe
  2⤵
  PID:14980
- C:\Windows\System\gEjtnOn.exe
  C:\Windows\System\gEjtnOn.exe
  2⤵
  PID:15172
- C:\Windows\System\FrXAxAO.exe
  C:\Windows\System\FrXAxAO.exe
  2⤵
  PID:14080
- C:\Windows\System\rehTMHS.exe
  C:\Windows\System\rehTMHS.exe
  2⤵
  PID:15380
- C:\Windows\System\cCMOXsM.exe
  C:\Windows\System\cCMOXsM.exe
  2⤵
  PID:15404
- C:\Windows\System\gqRCciV.exe
  C:\Windows\System\gqRCciV.exe
  2⤵
  PID:15432
- C:\Windows\System\vDowKyz.exe
  C:\Windows\System\vDowKyz.exe
  2⤵
  PID:15456
- C:\Windows\System\PZIQwad.exe
  C:\Windows\System\PZIQwad.exe
  2⤵
  PID:15488
- C:\Windows\System\vIswXyE.exe
  C:\Windows\System\vIswXyE.exe
  2⤵
  PID:15508
- C:\Windows\System\hyDyLKo.exe
  C:\Windows\System\hyDyLKo.exe
  2⤵
  PID:15524
- C:\Windows\System\ieSZVsW.exe
  C:\Windows\System\ieSZVsW.exe
  2⤵
  PID:15560
- C:\Windows\System\StUkUmK.exe
  C:\Windows\System\StUkUmK.exe
  2⤵
  PID:15584
- C:\Windows\System\JxvCZJV.exe
  C:\Windows\System\JxvCZJV.exe
  2⤵
  PID:15604
- C:\Windows\System\ZJmdwOy.exe
  C:\Windows\System\ZJmdwOy.exe
  2⤵
  PID:15628
- C:\Windows\System\ttuirUy.exe
  C:\Windows\System\ttuirUy.exe
  2⤵
  PID:15668
- C:\Windows\System\iaXredc.exe
  C:\Windows\System\iaXredc.exe
  2⤵
  PID:15684
- C:\Windows\System\zwOsyJR.exe
  C:\Windows\System\zwOsyJR.exe
  2⤵
  PID:15708
- C:\Windows\System\aRFDBBD.exe
  C:\Windows\System\aRFDBBD.exe
  2⤵
  PID:15732
- C:\Windows\System\duPzMpW.exe
  C:\Windows\System\duPzMpW.exe
  2⤵
  PID:15764
- C:\Windows\System\WJhdxfx.exe
  C:\Windows\System\WJhdxfx.exe
  2⤵
  PID:15800
- C:\Windows\System\gwqncWn.exe
  C:\Windows\System\gwqncWn.exe
  2⤵
  PID:15824
- C:\Windows\System\BTlQspI.exe
  C:\Windows\System\BTlQspI.exe
  2⤵
  PID:15856
- C:\Windows\System\hrXjtNK.exe
  C:\Windows\System\hrXjtNK.exe
  2⤵
  PID:15892
- C:\Windows\System\RGJhFyV.exe
  C:\Windows\System\RGJhFyV.exe
  2⤵
  PID:15920
- C:\Windows\System\KEJyYoc.exe
  C:\Windows\System\KEJyYoc.exe
  2⤵
  PID:15944
- C:\Windows\System\WzbeoAk.exe
  C:\Windows\System\WzbeoAk.exe
  2⤵
  PID:15968
- C:\Windows\System\jKJwJkC.exe
  C:\Windows\System\jKJwJkC.exe
  2⤵
  PID:15984
- C:\Windows\System\hjqCZoP.exe
  C:\Windows\System\hjqCZoP.exe
  2⤵
  PID:16008
- C:\Windows\System\yFhWFGS.exe
  C:\Windows\System\yFhWFGS.exe
  2⤵
  PID:16032
- C:\Windows\System\BuYBraP.exe
  C:\Windows\System\BuYBraP.exe
  2⤵
  PID:16048
- C:\Windows\System\LqKOsnr.exe
  C:\Windows\System\LqKOsnr.exe
  2⤵
  PID:16072
- C:\Windows\System\ZOcMICt.exe
  C:\Windows\System\ZOcMICt.exe
  2⤵
  PID:16100
- C:\Windows\System\ppnURIH.exe
  C:\Windows\System\ppnURIH.exe
  2⤵
  PID:16124
- C:\Windows\System\ncnEZJI.exe
  C:\Windows\System\ncnEZJI.exe
  2⤵
  PID:16148
- C:\Windows\System\AvgZMHM.exe
  C:\Windows\System\AvgZMHM.exe
  2⤵
  PID:16168
- C:\Windows\System\CsUXxJV.exe
  C:\Windows\System\CsUXxJV.exe
  2⤵
  PID:16188
- C:\Windows\System\iNodOeO.exe
  C:\Windows\System\iNodOeO.exe
  2⤵
  PID:16216
- C:\Windows\System\enFvDNF.exe
  C:\Windows\System\enFvDNF.exe
  2⤵
  PID:16244
- C:\Windows\System\VNdmgpN.exe
  C:\Windows\System\VNdmgpN.exe
  2⤵
  PID:16280
- C:\Windows\System\ETFzZnQ.exe
  C:\Windows\System\ETFzZnQ.exe
  2⤵
  PID:16308
- C:\Windows\System\HNqPFUq.exe
  C:\Windows\System\HNqPFUq.exe
  2⤵
  PID:16328
- C:\Windows\System\fPmecPf.exe
  C:\Windows\System\fPmecPf.exe
  2⤵
  PID:16348
- C:\Windows\System\GvSjLAN.exe
  C:\Windows\System\GvSjLAN.exe
  2⤵
  PID:16380
- C:\Windows\System\beSmvXt.exe
  C:\Windows\System\beSmvXt.exe
  2⤵
  PID:11616
- C:\Windows\System\efyWkEj.exe
  C:\Windows\System\efyWkEj.exe
  2⤵
  PID:13260
- C:\Windows\System\HKKVqby.exe
  C:\Windows\System\HKKVqby.exe
  2⤵
  PID:13100
- C:\Windows\System\dJbNxUM.exe
  C:\Windows\System\dJbNxUM.exe
  2⤵
  PID:11896
- C:\Windows\System\YuVEllj.exe
  C:\Windows\System\YuVEllj.exe
  2⤵
  PID:12500
- C:\Windows\System\ZyxZiPU.exe
  C:\Windows\System\ZyxZiPU.exe
  2⤵
  PID:9104
- C:\Windows\System\oYQpvFI.exe
  C:\Windows\System\oYQpvFI.exe
  2⤵
  PID:14804
- C:\Windows\System\GkHnvTE.exe
  C:\Windows\System\GkHnvTE.exe
  2⤵
  PID:14520
- C:\Windows\System\DlUkaCo.exe
  C:\Windows\System\DlUkaCo.exe
  2⤵
  PID:14592
- C:\Windows\System\UPMUemv.exe
  C:\Windows\System\UPMUemv.exe
  2⤵
  PID:15084
- C:\Windows\System\iDHXRUi.exe
  C:\Windows\System\iDHXRUi.exe
  2⤵
  PID:14300
- C:\Windows\System\DcHtlUG.exe
  C:\Windows\System\DcHtlUG.exe
  2⤵
  PID:14952
- C:\Windows\System\pSogHmk.exe
  C:\Windows\System\pSogHmk.exe
  2⤵
  PID:15012
- C:\Windows\System\zjaDOZG.exe
  C:\Windows\System\zjaDOZG.exe
  2⤵
  PID:16400
- C:\Windows\System\sJUCNSF.exe
  C:\Windows\System\sJUCNSF.exe
  2⤵
  PID:16420
- C:\Windows\System\qgJswmS.exe
  C:\Windows\System\qgJswmS.exe
  2⤵
  PID:16440
- C:\Windows\System\mamuGTn.exe
  C:\Windows\System\mamuGTn.exe
  2⤵
  PID:16464
- C:\Windows\System\NnmYkRj.exe
  C:\Windows\System\NnmYkRj.exe
  2⤵
  PID:16480
- C:\Windows\System\HcnVbib.exe
  C:\Windows\System\HcnVbib.exe
  2⤵
  PID:16500
- C:\Windows\System\bzSJlhk.exe
  C:\Windows\System\bzSJlhk.exe
  2⤵
  PID:16520
- C:\Windows\System\hRlybGX.exe
  C:\Windows\System\hRlybGX.exe
  2⤵
  PID:16536
- C:\Windows\System\jREjeVQ.exe
  C:\Windows\System\jREjeVQ.exe
  2⤵
  PID:16556
- C:\Windows\System\IcKRdjF.exe
  C:\Windows\System\IcKRdjF.exe
  2⤵
  PID:16576
- C:\Windows\System\GOnwzvI.exe
  C:\Windows\System\GOnwzvI.exe
  2⤵
  PID:16592
- C:\Windows\System\npWTRCE.exe
  C:\Windows\System\npWTRCE.exe
  2⤵
  PID:16608
- C:\Windows\System\InRWoih.exe
  C:\Windows\System\InRWoih.exe
  2⤵
  PID:16636
- C:\Windows\System\YOOuKrX.exe
  C:\Windows\System\YOOuKrX.exe
  2⤵
  PID:16664
- C:\Windows\System\rYTOGIc.exe
  C:\Windows\System\rYTOGIc.exe
  2⤵
  PID:16680
- C:\Windows\System\ZzdoGpJ.exe
  C:\Windows\System\ZzdoGpJ.exe
  2⤵
  PID:16700
- C:\Windows\System\SCTKftt.exe
  C:\Windows\System\SCTKftt.exe
  2⤵
  PID:16720
- C:\Windows\System\TmaWRMP.exe
  C:\Windows\System\TmaWRMP.exe
  2⤵
  PID:16748
- C:\Windows\System\IOeOPgU.exe
  C:\Windows\System\IOeOPgU.exe
  2⤵
  PID:16780
- C:\Windows\System\vVPbtMq.exe
  C:\Windows\System\vVPbtMq.exe
  2⤵
  PID:16796
- C:\Windows\System\chuWrAc.exe
  C:\Windows\System\chuWrAc.exe
  2⤵
  PID:16824
- C:\Windows\System\uWFjqVi.exe
  C:\Windows\System\uWFjqVi.exe
  2⤵
  PID:16848
- C:\Windows\System\vCYnzQC.exe
  C:\Windows\System\vCYnzQC.exe
  2⤵
  PID:16864
- C:\Windows\System\sLnmnxv.exe
  C:\Windows\System\sLnmnxv.exe
  2⤵
  PID:16892
- C:\Windows\System\slIDutI.exe
  C:\Windows\System\slIDutI.exe
  2⤵
  PID:16924
- C:\Windows\System\pLMaHTj.exe
  C:\Windows\System\pLMaHTj.exe
  2⤵
  PID:16952
- C:\Windows\System\UfOJYQA.exe
  C:\Windows\System\UfOJYQA.exe
  2⤵
  PID:16984
- C:\Windows\System\IjFgElH.exe
  C:\Windows\System\IjFgElH.exe
  2⤵
  PID:17008
- C:\Windows\System\lDFnKyG.exe
  C:\Windows\System\lDFnKyG.exe
  2⤵
  PID:17032
- C:\Windows\System\tlcGAjU.exe
  C:\Windows\System\tlcGAjU.exe
  2⤵
  PID:17064
- C:\Windows\System\PYGSjVj.exe
  C:\Windows\System\PYGSjVj.exe
  2⤵
  PID:17084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DklAbbi.exe

Filesize
1021KB

MD5
8671145bd571cea5759f26769e2101fe

SHA1
b3f89cbb291eea63238863f603d5fe70fe066a34

SHA256
add8afe3805458727b4a64d4f3ad765dc5d2c6434ca414352880957a71536e09

SHA512
e79086ddc258862bec35b8efeaefc26517eb31e0824ca11050e47d43a059b0a88574b7dcdb4420a75fa858336385b9740fa1387ff439a1096818e85755605f92

Download Submit
C:\Windows\System\GYWHVvW.exe

Filesize
1019KB

MD5
3372192d8bbe90096b69ac445ea60292

SHA1
7c181c1dbc59fea8bb26eb487cf6fcb7c9cd5e66

SHA256
51e45fec08c27d966dc66051079e5992be65fae920d7947d727649b1304be678

SHA512
220340e7e7b4435f12ffc0af44eefd694f2ccaf7a8f0629c49ffc321af8a77143e8676d542898461430725ff0d644b77284e4f5baf7dbdc42329e0375a063b59

Download Submit
C:\Windows\System\HgQTDBn.exe

Filesize
1020KB

MD5
02bedb85cf74b3bf94836212233bcec0

SHA1
7facd1c47a1dc489cd37d80208ab4615543c5286

SHA256
3eddb4a5671be628802b38912174a5a7175c2870492ff4142781d0f2e3e9e353

SHA512
a70839d700afeb6b28d3db961cd9340c9bb9790dfaad2cc1bd740b9d33e780280dbe497fe829293525d2d393503ccac1a38a1a19ad78c611de3fe45742db2ad2

Download Submit
C:\Windows\System\IyvqHJZ.exe

Filesize
1021KB

MD5
8dc3c7fde44b3705630b5f92fcea9696

SHA1
462302f2933b5a39f1cddd1e1ba6c1f441a529dc

SHA256
c60d2b4cd3d643f27706a478ccdd0cdcd3517150f81669c74b4ee028d690dad6

SHA512
95cac30079f1a614ebcae29d1391dd8d6512076e873565cbdbef89c13d21de8335411ceea78a9f6a5cd321a623aa5e50a32c2e45752a7f7185f17eab048d16d2

Download Submit
C:\Windows\System\JDDdkOw.exe

Filesize
1.0MB

MD5
26f213532f89539d13d6a56278f0a0a4

SHA1
4847ad74c5a37f8eec44e7a3c91d210d6e7bce6a

SHA256
4ac1ac6bbf037e48911ec9ea56e7b1625dd7659e1d11b5aa520410558a6aa05f

SHA512
7901d9be08b1156926337eaff265ab49527ad84561ab984f9d0ae11a4d7f06705d7907bbcb8971bbd9c0c37284e69c49bbc5c4f891b93d93e3c22f718b64f33b

Download Submit
C:\Windows\System\MAZMYFM.exe

Filesize
1.0MB

MD5
2eacd559fbb25323c8c01a7c6a7f63dd

SHA1
5b756964a7cc0acd27ea67d4b0cebf7eb939c773

SHA256
f0835e39b52cada425885afad262ab6cfe1769e39538d2dab5962666994d660b

SHA512
ca4d238639e751dafd77bde4cc90cc34e488d1f7209e34f08a141c9cc9f77fb5add489c443bfd399a0e7ead986b4bac5f51b30ba793c79d5400f986b4c0fa2bf

Download Submit
C:\Windows\System\MbzbJYL.exe

Filesize
1019KB

MD5
e201f202501a61251cddc416452ed9dd

SHA1
633aa0943392c36cb96df21df62074abb9a6d1d8

SHA256
bca1c596be2a53760d6dc92e8859fdd9055ce9c093021c1182590f6a33c72af7

SHA512
825a64c6d5ea361b62cb53f27b7454b1f6aad75c35537ab455e92a992118e73731cd7af2b7e724b42adebd013c9968f45730ea7ba6270f2a5a7f744d8e1b6bb4

Download Submit
C:\Windows\System\MkqzCbD.exe

Filesize
1023KB

MD5
b2c9622a07675d1b0a5b9bae624e335d

SHA1
dde301f84b8d0edc53c757c3a6cb2477a37e2fa8

SHA256
bafb3ee9c2ac403cfdfa8898a59774cf8f8567189a6ffc44eb726b327450bb55

SHA512
2ea187a27971e47fba70bcd19825bffc1c21ea9139a40d16e6e31e5a094790761c235702236fb2b158dc1a7a623aae54943cbc3cde8637e9a8a6ee6712c7e33a

Download Submit
C:\Windows\System\NJnFBcS.exe

Filesize
1023KB

MD5
2d1a54f7ae484d82ad17b82b1b0e4914

SHA1
0afd86d1d7055394ad0d5210557721c0cb78c983

SHA256
45e2729d82dbf46f1040347fa53553f62338576ac409b789296fb933614a5f30

SHA512
10a45eb5b3bd2c714a8bdf3496d5a5d4221642184649a0e5554f81b1ba5b38f7fa295a1b002168bc8802238c61e1a503e2893503e15aefd2d0d9cbe45934c685

Download Submit
C:\Windows\System\NMBjhne.exe

Filesize
1.0MB

MD5
84a20cf6528d53620b4be35d17b2977f

SHA1
3716c4c1c08c20eb7a9550b39adeb13f00f3fbc4

SHA256
a3b3432f56316170dc6d3209fbdcaa488c7c4c91489a74f103698c91a96b05cd

SHA512
98f96678592725af6d565049effffeafcd3cb7f791f94e00197d627413d5f9e916c0464cb5c36a31683e8f336a1bd687bd59528d77769531be4429a93c490037

Download Submit
C:\Windows\System\NmzNokU.exe

Filesize
1019KB

MD5
6c20df3d61e13852d5c488d18ea071fb

SHA1
ff680f3e6d0b4e500e3ba344d7d93e20be1949fc

SHA256
1c9a816eaf25341fdb6662d95786f472407980b23869ec33070879e64dff2217

SHA512
ed12e0bdc6aab63d7512841f08294d9f6e91764275f68459635eba694a67ac0011c481630c42d0eba2be13ff9948e65c9088aba1ac61505b596e1d97798d1f4e

Download Submit
C:\Windows\System\OLGKpoU.exe

Filesize
1.0MB

MD5
3440255daa3d06245f492a232c82aa08

SHA1
54588823b6fcde7643b3f73c7b0790159dd63b3f

SHA256
684d3f03e7e751c22f374d0406cc06298d873d4e96e1b9da3e6514ed4ef0ebf0

SHA512
c83107ecab500a7233150e75659762dc7230c94b87fdeb3b60dfbcb63efe524076e3bb707d27b6168494639541c1806149b606b18a8b02c76b8204f0a64fd88b

Download Submit
C:\Windows\System\PQvKjDX.exe

Filesize
1.0MB

MD5
eb75751d5fbb2b4e998e7fdc8f3ec225

SHA1
b25faaa6c6238e496f784a8579f03d4ac6f65e43

SHA256
99ac8cc4b3eeb3a5ff355ca47a347331aafe650d87a0bd57eb3d413f0a303b6b

SHA512
0e7270ce0ee22fcd60cd75a2589391a1f59e94a699d97816efba384404c2a7cd07c48554ccc943e95f20ce182c9d0e0a198ab1be1d61f35a13c54526cc8d3f1f

Download Submit
C:\Windows\System\PcZUKgA.exe

Filesize
1021KB

MD5
4654ebdaf039e5f152f7efb004bf0448

SHA1
4b60e75764fdc0d42824842e10203c013ba925d1

SHA256
81d280e43e0f0557435c7832f3c5e5ac4f7652bfab0b299c6e04b6a169422b61

SHA512
b03870a2e9954609cda89da5ce62915d87ed0497080b63f227fe70abf6db589c45ca8e5b12fd67e8d361470e9bed1db49199862d0a1e219ce0534bc6ba8a7c03

Download Submit
C:\Windows\System\SSdGSZW.exe

Filesize
1.0MB

MD5
faa070f4fe13f4450efe3d1731417145

SHA1
d9097e503acfd5059a1c3a1684c0fbb3de2c9f5c

SHA256
44ea9620f8409f51dc9dd44346d1c1c1b96d90c6bf54bfc2a1b15013b530705e

SHA512
7a89fd46b06c88df2dc749801f61c950032aa06e20a4fdb66b590a3d014de467d468c43b6e5ee5aacef769fa955d1d3afb71101a382003f335e61dd4f93ea2ae

Download Submit
C:\Windows\System\Szjjhos.exe

Filesize
1.0MB

MD5
0096abe62cc93958f99437dde8119b60

SHA1
9c26d50839d216a3dbf170ca95ce390c151554b7

SHA256
9805b8dcfc4da0f30b161706a25f41f174d06f156d9e082154a76969e6f95274

SHA512
2ff4e5dd538c2bf222936d8552a8d5f86410beb476dfc5dffa37bddc6bc7779964bf1c92e711e9efc45daf304b69a95bd0072e93493bb14fba66278266885abb

Download Submit
C:\Windows\System\UMTPCID.exe

Filesize
1022KB

MD5
feccdc09edb437318d3a70b02e17b37b

SHA1
7c0ac05a21bda8b3bdf00e1f8e1326331a58f027

SHA256
e6237d684c7b6aaf1897a54660dcb6cd0b8b7e314feb359b8ba28674c3f95c48

SHA512
59bac169767d4fc855fdb0c1012d19b3d87521b61932149b45ccd42319e9bdcf0680cfa717657ac0625cc03ddcbdebd01d05a941f6babd294f5adb14c9a21721

Download Submit
C:\Windows\System\VYnatRX.exe

Filesize
1.0MB

MD5
e5b7e441981082b9ee3db1dcbbaa2807

SHA1
54dd96404029d4499690d815586ba518cc7f02d2

SHA256
47ebaf429026dbb388833c2b6db0dfbaa9f18203e3193c76affa7a929a07ddf8

SHA512
08b871a0db06c293000d76b3c8344ba2b7004f9b1d24fb6b2cc3b2adf8140c52ccf7191532133bee311087adc4e9c915b0d83ac3ecff02cb932785fccaeab5ed

Download Submit
C:\Windows\System\VbczLiq.exe

Filesize
1.0MB

MD5
a718707cf6d72f5f0196cb3c15010441

SHA1
de0a90471f9395a151c5f067bf8a5ae78bd28a17

SHA256
df8363772dc0871c4cf93388e573e9fd6bdb4eca55eb5c4e1010d72559009707

SHA512
89d45c23b4e427d0e966a08bfcff3cbde1e17be448105e99e762ac87b88b46aba695ded2f81cc3fb4eb96bd722b58e8c5735d667a6d3a1845d02c2f268acee1b

Download Submit
C:\Windows\System\XJRPwZj.exe

Filesize
1.0MB

MD5
205b2b2d27dd75d648f3466730e7b2e0

SHA1
a4799ff630ea9e5b1846833087c44e0957f8bce4

SHA256
69121c832845890c86e110ef9210512be1ccac71648abf33228b754514f640ce

SHA512
be3240572507a1bb5501563060f5155e87902bd1ac810b79fe59b488c44113234e1ea0067988e8c9f3ae88e067e721435a669cc1fabd9746899af7e05e81097b

Download Submit
C:\Windows\System\XeZvrHs.exe

Filesize
1020KB

MD5
f19fd77c4ff27b39f3887115270428dd

SHA1
ccaba7b66726ab8104bc056e03431d18581f418c

SHA256
c5e59b029f4d908c1c7694e0c1eff77a9093017db9a634e3835f004e2f2a0c95

SHA512
6899473ee51648396a011de5841cd7cf151b978874d3c64f040525af8a574ca605e6952249ecefdd08d36d79c63f2311c87c5877290039b56887bb25f0dae029

Download Submit
C:\Windows\System\XqawuQw.exe

Filesize
1.0MB

MD5
4179fd9f44c614589bad931eaec392d3

SHA1
979519efb2f7de3aa409c419ed6f7fa9645ebe69

SHA256
d9627bfd9b46f694a6bc0e7b9adb858b8f8f236c831b9095b16feb717a2bb3ce

SHA512
a1b21d518c0102153f260b974bc9bf0d0ef1aaeaad7414aff6e016608bf4a760c761244ec92ec059f941697f9da30689d94f0f1d24e3b3b23e0e08de82719a96

Download Submit
C:\Windows\System\ZPhtgHP.exe

Filesize
1021KB

MD5
5f4fa7d7b63718ec5c8dff804303ca63

SHA1
8cf00ff2874100d5a490c18ce70a5fd09d007e99

SHA256
77264e533d3fdadf1a62e5b90a42b681ca39f5c9cedd9de23ac3c46d00928832

SHA512
74d853e903d47cb4a77ecc8b91bfb2a28bf93a4348d1153276800ebca7417dd262ebb7598dddc615dc35b1070913a4706cfc582924417323636728e01f0eaba6

Download Submit
C:\Windows\System\afyFRRq.exe

Filesize
1.0MB

MD5
ce7ccf4673d1a806ce80042f0430e280

SHA1
3cffdfb80976607fba539ce797b34b018687fbac

SHA256
84e1ed5e6b65d2a9461a15768255f7cb5e099125c944a53e4bfbc6520c4751f8

SHA512
586c35ff814b7a98ec9fc25f678c9f6c6bcf08a3fc8bce7cec9e2c61d6215dda50da93de4dc1ef3abf6447347deac1a5b2e881004d423a43a4eb8079019348c3

Download Submit
C:\Windows\System\cJEYdKm.exe

Filesize
1022KB

MD5
0689b5f516aa45db39b3fccc2e0b7469

SHA1
a9bc652d74ae28b201b0ec2746974ab23b6fa712

SHA256
c83e7a6e4e9860d5d65ec454ffbaef929f68badb71a71b1a073a576e10d753bc

SHA512
9ab2cd19187cacd9b2c750a675e832a195a59281d4bd4e356a8fe497e3462dea338da868ed50fdc8f76d724e4f2b750c5d612808a20e5d7d5bccb59dcd3dc9bf

Download Submit
C:\Windows\System\gDeXJsr.exe

Filesize
1023KB

MD5
71ee902c32c58421a47f1dbae7daeca3

SHA1
916504ec10124a209cf68332658ccf4c792225fe

SHA256
0140b66a1f47ecf42dd3ea7434851657f1f22230d0399547931dd1d4d7d94f4e

SHA512
d410e88de2d48ec073b112d020ec1937f1492132bc68789b36b722f2e17b601b8be37704c2ac32c9ccd84410c26815792154e353a6efd0aec851960c3f091fec

Download Submit
C:\Windows\System\gadGAAn.exe

Filesize
1022KB

MD5
dd2432b69422f191e4099b56251155c6

SHA1
679b08adc641cd71f7737a3b8c2cb5d059b6dd9f

SHA256
c206455138403c0d12da662819309b29253e6091dceacd60f6dd7cf5dd6816a5

SHA512
e7999198a03f6ffba821dff7367657192115852c3b8c0d539a172be7b608d716fa190aaf45b11d7669acc367d03c4b66cddb175374cfd499282e40436a4d7d2a

Download Submit
C:\Windows\System\hFNnoKL.exe

Filesize
1.0MB

MD5
5aa277f24742782058424233a27bc8b1

SHA1
6ddb1026702f4f0f0ccac11ccd57dd045d819659

SHA256
c004feac9105bd73fb2ffbd2aed44e58a482d6d8c8f5bb9ddec19df25a496fb8

SHA512
2460506f2c60d2578304722f72d85904ef0bdb453b118c65bc4afa80a209ec027bbd6ff612232193b695261a49da409dc068d85fb47b44e6267774f4eb2a80e3

Download Submit
C:\Windows\System\iZfOLOH.exe

Filesize
1.0MB

MD5
14ecc44e50f683bf623605892e87b78e

SHA1
d5e2c48de86a870c409b94b9f3e1ec3d515a3040

SHA256
48f3ea37799e28a1cc67e900bd481f08875345bab1a1c8a3bd4d459483c1dd64

SHA512
73db7db294ce2a41ec52ebbe94e9371acf6cd2358bfa2536a80ab7af4f7e7f2269a0652a24f94e6ab0d21f6b30609f205840d0e7b9aa223d9b37be5047ab2feb

Download Submit
C:\Windows\System\jBJNZNO.exe

Filesize
1.0MB

MD5
2d02fa60d05c7bf19c7f8d3e3f3f337e

SHA1
08b4950445811ec304e090abf404519dd20b22d4

SHA256
5e871fb5228d86e3ffc2fa9a993ba8d5fb587efb43e306d6300d043369a823dc

SHA512
82e12df69f4164613329932dbd8c8f9863375a00416f368d706b46314fcd9ecfd9b8aa03f7f5328ff7b341ba12549332d5a73e353d6f0dfa5037a553822cdd93

Download Submit
C:\Windows\System\jdZkmzF.exe

Filesize
1020KB

MD5
29a23b745df3fafb35087ccf25087231

SHA1
b7add85b7f301077b5359f09843813485f2a0ae5

SHA256
4a2f32cecd4fa34d2c82d4b89698f5c89af23514c335e2f94a635c23864d62ab

SHA512
8ea0c551d2ebf5158307aed6e9358a3e263fc58e2f0442b6273bdb1390e48ce02796fd86dbab5e820113a5a0bba1d36e2d1e4b136c5d72e2d6eb812289b3668d

Download Submit
C:\Windows\System\mQUAkGe.exe

Filesize
1022KB

MD5
e7b32be1fe0e8b04ee0fe23432d474cf

SHA1
5e7aa2cc672a9a758e610edf2ea16a97f4134d1a

SHA256
de0bf90b190c6d49bc476a0afc5d1abe74876717144ea8a2b4bbc7bb8e914569

SHA512
a16721eccfee3dc8cc06617dcccdd9d59cd376e9d9d469297e498ddb7af7635e5f3a74a97a8acd10c4e3cc734af446620dc613106c9ccd4d9d32f5504b51204e

Download Submit
C:\Windows\System\miMOJbh.exe

Filesize
1.0MB

MD5
6c61b5c84117ff9b8666719579295663

SHA1
d3d77a7deb285f7a7d28746bfcee47131ecf47a7

SHA256
95c16358c3dc7f70f44d673df19634411bc0a7867755a92c14f9adf28081c882

SHA512
c4981cc676f6c776303e28f102d47a252e248041dff618d53a51bac555afe0b35f7cff753ee37c20414704c6b867e4c7bee0df38860c2218d5465bc183a0ecbe

Download Submit
C:\Windows\System\newbKND.exe

Filesize
1023KB

MD5
66b58417165fff1d2170a252d5c28749

SHA1
aaecb89512c402271d95d33541404f3f695507a8

SHA256
8376fd2376fe9aa8bbeb1baa7d7a10e5330744adc588d67fb5b1b07029d3e4de

SHA512
ee3f158e133f03da605fb07f6578da6116c956755f10e69bdb58046593dd5b49fa3784e277154e62b3366093215dc63ee2e737e3d09803cd7e5b157ff3df5f76

Download Submit
C:\Windows\System\oOuPzuK.exe

Filesize
1.0MB

MD5
34218ed5fe0306e9028dd8131ef3b83b

SHA1
9f48ec42b60ca91261471c067aaed8d63d043d5f

SHA256
bad53f1782c61f1d1835d8d160fdf9ca7fb3ed9aa47e4317e07db034584b10ee

SHA512
774ec2fc390af38afa7b805b84f8a92e7dcb6bd78374dd5803ab94481e4ca38c383106f3c9b36530461d6bad3a20d1a11034538789f71ecf52d8a75d339d33c6

Download Submit
C:\Windows\System\oXHzLet.exe

Filesize
1.0MB

MD5
98f3c2a839d78df92a785f896cb4dae6

SHA1
0ec2e32071751c069f4e9125215ea4a331b44b6f

SHA256
5739c7d799bdf6ee86804c8c69fed7115668368b56aa5f4ccd7e94ad981a54e8

SHA512
f5e8955a9677350affb9798c159c77005db40b82f9be21758f543da5c40166bb1f2f3d1b812daf98342d7953cae3055cf8eaca77e32ec372f90f35112ce3d3d9

Download Submit
C:\Windows\System\prLHqlv.exe

Filesize
1.0MB

MD5
9e530b2e871e9ab56dd8b9f9ace05023

SHA1
a2f3949a629ac313bcfcf56ba93aa62b3bb7da18

SHA256
f6645ec2442b69e46f8c912d7373d032ed33fe7d360e4f340b86bdc5cfb112b5

SHA512
637afd6f01fc0809950f49d4a2b12c1422d374f2244507e296d5e12a8e444dd2cf6c058b88c7bdc048f6bfac8754d5f9a92f70a44de080d9259585360d5fd263

Download Submit
C:\Windows\System\rulbSws.exe

Filesize
1.0MB

MD5
250e2ec38ef7bb79ead1b74d68af2f4d

SHA1
5852383624cf7784dbec722763e00e06cda358a0

SHA256
45030b8be9aa9d37a3d8a51544b4155022824e5f1a84b8d357f96190ad38b164

SHA512
d52092c33622cbeeb063c49993ee3a53617c6ec5d2f0187da1dbc92be37fdc2dcc4bae7ec474c6d0145adc84ed04f1d0ee2f8ab09569a8e04da42270ce9c4289

Download Submit
C:\Windows\System\zKMhMkn.exe

Filesize
1020KB

MD5
eaf0c8ff0f924d7c5a34df942687817a

SHA1
1f2dddb32ea959bed34877379edcfe12a76f0b0e

SHA256
9e57d53dd34e7c0c956c9a345327d26fd465b23535a5a86a09c59118d8361974

SHA512
5c9f0ad23aad5b3c415e421b15d021948bcee3f5a712e7dd4d814d5deea652d1affcbd8a932eecbe2f4d6c9253cd7c766b3cf803885d6fed4dde74c6a14be626

Download Submit
C:\Windows\System\zSskbjQ.exe

Filesize
1019KB

MD5
4c74a19668c83eeed87fdcc6b86be04b

SHA1
0294a23692f6950f94d4096774cf53b824023bb0

SHA256
9b217910315e87942c560353af036f0e6b4599e2c424f0042e9e55caf8f93757

SHA512
c160a9d97943e7c8e0e3fba03524a4784e4704a2b2570ddaa2e2e4ef43276a7ac5699e8957cd6d26d7b34cf3057e53cb4062608a0ab641b0102cb58de052d793

Download Submit
memory/2896-0-0x0000026405F90000-0x0000026405FA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads