xmrig | 3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
Size

1.3MB
MD5

6b8cd45a7b17168683b4ccb1336e5cdf
SHA1

80b50f7bc591f8759fd1a8c116ed265b9478bf09
SHA256

3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d
SHA512

f75b9111f8362aa261ce862202671627ba00ddad65b3490bc44d52bf3c1dc5906dc0d44a8f9365649eb899e53c308b8f45af182451ca54acd6f192bc9025bcbc
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6PbWgzVQ:GezaTF8FcNkNdfE0pZ9ozttwIRx3QYGT

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b8c-4.dat	xmrig
behavioral2/files/0x0007000000023c76-6.dat	xmrig
behavioral2/files/0x0009000000023c6d-8.dat	xmrig
behavioral2/files/0x0007000000023c77-20.dat	xmrig
behavioral2/files/0x0007000000023c78-24.dat	xmrig
behavioral2/files/0x000a000000023c73-31.dat	xmrig
behavioral2/files/0x0007000000023c7a-35.dat	xmrig
behavioral2/files/0x0007000000023c7d-45.dat	xmrig
behavioral2/files/0x0007000000023c7c-51.dat	xmrig
behavioral2/files/0x0007000000023c82-69.dat	xmrig
behavioral2/files/0x0007000000023c81-75.dat	xmrig
behavioral2/files/0x0007000000023c83-79.dat	xmrig
behavioral2/files/0x0007000000023c80-72.dat	xmrig
behavioral2/files/0x0007000000023c7f-67.dat	xmrig
behavioral2/files/0x0007000000023c7e-63.dat	xmrig
behavioral2/files/0x0007000000023c7b-34.dat	xmrig
behavioral2/files/0x0007000000023c84-87.dat	xmrig
behavioral2/files/0x0007000000023c85-88.dat	xmrig
behavioral2/files/0x0007000000023c86-106.dat	xmrig
behavioral2/files/0x0007000000023c89-110.dat	xmrig
behavioral2/files/0x0007000000023c8a-112.dat	xmrig
behavioral2/files/0x0007000000023c8b-119.dat	xmrig
behavioral2/files/0x0007000000023c88-111.dat	xmrig
behavioral2/files/0x0007000000023c87-99.dat	xmrig
behavioral2/files/0x0007000000023c8c-124.dat	xmrig
behavioral2/files/0x0007000000023c8e-127.dat	xmrig
behavioral2/files/0x0007000000023c91-145.dat	xmrig
behavioral2/files/0x0007000000023c90-142.dat	xmrig
behavioral2/files/0x0007000000023c8f-137.dat	xmrig
behavioral2/files/0x0007000000023c92-149.dat	xmrig
behavioral2/files/0x0007000000023c93-154.dat	xmrig
behavioral2/files/0x0007000000023c94-161.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1516	mdgibdP.exe
2828	TNTIktD.exe
4804	oBvwtNh.exe
3052	NYPKLdp.exe
2348	WPPOQlq.exe
3900	NvOwhYR.exe
2448	avTQfCT.exe
4056	HRMqSOT.exe
216	zmityEd.exe
1084	UDEKYmP.exe
3964	ECuVwTe.exe
2428	HrKftRr.exe
4884	DMRSlUJ.exe
4080	JLoXEhn.exe
1756	ZSFuvnF.exe
1472	HyEgMMb.exe
2016	ehrKHeD.exe
2356	DLNRItW.exe
2508	puznAHq.exe
5024	CQIRcnK.exe
3768	QzRyrXF.exe
432	sXpNoXs.exe
4948	fTEeCMM.exe
4680	YykWIrB.exe
1532	cfdSgoX.exe
3124	ufnSoKa.exe
3896	adDUMmq.exe
5072	SlBZEfu.exe
3604	xRrapOh.exe
4236	zSUPiQD.exe
4712	mPXmBoe.exe
5036	CCKRyZi.exe
3620	JzoQSiX.exe
4752	XmKEqsc.exe
4716	RxUoMPh.exe
3548	SFCdYOV.exe
3316	BNxeIcx.exe
4640	NdGWhKF.exe
4016	ePfZoUS.exe
4520	lEYbaQx.exe
4400	tyMxaFj.exe
984	cInGSsW.exe
4852	BaCtfpu.exe
2844	GfZUmJa.exe
2772	HtGQWNl.exe
4460	pzUzlTJ.exe
4644	YBACTar.exe
4428	DdMXYfB.exe
552	KUywgTM.exe
1500	lzYNRii.exe
5044	kPOZqoD.exe
5056	SyrJHMI.exe
4352	egiavYd.exe
4292	tiJydYt.exe
1860	GidtDen.exe
4856	xvWppUC.exe
1812	jnecuPO.exe
4968	kqIeNIM.exe
408	NzpLhty.exe
3928	rzgsLqe.exe
1132	ydudzOg.exe
2768	qXhPwJZ.exe
3032	SdYJmTV.exe
4476	BopJWHO.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OwsAtBO.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\ROdDOaN.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\mnXBIbE.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\rIvSSnm.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\aEpDVAA.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\OWvzOSp.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\kVeYGwM.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\etkHrlr.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\MPworgt.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\oshGUTH.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\dihBPoa.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\DAmmgeJ.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\DRkrgvy.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\XqLpcoL.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\lNTIvVK.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\FiRykIm.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\HrKftRr.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\kUJWXvj.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\WYSWeII.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\NmxcBix.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\avsaCDR.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\CedthmE.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\tanHKQM.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\lqbyOBb.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\kMqSCxP.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\GfZUmJa.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\JXrIvgh.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\NFLpaUE.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\tBUBwjr.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\OagLZgh.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\RjEiwOW.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\TzgCeDW.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\gOkaNuJ.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\NdGWhKF.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\hyjNPjl.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\dXvHnjh.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\WZqQzrt.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\FFiQCaD.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\qJiJedU.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\wnVwPKz.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\mYshIXc.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\hCarJEI.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\UBaMoUL.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\tsvgEae.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\JepNLpA.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\xUkwSTO.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\xrFdLuE.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\XhiKArp.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\oBwkXKr.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\BopJWHO.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\CEPYZgo.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\OHNXitw.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\bCMZzAi.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\lnmEsWs.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\xisyolL.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\pBknFTH.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\SYuuBtL.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\dQIIrAv.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\KhaxXrM.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\rkMWoCG.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\jsaPFkY.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\kPOZqoD.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\SygcoEb.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
File created	C:\Windows\System\lEYbaQx.exe	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 1516	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	84
PID 4552 wrote to memory of 1516	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	84
PID 4552 wrote to memory of 2828	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	85
PID 4552 wrote to memory of 2828	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	85
PID 4552 wrote to memory of 4804	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	86
PID 4552 wrote to memory of 4804	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	86
PID 4552 wrote to memory of 3052	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	87
PID 4552 wrote to memory of 3052	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	87
PID 4552 wrote to memory of 2348	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	88
PID 4552 wrote to memory of 2348	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	88
PID 4552 wrote to memory of 3900	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	89
PID 4552 wrote to memory of 3900	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	89
PID 4552 wrote to memory of 4056	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	90
PID 4552 wrote to memory of 4056	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	90
PID 4552 wrote to memory of 2448	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	91
PID 4552 wrote to memory of 2448	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	91
PID 4552 wrote to memory of 216	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	92
PID 4552 wrote to memory of 216	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	92
PID 4552 wrote to memory of 1084	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	93
PID 4552 wrote to memory of 1084	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	93
PID 4552 wrote to memory of 3964	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	94
PID 4552 wrote to memory of 3964	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	94
PID 4552 wrote to memory of 2428	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	95
PID 4552 wrote to memory of 2428	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	95
PID 4552 wrote to memory of 4884	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	96
PID 4552 wrote to memory of 4884	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	96
PID 4552 wrote to memory of 4080	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	97
PID 4552 wrote to memory of 4080	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	97
PID 4552 wrote to memory of 1756	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	98
PID 4552 wrote to memory of 1756	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	98
PID 4552 wrote to memory of 1472	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	99
PID 4552 wrote to memory of 1472	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	99
PID 4552 wrote to memory of 2016	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	100
PID 4552 wrote to memory of 2016	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	100
PID 4552 wrote to memory of 2356	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	101
PID 4552 wrote to memory of 2356	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	101
PID 4552 wrote to memory of 2508	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	102
PID 4552 wrote to memory of 2508	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	102
PID 4552 wrote to memory of 5024	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	103
PID 4552 wrote to memory of 5024	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	103
PID 4552 wrote to memory of 3768	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	104
PID 4552 wrote to memory of 3768	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	104
PID 4552 wrote to memory of 432	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	105
PID 4552 wrote to memory of 432	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	105
PID 4552 wrote to memory of 4948	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	106
PID 4552 wrote to memory of 4948	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	106
PID 4552 wrote to memory of 4680	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	107
PID 4552 wrote to memory of 4680	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	107
PID 4552 wrote to memory of 1532	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	108
PID 4552 wrote to memory of 1532	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	108
PID 4552 wrote to memory of 3124	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	109
PID 4552 wrote to memory of 3124	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	109
PID 4552 wrote to memory of 3896	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	110
PID 4552 wrote to memory of 3896	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	110
PID 4552 wrote to memory of 5072	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	111
PID 4552 wrote to memory of 5072	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	111
PID 4552 wrote to memory of 3604	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	112
PID 4552 wrote to memory of 3604	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	112
PID 4552 wrote to memory of 4236	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	113
PID 4552 wrote to memory of 4236	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	113
PID 4552 wrote to memory of 4712	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	114
PID 4552 wrote to memory of 4712	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	114
PID 4552 wrote to memory of 5036	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	115
PID 4552 wrote to memory of 5036	4552	3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe	115

C:\Users\Admin\AppData\Local\Temp\3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe
"C:\Users\Admin\AppData\Local\Temp\3082af724c249a528f97d0d4d170e98c2a3fcf8ae652cfd8f97f1f00e0a9f00d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\System\mdgibdP.exe
  C:\Windows\System\mdgibdP.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\TNTIktD.exe
  C:\Windows\System\TNTIktD.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\oBvwtNh.exe
  C:\Windows\System\oBvwtNh.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\NYPKLdp.exe
  C:\Windows\System\NYPKLdp.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\WPPOQlq.exe
  C:\Windows\System\WPPOQlq.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\NvOwhYR.exe
  C:\Windows\System\NvOwhYR.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\HRMqSOT.exe
  C:\Windows\System\HRMqSOT.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\avTQfCT.exe
  C:\Windows\System\avTQfCT.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\zmityEd.exe
  C:\Windows\System\zmityEd.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\UDEKYmP.exe
  C:\Windows\System\UDEKYmP.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\ECuVwTe.exe
  C:\Windows\System\ECuVwTe.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\HrKftRr.exe
  C:\Windows\System\HrKftRr.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\DMRSlUJ.exe
  C:\Windows\System\DMRSlUJ.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\JLoXEhn.exe
  C:\Windows\System\JLoXEhn.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\ZSFuvnF.exe
  C:\Windows\System\ZSFuvnF.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\HyEgMMb.exe
  C:\Windows\System\HyEgMMb.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\ehrKHeD.exe
  C:\Windows\System\ehrKHeD.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\DLNRItW.exe
  C:\Windows\System\DLNRItW.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\puznAHq.exe
  C:\Windows\System\puznAHq.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\CQIRcnK.exe
  C:\Windows\System\CQIRcnK.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\QzRyrXF.exe
  C:\Windows\System\QzRyrXF.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\sXpNoXs.exe
  C:\Windows\System\sXpNoXs.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\fTEeCMM.exe
  C:\Windows\System\fTEeCMM.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\YykWIrB.exe
  C:\Windows\System\YykWIrB.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\cfdSgoX.exe
  C:\Windows\System\cfdSgoX.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ufnSoKa.exe
  C:\Windows\System\ufnSoKa.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\adDUMmq.exe
  C:\Windows\System\adDUMmq.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\SlBZEfu.exe
  C:\Windows\System\SlBZEfu.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\xRrapOh.exe
  C:\Windows\System\xRrapOh.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\zSUPiQD.exe
  C:\Windows\System\zSUPiQD.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\mPXmBoe.exe
  C:\Windows\System\mPXmBoe.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\CCKRyZi.exe
  C:\Windows\System\CCKRyZi.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\JzoQSiX.exe
  C:\Windows\System\JzoQSiX.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\XmKEqsc.exe
  C:\Windows\System\XmKEqsc.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\RxUoMPh.exe
  C:\Windows\System\RxUoMPh.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\SFCdYOV.exe
  C:\Windows\System\SFCdYOV.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\BNxeIcx.exe
  C:\Windows\System\BNxeIcx.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\NdGWhKF.exe
  C:\Windows\System\NdGWhKF.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\ePfZoUS.exe
  C:\Windows\System\ePfZoUS.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\lEYbaQx.exe
  C:\Windows\System\lEYbaQx.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\tyMxaFj.exe
  C:\Windows\System\tyMxaFj.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\cInGSsW.exe
  C:\Windows\System\cInGSsW.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\BaCtfpu.exe
  C:\Windows\System\BaCtfpu.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\GfZUmJa.exe
  C:\Windows\System\GfZUmJa.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\HtGQWNl.exe
  C:\Windows\System\HtGQWNl.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\pzUzlTJ.exe
  C:\Windows\System\pzUzlTJ.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\YBACTar.exe
  C:\Windows\System\YBACTar.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\DdMXYfB.exe
  C:\Windows\System\DdMXYfB.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\KUywgTM.exe
  C:\Windows\System\KUywgTM.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\lzYNRii.exe
  C:\Windows\System\lzYNRii.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\kPOZqoD.exe
  C:\Windows\System\kPOZqoD.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\SyrJHMI.exe
  C:\Windows\System\SyrJHMI.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\egiavYd.exe
  C:\Windows\System\egiavYd.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\tiJydYt.exe
  C:\Windows\System\tiJydYt.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\GidtDen.exe
  C:\Windows\System\GidtDen.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\xvWppUC.exe
  C:\Windows\System\xvWppUC.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\jnecuPO.exe
  C:\Windows\System\jnecuPO.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\kqIeNIM.exe
  C:\Windows\System\kqIeNIM.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\NzpLhty.exe
  C:\Windows\System\NzpLhty.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\rzgsLqe.exe
  C:\Windows\System\rzgsLqe.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\ydudzOg.exe
  C:\Windows\System\ydudzOg.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\qXhPwJZ.exe
  C:\Windows\System\qXhPwJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\SdYJmTV.exe
  C:\Windows\System\SdYJmTV.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\BopJWHO.exe
  C:\Windows\System\BopJWHO.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\kEHGKvy.exe
  C:\Windows\System\kEHGKvy.exe
  2⤵
  PID:380
- C:\Windows\System\TYIiNNM.exe
  C:\Windows\System\TYIiNNM.exe
  2⤵
  PID:4572
- C:\Windows\System\qpBvUzR.exe
  C:\Windows\System\qpBvUzR.exe
  2⤵
  PID:4456
- C:\Windows\System\jbcxxKQ.exe
  C:\Windows\System\jbcxxKQ.exe
  2⤵
  PID:3384
- C:\Windows\System\oyJMYgL.exe
  C:\Windows\System\oyJMYgL.exe
  2⤵
  PID:4860
- C:\Windows\System\QFyYNEd.exe
  C:\Windows\System\QFyYNEd.exe
  2⤵
  PID:3956
- C:\Windows\System\HaYbUdj.exe
  C:\Windows\System\HaYbUdj.exe
  2⤵
  PID:2208
- C:\Windows\System\nEKekIk.exe
  C:\Windows\System\nEKekIk.exe
  2⤵
  PID:2512
- C:\Windows\System\yVCfHHU.exe
  C:\Windows\System\yVCfHHU.exe
  2⤵
  PID:1476
- C:\Windows\System\dOrzuZh.exe
  C:\Windows\System\dOrzuZh.exe
  2⤵
  PID:2108
- C:\Windows\System\IqITpIt.exe
  C:\Windows\System\IqITpIt.exe
  2⤵
  PID:3856
- C:\Windows\System\bPyEOxL.exe
  C:\Windows\System\bPyEOxL.exe
  2⤵
  PID:4904
- C:\Windows\System\XeeOMtw.exe
  C:\Windows\System\XeeOMtw.exe
  2⤵
  PID:1320
- C:\Windows\System\BFEzbmg.exe
  C:\Windows\System\BFEzbmg.exe
  2⤵
  PID:4556
- C:\Windows\System\YrvAwoL.exe
  C:\Windows\System\YrvAwoL.exe
  2⤵
  PID:4348
- C:\Windows\System\AxVyCfo.exe
  C:\Windows\System\AxVyCfo.exe
  2⤵
  PID:2524
- C:\Windows\System\UbSzbqD.exe
  C:\Windows\System\UbSzbqD.exe
  2⤵
  PID:2284
- C:\Windows\System\QDNmPsX.exe
  C:\Windows\System\QDNmPsX.exe
  2⤵
  PID:624
- C:\Windows\System\iKfAWDF.exe
  C:\Windows\System\iKfAWDF.exe
  2⤵
  PID:4840
- C:\Windows\System\GbfvVnP.exe
  C:\Windows\System\GbfvVnP.exe
  2⤵
  PID:2180
- C:\Windows\System\maaGUpq.exe
  C:\Windows\System\maaGUpq.exe
  2⤵
  PID:760
- C:\Windows\System\LIRZIVA.exe
  C:\Windows\System\LIRZIVA.exe
  2⤵
  PID:3808
- C:\Windows\System\tYRhuCK.exe
  C:\Windows\System\tYRhuCK.exe
  2⤵
  PID:4320
- C:\Windows\System\ScgryAW.exe
  C:\Windows\System\ScgryAW.exe
  2⤵
  PID:820
- C:\Windows\System\ZTxWDFj.exe
  C:\Windows\System\ZTxWDFj.exe
  2⤵
  PID:3464
- C:\Windows\System\pAvEhBJ.exe
  C:\Windows\System\pAvEhBJ.exe
  2⤵
  PID:3936
- C:\Windows\System\cnSyAkW.exe
  C:\Windows\System\cnSyAkW.exe
  2⤵
  PID:4332
- C:\Windows\System\EImzLmq.exe
  C:\Windows\System\EImzLmq.exe
  2⤵
  PID:2244
- C:\Windows\System\CQBFgzx.exe
  C:\Windows\System\CQBFgzx.exe
  2⤵
  PID:1036
- C:\Windows\System\IgkuMua.exe
  C:\Windows\System\IgkuMua.exe
  2⤵
  PID:4564
- C:\Windows\System\lONRGnb.exe
  C:\Windows\System\lONRGnb.exe
  2⤵
  PID:1832
- C:\Windows\System\vRDmMff.exe
  C:\Windows\System\vRDmMff.exe
  2⤵
  PID:3688
- C:\Windows\System\CZcASld.exe
  C:\Windows\System\CZcASld.exe
  2⤵
  PID:2280
- C:\Windows\System\DllaFcz.exe
  C:\Windows\System\DllaFcz.exe
  2⤵
  PID:4696
- C:\Windows\System\mxtcfON.exe
  C:\Windows\System\mxtcfON.exe
  2⤵
  PID:4212
- C:\Windows\System\WbZgGHy.exe
  C:\Windows\System\WbZgGHy.exe
  2⤵
  PID:464
- C:\Windows\System\hSLrwHn.exe
  C:\Windows\System\hSLrwHn.exe
  2⤵
  PID:1316
- C:\Windows\System\TWQptfr.exe
  C:\Windows\System\TWQptfr.exe
  2⤵
  PID:8
- C:\Windows\System\eeylXCq.exe
  C:\Windows\System\eeylXCq.exe
  2⤵
  PID:2392
- C:\Windows\System\GpyFwfF.exe
  C:\Windows\System\GpyFwfF.exe
  2⤵
  PID:1948
- C:\Windows\System\gEfJcKF.exe
  C:\Windows\System\gEfJcKF.exe
  2⤵
  PID:4392
- C:\Windows\System\LubKMqM.exe
  C:\Windows\System\LubKMqM.exe
  2⤵
  PID:100
- C:\Windows\System\bNlyrGv.exe
  C:\Windows\System\bNlyrGv.exe
  2⤵
  PID:1004
- C:\Windows\System\zbhepdi.exe
  C:\Windows\System\zbhepdi.exe
  2⤵
  PID:4244
- C:\Windows\System\LzWGGoD.exe
  C:\Windows\System\LzWGGoD.exe
  2⤵
  PID:3684
- C:\Windows\System\JWTpfBr.exe
  C:\Windows\System\JWTpfBr.exe
  2⤵
  PID:2432
- C:\Windows\System\REbocRf.exe
  C:\Windows\System\REbocRf.exe
  2⤵
  PID:1712
- C:\Windows\System\SqOhFGf.exe
  C:\Windows\System\SqOhFGf.exe
  2⤵
  PID:32
- C:\Windows\System\YRegUfq.exe
  C:\Windows\System\YRegUfq.exe
  2⤵
  PID:5092
- C:\Windows\System\OMYfIuy.exe
  C:\Windows\System\OMYfIuy.exe
  2⤵
  PID:4036
- C:\Windows\System\NvgTImt.exe
  C:\Windows\System\NvgTImt.exe
  2⤵
  PID:5140
- C:\Windows\System\UBgfERr.exe
  C:\Windows\System\UBgfERr.exe
  2⤵
  PID:5172
- C:\Windows\System\GJfirNn.exe
  C:\Windows\System\GJfirNn.exe
  2⤵
  PID:5204
- C:\Windows\System\LCeziDr.exe
  C:\Windows\System\LCeziDr.exe
  2⤵
  PID:5224
- C:\Windows\System\wBUPpfs.exe
  C:\Windows\System\wBUPpfs.exe
  2⤵
  PID:5264
- C:\Windows\System\DRkrgvy.exe
  C:\Windows\System\DRkrgvy.exe
  2⤵
  PID:5288
- C:\Windows\System\gcumKTW.exe
  C:\Windows\System\gcumKTW.exe
  2⤵
  PID:5320
- C:\Windows\System\hitrZIF.exe
  C:\Windows\System\hitrZIF.exe
  2⤵
  PID:5348
- C:\Windows\System\JwghUGA.exe
  C:\Windows\System\JwghUGA.exe
  2⤵
  PID:5368
- C:\Windows\System\dQIIrAv.exe
  C:\Windows\System\dQIIrAv.exe
  2⤵
  PID:5408
- C:\Windows\System\HFRiQRP.exe
  C:\Windows\System\HFRiQRP.exe
  2⤵
  PID:5432
- C:\Windows\System\AqJgbyE.exe
  C:\Windows\System\AqJgbyE.exe
  2⤵
  PID:5460
- C:\Windows\System\QwXIPfh.exe
  C:\Windows\System\QwXIPfh.exe
  2⤵
  PID:5488
- C:\Windows\System\NFLpaUE.exe
  C:\Windows\System\NFLpaUE.exe
  2⤵
  PID:5516
- C:\Windows\System\clxeFCO.exe
  C:\Windows\System\clxeFCO.exe
  2⤵
  PID:5544
- C:\Windows\System\XEVVIPu.exe
  C:\Windows\System\XEVVIPu.exe
  2⤵
  PID:5560
- C:\Windows\System\vSTnXIU.exe
  C:\Windows\System\vSTnXIU.exe
  2⤵
  PID:5592
- C:\Windows\System\OoJXDIk.exe
  C:\Windows\System\OoJXDIk.exe
  2⤵
  PID:5612
- C:\Windows\System\hmbIKfC.exe
  C:\Windows\System\hmbIKfC.exe
  2⤵
  PID:5672
- C:\Windows\System\ptMzIWd.exe
  C:\Windows\System\ptMzIWd.exe
  2⤵
  PID:5688
- C:\Windows\System\UKqRVqY.exe
  C:\Windows\System\UKqRVqY.exe
  2⤵
  PID:5712
- C:\Windows\System\jNuSqor.exe
  C:\Windows\System\jNuSqor.exe
  2⤵
  PID:5728
- C:\Windows\System\XsYRLfD.exe
  C:\Windows\System\XsYRLfD.exe
  2⤵
  PID:5748
- C:\Windows\System\meXyLLl.exe
  C:\Windows\System\meXyLLl.exe
  2⤵
  PID:5768
- C:\Windows\System\wvLLgNz.exe
  C:\Windows\System\wvLLgNz.exe
  2⤵
  PID:5788
- C:\Windows\System\pNpQLLb.exe
  C:\Windows\System\pNpQLLb.exe
  2⤵
  PID:5804
- C:\Windows\System\qlssQFR.exe
  C:\Windows\System\qlssQFR.exe
  2⤵
  PID:5828
- C:\Windows\System\tCikvPu.exe
  C:\Windows\System\tCikvPu.exe
  2⤵
  PID:5852
- C:\Windows\System\UycWxLo.exe
  C:\Windows\System\UycWxLo.exe
  2⤵
  PID:5876
- C:\Windows\System\iQnXVsU.exe
  C:\Windows\System\iQnXVsU.exe
  2⤵
  PID:5904
- C:\Windows\System\kvzcnDP.exe
  C:\Windows\System\kvzcnDP.exe
  2⤵
  PID:5964
- C:\Windows\System\tkXdUef.exe
  C:\Windows\System\tkXdUef.exe
  2⤵
  PID:5988
- C:\Windows\System\uaHedqn.exe
  C:\Windows\System\uaHedqn.exe
  2⤵
  PID:6004
- C:\Windows\System\ICJwehF.exe
  C:\Windows\System\ICJwehF.exe
  2⤵
  PID:6032
- C:\Windows\System\bSktfCR.exe
  C:\Windows\System\bSktfCR.exe
  2⤵
  PID:6060
- C:\Windows\System\lgwmNgs.exe
  C:\Windows\System\lgwmNgs.exe
  2⤵
  PID:6084
- C:\Windows\System\LMIlJpg.exe
  C:\Windows\System\LMIlJpg.exe
  2⤵
  PID:6116
- C:\Windows\System\TbgWaNS.exe
  C:\Windows\System\TbgWaNS.exe
  2⤵
  PID:5124
- C:\Windows\System\eZYyBHX.exe
  C:\Windows\System\eZYyBHX.exe
  2⤵
  PID:5216
- C:\Windows\System\sXdrYcn.exe
  C:\Windows\System\sXdrYcn.exe
  2⤵
  PID:5256
- C:\Windows\System\iOiflVe.exe
  C:\Windows\System\iOiflVe.exe
  2⤵
  PID:5304
- C:\Windows\System\nSxapqP.exe
  C:\Windows\System\nSxapqP.exe
  2⤵
  PID:5340
- C:\Windows\System\eEvLKrf.exe
  C:\Windows\System\eEvLKrf.exe
  2⤵
  PID:5388
- C:\Windows\System\SRbNNxl.exe
  C:\Windows\System\SRbNNxl.exe
  2⤵
  PID:5444
- C:\Windows\System\KstIYnl.exe
  C:\Windows\System\KstIYnl.exe
  2⤵
  PID:5624
- C:\Windows\System\tBUBwjr.exe
  C:\Windows\System\tBUBwjr.exe
  2⤵
  PID:5744
- C:\Windows\System\kzHIMZz.exe
  C:\Windows\System\kzHIMZz.exe
  2⤵
  PID:5824
- C:\Windows\System\OagLZgh.exe
  C:\Windows\System\OagLZgh.exe
  2⤵
  PID:5816
- C:\Windows\System\fzRawBD.exe
  C:\Windows\System\fzRawBD.exe
  2⤵
  PID:5984
- C:\Windows\System\lwbCnFI.exe
  C:\Windows\System\lwbCnFI.exe
  2⤵
  PID:6016
- C:\Windows\System\gQyLUNE.exe
  C:\Windows\System\gQyLUNE.exe
  2⤵
  PID:6080
- C:\Windows\System\TPIRgNi.exe
  C:\Windows\System\TPIRgNi.exe
  2⤵
  PID:5188
- C:\Windows\System\VEEcTJf.exe
  C:\Windows\System\VEEcTJf.exe
  2⤵
  PID:6124
- C:\Windows\System\uYwWDWH.exe
  C:\Windows\System\uYwWDWH.exe
  2⤵
  PID:5260
- C:\Windows\System\aYJlmFh.exe
  C:\Windows\System\aYJlmFh.exe
  2⤵
  PID:5356
- C:\Windows\System\SFosnfB.exe
  C:\Windows\System\SFosnfB.exe
  2⤵
  PID:5588
- C:\Windows\System\AZAhAOy.exe
  C:\Windows\System\AZAhAOy.exe
  2⤵
  PID:5776
- C:\Windows\System\tXadshW.exe
  C:\Windows\System\tXadshW.exe
  2⤵
  PID:5892
- C:\Windows\System\KCONCWb.exe
  C:\Windows\System\KCONCWb.exe
  2⤵
  PID:6048
- C:\Windows\System\mxoEYNy.exe
  C:\Windows\System\mxoEYNy.exe
  2⤵
  PID:6108
- C:\Windows\System\MXGyIMT.exe
  C:\Windows\System\MXGyIMT.exe
  2⤵
  PID:5296
- C:\Windows\System\ZIFFvrR.exe
  C:\Windows\System\ZIFFvrR.exe
  2⤵
  PID:5396
- C:\Windows\System\CZIdYVB.exe
  C:\Windows\System\CZIdYVB.exe
  2⤵
  PID:6148
- C:\Windows\System\OWvzOSp.exe
  C:\Windows\System\OWvzOSp.exe
  2⤵
  PID:6164
- C:\Windows\System\YgbyQKa.exe
  C:\Windows\System\YgbyQKa.exe
  2⤵
  PID:6192
- C:\Windows\System\BbXgpTL.exe
  C:\Windows\System\BbXgpTL.exe
  2⤵
  PID:6220
- C:\Windows\System\dUtAoes.exe
  C:\Windows\System\dUtAoes.exe
  2⤵
  PID:6248
- C:\Windows\System\nROvmeC.exe
  C:\Windows\System\nROvmeC.exe
  2⤵
  PID:6264
- C:\Windows\System\YGDEWwr.exe
  C:\Windows\System\YGDEWwr.exe
  2⤵
  PID:6316
- C:\Windows\System\MxSEwVm.exe
  C:\Windows\System\MxSEwVm.exe
  2⤵
  PID:6336
- C:\Windows\System\bAQgenD.exe
  C:\Windows\System\bAQgenD.exe
  2⤵
  PID:6360
- C:\Windows\System\qLDJziT.exe
  C:\Windows\System\qLDJziT.exe
  2⤵
  PID:6392
- C:\Windows\System\wytIYLo.exe
  C:\Windows\System\wytIYLo.exe
  2⤵
  PID:6428
- C:\Windows\System\lnmEsWs.exe
  C:\Windows\System\lnmEsWs.exe
  2⤵
  PID:6456
- C:\Windows\System\vmCsGjg.exe
  C:\Windows\System\vmCsGjg.exe
  2⤵
  PID:6484
- C:\Windows\System\zZrITQw.exe
  C:\Windows\System\zZrITQw.exe
  2⤵
  PID:6500
- C:\Windows\System\zxRXwsB.exe
  C:\Windows\System\zxRXwsB.exe
  2⤵
  PID:6528
- C:\Windows\System\AEsvVUN.exe
  C:\Windows\System\AEsvVUN.exe
  2⤵
  PID:6556
- C:\Windows\System\BChKMvz.exe
  C:\Windows\System\BChKMvz.exe
  2⤵
  PID:6596
- C:\Windows\System\KRLjBcw.exe
  C:\Windows\System\KRLjBcw.exe
  2⤵
  PID:6624
- C:\Windows\System\fhPLZUG.exe
  C:\Windows\System\fhPLZUG.exe
  2⤵
  PID:6644
- C:\Windows\System\PlYSEDc.exe
  C:\Windows\System\PlYSEDc.exe
  2⤵
  PID:6668
- C:\Windows\System\aXLbqUU.exe
  C:\Windows\System\aXLbqUU.exe
  2⤵
  PID:6708
- C:\Windows\System\IOSjvhm.exe
  C:\Windows\System\IOSjvhm.exe
  2⤵
  PID:6724
- C:\Windows\System\LuPjSzt.exe
  C:\Windows\System\LuPjSzt.exe
  2⤵
  PID:6744
- C:\Windows\System\PEjTGMB.exe
  C:\Windows\System\PEjTGMB.exe
  2⤵
  PID:6764
- C:\Windows\System\pCZDrsz.exe
  C:\Windows\System\pCZDrsz.exe
  2⤵
  PID:6800
- C:\Windows\System\bkUPZwL.exe
  C:\Windows\System\bkUPZwL.exe
  2⤵
  PID:6828
- C:\Windows\System\XqLpcoL.exe
  C:\Windows\System\XqLpcoL.exe
  2⤵
  PID:6852
- C:\Windows\System\gauIjyj.exe
  C:\Windows\System\gauIjyj.exe
  2⤵
  PID:6868
- C:\Windows\System\JEHsJFF.exe
  C:\Windows\System\JEHsJFF.exe
  2⤵
  PID:6896
- C:\Windows\System\wSjVmZx.exe
  C:\Windows\System\wSjVmZx.exe
  2⤵
  PID:6960
- C:\Windows\System\mgIslnv.exe
  C:\Windows\System\mgIslnv.exe
  2⤵
  PID:6988
- C:\Windows\System\mJyWutK.exe
  C:\Windows\System\mJyWutK.exe
  2⤵
  PID:7012
- C:\Windows\System\uqDpHdk.exe
  C:\Windows\System\uqDpHdk.exe
  2⤵
  PID:7044
- C:\Windows\System\RzdmevJ.exe
  C:\Windows\System\RzdmevJ.exe
  2⤵
  PID:7064
- C:\Windows\System\pEtHOkf.exe
  C:\Windows\System\pEtHOkf.exe
  2⤵
  PID:7092
- C:\Windows\System\DfSCabP.exe
  C:\Windows\System\DfSCabP.exe
  2⤵
  PID:7120
- C:\Windows\System\gLbafKb.exe
  C:\Windows\System\gLbafKb.exe
  2⤵
  PID:7160
- C:\Windows\System\oOZCwoJ.exe
  C:\Windows\System\oOZCwoJ.exe
  2⤵
  PID:6180
- C:\Windows\System\oPtRMpS.exe
  C:\Windows\System\oPtRMpS.exe
  2⤵
  PID:6232
- C:\Windows\System\MPworgt.exe
  C:\Windows\System\MPworgt.exe
  2⤵
  PID:6284
- C:\Windows\System\ynFqTbQ.exe
  C:\Windows\System\ynFqTbQ.exe
  2⤵
  PID:6332
- C:\Windows\System\zzzNZif.exe
  C:\Windows\System\zzzNZif.exe
  2⤵
  PID:6384
- C:\Windows\System\LXPFUhg.exe
  C:\Windows\System\LXPFUhg.exe
  2⤵
  PID:6440
- C:\Windows\System\ojbADMF.exe
  C:\Windows\System\ojbADMF.exe
  2⤵
  PID:6512
- C:\Windows\System\NJOTxPP.exe
  C:\Windows\System\NJOTxPP.exe
  2⤵
  PID:6572
- C:\Windows\System\CdlnuyZ.exe
  C:\Windows\System\CdlnuyZ.exe
  2⤵
  PID:6636
- C:\Windows\System\stAzhso.exe
  C:\Windows\System\stAzhso.exe
  2⤵
  PID:6692
- C:\Windows\System\VuGXNzF.exe
  C:\Windows\System\VuGXNzF.exe
  2⤵
  PID:6720
- C:\Windows\System\wnVwPKz.exe
  C:\Windows\System\wnVwPKz.exe
  2⤵
  PID:6760
- C:\Windows\System\qwJdWfG.exe
  C:\Windows\System\qwJdWfG.exe
  2⤵
  PID:6940
- C:\Windows\System\vuPqGHQ.exe
  C:\Windows\System\vuPqGHQ.exe
  2⤵
  PID:6972
- C:\Windows\System\EcrFlhf.exe
  C:\Windows\System\EcrFlhf.exe
  2⤵
  PID:7024
- C:\Windows\System\royYDSA.exe
  C:\Windows\System\royYDSA.exe
  2⤵
  PID:7056
- C:\Windows\System\wSKYOZp.exe
  C:\Windows\System\wSKYOZp.exe
  2⤵
  PID:7108
- C:\Windows\System\hEQsBJZ.exe
  C:\Windows\System\hEQsBJZ.exe
  2⤵
  PID:6160
- C:\Windows\System\mnXBIbE.exe
  C:\Windows\System\mnXBIbE.exe
  2⤵
  PID:6356
- C:\Windows\System\RPhWUot.exe
  C:\Windows\System\RPhWUot.exe
  2⤵
  PID:6472
- C:\Windows\System\EJBJwAx.exe
  C:\Windows\System\EJBJwAx.exe
  2⤵
  PID:6664
- C:\Windows\System\xisyolL.exe
  C:\Windows\System\xisyolL.exe
  2⤵
  PID:6788
- C:\Windows\System\FyjrlLz.exe
  C:\Windows\System\FyjrlLz.exe
  2⤵
  PID:6864
- C:\Windows\System\MTjeBzn.exe
  C:\Windows\System\MTjeBzn.exe
  2⤵
  PID:6256
- C:\Windows\System\ifRzNuF.exe
  C:\Windows\System\ifRzNuF.exe
  2⤵
  PID:6476
- C:\Windows\System\xJuEAFw.exe
  C:\Windows\System\xJuEAFw.exe
  2⤵
  PID:6928
- C:\Windows\System\MoYTyYY.exe
  C:\Windows\System\MoYTyYY.exe
  2⤵
  PID:7052
- C:\Windows\System\noqinPd.exe
  C:\Windows\System\noqinPd.exe
  2⤵
  PID:7172
- C:\Windows\System\yJQtBli.exe
  C:\Windows\System\yJQtBli.exe
  2⤵
  PID:7196
- C:\Windows\System\sqDEiCW.exe
  C:\Windows\System\sqDEiCW.exe
  2⤵
  PID:7224
- C:\Windows\System\TAJShRI.exe
  C:\Windows\System\TAJShRI.exe
  2⤵
  PID:7252
- C:\Windows\System\MUccDGL.exe
  C:\Windows\System\MUccDGL.exe
  2⤵
  PID:7288
- C:\Windows\System\lwwglLq.exe
  C:\Windows\System\lwwglLq.exe
  2⤵
  PID:7304
- C:\Windows\System\pLTqTyq.exe
  C:\Windows\System\pLTqTyq.exe
  2⤵
  PID:7348
- C:\Windows\System\tqROuWY.exe
  C:\Windows\System\tqROuWY.exe
  2⤵
  PID:7372
- C:\Windows\System\MvBXOJg.exe
  C:\Windows\System\MvBXOJg.exe
  2⤵
  PID:7396
- C:\Windows\System\iONCWLp.exe
  C:\Windows\System\iONCWLp.exe
  2⤵
  PID:7440
- C:\Windows\System\XpeKBrk.exe
  C:\Windows\System\XpeKBrk.exe
  2⤵
  PID:7468
- C:\Windows\System\feLJAuu.exe
  C:\Windows\System\feLJAuu.exe
  2⤵
  PID:7496
- C:\Windows\System\GjPpycg.exe
  C:\Windows\System\GjPpycg.exe
  2⤵
  PID:7516
- C:\Windows\System\byQRRXw.exe
  C:\Windows\System\byQRRXw.exe
  2⤵
  PID:7552
- C:\Windows\System\JumepSO.exe
  C:\Windows\System\JumepSO.exe
  2⤵
  PID:7572
- C:\Windows\System\CEPYZgo.exe
  C:\Windows\System\CEPYZgo.exe
  2⤵
  PID:7604
- C:\Windows\System\gaIWWlJ.exe
  C:\Windows\System\gaIWWlJ.exe
  2⤵
  PID:7636
- C:\Windows\System\hTRqbxc.exe
  C:\Windows\System\hTRqbxc.exe
  2⤵
  PID:7652
- C:\Windows\System\sEikMsS.exe
  C:\Windows\System\sEikMsS.exe
  2⤵
  PID:7668
- C:\Windows\System\tFJRNLZ.exe
  C:\Windows\System\tFJRNLZ.exe
  2⤵
  PID:7700
- C:\Windows\System\XBHvDlB.exe
  C:\Windows\System\XBHvDlB.exe
  2⤵
  PID:7728
- C:\Windows\System\sROSWRr.exe
  C:\Windows\System\sROSWRr.exe
  2⤵
  PID:7752
- C:\Windows\System\McbdbWr.exe
  C:\Windows\System\McbdbWr.exe
  2⤵
  PID:7772
- C:\Windows\System\vZAHfXK.exe
  C:\Windows\System\vZAHfXK.exe
  2⤵
  PID:7800
- C:\Windows\System\hHgViKb.exe
  C:\Windows\System\hHgViKb.exe
  2⤵
  PID:7824
- C:\Windows\System\frWWtII.exe
  C:\Windows\System\frWWtII.exe
  2⤵
  PID:7848
- C:\Windows\System\uZrdarm.exe
  C:\Windows\System\uZrdarm.exe
  2⤵
  PID:7916
- C:\Windows\System\xrFdLuE.exe
  C:\Windows\System\xrFdLuE.exe
  2⤵
  PID:7932
- C:\Windows\System\kFPDdEs.exe
  C:\Windows\System\kFPDdEs.exe
  2⤵
  PID:7968
- C:\Windows\System\YOuqJEg.exe
  C:\Windows\System\YOuqJEg.exe
  2⤵
  PID:7988
- C:\Windows\System\CGqStMW.exe
  C:\Windows\System\CGqStMW.exe
  2⤵
  PID:8028
- C:\Windows\System\HjufQVD.exe
  C:\Windows\System\HjufQVD.exe
  2⤵
  PID:8056
- C:\Windows\System\lNNGCrW.exe
  C:\Windows\System\lNNGCrW.exe
  2⤵
  PID:8072
- C:\Windows\System\VygBiDp.exe
  C:\Windows\System\VygBiDp.exe
  2⤵
  PID:8096
- C:\Windows\System\wDrtZFi.exe
  C:\Windows\System\wDrtZFi.exe
  2⤵
  PID:8140
- C:\Windows\System\ccRYSOK.exe
  C:\Windows\System\ccRYSOK.exe
  2⤵
  PID:8160
- C:\Windows\System\FuylcZP.exe
  C:\Windows\System\FuylcZP.exe
  2⤵
  PID:8184
- C:\Windows\System\sosDkBz.exe
  C:\Windows\System\sosDkBz.exe
  2⤵
  PID:7204
- C:\Windows\System\ulVBiSS.exe
  C:\Windows\System\ulVBiSS.exe
  2⤵
  PID:7220
- C:\Windows\System\ZRabSrm.exe
  C:\Windows\System\ZRabSrm.exe
  2⤵
  PID:7296
- C:\Windows\System\DoKCAPi.exe
  C:\Windows\System\DoKCAPi.exe
  2⤵
  PID:7364
- C:\Windows\System\BMppLiG.exe
  C:\Windows\System\BMppLiG.exe
  2⤵
  PID:7392
- C:\Windows\System\UZEGgcE.exe
  C:\Windows\System\UZEGgcE.exe
  2⤵
  PID:7488
- C:\Windows\System\CUvnxaD.exe
  C:\Windows\System\CUvnxaD.exe
  2⤵
  PID:7600
- C:\Windows\System\pMydKZi.exe
  C:\Windows\System\pMydKZi.exe
  2⤵
  PID:7648
- C:\Windows\System\XIpujci.exe
  C:\Windows\System\XIpujci.exe
  2⤵
  PID:7720
- C:\Windows\System\sxWiafv.exe
  C:\Windows\System\sxWiafv.exe
  2⤵
  PID:7712
- C:\Windows\System\mwdeQKG.exe
  C:\Windows\System\mwdeQKG.exe
  2⤵
  PID:7740
- C:\Windows\System\eiZshYe.exe
  C:\Windows\System\eiZshYe.exe
  2⤵
  PID:7816
- C:\Windows\System\pnyGBpd.exe
  C:\Windows\System\pnyGBpd.exe
  2⤵
  PID:8004
- C:\Windows\System\YmJEaAo.exe
  C:\Windows\System\YmJEaAo.exe
  2⤵
  PID:8024
- C:\Windows\System\moeoGKC.exe
  C:\Windows\System\moeoGKC.exe
  2⤵
  PID:8064
- C:\Windows\System\mxunzai.exe
  C:\Windows\System\mxunzai.exe
  2⤵
  PID:8148
- C:\Windows\System\PhEspBF.exe
  C:\Windows\System\PhEspBF.exe
  2⤵
  PID:7060
- C:\Windows\System\uErIIWk.exe
  C:\Windows\System\uErIIWk.exe
  2⤵
  PID:7416
- C:\Windows\System\WYSWeII.exe
  C:\Windows\System\WYSWeII.exe
  2⤵
  PID:7564
- C:\Windows\System\ZWrGlxe.exe
  C:\Windows\System\ZWrGlxe.exe
  2⤵
  PID:7644
- C:\Windows\System\SCbHLAc.exe
  C:\Windows\System\SCbHLAc.exe
  2⤵
  PID:7864
- C:\Windows\System\mYshIXc.exe
  C:\Windows\System\mYshIXc.exe
  2⤵
  PID:7836
- C:\Windows\System\TAqWrtw.exe
  C:\Windows\System\TAqWrtw.exe
  2⤵
  PID:8068
- C:\Windows\System\bcJihjE.exe
  C:\Windows\System\bcJihjE.exe
  2⤵
  PID:7020
- C:\Windows\System\SQAOVYs.exe
  C:\Windows\System\SQAOVYs.exe
  2⤵
  PID:7420
- C:\Windows\System\cyezkCZ.exe
  C:\Windows\System\cyezkCZ.exe
  2⤵
  PID:7628
- C:\Windows\System\iwkrYHz.exe
  C:\Windows\System\iwkrYHz.exe
  2⤵
  PID:7956
- C:\Windows\System\ROdDOaN.exe
  C:\Windows\System\ROdDOaN.exe
  2⤵
  PID:7840
- C:\Windows\System\KZxqtfq.exe
  C:\Windows\System\KZxqtfq.exe
  2⤵
  PID:8212
- C:\Windows\System\LmHvRQk.exe
  C:\Windows\System\LmHvRQk.exe
  2⤵
  PID:8232
- C:\Windows\System\zkiQdGF.exe
  C:\Windows\System\zkiQdGF.exe
  2⤵
  PID:8268
- C:\Windows\System\HNUGHRR.exe
  C:\Windows\System\HNUGHRR.exe
  2⤵
  PID:8288
- C:\Windows\System\ohdAExa.exe
  C:\Windows\System\ohdAExa.exe
  2⤵
  PID:8344
- C:\Windows\System\sKTMHyK.exe
  C:\Windows\System\sKTMHyK.exe
  2⤵
  PID:8364
- C:\Windows\System\NgFnyrM.exe
  C:\Windows\System\NgFnyrM.exe
  2⤵
  PID:8420
- C:\Windows\System\qmYpJYK.exe
  C:\Windows\System\qmYpJYK.exe
  2⤵
  PID:8448
- C:\Windows\System\OpcNzoN.exe
  C:\Windows\System\OpcNzoN.exe
  2⤵
  PID:8464
- C:\Windows\System\OabORmW.exe
  C:\Windows\System\OabORmW.exe
  2⤵
  PID:8484
- C:\Windows\System\msLKvrR.exe
  C:\Windows\System\msLKvrR.exe
  2⤵
  PID:8516
- C:\Windows\System\pyhUrMq.exe
  C:\Windows\System\pyhUrMq.exe
  2⤵
  PID:8540
- C:\Windows\System\ePDOEbd.exe
  C:\Windows\System\ePDOEbd.exe
  2⤵
  PID:8572
- C:\Windows\System\fWNuuFH.exe
  C:\Windows\System\fWNuuFH.exe
  2⤵
  PID:8596
- C:\Windows\System\ocuSPWS.exe
  C:\Windows\System\ocuSPWS.exe
  2⤵
  PID:8616
- C:\Windows\System\ARBGgLb.exe
  C:\Windows\System\ARBGgLb.exe
  2⤵
  PID:8672
- C:\Windows\System\kDdUfgP.exe
  C:\Windows\System\kDdUfgP.exe
  2⤵
  PID:8692
- C:\Windows\System\blbPMmx.exe
  C:\Windows\System\blbPMmx.exe
  2⤵
  PID:8720
- C:\Windows\System\RolrSxe.exe
  C:\Windows\System\RolrSxe.exe
  2⤵
  PID:8748
- C:\Windows\System\zYMZCQx.exe
  C:\Windows\System\zYMZCQx.exe
  2⤵
  PID:8772
- C:\Windows\System\RjEiwOW.exe
  C:\Windows\System\RjEiwOW.exe
  2⤵
  PID:8812
- C:\Windows\System\DVJvbmK.exe
  C:\Windows\System\DVJvbmK.exe
  2⤵
  PID:8832
- C:\Windows\System\HemOLdR.exe
  C:\Windows\System\HemOLdR.exe
  2⤵
  PID:8856
- C:\Windows\System\yzCwZls.exe
  C:\Windows\System\yzCwZls.exe
  2⤵
  PID:8872
- C:\Windows\System\XOkXejE.exe
  C:\Windows\System\XOkXejE.exe
  2⤵
  PID:8896
- C:\Windows\System\tanHKQM.exe
  C:\Windows\System\tanHKQM.exe
  2⤵
  PID:8924
- C:\Windows\System\TzgCeDW.exe
  C:\Windows\System\TzgCeDW.exe
  2⤵
  PID:8952
- C:\Windows\System\qMbDetJ.exe
  C:\Windows\System\qMbDetJ.exe
  2⤵
  PID:8988
- C:\Windows\System\yAITnBA.exe
  C:\Windows\System\yAITnBA.exe
  2⤵
  PID:9020
- C:\Windows\System\HKSdQHN.exe
  C:\Windows\System\HKSdQHN.exe
  2⤵
  PID:9040
- C:\Windows\System\PKGCkRf.exe
  C:\Windows\System\PKGCkRf.exe
  2⤵
  PID:9064
- C:\Windows\System\CvSrdQY.exe
  C:\Windows\System\CvSrdQY.exe
  2⤵
  PID:9112
- C:\Windows\System\dXvHnjh.exe
  C:\Windows\System\dXvHnjh.exe
  2⤵
  PID:9136
- C:\Windows\System\zPhCtZg.exe
  C:\Windows\System\zPhCtZg.exe
  2⤵
  PID:9176
- C:\Windows\System\rIvSSnm.exe
  C:\Windows\System\rIvSSnm.exe
  2⤵
  PID:9204
- C:\Windows\System\RleSUgH.exe
  C:\Windows\System\RleSUgH.exe
  2⤵
  PID:7548
- C:\Windows\System\WZqQzrt.exe
  C:\Windows\System\WZqQzrt.exe
  2⤵
  PID:8312
- C:\Windows\System\CCgFoMy.exe
  C:\Windows\System\CCgFoMy.exe
  2⤵
  PID:8328
- C:\Windows\System\lzQxnhq.exe
  C:\Windows\System\lzQxnhq.exe
  2⤵
  PID:8388
- C:\Windows\System\mkYbVoo.exe
  C:\Windows\System\mkYbVoo.exe
  2⤵
  PID:8460
- C:\Windows\System\fCJbnGL.exe
  C:\Windows\System\fCJbnGL.exe
  2⤵
  PID:8504
- C:\Windows\System\FQedirj.exe
  C:\Windows\System\FQedirj.exe
  2⤵
  PID:8560
- C:\Windows\System\CbedmKu.exe
  C:\Windows\System\CbedmKu.exe
  2⤵
  PID:8660
- C:\Windows\System\QniRYfI.exe
  C:\Windows\System\QniRYfI.exe
  2⤵
  PID:8680
- C:\Windows\System\CyPxPuz.exe
  C:\Windows\System\CyPxPuz.exe
  2⤵
  PID:8736
- C:\Windows\System\ukadCyr.exe
  C:\Windows\System\ukadCyr.exe
  2⤵
  PID:8792
- C:\Windows\System\ywccxcV.exe
  C:\Windows\System\ywccxcV.exe
  2⤵
  PID:8828
- C:\Windows\System\JVAoPTr.exe
  C:\Windows\System\JVAoPTr.exe
  2⤵
  PID:8892
- C:\Windows\System\PnflWCX.exe
  C:\Windows\System\PnflWCX.exe
  2⤵
  PID:8948
- C:\Windows\System\DIYcHsC.exe
  C:\Windows\System\DIYcHsC.exe
  2⤵
  PID:9012
- C:\Windows\System\YrvHCEu.exe
  C:\Windows\System\YrvHCEu.exe
  2⤵
  PID:9172
- C:\Windows\System\YzHVNlD.exe
  C:\Windows\System\YzHVNlD.exe
  2⤵
  PID:8200
- C:\Windows\System\jHIALjh.exe
  C:\Windows\System\jHIALjh.exe
  2⤵
  PID:8444
- C:\Windows\System\RHccqpr.exe
  C:\Windows\System\RHccqpr.exe
  2⤵
  PID:8636
- C:\Windows\System\lyatSDX.exe
  C:\Windows\System\lyatSDX.exe
  2⤵
  PID:8656
- C:\Windows\System\gsFDiPr.exe
  C:\Windows\System\gsFDiPr.exe
  2⤵
  PID:8888
- C:\Windows\System\QspvPGZ.exe
  C:\Windows\System\QspvPGZ.exe
  2⤵
  PID:9008
- C:\Windows\System\jHxSbsu.exe
  C:\Windows\System\jHxSbsu.exe
  2⤵
  PID:9088
- C:\Windows\System\CCTsgpK.exe
  C:\Windows\System\CCTsgpK.exe
  2⤵
  PID:8408
- C:\Windows\System\xfbHHyZ.exe
  C:\Windows\System\xfbHHyZ.exe
  2⤵
  PID:8612
- C:\Windows\System\twJdtPh.exe
  C:\Windows\System\twJdtPh.exe
  2⤵
  PID:9120
- C:\Windows\System\YaQdbtT.exe
  C:\Windows\System\YaQdbtT.exe
  2⤵
  PID:9036
- C:\Windows\System\QKQlbyY.exe
  C:\Windows\System\QKQlbyY.exe
  2⤵
  PID:9228
- C:\Windows\System\JoYNtXV.exe
  C:\Windows\System\JoYNtXV.exe
  2⤵
  PID:9248
- C:\Windows\System\JXrIvgh.exe
  C:\Windows\System\JXrIvgh.exe
  2⤵
  PID:9284
- C:\Windows\System\JikJuKF.exe
  C:\Windows\System\JikJuKF.exe
  2⤵
  PID:9312
- C:\Windows\System\oshGUTH.exe
  C:\Windows\System\oshGUTH.exe
  2⤵
  PID:9344
- C:\Windows\System\BzcWGXR.exe
  C:\Windows\System\BzcWGXR.exe
  2⤵
  PID:9372
- C:\Windows\System\BqUlPcG.exe
  C:\Windows\System\BqUlPcG.exe
  2⤵
  PID:9392
- C:\Windows\System\kpdjHLy.exe
  C:\Windows\System\kpdjHLy.exe
  2⤵
  PID:9432
- C:\Windows\System\dPppcGr.exe
  C:\Windows\System\dPppcGr.exe
  2⤵
  PID:9448
- C:\Windows\System\BnewQIk.exe
  C:\Windows\System\BnewQIk.exe
  2⤵
  PID:9504
- C:\Windows\System\qqXOCfA.exe
  C:\Windows\System\qqXOCfA.exe
  2⤵
  PID:9548
- C:\Windows\System\sbJcJMK.exe
  C:\Windows\System\sbJcJMK.exe
  2⤵
  PID:9564
- C:\Windows\System\KZhSeNc.exe
  C:\Windows\System\KZhSeNc.exe
  2⤵
  PID:9580
- C:\Windows\System\EigFDjz.exe
  C:\Windows\System\EigFDjz.exe
  2⤵
  PID:9628
- C:\Windows\System\eXZIKlC.exe
  C:\Windows\System\eXZIKlC.exe
  2⤵
  PID:9660
- C:\Windows\System\EdShKxR.exe
  C:\Windows\System\EdShKxR.exe
  2⤵
  PID:9688
- C:\Windows\System\mmpDiYD.exe
  C:\Windows\System\mmpDiYD.exe
  2⤵
  PID:9704
- C:\Windows\System\OPNudvC.exe
  C:\Windows\System\OPNudvC.exe
  2⤵
  PID:9728
- C:\Windows\System\mXZsRHE.exe
  C:\Windows\System\mXZsRHE.exe
  2⤵
  PID:9744
- C:\Windows\System\HnQEzsX.exe
  C:\Windows\System\HnQEzsX.exe
  2⤵
  PID:9764
- C:\Windows\System\nLQHCbM.exe
  C:\Windows\System\nLQHCbM.exe
  2⤵
  PID:9832
- C:\Windows\System\kUJWXvj.exe
  C:\Windows\System\kUJWXvj.exe
  2⤵
  PID:9852
- C:\Windows\System\pkqKJcg.exe
  C:\Windows\System\pkqKJcg.exe
  2⤵
  PID:9872
- C:\Windows\System\iOmZbzu.exe
  C:\Windows\System\iOmZbzu.exe
  2⤵
  PID:9888
- C:\Windows\System\uQEmrKz.exe
  C:\Windows\System\uQEmrKz.exe
  2⤵
  PID:9928
- C:\Windows\System\RfTSMtG.exe
  C:\Windows\System\RfTSMtG.exe
  2⤵
  PID:9964
- C:\Windows\System\WLSnhRi.exe
  C:\Windows\System\WLSnhRi.exe
  2⤵
  PID:9988
- C:\Windows\System\LXtvLNc.exe
  C:\Windows\System\LXtvLNc.exe
  2⤵
  PID:10020
- C:\Windows\System\gOkaNuJ.exe
  C:\Windows\System\gOkaNuJ.exe
  2⤵
  PID:10064
- C:\Windows\System\XbPiUOg.exe
  C:\Windows\System\XbPiUOg.exe
  2⤵
  PID:10080
- C:\Windows\System\NmxcBix.exe
  C:\Windows\System\NmxcBix.exe
  2⤵
  PID:10104
- C:\Windows\System\mGOHDKO.exe
  C:\Windows\System\mGOHDKO.exe
  2⤵
  PID:10136
- C:\Windows\System\jHHzavW.exe
  C:\Windows\System\jHHzavW.exe
  2⤵
  PID:10164
- C:\Windows\System\dYOQjtP.exe
  C:\Windows\System\dYOQjtP.exe
  2⤵
  PID:10188
- C:\Windows\System\AVfWSdz.exe
  C:\Windows\System\AVfWSdz.exe
  2⤵
  PID:10212
- C:\Windows\System\KkEZKII.exe
  C:\Windows\System\KkEZKII.exe
  2⤵
  PID:8500
- C:\Windows\System\jXLwdhq.exe
  C:\Windows\System\jXLwdhq.exe
  2⤵
  PID:9264
- C:\Windows\System\JKyxBRc.exe
  C:\Windows\System\JKyxBRc.exe
  2⤵
  PID:9292
- C:\Windows\System\SivJerU.exe
  C:\Windows\System\SivJerU.exe
  2⤵
  PID:9444
- C:\Windows\System\PjFdKji.exe
  C:\Windows\System\PjFdKji.exe
  2⤵
  PID:9516
- C:\Windows\System\NPKcReg.exe
  C:\Windows\System\NPKcReg.exe
  2⤵
  PID:9544
- C:\Windows\System\TzBzWfz.exe
  C:\Windows\System\TzBzWfz.exe
  2⤵
  PID:9620
- C:\Windows\System\MhUzgyz.exe
  C:\Windows\System\MhUzgyz.exe
  2⤵
  PID:9672
- C:\Windows\System\hoRaGMR.exe
  C:\Windows\System\hoRaGMR.exe
  2⤵
  PID:9736
- C:\Windows\System\PSnMrae.exe
  C:\Windows\System\PSnMrae.exe
  2⤵
  PID:9760
- C:\Windows\System\XMHTIgA.exe
  C:\Windows\System\XMHTIgA.exe
  2⤵
  PID:9820
- C:\Windows\System\PQRZPWs.exe
  C:\Windows\System\PQRZPWs.exe
  2⤵
  PID:9940
- C:\Windows\System\RbBROXn.exe
  C:\Windows\System\RbBROXn.exe
  2⤵
  PID:9984
- C:\Windows\System\ScAgHdP.exe
  C:\Windows\System\ScAgHdP.exe
  2⤵
  PID:10036
- C:\Windows\System\ajBoAUs.exe
  C:\Windows\System\ajBoAUs.exe
  2⤵
  PID:10092
- C:\Windows\System\hglqcnw.exe
  C:\Windows\System\hglqcnw.exe
  2⤵
  PID:10156
- C:\Windows\System\jGHPeHD.exe
  C:\Windows\System\jGHPeHD.exe
  2⤵
  PID:9360
- C:\Windows\System\xogmOHi.exe
  C:\Windows\System\xogmOHi.exe
  2⤵
  PID:9384
- C:\Windows\System\WORdkLy.exe
  C:\Windows\System\WORdkLy.exe
  2⤵
  PID:9500
- C:\Windows\System\aguIQGG.exe
  C:\Windows\System\aguIQGG.exe
  2⤵
  PID:9700
- C:\Windows\System\WhQJbkj.exe
  C:\Windows\System\WhQJbkj.exe
  2⤵
  PID:9800
- C:\Windows\System\klbvXKE.exe
  C:\Windows\System\klbvXKE.exe
  2⤵
  PID:9880
- C:\Windows\System\sNBDTBJ.exe
  C:\Windows\System\sNBDTBJ.exe
  2⤵
  PID:8228
- C:\Windows\System\dYoqRIQ.exe
  C:\Windows\System\dYoqRIQ.exe
  2⤵
  PID:8536
- C:\Windows\System\zznevsA.exe
  C:\Windows\System\zznevsA.exe
  2⤵
  PID:9424
- C:\Windows\System\XazrpOB.exe
  C:\Windows\System\XazrpOB.exe
  2⤵
  PID:9060
- C:\Windows\System\eruXSFc.exe
  C:\Windows\System\eruXSFc.exe
  2⤵
  PID:9428
- C:\Windows\System\JXtcxzd.exe
  C:\Windows\System\JXtcxzd.exe
  2⤵
  PID:9980
- C:\Windows\System\SNIgyJp.exe
  C:\Windows\System\SNIgyJp.exe
  2⤵
  PID:10272
- C:\Windows\System\CBNNvEE.exe
  C:\Windows\System\CBNNvEE.exe
  2⤵
  PID:10300
- C:\Windows\System\icZKPRq.exe
  C:\Windows\System\icZKPRq.exe
  2⤵
  PID:10320
- C:\Windows\System\YpxpXAK.exe
  C:\Windows\System\YpxpXAK.exe
  2⤵
  PID:10340
- C:\Windows\System\sYKdJrx.exe
  C:\Windows\System\sYKdJrx.exe
  2⤵
  PID:10360
- C:\Windows\System\LavYbpS.exe
  C:\Windows\System\LavYbpS.exe
  2⤵
  PID:10376
- C:\Windows\System\qKdABgo.exe
  C:\Windows\System\qKdABgo.exe
  2⤵
  PID:10432
- C:\Windows\System\kJfmqEn.exe
  C:\Windows\System\kJfmqEn.exe
  2⤵
  PID:10464
- C:\Windows\System\jzGheBv.exe
  C:\Windows\System\jzGheBv.exe
  2⤵
  PID:10480
- C:\Windows\System\tTSmbtN.exe
  C:\Windows\System\tTSmbtN.exe
  2⤵
  PID:10500
- C:\Windows\System\mInyShz.exe
  C:\Windows\System\mInyShz.exe
  2⤵
  PID:10524
- C:\Windows\System\ZwvVeex.exe
  C:\Windows\System\ZwvVeex.exe
  2⤵
  PID:10556
- C:\Windows\System\emQQMtN.exe
  C:\Windows\System\emQQMtN.exe
  2⤵
  PID:10580
- C:\Windows\System\JmerFow.exe
  C:\Windows\System\JmerFow.exe
  2⤵
  PID:10620
- C:\Windows\System\nfbVTtX.exe
  C:\Windows\System\nfbVTtX.exe
  2⤵
  PID:10640
- C:\Windows\System\zCmtHvN.exe
  C:\Windows\System\zCmtHvN.exe
  2⤵
  PID:10668
- C:\Windows\System\KfjNeqs.exe
  C:\Windows\System\KfjNeqs.exe
  2⤵
  PID:10696
- C:\Windows\System\wZtafhC.exe
  C:\Windows\System\wZtafhC.exe
  2⤵
  PID:10720
- C:\Windows\System\uksrrkl.exe
  C:\Windows\System\uksrrkl.exe
  2⤵
  PID:10760
- C:\Windows\System\MJdiQdQ.exe
  C:\Windows\System\MJdiQdQ.exe
  2⤵
  PID:10780
- C:\Windows\System\miRgjhb.exe
  C:\Windows\System\miRgjhb.exe
  2⤵
  PID:10804
- C:\Windows\System\mMGiuzX.exe
  C:\Windows\System\mMGiuzX.exe
  2⤵
  PID:10860
- C:\Windows\System\rKTtpZs.exe
  C:\Windows\System\rKTtpZs.exe
  2⤵
  PID:10888
- C:\Windows\System\SVBiPss.exe
  C:\Windows\System\SVBiPss.exe
  2⤵
  PID:10916
- C:\Windows\System\MydPqtW.exe
  C:\Windows\System\MydPqtW.exe
  2⤵
  PID:10940
- C:\Windows\System\scjACLD.exe
  C:\Windows\System\scjACLD.exe
  2⤵
  PID:10968
- C:\Windows\System\KhaxXrM.exe
  C:\Windows\System\KhaxXrM.exe
  2⤵
  PID:10992
- C:\Windows\System\dBeAqzP.exe
  C:\Windows\System\dBeAqzP.exe
  2⤵
  PID:11020
- C:\Windows\System\lqbyOBb.exe
  C:\Windows\System\lqbyOBb.exe
  2⤵
  PID:11040
- C:\Windows\System\CQQDolQ.exe
  C:\Windows\System\CQQDolQ.exe
  2⤵
  PID:11068
- C:\Windows\System\JHYzwqX.exe
  C:\Windows\System\JHYzwqX.exe
  2⤵
  PID:11088
- C:\Windows\System\SPxlKtC.exe
  C:\Windows\System\SPxlKtC.exe
  2⤵
  PID:11128
- C:\Windows\System\TFUSebu.exe
  C:\Windows\System\TFUSebu.exe
  2⤵
  PID:11160
- C:\Windows\System\akYbZtD.exe
  C:\Windows\System\akYbZtD.exe
  2⤵
  PID:11184
- C:\Windows\System\tYMeNnr.exe
  C:\Windows\System\tYMeNnr.exe
  2⤵
  PID:11200
- C:\Windows\System\DwkUrzr.exe
  C:\Windows\System\DwkUrzr.exe
  2⤵
  PID:11240
- C:\Windows\System\UuESujr.exe
  C:\Windows\System\UuESujr.exe
  2⤵
  PID:10260
- C:\Windows\System\pVqusQr.exe
  C:\Windows\System\pVqusQr.exe
  2⤵
  PID:10308
- C:\Windows\System\FcXKrax.exe
  C:\Windows\System\FcXKrax.exe
  2⤵
  PID:10332
- C:\Windows\System\DFfOQUs.exe
  C:\Windows\System\DFfOQUs.exe
  2⤵
  PID:10424
- C:\Windows\System\yKeanEz.exe
  C:\Windows\System\yKeanEz.exe
  2⤵
  PID:10508
- C:\Windows\System\RQxOVyp.exe
  C:\Windows\System\RQxOVyp.exe
  2⤵
  PID:10552
- C:\Windows\System\NxVIOTC.exe
  C:\Windows\System\NxVIOTC.exe
  2⤵
  PID:10632
- C:\Windows\System\dihBPoa.exe
  C:\Windows\System\dihBPoa.exe
  2⤵
  PID:10684
- C:\Windows\System\ZdAhDxG.exe
  C:\Windows\System\ZdAhDxG.exe
  2⤵
  PID:10712
- C:\Windows\System\vQsfQUC.exe
  C:\Windows\System\vQsfQUC.exe
  2⤵
  PID:10752
- C:\Windows\System\pBknFTH.exe
  C:\Windows\System\pBknFTH.exe
  2⤵
  PID:10872
- C:\Windows\System\pMdUvHn.exe
  C:\Windows\System\pMdUvHn.exe
  2⤵
  PID:11000
- C:\Windows\System\uxvFBhk.exe
  C:\Windows\System\uxvFBhk.exe
  2⤵
  PID:11012
- C:\Windows\System\hGteaKE.exe
  C:\Windows\System\hGteaKE.exe
  2⤵
  PID:11100
- C:\Windows\System\dIxdlFq.exe
  C:\Windows\System\dIxdlFq.exe
  2⤵
  PID:11120
- C:\Windows\System\fWgRwiz.exe
  C:\Windows\System\fWgRwiz.exe
  2⤵
  PID:11236
- C:\Windows\System\atbHntr.exe
  C:\Windows\System\atbHntr.exe
  2⤵
  PID:10292
- C:\Windows\System\nluZibb.exe
  C:\Windows\System\nluZibb.exe
  2⤵
  PID:10312
- C:\Windows\System\jiXDZlI.exe
  C:\Windows\System\jiXDZlI.exe
  2⤵
  PID:10496
- C:\Windows\System\RsTYBCQ.exe
  C:\Windows\System\RsTYBCQ.exe
  2⤵
  PID:10656
- C:\Windows\System\APTdNhj.exe
  C:\Windows\System\APTdNhj.exe
  2⤵
  PID:10748
- C:\Windows\System\CpsOrAY.exe
  C:\Windows\System\CpsOrAY.exe
  2⤵
  PID:10924
- C:\Windows\System\lYjwLlX.exe
  C:\Windows\System\lYjwLlX.exe
  2⤵
  PID:11168
- C:\Windows\System\qobDkNX.exe
  C:\Windows\System\qobDkNX.exe
  2⤵
  PID:10488
- C:\Windows\System\jtVwRYU.exe
  C:\Windows\System\jtVwRYU.exe
  2⤵
  PID:10648
- C:\Windows\System\mmmWCQM.exe
  C:\Windows\System\mmmWCQM.exe
  2⤵
  PID:10908
- C:\Windows\System\rEqFrDx.exe
  C:\Windows\System\rEqFrDx.exe
  2⤵
  PID:11260
- C:\Windows\System\PBsnFYD.exe
  C:\Windows\System\PBsnFYD.exe
  2⤵
  PID:11304
- C:\Windows\System\pkYGQap.exe
  C:\Windows\System\pkYGQap.exe
  2⤵
  PID:11332
- C:\Windows\System\HZzMdNK.exe
  C:\Windows\System\HZzMdNK.exe
  2⤵
  PID:11348
- C:\Windows\System\FcEUtoc.exe
  C:\Windows\System\FcEUtoc.exe
  2⤵
  PID:11372
- C:\Windows\System\rdYPcze.exe
  C:\Windows\System\rdYPcze.exe
  2⤵
  PID:11388
- C:\Windows\System\qLMrFHz.exe
  C:\Windows\System\qLMrFHz.exe
  2⤵
  PID:11412
- C:\Windows\System\sgTiKoV.exe
  C:\Windows\System\sgTiKoV.exe
  2⤵
  PID:11452
- C:\Windows\System\MuKUXwW.exe
  C:\Windows\System\MuKUXwW.exe
  2⤵
  PID:11468
- C:\Windows\System\ckvHopN.exe
  C:\Windows\System\ckvHopN.exe
  2⤵
  PID:11492
- C:\Windows\System\aEpDVAA.exe
  C:\Windows\System\aEpDVAA.exe
  2⤵
  PID:11524
- C:\Windows\System\NIklnWt.exe
  C:\Windows\System\NIklnWt.exe
  2⤵
  PID:11564
- C:\Windows\System\JLSBwPv.exe
  C:\Windows\System\JLSBwPv.exe
  2⤵
  PID:11584
- C:\Windows\System\AfsCkYt.exe
  C:\Windows\System\AfsCkYt.exe
  2⤵
  PID:11620
- C:\Windows\System\wJMSQdb.exe
  C:\Windows\System\wJMSQdb.exe
  2⤵
  PID:11644
- C:\Windows\System\hBBsLNA.exe
  C:\Windows\System\hBBsLNA.exe
  2⤵
  PID:11668
- C:\Windows\System\BOKWuet.exe
  C:\Windows\System\BOKWuet.exe
  2⤵
  PID:11688
- C:\Windows\System\OIRCFvD.exe
  C:\Windows\System\OIRCFvD.exe
  2⤵
  PID:11732
- C:\Windows\System\OYCQlQT.exe
  C:\Windows\System\OYCQlQT.exe
  2⤵
  PID:11764
- C:\Windows\System\hCarJEI.exe
  C:\Windows\System\hCarJEI.exe
  2⤵
  PID:11788
- C:\Windows\System\jBVTffZ.exe
  C:\Windows\System\jBVTffZ.exe
  2⤵
  PID:11808
- C:\Windows\System\uEOnhKu.exe
  C:\Windows\System\uEOnhKu.exe
  2⤵
  PID:11836
- C:\Windows\System\ReQmgJe.exe
  C:\Windows\System\ReQmgJe.exe
  2⤵
  PID:11856
- C:\Windows\System\XsWJaIK.exe
  C:\Windows\System\XsWJaIK.exe
  2⤵
  PID:11872
- C:\Windows\System\uhVilmn.exe
  C:\Windows\System\uhVilmn.exe
  2⤵
  PID:11908
- C:\Windows\System\kpYycAE.exe
  C:\Windows\System\kpYycAE.exe
  2⤵
  PID:11944
- C:\Windows\System\vQjWWwW.exe
  C:\Windows\System\vQjWWwW.exe
  2⤵
  PID:11972
- C:\Windows\System\XsbNaCu.exe
  C:\Windows\System\XsbNaCu.exe
  2⤵
  PID:11996
- C:\Windows\System\sjcshRH.exe
  C:\Windows\System\sjcshRH.exe
  2⤵
  PID:12024
- C:\Windows\System\UBaMoUL.exe
  C:\Windows\System\UBaMoUL.exe
  2⤵
  PID:12044
- C:\Windows\System\fqFfbcU.exe
  C:\Windows\System\fqFfbcU.exe
  2⤵
  PID:12076
- C:\Windows\System\FFiQCaD.exe
  C:\Windows\System\FFiQCaD.exe
  2⤵
  PID:12092
- C:\Windows\System\SlGaWGE.exe
  C:\Windows\System\SlGaWGE.exe
  2⤵
  PID:12116
- C:\Windows\System\MOPjspI.exe
  C:\Windows\System\MOPjspI.exe
  2⤵
  PID:12140
- C:\Windows\System\NHIxAgs.exe
  C:\Windows\System\NHIxAgs.exe
  2⤵
  PID:12156
- C:\Windows\System\JXKUCRe.exe
  C:\Windows\System\JXKUCRe.exe
  2⤵
  PID:12184
- C:\Windows\System\HfxkLmX.exe
  C:\Windows\System\HfxkLmX.exe
  2⤵
  PID:12212
- C:\Windows\System\pwlXxsC.exe
  C:\Windows\System\pwlXxsC.exe
  2⤵
  PID:12264
- C:\Windows\System\JepNLpA.exe
  C:\Windows\System\JepNLpA.exe
  2⤵
  PID:9528
- C:\Windows\System\suYRCIg.exe
  C:\Windows\System\suYRCIg.exe
  2⤵
  PID:11344
- C:\Windows\System\kvdSsOg.exe
  C:\Windows\System\kvdSsOg.exe
  2⤵
  PID:11404
- C:\Windows\System\OHNXitw.exe
  C:\Windows\System\OHNXitw.exe
  2⤵
  PID:11520
- C:\Windows\System\rpQqYdF.exe
  C:\Windows\System\rpQqYdF.exe
  2⤵
  PID:11560
- C:\Windows\System\IutKCBR.exe
  C:\Windows\System\IutKCBR.exe
  2⤵
  PID:11632
- C:\Windows\System\kXQRWDS.exe
  C:\Windows\System\kXQRWDS.exe
  2⤵
  PID:11680
- C:\Windows\System\iLepYNT.exe
  C:\Windows\System\iLepYNT.exe
  2⤵
  PID:11720
- C:\Windows\System\gfAqixV.exe
  C:\Windows\System\gfAqixV.exe
  2⤵
  PID:11776
- C:\Windows\System\QRiyQDL.exe
  C:\Windows\System\QRiyQDL.exe
  2⤵
  PID:11832
- C:\Windows\System\DAmmgeJ.exe
  C:\Windows\System\DAmmgeJ.exe
  2⤵
  PID:11892
- C:\Windows\System\lcgjaCC.exe
  C:\Windows\System\lcgjaCC.exe
  2⤵
  PID:11952
- C:\Windows\System\phXMtgy.exe
  C:\Windows\System\phXMtgy.exe
  2⤵
  PID:12084
- C:\Windows\System\cJamkhz.exe
  C:\Windows\System\cJamkhz.exe
  2⤵
  PID:12108
- C:\Windows\System\Bwgtyso.exe
  C:\Windows\System\Bwgtyso.exe
  2⤵
  PID:12196
- C:\Windows\System\AxvCapR.exe
  C:\Windows\System\AxvCapR.exe
  2⤵
  PID:11296
- C:\Windows\System\QCYWSzN.exe
  C:\Windows\System\QCYWSzN.exe
  2⤵
  PID:11380
- C:\Windows\System\fNIpdMh.exe
  C:\Windows\System\fNIpdMh.exe
  2⤵
  PID:11484
- C:\Windows\System\EDunoxR.exe
  C:\Windows\System\EDunoxR.exe
  2⤵
  PID:11600
- C:\Windows\System\fDfoyfm.exe
  C:\Windows\System\fDfoyfm.exe
  2⤵
  PID:11740
- C:\Windows\System\FDoqBjo.exe
  C:\Windows\System\FDoqBjo.exe
  2⤵
  PID:11940
- C:\Windows\System\hSKULFq.exe
  C:\Windows\System\hSKULFq.exe
  2⤵
  PID:12032
- C:\Windows\System\AwgZXez.exe
  C:\Windows\System\AwgZXez.exe
  2⤵
  PID:11320
- C:\Windows\System\jyIteGw.exe
  C:\Windows\System\jyIteGw.exe
  2⤵
  PID:11576
- C:\Windows\System\aHUfcKX.exe
  C:\Windows\System\aHUfcKX.exe
  2⤵
  PID:12148
- C:\Windows\System\qAsRiDk.exe
  C:\Windows\System\qAsRiDk.exe
  2⤵
  PID:12276
- C:\Windows\System\sSKJSny.exe
  C:\Windows\System\sSKJSny.exe
  2⤵
  PID:12296
- C:\Windows\System\uWNbQHx.exe
  C:\Windows\System\uWNbQHx.exe
  2⤵
  PID:12320
- C:\Windows\System\qJiJedU.exe
  C:\Windows\System\qJiJedU.exe
  2⤵
  PID:12344
- C:\Windows\System\EmJkJJX.exe
  C:\Windows\System\EmJkJJX.exe
  2⤵
  PID:12364
- C:\Windows\System\amLBfsH.exe
  C:\Windows\System\amLBfsH.exe
  2⤵
  PID:12420
- C:\Windows\System\hFvQwtV.exe
  C:\Windows\System\hFvQwtV.exe
  2⤵
  PID:12460
- C:\Windows\System\HbXQbvU.exe
  C:\Windows\System\HbXQbvU.exe
  2⤵
  PID:12488
- C:\Windows\System\upuxMlJ.exe
  C:\Windows\System\upuxMlJ.exe
  2⤵
  PID:12512
- C:\Windows\System\pkgziLW.exe
  C:\Windows\System\pkgziLW.exe
  2⤵
  PID:12532
- C:\Windows\System\ieLlKUc.exe
  C:\Windows\System\ieLlKUc.exe
  2⤵
  PID:12556
- C:\Windows\System\ckfWsMm.exe
  C:\Windows\System\ckfWsMm.exe
  2⤵
  PID:12576
- C:\Windows\System\MDamVDY.exe
  C:\Windows\System\MDamVDY.exe
  2⤵
  PID:12604
- C:\Windows\System\GykwaTD.exe
  C:\Windows\System\GykwaTD.exe
  2⤵
  PID:12636
- C:\Windows\System\GbaOMlc.exe
  C:\Windows\System\GbaOMlc.exe
  2⤵
  PID:12660
- C:\Windows\System\paECCoD.exe
  C:\Windows\System\paECCoD.exe
  2⤵
  PID:12684
- C:\Windows\System\jPbNFaF.exe
  C:\Windows\System\jPbNFaF.exe
  2⤵
  PID:12740
- C:\Windows\System\WhDiyTK.exe
  C:\Windows\System\WhDiyTK.exe
  2⤵
  PID:12756
- C:\Windows\System\fBrkaMD.exe
  C:\Windows\System\fBrkaMD.exe
  2⤵
  PID:12772
- C:\Windows\System\fEvAQAn.exe
  C:\Windows\System\fEvAQAn.exe
  2⤵
  PID:12796
- C:\Windows\System\avsaCDR.exe
  C:\Windows\System\avsaCDR.exe
  2⤵
  PID:12832
- C:\Windows\System\mAtgUSO.exe
  C:\Windows\System\mAtgUSO.exe
  2⤵
  PID:12852
- C:\Windows\System\bToZYmP.exe
  C:\Windows\System\bToZYmP.exe
  2⤵
  PID:12908
- C:\Windows\System\jvLBfkr.exe
  C:\Windows\System\jvLBfkr.exe
  2⤵
  PID:12956
- C:\Windows\System\OwsAtBO.exe
  C:\Windows\System\OwsAtBO.exe
  2⤵
  PID:12972
- C:\Windows\System\pgYhaax.exe
  C:\Windows\System\pgYhaax.exe
  2⤵
  PID:13000
- C:\Windows\System\BIdvkiU.exe
  C:\Windows\System\BIdvkiU.exe
  2⤵
  PID:13024
- C:\Windows\System\kaYhQZI.exe
  C:\Windows\System\kaYhQZI.exe
  2⤵
  PID:13044
- C:\Windows\System\xqzzbVA.exe
  C:\Windows\System\xqzzbVA.exe
  2⤵
  PID:13060
- C:\Windows\System\sDAXGFS.exe
  C:\Windows\System\sDAXGFS.exe
  2⤵
  PID:13088
- C:\Windows\System\XhiKArp.exe
  C:\Windows\System\XhiKArp.exe
  2⤵
  PID:13116
- C:\Windows\System\QjtpRyk.exe
  C:\Windows\System\QjtpRyk.exe
  2⤵
  PID:13132
- C:\Windows\System\ixPSUAk.exe
  C:\Windows\System\ixPSUAk.exe
  2⤵
  PID:13152
- C:\Windows\System\OMBLNcL.exe
  C:\Windows\System\OMBLNcL.exe
  2⤵
  PID:13184
- C:\Windows\System\QhbAAmP.exe
  C:\Windows\System\QhbAAmP.exe
  2⤵
  PID:13240
- C:\Windows\System\xUkwSTO.exe
  C:\Windows\System\xUkwSTO.exe
  2⤵
  PID:13280
- C:\Windows\System\kipkllQ.exe
  C:\Windows\System\kipkllQ.exe
  2⤵
  PID:13308
- C:\Windows\System\KxdZAnc.exe
  C:\Windows\System\KxdZAnc.exe
  2⤵
  PID:12248
- C:\Windows\System\DdjVxHY.exe
  C:\Windows\System\DdjVxHY.exe
  2⤵
  PID:12328
- C:\Windows\System\HGazlpx.exe
  C:\Windows\System\HGazlpx.exe
  2⤵
  PID:12356
- C:\Windows\System\hvgvodS.exe
  C:\Windows\System\hvgvodS.exe
  2⤵
  PID:12416
- C:\Windows\System\fbDnCJe.exe
  C:\Windows\System\fbDnCJe.exe
  2⤵
  PID:12480
- C:\Windows\System\jVKEXQZ.exe
  C:\Windows\System\jVKEXQZ.exe
  2⤵
  PID:12588
- C:\Windows\System\BblbRYM.exe
  C:\Windows\System\BblbRYM.exe
  2⤵
  PID:12656
- C:\Windows\System\XxqNhMv.exe
  C:\Windows\System\XxqNhMv.exe
  2⤵
  PID:12680
- C:\Windows\System\qXtuBBH.exe
  C:\Windows\System\qXtuBBH.exe
  2⤵
  PID:12824
- C:\Windows\System\yeMnOKT.exe
  C:\Windows\System\yeMnOKT.exe
  2⤵
  PID:12868
- C:\Windows\System\bCMZzAi.exe
  C:\Windows\System\bCMZzAi.exe
  2⤵
  PID:12904
- C:\Windows\System\KJUCsPI.exe
  C:\Windows\System\KJUCsPI.exe
  2⤵
  PID:12968
- C:\Windows\System\gURqRwZ.exe
  C:\Windows\System\gURqRwZ.exe
  2⤵
  PID:13040
- C:\Windows\System\LDtLRBt.exe
  C:\Windows\System\LDtLRBt.exe
  2⤵
  PID:13076
- C:\Windows\System\NNukHwU.exe
  C:\Windows\System\NNukHwU.exe
  2⤵
  PID:13128
- C:\Windows\System\CtYUvkp.exe
  C:\Windows\System\CtYUvkp.exe
  2⤵
  PID:13220
- C:\Windows\System\rjBWOoz.exe
  C:\Windows\System\rjBWOoz.exe
  2⤵
  PID:11464
- C:\Windows\System\hCXqhSy.exe
  C:\Windows\System\hCXqhSy.exe
  2⤵
  PID:12408
- C:\Windows\System\LwhfhLB.exe
  C:\Windows\System\LwhfhLB.exe
  2⤵
  PID:12524
- C:\Windows\System\URMEwrD.exe
  C:\Windows\System\URMEwrD.exe
  2⤵
  PID:12724
- C:\Windows\System\hJNhgRs.exe
  C:\Windows\System\hJNhgRs.exe
  2⤵
  PID:12896
- C:\Windows\System\eGhZPNl.exe
  C:\Windows\System\eGhZPNl.exe
  2⤵
  PID:12964
- C:\Windows\System\angKiKa.exe
  C:\Windows\System\angKiKa.exe
  2⤵
  PID:13204
- C:\Windows\System\CYhjKpH.exe
  C:\Windows\System\CYhjKpH.exe
  2⤵
  PID:13272
- C:\Windows\System\lycSuli.exe
  C:\Windows\System\lycSuli.exe
  2⤵
  PID:12528
- C:\Windows\System\bBFqspz.exe
  C:\Windows\System\bBFqspz.exe
  2⤵
  PID:4000
- C:\Windows\System\hPslVAk.exe
  C:\Windows\System\hPslVAk.exe
  2⤵
  PID:13320
- C:\Windows\System\YSQRyTB.exe
  C:\Windows\System\YSQRyTB.exe
  2⤵
  PID:13348
- C:\Windows\System\gJTvSDt.exe
  C:\Windows\System\gJTvSDt.exe
  2⤵
  PID:13380
- C:\Windows\System\jvVruaI.exe
  C:\Windows\System\jvVruaI.exe
  2⤵
  PID:13420
- C:\Windows\System\tiuUoQR.exe
  C:\Windows\System\tiuUoQR.exe
  2⤵
  PID:13448
- C:\Windows\System\MkwHOhH.exe
  C:\Windows\System\MkwHOhH.exe
  2⤵
  PID:13468
- C:\Windows\System\EoEnMJG.exe
  C:\Windows\System\EoEnMJG.exe
  2⤵
  PID:13536
- C:\Windows\System\TTAnIje.exe
  C:\Windows\System\TTAnIje.exe
  2⤵
  PID:13556
- C:\Windows\System\kMqSCxP.exe
  C:\Windows\System\kMqSCxP.exe
  2⤵
  PID:13584
- C:\Windows\System\aFYfarN.exe
  C:\Windows\System\aFYfarN.exe
  2⤵
  PID:13628
- C:\Windows\System\prjjzeR.exe
  C:\Windows\System\prjjzeR.exe
  2⤵
  PID:13656
- C:\Windows\System\hANWDHz.exe
  C:\Windows\System\hANWDHz.exe
  2⤵
  PID:13684
- C:\Windows\System\LwYVbVh.exe
  C:\Windows\System\LwYVbVh.exe
  2⤵
  PID:13716
- C:\Windows\System\qKZRpjS.exe
  C:\Windows\System\qKZRpjS.exe
  2⤵
  PID:13752
- C:\Windows\System\cEEfnvE.exe
  C:\Windows\System\cEEfnvE.exe
  2⤵
  PID:13788
- C:\Windows\System\lwQvxZl.exe
  C:\Windows\System\lwQvxZl.exe
  2⤵
  PID:13804
- C:\Windows\System\KkQghLi.exe
  C:\Windows\System\KkQghLi.exe
  2⤵
  PID:13848
- C:\Windows\System\etkHrlr.exe
  C:\Windows\System\etkHrlr.exe
  2⤵
  PID:13872
- C:\Windows\System\cmkvPze.exe
  C:\Windows\System\cmkvPze.exe
  2⤵
  PID:13892
- C:\Windows\System\FRYBKdH.exe
  C:\Windows\System\FRYBKdH.exe
  2⤵
  PID:13932
- C:\Windows\System\SIzAXME.exe
  C:\Windows\System\SIzAXME.exe
  2⤵
  PID:14000
- C:\Windows\System\mtKrjFI.exe
  C:\Windows\System\mtKrjFI.exe
  2⤵
  PID:14028
- C:\Windows\System\zTglYqX.exe
  C:\Windows\System\zTglYqX.exe
  2⤵
  PID:14044
- C:\Windows\System\clKVsVf.exe
  C:\Windows\System\clKVsVf.exe
  2⤵
  PID:14080
- C:\Windows\System\qNurgaj.exe
  C:\Windows\System\qNurgaj.exe
  2⤵
  PID:14108
- C:\Windows\System\yrawUAX.exe
  C:\Windows\System\yrawUAX.exe
  2⤵
  PID:14144
- C:\Windows\System\whESNCC.exe
  C:\Windows\System\whESNCC.exe
  2⤵
  PID:14184
- C:\Windows\System\qltHNVi.exe
  C:\Windows\System\qltHNVi.exe
  2⤵
  PID:14212
- C:\Windows\System\HXnDLOu.exe
  C:\Windows\System\HXnDLOu.exe
  2⤵
  PID:14244
- C:\Windows\System\ylcUfPY.exe
  C:\Windows\System\ylcUfPY.exe
  2⤵
  PID:14268
- C:\Windows\System\GLMevem.exe
  C:\Windows\System\GLMevem.exe
  2⤵
  PID:14284
- C:\Windows\System\xGvSCuy.exe
  C:\Windows\System\xGvSCuy.exe
  2⤵
  PID:14300
- C:\Windows\System\FWtSAsr.exe
  C:\Windows\System\FWtSAsr.exe
  2⤵
  PID:14324
- C:\Windows\System\NsSPiHk.exe
  C:\Windows\System\NsSPiHk.exe
  2⤵
  PID:12792
- C:\Windows\System\XXIOeNF.exe
  C:\Windows\System\XXIOeNF.exe
  2⤵
  PID:13388
- C:\Windows\System\OnTypoO.exe
  C:\Windows\System\OnTypoO.exe
  2⤵
  PID:13528
- C:\Windows\System\KgdTYvd.exe
  C:\Windows\System\KgdTYvd.exe
  2⤵
  PID:13616
- C:\Windows\System\uDwuZsN.exe
  C:\Windows\System\uDwuZsN.exe
  2⤵
  PID:13676
- C:\Windows\System\jnLfZdN.exe
  C:\Windows\System\jnLfZdN.exe
  2⤵
  PID:13732
- C:\Windows\System\xTFZyOp.exe
  C:\Windows\System\xTFZyOp.exe
  2⤵
  PID:13856
- C:\Windows\System\sAruFVj.exe
  C:\Windows\System\sAruFVj.exe
  2⤵
  PID:13916
- C:\Windows\System\Aijyanh.exe
  C:\Windows\System\Aijyanh.exe
  2⤵
  PID:13984
- C:\Windows\System\hEWbRbC.exe
  C:\Windows\System\hEWbRbC.exe
  2⤵
  PID:14132
- C:\Windows\System\FiRykIm.exe
  C:\Windows\System\FiRykIm.exe
  2⤵
  PID:14168
- C:\Windows\System\BXxsJMD.exe
  C:\Windows\System\BXxsJMD.exe
  2⤵
  PID:14224
- C:\Windows\System\ZtrRWZQ.exe
  C:\Windows\System\ZtrRWZQ.exe
  2⤵
  PID:14260
- C:\Windows\System\ZrBHRMk.exe
  C:\Windows\System\ZrBHRMk.exe
  2⤵
  PID:14320
- C:\Windows\System\ehGsyZx.exe
  C:\Windows\System\ehGsyZx.exe
  2⤵
  PID:13576
- C:\Windows\System\efFPlmz.exe
  C:\Windows\System\efFPlmz.exe
  2⤵
  PID:13600
- C:\Windows\System\qAYxrAu.exe
  C:\Windows\System\qAYxrAu.exe
  2⤵
  PID:13800
- C:\Windows\System\htoZQqQ.exe
  C:\Windows\System\htoZQqQ.exe
  2⤵
  PID:13776
- C:\Windows\System\OYZvPlK.exe
  C:\Windows\System\OYZvPlK.exe
  2⤵
  PID:13948
- C:\Windows\System\bUwgWNf.exe
  C:\Windows\System\bUwgWNf.exe
  2⤵
  PID:14064
- C:\Windows\System\QOKcjNq.exe
  C:\Windows\System\QOKcjNq.exe
  2⤵
  PID:13408
- C:\Windows\System\GJpbyJz.exe
  C:\Windows\System\GJpbyJz.exe
  2⤵
  PID:14352
- C:\Windows\System\uvUHqPV.exe
  C:\Windows\System\uvUHqPV.exe
  2⤵
  PID:14408
- C:\Windows\System\QfvOvXh.exe
  C:\Windows\System\QfvOvXh.exe
  2⤵
  PID:14424
- C:\Windows\System\oTWgnGm.exe
  C:\Windows\System\oTWgnGm.exe
  2⤵
  PID:14448
- C:\Windows\System\qhtxygK.exe
  C:\Windows\System\qhtxygK.exe
  2⤵
  PID:14468
- C:\Windows\System\SHStnwZ.exe
  C:\Windows\System\SHStnwZ.exe
  2⤵
  PID:14492
- C:\Windows\System\FpznCCo.exe
  C:\Windows\System\FpznCCo.exe
  2⤵
  PID:14520
- C:\Windows\System\oAQNWdX.exe
  C:\Windows\System\oAQNWdX.exe
  2⤵
  PID:14540
- C:\Windows\System\jrnnlIH.exe
  C:\Windows\System\jrnnlIH.exe
  2⤵
  PID:14584
- C:\Windows\System\jtWtdPm.exe
  C:\Windows\System\jtWtdPm.exe
  2⤵
  PID:14612
- C:\Windows\System\bQwVLtM.exe
  C:\Windows\System\bQwVLtM.exe
  2⤵
  PID:14656
- C:\Windows\System\sfGoJpy.exe
  C:\Windows\System\sfGoJpy.exe
  2⤵
  PID:14680
- C:\Windows\System\xWADEmq.exe
  C:\Windows\System\xWADEmq.exe
  2⤵
  PID:14696
- C:\Windows\System\urIClnT.exe
  C:\Windows\System\urIClnT.exe
  2⤵
  PID:14712
- C:\Windows\System\FWpLlMS.exe
  C:\Windows\System\FWpLlMS.exe
  2⤵
  PID:14744
- C:\Windows\System\kTcYBzZ.exe
  C:\Windows\System\kTcYBzZ.exe
  2⤵
  PID:14792
- C:\Windows\System\YZLZcby.exe
  C:\Windows\System\YZLZcby.exe
  2⤵
  PID:14816
- C:\Windows\System\daMQPHm.exe
  C:\Windows\System\daMQPHm.exe
  2⤵
  PID:14848
- C:\Windows\System\deqbbTB.exe
  C:\Windows\System\deqbbTB.exe
  2⤵
  PID:14872
- C:\Windows\System\rkMWoCG.exe
  C:\Windows\System\rkMWoCG.exe
  2⤵
  PID:14908
- C:\Windows\System\meyuJTL.exe
  C:\Windows\System\meyuJTL.exe
  2⤵
  PID:14928
- C:\Windows\System\PwWcUUL.exe
  C:\Windows\System\PwWcUUL.exe
  2⤵
  PID:14956
- C:\Windows\System\kWnEJTR.exe
  C:\Windows\System\kWnEJTR.exe
  2⤵
  PID:14992
- C:\Windows\System\IrMjzqC.exe
  C:\Windows\System\IrMjzqC.exe
  2⤵
  PID:15016
- C:\Windows\System\kVPWYtu.exe
  C:\Windows\System\kVPWYtu.exe
  2⤵
  PID:15032
- C:\Windows\System\uyCPLcd.exe
  C:\Windows\System\uyCPLcd.exe
  2⤵
  PID:15056
- C:\Windows\System\THqFeoE.exe
  C:\Windows\System\THqFeoE.exe
  2⤵
  PID:15104
- C:\Windows\System\TSXAQNy.exe
  C:\Windows\System\TSXAQNy.exe
  2⤵
  PID:15124
- C:\Windows\System\pDFLLhI.exe
  C:\Windows\System\pDFLLhI.exe
  2⤵
  PID:15144
- C:\Windows\System\hEvrKUb.exe
  C:\Windows\System\hEvrKUb.exe
  2⤵
  PID:15160
- C:\Windows\System\bSewpCZ.exe
  C:\Windows\System\bSewpCZ.exe
  2⤵
  PID:15176
- C:\Windows\System\uhprzzS.exe
  C:\Windows\System\uhprzzS.exe
  2⤵
  PID:15220
- C:\Windows\System\FlRWoQB.exe
  C:\Windows\System\FlRWoQB.exe
  2⤵
  PID:15244
- C:\Windows\System\wLVcRcW.exe
  C:\Windows\System\wLVcRcW.exe
  2⤵
  PID:15292
- C:\Windows\System\HxCbezu.exe
  C:\Windows\System\HxCbezu.exe
  2⤵
  PID:15320
- C:\Windows\System\kVeYGwM.exe
  C:\Windows\System\kVeYGwM.exe
  2⤵
  PID:15352
- C:\Windows\System\inBZSAp.exe
  C:\Windows\System\inBZSAp.exe
  2⤵
  PID:13888
- C:\Windows\System\qXTEZIY.exe
  C:\Windows\System\qXTEZIY.exe
  2⤵
  PID:14444
- C:\Windows\System\vwZGxxk.exe
  C:\Windows\System\vwZGxxk.exe
  2⤵
  PID:14504
- C:\Windows\System\XFizgDf.exe
  C:\Windows\System\XFizgDf.exe
  2⤵
  PID:14528
- C:\Windows\System\paRJcYX.exe
  C:\Windows\System\paRJcYX.exe
  2⤵
  PID:14568
- C:\Windows\System\ONxMRgi.exe
  C:\Windows\System\ONxMRgi.exe
  2⤵
  PID:14652
- C:\Windows\System\FtRBKMs.exe
  C:\Windows\System\FtRBKMs.exe
  2⤵
  PID:14740
- C:\Windows\System\ZjAMvjG.exe
  C:\Windows\System\ZjAMvjG.exe
  2⤵
  PID:14832
- C:\Windows\System\WowTVaa.exe
  C:\Windows\System\WowTVaa.exe
  2⤵
  PID:14836
- C:\Windows\System\aRIwFHx.exe
  C:\Windows\System\aRIwFHx.exe
  2⤵
  PID:14892
- C:\Windows\System\VXWSRIs.exe
  C:\Windows\System\VXWSRIs.exe
  2⤵
  PID:14964
- C:\Windows\System\kpsmjiZ.exe
  C:\Windows\System\kpsmjiZ.exe
  2⤵
  PID:15028
- C:\Windows\System\CDAlmQD.exe
  C:\Windows\System\CDAlmQD.exe
  2⤵
  PID:15076
- C:\Windows\System\zrNbxBc.exe
  C:\Windows\System\zrNbxBc.exe
  2⤵
  PID:15168
- C:\Windows\System\cKisnUZ.exe
  C:\Windows\System\cKisnUZ.exe
  2⤵
  PID:15156
- C:\Windows\System\gBJIoaN.exe
  C:\Windows\System\gBJIoaN.exe
  2⤵
  PID:15212
- C:\Windows\System\LSKdSUh.exe
  C:\Windows\System\LSKdSUh.exe
  2⤵
  PID:15288
- C:\Windows\System\NWrvxtc.exe
  C:\Windows\System\NWrvxtc.exe
  2⤵
  PID:15300
- C:\Windows\System\jXMklwi.exe
  C:\Windows\System\jXMklwi.exe
  2⤵
  PID:13956
- C:\Windows\System\nWMvsic.exe
  C:\Windows\System\nWMvsic.exe
  2⤵
  PID:14348
- C:\Windows\System\lNTIvVK.exe
  C:\Windows\System\lNTIvVK.exe
  2⤵
  PID:2952
- C:\Windows\System\JWxfUkX.exe
  C:\Windows\System\JWxfUkX.exe
  2⤵
  PID:14516
- C:\Windows\System\MRTOorq.exe
  C:\Windows\System\MRTOorq.exe
  2⤵
  PID:14592
- C:\Windows\System\oWHomaV.exe
  C:\Windows\System\oWHomaV.exe
  2⤵
  PID:14688
- C:\Windows\System\WToGomG.exe
  C:\Windows\System\WToGomG.exe
  2⤵
  PID:14780
- C:\Windows\System\DFzDBjH.exe
  C:\Windows\System\DFzDBjH.exe
  2⤵
  PID:14924
- C:\Windows\System\SygcoEb.exe
  C:\Windows\System\SygcoEb.exe
  2⤵
  PID:15044
- C:\Windows\System\yctTKiV.exe
  C:\Windows\System\yctTKiV.exe
  2⤵
  PID:15348
- C:\Windows\System\nqrcRvn.exe
  C:\Windows\System\nqrcRvn.exe
  2⤵
  PID:14604
- C:\Windows\System\SSdjFvK.exe
  C:\Windows\System\SSdjFvK.exe
  2⤵
  PID:15376
- C:\Windows\System\CPxHeKD.exe
  C:\Windows\System\CPxHeKD.exe
  2⤵
  PID:15392
- C:\Windows\System\csUkdTJ.exe
  C:\Windows\System\csUkdTJ.exe
  2⤵
  PID:15420
- C:\Windows\System\RxObhuT.exe
  C:\Windows\System\RxObhuT.exe
  2⤵
  PID:15440
- C:\Windows\System\FQKySBR.exe
  C:\Windows\System\FQKySBR.exe
  2⤵
  PID:15460
- C:\Windows\System\WvIMiLz.exe
  C:\Windows\System\WvIMiLz.exe
  2⤵
  PID:15480
- C:\Windows\System\BcUdwLh.exe
  C:\Windows\System\BcUdwLh.exe
  2⤵
  PID:15504
- C:\Windows\System\rosAklw.exe
  C:\Windows\System\rosAklw.exe
  2⤵
  PID:15528
- C:\Windows\System\SGQaPhu.exe
  C:\Windows\System\SGQaPhu.exe
  2⤵
  PID:15552
- C:\Windows\System\mdgrkpH.exe
  C:\Windows\System\mdgrkpH.exe
  2⤵
  PID:15568
- C:\Windows\System\RfEIMHg.exe
  C:\Windows\System\RfEIMHg.exe
  2⤵
  PID:15588
- C:\Windows\System\kHKVvQu.exe
  C:\Windows\System\kHKVvQu.exe
  2⤵
  PID:15604
- C:\Windows\System\SBhymRb.exe
  C:\Windows\System\SBhymRb.exe
  2⤵
  PID:15628
- C:\Windows\System\DJfeGGs.exe
  C:\Windows\System\DJfeGGs.exe
  2⤵
  PID:15652
- C:\Windows\System\IMAzCce.exe
  C:\Windows\System\IMAzCce.exe
  2⤵
  PID:15668
- C:\Windows\System\ZthbFKG.exe
  C:\Windows\System\ZthbFKG.exe
  2⤵
  PID:15696
- C:\Windows\System\uuCjWvI.exe
  C:\Windows\System\uuCjWvI.exe
  2⤵
  PID:15716
- C:\Windows\System\dRHRGLO.exe
  C:\Windows\System\dRHRGLO.exe
  2⤵
  PID:15740
- C:\Windows\System\iKzNhWA.exe
  C:\Windows\System\iKzNhWA.exe
  2⤵
  PID:15764
- C:\Windows\System\ibGTRUL.exe
  C:\Windows\System\ibGTRUL.exe
  2⤵
  PID:15784
- C:\Windows\System\tjJxcJf.exe
  C:\Windows\System\tjJxcJf.exe
  2⤵
  PID:15812
- C:\Windows\System\yoFuWHB.exe
  C:\Windows\System\yoFuWHB.exe
  2⤵
  PID:15828
- C:\Windows\System\CxwyuYJ.exe
  C:\Windows\System\CxwyuYJ.exe
  2⤵
  PID:15852
- C:\Windows\System\hadJNIQ.exe
  C:\Windows\System\hadJNIQ.exe
  2⤵
  PID:15872
- C:\Windows\System\UiCcsaj.exe
  C:\Windows\System\UiCcsaj.exe
  2⤵
  PID:15896
- C:\Windows\System\jXUnwNg.exe
  C:\Windows\System\jXUnwNg.exe
  2⤵
  PID:15916
- C:\Windows\System\NCditpl.exe
  C:\Windows\System\NCditpl.exe
  2⤵
  PID:15936
- C:\Windows\System\hyjNPjl.exe
  C:\Windows\System\hyjNPjl.exe
  2⤵
  PID:15952
- C:\Windows\System\LvpFSss.exe
  C:\Windows\System\LvpFSss.exe
  2⤵
  PID:15968
- C:\Windows\System\FAoNXJX.exe
  C:\Windows\System\FAoNXJX.exe
  2⤵
  PID:15992
- C:\Windows\System\paMIEbP.exe
  C:\Windows\System\paMIEbP.exe
  2⤵
  PID:16020
- C:\Windows\System\heIfDiA.exe
  C:\Windows\System\heIfDiA.exe
  2⤵
  PID:16044
- C:\Windows\System\YyVhtxn.exe
  C:\Windows\System\YyVhtxn.exe
  2⤵
  PID:16060
- C:\Windows\System\VRvZDMb.exe
  C:\Windows\System\VRvZDMb.exe
  2⤵
  PID:16084
- C:\Windows\System\AmMTwKK.exe
  C:\Windows\System\AmMTwKK.exe
  2⤵
  PID:16104
- C:\Windows\System\IjOXgaX.exe
  C:\Windows\System\IjOXgaX.exe
  2⤵
  PID:16120
- C:\Windows\System\LHQAUha.exe
  C:\Windows\System\LHQAUha.exe
  2⤵
  PID:16152
- C:\Windows\System\kfRduBn.exe
  C:\Windows\System\kfRduBn.exe
  2⤵
  PID:16168
- C:\Windows\System\YGcYyvN.exe
  C:\Windows\System\YGcYyvN.exe
  2⤵
  PID:16184
- C:\Windows\System\ekOwpfF.exe
  C:\Windows\System\ekOwpfF.exe
  2⤵
  PID:16204
- C:\Windows\System\URHMqZo.exe
  C:\Windows\System\URHMqZo.exe
  2⤵
  PID:16232
- C:\Windows\System\VxuTJHk.exe
  C:\Windows\System\VxuTJHk.exe
  2⤵
  PID:16252
- C:\Windows\System\TMBmgwM.exe
  C:\Windows\System\TMBmgwM.exe
  2⤵
  PID:16280
- C:\Windows\System\aiwiZOO.exe
  C:\Windows\System\aiwiZOO.exe
  2⤵
  PID:16300
- C:\Windows\System\bJhKdcW.exe
  C:\Windows\System\bJhKdcW.exe
  2⤵
  PID:16324
- C:\Windows\System\CedthmE.exe
  C:\Windows\System\CedthmE.exe
  2⤵
  PID:16344
- C:\Windows\System\tEsUDPn.exe
  C:\Windows\System\tEsUDPn.exe
  2⤵
  PID:16360
- C:\Windows\System\yrzXKne.exe
  C:\Windows\System\yrzXKne.exe
  2⤵
  PID:14676
- C:\Windows\System\nbgcuaG.exe
  C:\Windows\System\nbgcuaG.exe
  2⤵
  PID:2696
- C:\Windows\System\lGxbbLx.exe
  C:\Windows\System\lGxbbLx.exe
  2⤵
  PID:15264
- C:\Windows\System\ODpjhDd.exe
  C:\Windows\System\ODpjhDd.exe
  2⤵
  PID:14056
- C:\Windows\System\ZCWxhgS.exe
  C:\Windows\System\ZCWxhgS.exe
  2⤵
  PID:14920
- C:\Windows\System\LVXZKkr.exe
  C:\Windows\System\LVXZKkr.exe
  2⤵
  PID:12632
- C:\Windows\System\GbNFJHf.exe
  C:\Windows\System\GbNFJHf.exe
  2⤵
  PID:15576
- C:\Windows\System\tsvgEae.exe
  C:\Windows\System\tsvgEae.exe
  2⤵
  PID:15436
- C:\Windows\System\EHYqGiM.exe
  C:\Windows\System\EHYqGiM.exe
  2⤵
  PID:15468
- C:\Windows\System\tgEbfSO.exe
  C:\Windows\System\tgEbfSO.exe
  2⤵
  PID:15680
- C:\Windows\System\mTFAmTf.exe
  C:\Windows\System\mTFAmTf.exe
  2⤵
  PID:15524
- C:\Windows\System\DYYsVmQ.exe
  C:\Windows\System\DYYsVmQ.exe
  2⤵
  PID:15884
- C:\Windows\System\ufUBdZW.exe
  C:\Windows\System\ufUBdZW.exe
  2⤵
  PID:15912
- C:\Windows\System\GdVbmlQ.exe
  C:\Windows\System\GdVbmlQ.exe
  2⤵
  PID:15712
- C:\Windows\System\rkSVmrf.exe
  C:\Windows\System\rkSVmrf.exe
  2⤵
  PID:16008
- C:\Windows\System\MftjeGb.exe
  C:\Windows\System\MftjeGb.exe
  2⤵
  PID:15760
- C:\Windows\System\aLMhYyo.exe
  C:\Windows\System\aLMhYyo.exe
  2⤵
  PID:16100
- C:\Windows\System\OazdxWf.exe
  C:\Windows\System\OazdxWf.exe
  2⤵
  PID:16164
- C:\Windows\System\DsAWnwz.exe
  C:\Windows\System\DsAWnwz.exe
  2⤵
  PID:16228
- C:\Windows\System\rNrLHFW.exe
  C:\Windows\System\rNrLHFW.exe
  2⤵
  PID:16392
- C:\Windows\System\hXLYLfe.exe
  C:\Windows\System\hXLYLfe.exe
  2⤵
  PID:16416
- C:\Windows\System\VjAHWCS.exe
  C:\Windows\System\VjAHWCS.exe
  2⤵
  PID:16432
- C:\Windows\System\lQcVxSm.exe
  C:\Windows\System\lQcVxSm.exe
  2⤵
  PID:16452
- C:\Windows\System\ByhLPNS.exe
  C:\Windows\System\ByhLPNS.exe
  2⤵
  PID:16484
- C:\Windows\System\RrXiOGB.exe
  C:\Windows\System\RrXiOGB.exe
  2⤵
  PID:16500
- C:\Windows\System\WgLiuuG.exe
  C:\Windows\System\WgLiuuG.exe
  2⤵
  PID:16520
- C:\Windows\System\jsaPFkY.exe
  C:\Windows\System\jsaPFkY.exe
  2⤵
  PID:16552
- C:\Windows\System\UKojOjj.exe
  C:\Windows\System\UKojOjj.exe
  2⤵
  PID:16568
- C:\Windows\System\QKVCsOl.exe
  C:\Windows\System\QKVCsOl.exe
  2⤵
  PID:16588
- C:\Windows\System\AzVmkIs.exe
  C:\Windows\System\AzVmkIs.exe
  2⤵
  PID:16616
- C:\Windows\System\CjDmjJW.exe
  C:\Windows\System\CjDmjJW.exe
  2⤵
  PID:16636
- C:\Windows\System\DFdIUtV.exe
  C:\Windows\System\DFdIUtV.exe
  2⤵
  PID:16652
- C:\Windows\System\kFiZVjj.exe
  C:\Windows\System\kFiZVjj.exe
  2⤵
  PID:16668
- C:\Windows\System\nXYJQyR.exe
  C:\Windows\System\nXYJQyR.exe
  2⤵
  PID:16684
- C:\Windows\System\KSEOKTB.exe
  C:\Windows\System\KSEOKTB.exe
  2⤵
  PID:16708
- C:\Windows\System\DvoIanW.exe
  C:\Windows\System\DvoIanW.exe
  2⤵
  PID:16724
- C:\Windows\System\pZqCyAK.exe
  C:\Windows\System\pZqCyAK.exe
  2⤵
  PID:16748
- C:\Windows\System\uanrVgY.exe
  C:\Windows\System\uanrVgY.exe
  2⤵
  PID:16764
- C:\Windows\System\uMtmoXl.exe
  C:\Windows\System\uMtmoXl.exe
  2⤵
  PID:16784
- C:\Windows\System\kAFwSKb.exe
  C:\Windows\System\kAFwSKb.exe
  2⤵
  PID:16800
- C:\Windows\System\ctNNpUD.exe
  C:\Windows\System\ctNNpUD.exe
  2⤵
  PID:16820
- C:\Windows\System\RStwucE.exe
  C:\Windows\System\RStwucE.exe
  2⤵
  PID:16840
- C:\Windows\System\uhuMlZD.exe
  C:\Windows\System\uhuMlZD.exe
  2⤵
  PID:16864
- C:\Windows\System\uwmfmnw.exe
  C:\Windows\System\uwmfmnw.exe
  2⤵
  PID:16888
- C:\Windows\System\KSSBaYs.exe
  C:\Windows\System\KSSBaYs.exe
  2⤵
  PID:16908
- C:\Windows\System\SdiTSKK.exe
  C:\Windows\System\SdiTSKK.exe
  2⤵
  PID:16924
- C:\Windows\System\plAhYFi.exe
  C:\Windows\System\plAhYFi.exe
  2⤵
  PID:16944
- C:\Windows\System\hscIPuW.exe
  C:\Windows\System\hscIPuW.exe
  2⤵
  PID:16960
- C:\Windows\System\DyPsaer.exe
  C:\Windows\System\DyPsaer.exe
  2⤵
  PID:16980
- C:\Windows\System\ACtIGCS.exe
  C:\Windows\System\ACtIGCS.exe
  2⤵
  PID:17012
- C:\Windows\System\dLJegrT.exe
  C:\Windows\System\dLJegrT.exe
  2⤵
  PID:17032
- C:\Windows\System\pSRLiAY.exe
  C:\Windows\System\pSRLiAY.exe
  2⤵
  PID:17048
- C:\Windows\System\tXbWEuL.exe
  C:\Windows\System\tXbWEuL.exe
  2⤵
  PID:17068
- C:\Windows\System\eijNHcF.exe
  C:\Windows\System\eijNHcF.exe
  2⤵
  PID:17104
- C:\Windows\System\oBwkXKr.exe
  C:\Windows\System\oBwkXKr.exe
  2⤵
  PID:17120
- C:\Windows\System\scPLSmZ.exe
  C:\Windows\System\scPLSmZ.exe
  2⤵
  PID:17136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CCKRyZi.exe

Filesize
1.3MB

MD5
0570646df8fd0db01a5b280d8d96955b

SHA1
0b304ad96b3f0159d19887a3bed5fa95f6637d05

SHA256
851ced3e2600b894e5512c94dac82d39a256a94cfb45e250b4dd5d028410406f

SHA512
7162e0023bc1488093dad147054aa78dd8cc09984a6df5bf582aa188162175eeb531856ceb2578c5ec6d40f76ea3b4d829a1743d7c0cf41722ca6186ce72b480

Download Submit
C:\Windows\System\CQIRcnK.exe

Filesize
1.3MB

MD5
8b97546100f4222a9ac8005dbdbbf4dc

SHA1
9b2706c6a8953cf5fda1b32bc91972995832f5c6

SHA256
41b1510ace2d42854f37186d5b0452daf17680ca743bf45093d3a4132fb0d54b

SHA512
a4a612ef88aaceb7329e4fe62130ed18bf46f201d3d1fb411b4c9c0cce1597dff850b29e8ece0451f8414f27b2aea0d04d537d70efeff5c44f4771ebf716f9f3

Download Submit
C:\Windows\System\DLNRItW.exe

Filesize
1.3MB

MD5
c6e75cd842508a28bb60c2ebcf0ea9e9

SHA1
d490c0f986b0960b84bd11599cab5a16aa694536

SHA256
babe6b807dbd218285a1aa47ec219204f759ec36aee548d2e79ff1aaf54e3246

SHA512
aadd65a7f041ff035215a9219ed8589a3f9ca09a1248f0c6bfe0538e1ab94313fdbd5c3e5fc3595fa838afc3fb2490253dab82cdc4bb86624188a09a63688dcf

Download Submit
C:\Windows\System\DMRSlUJ.exe

Filesize
1.3MB

MD5
0fc0db70aa8b89cdb11e19c5f60e1742

SHA1
b72dd62dc4f109af45fc308e51e5f774e9a6ab0f

SHA256
f5bfe46dce91ccd60af6ff5fcd5b19ba1fa39854b10ae6553cd8ee685bff0a9d

SHA512
12b85d17c1aed5887c692088b91525f1b80d12b0179b687927d266c61557a31ce2dadeee4f230d17668c95e5bd6a8839316452f5626cf16c67140fb63aede1e9

Download Submit
C:\Windows\System\ECuVwTe.exe

Filesize
1.3MB

MD5
6f1759bef8aa0b3460a30f9a49b1a0ad

SHA1
c0df665f535f547fbc92806f2d8c96bf35f5fdf1

SHA256
8a912a5c87855ffa8d76d9e5a1cff7d44623b5b1af49e130e75c2caaa3b23357

SHA512
dfd681a605d1ee9c463a3a7ef30ab6e07280dd99a409050afa19967b201a9cda45a9a46d5968d6327748129645b81c04582575ce50327083a2f3cc907cfc7570

Download Submit
C:\Windows\System\HRMqSOT.exe

Filesize
1.3MB

MD5
908e970711af2203524826d50cf81faa

SHA1
33e4506ef26556bbaa0fe0b584695d4fe3d3f008

SHA256
9bae4d5cf14cbcfa28657f1e975263b99eb68fc896d07bc668c7a4856b039773

SHA512
0cea0489f81b524ce8336daa6562593e3638d2eddf641011f9fe13cc41a33d8f598f1669eb3a691aaf64a4f462dba20a26aac98a4456d334e097f3a65ffec870

Download Submit
C:\Windows\System\HrKftRr.exe

Filesize
1.3MB

MD5
ebf173b18d06fcfc959ff4974e8298b4

SHA1
b8dfa16b98ff07418691de709ab8589d8134b350

SHA256
d4ce6579047a6c58a9efe237c29df2ec5f3a8818958fed7b8bbe7a047fb0541a

SHA512
7c0ae4c6880321c749452054b361b0036c15128a16d9bcd3dba5b704f616df311aad5a7e272e554503103b270484db33fa43537d05cce04ab977732f6fa6ff6a

Download Submit
C:\Windows\System\HyEgMMb.exe

Filesize
1.3MB

MD5
d5ffa6fa49db7f0c5433093ea45cb213

SHA1
e8d47981dc7eef2bbbb8790d3f55abba383ad748

SHA256
b0af2b0c42defb4b41043475ce56f275320f2831e4ba635115dddb3ba863b67b

SHA512
606bae3d340c704e354a217d00ceae13c8e08474b94f7f427c1955414dad39fcfb2d96d30e78477576d31cb7775488cbff318e998e0c49025bf6509e3c11339a

Download Submit
C:\Windows\System\JLoXEhn.exe

Filesize
1.3MB

MD5
9fa29295d33fe50a0ea26bb23298b8e8

SHA1
d327d6c4732e24c34af4f099f64c4cbdf0b8c1a7

SHA256
ff5cb8ed28235944fd942c912593eef8ade0ee7ffa7002916cb999e0c6415794

SHA512
f738c309de194b3753e7b72afb66c340ce37d0ea23d52637cf37754b643b3a8edb0cfd401c00c6c37663da7773628e98d20ef64b2707db21ccdae2ccf75e60d4

Download Submit
C:\Windows\System\NYPKLdp.exe

Filesize
1.3MB

MD5
263e0c25925f76f93aaecf220bf17ca6

SHA1
371d0f1f6d89de147e8341f4920691273e2a0c5d

SHA256
fc92cc9872b49253277ff380694bf25a9a2466a05df0a8392f2f0aa87401d321

SHA512
d6cf1945501a04bc75049b25442a31850b615ca3760bd4601850b7fe44fe0a5f9be397569c9cba505b01ffa19169581a711f75b6349520730a46ed3dc398a1d1

Download Submit
C:\Windows\System\NvOwhYR.exe

Filesize
1.3MB

MD5
e69a809aca39351a4c46adb82a9cfe14

SHA1
0047f1bede080da6878c1e355b05d795369ec92a

SHA256
b3a9cce0cccbc259051bcfa097a2487eaf6634b4f0f6854f667421c1a78466be

SHA512
b2e2056ac9e4a9c899e1bf2682f786b26687286b8969c05701f7a1c87fd86f916332b9ecefff1535bc07d06ff4402e2a83ab67cd41e023b3a5036dc69fbf0511

Download Submit
C:\Windows\System\QzRyrXF.exe

Filesize
1.3MB

MD5
c81573f444a7fb9072f04505fadb6d27

SHA1
c74659e56ccd27db99654d4be5b689c1b9271468

SHA256
cd4723b5f069c7e9209fd8ab5479b83ca30b8141f6578069a16c1600a7ce5ee8

SHA512
71753007dec972021ac263ec771de8e88ff8e18e32da36517928bc6841bfc7dbff5615c5c47dc355bc214cef9e99ccbf346f6d37fa2f6a025d3c408e40f3984a

Download Submit
C:\Windows\System\SlBZEfu.exe

Filesize
1.3MB

MD5
0b66e6a179e40a0f91181acb3198f5aa

SHA1
c6ad068338aa285a1bf8e1054568dcb616415c6c

SHA256
ed61244f3ab9c4367cfa23a59871f6381a2196f48da7bbcddd877baa8d399d0f

SHA512
fccced4429c48c7be04271df45d3676e567f36fe01e0ed230b983ba6fb74591c0486c3d81f1f646cae4789ee6f937036f26e0d33cc7c2b1edf19f12ba25c6398

Download Submit
C:\Windows\System\TNTIktD.exe

Filesize
1.3MB

MD5
a175aaa39de41b0fcee6bad8f00eb6a4

SHA1
c59421f9c33531b687b146c4e83df2109f2822e3

SHA256
7072883957d686527cbee06901c37b1f7f05f4bcc4161c08b93e819681d39e51

SHA512
67aeb58fac70abeace7ce8faed51c8b90c1665646d437244473f1ee7af60b386db61d3667ecf0cb2423b3e442d88064b32557fbd3564d8fb8e2234e9f494e16b

Download Submit
C:\Windows\System\UDEKYmP.exe

Filesize
1.3MB

MD5
d368cf5d4eddd70a6b224d8e7a12994b

SHA1
6fe8e23ec21b58046dea8f61270895c0c9cd68bf

SHA256
ca825161b67ce0495b9033c658300bd40da1cf6166bf13dfded971f1bf8c1ffb

SHA512
ab6a3e128d3d655ad247de6e9704da05a6484fee5dedd626622329aa8ab0e40f94a5839b60f584d77c3f2806508f507008cf130dd0ca281653d765c2942677c0

Download Submit
C:\Windows\System\WPPOQlq.exe

Filesize
1.3MB

MD5
8554e8ad3e29bf4adcbccfc46ebe5f7f

SHA1
e1dfd44027b969837d5f8fa71aa2d685be6d476a

SHA256
0ed67908414d2e3423813de74271d3aad74c6cc6cf3bb29d411bf92073d58cad

SHA512
b28ca2c8dca57732f5a2ad92c9d34937aca78cbd6aa720a1ad0601cb8e1797763ba31d353938789361555a6952cabd368e8a0d31ba05b3c68c10a368664abf1c

Download Submit
C:\Windows\System\YykWIrB.exe

Filesize
1.3MB

MD5
3671ddb04edbeb4bfed3f84faab8e7f4

SHA1
fb351c0cb2df12876f38e82a5e1c90ef309dca37

SHA256
2d76757213beac5de3461d4080b3fd358395d529458d3c460e967b8ac332fea3

SHA512
0dfaae3d56acacd43cb6c81c3cf4bc8a1b37398e225e50592ca9f64d80905878a07844b04d4a500cb617587434a8a3a6b03fb4e4361367a993d7f1e8c3f6c5cd

Download Submit
C:\Windows\System\ZSFuvnF.exe

Filesize
1.3MB

MD5
e20d65f870c7b7367c20a7628edacbb8

SHA1
fb78dfff6e0973e936e4419e012c8af2ea8bc191

SHA256
96e88e11efba7f6626a032fcdff5ce00691f5e842691c53dd4e350ad5f53223c

SHA512
9a867ea3f874f878150710e1ac641c4dede12104506148f80172df0ca936f6e5039e5f04fb054693e391d4d55d8234e61018882e413205ba0531a7513c6992e5

Download Submit
C:\Windows\System\adDUMmq.exe

Filesize
1.3MB

MD5
884133a0dd61dbb6d0b55df92160cd4f

SHA1
6e11e557cb1166116c35455cbd7790e32d12b018

SHA256
7b51fffdcc8aaac9610eeae6015b582481fd65fd458b87a5d2d240dff44047b4

SHA512
96b883db183c8dcd50489a69454061a432926d04a8afcd1f75adc337ebaa21b22c5f959f9828cfc52deb269fb3755ce3bed305918a04a0b0244b13b894ee89b6

Download Submit
C:\Windows\System\avTQfCT.exe

Filesize
1.3MB

MD5
9c7c2a396c8bb6ceda17cd2e47c4b3df

SHA1
b0ae915d581f3591c2077668ff9ebbe932f8604d

SHA256
b29f85a1db708c4aecd3f8b1013c0e31fa1f9efb91e28cfa1273d36894ae2eb4

SHA512
938a0071c9b927c41ed078e7a6b7862b05b53332c59cff88471f9328badbcf3bcc4770e1fae528565dd0a13e2a3a625cbf4834aca4cbfc59130c5864a262a1ea

Download Submit
C:\Windows\System\cfdSgoX.exe

Filesize
1.3MB

MD5
e8f85970066e33ab3b0012bdcd09a450

SHA1
7b8f0b2f29e3f9ffdc5b706ea6c0bdc56717bbc7

SHA256
47778cd9f069b7d2b2f9a69c963ad897287eead2e45beeee4929df8d21126ac4

SHA512
bbf07363240f44d30b3817e4002736b71a2a3fa2a4108a7ca11a46a6603228cfc8a28b99e0e4bc435772a242b5b3913f40595c28db72f1473e17579616da1cdb

Download Submit
C:\Windows\System\ehrKHeD.exe

Filesize
1.3MB

MD5
baeb21637a24576b46dd0c9af6186c72

SHA1
fcee107cd7b9d492f1b8b748c5c15cb16ebe41a2

SHA256
91300ce98a4e13d7c637247c0d5aba84f30afe929b1979fff4172f8f3125e96f

SHA512
e93296bea7c1c2d7315be1bf6811e926192a534a3d0ec4fc2eb8d1b343c7297cb1ef88230ef6c45cb3f309d7ba56756463bf8c28ae5d467afda05b72eab24c81

Download Submit
C:\Windows\System\fTEeCMM.exe

Filesize
1.3MB

MD5
e7e4e0f70f7428a7f34e8dcc246fbebb

SHA1
4ce01453247839c35ea06fee42122fbf6ee33744

SHA256
4f54ef373734900c0a42daf503b015986949b1a2254cf8bb2f5d7418cb62166e

SHA512
e9a8bcfe5aea25276c3233e2bddff2dc3414bf2886585c43abecf8ee580eb5cd66a7fb774b9b8b82261dfd0d0d7c800683443f8da2382f36de17322ca3eecaff

Download Submit
C:\Windows\System\mPXmBoe.exe

Filesize
1.3MB

MD5
4c5de6308d3da505f127f4c52c1855f6

SHA1
5ecdb495e3d3b5cdb8c92da7aeda3be7c54ad60d

SHA256
92ff3f2d137c29f88fb95a425588e6949c72ee778f510452b525ff2c059c0698

SHA512
384f10bc82ced57dda3abde14ce4efaebb334eee141755496c8091106e3f16b45819b66a9b5af2781a6a9f6b52a7270c9c19f42ab730ce8234d8a90e01dc5705

Download Submit
C:\Windows\System\mdgibdP.exe

Filesize
1.3MB

MD5
f6638ade8071d24568a2895412c26cba

SHA1
c80dc8975ecd6cd529b25c979c56fe6441c41d04

SHA256
c007330a6d819230d81508f377bf21e22c6e329a60186cc27b613773bf8e8715

SHA512
505f31e3cb50b6674cce404f04ccfb79d77c24c21cb2a9d4d23804cf85b08c87a2a7185383a1adf923d6bfdc4232f6384be9bf1fb5277b5c5d428227d9309e6a

Download Submit
C:\Windows\System\oBvwtNh.exe

Filesize
1.3MB

MD5
a491c615fa49f3c0f31cc6c01a8d33e8

SHA1
a87fa20e916cf8d019fa8e40634c2cbe5f71ffcc

SHA256
36e84df0e24d6e24a45b24d5bee9812ad867a2c1a702b2436d4b45ebacb743fb

SHA512
8d28dcf1c583100b23659d5af11a7ac1ff0430388e12bdbe7441b426ca64da4702d6bb2908b45ab2ca557f6a653d0c468252e3598b523e7e18552d52392d399f

Download Submit
C:\Windows\System\puznAHq.exe

Filesize
1.3MB

MD5
759c581d990040d8a07ffd52ef39a7cb

SHA1
471caff3f4cb72dd56f94b79f50f4432383fc718

SHA256
005989e6247c009e609eb628c4c7bd76817bf2a4863aa6e4344a6c948f7be836

SHA512
732b7c3f5ac9a8e8ade447df0c6fd020ccc56d60ac3013162119f2a361d2fa781d7dd55753f1ae0627bfb44c208b429f3fcac6e5d8d4798b52647686d3989976

Download Submit
C:\Windows\System\sXpNoXs.exe

Filesize
1.3MB

MD5
07be3ca7033fab5a37ce149992781eb5

SHA1
1ced4f5e59f878761aac61f537c1a0c626abbc80

SHA256
db1bbe621e07380e8babc017c9896f1de470a1a560b5311e4a907dcb6574e030

SHA512
f956a41bf0b5c2db5eb188f7083821cf3382366a32cdbfde89895a2e579add26c6ddc830b96f9f7333e87d940a306bdd260525c7cfb2eaf1957668a0e4ef3571

Download Submit
C:\Windows\System\ufnSoKa.exe

Filesize
1.3MB

MD5
6a4db9e82ebdd5cc9ddf454bc44e0ffb

SHA1
a0100fb6ecc8b6553eb8b8f6ea49abac06ed6d7e

SHA256
ddef24c51151c43e5d7d1b4e166e79887ec0f4d855a20fb736d97cd434d0fda9

SHA512
33a6b2a0a9059e8e9fb1ca10c6197a5facc777720abf8f5b1501caafb19e7f5aab0ef48ba395658ee3e093b0f269d3e4c6ccc8ea0a8dd9fafa6968161f0c900d

Download Submit
C:\Windows\System\xRrapOh.exe

Filesize
1.3MB

MD5
98663902e1924e60a0d48fed9c57d1b0

SHA1
e5dc066ec1a2d0dd8cabb1d03cfb094c8d94064d

SHA256
2cc58530670cf1f65d79b9db790b9d52779e91bc1b125337568671fd04323228

SHA512
c3b82427e0c2d23e8864dc31e56b4c47642eef189d9d6ed017f0582b9a59eef4ed41442e656dc8a44c8b057a64f3c09c9703db6296d4f280311374e715db7506

Download Submit
C:\Windows\System\zSUPiQD.exe

Filesize
1.3MB

MD5
140f6816e0d2e2633ef06c6cd40b4cee

SHA1
e462077916c1c11e467858c55e479d4aee29294e

SHA256
c39b10693ce7a2b5984fae680454bd95bfd717bbdb6ca07cc1a17c5cb5e3783e

SHA512
5d82e1e6daa3cbb70a26c1109b2d99858076ae41a8d309a566097386deb33763dfc5834d5e548bbf88aaf48f050fd2228fdc242fd0e2cd090476188eacfcb168

Download Submit
C:\Windows\System\zmityEd.exe

Filesize
1.3MB

MD5
2966430aa2a3226d99481fc519c77edb

SHA1
f71930956a9497f4b60a125bbcd441e7040ab842

SHA256
014c10fa60922f4d5ad1cf0a745c6fc7b769ba41da1c759d4a0471a943128c3e

SHA512
48a4071b3ee525ca7a1588bb7069e51b87b55a020798316f57c2b906b9c335f895c7d10364352f770544dc115ad71d10e5eb2186de968360bb40ad5e0da62ed1

Download Submit
memory/4552-0-0x0000018B74610000-0x0000018B74620000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads