xmrig | 4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
Size

1.2MB
MD5

1541a2ee699c3e6fcf4f00f8dfaea390
SHA1

5bfaab0889712ec26e462fb0f9cdeaffda3bd54a
SHA256

4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62
SHA512

593256413394e581023b942967df452b55cbd811ffee20a2e0b4b59db0ea891ebf75ad41971c14fe8ef27ff4bcf5de03c63c83745933e145eb3c09800d9c4017
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMru475NRSd:GezaTF8FcNkNdfE0pZ9ozttwIRQNdnK

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b88-4.dat	xmrig
behavioral2/files/0x0007000000023c74-21.dat	xmrig
behavioral2/files/0x0007000000023c75-30.dat	xmrig
behavioral2/files/0x0007000000023c73-26.dat	xmrig
behavioral2/files/0x0007000000023c72-24.dat	xmrig
behavioral2/files/0x0008000000023c6e-10.dat	xmrig
behavioral2/files/0x0007000000023c76-33.dat	xmrig
behavioral2/files/0x0007000000023c77-39.dat	xmrig
behavioral2/files/0x0007000000023c78-44.dat	xmrig
behavioral2/files/0x0008000000023c6f-55.dat	xmrig
behavioral2/files/0x0007000000023c7b-61.dat	xmrig
behavioral2/files/0x0007000000023c7d-65.dat	xmrig
behavioral2/files/0x0007000000023c7c-69.dat	xmrig
behavioral2/files/0x0007000000023c81-88.dat	xmrig
behavioral2/files/0x0007000000023c83-104.dat	xmrig
behavioral2/files/0x0007000000023c8d-149.dat	xmrig
behavioral2/files/0x0007000000023c94-173.dat	xmrig
behavioral2/files/0x0007000000023c93-172.dat	xmrig
behavioral2/files/0x0007000000023c87-170.dat	xmrig
behavioral2/files/0x0007000000023c85-168.dat	xmrig
behavioral2/files/0x0007000000023c92-167.dat	xmrig
behavioral2/files/0x0007000000023c91-166.dat	xmrig
behavioral2/files/0x0007000000023c90-165.dat	xmrig
behavioral2/files/0x0007000000023c8f-164.dat	xmrig
behavioral2/files/0x0007000000023c8e-160.dat	xmrig
behavioral2/files/0x0007000000023c8c-147.dat	xmrig
behavioral2/files/0x0007000000023c8a-146.dat	xmrig
behavioral2/files/0x0007000000023c89-145.dat	xmrig
behavioral2/files/0x0007000000023c88-143.dat	xmrig
behavioral2/files/0x0007000000023c86-141.dat	xmrig
behavioral2/files/0x0007000000023c84-136.dat	xmrig
behavioral2/files/0x0007000000023c82-119.dat	xmrig
behavioral2/files/0x0007000000023c80-90.dat	xmrig
behavioral2/files/0x0007000000023c7f-87.dat	xmrig
behavioral2/files/0x0007000000023c7e-80.dat	xmrig
behavioral2/files/0x0007000000023c79-50.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
736	KvfRuDm.exe
4768	GjyROSy.exe
4304	sEboWHy.exe
444	FMoQpwa.exe
4504	kfqAGgN.exe
4436	JqVPEKN.exe
3160	SMylMTo.exe
2844	ISDqYVy.exe
2444	AFrhWXr.exe
1420	sZhdzsN.exe
3372	GGfQYuz.exe
2200	QHjnGsm.exe
4920	cqXOYXf.exe
2372	qaBwmel.exe
3260	SzgImEG.exe
4516	WdFEHTC.exe
904	OBipUmb.exe
2168	aZYtTMm.exe
3932	YCYQoNt.exe
2376	Hvzbvil.exe
2284	HkpqztD.exe
760	oFsGjUZ.exe
1828	vzQIDjF.exe
756	CKMpEGq.exe
3528	lsqpYhZ.exe
468	VGAZtrj.exe
3952	KbOIuOb.exe
3180	beulXbA.exe
1124	eaKMSGv.exe
5028	lbCUbtb.exe
2056	cTnHJTu.exe
4348	WVtOTUG.exe
212	TjFggVJ.exe
548	kYaOWjm.exe
1392	lbQFePc.exe
1112	OnWnrGj.exe
4672	GiJZilR.exe
1532	KBwEpsm.exe
3444	UfIIVYX.exe
4352	ZvvkPWf.exe
1716	AXWpyDQ.exe
3488	tcxGhWq.exe
4828	bvPhWLC.exe
1452	PCWgYYI.exe
908	sSYQAKH.exe
2440	QkaaMcP.exe
1212	JIdIsWz.exe
1840	EBWYtnv.exe
4164	gtCiEcg.exe
1360	dtKcOTC.exe
5012	TzSIpyV.exe
1640	GIrdEMF.exe
4100	wxhvKBC.exe
2736	kLpSaPF.exe
3872	wvWumff.exe
4376	sujVuce.exe
4428	VmjheLg.exe
540	fLTOXZb.exe
4688	Wyjhwmx.exe
5052	clxEWSP.exe
3128	GEMHsLu.exe
1696	ceJazmj.exe
5020	VdNigMv.exe
5108	QciWpqe.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mMoDEnp.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\cTdIjlh.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\mBwajFd.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\szGyDdO.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\vYiXuwH.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\xacvfcv.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\bdorBxE.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\xBdRFMZ.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ZfUwNwM.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ynJaiFq.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\FXodusl.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\gKhzBjY.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\bXfYojn.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ppdKBwi.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ymENnoF.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\dONkDHU.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\OnBsBvm.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\QYSrQMC.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\iNcARvr.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\lojtYFQ.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\EBWYtnv.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\fttXguH.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\tUXIejh.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\jXEwKbx.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\EXJLtzO.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\Vbyfzaw.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\sEboWHy.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\MRyHoMR.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ignmtXh.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\QrcqbRA.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\yhQXPrt.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\injJOaS.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\YqPDbxh.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\TtDVOAI.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\cLpGkpg.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\IHosKfQ.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\FMoQpwa.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\clxEWSP.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\zlyFWoG.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\gTbfnqi.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\QxHiGMX.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\qVgXXzb.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ORJwVbP.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ZAByDlW.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\WppVHDI.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\HKuQQpN.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\DImLqIF.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\beulXbA.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\KhvArsp.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\zWzjxTq.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\FmxdWAS.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\oKeFmMD.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\GtmjGRX.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\CBNcuIN.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\qQBLkcB.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\apHlFXD.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ovQRoZI.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\GGfQYuz.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\bRARTpY.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\TuWOEGl.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\zhqvsUX.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ccGYNRU.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\ytTaOxB.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
File created	C:\Windows\System\HGIdvqJ.exe	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 736	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	84
PID 2556 wrote to memory of 736	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	84
PID 2556 wrote to memory of 4768	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	85
PID 2556 wrote to memory of 4768	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	85
PID 2556 wrote to memory of 4304	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	86
PID 2556 wrote to memory of 4304	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	86
PID 2556 wrote to memory of 444	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	87
PID 2556 wrote to memory of 444	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	87
PID 2556 wrote to memory of 4504	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	88
PID 2556 wrote to memory of 4504	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	88
PID 2556 wrote to memory of 4436	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	89
PID 2556 wrote to memory of 4436	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	89
PID 2556 wrote to memory of 3160	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	90
PID 2556 wrote to memory of 3160	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	90
PID 2556 wrote to memory of 2844	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	91
PID 2556 wrote to memory of 2844	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	91
PID 2556 wrote to memory of 2444	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	92
PID 2556 wrote to memory of 2444	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	92
PID 2556 wrote to memory of 1420	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	93
PID 2556 wrote to memory of 1420	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	93
PID 2556 wrote to memory of 3372	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	94
PID 2556 wrote to memory of 3372	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	94
PID 2556 wrote to memory of 2200	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	95
PID 2556 wrote to memory of 2200	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	95
PID 2556 wrote to memory of 4920	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	96
PID 2556 wrote to memory of 4920	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	96
PID 2556 wrote to memory of 2372	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	97
PID 2556 wrote to memory of 2372	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	97
PID 2556 wrote to memory of 3260	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	98
PID 2556 wrote to memory of 3260	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	98
PID 2556 wrote to memory of 4516	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	99
PID 2556 wrote to memory of 4516	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	99
PID 2556 wrote to memory of 904	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	100
PID 2556 wrote to memory of 904	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	100
PID 2556 wrote to memory of 2168	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	101
PID 2556 wrote to memory of 2168	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	101
PID 2556 wrote to memory of 3932	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	102
PID 2556 wrote to memory of 3932	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	102
PID 2556 wrote to memory of 2376	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	103
PID 2556 wrote to memory of 2376	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	103
PID 2556 wrote to memory of 2284	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	104
PID 2556 wrote to memory of 2284	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	104
PID 2556 wrote to memory of 760	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	105
PID 2556 wrote to memory of 760	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	105
PID 2556 wrote to memory of 1828	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	106
PID 2556 wrote to memory of 1828	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	106
PID 2556 wrote to memory of 756	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	107
PID 2556 wrote to memory of 756	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	107
PID 2556 wrote to memory of 3528	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	108
PID 2556 wrote to memory of 3528	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	108
PID 2556 wrote to memory of 468	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	109
PID 2556 wrote to memory of 468	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	109
PID 2556 wrote to memory of 3952	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	110
PID 2556 wrote to memory of 3952	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	110
PID 2556 wrote to memory of 1532	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	111
PID 2556 wrote to memory of 1532	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	111
PID 2556 wrote to memory of 3180	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	112
PID 2556 wrote to memory of 3180	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	112
PID 2556 wrote to memory of 1124	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	113
PID 2556 wrote to memory of 1124	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	113
PID 2556 wrote to memory of 5028	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	114
PID 2556 wrote to memory of 5028	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	114
PID 2556 wrote to memory of 2056	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	115
PID 2556 wrote to memory of 2056	2556	4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe	115

C:\Users\Admin\AppData\Local\Temp\4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe
"C:\Users\Admin\AppData\Local\Temp\4a5f168f50b1b1624f76c73eed1ed8199d90bb92ef0cdeb3e6bbe49df5fe3f62.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\System\KvfRuDm.exe
  C:\Windows\System\KvfRuDm.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\GjyROSy.exe
  C:\Windows\System\GjyROSy.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\sEboWHy.exe
  C:\Windows\System\sEboWHy.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\FMoQpwa.exe
  C:\Windows\System\FMoQpwa.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\kfqAGgN.exe
  C:\Windows\System\kfqAGgN.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\JqVPEKN.exe
  C:\Windows\System\JqVPEKN.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\SMylMTo.exe
  C:\Windows\System\SMylMTo.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\ISDqYVy.exe
  C:\Windows\System\ISDqYVy.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\AFrhWXr.exe
  C:\Windows\System\AFrhWXr.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\sZhdzsN.exe
  C:\Windows\System\sZhdzsN.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\GGfQYuz.exe
  C:\Windows\System\GGfQYuz.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\QHjnGsm.exe
  C:\Windows\System\QHjnGsm.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\cqXOYXf.exe
  C:\Windows\System\cqXOYXf.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\qaBwmel.exe
  C:\Windows\System\qaBwmel.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\SzgImEG.exe
  C:\Windows\System\SzgImEG.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\WdFEHTC.exe
  C:\Windows\System\WdFEHTC.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\OBipUmb.exe
  C:\Windows\System\OBipUmb.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\aZYtTMm.exe
  C:\Windows\System\aZYtTMm.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\YCYQoNt.exe
  C:\Windows\System\YCYQoNt.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\Hvzbvil.exe
  C:\Windows\System\Hvzbvil.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\HkpqztD.exe
  C:\Windows\System\HkpqztD.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\oFsGjUZ.exe
  C:\Windows\System\oFsGjUZ.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\vzQIDjF.exe
  C:\Windows\System\vzQIDjF.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\CKMpEGq.exe
  C:\Windows\System\CKMpEGq.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\lsqpYhZ.exe
  C:\Windows\System\lsqpYhZ.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\VGAZtrj.exe
  C:\Windows\System\VGAZtrj.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\KbOIuOb.exe
  C:\Windows\System\KbOIuOb.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\KBwEpsm.exe
  C:\Windows\System\KBwEpsm.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\beulXbA.exe
  C:\Windows\System\beulXbA.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\eaKMSGv.exe
  C:\Windows\System\eaKMSGv.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\lbCUbtb.exe
  C:\Windows\System\lbCUbtb.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\cTnHJTu.exe
  C:\Windows\System\cTnHJTu.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\WVtOTUG.exe
  C:\Windows\System\WVtOTUG.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\TjFggVJ.exe
  C:\Windows\System\TjFggVJ.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\kYaOWjm.exe
  C:\Windows\System\kYaOWjm.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\lbQFePc.exe
  C:\Windows\System\lbQFePc.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\OnWnrGj.exe
  C:\Windows\System\OnWnrGj.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\GiJZilR.exe
  C:\Windows\System\GiJZilR.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\UfIIVYX.exe
  C:\Windows\System\UfIIVYX.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\ZvvkPWf.exe
  C:\Windows\System\ZvvkPWf.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\AXWpyDQ.exe
  C:\Windows\System\AXWpyDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\tcxGhWq.exe
  C:\Windows\System\tcxGhWq.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\bvPhWLC.exe
  C:\Windows\System\bvPhWLC.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\PCWgYYI.exe
  C:\Windows\System\PCWgYYI.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\sSYQAKH.exe
  C:\Windows\System\sSYQAKH.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\EBWYtnv.exe
  C:\Windows\System\EBWYtnv.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\JIdIsWz.exe
  C:\Windows\System\JIdIsWz.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\QkaaMcP.exe
  C:\Windows\System\QkaaMcP.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\dtKcOTC.exe
  C:\Windows\System\dtKcOTC.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\gtCiEcg.exe
  C:\Windows\System\gtCiEcg.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\TzSIpyV.exe
  C:\Windows\System\TzSIpyV.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\wxhvKBC.exe
  C:\Windows\System\wxhvKBC.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\kLpSaPF.exe
  C:\Windows\System\kLpSaPF.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\wvWumff.exe
  C:\Windows\System\wvWumff.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\GIrdEMF.exe
  C:\Windows\System\GIrdEMF.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\sujVuce.exe
  C:\Windows\System\sujVuce.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\VmjheLg.exe
  C:\Windows\System\VmjheLg.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\fLTOXZb.exe
  C:\Windows\System\fLTOXZb.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\Wyjhwmx.exe
  C:\Windows\System\Wyjhwmx.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\QciWpqe.exe
  C:\Windows\System\QciWpqe.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\clxEWSP.exe
  C:\Windows\System\clxEWSP.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\GEMHsLu.exe
  C:\Windows\System\GEMHsLu.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\ceJazmj.exe
  C:\Windows\System\ceJazmj.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\VdNigMv.exe
  C:\Windows\System\VdNigMv.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\GAQIntc.exe
  C:\Windows\System\GAQIntc.exe
  2⤵
  PID:1864
- C:\Windows\System\kjWfeTh.exe
  C:\Windows\System\kjWfeTh.exe
  2⤵
  PID:4804
- C:\Windows\System\dPOnfpI.exe
  C:\Windows\System\dPOnfpI.exe
  2⤵
  PID:2756
- C:\Windows\System\SwoYLBj.exe
  C:\Windows\System\SwoYLBj.exe
  2⤵
  PID:4280
- C:\Windows\System\PmzCoSO.exe
  C:\Windows\System\PmzCoSO.exe
  2⤵
  PID:3376
- C:\Windows\System\fLiAToC.exe
  C:\Windows\System\fLiAToC.exe
  2⤵
  PID:4636
- C:\Windows\System\hWXrNcv.exe
  C:\Windows\System\hWXrNcv.exe
  2⤵
  PID:2496
- C:\Windows\System\bJjEMMd.exe
  C:\Windows\System\bJjEMMd.exe
  2⤵
  PID:4772
- C:\Windows\System\tLivewY.exe
  C:\Windows\System\tLivewY.exe
  2⤵
  PID:1388
- C:\Windows\System\qHzpFMv.exe
  C:\Windows\System\qHzpFMv.exe
  2⤵
  PID:3136
- C:\Windows\System\fLuhseZ.exe
  C:\Windows\System\fLuhseZ.exe
  2⤵
  PID:2296
- C:\Windows\System\cMaZFnu.exe
  C:\Windows\System\cMaZFnu.exe
  2⤵
  PID:352
- C:\Windows\System\XVWAQDe.exe
  C:\Windows\System\XVWAQDe.exe
  2⤵
  PID:4632
- C:\Windows\System\QDGHwwf.exe
  C:\Windows\System\QDGHwwf.exe
  2⤵
  PID:2960
- C:\Windows\System\rIZfsht.exe
  C:\Windows\System\rIZfsht.exe
  2⤵
  PID:4976
- C:\Windows\System\MXrRYEm.exe
  C:\Windows\System\MXrRYEm.exe
  2⤵
  PID:4056
- C:\Windows\System\ycqWaZk.exe
  C:\Windows\System\ycqWaZk.exe
  2⤵
  PID:536
- C:\Windows\System\BOroAoN.exe
  C:\Windows\System\BOroAoN.exe
  2⤵
  PID:2924
- C:\Windows\System\fdQihvh.exe
  C:\Windows\System\fdQihvh.exe
  2⤵
  PID:1736
- C:\Windows\System\XvbzECu.exe
  C:\Windows\System\XvbzECu.exe
  2⤵
  PID:2044
- C:\Windows\System\qaATyxK.exe
  C:\Windows\System\qaATyxK.exe
  2⤵
  PID:1972
- C:\Windows\System\ehHZDCA.exe
  C:\Windows\System\ehHZDCA.exe
  2⤵
  PID:992
- C:\Windows\System\ngoRHlE.exe
  C:\Windows\System\ngoRHlE.exe
  2⤵
  PID:4256
- C:\Windows\System\ieLwBAE.exe
  C:\Windows\System\ieLwBAE.exe
  2⤵
  PID:3796
- C:\Windows\System\rhdSOXE.exe
  C:\Windows\System\rhdSOXE.exe
  2⤵
  PID:2696
- C:\Windows\System\huCfdfs.exe
  C:\Windows\System\huCfdfs.exe
  2⤵
  PID:3440
- C:\Windows\System\eScvoKF.exe
  C:\Windows\System\eScvoKF.exe
  2⤵
  PID:3236
- C:\Windows\System\zhGNWRa.exe
  C:\Windows\System\zhGNWRa.exe
  2⤵
  PID:1028
- C:\Windows\System\XewkRGq.exe
  C:\Windows\System\XewkRGq.exe
  2⤵
  PID:836
- C:\Windows\System\SCiyRiM.exe
  C:\Windows\System\SCiyRiM.exe
  2⤵
  PID:4652
- C:\Windows\System\blYVLPo.exe
  C:\Windows\System\blYVLPo.exe
  2⤵
  PID:2392
- C:\Windows\System\SJnhjlJ.exe
  C:\Windows\System\SJnhjlJ.exe
  2⤵
  PID:4344
- C:\Windows\System\dhJEMyc.exe
  C:\Windows\System\dhJEMyc.exe
  2⤵
  PID:4500
- C:\Windows\System\ePwqJKA.exe
  C:\Windows\System\ePwqJKA.exe
  2⤵
  PID:4844
- C:\Windows\System\ZfUwNwM.exe
  C:\Windows\System\ZfUwNwM.exe
  2⤵
  PID:804
- C:\Windows\System\hSqcEPk.exe
  C:\Windows\System\hSqcEPk.exe
  2⤵
  PID:1408
- C:\Windows\System\zTwiIKa.exe
  C:\Windows\System\zTwiIKa.exe
  2⤵
  PID:4400
- C:\Windows\System\jeQkpaN.exe
  C:\Windows\System\jeQkpaN.exe
  2⤵
  PID:3320
- C:\Windows\System\IdlCcaL.exe
  C:\Windows\System\IdlCcaL.exe
  2⤵
  PID:232
- C:\Windows\System\QVLqoiW.exe
  C:\Windows\System\QVLqoiW.exe
  2⤵
  PID:1172
- C:\Windows\System\aFRDsVN.exe
  C:\Windows\System\aFRDsVN.exe
  2⤵
  PID:2632
- C:\Windows\System\JLgQCoW.exe
  C:\Windows\System\JLgQCoW.exe
  2⤵
  PID:4996
- C:\Windows\System\GGOPyti.exe
  C:\Windows\System\GGOPyti.exe
  2⤵
  PID:4556
- C:\Windows\System\gGlCRoV.exe
  C:\Windows\System\gGlCRoV.exe
  2⤵
  PID:4896
- C:\Windows\System\PRKNByr.exe
  C:\Windows\System\PRKNByr.exe
  2⤵
  PID:1564
- C:\Windows\System\sXATlui.exe
  C:\Windows\System\sXATlui.exe
  2⤵
  PID:4916
- C:\Windows\System\mjXVKWR.exe
  C:\Windows\System\mjXVKWR.exe
  2⤵
  PID:1096
- C:\Windows\System\YnhRBml.exe
  C:\Windows\System\YnhRBml.exe
  2⤵
  PID:3640
- C:\Windows\System\BPcIAdq.exe
  C:\Windows\System\BPcIAdq.exe
  2⤵
  PID:1240
- C:\Windows\System\glIcTsC.exe
  C:\Windows\System\glIcTsC.exe
  2⤵
  PID:1040
- C:\Windows\System\CQhGDMA.exe
  C:\Windows\System\CQhGDMA.exe
  2⤵
  PID:2896
- C:\Windows\System\XgnSgIW.exe
  C:\Windows\System\XgnSgIW.exe
  2⤵
  PID:3064
- C:\Windows\System\KLUJAVy.exe
  C:\Windows\System\KLUJAVy.exe
  2⤵
  PID:4072
- C:\Windows\System\KhvArsp.exe
  C:\Windows\System\KhvArsp.exe
  2⤵
  PID:3200
- C:\Windows\System\Qdjjebd.exe
  C:\Windows\System\Qdjjebd.exe
  2⤵
  PID:5148
- C:\Windows\System\YFtbtXz.exe
  C:\Windows\System\YFtbtXz.exe
  2⤵
  PID:5176
- C:\Windows\System\QYqjaeV.exe
  C:\Windows\System\QYqjaeV.exe
  2⤵
  PID:5204
- C:\Windows\System\REdSuzG.exe
  C:\Windows\System\REdSuzG.exe
  2⤵
  PID:5232
- C:\Windows\System\TqORyUI.exe
  C:\Windows\System\TqORyUI.exe
  2⤵
  PID:5268
- C:\Windows\System\jkoYgYL.exe
  C:\Windows\System\jkoYgYL.exe
  2⤵
  PID:5304
- C:\Windows\System\ggyamtR.exe
  C:\Windows\System\ggyamtR.exe
  2⤵
  PID:5344
- C:\Windows\System\TUYNGgM.exe
  C:\Windows\System\TUYNGgM.exe
  2⤵
  PID:5372
- C:\Windows\System\VCRJDDb.exe
  C:\Windows\System\VCRJDDb.exe
  2⤵
  PID:5396
- C:\Windows\System\SQxRBEv.exe
  C:\Windows\System\SQxRBEv.exe
  2⤵
  PID:5432
- C:\Windows\System\ICakQCI.exe
  C:\Windows\System\ICakQCI.exe
  2⤵
  PID:5468
- C:\Windows\System\HmQEovQ.exe
  C:\Windows\System\HmQEovQ.exe
  2⤵
  PID:5500
- C:\Windows\System\JJDxPey.exe
  C:\Windows\System\JJDxPey.exe
  2⤵
  PID:5536
- C:\Windows\System\lJoFhRW.exe
  C:\Windows\System\lJoFhRW.exe
  2⤵
  PID:5560
- C:\Windows\System\LfGeFEa.exe
  C:\Windows\System\LfGeFEa.exe
  2⤵
  PID:5588
- C:\Windows\System\LNLybPh.exe
  C:\Windows\System\LNLybPh.exe
  2⤵
  PID:5612
- C:\Windows\System\qgfuHrs.exe
  C:\Windows\System\qgfuHrs.exe
  2⤵
  PID:5644
- C:\Windows\System\HWtBfYH.exe
  C:\Windows\System\HWtBfYH.exe
  2⤵
  PID:5684
- C:\Windows\System\UNZuray.exe
  C:\Windows\System\UNZuray.exe
  2⤵
  PID:5712
- C:\Windows\System\FUPUQgI.exe
  C:\Windows\System\FUPUQgI.exe
  2⤵
  PID:5744
- C:\Windows\System\JXGZDaf.exe
  C:\Windows\System\JXGZDaf.exe
  2⤵
  PID:5776
- C:\Windows\System\iJpYpsN.exe
  C:\Windows\System\iJpYpsN.exe
  2⤵
  PID:5800
- C:\Windows\System\PvHabCy.exe
  C:\Windows\System\PvHabCy.exe
  2⤵
  PID:5840
- C:\Windows\System\NcrKClD.exe
  C:\Windows\System\NcrKClD.exe
  2⤵
  PID:5872
- C:\Windows\System\rJNfzQh.exe
  C:\Windows\System\rJNfzQh.exe
  2⤵
  PID:5896
- C:\Windows\System\GImmksD.exe
  C:\Windows\System\GImmksD.exe
  2⤵
  PID:5940
- C:\Windows\System\JUptsOf.exe
  C:\Windows\System\JUptsOf.exe
  2⤵
  PID:5976
- C:\Windows\System\FlYyUUz.exe
  C:\Windows\System\FlYyUUz.exe
  2⤵
  PID:6008
- C:\Windows\System\fttXguH.exe
  C:\Windows\System\fttXguH.exe
  2⤵
  PID:6032
- C:\Windows\System\NgaweAh.exe
  C:\Windows\System\NgaweAh.exe
  2⤵
  PID:6064
- C:\Windows\System\KPsQvpw.exe
  C:\Windows\System\KPsQvpw.exe
  2⤵
  PID:6092
- C:\Windows\System\AIZNwLx.exe
  C:\Windows\System\AIZNwLx.exe
  2⤵
  PID:6120
- C:\Windows\System\RRXnziI.exe
  C:\Windows\System\RRXnziI.exe
  2⤵
  PID:4104
- C:\Windows\System\PTQuZfB.exe
  C:\Windows\System\PTQuZfB.exe
  2⤵
  PID:3300
- C:\Windows\System\kbLVlfK.exe
  C:\Windows\System\kbLVlfK.exe
  2⤵
  PID:4964
- C:\Windows\System\hgtwjIJ.exe
  C:\Windows\System\hgtwjIJ.exe
  2⤵
  PID:5332
- C:\Windows\System\injJOaS.exe
  C:\Windows\System\injJOaS.exe
  2⤵
  PID:5280
- C:\Windows\System\jlQQwkT.exe
  C:\Windows\System\jlQQwkT.exe
  2⤵
  PID:5140
- C:\Windows\System\zwTmtkQ.exe
  C:\Windows\System\zwTmtkQ.exe
  2⤵
  PID:5380
- C:\Windows\System\oKeFmMD.exe
  C:\Windows\System\oKeFmMD.exe
  2⤵
  PID:5480
- C:\Windows\System\PAvvjbP.exe
  C:\Windows\System\PAvvjbP.exe
  2⤵
  PID:5448
- C:\Windows\System\MpkBTID.exe
  C:\Windows\System\MpkBTID.exe
  2⤵
  PID:5604
- C:\Windows\System\TpcLJir.exe
  C:\Windows\System\TpcLJir.exe
  2⤵
  PID:5656
- C:\Windows\System\JMRCQjf.exe
  C:\Windows\System\JMRCQjf.exe
  2⤵
  PID:5848
- C:\Windows\System\enUKCOa.exe
  C:\Windows\System\enUKCOa.exe
  2⤵
  PID:5972
- C:\Windows\System\stTffee.exe
  C:\Windows\System\stTffee.exe
  2⤵
  PID:6004
- C:\Windows\System\lunBZec.exe
  C:\Windows\System\lunBZec.exe
  2⤵
  PID:6132
- C:\Windows\System\zlyFWoG.exe
  C:\Windows\System\zlyFWoG.exe
  2⤵
  PID:6052
- C:\Windows\System\qvVGdSR.exe
  C:\Windows\System\qvVGdSR.exe
  2⤵
  PID:6100
- C:\Windows\System\MVIywCY.exe
  C:\Windows\System\MVIywCY.exe
  2⤵
  PID:4460
- C:\Windows\System\rwwfXxM.exe
  C:\Windows\System\rwwfXxM.exe
  2⤵
  PID:5388
- C:\Windows\System\hlRNJHd.exe
  C:\Windows\System\hlRNJHd.exe
  2⤵
  PID:4932
- C:\Windows\System\CmTpMkh.exe
  C:\Windows\System\CmTpMkh.exe
  2⤵
  PID:5552
- C:\Windows\System\PLoGjeM.exe
  C:\Windows\System\PLoGjeM.exe
  2⤵
  PID:5636
- C:\Windows\System\vBmWhBK.exe
  C:\Windows\System\vBmWhBK.exe
  2⤵
  PID:5756
- C:\Windows\System\ecRoRQa.exe
  C:\Windows\System\ecRoRQa.exe
  2⤵
  PID:5964
- C:\Windows\System\lKBAmkl.exe
  C:\Windows\System\lKBAmkl.exe
  2⤵
  PID:6128
- C:\Windows\System\VBSvYFv.exe
  C:\Windows\System\VBSvYFv.exe
  2⤵
  PID:3632
- C:\Windows\System\LURhedD.exe
  C:\Windows\System\LURhedD.exe
  2⤵
  PID:5408
- C:\Windows\System\ZLXuYwz.exe
  C:\Windows\System\ZLXuYwz.exe
  2⤵
  PID:5216
- C:\Windows\System\vIxaEnT.exe
  C:\Windows\System\vIxaEnT.exe
  2⤵
  PID:6088
- C:\Windows\System\lvYOGaE.exe
  C:\Windows\System\lvYOGaE.exe
  2⤵
  PID:6172
- C:\Windows\System\gsxrlDm.exe
  C:\Windows\System\gsxrlDm.exe
  2⤵
  PID:6192
- C:\Windows\System\XXvWgPF.exe
  C:\Windows\System\XXvWgPF.exe
  2⤵
  PID:6220
- C:\Windows\System\LHOCIpi.exe
  C:\Windows\System\LHOCIpi.exe
  2⤵
  PID:6248
- C:\Windows\System\RdAALlZ.exe
  C:\Windows\System\RdAALlZ.exe
  2⤵
  PID:6268
- C:\Windows\System\TZTqfHL.exe
  C:\Windows\System\TZTqfHL.exe
  2⤵
  PID:6300
- C:\Windows\System\wvecotZ.exe
  C:\Windows\System\wvecotZ.exe
  2⤵
  PID:6324
- C:\Windows\System\JYrxLrU.exe
  C:\Windows\System\JYrxLrU.exe
  2⤵
  PID:6348
- C:\Windows\System\QYSrQMC.exe
  C:\Windows\System\QYSrQMC.exe
  2⤵
  PID:6372
- C:\Windows\System\JSwMscb.exe
  C:\Windows\System\JSwMscb.exe
  2⤵
  PID:6400
- C:\Windows\System\rFMZNXP.exe
  C:\Windows\System\rFMZNXP.exe
  2⤵
  PID:6432
- C:\Windows\System\RDBOjqB.exe
  C:\Windows\System\RDBOjqB.exe
  2⤵
  PID:6456
- C:\Windows\System\mhfLRlP.exe
  C:\Windows\System\mhfLRlP.exe
  2⤵
  PID:6480
- C:\Windows\System\RQDuqhS.exe
  C:\Windows\System\RQDuqhS.exe
  2⤵
  PID:6508
- C:\Windows\System\bWEUZkv.exe
  C:\Windows\System\bWEUZkv.exe
  2⤵
  PID:6552
- C:\Windows\System\TZBvxoL.exe
  C:\Windows\System\TZBvxoL.exe
  2⤵
  PID:6580
- C:\Windows\System\zWzjxTq.exe
  C:\Windows\System\zWzjxTq.exe
  2⤵
  PID:6608
- C:\Windows\System\PzCecuO.exe
  C:\Windows\System\PzCecuO.exe
  2⤵
  PID:6632
- C:\Windows\System\XTbtYZl.exe
  C:\Windows\System\XTbtYZl.exe
  2⤵
  PID:6664
- C:\Windows\System\NSMuhMu.exe
  C:\Windows\System\NSMuhMu.exe
  2⤵
  PID:6684
- C:\Windows\System\vqpxkMF.exe
  C:\Windows\System\vqpxkMF.exe
  2⤵
  PID:6708
- C:\Windows\System\mMoDEnp.exe
  C:\Windows\System\mMoDEnp.exe
  2⤵
  PID:6736
- C:\Windows\System\zWtqXIl.exe
  C:\Windows\System\zWtqXIl.exe
  2⤵
  PID:6760
- C:\Windows\System\bwIYkfg.exe
  C:\Windows\System\bwIYkfg.exe
  2⤵
  PID:6784
- C:\Windows\System\beHpRvU.exe
  C:\Windows\System\beHpRvU.exe
  2⤵
  PID:6812
- C:\Windows\System\DnuOxes.exe
  C:\Windows\System\DnuOxes.exe
  2⤵
  PID:6844
- C:\Windows\System\ISwjpsA.exe
  C:\Windows\System\ISwjpsA.exe
  2⤵
  PID:6872
- C:\Windows\System\diNwTmM.exe
  C:\Windows\System\diNwTmM.exe
  2⤵
  PID:6888
- C:\Windows\System\tzvaGxq.exe
  C:\Windows\System\tzvaGxq.exe
  2⤵
  PID:6916
- C:\Windows\System\vkIBnGn.exe
  C:\Windows\System\vkIBnGn.exe
  2⤵
  PID:6940
- C:\Windows\System\OuWXXoc.exe
  C:\Windows\System\OuWXXoc.exe
  2⤵
  PID:6968
- C:\Windows\System\IYcjeYu.exe
  C:\Windows\System\IYcjeYu.exe
  2⤵
  PID:6992
- C:\Windows\System\eFlOsNu.exe
  C:\Windows\System\eFlOsNu.exe
  2⤵
  PID:7020
- C:\Windows\System\zWxjkhW.exe
  C:\Windows\System\zWxjkhW.exe
  2⤵
  PID:7040
- C:\Windows\System\sIXCaFI.exe
  C:\Windows\System\sIXCaFI.exe
  2⤵
  PID:7060
- C:\Windows\System\WyuvbJG.exe
  C:\Windows\System\WyuvbJG.exe
  2⤵
  PID:7092
- C:\Windows\System\EviLEWe.exe
  C:\Windows\System\EviLEWe.exe
  2⤵
  PID:7112
- C:\Windows\System\IckQoqx.exe
  C:\Windows\System\IckQoqx.exe
  2⤵
  PID:7140
- C:\Windows\System\GQmYgwi.exe
  C:\Windows\System\GQmYgwi.exe
  2⤵
  PID:6040
- C:\Windows\System\KGIOmPo.exe
  C:\Windows\System\KGIOmPo.exe
  2⤵
  PID:5196
- C:\Windows\System\ZdBUigG.exe
  C:\Windows\System\ZdBUigG.exe
  2⤵
  PID:6200
- C:\Windows\System\VNkDlbS.exe
  C:\Windows\System\VNkDlbS.exe
  2⤵
  PID:6212
- C:\Windows\System\ZzidbEw.exe
  C:\Windows\System\ZzidbEw.exe
  2⤵
  PID:6236
- C:\Windows\System\CrMmgVc.exe
  C:\Windows\System\CrMmgVc.exe
  2⤵
  PID:6296
- C:\Windows\System\IArAaDc.exe
  C:\Windows\System\IArAaDc.exe
  2⤵
  PID:6384
- C:\Windows\System\DhzXfwP.exe
  C:\Windows\System\DhzXfwP.exe
  2⤵
  PID:6340
- C:\Windows\System\VQQangZ.exe
  C:\Windows\System\VQQangZ.exe
  2⤵
  PID:6520
- C:\Windows\System\IfJXhIz.exe
  C:\Windows\System\IfJXhIz.exe
  2⤵
  PID:6496
- C:\Windows\System\isswGnx.exe
  C:\Windows\System\isswGnx.exe
  2⤵
  PID:6560
- C:\Windows\System\EexGnWu.exe
  C:\Windows\System\EexGnWu.exe
  2⤵
  PID:6604
- C:\Windows\System\mBwajFd.exe
  C:\Windows\System\mBwajFd.exe
  2⤵
  PID:6676
- C:\Windows\System\zJNGRpE.exe
  C:\Windows\System\zJNGRpE.exe
  2⤵
  PID:6808
- C:\Windows\System\szGyDdO.exe
  C:\Windows\System\szGyDdO.exe
  2⤵
  PID:6752
- C:\Windows\System\yqioubB.exe
  C:\Windows\System\yqioubB.exe
  2⤵
  PID:6704
- C:\Windows\System\bRARTpY.exe
  C:\Windows\System\bRARTpY.exe
  2⤵
  PID:6984
- C:\Windows\System\PtCJdWk.exe
  C:\Windows\System\PtCJdWk.exe
  2⤵
  PID:6800
- C:\Windows\System\JYSjuPh.exe
  C:\Windows\System\JYSjuPh.exe
  2⤵
  PID:7132
- C:\Windows\System\nIIqYVN.exe
  C:\Windows\System\nIIqYVN.exe
  2⤵
  PID:7160
- C:\Windows\System\nmGxecE.exe
  C:\Windows\System\nmGxecE.exe
  2⤵
  PID:5920
- C:\Windows\System\HpXHKlq.exe
  C:\Windows\System\HpXHKlq.exe
  2⤵
  PID:6420
- C:\Windows\System\GZARVYV.exe
  C:\Windows\System\GZARVYV.exe
  2⤵
  PID:6448
- C:\Windows\System\UiCQyom.exe
  C:\Windows\System\UiCQyom.exe
  2⤵
  PID:6600
- C:\Windows\System\mnUCUcN.exe
  C:\Windows\System\mnUCUcN.exe
  2⤵
  PID:6832
- C:\Windows\System\opCCfCd.exe
  C:\Windows\System\opCCfCd.exe
  2⤵
  PID:6960
- C:\Windows\System\NSZWZNQ.exe
  C:\Windows\System\NSZWZNQ.exe
  2⤵
  PID:6540
- C:\Windows\System\XMEoIdi.exe
  C:\Windows\System\XMEoIdi.exe
  2⤵
  PID:7180
- C:\Windows\System\yNLaWAe.exe
  C:\Windows\System\yNLaWAe.exe
  2⤵
  PID:7204
- C:\Windows\System\ucNijhs.exe
  C:\Windows\System\ucNijhs.exe
  2⤵
  PID:7224
- C:\Windows\System\zMRJzUV.exe
  C:\Windows\System\zMRJzUV.exe
  2⤵
  PID:7248
- C:\Windows\System\UPtDVDb.exe
  C:\Windows\System\UPtDVDb.exe
  2⤵
  PID:7276
- C:\Windows\System\jUDyYDA.exe
  C:\Windows\System\jUDyYDA.exe
  2⤵
  PID:7308
- C:\Windows\System\EUVjedW.exe
  C:\Windows\System\EUVjedW.exe
  2⤵
  PID:7336
- C:\Windows\System\osHfRVW.exe
  C:\Windows\System\osHfRVW.exe
  2⤵
  PID:7364
- C:\Windows\System\fVEYQft.exe
  C:\Windows\System\fVEYQft.exe
  2⤵
  PID:7388
- C:\Windows\System\ZlgascJ.exe
  C:\Windows\System\ZlgascJ.exe
  2⤵
  PID:7416
- C:\Windows\System\PkBQEbB.exe
  C:\Windows\System\PkBQEbB.exe
  2⤵
  PID:7444
- C:\Windows\System\IguUvxX.exe
  C:\Windows\System\IguUvxX.exe
  2⤵
  PID:7468
- C:\Windows\System\gCHZRie.exe
  C:\Windows\System\gCHZRie.exe
  2⤵
  PID:7492
- C:\Windows\System\vtxEZtN.exe
  C:\Windows\System\vtxEZtN.exe
  2⤵
  PID:7524
- C:\Windows\System\VzxjiKU.exe
  C:\Windows\System\VzxjiKU.exe
  2⤵
  PID:7548
- C:\Windows\System\InKikeg.exe
  C:\Windows\System\InKikeg.exe
  2⤵
  PID:7568
- C:\Windows\System\gYgNiIu.exe
  C:\Windows\System\gYgNiIu.exe
  2⤵
  PID:7592
- C:\Windows\System\xVTJVtP.exe
  C:\Windows\System\xVTJVtP.exe
  2⤵
  PID:7608
- C:\Windows\System\PsnjQsK.exe
  C:\Windows\System\PsnjQsK.exe
  2⤵
  PID:7628
- C:\Windows\System\bXfYojn.exe
  C:\Windows\System\bXfYojn.exe
  2⤵
  PID:7660
- C:\Windows\System\LfSkeaT.exe
  C:\Windows\System\LfSkeaT.exe
  2⤵
  PID:7680
- C:\Windows\System\TrMwEYB.exe
  C:\Windows\System\TrMwEYB.exe
  2⤵
  PID:7708
- C:\Windows\System\esfeEnp.exe
  C:\Windows\System\esfeEnp.exe
  2⤵
  PID:7736
- C:\Windows\System\ynJaiFq.exe
  C:\Windows\System\ynJaiFq.exe
  2⤵
  PID:7764
- C:\Windows\System\kNORxKD.exe
  C:\Windows\System\kNORxKD.exe
  2⤵
  PID:7788
- C:\Windows\System\CsJFpwT.exe
  C:\Windows\System\CsJFpwT.exe
  2⤵
  PID:7812
- C:\Windows\System\LXoyzVE.exe
  C:\Windows\System\LXoyzVE.exe
  2⤵
  PID:7840
- C:\Windows\System\cUWxPVy.exe
  C:\Windows\System\cUWxPVy.exe
  2⤵
  PID:7860
- C:\Windows\System\XEWCXLR.exe
  C:\Windows\System\XEWCXLR.exe
  2⤵
  PID:7884
- C:\Windows\System\MRyHoMR.exe
  C:\Windows\System\MRyHoMR.exe
  2⤵
  PID:7904
- C:\Windows\System\NgQnLnM.exe
  C:\Windows\System\NgQnLnM.exe
  2⤵
  PID:7932
- C:\Windows\System\RSYyPbg.exe
  C:\Windows\System\RSYyPbg.exe
  2⤵
  PID:7960
- C:\Windows\System\MjFuudA.exe
  C:\Windows\System\MjFuudA.exe
  2⤵
  PID:7984
- C:\Windows\System\CIpZIRg.exe
  C:\Windows\System\CIpZIRg.exe
  2⤵
  PID:8008
- C:\Windows\System\ODxHUSd.exe
  C:\Windows\System\ODxHUSd.exe
  2⤵
  PID:8032
- C:\Windows\System\GtmjGRX.exe
  C:\Windows\System\GtmjGRX.exe
  2⤵
  PID:8052
- C:\Windows\System\CmBRgOe.exe
  C:\Windows\System\CmBRgOe.exe
  2⤵
  PID:8076
- C:\Windows\System\AuhLAAu.exe
  C:\Windows\System\AuhLAAu.exe
  2⤵
  PID:8108
- C:\Windows\System\vjbCgDU.exe
  C:\Windows\System\vjbCgDU.exe
  2⤵
  PID:8132
- C:\Windows\System\yNuhZvn.exe
  C:\Windows\System\yNuhZvn.exe
  2⤵
  PID:8156
- C:\Windows\System\zrbbOqL.exe
  C:\Windows\System\zrbbOqL.exe
  2⤵
  PID:8184
- C:\Windows\System\AwtyNLe.exe
  C:\Windows\System\AwtyNLe.exe
  2⤵
  PID:6904
- C:\Windows\System\UeGXBJG.exe
  C:\Windows\System\UeGXBJG.exe
  2⤵
  PID:6596
- C:\Windows\System\jcHfQZe.exe
  C:\Windows\System\jcHfQZe.exe
  2⤵
  PID:7172
- C:\Windows\System\CBNcuIN.exe
  C:\Windows\System\CBNcuIN.exe
  2⤵
  PID:6152
- C:\Windows\System\CdwdjVj.exe
  C:\Windows\System\CdwdjVj.exe
  2⤵
  PID:7028
- C:\Windows\System\qQEPnag.exe
  C:\Windows\System\qQEPnag.exe
  2⤵
  PID:7384
- C:\Windows\System\qjQyfGV.exe
  C:\Windows\System\qjQyfGV.exe
  2⤵
  PID:7484
- C:\Windows\System\nNfmFLE.exe
  C:\Windows\System\nNfmFLE.exe
  2⤵
  PID:7300
- C:\Windows\System\LFaVQci.exe
  C:\Windows\System\LFaVQci.exe
  2⤵
  PID:7620
- C:\Windows\System\arZovhh.exe
  C:\Windows\System\arZovhh.exe
  2⤵
  PID:7412
- C:\Windows\System\lojtYFQ.exe
  C:\Windows\System\lojtYFQ.exe
  2⤵
  PID:7456
- C:\Windows\System\kNoqbfv.exe
  C:\Windows\System\kNoqbfv.exe
  2⤵
  PID:7240
- C:\Windows\System\BGQALbi.exe
  C:\Windows\System\BGQALbi.exe
  2⤵
  PID:7512
- C:\Windows\System\IKSxUZW.exe
  C:\Windows\System\IKSxUZW.exe
  2⤵
  PID:7544
- C:\Windows\System\GOQKFRD.exe
  C:\Windows\System\GOQKFRD.exe
  2⤵
  PID:7604
- C:\Windows\System\EGXBaxv.exe
  C:\Windows\System\EGXBaxv.exe
  2⤵
  PID:7968
- C:\Windows\System\aoCAsyQ.exe
  C:\Windows\System\aoCAsyQ.exe
  2⤵
  PID:7748
- C:\Windows\System\AUAMzjJ.exe
  C:\Windows\System\AUAMzjJ.exe
  2⤵
  PID:7824
- C:\Windows\System\kXjpWGe.exe
  C:\Windows\System\kXjpWGe.exe
  2⤵
  PID:8104
- C:\Windows\System\vYiXuwH.exe
  C:\Windows\System\vYiXuwH.exe
  2⤵
  PID:7876
- C:\Windows\System\wtDqSMy.exe
  C:\Windows\System\wtDqSMy.exe
  2⤵
  PID:7924
- C:\Windows\System\hJhxVNO.exe
  C:\Windows\System\hJhxVNO.exe
  2⤵
  PID:7200
- C:\Windows\System\oNlFEOh.exe
  C:\Windows\System\oNlFEOh.exe
  2⤵
  PID:7220
- C:\Windows\System\uXkEywV.exe
  C:\Windows\System\uXkEywV.exe
  2⤵
  PID:8220
- C:\Windows\System\sbKPRId.exe
  C:\Windows\System\sbKPRId.exe
  2⤵
  PID:8244
- C:\Windows\System\TtTjvnx.exe
  C:\Windows\System\TtTjvnx.exe
  2⤵
  PID:8260
- C:\Windows\System\ZBcwObS.exe
  C:\Windows\System\ZBcwObS.exe
  2⤵
  PID:8280
- C:\Windows\System\TVOkzAZ.exe
  C:\Windows\System\TVOkzAZ.exe
  2⤵
  PID:8304
- C:\Windows\System\gTbfnqi.exe
  C:\Windows\System\gTbfnqi.exe
  2⤵
  PID:8320
- C:\Windows\System\zTkBAQF.exe
  C:\Windows\System\zTkBAQF.exe
  2⤵
  PID:8344
- C:\Windows\System\CQnlmxX.exe
  C:\Windows\System\CQnlmxX.exe
  2⤵
  PID:8364
- C:\Windows\System\lTWcLGi.exe
  C:\Windows\System\lTWcLGi.exe
  2⤵
  PID:8388
- C:\Windows\System\OanXwcM.exe
  C:\Windows\System\OanXwcM.exe
  2⤵
  PID:8420
- C:\Windows\System\tNofiye.exe
  C:\Windows\System\tNofiye.exe
  2⤵
  PID:8448
- C:\Windows\System\ymAdUyS.exe
  C:\Windows\System\ymAdUyS.exe
  2⤵
  PID:8476
- C:\Windows\System\zUwcklD.exe
  C:\Windows\System\zUwcklD.exe
  2⤵
  PID:8496
- C:\Windows\System\UGMaLvz.exe
  C:\Windows\System\UGMaLvz.exe
  2⤵
  PID:8516
- C:\Windows\System\QMrvtIJ.exe
  C:\Windows\System\QMrvtIJ.exe
  2⤵
  PID:8540
- C:\Windows\System\wIoStUs.exe
  C:\Windows\System\wIoStUs.exe
  2⤵
  PID:8564
- C:\Windows\System\icnDTyy.exe
  C:\Windows\System\icnDTyy.exe
  2⤵
  PID:8588
- C:\Windows\System\xPKCzLu.exe
  C:\Windows\System\xPKCzLu.exe
  2⤵
  PID:8612
- C:\Windows\System\IerBgdo.exe
  C:\Windows\System\IerBgdo.exe
  2⤵
  PID:8644
- C:\Windows\System\duCfejw.exe
  C:\Windows\System\duCfejw.exe
  2⤵
  PID:8664
- C:\Windows\System\eCgzsAe.exe
  C:\Windows\System\eCgzsAe.exe
  2⤵
  PID:8688
- C:\Windows\System\jWdxcJR.exe
  C:\Windows\System\jWdxcJR.exe
  2⤵
  PID:8708
- C:\Windows\System\WOBvbMp.exe
  C:\Windows\System\WOBvbMp.exe
  2⤵
  PID:8740
- C:\Windows\System\gIGtbIl.exe
  C:\Windows\System\gIGtbIl.exe
  2⤵
  PID:8764
- C:\Windows\System\ptMoPmR.exe
  C:\Windows\System\ptMoPmR.exe
  2⤵
  PID:8784
- C:\Windows\System\ORJwVbP.exe
  C:\Windows\System\ORJwVbP.exe
  2⤵
  PID:8812
- C:\Windows\System\iwzVwnZ.exe
  C:\Windows\System\iwzVwnZ.exe
  2⤵
  PID:8840
- C:\Windows\System\lLHrOSN.exe
  C:\Windows\System\lLHrOSN.exe
  2⤵
  PID:8860
- C:\Windows\System\mkFEzfY.exe
  C:\Windows\System\mkFEzfY.exe
  2⤵
  PID:8880
- C:\Windows\System\CvrqjMq.exe
  C:\Windows\System\CvrqjMq.exe
  2⤵
  PID:8908
- C:\Windows\System\XfeVKqR.exe
  C:\Windows\System\XfeVKqR.exe
  2⤵
  PID:8932
- C:\Windows\System\gzeuPTN.exe
  C:\Windows\System\gzeuPTN.exe
  2⤵
  PID:8952
- C:\Windows\System\GGScAhd.exe
  C:\Windows\System\GGScAhd.exe
  2⤵
  PID:8980
- C:\Windows\System\zMmgjEm.exe
  C:\Windows\System\zMmgjEm.exe
  2⤵
  PID:9000
- C:\Windows\System\QdrBixy.exe
  C:\Windows\System\QdrBixy.exe
  2⤵
  PID:9024
- C:\Windows\System\QxHiGMX.exe
  C:\Windows\System\QxHiGMX.exe
  2⤵
  PID:9052
- C:\Windows\System\jsCTRVA.exe
  C:\Windows\System\jsCTRVA.exe
  2⤵
  PID:9080
- C:\Windows\System\KzhFuNe.exe
  C:\Windows\System\KzhFuNe.exe
  2⤵
  PID:9108
- C:\Windows\System\FXodusl.exe
  C:\Windows\System\FXodusl.exe
  2⤵
  PID:9132
- C:\Windows\System\OxvDUEq.exe
  C:\Windows\System\OxvDUEq.exe
  2⤵
  PID:9168
- C:\Windows\System\lAovHqV.exe
  C:\Windows\System\lAovHqV.exe
  2⤵
  PID:9200
- C:\Windows\System\jwglvXO.exe
  C:\Windows\System\jwglvXO.exe
  2⤵
  PID:7320
- C:\Windows\System\RpHgPXS.exe
  C:\Windows\System\RpHgPXS.exe
  2⤵
  PID:8124
- C:\Windows\System\cCxJEcL.exe
  C:\Windows\System\cCxJEcL.exe
  2⤵
  PID:6312
- C:\Windows\System\HNrOCSh.exe
  C:\Windows\System\HNrOCSh.exe
  2⤵
  PID:7976
- C:\Windows\System\HVeHzmd.exe
  C:\Windows\System\HVeHzmd.exe
  2⤵
  PID:8148
- C:\Windows\System\VfQDwsM.exe
  C:\Windows\System\VfQDwsM.exe
  2⤵
  PID:7376
- C:\Windows\System\dONkDHU.exe
  C:\Windows\System\dONkDHU.exe
  2⤵
  PID:8252
- C:\Windows\System\zJcmVfF.exe
  C:\Windows\System\zJcmVfF.exe
  2⤵
  PID:7564
- C:\Windows\System\rpXVSdA.exe
  C:\Windows\System\rpXVSdA.exe
  2⤵
  PID:8360
- C:\Windows\System\AaoPAQz.exe
  C:\Windows\System\AaoPAQz.exe
  2⤵
  PID:8436
- C:\Windows\System\DigzUql.exe
  C:\Windows\System\DigzUql.exe
  2⤵
  PID:8432
- C:\Windows\System\wIaaTlP.exe
  C:\Windows\System\wIaaTlP.exe
  2⤵
  PID:7380
- C:\Windows\System\nuJOuOU.exe
  C:\Windows\System\nuJOuOU.exe
  2⤵
  PID:8508
- C:\Windows\System\alQMeEN.exe
  C:\Windows\System\alQMeEN.exe
  2⤵
  PID:8608
- C:\Windows\System\JDBJYyz.exe
  C:\Windows\System\JDBJYyz.exe
  2⤵
  PID:8652
- C:\Windows\System\uxgfWKV.exe
  C:\Windows\System\uxgfWKV.exe
  2⤵
  PID:8288
- C:\Windows\System\IxqPjuZ.exe
  C:\Windows\System\IxqPjuZ.exe
  2⤵
  PID:8760
- C:\Windows\System\zjdFckB.exe
  C:\Windows\System\zjdFckB.exe
  2⤵
  PID:8832
- C:\Windows\System\Cvdppxv.exe
  C:\Windows\System\Cvdppxv.exe
  2⤵
  PID:8900
- C:\Windows\System\iHeMKfh.exe
  C:\Windows\System\iHeMKfh.exe
  2⤵
  PID:8536
- C:\Windows\System\GePZDdu.exe
  C:\Windows\System\GePZDdu.exe
  2⤵
  PID:8212
- C:\Windows\System\vLKjysI.exe
  C:\Windows\System\vLKjysI.exe
  2⤵
  PID:9048
- C:\Windows\System\lkpsgqQ.exe
  C:\Windows\System\lkpsgqQ.exe
  2⤵
  PID:8728
- C:\Windows\System\aLKoHOA.exe
  C:\Windows\System\aLKoHOA.exe
  2⤵
  PID:9224
- C:\Windows\System\UpZBglG.exe
  C:\Windows\System\UpZBglG.exe
  2⤵
  PID:9248
- C:\Windows\System\LfhRTTK.exe
  C:\Windows\System\LfhRTTK.exe
  2⤵
  PID:9264
- C:\Windows\System\QcYXTae.exe
  C:\Windows\System\QcYXTae.exe
  2⤵
  PID:9284
- C:\Windows\System\NjyniAY.exe
  C:\Windows\System\NjyniAY.exe
  2⤵
  PID:9308
- C:\Windows\System\ktQfNwc.exe
  C:\Windows\System\ktQfNwc.exe
  2⤵
  PID:9332
- C:\Windows\System\HPaZxDv.exe
  C:\Windows\System\HPaZxDv.exe
  2⤵
  PID:9360
- C:\Windows\System\HNoDosr.exe
  C:\Windows\System\HNoDosr.exe
  2⤵
  PID:9380
- C:\Windows\System\MHNrlZj.exe
  C:\Windows\System\MHNrlZj.exe
  2⤵
  PID:9404
- C:\Windows\System\CneqpBM.exe
  C:\Windows\System\CneqpBM.exe
  2⤵
  PID:9424
- C:\Windows\System\suvXJPN.exe
  C:\Windows\System\suvXJPN.exe
  2⤵
  PID:9448
- C:\Windows\System\YWSYgvR.exe
  C:\Windows\System\YWSYgvR.exe
  2⤵
  PID:9472
- C:\Windows\System\HGIdvqJ.exe
  C:\Windows\System\HGIdvqJ.exe
  2⤵
  PID:9496
- C:\Windows\System\WlRAHkh.exe
  C:\Windows\System\WlRAHkh.exe
  2⤵
  PID:9524
- C:\Windows\System\TuWOEGl.exe
  C:\Windows\System\TuWOEGl.exe
  2⤵
  PID:9544
- C:\Windows\System\ulWEixt.exe
  C:\Windows\System\ulWEixt.exe
  2⤵
  PID:9568
- C:\Windows\System\cZMEyFt.exe
  C:\Windows\System\cZMEyFt.exe
  2⤵
  PID:9596
- C:\Windows\System\IxZcVjD.exe
  C:\Windows\System\IxZcVjD.exe
  2⤵
  PID:9620
- C:\Windows\System\rdulENf.exe
  C:\Windows\System\rdulENf.exe
  2⤵
  PID:9644
- C:\Windows\System\vASoIwd.exe
  C:\Windows\System\vASoIwd.exe
  2⤵
  PID:9672
- C:\Windows\System\MtKnLLe.exe
  C:\Windows\System\MtKnLLe.exe
  2⤵
  PID:9696
- C:\Windows\System\gbEYqax.exe
  C:\Windows\System\gbEYqax.exe
  2⤵
  PID:9716
- C:\Windows\System\GOzMAll.exe
  C:\Windows\System\GOzMAll.exe
  2⤵
  PID:9740
- C:\Windows\System\xqcRhiS.exe
  C:\Windows\System\xqcRhiS.exe
  2⤵
  PID:9760
- C:\Windows\System\bEAeJnD.exe
  C:\Windows\System\bEAeJnD.exe
  2⤵
  PID:9776
- C:\Windows\System\CrNhqBd.exe
  C:\Windows\System\CrNhqBd.exe
  2⤵
  PID:9800
- C:\Windows\System\ZluNmLo.exe
  C:\Windows\System\ZluNmLo.exe
  2⤵
  PID:9816
- C:\Windows\System\lgBIVjw.exe
  C:\Windows\System\lgBIVjw.exe
  2⤵
  PID:9832
- C:\Windows\System\bsGXEJd.exe
  C:\Windows\System\bsGXEJd.exe
  2⤵
  PID:9856
- C:\Windows\System\UmWJalL.exe
  C:\Windows\System\UmWJalL.exe
  2⤵
  PID:9880
- C:\Windows\System\OgCroRP.exe
  C:\Windows\System\OgCroRP.exe
  2⤵
  PID:9908
- C:\Windows\System\ocIsjOK.exe
  C:\Windows\System\ocIsjOK.exe
  2⤵
  PID:9936
- C:\Windows\System\gcMIcqa.exe
  C:\Windows\System\gcMIcqa.exe
  2⤵
  PID:9960
- C:\Windows\System\fkvJftR.exe
  C:\Windows\System\fkvJftR.exe
  2⤵
  PID:9976
- C:\Windows\System\xWxjQap.exe
  C:\Windows\System\xWxjQap.exe
  2⤵
  PID:10004
- C:\Windows\System\zrXgtrn.exe
  C:\Windows\System\zrXgtrn.exe
  2⤵
  PID:10028
- C:\Windows\System\GWjaqGE.exe
  C:\Windows\System\GWjaqGE.exe
  2⤵
  PID:10056
- C:\Windows\System\hNffDBC.exe
  C:\Windows\System\hNffDBC.exe
  2⤵
  PID:10072
- C:\Windows\System\fkOHyFg.exe
  C:\Windows\System\fkOHyFg.exe
  2⤵
  PID:10092
- C:\Windows\System\dWXSJPm.exe
  C:\Windows\System\dWXSJPm.exe
  2⤵
  PID:10124
- C:\Windows\System\BDGtSdp.exe
  C:\Windows\System\BDGtSdp.exe
  2⤵
  PID:10144
- C:\Windows\System\AtPYWuD.exe
  C:\Windows\System\AtPYWuD.exe
  2⤵
  PID:10164
- C:\Windows\System\sxnnOLc.exe
  C:\Windows\System\sxnnOLc.exe
  2⤵
  PID:10188
- C:\Windows\System\wzsuTrj.exe
  C:\Windows\System\wzsuTrj.exe
  2⤵
  PID:10208
- C:\Windows\System\bllWSuL.exe
  C:\Windows\System\bllWSuL.exe
  2⤵
  PID:10232
- C:\Windows\System\JjJUtYi.exe
  C:\Windows\System\JjJUtYi.exe
  2⤵
  PID:7056
- C:\Windows\System\FZKNcux.exe
  C:\Windows\System\FZKNcux.exe
  2⤵
  PID:8776
- C:\Windows\System\edwoxiM.exe
  C:\Windows\System\edwoxiM.exe
  2⤵
  PID:8316
- C:\Windows\System\UcGkbgW.exe
  C:\Windows\System\UcGkbgW.exe
  2⤵
  PID:8948
- C:\Windows\System\BZoddIw.exe
  C:\Windows\System\BZoddIw.exe
  2⤵
  PID:8256
- C:\Windows\System\lULHrdr.exe
  C:\Windows\System\lULHrdr.exe
  2⤵
  PID:9120
- C:\Windows\System\JzYUeue.exe
  C:\Windows\System\JzYUeue.exe
  2⤵
  PID:8696
- C:\Windows\System\ELHudRE.exe
  C:\Windows\System\ELHudRE.exe
  2⤵
  PID:8268
- C:\Windows\System\qQBLkcB.exe
  C:\Windows\System\qQBLkcB.exe
  2⤵
  PID:9276
- C:\Windows\System\ZmrWWTf.exe
  C:\Windows\System\ZmrWWTf.exe
  2⤵
  PID:8064
- C:\Windows\System\zpOhZQF.exe
  C:\Windows\System\zpOhZQF.exe
  2⤵
  PID:9396
- C:\Windows\System\suOkBiz.exe
  C:\Windows\System\suOkBiz.exe
  2⤵
  PID:9460
- C:\Windows\System\UjpsqQE.exe
  C:\Windows\System\UjpsqQE.exe
  2⤵
  PID:9560
- C:\Windows\System\MKOMGvf.exe
  C:\Windows\System\MKOMGvf.exe
  2⤵
  PID:9584
- C:\Windows\System\ttorqor.exe
  C:\Windows\System\ttorqor.exe
  2⤵
  PID:8640
- C:\Windows\System\ClOifwZ.exe
  C:\Windows\System\ClOifwZ.exe
  2⤵
  PID:9728
- C:\Windows\System\tQtXfpX.exe
  C:\Windows\System\tQtXfpX.exe
  2⤵
  PID:9096
- C:\Windows\System\GvFElft.exe
  C:\Windows\System\GvFElft.exe
  2⤵
  PID:9156
- C:\Windows\System\tzNYFcg.exe
  C:\Windows\System\tzNYFcg.exe
  2⤵
  PID:8872
- C:\Windows\System\PRNmuRn.exe
  C:\Windows\System\PRNmuRn.exe
  2⤵
  PID:8296
- C:\Windows\System\bHAcEpU.exe
  C:\Windows\System\bHAcEpU.exe
  2⤵
  PID:9240
- C:\Windows\System\RsjUryq.exe
  C:\Windows\System\RsjUryq.exe
  2⤵
  PID:9876
- C:\Windows\System\PWeZreO.exe
  C:\Windows\System\PWeZreO.exe
  2⤵
  PID:9920
- C:\Windows\System\qZXueGN.exe
  C:\Windows\System\qZXueGN.exe
  2⤵
  PID:9400
- C:\Windows\System\ignmtXh.exe
  C:\Windows\System\ignmtXh.exe
  2⤵
  PID:8384
- C:\Windows\System\IuZZAeh.exe
  C:\Windows\System\IuZZAeh.exe
  2⤵
  PID:10256
- C:\Windows\System\bpMXGIL.exe
  C:\Windows\System\bpMXGIL.exe
  2⤵
  PID:10272
- C:\Windows\System\DESZRgz.exe
  C:\Windows\System\DESZRgz.exe
  2⤵
  PID:10300
- C:\Windows\System\cgMSqdH.exe
  C:\Windows\System\cgMSqdH.exe
  2⤵
  PID:10328
- C:\Windows\System\LclwILx.exe
  C:\Windows\System\LclwILx.exe
  2⤵
  PID:10352
- C:\Windows\System\cPvaGIj.exe
  C:\Windows\System\cPvaGIj.exe
  2⤵
  PID:10372
- C:\Windows\System\rNfzgGy.exe
  C:\Windows\System\rNfzgGy.exe
  2⤵
  PID:10388
- C:\Windows\System\EqDlXJa.exe
  C:\Windows\System\EqDlXJa.exe
  2⤵
  PID:10416
- C:\Windows\System\XHHIssd.exe
  C:\Windows\System\XHHIssd.exe
  2⤵
  PID:10436
- C:\Windows\System\bGgGoHY.exe
  C:\Windows\System\bGgGoHY.exe
  2⤵
  PID:10460
- C:\Windows\System\LpPgQgz.exe
  C:\Windows\System\LpPgQgz.exe
  2⤵
  PID:10484
- C:\Windows\System\SvMEBpa.exe
  C:\Windows\System\SvMEBpa.exe
  2⤵
  PID:10508
- C:\Windows\System\FswxdXM.exe
  C:\Windows\System\FswxdXM.exe
  2⤵
  PID:10536
- C:\Windows\System\dIFdrMe.exe
  C:\Windows\System\dIFdrMe.exe
  2⤵
  PID:10560
- C:\Windows\System\koLsrgN.exe
  C:\Windows\System\koLsrgN.exe
  2⤵
  PID:10580
- C:\Windows\System\uuoTTWw.exe
  C:\Windows\System\uuoTTWw.exe
  2⤵
  PID:10608
- C:\Windows\System\XMgbUaN.exe
  C:\Windows\System\XMgbUaN.exe
  2⤵
  PID:10624
- C:\Windows\System\QrcqbRA.exe
  C:\Windows\System\QrcqbRA.exe
  2⤵
  PID:10656
- C:\Windows\System\qcdiFno.exe
  C:\Windows\System\qcdiFno.exe
  2⤵
  PID:10684
- C:\Windows\System\DNAGTsR.exe
  C:\Windows\System\DNAGTsR.exe
  2⤵
  PID:10708
- C:\Windows\System\WyIrIpF.exe
  C:\Windows\System\WyIrIpF.exe
  2⤵
  PID:10732
- C:\Windows\System\jPVkZQy.exe
  C:\Windows\System\jPVkZQy.exe
  2⤵
  PID:10764
- C:\Windows\System\bdorBxE.exe
  C:\Windows\System\bdorBxE.exe
  2⤵
  PID:10788
- C:\Windows\System\wQnWjBb.exe
  C:\Windows\System\wQnWjBb.exe
  2⤵
  PID:10804
- C:\Windows\System\VbfjQYD.exe
  C:\Windows\System\VbfjQYD.exe
  2⤵
  PID:10832
- C:\Windows\System\kphPoPx.exe
  C:\Windows\System\kphPoPx.exe
  2⤵
  PID:10852
- C:\Windows\System\brgEuzL.exe
  C:\Windows\System\brgEuzL.exe
  2⤵
  PID:10872
- C:\Windows\System\xVErTfq.exe
  C:\Windows\System\xVErTfq.exe
  2⤵
  PID:10892
- C:\Windows\System\RUbXXeJ.exe
  C:\Windows\System\RUbXXeJ.exe
  2⤵
  PID:10912
- C:\Windows\System\TnzpqCy.exe
  C:\Windows\System\TnzpqCy.exe
  2⤵
  PID:10932
- C:\Windows\System\QMTagxa.exe
  C:\Windows\System\QMTagxa.exe
  2⤵
  PID:10956
- C:\Windows\System\NWPczyh.exe
  C:\Windows\System\NWPczyh.exe
  2⤵
  PID:10984
- C:\Windows\System\OMCoQOA.exe
  C:\Windows\System\OMCoQOA.exe
  2⤵
  PID:11004
- C:\Windows\System\mTOSdFH.exe
  C:\Windows\System\mTOSdFH.exe
  2⤵
  PID:11028
- C:\Windows\System\QANDMsi.exe
  C:\Windows\System\QANDMsi.exe
  2⤵
  PID:11052
- C:\Windows\System\reVVpjW.exe
  C:\Windows\System\reVVpjW.exe
  2⤵
  PID:11076
- C:\Windows\System\hkQuuWb.exe
  C:\Windows\System\hkQuuWb.exe
  2⤵
  PID:11104
- C:\Windows\System\SapicOA.exe
  C:\Windows\System\SapicOA.exe
  2⤵
  PID:11124
- C:\Windows\System\ytyyWpy.exe
  C:\Windows\System\ytyyWpy.exe
  2⤵
  PID:11148
- C:\Windows\System\DUyBNBL.exe
  C:\Windows\System\DUyBNBL.exe
  2⤵
  PID:11168
- C:\Windows\System\lwqiygE.exe
  C:\Windows\System\lwqiygE.exe
  2⤵
  PID:11196
- C:\Windows\System\esQuDzW.exe
  C:\Windows\System\esQuDzW.exe
  2⤵
  PID:11216
- C:\Windows\System\ppdKBwi.exe
  C:\Windows\System\ppdKBwi.exe
  2⤵
  PID:11240
- C:\Windows\System\maxYQOC.exe
  C:\Windows\System\maxYQOC.exe
  2⤵
  PID:11256
- C:\Windows\System\UfKgicB.exe
  C:\Windows\System\UfKgicB.exe
  2⤵
  PID:10080
- C:\Windows\System\wahELaq.exe
  C:\Windows\System\wahELaq.exe
  2⤵
  PID:9556
- C:\Windows\System\xacvfcv.exe
  C:\Windows\System\xacvfcv.exe
  2⤵
  PID:10228
- C:\Windows\System\yEWggLC.exe
  C:\Windows\System\yEWggLC.exe
  2⤵
  PID:7944
- C:\Windows\System\YBYzpSM.exe
  C:\Windows\System\YBYzpSM.exe
  2⤵
  PID:8824
- C:\Windows\System\EOLHKRY.exe
  C:\Windows\System\EOLHKRY.exe
  2⤵
  PID:9076
- C:\Windows\System\vKSlWmo.exe
  C:\Windows\System\vKSlWmo.exe
  2⤵
  PID:8100
- C:\Windows\System\TlFapQU.exe
  C:\Windows\System\TlFapQU.exe
  2⤵
  PID:8876
- C:\Windows\System\leqwkIz.exe
  C:\Windows\System\leqwkIz.exe
  2⤵
  PID:9932
- C:\Windows\System\tJoxmPI.exe
  C:\Windows\System\tJoxmPI.exe
  2⤵
  PID:9324
- C:\Windows\System\uDttVPy.exe
  C:\Windows\System\uDttVPy.exe
  2⤵
  PID:9992
- C:\Windows\System\xtgwJNb.exe
  C:\Windows\System\xtgwJNb.exe
  2⤵
  PID:10020
- C:\Windows\System\ahZUimm.exe
  C:\Windows\System\ahZUimm.exe
  2⤵
  PID:10252
- C:\Windows\System\snZNGLW.exe
  C:\Windows\System\snZNGLW.exe
  2⤵
  PID:10340
- C:\Windows\System\UWujAvm.exe
  C:\Windows\System\UWujAvm.exe
  2⤵
  PID:10384
- C:\Windows\System\xBTllrA.exe
  C:\Windows\System\xBTllrA.exe
  2⤵
  PID:9680
- C:\Windows\System\OmYdNiL.exe
  C:\Windows\System\OmYdNiL.exe
  2⤵
  PID:9704
- C:\Windows\System\bpqeWpZ.exe
  C:\Windows\System\bpqeWpZ.exe
  2⤵
  PID:10528
- C:\Windows\System\OrzHaKH.exe
  C:\Windows\System\OrzHaKH.exe
  2⤵
  PID:9748
- C:\Windows\System\HWDowiW.exe
  C:\Windows\System\HWDowiW.exe
  2⤵
  PID:10648
- C:\Windows\System\xqFYaZa.exe
  C:\Windows\System\xqFYaZa.exe
  2⤵
  PID:8028
- C:\Windows\System\VafgFOe.exe
  C:\Windows\System\VafgFOe.exe
  2⤵
  PID:11276
- C:\Windows\System\kIYWYIA.exe
  C:\Windows\System\kIYWYIA.exe
  2⤵
  PID:11296
- C:\Windows\System\RBKYYTa.exe
  C:\Windows\System\RBKYYTa.exe
  2⤵
  PID:11320
- C:\Windows\System\oxjynoD.exe
  C:\Windows\System\oxjynoD.exe
  2⤵
  PID:11336
- C:\Windows\System\cTdIjlh.exe
  C:\Windows\System\cTdIjlh.exe
  2⤵
  PID:11356
- C:\Windows\System\VTyHlPT.exe
  C:\Windows\System\VTyHlPT.exe
  2⤵
  PID:11372
- C:\Windows\System\blTkNTj.exe
  C:\Windows\System\blTkNTj.exe
  2⤵
  PID:11400
- C:\Windows\System\UVeBEud.exe
  C:\Windows\System\UVeBEud.exe
  2⤵
  PID:11424
- C:\Windows\System\KzRKKHp.exe
  C:\Windows\System\KzRKKHp.exe
  2⤵
  PID:11452
- C:\Windows\System\WPoXZGS.exe
  C:\Windows\System\WPoXZGS.exe
  2⤵
  PID:11472
- C:\Windows\System\utuIcSX.exe
  C:\Windows\System\utuIcSX.exe
  2⤵
  PID:11492
- C:\Windows\System\yKPfPnb.exe
  C:\Windows\System\yKPfPnb.exe
  2⤵
  PID:11520
- C:\Windows\System\FmxdWAS.exe
  C:\Windows\System\FmxdWAS.exe
  2⤵
  PID:11536
- C:\Windows\System\jXwGfMQ.exe
  C:\Windows\System\jXwGfMQ.exe
  2⤵
  PID:11556
- C:\Windows\System\IXWtCjP.exe
  C:\Windows\System\IXWtCjP.exe
  2⤵
  PID:11592
- C:\Windows\System\AYRKrnA.exe
  C:\Windows\System\AYRKrnA.exe
  2⤵
  PID:11612
- C:\Windows\System\OxBEjXM.exe
  C:\Windows\System\OxBEjXM.exe
  2⤵
  PID:11636
- C:\Windows\System\dXoeAsx.exe
  C:\Windows\System\dXoeAsx.exe
  2⤵
  PID:11668
- C:\Windows\System\MUXopBu.exe
  C:\Windows\System\MUXopBu.exe
  2⤵
  PID:11692
- C:\Windows\System\JwiJvBY.exe
  C:\Windows\System\JwiJvBY.exe
  2⤵
  PID:11708
- C:\Windows\System\NMKzZdE.exe
  C:\Windows\System\NMKzZdE.exe
  2⤵
  PID:11728
- C:\Windows\System\WppVHDI.exe
  C:\Windows\System\WppVHDI.exe
  2⤵
  PID:11752
- C:\Windows\System\IsJLSmq.exe
  C:\Windows\System\IsJLSmq.exe
  2⤵
  PID:11776
- C:\Windows\System\pJqvDUY.exe
  C:\Windows\System\pJqvDUY.exe
  2⤵
  PID:11796
- C:\Windows\System\azvrCmC.exe
  C:\Windows\System\azvrCmC.exe
  2⤵
  PID:11820
- C:\Windows\System\fRqTMfr.exe
  C:\Windows\System\fRqTMfr.exe
  2⤵
  PID:11844
- C:\Windows\System\aVACEYV.exe
  C:\Windows\System\aVACEYV.exe
  2⤵
  PID:11868
- C:\Windows\System\LiowfXX.exe
  C:\Windows\System\LiowfXX.exe
  2⤵
  PID:11892
- C:\Windows\System\bWqKiqC.exe
  C:\Windows\System\bWqKiqC.exe
  2⤵
  PID:11912
- C:\Windows\System\xSqAfuB.exe
  C:\Windows\System\xSqAfuB.exe
  2⤵
  PID:11940
- C:\Windows\System\RZErFTU.exe
  C:\Windows\System\RZErFTU.exe
  2⤵
  PID:11968
- C:\Windows\System\apHlFXD.exe
  C:\Windows\System\apHlFXD.exe
  2⤵
  PID:11988
- C:\Windows\System\tTWXrYP.exe
  C:\Windows\System\tTWXrYP.exe
  2⤵
  PID:12012
- C:\Windows\System\pjasYYh.exe
  C:\Windows\System\pjasYYh.exe
  2⤵
  PID:12044
- C:\Windows\System\NsvrqqP.exe
  C:\Windows\System\NsvrqqP.exe
  2⤵
  PID:12068
- C:\Windows\System\uXnXFGY.exe
  C:\Windows\System\uXnXFGY.exe
  2⤵
  PID:12092
- C:\Windows\System\ovQRoZI.exe
  C:\Windows\System\ovQRoZI.exe
  2⤵
  PID:12112
- C:\Windows\System\LiDkciP.exe
  C:\Windows\System\LiDkciP.exe
  2⤵
  PID:12136
- C:\Windows\System\GOVolLY.exe
  C:\Windows\System\GOVolLY.exe
  2⤵
  PID:12152
- C:\Windows\System\GCrfWaY.exe
  C:\Windows\System\GCrfWaY.exe
  2⤵
  PID:12180
- C:\Windows\System\tUXIejh.exe
  C:\Windows\System\tUXIejh.exe
  2⤵
  PID:12200
- C:\Windows\System\fwmjhVu.exe
  C:\Windows\System\fwmjhVu.exe
  2⤵
  PID:12216
- C:\Windows\System\OGpvUZR.exe
  C:\Windows\System\OGpvUZR.exe
  2⤵
  PID:12244
- C:\Windows\System\yOgaChE.exe
  C:\Windows\System\yOgaChE.exe
  2⤵
  PID:12264
- C:\Windows\System\rLcjrfO.exe
  C:\Windows\System\rLcjrfO.exe
  2⤵
  PID:9436
- C:\Windows\System\eOhChQI.exe
  C:\Windows\System\eOhChQI.exe
  2⤵
  PID:9840
- C:\Windows\System\ibZXjWP.exe
  C:\Windows\System\ibZXjWP.exe
  2⤵
  PID:9668
- C:\Windows\System\YqPDbxh.exe
  C:\Windows\System\YqPDbxh.exe
  2⤵
  PID:10944
- C:\Windows\System\zgLRHAM.exe
  C:\Windows\System\zgLRHAM.exe
  2⤵
  PID:9192
- C:\Windows\System\jXEwKbx.exe
  C:\Windows\System\jXEwKbx.exe
  2⤵
  PID:9824
- C:\Windows\System\ZkDtOjW.exe
  C:\Windows\System\ZkDtOjW.exe
  2⤵
  PID:9356
- C:\Windows\System\UFuVTLw.exe
  C:\Windows\System\UFuVTLw.exe
  2⤵
  PID:11160
- C:\Windows\System\qMqShKD.exe
  C:\Windows\System\qMqShKD.exe
  2⤵
  PID:11192
- C:\Windows\System\wWoVMcp.exe
  C:\Windows\System\wWoVMcp.exe
  2⤵
  PID:10344
- C:\Windows\System\dYBwuCK.exe
  C:\Windows\System\dYBwuCK.exe
  2⤵
  PID:7452
- C:\Windows\System\eJeMPxG.exe
  C:\Windows\System\eJeMPxG.exe
  2⤵
  PID:9508
- C:\Windows\System\ZGokIVy.exe
  C:\Windows\System\ZGokIVy.exe
  2⤵
  PID:10452
- C:\Windows\System\eMdMpeA.exe
  C:\Windows\System\eMdMpeA.exe
  2⤵
  PID:9968
- C:\Windows\System\dYBGqzG.exe
  C:\Windows\System\dYBGqzG.exe
  2⤵
  PID:10024
- C:\Windows\System\ZAByDlW.exe
  C:\Windows\System\ZAByDlW.exe
  2⤵
  PID:10596
- C:\Windows\System\oGDKnMQ.exe
  C:\Windows\System\oGDKnMQ.exe
  2⤵
  PID:10576
- C:\Windows\System\gRqBTQj.exe
  C:\Windows\System\gRqBTQj.exe
  2⤵
  PID:9316
- C:\Windows\System\uiVVuRv.exe
  C:\Windows\System\uiVVuRv.exe
  2⤵
  PID:10800
- C:\Windows\System\zNnOeAj.exe
  C:\Windows\System\zNnOeAj.exe
  2⤵
  PID:10840
- C:\Windows\System\CLmuByu.exe
  C:\Windows\System\CLmuByu.exe
  2⤵
  PID:10868
- C:\Windows\System\gPATOsj.exe
  C:\Windows\System\gPATOsj.exe
  2⤵
  PID:11448
- C:\Windows\System\kuQaqvI.exe
  C:\Windows\System\kuQaqvI.exe
  2⤵
  PID:10992
- C:\Windows\System\HzhNMQL.exe
  C:\Windows\System\HzhNMQL.exe
  2⤵
  PID:12320
- C:\Windows\System\ExApWqP.exe
  C:\Windows\System\ExApWqP.exe
  2⤵
  PID:12344
- C:\Windows\System\RKhfGjL.exe
  C:\Windows\System\RKhfGjL.exe
  2⤵
  PID:12368
- C:\Windows\System\aCxndpf.exe
  C:\Windows\System\aCxndpf.exe
  2⤵
  PID:12388
- C:\Windows\System\tiGtCpw.exe
  C:\Windows\System\tiGtCpw.exe
  2⤵
  PID:12420
- C:\Windows\System\QtyPVmT.exe
  C:\Windows\System\QtyPVmT.exe
  2⤵
  PID:12436
- C:\Windows\System\KIieoFE.exe
  C:\Windows\System\KIieoFE.exe
  2⤵
  PID:12464
- C:\Windows\System\dIIqBgE.exe
  C:\Windows\System\dIIqBgE.exe
  2⤵
  PID:12484
- C:\Windows\System\BhpSNRr.exe
  C:\Windows\System\BhpSNRr.exe
  2⤵
  PID:12508
- C:\Windows\System\cqKjTpm.exe
  C:\Windows\System\cqKjTpm.exe
  2⤵
  PID:12532
- C:\Windows\System\pWMFoSO.exe
  C:\Windows\System\pWMFoSO.exe
  2⤵
  PID:12556
- C:\Windows\System\GftCdky.exe
  C:\Windows\System\GftCdky.exe
  2⤵
  PID:12576
- C:\Windows\System\WyNsscb.exe
  C:\Windows\System\WyNsscb.exe
  2⤵
  PID:12604
- C:\Windows\System\bHBPbXN.exe
  C:\Windows\System\bHBPbXN.exe
  2⤵
  PID:12620
- C:\Windows\System\pXFyJUe.exe
  C:\Windows\System\pXFyJUe.exe
  2⤵
  PID:12640
- C:\Windows\System\HKuQQpN.exe
  C:\Windows\System\HKuQQpN.exe
  2⤵
  PID:12664
- C:\Windows\System\wawVWTk.exe
  C:\Windows\System\wawVWTk.exe
  2⤵
  PID:12688
- C:\Windows\System\zsZazDC.exe
  C:\Windows\System\zsZazDC.exe
  2⤵
  PID:12716
- C:\Windows\System\rGZjSbK.exe
  C:\Windows\System\rGZjSbK.exe
  2⤵
  PID:12744
- C:\Windows\System\cWdjFzq.exe
  C:\Windows\System\cWdjFzq.exe
  2⤵
  PID:12760
- C:\Windows\System\xQWiNzY.exe
  C:\Windows\System\xQWiNzY.exe
  2⤵
  PID:12780
- C:\Windows\System\yUHgcrx.exe
  C:\Windows\System\yUHgcrx.exe
  2⤵
  PID:12808
- C:\Windows\System\bgeKbYr.exe
  C:\Windows\System\bgeKbYr.exe
  2⤵
  PID:12832
- C:\Windows\System\SKsGCzK.exe
  C:\Windows\System\SKsGCzK.exe
  2⤵
  PID:12852
- C:\Windows\System\gMZSjXP.exe
  C:\Windows\System\gMZSjXP.exe
  2⤵
  PID:12876
- C:\Windows\System\gmKtJJg.exe
  C:\Windows\System\gmKtJJg.exe
  2⤵
  PID:12896
- C:\Windows\System\ldGuuhy.exe
  C:\Windows\System\ldGuuhy.exe
  2⤵
  PID:12920
- C:\Windows\System\qCnWmQr.exe
  C:\Windows\System\qCnWmQr.exe
  2⤵
  PID:12944
- C:\Windows\System\OxGcpIK.exe
  C:\Windows\System\OxGcpIK.exe
  2⤵
  PID:12964
- C:\Windows\System\TIdKpaE.exe
  C:\Windows\System\TIdKpaE.exe
  2⤵
  PID:12988
- C:\Windows\System\iwJbHPp.exe
  C:\Windows\System\iwJbHPp.exe
  2⤵
  PID:13016
- C:\Windows\System\OxBayTx.exe
  C:\Windows\System\OxBayTx.exe
  2⤵
  PID:13040
- C:\Windows\System\prfVOJL.exe
  C:\Windows\System\prfVOJL.exe
  2⤵
  PID:13056
- C:\Windows\System\faxjLpn.exe
  C:\Windows\System\faxjLpn.exe
  2⤵
  PID:13092
- C:\Windows\System\bLAXlYF.exe
  C:\Windows\System\bLAXlYF.exe
  2⤵
  PID:13112
- C:\Windows\System\iOlPjMQ.exe
  C:\Windows\System\iOlPjMQ.exe
  2⤵
  PID:13136
- C:\Windows\System\seCvmZX.exe
  C:\Windows\System\seCvmZX.exe
  2⤵
  PID:13164
- C:\Windows\System\SHCPNsG.exe
  C:\Windows\System\SHCPNsG.exe
  2⤵
  PID:13192
- C:\Windows\System\VhxLbWa.exe
  C:\Windows\System\VhxLbWa.exe
  2⤵
  PID:13208
- C:\Windows\System\EXJLtzO.exe
  C:\Windows\System\EXJLtzO.exe
  2⤵
  PID:13232
- C:\Windows\System\eVdBWgV.exe
  C:\Windows\System\eVdBWgV.exe
  2⤵
  PID:13256
- C:\Windows\System\EWMJJzq.exe
  C:\Windows\System\EWMJJzq.exe
  2⤵
  PID:13272
- C:\Windows\System\VVtCtvC.exe
  C:\Windows\System\VVtCtvC.exe
  2⤵
  PID:13292
- C:\Windows\System\cLpGkpg.exe
  C:\Windows\System\cLpGkpg.exe
  2⤵
  PID:13308
- C:\Windows\System\khTDAEe.exe
  C:\Windows\System\khTDAEe.exe
  2⤵
  PID:11024
- C:\Windows\System\BaLZtpP.exe
  C:\Windows\System\BaLZtpP.exe
  2⤵
  PID:11632
- C:\Windows\System\bfHHNUN.exe
  C:\Windows\System\bfHHNUN.exe
  2⤵
  PID:11680
- C:\Windows\System\tyatXTS.exe
  C:\Windows\System\tyatXTS.exe
  2⤵
  PID:11140
- C:\Windows\System\JBBEHcb.exe
  C:\Windows\System\JBBEHcb.exe
  2⤵
  PID:11204
- C:\Windows\System\bAGmauP.exe
  C:\Windows\System\bAGmauP.exe
  2⤵
  PID:11808
- C:\Windows\System\sJeyHvK.exe
  C:\Windows\System\sJeyHvK.exe
  2⤵
  PID:10324
- C:\Windows\System\SRYXiLx.exe
  C:\Windows\System\SRYXiLx.exe
  2⤵
  PID:11952
- C:\Windows\System\PsWeWxC.exe
  C:\Windows\System\PsWeWxC.exe
  2⤵
  PID:9628
- C:\Windows\System\JeGMmtj.exe
  C:\Windows\System\JeGMmtj.exe
  2⤵
  PID:12120
- C:\Windows\System\ppJogtx.exe
  C:\Windows\System\ppJogtx.exe
  2⤵
  PID:10040
- C:\Windows\System\waWdTZl.exe
  C:\Windows\System\waWdTZl.exe
  2⤵
  PID:12212
- C:\Windows\System\MaSZRmO.exe
  C:\Windows\System\MaSZRmO.exe
  2⤵
  PID:12256
- C:\Windows\System\teKBbUH.exe
  C:\Windows\System\teKBbUH.exe
  2⤵
  PID:8752
- C:\Windows\System\kABEksh.exe
  C:\Windows\System\kABEksh.exe
  2⤵
  PID:9612
- C:\Windows\System\FAdCKkT.exe
  C:\Windows\System\FAdCKkT.exe
  2⤵
  PID:10616
- C:\Windows\System\uqXPdzc.exe
  C:\Windows\System\uqXPdzc.exe
  2⤵
  PID:8232
- C:\Windows\System\psBlhhA.exe
  C:\Windows\System\psBlhhA.exe
  2⤵
  PID:11348
- C:\Windows\System\yDqKmXT.exe
  C:\Windows\System\yDqKmXT.exe
  2⤵
  PID:11364
- C:\Windows\System\SMtpBtT.exe
  C:\Windows\System\SMtpBtT.exe
  2⤵
  PID:11412
- C:\Windows\System\KBuqlaQ.exe
  C:\Windows\System\KBuqlaQ.exe
  2⤵
  PID:13344
- C:\Windows\System\BBNUwQo.exe
  C:\Windows\System\BBNUwQo.exe
  2⤵
  PID:13364
- C:\Windows\System\xADEtJM.exe
  C:\Windows\System\xADEtJM.exe
  2⤵
  PID:13384
- C:\Windows\System\CCklVuD.exe
  C:\Windows\System\CCklVuD.exe
  2⤵
  PID:13404
- C:\Windows\System\fNwwmbT.exe
  C:\Windows\System\fNwwmbT.exe
  2⤵
  PID:13424
- C:\Windows\System\dTGFBeG.exe
  C:\Windows\System\dTGFBeG.exe
  2⤵
  PID:13444
- C:\Windows\System\vCNfSIx.exe
  C:\Windows\System\vCNfSIx.exe
  2⤵
  PID:13460
- C:\Windows\System\XvCZSRc.exe
  C:\Windows\System\XvCZSRc.exe
  2⤵
  PID:13476
- C:\Windows\System\rceqDBs.exe
  C:\Windows\System\rceqDBs.exe
  2⤵
  PID:13500
- C:\Windows\System\FwZVCim.exe
  C:\Windows\System\FwZVCim.exe
  2⤵
  PID:13536
- C:\Windows\System\ZOQRehx.exe
  C:\Windows\System\ZOQRehx.exe
  2⤵
  PID:13552
- C:\Windows\System\CInmBNg.exe
  C:\Windows\System\CInmBNg.exe
  2⤵
  PID:13568
- C:\Windows\System\JjCpHxy.exe
  C:\Windows\System\JjCpHxy.exe
  2⤵
  PID:13584
- C:\Windows\System\ipREzVd.exe
  C:\Windows\System\ipREzVd.exe
  2⤵
  PID:13600
- C:\Windows\System\CefQJZm.exe
  C:\Windows\System\CefQJZm.exe
  2⤵
  PID:13616
- C:\Windows\System\ZEAlXvN.exe
  C:\Windows\System\ZEAlXvN.exe
  2⤵
  PID:13636
- C:\Windows\System\BrZCizh.exe
  C:\Windows\System\BrZCizh.exe
  2⤵
  PID:13652
- C:\Windows\System\zhqvsUX.exe
  C:\Windows\System\zhqvsUX.exe
  2⤵
  PID:13680
- C:\Windows\System\viyLeZO.exe
  C:\Windows\System\viyLeZO.exe
  2⤵
  PID:13712
- C:\Windows\System\BuzKKLN.exe
  C:\Windows\System\BuzKKLN.exe
  2⤵
  PID:13728
- C:\Windows\System\idtoZLU.exe
  C:\Windows\System\idtoZLU.exe
  2⤵
  PID:13744
- C:\Windows\System\mGsyjGN.exe
  C:\Windows\System\mGsyjGN.exe
  2⤵
  PID:13760
- C:\Windows\System\cujXulj.exe
  C:\Windows\System\cujXulj.exe
  2⤵
  PID:13780
- C:\Windows\System\gmDPINU.exe
  C:\Windows\System\gmDPINU.exe
  2⤵
  PID:13796
- C:\Windows\System\YylFEpk.exe
  C:\Windows\System\YylFEpk.exe
  2⤵
  PID:13812
- C:\Windows\System\KFDkGhH.exe
  C:\Windows\System\KFDkGhH.exe
  2⤵
  PID:13836
- C:\Windows\System\DXBSVCk.exe
  C:\Windows\System\DXBSVCk.exe
  2⤵
  PID:13868
- C:\Windows\System\cBcARRZ.exe
  C:\Windows\System\cBcARRZ.exe
  2⤵
  PID:13920
- C:\Windows\System\bbnPTFB.exe
  C:\Windows\System\bbnPTFB.exe
  2⤵
  PID:13980
- C:\Windows\System\UtfyPJy.exe
  C:\Windows\System\UtfyPJy.exe
  2⤵
  PID:14004
- C:\Windows\System\AfaKsjk.exe
  C:\Windows\System\AfaKsjk.exe
  2⤵
  PID:14052
- C:\Windows\System\huaioqJ.exe
  C:\Windows\System\huaioqJ.exe
  2⤵
  PID:14076
- C:\Windows\System\CragDyf.exe
  C:\Windows\System\CragDyf.exe
  2⤵
  PID:14096
- C:\Windows\System\XrHMpom.exe
  C:\Windows\System\XrHMpom.exe
  2⤵
  PID:14124
- C:\Windows\System\uXIbAld.exe
  C:\Windows\System\uXIbAld.exe
  2⤵
  PID:14140
- C:\Windows\System\GZvETaI.exe
  C:\Windows\System\GZvETaI.exe
  2⤵
  PID:14160
- C:\Windows\System\eMWSEnR.exe
  C:\Windows\System\eMWSEnR.exe
  2⤵
  PID:14180
- C:\Windows\System\yvgItgY.exe
  C:\Windows\System\yvgItgY.exe
  2⤵
  PID:14212
- C:\Windows\System\UxyOETZ.exe
  C:\Windows\System\UxyOETZ.exe
  2⤵
  PID:14228
- C:\Windows\System\RUEkCzk.exe
  C:\Windows\System\RUEkCzk.exe
  2⤵
  PID:14252
- C:\Windows\System\KwjuEhU.exe
  C:\Windows\System\KwjuEhU.exe
  2⤵
  PID:14268
- C:\Windows\System\EHeDegl.exe
  C:\Windows\System\EHeDegl.exe
  2⤵
  PID:14304
- C:\Windows\System\aBVDBAC.exe
  C:\Windows\System\aBVDBAC.exe
  2⤵
  PID:14332
- C:\Windows\System\lyzUEEU.exe
  C:\Windows\System\lyzUEEU.exe
  2⤵
  PID:10704
- C:\Windows\System\lDZBDzm.exe
  C:\Windows\System\lDZBDzm.exe
  2⤵
  PID:11500
- C:\Windows\System\aMaGkkz.exe
  C:\Windows\System\aMaGkkz.exe
  2⤵
  PID:8044
- C:\Windows\System\sNcYKER.exe
  C:\Windows\System\sNcYKER.exe
  2⤵
  PID:12456
- C:\Windows\System\YpgfYir.exe
  C:\Windows\System\YpgfYir.exe
  2⤵
  PID:11704
- C:\Windows\System\qVgXXzb.exe
  C:\Windows\System\qVgXXzb.exe
  2⤵
  PID:11840
- C:\Windows\System\sfMJCdy.exe
  C:\Windows\System\sfMJCdy.exe
  2⤵
  PID:11860
- C:\Windows\System\LvoMaFY.exe
  C:\Windows\System\LvoMaFY.exe
  2⤵
  PID:12752
- C:\Windows\System\DgNOMYk.exe
  C:\Windows\System\DgNOMYk.exe
  2⤵
  PID:12804
- C:\Windows\System\csnsvRd.exe
  C:\Windows\System\csnsvRd.exe
  2⤵
  PID:12912
- C:\Windows\System\MpwkFcm.exe
  C:\Windows\System\MpwkFcm.exe
  2⤵
  PID:12028
- C:\Windows\System\ckzvWAn.exe
  C:\Windows\System\ckzvWAn.exe
  2⤵
  PID:9296
- C:\Windows\System\ahwEmpy.exe
  C:\Windows\System\ahwEmpy.exe
  2⤵
  PID:13124
- C:\Windows\System\gwOIMsg.exe
  C:\Windows\System\gwOIMsg.exe
  2⤵
  PID:13184
- C:\Windows\System\DImLqIF.exe
  C:\Windows\System\DImLqIF.exe
  2⤵
  PID:10368
- C:\Windows\System\IHosKfQ.exe
  C:\Windows\System\IHosKfQ.exe
  2⤵
  PID:11020
- C:\Windows\System\RgKFlPL.exe
  C:\Windows\System\RgKFlPL.exe
  2⤵
  PID:14360
- C:\Windows\System\pdkHXPw.exe
  C:\Windows\System\pdkHXPw.exe
  2⤵
  PID:14380
- C:\Windows\System\IFgVSer.exe
  C:\Windows\System\IFgVSer.exe
  2⤵
  PID:14412
- C:\Windows\System\YNJhxXS.exe
  C:\Windows\System\YNJhxXS.exe
  2⤵
  PID:14444
- C:\Windows\System\HFeaBhg.exe
  C:\Windows\System\HFeaBhg.exe
  2⤵
  PID:14468
- C:\Windows\System\uiHEOdz.exe
  C:\Windows\System\uiHEOdz.exe
  2⤵
  PID:14492
- C:\Windows\System\vXgLxFp.exe
  C:\Windows\System\vXgLxFp.exe
  2⤵
  PID:14524
- C:\Windows\System\HLNvgNH.exe
  C:\Windows\System\HLNvgNH.exe
  2⤵
  PID:14544
- C:\Windows\System\XLtXOgv.exe
  C:\Windows\System\XLtXOgv.exe
  2⤵
  PID:14560
- C:\Windows\System\peDHCeq.exe
  C:\Windows\System\peDHCeq.exe
  2⤵
  PID:14576
- C:\Windows\System\ccGYNRU.exe
  C:\Windows\System\ccGYNRU.exe
  2⤵
  PID:14600
- C:\Windows\System\QqaEGfm.exe
  C:\Windows\System\QqaEGfm.exe
  2⤵
  PID:14616
- C:\Windows\System\rhLxDUl.exe
  C:\Windows\System\rhLxDUl.exe
  2⤵
  PID:14636
- C:\Windows\System\jbDnnQc.exe
  C:\Windows\System\jbDnnQc.exe
  2⤵
  PID:14660
- C:\Windows\System\WkuacyF.exe
  C:\Windows\System\WkuacyF.exe
  2⤵
  PID:14680
- C:\Windows\System\ABkDIHe.exe
  C:\Windows\System\ABkDIHe.exe
  2⤵
  PID:14696
- C:\Windows\System\OYdStWu.exe
  C:\Windows\System\OYdStWu.exe
  2⤵
  PID:14732
- C:\Windows\System\URpVyjk.exe
  C:\Windows\System\URpVyjk.exe
  2⤵
  PID:14764
- C:\Windows\System\IvgVYap.exe
  C:\Windows\System\IvgVYap.exe
  2⤵
  PID:14788
- C:\Windows\System\vTSxDui.exe
  C:\Windows\System\vTSxDui.exe
  2⤵
  PID:14804
- C:\Windows\System\Vbyfzaw.exe
  C:\Windows\System\Vbyfzaw.exe
  2⤵
  PID:14832
- C:\Windows\System\gZeELNt.exe
  C:\Windows\System\gZeELNt.exe
  2⤵
  PID:14852
- C:\Windows\System\LBIEPec.exe
  C:\Windows\System\LBIEPec.exe
  2⤵
  PID:14880
- C:\Windows\System\ubOkqKL.exe
  C:\Windows\System\ubOkqKL.exe
  2⤵
  PID:14896
- C:\Windows\System\TUqURMr.exe
  C:\Windows\System\TUqURMr.exe
  2⤵
  PID:14912
- C:\Windows\System\sRUJAun.exe
  C:\Windows\System\sRUJAun.exe
  2⤵
  PID:14928
- C:\Windows\System\YIICGjj.exe
  C:\Windows\System\YIICGjj.exe
  2⤵
  PID:14948
- C:\Windows\System\Nehzvye.exe
  C:\Windows\System\Nehzvye.exe
  2⤵
  PID:14972
- C:\Windows\System\FPzxGcn.exe
  C:\Windows\System\FPzxGcn.exe
  2⤵
  PID:14992
- C:\Windows\System\GwpKGNb.exe
  C:\Windows\System\GwpKGNb.exe
  2⤵
  PID:15008
- C:\Windows\System\YGKOCFt.exe
  C:\Windows\System\YGKOCFt.exe
  2⤵
  PID:15028
- C:\Windows\System\faLryKZ.exe
  C:\Windows\System\faLryKZ.exe
  2⤵
  PID:15052
- C:\Windows\System\OiepfqP.exe
  C:\Windows\System\OiepfqP.exe
  2⤵
  PID:15068
- C:\Windows\System\oblJkXv.exe
  C:\Windows\System\oblJkXv.exe
  2⤵
  PID:15092
- C:\Windows\System\wumqzHb.exe
  C:\Windows\System\wumqzHb.exe
  2⤵
  PID:15108
- C:\Windows\System\iNcARvr.exe
  C:\Windows\System\iNcARvr.exe
  2⤵
  PID:15124
- C:\Windows\System\DQXjePr.exe
  C:\Windows\System\DQXjePr.exe
  2⤵
  PID:15140
- C:\Windows\System\uzRkxdB.exe
  C:\Windows\System\uzRkxdB.exe
  2⤵
  PID:15172
- C:\Windows\System\HCCZEgR.exe
  C:\Windows\System\HCCZEgR.exe
  2⤵
  PID:15192
- C:\Windows\System\HEIobwC.exe
  C:\Windows\System\HEIobwC.exe
  2⤵
  PID:15216
- C:\Windows\System\TtDVOAI.exe
  C:\Windows\System\TtDVOAI.exe
  2⤵
  PID:15244
- C:\Windows\System\dkJTECU.exe
  C:\Windows\System\dkJTECU.exe
  2⤵
  PID:15264
- C:\Windows\System\xTGxyOk.exe
  C:\Windows\System\xTGxyOk.exe
  2⤵
  PID:15280
- C:\Windows\System\EScoUYA.exe
  C:\Windows\System\EScoUYA.exe
  2⤵
  PID:15296
- C:\Windows\System\RoLfIEY.exe
  C:\Windows\System\RoLfIEY.exe
  2⤵
  PID:15316
- C:\Windows\System\vHsvFlM.exe
  C:\Windows\System\vHsvFlM.exe
  2⤵
  PID:15336
- C:\Windows\System\qaCkudw.exe
  C:\Windows\System\qaCkudw.exe
  2⤵
  PID:15356
- C:\Windows\System\zcJlRTA.exe
  C:\Windows\System\zcJlRTA.exe
  2⤵
  PID:9796
- C:\Windows\System\bWSNrrf.exe
  C:\Windows\System\bWSNrrf.exe
  2⤵
  PID:10996
- C:\Windows\System\fadzwju.exe
  C:\Windows\System\fadzwju.exe
  2⤵
  PID:4764
- C:\Windows\System\ZiaIvtY.exe
  C:\Windows\System\ZiaIvtY.exe
  2⤵
  PID:10724
- C:\Windows\System\GBmVWdB.exe
  C:\Windows\System\GBmVWdB.exe
  2⤵
  PID:10728
- C:\Windows\System\GPCBfXu.exe
  C:\Windows\System\GPCBfXu.exe
  2⤵
  PID:13320
- C:\Windows\System\sVvzJhG.exe
  C:\Windows\System\sVvzJhG.exe
  2⤵
  PID:12352
- C:\Windows\System\eUfMtZM.exe
  C:\Windows\System\eUfMtZM.exe
  2⤵
  PID:11600
- C:\Windows\System\RaeXLko.exe
  C:\Windows\System\RaeXLko.exe
  2⤵
  PID:11608
- C:\Windows\System\JZnzNpu.exe
  C:\Windows\System\JZnzNpu.exe
  2⤵
  PID:12428
- C:\Windows\System\OfVpoUl.exe
  C:\Windows\System\OfVpoUl.exe
  2⤵
  PID:13624
- C:\Windows\System\NFqWVAT.exe
  C:\Windows\System\NFqWVAT.exe
  2⤵
  PID:13672
- C:\Windows\System\cpalSUc.exe
  C:\Windows\System\cpalSUc.exe
  2⤵
  PID:11736
- C:\Windows\System\iAYVFMc.exe
  C:\Windows\System\iAYVFMc.exe
  2⤵
  PID:12628
- C:\Windows\System\wuKxMZA.exe
  C:\Windows\System\wuKxMZA.exe
  2⤵
  PID:12652
- C:\Windows\System\OjIBvIb.exe
  C:\Windows\System\OjIBvIb.exe
  2⤵
  PID:12684
- C:\Windows\System\uVXVRvd.exe
  C:\Windows\System\uVXVRvd.exe
  2⤵
  PID:13708
- C:\Windows\System\hqNoeGn.exe
  C:\Windows\System\hqNoeGn.exe
  2⤵
  PID:13740
- C:\Windows\System\BmLzvKw.exe
  C:\Windows\System\BmLzvKw.exe
  2⤵
  PID:13884
- C:\Windows\System\UCqykJs.exe
  C:\Windows\System\UCqykJs.exe
  2⤵
  PID:12800
- C:\Windows\System\aKOqTzk.exe
  C:\Windows\System\aKOqTzk.exe
  2⤵
  PID:12892
- C:\Windows\System\OXHMakC.exe
  C:\Windows\System\OXHMakC.exe
  2⤵
  PID:14200
- C:\Windows\System\qEMiYrk.exe
  C:\Windows\System\qEMiYrk.exe
  2⤵
  PID:14220
- C:\Windows\System\RElxwfy.exe
  C:\Windows\System\RElxwfy.exe
  2⤵
  PID:15376
- C:\Windows\System\PGnmrbH.exe
  C:\Windows\System\PGnmrbH.exe
  2⤵
  PID:15392
- C:\Windows\System\sXDLDmC.exe
  C:\Windows\System\sXDLDmC.exe
  2⤵
  PID:15424
- C:\Windows\System\ApcYglo.exe
  C:\Windows\System\ApcYglo.exe
  2⤵
  PID:15452
- C:\Windows\System\WmagiKr.exe
  C:\Windows\System\WmagiKr.exe
  2⤵
  PID:15468
- C:\Windows\System\WBZglWH.exe
  C:\Windows\System\WBZglWH.exe
  2⤵
  PID:15484
- C:\Windows\System\iIMOhNU.exe
  C:\Windows\System\iIMOhNU.exe
  2⤵
  PID:15512
- C:\Windows\System\ymENnoF.exe
  C:\Windows\System\ymENnoF.exe
  2⤵
  PID:15536
- C:\Windows\System\gKhzBjY.exe
  C:\Windows\System\gKhzBjY.exe
  2⤵
  PID:15552
- C:\Windows\System\mNHpjDQ.exe
  C:\Windows\System\mNHpjDQ.exe
  2⤵
  PID:15576
- C:\Windows\System\ChqoXwI.exe
  C:\Windows\System\ChqoXwI.exe
  2⤵
  PID:15596
- C:\Windows\System\caBozkC.exe
  C:\Windows\System\caBozkC.exe
  2⤵
  PID:15612
- C:\Windows\System\wNXgiYU.exe
  C:\Windows\System\wNXgiYU.exe
  2⤵
  PID:15640
- C:\Windows\System\lCExJTe.exe
  C:\Windows\System\lCExJTe.exe
  2⤵
  PID:15660
- C:\Windows\System\gyPmPsv.exe
  C:\Windows\System\gyPmPsv.exe
  2⤵
  PID:15692
- C:\Windows\System\iTfrAGu.exe
  C:\Windows\System\iTfrAGu.exe
  2⤵
  PID:15712
- C:\Windows\System\LLkMFvs.exe
  C:\Windows\System\LLkMFvs.exe
  2⤵
  PID:15740
- C:\Windows\System\HUlSewm.exe
  C:\Windows\System\HUlSewm.exe
  2⤵
  PID:15756
- C:\Windows\System\tEzVnNt.exe
  C:\Windows\System\tEzVnNt.exe
  2⤵
  PID:15784
- C:\Windows\System\ePOSOmC.exe
  C:\Windows\System\ePOSOmC.exe
  2⤵
  PID:15800
- C:\Windows\System\kWQiCuq.exe
  C:\Windows\System\kWQiCuq.exe
  2⤵
  PID:15824
- C:\Windows\System\scSXfEM.exe
  C:\Windows\System\scSXfEM.exe
  2⤵
  PID:15844
- C:\Windows\System\hYlgClU.exe
  C:\Windows\System\hYlgClU.exe
  2⤵
  PID:15868
- C:\Windows\System\KehnQzP.exe
  C:\Windows\System\KehnQzP.exe
  2⤵
  PID:15892
- C:\Windows\System\nBPXIBP.exe
  C:\Windows\System\nBPXIBP.exe
  2⤵
  PID:15912
- C:\Windows\System\OZyYvDe.exe
  C:\Windows\System\OZyYvDe.exe
  2⤵
  PID:15936
- C:\Windows\System\kZFmsEE.exe
  C:\Windows\System\kZFmsEE.exe
  2⤵
  PID:15960
- C:\Windows\System\OeJygxY.exe
  C:\Windows\System\OeJygxY.exe
  2⤵
  PID:15988
- C:\Windows\System\mDgAODw.exe
  C:\Windows\System\mDgAODw.exe
  2⤵
  PID:16012
- C:\Windows\System\REIuDXd.exe
  C:\Windows\System\REIuDXd.exe
  2⤵
  PID:16032
- C:\Windows\System\syXldnS.exe
  C:\Windows\System\syXldnS.exe
  2⤵
  PID:16056
- C:\Windows\System\lvneAqA.exe
  C:\Windows\System\lvneAqA.exe
  2⤵
  PID:16072
- C:\Windows\System\bkwhPPL.exe
  C:\Windows\System\bkwhPPL.exe
  2⤵
  PID:16096
- C:\Windows\System\vlHuvVa.exe
  C:\Windows\System\vlHuvVa.exe
  2⤵
  PID:16120
- C:\Windows\System\VIsdIDb.exe
  C:\Windows\System\VIsdIDb.exe
  2⤵
  PID:16136
- C:\Windows\System\AGoBUJe.exe
  C:\Windows\System\AGoBUJe.exe
  2⤵
  PID:16156
- C:\Windows\System\WHkcvVK.exe
  C:\Windows\System\WHkcvVK.exe
  2⤵
  PID:16176
- C:\Windows\System\weLWnqb.exe
  C:\Windows\System\weLWnqb.exe
  2⤵
  PID:16200
- C:\Windows\System\nZxHDYe.exe
  C:\Windows\System\nZxHDYe.exe
  2⤵
  PID:16220
- C:\Windows\System\MCUeYOK.exe
  C:\Windows\System\MCUeYOK.exe
  2⤵
  PID:16244
- C:\Windows\System\QEvbsuL.exe
  C:\Windows\System\QEvbsuL.exe
  2⤵
  PID:16260
- C:\Windows\System\aEwACkz.exe
  C:\Windows\System\aEwACkz.exe
  2⤵
  PID:16276
- C:\Windows\System\GJbdAfT.exe
  C:\Windows\System\GJbdAfT.exe
  2⤵
  PID:16292
- C:\Windows\System\loCYBPe.exe
  C:\Windows\System\loCYBPe.exe
  2⤵
  PID:16316
- C:\Windows\System\uoUrftw.exe
  C:\Windows\System\uoUrftw.exe
  2⤵
  PID:16344
- C:\Windows\System\ALjpIek.exe
  C:\Windows\System\ALjpIek.exe
  2⤵
  PID:16368
- C:\Windows\System\eabthmv.exe
  C:\Windows\System\eabthmv.exe
  2⤵
  PID:13036
- C:\Windows\System\mdFtmwB.exe
  C:\Windows\System\mdFtmwB.exe
  2⤵
  PID:13084
- C:\Windows\System\BXTZmtv.exe
  C:\Windows\System\BXTZmtv.exe
  2⤵
  PID:14324
- C:\Windows\System\qxDAEWC.exe
  C:\Windows\System\qxDAEWC.exe
  2⤵
  PID:11544
- C:\Windows\System\YkiYYaA.exe
  C:\Windows\System\YkiYYaA.exe
  2⤵
  PID:12176
- C:\Windows\System\MoKcSkD.exe
  C:\Windows\System\MoKcSkD.exe
  2⤵
  PID:13264
- C:\Windows\System\BBoNpKB.exe
  C:\Windows\System\BBoNpKB.exe
  2⤵
  PID:11576
- C:\Windows\System\EUfaNDE.exe
  C:\Windows\System\EUfaNDE.exe
  2⤵
  PID:13224
- C:\Windows\System\drVThIY.exe
  C:\Windows\System\drVThIY.exe
  2⤵
  PID:11768
- C:\Windows\System\ycqLRVN.exe
  C:\Windows\System\ycqLRVN.exe
  2⤵
  PID:14392
- C:\Windows\System\RJEVzks.exe
  C:\Windows\System\RJEVzks.exe
  2⤵
  PID:14464
- C:\Windows\System\qINsUGI.exe
  C:\Windows\System\qINsUGI.exe
  2⤵
  PID:10296
- C:\Windows\System\HayGyKC.exe
  C:\Windows\System\HayGyKC.exe
  2⤵
  PID:10248
- C:\Windows\System\lJoJqiE.exe
  C:\Windows\System\lJoJqiE.exe
  2⤵
  PID:14568
- C:\Windows\System\QnzliOX.exe
  C:\Windows\System\QnzliOX.exe
  2⤵
  PID:14632
- C:\Windows\System\iYJXHTy.exe
  C:\Windows\System\iYJXHTy.exe
  2⤵
  PID:14652
- C:\Windows\System\oVTTLAq.exe
  C:\Windows\System\oVTTLAq.exe
  2⤵
  PID:16688
- C:\Windows\System\MqkaTIC.exe
  C:\Windows\System\MqkaTIC.exe
  2⤵
  PID:16708
- C:\Windows\System\YWnbWtS.exe
  C:\Windows\System\YWnbWtS.exe
  2⤵
  PID:16736
- C:\Windows\System\yhQXPrt.exe
  C:\Windows\System\yhQXPrt.exe
  2⤵
  PID:16752
- C:\Windows\System\ytTaOxB.exe
  C:\Windows\System\ytTaOxB.exe
  2⤵
  PID:16768
- C:\Windows\System\QTORIIl.exe
  C:\Windows\System\QTORIIl.exe
  2⤵
  PID:16784
- C:\Windows\System\esCxEpT.exe
  C:\Windows\System\esCxEpT.exe
  2⤵
  PID:16804
- C:\Windows\System\xRuePys.exe
  C:\Windows\System\xRuePys.exe
  2⤵
  PID:16820
- C:\Windows\System\DXoIooY.exe
  C:\Windows\System\DXoIooY.exe
  2⤵
  PID:16836
- C:\Windows\System\smAAPHn.exe
  C:\Windows\System\smAAPHn.exe
  2⤵
  PID:16852
- C:\Windows\System\GDleJkS.exe
  C:\Windows\System\GDleJkS.exe
  2⤵
  PID:16876
- C:\Windows\System\SlOZuWY.exe
  C:\Windows\System\SlOZuWY.exe
  2⤵
  PID:16892
- C:\Windows\System\IFkSYVt.exe
  C:\Windows\System\IFkSYVt.exe
  2⤵
  PID:16908
- C:\Windows\System\ZJcuGKf.exe
  C:\Windows\System\ZJcuGKf.exe
  2⤵
  PID:16924
- C:\Windows\System\jrOjUIo.exe
  C:\Windows\System\jrOjUIo.exe
  2⤵
  PID:16940
- C:\Windows\System\rzfZYsp.exe
  C:\Windows\System\rzfZYsp.exe
  2⤵
  PID:16956
- C:\Windows\System\FYkKtkh.exe
  C:\Windows\System\FYkKtkh.exe
  2⤵
  PID:16972
- C:\Windows\System\HxfvulE.exe
  C:\Windows\System\HxfvulE.exe
  2⤵
  PID:16992
- C:\Windows\System\EXJjFNc.exe
  C:\Windows\System\EXJjFNc.exe
  2⤵
  PID:17020
- C:\Windows\System\KZkVbhm.exe
  C:\Windows\System\KZkVbhm.exe
  2⤵
  PID:17036
- C:\Windows\System\JKtpYjn.exe
  C:\Windows\System\JKtpYjn.exe
  2⤵
  PID:17052
- C:\Windows\System\RGRFuuR.exe
  C:\Windows\System\RGRFuuR.exe
  2⤵
  PID:17068
- C:\Windows\System\XoDsvkP.exe
  C:\Windows\System\XoDsvkP.exe
  2⤵
  PID:17084
- C:\Windows\System\KooaBRL.exe
  C:\Windows\System\KooaBRL.exe
  2⤵
  PID:17100
- C:\Windows\System\rVspWlf.exe
  C:\Windows\System\rVspWlf.exe
  2⤵
  PID:17116
- C:\Windows\System\OokOrbd.exe
  C:\Windows\System\OokOrbd.exe
  2⤵
  PID:17140
- C:\Windows\System\vGCbGdI.exe
  C:\Windows\System\vGCbGdI.exe
  2⤵
  PID:17156
- C:\Windows\System\gDzXEPm.exe
  C:\Windows\System\gDzXEPm.exe
  2⤵
  PID:17172
- C:\Windows\System\IazhvdJ.exe
  C:\Windows\System\IazhvdJ.exe
  2⤵
  PID:17188
- C:\Windows\System\xeiqqSi.exe
  C:\Windows\System\xeiqqSi.exe
  2⤵
  PID:17204
- C:\Windows\System\mpRPfVc.exe
  C:\Windows\System\mpRPfVc.exe
  2⤵
  PID:17220
- C:\Windows\System\paZaVXX.exe
  C:\Windows\System\paZaVXX.exe
  2⤵
  PID:17244
- C:\Windows\System\bUzwEEn.exe
  C:\Windows\System\bUzwEEn.exe
  2⤵
  PID:17264
- C:\Windows\System\XnZgjVF.exe
  C:\Windows\System\XnZgjVF.exe
  2⤵
  PID:17280
- C:\Windows\System\FPjHgzV.exe
  C:\Windows\System\FPjHgzV.exe
  2⤵
  PID:17308
- C:\Windows\System\puSuvUK.exe
  C:\Windows\System\puSuvUK.exe
  2⤵
  PID:17332
- C:\Windows\System\TFDcRNV.exe
  C:\Windows\System\TFDcRNV.exe
  2⤵
  PID:17348
- C:\Windows\System\QHmBlYz.exe
  C:\Windows\System\QHmBlYz.exe
  2⤵
  PID:17372
- C:\Windows\System\OnBsBvm.exe
  C:\Windows\System\OnBsBvm.exe
  2⤵
  PID:17396
- C:\Windows\System\dAdOkfF.exe
  C:\Windows\System\dAdOkfF.exe
  2⤵
  PID:13768
- C:\Windows\System\wGsziaV.exe
  C:\Windows\System\wGsziaV.exe
  2⤵
  PID:13808
- C:\Windows\System\jmoaOGt.exe
  C:\Windows\System\jmoaOGt.exe
  2⤵
  PID:12776
- C:\Windows\System\WrOipbN.exe
  C:\Windows\System\WrOipbN.exe
  2⤵
  PID:14092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AFrhWXr.exe

Filesize
1.2MB

MD5
04ad410f73b48a4dcd0eb9a7df76e395

SHA1
d6607d003318ac105e0ecf958f107872ea29bfcc

SHA256
926c39c7528921b00e1693bb203f89e9983ecb302173f1d3f22eea8302226065

SHA512
f6ef07112dd21fa9ffb5ba25b97aece0f1722fa9643947a27b639b31af930075e36f5cc377e4896abeadf549f7fc704bc4ba47862c347733e3d53fcd7d0f6b1f

Download Submit
C:\Windows\System\CKMpEGq.exe

Filesize
1.2MB

MD5
144aa82ea16fc7483021660797ed9dc8

SHA1
fb6d47e0fdadb754b0245e6476c49337efd20d78

SHA256
1e84476b02df794d5f7ca85d17b9079d5e728c4121df35a274478b85c906961b

SHA512
285fecfe8a72e95b44e985ae6a0b12dcfe26be78614745771b1e8de1c4813cc11a6e2031df58c781b69031bc11ba23536766250bacbdae6e7a4c71148b41add0

Download Submit
C:\Windows\System\FMoQpwa.exe

Filesize
1.2MB

MD5
5124b8d83ddbea8179fc15f034a20837

SHA1
6acd17eff5655fbc0063fb29dd1aa68019eb5a26

SHA256
4e495a1fa5078804d310b6c97ef69966ffefa4999cf2cc5194a48256a46979d9

SHA512
ca81bc6dfabc01e56c19a3efbb889ef6ddd45431558a2fd83acc38e69c92091a2c7cf11754a36652fff50e8e94f2a3d7bf61b13b960865d4a123cf30181bb0cd

Download Submit
C:\Windows\System\GGfQYuz.exe

Filesize
1.2MB

MD5
ae3a16ca2ebd4f21e464633b1a66284a

SHA1
3d813c5a181211b3f9cce38805970739b3ec9d9d

SHA256
6ff4594b567f3d08a757ea1a339e54676454f9e6dac9db9ebf4480f3c1aa196a

SHA512
5c0e7376932493a2d5536c764a6244c2996e7f8acbbad52c8766393c95f1254345e85dbce90cd7ec5acf5ebb833969385ef4a3226923e02ff13112d8d65f70cd

Download Submit
C:\Windows\System\GjyROSy.exe

Filesize
1.2MB

MD5
ea02fdaefdc9621e6b16f5a3bb9e319e

SHA1
84307b159235e2b38abd91ed936300277e19a82b

SHA256
8a0ecb73c34ba2a5e1497988fce6e8a7305f15e6a7a34a519628907c4e50612e

SHA512
84dcfed15448d208febc86b2cb10c95b51e51ad26fab754f4d1573d1f5f44ab7ddafa41ab8037cc81e4940a8521df028256e1ab4267c2731a7e447426ff9805b

Download Submit
C:\Windows\System\HkpqztD.exe

Filesize
1.2MB

MD5
f4faec0446fca8ea40234716a681f918

SHA1
a367ebe45c16563b3415e5440f4195b15e6cafca

SHA256
f20d6004818fa6accf6bebf7cf627254c41172931c8b3dfda66700995da0cc6a

SHA512
e8977d6f93eeeebbd3b926867e6e970bacd54e789a02975a5ab2118c5dd158fab43b972f62760868c1140a5651dcf2b267a7d03e35ec6315663f95dc29bf1a88

Download Submit
C:\Windows\System\Hvzbvil.exe

Filesize
1.2MB

MD5
3ddd9f9513410bcc3da2a8d1e1f659f1

SHA1
656a9d484b27ad18785e8636af5329d8eeaf7a63

SHA256
c47c208e9d3e2cd894b826ba91fd09c871da03e0a8884fed2f046b78ccefa32b

SHA512
19cb4d31fc4db7bafc7eb62ca1869cd4e1d4b21dd4e0648d84f439e6c2cc57a63a4fa74946f7d326a53005d340acdc4f681ea7873d5cc1a7a24de572dc589538

Download Submit
C:\Windows\System\ISDqYVy.exe

Filesize
1.2MB

MD5
a1629c35a87eb19e27f372e8c9c809a2

SHA1
726a1f3902218495563848c5100f700327b6a02d

SHA256
a5341d37374852b97b7c06cc8528c5fd0d15c31ceb4eec658682f0ae44f62161

SHA512
54d251698d53de9e933f5bb46e75df6c0f5f1add1c652a682bdba8bdb34df2cfa6eba91c250a5efb4209eaa8ecef989fd556f407cbe6e5e9d052c32f3764c628

Download Submit
C:\Windows\System\JqVPEKN.exe

Filesize
1.2MB

MD5
8f0143622e87d69bd15134d9e560425c

SHA1
a57e3df9896e5ec0772fe260e4652313f7d1e0ff

SHA256
7b1a7f3c975286b2a78c053171bcd03d2d9626d1bd66278110d4caa7841a4b9e

SHA512
ca11fa68260978fc2f95c46e534b21aa5bcb2fb013a75ea7095ec10b448ccba0c71c64e7c5bd54ed4740aacb306c1b7b990599be48e44194cb40878903a9220f

Download Submit
C:\Windows\System\KbOIuOb.exe

Filesize
1.2MB

MD5
51a477569e810bd7f323939d3d6381bd

SHA1
9736f70ee1851ab7c605c3f69966580ed574243e

SHA256
352302e03e971601fddeef9e478b9cbdd3f1ee0960da67b55cc636bec4b9fd92

SHA512
b2684145f0713a31f6eefd24e4900cb15636eaa6c897695c7ce38cd79ad9d704df6591b11f65902ef3bcf89fbdb0c0992081228c5be2319c4b3534eaff42eee4

Download Submit
C:\Windows\System\KvfRuDm.exe

Filesize
1.2MB

MD5
6b6e5439d4fc22e88ee45b21a5a46c93

SHA1
5ef6e1db8b84c0c43c18192cf20d883277349734

SHA256
f8ea39e3634643abfa247074bac9b627e7ae525d89784729a051051429b3912a

SHA512
cf55cc891d7916ac0ef820d4db913273e03a4067a1b25886591d9897497bf88872a5a32836828f705fa79792c135c366955839a8215140806e02b290875fc288

Download Submit
C:\Windows\System\OBipUmb.exe

Filesize
1.2MB

MD5
51c54a9aecfde9da6f510df0716de0b8

SHA1
dba58a746a4db4ade13cf4ffab0331ad72314c4b

SHA256
d2c6287f1dd03a484e641beb549ae7dc0266d7d2dec644d1ac75112ec5d97567

SHA512
339d37400c1e250f758195d65208c8a6ee48ec0f77d891c9118eaec531875743d7602731aa32376f385f802918734426539a0ddcfc774147b5be19ed551e8c4a

Download Submit
C:\Windows\System\OnWnrGj.exe

Filesize
1.2MB

MD5
28af560349967e52bdc6506759b8bdb0

SHA1
457778eb18967373dad1f08feed9ae1aba7bed22

SHA256
08332a340c645081137f28750e77114c8715518923a3059ea66400d984a3c9d0

SHA512
c0cf319589cf550ced23b4d450fef97077bf76174e325d1bf45c862285a6df665f971844387ca2b3b187fbfbf64c6da2397bd0a3dc66a79acde0930aed7230ea

Download Submit
C:\Windows\System\QHjnGsm.exe

Filesize
1.2MB

MD5
48e5129927af4b0cfc3b4fa802d83cfe

SHA1
78fb2cfc7ab6663ffcfaaed0c9c1e91fd85f64d4

SHA256
77451d1f19e26f6df4b45edd3dbf83060967bedc8504d8c7a6b2a3cc164354eb

SHA512
e496c6d73e5079d81742eca345e02dc1e37a1f78e83b49fdb767b61b1568982fcca6b10493b07f1962a0151debe05138abbf08b61f9c8276768eb2339221c2e0

Download Submit
C:\Windows\System\SMylMTo.exe

Filesize
1.2MB

MD5
be9c3abc12ab1fe321e3d2f3f3d82e21

SHA1
35b3a47b39760f144162ecbbb0377c76b2882fb6

SHA256
3958e2f41f8ae439920e9ebe3cd25fc45ee4e63cefb9e6abd9210d8cac7d4efe

SHA512
e745421d4c876844cd273a72ceea02a7f76abceb5b71befc3a4a45b35690e642132830c913db74ec65b81b9e29d301e5801646c185e66fcdf2ff4120c82dac13

Download Submit
C:\Windows\System\SzgImEG.exe

Filesize
1.2MB

MD5
3b57d115e122324ec1a847a0572d58e3

SHA1
57ce452fe1a72a7e9786b492d5c5c1b6ca6ee2d7

SHA256
4d31d1359bee59cfc6aad150204ecd142fd503cf618488f017d5c4c48cc168b8

SHA512
5bdc18320c6a1131fd19fb66ef4d04060e6cf5dd6229e1bfa510d1390f2a71dfbbd5ea4961c887659faee4d2bc3419a8e53c278b45c97f7a2340149759f856dd

Download Submit
C:\Windows\System\TjFggVJ.exe

Filesize
1.2MB

MD5
6b13c5aac8cb535c09b83060be657b6c

SHA1
03393d71d34d7e67249395cb945836713dd99905

SHA256
1020be782f33bd9374b89a4d98e16450e93a3f1eedf4e5c0992cd5cd19874039

SHA512
2cf8f71afb8cf2761a38ba59f788ccd4692595e3a76a6f310c662be165917f93f531bd265990b9eb57efd502d544d1ac966cd5ef0c5065694c28e3d41899391c

Download Submit
C:\Windows\System\VGAZtrj.exe

Filesize
1.2MB

MD5
a904f67073efa9bb4f601eab71c277c3

SHA1
90527daec2d927ee9b70cbdecc40e51d231a67eb

SHA256
366498e4b8787d2b7bbcdabda9525872b28ea13ab30cf84f3878fbeb13be3898

SHA512
812550b7843df648e94f4e1e4a02e1c4b47a714c63be6e0995b2e968ea9f6e6b29499975a530a2839b6390e3b87ab9f9f609b8d713c38d025fde157608856f5b

Download Submit
C:\Windows\System\WVtOTUG.exe

Filesize
1.2MB

MD5
fac188eb7ab52467212b8637b9c51df5

SHA1
e88f31dd9b2762d8632b643eb233e3fa45c9d662

SHA256
f7ec928ae976094c0de64661f2a209e2ea1269a5d5ee48b59e703157cc846d2a

SHA512
18d12b117ca2881ba75da8b1847b29cc06b84a4f80ae9606fa1200ffd2d93b83a2777f1478064608aae7c880f099eddf5c5b064eb3017732c435a952dbf46923

Download Submit
C:\Windows\System\WdFEHTC.exe

Filesize
1.2MB

MD5
522018b12540183b011b6b6ec1b61745

SHA1
08e40e94ad1c0016a73e3bacacd85499ccb32806

SHA256
4697cf4263adfad217fff2b37a9c8a377b8c5380115dae88447ea4b141612049

SHA512
6638345b78a95f80111e74dab14f3375e561da1aeadc45e92e44e239c564c57daef06c117a9c90e70cf7ce9bf595b3edccd66cf9f9332f189946fd33ee5fea85

Download Submit
C:\Windows\System\YCYQoNt.exe

Filesize
1.2MB

MD5
b86a1067b2e002fc6a2f6ce2124cf6c2

SHA1
ea07f601da20df775d17b0a3abfc3d7ac4dce1fe

SHA256
592a942427e0f3ee6922cf470ba5527204e3a4d15b71ff97ecbc5400db2cf8ae

SHA512
29097be25eb4f725895ad608174d83c1def497fdd50358f5a24da6ff00466182ae7db65e6f336eb848706435cc3d3ad2836105caa563ab5fbe3eac52c864f1a0

Download Submit
C:\Windows\System\aZYtTMm.exe

Filesize
1.2MB

MD5
640b6a7e02321e0ea3a70303191b27b6

SHA1
a694d401a996fe4501d3185dd1e97c26d0cadbef

SHA256
ff111ae687ac095ac2c601fbec6a388f648d27a04be20eab780782d48893f201

SHA512
d870d6f578dc05eca352d2d1c82abada2a21828e8ba903a24af286fc7f3c131486b98046eafca4e4cd02e167fc3d4ac1b4fbf4b913a91f449e0b8f5e5f6d6ca7

Download Submit
C:\Windows\System\beulXbA.exe

Filesize
1.2MB

MD5
568ea76c1f05932a4c3fc821686cd222

SHA1
900a1dbe54b0479c5df5e2be93dfc9e1ec28b1ac

SHA256
2bdf6f207eaf3c789c7466987b6f0ee7f4684ba352eed1baa2e2ddcb2ecc0540

SHA512
4dba275eca9f8baaac462dce74b1efc82707927ca42839c670a58310f335e1b8f5817e6e044aec8c234a1aef7d1e8111160f89fc554520324fb1f3e82d9f2c2c

Download Submit
C:\Windows\System\cTnHJTu.exe

Filesize
1.2MB

MD5
b6fdb21beedcec2d75d68b244b68b665

SHA1
18c5593a199ca4df0bd794112f8047797cc1b82e

SHA256
1f359187eaca654816c1b4ba10ab575c6efc0fa1f7b1b16010a046432946c2dd

SHA512
42fc1fdaf6fd1d79bf75ed7ba4af8ebf375b1d2d9ffbab29061f6a4ed2b54ca5620c331d7c72df9f8c226069726efa1fc11f0a160a757785f17971f8a51c1987

Download Submit
C:\Windows\System\cqXOYXf.exe

Filesize
1.2MB

MD5
062d89a8ebdda15ee742733bf4b4d499

SHA1
471d055bc02288318a4b7d620cebfac6ea66161d

SHA256
378dc23e779031c1058cbbd2d635dd3c41ce6fc17e922cb5cbf21294c2784722

SHA512
0f72a20b7476fee7b22f8dc1581cd1f818f98a1949739aefe0ba9398f43a4a267fe744d3b33355d7d6f1a4183c399b1ed004ee2df5095119605e75f33ac51776

Download Submit
C:\Windows\System\eaKMSGv.exe

Filesize
1.2MB

MD5
47e2dbfe1ffa021c8c57beeee7f708eb

SHA1
2d3d51053f5c9845d0eac35a6525f2de7e93edb3

SHA256
ac0c813bd8348f1e659aae0cd73817ffce1cbc4e1c78ae38487a74d2a4450744

SHA512
50f1b5d67060cd5b9b022ba8030ed3fb16ce06c2ec638a86cda7bcdabc9a23c268203c640b6a9d50e295e2c8e2b2f9d221ea442576e77fed491086c7d4e9b748

Download Submit
C:\Windows\System\kYaOWjm.exe

Filesize
1.2MB

MD5
ed04ffc37e55b15b3b5b6a30ab9e04da

SHA1
1f12fb69e6318ccb1ff8efecb84bd03217653081

SHA256
930d5aba5d18f6bcd46edac6e25922a705fe1863ca815954c1b16b1f3bd4022c

SHA512
50ca86aa09231b1f7db9074ea7bfff64fe7766167d5b76df184442f8a894ea4501240f5ab16802551e25b88bb977ad0645372dee226eabb7aa262c38c9320291

Download Submit
C:\Windows\System\kfqAGgN.exe

Filesize
1.2MB

MD5
fb443be42a7106136dc0d8d5295fc7a6

SHA1
24b4f05492b9cbc3bf9d1eae57dd8c9e74fb36f1

SHA256
b0e1f7d39ebb2e4a546f14e7df89e8d9f50a3847e2f649baab3c9a5a53e7e113

SHA512
ef3bd75246b17fafd440d3c59e932ab2069f0dd86cc23461218d3294c65180b73eae149eda129f3ddb8feb16d267d98ca511c712fc2496ed7ac362a5db41c411

Download Submit
C:\Windows\System\lbCUbtb.exe

Filesize
1.2MB

MD5
d109c47f2411aec20bbabd70884a931b

SHA1
65891527cba3f79f0f471f81e044cc58df3b3a78

SHA256
89f84533ebbdb2f8ea0547c8177a96bb208f5abc1c6f3e9ea2f602a8a69ba4bf

SHA512
43a13b7fbe3bf801f1ca3dc38773a0ffef5de789a2e498b38d0e8599bb6a75cf7cd8e2801776d38e2968db66b49a38843d3e9737f596cb9d1064119cfb16b175

Download Submit
C:\Windows\System\lbQFePc.exe

Filesize
1.2MB

MD5
f3754a7590f6ceb756035ebcca8a949a

SHA1
4fe392870a7c557108159b17e2932a389b6e4d45

SHA256
5cdd043c06cc6a33191814d3ef57b389c787e0658199ae6ddbdd37f14a3328a3

SHA512
a8e412612604782e59e6003042a5dbb4d216e479172ff0e8b033221e73a4262555731691cd1c252de965169963cfc02da31d7897de1cdc77a7452562fa9b976e

Download Submit
C:\Windows\System\lsqpYhZ.exe

Filesize
1.2MB

MD5
513c2a43efd60808fbdb0a35bf675981

SHA1
809d1761c5b69e0dfd51f0954fb9cd7d65c1a9a6

SHA256
d4c8eb4b7cc3edc48e71f5d896e6cf3ecf7576b1997a00b1eb4f155371ccaeeb

SHA512
683225c3f8c9118bb14b9f2d59bc72345819d7ebc17b3e01c56a8bad7ff7324d18e9606d528ac98ab1bcbdb977a3d18d16014460f423f4f0e4772d62cf882f55

Download Submit
C:\Windows\System\oFsGjUZ.exe

Filesize
1.2MB

MD5
363e8fd6c2c1e32f5a23a9c7dd104fb8

SHA1
586d0b59174420b04b78d7e4ad2bb61bfaeb1152

SHA256
dd8902b1ac64c4d871e683541c7ee1e37103472a530046a91a070c16ea91bb25

SHA512
141e849e2a9ae97119eb7949e6758e56e7e4f537bd587b0f909f5a2913603472f1c7d02b7a416158ded51ac0e118ba39e7afa79bf353de69adcf634ea99be725

Download Submit
C:\Windows\System\qaBwmel.exe

Filesize
1.2MB

MD5
cb2a79d913b6094390c50acf31eba0c3

SHA1
2c39627d56f7adf72368e7d8d046311e231392d7

SHA256
5bf98d06f2727732e402a9300bb34473d4a7e1f5512559f707deae80ccc9e83a

SHA512
70197142e442086962871b0751e2711e21c11dd6fd653653f4674b5c158ea753a20c8406ba97a2d33ddc8b75fab6778f79fbad3eed07e6417e1a5aa9419c00eb

Download Submit
C:\Windows\System\sEboWHy.exe

Filesize
1.2MB

MD5
470ef27c86086e91d9cfaecbe3ae4ebb

SHA1
85239ce4451420c95a1bbe2c95aa7df608895e41

SHA256
bde51cdb03803ef9af4d820e47bff5011ef75c54a969ba47460b3330257c1d8d

SHA512
1c3b89cc689cd64714f14ae1435a2cb7c28919c0665219e5cfe22a5c754adba13641dc725194a6925549391f6bd91251004b5fd85a19daa040a37cae6f9085f4

Download Submit
C:\Windows\System\sZhdzsN.exe

Filesize
1.2MB

MD5
d80d0f0a44ab8ba167f633ea083d16fd

SHA1
a5a0eacf3c3ae6fcdd984b7718e7d10a63184b54

SHA256
956d456130ee74baa33d50ab81cefa4e24799a071451652bf0d4e851f5181670

SHA512
fabe52f9e8559237d4982bc975b008ad106eed7911e721e35eafb8e53a39b1de5f994ac2988de33a71c76e214761d9eebbc2e842757a8ea01517bb3703d3399e

Download Submit
C:\Windows\System\vzQIDjF.exe

Filesize
1.2MB

MD5
41c187aeb34890c4a027d70c7237a056

SHA1
4422f2fbd88b96fcad8b98ca53017e197b30e63b

SHA256
ad7c16c6cbec2a17f9d820cddffd8837e1c159e64e592201c3b9b97d105256f7

SHA512
8be058fcea700139301bfca80539afa31ed4e6b947e6abbea83b927c5ec3170472e01db77fce06e28b49461bf9685349c7d4886bc067ef7f2ecc0cf4a6ee7124

Download Submit
memory/2556-0-0x00000200FB930000-0x00000200FB940000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads